DAPPCON 2025: Meerkat, building a ZAPP (0xparc SDK)- making privacy social - Miriam Neubauer

Transcript

Thank you. Wow, this is very bright. Uh, okay. Actually very bright. Uh, good morning. I hope you had a wonderful morning. I'm Miriam from Mircat and I will be talking about how we went from zero to one after having our app at several hundred talks. And um, Mircat is a uh, events app. um it fosters better audience engagement and it's open source and it's uh privacy preserving and the center of it is um the Q&A. I'm going to just try to stand out a little bit off the light but I don't think that's going to work. Um yeah, so uh I will dive a little bit into which product decisions

we made and which helped us guide our uh product decisions in terms of uh being between privacy features and utility. And then secondly, I'll also be talking about the programmable cryptography elements that we are using. Um, and we were using the SR X Park SDK. You're welcome to scan the QR code or actually please scan the QR code. Um, then you can experience the app. Um, as I'm going through the slides, um, this is the fully anonymous version. As I'm going through the talk, you will see me talk about the Zupascated version. Um, but it'll still be nice to follow along.

Maybe some of you have been to Defcon. Um, and this is what it looked like basically at a at a large event. Um, I would say raise your hand, but I really can't see anything. Um, yes, maybe some of you have been to conferences and it was hard to uh um ask a question um or the microphone got passed around. So um yeah, Mircat has these advantages that participants or attendees say that they feel safe and inclusive. Um we have about two to three times higher engagement rates um that we see that people ask questions and it's also great for organizers. organizers.

Imagine spend a lot of budget on um these events and it makes sense for them to um double down on the engagement at the live event itself and the intensity and using software um that makes that engagement uh better. And uh for speakers it's also great because they know they get the questions read to them in a prioritized order and uh not just um randomly when the microphone is get passed around. And thirdly, it's a little bit of a multiplayer game. You also have the MC that has something to do while they're talking and the audience is doing something. Um, so this is very great also for talks uh for the Gen Z attention spans.

Uh, yeah, and sometimes it fosters engagement even after the talk on other social media platforms. Why do we need better event software? Uh, this is slides from Richard from Cox Park. And so the software stack for events and crypto is based on so many in real life events is um still the same old one. You uh sign up for a ticket, pay it, have your transaction there, your role permission in this system, then maybe you get an email confirmation and then you're also in a telegram group. And wouldn't it be nice if all this data was um more streamlined and the user just owned these uh their transactions, roles, permissions once?

Why does it make sense to build a Q&A or live engagement app? Now, um so when you look at like life cycle theory of products, early when the internet came out, it makes sense to um build something where you can win in the market by having a better product. And then as the market matures, you usually have to put in much more marketing dollars like you saw maybe over the last 1015 years where you got vouchers for ride hailing apps and so on. Um and then the market matures even more and the technology moves on and you can get uh you can build a product for the market again by improving a core feature such as what we're doing with the privacy

preserving part or yeah other angles and I think this uh fits very nicely from where we are at. Um so for us as Mircat we have to both focus on making a better product but also on distribution. I'll go into that um in a bit. And some of the technological advancements that make our app possible are 10 to 12 years ago. Uh everything encryption related um especially client side proving was still more of a research pipe dream. And these things uh yeah as you can see here every week there's new advancements um that are just very exciting and make it very accessible for web developers to work with these technologies. And then

um secondly also in terms of AI agentic systems um MCP servers or other things where that just want to use data it makes sense to yeah build something that can work with these architectures as well. Okay. So for us, so like I mentioned, we were building at the interface of privacy and utility and when building a product um we had to scope away a lot of features actually um and stayed a really very long time with just the core product. Um over time though we are adding on more features that reflect our convictions and inspiration and these were some of them. So we want this new

internet to feel safe and inclusive for everyone. Um we want we believe that people should be able to reveal what they want to reveal when they want to reveal it. And um we also um I think that live uh audienc's engagement has a lot to do with being playful. And we uh my project partner and I we have an interest in gaming and uh looked a lot into autonomous worlds which is um the concept that came out of Sax Park um after they built the game called Dark Forest and yeah so a lot of how we approach product actually um we use a lot of gaming language like we

don't say product market fits so much but more okay we have to get the core loop right and you yeah that's what we try to get into the app. There's a few more. Oh. Um, yeah. And then in terms of distribution, um, where are we at? So, these are just some examples. Um, we were lucky to have been, uh, present at Defcon or last. Those are the hosted versions of the app. And then we also did some integrations because we have an open API um at Switzerland for example that automatically lets you create Q&A events and uh in another way the Ethereum Foundation for example uh ran their own instance of our software because they

had much more sensitive data. Um another fun integration was for example Fileverse or this was from Protocolberg. Uh yeah, this is for example the Switzerland integration where you have a session and you can right away create the Mircat link and these are screenshots from the integration with Filever. So if you've been to Defcon, you can still review all the talks including all the questions that the audience asked um in the Defcon app but also in FileWorth. Um so the the data is already the collective intelligence from these questions is already propagating Yeah, to sum this first part part up, um, yeah, we really had to focus on just

the core uh until we really felt uh it was we've tested it enough. It it kept pushing us into going into testing mode and testing early even when the product didn't feel ripe at all. and then um uh because we wanted to make sure that our app can rival with the dominant apps uh in terms of UX and then later again expand um and then the same goes for the privacy features where there are some compromises but um it's important to start somewhere it was for us and then keeping the larger vision um in mind and and adding this back in um about the tech. So this is what the app is built in. Um I'm it's a note app and it's

fully open source and I'm going to explain a little bit about the um privacy tech. So it's using supass which is a credentials manager. Um and that's what it's called a Z app. Um yeah that's just where the name cames from. And then this is using the Z API which is the software package that lets you uh connect to the data in supass. And then there's these three words. Um we also had to wrap our head around it. Yeah. POT, PCD, and GPC. And POT is just the data format that the provable data Yeah. comes in. PCD is when the GP uh

when when the data is proven on a GPC and the GPC is the general purpose circuit. Um and that's a um yeah pre-ompiled cryptographic uh circuit that facilitates um zero knowledge proofs in the pot format. Okay. Okay. So where in the app exactly are we using uh these technologies? This is uh three features we had at Defcon. So one is for identity, the second one is for ownership and the third one is peerto-peer.

For the identity you have to log into Zupass and prove your ticket in order to be able to ask a question, vote and uh react to the talk. And so this is using um the ticket proving and also the Z API and it generates and consumes um the pod and this is uh what it yeah looks like in the um sequence diagram. So the web app creates a connection to the app connector. The app connector is this popup that comes up and once that connection um is established and synced to supass.

Yeah. Then the web app requests the ticket proof from the app connector. It's it's the drop down where you select um your ticket and uh the app connector generates the proof and sends it to our back end where it gets verified. Um and once the verification is done, the uh access credentials will be returned to the web app and the user is authenticated and can interact with the um yes can start adding questions. You might wonder where the proof even comes from. Um I'll explain that in a second. One quick reality check about this uh is that you see the additional popup.

So UX- wise that's medium ideal. Um and also some setups don't work still. This is at least um when we used it in a big scale for the 12,000 participants at Defcon. Um yeah and the proving time especially at conferences sometimes the Wi-Fi is bad. It can take a few seconds and then users drop off when it loads longer than two three seconds. Um, and something we also realized is identity wallets sound really nice. Um, especially if you do it for one event, you have your ticket in the correct wallet uh or credentials holder and then as soon as you go to more conferences, you have multiple supas accounts and it starts becoming um

hard to use and we have to help people what these identity wallets were built with in mind. Um and then another thing with the privacy um so the ticket proof itself uh gets into your zupass by being um signed from potbox which is from 0x park and that is being uh fed with email addresses. So it's not end to end private in this setup. The second uh part where we generate a pod um that is not consumed. So in the ticket proof we the pod is generated and consumed as a zk proof. And here it's only it lands in your zoo pass is one um an attendance card uh which is yeah it

just has some information about the talk you attended and then a second thing is uh your summary pod um which shows your which rewards your engagement if you added a lot of good questions and other people upvoted your questions that means you added high quality questions to the for the whole audience and that's kind of summed up and then if you open your zupass to see a list of all these little data nuggets that you um collected and that got generated. How does this Yeah. So if you zoom into one uh of these parts of the different kinds then yeah this looks like on the front and on the back side of the pod you would see the part um chasing with

all the attributes that can be proven by a downstream app. Okay, what does this look like? Yeah, the web app um requests the attendance pod from the back end. Um it gets inserted into the uh app connector gets synced to the Supass server at which point it shows up in the user's Zupass account. Um once that sync is complete, yeah, it successfully is in the Zupass account. And a quick look at the JSON itself. Um what's important here is that each one has to have an owner. This prevents pots being a being sent uh between people just randomly exchanged. So it has to be

owned by one person. They can't just forward it. Um, this one is also it's signed and then the this part oops with your public key and then I guess the middle part from track to supass title is the attributes that you can give the the pod and you can make it look however you want to. All right. And then the last one is peer-to-peer. It's a speaker feedback. This is uh actually lands in both the speakers and the attendees zupass. And this is where the attendee yeah writes some feedback and the speaker has a page where they collect it. Um in both parts in order to click sign uh with the public key from the Zupass account um

Zupass identity the app connector opens as well as for connecting. So for the attendee again um it yeah requests from the app connector to sign the pot. It wants to give as feedback to the speaker. um same stream gets inserted into again synced with the supass server um sent to our back end and once it's stored on our back end then the speaker can come and pretty much do the same thing. Um yeah so here's another example uh three learnings. So to do all of this you have to have an identity connected to your um to your app. In this case, we're using

the supass identity, but could be anything um that works with with it. Um secondly, now you see we have a list of proofs that somebody can call on. Um and it's important to keep this downstream consumption of the pods in mind when building an app with it. And third, the third thing we noticed that at at least at that time in November, um client side proving still needed some adjustments uh improvements. Um I'll skip to this part. I'll skip this also. Yeah, what's next for us is actually maybe this is this was actually a talk at the web 3 privacy uh hub yesterday upstairs um where they were talking about okay maybe this ties in

with our experience maybe humans don't need one identity account that holds everything um but rather yeah other kinds of um temp temporary representations of your identity. Um, at least that's also what we saw how people use Supass. Okay, so for us, these are some feature ideas. We want to build in threads so that um people can also answer audience questions um knowledge and trust graphs such as uh circles maybe even um if you're using that. And yeah, I guess we have an we have an open

uh open source repo. So you're more than welcome to get in touch with us if you want to uh build on Mircat um or any of the pods and yeah equally if you're interested in in using the app at an event um feel free to get in touch with us. Yeah, I think I'm going to end it here and move to the questions if there are any to to showcase that um way as well. Okay, cool. Thanks for switching. All right. Um Okay. What was a pivotal moment? Uh maybe for explaining. So, usually if you if there is an MC, somebody would have um an admin role and mark the questions as selected for

answering as I'm doing now and then they can check it off. So this is the where the multi-arty multiplayer game aspect comes in. What was a pivotal moment for getting product market fit? Yeah, product market fit. I'd say we have some, but um probably the most rewarding aspect was the surprise effect when we were at Defcon and how many people then tweeted nice things and were really loved interacting with the app and we talked to some of our top users who uh contributed I don't know 40, 50, 100 questions why they loved it. Um I think

that was really rewarding and um pivotal for us. And then also the support in the Ethereum ecosystem um from the Defcon team was really amazing um when we wrote the DIP and from Zox X Park as well. So probably those those two things other people believing in it and um yeah giving good feedback on the usage itself that we could not have predicted. Is this a startup and nonprofit? That's a really good question.

Um, so we started at the East Berlin Hackathon last year. Um, with the goal in mind, we want to do something that lasts and has a real value. Um, though at the East Berlin hackathon, we created a different product and then pivoted to this one. We did receive a um small grant funding from Zero X Park and currently it's I guess what you call in Germany a GB. Uh it it's it's two people working on it. Um yeah, I hope this answers the question.

Okay. Love that I don't need to sign into another application to interact. Yes. So the version you're currently using is the fully anonymous version. Um, it's tied to your phone with a JWT token. So, that's a little bit of a tricky thing. Um, but it's very lightweight and thank you for the feedback. Will you uh will you integrate more authentication methods? Um, feel free to find me after the talk because the time just ran out. Um, thank you so much for listening and I hope you enjoy the rest of Devcon 2025.

[Applause]