Adapting Tornado Cash for Gasless Token Mixing with GSN2

Transcript

so now we're stuck but what I could do because we don't have that much time you could just start and you guys may be able to see it kind of sucks but at least I'll be able to explain parts of the system and what we've done hello yes I will be able to send anyone that wants the presentation actually again I can send it to everyone like right now I could just post it on Twitter and then

you guys can open it on your devices right that's it's do something more decentralized a centralized computer is not working for us okay so I'm posting I'm posting this right now on Twitter and right yeah that's a thing but we don't have

the key no I don't yeah sure man come in I'll be better I think everybody's waiting for that stuff no I'm just going up I'm going to close this right now let's start a meeting on my phone I'm gonna send you a telegram

oh this is a French keyboard okay can you please the gift that keeps on giving so I posted on my Twitter my Twitter is at Li Raz laura's it's my first name Siri like Apple Siri s iri and i mean if if you have internet access right here like it should be mmm you can just open we can get this like yeah let's just open my Twitter account and we could just get the link from there yeah no I mean then just yeah

right alright ok so then what was missing okay we got you got this it does does

not oh it does okay alright so if we if we have time if either I don't kick me out I will try to like figure out a way to do an interactive demo so with one like a computer out here because I was expecting to be able to use my computer but the gasless token mixing demo is live on maenette so anyone that has died can use that right now and we're gonna be talking a little bit about that and also more generally how GSN 2 enables gasps is a service to unmodified

contracts right and then we're developing this as an open source project called open GSN okay so what what's new and GSN - well we realize that to make GSN exciting it has to have concrete use cases and gas abstraction and gasless interaction with contracts that's you know we realized that it's not something that like new users would be comfortable with they don't have a concept of gas when they're interacting with regular service so we want to make that go away but for this ecosystem you

know most people have a handle on that and we one find it's like very compelling use case that we could show off as a reasons were for explaining why we need to be able to support gasless interaction with any contracts so the you know the the the GSN proposed a way of modifying contracts to be to be capable of receiving meta transactions on their behalf and this means that instead of requiring you know an account with eath on it and then you

have to put that you have to put that transaction on chain what you do is instead you could have system of relays I hope to expand a little bit how that works and and then that really can submit the transaction on on its behalf and in in the minute transaction there is sort of a proof that the relays going to be compensated from another contract so you don't have to worry and they get a transaction fee and this has been around for a while GSN accomplished is a decentralized network of relays but the limitation with gin1 is that it only supported contracts that were GSN aware and this has not been established as de facto meta transaction standard yet so

it's really hard it's chicken-and-egg problem and we realize if we want to accelerate adoption for meta transactions we would have to figure a way to both natively support modified contracts that have been modified to be GSN aware and maybe that's that's the the ultimate integration but also figure out how to support unmodified contracts if you want a meta transactions today so what's interesting about this is when we do this it creates a new type of business model or you can have a contract that is providing gas as a service and this would be something that could be useful for wallets for example and then you know the wallet could make it very easy for their users to interact without eath with taps on the theorem

blockchain and though the wallet is paying for the gas fees of the users as a service so that wouldn't require the usual kyc process if a user wants to interact right now they have to buy eath and buying eath is something that usually requires a kyc process but if if the wallet is just paying for your gas as a service that does not require kyc it's easier it's also possible to implement other types of business models so for example the hosting model that we have with servers is you know if you don't want to host your own server you pay someone else to do that and users they don't have to think about oh I'm gonna pay for my interaction with a server and you could have something like

this for daps weird app sign up to a gas as a service provider and at that point the onboarding process for their users may be all the interaction is abstracted away and it kind of looks a lot more like a web 2 app so we will not be able to do this on my computer but this is working live on maenette there is no link which is unfortunate but it's GSN - tornado actually may post on that on Twitter yet later it's GSN - tornado dot open-open 1/8 dot dev that's where the demo is living

right now and it works on both Colvin and main it and the way I set up the demo is you have you have an account that only receives die the the use case is let's say I want to perform a contract and I don't want to give away my main account because then wherever I'm working for they can see all the other contracts I'm getting to see how much money I have right like I'm giving up all my financial privacy and that's not really desirable so these cases I could create an empty a new empty account that has its never been used before and he can give that as the recipient address this is kind of how like Bitcoin HD while it's work they generates these these one-time addresses

and that works great for eath if you use a mixer but it does not work for tokens and if I want to get paid in stable coin I USD C because I don't want to speculate on the value of eath then I have the problem of okay I receive these tokens how do I transfer them to my main account without compromising my privacy again if I send eath from my main account to this new account and of course like the accounts are linked and being able to support gasless token mixing solve that now you can just and this is the the demo is you you go to you go to this version of tornado that we've hacked to use the the GSN and you know you select an account that does not have eath and you you send

deposit you pay one die for the deposit so I mean the minimum deposit and tornado is 100 died we think it's possible to you know make some improvements and you get back a receipt a little note that you have to save somewhere and then from a different account maybe your main account it can also be another account does not have any East then maybe you wait a while because you want to benefit from the unanimity set and make let other people make more deposits right but at some point you take the receipt which is it's possible to generate as your knowledge proof rum and then you ask to withdraw to any other address and yeah that's that's uh that's working afterwards if

anyone wants to try it or I will like you know I will stick around and show this on my computer so how does it know this is this is a sort of how it works in principle very high level so there's a dirty source source address which what byte well what I mean by dirty is there is there is a person associated but others there's my identity associated with that right and I want to I want to I want to want to clean that that linkage away but because I don't have any eath I can't create any theorem transaction right so what you do it what we do instead is we are signing a meta

transaction and that medicine of exit like we're submitting it to a relay on the GSN to relays is uh like you know looked up by the client code it's something that can live in a like does live in your browser and then what that happens is that you know the the relay it checks that GSN to makes your app it has sort of a gas tank it's it's registered in the GSN as offering to accept meta transactions on behalf of tornado cash users or you know users of this demo but it first checks that the user has sort of signed a pre-authorization to charge the gas for that transaction and the demo it's just

one die they make sure that part of that transaction once it's submitted will pay for the GSN two mixer gas fees and then once it's submitted the GSN two mixer actually authorizes one of the relays to pay for it the relay space for the transaction and any for the gas and at that point is just like a regular etherium transaction right and behind the scenes you know the relay gets gets there there eath back from the GSN to mixer wrapper and again this is trustless you don't have to relays don't know they don't have to trust or know about the GS and to make sure this is

happening through the relay the really hub brings all the participants together and so the GSN to Mexico doesn't run out of 108 itself then it swaps the dye for 8th and we can do that dynamically in the demo we're doing that statically just to simplify things and charging a one die but probably makes sense to do this in a more dynamic way in the future so this is what happens in the background so yeah the the client it's it's it's signing a meta transaction that gets turned into a relay call right well the relays looked up we've sort of

assumed that we did that step already and the relay call is a call to essentially Ike asks the GSN to rapper like you know are you willing to accept this call right and this is this is a view function so it doesn't cost gas and you know what GSN - mixer does is it actually goes to the the dye you're the dye contracts right because you have you have on your address you have some dye to your to your credit and what we do is die also natively supports

meta transactions which is how like we don't have to modify a tornado cache and we can still use external accounts so what we do is we we sign we sign a transaction to authorize to give like you an allowance to pay back the GS and to mixture that's the first thing you sign in the demo and after we say ok we see that died says yes you know the allowance has been signed then and we we do uh we do a pre relayed call which eventually results in a transfer from from the client to the the mixture itself and then you know the mixer it serves as a as a as a proxy like the GSN

to make sure is a proxy Edition didn't tonight Oh cash so in one atomic transactions it will send the the funds tornado and then it settles it settles for itself to die by using unit swap and refunds it so and then when you withdraw so the you know the the but this this this flow enabled that wasn't possibly before you could use you could only use tomato cash if you already had eath right now the advantage of using the GSN for withdrawal is it's slightly different because tornado cash did integrate their own centralized relay but they also integrated a feature which

allows you to specify okay you'll want to use like another relay or want to use a different wallet and we take advantage of this to wrap around a tornado cash so what happens with a clean target address it's an address that can have nothing they can have no 'if you could have you can have no no no die it's it's completely it's completely clean and empty and it signs it withdrawal request to the through GSN like it submits the transaction to GSN to and then this is verified by the GSN - mixer which is proxying the request - tornado cache and asking like okay is this recently you

have a receipt that's one of the things what you get back when you do a deposit right and you can submit this receipt back say okay now now give me a hundred diet and it's a it's a it's a view function so the view function is called a actually there's another flow but I didn't know if we had it would have time to do another flow I can do that after and bottom line is the funds are withdrawn from tornado cash using the gSN's decentralized relays which means that anyone like anyone can this happens transparently but if you use tornado cash without this then you there was there's one specific relay that you're

using like the the dab selects that for you and there's there's a fee involved and it's not a competitive relay market like the the GSN and also you know if someone wants to prevent you from using the depth they if they take down the relay they you know attack it do it now service attack then nobody can use the depth and the GSN like anyone can set up their own relays and like the client code automatically selects relays so all right so let's talk a little bit about what's happening under the hood for GSN - but first a primer I'm not sure everyone is familiar so just explain

like what what what the decentralized network of meta transaction relay means in principle many transactions are a format of signing a message and then if you give it to a relay the relay can can sort of open the envelope and turn and submit that as a transaction but there's the problem of why would the relay do that how do you incentivize the relay and what the GSN does is it uses a non chain contract called the real a hub and essentially to create this registry of relays that anyone can set up so an eephus client what what happens is they are looking up relays on unreal a hub selecting a few

randomly that have been giving service recently and they they sign the transaction and and they send it to the the first the first relay right they get back an immediate response the relay of course a checks with a relay hub that there is a destination contract that is willing to pay for the transaction because the relays is getting transaction fees so somebody has to pay for that right and then yes if the the collect call you know that's another way of thinking of it is allowed you see transaction fees and the way you prevent relays from censoring you or for doing like you know blocking you for too long is after you get the the request back you can it's assigned its assigned

commitment on behalf of the relay to submit the transaction on chain and timely manner if it does not do that then you can the like the the other relays can penalize it so you can submit you can submit all relays have a stake they have a Nita stake into the system in order to participate this binds them to perform like some level of service and if they don't do it then they're signed covenant is something that you can use to penalize the misfunctioning we light so in GSN one we got all this to work with GSN aware contracts and and I was nice but but there is a catch 22

of until you have well established standard as a DAP developer you're not sure like what what to use would you make modifications to your contract also this doesn't work with contracts already live on may net and if there are multiple competing standards or competing approaches as a DAP developer you're just incentivized to wait and see what happens but then this results in a deadlock where no standards no standard can become dominant enough to consensus and then DAP developers continue waiting so for the GSN to we we still still make it possible of course

for contracts to interact in the direct integration with a GSN and then this allows yes and aware contracts can interact with external accounts so if you if you look at a block Explorer you would see the tokens or the you know actually to the to an external account to an external key and and and still work what we changed the GSN is that we separate the logic of like whether yours recipient from what would like who pays for it so you could be a recipient you can add a very small modification to your adapt that allows you to be a

recipient of meta transactions without any of the accounting logic without having to decide like okay how do I pay for the transaction and then there's a separate system of paint master's paint master contracts they could be run by by wallets or you know gases service providers of all kinds and they can fund any contract that is that is a GSN where directly even from external accounts but to take it a step further this is or really excited about is with the same architecture we can support and modified contracts but we can't we deploy through the GSN to a gasless account so at the minimum this is a proxy it's a proxy it does require some some changes to client

code because you know the owner let's say there's died in this status account the dies registered to the gasless account and then this gasless account maybe is just verifying the signature from an external account right but if you're using a regular like a client that doesn't know about any of this then it would look on changed it's like you don't have any died right so the the client would need to know about the gasless account and we're also we're exploring like different approaches for guestlist accounts we've created one type the top demise to work with a GSN and has a flexible security policy but the the the most simplest simple version of this is just a proxy contracts that

verifies that an externally own account has signed the meta transaction that's it and this works now with any anything on the if you're in blockchain so so yeah that I mean if you want people to actually used apps the apps can control their o tokens and some of these tokens can be swapped free on unit swap and maybe you know the DAP has an incentive to to give you Stoke tokens to get you started but because you need to get eath from somewhere then that complicates things and we think we can remove one of the roadblocks to mass adoption by

getting rid of of gas as something that a user has to be aware of so this is sort of an example of a GSN two token pain master and this is something that we could implement once and we actually we have implement it for die as an example and the same architecture that I was speaking about before which is which is here like the last one just expanding a little bit up about it and with the way the GSN to token map paymaster works and this is something that that you can also take a look at the code if you're interested but essentially it checks that well first it deploys their deploys

gaseous accounts on behalf of users that are like authorized like to get service right the deployment of the first classes account could be paid for by itself which is kind of weird because you see an externally owned account suddenly transformed and something else and we use create to to do that it's not very intuitive but essentially we can calculate what the address of this this account is going to be and then you can send you can send tokens here and I mean these doesn't even have to be aware like they they have an external account somewhere that you can extract that away but what happens is you send you send tokens to an address that looks like an external account and and then later you

sign a meta transaction authorizing the the token paymaster to pay for its gas from those tokens and the first thing it does it actually deploys the contract so you see how like a slightly unintuitive situation where a contract is playing for the deployment of itself and we can do that safely without trust because once the once we pass through the GSN to assignment a transaction that authorizes the token paymaster which isn't you know just a contract on chain you have a source code for so you don't really need to trust it either once you have the signature you know that like once you submit the transaction to deploy the

Pigasus account you are going to be paid back for it another way of doing it it's just hit to have a spot you know somebody that sponsors the creation of gas accounts on for users maybe that could be you know adapt that wants to unboard them so we actually have a nice a nice demo and we're making this a lot easier now in GSN to we got it to work kind of in GSN one but it was very very complicated and with GSN two by separating paymaster's from the recipients we've made that dramatically simple simpler and you can have like as many paymaster's as you want different models and the bottom line is now you can interact Daskal see with any

unmodified contract on the theorem blockchain that as long as you have tokens that can be swapped for eath on unit swap so GSN one is has been live since august on on main it and it would have happened without all the help where you see from the community and yes if we have time for questions then i'm also sticking around anyone wants to like have a conversation about it yeah well yeah yeah oh great yes we modified the noisiest music contract to make it

Jason Jason enabled alright and we just went through audit so yeah modify contract so just to be to understand we can it still gonna work like as it is now all with relays and so we're changing which we're we're not changing the fact that the relays are registered into the relay hub but what we realized talking with taps is they want to set up their own relays and we want to encourage them to set up their own relays right so with GSN to the default is for adapt to set up its own relays but they're not centralized if they get attacked if they fall down traffic is routed through the relays of other

depths that are still up okay right now we use yes yeah I mean that there's no reason for okay it's it's well GSN one is not backwards compatible we've we've it's like with Jason - it's a completely new system but in from the relays perspective not a lot that have been modifications but it's a very simple upgrade but GSN to is a new system it wouldn't be possible for us like made significant changes to the API of the relay hub we've separated the architecture actually breaking apart the contract into multiple pieces that are easier to audit so you'll be able to the

most critical piece of the system from a security standpoint is a forwarder contract and and that is something that if it fails we're we're in trouble but there's like most of the complexity of the system is actually the relay the relay hub registry relay registry right and we want to make sure that we have compartmentalization different parts can fail so the bottom line is we it's it's the same it's the same general approach but re-engineered to be like more robust slightly more robust and also the apps don't have to trust that there will be some other relay out there that are

servicing it's very very easy we're making that like you know a five minute relay deployment process for the DAP and you still get the benefit of a fallback to the relays of other DAPs if you're you're really falls down right the relay registry I mean when I want to broadcast a transaction yes NS coupon in cough Jim because I'm just signing some message and sending it to someone so there is some REST API that is out your signed message to know well so so the way it

works is that we have a web free provider right and we have a trick for for taking the existing web providers and hooking into them so the app doesn't need to need to make a lot of modifications after you do that what happens behind the scenes is that we we insert a process where the client code is now it's executing a view function on chain and the relay hub and saying like what read what relays have been active recently right and then again last week because you don't want to reach out to it that relay you take the sign meta transaction and you you submit it to one of them they are supposed to give you an

immediate response back committing themselves to transmitting the transaction and getting the transaction fee so this is not like what you submit it to a node and then through a peer-to-peer protocol this is not like this is a client driven approach and you can do that safely because the relay is committing itself by having a stake on relay hub and at that point like if it if it misbehaves you can penalize it so every time that you have a new relay or someone don't want to be a relay anymore you should update this contract I mean I said that you have the registry is unchanged so like when you essentially you're there's client code it just asks

a contract I'm Karen black but blockchain which which relays are active right now which which meta transaction relays will accept the transaction and and would fee right but how do you know which are active right now yeah well every time that a relay accepts a transaction it emits an event and you can do a filter on the events and you're checking the recent activity of this relation today it's done some transactions recently then you yeah you consider directive exactly so there's there's there's a mechanism for choosing relays that are most likely to respond and you can you can play with things like you know what is the size of their stake right and

what is the what is the the fee that they want because it's a dynamic theme archit like any real I can say I'm willing to service that's another slight modification that we made that now relays can say I want like a fixed amount for each transactions or I wanted to be a percentage like we're making it a little bit more flexible with some rating system yeah and you can have you can have rating systems this doesn't have to be on chain I mean we want to achieve trust lessness but we don't want to have to create a new consensus protocol because as you're inventing a new blockchain yeah does it work only we die or also with

it's deposited the mixer the the the mixer work or the technics oh oh no it works yeah it still works with these yeah it works with if if you don't feel comfortable playing with your real die there's a version on covin but you can I know that the GSN like- tornado dot openeth dev there's also the source code for the demo on our github so you can take a look at that but if you want to play with it without taking risk then you have to get some Colvin died and you have to add like to your meta mask the the die contract on Colton it's a little it's a little bit inconvenient to do

that but you know any any any other questions alright I'm sticking around so thank you everyone my didn't we're not down we couldn't take it down

I mean that would also show us security whether begin - why we can break everyone's go