Commit-reveal schemes against front-running attacks

Transcript

foreign [Music] thank you alright thank you very much for being here and thanks for the to the organizer for including my presentation in the in the program my name is Andrea canidio I'm senior research Economist at Cal protocol and what I'm going to discuss today is joint work with vansandano who is

could be around should be around and is also research that was supported by the ethereum foundation with the grant that we received last year now I assume that there are many smart contract developers in the audience and that is great because when working on this research we thought about a lot about you guys in the following sense because we were really thinking as a smart contract developer what can you do to prevent your users from being exposed to front-running attacks okay now we think this is a relevant question because a lot of the research that being done recently on the topic of Mev and various type of attack has focused a lot

on the infrastructure that is on how a transaction originates and then you know is sent to either a public mempool or a private Channel and eventually ends up included in a block but we think that uh front running attack Mavs and those things also have a lot to do with how those transactions are interpreted by a smart contract once they are included in a block okay and so the what we've started thinking is okay can we have tools that potentially any smart contract developer could use in order to prevent their users from being exploited by attackers okay so let's keep the infrastructure as it is now we can also think of the

infrastructure as the one of the old day where everything was going through the public main pool and can we work exclusively on the smart contract layer to prevent attacks now I think a natural uh object to look at for us to answering this question are commit revealed protocols commit reveal schemes and in the paper we propose a somehow novel commit reveal scheme which is you know it's similar to a couple of things that are around one is the sub-americ submarine commitment protocol which is in the literature I don't think it has been actually used but and the other one is also similar to how ens manage their domain registration okay so it's not exactly the same as you

will see there is there are some differences but the the novelty of the protocol is is limited what is really novel here is a type of analysis we build a game theoretic model of front running and then we use the model to study what is the effect of introducing the protocol on the probability of having an attack and the severity attack Zone and so forth so it's really on the methodology and we essentially we derive three results which I list here in order of you know how intuitive they are to some extent the first result is that this commit reveal scheme prevents the most severe forms of front-running attacks and I realized that this statement requires me to tell you what we mean by the severity of attack and this will be in a couple of slides

then it's also we think interesting because it preserves a legitimate competition among users so if you want it preserves good math and again how we distinguish between legitimate competition and attack you know it's the formalities are in the mod in the paper but I will give you an intuition in a couple of slides and then the third result that is the least intuitive the one for which we kind of need a model to see is that even when it does not fully eliminate attacks the protocol is effective at reducing competition among attackers okay so for example whereas with the protocol you without the protocol you may have three attackers with the committer with scheme maybe you have a single attacker and hence reduces total expenditure by

attackers and this also benefits the the honest user now of course we know that commit reveal schemes have costs in particular they require two messages and imposes delay so whether you know in principle you could apply this protocol to any smart contract but whether it's cost effective you know will depend a bit on the specific environment where you're thinking about deploying this okay now I mentioned the fact that we have a notion of severity of attacks and we have a we distinguish between honest competition and uh and attacks let me give you an intuitive sense of how we Define those concepts by uh what by by an example that of a smart contract that Awards a very nice nft this one to the

very first person who can correctly answer a question now and let's consider three situation okay the first one is you know we have two users Alice and Bob they simultaneously find the answer and they submit it and then of course they realize that they are competing with each other and they will do this kind of gas replacement replacement transaction in order to you know each of them is trying to have their transaction included earlier in the block so to claim the nft this is clearly a case of legitimate competition they both found their answer independently and then they are competing with each other and not that there is an element of economic efficiency here in the fact that there is competition because this guarantees that the one who likes the NF nft the

most will be able to get it because this person will be able to outspend the other guy so the one who likes it the most gets it and this is the efficient things to do now the case two is the classic attack Alice does all the research finds the answer but she's naive she sends the transaction through the public mempool Bob is just doesn't you know he's has not done any research but sees the transaction by Alice and then can craft his own transactions send it faster and perhaps manage to steal the nft from Alice okay so this is an attack and why it's an attack not that case one and case two could be observationally very similar like if you're looking at the mempool and the blockchain they look the same but clearly one is an attack because Bob

is using information extracted from Alice in order to craft his own message okay while in the first case this is not the case okay and the third case is the most subtle which is where you know we have Alice she finds the answer that submits it Bob is someone who was also doing his own research okay but he is a bit slower so by the time Alice found the answer Bob managed to narrow down the possible answers to two let's say okay and now he sees Ali's message in the mempool OR now he figures out which one of the two is the correct answer and he can then send his own transaction okay now we in the model we classify this as an attack because Bob is using information extracted from Alice but we will

classify as a milder attack by because the success Bob is already has a lot of Prior information to start with so the amount of information he is extracting from Alice is is lower okay he's already full like fairly informed to start with contrary to case two in which Bob has absolutely no information and is fully reliant on Alice on the observational analyst message to craft his own message okay so in another in the paper we have all the formalities but intuitive then an attack is characterized by the fact that you know Bob is has to use information extrator formalities to add to extra to send his transaction and the severity has to do with kind of how much information he is relying on

so now that I told you this I can tell you what the protocol is about sorry for the slot it is a bit dense but okay again the transaction and messages here are sent as they are now this is not about infrastructure it's about how those messages are interpreted by the smart contract and they commit reveal protocol does this okay if a honest player or anyway anybody wants to send a message ask to a Smart contract this player who has to First commit the message and the commitment phase was the following way you take your message you concatenate it with the with an address that you also control and then you hash it and then you send

this as a message to a Smart Contra that's the commit message and then comes the reveal period in which the player has to send the reveal message and in s so the message intends to send but importantly it has to send it from the address that he committed in the commit stage okay so the address that was part of the commit message now the Smart Control received the reveal message can observe from which address it was sent can compute the hash and then can check whether this was actually this message was received during the commit period And if the answer is yes the message is considered as valid and will trigger some action depending on exact context otherwise the message will be discarded okay

and of course send the messages is costly and there may be multiple honest users who want to interact with the same smart contract and there may be multiple attackers now not also that in the paper we so in this version of the protocol an observer will see that someone committed something okay so there is this form of information leakage we have another version of the protocol in the paper where this is also obfuscated because the commitment is placed somewhere else and then when you reveal your place you also review the pointer to where the community commitment is placed but even in that version there is another form of information leakage which is that an attacker could commit a message and then decide to send the

reveal only after having observed the reveal message of the honest player so the protocol severely limits but does not fully eliminate the ability of an attacker to act upon the observation of the victim message okay in the in the sense that here you can still decide not to reveal or or so reveal or not after observing the victory message and the last observation that is important is that in this scheme an attacker cannot clone the commit message because the commit message it contains the address from which the reveal will be sent so you cannot just see a commit and copied because that won't work for you you have to guess some myths such as that might be useful

to you as an attacker in the next stage when you reveal and hence the the three main results as I said the protocol is built so to force an attacker to guess and of course again here's the severity of the attack plays a role because if they are the the the the attacker is completely uninformed guessing will be very costly for him and the protocol is effective at preventing attacks but in situations like the third case earlier where the attacker already has a lot of Prior information it is possible that the protocol will not prevent the attacks so that we can say that the protocol is effective to preventing the most severe attacks perhaps not on the least severe attacks

the second result is that competition between honest player is preserved it is just pushed toward in the reveal message now it doesn't matter the order in which commit messages are received as long there are both there are all received in the commit period and then when the reveal reveal period arrives honest prayer will all compete we try to get their own reveal message earlier in the block so essentially competition is preserved but pushed by one period on the reveal period reveal message and the third point which is the least intuitive now there is this very famous result in Game Theory especially contest Theory which is called Full dissipation of rent essentially it says that when there are multiple competitors competing for the same price and they are heterogeneous at

most one of them there's at most one of those competitors which is the strongest exante can expect to earn positive profits once in the competition and it says that everybody else expects in the competition to exert effort and pay as much as what they expect to win okay and the reason is that if this wasn't the case then the strongest player can increase a bit their effort and win also the other and increase their payoff anyway just run standard results and very robust now essentially the commit reveal protocol imposes an entry ticket so creates an entry ticket for attackers so the attacker has to pay the cost of the commit message to then attack but now you are one of the attacker you know that once in the

competition you will learn zero why do you want to pay the commit message so at least in the pure strategy equilibrium of the game let's say this way there is all at most one attacker will want to pay the commit message and then attack in the following period so this is why the even if it doesn't fully eliminate attacks it reduces the number to attack of attackers to at most one foreign so then the novelty here okay a little bit the protocol is kind of a little bit new but particularly on the methodology of using Game Theory and deriving novel benefits of these commit reveal schemes in the context of math and fortunatic attack

not also that because it's applied to the smart contract level it can also be very flexible so for example you could decide that only sort this protocol is required only for certain messages so there is a set of messages that as they are received they are executed but then there are another set of messages that okay they're executed only if they were prior committed earlier and it's also possible to design a system in which the scheme is required all in some periods and not in other so it affords a lot of flexibility that's it so yes these are my contact on Twitter that and the latest version of my of the research paper is always available on my webpage and let me also just use the last second to point you to the open

position page at Cal protocol thank you finished okay and questions there is no time for questions but I'll be also in the back if you need to talk sorry sorry let's go outside [Music]