Towards a Feature-Complete and Backwards-Compatible Privacy Layer for Ethereum | Devcon Bogotá

foreign [Music] ers why do we need privacy layers and how are we going to get a private layers that people need so first let me State the why for privacy layers obviously the reason why we need privacy is because we don't have it right now if you're going to Easter CN every single transaction is public right you're able to see the entire history of all the wallets so the second reason why we need privacy is that if we want mainstream adoption of blockchain Technologies we really need privacy right it's one of the main hurdles alongside scalability and um you know identity and other issues and finally uh I'd like to just quickly address on uh you know privacy and regulation issues and there's effectively a spectrum Solutions right when you build privacy technology we're on one side you build fully self-sovereign Solutions where only the individual control their information and assets and the other side you could give you know a lot of control to The Entity actually controlling this ecosystem uh while preserving privacy between individuals and so on the right side you have something like cptcs and the livestock has something like Toyota cache right and perhaps actually in the middle we'll have something uh that's more or less uh maybe you know Best of Both Worlds where we could have a privacy preserving system yet give some limited form of control to you know some set of authorities okay so enough enough on the why uh let's talk about what I mean by privacy layers um so uh just reiterate everything on ethereums is public so you're able to see everything on users again and first uh what I wanted to find is the notion called anonymity so anonymity is the inability to tell who is doing a transaction right so if somehow you're going to etherscan and you look at transaction and you can't really tell who the address you know whose engineering address then we say that this system that's the anonymity and second is the notion of confidentiality if you're going and you cannot see exactly what the trades are then we say this system is confidential and it turns out confidentiality is really really hard on ethereum it's pretty much impossible and so unless you want to redesign entirety of ethereum right so um on the other hand anonymity is actually quite easy right we can use any mixer to mix the funds and every single time we want to do an operation however this is very very unusable right to the extent that only you know we only when you very much need this would you do such a thing right normal users would not uh do this for every single operation that would do um D5 protocols um so the goal is really to make this very usable right how do we get usable anonymity for ethereum so um so what I mean by again so just reiterate the system will have anonymity if you go to etherscan and you cannot see uh you know who's already using all these contract calls right so the question is can we get something like this with ethereum right um so and you know we don't we don't want uh privacy uh an enemy just for payments we want this type of identity for any type of smartphone so you can see you know on ethereum you can do many many different things um you know it's it's an ecosystem of the apps not just payments not just you know peer-to-peer swapping of assets not just in empties it's whatever you can imagine on top of token standards right we want to have identity by default for all the apps so that's the question um um and that's also what I mean by a privacy layer approach layer for ethereum should have the following um you know set of features but let us look at what are the current solutions for privacy layers um if you look at the inside ecosystem we have many many different UVM chains that's you know more or less uh you know you can run a d app and typical you know any any of them and you have many many uh applications sometimes um one popular chain sometimes on money chains and what are the Privacy Solutions well we have some mixers and we'll have uh you know some solutions that offer some type of D5 compatibility and we have solutions that more or less act as a layer two and with privacy so for instance Aztec and zika Opera are good examples of this and on the other hand we have also about privacy old ones uh and the examples are like for instance for example allele uh and Manta where uh you know it's a separate chain uh it might be a different ecosystem and you have a bootstrap a lot of liquidity and so it turns out you know there's no single solution that works with all the D apps so if you look at what these Solutions do uh so real guide and see copper actually allow you to support some limits in the form of swaps and uh project as I connect uh allow you know actually pretty good differential probability but it's not completely compatible with every single D app right so for as that connects you need to write this custom Bridge contract and in fact you know that's basically if you go to every single Aztec hackathon like that's what people do with you know they build Bridge contract for everything of the app uh you know and that's not scalable if you want to want this to support every single D5 projects out there so uh you know this is observation we don't have a private solution that um you know it's default and really usable right so um so yeah so let's look at um what what I mean by privacy later and what we should get in this previous layer so first of all it should be feature complete okay so uh so what do you mean by that you should have two features you should be able to use this you know privacy layer exactly the same way you would use you know ethereum right so you should be able to use um a browser's private suppression solution or any the app that you want um any and ideally you know with basically the same interface right you go to you go into a Dr front end you click some buttons uh and you you know you do a swap and second um you should be able to disclose what you have done okay so if you look at you know existing privacy Solutions it's actually really hard to tell someone else that you did something um you know the interface is not intuitive whereas right now for the transparent solution if you give someone your address they know you know they can see entire history right so we want some type of form of information disclosure right so if you own set of nfts and you want to prove to your friends that you know I own this at nfts and I authorize a message uh you can do that you should be able to do that really really easily right um okay and the second thing you should you should do is be backwards compatible right because we'll have all this amazing ecosystem out there obviously apps that people use um we don't want to you know throw it out to waste and build something completely brand new like we want to reduce the existing ecosystem so the ecosystem should be to support your 220 721 1155 standards um and you know you should more or less work with existing applications right and finally most importantly you should actually offer some from a privacy which in this case anonymity right so recall back to the previous slides um you will be the form you know use this thing and everybody will use this privacy layer and you're going to either scan no one can figure out who did what action right so the question for my talk is you know can we build such a thing and actually the goal of my talks to convince you that we could build such a privacy layer for ethereum today and we're building one okay so so let's look at how we're going to do this right so um so let's look at this you know set of three things we want for our privacy layer and it you know if you kind of categorize them the first uh two you know two features are basically what the smart contract wallet gives you right so if you're familiar with their kind of abstraction or you know any type of smart contract wallet this is the two things that this should offer you right you should you should be able to use it on any single application and it's backwards compatible and the second thing second feature that's you know it's really what a mixer offers you right what a short approve gives you so I realized you know some of you might not know what a sort of pull or you know mixer is so let me just reintroduce the two two concepts so first of all what do you show that pool a shielded pool allows you to unlink deposits withdrawals right so this is the most basic form of privacy solution that you know we've had since the Bitcoin days right so it allows you any user to deposit and later on you should be to withdrawal but by the time that you withdraw nobody else should know uh who's actually withdrawing right so you withdraw to a fresh UAE address so that's the no geometry pool or mixer and second uh let's recall Notions uh actually this should say wallet uh let's recall those of a contract what is your contract wallet well for a contract wallet the users actually do not own a uoa anymore right so for for instance for account obstruction uh you will have different uh address that we use um and you know but basically you know for your for your smart contract wallet you should be able to do the exact same things that you would do with you know your metamask right you should be able to submit it arbitrary Smart Control calls and get executed right and this is done in the form of a intermediary uh contract wallet that verify some signature and carry out the calls for you okay so that's not contract wallet and recall we want to do before we know we said that you know the the thing we want to build is basically a shielded Pool Plus or Smart Control wallet so so here's what we're actually going to do we're going to take the two and just put them together okay um so it seems to be a shielded contract wallet right so what can I do you should be able to use anything uh that's on ethereum and every single time you use the wallet nobody should actually know who's actually using the wallet right so there's one single shielded contract wallet that's shared by all the users in the ecosystem um okay so so you know that's on a very high level but how does this actually work um right so for sure the pools like like we said before it supports deposits and withdrawals and for contract wallets you'll support arbitrary calls and we'll put them together you will support again deposits and withdrawals but but also crucially something that you you can use to to call and eat the app you know the app all right so so here's the picture here's how it's going to work um it's going to be a smart contracts in ethereum where it allows any any user to you know enter this ecosystem and once they enter they're able to use it as if it's you know a metamask wallet and when different users have an application transactions they will you know they'll be reflected on chain so if you want to call Unison up you want to call openc um you should just work and furthermore on etherscan you have no idea of who's actually behind the scene during this operation right and that's a bonus actually we can make this um smart contract or contract wallet compatible with account abstraction or eip4337 Okay so as it turns out like there's two problems you know if you want to build this if we want to build this you know just combine and show the pool with the smart contract wallet the first problem is that when user submits a transaction that you know contains arbitrary calls you can actually just steal the funds of the entire contract right um so here if the user only owns supposedly on one ethereum in the pool but it constructs a call you know that consumes 20 ethereum um you know this is we shouldn't let this happen right because you know um people would be able to still the entirety of the funds of the entire protocol so uh what's the solution well the solution for this problem is that we actually just separate out of two contracts uh into a contract that actually holds the the other funds what we call a vault contract and a wallet contract which I will actually carry out the calls um so in this way users will unwrap the tokens that they have and only the tokens that they have is uh inside the wallet when they're actually not call this is actually kind of equivalent to the other way of doing it which is you also have a router and have the wallet holding all the funds and putting the things into the router so there's kind of two equivalent solutions to solve the same problem and the second problem that if you know if you were to do this which I think is the main reason why we don't have these things before you know is that for this type of privacy preserving show the pools you need to know the exact amount of tokens uh which is called you know that's including the nodes before um you insert it into the protocol right so so everything has to be known in advance whereas in D5 protocols you have no idea how much tokens you're getting back right so there's this uncertainty of smart contract decides how much you get back but traditionally for children pools uh you know everything has been only in advance uh and so that's this is like uh you know one feature that would you know didn't really know how to do before um and there's a solution for this which is that um we have this notion of refunding to Anonymous address uh so we have to be able to randomize accuracies and refund to them I realized I actually you know basically spread through my uh entire deck and the end of the talk um so let's recap what have you learned in this talk so first off privacy is really important we do not have privacy on ethereum we need some type of privacy solution for ethereum that's really usable before ethereum can go mainstream and a shielded contract wallet combining a shielded pool and control wallet is our best shot at this backwards compatible feature complete privacy layer and finally we're building this out um we you know hope to put something on the public and uh and the hope is that you know long term for this ecosystem most people will actually be inside you know a privacy layer instead of the standard uoa layer and if you're interested in contributing to this effort uh please come talk to me and I realized I didn't do a soft introduction at the beginning my name is wayday a research partner at Ben capricel and um come ask me if you have more questions about this project but I'll take any questions from here thank you hi uh congrats for the work I think privacy is very important I've worked for a few years on having trying to make users uh have Smart contract wallets by default and the big problem is the gas cost of of just having to onboard someone and already having to spend like ten dollars five dollars sometimes a hundred dollars how do you think that that can be solved um yeah very good question I think two things uh one is the you know actual cause of gas over time as we build these scalability layers should go down right as we build more Roll-Ups um and the second is uh we could use batching to um amortize the gas cost so usually you know actually in 457 there's notion of uh bundlers and aggregators where you know you compress authentication information uh you know from multiple transaction from multiple transactions into into a single authorization for for all the transactions and you know there's different tricks to kind of further optimize the gas cost uh so over time through these you know two Avenues the hope is that the the additional cost incurred to to get a contract wallet with privacy uh it's not prohibitive for for users for you know for vast majority of users uh great talk I'm interested in how you figure out ofac and tornado cache um because if this is like an opt-in where this person coming from hi over here oh yeah hi no how you think about uh because if you look at tornado cache and the ofax sanctions how do you think about sort of avoiding that kind of thing with because my understanding is that this would be like an opt-in smart counter wallet so how can you avoid that and kind of adverse selection and these types of things yeah so um so referring back to my slides where I showed the special Solutions you you know I think as a builder we should be flexible in kind of so good what is privacy right privacy is appropriate full of information I don't think privacy is as absolute notion where everything should be private to you uh you know there's there's some societal like consensus on what is appropriate for a lot of information right and everybody can have their own interpretation of that you know um government agencies have their own interpretation individuals in ethereum community can have you know you know our interpretation uh and they might be incompatible but I think as Builders we should be open to different versions of you know what is appropriate for all of information uh because technology is really flexible um and you know over time there should there will be communities that might be incompatible but like you know we should work towards the solution uh that's more toward the center I would say where we include as many users in your ecosystem as possible yet give some sort of control perhaps maybe to some set of people to be able to prevent illicit activities So when you say you're we're building this already how far have you got uh we have prototype contracts you know it's very early stage um uh yeah so the idea has been been there for you know a while but um the building is just just speaking of traction and you know we'll have basically two people full-time on this but why not embed these Innovations into an existing contract wallet like margin or something so this well there's many many different contract was out there with different Focus it's this is a contractual with privacy um you know I think it doesn't make sense to well I mean we could take existing you know we'll take the existing fourth of the seven uh you know standard uh reference code base and just you know fit this into there um if the main difficulties is actually not being a contract wallet I'll show you like how to add privacy I think because when you also changed the front-end apis so I mean every single smart contract all in have to do this but like I think for for privacy is more important because the a lot of command is seem to change right so if you think about how currently you pull balances ready accounts you first connect your wallet you pull like you know what is the connected wallet address and you like go to the contract and pull okay what is your action that balance that cannot be made privacy preserving right because you get who it is so you have to change that into something like you know connect to wallet can I get the usdc balance um you know so so a lot of things to change uh when something needs to be you know it's you want to imagine a privacy preserving system so I would love to collaborate with you know uh contract wallet projects uh and that's also another reason why we're trying to stay compatible with 437 because we can reuse uh we you know have the same bundler infrastructure and this you know account abstraction man pool so we will be part of that ecosystem and contribute to the efforts as well great Doug thanks uh what kind of uh what kind of zero knowledge protocol you decided to use um yeah so so you know as it turns out the easiest way to prototype something like this is circle still like there's nothing better out there that you can you know drive a zero dollar shortcut and have like solidly verifier and like a you know approval that's rather than like a browser circle on this the only ecosystem so this is like another ranks I would use you know the like most efficient proof system out there like it probably more like plunk but that tooling is not there um and also like over time it sounds like you're familiar with this type of systems but like over time uh there'll be like kind of two separate proof systems right so one is on the user side where you essentially want zero knowledge property only for privacy uh so you know what is this thing it's a the overall design is very similar to like any other show the pool you have a Merkel tree of notes right you're referring to a note and spinning it without revealing which no you're you're referring to right um and that for that you needs your knowledge to preserve your privacy and you actually don't really use extinctions and we're going to have this like aggregation layer that roll up these user spending proofs and for that you really want to synchronous right you want to be able to verify on the contract side really efficiently right and so uh you know I think this this is something that have been discussed a lot in Devcon in the past couple days which is you have the notion of inner proof and outer proof right so for us this inner proof will basically be the user proof that has zero knowledge right we can use I think over time you know which we'll probably evaluate things that's really fast in the browser adds to your knowledge and maybe some type of compression you know it's like maybe Spartan or something and then on the outer proof we'll have you know probably gross 16 or Planck that really compresses the other proofs right um yeah so one approach to solving this problem would be to make backwards compatible contracts on ethereum other approaches might be to wait until there's an L2 that has more Primitives built in that support this and I'm just curious to learn more about your thinking of if it ever makes sense that privacy will be in one place and non-private things can exist in another I think yeah so yeah the question is you know do we build privacy sources on top of existing things where do we build a new ecosystem to build privacy presumed Solutions and I think the key question is what are the Privacy supported and what is the features of those applications and um so it turns out that the short answer is there's no privacy preserving ecosystem right now out there that actually support more features the anonymity okay so if you look at like a Leo uh or like Mina it's really just a solution to build roll ups like you know with zero knowledge you cannot get privacy for share States so I actually discussed this in another toggle mine so if you think about the features we can support I think unless you have vastly more capabilities to support privacy Brazil Solutions which I think is actually in the privacy of share State um it doesn't make sense to have a complete brand new ecosystem because privacy that that's achievable is the same so there's no benefit to building a new ecosystem that do the same thing right so therefore so if that's the case we should build on top of the existing ecosystems because everyone is there we're desperately need privacy Solutions and it's possible to build it so you know let's not reinvent the wheel is it working yep so it sounds like you need a sequence of maintaining the Marco tree have you got thoughts on how you're going to decentralize that or whether you will yeah so there's actually kind of two two different things right so four four three three seven you have the notion of bundlers um and and we could basically use that so we could actually so bundlers um so I think it's yet to determine exactly what's in the standards but uh isn't that for every single contract wallet bundler needs to run custom code to be able to compress different user operations to one uh so we could it's interesting compatible to that standards when you know when it's more finalized to be able you know to to have essentially supplied into that ecosystem right so it could be like different 437 bundlers that's supporting different smart contract wallets and will be one of them and in that in that way we can decentralize uh bundling and the second is yeah so exactly so there might be this management of Merkel trees that's separate to many you know compressing multiple user operation proofs into one and we can make that permissionless yeah I think it's a current thinking right so um so it's okay what is the overall story is that so because we support backwards and platform I will support the exact same set of operations we like users need to pay more gas right it's like that's the you're paying the same amount of gas by default um and the additional things that's you know the overhead to like maintain everything and the idea is to like make it as small as possible and the only way to do that is to can Outsource these aggregated work into some sequence or bundler so so it's basically necessary if you want to make this really usable and so yeah so you know to decentralize I think you know make it permissionless and some really design incentives around this right that's because these are bundlers sequences are providing a service um instant Advanced behavior and make it provincialized and design kind of this ecosystem that's so self-sustainable right uh because because I think that uses wallpaper privacy uh if it's cheap enough and you can get this network effect right thank you so much boy [Applause]