Christy Cui of Aleo @ ZK Hack Meetup in NYC, Aug 2025

Transcript

I'm going to talk a little bit about Aleo and what we've been up to. Um so, we've been around for quite a while in the ZK space. Uh we officially launched to mainnet, which is a huge undertaking, last summer. Uh and a lot of folks have been curious about what we've been up to. And so, today I'm going to tell you about uh compliant private payments on Aleo. Uh it has been a pretty hot topic recently, both privacy and payments. Uh but it's actually something we've been thinking about for quite a while. Uh and uh I'll tell you about uh what we've been up to.

So, first first off, for those of you who don't know what Aleo who who Aleo is, Aleo is a privacy-first L1 blockchain. Um we uh like to call ourselves the combination of Zcash and Ethereum because uh we have programmable privacy. Um so, essentially, we have our own smart contract a called Leo that compiles into ZK circuits. Uh and then you generate the proofs locally, and then they settle on chain.

Um when uh they settle on chain, they get verified on chain constants in constant time. Um I can talk more about what uh what Aleo is about as a blockchain, but I think what's going to be more interesting is to look at some um actual examples of um um some real-world private payments that's already live today. And so, I'll start my talk with uh some examples, um demos, and then I'll go into the privacy challenges that we run into, as well as how we're thinking about them.

Um and then lastly, I'll tell you a little bit about on the technical front, uh, what's on the road map, what, uh, what have we just, uh, launched recently, because we take the technical piece very seriously. Okay, so let's look at some, examples first. When I say examples, these are all live. Uh, this is all in production. So, Request Finance is a platform, as a payment platform, for both fiat and crypto and, uh, stable coins. They have processed 1 billion plus in payments, um, and Aleo is integrated with them for private payments. Uh, both public and private.

You can choose your, you know, choose your flavor. And, uh, this is an example of, uh, what it looks like on Request Finance. So, you can actually make a payment, uh, you can pay for expenses. In this case, uh, you're paying 1 euro, uh, with Aleo, and you can check that little box to enable private payment, uh, and then you can see that what's highlighted is a box, uh, for where you can put in your view key. So, what is a view key? Um, Aleo has the special feature, uh, of this concept of a view key for each account. So, you can generate a view key from a private key, but you can't derive a private key from a view key.

Um, as the name suggests, with a view key, with a view key, you can decrypt, uh, private transactions, uh, and then you can essentially have full visibility into the transactions. So, whoever this view key that you give it to will be able to see, uh, your private transactions. Uh, so, in this case, we're giving it to Request Finance, um, so that you can see all of your private transactions on their platform. So, that's an example of how you can pay for expenses privately, today, on Request Finance. Um, but that's just one private payment. What you can also do is you can make a bunch of batch payments.

Um, why would you want to do that? This is actually a very common use case for businesses where for ins- for instance, uh employers want to pay their employees um, and you know, you don't want other people to know how much you're being paid, so you send private batch payments. And so, I'm going to show you a little video. Okay, so it says can't play this file for some reason. So, I can't show you, unfortunately. So, I'll try to describe what happens in the video. Um, essentially on request finance today, you can make batch payments uh by essentially um entering all of the name and their addresses of all the people you want to

pay, and then you can batch the transactions like 80, 100 of them, and then you can sign one trans- you essentially sign once in your wallet, and then it they get out paid they get paid out in batch, and you can see every single transaction that goes out, and then you can click on the block explorer to see that your transaction is confirmed. Uh I really wish I can show you this video. It's actually pretty cool, but um live demos that never work, so we got to move on. Um Another pretty big news is that we are integrated with Revolut. This just came out last week, but it's something we've been working on for a while. Revolut is the number one finance app in Europe. Uh

it's the number one uh spending as well as uh investing app, and we were really excited that this uh this integration will make our privacy first crypto available to even more people. Um So, yeah. So, that that those are some like real world private payments that you you see today. Um but, you know, those are all recent successes, but of course, Aleo also comes with a lot of challenges. Um, with privacy, obviously, a lot of things need to be walked around in particular, uh, compliance and also making sure that, uh, you know, bad actors, uh, are kept

outside of the ecosystem. So, this is how I like to kind of describe the approaches we're taking. Um, it's like two approaches that we, uh, use at the same time. So, on one side you have enforcement, you have decentralized enforcement via governance proposals essentially. So, this is where the community comes together and they decide uh, what level of enforcement, um, is appropriate for the network and then we vote on uh, something called ARC, um, which stands for Aleo request for comments. It's similar to EIP. Um, on the other side is where you have smart contracts,

uh, and then that's where, uh, kind of you can define all of your risk mitigation, um, tools with, uh, smart contracts and I'll get into both of them in a little bit. So, let's start with uh, decentralized enforcement. This is particularly, um, applicable to bridges. So, what I'm showing here is something called, um, ARC 100. It's, um, proposal that was passed, uh, for Aleo bridges that basically sets a holistic list of requirements for these bridges. Um, so, that would include, um, checks on AML, uh, or sanction actors,

uh, includes geo-fencing, um, and a couple other requirements. Um, and this is the well, the the thing is without this type of with without enforcement, uh, we can't really have privacy safely, but at the same time we don't want it to be centralized. So, ARC is something that, um, can change in the future, uh, depending on the maturity of the network. Um, and then on the other side, on the right-hand side is, um, how it's been implemented. So, we work with, uh, a startup called Predicate, um, where they have essentially policy engines that define these rules. And, um,

what we we call them, uh, pre-pre-transaction logic. So, all these pre-transaction logic outlined in the ARC gets checked for every transaction before they bridge over, for instance, from Ethereum to Aleo. Um, this is an example of the flow diagram of a transaction in in our bridge today. Uh, the bridge is called VariabLinc. It is between, uh, Ethereum and Aleo. You can bridge in and you can bridge out. And then the the transact pre-transaction checks happen before every transaction. And the the good part about, um, working with Predicate, a policy engine, um, startup is that,

uh, if you're a new bridge wanting to build on Aleo, you don't have to replicate these boring, you know, regulatory checks. You can just focus on building the best bridges and the best user experience. Um, which is great. Okay. So, the next part, if you remember the image that I showed you, the other path that, uh, we're taking is to make sure that, um, the um, at a contract level, there are tools that you can take, um, to essentially mitigate the risks.

Um, so once you bridge it safely from the network within the network, there are still these tools um, that can help make private stable coins a reality. Um so something that I just talked about during the request finance um, demo was that uh, you have a view key. And this is where that view key comes in because uh, you can have a delegated compliance party where everyone delegate their view key to and so only that particular party will have access to decrypt the tran- decrypt the transaction in case something goes wrong.

Um, but otherwise everything is uh, safely private. And then um, that's kind of what it means by selective disclosure is you kind of selectively disclose who your transactions are are visible to. Um, there are other tools like freeze lists and spend limit and time lock. These are all business logic that you can implement at a smart contract level. Um, and uh, we're building the tools to make the issuer to make these tools available to the issuers. Um, and we're actively working on quite a few of private stable coin integrations. Um, it's going to come uh, it's going to uh, be really exciting in the coming months. Um, and then

all of these tools, all of these um, smart contracts, what they enable is kind of the use cases on the right hand side. Um, so many of the typical uses use cases for a privacy you've heard of like for instance treasury management, uh, payroll solutions, um, charity donations where you you know, hide your identity and who you're donating to. Uh, private prediction market is another big one. Personally, I'm really excited uh, about private DeFi and private agentic payments.

Um and I'll I'll go into you a little bit detail. So, for private DeFi, it's really interesting because on top of DeFi, what you can do is you can hide your position and size. So, it's especially interesting for whales and it's a uh it also has other effects if you think about it because in the context of perps, what you can actually do is you can hide your liquidation price. And actually, someone from the audience had a really brilliant idea um at one of the hackathons at ZK Hack in Berlin um who made this possible. So, yeah. So, if you if you're interested in make taking this idea and building into a

business, you should come talk to me. I'll connect you with the right person. Um and a lot of these really cool ideas are waiting to be built out. Um the other one that I'm really personally really excited about is private agentic payments. Um so, actually, round of hands, who today has not has not talked to an agent today? So, nobody Everybody talked to an agent today. That sounds about right, actually. Um so, agents have been you know, providing a lot of convenience and in the near future, they will definitely be transacting on our behalf.

Uh so, this means that they will probably you know, order our Ubers, buying our flight tickets. They will probably be also making API calls for us. Maybe, you know, uh making paying for, let's say, generating images, paying for your storage on the cloud, and so on and so forth. Um and crypto is great for these micro payments. But, what that also means is that uh with agentic payments, not only your daily activities are leaked.

With your online activities are also out in the public. So, who you're paying to to generate what images, where you're storing your data, and so on and so forth. Are you all of your online activities, right? So, to to make a gigantic payments a reality, privacy is a necessity, in my opinion. That's why I'm personally really excited about it. I actually spent the entire weekend hacking on a gigantic private agent payment protocol I use global. And so, those kind of like things I'm really excited about and really look forward to seeing built out on Aleo.

Um so, that's my little spiel. And then, lastly, I have some updates for Aleo. We have actually we have a new feature called program upgradeability that's coming out right now. It's live on testnet, and it is it will be live on mainnet on approximately Tuesday this coming week. Um it's really exciting because, especially for DeFi use cases, it's super useful. This means that if you, let's say, found a bug in your program or maybe you had a typo, you don't have to redeploy it. Especially for DeFi protocols, it means that when you add new features, you don't have to move your liquidity, right? So,

it has a lot of different use cases. can also specify who can upgrade your program. It could be an admin, it could be a multi-sig, it could be a DAO. So, you know, code is law law, and it's completely up to whoever's writing the contract. Um this is actually quite special given we're a privacy chain because we're working with private states on the blockchain. And so, to be able to upgrade to be able to upgrade your private smart contract to do this is is an easy task and we're really proud that it is live today.

Yeah, so that's it about my little talk and then some useful links. I would recommend you to check out our technical roadmap at aleo.org/roadmap. It has more stuff coming out this year. It also I also have a link for a dev's telegram channel. The sorry the QR code for the dev's telegram channel is pretty active. If you ask a question, I'm pretty sure it'll get answered. And also for more inspirations for products, you can check out how our awesome Aleo repo.

Thank you and let's build.