Privacy for Safe using Zero Knowledge - Valeriy Zamaraiev

Transcript

[Music] you everyone okay so we're going to be talking about safe as ansis safe and the Privacy aspects of it and first of all like I represent 1kx which is a VC fund and the question is sometimes I'm getting this why build as a VC and Lucas founder of gnosis safe basically said this that we are kind of the ultimate Cipher bunk we see out there and seriously it's we're interested in just uh enhancing the ecosystem and just

contributing to the space and this gives us more opportunities as well like for Investments but this is not a commercial product this is free open-source uh stuff just trying to do something good for the community so what is it all about when multiple people need to sign transactions basically have two options one is MPC the other is multi and sometimes in the past you could hear that you know why when do you choose MPC when you know MPC is compatible with multiple chains and there is no onchain Trace because it all happens off chain and there's privacy and in

multi well there is on chain trays and uh basically everything is public everything is transparent everybody can see what happened and who signed which transactions and this is kind of a limiting use case but on the other hand multi are much preferred in practice uh because gsis safe is the most used multi uh over 100 billion tvl solidity code has been verified it's like the tech book of if you want to learn all the solidity tricks you just need to read the smart contract code of save and it's like when you ask people who actually work with a lot what is the

best code to read they would point to save and the use cases are not limited to just storing assets for safe it's very often used essentially for governance right when you have a committee uh and the committee needs to vote for something and um then this happens very often through nosis safe in practice for example L2 networks when they need to release a new version of their Network it often comes through an L1 transaction and uh for decentralization reasons you you must not like upgrade your L2 network uh just

by running some command somewhere it goes through an L1 transaction that has to be be signed by multisig and this happens through various security committees that have to be in place and for various reasons like these security committees need to be public the membership of the security committees because you need to see that there are real people there but like who exactly signs what out of those security committees you don't want people to know and this is precisely what we solve with ZK save so what we do currently is we make sure sure that like how do multisig work you basically collect signatures and when there are enough of signatures collected

you can send it agnosis safe will verify it and execute the transaction we make a small modification where uh somebody has to collect all the signatures and create a proof that they have seen and verified all of these signatures now you send your transaction the desired transaction along with the proof to a ZK safe module which does the verification and uh and then we execute this transaction so this it's it's a very simple scheme which for some reason was kind of hard to build

um so the ux flow is actually a little bit different because like how do you normally does anybody use multi I sixs here okay nice great crowd so you probably use nosis safe right you what you do is you just have like UI where you basically sign one transaction and then the other signers get a notification that there is a transaction to sign and so on the problem with this is that this is a centralized component of gsis safe uh which is kind of fine if you are in the open right but if you want to actually hide the fact that signatures are being collected this doesn't work because all of the signatures collected

during the process are stored in the save back ends that everyone in the world can read them so it's not only on chain but it's also on this infrastructure so we have to a little bit modify the flow so that you basically are responsible for collecting signatures and the way we do this in the UI we basically embed them in URLs and people need to send to each other messages using instant messaging or whatever means they have to exchange all the signatures collect them together and then one somebody who when all signatures are collected needs to click the button to generate the proof and then we basically can send the transaction together with the proof so and because of that we also have to

modify the UI basically build another alternative UI agnosis Save which actually does not have a back endend and later we realized realized okay but actually it's an interesting thing because you ZK or not ZK uh there is a need for backendless UI because there are many chains that do not have support for official safe UI so basically we also use it for some chains that do not that have safe contracts deployed but they do not have official support for UI you just fire up a browser you configure your RPC node where you have your weird Network and there are many many weird

networks out there you have the weird network with safe contracts and it works already so and then you can use ZK or not use but you kind of have safe support and build bear is also an interesting tool where you basically can have uh as many test Nets as you want for any network so basically it Forks networks in a cloud environment and U but like when you clone a network when you Fork a network you don't have the UI support but with this tool you can have it um the more technical part here and I have three minutes maybe I'll spend one minute here um I mean I think it's pretty

straightforward what do you need to verify a signature um well you need to see the threshold of this save you need to see the transaction has you need to see the list of owners and then the private information which you don't want to expose is actually who signed and their signatures so these private inputs go into the Prov from the person or or or agent or whatever who bought who collected all the signatures and the logic of this proving is exactly as inis safe solidity code that verifies the provs and as techar has been pretty good

for this and it's quite interesting that as technoir ended up being the only single solution here surprisingly because it's the only thing that supports cdsa verification and at the same time has an efficient wasm proving because all the proving done in in the browser there is no server there is no component so the signatures that you are collecting are never sent anywhere it's like all local in your browser and and to this day it is kind of the only way to build this paradoxically I was told by risk zero that probably you can do the same in browser

now but like a few months ago you couldn't do this so maybe we could try that and we have more uh web assembly proving coming with a company called liero soon but it is what it is right now it's like no ared up the only choice so what we plan to do as well is we only hide right now who from the group has signed a transaction we don't hide the group membership like the owners themselves and the reason for that is that in many in most cases you actually want people to see that uh this save has a reasonable amount of owners because otherwise if you hide that then you

don't even know if there is more than one person controlling it like you cannot disting that but there are use cases for that as well and we've actually been told okay we're going to we would like to use this but we also need to hide the owners this is kind of semi- implemented it's working in progress but the circuits are implemented not yet audited so we're going to be working on this and also release a version that also hides everything and um we're not the only ones who are interested in this problem there is also a project called Dark safe which does some interesting math you can look it up uh does this in a funny uh way um and yeah these are the URLs and the contacts if you want to

learn more and if you want to use it and I think that's it for me I don't know if you have a minute for questions thank you Valerie questions from the room yep I was just wondering if you have um these proofs in the URLs are there any issues with URL lengths and the proof sizes so you're worried that the exchanging URLs will kind of expose something or as in I'm sure there's like a limit on how long a URL can be oh yes um we put signatures not the proofs in the URL okay and in the UI basically it looks like you when you have everything

collected we use just browser local storage for that and uh then you just copy paste the proof so it does not go into the URL it's like it's displayed on on the web page in a box right um that's a good question I mean there are other ways of doing this which is show something that's easy to copy paste basically yep do I get this correctly that the whole transport layer or communication layer uh is not something you're solving this is just an you take what ever um yeah absolutely messages absolutely it's just uh it's up to the group that does this and usually they they will have

some some signal of telegram and I mean if if they're happy with the privacy of communication among them then that's okay right so okay thank you very much valer [Music]