Last month, JSC sponsored EthTokyo Hackathon with a total prize pool of $3500. This post is the second in a three-part series where we will highlight each winning team, their winning solution, why we awarded them the respective prize, and the winning team’s feedback to JSC.
JSC sponsored the following hackathon tracks:
Compliant, Privacy-Preserving DeFi application (
Winner prize:
US$1500)
Ticketing application (
One Special Award (
Mamizu Cash was our clear winner for the Compliant, Privacy-Preserving DeFi track. We were impressed by their understanding of the real-world needs of compliance and privacy in web3 ecosystems, using their technical expertise to build a solution that was not only complete and practical, but provided a seamless user experience.
The Mamizu Cash team, consisting of Yuki, Fuyu and Shodai, came together via the Ethereum Foundation’s Privacy Scaling and Explorations’ ZK Core Program held in Tokyo, which was being held in the months prior to the EthTokyo hackathon. Given their fundamental understanding of privacy-preserving cryptography and open-source contribution, we found that the standard of documentation, zero-knowledge circuit integration was very high for a hackathon submission.
The Problem with Privacy Tooling today
Improved privacy tooling will help advance the mainstream adoption of public blockchains[1]. However, current solutions—such as “coin mixers” like Tornado Cash and Cyclone—are often associated with illicit activity and have faced regulatory crackdowns. As a result, even legitimate actors risk potential blacklisting if using Tornado Cash or similar tools. JSC set out a challenge to hackathon participants to create privacy-preserving solutions that protect users while remaining compliant.
The Mamizu Cash Solution
Mamizu Cash made a clone of Tornado Cash, a well-known, privacy-preserving protocol used for EVM-based chains. However, Mamizu Cash used Mizuhiki Verified soulbound tokens to check “Proof of KYC”, and ZK Email-issued UNTIs to check “Proof of KYB”, ensuring that anyone depositing and withdrawing from the Mamizu Cash privacy pool is a trusted actor.
This is exactly the kind of DeFi application the JSC judges were looking for, as privacy is a fundamental obstacle to mainstream businesses using public chains for trade finance, salary payments, and even regular day-to-day payments.
How Tornado Cash Works for Privacy
Tornado Cash is a very simple concept: a user makes a deposit into the privacy pool and gets a “receipt” of that deposit. When the user wants to withdraw, they only need to show the receipt: i.e., it is possible to make a withdrawal to a completely new EVM address by showing only the receipt. It is analogous to picking up your dry cleaning: if you want your mother, brother or sister - or even a stranger - to pick up your dry cleaning, you only need to give them the receipt and they can go pick it up for you.
For a real life use case, imagine you wish to receive your salary on a public blockchain like Japan Smart Chain. However, since your boss must know your blockchain account address to make the payment to you, your boss would be able to see how much money you have in your account and look at the transactions you make. For obvious reasons, an employee may want to receive their salary at one publicly-known address, and then later transfer it to a different address that their boss does not know about.
Unfortunately, without using privacy tooling, the transfer to the “other address” is traceable on blockchains, and your boss could quite easily find out about other accounts that are linked to your salary-receiving account.
Using Tornado Cash, this problem is solved. The employee can receive their salary (¥100,000) to one address, deposit this amount into Tornado Cash pool and get the receipt of deposit proof, and use the receipt to withdraw the ¥100,000 to another address. As long as many people are depositing and withdrawing from the Tornado Cash pool, it is hard to make a link between the depositing and withdrawing addresses. Tornado Cash works almost perfectly for privacy-preserving transactions: criminals use it seamlessly to launder billions of dollars every year!
Enter, Mamizu Cash: Privacy-Preserving Transfer, Compliance-Ready
Privacy is important for everyday users, but many of these users are too afraid to use tools like Tornado Cash, as they do not want to be affiliated with the criminals using them.
So, what if a privacy-seeking user needed just a little bit more than a receipt to make a deposit and withdrawal from Tornado Cash? Showing their ID card may be counterintuitive, since they would reveal their personal details at some point, which goes against the whole point of using a privacy pool in the first place. What we are looking for is some proof that the user is not a criminal.
Mamizu Cash designed their privacy pool by checking all deposit and withdrawal accounts that had a Proof of KYC or Proof of KYB.
For KYC, they used Japan Smart Chain’s proprietary “Mizuhiki Verified” soulbound token, which is provided for free to all end-users of Japan Smart Chain. The Mizuhiki Verified soulbound token[2] has no personally identifying information on it whatsoever, only a proof that the user performed Japan-compliant KYC with a trusted entity.
However, Mizuhiki Verified is currently limited to individuals who hold a My Number Card in Japan - which businesses do not possess - restricting the privacy pool’s usage to individuals only. To resolve this limitation, the Mamizu Cash team made their own “KYB” solution using ZK Email.
To “KYB”, the user belonging to the enterprise needs to send an email from their company email address along with a DKIM signature (this signature is usually sent automatically by most modern email clients, such as Gmail, Apple Mail, and Outlook), and the user confirms they sent an email by pressing the confirmation button on the Mamizu Cash app.
On the backend, the relayer generates a ZK proof of this email, and verifies the DKIM signature via the ZK Email SDK. Once verified, the relayer issues a UNTI credential (similar to a soulbound token) to the user’s wallet address.
Since time was a limiting factor in the hackathon, Mamizu Cash did not automate the relayer capability, and instead demonstrated the usage manually to the JSC judges. Since the logic of the ZK email functionality, ZK Proof verification, and UNTI issuance was fully thought out, with comprehensive documentation to support it, we believe that the team made the right choice in showing us the capabilities rather than completely automating the backend functionality.
Enhanced Salary Payments with Mamizu Cash
One of the key UX features Mamizu Cash developed, on top of the standard privacy pool, is the ability to distribute the funds to multiple recipients directly from the pool via “claim links”.
Currently, if your employer were to make salary payments on the blockchain, you could see what your other colleagues are being paid: since you can see the address the company paid you from, you are able to see the other transactions it makes.
The way a company can pay salaries through Mamizu cash is:
-
The company deposits the total payroll amount to the pool.
-
The company generates separate claim links for each employee and sends it to them.
-
The employee claims their salary from the pool directly.
This way, your boss never learns your address, but also you never learn your company’s address.
While this claim link functionality is theoretically feasible with Tornado Cash, the UX is missing, which presents a major obstacle to mainstream businesses adopting blockchain technology for salary payments and trade finance. This UX feature required minimal development effort - relative to the heavy ZK engineering - but delivered a significant improvement in user experience, which we found highly appealing.
Final Thoughts
The Mamizu Cash team did an excellent job for the privacy-preserving DeFi standard. They not only successfully implemented KYC-checking via JSC’s Kaigan testnet, but they also thought deeply about the real-world use cases of privacy-preserving tooling and addressed a critical gap: KYB verification.
There were many challenges the team faced, including ensuring the ZK proof verification worked for deposit and withdrawals from the compliant privacy pool, addressing ZK Email errors, and also utilising JSC’s private testnet and Mizuhiki Demo environment, which - since is not yet public - can be difficult to access (don’t worry, we are working on this, and will have a public testnet for you soon!).
The Mamizu Cash team has expansion goals of automating KYC and KYB processes in Japan, making it cheaper for start-ups in Japan to launch finance-related applications. As our goals at Japan Smart Chain are very similar, we hope to work closely with Mamizu Cash in the near future!
Stay tuned!
Links:
Code: https://github.com/Mamizu-Cash/Mamizu-Cash/tree/development
Demo: https://untiittit.mamizu-cash.pages.dev/
Documentation: https://aoki-app.jp.larksuite.com/docx/YJRGdVnAgoE1QFxpY3lj073ppxg
ERC-6268 (UNTI): https://eips.ethereum.org/EIPS/eip-6268
Public blockchains are easily accessible, transparent and offer far greater network effects for users and applications when compared to private chains. ↩︎
A soulbound token is a non-transferable token, usually a non-transferable non-fungible token. In other words, the Mizuhiki Verified soulbound token is a non-transferable “Proof of KYC”. ↩︎
