Coin-mixing Service for ERC-20 Tokens by Frederic Fortier of Enigma

okay so enigma is a privacy layer for a theorem what it does that it enables the centralized application to compete over encrypted data and we'll go to the detail because I care about the words we use trusted execution environment to accomplish this we can compute on arbitrary we can perform arbitrary computation it's like a different this is an overview of the network itself I'm just gonna go over this very fast Victor already but ultimately the way it works is that we've created some client libraries that can be used in an application for example a GUI application that web application where inputs of a particular computation can be encrypted locally then those inputs are say or sent into the England Network a network of workers you see here in the middle to run in us in a secret contract so suppose you had a secret contract for policing and you're trying to send your address the address you want to send your coins to then you would have a pre-deployment in contract you will encrypt your address and then locally and then you would send that to be network in a worker one or many workers on the network will perform the computation the function that you're calling for the coin mixer once the computation is done the encrypted input will go back to you as the caller and you're free to decrypt it which are keyed and welcome to body else can access them in optionally a secret contract function which is our smart you can call a material function and you might do that if you want to after coat after a secret computation publish some aggregate principal this is kind of hard words now coin mixing when it seems sort of the first situation that we're doing by welcome so the reason we're focusing on citations is a great fit for our network and we see that there's a problem right now with Tyrion transactions being public of course when you transact with a tailoring user of your wallet which is pseudonymous but there are more and more ethereal maps and some of these dax I don't know I have key white seas and other things that the anonymize you and presumably if you'd be anonymize yourself once someone can easily analyze the chain and see you are everywhere that's no good so the solution is to really work out the easiest solution and the one that we're focusing on today would be to mix coins to hide to hide user in history so since CDI visit should take the coins and send them to another address that is fresh now there are twenty some point mixing solutions even only in the theoretical system there's been some Bitcoin for mixing solutions for a while but there are problems with first of all there are centralized mixers but these are they don't have a great reputation you can easily see how they could be honeypot like you can you mix your coins in servers these servers easily know who you are you know ever together there are some decentralized mixers that are being built right now and release but you know a lot of it have problems especially the ones around the ones around zero knowledge proof tend to be expensive and cumbersome we're going to some of these and especially with these mixers also like they may not be secure so if I move together and you guys are familiar with zero knowledge based mixers but the wind works is you make a deposit and then from that after making a deposit you receive a note and that note certifies that you made a deposit for a certain amount but then whoever has that note whatever you do or someone else can we draw out that that amount so essentially you have to keep that little safe otherwise it's visibly a blank check to anyone to draw them out and you have to do this withdraw transaction where if you're trying to send your coins to the brand new wallet that hasn't been touched just created then you have this Genesis problem where you have to have gas in this the ffs eat in this wallet first pay for the gas of withdrawing in those coins so you need to have maybe some points that you bought from a guy in person or if you mix it before it's complicated and of course these mixers are finding some workarounds for this meaning say using the relay er but the way that they use this flare makes it possible for this relay the anonymize yourself and this like you're sitting behind like a tour and your DNS is then and you know so the create so pretty cumbersome user experience and most select one that could be unsafe so why would we build SATA this kind of a response to what I just said usability we think that it's a much easier solution and it's kind of a fire-and-forget thing we just made a deposit later and the costs also like you know certain large groups are expensive things and the apartment many transactions including the draw and our solutions visited single transaction so we're gonna make a so yeah why do we just present this today with regards thing of protocol because it demonstrates some key features of the protocol it demonstrates how to use encryption libraries in in secret contract which is a use case it is going to come up for any any for most any more identification this idea of proxy encryption and also it shows what to make interim call back within within stupid contracts which is also of your future yeah so essentially yes salad is the product things anymore basically mixing is a coin joint limitation it's non-custodial and non-interactive they're not an interactive part is what's a is it to earlier where you don't have to come back to make withdrawals and positive fountain is ready in requires some thresholds which requires that each I call the deals the coins that are being mixed lieutenant group of public appeals so each deals our course or number of participants require a time interval and so forth so that's pretty much what the product is okay so this is a demo I'm gonna run this at least today yeah I'm just gonna run through it so essentially you see here on the left there was a browser where we were just avoiding the application the salutation and then we left the log of meetup on the right-hand side so you can see what's going on the word is doing right now is it's fetching a encryption key from the Enigma network in order to warm up the application order to be able to work it needs this encryption key to encrypt the users deposits now I'm just verifying as a user my account and I'm selecting this account this mini mask account as the sender and I'm selecting my recipient address this recipient address is never leaving the browser it's getting encrypted as soon as it's submitted and I'm selecting the deposit amount from one either now I just made a deposit in an interim contract that is locked in now I'm coming back with another user see I'm switching here my user to account to so we have a deal with two users in it you know now I'm sick my sender is me the disorder beside respect and then another recipient address doesn't matter right now the amount is reformed so we became one which we look we're going to make so now because this deal had a quorum of two so it required two participant to be executed when the second participant made its deposit that triggered the deal so now the deal is being executed and that's why you know there's there's more things going on now what we see here is almost impossible to see that so should we see any mark receiving the deal decrypting the recipient addresses and outputting some knock message and mixing the deals and now you saw the notification at the bottom saying the deal has been executed essentially which means that the deals is being sentenced planetarium so after edema mixed the addresses and also committed these addresses and the information about the auditorium and the funds were distributed to the recipients I know that was great but hopefully make some sense you can check it out in the code and everything on this that can be a good starting point when you're building an application again it has uses some she has to buy and it's useful so how it works just going to summarize because I try to expand who's running the basically there's a deposit contract on ethereum which will which holds the funds of the participant so say there is two participants in a deal it each provided one either first thing you're going to do is to deposit this one heater on a neat area and dandy there's a secret contract which randomize the recipient addresses so very gonna take their address where they want to receive the phone encrypt this send that to an anyone secret contract and the secret contract is going to decrypt this and reor just shuffle it so that you know who the participants are who the recipients address are we just don't know which participants associated with which which recipient address the only thing that knows this is the Enclave the trusted execution environment of any model human information and there's also relayer that or operator aka Oh further that were using here and the purpose of using this is it makes the whole system more efficient so instead of each end users making a transaction in each area or in a lot for you know after their deposit what what we're doing is we're sending those encrypted and that's the key we're sending those recipient addresses encrypted to their their so that the reader isn't able to be anonymized a user in any way and the reader just kind of holds onto it and submits it in batch to to lading moment is done and also the prevents spam by giving some accounting for example making sure that the encrypted address that's been received and is associated with the right account that has deposited it's fun you know so it basically does accounting to make sure that the deal is properly funded before sending the data to the pneuma for for mixing so this is my colleague who works with me so this is kind of Pavia this section here doesn't describe how to deploy a secret contract way to describe how to the application warms up essentially so well yeah it's possible the key here is when the secret contract gets deployed it generates a key and that key is what is being used for encryption by the users who want to submit their deposit so when the secret contract gets deployed that he is generated and in when the real air comes online it fetches the the public key of disrepair and cashes it and gives that to each user as a way to encourage their recipient address and the users of the system don't use that to directly to encrypt we use like a DPL Man scheme where users generally don't compare and take the encryption public key deriving from this it's kind of just just described I call you cryptography I hope point being that the recipient address is always encrypted until it reaches developer okay so to go over the flow artwork somewhere specifically so first the user gets the public key from the reader to encrypt the recipient address as I just mentioned then the user sends is deposit to the TMC smart contract at the end user increase its recipient address where the mix coin should be sent and some myths signs this and some instances of the operator and this is what I was talking about where we use a thief young man and we do a local perform local encryption of this recipient address to make sure that it's not known by anyone other than the user this is all of them literally using a client ivory that we built javascript library then the corporator received new receives those submission those deposit and watches for the threshold to be met so for example if a deal requires two participant to execute then if the operator receives one is going to first verify that the deposit is indeed in this in the smart contract that the signature is valid then it's going to wait for the second participant that's what you saw earlier when I was using this system and also the second participant and yeah so when when when the conditions are met essentially the operator is the one that submits the deal information and the contract [Music] so yeah I could this is here just describes it the parameters of the deal like each deals inclusive number participant deposit addresses the sender's address is in the encrypted recipient addresses and so forth and this is what's being sent to it when this so see the section here is important this is what happens in the secret contract and mixing is being done so remember we just had a operator detecting that the new deal must be created then the operator sends the encrypted recipient addresses and the other deal information to the any must secret contract and the in my secret contracts has some business logic that is written in rows as Victor showed this morning that decrypts the recipient address again using the reverse the elevation scheme decrypts the addresses and enigma also has a randomness services so it's very important we as part of the secret contract api we provide a randomness service where one can get a random seed that is generated from the electric current that passes through the secure Enclave so basically like your randomness it's quite safe saving that music impossible to predict so this is how we reorder the atrocities in that print in this service so once once the work is done like once these any my secret contract we mixed those addresses now no funds have been redistributed yet - right anyways I'm pretty capable of doing that on its own so what happens is that anymore has a function which is called an ethereal callback so I've heard the addresses have been mixed decrypted and mix this secret contractor will perform a callback to a material smart contract the same smart contract that holds the deposit saying hey here here are the order recipient addresses and then the smart contract we verify again the parameters of the deals will receive these ordered recipient addresses and will then distribute the funds to these addresses I've took performance under the correct verification to ensure that all the time so that kind of describes the workload of the qualification and you see here that there the sensitive data we're only available once when they were in the Enclave everything that's happening outside of the Enclave is either for the users eyes only it sounded up or available publicly for this stuff that's been pushed to the area simply for the financial and one thing that's important to like to point out is in this particular application the Enclave is trusted for privacy correctness is actually ensured by theory on itself which means that well suppose it's impossible that in my play will ever be corrupted but as this was a theoretical attack that and I'm claiming to be corrupted somehow then the words that could happen is that the user addresses the anonymous not that forms will be stolen from the users so there's just a characteristics was characteristic of this application and the kind of things to think about think about the creativity of data you know and try to try to make things as correct by consensus as possible yeah and there's also like this notion of gas so like eating ma requires gas and similar to material but just is faded Engr okay and there are different schemes there like for example in this particular case we achieve economic abstraction because the real air is coming brokering the transactions so for example if a user mixes some ether the UI will tell the user okay you're mixing one ether you're going to receive 0.99 whatever you know - the cost of the transaction is and that cost will be the cost of doing business for the operator so the operator programmatically would know how much he and GE has to pay to submit this transaction to enigma and we'll you know take it cost from the users deposit to cover this like fully kinetic abstraction where users don't have to worry about only dmg and similarly the worker the enigma node that performs the computation and commits the results back on chain has to pay the carrion gas for this and similarly he gets compensated in Eng which covers this cost of doing business which is now in heat it's it's kind of the reverse dynamic for for the worker but you know the form being that there's economic abstraction and there to manage the cost of this system yeah so just a comparison here essentially between like salad and some CKD based system but you can see we've done some analysis on the gas bus and estimated that cost about five to ten times less in gas to makes a voluminous ezk basis and a lot of it has to do with the cost of the Graduate in your knowledge of cook on chain and even if it's not for that it also has to do with the fact that there needs to be a withdrawal transaction for each participant while with enigma it's like a single distribution transaction and there's also like usability differences in Ezekiel based solution as mentioned earlier it's interactive meaning that you make a deposit you have to hold on to your ZK proof like your note and then submit that at a later point to withdrawal and some of these implementation have taken some interesting work around where you have to leave your browser window open for 24 hours you know and hope that it doesn't crash it can submit the key for you right so I'm not so sure it's gonna work well but in our case in the case of salad all you have to do is basically make your deposit and because of the sort of cryptography that we're using everything can be automated which means that this is not present in this transaction but in sorry this version but in future version what we're planning to do is having some sort of re-entry where maybe like each deposit are number each deals are done with fixed amount of say point 1 right but does he wanna mix one full either in is the case we should you have to return 10 times and mix point 1 in 10 times interactively but with this with this you can make one teacher deposit and the business object in the system would be responsible for dispatching that across like 10 different deals without your intervention in a way that's secure and that's interesting because we can also use this to like even surprised before we do this we can use this to create liquidity where we can have the quiddity provider that don't necessarily care about being anonymous but they have the collective reward props they share the fees and what they will do is that they will provide liquidity to the system so you would have these different liquidity provider that would provide liquidity to the deal to avoid cases where for example a whale tries to come in in the anonymize people sort so we this non interactiveness really helps us achieve high level of liquidity in this system which is challenging and yeah that that's pretty that's pretty much it questions