ZKPodcast: Mixers with Tornado.cash

Transcript

[Music] welcome to zero knowledge a podcast where we talk about the latest in zero knowledge research and the decentralized web the show is hosted by me Anna and me Fredrik [Music] all right so this week we're sitting down with the guys from tornado cash tornado cash is a zero knowledge based mixer and what we're going to talk about today is what a little bit about mixers what they're used for how they work and

then dig into tornado cash so welcome to the show guys hello welcome and Roman storm I'm part of a tornado cash team yeah I'm Roman siminoff I'm more responsible for our like snarky part and Roman storm is more responsible for user experience and everything cool well I think this is the first time we've had two people on with the same name so we'll have to deal with that toward the episode I think what's really funny with you two is it's roman s and roman anise we can't even differentiate on last name here yeah yeah that's right so we have both ui/ux representative and a snarky representative that's good

talking about the full stack of building an application like this maybe it would be really great for our audience to get to know you guys a little bit better so Romans storm why don't we start with you what's a little bit about your background sure I'm Roman storm and I I work as a software engineer starting in Silicon Valley in San Francisco working for small companies and big companies and then like I learned about Bitcoin back in 2015 that's where I like build some small applications for Bitcoin chain then I met my friend eager buy enough we're together we built something called

Pio a network which is based on a parity protocol from Cohen test net we learn quite a lot about DF development the solidity theory on how to scale solidity and that would need quite a lot of research on that back in 2017 and 18 after that I decided to run a consult a consulting company called pepper sack and that's where we were focusing on helping other companies to do security audits and the custom development and we were always focused on making our own products as well which led us to build tornado cache interesting how about you romance him enough by education I'm come

from the ground but I'm in the space of blockchain for around two years I started by working on various plasma implementations like plasma the people at my prime stuff like this and then I got into more snarks and zero knowledge in general privacy technologies we haven't really covered mixers on the podcast before and even though they're like a pretty standard concepts they've been around as long as Bitcoin has been around it obviously like their design

changes with discoveries in in cryptography this sort of primitives of them change but maybe we cover a little bit of like what what is a mixer of first of all what is its goal sure there are different types of mixers so-called one of them would be like depends on which cryptocurrencies you're using for example Bitcoin Bitcoin has their own mixers and there are also mixers custodial and noncustodial so we would be more interesting to talk about non-custodial mixers because they are much more technically complex to implement so for example in Bitcoin

blockchain there is a popular technology called Cohen join and one of the popular Wallis would be beside the wallet that implement this technology it's much more different and they do not use any zero knowledge technology in it there are also other popular cryptocurrencies such as manera and z cash and manera would use something called ring signatures and z cash is using ZK snarks so Toronado cash is based on Zeki snarks because one of our visions is to replicate all the cool privacy-preserving features that exist

on the Z cash watch chain on the film but is like maneras privacy this rig signature does it act a little bit like a mixer like it sort of how does it hide the actual transfers like what I understood was they was hiding it much more by like mixing it up with other transfers so that you couldn't necessarily map which one would be an individual's yeah like mine era uses decoys so basically they have you take some model there are outputs and inputs for transactions and for each transaction they add fake inputs so instead of single true input there are

11 inputs one of them is real one and then others are decoys and so yeah it would you call that a mixer type build is that like is that in the same kind of category as a mixer I think like for mixer the more proper description is like I mentioned mixer is the thing where you put money into and then take it out like kind of like vital coins some people come along and coins there and then under new identities or maybe the other people's come and take coins from this bag so I think manera is different from because it's a full block chain and a cryptocurrency in itself I

would say it's different only because you're not mixing it up with other people's transactions you're generating these decoys and then kind of mixing it with those so in like this microcosm I would also see as a mixer but it's mixing it not with other people's real transactions but with decoys decoys are you transact like if they are real outputs on the blockchain but they are not used in the computation so you pick or 11 you take source and only one you think so is checked against the outfit that it has enough money correct but the decoys are not like generated

you see they are real ones so then I mean my my actual question here is like is it does a mixer as we define it is that something that has to sit on top of another blockchain not necessarily can it be a blockchain because like yeah as we can see from the production versions of mixers like there is a whole ball chain called G cache which also allows you to have the mixing of coins with other participants and there is a solution that we built our navigation it's not a it's not a blockchain it's just a decentralized application that is built on top of if

you don't using solidity language diet so this is interesting because I wouldn't necessarily think of Z cache as a mixer or like at mixing structure because it's just using a zero knowledge proof to hide the transaction sort of in plain sight and it's not mixing of transactions with a bunch of other participants but I suppose like when I think about it and how mixer would work you could define it that way because there are multiple transactions and they all look the same and you can't do it like in that sense so but how would you say that Z cache is a mixer like the definition probably depends on

whether we allow internal transactions to be inside the mixer like if we would call the similar structure but with transactions inside of it allow the mixer or not like if we allow internal transactions that the catchment can be called if we don't allow if you call it the privacy pool for example but systems similar to the cache like supporting internal transactions can be also implemented on their own so I just want to query for a little bit when Roman says internal transaction he means that for example if in case of there another cache let's say if we deposit a transaction into the tornado cache and

then we can transfer ownership of those funds without exiting the smart contract on chain so that would be kind of definition of internal transaction and see cache has this functionality where I can enter the shielded I mean I can make a shoot the transaction and then I can transfer the ownership of my sequence to like somebody else without exiting exiting the anonymity a pool wow this is interesting now to compare because I too had never really thought about see cache in that context but yeah I mean if we take a step back to like the original

question what's a mixer and you said there's custodial and noncustodial ones I have mostly thought about custodial ones and and interacted with them in the past where it's basically kind of like a mining pool UI where you transfer your coins to some entity they kind of keep it for a while and then they transfer it back after you know sending our owned a bunch of transactions doing whatever they do that's a very easy model to think about and to explain because like this person takes a bunch of money and shuffles that around in a bag and sends it all out against like it's it's a pretty easy model the non-custodial ones yeah that's interesting because I never lose ownership and Zee cash I

guess fits that model where you know I never lose ownership of my thing but I can transfer it you know under the veil of their own food yeah that's correct and basically custodial mixer could be considered any crypto exchange that doesn't require kyc yeah also if you are talking about Bitcoin mixers for example they work very differently they are like toddlers in the sense that they don't really hide the transaction graph but they tried to dangle it like make a lot of transactions and make the work of analysts hype harder but they don't

really like perfectly hide the transaction graph like seekers does or like the decimal something and that's that was actually a question that I had about mixers so mixers the point of them it's to basically hide where tokens have been it's to sort of make private the owners like it's basically to obfuscate the transaction paths but I guess the question I have is like how effective have mixers actually been like coin drawing the one you mentioned on Bitcoin does that work they could be quite effective if a user Falls some rules for

coin control and doesn't like intentionally or unintentionally mess up the post mixing process because there are some rules that you have to follow like when you use privacy solutions like this for example like if I use like tornado cash and you're making multiple deposit and you withdraw all this deposits at the same time to the same address you're already exposing that you you are the one who made those let's say three for deposits and your would run to the same address that's why solutions like wasabi Roylott they are doing really good job on

differentiating between your private private like you private bitcoins and your nonprofit bitcoins where you can label each address with let's say like you know that this address is known and most of the public can identify you because you have transact transacted these coins with let's say some cryptic change that have a queue I see on your profile and then you can have some other addresses where you can label that you have gone through a conjoined process and you can safely assume that those coins are not associated with your public addresses but if you let's say make a transaction between those two addresses then you are already exposing

yourself and your identity okay so we've mentioned a couple of these setups but what other mixers have come before you guys like what what are common mixers and how do they work I can also mention more like privacy technology meanwhile Wimble it gained popularity lately the idea is that you join all transactions similar to what going joined us but you do it with all transactions on the blockchain so entire blockchain is basically a make a single block yeah and on paper it looks really good but when you start to dig in into

this for example if the observer monitors how this last block state changes with time he can see the transactions happening like if you see the Delta between last state and new state you see what changed so the observer sees not only the last node but the evolution and can tell something about what transactions are happening there and there are a few techniques that they utilize to hide what actually happens for example Tom de Leon at the end alliant oh my yeah this when transaction not immediately published but goes through a few notes first and

joins with a few more other transactions and only then is published but still the observer can sometimes catch these transactions when they not published yet and see this partial state when they are joint only with a few transactions they will not really be very private so there are a couple different attacks that can discover the transaction graph on the base chains do but I mean again is that a I mean I love I actually really I think it's super interesting to kind of understand these protocols he's like full blockchain protocols as using these techniques that mixers maybe would use

but are there other sort of mixers that live on other chains that you see coming before what you guys are working on for example it's based on accepting signatures and ink signature based losers usually have Mars much worse privacy properties because they're on an intercept it's much smaller it's within a single ring and in practice it's it's usually around like five or ten well whereas Solutions similar to that medication can help thousands there's obviously lots of custodial mixers like we talked about there they've been

around forever and they're easy to build I guess there's a shift now and in moving to non-custodial asked cryptography evolves as if they're in gets more crypto primitives available to it as well but there has been some interesting attempts although i'm i can't really say that they've been successful but i've seen you know sort of things sitting a bit in between custodial and noncustodial where it's custodial but it's a smart contract that holds it so we can sort of say that you know with the smart contract has to control and you can verify the code and you're going to or money back but then there's no randomness in smart contracts

the smart contract can't hold private keys and do crypto on its own so the the mixers become kind of dumb and just like it would be easy to analyze and trace but what's actually going on so okay so I think we've set that we've set the scene in a way of like what has existed before what what kind of techniques have been used what are some of the limitations of those techniques with zero knowledge-based what did you say non-custodial mixers I do know of one other case you kind of mentioned quickly they're mixing us so miksa must is also zero knowledge-based it comes from the lab of Barry White hat did if tornado

cash sort of taken is it mix Emes Plus is it was it started on mixing us and then you moved it was is it based on that or is it a completely new construction it is almost the exactly same thing but it uses more it's not friendly hash functions Paterson commitment and memes fish and they are much easier to compute on the snark side and on the smart contract sign and I if I'm not mistaken I think Maximus has been used with the secretes framework to build and Socrates yes yeah yeah even the lip snark which is much more like

it's not very user friendly comparing to circum Lee that was published by I didn't read and the semaphore mixer and turn a Turkish mixer they both utilizing the circum lip library which is much more friendlier to build nude circuits which is used in zero-knowledge prose let's now explain then what what does how does it work for tornado cache what what is the process like where does it live I guess it's all built using smart contracts correct so basically it's the process of building a mixer is similar to build a

decentralized application on helium network you have your set of smart contracts that you would design a special way that you would later deploy and one of the I think he components is to compile so-called like really fire smart contracts with very fire smart contract would have some would have some functions to verify your zero knowledge proof and in order to generate proof for that you would have to have some keys on the client-side for example in our case enter another cash when you go to turn

under that cash website you don't load sixteen megabyte keys that would be used to generate a zero Nagy proofs in order to submit this proof to the smart contract that's the process on a smart contract site and the rest of it is just basically front-end code with which consists of HTML CSS and JavaScript to interact with a smart contract do you use anything I mean you mentioned Socrates before which has these tools it generates more contracts to do verification do you use anything like that to generate the smart contracts or are they all like handwritten no they're not all handwritten we use framework

called circum Lib that allows you to write a circuit in a in their own programming language I would say it's that's what Roman siminoff has been working on when he to enter another question and answer question about smart contracts the circum has a similar function that allows you to generate very fired contract so you do setup generates nark parameters and the result of this process is ruler and verifier keys and the verifier key gets embedded into verifier smart contract and if you're curious how we what what

has been deployed on to Minot and how to deploy or play around in your local environment feel free to go to our github repository where everything is published there how does it this is actually a question I have about like deploying a mixer on top of aetherium would you like is it the like is is it tornado cash that has deployed a smart contract and then anyone can use it or is it that you'd actually be deploying a smart contract yourself when you're actually participating in tornado cash so right now you don't really need to deploy anything in order to use there another

cash because those contracts have a they already been deployed but if you want to learn about how it's been built and to play around in your local environment you can definitely do so just by downloading our github code and understanding how it works so in in a presentation I did a presentation this summer with Howard Wu and he actually explained mixedness to me an end to the audience in a pretty simple way the way that he described it was like you as a user you have the prover key and then you use a zero knowledge proof to prove that you have the prover key without

actually revealing what that is your key is usually the term used for snart keys so it is this not prove your keys is the term used for snart parameters that I used to generate the proof but also you have your like private information describing your deposit internet occasion we call this amount so when you go to a smart contract you generate some secret and cost your money and the hash of this secret to the smart contract and then when you want to withdraw under your new identity you generate a proof that you know preimage to some hair that smart contracts nose and also there

are Lula fires similar to the occasionally fires so based on your note you also generate the hash of nullifier and send it along to the contract with withdrawal requests and each note has unique hash that you post during the deposit and unique Lula fire and the hash and doula fire are connected so when you post the nullifier to the smart contract it checks that it didn't see it before so that this note was not spent I see so in it when you deploy the smart contract at the beginning does it have sort of a set of these nullifiers no no you generate the unique nullifier and

initially contract doesn't have any deposit but any deposits and doesn't have any nullifiers so you make it deposit and it does not contracts and the hash of your deposit to its list and when you make a withdrawal it also adds the cash of your nullifier to this list I see and when you doing the withdrawal it just checks the list it doesn't contain your modifier already that's what prevents from double spending double spend yeah this is actually so the episode we do with Zuko he actually explained that model and Z cash quite extensively and so that's that's helpful that's kind of what you're doing but in smart contract

format and how does this get written like does somebody they deposit it they must also have to pay gas yes so the deposit you can do from any web free enabled wallet by and any like G a browser so it's just a regular transaction that you do like on any other the app and but before they deposit you generates something on a coin site called note this note is your actual deposit later on that you can that you would have to use later on you want to withdraw from Toronado cash

so that's very important to keep it somewhere or to make a backup in your whatever preferred way to store your private keys if you should consider this not as a as a private key basically I say yeah yeah and then when you want to withdraw you would provide this note front-end interface and then you would select where would you like to withdraw this not to like to which address and it's highly recommended yet you read some rules that you should not reuse the addresses you will most likely need to generate a completely fresh address

without any transaction history in it and then when you click withdraw it will start generating the proofs that would later on be will be submitted to a smart contract and that proof will would have those properties like recipient there are like private and public inputs that are that are generated inside of that prove that you would submit a smart contract how was the proof generated it technically like is it a JavaScript library to generate that how long does it take to generate you use webassembly a library called web snark in this part

of silken system and our proofs take around like 10 seconds to prove 8 to 10 seconds and also we have this relayer system as for example when you generate the new ATM address for your withdrawal it doesn't have any either to pay for class and you somehow need to submit this transaction on theorem and you cannot directly fund this address from your old wallets because it will connect old wallets through the on the blockchain so we use relayer so basically you instead of submitting the

transaction with the proof you give this proof date data to every layer that submits the ATM transaction for you and gets compensated for the gas you just spent and the earlier cannot alter any data inside the proof including your withdrawal address and fees that you are willing to pay for a layer because if any data is altered so the river network is completely trust less and anyone can spin up their own rewear by going to our github and taking a look how to do that that that real layer is actually solving a problem that was highlighted in the

past I think around mix amidst which is that because of these gas fees you could actually do some sort of tracing so there's like all this crazy magic happening in this mixer only to be ruined by this little gas fee that happens to match up to the address that you're too kind of taking it out of so this is some part of your construction that's been created to make sure that that like that gas reveal doesn't happen but it's the relator something that is very common is this like a very standard piece of software they it's like just a lot of people are using or is this something that you guys build to ask for your question like if somebody else used the reverse Network I think the answer

is yes for example Mesabi wallet they have something called coordinator which is very similar concept of rewires and when we were trying to we didn't want to actually build our own rewear system because we wanted to use something more generic that that would so that it would be more decentralized and we tried using something called gas station network by open zeppelin unfortunately we hit some technical limitations of that current implementation and i think they will solve these issues in the next days so that's why we we just had to build our own like

made a solution that would define our like everywhere protocol and how does everywhere behaves and what kind of end points that should have gas station network is basically it's a concept made by I think open Zeppelin and there is some other company yeah okay yeah thank you basically what they're trying to solve is that to make this network for a decentralized application so that any dr developer that wants to build some

application they they can use some endpoints from the gas station networks so that users don't even have to have a meta mask or any web 3 enabled wallet to interact with a smart contract so that everything will be paid out by this gas station network for gas fees so it sounds like gas station was originally created really just as a Desa means to help people get involved like to be able to use web 3 products yeah like just to help reduce friction exactly yes because as we know the user experience is something that we all struggle in a

crypto space like how do you build an application that would be very similar to web 2.0 experience and yes I think that's the vision for gas station network got it but you guys have created your own do does it does it also reduce friction or is it is it actually still you have to be pretty sophisticated in order to use it I wouldn't say so that you have to be sophisticated yes I I want to believe yes it reduces the friction okay so as you've sort of indicated in various ways like it it does take some effort to use this correctly and I think the simplest

example is if there was only one user of tornado cache then it wouldn't be private right like that's the very concept of a mixer and why it's called the mixer because it's mixing a bunch of people's stuff if it's just one person depositing and then you know ten minutes late or one person exiting out of it then yeah it's pretty obvious what's going on we figure out who that is so what is the correct way to use tornado cache to continue this example of one user for example we if we see the situation where a lot of user users use the tornado cache before but there was some period of inactivity for example and then one user came along and did a

deposit and immediately someone else did the withdrawal there is very high chance that it is the same user right the similar like there are a lot of correlations and statistical analysis that can be done for example if someone deposited did 10 deposits and then immediately someone did 10 withdrawals to the single address there is also a high chance that it is the same person so we always recommend to wait some time before between deposit and withdraw and also wait until there will be a few

deposits like a few other people that came along and did deposit between your deposit and withdrawal there are also a lot of network level concerns term etiquette solves only on chain part of privacy but you also need to take care of your writing to your IP address for example so what can happen is maybe your internet service provider he knows your IP address and he can log all the websites you connect to and for example he can see that you send some packets to a tornado relay it's the connection

itself is HTTP encrypted but he sees that you sent some packets to they're neither a lair and then he immediately sees that someone did a withdrawal on a terror network so then in this case your internet service provider can tell that probably it was also the D UPS if you didn't clear cookies and use the same cookie with the old address and images in this case the app can tell that it is the same person also in for not to interact with the tearoom you use some kind of material node and if this is import and it usually has API key for example meta

mask it'll usually use the same API key for every wallet and if you use your old address and new address in the same meta masks instance the info can be able to see that those addresses are connected but for regular users it's important to note that you don't need to be like hardcore paranoiac maybe you can do some trade-offs for convenience for example you can be okay is it in for a probably in T or you can know that your dresses are connected but most likely they don't bother I think the idea here is like it's also like would the average viewer be able to understand what's happened

like can I figure out what has happened to somebody's tokens or would you need to like have an investigation go in and like talk to all the service providers and the and the node providers like I think this is maybe what you're talking about like if some overarching power wanted to know they could but the average viewer can't see what you're doing yeah usually we try to analyze like worst case scenarios as much as possible but probably for average user it doesn't need to be on this level it's sort of a difference between is is a crazy ex trying to figure out what

you're spending money on or is it the government try to rest very kind of difference attack vectors right so this at Def Con this year we actually did a panel on mixers with wrote room and you're on that panel and I asked a very unpopular question about regulators and the legality of all of this the entire room just like groans but I still think it's very important and I I don't think it's something that one should groan about I think you should probably you know think about it so what what is your thoughts on that like our mixers our mixers okay our mixers are they legal so I can quote

from a documentation website from Mesabi walnut they had they actually have this question that like what's the legal status of Mosiah voted and I think it can be also quite or nada cash and it says in USA on like May 9th 2009 teen the fins and issued guidance that stated that anonymizing software provider is not a money transmitter and FinCEN Rico ish we go regulations exempt from the definition of my transmitter those persons providing the delivery communication or network access services used by a money transmitter to support money transmission services basically if

it's a non custodian solution and you do not collect any extra information that should not be considered as a Mayan transmitter more general level private doesn't need to mean illegal like I don't want to leak my private information I am NOT like hiding something and for regulators it is already known scenario because we have cash that has similar properties then it's kind of anonymous and regulators already know how to deal with this they have mechanisms in place to make sure that people that interact with cash pay

taxes and things like this and the same mechanisms can be applied to private currencies and mixers yeah I wonder I mean so let's let's use an example that I think really lives in the crypto world but like say there was animate like a hack of an exchange or something and a bunch of funds were taken they they were run through mixers like if the mixer is really really effective doesn't it make it almost impossible to track down that hacker and like get those funds back or is there still some trace outside of the mixer that you you can imagine so I I would say it could be effective if the

people who who use it know how to use it like and follow their rules and for anyone else it would not be possible to to see that and also to prevent that kind of usage what if what if the amounts were really really big though like is that viewable like in a mixer scenario like say this huge deposit happens into the smart contract and then this huge like like it does the value that's being mixed matter yes it matter like I will just answer that right now on turnout the cash there are like for the type of amounts that you can deposit

using aphelion purest it's a 0.1 1 10 and 100 so you would not be able to deposit more than that I say yeah you can do multiple deposits but then like it depends on liquidity of termina cash so you can mix the similar amounts that other people are mixing you cannot mix like a lot and also in situation when someone steals a lot of money it's like in the real world in the same situation is someone stole a bunch of cash and how law enforcement works in these cases they usually find that someone starts buying yachts and property for money he is not supposed to

have and then they confiscate the computer and hardware and find evidence there so like this is how law enforcement finds similar thefts in cash so I guess there will be the same situation yeah I think well of course it already knows how to handle those situations yeah I think when talking about regulation and maybe part of why it gets a groan is that it's so undefined and like it usually just devolves into like is it moral to provide privacy services kind of thing where it's like there are there are certain angles like is it a money transmitter that's a very clear question

and should have a clear answer and then we should know about when we go build these things but then yeah it's always surprising to me when I talk to like particularly Bitcoin people but crypto people in general who think that like oh yeah I'm just gonna like send my money through Z cash and then the government can never find me spending the money is like well no that's not really how it works like if you can't you know say where the money comes from they're still going to like taxi or put you in jail or something like it's not just oh and showed up out of nowhere and I just spent it and like you can prove otherwise no but they don't have to if the burden of proof is on you so like in that

regard I don't think it matters at all like it's like everyone I said is just like cash and it's no difference and and just a final point a regulation question I think G cash did the enormous job to explain York regulators about the cash and about its privacy features that would enable Jamie and I crypt exchange to list easy cash cryptocurrency and it's still like compliant with all the regulations well I mean I I think that on the front of like I actually I feel like this has been repeated many times

but this idea that like if you want businesses or even just individuals to really really work with crypto then you definitely need to provide some way for them to protect their privacy like nobody wants all of their salary published at all times all of their activity you know viewable by everybody and businesses especially like cannot function if everything is transparent actually at least not in the way that they're built up right now and so I think having this kind of privacy is very very important for sure it's strange though because it's almost like the complete privacy is the part where actually governments or attacks you know

enforcers they would no longer be able to track it I think this is where we get into these questions of like how private do we need things before being people they're all still I don't know how even after they like have this private money they would need to spend it somewhere and that's when they how do you get exposed and they'll make mistakes that's why it will never be I think a possibility for like complete privacy of all the money yeah I think your definition of complete privacy there is no more private than cash right or you still have you still have endpoints that

interact with the real world correct for businesses most of privacy solutions like the cached Armada Aztec they provide an ability to give a special key to taxman to allow him to view the cash flow so the regulator can see actual transaction data but you hide it from your competitors yeah this is a cache has this viewing key and I think it's a it's one of those things that they don't have to put in there's no real kind of reason that they should put that in like the government isn't forcing them to put

that in they're doing it as a sort of pre-emptive like we know this is a good feature to have some people will want it you can use around in the later notes can be used in the same way as a kiss after you do a withdrawal there no data can be used to link deposits with withdrawals so if you want someone to be able to see a connection between your deposit and withdrawal you can provide this note to them it will serve as a proof so this would be like if you want to declare something or if you like if you actually needed to prove it yourself for whatever purpose is yeah if you want to construct

the the transactional history of your funds like well before you use their data and after you store nada and if you want to prove that that you have normal either I don't know how to say then you can provide those notes just to build the whole picture why would somebody use tornado cash and not use the cash because oh yeah that's a basically we did the research recently by downloading all those privacy solutions and try to using them with Z cash I don't know if they hear me I hope they do if you go to your website on Z

cash calm and you try to find a wallet that has a shielded transaction for some reason their main wallet is listed at the end which is not even up to date and when you download it you have to synchronize the full chain and don't look like two gigabyte of keys which is not user friendly and so it's it's not designed for like very easy user experience and for example if you there are some other Z cash wallet which are not listed on Z cache website I think they will update their information after they hear it there is like a capi wallet which is much more user friendly and there is also Zak wallet light but still like

there is not enough like documentation and explanation how to actually use this wallet so I would say there is a very high user friction and that's why people you Tonetta cash rather than easy cash because we really pay attention on very easy user experience and I guess you're also living on the ethereum blockchain so do you just need to have eath to use it that's correct yeah if you already have your assets in material it's much easier to do smart contract on the theorem than trying to use some other chain and if you use another cache like swapping easier to see cache if you use the cache by swapping either here and

then doing transaction and swapping back to eater it is basically the same as using Tornetta you need to take care of all the correlations so you basically use it as a mixer and you need to take all the same precautions and in this case why not just use something like this already this tornado cache also work with other ERC 20s or is it only working yes we have added years to 20 tokens support but unfortunately people don't really use it for the anonymity said pools are very low that's one of the problems would they are c28 tokens and yeah we spent quiet of time developing and and it turned out that

it's not something that our users use at this moment even die die die has like stable coin with a deposit of like I think 10 died that there is like an immediate set of 15 or something and the for larger deposits there there is no one that has my the transaction together also some like many people I think asked for interest on Terminator like economic incentives and to eat at sea die and see use the T's that allow you to earn interest while your fronts are silty and another anonymity pool and still nobody is like a lot of people ask about it but nobody uses so that's one of the lessons

that we learned if somebody gives you like a cool idea you should not just Jana like jump and implemented because it might turn out that nobody's going to use it or like the three people who asked you're the only people who are gonna use it and it's not enough to create a mixer right what happened so a few months ago back in October you published a blog post that was something along the lines of we got hacked and then hacked ourselves or something so what what happened there basically those I just want to mention that when that happened we still haven't got our security audit yet which we do now but at that time we didn't have it and we we basically we

published very minimal version after another cache which somewhere hard limits like 0.1 ether as a deposit and we found some issue which Roman can further explain it turned out that in underlying fiber it's a company that we depend on there was a vulnerability that eventually allowed if exploited to drain all the funds from the mixer so a pretty bad exploit if it had been like found yeah and thankfully we knew about it before anyone actually exploited so we were the first to exploit it and drain all the funds from the mixer and then we deposited it to a new instance that

contained fix got it and with this this was because I feel like miksa mess was also affected by this right I remember when it went around that this was found it was a different one in the end of July we discovered another vulnerability I found I was looking at the mother cash code and trying to make sure that everything is okay and found one issue and turned out this issue was present in like almost all the case Mart waste solutions at this moment one of Helium yeah it was like there was more than I think ten

projects that had pull requests back fix this issue yeah I think I remember that one so that was a different one that was this this sort of underlying was that also something found in a library yeah it was the way that the verifier contract didn't make certain check and this was like so obvious issue and I think this is why a lot of people missed it because when you look at it like everyone probably thought that for sure this check should be in the contract and nobody even tried to check and which was that people which which library with the different libraries so a lot of people independently made this

exact same mistake and multiple places okay what's the name of the library that he founded it was everywhere it was in Socrates in circum in in libraries that used to generate snark and any solution based on this library was well was this this was the July vulnerability you're talking about okay right but then in October there was one that was more specific to tornado cache it was in news okay it was vulnerability that allowed to fake car collisions so this I mean this in general brings up the topic of security and like every project we talk to you has to have some sort of you know idea around security when it comes to

privacy tokens thus the the worry or the the worst case scenario is that everything is private and yet there's a vulnerability that allows either like in the Z cat that's AZ cache vulnerability where it allows someone to forge tokens secretly and then be able to extract basically value from nothing or that you could actually hack it and drain it but it would be private and no one would notice until I guess they go to get their tokens when someone drains it it's exactly the same process as Z cash for ability basically someone prints that thing oh I see okay mechanism is exactly the same yeah and

in theory vulnerabilities can could happen in the future but without actually deploying solutions and trying to use it nobody will ever like we need to deploy something in practice in order for it to gain popularity and I see what you're saying so it's this idea that like we still need to publish something you need to get something out there this shouldn't make people worried about publishing because if you don't publish I mean things need to come out and then vulnerabilities need to be found and then I guess the question is how do you deal with that and it was interesting how you guys dealt with it

I actually appreciated the the speed and transparency with which she kind of just like you're like this thing was found her thing was broken and we've you know done what we can to fix it I think you were lucky too though cause like what hadn't what would have happened if it had not been found by you well if if somebody else would found it they would profit like two thousand dollars at that time so I guess this was something that we would be able to risk and to fund with our own money and later to reimburse the users I I would say yeah we do the security ology so we hope that

it was robust enough to cover the issues and if there is something else comes up in the future I guess we'll deal with it yeah and disaster happens from time to time like very to move to Sikhs and some other stuff like that and it can happen with any project I think it is part of every project I find this an interesting story not so much because of the details but because it's a realistic view into what it takes to build something on aetherium I think like like you say like you ship something you find bugs you scale it up you do what you can you do audits you do whatever else um you know I think projects should have a sort of a plan of

attack if you know this is what we're going to do if there is another hack or when disaster strikes this is how we will react it is obviously extremely hard to define that upfront because you don't know what the disaster is but sort of a disaster recovery plan kind of thing I know that there are a lot of projects and make her down spends a bunch of time trying to design Reyes fallback solutions and escape hatches and everything else and you know we haven't really seen if those measures are effective yet or not and I think this in general this whole topic is something that this space has yet to really figure out the problem with the

point for disaster recovery is that if you have one that means your your application is not decentralized if you decentralize then you cannot have a disaster plan recovery yeah because your decentralize that's all there is immutable that's it so the disaster recovery plan could be something decentralized as well like having a statement in the EIP process that should this thing happen then we as a community you will come together and take this action which would be nice to have but you know for aetherium is probably not going to happen I know what you're referring to

yes I agree it would be great to have some have something like this and some other projects they choose to use some douse that would be able to let's say upgrade the smart contract in case of disaster but right now I don't think we have any like huge dowels that would effectively implement the strategy and that the community will trust some dowel that they will act in a you know in a good manner yeah yeah that's what I think it like this is something we haven't figured out as a as a community and as an industry right the way

there is one more potential solution there is centralized insurance yeah project project that you can buy insurance from them in in the event that something happens with a smart contract someone steal the funds you will get money from the insurance yeah I think that's speaking about defy and everything else like that's something that we've yet to see that I think should exist like proper insurance companies Alan Jane all right so I feel like we've gotten a pretty good picture of tornado cash and what you're working on and you know we've covered quite a

bit of ground but what's next for you guys what do you see happening with tornado cash our current road map is that the bigger region is to replicate all the privacy-preserving features from Z cash on top of aphelion the next one would be to implement see more - wasabi wallet like Toronado cash wallet where you can help the private private and nonprofit transactions and the third one to make a research how you can do internal transactions for tornado cash and keep in mind we we are a project that we didn't have any VC funding we

didn't have any token offerings so our our motivation comes from just bringing the privacy for everyone and if you like what we do you can check out our get coin grant application to learn more about our roadmap put a link to that in the show notes current version of tornado is it was the simplest thing that we could roll out quickly so further down the road we'll have a lot of ideas how to make more advanced and Twitter solutions with internal transactions and any amounts inside the privacy pool and tokens and stuff like

this cool thanks so much for sharing this topic with us and kind of going into it yeah thank you very much yeah thank you for having us and to our listeners thanks for listening thanks for listening [Music]