Beyond the Blacklist, The Compliant Way To Do Private Transactions I Howard Wu at Pragma Denver 2025

[Music] we're going to continue this theme again for the next talk and we're actually going to cover also how to you do these confidential transactions that are also compliant and for this talk I'd like to bring on Howard who is the CE of provable the team behind Alo so please give Howard a big round of applause hi um thank you for uh attending and thank you for your time today uh I want to talk about this title Beyond The Blacklist the compliant way to do private transactions uh my name is Howard I'm one of the founders of Alo and currently run the Alo Labs company which is called provable to really set the stage and to help give you guys context in terms of what it is that I want to talk about you know you've all heard this afternoon so many topics about ZK and privacy and why this is important I really want to take a step back and really try to set the stage to help you guys see you know from the from past Technologies why this is so important you know whenever a new technology comes uh there are good actors and there are Bad actors and with it um there are different ways that a technology evolves and if we look back to 20 years ago 30 years ago when the internet was starting to come about you know there was a very key pivotal moment that really started to unlock what the internet became for us today and that was https and that was encryption you know this technology enabled trust and it unlocked e-commerce for all of us today and we take it for granted now in all of our systems if you look forward now to where web 3 and where crypto is at we're seeing a very similar type of Paradigm arise and what I mean by that is if you look at the payments space today in crypto we are such a small dot when it comes to encrypted payments this is such an early stage phase that we're in right now and it's because the technology is incredibly new and the technology that I'm really calling out here is ZK with this right now we have something like 27 trillion dollar in payments happening in crypto just last year but only 0.01% of it was actually endtoend encrypted and that's saying something I see that there's two primary problems with the current design and the current way that we've gone about this and there's at least one solution that I see in terms of how we can solve for that and the approach that we're taking really is to try to solve for these types of problems the first is to say that fully transparent blockchains overexpose data and it puts users at risk so take for example um you know a user journey of money in crypto today if you want to go to your local coffee shop and you want to buy coffee using usdc well you you probably don't want the Barista to be able to know um you know your wallet address because suddenly it reveals to them how much money you have uh how much money you make how much money you spend how frequently you spend and they can track this type of information for the rest of time and that's not a great user experience for for users who actually want to use crypto in day-to-day real world payments the second problem is you can't just sprinkle encryption on blockchains and call it a solve problem and the reason for that is it's difficult to create the flexibility and the fluidity of what you need to be compliant in a fully encrypted blockchain and we've actually seen this with existing blockchains try to do that um and offer encryption uh uh for for crypto the approach that we're taking is with a new blockchain that's called alo alo is an L1 it's an L1 that offers private smart contracts and what makes it different is that it is at the intersection of several unique properties the first is that it is permissionless the second is that it is programmable and the third is that it is privacy preserving the goal is to make it so that you can build your decentralized applications as you could on a blockchain like ethereum or like salana however you can also have private shared State on it and this is a very important piece and I'm going to talk about why in just a moment but right now this is a very unique technology it's one of the first that's out there and available and for us we see this as a landscape that that we think is going to completely change how payments work you know just as I mentioned with the diagram of the stable coins you know this is another diagram to try to just really give you an idea of where blockchains are today the folks who have tried privacy preserving blockchains and where we think this is going to go next which is having programmable privacy so there's really two areas that I think we really need to touch on the first as many have already spoken about is privacy and I think that the second area which is often uh often not looked at close enough is really compliance you know today there are many different types of schemes that are being proposed for how you do um blockchain addresses blockchain wallets and blockchain transactions you have this scheme in our case we use something called the private key to the vew key to the address model and the vew key is really the heart of of what makes this different um in a V key you get some strong compliance policies for one uh you allow for third parties to be able to see specific transaction history you also allow for other people with this vew key to be able to see all transaction data but it also provides you some stronger guarantees for instance I can use a v key to verify that a user has no transactions with uh ofac sanctioned accounts for instance um that their interactions in the his in the past have been correct or have been cleaned theyve been done properly um and even more so um this is something that can even be threshold shared so that you can have uh policies Beyond just what the V key itself entails um and allows for requirements to be hit so that a threshold number of parties need to be um uh complicit in order to reveal um some information from your account now this approach of ukis is being actively explored by a lot of teams but you know the purpose of this talk today is to really talk about how we think about compliance when it comes to private transactions and there's a few key areas I'd love to tuck on uh touch on Beyond just vew keys this is really starting to get into this idea of going for compliant by Design tooling and the first is really to think about it from the true General smart contract perspective um right now Beyond just vew Keys what we need is an ecosystem of teams that are building compliance and Rule engines so to give one example um on this slide we mentioned predicate predicate itself is developed a policy engine that provides smart contracts um to Define rules for onchain transactions and you know this type of approach of having a compliance engine a policy engine at its heart is something that will allow for third parties including regulators and policy makers to actually be able to look and inspect at transactions at the level of detail or granularity that they need in order to determine whether the transaction is malicious or honest behavior and I think that this is something that you're starting to see also with a lot of the analytics firms out there you know as you probably just have heard from from some past talks there are many teams that are exploring privacy at various um degrees of Integrations from you know very specific purpose uh applications like private staking or private private swaps all the way to the general purpose private smart contracts and at every one of these types of implementations and use cases you're going to need to have some level of compliance that is going to satisfy not just Regulators but financial institutions and end users at the end of the day and so we think that having a general purpose programming language that can Define rules and provide a compliance engine is going to be a very important part of what this industry becomes the second is really to Think Through verifiable credentials so um we have an effort called zpass it's uh an idea for providing uh identity for users by which you do not have to disclose all of the information about yourself so to give you one concrete example of this in action today um people are using this technology in order to provide attestations that uh for example I'm over the age of 18 uh without revealing uh to other people uh my birth date specifically um it can also provide uh specifically for example claims of my citizenship And my nationality that I am not coming from a sanctioned country for instance and this is another type of thing that we believe is going to be very important to have live on chain so for example when when you think about um real world assets as they start to become tokenized into crypto um most of the time times those types of assets are things that may need to start off in closed loops and more so for you to join a Clos Loop you may need to provide attestations that you are an accredited investor uh that you are above a certain age uh that you may even have a certain type of background and that allows you to qualify to participate this is something that we've seen already actually as something as fairly standard when you open a brokerage account um to trade Securities today already um and you know when it comes to coming into crypto we think it's going to be something that's going to be very very similar a third area which I think is going to be quite important is really looking through time locks and escros um you know when uh we have this bridge right now that's on Alo which allows you to move assets like eth and usdc from ethereum over to Alo and back um the goal of bridges like this is really to enable uh users to be able to have not just public uh uh versions of these tokens but also private versions of these tokens so you know I think that long term a huge part of crypto is going to end up being private and it's because users want to make sure that they retain ownership over their assets that they have uh the full control of visibility and the full control of ownership over their assets and time locks and escros are an important part of ensuring that we're doing sufficient due diligence when you're trying to move assets across l1s and across l2s um so having this type of component gives time for those who are setting those rules engines or policies to be able to do analytics correctly and actually verify that these transactions um are coming from honest actors uh with honest intentions I think the last area to really touch upon on here um is about engaging with policy makers so you know I think for most of the people that are in this room you know what I'm talking about here may not be rocket science but I think outside of this room this is very early ideas we're at the ground floor of new types of capabilities that have been only possible in computers in the last 3 to four years and are only now starting to make their way into the market in the last 12 months and because of that it's on us as an industry to also try to Define what we believe are best practices and hold ourselves accountable to that so one example is with uh this community proposal called Arc 100 that was proposed by uh the executive chairman for uh the foundation here at Alo and the goal here was to really to propose compliance best practices um for Bridges and for validators that are being adopted by the community and this includes some of the techniques that I just described um along with some others and you know this is an ongoing conversation not only in our ecosystem but also across many other ecosystems um in addition you know there are many advocacy groups uh many of you may know of blockchain Association and coin Center you know I believe that these are teams that are going to continue to be an important voice and Champion for the industry as um we start to develop uh what we believe to be best practices in this case for a chain like Alo and to really set a standard for other other ecosystems that are also pursuing um private smart contracts or private applications um to be able to be compliant and and operate in a way that allows for regulators and for third parties to inspect information at the time that they need to be checked and it's not just us who are saying this actually um there are many folks uh uh in Industry um that we work with and and that are that are already here you know even in this room uh that are saying that this is an important part just to give you two examples uh miles Jennings who's a general counsel over a6z crypto has pointed out that the Alo Network being one of the first to Market here with private smart contracts um is pioneering technology that enables developers to build applications that safe saard user privacy and more importantly comply with local laws and regulations and uh Michael Michael mosio who's uh one of the former Fin and folks um has made the point that ANF is leading the way to empower developers to doubly protect users with a high performance combination of privacy as security and configurable compliance um adaptable to jurisdictional expectations and I think that that is probably the more important part to call out is that different different regulators and different jurisdictions are going to have different requirements and this is where we think the idea of using private smart contracts is going to be a very pivotal part of getting this technology out there um there's no one- siiz fits-all for everybody and you know even the techniques that I've just defined here I believe are still very much in their infancy and we're going to be testing different limits for them for instance with time locks some have proposed setting it to be what is the absolute minimum necessary which is for example on ethereum today to be 15 minutes in order to reach a checkpoint and have strong confirmation that your transaction has been confirmed um there are others who are saying that you need up to 24 hours for instance in order to provide for analytics firms the ability to inspect this transaction and give them adequate time to give a response that um the transactions that are being uh being uh sent over a bridge for example um are actually uh honest and uh and and well-intentioned now for those uh who are interested in exploring a technology like this you know I certainly encourage you to check out alo alo is the first privacy preserving blockchain that coinbase has launched as a day one launch partner since 2018 um they've been offering validator staking custody and listing support um and for those who are interested in building on Alo um there's a few areas that we think are going to be incredibly interesting to tell a story about um specifically around payments and commerce I'd like to walk you through just some of the ideas that we have um and certainly uh some of the teams that are building on here now um there's four areas that I think that are going to be quite interesting when it comes to privacy uh on blockchains it's really going to be payments identity gaming and defi when it comes to payments you know having uh having assets like stable coins be private is going to be an important part of the user Journey why um well let's take the user journey of buying an anniversary gift for your spouse um being married you probably know your spouse's wallet address and so if you want to buy them an anniversary gift um You probably don't want to reveal to them um all the data associated with it because being your spouse you probably know um well there address and you can then look up uh one when did you remember that our anniversary is coming up um two you can just see where you bought this gift from and three most importantly uh you can know how much you spent on your anniversary gift uh I think that this is a fundamental break in the uiux uh uh Journey for money uh and I think that this is where private stable coins can actually help to solve that problem it's effectively giving you um what is um bank account level privacy that you're used to in web 2 already now in web 3 um and so I do think that this this use for payments is going to be quite big secondly is with regards to Identity um for those of you who are based in the US you may have seen there's been ongoing conversations in several States um about adding age verification and about adding identity verification um to websites uh when you go on the web um I think that this is something that you know there's first iteration Pilots zpass is certainly one of them um however I think as time goes on you're going to start to see governments themselves uh explore using crypto-friendly Primitives and ZK friendly Primitives to issue national ID cards and to issue passports with and I think that this is an area that is ripe for opportunities um to be able to prove that I am for example a part of a set um of of individuals whether they be accredited investors or to be that I'm a US citizen or to be that I'm a part of the set of folks who's over 18 you know for those who are technical in this room you can think about it as Markle set inclusion and also proofs that of set non- inclusions um and having a blockchain where you have Smart contracts that are crypto friendly and ZK friendly will allow you to build those types of Primitives and actually deploy it at scale the third area is with regards to gaming you know for those who have tried building games in crypto especially on a blockchain like ethereum or salana you probably quickly realize that gaming is quite limited and what I mean by that is um on these types of public blockchains you can deploy games like chess where the board is fully visible for all players and all Spectators to see and and those types of games work on ethereum because there is no hidden State there's no hidden game state but if you want to deploy a game like Battleship it doesn't work so easily on a blockchain like ethereum you know for the cryptographers in the room you could argue that you could try a commit and reveal scheme uh to try to make it work uh but I think for most who are product folks in the room they may be quick to point out that while that will require several block times and block intervals it it slows down game play and it makes it very cumbersome on the user to have to constantly approve and sign each individual step what makes a private smart contract system so interesting in power for gaming is you now open the world to information asymmetric games so a game like Battleship can easily be played because you can hide the opponent's board on the smart contract on chain itself but even more so for games like poker where you have game state that is hidden between multiple players this is also an opportunity because now can deal cards to you that are only visible to you and not to any other players or to the house in addition by having a chain like this where you have ZK at its core you can also have strong verifiable integrity and what I mean by that is for example if I want to spin a roulette wheel or if I want to roll the dice I can prove to you in ZK that I did a fair Shuffle or that I did a fair roll and that is an opportunity to provide stronger Integrity for users who are gaming on the web and lastly of course is defi there are a few protocols that are already deployed on Alo today and one of the key features that they Leverage is this ability to provide confidentiality when you trade um why is this important well as you guys can probably tell uh crypto assets like Bitcoin like ethereum salana they're starting to make their way into mainstream financial institutions one of the main challenges though is that everyone can just see what everyone is holding and that that is a huge problem uh not just because you start to reveal what you're holding but also because every time you rebalance your portfolio or every time that you make a trade other people and everyone in defi can just simply copy your actions um by having defi on a system like Alo and by having Bridges from Alo to other l1s and l2s you can move your assets here store them in a confidential wallet and you can trade confidentially on a platform like this providing you not just banking level secrecy but also banking level privacy and and compliance and so this is an opportunity to really change how dii works and also open the doors to new types of applications like dark pools with that um I'm out of time uh I want to thank you for for your time and uh if you're interested to learn more please uh check out Alo and also please follow me on Twitter at uh my handle is one Howard woo thank you very much [Music]