The Darkest Pool Yet
NoirCon 2 Berlin 2025 · June 2025 · 17:33
Nemi co-founder Oleh Misarosh explains how Nemi combines zero-knowledge proofs with multi-party computation to produce UltraHonk proofs for a private dark pool. He highlights the tradeoffs made to achieve full privacy and looks at where private DeFi and trading venues go next. The talk was presented at NoirCon 2.
Speakers
Topics
From NoirCon 2 Berlin 2025, hosted by Aztec Network.
Transcript
Ty. Uh, please raise hands. Maybe maybe. Okay, you got to spend more money on your white. I see one first. I don't know. So uh stationation is the darkest yet and uh let's first explain what memory is. Naming is the civilization that which is the means to live and it represents how we give topic of chain and money also is a decimalized exchange. It's
decoying test as tested right now and as you can see it's usual swap interface but everything is hidden on history is not missing um here's the agenda we will first go through all the limitaries also we will check traditional art pools we will I will give the introduction to what S6 domain looks like and then we will TV is okay architecture very brief we go through auto situation okay a few more people so uh
some here uh you can see the limit of the left and users is where traders put their buyers and sellers there's audio request to buy or sell tokens And if the two uh like two quarters they match the price they are about uh exchanged for buyers and sellers to see people. So what is hard is what is editing when you play the parts you learn. Yes.
And this is the same order book, but the great thing is that you don't see uh you only see your orders while you see other people. While other is that the server operator can see you still can see everything. Why other rooms are useful? He don't know. For example, if somebody wants to sell I don't know hundreds of tens of thousands of bitcoins if they publish that people will see it the market people will start buying or selling maxes
on how to affect the price and it also hides their trade strategies. This is and traders to stay private. But there are some problems and the major problem is that the server operator still sees the orders they can trade against their clients for example finance CSV or high frequency high frequency firms close like we will you right so how how we watch. Yeah. Yeah, a little bit
before in the watch. So this is a zero theorem balance order you have addresses instead but we need to see that this doesn't work that's getting to detect why it doesn't work so that that's the model is a little bit more complicated as nodes have nodes are kind of like for example if you have two nodes 10 and
five a visitor together you would have 15 so is similar you have for example that has 10 yeah the total is 10 all has two the total is one uh 10 note of 10 only 10 the new note passing also now have balance of nine in full he's not value one that is the year that Alice is sending to Bob and the total of both uh yeah so it's similar to cash I'm
thinking about it now and not the problem is that not only to their owners of Alice cannot see the balance of swing can see the address of L. And this is a problem because if the balance is a private, how do we exchange? Like how do we swap? How do we exchange? Uh what if we put it in a T? Who knows what T is raise your hands for? Why something? Okay, I still have the definition here. It's a uh what can you explain inside processor?
What guaranteed by Intel or AMD? Uh uh the code is tempered uh like nothing less how they play but there are some back doors for sure. Uh so if you implement it in the tea we just uh make the alison send their nodes the T the T can privately match orders with those balances. But this is not that great. So how do we improve that? Oh I forgot. So the pros uh the T is extremely fast around maybe like 5 to 10% overhead versus A2 execution and it's pretty easy to implement uh because T support any language but the cons I said already
secured by Intel AFD at the stations uh the T can be broken broken uh allers will be public uh public knowledge uh so Now we move to the MPC layer. So is it the holy grail probably uh so what is MPC? is when you have uh two more parties they compute owner sub code but they don't share their part of private data uh and but they can compute the result of two pieces of private data they uh with their individual column and uh this is this would uh this is how an MPC
architecture would like contact Alice part of her balance to which party often do the same and you can see here each party must see the balance. You have this uh uh like rectangles. So each party cannot see the balance individually but they can compute the rate together via some uh uh some shared logic. Uh so what are the what is the flow? So the MPCs will gather all the limit orders. they will uh uh they can privately compute the price matching and they can uh privately send the new nodes to the uh LBC but the uh so the process distributed storage match
orders but the recent war had of additional code this is actually changed like the rest of like breakthrough recently I believe like two months ago so yeah so this is like really really uh the continent like yeah um yeah so if you got to the MBCZ KT technology like why is it the darkest yet I did some broken offices um so this implementation hides trades of traders it hides amounts it hides tokens and oh it also leverages the universal uh privacy set of u this is separate topic but the unique set
will be very brush and if you implement dark post this is an additional uh if I implement for privacy. So how do we get to this T CK and VPC thing? We have uh Intel, we have Intel for R. Sorry, we have Intel for G bar for ZK. We have uh T I'm sure we built them for um now let's go through the code. You're not supposed to understand it. You just you will see how succinct the code is how small it is. You should try to
increase it like it's so you uh yeah so LFR R is R likelike language. Um here you can see a very simple component. I'm not mature like this probably didn't work you know uh so this will just uh play like sorts at I know some prevention some hash value very and quick introduction tells you is that you have this large circuit and if you look at the right you you see one two this is this would be involved they will have their data they will send this their
private data to I will share it uh in a way that send each piece of private data to uh each party of the NPC down the entire line here. So when dark roll is unhappy trying to indulge yourself I I feel and if I should I do feel well the robot selfite so stay forever thank you for the talk. So um since the
server operator has all the data does not defeat the purpose like uh provide them with a possibility to like use this data. Yeah. So that's why we need the NPCs. So we have not a single server but multiple servers. They don't have to kill the I believe two out of three doesn't have to treat the hydra and like uh I probably skip this part but do they know about each other so is it possible for them to collaborate during is it possible for parties to commute like do the parties or something parties yeah they see like I ask do they know how did you know
like they Okay. Yeah, then they have to they have to coordinate the computer. Yeah, they do. They do know each other. Okay. Thank you. Sorry. Uh you actually answered one of my question. Another one. Uh so could you elaborate if I want to? Yeah, let me put it this way. So if my money is represented in terms of nodes that are like hip mutxos who make eight sugar has the ability to see them in plain text like this
matching agent that is implemented inside the does it operate on plain text values or or if not then how does it operate? Yeah. So if you have only T architecture the T greater no greater but the T8 like it's my prime analysis. Yeah. So that's why we accuracy also we sh the prime balances make the bars. So we this way we've impacted improve our spirituality.
So each of the MPC nodes has a TE enclave and these enlares collaborate between each other. Yes, hiding values like one TE enclave hides values from other Tre but but it's not a plain text running. If you go back to the just Yeah. I'm not sure I understood this light where you had like hidden dark uh this one. Yeah. So each party even if it even if it's not running you see we still cannot see like party one cannot see any balances by itself party one has to collude with other parties party two party three to decrypt the values
like there has to be honest unhonest majority to decrypt that so it's not tax so essentially it's operating on encrypt data. Yes, that's right. It's not actually secret. I mean, sorry, maybe just last one. uh offenses. I mean I know what signature sharing is and I know that we can split a secret into I don't know two three parts that any two of them will construct a secret but it's kind of unclear how to go from this this construction
to dividing the values of orders such that orders can be matched because we're interested in matching the whole amounts of shares of elements. Yeah that's possible. So you also secret share the voters. So orders will be it's similar position like similar secret share for this balances and then you can compute all the secret shared orders using NPC but yeah you can do that but at any point of time no team will see the full play list.
I mean, so at any point of time playing text is revealed only like decks can only be revealed for you to party school to like fine. Yeah. Rabbi, thank you for that. You have a rather strong you have a rather strong uh statement that will not be finally broken. Uh how can you support this statement? I don't it's the same that uh the P1 curve
is quite you might believe that any has a vector you believe it doesn't uh so similarly to the TE's you can I mean I'm pretty sure Intel I don't they have a factor for T just national security reasons no yeah why do I have to support it's fine I just I Sorry. Yeah. Question like why do you have something? No, I mean that's conspiracy theories and I don't stage. Uh can I ask a followup question then? uh piece of there is no reason to believe that this will be publicly
brought in the TE and doesn't make a T a viable solution to make that should be very worried very uh but TE's will definitely be broken uh similar so right now there is a DGX generation previous generation which I think was broken and you will stay broken very it's like long term Frank, you just assume they will be. Okay, fine. Because she's not going to be able to hear us. This is the biggest station.
Thank you. To send back like, you know, uh audio in and out. Yeah. Okay. Have we got all the four mics there? Yeah.