Know Your Degens Oracles - how to do compliance the DeFi way by Matt Gurbiel (@mattgurbiel)

Transcript

hello everyone so my name is Matt and I lead BD for Redstone which is an oracle provider and what I'm going to talk about is sort of related to Oracles in a sense that it uses the same infrastructure but in a slightly different way than than intended probably but first let me start with a bold statement so I really believe that hard regulations are going to kill most of the protocols that we know and love today unless they know how to protect themselves the right way how to protect themselves

correctly so recently we have seen a lot of mainstream media coverage if it comes to the web 3 space in general we've seen a lot of headlines about turmoil about businesses going past about retail money being lost in the process so I I think it's fair to say that 2022 is probably not the best year for web 3pr in general and that is something that puts pressure on The Regulators as well to act quicker to interfere more to be more engaged in what we do here to be more present to have more control over what is happening

here in general and just to set the cards on on the table and we've seen that very well especially at the beginning of this week or this whole mess with usdc and with this whole mess of with sdb bank and Signature Bank going Bust or being closed in general with its probably unclear connections to the government itself and to the fact that it was a crypto-friendly institution but we are definitely going to see more and more of such things in the upcoming future so not that Regulators need any more encouragement to be present in this space they are already encouraged enough so I believe that if it comes to hard

regulation in web 3 so the type of Regulation that we now think is too much but this is also the type of Regulation that we are going to think as normal all the standard probably in the foreseeable future so if it comes to these kinds of regulations I think it's rather the question of if than when sorry then of the question of when rather than if so it's rather inevitable in my opinion but obviously different countries are going to implement these regulations differently there is going to be countries that are going to have the throw the baby out of out with the bathwater approach like the U.S probably there is going to be countries like the

UAE maybe with some more sort of liberal or strategic approach to the topic but one thing I believe is certain and the procedures of kyc and AML are going to be one of the main pillars of implementing the new regulations in the foreseeable future and right now kyc and AML mainly refers to the on-ramping process to web3 so mainly if you want to do some things with centralized exchanges or or on-ramping providers then you have to go through the kyc AML process but I believe this is going to be extrapolated to most if not all of D5 so probably in the future you're going to see more and more d-apps

being permissioned by kyc or perhaps the whole blockchains being permissioned by by kyc as well perhaps things build customly on Cosmos SDK or Avalanche subnets or perhaps Base by coinbase is going to go that direction in the future we don't know yet but that's that's also possible but I think it's both good and bad it's it's good in a sense that D5 finally recognizes that in order to have institutions present you need to have a very well set up legal framework for them to operate because what we have right now it's not it's not clear it's not enough so in that sense that's good because it's a sort of mental shift that we have

to go through but it's bad obviously because the D5 principles are at risk the anonymity the accessibility the fact that you only have to have the internet connection in order to be able to participate in the financial system is something that we fight for in this space and this could be lost if the regulations are not implemented correctly so the point is that kyc AML is inevitable but at this point as we speak it does have a lot of drawbacks to it so the process is rather painful for now I would say it gets expensive depending on the use case but can get pricey per per User it's a

lengthy process so even if it takes around three to five or six minutes it still takes the user out of the user flow and that is substantial time I mean I've dropped out many times from different apps asking me to do kyc because that was just not what I was feeling like I want to do at that particular moment and they just lost me in the process because of that it's very much a one-size-fits-all kinds of kind of solution right now so you all almost always have to submit documents the same documents for even small simple use cases and it's a very frustrating experience in general it's it's painful I believe

not only for me but for the general general public as well but the future does not look brighter at all so let's say we extrapolate this trend and we do kyc permission D5 then we are probably going to have around 15 to 20 different kyc providers each of them requiring to log in to different applications when you are going to try and when you are going to be trying to use different applications you are going to have to log into these Services as well a lot of pop-ups a lot of collection of your personal data huge counterparty risk because each of them can go you know can have a breach or or anything like that

so it's it's really dangerous for your personal information as well and this also means that each time you're going to try to interact with defy you are going to have to have your document documents at hand you're going to have to have your utility bill bills your driving license and all of that that we all keep at hand at all times and the thing gets worse if we think that it's possible that big D5 applications are going to want to have a proprietary kyc process so it gets even more fragmented and besides I believe that you would not want to give your ID details to each Decks that you have ever interacted with I mean that's that's the

case for me probably for you as well so it's painful it's becoming more and more and painful and the future does not look bright on that front at all but what if and that's the hypothesis of what we do at Redstone if it comes to kyc but what if we could try to do it differently so use a different approach more data-driven approach to it if you will so the goal for us would be to make it super lightweight from the diops perspective so it should be very much plug and play for the D up but at the same time it should be completely invisible for the end user so ideally

what you would do as a user is you would interact with a protected D up the same way you would interact with the non-protected d-app this should be abstracted from the user's flow if you will so if that was the case then the d-app could stay compliant could exist in compliance with the legal framework and the D5 experience in ux would stay the same as it is right now because after all the d-apps call if it comes to kyc IML process is to minimize the risk it's not to eradicate the possibility of interacting with wrong

users or sanctioned users but it is to minimize the risk and the user's goal is obviously to just interrupt the D up without any additional additional steps and we believe that there is a way to do it we've called it kyd Oracle and kyd stands for know your data know your D5 or know your Degen however you want to call it it's all correct so basically what it is it's like a firewall over a smart contract that protects the D app from interacting with restricted users without adding a single step to the ux of that the app we believe that ux is sacred here especially in D5 when you have different Forks of different applications you can switch between them

you have to have this this ux very much the smoother it gets the better for you as the d-app so the premise here is that we are not adding any more steps to the user's journey and let me get into the details on how that works but before I do let me just give you like a brief introduction to what we do at Redstone so in general we do oracles but mainly on-demand oracles which means that we keep the data off chain for as long as possible and then push it on chain only when it's needed so the user flow is the user wants to interact with a lending protocol say Ave and when they do when they send the transaction that

transaction has to go through our layer first because we act like a wrapper around the smart contract of the d-app so it's wrapped ethers JS so they have to go through our layer first and that is when we add the data from the data delivery Network to the call data of the user's transaction and that's how it gets pushed onto the target chain so we've used this mechanism of wrapping the smart contract of of the d-app to create a firewall because we thought that okay what happens if instead of just adding data to the transaction that user triggers when they go through this firewall layer instead of that we could just put a set of of conditions that the

user has has to check and if they don't we can just bounce the transaction the transaction reverts so that is how the firewall firewall thing works high level in practice so diving deeper to give you an example let's say there is a subsidiary of Ave that's established in the US so they have to comply with the U.S regulations so to be specific they have to bounce any user that has ever interacted with mixers or tumblers like tornado cash they have to bounce any user that's flagged as sanctioned by the by the ofak they have to only accept users that have been

already kyc'd by taxes like coinbase for example which is a U.S entity and there is a variety of different checks and conditions you could put into this into this bracket so the the flow of interaction from from the user's perspective is that you just interact with the lending application but from the d-apps perspective what happens is the whole process this check is obstructed from the from the user's journey and it's done on the smart contract level so we as the kyd Oracle check the address of this user against the set of conditions and against the data that is given to us by by the chain itself or by third-party data providers like coinbase and what is important to

mention here is that this is not personal data we just get the list of addresses that have been kyc by coinbase and that is it that is the input to to the firewall to give you another example let's say there is an RV subsidiary based in the UAE so the conditions are entirely different because they have to be and stay in compliance to the rules here so the point here is that you can basically very flexibly customize all of these conditions to your risk profile to your specific business use case to your regulatory environment that you have to operate in and you can also customize the data

providers that you want to use for this specific check and after all as I've said AML kyc is all about dealing with risk so obviously it does not eradicate a hundred percent of the risk it just minimizes it to the point that is acceptable by institutions that is acceptable by big big players in this on this Market you can think of it more of a like like Risk scoring so it's not like a hundred percent but it's like 99.9 which is acceptable for for the players on the institutional level also what you can do is you can set different brackets of checks or conditions so let's say the level one

the softest would be I want to only accept users that have ever received any transfer from coinbase whatsoever level two would be I want to only accept users that have received the transfer from coinbase for at least a hundred dollars and the level three could be I want to accept only users who have ever only received transfers from coinbase and not any other wallets to make it strict so in through this you could actually limit the access of users per different bracket to different features in your D app or different parts if you're the app and that is why this is very flexible in terms of layers of security not only

like zero one Boolean type of check also going a bit into the future you could also add some business Logics to it like General business Logic for example I want to exclude Bots I want to exclude people who have done less than x transactions uh in a given time frame I want to only include people who have a VIP nft pass so that's also possible the hard compliance compliance things is what we have focused first but if you do have a use case that you would like to use it for with like the general broader business logic feel free to reach out to us as well things like civil protection um it's all it's all possible with that

as well so just to just to summarize the points that I've laid out here why use this instead of just building other kyc standard or use a kyc standard slash provider first we are not collecting any personal data here we're not collecting any more data to be honest than it is already collected through kyc processes that you've gone through so we reuse what's already on chain what's already in the databases of the data partners and we don't have the access to your ID to your driving license to your documents we don't even know who you are we just get your address as the address that is safe and sound okay that is

checked or kyc'd and that is the input to the check that the kyd Oracle does it's very flexible in terms of defining roles because the logic could be anything you would like it to be pretty much depending on the regulations depending on the risk profile depending on your risk appetite as well so how much risk you want to take versus how big your target group is you have to balance things out on your own and you just give us input and create conditions that we set up in the kyd oracle it's real time as well because if it comes to standard kyc processes then you have to update your information once in a while so if that is like 20 different kyc providers you are going to

have to do it constantly you constantly have to have your documents at hand whereas we just use the updates that you do at the kyc providers so you don't have to do anything more here we just have the data up to date because it's either coming from one chain or it's coming from our partners so the data is up to date already you don't have to update anything here as well from the d-apps perspective it's also super important because they don't have to do anything it just works it's plug and play and probably the most important thing if it comes to the whole flow is the ux so it's indivisible from the ends user and the user's perspective it does not bring them out of the user flow it does not screw up your conversion rate

because it's just not not visible for for the end user and the premise of it is that with thing things like this with tools like this institutions are going to be finally able to interact safely with D5 plus bringing liquidity and slowly working towards what we like to call Mass adoption in the near future hopefully right quick demo it's not a live demo because we all know how live demos work but in general just to give you context this is a very very simple application that's built by our founder Jacob so what it does it's it it checks your

address against certain conditions or sets of conditions just as I've shown you about five minutes ago so what you have to do is you have to connect your wallet and then you have these sets of conditions so first is I want only users who have received transfer from coinbase second transfer for at least a hundred dollars in the third only transfers from coinbase and what Kuba does is he checks the the most strict level so you just sign a transaction as you would interact with with the D5 protocol normally and maybe I can just make it quicker it's not it's not the

most dynamic demo you've ever seen and that's basically it so you get mint today token which is like a stamp of approval on your wallet that you can access all of the features of this particular application because you've gone through the most strict part of the automatic kyc slash AML process and obviously same situation would happen if if you try to do he just switched the wallet so he's now trying to go through the second level and just to show you what happens if you don't pass these conditions so you interact normally

you sign the transaction and and what it says is that you don't have you don't meet the conditions of the transaction just reverts you don't have access to this particular protocol very simple not visible for the user plug and play for the Ed app but still it makes sure that you as the D up stay within the compliance boundaries within the risk boundaries set up by by your

regulatory factors or by your risk appetite okay so when it comes to what's next it's an MVP it's an early stage kind of hypothesis product that we have but it does not mean that we haven't done anything about it yet so what we are doing right now we are piloting with couple of different projects and institutions an example I could give you is the Signum Bank from Switzerland one of the one of the household names if it comes to crypto in Switzerland but in general my call to you would be that if you see that this approach towards compliance could be useful to your

application or your business in general feel free to reach out to us we are more than happy to bring on more projects and businesses for a pilot integration we want to learn this Market as well so it's you know it's a great value for us as well to be able to bring in somebody new with a different set of needs and business problems especially when it comes to compliance when it comes to staying compliant with with the regulations different types of regulations as well so we want to learn directly from the market so if you have something like that then feel free to reach out to us and obviously when it comes to the path forward we are experimenting heavily with this product obviously it seems like a great use for

ZK proofs as well so show me that you have a proof of the user being over the legal age in their sort of state of residency and not only that they are kyc by coinbase so for that ZK proofs will be perfect not to have the access to to personal information it's probably down the roadmap first we need to verify the most underlying hypothesis about this product but if you don't have um any use case that you would like to try it on just feel free to reach us out you can do it via our Twitter and Via our Discord you can reach out to me personally as well and that is mainly it from me so if you have any questions about that this would be the best time

but if not you can also reach out to me hit me up somewhere there in the at the venue and probably see you at the side events as well thank you so much for your attention