Privacy on Public Ledger Blockchains - Alan Scott, Edward Fricker and Kieran Mesquita

okay gm eat denver [Music] [Applause] so my name is edward fricker this is alan scott and this is kai mesquita and we are three of the contributors to the railgun project railgun project is a privacy system for public ledger chains and our uh app is a d app called railgun a smart contract system for private dex trading private transactions and private balances that does not require use of a layer 2 or bridge now uh i will give some brief context then kai will talk about the zk snarks and the technology that was needed to put this d app together and alan will talk about uh the practical applications and why people are using this kind of privacy technology uh and also how builders like you can adapt this technology to make your applications private as well so people who use your d apps can enjoy the same privacy that we do so to start off uh privacy is important uh privacy is something that all humans instinctually value even those who seek to remove our privacy want it for themselves information about you is used to pretend to be you your own information is used to access your accounts and if the people have access to that same information they can also access your accounts so privacy isn't just about information and and you know things you want to hide it is access to the things that you find valuable in the things that you desire uh furthermore professionals need privacy i'm a lawyer i am legally required to keep the interactions between me and my clients confidential even the act of visiting the lawyer has to remain confidential because people do not want suspicion thrown upon them simply because they're seeking legal advice that is the same for psychiatrists even the amount that you pay a psychiatrist needs to be private because just from that information alone a lot can be uh assumed about your private life which you might not uh feel is appropriate to share with the public in the outside world uh not you know you can see that privacy is not just a luxury that people can enjoy it's required for many professionals no one questions why government officials might ask to make their uh documents confidential or classified for example payrolls you if you had access to the payrolls of undercover agents in in a law enforcement agency then you would also know where they shop and where they happen to be at any particular time of the day i don't think it would bode well for their career so uh why is this relevant blog chains are fully public all of your embarrassing mistakes and all of your behaviors are not just recorded in life they're immutable until the end of time so you can't erase them 20 years in the future if you happen to want to hide some of the djen trades you've made it's actually easy now to assign your real identity to your wallet address many applications collect all kinds of metadata about you and the the data analytics servers are very successful at attaching users to their wallet address so people like to use privacy applications and privacy solutions you can use a decentralized exchange with a d app like railgun to stay private when you're trading now i'll introduce kai who's going to talk about some of the technology that's used for achieving this kind of privacy uh when you're interacting with smart contracts um yeah well so um i think people we have some some of the room might be familiar with zero knowledge proofs and associated cryptography they usually so they do provide a pretty strong level of privacy but they're usually pretty expensive to use computationally and in a constrained environment like ethereum that can be a bit of a problem um and then of course on the user side there's an issue [Music] we've got a mic here on the user side um of course you know you want to be able to um use it on mobile devices and not require your users to have a super computer in order to generate a transaction so on ethereum um we can be smart about the uh cryptographic primitives that we use in order to make things more efficient so we've got eip 196 and 197 which adds the relevant pre-compiles in order to do a verification of group 16 proofs fairly succinctly to guard 16 is a zk snark proving system that is unmatched when it comes to verification efficiency but it's pretty expensive to prove so um in order to keep the efficiency on the proving side within the realm of being able to run it on say a mobile wallet um we need to be smart about what crypto primitives we choose in our protocol so we can choose a say for example for hashing systems rather than traditional chart of 26 we can use mimsi or poseidon which is very snark friendly so rogan uses poseidon and rough 16 specifically because they kind of fit the trade-offs that we're looking for on ethereum and it uses them to create a private smart contract wallet so you can deposit into a privacy pool uh transact internally privately uh using a similar construction to zcash so that's using a utxo merkle tree to keep track of balances nullifiers to prevent double spends and then snack proof to actually do the updating and that provides a pretty strong level of privacy but we can also extend that to add in the ability to encode arbitrary smart contract calls into the uh smart transaction so now you've got a private balance which you can transact internally you can use that private balance through you know arbitrary smart contract calls to interact with d5 so that gives you a strong level of privacy and you can interact with d5 through a mobile wallet and that should explain the basics of the technical side if people want to dive deeper into anything we can take questions at the end um but now i'd like to introduce alan to talk about the developer experience and applications of railgun yeah does this uh might work you guys near me right cool sick uh yeah so the practical applications of all this tech that he was just talking about uh there's there's three fundamental places that you could use this uh first and foremost of course is alpha protection uh there's a lot of companies out there like nansen chain analysis that are taking collecting collating and then selling all of your alpha and the shelf life of this alpha and traditional finance will be a lot further than it would be in somewhere in d5 we have a public ledger of that that you can actually walk backwards and then study right so i'm sure everybody here takes and follows things like uh whale alerts right you can just take and walk backwards of people who are growing their balances really rapidly and steal their alpha that they've worked really hard to develop you can take and avoid negative publicity some of you guys here work on d5 teams that have tokens and you know you have practical reasons that you have to actually take and sell those tokens uh if you have a team wallet maybe you want to give those to some developers uh you want to pay out bug bounties uh maybe you want to actually pay out an auditor in tokens some of these people take those right and there's a lot of negative connotations in the marketplace that perhaps come from that and you can actually do that with a private balance and then avoid those and then you know the most important thing perhaps to me is anti-surveillance there's probably a good reason why there's a lot of anons on crypto twitter right because they don't want to actually take and uh coincide their um defy habits with uh you know their their financial information right um and you can use a private balance like railgun to take and avoid that you know so if you're like i don't know mark cuban trying to get into olympus and uh getting a lot of critics about that you can avoid it in terms of the sdk there's three fundamental ways you can interact with the smart contract first and foremost is railgun connect this would probably be really easy for anyone here to implement it's just like you would take and connect your metamask you can actually set that up to connect to a private balance and use your private balance in railgun uh we actually have a very interesting part of the sdk that will allow wallet providers to develop an incognito mode so you can think of this like the control shift in of your metamask so there's some things that you might want to do private maybe you want to test out a new alpha and you're not sure if it'll work out well so you can do that with a private balance and then of course like kai mentioned earlier there's arbitrary smart contract calls so you can think of just like you could do with a public balance you can take into arbitrary smart contract calls to railgun to do staking farming swaps whatever you can possibly think of maybe you're competing in the curve wars trying to bribe as much as humanly possible you can do that in a private fashion yeah that's kind of the soup to nuts there we wanted to keep the the presentation part kind of short in order to try to open it up for some questions comments concerns i just wanted to add you can go to one of the two websites railgun.org or railgun.ch and create uh your private railgun address there try it out see see how it goes and uh use it to read more about the project if you like and yeah if you have any questions then extended um collusion prevention because i'm thinking about the bitcoin grants around this this session that had the zk cream uh like voting for government using zero knowledge groups to like prevent collusion among actors in a governance system um i assume you're talking about uh uh okay cool i assume you're talking about um the zero knowledge like voting systems that are out which allow you to change votes um after the fact without like letting people know what you voted um railguns are purely transaction system so um like you can use dk snacks to develop a voting system and then maybe you know vote with a private balance and railgun but i don't think um yeah we're not a government platform so that's that's a problem for a different project to tackle yeah so there can be any mainnet um application essentially like you you encode the um api information into a particular field in the spark um and the royal gun contract ensures that when the um stock or the merkle tree updates executed the call that goes out to the external contract with your like api data also has to be executed and like returned successfully before the balance update's committed yeah so there are a couple of like eighth miners that provide you know hidden transactions um that they're private um until they're mined right so you can do a transaction and the idea behind that is mostly to prevent uh front running so if you know you get a front running bot that sees a transaction in the mempool um that's you know buying a large amount of like some low liquidity uh coin and you're obviously gonna get get hit pretty hard by like sandwiching um so the idea behind the private um rpcs is to like you don't reveal your transaction in the in the mempool until that's actually included in the block but once it's included in the block you have the same privacy properties as anything else right so you can still go to scan and see like all your transaction data so railgun transactions hide um the transaction data even after it's been included in the block can you please describe what the system compliance audit process was like and what did it entail uh talk about the audit so you're referring to like um like an audit of the smart contract system yeah so um yeah we've actually pretty intensely audited the smart contract system here so um we've completed audits with abdk zoko hackin and we're actually in audit now with trailer bits um i think we'll get to like remediation or whatever at the end of the month and you know we chose abdk because they're like subject matter experts on the poseidon hash they did a lot of the research for this stuff um so i'm not sure if that really answers your question but yeah we had to you know do a lot of uh rigorous testing to ensure that one it's not only uh funds or seifu but also that it's private right so there's a whole different level of it right so the the caliber for security has to be pretty high because in a privacy system right if there is an issue you don't really know where it is because it's private right you have to be right from the good so i mean we're constantly auditing the code right so um abdk has been digging into the code since what june yeah and then some some of them had you know a nine month waiting list so yeah we had to wait yeah but hey uh you guys mentioned using a railgun for uh but uh how would that really work if the bride is not public how would people know to take that ride or if it's working first maybe a public yeah so this is more about like um taking and not revealing who you are as an actor so we can kind of like extrapolate this out to like a constitution down right one of the main reasons why those people lost that auction is because they knew exactly how much they had to bid with right so this is more about obfuscation of like the actor not necessarily um like hiding the exact bribe amount because you'll actually see that bribe amount come out of the railgun smart contract right it's just like a big pool of black hole like a a dark pool of liquidity that's taking and doing the bribing not necessarily you exactly if you don't want people to know that you're the one that's doing the bribing the people should be able to see what they're getting yeah no you'll see that right so you see it right but it's all about in this particular circumstance right obfuscating that you're the one that's doing the bribing right so it won't be coming from your wallet but instead from the railgun dark pool yeah people will only see that a railgun user is sending transactions they won't be able to see anything else other than that but once it's sent then it if it's comes out of the railgun system then it's back in the ethereum public ledger yeah um so the merkle tree is just purely keeping track of balances um we don't do any accumulation on our transaction execution um so the idea behind the merkle tree is like if if you've got the the transaction systems utxo based and if you have a particular txo in a buckle tree um you can use a snark to essentially prove that your uh the utxo that you're spending is contained within the merkle tree without revealing you know which actual leaf in the merkle tree it is so that that provides the the privacy layer there and then you've got the nullifier which is a hash of the private the user's private key plus the the fields of the utxo so it's not tiable to the utxo itself but it's also deterministically like linked so you can prevent um uh you can prevent like double spending that way so in terms of actual execution speed it's just a pure railgun a pure ethereum transaction so as soon as you can get an eighth transaction to block your railgun transactions executed um so you can you can see the fact that the the merkle tree is updated but because none of the actual uh contents of the leaves are revealed on chain it's just proof of existence that's revealed you prove something exists a transaction took place but you don't reveal the contents of the transaction on chain maybe someone near the back or something okay so i've been trying for a while so the first question is if a user wants to deposit balance into the private contract and do a smart contract to use that balance that that smart contract is so the user can do this by themselves without you modifying your deck or someone deploy a contract right okay so the question was can railgun support any erc20 without prior approval yes yes any erc20 works in railgun but you should probably not use rebase tokens because they might not work okay the relative thing using that is security contract there's no privacy because people kind of observe the income yeah so in that situation if you are the only person using like elon doe shiba mark iii and that's like some token that only you have then um true your anonymity would be quite poor but once it's in railgun no one would know what you're doing with it let's say you sent a million your elon shiva to this person and two million elon shipper to that person within railgun no one knows how much you're sending to anyone else of course it would be obvious that you're the only person using elon sugar in there because you're the only depositor so your anonymity would be quite low in that situation but your privacy of the transactions that you do within railgun would still hide the amount and also no one would know that you're making transactions of that particular token inside railgun right um so yeah a lot of people want to know more about uh you know what what are the laws around these kind of things at the moment you know it's not it's not particularly clear but there has not been any problem for zcash which is a very effective uh private transaction tool and you know even even railgun is not as private as you know giving someone an envelope with cash in it so uh you know most people have blinds at home they like to draw the curtains when when they're not home or when you know it's late at night uh people do acknowledge that privacy is a human right so you know there's always there's always a line that's drawn and like i said even the government wants uh private privacy solutions so um i you know i personally you know this is not legal advice but i i personally believe that there will not be a problem with with having useful privacy solutions because people professionally need them it not just hedge funds not just you know big uh whale traders but you know normal people um and government officials do need privacy solutions for their their financial transactions so you know railgun is a permissionless tool it's completely decentralized there's no railgun company it's it's an open source um uh project that you know hopefully some of you guys will also contribute to so yeah um you know at the moment it it seems like everything's good and because people really need this kind of solution thanks guys [Applause]