ZKV presents Privacy on Polkadot - panel discussion about privacy in DEXs and DeFi

Transcript

hello everyone camera do you want to say something so we know we can hear you well i can yeah we can hear you great all good okay okay so um just a quick intro to this panel it was originally going to actually have someone from parallel finance we're going to talk a little bit more generally about like d5 but they weren't able to make it this time around so today we have shumo who you just heard from from manta and guillermo guillermo do you want to tell us a little bit about yourself yeah i guess a quick uh tldr is uh uh hi i'm a stanford phd i actually my phd is not in zk or really anything related to zk it's actually in uh optimization physics um but it turns out that every once in a

while i i can come up with a problem that actually happens to touch the zero knowledge side of it so uh we've essentially done some work on privacy and defy and and all these things like differential privacy and the possibility of source privacy and all of this stuff uh and and i guess uh in the not so far future uh uh lb uh head of research at um vain capital's new crypto fund which is soon to be announced yay that's why i didn't want to i didn't want to announce you i keep letting you announce you until we know that until it's all cool but yeah i one of the questions i kind of i want to start this off so i do have what i want to do with this session is basically explore

privacy and d5 type contact concepts and but before i do that i actually wanted to ask you shumo something because i remember like when we first heard about manta manta was presented as a privacy amm but what you just presented to me looked more like a shielded area so can you just tell me like are you still an amm i think i think we are going to bmm uh i think uh first kldr right so i think are we basically uh basically we there is a little bit a road map switch um basically we are uh we already built the shielded payment part right the next thing we are going to build is actually um a like a fully evm compatible programming layer for the

uh programming layer for the private asset and not then the mm will just be one of the many contracts we can deploy contract you can deploy the contract so this is a this is a i think we will have uh announcements uh once a week uh we're basically already finished design but we're actually holding the announcement a bit but uh uh please keep following us we are committed to bring you the uh privacy and then okay but uh it will be the part of the bigger project yeah could sound but it sounds like it's still part of the work that you're doing like in understanding these and navigating them indeed i think so so why don't we spend a little bit of time though talking about like what like if it was easy everyone would do it what

is the actual challenge of private amns in general guillermo i feel like you've navigate you've done like some papers where you talked about some of these problems but maybe you can share with us like why is it hard yeah so well so so i guess uh uh i i i hope not if you follow me on twitter but if you do uh you've probably seen this i do i do oh i'm so sorry uh i'm just apologizing in advance um it's probably bad for your health but so yeah the hard thing about any kind of general private application is that global state like having global state is really hard because global state leaks like something about the underlying things

that's supposed to be private so the special so cfo is a very very special case where the global state uh literally just knowing things like very basic stuff like knowing the marginal price of a token right in a cfm actually turns out to be enough to leak the entire flying state right so it's enough to leak the reserves this is some some uh result that we've actually inspired by annum originally i think you're acknowledged in the paper uh if i recall correctly um where we essentially show that you solve some some cute little non-linear system of equations and immediately you get the reserves out given just the prices um of the of the assets in the in the cfm so in general right it's very hard to make full privacy guarantees about

things that rely on global state um and and you can often say something like hey look statistically like we can know a little bit more information that gets leaked about the underlying perception in cfm's it turns out there's like a very explicit simple form for what that is and it's in fact i can recover the entire state of the uh of the cfm given just the prices um and and i guess yeah i can provide a link to the paper uh one second so um that's that's the big challenge this is true of any again it's true of any global application that really interacts with global state in a non-trivial way but it is it is like cfm is just like a really clear example where you can just like just the basic stuff that you need to know to be able to interact with it is enough to

reconstruct the the entire thing yeah i want to add a little bit right so for example uh in our mm design i think we actually know uh like um i hope i pronounce your name right uh guinea almost uh results i i will first design it i think uh basically um it's i think for it's the the real problem is on the amm scheme itself right also it's about the usability for example when people want to trade right it's very hard it's very hard to ask people trade without knowing the price and because every the public ledger's nature the price have to be kind of public unless you have like really really fancy crypto i don't even know how to do that right

so um but here so for our for the fundamental design right we're still committed to that design uh it actually the privacy guaranteed if you read our paper the privacy guard is very clear we don't provide any protections on the not leaking the price we are actually providing the protections of not leaking your identity basically you can think of after shield after shield transfer your identity will be shielded by the zkp it's wide the price is getting leaks so this is um so basically um i mean there are kind of uh theoretical more advanced designs like zaxy right they can provide you better protections in terms of the price leakage but i i think

we're trying to make a trade-off here right basically um like zaxy's design is a pretty complicated not i mean probably one day people are going to actually fully implement that but uh for us basically we want to provide uh like a a m style that it's kind of like a bulletproof design of the uh of actually am actually works in the real world and then provides you a protection of the privacy leakage of your identities also i just want to say we actually have a full uh like uh security proofs of uh reduction based security proof of privacy uh for for for for the exact privacy we're trying to protect is that still the work that you're doing

though or have you kind of pivoted like you sort of mentioned that you're sort of switched up your design does your amm still yeah yeah exactly the same do that it is so it's focused mostly on id privacy but not on amount or price yeah basically you can think of the foundable token layer is private also i also just want to say we didn't pivot we just uh try to generalize the same so for example uh you can write a swarming contract to manipulate the thing we don't have to be the only player to deploy the deploy the m and basically we are kind of building a platform right now yeah okay so yeah this is this is similar in spirit to uh i believe phlox by wei dai if you've heard of it's it's a i can

link the paper as well yeah yeah yeah everything here is distinguishing between two things it's anonymity and like true privacy right so anonymity is absolutely that's easy to keep and and you guys have absolutely done it right um right assuming that hardness will hold of course but whatever yesterday right right um but yeah the price is always fundamentally leaked and that's essentially like we no one knows how to do this in a way that doesn't really result in us uh there's some interesting ideas uh around how to kind of mitigate this uh for example penumbra has one idea which is i think you know there's like a pareto optimal curve like economic efficiency unlike privacy and i think it's like on the economic or sorry on the on the i guess the bottom right last

case um of the pretty optimal curve but this is a very different trade-off so right right right i think i think yourself has a paper for adding some differential privacy uh into into this realm right so actually this is a very interesting design i think could be uh some some i think could be practical if someone really draw go deep into that yeah so just yeah just just to the audience who don't know differential privacy a little bit right so differential privacy is kind of like it's kind of like a not as good as the case privacy guarantee become a kind of waving scene right you define two two parameters if it's not delta right so so basically you can control the leakage but you don't have um a good picture of what is that adversarial

models of the privacy like you don't have assumptions of stereo powers instead it gives this kind of like a uh a little bit more hand waving but still good privacy guarantee yeah yeah yeah please the the ideas is essentially you can then so they're there this gives you this method of differential privacy essentially does stuff like add noise to the price and norfolk will not be able to reconstruct it so uh it gives you some nice guarantees right so like you said you know it gives us some slight model free guarantee so the constants are really terrible so it's not particularly practical but the big thing is that it gives the user away essentially a sliding scale so you can choose to be completely not

you could be completely anonymous but not private at all right in the sense of like you just leak the exact amounts uh but but you're really economically efficient right because your price is exactly what the the cfm says it you you do the trade it works great on the other hand you could have a sliding scale that goes all the way up that says i'm willing to pay a lot of money to preserve my my underlying trade privacy right and so that's kind of the way of thinking about it it's it's uh differential privacy is kind of this this method where you you're trading off two costs one of which is economic costs to you uh and these you know these aren't always bad they're just on average worse uh versus kind of how much

uh privacy you actually want to have right in the underlying asset so um but but yeah so but you know uh the problem is uh it's very complicated a it's very weird to reason about b and the constants are terrible so uh you know just this is uh that is the best uh a weird paper to read and be like huh that's interesting i guess we could do that but don't take it too seriously you might end up in a bad place i i also want to add a little bit i was doing some differential privacy research i think one thing is that the privacy guarantee is not very compostable right so for example you have two things the two leakage together will constitute a bigger leakage and still active research how to control that so basically my take is that

you should add dp on the primitives like manta so that you have fundamental layers privacy guaranteed then adding differential privacy it works better then you just just just use dp first right that's i think this is quite interesting yeah you just said if you add two things but what do you mean by that what does that look like so so for example you have action one whose privacy guarantee is in differential privacy and the privacy and action two your your uh like uh privacy guarantees also differential privacy then by adding this because the action one you have some deep privacy leakage action two you have some privacy leakage this thing combined so sometimes you combine linearly and

sometimes you actually combine them as a multiplier so that uh it's really really hard because then the leakage will go on on then you may find that you are very quickly in the situation uh that the leakage is too big that becomes a a serious threat to your privacy yeah so this is uh sorry to drag you do you think can this kind of academic privacy discussion rabbit hole but that's that's a spirit yeah can i can i go back to this sort of like the type of things that get leaked and in the differential privacy uh arg like um option is that is that actually hiding amount and price and id or is it which parts so we had talked

about these three different pieces of an amm that you could make private id price amount what does it hide so uh i guess the big thing to remember is that price gives you amount okay so they're kind of the same thing yeah exactly so they're equivalent in a lot of ways and in fact you hiding in some sense and some statistical says hiding one heights the other and that's the result here hiding one hides the other that's right that's okay but leaking one does not leak the other uh leaking one it also leaks the other equivalent okay like in a sense of like you you can use either to reconstruct the other okay so you have to hide all of it essentially yeah okay right so usually people don't need the

quantities to trade they need the prices right so you usually reason about prices as opposed to these specific quantities but but at the end of the day the user pays out the quantities right so like the user has to be like i'm putting you know 0.3 e right so that that is where the the key comes in and so so that could be but you know if the market says actually here i'm going to say that the price is 0.3 but i added a little bit of noise actually in reality it's actually 2.7 or sorry 0.27 three that would be very bad at first 27. um then then you know you can say something like oh yeah you know like we're not as economically efficient or in that case you came out on top but an expectation it's actually worse so does that make sense

essentially they're both equivalent notions that what's that result essentially just says that you can by knowing the prices that's enough to reconstruct the amount and and vice versa is obvious because like obviously knowing the amounts that you have gives you the price slippage and now right i sort of almost i i'm realizing i'm doing this panel kind of backwards but now i want to go into like why why do we want to hide either of them this is like where you're supposed to start this conversation but we did it the other way so we got there why would you want like hiding amount flash price hiding price or hiding id what you like maybe color like give us a little bit of a sense for like why you do that so maybe let's start with id why

do you hide id why do you need an amm that hides id but doesn't hide price i think the identity is the one the like fundamental kind of a human digital sovereignty right so for example like everything else for example you probably don't want your transaction history lack it after the project for for everyone so i also recently we talked to a lot of folks in downforce like i think one of the problems we're trying to help them to solve is that the payroll of dollar payroll it's kind of like a payroll payroll information is very sensitive right so like how like if you think dial is going to be the future then we need to solve this on-chain privacy problem i think i think there's just like a lot of

potential usage of privacy and that's actually core need but i kind of agree with you and uh doesn't everything i mean we're kind of thinking the future is a hybrid model you should control which part you want to be private or not depending your purpose and need but not absolutely not everything have to be privacy in the specific context of mm i'm actually curious and i want to ask uh your german question like it's so once i'm curious if you have a fully private amm right then you don't have the price and uh quality being being leaked then um i feel like kind of a liquidity discovery this is kind of like a market

arbitrage could be an interesting problem too right because the the kind of the assets of the mm is that hey like we have a free market so that uh different people arbitrage and the the balance the price and the balance curve will be eventually be there right so uh this is just actually very very interesting yeah so yeah yeah so so i guess i'm gonna start with anna's question i guess and then i'll move on to the second uh part uh which we asked so um but i'm going to do why would you want to hide the prices in the trade right that's that's the next natural question because you know identity is obviously extremely important right and honestly like in a lot of ways it's almost the most important

um so here's one one easy answer is uh i am you know jump trading and i am trading coin arbitrarily and i'm putting a bunch of money into like random stuff i do not want people here's the thing that i definitely don't want is people reconstructing my strategy so right now they don't have your id how do they know it's you right but so how would you know let's say you you are on average buying a bunch of tokens right and slowly but surely the price is going up and there seems to be this consistent stream of purchasing right statistically right like sure you know it could be the fact that like everyone decided to buy like whatever dog token number 365 right but it could also be the fact that

maybe there's one person slowly but surely purchasing uh this token right and trying to get a good price on it so i could front run you right and then push the price up so that's and so this is why you do things like whatever time weighted uh time winning average pricing and things like that this is why like large orders sometimes get chunked into smaller blocks and you do them slowly but surely but statistically speaking right like you're still leaking information about what you're doing even if you do it slowly over a good amount of time so this is a huge thing like in in high frequency trading this is a massive thing is like trying to discover the other person's playbook and then trying to play against that so this weird cat and mouse game here's one perfectly reasonable way to get rid of that is uh

i actually have no idea what the hell you just traded and i have no idea how much of it was and not only do i not know that i also don't know who you are so goodbye right um yeah i want to add a little bit please please yeah i think uh anti-front running and mev protection is actually harder problem than privacy i actually did a little bit of practical research right so um so for example let's say even you are everything is perfectly private but as long as this is a permission permissionless system some some people can do uh like a price per price probing actions and uh so yeah so so actually uh like i had some this discussion with some mit

folks about how do you really design like a fully like front-running resilient uh like a system seems to really really hard you probably need something like a vdf basically you should delay you should you should delay the delay the sex delay disclosure whether this this this this trade is successful or not then you kind of have some hope for like a full like front-running discussion because we were thinking hey like can can a fully like private deck be uh anti-front-running and unfortunately at least theoretically the answer is kind of no because you because it's a the route is because it's a permissionless system and everyone can everyone can trade and try

to prop the price then there there might still have chance to front rack yeah that's that's kind of like accidentally accidentally front running like for example yeah exactly exactly you keep pinning you just have some like a higher confidence that you have you have some front running opportunity just actually uh let's say if you use our validator right so you just just keep probing right despite you don't know the exact exact price then you can still find some like a front running opportunities for for very like a complicated strategy for for farming yeah it's it's actually a very hard problem in general yeah so uh yeah unfortunately i'll give you the the kicker on the vdf is that it probably doesn't work because you can often grind through possibilities um right correct

correct yeah so so actually it turns out it's even harder than like we ever think uh it's actually kind of bonkers how difficult like me protection is and it's there's also a question of whether we even want that or like what it means so but number has actually an interesting solution for this uh sorry henry if you're idiot does also osmosis like this idea threshold decryption maybe yeah i think osmosis might do something similar about unfortunately were you about to say threshold just decryption that's right so the idea is actually what you do is at every block you just aggregate everyone's traits and and then afterwards to trip them and then put them through the decks right yeah in some sense now you you don't get screwed because everyone gets the same

price um but here's the deal now arbitrage and uh and direct trading is weird right because now you don't know the price you're gonna trade at up to a slippage threshold ooh but b you also don't perform the trade until the block is like like fully minted right like you're not guaranteed that that thing is like done until like 50 seconds from now and then you don't know what price you're gonna execute at uh yeah yeah so but it it's weird but essentially now you you've you've done this thing where i can't front run you like i got the the notion doesn't even make sense anymore right i can like do statistical things where i'm i'm guessing that you're going to continue buying and then you could you know you could do it across a bunch of blocks but it's

like there's no notion of like pure like you know flashback style front running which is kind of crazy um so i want to just check in shumo you had this other question the second question before did we actually answer that in what you just said or is that was that something else and i tried to write it down but i missed it do you remember what it was i can repeat the question the question is if you have a truly private uh like a big change scheme right how about arbitrage and liquidity discoverer which kind of makes the price kind of in the free market and in the equilibrium of the supply and demand yeah but is this assuming not we're not talking about the mev threshold decryption we're talking about just pure private amm or cfm okay yeah

so uh in that case yeah again the the answer is the same right uh any cost that's gonna come to the user it's gonna get offloaded to the people who are doing arbitrage for the people who are like maintaining prices to be approximately equal so uh if you're eating the cost someone else is also eating the cost uh sorry right so uh yeah in some sense they're also less economically efficient and an economic efficiency here is a very general mostly ill-defined term if you ask anyone and their moms are going to tell you something different but but the point is yeah yeah so like someone eats the cost of the of the unfortunate thing that like now you don't have an exact price right you have some price within some like weird like epsilon ball which gives you the privacy amount or something like that

so sometimes you end up better but in expedition you probably end up worse because you just have less information about what the underlying object is you're interacting with so yeah that's that's my intuition but uh thanks for answering the question yeah yeah yeah yeah i mean it's intuitive too i haven't written down like theorem 3.26 that says uh right here but but you know you see next paper that's right yeah there we go but you might be an author if you're not careful oh no that's right oh yeah right i'm just i'm just the moderator man all right all right so i think we actually are at the end of the time frame we had allocated for this we even maybe went over

i want to say a big thank you to both of you to cut to come on and it's great because we you know i wasn't sure when one of our panelists dropped off if we could pull off the privacy d5 decks and we did and i'm very very happy that you are both here to explore this with us for sure thank you for having us thank you yeah thank you thank you yeah cool