DAPPCON 2025: Pragmatic Privacy - Ameen Soleimani

Transcript

Good uh almost noon everybody. Uh I would say afternoon. It's not quite morning. Um today I'm here to talk about privacy pools. Uh I've talked about many things. Uh this isn't my first uh Berlin Ethereum conference. I'm grateful to be here. Thanks for the Nosis folks for organizing it and for inviting me. Um but this year we're focused on privacy. So before talk about privacy pools, I'm going to talk about some of the other events uh in the privacy space. Um why privacy matters and uh what the current legal fight is for Alexi and and Roman.

I'll just talk about it briefly. So one of the questions that you get when you advocate for privacy is why privacy. And one of the examples that I like to use is about how uh and I last the first time I gave this talk I was in Amsterdam uh talking to the Dutch people about how the Dutch had the highest uh casualty rate during the Holocaust because their civil surveillance infrastructure. They had really good KYC and so they knew where all the Jews were and so it was very easy for the Nazis to find them all and uh holocaust them. And the lesson there is that you should be careful when you design your systems because you don't always know if the good guys are continuing to be the people who

administer them indefinitely. And so you should design the systems that you build to protect the people who uh use them from the operator as well so that uh you're not creating uh uh the problem. So this is from Ryan's post in response to Alexi Persza being arrested in the Netherlands. Uh he was fleeing Russia in hopes of a better life and uh he was arrested for who who how many of you have heard of tornado cash and Alexi and everybody. Cool. So uh you guys know uh this is a a really bad uh precedent to set. Um and one of the things that they

said in the courtroom I was there was that the the judge said uh there is no positive use case for tornado cash. This is despite me using it for payroll. Vitalic using it to send money to the Ukrainians without the Russians figuring out how much he was sending and things like that. Um so the p the fight for privacy is ongoing. Uh Alexi has appealed his uh the outcome of his case. He lost his case. He was sentenced to 5 years in prison. He's appealed that. He's out uh with an anklet. He's not like free, but um pending his appeal trial. Roman's trial is in about a month. Uh he's currently fundraising for it. Uh ignore the low battery. I think

I'll make it to the end of this presentation. Um, and in addition to those, we have uh more proposed EU uh legislation that will actually ban privacy coins uh from exchanges and and and things like that. And so uh there there are some positive notes. Uh, for example, in the US, the Department of Justice had a memo about a month ago that said that we should not prosecute privacy devs for the crimes, you know, protocol devs generally for the crimes of their users and any ongoing legislation should be dropped.

But so far, the prosecutors in Roman storm's case are uh ignoring this. So, support Alexi, support Roman, check out we want justice dow.org. Uh, and you can buy a juice box, buy an NFT on Juicebox. Uh, take a picture of this and scan it. If you, uh, have the means of helping out, please do. Thank you. Um, so we keep building uh, privacypools.com. So, this started, we built a demo at ETH Denver two years ago. Uh, we wrote a paper with Vitalic uh, one year ago. Uh the demo that we released was very

basic. You you know the idea of privacy pools is that you can deposit and then uh you can withdraw from it but you dissociate uh from some of the people who deposited. So you can say hey look I'm not North Korea uh when you know they have used some of these systems. So uh it's what I consider a tornado cache compliance tool 2.0. Uh raise your hand if you know about the tornado cache compliance tool. Not enough people know about this. I wish more people did. Uh, and it's that the Tornado Cash team actually built themselves a a tool that allowed you with the note that you get when you deposit to uh, uh, identify a specific withdrawal as being from a

specific deposit. So, you can dox yourself. You can go to a, you know, regulated financial institution and say, "Hey, look, this deposit was actually me and is my money." That's why we don't it doesn't even really make sense to call these things mixers because if it was a real mixer then you wouldn't be able to prove which deposit belonged to you. So uh yeah the the idea of privacy pools takes this to the next level. Instead of only being able to privately prove which deposit you are, you can publicly prove which deposits you are not. And this is a more scalable system. And so Oxbow is my company that I'm the CTO of and we manage the approval process. We op we manage a whitelist of all of the

approved deposits and we update that uh periodically. And so we do you know KYT which is know your transaction figure out the source of funds and decide uh you know to admit the people who came from uh legitimate usage you know a known ENS account or uh reputable exchange and not you know uh terrorist money that has hacked D5 protocols that our friends run. So we launched last month with a one ETH limit. We removed the deposit limit uh a month ago. This is some old slides. Uh and privacy pools.com is open for business. Uh it is called it is onchain privacy without the

terrorists. So how does it work? Uh the user deposits and then must wait for approval. We do a wallet analysis. The KYT uh the funds from untrusted sources are rejected. Only the approved deposits can withdraw privately. The rejected funds can still rage quit. Who remembers what rage quit means? All right. I presented the rage quit at a DAPCON in 2019. Uh it's a term from Mollik Dow. It just basically means you can take your money at any time uh and exit the system. Uh and so you when you rage quit, you go back to the original address that you deposited from. So you don't get any

privacy. Partial withdrawals are supported. So there's a UX upgrade from tornado cache. I don't always want to pay somebody 1 10 or 100 ETH. So what you can do in this is deposit, you know, 5 10 100 uh and then withdraw however you want. Uh 1 2 3 4 and uh the rest of the money gets redeposited and so it maps more naturally onto how people generally spend their money. So, uh, one of the cool things about this is that Oxbow can still reject deposits that we've approved later. And once we've done that, the people who withdraw after that point are able to prove that they are not the deposit that we have now rejected. And so, this allows us to

make mistakes and recover from potential mistakes. So if we do accidentally let in some money that we shouldn't have or we let in money from somebody that then goes on to do some heinous crime and gets sanctioned, then we can remove that deposit from the approved deposits whitelist and any funds still in the pool go back to the original deposit address via ragequit. So now I'm going to do a quick demo. Can you guys still see this? Perfect. So, this is an account that I've already signed into. And you can see the activity. People have deposited some ETH. There's over a thousand uh total deposits made. Uh there's 200 ETH uh

plus currently in the pool. So, the deposit flow looks like this. It's pretty straightforward. Uh we charge a half a percent fee on top because if we charge the fee uh if we deducted it, then I would have N95 in the pool. And when I go to withdraw.995, everybody will know that I deposited one. So this improves your anonymity set. Uh I click confirm. It's going to pop up on my MetaMask. Would you like to spend the money? Yes. Um hopefully this all works so that I'm not embarrassed.

Usually it's when you demo stuff that things break. So So here now I have a pending deposit that you can see. Uh notice I cannot withdraw this. Uh that would be privately withdrawing it. I can try to withdraw one of the ones that I've have approved before. And so I'll just use one of my normal addresses. Uh 0.1 ETH is the minimum withdrawal amount. So if I try to withdraw less than that, it'll complain. Uh I think must be greater than zero. Oh well, the relayer will complain. It has a different should say it in the UI. Uh hopefully this works. Sometimes uh if gas is too high, it's still hard-coded

uh and it won't process it. But it looks like uh gas is in our favor and so it is processing this withdrawal and we can see how it's going. So haven't seen it yet, but it's in the works. Um and so once that's done, uh I will have uh received money and I can use that to fund fresh accounts. I can use that to send payments. Uh I can use that to break the links between money that I've received and money that I want to spend so that the people who send me money don't see, you know, all of the ways that I'm going to spend that in the future. And so my withdrawal has uh succeeded. I have withdrawn uh 0.1 ETH.

Uh and so yeah, I've called the relay function. And so now uh I can show you guys what happens if uh if this was for example rejected. Uh I would be able to do the same thing which is I can come here and call this exit. And this generates a different zero knowledge proof. And the zero knowledge proof this generates is uh simply that I have the money and I have not spent the money yet. Uh it's different than saying that my deposit is currently on the original uh approved white list that Oxbow publishes.

And so now I can uh exit this money and when I exit the money I have to use the wallet that I deposited and I can withdraw back to that same wallet minus the uh the vetting fee. We keep that. So if you're probing our system, you know, we'll make it a little bit more expensive for you. So now I have exited that ETH and I still have a different 0.1 ETH that I have deposited uh before. And that's basically how privacy pools works and we are working on updating this uh and adding some more features as well. Uh I'm going to talk about the admin design of this. We thought pretty hard about what privileges we have and what we uh consciously have chosen not

to have. Um for example uh what one thing we can do is nuke the entire association set the whole white list of approved deposits and all users at that point are forced to rage quit back to their original public uh addresses that they deposit from. So we can rug your privacy kind of but we cannot retroactively deanonymize your withdrawals. So if you have already withdrawn from the system there's nothing we can do to reveal you know which deposit that withdrawal came from. We don't know does.

So we have a function that allows us to prevent future pool deposits. uh onetime switch. We essentially give up and we're like, you know, this pool is getting flooded by bad actors. We can't keep up. Uh we need to freeze deposits. And so we can freeze deposits, but we cannot freeze withdrawals. We can never use uh move user funds. Uh users will have to themselves either rage quit or withdraw if we're still allowing private withdrawals in the number two scenario. Um, another thing is that we separated the contracts that hold the money from the interface to those contracts. So there's a two contracts. One is called the privacy pool and one is called the entry point. And the privacy pools

contract holds the money and implements the rage quit functionality that allows the users to withdraw at at any time. And the entry point is the thing that charges deposit fees and implements the relay function. And so we can update that. You know, one of the things we're thinking about is adding potentially a discount for volume like exchanges do. If you deposit a lot of money pretty often, then we might want to charge you lower fees. Right now, we have a flat fee system that applies to everybody. So, you know, there's reasons to want to upgrade that, but if we could upgrade the contract that held all the money, then we could potentially take people's money. And so uh the combination of these things makes it a non-custodial but you know somewhat permissioned

privacy protocol. So non-custodial is important there because it means that we can't steal move uh or otherwise uh impair anybody's money uh that is in the system. And so we don't have the same like for example KYC requirements uh that we might if we were a custodial uh system would be considered a money services business. Future plans. So we are adding ERC20 support. We want yield bearing tokens in privacy pools. That's a big uh thing that people are asking for. They say why would I want my raw ETH in there? I want my staked ETH in there so I can earn yield while it's in the pool. Uh this

makes sense because typically you want to keep the money in the pool for a while. So we'll have uh that smarter relayer fees so that I don't have to hardcode a gas limit. It'll be dynamic fee based on uh what the gas price is. We'll do multi-chain uh EVM support. So we're adding uh other L2s and and L1s. Uh and we might add some non-EVM support. We're currently building a a port of this for Cairo for Stark for Starknet. Um, and they're exploring building a V2 system, uh, which would have accounts and swaps and internal payments and, uh, maybe probably built on Noir from what I hear. Noir good. So, we'll, uh, explore

that. So, we're hiring. Join us. Help build privacy for the good guys. Follow us on Twitter. I'm Amin Soul. Uh, and our company accounts are 0xbo.io and 0x Privacy Pools. And some of you might be wondering why it's called oxbow. Uh besides it having a cool 0x prefix prefix, uh an oxbow is a type of lake that happens when a river folds and bends on itself and then connects back to itself leaving a pool of isolated liquidity called an oxbow lake.

So that's uh this this little part that uh separated is called the oxbow lake. And so uh we thought that looked cool. It also looks like the elliptic curve. So like let's do it. Okay, cool. Thank you for watching my presentation. Any questions? Yep. Questions for a mean? Yes. I have two questions. Um, do you have plausible deniability for somebody depositing from another privacy tool or a mixer? You kind of just treat that as a black box. Um, and then second, does

7702 have any unlocks or are is it still too early to figure out how to make this work in a privacy system or any benefits from that EIP? Um, yeah. So 7702 is the account abstraction one so that I can maybe not need a relayer or something. Uh it it it one of the silly problems I have to solve is like if you get ERC20 tokens to a fresh address, do you have the ETH to move the tokens? Uh and so like that's a nice thing that uh if account abstraction was widely supported I I wouldn't have to worry about as much because you would just have you know tokens in an account and you could uh use some of those tokens to pay for the

gas to move the tokens without needing to get separate uh ether. Um repausible deniability for other privacy money coming from other privacy protocols into uh privacy pools. It's a tricky one. the so far none of the other privacy systems uphold our standards. Uh and so uh we would probably blanket reject any money coming from other uh privacy systems. Um something like Coinbase could be considered a privacy system, but we'll probably accept money from that because they KYC their users, right? So uh remove some of the liability from us. From what we've seen,

hackers do use these systems and there is aren't great ways of uh separating them. One thing that we have we haven't finished implementing and and publishing is the uh full complete list of who the good guys and bad guys are who deposited into. Uh so we have you know one of we'll launch this at some point is a essentially uh privacy pools version of tornado cashache to allow people who've already withdrawn from tornado cashache to prove that they are not the uh North Korean hackers who deposited in to tornado cashache or other hackers. Um, and hypothetically we would consider uh

allowing those users to deposit into privacy pools. Hope that makes sense, answers your question. It's a it's a tricky one. It's a bit nuanced, but happy to answer more questions offline also. Another question down here in in the front. Thank you for the talk. Um so you mentioned the current kind of um commercial model is to implement a 0.5% deposit fee. I'm curious how was that decided? Did you also get the chance to I guess explore different kind of monetary model when it comes to privacy pools as well? Um so for privacy pools we didn't uh the the 0.5% fee is competitive with

you know our other uh privacy protocols. Uh for example rail gun charges a 0.25% shielding and then another 0.25% unshielding fee. So it amounts to 0.5% total. So it's the roughly the same number. I don't know what other monetary economics you want to apply on top. Uh but that's uh where we're at. We might offer some discounts for higher volume users um and things like that. So any other questions for I mean up up there up top.

Uh have a mic up top. Oh go ahead. You can just shout out your question. Shout it out. Yeah. I got a question about is there any work done in terms of something called anyway? Yeah. Um it's a process. I don't think any

regulator on the planet has said yes this is your this is okay. You can use these privacy tools exactly as is. Uh Fininsen like in in the US Fininsen gave guidance that the department of justice ignored. So it's not uh super clearcut. There's interest in regulatory bodies and learning more about this. I'm a compliance guy now. I get to go to regulatory meetups uh hang out with lawyers and you know DOJ, Fininsen, CFTC, etc. uh and pitch them on this kind of thing and see what their reaction is. uh and so you have to build it first in order to start the conversation and I think we're taking the necessary steps to protect ourselves

so that uh you know we do this in a way that everybody knows that it is uh about compliance from They