Where to Hide: Wormholes, Beacon Deposits, and the Cost of Deniability

Transcript

[music] [music] Can you hear me? Yes. Okay. Hi. Uh so I'm presenting those slides. Uh but it's Mo uh my cotor who actually did them. He could not come because of visa issue sadly. So yeah, say hi to to him and I'm happy to present this um today. So uh the title of the talk is called where to hide. So it's about the wormholes become deposits and the cost of deniability.

So to recall a bit uh why we need privacy. So we have like this glass house problem. So I don't know if you have heard about that problem but it's a problem in architecture where it's very hard to design uh buildings made only of glass. uh because um uh it's it's very hard to design spaces in those buildings where you can have like some kind of privacy uh for yourself and it's uh a bit of the same for Ethereum. Uh um users are evolving into that glass house uh context and uh it exposes to uh different kind of um threats namely the fact that their history get leaked. uh

you have predatory data harvesting uh from different kind of data brokers and finally that can actually um lead to uh more general problem like uh authoritarian question. Uh so yeah that's that's basically why we need privacy on on Ethereum and why we have worked on on this EAP. So if you look for instance at U tornado cashache or reagan why wouldn't we just use that and uh the graph is this graph is is the answer it's because using uh when you use uh explicit privacy so uh tools that actually show that you are looking to

use privacy protocol then you almost automatically get flagged as a high risk or at least an address that needs to be targeted for uh some kind of uh surveillance. Um it's uh you are uh basically just leaking your um intent to transact on Ethereum privately. And what happens is that um when uh you have a privacy like tornado cache that gets uh offaxioned then um uh it's becomes very uh hard for users to be able to find ways to to to shun away from um those um uh this glass

house uh problem. Um and so uh the questions the question that uh um people have asked on on Ethereum for privacy is that uh is whether you can hide that you are trying to hide. Um so for instance if you take a rail gun um when you're transacting within that space of uh from 0K to another ZK uh address then this space is kind of opaque but entering and exiting uh the public border uh that you have between your transparent address and those zero ZK address um you are actually already sending a signal that

uh you are crossing that that public border. So that's uh basically what this is showing. Uh you have explicit deposits and explicit withdrawals. So maybe your zero zk to zk transfers are shielded but u your withdrawals and your deposits are public right? So everyone is going to know that you are using a rail gun and the goal is to blur the border so the entry looks identical to a neutral everyday action. So not only you want to mix your funds uh uh in a shielded pool but you want to mix your funds with uh everyday transparent looking funds. Uh that's what we call deniability because

you can basically deny that you are trying to seek privacy since you are transacting as any kind of other everyday uh uh user. So yeah, again the the problem is what we want is to uh get um make it possible to make the deposit and the withdrawal process uh hidden um and while you stay maybe safe in the shielded zone. U you want those two major steps uh to be hidden from from uh everyone mainly the chain analytics services or maybe compliance desks. You don't want them to flag you as a high-risk um uh person

just because you are trying to seek privacy for for your funds. And so this was uh the idea of wormholes which was a a very very interesting idea. It was EIP7503. And uh this EIP was basically proposing uh to have a way for users uh to send their transactions to an unspendable address. So some address that you derive um from uh from a hash uh with some public parameters that are agreed by everyone such that the address to which you are sending funds to becomes an unspendable address. Um and as you can

see on on the right um the first transaction say is paying ETH to a friend and the second transaction is entering into the wormhole but both book look uh look look the same kind of transaction. So now it becomes impossible for any kind of chain analytics or compliance desk to uh know that you are trying to use uh any kind of privacy protocol. Um it's uh the the the wormhole say that if you are spending to an unspendable address then you can then eventually mint back your east um uh in protocol um and yeah you just um uh have access now to a new

fresh address uh that's unrelated uh to your previous address. And this process looks like any other kind of uh of uh privacy pro any other kind of regular transaction. Um so you still have a caveat which is that mincing so when you are withdrawing though the minting process is still public. So your exited fund in the wormhole context still gets flagged. So yeah that's one big uh caveat of wormholes. But the deposit process is uh possibly deniable. So that's that's very interesting. Oh, it's 5 minutes already. Oh, wow. Okay, it goes fast. So the problem with holes is

that um you have the a collision problem. So the security that you get is uh too small. It's around 80 bits. Uh today the proof of work of Bitcoin secures more than maybe 90 bits. So it's actually less than the Bitcoin proof of work. What we proposed is instead to use the uh beacon chain uh where you have longer addresses and you just mix your funds with people that are deposing their their funds into the consensus layer. So it's EIP82 called LIN staking because we are using LINVM to do that and it's actually now something that is even um pushed by Vitalik but in a different way and in a very smart way I

would say uh using a different mechanism uh namely rotating uh consensus public keys. So go check out the EIP uh 8 triple 2 if you are interested and then go check out Vitalik's extremely lean chain is research post uh to understand how it works. Uh so yeah uh thank you. Uh don't use mixers or pools if you want posible deniability. Uh wormholes won't get deployed on Ethereum because they are just too insecure and soon I guess we might have just consensus layer possible deniability uh and privacy then.

>> [music]