# Ethereum 9¾: MimbleWimble for ERC20 with zkSNARKS by Wanseob Lim

- Speakers: [Wanseob Lim](https://streameth.org/speakers/wanseob-lim)
- Channel: [Devcon](https://streameth.org/devcon)
- Date: 2020-10-09
- Duration: 18:50
- Topics: blockchain, smart contracts, distributed ledger, ethereum
- Watch: https://streameth.org/watch/yt-5LRh9iDb1sw
- YouTube: https://www.youtube.com/watch?v=5LRh9iDb1sw

## Description

Visit the https://archive.devcon.org/ to gain access to the entire library of Devcon talks with the ease of filtering, playlists, personalized suggestions, decentralized access on IPFS and more.
https://archive.devcon.org/archive/watch/5/ethereum-9-mimblewimble-for-erc20-with-zk-snark

Ethereum 9¾ is an entrance to the magical world to send ERC20s privately. It hides the transaction histories using MimbleWimble and ZK Snark.
A user enters into the magical world by depositing ERC20 tokens with a valid MimbleWimble output. As Ethereum 9¾ appends it as a coin-base to the Merkle Mountain Range tree, the user becomes able to use MimbleWimble spell to send ERC20 privately.
The contract only accepts MW spells which include an unlinkable spent tag, result outputs, and a ZK proof. The proof should pass the ZK-circuit which ensures that the tag is derived from an output which definitely exists in the MMR tree while the sum of spent and resulting outputs satisfies the MimbleWimble equation. Then, the spent tag prevents double-spending and ZK Snark secures deposited ERC20s by proving that the sum of inflow and outflow is zero by MimbleWimble protocol without revealing details.
Or the user can go back to the muggle world anonymously and withdraw ERC20s by providing an unlinkable spent tag and a ZK proof. Because MimbleWimble doesn't reveal the value during transactions and we also don't know which output has been spent, it becomes hard to link the deposit and withdrawal.

Speaker(s): Wanseob Lim
Skill level: intermediate
Track: Privacy
Keywords: technical

Follow us: https://twitter.com/efdevcon, https://twitter.com/ethereum
Learn more about devcon: https://www.devcon.org/
Learn more about ethereum: https://ethereum.org/ 

Devcon is the Ethereum conference for developers, researchers, thinkers, and makers. 
Devcon 5 was held in Osaka, Japan on Oct 8 - 11, 2019.
Devcon is organized and presented by the Ethereum Foundation, with the support of our sponsors. To find out more, please visit https://ethereum.foundation/

## Transcript

[Applause] area I'm here to judge us in Germany in three quarters listen I'm once up and now working for nuns I mean to say is in Krypton community in Seoul there are 70 people all living and working together so and recently I like the polyster and recently I organized a local communities Developer Conference which name is so first 70 people in nuns are all the crypto related people but including me we did not use venomous anti to split the peel after we have dinner together it's because it is really hard to find my friend using animal skin hi so actually we use in actually in Korea we use compain which is equivalent to venmo to split the bill because those services are providing the features to find my friend using the messenger feature so however as the ux t acquaintances is to coming to institutes and mike refer to my friend using darkness so how many are using unison there are so many people are using illness then how many has states to use in how many has disease PMS is um yeah not many but people who use ENS frequently definitely feel that it is really high release so if I know your illness then I can very easily know how much if you have and how much die you have learned from me right now or even how much you got liquidated from the main renowned biases type in your ears into the industry so so if they're 9 3 4 s comes up as a lightweight pirate renters of solution so which place figure out this is either penetrate course knees it's a kind of Harry Potter stuff he said get to into the medical work where we can use them people in Moscow so let's see how it practiced the users can can change into the masker world by depositing your stranded tapas and then they go into the medical world and using the mobile in football they can make some confidential tradition each other and the relator can create the mobile transactions and submit that rejection to the interview using secure mobile app and the important thing is that the relay also aggregates the fees so okay this is just and by the way the users can we throw their money back to the mobile world submitting a valid proof this is just a brief explanation about how it breaks and now we are going to talk about the deep technical details about people either in three quarters so the first priority of the design was how much dick is nurse friendly and the second one was how much business friendliness and the third one was mr. friendly is so I'd like to employ I started to use the me more on first because removing one is the one of the lightest part of building comprehensive transition so it's transaction of consists of a randomness and a value and it expresses the TSO as a point on deal on the other two card using a pistol movement so it can hide those secrets while it allows the homework culturally Asian so this is hidden like the same IDenticard I added to point of the curve therefore using so imperfect hiding features we can verify that the sum of the input values and the sum of the outfit is equals so you can see that the coefficient of the base point on H equals 0 becomes zero cost only so we can also consider a prediction using this equation but it's not enough to make a robust condition therefore first because the zero sum replication works on a cyclic group to prevent the off wall and the underflow inside the home were free consulation we need to restrict the range of the values inside the check piezo and secondly we also add some metadata in a marquis we can't we concatenate the es to any address of the topic we understand and expiration time so the expiration time means that the contractor contract will not accept if the block number exists expiration hunter and finally to make sure this transaction is confirmed by the pool party we as a snore signature by the sender and the recipient but the problem is that actually is not preventing the tracking of the transition flow so actually green which is the most popular importantly implementation see crystal privacy by having no account and contouring in on interview we can not prevent the track of the change in RAM so therefore ninety three quarters uses C caches commitment only para scheme to hide the input input CSS so with the treatment only price in suggest nurse allow us to generate a an inclusive proof without redoing the commitment and also prevent the double also prevent the double spending by using the knowledge wire which is deterministically derived from the commitment finally so we append two more CK start with the first one is impressive proofs of the span test with the samples of the no defiers and the second is that the middle and bottom because it is because we hide the impacts of area so if not isn't not anymore able to verify the removable using the homomorphic calculation so we need to make them city stars proof that just guarantees that all the hidden values are following the removal Ponte Preta me the next part so as far as C cable la friendly data structure I'm pure top purpose virtual mountain range for an efficient a pen on mean vertical tree data structure and green is now using that in interview 9 3/4 it uses a slightly tweaked version of a recommendation range that uses elliptic curve - repeat - but to compute the whole notes so most of all in Pearson replicants arranged every knows our every note is the point on the baby - current so we calculate the lead note by the scholar multiplication of the lip position and the live item and we calculate the French note the principal value becomes the left node Y value and right now the molecule is multiplication of the left node Y value and the right right finally the root value because the stolen multiplication of the week of the merkel mountain range and the product of all Peaks we call this big bang in merkel mountain range so with this construction a 16-bit penis Merkle tree which has 65,000 least achieved 10 million constraints for rolling up 64 items at once it is generally because a firm Istanbul the cusp guests cause poor circulation reduces sloth so it will be able to verify around 256 rolling up 256 items at once so finally we can jump up to the Torah performance of the roller with the Optimus igual just like plasma we can use a challenge system to skip the CPS knife computation so therefore we can read this aloud as opposed to verify the sickest interpretation is that unchanging vision therefore in Petersburg in Paris perversion rolling up kisara 3 million and spurt injection but Optimus tabula on Nico's on about 147,000 Kasper transition and in Istanbul it only concern around about 50,000 yes per generation we need to actually is much expensive than our general Lola it is because it contains alarm which is nurse proof to make the transaction as a some comparator transaction but it is still very reasonable because the original the Bayer years training total transaction cost around 50,000 to 100,000 cast so as a result of return is passed through inter magnet drinkers or is a towel and some deep-lying for not using them so first anyone can be a real laner and we can decide their own transaction fee policy but to submit the optimist you want the relationship to pass some states to secure the product to you just thanks for the challenge system since beings are therefore being a real layer can be considered as a kind of a financial part which gives some revenue for the transition aggregated transition be against regarding to the closet space therefore we can also make a kind of a towel system like delegating some states to receive some dividends of the transaction fee revenue so the future word is first one is optimization and the second is related plan and mobile client and because if we also get some instant finality if we Ola without the optimum I mean it means that if we compute all the sickest our computation then we can get that is the finality but if we use up to mr. Bhalla we need to give some challenge period so we we lose the instant by on limit therefore if we change some construct a network of the real layers then we can not is not exactly an instant finality but we can offer you to provide some security of instant finally with the states of the relators network and what we have to do is gently just destroying the hypothesis yeah strike that pasty-faced so here's the summary the remaining three choruses removing the protocol and coming month Allah Christ came together and he uses Peter Suber the mountain range for an efficient secure all there for each chain is able to pan up to 256 items at once and the optimal provides deterministic front proof without any t88 problem and also it reduces the cost down to 15,000 yes per transaction so this is the implementation so if you like that please give me some top stars or yes or if you like that I'm looking for teammates or teams you can support this project so if you're interested in this project please let me know so thank you owe me some pressure if you want yeah we have four minutes so you can go up there is a stable internet Reza yeah um the devil yeah but on the Internet [Music] I already prepared as an Iranian and proves generic growth and some samples and extras [Music] but it's amusing so the first song is war 2 memorial transaction which spend one point mixing so we can make some appointments by depositing to BSU Chinese and the second round is spending to see the new traditionalist which is right throughout by the personnel so it means we used continues to include CSS and for once and make one change so if you have some removable trench blog post and you can aggregate them to use or a one so as I know many some part of all uses two inputs and two of us so there was the only 64 at once so this is the wizard will be rolled wallops 32-bit border connection service in perspiration how long did it take to build a parrot how long did it take you to build it I started to design from from the tree and finished specification Iran from July and started to build from honest full-time [Applause]