Compliance and the next wave of privacy applications

Transcript

[Music] thank you [Music] [Music]

thank you [Music] hi everyone good morning it's great to see you all here conference maximizers and for a day of privacy so excited to be here I'm Andrew I work on the ZK Bob protocol we are a privacy preserving smart contract wallet and it anonymizes senders receivers and amounts through zero knowledge proofs we've been working on this protocol for over two years in r d about eight months now we have been deployed on polygon and optimism

and today just wanted to share some learnings as far as how we've worked with compliance to incorporate it into our Pro privacy protocol and how other privacy protocols can start to do that as we know privacy is a huge transition that needs to happen for adoption so in a recent blog post vitalik mentioned three things L2 scaling needs to improve wallet security and privacy why do we need privacy there's a lot of reasons right it's a basic human right that's kind of our our first reason that we need privacy and we need to have the choice to be

able to share information as we choose to share it and not have it just out there by default and this extends to our private lives as well as our financial lives so how much money we receive how we spend our money on Medical Services donations all those nfts in our wallets that's our own private information and not something that should just be out there we can choose to share it or not and this can even extend to personal safety if someone has a lot of assets or a lot of nfts and you can see all of their transactions it opens up possibilities for manipulation and even threats to our physical well-being

from a business perspective there are you know tons of use cases vendor relationships who we're buying from how much we're spending all of those things are our competitive Advantage as a business we shouldn't be sharing those it can extend to trading strategies as well someone comes up with a trading strategy the minute they implement it it's on chain should be able to keep those private and of course remittances across border need to be kept private to avoid any manipulation we're getting there from a technology standpoint we've made some huge gains in the past several years

uh ZK Bob uses ZK snarks which allows us to anonymize the sender receiver and transfer amounts we've been optimizing this protocol so that it can be used on mobile phones now can create zero knowledge proofs in that way another topic that has been lately popularized is the idea of stealth addresses this is where you can have a meta address and the sender can then create one-time private addresses and be able to send like small cap assets nfts and other things and this technology is coming along in fact we're getting there with with ZK Bob

you can transfer assets privately so we're there right not so fast we're living in a to what many call a post tornado cash world compliance is not really an option anymore in some ways if you want your users to feel safe if you want users to be able to use a protocol and not worry about sanctions or other things that can happen we need to be able to provide some sort of compliance this is a great article to kind of wrap your head around and one

that we've used with ZK Bob in order to inform some of our decisions it's called privacy protecting regulatory Solutions using zero knowledge proofs and it is by the folks at a16z Along with Dan Bonnet he's a Stanford blockchain researcher and basically they posit three main ideas of ways that we can use ZK proofs in order to provide compliance for these protocols the first is deposits we just need to prevent the funds from getting in in the first place illicit funds so we can check sanctioned wallets we can check for sanctioned wallets if the wallet has some sort of illicit activity we simply

do not let it deposit into the Privacy protocol the same goes for withdrawals so with withdrawals you actually need to not only check the withdrawing address but during the time of withdrawal check the original depositing address as we as we've seen you know someone can have a bridge hack move a bunch of funds into a privacy protocol let it simmer for a few days and then withdraw if during that simmering period the depositing address is sanctioned we're able to check that and make sure that people can't withdraw from the protocol as well and then finally the idea of reporting so protocols need to provide some method

of being able for users to be able to access their information we can break these down into two basic ideas they can even rhyme prevention retention so with prevention we're just trying to keep bad funds out we're trying to if they do slip in we're trying to prevent withdrawals and then retention we need to have a method for showing records to users that they can access via their private key not available to everyone but accessible via private key and then be able to share those with those that they choose to

let me talk a little bit about what we've done at ZK Bob to incorporate some of these ideas as I mentioned with prevention deposit and withdrawal screening first of all so depositing addresses are always checked and withdrawal addresses are also checked in addition we have a white listing capability for businesses so there's several businesses that use ZK Bob to send salary payments this is a great use case for privacy and for those KYB users they can have inherited kyc for their employees because we assume the business knows who their employees are so with that white

list we're able to allow for higher deposits for those users we also use trm labs to screen for deposits this is still a centralized service something we're still working towards decentralizing but for now this is what we use and this is a a way to really kind of protect users within the protocol deposit limits it prevents large hacks from ever entering the pool as we know last year with tornado you know every week it seemed like there were millions of dollars going into these into Tornado from hacked funds railgun had a 200 million dollar Harmony

Bridge hack roll-in so what we can do is prevent that from happening by lowering the deposit limits it's really a pretty simple solution with ZK Bob we allow for 10K USD per day and then 300K total so that someone can't just create hundreds of wallets and start depositing it also provides time to catch up if there is a hack can move a few funds into the protocol but then you know it catches up and they can't continue to move the funds in another idea is optional kyc not providing not having it be mandatory but with kyc being able to have higher

deposit limits and this can use ZK snarks to provide proof that a user has passed kyc at ZK Bob we use something called the know your cat protocol which is basically an nft that allows for certain traits to be added on and the trait that we use is called the bab token it's a the binance kyc token if someone has that token we know that they have passed binance's kyc and this can also be used to keep some users out of the protocol um because for example you know us users can't use binance so it acts as a GE geofence in that way

again Geo restrictions this isn't the only thing that you can do but it can act as a another deterrent on the retention side so this is the reporting side something called selective de-anonymization the ability to have your transactions and choose to share them as you wish so users can access and share the records with those who want them with ZK Bob you can download a full CSV of your transactions and share those for tax reasons or other reasons and the idea of of read-only keys so at ZK Bob we use something called

intermediate Keys which which uses nullifiers it's a little bit more user-friendly solution than just allowing for for read-only keys for example railgun uses this and their privacy application and it's great to share with Regulators because they can see all transactions the unfortunate part is they can see all future transactions as well so it's a private it's a problem from a privacy perspective some key takeaways I'd like to make sure that you come away with today we need both right we need privacy more than ever we need privacy

but we also need compliance if we don't have both of those it's not going to work going forward so we need to find ways that we can incorporate compliance into our privacy applications and it's possible it's possible today applications can introduce prevention and retention strategies in order to provide that basic compliance and I invite privacy protocols or protocols who are incorporating privacy into their protocols to be proactive you know we we need to set the agenda here we need to put in some of these things in place instead of waiting for the compliance people to decide what they want to do so we put

these in and then you know we can find some sort of Middle Ground where we can work together to provide responsible personal privacy for people now really this just scratches the surface there are definitely some open questions that still need to be addressed first and foremost what are the actual compliance requirements you know we still don't know we still don't know from the tornado situation what exactly the problem is and what the solution is so if we can get some more clarity there it's going to help everyone to be able to enact more compliance into their privacy protocols

which assets do we want to use in our in our privacy protocols you know with ZK Bob we started with Bob which is a stable coin it's kind of a niche stable coin and without enough users the anonymization suffers so what we've done is add an eath pool we're adding a usdc pool we want to use some larger cap assets that have enough volume to provide true privacy there contract upgradability you know do we want to incorporate proxy patterns into our contracts I think it's important as things are moving so quickly or if there's a hack or

something we may need to make changes but probably the most important question here is then who decides you know who enforces these rules who who is allowed to make updates to the contract so there's still some work to be done on the on the governance side on the decentralization side to make sure that we're protecting people's assets and most importantly protecting their privacy so we've got a lot of presentations today this is a quick one today I'm excited for a day of privacy and the ZK Bob team is is here I invite you to try our application and see how

compliance and privacy can work together it's at app.zkbob.com we also have some gift cards we'd love to share with you some assets to to give them a try in ZK Bob thanks so much [Applause] [Music]