这篇文章从技术上介绍了我们新的应用程序，即一种订单簿代币兑换平台。其采用名为 InvisibL3 的专门为应用定制的ZK Rollup，在保留快速交易的同时结合隐私保护，允许用户在利用 ZK Rollups 的完全可扩展性的同时保持链上匿名性。

隐私的重要性

尽管区块链上的地址对不熟悉的用户来说似乎是匿名的，但它们允许任何人查看您的所有交易。一旦地址的假名与个人联系在一起，基本上就无处可藏了。虽然现有的解决方案，比如 Tornado Cash，是很好的选择，但它们缺乏很多实用性。

InvisibL3 将提供一些完全独特的功能。我们的交易所将允许用户匿名交易资产，同时以保密方式隐藏他们交易的金额。我们的观点是，隐私不应该只是一种选择，而应该是一种业界标准。任何人都可以匿名浏览银行对账单的世界并不是加密货币发展的实际愿景。我们的交易所不仅旨在与现有的隐私解决方案（例如 Aztec Protocol 或 Tornado Cash）竞争，而且还与传统的中心化和去中心化交易所扳手腕。隐私匿名交易所的一些好处是：

• 允许机构交易者入场 DeFi，因为隐私是他们的主要关注点之一（法律或其他方面）
• 帮助减少我们在 AMM 模式下司空见惯的“恶性” MEV，例如三明治攻击
• 允许专业交易者将其策略保密

不影响安全性或可扩展性的隐私 DEX

问题是如何在无需许可的交易中实现隐私，同时保持安全性和可扩展性。我们想到的最简单的答案可能是利用 ZK 证明的力量来证明状态转换已正确执行，而无需透露任何输入（金额或地址）。归根结底，这与传统中心化交易所来说并不是一个很大的改进。不仅把资金交给中心化交易所，你还要信任另一个中心化机构来保障你数据可用和私密。

第二种选择是设计一个系统，使所有隐藏的交易都是公开的：除非提供正确的私钥，否则无法看到金额或发送者。这允许任何人重建状态并使用他们的私钥创建他们确实拥有他们的资金的证据。

资金是如何隐藏的？

隐藏您的资金需要您对所交易的金额做出承诺，并且与所有其他承诺方案一样，这需要具有约束力（以后不能显示为不同的值）和隐匿性（不透露任何有关隐藏数据的信息） .

一个常见的选择可能是散列函数，但 InvisibL3 将使用称为Pedersen 承诺的东西，它具有附加同态的附加属性：

C(a + b) = C(a) + C(b)

我们稍后会讲解为什么这很重要。

为了构建这些承诺，我们将一个椭圆曲线点乘以我们想要隐藏的数量。别担心，如果您不熟悉椭圆曲线，您只需要知道从x*G很难推导出x，其中G是已知的生成点。

但是，由于金额 a 始终在给定范围内，我们需要按如下方式构建承诺：

C(a) = xG + aH

其中x是只有所有者才知道的随机致盲因子，以防止有人暴力破解所有常见金额值并找到您发送的值。

你的身份是如何隐藏的？

为了隐藏您的身份，将构建一个称为子地址的功能（由 Monero 推广）。每个用户从一组两个私钥开始 — — 一个私人视图和一个支出密钥 — — 正如名字所暗示的那样，一个将用于查找或披露用户拥有的票据，另一个用于花费它们。用户可以从私钥任意生成许多无法链接回原始地址的子地址，并使用这些子地址与做市商或其他用户进行交互。

不过，为了防止多张纸币被发送到同一个地址或每次兑换都必须生成一个新地址（这可能会揭示该地址进行了多少次交换，并可用于识别较大的做市商或机构交易者），我们还添加了一次性地址功能。

打款方没有向实际地址发送一串信息，而是生成一个带有秘密随机种子的随机一次性地址，在用户和做市商之间私下共享。然后，用户可以用他们的私钥证明他们在一次性地址拥有这串信息，而无需透露他们的地址甚至他们的子地址。

关于我们将如何使用子地址和一次性地址的更多技术细节可以在附录 A中找到。

如果我丢失了我的私钥怎么办？

为每次兑换生成具有新地址的新信息是不必要的麻烦，因此实际上钱包提供商和交易所（我们）将以加密格式存储您的数据，以便您可以使用您的私钥轻松检索您的信息。

但是，这并不意味着您依赖第三方来提供该数据。重新创建状态和查找发给您的信息所需的所有交易和相应信息都作为调用数据（calldata）存储在链上，并且可以使用您的私钥进行检索。

有关重构承诺的详细信息，请参见附录 B。

兑换是如何发生的？

现在最重要的部分是兑换以做市商和用户都认可的方式进行。让我们看一个代币兑换例子。假设用户 A 想要将 X 数量的 ETH 换成 USDC。用户必须首先证明他们拥有足以进行该交换的数量的信息。这就是 Pedersen 承诺的用武之地。

假设 C1, …, Cn 是用户想要花费的输入信息，而 Co1, …, Com 是用户正在生成的输出信息。由于这些承诺的同态性，我们可以很容易地检查输入信息的总和是否等于输出信息的总和，而无需透露数量。在实践中，有一个额外的步骤是产生中间承诺以使总和为零，但这不是理解一般架构所必需的。有关验证承诺金额的详细信息，请参见附录 C。

在进行交换时，您提供输入的哈希值：您想要交易的金额、输入和输出资产类型和资产价格，以及称为返回地址签名的东西。返回地址签名是将制造商和接受者交易联系在一起的东西。这使您可以证明您知道交易私钥（您和做市商共享的随机种子）生成的一次性地址的私钥，并防止做市商将您的资金发送到他们的任意地址控制或您意外提供错误的地址（如果您输入了正确的 64 个字符的十六进制字符串，则无需进行四次检查）。

总结与结论

总而言之，每次兑换包含两个交易（做市商和交易方），其中兑换仅在以下情况下被视为有效：

1. 输入的信息存在于状态中；
2. 两次交易的输入和输出信息总和为零；
3. 双方使用与所花费信息对应的私钥签署了预期的交易哈希；
4. 被交换的代币和金额与交易对手签名匹配；
5. 目标地址与返回地址签名匹配。

前一到三个输出信息通常会发送给承兑您订单的做市商，另一个信息将作为费用发送给交易所，剩下将作为退款退回给您。

如果您对推动我们研究和这篇博文的现有技术感到好奇，我们建议您查看原始的门罗币白皮书和原始的ZCash 白皮书。

请务必在 Twitter（ZigZagExchange和ZigZagLabs）上关注我们，以获取有关我们开发的更多更新。还可以加入我们的Discord与团队交谈，并提出您心中的任何问题。

附录 A) 子地址和一次性地址

每个用户从一组两个私钥开始：一个私有视图密钥 (kv) 和一个私有支出密钥 (ks)，从中生成主公钥：

Kv = kv*G 和 Ks = ks*G

然后用户生成他的子地址私钥，如下所示：

ksi = ks + H(kv, i) ; kvi = kv*(ks + H(kv, i))

以及对应的公钥Ksi和Kvi如上。

对于一次性地址的计算，发送方和接收方共享一个私有交易密钥r（使用私有输入上的 FSH 计算的随机种子）。

发送者知道接收者的地址之一（（Ksi，Kvi）对），并且可以计算一次性地址：

Ko = H(r*Kv)G + Ksi

然后，用户可以计算该地址的私钥：

ko = H(r*Kv) + ksi

并使用所述私钥证明他们确实拥有该信息

附录 B) 重建承诺

除了您的私钥之外，当花费一张便笺时，您还需要知道能够重建该便笺的承诺数量和致盲因素。以下是描述如何计算这些的方案，因此您可以随时检索发给您的笔记。

发送方使用交易私钥r和发送方Kv构造：

• 致盲因子；

x = H(“commitment_mask”, H(rKv))

• 隐藏金额；

Ah = a XOR8 H(“amount_mask”, H(rKv))

• rG，rKv，

与链rG 上的每笔交易一起，为接收方提供了 rKv和Ah，以便能够重新创建承诺。

接收方接收rG、rKv和Ah：

• 用户首先使用私有视图密钥检查rG * kv == rKv；如果是这样，则该注释是发给用户的；
• 然后用户可以计算致盲因子；

x = H(“commitment_mask”, H(rKv))

• 和金额。

a = Ah XOR8 H(“amount_mask”, H(rKv))

因此，请注意：

C(a) = xG + aH

附录 C) 验证承诺金额

投入承诺的总和为：

C1 + … + Cn = x1G + a1H + … xnG + anH = (x1+…+xn)*G + (a1+…+an)*H

和输出的总和：

Co1 + … + Con = y1G + b1H + … ymG + bmH = (y1+…+ym)*G + (a1+…+bm)*H

在哪里

(a1+…+an) == (b1+…bm)

但

(x1+…+xn) /= (y1+…+ym)

所以

(C1 + … + Cn) /= (Co1 + … + Com)

为了使总和相等，我们需要为每个输入音符产生中间承诺，以便新的盲法总和与输出盲法相匹配：

C’i = x’i*G + a*H 和 (x’1+…x’n) == (y1+…+ym)

和

(C’1 + … + C’n) == (Co1 + … + Com)

差异zi = (xi — x’i)称为中间承诺私钥，然后包含在签名中以证明Ci和C’i中的金额相同。

This post is a technical introduction to the design of our new app-specific ZK Rollup called InvisibL3: an order book exchange that natively incorporates privacy while preserving atomic swaps, allowing users to maintain anonymity on-chain while leveraging the full scalability of ZK Rollups.

The importance of privacy

Even though addresses on the blockchain appear anonymous to unfamiliar users, they allow anyone to see all your transactions. Once the pseudonymity of an address is tied to an individual, there is essentially nowhere to hide. While existing solutions, primarily Tornado Cash, are great options, they lack a lot of utility.

InvisibL3 will provide something completely unique. Our exchange will allow users to anonymously trade assets, while simultaneously concealing the amounts they are trading in a confidential manner. Our notion is that privacy should not just be an option, but a standard when it is concerning transactions. A world in which pseudonymous bank statements are publicly visible for anyone to browse through is not a practical vision for the evolution of cryptocurrencies. Our exchange is not only meant to rival the existing privacy solutions, such as Aztec Protocol or Tornado Cash, but also the traditional centralised and decentralised exchanges. Some of the benefits of a private exchange are:

• Allowing institutional traders to enter DeFi, as privacy is one of their main concerns (legally or otherwise)
• Helps mitigate the “bad” MEV we are used to in the AMM mode, such as sandwich attacks
• Allowing professional traders to keep their strategies private

A privacy DEX without compromising on security or scalability

The question is how to achieve privacy on a permissionless exchange while preserving security and scalability. Probably the simplest answer that comes to mind is leveraging the power of ZK proofs to prove that a state transition was executed correctly without revealing any of the inputs (amounts or addresses). Ultimately, that is not a big improvement over centralised exchanges. Instead of trusting them with your funds, you would be trusting another centralised party to keep your data available and private.

The second option is to design a system in such a way that all the hidden transactions are public: amounts or senders can’t be seen, unless the correct private keys are provided. This allows anyone to reconstruct the state and with their private keys create proof that they indeed own their funds.

How are funds hidden?

Hiding your funds requires you to make a commitment to the amount you are trading and like all other commitment schemes this needs to be both binding (cannot be revealed to a different value later) and hiding (does not reveal anything about the data being hidden).

A common choice for this could be a hash function, but InvisibL3 will use something called Pedersen commitments instead, which have the additional property of being additively homomorphic:

C(a + b) = C(a) + C(b)

We will see why this is important later.

To construct these commitments, we multiply an elliptic curve point by the amount we want to hide. Don’t worry, if you’re not familiar with elliptic curves, all you need to know is that from x*G it’s very hard to find x, where G is a known generator point.

However, because the amount a is always in a given range, we need to construct the commitments as follows:

C(a) = xG + aH

where x is a random blinding factor known only by the owner to prevent someone from brute forcing all the common amount values and finding the one you sent.

How is your identity hidden?

To hide your identity, a feature called subaddresses (popularised by Monero) will be constructed. Each user starts with a set of two private keys — a private view and spend key — and as the names suggest one will be used to find or disclose the notes owned by the user and the other to spend them. From the private keys a user can arbitrarily generate many subaddresses that cannot be linked back to the original address and use those subaddresses to interact with a market maker or another user.

Though, to prevent multiple notes being sent to the same address or having to generate a new address every swap (which might reveal how many swaps the address is making and could be used to identify larger market makers or institutional traders), we also add so-called one-time addresses.

Instead of sending a note to the actual address, the sender generates a random one-time address with a secret random seed, shared privately between the user and the market maker. The user can then prove they own the note at the one-time address with their private keys without disclosing their address or even their subaddress.

More technical details on how we will work with subaddresses and one-time addresses can be found in appendix A.

What if I lose my private keys?

Generating new notes with new addresses for every swap is unnecessarily troublesome, so in practice the wallet provider and the private exchange (us) will store your data in encrypted format so that you can easily retrieve your notes using your private keys.

However, this does not mean you are relying on a third party to make that data available. All the transactions and corresponding information needed to recreate the state and find notes addressed to you are stored on chain as calldata and can be retrieved using your private keys.

See appendix B for details on reconstructing commitments.

How does the swap happen?

The most important part now is that the swap happens in a way agreed upon by both the market maker and the user. Let’s look at an example swap. Say user A wants to swap X amount of ETH for USDC. The user must first prove that they own notes with amounts sufficient to make that swap. This is where Pedersen commitments become useful.

Let’s say C1, …, Cn are the input notes user wants to spend and Co1, …, Com are the output notes user is producing. Because of the homomorphic nature of these commitments, we can easily check that the sum of input notes is equal to the sum of output notes without revealing the amounts. In practice there is an extra step of producing intermediary commitments to make the sum equal zero, but this is not needed to understand the general architecture. See appendix C for details on verifying commitment sums.

When making a swap you provide the hash of the inputs: the amount you want to trade, the input and output asset type and asset price, as well as something called a return address signature. The return address signature is what links the maker and taker transactions together. This allows you to prove that you know the private key of the one-time address generated by the transaction private key (a random seed shared by you and the market maker) and prevents either the market maker from sending your funds to some arbitrary address they control or you from providing the wrong address by accident (removing the need to quadruple check if you typed in the right 64-character hex string). The transaction hash is then signed with the private keys of the input notes being spent (and the intermediate commitment private key from appendix B) to prove everything is in order.

Summary and conclusion

To sum up, each swap consists of two transactions (maker and taker), where the swap will only pass as valid if:

1. the input notes exist in the state;
2. the input and output notes sum to zero for both transactions;
3. both parties signed the expected transaction hash with private keys corresponding to the notes being spent;
4. the tokens and amounts being swapped match the counterparty signature;
5. the destination address matches the return address signature.

The first one to three output notes will usually be sent to the market makers filling your order, one note will be sent to the exchange as a fee and one will be the refund sent back to you.

If you’re curious about existing technologies that have fuelled our research and this blogpost, we suggest taking a look at the original Monero whitepaper and the original ZCash whitepaper.

Be sure to follow us on Twitter (ZigZagExchange and ZigZagLabs) for more updates on our development. Also join our Discord to talk to the team and ask any questions that are on your mind.

Appendix A) Subaddresses and one-time addresses

Each user starts off with a set of two private keys: a private view key (kv) and private spend key (ks) from which main public keys are generated:

Kv = kv*G and Ks = ks*G

User then generates his subaddress private keys like so:

ksi = ks + H(kv, i) ; kvi = kv*(ks + H(kv, i))

and the corresponding public keys Ksi and Kvi as above.

For the calculation of the one-time address the sender and receiver share a private transaction key r (a random seed calculated using the FSH on the private inputs).

The sender knows one of the receivers’ addresses ((Ksi, Kvi) pair) and can calculate the one-time address as:

Ko = H(r*Kv)G + Ksi

The user can then calculate the private key for that address as:

ko = H(r*Kv) + ksi

And use said private key to prove that they indeed own that note

Appendix B) Reconstructing commitments

When spending a note besides your private keys you also need to know the amount and blinding factor of the commitment to be able to reconstruct that note. Below is a scheme describing how these are calculated, so you can always retrieve the notes addressed to you.

Sender uses the transaction private key r and senders Kv to construct:

• blinding factor;

x = H(“commitment_mask”, H(rKv))

• hidden amount;

Ah = a XOR8 H(“amount_mask”, H(rKv))

• rG, rKv, Ah.

Along with every transaction on chain rG, rKv and Ah are provided for the receiver to be able to recreate the commitments.

Receiver receives rG, rKv and Ah:

• user first uses the private view key to check if rG * kv == rKv; if so, the note is addressed to user;
• user can then calculate the blinding factor;

x = H(“commitment_mask”, H(rKv))

• and amount.

a = Ah XOR8 H(“amount_mask”, H(rKv))

Therefore, the note:

C(a) = xG + aH

Appendix C) Verifying commitment sums

The sum of input commitments is:

C1 + … + Cn = x1G + a1H + … xnG + anH = (x1+…+xn)*G + (a1+…+an)*H

And the sum of outputs:

Co1 + … + Con = y1G + b1H + … ymG + bmH = (y1+…+ym)*G + (a1+…+bm)*H

Where

(a1+…+an) == (b1+…bm)

But

(x1+…+xn) /= (y1+…+ym)

So

(C1 + … + Cn) /= (Co1 + … + Com)

To make the sums equal we need to produce intermediate commitments for every input note, such that the new sum of blindings matches the output blindings:

C’i = x’i*G + a*H and (x’1+…x’n) == (y1+…+ym)

and

(C’1 + … + C’n) == (Co1 + … + Com)

The differences zi = (xi — x’i), referred to as the intermediate commitment private keys are than included in the signature to prove that the amounts in Ci and C’i are the same.

ZigZag (ZZ) 是 ZigZag Exchange 多链生态系统的 ERC-20 治理代币。代币持有者将通过社区主导的决策过程以及在我们新成立的金库中管理资金来塑造 ZigZag 交易所的未来。

我们的使命仍然是通过革命性的零知识证明创建具有用户体验的去中心化交易所，与现有的中心化交易所没有区别。由于 ZigZag 交易所的做市商提供从中心化交易所提取的报价，交易者可以在保持链上的同时获得最公平的市值价格。

在我们推出代币之前，我们的并未收取任何手续费。 zkSync 的网络所用gas，每次交换约 0.10 美元是交易者唯一需要支付的费用。 在近一年的运营中，我们没有产生任何收入，因此没有资金。

在过去的几个月里，我们一直在努力将 ZigZag 交易所从 zkSync 扩展到另一个链。

在此次扩展启动时，我们将能够以订单模式推出永续期货以及我们目前的现货交易。 我们的打算是在这个时候开始收费； 收入会进入国库。

发行仅具有治理投票功能的代币从来都不是我们的目标； 现在已经有太多的代币存在，它既不是长久之计，也不是成功的秘诀。

代币持有者可以提出一些方法，这些收入将如何回馈给他们，并最终投票决定最重要的程序。权益池中的红利可能是一个建议，回购和烧毁是另一个提议。

我们的目标是让代币持有者最终成为社区驱动的去中心化交易所的平等所有者，任何代币资产类别的上市许可都会减少，一切都在链上广播。

代币经济学

57% 财务部（包括为进一步的公开销售回合供应）。

1% 战略伙伴

30% 创始团队（从2022年11月开始解锁）

• 24个月内每月线性解锁

10% 保险基金

2% IDO (公开销售第一轮)

ZigZag的保险基金

5月，UST脱勾了其1美元的支持。私人基金用ETH和WBTC以及USDC进行LP。

我们的大型做市商 与UST一起，损失了2000万美元。整体市场的低迷增加了这些损失，特别是altcoin的持有量。为了补偿他们的损失，我们在一个保险基金中保留了10%的代币。

我们想强调的是，这个IDO的收益不会用于偿还这些资金，相反，收益将以透明的方式进入我们的国库，用于ZigZag Exchange的一般维护，如支付我们的开发人员和扩大我们的团队。10%的专用代币将被保留作为私人LP的保险。

专门用于该基金的最大10%的供应量可以在2年内进入流通。很可能不需要全部供应；在这种情况下，剩余的代币将返回国库。

社区LPs和Atlendis贷款人没有受到影响；我们的内部做市商有足够的资金来偿还他们。

IDO 详细信息（第一轮公开发售）.

• 2百万的最大供应量。
• 代币将以3美元的价格开始分批出售，每批10万。

IDO将于世界标准时间6月24日星期五下午3点(北京时间6月24日晚上11点)开始。

我们正计划推出更多的公开销售回合，每季度供应2%的代币，为的是获得比以前更高的估值。这些供应将从国库中进入流通，因为ZigZag国库代币会被替换成USDC。

我们鼓励DAO成员通过有意义的措施将国库代币逐步引入流通，前提是代币稀释对 ZigZag 交易所平台以及代币持有者都是积极的。

要参加IDO，你必须有一个激活的zkSync账户，并持有USDC资金。

通过我们的跨链桥将您的L1资金转移到
zkSync：https://trade.zigzag.exchange/bridge

bridge: https://docs.zigzag.exchange/zksync/bridge-guide

对于我们的DEX和zkSync的新用户，这里有一个关于如何使用跨链桥的简化说明：https://docs.zigzag.exchange/zksync/bridge-guide

代币合同：https://etherscan.io/token/0xc91a71a1ffa3d8b22ba615ba1b9c01b2bbbf55ad

在此讨论：https://discord.com/invite/zigzag

ZigZag (ZZ) is an ERC-20 governance token for ZigZag Exchange’s multi-chain ecosystem. Token holders will shape the future of ZigZag Exchange with a community-led decision making process, as well as managing the funds within our newly formed treasury.

Our mission remains to create a decentralised exchange with user experience that feels indistinguishable from existing centralised exchanges through revolutionary Zero-Knowledge Proofs. As market makers on ZigZag Exchange offer price quotes that are extracted from centralised exchanges, traders can access the most fair market-value prices while still remaining on-chain.

Prior to our token launch, our protocol has not been charging any fees. zkSync’s network were the only fees traders would pay, around $0.10 per swap. For nearly a year of operating, we have not been generating any revenue and therefore had no treasury.

Over the past few months, we have been working diligently on expanding ZigZag Exchange beyond zkSync to another chain.

At the launch of this expansion, we will have the ability to launch perpetual futures in an order book model as well as our current spot trading. Our intent is to start charging fees at this point; with the revenue going to the treasury.

Releasing a token with solely governance voting functionality has never been our objective; there are already too many existent and it is neither a recipe for longevity nor success.

Token holders may propose a number of ways how this revenue will circle back to them and eventually vote on the most requested procedures. Dividends for staking in a pool could be one proposal for this, buyback-and-burn another.

Our aim is for token holders to ultimately become equitable owners of a community-driven decentralised exchange, with permissionless listing for any tokenised asset class and everything being broadcasted on-chain.

Tokenomics

57% Treasury (including supply for further public sale rounds)

1% Strategic partners

30% Founding team (unlocks starting in November 2022)

• Linear monthly vesting for 24 months

10% Insurance fund

2% IDO (Public sale round 1)

ZigZag’s Insurance Fund

In May, UST depegged from its $1 backing. Private funds LPed with ETH and WBTC as well as USDC alongside UST pairs, resulting in a loss for our market makers of $20m. The overall market downturn added onto these losses, especially with altcoin holdings. To compensate for their loss, we are reserving 10% of our tokens in an insurance fund.

We would like to emphasise that the proceeds of this IDO will NOT go towards reimbursing these funds, instead, the proceeds will enter our treasury in a transparent manner, where it will be used for the general upkeep of ZigZag Exchange such as paying our developers and expanding our team. The dedicated 10% of tokens will be reserved as insurance for the private LPs.

The maximum 10% supply dedicated for this fund may enter circulation over a span of 2 years. It is likely that not the full supply will be required; in which case the remainder of the tokens will return to the treasury.

Community LPs and Atlendis lenders were NOT affected by this; our internal market makers have sufficient funds to repay them all.

IDO details (Round 1 public sale)

• 2M maximum supply.
• Tokens will be sold in batches of 100k starting at a price of $3.

The IDO will start at 3PM UTC Friday, 24th June on https://trade.zigzag.exchange/

We are planning on launching further public sale rounds with a supply of 2% tokens every quarter, with the intention of a higher valuation than the previous one. This supply will enter circulation from the treasury, as ZigZag treasury tokens get replaced with USDC.

We encourage DAO members to bring treasury tokens into circulation gradually through purposeful measures, only if the token dilution is a net positive for both ZigZag Exchange as a platform, and a positive for token holders.

To participate in the IDO, you must have an activated zkSync account with USDC funds.

Transfer your L1 funds to zkSync via our bridge. https://trade.zigzag.exchange/bridge

For new users to our DEX and zkSync here is a simplified explanation on how to use the bridge: https://docs.zigzag.exchange/zksync/bridge-guide

Token contract: https://etherscan.io/token/0xc91a71a1ffa3d8b22ba615ba1b9c01b2bbbf55ad

Discuss at: https://discord.com/invite/zigzag

These seven coins helped leading exchanges bootstrap trading volumes, enriching holders, operators and investors. Here’s a comparison of how they work.

When the narrative of the “utility token” caught fire in 2016, lots of ICO tokens followed with little utility. Today, the category is very real, and it’s dominated by exchange coins — complex instruments that vary wildly in design and function.

The success of these coins is obviously vital for the exchanges themselves, who use the token for marketing: to keep and grow volumes. And it’s arguably a windfall for traders, who — using those incentive structures as designed — are often rewarded for buying these coins early.

But exchange tokens are also a business in and of themselves. Unlike conventional rewards points, these tokens can become free-standing financial assets which traders can use as collateral on other platforms. And since many of them are DAO governed, they aren’t necessarily bound by their initial issuance schedule or incentives.

Exchanges have transformed the “points” model into something new, but what’s worth discussing is how they’ve done. Each coin has its own economic model. Here’s our list and how each one works.

Binance Chain (BNB)

Maximum Supply: 200,000,000

BNB is the fourth-largest coin by market cap, a spot it earned as a darling of the bear market of 2017–2019. BNB was created originally as an ERC-20 coin, but migrated later to Binance Chain.

Issuance: Fifty percent of BNB coins were allocated to an ICO which raised $15 million in funding in July 2017, selling tokens for a flat $0.10 each. Forty percent of the supply went to the founding team. Ten percent went to outside investors. As if raising a venture round, Binance made available a use-of-funds pie chart, allocating the capital raised to exchange improvements, marketing, and a bailout fund. There were no lockups.

Source of Demand: Users hold BNB to get reduction in fees on various trading markets on the Binance exchange, Binance DEX, BNB Beacon Chain, and BNB Smart Chain. Importantly, the fee discounts reduce significantly over time, starting at 50 percent and going to zero on July 13, 2022.

According to Investopedia, Binance spends 20 percent of its corporate profits each quarter to repurchase and burn BNB. The ever-reducing supply reduces overall liquidity, increasing the price of the remaining coins. Burning stops once half the supply is gone, leaving 100 million coins.

Other Uses: Binance has also formed partnerships with a surprising number of brands to accept BNB as retail payment for goods and services, as well as collateral for loans. Investopedia has a good list. Binance Launchpad allows aspiring seed investors to use BNB to crowdfund startups, too.

FTX Token (FTT)

Maximum Supply: 350,000,000

FTT is a highly engineered financial instrument, unlike BNB. For better or worse, FTX compiled all of the token’s mechanics on one confusing “transparency” page here, from which we’ll draw attention to a few highlights below.

Issuance: FTT was “pre-sold” in Summer 2019 prior to the token’s debut for trading on FTX on July 29. The proceeds were rumored to be valued around $70 million USD, but the exact number is private. The sale proceeds came from a mixture of private “seed” investors and public (non-US) crowdfunding contributors, who were limited to buying 1,000 FTT per account. According to FTX, it sold 40 percent of the total supply, or about 140 million tokens.

Pricing followed a multi-tier formula:

Of the 140 million sold, 50 million went to private investors at $0.10-$0.20, and another 9.3 million were sold privately between $0.20-$0.80, both tranches coming with vesting schedules. The remaining 80 million tokens were then sold to the public between $0.80 and $1.

Sixty percent of FTT tokens are held by FTX itself for one purpose or another; you can find the budgeting and the sale details on the Transparency site, although again the language is contradictory and appears to need correcting. All investors public and private were subject to various lockups between 1–3 months, with the private investors on the longer end.

Source of Demand: Like Binance, FTX uses a portion of its trading fees — 33.3 percent — to repurchase and burn its own token, but does it on a weekly basis. It also burns FTT equalling the 10 percent of net additions to the exchange’s “backstop fund” and yet equalling five percent of fees from non-trading activity on FTX. (Around 16 million tokens have been burned as of this writing.)

Traders can also buy FTT to use as collateral on margin accounts. Holders may buy FTT to participate in a many-layered discount schedule, seen below.

Other Uses: FTT holders were entitled to Serum (SRM) airdrops, which refers to the native token of a “protocol for decentralized finance” written for the Solana network. The Serum DEX is a collaboration between Solana and FTX. More on that below.

Serum Token (SRM)

Maximum Supply: 1,000,000,000

Serum is a cross-listed Solana and ERC-20 token launched at ICO in August 2020. It bears the hallmarks of an FTX project, which are abundant complexity, ambiguous language, and success. Zooming out, it’s a different approach to monetizing an exchange coin from FTT and others, so it bears a longer introduction.

The surprising thing about the Serum DEX, as it relates to SRM coin, is that it spends a huge proportion of its trading fee revenue on buying back and burning SRM. What fee remains is split between an “introducing broker” type role who builds a GUI to originate trades, and the network node operators in the form of staking fees. There are no trading fees left for the people who actually built Serum, unless they operate nodes, which comes with an operating cost. How do they get paid?

The big strategy here for the project founders, as compared to FTT, is delayed gratification. Here’s how it works.

Issuance: Marketing copy on the Serum homepage advertises that “91.25 percent of all tokens have long-term unlocking periods,” as if 25 bips too much or too little would ruin everything. But Serum’s initial illiquidity is actually its defining feature.

Only 8.75 percent of the token supply began life unlocked. Of that, 4 percent of SRM (or 7 million coins) were sold to auction operators and seed investors combined. Auction operators — other exchanges — were allowed to sell lottery tickets to bid on blocks of coins. The pricing across auction operators was the same, but the incentives were priced in their own coins. The bid range was $0.10-$0.11 per SRM for blocks of 2500 coins per lottery ticket. The final price of the seed round was roughly $80,000 per one million SRM, raising a total of roughly $20M for 4 percent of the supply, for a market cap of $480 million. Far less than FTT’s $70 million sale.

Here’s an example of the ICO (or IEO) pricing as advertised on FTX with a special incentive for FTT holders:

The other 825 million illiquid SRM are allocated to the founders, their partners, and their purposes, says a pie-chart on Serum’s website. It’s unclear which category of recipient received the other 4.75 percent of the initially unlocked tokens.

The huge illiquid block began vesting after one year, with linear increases over the next 6 years at a fraction of “approximately 1/2190” per day.

Importantly, one-third of the coins paid as fees on the Serum DEX are partially recycled: 20 percent goes to the GUI operator who originated the trade, 10 percent to the Serum node operators as staking rewards, and 2 percent towards the “Ecosystem fund.” But most are burned.

Source of Demand: Of the trading fees generated on Serum DEX, a full 68 percent go towards buying back and burning SRM.

Traders can hold SRM to pay reduced taker fees on the Serum DEX, similar to the discount scheme of FTT. But there are natural limits to how much the protocol can discount trading fees, because they’re used in part to pay node operators and GUI operators. The taker fees on Serum DEX are between 3–4bps, depending on how much SRM you hold, so the maximum discount is 1bps or 25 percent — far less than the maximum 60 percent discount FTX gives FTT holders.

Users can also participate in lending and margin trading through third party pools like Mango.

Other Uses: SRM is also a governance token, offering holders collective control “over the use of fees in Serum.” Users must stake to receive rewards and vote. A requirement of staking nodes is to have at least 1 “MegaSerum” of coins in the node, which is an illiquid block of 1 million SRM coins. The rest of the staking requirement, or 9 million of the total 10 million required stake, can be liquid SRM coins. Traders can mint a MegaSerum (MSRM) block by locking up their SRM coins.

Uniswap Token (UNI)

Supply: 1,000,000,000 after four years; inflationary

Uniswap V2 launched in November 2018 as one of the first exchanges to widely employ an automated market maker (AMM) in lieu of an order book, allowing it to make markets with less liquidity than traditional exchanges. In September 2020, the DEX’s founders announced a governance token called UNI would be airdropped to existing users.

This new token wasn’t part of the roadmap. Someone had forked Uniswap and launched a token with community incentives, and Uniswap had to do the same to prevent users selfishly migrating over. We’ll talk about that fork next — now back to UNI.

Unlike other tokens here, UNI doesn’t afford holders any discounts on trading — instead it’s a governance token for the Uniswap DAO, and it doesn’t do a lot else.

Today, the DAO has 310,000 members who hold UNI in order to submit proposals for use of funds in the community-run treasury. UNI holders also control the Uniswap.eth ENS name, the default listing directory, and a marketing project called SOCKS liquidity, which features actual physical schwag in the form of socks.

Issuance: Sixty percent of UNI’s initial supply is allocated to Uniswap “community members,” of which 15 percent of the total supply — or 25 percent of the community allocation — was distributed in the September 2020 airdrop to users of Uniswap V1, according to the Uniswap blog. The remainder is to be released over four years.

Like other exchanges, UNI pays out its trading fee (30bps) back to its liquidity pools, pro rata in UNI tokens. Unlike some other tokens, Uniswap inflates over time at the considerable rate of 2 percent per annum beginning four years after the initial issuance, in order to ensure “continued participation and contribution to Uniswap at the expense of passive UNI holders.”

Here’s the “genesis” UNI allocation:

• ​​60.00 percent to Uniswap community members (through various channels)
• 21.266 percent to team members and future employees with 4-year vesting
• 18.044 percent to investors with 4-year vesting
• 0.69 percent to advisors with 4-year vesting

There are a couple of non-obvious things here. For one, the “community” that receives 60 percent is composed of two cohorts: one is the 15 percent of tokens that were distributed to Uniswap V1 users, and the rest is allocated into the DAO treasury — not actually distributed to users. Although it bears mentioning that this treasury seems designed to distribute at least some coins through other channels, such as grants, “community initiatives,” and “other programs.”

In fact, inflation comes at the expense of the team, investors, and advisors, who are diluted by 7.19 percent over that ten year period. The message to those early stakeholders is clear: stake, lend, or join a liquidity pool, or see your UNI stash get diluted.

Source of Demand: Traders who participated in Uniswap V1 and received the UNI token were richly rewarded through May 2021, when the price reached $43 from a low of $2. Initial holders could use their UNI as collateral for loans or trades at the elevated price, as well as stake for more UNI, leaving little motivation to sell — at least for a while.

New buyers might be drawn to UNI to participate in governance, but with numerous votes required to pass proposals, the process isn’t exactly a thrill. UNI’s peaks might result more from a lack of sellers than organic demand. Airdrop recipients may have gotten free money, but Uniswap ensured they had reasons to lock it up and speculate… for a while, anyway.

Other Uses: Besides its use in governance, Uniswap’s is used as collateral on lending platforms and in liquidity pools.

SushiSwap (SUSHI)

Issuance: 600,000,000 after two years; inflationary

SushiSwap, a fork of Uniswap, launched in September 2020 with an exciting and ultimately untenable issuance scheme, offering more rewards for liquidity providers. By Fall 2021 it was all the rage with DeFi traders.

Like Uniswap, SushiSwap shared trading fees with liquidity providers pro rata. But the fork routed one-sixth of those trading fees to regular coin-holders as a dividend. (The trading fee on both DEXs is 30bps; SushiSwap shares 5bps with people who stake SUSHI.) The staking rewards were a popular incentive but also drew speculators. More on that shortly.

Issuance: SUSHI wasn’t pre-mined like UNI; instead, it was created during a two-week “liquidity mining” period. To receive SUSHI, UNI holders could stake their UNI on SushiSwap and begin receiving the new coin. When Ethereum hit block #10,750,000, newly-minted SUSHI began flowing at a rate of 1,000 SUSHI per block. UNI stakers began receiving SUSHI (less a 10 percent developer’s share) for a period of 100,000 blocks.

After that period, SUSHI emission dropped to 100 coins per block and now continues indefinitely, as seen in the chart below.

Behind the scenes, SushiSwap’s founder used a few subtle mechanisms to control the issuance, despite its advertisement as a permissionless airdrop. According to Glassnode, liquidity pools in SushiSwap are not rewarded equally; they are assigned scores which dictate their share of the newly minted tokens. The “pool weight” can be changed via DAO governance vote. This is either a means of defense against a malicious liquidity pool, or a way to covertly show preference, or both.

Source of Demand: The primary demand for SUSHI came initially from regular holders, who sought to stake SUSHI in order to receive more SUSHI. As trading volume on SushiSwap grew, users figured out they could not only stake — but also borrow against their illiquid SUSHI on DeFi platforms to buy more SUSHI. This was accomplished via an illiquid instrument called xSUSHI, which users received in exchange for staking their SUSHI.

As the Sushi docs say:

Once per day or more, the liquidity provider rewards contracts are closed and all LP tokens are swapped for SUSHI tokens, which are sent, proportionately, to xSUSHI holders. At this time, xSUSHI would have a greater value than the bought SUSHI tokens.

Many people also wonder if it’s better to farm $SUSHI on other platforms in lieu of staking. One of the benefits of staking SUSHI over using it to farm is that you can use your staked SUSHI in other DeFi protocols. For instance, you can lend your xSUSHI on CREAM as collateral, use that to borrow ETH, then use that borrowed ETH to farm another asset with an even higher APY. It can really be used to maximize token yield potential.

SUSHI was styled as being more equitable than UNI; regular holders who bought and staked a few SUSHI could get a small share of trading fees without lending any capital to a liquidity pool. But in fact, it rewarded initial airdrop holders most of all, creating an enormous speculative opportunity for those who arrived early and kept participating.

By March 2021, a significant amount of xSUSHI had ended up on two major DeFi platforms. The vesting schedule dictated that $878 million of SUSHI, or 47 million coins would unlock to these two platforms, whose DAOs could decide to dump the coins. A shit-show ensued and the contract was altered to prevent the unlock.

Other Uses: SUSHI features “economic participation,” but does not claim to have a real DAO. As mentioned, xSUSHI can be used as collateral on various DeFI platforms.

BISQ (BSQ)

Dynamic supply

Bisq is a peer-to-peer bitcoin DEX launched in 2016 that functions similarly to LocalBitcoins. It may not have record-breaking volumes, but it’s the only DEX here that incorporates the exchange, DAO, and token into a closed economic system. And it’s simple enough to describe in a few sentences.

The first thing to know is that BSQ (the token) is a colored coin on Bitcoin. Fees collected in BSQ are actually bitcoin, and those fees are distributed to the community — leading to a windfall for people who joined to the project before the last two bull markets.

Issuance: The Bisq network is developed and maintained by community contributors, who make work proposals to the Bisq DAO along with a compensation requirement denominated in bitcoin. If the proposal is approved by the DAO in a blind vote, the contributor is promised a payment in BSQ tokens.

To get that payment, the contributor must submit a few satoshis of their own bitcoin to the DAO to be “colored.” BSQ issuance takes place dynamically over time as contributors are paid, and didn’t begin with one big mint.

Source of Demand: Once they receive back their colored coins, contributors can list their BSQ for sale on the DEX, where non-contributing users buy it in order to pay fees when they trade. They can also use BTC, but using BSQ affords a discount of 50 percent. Indirectly, the trader is paying the contributor for maintaining the exchange.

Once a trader spends those BSQ on fees, those coins are “burned,” reducing the supply of BSQ available. And while this is an elegant approach, in practice it means that increasing development velocity too much can produce an excess of BSQ liquidity, inflating away the earnings of the contributors who held their BSQ.

Other Uses: BSQ holders who want to participate in the Bisq DAO can post a bond with BSQ in order to take responsibility for what Bisq calls a “high trust role.” If the stakeholder undertakes the role and screws it up, the rest of the DAO stakeholders can take their stake.

dYdX (DYDX)

Maximum Supply: 1,000,000,000

Launched in 2017 with a $10 million venture round, dYdX is a perpetual futures DEX that allows users to deposit USDC and trade contracts for dozens of other cryptocurrencies, on margin. Unlike other DEXs on this list, dYdX is a layer 2 exchange: built on the StarkEx engine from Starkware, it offers instant trade settlement and gas-efficient transactions.

The token design here is different from other DEXs here, since dYdX offers leveraged trading natively. Notably, the only collateral allowed on dYdX is USDC. The DYDX coin is used for governance — you must stake it to vote, et cetera — and also funds a liquidity backstop for the exchange.

Issuance: Issuance of DYDX governance token happens several ways, and began with an airdrop equalling 7.5 percent of the initial 250 million coin supply. Those coins were distributed to users who traded on dYdX before a snapshot taken on July 26, 2021. You can see how the airdrop kickstarts the issuance process in the chart below.

To claim “historical rewards,” users had to meet these milestones:

The aidrop was part of 50 percent of the total allocation for the community, which includes specifically:

• Retroactive Rewards (mentioned above): 7.5 percent — 75,000,000 DYDX
• User Trading Rewards: 25 percent — 250,000,000 DYDX
• Liquidity Provider Rewards: 7.5 percent — 75,000,000 DYDX
• Community Treasury: 5 percent — 50,000,000 DYDX
• Liquidity Staking Pool: 2.5 percent — 25,000,000 DYDX
• Liquidity Provider Rewards: 2.5 percent — 25,000,000 DYDX

The non-community pool is allocated as follows:

• Investors: 27.73 percent — 277,295,070 DYDX.
• Employees & Consultants of dYdX Trading or Foundation: 15.27 percent — 152,704,930 DYDX.
• Futures Employees & Consultants of dYdX Trading or Foundation: 7 percent — 70,000,000 DYDX.

The initial issuance pool will last the network for five years, until an inflation rate of 2 percent per year kicks in, until a maximum supply of 1 billion tokens is reached. The distribution of these inflationary rewards changes the ownership profile of the token in favor of the community, diluting the founders, investors and employees:

• Community: 54.7 percent:
• User Trading Rewards: 22.7 percent.
• Retroactive Rewards: 6.8 percent.
• Liquidity Provider Rewards: 6.8 percent.
• Community Treasury: 4.5 percent.
• Liquidity Staking Pool: 2.3 percent.
• Liquidity Provider Rewards: 2.3 percent.
• Investors: 25.1 percent.
• Employees & Consultants of dYdX Trading or Foundation: 13.8 percent.
• Futures Employees & Consultants of dYdX Trading or Foundation: 6.3 percent.

There are a few dynamics behind the scenes worth mentioning.

In the “trading rewards program,” wherein 25 percent of the initial token supply are distributed to traders who currently use the platform, the amount traders are compensated is tied to fees paid and their level of open interest at the time of the distribution. This distribution happens on a 28-day cycle over five years, without vesting or lockup, although the tokens need to cool for seven days before they can be used in governance. So there’s a strong incentive for market makers to stick around or see their coin value get inflated away.

There are two pools or “modules” for liquidity, where users stake USDC or DYDX and receive a pro rata share of DYDX. The current yield is 0.06 DYDX per $1,000 of USDC in the normal Liquidity Module.

A much higher return is paid to those who stake in the “Safety Module,” where the going rate is 17 percent annualized. The dYdX Foundation — which the project’s websites take pains to distinguish from the commercial exchange — says this pool can be slashed “as a result of a shortfall event,” which is the rationale for the higher reward.

Source of Demand: On the demand side, DYDX is fairly simple governance token; the demand is ostensibly to use the token to vote, but some traders are probably buying it to stake and get more DYDX. Of course, staked DYDX can’t be lent elsewhere like xSUSHI.

Interestingly, there’s also no burn or buyback mechanism at work — the coin inflates, and ostensibly the demand for DAO governance is supposed to keep the buy-side healthy. In practice, the large Series C venture round the dYdX team raised may be used to make markets for the tokens on centralized exchanges. Binance has the most trading volume today at 18 percent of the total. Perps for the coin do not trade on dYdX itself.

Bottom line, this is a market maker’s coin. The value proposition here is basically to give the biggest traders on the platform control of the governance of the exchange, while maintaining representation for the mass of smaller voters representing retail interests. From there, DYDX whales can use the DAO to propose something like a burn, if they think supply is excessive.

Other Uses: You can use DYDX as collateral to lend and borrow on other exchanges and platforms like Binance.

How do they compare?

It’s tempting to rank these schemes, or at least comment on their strengths and weaknesses. But in fact, they’re hard to compare, due to their varying goals and risk appetites. Here’s what we can deduce from their designs.

Binance — with the simplest coin of the group — is designed to be retail friendly, and seems to have succeeded. However, its decision to end fee discounts for holders this year may ultimately de-motivate them. It’ll be interesting to see whether Binance reconsiders and continues the discount.

SUSHI — the shitcoin of the group — was designed to be fun for degenerates, and blew up as you’d expect. Users could stake xSUSHI elsewhere, get USDT, buy more SUSHI and repeat.

Bisq, by comparison, is either the most ambitious or stupidest design of the bunch. Attempting to bootstrap both supply and demand without exogenous funds, market making, or even listing on another exchange, it attempts to use the token purely as an instrument between two peers. As a result, it doesn’t even appear on Coinmarketcap.com, which can’t be good for grassroots growth. It’s unclear how growth is achieved in such a model, when increased development velocity leads to increased token liquidity, not necessarily increased demand.

Serum, FTT, and DYDX are carefully-engineered tokens aimed at incentivizing and protecting sophisticated traders. These three deserve a little more discussion.

The Serum and FTT launches illustrate different risk appetites. The FTT launch was gutsy — FTX publicly set out to raise a whopper of a coin offering, succeeded, and rewarded buyers with a coin that vested quickly. Serum, by contrast, was more risk-averse.

The entire SRM scheme felt careful. The initial raise was private and much smaller, and while the coin initially had some unlocked liquidity, the aggressive burn rate ensures that there’s never too many coins floating. Serum outsources liquidity pools and node operation to third-party operators, which can be interpreted as a legal hedge. Liquidity for SRM is also nicely balkanized, which is good for volatility. Binance, with the greatest share at 9 percent, has only $200,000 on either side of the SRM book, which seems low relative to its overall trading volume in the $300 million per day range (as of this writing.) SRM’s total volume across exchanges is regularly 10x that of FTT, and has ranged into the billions — although never in a single venue. Maybe this was Solana’s way of trying to create a bulwark against FTX controlling liquidity for SRM, or maybe it’s a way of creating arbitrage opportunities.

Of the group, dYdX’s coin had the most intentional design. The demand side of the token isn’t engineered into the smart contract, but “off chain,” in the form of capital raising and CEX market-making. All of the complexity exists on the issuance side, which is carefully designed to attract and retain liquidity providers as well as retail traders. Its clear documentation made the incentives easy to understand, if not easy to model.

If you’re going to take inspiration from one exchange coin in 2022, the example of DYDX might offer this as a lesson: incentivize the early traders and market makers; give them reason to stick around; add a dash of inflation to encourage a search for yield (which, in turn, produces DAO participation); and take care of the rest offline.

One year ago, the ZigZag team began reimagining what they saw on Uniswap. Yes, to trade without lengthy onboarding was revolutionary, harkening back to the days of EtherDelta, but Uniswap’s UI lacked… information. Without an order book, trade log, or DOM indicator, a flow trader would be helpless to calibrate a good entry or exit.

Of course, Uniswap v.1 was working with serious limitations: on-chain matching, high gas fees, and an untested security model, and Uniswap v.2 is markedly more efficient and complete. Still, we suspected the job could be done better with L2 technology.

On January 22, we announced a vision for a new approach to decentralized trading.

On the Leading Edge

When Uniswap reached its growth stage, scaling solutions were nascent; optimistic rollups were gaining traction as a way to scale Ethereum, and so were zk-SNARKs. Both technologies purported to let users retain custody of their own coins during order execution without increasing counterparty risk or delaying settlement.

But while optimistic rollups grew quickly in hype, they also had significant downsides at scale. Fees compounded on fees, making an exchange more expensive to operate as it grew. Approaches which used Zero Knowledge Proofs had the opposite quality, becoming more economical at scale. With ZKP, an opportunity for a new kind of DEX emerged: high throughput, trustless, and low cost.

ZkSync was the first live protocol to attempt ZK rollups on ETH. It launched quickly, and came with a built-in swap contract that saved time rolling our own. Users flocked to zkSync — in fact, ZigZag Exchange has had over 500,000 unique addresses registered using a ZK key to date. It is the lynchpin of ZigZag’s first version, currently live now.

Soon after the engineering team discovered zkSync, StarkNet was announced, promising a large, open ecosystem and a new smart contract language, Cairo. And while StarkNet’s mainnet still lacks live bridges, the team decided to integrate both of these L2 chains.

Two Paths, One Destination

Both StarkNet and zkSync 2.0 support our long term vision for a DEX. We believe that pseudonymous P2P exchanges are critical to the liquidity of the crypto-network ecosystem, and we believe that such a platform need not be inferior to centralized alternatives. The team’s priorities are borne out by our flagship features, which are (or in some cases, will be) enabled by zkSync and StarkNet.

Here are those priorities:

• Permissionless Listings. There is no approval process to trade a pair on ZigZag — almost any ERC-20 can trade there with just a few minutes of work. If you don’t see a pair you like, see this guide on submitting listings.
• Fully Non-Custodial. Like any DEX, you can connect with Metamask to trade, and maintain control of your own funds.
• Market-Maker Bot Included. Traditionally, writing a reliable market-making bot takes years of experience and specialized skills. ZigZag ships with a market making library pre-written, so that any coin-holder can host and deploy their own by merely copy-pasting code and changing parameters. Check out the tutorial here for more details.
• Advanced Interface. We look up to the DYDX developers immensely for their well-crafted trading UI, which surfaces most of the information you’d expect in a traditional futures exchange, without the cluttered look of other exchanges. (Check out a preview of the new UI here.)
• Exchange Tokens of Value. Traders who became enfranchised in the native $DYDX token are partly responsible for the exchanges’ popularity; its perpetual contracts markets are deeper than even top CEXs. While ZigZag has not launched a token, it would follow the DYDX playbook if it did.
• Liquidity Pools. One of ZigZag’s major milestones will be the launch of the Mammoth Pool this month. Written in Cairo by the brilliant @0xTonysprocket, this Automated Market Maker (AMM) allows anyone to deposit wBTC, ETH, or stablecoins to earn a pro rata share of swap fees. Whitelisted market makers can draw from this pool and place exchange orders without needing to onboard their own liquidity. (Mammoth Pool will be available on the StarkNet implementation of ZigZag only until zkSync 2.0 launches.) Watch @ZigZagExchange on Twitter for an announcement on launch.
• Tighter Fills. In randomized testing, our matching engine (built on top of zkSync 1.0) routinely fills orders at 5–7bps below Uniswap. On a $1M trade, that’s $700 in savings. For makers, who are accustomed to doing hundreds of trades per day, the economics matter.

We acknowledge our goals are lofty, but the marketplace is hearing our message. Since going live three months ago, ZigZag users have traded over $1B USD in volume across 500,000 disparate wallet addresses. Why did this DEX achieve such rapid growth? We encourage you to find out first-hand: connect your wallet and start trading.

As we refine the roadmap for ZigZag, please let us know what you’d like to see. You can find us on Twitter @ZigZagExchange.

Getting setup as a liquidity provider has never been easier with this simple bot.

Exchanges need liquidity, and they’ll pay token-holders to provide it — but the relationship isn’t exactly symbiotic. Until recently, becoming a “liquidity provider” meant giving up control of your coins to a pool, or writing sophisticated market-making software on your own. Is there a better way to crowdsource market depth?

Enter the ZigZag Market Maker: a simple pre-rolled library for anyone who wants to run a small market on their own — with no intermediaries and no complexity. And while this library might require you to host your own VPS, anyone with some command line experience can get it up and running quickly.

In this post, we’ll talk about the design rationale behind the Market Maker, and how to deploy it.

What You’ll Need

The code for the Market Maker can be found in Github here; the direct download link is here. Begin by downloading this repo, and remember: ​​the ZigZag team and community is always available to help you get your bot running. If you get stuck, head over to to the designated channels in Discord.

You will also need the following:

• Activated zkSync account
• Ethereum private key of that account
• Funds in that account corresponding to the pairs you want to market make
• Cryptowatch API key (free for limited time)
• Node.js v.16
• Optionally, a VPS in the US (ZigZag runs on AWS US East)

Note: In order to provide liquidity for a market, there must be an existing market on another exchange with greater liquidity, and it must be listed on Cryptowatch. It is crucial that the oracle market has several sources of liquidity, to prevent the opportunity for oracle attacks. The ability to run standalone markets, without listings elsewhere, is in the ZigZag roadmap.

Installation (macOS, Windows, and Linux)

This library works on both Mainnet and Rinkeby testnet.

1. Open Terminal on macOS or Linux. If on Windows, open the command prompt or install the Terminal application from the Windows App Store
2. Use the “cd” command to enter the directory of the Github repo you downloaded
3. Run <npm install>
4. Duplicate the config.json.EXAMPLE file from the Market Maker folder and rename it to <config.json>
5. Open <config.json> with a text editor such as Nano or Vim
6. Paste in the CryptoWatch API key to its designated field
7. Paste in the Ethereum private key to its designated field
8. Set the pairs to true (active) if you want to market make them, or set them to false (inactive) if you don’t want to run them
9. Adjust sizing in the base asset and spread (expressed as a percentage)
10. Save and close the config file
11. Open the Terminal and run the bot by typing <node marketmaker.js>

As with any command line application, simply hit CTRL-C to stop the bot and return to the prompt.

Consider Your Goals

Before you load up your wallets, consider what you hope to achieve by running the bot. One of the most important considerations will be positioning and sizing.

If your goal is to provide two-sided market depth for a new project, then you may need to rebalance each day to counteract the net effects of that day’s buyers and sellers.

On days where your token is in high demand, there’s a chance a whale comes in and buys the entire ask side. On days where your token is crashing, the same might happen in reverse, wiping out your bid side. Size your positions large enough that other traders can’t easily manipulate your bot. You may consider hedging several times per day on another exchange, to retain control of your financial exposures.

Note: It is possible to set one-sided markets. By default, the side setting is set to d, which stands for double-sided liquidity. To toggle single-sided liquidity, the value can be set to “b” or “s” for “buy-side only” or “sell-side only.” This setting is useful if you have a large bag of coins you’d like to liquidate or accumulate by dollar-cost-averaging.

To learn more about pair settings, view the ReadMe.

Design Goals

One of the challenges for new projects is bootstrapping liquidity on exchanges. And while ZigZag has disintermediated the listing process, a listing is no good without some liquidity — in fact, it won’t even appear until there are some lots available on the ask side.

But for many projects, writing market-making bots is a foreign skillset, and the path towards earning one is mined with expensive trading losses. There are few bugs as expensive as market-making bugs.

With the Zig Zag Market Maker, providing liquidity is reduced to a series of copy-pastes — and depending on the demand for the pair you’re trading, it can be quite profitable.

Security Notes

By default, the bot doesn’t expose any open ports; thus there is no point of entry for an attacker. Do not open unnecessary ports. For a longer guide on setting up a VPS securely, see this tutorial.

Questions about running the Market Maker bot? Comments on this tutorial? Join our Discord to get help from the community.

One of the great advantages of a DEX is its ability to scale the number of products it trades. Without a centralized agent to approve listings, there’s no toll-collector to keep tokens out of the marketplace.

This month, ZigZag introduced permissionless listings, allowing any user to add to the products traded on ZigZag. The listing process is fairly simple, but we’ll take this opportunity to provide context around the functionality and intended design.

First, let’s begin by pointing out one big difference between ZigZag and Uniswap when it comes to permissionless listings.

Uniswap made waves in September 2020 when it added permissionless listings to its Token Factory, a Web-based tool that let non-technical users mint new ERC-20 tokens. Listings quickly grew to exceed Binance’s with over 8,000 pairs trading — albeit many of them spam. The Uniswap team wrote in a blog post post prior to launch:

“As the rate of token issuance accelerates, it has become increasingly difficult for users to filter out high quality, legitimate tokens from scams, fakes, and duplicates.”

ZigZag didn’t build a Token Factory — in fact, we wonder why anyone would — but instead, its listing UI is geared towards tokens that already exist. And while it’s technically possible to list any ERC-20, traders will have the best experience with tokens that have the following characteristics:

1. Already have charts appearing on TradingView.
2. Already have liquidity on other exchanges.
3. Already listed in the zkSync explorer.

The last criteria is easy — anyone can list a token on zkSync — and if you have a market maker lined up, it may not be so critical that the token trades widely elsewhere. But, your token will appear without a price chart if it is not available on TradingView. Read on to learn more.

Five-Minute Guide to Listing an ERC-20 on ZigZag

1. First, check if the token you want to trade is listed on zkSync. ZigZag uses zkSync’s token listing standard. You can search the listings here: https://zkscan.io/explorer/tokens/. If you don’t see the token you want, no worries; go ahead and register it by clicking “Add New Token”.
2. Next, head over to ZigZag’s List New Market form here: https://trade.zigzag.exchange/list-pair
3. Paste in the Internal ID of the Base Asset and the Quote Asset. (The Quote is the coin you’re buying with; the Base is the currency you’re trying to buy.) The Base Swap Fee and Quote Swap Fee will auto-calculate, but some users may choose to alter them. Pro-tip: set them as close to $1 as possible.
4. To learn more about the Advanced Settings, read the next section. Otherwise, hit Submit. Your token is now ready to be listed, once you pay for the storage of the metadata you entered.
5. Depending on whether you already have storage space on Arweave, you may be asked to buy storage space. Hit “Purchase” and your wallet will generate a $0.50 USDC transaction. Once paid, the button will transform to read “List.” Click it, and you’re done.

Note: A newly-listed token will not appear to bidders until liquidity is available on the ask side. Once a maker adds liquidity, the market will show up on the frontend and become trade-able for bidders. If you’ve listed a token that already trades widely, don’t worry — market makers may find their way without prompting. If not, you may consider privately retaining a dedicated market maker for your token.

Displaying a Price Chart

By default, ZigZag will search the TradingView chart database for a chart ticker composed of your base currency and your quote currency combined, eg., “BASEQUOTE.” If the system doesn’t find your pair in TradingView, you’ll get an error and no chart will display.

If you know the TradingView ticker symbols for the chart you want to display, click “Advanced Settings” of the List New Market form, and paste the ticker into the text field (eg., FTX:BTCUSDC). Now your listing will appear with a chart.

How Does It Work?

On submission, a ZigZag server posts a file to Arweave with the metadata of the pair, including base currency, quote currency, decimal precision, base fee, and quote fee. If you don’t already have adequate storage associated with your Ethereum account, then you’ll be prompted to buy some.

Once listings are submitted, the ZigZag Markets API allows the front-end to read that metadata and displays possible markets to traders. Market makers then have the option to provide liquidity for one of those markets. Once a maker appears and provides some liquidity, the pair will appear as trade-able by all bidders.

Preventing Spam

The use of zkSync’s token registry allows ZigZag to easily filter out spam. Tokens only achieve a zkSync listing if they have a live Coingecko price and some Uniswap V2 liquidity. Other tokens are listed with placeholder tickers (eg., ERC20-XXX) until you contact Matterlabs (the makers of zkSync) for manual approval.

Questions? Comments? Let us know on Twitter @ZigZagExchange.

It seems after spending some time in our community Discord that many of our users do not exactly understand ZigZag’s goals and objectives, which is why we are going to explore them in this post. We are going to keep an open-ended and honest conversation about the current state of decentralised exchanges. To put it in a direct manner, we are not working towards creating another mediocre decentralised exchange (there are plenty of those out there, so if you wish to trade on them go ahead).

ZigZag aims to bring the flawless trading experience and optimal liquidity that users get from centralised exchanges, and create a fully decentralised exchange with the same functionality. Keep in mind that this was not previously possible due to developmental limitations with scalability. However, with the integration of Zero-Knowledge proofs on the Ethereum network, we can turn this into a reality. We can thank Eli Ben-Sasson for his ingenuity on that matter.

What exactly is ZigZag aiming to solve?

The concept of decentralised exchanges has been tried and tested since 2016 with the earliest version gaining traction being EtherDelta. Very outdated it seems right? (At least for the ones who were around back then). Manually taking trades by clicking on the orders seems like a hilarious concept, and let’s not forget the pain you would feel if you accidentally mistyped your price.

From our perspective, AMM-based DEXs will suffer the same fate as EtherDelta did back in 2016. Give it 4 more years and the result will be clear: crypto moves at such a rapid pace that if you don’t innovate, you’re out. It’s as simple as that.

Crypto has advanced so much since EtherDelta’s release, but with the upsides in developmental advancement and user base, came the downside of congestion on blockchains and the issue of scalability. Most crypto users assume that this is an easy fix by simply using alternative blockchains or existing L2 scaling solutions, but the truth is that users don’t want to manually approve each transaction through MetaMask and pay gas fees (no matter how minuscule) for each trade. This hinders the ability to bring high-frequency trading to any blockchain.

Furthermore, for optimal liquidity and to be able to trade with size, the harsh reality is that L2s and alternative blockchains simply do not suffice. If you want to make a swap of relative size, it is most likely preferred to bridge back to mainnet Ethereum to get quoted the best price (even after paying the substantial gas fees of $1k+).

What’s next for ZigZag?

How we are aiming to solve the liquidity issue is by attracting and incentivising top market makers within the cryptocurrency space. We are aiming to be the most liquid DEX: by bringing on-board the same top market makers who create a significant percentage of the order books on centralised exchanges, we can bring the liquidity that users achieve on CEXs to a DEX.

Our first step was going live on zkSync 1.0 mainnet in the beginning of November 2021 as the first, and at time of writing still, the only DEX. Going live on StarkNet mainnet as the first DEX and launching on zkSync 2.0 will be the next steps for us. Our contracts are ready to be deployed ASAP to capture a lot of the value on these newly established ecosystems. Fixing bugs as soon as they get recognised on testnets is what we are doing from the developmental side. From our perspective, ZK-Rollups are the end-game scaling solution that will hopefully put to bed the arguments about Ethereum’s scalability flaws.

The trading UI will be given a fresh look soon, completely revamped. We understand that it is not the prettiest thing to be looking at right now.

If you haven’t tried out StarkNet Alpha nor zkSync 1.0 yet, I highly recommend you to experiment with it as a user and developer. We have a testnet on StarkNet up right now that I encourage everyone to try out. You can also try out our zkSync 1.0 testnet on Rinkeby for free. Grab some Rinkeby ETH at one of the faucets and start trading. The possibilities are limitless in comparison to what previously was possible on Ethereum.

Hopefully this post will bring a lot of our users on the same page as the ZigZag team and understand what we are going to achieve here! Our orderbook DEX live on zkSync 1.0 is only a mere fraction of what our true intentions are with ZigZag, please keep that in mind.

Join us on our mission using the links below:

• ZigZag Exchange
• Join the ZigZag Exchange Discord Server!
• JavaScript is not available.
• ZigZag Exchange