In the fall of 2008, a 9-page PDF was published by an anonymous person, with no team or funding, outlining a technology that enabled digital ownership without intermediaries. Twelve years later, after a recent sell-off, Bitcoin has a market value of $850 billion.
While Bitcoin has been useful as a digital store of value, it did not live up to its original promise to “allow online payments” at scale. There are four reasons why Bitcoin does not work well for payments: price volatility, transaction throughput, transaction fees, and privacy.
The price of Bitcoin fluctuates. If I bought Bitcoin at $30k per coin, and pay someone using Bitcoin when the price is $40k per coin, I owe capital gains tax on the transaction. In addition, unless the transaction is instant and the receiver sells immediately, they don’t know the exact value that they’ll receive.
While the Visa payment network can handle 65,000 transactions per second, Bitcoin handles 7. To deal with network congestion, transaction fees (gas) go up. This means if I buy an (analog) espresso for $4, transaction fees could be $20.
And, despite memes of private transactions, all Bitcoin transactions are available on a public ledger for everyone with an internet connection to see. While masked behind a wallet address, it is not difficult to pattern match and identify the sender and receiver. Compliant privacy is an essential feature for payments. Businesses do not want competitors to see payments to their suppliers; traders do not want their trades visible; individuals do not want their net worth leaked; and governments require monitoring and compliance.
If you expand beyond Bitcoin, and look at the current state of Web3, some of these problems have been solved. Stablecoins, with a transaction volume of $500 billion per month, have solved price volatility for payments by pegging the value of a digital currency with an off-chain asset, such as the USD. There are a variety of L1 & L2 scaling solutions that attempt to solve throughput and fees, but the solutions have had to make trade-offs with data availability and centralization. Compliant privacy is mostly unsolved in the industry – solutions are either fully private with no ability for risk monitoring and reporting, or fully public for competitors and bad actors to see.
That’s why I am excited to share our investment in Espresso Systems, which is building the infrastructure to underpin a more scalable and more private future of Web3. I am grateful to co-lead the $30M Series A with our friends at Electric Capital, and I will be joining the board. Co-founders Ben Fisch, Benedikt Bunz, Charles Lu, and Jill Gunter combine some of the world’s leading experts in zero knowledge proofs and cryptography from Dan Boneh’s Applied Cryptography PHD at Stanford, with deep product and go to market expertise.
Zero knowledge proofs are a mathematical technique that enables one to verify that something is true without revealing the underlying data. The classic example is that I can prove that I solved a Sudoku puzzle without revealing any information about the solution. ZK proofs solve two problems for a public blockchain: they enable less data to be recorded on chain, therefore increasing scalability and decreasing transaction costs, and they keep transaction data private. This is an emerging area of research that has not yet reached full commercial adoption, and has yet to be integrated into a layer one consensus protocol.
Espresso is designed to deliver fast, low-fee transactions through an integration of a decentralized proof-of-stake consensus protocol with a zk-rollup mechanism, which uses zero-knowledge proofs to bundle many transactions in a way that reduces the resources needed to process them.
The Espresso team has also released a smart contract application that addresses privacy for Ethereum: Configurable Asset Privacy for Ethereum (CAPE). CAPE enables asset creators to customize who can see what about the ownership and movements of the assets they generate. The protocol also allows asset creators to customize the data privacy of existing assets on Ethereum. As an example, a stablecoin provider can create a version of their stablecoin that enables users to transact privately while allowing the issuer to retain real-time visibility into balances and transactions. This enables the stablecoin provider to balance user demands for enhanced privacy against the provider’s needs regarding risk-management and reporting.
Enabling configurable privacy and decentralized scalability unlocks an entirely new design space for entrepreneurs in Web3. Espresso enables anyone to build private & compliant stablecoins, private and fast DeFi, accessible NFTs and games, and entirely new private applications using ZK proofs.
We – at Greylock – are grateful to be part of the Espresso community and hope you will join us. You can learn more about what is being built at www.espressosys.com. Follow the team on Twitter, LinkedIn, and engage in the conversation on Discord. You can also listen to my conversation with the team on the Greymatter podcast at the link below, or wherever you get your podcasts.
Hi, everyone. Welcome to Greymatter, the podcast from Greylock, where we share stories from company builders and business leaders. I’m Seth Rosenberg, an investor at Greylock.
Our guests today are Charles Lu and Benedikt Bunz, who are part of the founding team of Espresso. Espresso is using zero-knowledge proofs to solve privacy and scalability for WEb3.
The company just came out of stealth yesterday and Greylock is proud to be co-leading Espresso’s $30 million Series A with our friends at Electric Capital.
Charles and Benedikt, congratulations on the launch and thanks so much for joining me on this.
Yeah, it’s great to be on. Thanks for the invite, Seth.
Yeah. Thanks for having us. Really excited about the launch and being on this podcast.
Yeah, this’ll be fun.
So just to kick it off with some background: It’s just been an amazing time over the last several years to be working in Web3 and blockchain, and you guys are both very early to this industry. Even with the “sell off” over the last couple months, there’s still just under $2 trillion of market cap in the industry, and we’ve seen just an explosion of creativity from developers; from payments to gaming, to art and collectibles and DeFi. But it’s obviously still extremely early innings, especially in terms of making crypto more mainstream.
So just to kick it off, maybe if you could just share with the audience what Espresso is doing, and give us an overview of the company.
Yeah, absolutely, Seth. We’ve seen so many use cases for blockchain and Web3 just explode over the last few years. And it’s crazy to think back just even just two or three years and realize that so much of what people are using and building today didn’t even exist back in 2018 or even 2020.
But like you said, it’s still early innings, and with all these new use cases popping up, we’re also seeing a lot of limitations with existing blockchain infrastructure.
So with Espresso, we like to call it a single shot skilling privacy solution. And our goal is to bring low fees and flexible privacy to Web3 applications. Though scalability and privacy seem like orthogonal problems, it actually turns out that the same underlying technology, which you mentioned zero-knowledge proofs, can actually be used to solve both of them.
On the scalability side in particular, we’re developing a high-throughput transaction protocol that integrates rollups, ZK-Rollups, with a decentralized group of say,consensus protocols. And the goal is to be able to scale beyond hundreds of thousands of transactions per second, while still maintaining decentralization, including for the orthogonal problem.
And on the privacy side, our goal is to enable what we call configurable privacy. So not just full transparency like in most blockchain applications today where anyone in the world can see all data associated with an application or full anonymity like in Zcash, but rather enabling a spectrum of possibilities depending on a particular application’s needs.
Yeah, that’s great. Thanks Charles.
So I want to circle back to this term zero-knowledge proofs. So you guys are leading researchers in this field from Stanford. You mentioned that it’s a technique that can be useful for both scalability and privacy. Wondering if you could just spend a few moments just explaining to the audience who are maybe not PhDs in cryptography, what zero-knowledge proofs mean and how they’re deployed within Espresso?
Yeah. So zero-knowledge proofs are this really exciting technology that has actually existed since the late eighties, but it was kind of like an obscure cryptographic tool that we didn’t even know. It was at a level where for a long time, there had been papers about zero-knowledge proofs, but it’s not clear that anybody had ever implemented the zero-knowledge proofs, because we didn’t know how to do that very efficiently.
But what zero-knowledge proofs allow you to do is to show that something is true without revealing why it’s true. So this seems a little bit paradoxical, but I can basically prove to you that, classic examples, I can prove to you that I know the solution to Sudoku without giving you the solution to the Sudoku or any information about the solution.
And why is this important for privacy and blockchains? Well, if I encrypt my transaction, then no one can see or only the sender and receiver can see the details of the transaction. So this gives me great privacy.
But the fundamental issues there is that it’s not clear how people then check that the transaction is valid so that the sender for example had enough money to create the transaction. And for that, you need zero-knowledge proofs, so you can prove that the transaction is valid without revealing why it’s valid. So for example, without revealing the amounts that have been transferred or who the sender and receiver is. And that is the core value proposition of zero-knowledge proofs.
And the amazing thing is that in recent years, these tools have become more and more practical, and now zero-knowledge proofs are being deployed and are being used on blockchains.
But so there’s two properties to zero-knowledge proofs. One is the privacy proof feature. And then the other one is amazingly, these things also have a scalability feature. And sometimes they’re called also SNARKs zero-knowledge proofs. And zk-SNARKs it’s really the two names for kind of the same thing. But these proofs, it turns out that I can create a proof for a large statement. So for example, I want to show to you that all of these transactions, like a million transactions in a block, all of them are valid. Well, it turns out that the size of the proof can be much, much smaller than the size of all of these transactions. So I can create a proof that is less than a kilobyte and everybody can verify these proofs. And also checking that the proof is correct takes milliseconds. And still after checking this proof, you’re convinced that all these transactions are valid.
Interestingly, the same techniques that give us privacy there can also give us scalability. So in the blockchain context, as I said, this can really be used to aggregate a bunch of transactions and then prove that all these transactions are correct using such as zero-knowledge proofs.
And it’s been a super exciting time. It’s a nascent technology, but there’s been so much progress even in the time during my PhD from like something that I don’t think was ever really used to something that is now being deployed on multiple blockchains, is usable, and there’s a lot of research being in this area and a lot of very, very exciting new developments.
And just for the audience, there’s going to be varying levels of familiarity with terms in blockchain, so just a couple terms I’m going to throw out and can you maybe describe how Espresso relates to these?
So there’s layer one, there’s layer two, and there’s EVM compatibility.
So what layer one and layer two mean and these terms, unfortunately in the blockchain space, there’s a lot of terms that have a lot of different meanings and it’s often helpful to step back a little bit. But what layer one and layer two really mean is whether this is an independent blockchain that runs its so-called own consensus protocol. So whether there’s a set of notes there that agree on, say, a set of transactions. So that would be a layer one.
Layer two is usually referred to as an application on top of another layer; one chain. And the most popular layer one blockchain is either a Bitcoin, but Bitcoin just enables simple transfers of value and then comes Ethereum, which enables much more complex smart contracts, which can be helpful for managing interaction between many different parties.
So you can, for example, build a full exchange, like a decentralized exchange on top of Ethereum, and these have been built and these are running, where people can exchange money to each other without having a central party in the middle.
So what Espresso is its own layer one blockchain, it runs its own consensus algorithm. We build a new consensus algorithm based obviously as always there’s a lot of beautiful ideas that have come out of academia in recent years, so we’re trying to incorporate some of the ideas there. But still we want to be part of the Ethereum ecosystem. And there’s really two ways in which we do that.
So first of all, we are building a blockchain that is so-called EVM compatible. That being said, if you write a smart contract for Ethereum and you can also deploy the same smart contract, the same code that you wrote on top of Espresso.
And the second important layer is what is called a bridge. So bridges have become very popular because they enable you to move assets from one blockchain to another blockchain. So you can, for example, create some stable coin, some circle based stable coin is created on Ethereum, and then you can move it over to Espresso transfer there for very low fees and then move it back to Ethereum.
So you can really view, even though Espresso is a layer one solution, it can really be viewed as also a privacy and scalability solution for existing blockchains like Ethereum because these bridges enable the connectivity between these blockchains.
Yeah. That’s super helpful. And I think it’s really exciting for anyone who’s tried to buy NFTs on Ethereum and had to deal with the hundreds of dollars of gas fees and transaction fees. I think the industry is definitely excited and ready for something like Espresso that brings scalability to blockchain. And I think privacy, especially configurable privacy is maybe less talked about today, but I think people are going to realize how important it is going forward.
I want to just double click on privacy for a second. I think kind of casual observers of the space especially early on, there were a lot of memes about Bitcoin being used for illicit transactions, like Bitcoin is a way to buy drugs online. I think in reality as you mentioned, cryptocurrencies as they exist today, every single transaction is available on a public ledger. So in many ways it’s kind of the worst technology that you could use if you’re trying to hide a transaction.
Tell us more about why privacy is important for different use cases and what the current state of privacy is for crypto?
Yeah, there’s this kind of common conception that Bitcoin is very private, but really what it is (the kind of the technical term is called pseudonymous). You can create a public key and that public key maybe doesn’t say your name, it’s just a long string, but it turns out that really gives you the kind of worst trade off in terms of privacy. In that, yes maybe you can if you really try hard, there’s some ways that you can at least temporarily pretend to be private, but if someone then has the tools like say, there’s now companies that build tools that can then explicitly de-anonymize people. And especially if, for example, you use your address twice, then I know who you are. If I ever interact with you, then I know what your address is. And then I can just simply go to the blockchain and see all of the transactions in the past. And I can even see the amounts and exactly infer things from that.
It really seems to be a bad term trade off, in terms of privacy. And there are now blockchains out there that give you kind of full privacy like Monero and Zcash, are famous examples of that. And certainly they have used cases even outside of illicit activities. If there’s oppressive governments, it’s important to have this level of privacy there. But they’re really very limited in their privacy options, they only give you full privacy.
So we really have an option. We have something like Bitcoin and Ethereum, which has no privacy. And we have Monero and Zcash, which has full privacy. But most people don’t really fall into either of these buckets. They want the similar level of privacy, or they want say a similar same level of privacy that you have for your bank transfers, where maybe your bank can see them, but certainly not the general public, not your ex-partner can see all of the transactions and what you’ve been doing. So we really think that there’s a need there for, as Charles was saying, configurable privacy.
For example, you can transfer money, but under certain conditions there’s a view key that someone can use in order to say we have a stable coin, which is a digital version of a dollar, and say the issue of that stable coin under certain conditions can use the view key in order to deanonymize the transaction, if they need to, but it’s always public, but it has always perfect privacy towards the general public.
Yeah. That’s fascinating. Thanks for walking us through that.
So maybe I would love to hear just a little, or maybe tell the audience a little bit more about your backgrounds and then how you also met Ben Fisch and Jill Gunter and how you all decided to work on this specific problem together.
I’m finishing my PhD actually at Stanford University in cryptography. So cryptography is the science of encryption, and is really the underlying technology behind blockchains and cryptocurrencies.
I think I’m one of the first PhD students that really came into cryptography from previously being excited about blockchains. Cryptography is an old science that is being used to secure our internet and our traditional financial transactions every day. And that is where I first met. Ben Fisch, who’s also a PhD student there (we’re both PhD students with Dan Boneh). And we worked on a lot of different cryptography protocols and especially zero-knowledge proofs, and wrote many papers together.
But one of the amazing things is that also these technologies now are going from academia and being deployed into practice. And then also we met Charles there who started his PhD and we decided that kind of the time was right. And then we started Espresso. And then shortly after, we knew Jill from conferences and we were really excited about getting her to join. We really have the same kind of view and the vision where I think all of us, one of the things that unites us outside of the technical knowledge, is that we really want to build something that is useful and that is going to get used and really have a focus there on not just the technology – even though that’s where we maybe come from – but really on trying to build something for important use cases.
Yeah. That’s fascinating. Thanks for walking us through that.
So, Charles, I’m curious. Walk me through kind of the moment you decided to finally pull the trigger and start the company and what you guys have accomplished since then.
That’s a good question, Seth. I was very passionate about blockchains and the technology. I started organizing the student group on campus called the Blockchain Club back when I was an undergrad. And now I believe it’s like one of the most popular organizations at the school. And so therefore we had the chance to invite a lot of projects and founders and investors and people in the ecosystem, and we had the opportunity to see a bunch of the use cases that were being built.
A lot of these use cases were very interesting and we saw the design space of applications grow and grow and grow. But fundamentally we saw a number of limitations, being the limitations that you and Benedikt have mentioned so far, like having this limited scalability and the limited privacy options.
Some applications, like NFTs, we already saw emerging many years ago, but they really only took off last year. And they might not require as high up level of privacy as payments, but there is this huge set of applications that still has not been unlocked yet, a massive design space that still awaits us out there, that can really take advantage of the benefits that blockchains provide such as decentralization, public auditability, censorship resistance. That has not yet been unlocked because of this lack of good scalability and this lack of configurable privacy.
So for instance take DeFi for example, DeFi, we’ve seen a ton of innovations over the last couple years. In fact, back when we were still at Stanford during that first class, I think MakerDAO had just came out. It’s actually my favorite DeFi product. It still remains my favorite DeFi product. And last year, actually two years ago, we saw these new innovations like yield farming come out to kind of bootstrap the initial DeFi network. We saw protocol and liquidity and all these things.
But one common thread is that DeFi applications, generally speaking, all require over-collateralization. So if I’m trying to take a loan out on compound or on MakerDAO, I generally need to lock up more collateral than the value of the loan I take out. So that’s like only having access to a secured credit card, and it’s super limiting. And the reason for that is that there’s no concept of credit, there’s no concept of identity on chain. And it’s really hard to imagine users being willing to put their personal identity information on a chain for the whole world to see, without having some privacy guarantees.
And there’s there’s a lot of applications for which privacy is important like enterprise payments that still aren’t really used on blockchains, but have massive market size. Deal has actually been starting to work on enabling international payroll with cryptocurrency. But in the current state, companies that want to pay their international employees or pay their suppliers only have two choices as Benedikt mentioned. One is to pay their employees or suppliers totally transparently on chain for the whole world to see, for their competitors to see, and the other is to use tools like Zcash or Moreno Cash. And neither of those is really appealing.
So one of the first products we’ve built at Espresso is a product called CAPE, Configurable Asset Privacy for Ethereum. And what we are doing there is actually bringing our technology to the Ethereum ecosystem. And what this allows users to do is to take their Ethereum assets, (assets that are already issued on Ethereum, such as Ethereum itself), either decentralized tokens, like Dai, (the decentralized stable coin from MakerDAO), or even centralized tokens like USDC or USDT, and wrap them into a form that is private, such that transfers are private, they hide the sender and the recipient, and the the asset type and the amount, but still have auditability properties.
So for instance, an asset issuer using CAPE could set it such that they alone or a set of auditors could view transactions or even have other fine grain control over these applications or these assets. So that we’re kind of bringing it from a sort of Venmo, where everyone’s transaction is totally public, to a version where that is more in line with what users would expect such as bank transfers where only a bank has access to your transaction history.
So that is the first we’re releasing on Ethereum. It’s live, the contracts are all open source now, and we’re really excited for the community to take a look. And that is the first step towards the larger vision, which is Espresso, to have our own highly scalable layer one with very configurable privacy.
Yeah. I love that. Thanks Charles. I love the reference to secured credit card. I do find it fascinating, just the amount of activity in DeFi, which just shows the latent demand, which I think has maybe blown past even the most optimistic early people’s expectations in cryptocurrency and blockchain, that this amount of demand and transaction volume exists, even with the problems that you mentioned. So I’m very excited to see what type of creativity that Espresso can unlock.
Yeah. I think one of the things that I find exciting is, you mentioned in the beginning, I think the market cap is in the order of trillions of dollars, and that is very exciting.
But what I think to some degree even more exciting is really, I think as we all mentioned, is that now these use cases are emerging. So even like transfers of stable coins, which are traditional currencies in digital forms on blockchains, I think in 2021, I saw a statistic that they exceeded a trillion dollars. And people are using these. There’s companies now using these for international payroll, and they’re really using blockchain and these tools not just for investment and speculation, but in order to enable better transfers – because anybody who’s tried to wire money internationally knows that is an extreme pain – but still this technology is so nascent and the fees are so high that I think there’s just so much more room to grow there.
Yeah. So Charles and Benedikt, I’m curious, let’s say I’m either a current computer science student, or I’m an engineering manager at Stripe, and I’m curious about Web3 and I want to start a company in Web3. Now I’m hearing that Espresso is launching a private and scalable layer that’s backed by Greylock, Electric, Sequoia and many others. And I’m curious, maybe I want to build on top of Espresso. First of all, why would I do that? And then if I decide to build on top of Espresso, what are some of the most interesting applications I should think about?
Yeah, that’s a great question. First of all, I think this is the case for many people right now. I think the cryptocurrency class at Stanford, the blockchain class at Stanford has fluctuated in terms of enrollment, but it’s consistently one of the biggest classes in the computer science department based on enrollment numbers. And it also fluctuates depending on the price of Bitcoin (I think that’s the joke).
There are a lot of people in the industry, we’re hiring a lot of people who come from “web 2.0” backgrounds that want to go into Web3. And I think one of the biggest skills is to learn Solidity. A lot of chains starting with Ethereum are now Solidity compatible. There’s a big developer ecosystem, there’s a lot of developer tools around the Ethereum ecosystem. And that is probably one of the fastest and most effective skills to learn, to get into the Web3 space.
In terms of the applications that we aim to support with Espresso and the most exciting types of applications… And by the way, we are also aiming to be Solidity compatible, EVM compatible, so that applications built on it, and those that are using the EVM can also be deployed on Espresso with lower fees and with additional configurable privacy.
I think we can divide types of applications into a few categories, the first being infrastructure surrounding this new ecosystem that is being built. For instance, on-ramps to convert fiat into blockchain assets – taking real world assets and turning them into digital representations. Wallets for users to interact with blockchains and to explore the blockchain, understand what transactions are doing. All these things at the periphery that are really allowing people to onboard users.
I think the second use case is to help applications bring additional privacy to DeFi products that already exist on blockchains. So for instance, having a decentralized exchange that exists on the blockchain, but with additional privacies. For instance, protecting the identities of the people trading, but still complying with any compliance requirements that would require a certain party such as a stable coin issuer to know who is transacting in that asset. These are all things that will be enabled by Espresso.
And then finally, I think there’s a big class of applications that have not even been thought of yet. We’re seeing a lot of new exciting games that take advantage of zero-knowledge. Poker was a big thing. In the last four or five years, there have been a lot of efforts to try to build poker onto blockchains. But poker is kind of a game with incomplete information. You don’t want people to see your cards, obviously, it’s not like chess where everyone can see everything. And that is a big challenge to build on something like Ethereum that is completely transparent, but it’s definitely going to be representative of the type of applications that can build on Espresso.
So there’s going to be a big design space of applications that is unlocked by Espresso. And we’re excited to see what people build.
I love that. We should host a world series of poker on Espresso and serve everyone coffee.
So Charles, I’m curious if you could just recap what you guys announced yesterday and what you have planned for the next six to 12 months?
Yeah, absolutely. We’re super excited to launch. We’re not just announcing the company, but also releasing a lot of the code bases and the products we’ve been building recently. I mentioned configurable asset privacy for Ethereum CAPE, which is an application that is going to allow people to bring configurable asset privacy to existing assets on Ethereum. So imagine the first stable coin where transactions are completely private, but where assets still allow issuers to maintain the compliance and auditability requirements that they demand.
So we have released those contracts, open source on GitHub. We’re really excited for the community to take a look. And we’re also going to be deploying those contracts onto Ethereum testnet, and also releasing a GUI for users to interact with this application and start testing it up later this month.
Concurrently with the release of CAPE, we’re also really excited to release a library called Jellyfish, which is a little lower in the stack. Jellyfish is a cryptographic library that we’re releasing under the MIT license. So it’s a very free license that is going to allow anyone to do really whatever they want with it. And we’re really excited for these implementations of cryptographic primitives that we’ve done to be used throughout the ecosystem.
Perhaps most exciting in the jellyfish library that we’ve implemented is an implementation of PLONK, which is a popular zero-knowledge proofs system that people have been using recently. And we believe we have the most feature-complete and efficient version of PLONK. So really excited for developers to start building new and exciting applications with that.
As for a roadmap for the next half-year or to a year, we’re looking forward to releasing our Espresso layer one testnet later this year, that is going to contain many of the features of CAPE, which is going to allow for configurable private asset transfers, but even more in terms of more flexible privacy for existing applications. That is of course going to also come with our highly scalable consensus, integrating rollups and our proof of state consensus protocol. And we’re really excited for developers and users to try that.
Well, it’s been so much fun having the opportunity to work with you guys for the last probably seven or eight months since we made the investment. And I’m excited to finally have Espresso out on the wild and get feedback from developers.
Yeah. At the same time, it’s been amazing to have a team like Greylock behind us and supporting us, and obviously you in particular, Seth. But we’re really happy about our leads, Greylock and Electric.
There’s probably a lot of entrepreneurs listening to this and we specifically decided to go with kind of the mainstream, one of the biggest and best mainstream VCs like Greylock and then also a blockchain VC, it’s Electric. And I think this combination is just such an amazing one -two punch of all the connections and the expertise that is there, and it’s been a joy working with you.
Yeah. I definitely want to echo that. Greylock has been incredible in terms of the support that it’s provided in terms of recruiting having just everything handled, like recruiting, best practices, press, et cetera, has been super helpful. And on the other hand, Electric, a very crypto-native fund, very in tune with the developers, they actually release an annual developer report. So just the combination of the two firms has been super helpful in helping us get Espresso to market.
Yeah. Well, definitely the pleasure is ours in terms of being able to work with you guys, and we’re very excited for this next phase of Espresso. So thanks for joining and congrats again on the launch.