Optimizing Commit-and-Reveal for Smart Contracts - Julie Bettens

all right so uh hi thank you for being here my name is Julie I am a blockchain security engineer with chain security very quickly I have the pleasure to work with some of these amazing clients to make blockchains more secure for everyone but today I'm not going to talk about something that has to do with that instead I'm going to talk about a project that I did at epfl you can see the nice campus that we have it was during my thesis and also during balc we're not sponsored by the way but I did this project with uh Brian Ford from the decentralized and distributed systems laboratory which was called the optimizing commit and review for smart contracts and as you might have guessed this going to be the subject today before I begin I would like to issue a challenge to all of you as you've noticed we don't get a lot of questions in this conference I think so give me your tough questions okay I did this for six months so I'm ready for it so I'd like to start by asking what is commit and reveal and so commit and reveal is essentially the digital equivalent of an envelope if you see this is a voting envelope and next week I will put my ballot in the envelope and seal the envelope and give it to the ballot point and why am I doing this well I want both to hide my vote and I also want other people to be able to take my vote and move it around and uh and also be able to open it at the end of the election now if we want to do the same thing in the digital space we can use a commit and reveal scheme or a commitment scheme so we would have the ability to generate a commitment for an arbitrary message and later we will have the ability to reveal what the message was and give proof that this was original message now that means there are two properties we want we want commitments to be hiding meaning that they don't reveal anything about the message and you want them to be binding meaning that you cannot change your mind or your vote in the middle of uh everything now how do smart contracts today use commit and reveal schemes I will give you three examples the first one is ens if you've ever registered an enss name you saw this screen which has so it has you do one transaction then wait 60 seconds and do a second transaction and the reason it does that is because the first transactions is making a commitment and putting it on chain and the second transaction is opening a commitment that was already on chain and the reason they do this is that if you did this in one transaction you would be revealing your name in What's called the mol which is where the unconfirm transactions go and someone could sweep your name in front of you which we want to avoid so more General we can say that ens uses commit and reveal to protect against front running now my second example is again enss at the very beginning of enss all the names went up at once so they made a big sealed bid auctions and to implement the seal bids they did also a commit and reveal protocol so there was a first phase where everyone went to publish commitments and then a second phase where everyone went to reveal their commitments and the bids that were inside them this so this using both the hiding property meaning that people cannot see your bid and also the binding property meaning that you cannot change your bid after you've seen other people's bids now the third example is an idea that has been in blockchain for a while which is to generate a random number which is usually hard on blockchains by having multiple parties commit to their own random number and then in a second phase having everyone reveal their number and mixing everyone's entropy together to get a fresh random number that should be unbias and unpredictable and we come back to that let's also note that the proof of stake algorithm for ethereum uses a very similar system slightly more optimized but with a lot of the same properties now if we look at all these examples at the lab we saw a bunch of limitations namely the fact that we you have to do two rounds you have to Comm and then reveal this means that the smart contracts can get more complex because you have to track commitments and things like that and especially it's difficult for these kinds of protocols to deal with unrevealed inputs to expand on that because only the sender can open a traditional commitment what if they don't reveal where you don't want to want to wait for them but if you ignore them this also opens more attx surface so what some protocols can do is require collateral so that they can they collateral from people who don't reveal their commitments but then the question is is this enough collateral the other question is can other people dos your internet connection so that you cannot uh you you cannot reveal and there's also this problem which is also in the proof of stake of ethereum that the last person that reveals their commitment can look at everyone's commitment and ask again is this advantageous to me to reveal my commitment now or not so we said at the lab there must be a betterway and so what we've been building uh for I think the last year so is a new architectures for blockchain where we say okay every transaction you can opt into temporarily encrypting your transaction and there's a threshold Network which is able to decrypt them they have the the policy that they only decry finalized transactions so that they are already set in the block blockchain and they cannot be removed or reorganized now this has the consequence that we need to delay the execution of these transactions until they are decrypted which on ethereum for example could be up to 12 minutes but we'll come back to that later so as a note we're building a prototype we are not saying it should be a rollup or it should be for Standalone chains we're also not saying it should be evm even though the Prototype is evm but we try to be be relatively agnostics with regards to that benefits of this approach is first of all you get complete front running protection you can also argue that you have better credible neutrality because now block proposers will only look at Cipher text so they can't discriminate against uh people's transactions and the last thing is we can Implement efficient and safe sealed B auctions and I will show you how so you implement open bit auctions like you would normally then you change the length of the auction to be less than the execution delay on the blockchain and you delay on a you deploy sorry on a temporary encryption blockchain and that's all you need to do you have still B auctions just like that and we did this in the Prototype which you can see later now the question when you do these types of modification is what about the gas you know if you make nodes that follow the blockchain do computation you have to be charged for that computation so luckily the biggest point in our encryption scheme is elliptic Earth fairings and we can align with the policy of EIP 1108 which in the end means that every transactions has an extra 192,000 additional gas for the encryption process now is this a lot well if you go to The Ether scan gas tracker you will see that they have the figure that it pial swap would cost 356,000 gas so that means that we use 53% more gas now knowing that you can lose thousands of dollars to sandwich attack I think in this use case a lot of people will be very happy to pay this type of uh of fee the other question that we have is what about data availability well first off we can store decrypted transaction after they've been executed in plain Tex which means that we can still compress them like we do today but there's some extra additional data to prove the encryption which there goes down to 144 bytes now the question is is this similar to the comparing Apples to Apples if you were to instead post commitments and then open them would you have a similar footprint depends how you measure because you have to do transactions but generally it's it's in the same bpack it's not one is much more expensive than the other so I argue that it's it's it's comparable now a last feature that we have is I don't know if you've heard of Dand Dand is also a threshold Network which has as a primary goal to Generate random beacons regularly and we use very similar cryptography to theand which has this interesting property that our decryption keys are also random beacons and in the same way dun's random beacons can also be used as decryption Keys which is why they have also the time lock encryp application that is running today so this means that if we give access to the decryption keys to the smart contracts we now have a synchronous source of Randomness which not a lot of FL chains can do this you know typically you have to do a call and then get a call back with the freshness from the vrf provider now of course there are drawbacks to this approach it require it clearly requires a hard Fork especially in the case of ethereum it also means that EIP 559 needs to be redesigned a bit because transaction takes sometimes to be executed and it's also difficult to say we refund unused gas because if you do that you open yourself to griefing attack where people reserve a lot of gas but then they don't use it and then uh you have a problem with the validators not being paid we also rely on the threshold Network to stay available which is something that the ethereum L1 doesn't like which is why they went with the uh the commit and reveal approach instead and we will lose most of the benefits of me to expand on that quickly there are also benefits to meev and the fact that proposers extract me namely they can liquidate very efficiently in lending protocols they can also do Arbitrage both between dexes and between Sexes and dexes and it leads to less fail transactions before flash BS existed we had a lot more failed transaction and wasted block space on transactions because people could not use Flash B protect to to prevent their transactions from reverting so that's also something that needs to be addressed When developing these types of services in the future a word on that we are not the first ones to work on this there are non-academic and Academic Teams working on these types of system like shutter and F and it's always very interesting to keep up with what's going on in this uh in this space so I just want to highlight light the this fact before I conclude I want to thank publicly a few people Professor Brian Ford from pfl yolan rer from randu and my colleague Shuan Wang for making this project possible overall and to conclude temporary encryption I think opens up new application new use cases on blockchain that would not be possible otherwise but of course there are these drawbacks it's bit it's difficult to implement properly and to develop and we know that having faster finality and more compute because we consume compute could be relatively helpful now I will link here the Prototype that we built which you can also find the link to the report and that's it for me I expect your questions [Applause] so amazing session amazing bit of alpha there and privacy from Julie so questions are opening up to Julie now who has someone must have a question I know we started a little bit slow today but questions I've got a question actually so what's you know what's uh behind the curtain for the brand now like where are you going with the you know any announcements maybe something you can fill this in on so so uh you maybe you're not going to like this but there is no brand there's nothing uh I did my uh project I got my e credits and my masters and now I'm working on something else so it's out there for anyone to pick up and if you if you have specific questions more technical questions of course you can ask me and I'd be happy to uh to contribute to anything uh that is built in this domain amazing so was about sharing guys so please do find Julie after and come and talk about everything there but thanks again once more round of applause for Julie guys so we have a we have an exciting