Self Workshop - What is Self, How to Integrate it I Evi Nova

Hey there. Welcome to the ETH global bonus series workshop for self protocol. I'm Eevee. I'm a smart contract engineer with self. And today we're just going to be taking a little look at what self protocol actually is.

Look at the bounties that we have on offer for the hackathon. And we're also going to go through a code example of our workshop repo which has a minimal implementation showing you how you can integrate self into your own project. So firstly what is self? Well self is a zero knowledge protocol that allows users to prove they have a passport and ID card a zero knowledge proof of that and that allows them to selectively uh prove information that the document contains without ever having to reveal the document itself. And so traditionally we see with KYC providers which are checking users a real person and checking all these sorts of information.

Uh the the issue here is that essentially users are relying on trusting these third parties to securely store their data and you know you upload your passport, your ID card which contains quite sensitive information and yet these KYC providers do not do a great job of securing that information and we've seen countless database leaks compromising users privacy which is really not great obviously. So what can we do? Introducing self. So with self instead of of storing your data on a database, you instead create a zero knowledge proof which transforms this data into something that can be used to uh prove information without ever having to show the document itself. And so what we do is we leverage passwords for example uh and why we do this is because you know they're quite difficult to obtain.

You need to go through this government verification process uh which proves that you're a unique person. So there's only one passport per person and it's also has a NFC chip on it which allows devices such as a smartphone to extract secure information from them. So this enables a few different use cases. Uh the first one being obviously civil resistance uh because you know your passport is a unique document that only you could have and you can only have one of them and so it can be a way to add civil resistance to your protocol. Next is that you can um obviously reveal facts about yourself with your ZK proof that you generate.

Uh and so anything that's on the document can be used to uh you can you can prove information about that. So that includes stuff like your name, your date of birth, your issuing state, your nationality, your gender. And then finally, you can do things like proving facts about yourself, like making sure that you're above a certain age, like over the age of 18 or that you're not from a set of countries or that you're not on the OFAC list, which is the list of addresses that the US government has sanctioned. And so if you're interested in compliancy, this is obviously really useful as well. And so recently self has started integrating uh non biometric uh data sources like adar uh and that relies on you know scanning a QR code in like a PDF and doing a the proper certification and so we can actually see with the coverage map we have uh we had uh 1.

1 billion u potential reachable users with biometric passport holders 200 million with biometric ID cards and now an extra 1.4 4 billion with AR cards. That reaches us a total amount of users that could potentially be reached of 2.77 billion. And we're obviously looking to make this map cleaner by the day.

So, uh, so yeah, what does experience look like and how does it all work really? So, firstly, uh, you download the self app and then you scan your passport. It reads the MRZ, which is the two bottom, uh, rows of data on your passport. And essentially this is a um a way of allowing you to access the chip and authenticate yourself. And so once you have uh scanned your document and scan the chip uh this hashes the data along with a secret and this is stored on chain and we can then later use that to be proving information about a document.

And so when you prove information about yourself without revealing the actual document itself, that's called a disclosure proof. So the app creates a QR code which contains a request for certain information, users then scan the QR code which opens the self app and they're prompted like they would about what they would like to do with disclosure proof. They're going to see what information is going to be disclosed and then if they accept brief is verified and if successful information is passed on to the app or the smart contract for utilization with the custom logic. We're just on our high level architecture for the registration process. Uh obviously we have the the passport being scanned by the mobile app and you get a secret generated and you can either store that on a cloud backup or like locally.

This is passed on to the TE. Uh this is an encrypted format because it's a hash of your secret and all your passport data. And so this is never accessible to anyone. And we also verify that the TE is actually the correct environment so that it's it's doing what we want it to do. And then once that proof is created, um it's submitted to the onchain registry.

Um make sure that's actually a legit proof of course. And then uh for the actual disclosure proof uh your app generates a QR code um or deep link and you with your mobile app you open that app and that opens up your self app uh and then the ZK proof um is sent to the back end and you can either use like a onchain verifier in which case it's going to go to your smart contract or you can use a backend verifier in which case it's going to go to your API endpoint and you can see we have the uh the two the repos there for onchain or offchain self xyz contracts SDK or the self xyz or SDK. So uh we have a few patties. So firstly we have two categories. We have the onchain verification and so we have three winners for that.

That's only 5,000 2,500 or 1,500. And then we have the offchain verification pack which is a prize of 1,000. So there'll be four winners in total and yeah we're really excited to see what you come up with and so uh we're going to be using the workshop repo for code demo that's github/ selfxyzworkshop and you can see the um two different pathways we have here right so either way your app is going to be running have a front end generating a QR code and then that's going to go to the user they're going to scan it right and then the zk proof that is generated uh it's then going to be sent either to a pack verifier if you're doing offchain verification or to your smart contract if you're doing onchain verification. Okay, so let's get into the code example. So I've already downloaded and the workshop repo from our GitHub and so I'm going to start with the front end stuff first.

So we have here the front end component which is the uh QR code and we go to pay tsx we can see we construct the uh the QR code here in the self app builder component and that contains information that's going to be passed on to the users self app that contains stuff like the version number the app name scope uh the endpoint which is your uh your smart contract if you're using the onchain verification using offchain verification. It's your HTTPS API endpoint and your logo uh the user ID which can be either like a hex which for theme address or you can use a new U ID uh the endpoint type if it's going to be on mainet or test net. We can also have user defined data and so for example you could define different types of configs to verify people based on this input. Uh you can also just have users uh enter whatever information you want on the front end and this can be passed on to the uh the when when you get the return call. So then we also have the disclosures and so this is what you're going to be asking the user to uh to prove you know.

So um this the demo example we just have the minimum age check and the excluded countries check but making sure that the user is over the age of 18 and they're not from the United States. Here you can see and so then essentially yeah this uh is in the QR code wrapper it's built up and then uh they have like you know your hook here. uh after you have a successful verification and then so on the smart contract side we go to proof of human and so proof of human is it's a relatively simple implementation you can see if your smart contracts you inherit from self-verification route and so we have uh three parameters in our constructor so firstly we have the identification identity verification hub Uh and so this is the onchain address that is used to verify the users generated Z key proofs and so that'll change depending on of your cell mainet or sell test net. Uh you can grab the uh which address is which from our documents and it's also available in our ENV uh example. Uh the next parameter is the scrape and so this is essentially like a unique identifier for your application.

Um so attackers would otherwise be able to do a bit of like traffic analysis and they'll be able to identify or be used to identify users who could do multiple disclosures across different apps. And so having different scopes essentially hide with the protocol and makes you less vulnerable to these kind of attacks. And so you just need to make sure this value is the same in the self app builder component. And so if we go back to here, you know, you just want to make sure the scope that you're passing in, uh, which is self workshop, is the same that you're, you know, setting up for your smart contract. Um, in general, like, and also for the verification config in general, you really need the smart contract to line up with the the front end and yeah, otherwise you'll get run into errors.

And yeah, so we finally, we have the verification config, and that's just a way of enforcing your config on chain. So uh on the front end uh we have it configured to check the users over 18 and they're not in the USA. Uh and so then we'll create a verification config that also matches that. Um and so obviously you're inheriting from self-verification route. So there's two functions you need to uh implement.

First one is the custom verification hook. And so after your proof has been uh verified correctly then you can actually uh work with the data that's been proven right. Firstly we have user data uh and that was the user defined data from the the front end that was this part that's we here hello and then the other component is the output right and so uh that is using this you can see all the possible data you can potentially get from the user although if you don't ask for it in the disclosure yeah then you're not going going to be it's going to be empty you know so uh for our example the only data sources we will have access to are minimum age and excluded countries but just say for example I wanted to grab the issuing state I could do something like uh last issuing date equals yeah output issuing state and yeah so then you also have the get config ID function that uh you also need to implement. And so this is uh passed into the uh the hub contract. Um here we go Yeah.

So in the uh the uh verify self-p proof function which is the main uh the function that is verifying the proof this uh config ID gets passed into the call on the the hub verification. And so what you can actually do is you can use this uh you can see one of the inputs is user find data. We also have user identifier and these can be used to uh make sure you implement uh custom verification. So for example if user defined data there was an option saying hey over the age of 30 you can pass in the user said over 30. So this would be like you know 30 right or whatever and um you know and then uh then the you'll check um you have a stored set of configs and then that'll be passed into the hub and so you'll check over the age of 30 or otherwise you use your default implementation and just but for the demo example I'm just going to keep it very simple and we're just going to have um a default verification config that we define in the constructor, right?

Yeah. Okay. So, I've already uh deployed a smart contract. Um, so you can see here I I just ran that with the um I went to see contracts and then I ran the deployment script um deploy proof of human um which runs the uh deploy proof of human script and we can see it's um yeah, you just got to make sure everything lines up with the front end and the back end, right? So um you can see we pass in the hub address and the scope seed and that's from ENV and so you can see uh we're on cell sepia because we're using a mock passport and it's just for test net.

If you had mainet you would want to use this address. Uh, make sure your scrape seed packages your front ends one self workshop, right? And self workshop. Great. And make sure you're on the right network as well.

And of course, don't forget to put your deployers private keys ENV as well. And so it grabs from the ENVs for the uh hub address, the scape seed. uh and then it's also uh using this um self utils uh function to format the verification config properly and then it deploys a contract. So once you've deployed the contract, you grab your contract address and you go to your front end and uh you can see in the example uh this is the endpoint and so uh for us uh we're doing onchain verification right now. So we put in smart contract here.

Uh but if you are doing offchain verification uh you put your HTTPS endpoint. Uh if you're doing local just make sure to use angro and also make sure the contract address is in lower case. Okay. So now we're going to spin up the front end. So we're going to go to app.

I'm going to run it. Okay. All right. So now I'm going to I've got a website. I've got my QR code and I'm gonna ran it with my phone.

Open up the self app. You can see that. And so it's asking to authenticate who I am. And then it's also going to be asking to make sure that I'm over the age of 18 and that I'm not a citizen of the USA. Uh I can also see the additional information.

Hello ETH wars errors. So, hold to verify and it's now take a few seconds and boom, we can see identity verified. The front end has well, we've got a nice little skeleton dancing around there, but you can put whatever you want, obviously. And on the self app, it tells the user that they successfully passed the verification. So um yeah and then also obviously uh one this is also calling this custom verification hook.

So on the deploy contract uh you would have all these data points now set right. Um but you can do whatever you want with the uh the output and the logic and so the other thing to talk about here is the um the offchain verification. So we can take a little look. Um so you go to this part backend integration. Um nice little like uh documents for this.

And so you can see uh it's essentially uh it's it's you know the same kind of uh data has been passed around. It's just processed a little differently verified offchain with the back end instead of onchain with the uh smart contracts. So you see pass in the scope pass in the end point you're determining if it's going to be mock passports or false um allowed ids and so that's just the uh like ID type so that's like do you want passports do you want passports ID cards you want passport ID cards out um and you have config storage and that's kind of similar to the uh the config ID you know talking about you know having different kinds of uh config stored to have different types of verifications applied to the user data. Uh that's what you would, you know, store there. And then the user identifier type.

Uh if that's going to be like a user address or with hex or the UU ID and then for a example of how to integrate that to that bottom. Yeah. So you know you just install it. That's the soft XYZ. And then you can see a working implementation here.

Um so you can see the uh you know the in this example um the check is here default config storage. So they're checking the minimum age is 18. They're checking that they're not from Iran, Pakistan, oh sorry, Iran, uh North Korea, Russia or Syria. And we're also checking that they are not on the OAC list. And then you can see uh yeah, basically the data is extracted, the proof is verified.

Um and if it's successful, then you can enact your own custom logic. And so yeah, it's it's kind of up to you to figure out if you want to use offchain verification or onchain verification. Um both different pathways depending on your app and your your project and what you want to do. So, I think that wraps it up. I just want to say thank you so much for listening and we're really excited to see what you can build with self and with the magic of ZK proofs cuz it really is magical uh this ability to prove information without ever having to reveal the information.

It's um really cool and yeah, good luck.