Private Exchange on ZKOPRU by Takamichi Tsutsumi | Devcon Bogotá

foreign [Music] and he's gonna tell us about a private exchange application that was built on top of ZK Opera yeah thank you for coming my name is takamichi today I'm going to talk about the Private Exchange yes I'm software engineer at the privacy and scaling Explorations team at EFM Foundation and yep say I want to explore a privacy preserving decentralized exchange on gko proof for this project we are aiming for more private peer-to-peer exchange system and private exchange consists of three different zero knowledge protocols to protect users privacy and I in this talk I'm not going very deep on the technical details of the protocol but I will show how those protocols works and how the protocols are used in private exchange all right before diving right into the private exchange um let me start with one question so why do we need privacy I think there are many reasons for many different people and for many different use cases so I'd like to share my opinion on this today the Privacy is important because it can contribute to censorship resistance like own public blockchain like ethereum like the transactions on the all the transactions on the blockchain are all visible to everyone so it can be censored um mostly like in a smaller Networks because the number of the validators and the block Builders are later to be relatively small to the censorship likely to be happened more often for example um if you want to spin up minor roll up on ethereum this is the case and for second it also can mitigate the Mev or front running if the privacy of the transactions can be kept at work to prevent the mov and front running but most importantly it is a human rights the Privacy is a human rights here is a quote from the universal Declaration of the human rights and article 12 so my opinion is we don't need any reason to work uh um protecting privacy we need privacy because it's human rights and we should care when we're building an application and today in this talk I will walk you through how we approach um to protect privacy when building a decentralized application like private exchange all right let's get into the interesting part what is private exchange and how it works so what we are trying to achieve with the Private Exchange is to make exchange process more private yes very simple and don't let users to expose their information or intentions that's our goal here so what exchanges do exchange let users exchange their tokens in this diagram Alice sends 1.0 if to exchange and gets 1050 500 die in exchange there are more functionalities but I'd like to focus this one function today and there are two popular constructions in decentralized exchanges today the first one is automated Market maker in this kind of Exchange users can typically users can exchange their tokens without a counterparty this means that at least just interacts with a smart contract and doesn't need to anyone else doing an opposite trade the price is calculated automatically in the smart contract and others can exchange tokens on that price the second approach is an order book in order book Alice puts something called an order to order book and the order contains information such as token pair amount and a price in this example I just wants to die in exchange of eight an amount she wants is one thousand five five hundred die and the price is one thousand and five hundred die per it and if there happens to be some other order by Bob who wants to do the opposite trade attending one thousand five hundred die 4 1 8. then the order book attempts to match the orders and execute the swap transaction by sending transaction on chain and one thing to note is that order books can be on chain or of chain if the order book is on chain Alice Post an order to the smart contract order book then Bob finds the order on the smart contract and takes it by sending transactions and if the order book is of Jane there is typically some intermediary order book provider that collects all the orders and trying to match the orders but in either way the orders bulb and Alice sense includes the information that uh order book provider or smart contracts can find a pair okay now it's time to think how we can execute the process more privately in order to make exchange process private we come up with a relatively simple peer-to-peer exchange system and it is some somewhat similar to an order book construction here but it tries to keep information private as much as possible so let's look at the Autobook diagram again here we can see the parts that are not private in this diagram the contents of the orders Alice and Bob sends to the order book are not private and the transaction that Autobook sends to the blockchain is not private so how do we make this more private here we use three zero knowledge protocols blind fine and socialist millionaire problem and zko Brew foreign let us think of how we can make others more private in the order book system order book is the one who collects all the orders from users and make matches so Alice and Bob needs to send the order data to the Autobook provider but if they can compare prices and make a much a more P2P way by directly directly sending messages to each other then they don't need to reveal the data to the order provider at all oh wait how does Bob Reach Out Alice in peer-to-peer Network we use land find protocol here land find is a network that peers have neighborhood lists and Bob can look up Alice and prove that he can reach to Alice in the network but importantly Bob can search for Alice in the network but without revealing that Bob is the one who is searching for Alice so the neighbors that receives a message from Bob will never learn that Bob is the one who is searching for Alice so in this way uh Bob have like some privacy of that key um have some intention to take the Alice's order in the public aboard now a bob can reach out to Alice to execute the peer-to-peer order matching thanks to the Socialist millionaire problem here we can do the private peer-to-peer order matching socialist millionaire protocol is used to check the equality of two values but without revealing the actual values so the idea is that they have some numbers in mind let's say Bob have X in mind and Alice have y in mind then they don't directly um sending the original values but instead they derive some values by by calculating um some mathematics and also they use some random values and exchanging messages then after the exchange uh complete they can test that if the original values that Bob has in mind and Alice has in mind are same or not but here Bob cannot calculate back using the received value to y and Alex cannot calculate X from the derived messaging values foreign and we use this protocol to check if the price is that Bob wants and Alice wants much or not and here's how things work in private exchange so firstly Alice creates information to public board but without a price we call this an advertisement and Bob finds the advertisement on public board and search Alice in the blind fine Network the price matches they proceed to create transactions and this way we could omit the intermediary who acts as comparing the price and making making a match and preventing posting prices they want to public now the order is partially private because they can post an advertisement without a price and now we should think about how we can make these transactions right hand part private so here comes TKO prove DK opru is an abbreviation of zero knowledge optimistic roll up we use ticket proofs for privacy and optimistic roll-up technology as a layer to technology protocol and in essence we can make secret transfers with a cheap fees we can prove that those transfers are valid using ticket proofs but without revealing the contents of the transfers but there is another thing a secret Atomic swap so there is a feature called Atomic swap on zko Brew and let's say that Alice and Bob agreed on Sam Price using socialist million problem and they can create they want to create the transactions called Atomic swap to make swap transactions or a pair of transactions and has to be included in the same block so in this uh case Bob send Alice 1500 500 die and Alice sends 1.0 is to Bob the two transactions have to be included in the same block and if not it's not valid transactions anymore and of course the transactions contents are secret even block Builders called coordinators cannot see the contents of the transactions so using the secret Atomic swap the transactions sent on the blockchain is private now so here is a diagram complete diagram of the Private Exchange all right so let's go over the private exchange flow again so firstly Alice and Bob joins the network called Blind fine so that they can reach to each other but without revealing that they are finding someone in the network next Alice posed an advertisement on the board but without a price and next Bob finds the advertisement and Bob search for Alice and a blind find if they successfully Bob finds the Alice he start executing socialist media on a problem to compare the price that they want and if the price are same they can create Atomic sub transaction and send it to ZK Oprah in this process advertisement is partially private and price matching is done privately and peer finding is done privately and transactions contents is also private so what I've talked today is one simple example of a privacy application and what I talked was firstly I started with a what does this application do so in our case it is an exchange so exchange let users to exchange their tokens and in that process which part of the exchange process is should be uh private in our case it is an orders and transactions sent on chain and lastly I talked about how to make those informations private we use three general knowledge protocols line find and socialist millionaire problem and decal Brew and as a result the private exchange does not reveal transactions content and it does not reveal price of the orders to public and it also does not reveal the peer-to-peer routing in the network but at the same time there are challenges in this constructions firstly socialist maybe on a problem can check the equality of the values therefore it's not easy to compare for example to use a range to create a match so in the application it's harder to find the counterparty elect Bob if the SMP can work only this way secondly and advertisers needs to stay online while waiting incoming social estimate on a problem messages so Alice after sending advertisement on public board she has to stay online until Bob shows up and finally users need to join line find network before starting the process and also run the blind find process while in the application so these are the challenges and it directly affects you the user experience of application but some of the challenges can be mitigated on the application layers but some other nice Improvement of the cryptographic protocol layer so in privacy and scaling exploration scheme we do many privacy projects like applications and also cryptographic protocols to improve privacy in this blockchain space if you're interested in those Projects please take a look at our home page and Discord and I want to give a shout out to the TK Opera team once up Jane Jimmy Geo chance jelly Rachel thank you [Applause] um questions please um first quick question is the s p uh interactive or non-interactive as interactive so you so you have to basically so like if there's a list of advertisers a user will have to communicate with every Advertiser right yes so this doesn't really scale well as it increases is N squared like complexity for yes okay so that's that's uh yes that's also uh our ux challenges as well yeah sort of on the same vein um one question I had was um because you know you still have to do the SMP to find the price um you sort of know a general idea of the price because you have other markets that you can measure the price from and so um is there any prevention mechanism for like a mass de-anonymization of the of the price the ads uh in a way that somebody could just keep trying to uh discover the price and build up an order book that sort of matches the expectation of the ads because there's no obligation to actually trade on any of these ads right so you could just try to Brute Force um figure out the actual order uh yeah yeah yeah um so uh for current implementation we don't have like such features but as you said it needs like the uh many times of SMP trial to find a the price matches and also we don't have like the prevent it to prevent such details like types of attacks right now so yep we need to uh work on that ux Improvement as well thanks thank you [Music]