Private Transactions on Public Blockchains

General Discussion / 一般
1

Private Transactions on Public blockchains

On public Ethereum Virtual Machine (EVM) chains - such as Japan Smart Chain - there are a few leading ways to do private transactions. This overview describes the top two options, which have been proven for many years on leading EVM-based chains.

:memo: A Quick Note on Compliance

Some well-known privacy tools, such as Tornado Cash, have gathered a bad reputation for their use in money laundering. However, it is possible to incorporate blacklists and whitelists for privacy pools and shielded transfer protocols to prevent illicit use of privacy tooling. (We emphasise that privacy is absolutely essential for trading and trade finance use-cases on blockchain!) As such, some compliance measures have been natively incorporated by Privacy Pools and the Railgun protocol.

Building on this, Mizuhiki ID, pioneered by Japan Smart Chain, can be easily incorporated to whitelist known addresses to ensure that private transactions are compliant under AML/CFT law in Japan.

Privacy Pool / Coin Mixer :money_bag::repeat_button:

:police_car_light: Privacy Pool and Coin Mixer are used interchangeably, as their functionality is essentially the same. :police_car_light:

Usage

A user puts a deposit of 1 ETH into a “privacy pool” from Address A. The privacy pool is usually a system of smart contracts, which are computer programs that are stored and executed on a blockchain. The privacy pool contains deposits from multiple addresses. The user computes a deposit note (also known as a “claim link”) proving their right to claim at most the amount they deposited (1 ETH).

The idea is that as long as that the privacy pool makes it harder to link Address A to Address B (see the following diagrams)

Coin Mixer Deposit

Address A generates a deposit note and deposits to the coin mixer smart contract protocol. The smart contract protocol stores a zero-knowledge proof of the deposit note.
Address A generates a deposit note and deposits to the coin mixer smart contract protocol. The smart contract protocol stores a zero-knowledge proof of the deposit note.1539×339 19 KB

Coin Mixer Deposit & Withdraw to new public address

Address B shows deposit note to the coin mixer smart contract protocol to prove that they have the right to the funds deposited by Address A. If the deposit note is valid, the smart contract protocol distributes the amount (1 USDC in this example) to Address B.
Address B shows deposit note to the coin mixer smart contract protocol to prove that they have the right to the funds deposited by Address A. If the deposit note is valid, the smart contract protocol distributes the amount (1 USDC in this example) to Address B.1539×339 20.2 KB

At a later date, the user is able to withdraw the funds to a different blockchain address “Address B”, using their deposit note as proof they are entitled to 1 ETH. Once the funds have been claimed, the deposit note becomes invalid, preventing the user from double-spending. Address B must pay for the gas costs of the withdrawal by calling the withdraw function directly, or use a relayer.As long as there are several addresses withdrawing from and depositing into the privacy pool, it is difficult to link Address A to Address B.

Considerations

  • It is important that the privacy pool protocol does not reveal the deposit note, as this could link Address A to Address B.

  • Currently, the world’s leading coin mixer only allows deposits/withdrawals of a certain denomination (e.g., 0.1 ETH, 1 ETH, 10 ETH, etc.). This is so that user deposits and withdrawals look the same on-chain, which makes it harder for deposit-withdrawal addresses to be linked.

    • In addition, only highly-liquid asset classes are supported, such as ETH or USDC. Otherwise, it becomes easier to link deposit and withdrawal addresses to each other. You can see the asset classes and denominations currently supported by Tornado Cash here and by Privacy Pools here.

Shielded Transfers :coin: :shield:

Usage

A user’s blockchain address A uses a shielding transfer protocol to create a shielded address, also known as a “0zk” address. Upon creation, the user obtains the spending and viewing keys for the shielded address. The shielded address is not viewable without the shielded viewing key, and is not shown on block explorers like Etherscan.

Shield

Address A can “shield” ERC20 tokens to a shielded address.
Address A can “shield” ERC20 tokens to a shielded address.1539×676 37.5 KB

View/Spend

The balance of the shielded address is not visible without the viewing or spending keys.
The balance of the shielded address is not visible without the viewing or spending keys.1539×676 50.7 KB

The balance of the shielded address is not visible on any block explorer without the viewing or spending keys.

Table 1: Difference between an normal, public EVM-based address and a shielded, private address.

Public “0x” Address Shielded “0zk” Address
Public address (public viewing key) Shielded address (Shielded public key)
Private key (spending key) Shielded private spending key
Shielded private viewing key

Using the spending and viewing keys for their 0zk address, the user is able to send tokens to other shielded addresses within the Shielded Transfer ecosystem. Shielded DeFi activity - such as using Uniswap to do ERC20 token swaps - is possible with the use of a relayer. This also means that yielding balances are possible with shielded addresses.

Shielded transfer

User A’s shielded address can send funds privately to another shielded address. This does not change the funds in the public Railgun Smart Contract pool, as the commitment to the assets (0.5 USDC) can now only be unlocked and/or seen with User C’s shielded private keys.
User A’s shielded address can send funds privately to another shielded address. This does not change the funds in the public Railgun Smart Contract pool, as the commitment to the assets (0.5 USDC) can now only be unlocked and/or seen with User C’s shielded private keys.1539×676 45.6 KB

To “unshield” tokens from a shielded address to a public address, the 0zk address selects a broadcaster and generates a proof showing they are entitled to spend those tokens. The broadcaster then sends the tokens from the Railgun smart contract to the EVM address.

Unshield/Transfer

User A unshields (publicly transfers) funds to User B’s public address. However, the public cannot see the link between User A and User B, reducing correlational privacy risk.
User A unshields (publicly transfers) funds to User B’s public address. However, the public cannot see the link between User A and User B, reducing correlational privacy risk.1539×676 56.1 KB

Considerations

  • Using a broadcaster for shielding/unshielding, and a relayer for defi activities, can cost extra fees beyond gas costs.

  • Tax and other compliance audits for the 0zk address in question is possible with the provision of the shielded private viewing key.

  • A broadcaster can also act as a paymaster, enabling “gasless” transactions for certain applications.

  • In the Railgun protocol ERC20 and ERC721 tokens can be used, however, native tokens such as ETH need to be wrapped into ERC20 tokens, such as “WETH”.

Table 2: Quick Comparison

Coin Mixer Shielded Transfer
Leading Implementations Tornado Cash, PrivacyPools.com Railgun
Privacy Method Mixing tokens with deposits sent by other addresses. Shielding tokens to private “0zk” addresses.
Denomination Fixed set (0.1, 0.5, 1, etc.). UTXO model - flexible.
Anonymity Set Based on: Constrained by liquidity (deposit/withdraw) for each denomination, for each asset, for each chain. Constrained by liquidity (deposit/withdraw) for each asset, for each chain. DeFi activity within the Railgun protocol increases the anonymity set.
User Experience User needs to handle deposit note securely. User needs to manage the shielded address’ viewing and spending keys.
Best For Simple, sequential transfers - e.g., 1 ETH from Address A to Address B. Savings, DeFi, Complex Transfers.
Potential Mizuhiki Integration Mizuhiki SBT needed to deposit/withdraw. Mizuhiki SBT needed to shield/unshield - however for unshielding you would only be able to prove that the unshielding transaction comes from an account that had the Mizuhiki SBT at the time of their original deposit (i.e., if depositor had their SBT revoked, their deposit could still be withdrawn to another address that holds a Mizuhiki SBT).
Please let us know your thoughts on privacy pools and shielded addresses in the comments below! What would you like to see in the private transfer user experience? Do you have any recommendations for leading private transfer protocols?
「いいね！」 5