Worldcoin 🛠 Proof of Personhood with World ID - Flywill , Miguel Piedrafita

foreign [Applause] [Music] I am Miguel and this is flywheel and we are here to talk to you about wolfquin and wallaby I'm basically how to make any app fully civil assistant within a few minutes and without keeping everyone's privacy so before that I want to talk a little bit about why we're doing this and the reason why we believe that this is a really big deal is because I feel like everyone here can agree crypto is really really awesome but at the same time it has a bunch of problems which is mostly with the its value being hoarded a little bit we all know about being early and the thing is especially for the things like latam that are now joining more and more in crypto and where it's clear that it can solve really big problems most of the value for things like ethereum or Bitcoin has already been captured by the people that were there at first and that is not great and that can uh hinder a little bit on the Innovation that we can all achieve with this and so at worldcoin we had this question like what if Bitcoin had started instead of by however it got started by just giving one Bitcoin to every human in the world and then seeing how the network reflects effects played out how how in a currency that was fully globally available was still being modern and online and cryptocurrency played out and so we wanted to find this out obviously we we cannot buy a Bitcoin for every human we I wish but instead we said okay let's make um an erc20 token and let's do the same experiment with it let's make a token that every person gets for free and then we'll see how that affects the supply let's see how that enables new people to interact with all of these ecosystems that we're building and the big question there obviously was if we're going to be given this token that is worth something and we're going to be giving up for free a lot of people are going to be trying to get it for free multiple times and just like steal from everyone really and so this question we went back and forth uh we learned about this thing called civil attacks which is um pretty modern concept nowadays because all of these nft means and airdrops are suffering from it it basically means that some of your users are not really unique users they get like someone running a bunch of accounts and this is really what we want to avoid we want to make our protocol and every other protocol there while we're at it civil assistance and so we went back and forth into different solutions that we could use for this maybe we could ask for an email or a phone which is better than nothing but kind of similar to what it can is doing but it's still not enough kyc can work but there's some areas of the world that don't have either documents or not don't have a database to check them against and also from a privacy standpoint it's really bad because we we would have to get everyone's ideas and we really don't want that there's other other approaches like web of trust where you are saying I trust these people around me and then that propagates that has the issue of you need an initial set of people to trust and then over time if you know a lot of people it's easier and easier to fake another human uh we looked into Biometrics like using your fingerprint and using your DNA which both work uh except for the fingerprint doesn't really have enough information for 8 billion humans um there are going to be some people that have similar enough fingerprints so that we cannot tell them apart and then it has the opposite problem it is really really unique but um it's super expensive and super slow to measure and also very invasive and so we wanted a solution that was both private uh inclusive meaning that we could onboard every human in the world all eight billion humans into the system and that again was scalable and didn't leave anyone behind and so we ended up sitting with irises which are like the perfect middle point between fingerprints and DNA they're still unique they're pretty hard to obtains and even then you can most of the times detect it and at the same time they're quick they're really quick to scan measure and use and so this is great using the system we have a system where we were taking no images we we did we do take an image of the iris but then we delete it and just extract information from there no name no contact info okay with no phone number really it's there's no link between these really and anything in the real world but for us it felt like it wasn't enough we wanted something more we wanted something that would allow us to really not just be private but be fully Anonymous and so we started looking into zero Edge proofs and how aside from saying this is a human that owns a public key that has been certified by an orb as human we could also say this is like one of those humans and we have no idea there's no way to even link them to the hash of their scan and We've Ended up with this system which allowed us to prove cryptographically on chain I am a real person and I have never done something other started something was mostly claimed worldcoin but as more developers came to us and said we want to reuse this technology that you guys have made on our own apps we started thinking maybe we can expand this so that this can be added to everyone to governance nfts airdrops even web to actions like you're in a Discord Channel which would help a lot with Spam and so we created this thing called quality which is a protocol that lets you fully anonymously verify that someone is a real human being and that has never done an action before like claiming Walco in and so it's a privacy first decentralized entity solution it's not even it's not even identity in the sense that it is fully Anonymous pair up so if I use my u-wall ID on two different apps these two different apps will get completely different ideas of who I am which doesn't makes it so that you cannot even track people along us it enables anonymously Anonymous proof of personhood which can pretty much search for every use case that civil assistance would uh use and it's also an open protocol that runs on the blockchain on publicly verified smart contracts and where you get to keep your own keys and so for example if you were just making an airtop to integrate this you just need to add a widget which we'll talk about a little bit more about and that's it you're set it's it's really that easy so now flywheel is going to talk a little bit about how it works amazing thank you let me I'll switch computers foreign there all right so here's roughly how the world ID protocol works so you go to an ore physically one of one of these guys and uh the orb will verify you're a unique person uh and you get your world ID so in in the background what actually is happening is uh your worldcoin app is going to generate a unique random identity commitment that's going to live in your phone and it's going to show the public part to the orb the orb is going to do the verification that you're a unique person and then add that identity to the public list on chain of verified identities the the cool thing about like this zero knowledge proofs is that there's literally no link between your identity and your wallet or your identity and anytime that you use it every time that you use it the world going app will generate a zero knowledge proof that you're someone in that set of verified persons but without revealing Who You Are and the purple is um very complex to support for this uh Anonymous proof of personhood but we've abstracted all of this complexity so you can integrate quite easily so um that the way we work is uh you you and install the widget in your app the app the widget will connect to the worldcoin app receive that zero knowledge proof and then you can verify it on our smart contract or on our API after you verify it you you um you know for a fact that that person has been verified by a north and it's an actual person uh and then I'm gonna show you how to integrate it using the API which is that the fastest route to integrate um however if you want to do something on chain we definitely recommend doing uh on the smart contract side will also show that in a little bit so let's say I have this example of I wanna I wanna issue a pull-up but I want to make sure that the pop-up can only be claimed once by a single person so I have this very simple form where um you know I can click claim pull up and I and I receive the pop-up in my wallet um this of course is very easy to farm and spam and and steal all the pop-ups so we can simply add uh World ID to prevent that uh and let me get my app here so to to do this we simply need to uh we simply need to uh the world going widget so you you can easily install it by just running yarn at worldcoin ID this will install the the widget on your project you can now just simply load the widget if you're using nexjs this is an important part you need to do this Dynamic import as I'm doing because the widget relies on um window being set so if you don't do this you'll get an error and then just remember to do the dynamic import no thank you Copilot all right there we go so I have the widget imported we can mount we can then Mount you're you're gonna need to provide a couple of things to the widget so one is the action ID the action ID basically uh defines the scope of the uniqueness for for your own application so you can just go to developer.worldcoin.org and you can create any number of action IDs there uh It'll ask you if you want to create something on production or staging and it'll ask you if you want to run it on chain or just with the API um and then you'll also need something called a signal so the signal is an additional security measure that you can add and it depends on what your application is what makes sense to do so for instance if you're doing an airdrop and you don't set a signal what I can do is man in the middle attack that um claiming process where you know I get the serial knowledge proof from the user and then I change my to my wallet address to receive the airdrop that would have belong to the other person if you add the signal the signal becomes part of the proof so if I tamper with it then the proof will become invalid so depending on your use case uh it might make sense to use different types of signals but then something like this in this case uh you know the signal can be the wallet address or it can be something else and then we're also going to need the action ID so let's just do all right then we're gonna need to receive the proof here just comes along for now all right let's see let's see if this works oh I need to run the server all right so now we have the widget mounted super easy to do uh just make sure to set the the right params once the verification process happens then I'll receive uh the proof in this in this um method and then here here comes the the probably the most important part what you need to do is verify that proof the fact that you got the proof from the widget is uh no safety measure at all it's obviously on the front end very easy to spoof very easy to change so what you want to do is grab that proof and verify it either on chain or with our API but don't just uh don't just assume that because you got the success um this is the success method that this is gonna work uh and then to to verify the proof is quite easy so um you if you're doing the API You're Gonna Wanna Do this from your back end uh if you again like if you do it from the front end it's quite easy to spoof so um make sure make sure to call it from the back end and you're you're simply going to want to do something like this where I call the API all right you don't have to remember the the end point of course you can it's very well um uh documented so don't worry about it uh and then the the API either the API or the smart contract is going to take five params to verify the proof so first it's it's going to be the action ID uh the SEC the second thing so let me let's just send the action ID of course if you don't send the exact same params this is not gonna work so be sure to send the the exact same params uh second of all the signal both of both of those params are set by you and sent to the to the widget so make sure to use the same ones uh let's see what signal that we use here let's fly with uh and then the other three params are what comes from the response on the widget so if you see this like verification response object it it actually has these three parameters Merkel root nullifier hash and proof and those are the additional uh three params that you need to send out I'm just gonna do it like this and then if if the response is successful uh 200 code you know the proof is valid if the same person tries to verify again uh they'll they'll then you'll get an error or of course if the proof is invalid and just to add a little bit more to that so the three params that we're sending is uh they they have different purposes the Merkle root is used uh just to prove that you're part of the uh Merkel tree where the identities are stored uh the proof is just as your knowledge proof um the interesting one to take a look at is the nullifier hash the nullify hash is basically the user ID it's going to be unique for you for every person and every application so this is what ensures uniqueness if if the same person tries to verify for the same action ID again you'll receive the same nullifier hash and you know that's the same person well what's cool is this will always be different for every application so if I use my world ID with um this pop-up app then my nullifier hash will be different than if I use it to verify my lens profile and now Miguel is going to show you how to integrate on the smart contract side there we go it never goes in the right direction the first time okay so um first of all um all of the stuff that we're saying here right now it's probably way more better explained in the documentation so any questions or any doubts or even like the endpoint ID or all of that is going to be there but yeah let's look at some code um start AC let's say that we are like we've seen we've seen how to verify it on the API and the API behind the scenes what it's doing is calling on chain anyways every it's always very financing the AP is just a convenience measure for people that are not super familiar with web3 or people that are making applications like the pop-up one we're really adding an unseen component doesn't really make sense but for most of the implementations of this you'd probably want to use a Smart contract and so let me make the font size a little higher hopefully that's big enough uh this is an example contract that what it's going to do is he has going to airdrop some tokens and the longest Care by all of the measure the all of the text here most of this is most it's just comments this is one of our example star kits and so they really the part that you need to look into is this claim function which receives um four parameters first is the address that is going to receive the proof we do it this way and stuff he has default into msg.sender in order to make it so that anyone can submit the transaction and so you can pay for gas for your users which is really nice and then the other three arguments are the ones that you got from the widget like Paolo uh demoed and so in here we're going to want to do three things to verify it and then you can do whatever you want to finish your logic first of all we're going to check if the nullifier has that we are getting here is already on our list of people that have claimed this so you'll see up here I have a mapping of Abu of the UN which is only foreign and this is going to be false by default so we'll just get right through it like Paolo mentioned this is a unique ID for this action on this person meaning that if they do it again you'll see later down here we're just going to mark it as true and this is like the dumbest solution for making sure that they cannot reuse you can also do some interesting things with this but the most common use case if yes checking if it is included and after verifying making it included and so afterwards what we're going to do is call the wallet contract and just say in verify proof and we're passing the root that we received group ID which is always one then um the signal of the proof and for the API the signal doesn't really matter usually it's on the smart contract side what it really really does matter and an example of what this would matter is let's say that I submit this proof I'm not using the signal um someone can just front run my transaction in the mempool change the receiver and get all the tokens by themselves and then I cannot verify again because I already went through by adding any number of parameters here on the signal what I can ensure is if this parameter doesn't match the one that the user specify when they generate the proof then the verification is going to fail and then it's someone where to like tamper with our transaction it's not going to get verified and so yeah you can add any number of parameters in here it's kind of like a way to of checking that the parameters that the contract received are the ones that the user intended and you usually we just want to add any parameters that your function is going to receive in here in this case we only have one which is the address and then every other thing that we received the action ID is important uh we are getting that in the construction here and you're just going to get the action ID like the string that Polo showed is like WID underscore the bunch of letters and numbers what we're doing here is encoding and crashing it this is required by the smart contract solution and if you're using one of our story kits it will be handled automatically for you and then finally this call if the proof doesn't uh get verified for any reason be it the user is not registered as a human or the signal has been changed or they haven't done this again then this is going to fail if that doesn't happen then we're just going to mark it as true so that the next time that the same user calls this function this is going to report right here and then we will proceed to do whatever we actually want to do in this case send them some tokens um a more advanced version of this would be we have this integration with lens protocol where users can mark their accounts as humans and the implementation of that follows the kind of the same pattern with one difference as you can see the first thing that we're doing is we're getting the profile ID which instead of the address is the parameter we care about here which profile we're verifying and then the three parameters we're going to verify the proof passing the profile ID because that's the as the signal because that's the parameter that we care about and then since this is really a unique identifier it just only for my app what I can say is if this user has already verified a profile we can use that to unverify the profile before verifying a new one to make sure that if I up and verify the wrong profile of or any point want to change the profile that I have verified I still have that option without allowing me to verify multiple ones so this is an example use case or how you can use the nullifier hash some sort of anonymous action ID so in this case if the instead of setting the nullifier has to true what I'm doing is I'm sending it to the profile ID and if that is different from zero that is the default what I'm going to do before is just unverify the other profile Levy which in this case is just emit in an event because a lens takes care of accounting for this in this part and finally let's look at how um we would hook all of this up on the front end so I have the front-end for this here it's a little bit of a it has a bunch of models and stuff but the one that you care about is the verify model which is where we have the profile that we want to verify already and the only thing that we're going to do is run the wallet that we get our signal is going to be the profile ID and we're doing some sanitizing here to encode it as a unit uh which you sometimes have to do when you're not working with strings and then the action ID and everything is going to be just fine once we uh once this is successful we are just going to call set proof and then send it to another component um in this case we're going to use what the what may react library to write it to a contract so we're calling the verify function on the contrast that I just saw showed we're only doing this though if we have a profile and we have a proof so until we actually go through with the verification this is not going to trigger and then once it does we are sending all of the same arguments that we saw here before and then calling the method that should call the contract if it doesn't revert it will go through everyone is happy and we are verified um so yeah just to recap a little bit the system is quite complex but we've made it super super easy to use you can just drop in a few lines of JavaScript integrate a wallet connect style JavaScript widget that acts in a similar way of a captcha and just allows the user to scan a QR code get us error noise proof that you can verify even either through an API or most commonly on scene and get to know that that user has never done whatever action your app cares about once um on the upside I didn't have time to hook it up with my to show my phone screen here I thought enough shifting with the computers was enough uh this is what it pops up on the wallcoin app where it will just show the name of the app and say the app wants to verify that you haven't done this specific thing before and it will tell you what that specific thing is and then when you click verify the it's more intense approved to the website again they call this really really simple but you find the proof with the API it takes probably a minute doing it on the smart contract takes a little bit more but we've been working really hard to provide lots of examples OnStar kits and pretty much anything that you would need to have fully commented code that you can just take the example that I should start with the airdrop change the thing that is in the end and in most of the cases you're going to be fine and yeah the really really cool thing is we have civil assistance now and it is super super flexible there's it's not just protecting airdrops there's a lot of things that you can do especially with governance and boating um quadratic funding things like wallcoin uh there's been a lot of talk about solvent nfts which are solved onto your wallet which is an ideal because then you lose your wealth and your fact something like the thing that I showed for the lens profiles could be used to bound nfts to a wall ID profile instead um making it so that if you lose your weight or you find any point you want to transfer them you can still transfer them as long as you can generate proofs with your wallet and there's a lot of other really really cool use cases all of the links that we have mentioned are in the documentation including the explanation of how this works links to uh probably not this stock because will not be out there but other similar talks that we've done in the past documentation guides uh test net simulators so that you don't have to go to Europe to try your app you can just use um faucet that will give you unlimited entities with on testnet examples and much much more so yeah you can just go to id.walkin.

org and we'll also be doing the entire hackathon both of on the walkway Discord which you can access at discord.edulecoin and at the external Discord on the sponsors um Dash working Channel yeah we wanted to give a little shout out at these three projects SEMA for havaland wallet connect which are kind of like the perks that are allowing us to do all the things that we're doing here most if not all of these products actually all of these products are open source um I'm sure everyone is familiar with wallet connect Hubble listen all pretty baby film foundation and semaphore is also an open source product by some really really cool people and those are the things that really enable all of the stuff that we're doing there here and yeah we we got started with this around East Amsterdam so um foreign of this year and we've been working into making more apps like the lens integration we're working with a git coin passport to get integrated as well and many others and we are hoping to release this multi-chain right now it's mostly on polygon but we'll be moldating hopefully by early 2023 and yeah I'm I personally think it's a really really exciting solution I've made a bunch of things that sound super hard but really just take a feelings of code like a contract that will receive any tokens and split it um through every human on earth or at least every human that has registered and things like before you could just not think of how to do and yeah I I'm really really looking forward to see what everyone else makes yeah if you have any questions are both these upstairs uh on the left first one that you see and will be here weekend you have this card I have purple hair pretty easy to spot yeah thank you for listening hope you have fun [Applause]