DAPPCON 2019: Smart Wallets - Richard Meissner & Tobias Schubotz (Gnosis)

Transcript

welcome everyone so I'm Richard that's to be us we are both working for the grossest safe and today we want to talk a little bit about our experience when developing a smart wallet and like the interplay of your eggs and contract design during this process so first I wanted to give for that very brief history on gnosis smart wallets because ignores has developed one of the very first smart wallets and the question is why did gnosis do that right so it all started in 2017 when gnosis was preparing their token sales so there were a lot of people or like they were a number of people in Wolfram just talking

sales ever as a founders form from noses they wear some management personnel from gnosis and then we had to consent those people and all of them together helped to manage this token sale and the funds that are involved in the tokens here but it should not be that they have one private keys that they just share and then everybody of them like every or each one of them has full access to all of the funds of the tokens here it should be more something like okay we have like a majority vote to use one of the like to use the assets also it was expected that there would be a lot of assets involved or like a high-value assets involved in the token sale so there was a high security requirement on this smart wallet so that's why Stephan

one of our founders actually implemented the first gnosis Motech and already this gnosis multisig had the very core features that we still have today as like for our multi six for our smart wallets and the first one has said you have a configurate configurable threshold so it should be possible that you can define how many owners do I need to perform an action with so safe so this is basically a multi-factor authentication so it's even if one key gets compromised it's not possible that all your funds or efforts get stolen because you normally need more than one owner to confirm a transaction the second thing was that you can replace

owners or let's change the owner said so you can add new owners you can swap out owners and this allows you actually to do something like a very simple social recovery so if you have the six owners involved and the canosa small tastic for example and one of them loses a key it's possible that three other owners just say ok we know that this person was the key so we replace this owner with represented by this key with a new owners so that we can recover access for that person and the last point that was already present in the first world was exception world so there are cases where we say ok it's not really required that we need multi-factor authentication for this transaction because it has such a low value so there stefan added the daily

limit so up to a certain limit you didn't have to use multi-factor authentication so having this really nice wallet that worked very well for the company and we were thinking about so how could we give this benefit to our users to the users of our core product and our core product our prediction markets and prediction markets are generated being outcome tokens which potentially have a high value and you want to use these outcome tokens to trade them using different market mechanisms so since we have a lot of like since I can have high value and we want to interact a lot with smart contracts we thought ok let's let's use a smart wallet to provide the same security and to this or an even better interaction with contracts that we as a

company enjoy the signals multisig so that's why we started then that one that's why we wanted to improve on this process say we want to provide also multi say multi-factor authentication as our gnosis multi-site we also want that the user can use some form of recovery we have to see how that exactly works and we also want to improve the contract interaction by up to batch transactions and that is why we started developing signals as safe so this is a completely new set of contracts and the target of this contract was that we drastically

reduce the gas usage we have the same level of security or even improve it and allow a more fine-grained control of access and also improves usability so that it's easier to use like we have seen an hour and the talk from Austin that there is a lot of things that you can do so how did we reduce the gas so the first thing that we did is that we actually store no data on chain anymore so in the previous and the previous version of the gnosis multi-sig could we get the screen back so in the previous in the initial

version of the grossest multisig we were actually storing all transaction data on chain so if you want to perform a transaction you normally interact with an address you send some funds you send some data and all this information was stored inside the contract which actually takes up a lot of storage which and and the user had to pay for this which ignores a safe we decided against during any information on the contracts of any one information on chain this allows us to drastically reduce the gas usage and additionally also adds a layer of privacy since even before like it's almost as if before the transaction was really executed the information were already public on the blockchain while

the signals are safe this will only be propagated once it's really executed the second thing is that we allow for off Shane signatures so before it was if you want to confirm a transaction you have to generate the transaction hash which you so it takes the information of the transaction and all the meta information generate a hash all the users have to sign like all the users take those hash confirm on the contract that we really want to execute this transaction versus hash and once all the users have confirmed that then we could perform a transaction to actually execute the transaction through the multisig with the gnosis say if it's possible that you use this hash you generator off Shane signature so there's no requirement to

actually perform any transaction on chain and then only once you have all the signatures gathered you send them together to the contract so only one transaction is required another thing is that there is still some information that we need to store Unchained that is more related to the contract to avoid that you can replay attacks right if you have some signatures and if you submit them again and again and again and they are valid for the same set of parameters you could replay the attack and for this the only information we store on the contract this is a nonce so the nonce is similar to a normal serum account nonce which will each trance actually increase it by one so that you cannot replace the

text before to do that we had to have out action information again where we had executed stale and we had a mapping with the confirmation so there was a lot more information actually stored on chain to provide the security so the next thing that we wanted to improve was like the security in the access control and obviously the minimum requirement that we set ourselves was that you again have this multi-factor authentication logic and that to improve this a little bit we use the it's very low level now but we use the link list which is a little bit more gas efficient when iterating users and checking if somebody is an owner and obviously we also provides the management functions that we had before where you can add owners remove owners

replace and change the threshold but additionally to that we wanted to make the contract more flexible so we wanted to allow it that you can define logic how the access to the contract is managed and for this we introduced modules so you can enable modules you can disable modules and once and modules enable it is allowed to cause a method extract transaction from module which allows it which allows a module to perform a transaction or any transaction so basically what it allows us to do is something like a daily limit where we say it's a contract this contract has their own replay protection our checks are you an owner is there's a transaction you want to perform is it

below your limit for this day and only once these conditions are true we perform the transaction so another example would be the social recovery where you say you define five friends like five public keys and only when a majority of these keys voted that an owner can be replaced you can actually replace them or like perform the replacement transaction so gaining access by using your social friends and on the other side now that we like we defined a way to extend the access controls there would also be we also wanted to have a way to extend the execution logic so for this we decided to introduce the possibility that you

can perform delegate calls so delegate calls are allow you to take place it is a logic from another contract executed in the context of yourself or of your contract in general what this allows us is something like multi cent multi centers our libraries that we allow you badge multiple media transaction into a big bytes data send it to the multi cent libraries which splits it up into normal like and to sing a meta transaction and then you execute all of them within one assirram transaction this is very useful when we think about exchanges or even compound where you normally have to perform multiple transaction before you get to the final result or like if we imagine an exchange where you first have to wrap

eases and you have to approve this rep easier that you can trade it and then only you can really trade and performing all of these in one transaction allows you that it is auto nominal so if one of these steps fail none of the other one will be executed and one of the other improvement that we focused on was usability improvement so we wanted that it's possible to pay or pay somebody else to execute your meta transaction this is for this we introduced a couple parameters here and with this we can basically define how much like if somebody else takes your signatures and submits inclusive contract how much

really get paid for doing this action so we can see here we then calculate how much gas was actually used so it doesn't matter if this real if the user or the meta transaction actually failed and we shake how much gas was used and then the person who submitted the transaction to the contract will be reef will be paid for this amount of gas in the last but also very important improvement was that we decided to use proxies so this actually touches all three areas so it's security improvement since now with the proxies there is a logic that we can upgrade the contract allowing us if there is something where we have to do a

security fix users can actually upgrade the contract to new logic without having to shift over all the funds also it touches gas optimization because deploying the whole know as safe contract cost around $20 currently and if you use a proxy contract that's below $2 so it's a 10x factor of a cost improvement and obviously it's also a general user usability improvement since we constantly adding new functionality to the core contracts and then the user can just upgrade to make use of this functionality so how are we doing that we it's very simple we have a very small contract where you define and at the first variable master copy this in the

same position also on the master copy we define the variable master copy and then we provide a function which basically lets us which allows us to set then the address of the master copy so when we upgrade to version 2 we can just point it to the new version so if we want to summarize it like from how did we go from the old moses multisig to the new Canosa safe so the old mode I said was not very like it had a very high gas usage org transaction information restored on chain you could only use on chain confirmations to confront change and that you had to use transaction to confirm unchain the transactions why when you use the save which is very

optimized on theirs you we don't store anymore information on the Chinon chain and you can use off chain signatures to save gears from confirming transaction also signora's multi-sig was not extendable so if you wanted to extend logic you always had to write a new contract extend from the based contract just to introduce new functionality and it was not possible that you use like a delegate call to pull a new execution logic on the other side signal so safe like what's written was xn was written like if the purpose was to for it to be extendable and we had there's a to propose like the two ways that I presented there was a module to extend access

logic and we had the libraries to extend the execution logically and the last thing which becomes more and more important as really the improvement and usability so before it was you had to have some it's your knowledge you had to have your own external account which you fund was easier and you you had to deploy the contract yourself and there was no way around it why was the safe since we have the refund logic and we can use signatures it's not really required that the users and has any account with Ethernet besides the safe all right thank you let us now take a look at how these contract decisions or design decisions basically influence the actual UI UX we

would take a look at the gnosis safe for individual users and then compare that to the ignore safe for teams which is our solution for teams managing funds collectively first the interfaces so the Dinos is safe for individuals are actually mobile apps because yeah well we learned that not everyone carries around a laptop on a daily basis and basically there's a lot of people who would like to access their crypto on mobile these are actually live on youthere main that you can download them on the iOS and on the Android store the ignore safe with teams is actually the direct successor of the old notice multi six does monastic and this is actually a

screenshot of the interface it was a web app and the first version of the team safe will also be a web app because yeah our user research has shown that for teams it's mainly it's still a test abuse case and they're not well they don't they're not all the time on on mobile we don't have that amended yet there's a wrinkly Testament version available and if you interested in using that ya go to our website and sign up for our beta test we hope to have our we plan to have a maenad version available until October all right you can also say for teams is designed for actually full

flexibility and for full control so you can ya create a multi sacred specify the number of owners you can add owners replace owners and we don't do a lot of things to abstract away the underlying tech because what we've learned is if there's really a lot of funds and people still are double checking what's going on and so that first version will have that also you will be able to choose the basically own a wallet of your choice so it can be meta mask it can be it can be yeah well connect enabled mobile wallet and it could also be our Ginoza safe mobile

apps in contrast to that we made some different assumptions when developing the keynotes is safe mobile app so there this scenario we had in mind was that users have barely more than two devices so they have their mobile phone which they have yeah with them at all times and then they have potentially a laptop and so at the second factor device that we use currently as a Chrome browser extension both of them have their own private key and that private key never leaves the device thereby we basically reduced the risk that this private key gets compromised now when you want to make a

transaction first you start on your mobile device and then you need that second a signature in order to make it actually happen we've learned that well having just this browser extension is actually a little bit tedious so we are working on adding Hardware wallet support we have a working prototype using the status key card and which we also plan to have life by by October this year and we also in touch with the team from ledger to also support the legend Anna nanos and we plan to incorporate integrate them in a way that you connect the hardware wallet directly to your phone without the need of having to go through some website and through

your laptop again now let's take a look at the actual transaction flows because this is where the differences become more parents this is signal say for teams so one of the owners wants to make a transaction and all the transaction info like address yeah basically which kind of Ezard and and the amount then they sign that with their wallet and then the transaction basically ends up in this way in state now at this point it's waiting for other signatures from other owners basically to appear so they need to be collected and this can take anything between a couple of minutes to even several days or weeks because yeah the

owners or the team members aren't always in the same place once they basically get notified about the transaction they also sign it with their wallet and then one of them has to submitted to the etherium blockchain actually and not to say for teams the owner wallets paid a transaction fees in contrast to that in that knows is safe for individuals but the beginning is actually exactly the same but then when the second factor but when the second signatures are needed we don't allow the user to leave the flow if they yeah they can only cancel or they need to successfully submit a

transaction because our assumption there was if a single user wants to make a transaction well they have all devices or all authentication devices handy and there's no need to wait so essentially the browser extension gets notified they confirm there as well the signature gets returned to the mobile app the mobile app signs the transaction as well and then it gets submitted to the youth in blockchain transaction fees here are paid from funds from within Ignacio safe so we do use meta transactions we do use a transaction relay service for that you can pay a your transaction fees not only in ether but also in EOC 20 tokens now yeah why yeah what are the current

challenges that we faced there's a lot of great tech there's a lot of great ideas but why haven't we seen more adoption of techno safe and actually of smart contract wallets in general first it's still a pretty they're still pretty new so people are just much more comfortable with what they have been presented first when entering the space this is in most cases still meta mask but it could also be any other wallet usually their private key single private he based wallets and so this is a challenge then there's some concerns about security first of all there's this it won't happen to me syndrome so when you have just a single private key if

that one gets compromised or stolen well then you could right away I lose access to all of your funds if there's more than one it won't happen at least that easily in that case and what people just think it won't happen to me and so that's why they don't see the need yet for smart contract wallets then the other extremists and that people are well there's concerns about security and they're not sure that these smart contracts are secure enough and they still have the parity multisig hacks in mind and they think this could happen as well of course we're not able to reduce the risk to basically zero percent but we mitigate that issue by letting our that by letting third-party auditors

auditing our apps and also we had random verification perform formal verification and ignore to safe smart contracts and yeah basically we believe Trust will come over time most importantly though the full potential of smart contract wallets has not been leveraged yet what does that mean essentially there are some features unique for smart contract wallets that just cannot be replicated one-to-one with regular private key based single private key based wallets first there's improved access control yeah the first example is the multi-factor authentication that I've

been explaining earlier in this presentation thinking also safe does support that then you can define more advanced access control schemes spending limits transfer limits that you can yeah maybe spend up to 0.1 0.5 eath without requiring a second factor and also you could work with whitelist and trusted contracts and some stuff like that in this category a very important dimension is also seedless recovery so basically Recovery Options because beyond just the backup of your recovery phrase the classic example is well social recovery where you just specify group of friends that could vouch for

your identity in case you do lose access to your funds the second big unique feature for smart contract wallets is meta transactions so basically at the fact that you can allow third parties to submit your transaction on your behalf so you have signed it first and the smart contract does basically check if you're allowed to make this transaction and this allows us to implement these so-called gasless transactions so basically that the wallet pays transaction fees on behalf of the user long term or well more practically practically we can allow depth to pay these transaction fees and ignores is

safe we have opted for the solution that you can use well besides either you can also pay transaction fees at nearly 20 tokens this is especially important for onboarding you crypto users for example when you get on board with your burner wallet you have X die on the XY chain then you transfer them via the bridge to die on the minute and so you would need either or I guess less wallet in order to make a transaction but they notice a few could pay the transaction fees also and die and last but not least smart contract wallis allow you to simplify interaction with other contracts the classic example here is again

interaction with yeah make a CDP a bit of maker CDP portal so no in order to open up a CDP you need well anything from four to seven transactions and but for the user it's just a single business action so we could batch them together via the use of delegate calls and the user just has to sign a single transaction all right please download our apps try them out let us know what you think and if you want us yeah if you need some tokens to pay the deployment costs and to paid for transactions please find us upstairs at our booth we're happy to under them and yes let us know your thoughts thank you

you