Chih-Cheng Liang | Tornado Cash with Poseidon Hash

can you hear me yes indeed thank you very much um so today i'm going to talk about my one of my site projects so when people are like starting to learn about snarks one of the problem is that they they got a lot of material to read they got good articles three and but like when people want to start like develop something like okay how can i build snark and and how can i like have some real code to like write down and usually you uh the the the first thing you can find is something like okay i'm proving like i have two numbers then they are private and i can make like multiply them together and uh become like public numbers and uh they're kind of boring or something like i can prove like thousand terms of like fibonacci sequences but that that kind of uh you kind of cannot get a a sense of okay what what is the real usage of snarks and what what are the utilities here what uh what's the real user experience of the snarks looks like but uh when you look like uh projects like macy's or like uh zk royals they are like thousand nines of codes of circuits and that is like really an uncheckable for for beginners but there's a project called tornado cache it's very like um it's a very like tiny project only like like less than 200 nights of code and it's very friendly for a beginner to to start looking uh hindu snacks so yeah so i i created this uh side project it's kind of uh modifying the tornado cache uh based on uh dimitri corratorius uh update report and so that's uh let me begin by uh introducing what tornado cash is and while uh if you want to follow you can uh clone the the repo i post it in the in in a chat chat room and then yeah and then and and you can like run npm install and npm build and while i'm uh i'm speaking so the tornado cache is the uh non-custodial uh engine mixers and to provide a transaction privacy usually you have um you have some balance in one address and you want to transfer this balance to another fresh new address and you can send this balance to the tornado cash contract so what torino cash contract can do is you can deposit and withdraw and with many people deposits and those same people withdrawing but without revealing who they are and so for the outsider and um and the public uh public cannot know uh which uh which withdrawal corresponding to which depositor so so a larger as many people deposit and withdraw you'll have more like privacy in this total contract and under hood uh the toronto cash uh maintains a sparse merkle tree that has uh could be 16 levels or 20 levels and it maintains like um and history rules and um also and in the in the leaf of this tree is uh two secret values one is nullifier another is sacred they are like hatching together and you'll be kind of leave and this micro tree and see um this mimc and pearson are like uh stock friendly hash functions that uh vitalik talked before and they're just hash functions and also um so when when people deposit uh the user generate a random secret and nullifier and compute the commitment which is the hash of nullifier class hash and the contract will uh insert this commitment into the tree when you withdraw when you withdraw the uh the the same either you deposit into it you provide a snap proof uh proving that first you know the you know the secret value and know the hash of a secret value and those commitments are inside the um this uh this this uh commitment tree and then you need to provide a public value called nullifier hash which is a hash of the nullifier and the country will the country will verify the snack proof uh to make sure you are actually a members that deposit it before and then uh it saves um it saves the nullifier hash so even though you are anonymous you cannot withdraw the same money twice so let's uh let's see the project so usually when you clone the project you run so this project is built with node.js so you need to install the node.js dependency and to run npm build and this uh this npm view will uh first it will compile the the withdrawing circuit and do a trusses uh setup there are like two phases of trussy setup and also it will generate a verifier contract and this uh will sim link the verifier contract uh to the contracts directory and then compiled with the contracts together um so yeah so for this project we like replacing all the different uh hash functions uh into the best snark hash function uh poseidon hash function and so here we use poseidon for hashing the uh the merkle tree and also hatching the nullifiers we can see that um we have like improvement in like in terms of less constraint uh much less constraints and that could improve the uh user experience of generating the snap pro faster in your uh in the web browser and also the are they report uh suggested uh um improvement in the format of commitment and nullifier hash specifically it used only nullifier and plus is constant zero and as a commitment so no no need to have this secret here as long as the hedge function secure and also nullify hash it use the nullifier and also leave index so the benefit of this is you can reuse the same nullifier again although i don't think that's recommended but like when you reuse again you can like put the same commitment in like different leaves but then you can withdraw them uh like um like like like if you two you have two leaves in the tree you can withdraw two times and so yeah the rest are the same and but uh i reviewed this uh project it's mostly copy pasting by like uh rebuild using the um latest uh developing tools like either jazz uh later version of solidity and circum and hardhead and uh type jazz uh types of typescript and it's yeah all the happy tools so uh so just like npm round build should able to build the uh projects uh successfully and uh the currently uh is still running the trustee set up part uh uh did the turnout cache is based on the growth 16 and it has a um it has a circuit specific trustee set up so it uh it could take a while okay now uh the translation is done and now it's like compiling the contract and um and and uh generating the uh type chain uh yeah that says development tools and the next step you want to run is the testing cases let's go to the test cases and see we have a deposit struct and when we initialize this uh deposit it will generate a secret uh random buys notifier and you can get the property of commitments and nullifier hash here we developed um well we we deployed the verifier contract and uh and a poseidon uh contract and also the tornado domain contract and when we um the user uh so here we have three types of uh user um they use the actors then the first is the user with the old address and this is the relay usually you don't like withdraw the toroidal caches a balance with your own own account there's a service provider called relayer they can you don't need to trust them but like they help you to withdraw because they can help you pay the uh pay pay the gas and you can use the uh your clean new address that that hasn't that has no any either balances and okay so so the user flow starts with like generating a new deposit and send a transaction to the tornado cash contract and deposit with some value and deposit with your commitments and then then we'll we'll build a merkle tree or um of night this this mega tree can be built by thinking all the past uh deposit event and then we um okay and then we wait a while and then we generate um we generate uh the winners and the proof so the winners we need this uh public variables and private variables um you can see the notifiers are the secret and the leaf index are like your secret because they kind of identify who you are and uh these are like micropath uh hashes and elements and um and now we um yeah i haven't cleaned out this part but these are just like loading the verification key and the in the circuit wasn't and then we generate a proof and then run this uh we send we hit the tornado caches withdraw function and with the proof elements and all the public uh variables and then we run the withdrawal so this is what the test case looks like and let's take a look of what the circuit looks like the circuit has there's two circuits and one is withdrawal another is the merkle tree usually you can like skip the merkle tree and focusing on the withdrawal part is like less than 59 and it just uh proved that the you know the pre-image of the hash function and the nullifier hash and the commitment hash and then it do a miracle proof check and here has a like strange part it like kind of uh forced computing some like uh non-use for numbers but like this is important to [Music] like keep your proof to um to fix the recipient fee and repair and the refund so that other reader cannot like like front run your replayer so yeah so this is this is the withdrawal circuit it's just that simple and the the contract is also very simple it has a process deposit and process withdrawal and then we have um oh this uh the there's a base tornado contract and there's a east tornado contract that uh overrides some method and so uh this if these tornado contracts supports like uh depositing and withdrawing ether but uh so um there there uh in the toriel core there's also a contract that can allow you to send erc tokens to deposit and withdrawing erc tokens but i didn't implement here so yeah so if you want to have some exercise and like action items um you can like uh adding that erc20 uh contract that's the first thing you can do and second is you add a test case and to check that if i already withdraw once i cannot withdraw twice and once you finish that testing cases you you you can have a like better understand how this uh snark proof work yeah so i think uh my talks answer any questions uh two questions so one is have you talked anything with the cash developers in australian interest in terms of moving to the position and the second question is uh so there's two two uh steps in the two separates of itself uh what the consequences if either of them fail okay um good question so the first question um i didn't talk to cash people yet but i talked to dimitri but he's too busy take a look yet and the second question is what if the setup fails so um so simple answer is that if the setup fails you have to redo it and but um okay so so trusted set up because uh when you're using snarks uh if someone knows the um so in this setup uh you need to like generate a random secret that no one should have know that but if that uh someone knows that random secret they can create a fake proof to convince the country to withdraw and so they can do that double withdrawing so uh is there anything for both of their setups so like if the conservatives said there were two two steps it's like what happens with you is kind of the step one is like generic uh for for like for the all applications and the second one is for this circuit specifically so if you are like uh let's say you deployed your instance function and then you want to change some code and you you want to change the circuit and you you don't have to redo the phase one and you need to redo the phase two and usually the phase one there's a file in the dropbox that's like um that's uh weight j i think he's maintaining a repo that's like a trusted setup of many people but you can download uh that uh that phase one uh results like uh it's very huge um and and it takes a while to download and then and then you use that phase one uh setup to build your space to setup yeah uh does that make sense i think it since jordy is in this chat so julia has something to comment yeah hello hello hello everybody yeah just some com some some comments uh one of the things is that i see that the gas cost uh of the deposit is still a little high more or less it's the same order of magnitude that the current tornado cache uh i was guessing if this is possible because i 800 k gas is a lot and then instead of computing the merk so the the problem here is that computing the position hash on chain this is quite expensive so my square my question is if you have considered to to uh the idea is that when you are adding a value to the mercury in esteto instead of doing that on chain can you create a proof can you create a proof that adds this uh so you just create a proof that the new state route is uh this one so instead of 100k maybe it takes 200k that's what takes a proof this is one thing i know that you have the synchronization problems there and then you maybe you have to do it in in delay yet or even if you have to do it in two transactions it's going to be much cheaper that paying 100 800 k this is one one thing um yeah dude uh okay um do you mean like creating a star proof to do the deposit and without computing exactly so instead of right now i expect that you are adding the the a leaf in a mercury yes by so on this and then you need to compute the position hash function on chain yeah exactly this is expensive so the the the idea is why don't you uh so the days why don't you um at so you you just update the mercury so you just uh update the mercury route just so you you provide the new route and the proof that the new route is the old route plus your your your addition yeah i yeah i i think uh yeah i i think that's that's possible i i didn't i haven't investigated like like uh the the the cost of like hashing with kozadan the poseidon function but yeah i i could take a look into that and see how if that can improve the deposit gas cost yeah the other thing interesting in poseidon is that uh you can get a lot of earnings in at least in constraints uh if instead of using binary merkle trees you are using for example actually merkle trees then the position is very effective in constrained terms i'm not sure uh in gas cost uh when you are so when you're competing on chain this may increase a little bit but if you really want to increase so if you want to gain a lot of efficiency in the computing the proof uh so mainly reducing the constraints you can use um x-ray so you can use bigger so merkle trees that are that has more branches 16 branches for example it's a good number that's the that's the the the thing and then just a side comment is just uh yeah i see that in your test you are like uh computing the powers of tao file yeah it takes a while uh maybe you can download the ports of tao uh somewhere at least for the testing you will save a lot of time yeah but uh um yeah as long as i host it like some somewhere the base one yeah just just a cycle and i just forget just but yeah i think that that's uh uh yeah actionary tree yeah that yeah that's a great great great idea yeah they i i tried that uh that both idea that's that's pretty cool yeah for the first one the problem you will have the problem when there are many people trying to uh deposit at the same time yeah there will be great candidates but yeah exactly but here i think you can do things like uh delaying maybe like maybe the next the next uh the the next person that puts the deposit just uh generates the proof uh of a deposit that was done before something like that so you can you can delay so you can do it in two steps you know just you are uh preparing something to deposit and uh creating the proof for the deposit of something that happens maybe one hour ago oh uh but okay but that that means that new user have to wait the previous user to finish that one hour yeah or or they can do another transaction if they want to accelerate oh it's okay i see let's see oh okay in any case just doing another transaction with a proof just see the numbers you know uh right now depositing making a deposit is a hundred games if doing uh doing um one transaction with a proof is around 200 300 case okay so you can do you have margin so doing two transactions so if you spend 600k this is even much cheaper that 800 100k that you are spending right now in gas terms oh interesting but that's you know maybe maybe the thing is makes more complex ever just an idea to analyze yeah but i can yeah at least i can write it down as a youtuber people do to figure yeah yeah and do you have plans to deploy it to run up and deploy it no actually just like for fun no no friends don't want to make it production yeah no no no no plan to like issue government tokens or like so so mainly this is this let me translate what you're saying you're looking for some volunteer to deploy tornado cash anonymously somewhere right yeah let's share with you some tokens when lobster taiwan [Music] but if anyone want to deploy feel free to reach out to me or like it hello yeah for doing that it would be better not to run a trusses setup here just maybe just run uh try to run it with uh um with splunk oh okay yeah yeah right now it's not js is fully compatible with plonk uh i need to work a little bit more in efficiency because splunk right now is a little bit inefficient especially if you're running in the for but for this small circuit should not be a big issue so maybe you can just run in a plug then you don't need to trust the setup and then it's easier for somebody just to deploy it uh that's the circum has a punk verification contract yeah yeah yeah the last the last version of of uh snark js just using circum uh you just uh just check that out with me you can you can with silcom you can generate the prolong proof and you don't need to run all the trusses up so it's much much easier the only thing is that the the proving it's a little bit more expensive i think it's around 300k gas compared to 200k gas of growth 16 but you don't need to trust the setup so it's much much easier and the big problem here is that the proof generation in the snark js is it requires some optimizations there is margin a lot of margin to do but i have no time to spend on this but it's it's it's it's it's well it's over and for a small circuit i tell you it should not be should be not big issue oh cool yeah that that might work yeah um okay so prong no transfer setup yeah anyone why did they contact me so uh this is calvin here sorry to hop in but i'll play the awkward uh bsc guy here i actually think it's very interesting to try and deploy this on bsc as well just because it's cheaper to deploy but more importantly on binance chain there are no anonymous bmds because every bmp originated from not a mine setup it's from binance.com so there's actually a lot more of a need for tornado like products or anything that does do this mixing because anyone that makes any large withdrawal basically had to have funds come from a withdrawal from binet so therefore pretty much any large amounts or any large wallets could be kyc'ed and identified so maybe that's another interesting thing if you want to try a deployment there that won't cost you as much in terms of gas and also is probably going to be used by a lot of people that because now finance is forcing kyc a lot of people including our own impossible finance we're withdrawing our funds out before they reduce the uh amounts that people can withdraw from the exchange um to i think 0.06 btc per day so essentially useless for any project team or fund so there will likely be a lot of project teams that currently hold their fundraising profits or other uh you know treasuries off of a centralized exchange and this would be a very helpful tool to make sure that their funds are not you know traced once they moved to an unchained world sorry to to hop in and steal the threat here thank you but gameplay cc is taking over the world i gotta have a clone okay um any other questions or feedbacks but to be honest i don't know if this is a common opinion or not but as far as i i observed some of the most hardcore people they don't really like to embrace the anything on binance trend i mean buying a small convention because because you know any exposure to them or any development effort to them will just help the ecosystem grow and that's not something that some of us uh we don't see that but but yeah i understand what you mean you know certain effort on the financing can definitely help people to somehow escape from the i mean the compliance issues now finance is facing so yeah i have missed feelings about it yeah yeah for the record i i no longer work at binance i'm not this is not a page show it's just i i really do think a lot of teams that you know use binance before just because it was pretty easy to set up and that because it didn't require kyc that a lot of teams were willing to work with this 2btc withdrawal limit but that now with these more stringent kycs you know i would hate to see any project team essentially get their funds locked inside finance because they cannot uh you know proactively move their funds out anymore um and so this could be a very helpful i think use case to help these project teams as far as i know by i mean the the license of both toenail cash cash and and cc's version finally for cash they should be the same and if i recall correctly some one one of the famous talent celebrities in taiwan already fork their version own version of tornado cash so i think it will be up to you or up to the team in the finance training consistent to use that to soon their needs maybe yeah i think um i forgot i feel like it was another uh name uh maybe it's not tsunami it was a but it was another typhoon i think yeah let's try to think what is it it's a different storm but yeah there is some deployment there but uh yeah i i think the the point is that this is probably really helpful for any evm chain that's not east mainnet because of uh the fact that most of these funds bridge over like even axi infinity with their ronin uh assignment chain you know all these ethers getting bridged over from that big contract that's like what the second largest gas usage uh so i think there should be much more uh yes uh someone said cyclone that in theory should be the correct uh uh eastern hemisphere uh weather phenomena but uh yeah so you know moving these funds to these other chains i think does bring a lot more needs more anonymity because pretty much everything can be traced over or mapped over from whatever wallet you're bringing these funds over from and so to me i think that's a very neat use case and also a cheaper gas feed to deploy your contracts on these other chains um sorry i have a question for cc down so um you know right so um i was thinking about like tornado cash is like one of the kind of easy applications but it's like very practical and in terms of like application um it's kind of like as you said it's like very very varied right like it's they're like those simple ones which is not useful at all and they're really complex ones and tornado cats kind of in between i wonder if you um know if there's like any other that's kind of like kind of in this level of complexity or um about how how do we think how to kind of wrap up normal developers on using uh you know like these things to to develop like smart contracts like if you have any resources that would be very helpful um do you mean like uh the similar projects or or like the uh like development guys or something uh i would say kind of on the how to think around like using this um these proofs to develop an application right because because typically the example is like too simple that we cannot imagine it as an application right like guess guess what i i know this number but you don't know that i like that that's not useful at all so like tornado is really nice but i i also kind of uh i didn't search extensively but this is kind of the only one that i encountered so far so i was wondering if you have like others yeah that's a good question so so i would say once you uh uh get familiar and get comfortable with the twin door cache the next thing you should look for is the semaphore so the semaphore is kind of like generalized idea and you can apply it on any applications and and yeah after semaphore might be like um like macy or unibrad but yeah that that's our project for our team so yeah and um but i think semaphore is a good one after the tornado cash let me i mean type it signal for um