EIP 8105: Why we must encrypt the Mempool

Transcript

So, the today's topic will be about encrypting the mempool. Right? About EIP 81 aimed to make Ethereum transactions more private before they are finalized with the goal of reducing front-running and improving fairness in all the networks. So, the speakers today, we are joined by two guests from Shutter Network. Luis Bezzenberger and Lorien Harkness who are here to just share their work and insights on the topic. Well, thank you for both of you for being here and we're just looking forward to hearing your thoughts on the mempool encryption

EIP 8105, where this fits into Ethereum's future, and why it matters for users, builders, and the broader ecosystem. So, we're looking for you looking forward for your presentation. Thank you. I'm with uh the company's called Brainbot, which is sort of the core developer behind Shutter. Um Brainbot's been active in the Ethereum space since 2014. Um and since a couple of years we're building yeah, Shutter Network, which is a threshold encryption as a service mechanism uh now also venturing into let's say homomorphic encryption as well on on the voting side. We're primarily serving these um

these two uh use cases that encrypt the mempool where we want to make the case that Ethereum uh L1 should have an encrypted mempool for front-running resistance and real-time censorship protection. And also then on the on the side I just briefly mentioned it the uh for private voting um the same kind of decentralized threshold encryption mechanism we're also applying for voting and uh it's live in sort of snapshot. Um and again we're moving sort of to homomorphic encryption for threshold homomorphic permanently uh, voting. And the way we wanted to set it this up, uh, or the idea was that we um, start with a with a very brief

uh, just intro us to start with a very brief uh, presentations of like 5 minutes, and then we would kind of open the the floor and open the a little bit of a more generalized discussion. Hey everyone. Uh, I'm Loring, head of commercial at Brandbot, the same organization as Lewis. Um, I wish we could be there in person with you all. Uh, unfortunately, we can't. Maybe in the future. Uh, and normally at this point, I would wish everyone a hearty GM GM. But, um, I'm actually going to break from the presentation cuz I got to tell you what happened to me just now.

The craziest thing happened and, um, I just got to get it off my chest. So, uh, you know, it's like what, 5, 5:30 here in Germany and, uh, you know, I've been feeling a little, uh, low energy today. So, I was like, you know what, I'm going to go get a cup of coffee before the presentation starts. And there's this new place which opened up in my neighborhood. Uh, it's called The Coffee Market. Uh, Lewis, I don't know, have you been there? Uh, okay. So, this place >> Yeah, the The Coffee Market is this crazy place where there's no fixed price for coffee. Uh, the prices actually fluctuate based on the time of day and

based on consumer demand. And, you know, I went in kind of in the middle of the afternoon thinking I could get a cheap cup of coffee, you know, just to give me a perk before we got on stage here. And, you know, it's one of these new, uh, fancy cafes where like, you scan the QR code in order to order. And I scanned the QR code and I ordered my normal Americano and it was like, "Hey, you know, the price is $5." And I was like, "Cool. Okay. Submit order." And then this uh this window popped up on my phone and it was like, "Hey, like we all know the price is $5, right?

Price is $5. But what's the maximum you'd be willing to pay for that cup of coffee?" And I was like, "What the What What's the maximum I'd be willing to pay? I don't know. I mean, this presentation is kind of important and like I'm feeling low energy, so maybe I'd be willing to pay what, like $50 for a cup of coffee?" And you know, I didn't really think anything of it. And then I went to tap my credit card in order to make payment.

And in the split second before my card hit the uh the payment terminal, the price of coffee skyrocketed to $50. And when I touched my card, I ended up paying $50 for that cup of coffee. And like I didn't know what was going on. And you know, after I had uh gotten my cup of coffee and settled down, I went and I spoke to the manager.

And the manager was like, "Hey, look. You know, you said that you'd be willing to pay $50 for a cup of coffee even though the price is $5. And so what someone started doing probably is they started buying up all the coffee in the store and in this town, driving the price up from $5 all the way up to $50. And so So, you paid, you actually paid like the maximum amount that you'd be willing to pay.

And then that person, after you paid, probably started selling coffee back into the market. And now the price is $5 again. And I was like, this is crazy. Like Like, who would buy a cup of coffee thinking that they're going to pay $5 and end up paying $50, right? Just cuz someone can see that order and manipulate it. And I was like, I'm never going back to this coffee shop again. Like, the coffee market is dead to me.

I am so pissed off and I just needed to share all of the with you guys uh cuz it is unreal. Um Crazy place. Crazy place. Yeah. Um obviously you guys are sitting there thinking um like what? This is a crazy story. This is kind of stupid. Like, who would pay $50 for a cup of coffee? Who would manipulate a coffee market? Um and it's actually kind of a silly story, but it does uh kind of give an insight into just how crazy uh malicious MEV on Ethereum has become.

Because that exact scenario where someone is making a purchase and a sophisticated actor can see that purchase order and then uh place their transaction before that order and then after order, thus manipulating the price and giving the user the worst price and extracting value uh from that transaction reordering attack.

That's actually exactly what malicious MEV is. And it's one of the problems which has plagued Ethereum for the past four or five years. And estimates range, but one solid estimate we often refer to is that 1.8 billion dollars has been extracted or some might even say stolen from everyday normal Ethereum users, people like me and you.

And so what we're going to be doing in this call with you guys today is we're going to be talking about some of the efforts in order to prevent malicious MEV on Ethereum mainnet. And it's actually a super hot topic right now. Um, there has been a flurry of proposals, EIPs with different ways to introduce encrypted mempools, one solution for preventing malicious MEV.

I'm going to hand it back over to Lewis and he's going to take you through some of the current conversation and then we'll kind of have a fireside chat and hopefully field some questions from you all in the audience. But again, thank you for having us here today. I think it's a great intro and I think should make it a little more tangible of what what the the core problem is. Um, and the way I saw it was I want to start this presentation is even just in general, not even just crypto, just just in general, what what would you expect from from your kind of like the your your marketplace, right?

Are your financial ordering machine um to do, right? And obviously people maybe banks or certain kind of more professional actors would would maybe um put forward this efficiency argument or you want to have you know, very very low latency trading and things like this. I don't think normal people care that much, right? I think they're more interested in just fairness and kind of like you need to have you need to be sure that you're not uh being put at at a disadvantage when when you enter this market, right? It's like it's you crypto and traditional finance when when you trade with that in your broker app with the with the bank or be that in crypto with you know, I don't know

Solana or or Ethereum or Coinbase whatever, you your primary concern is am I not getting exploited uh or is is it a is it going to be a fair environment that I'm trading in here? So So I mean quality, credibility, fairness I think is kind of like paramount. And in both in TradFi and crypto is is basically kind of to certain degree fundamentally broke. I mean it works but it also doesn't work that well, as I would say. Uh in traditional finance it's interesting front running um which is basically what what um Lauren just just laid out basically is the ability to uh see transactions early uh see your transaction early and sort of jump the

queue and steal your trade right? So front running so that happens in the real world as well or happened in the past just kind of was so in general made illegal or at least the the bulk of it. There's still ways that people get front run in the real world. It's it's quite quite interesting um uh Joey Ma from the the EFF has has a cool viewpoint on this. But but essentially front running is made illegal um but you have all these other problems that are also um and and it is I think there's a lot of time and money spent to um, ban it and to make it um, sort of like into into false trust into a false this regulation, right? Um, uh, but you also have all these other

sort of related issues with uh, transaction ordering and with kind of like where this is a transaction hit hit the hit the the exchange. For example, kind of similar to crypto, you have these dark pools. Uh, in crypto you have private mempools and in the real world you have these alternative venues for where trading happens. Um, another word for this is MTFs, multilateral trading facilities. The dark pools and MTFs similarly in in a way also to crypto, they fragment liquidity and people and certain people want to have want to be able to trade kind of on their own there and be like like um, have better prices there than than kind of the public markets. So, that's also

another another issue. Then you have this payment for order flow topic. So, basically that's kind of the primary income for these new brokers, right? Like Robinhood in the US. In Germany you have something called Trade Republic. Very similar like when you can trade your stocks on on on your app, right? What what happens is your order flow gets sold to these market makers because that's like interesting order flow, right? Yeah, people are seeing, oh, yeah, there might be something to capitalize on your your order flow, right? And that's And and so your neo broker sells this order flow to these market makers and thus they can offer you these extremely low but even something like free trading fees because they they monetize your

your trades, right? So, um, that's kind of another issue. Um, and general latency and arbitrage just just um, is creates inefficiencies. And in crypto we have this thing there's no kind of like legal or illegal as long as it's still like a little bit of a wild west, I would say. Although, that's sort of potentially also being discussed to make it illegal. But, you have this this front running issue. Somewhat addressed by these kind of private mem pools. But, that just means you're staking this sort of alternative route through an a trusted to to a trusted supply transaction supply chain intermediary that kind of guarantees you based on his trust that they won't front run you.

Um which is kind of like band-aid on the problem. So, yes, that's that's sort of like good for for for an immediate problem. Um But, that now it creates a trust issue. Now, you have to trust these people or institutions to not front run you. And that's kind of like that's the whole point of blockchain. You do not want to trust those intermediaries. So, not optimal. And also again, fragmentation there as well. Creates all these different places where where ordering where I'm transaction are flowing through. Not optimal for kind of like liquidity and and kind of like central and and and and sort of like a good marketplace.

Um also, we have this builder oligopoly. So, we have kind of like with PBS, we're separating between proposals and builders in the in in on the on the protocol level. And PBS was introduced to reduce the proposal monopoly, to reduce kind of the centralization there. But, now kind of the issue is as well, we have from on the builders who are actually creating the block, right? Um No, you have only have two builders that are dominating like 95% of all blocks.

Um so, that's that's another just centralization issue and um also a censorship issue. Though, I think both of these are situated in the US. Um where in the past you had these talks around censorship and OFAC list. So, very very likely that they will be regulated in the future not to include certain transactions based on this sanction list and OFAC list. So, again, that's like it's not a good situation if you have only two major builders kind of being the gate being the gateway and the gatekeeper to to the mempool, right? Uh and and we talked about this MEV extraction and kind of like today there's a lot of exploited um a value, right? Um so, enter kind of encrypted

mempools. Uh the idea is instead of sending a transaction either to the public mempool where it's transparent and you're just getting exploited or sending it to a trusted single party where you just have to trust them that they won't front run you. Instead, it is sort of like encrypted in a either you yourself encrypt or there is a decentralized way to encrypt and then you send it into the mempool encrypted and the block producer, they have to commit on the inclusion and order of the transactions while they're still encrypted.

So, even kind of the validator builder proposer, even they can't see what's in the transactions. They have to commit blind to the to the inclusion transactions right? And only afterwards do they only after this order is like fixed in place, only after this there is this decryption step again either by you yourself or by this kind of this decentralized um encryption mechanism. Uh only after that that that's released and then it's executed. And that just ensures well, even the validator builder proposer themselves can't see what's in the transactions.

Very hard to front run if you don't see what's in them, right? And very hard to censor as well. So, that's kind of just like the ELI5. Uh and and then we kind of like have the opinion that a threshold encryption is probably the best encryption decryption mechanism because it's that's this decentralized way of encrypting decrypting, but there's also other encryption methods, just like just as encrypting yourself or um for example, TEEs, which is a hardware um type of encryption decryption mechanism. Um and why we think this uh matters is um I >> [clears throat] >> kind of like primarily as it's actually less about front-running because again, we have kind of like quick fixed front-running with these private mempools. So, mhm well, people have different opinions on

what why why it's the why it's important, but to me maybe like censorship resistance is is sort of like maybe the the part one, right? If you encrypt your transactions, it's extremely hard to to censor them because you don't even know what's in the transaction, right? So, I think that's that's a major one. And you again, this like the reducing centralized trust assumptions in the mempool. Um uh a really big one to me is um the if we create this more fair marketplace and this more accessible marketplace where people don't get front-run left and right or where you don't have these like white glove specialized um mempools and and fragmented liquidity lanes where only certain people have access to,

I think we can uh get more people uh to the table, right? We can if we level the playing field, basically, we can just get more people to to be interested in and be uh and and and and and attract more traders and more people, which means more liquidity and to me that means ultimately more transactions, better prices, everything, right? So, I think that's key to I think it to me it's if you build a really good marketplace, trust with the marketplace, it just means you attract more liquidity, right? Um also, I think it applies to institutions because as you've seen like in in traditional finance, it's actually just you know, like made illegal and just from a compliance perspective and from a

regulatory perspective, uh traditional finance institutions might not even they they certainly, they won't feel comfortable trading on uh on a marketplace where front running is is possible, right? So I think it's like that's an argument for making it impossible as well. Um and then we talked about this builder and and private mempool oligopoly. I think that's something we where the encrypted mempool can can level the playing field and even for the builders can actually empower smaller builders to now be actually more chance. Because right now you're trusting these large builders not to

front run you. The more you take that trust assumption away and say like we that's part of the protocol that there's no front running. The more we think you empower smaller builders again to to be able to compete with the with the large builders. Because trust is something that smaller newer builders maybe have haven't accumulated yet, right? Um and then quite quickly what what what are we what's the current status of this, right? So we proposed a and something that's called EIP 155, which is this protocol level encrypted mempool encryption technology and agnostic and it's it's not even specific to a threshold encryption. Any encryption can be used.

Um and right afterwards the some a small kind of team kind of primarily from the EF has proposed their own approach to this called Lucid. Very similar approach and that's why we said we should join forces because it's kind of goal the goal side is very similar and also on the approach is pretty similar. So we joined forces to to bring this to Ethereum. Uh we it was then not included.

Pretty likely that it it won't be included in the Egorota hard fork, but there is actually a good chance for it to be included in the next fork, the Istar hard fork. Um because there it was just listed um on the um EF straw man roadmap um for Istar 2027. And in general, there is a lot of feedback that came from this uh client this um client process from from the client teams and this voting process, which I think it should now lead to us and Lucid team and others iterating on the design and just making it a lot better. So, couple of examples here.

There is very good criticism um for for Flashbots coming that the uh that back-running um is less efficient in this design. So, maybe first and foremost, just briefly, that encrypted mempool only prevents front-running, not all MEV. It can It can by definition only prevent front-running. And back-running is still able to um there's still ways to extract the to to to extract back-running MEV, which is actually something that people think is good um because that's for liquidations and arbitrage and can actually If you then pay that back to the user, that's actually kind of considered sort of like benign {slash} good MEV.

Totally possible in both Lucid and EIP-8105. Just the exact way how to extract it is arguably less efficient and let and you can extract maybe a little bit less of it um as compared to a private mempool. Um so, there are I think there are strong approaches to bringing that back-running efficiency to the same level as for private mempools. Um which I think one of them is post-inclusion ordering. There will be some other ideas. Um and by the way, just all in all, I don't think it matters even that much because it it certainly is better than it would be in the mempool.

Uh so, if you compare against pr- private mempools, there might be some efficiency losses, but if you compare against the public mempool, um that's certainly kind of like uh um better the the the the situation should be better for the user because they're not getting front-run. Um there's talks about potentially combining with friend transactions, which is like kind of like this UX uh account abstraction type of um EIP. And then I think there is definitely a push for it it should be ideally as post-quantum resistant as possible.

There's a strong push from the Ethereum Foundation to make everything no every addition to the protocol should be um every cryptography cryptography addition to the protocol should be post-quantum resistant, um which it is. Uh both the EIP-815 and um Lucid are because they're encryption technology agnostic. It's just you need to make sure that there is actually um sensible and good encryption technologies that fulfill the criteria. Um then while kind of this being figured out and we're kind of working on uh uh on I would say the next generation of this EIP, uh we uh are also just building out of protocol. So, one thing that's been live

actually for uh a longer time now is an out of protocol version of the encrypted mempool on NoSys chain. And that's actually supported by the Nethermind and Erigon clients. So, recommend everyone to go to check that out. But um for Ethereum 1, we're also bringing that to Ethereum 1 via um together with Prime Eth, which have this um builder and proposer commitment scheme called MEV commit. And we uh have built this uh together with the Prime Eth team have built this um encrypted mempool lane basically into that. And um that's really uh ready for builders to adopt. So, if you know any builders or if you are working on any builder, talk to us. We would love to

have you guys be part of that and and support it so that we can have a an out of protocol version of the encrypted mempool before it gets fully implemented deeply into the protocol. That's kind of it and just showing the EF Strawman roadmap where you can see the encrypted mempool here is scheduled for I-star 2027. Uh 2027. Yeah, and along with the other other things. And here, very brief sneak peek on this this the the swap demo app and AMM for this Shutter Prime app or encrypted mempool X MEV commit out of protocol

implementation. Um yeah, that's it and we thank Yeah, we think by making the mempool kind of by bringing back the public mempool. So, maybe there's something I forgot to say. The public mempool is broken. Kind of everyone agrees. So, that's why people are choosing these private mempool mempools. Um and I think the encrypted mempool is a way to bring back the public mempool and level the playing field and by doing so I think we're doing good in making Ethereum more attractive to to everyone.

Cool. Um there's a important concept which we kind of just gave the most surface explanation of which is really at the core of Shutter and that is commit and reveal threshold encryption. And um for everyone listening, it's probably good for us to dive into that in a little bit more detail because it underpins everything that Shutter does from uh MEV prevention with encrypted mempools to private voting and other applications.

So, to break that down for you, there's commit and reveal threshold encryption. When we talk about commit and reveal, this is a special type of encryption which is really important, not in the sense of making something private and hiding it away uh forever and always from everyone. Um this is uh a type of encryption which is particularly applicable in simultaneous move situations.

Um where it would, if one player were to see the other player's move before making their own move, and use that information asymmetry to their advantage, uh then they could potentially uh win every time or exploit or manipulate uh the game for their desired outcome. Uh a really good example of this is rock paper scissors. Uh that's a classic simultaneous move situation where one, two, you have to show rock, paper, or scissors, and the other person has to do the same.

And it works really well when you're in person because uh we trust each other um and our reflexes aren't fast enough to see the other person's move before making our move. Um but just imagine um that we played a lopsided game of rock, paper, scissors where we counted to three, you had to show your move, and then we kind of four, five, six, and I got to show my move. Then it would be completely unfair. It wouldn't be a simultaneous move situation anymore.

Um so the way that we can make this simultaneous move situation more fair and neutral is by uh essentially um encrypting the moves uh when people commit to them. So you can imagine uh a kind of partition between me and my opponent. I show one, two, and then I lock in that move, and then the other player locks in his or her move, and once uh both moves are locked in, then the partition is removed, and the results are revealed. That's kind of

the essence behind commit and reveal encryption. And if you think about it, uh private voting is another wonderful example, um not even thinking about uh DAOs or uh blockchain-based voting, but if you think about like putting your uh ballot in an envelope and then in a locked ballot box, that's actually kind of a manual form of commit and reveal encryption, which keeps all ballots secret until the end of the voting period.

Um and then the second part of that is threshold encryption. So going back to uh So threshold encryption is basically instead of uh relying on a trusted third party in order to provide the encryption and decryption service, you rely on a distributed group of nodes, which collaborates to generate encryption and decryption keys. And this is a very uh decentralized and robust way of doing encryption. It does start off with an honest majority assumption or an honest threshold assumption.

Um, but there are layers of security that you can put in place in order to kind of provide a backstop to that honest threshold assumption. One of those is you can do staking and slashing so that if any of the nodes is acting dishonestly, they'll have an economic penalty. And then there are some edge cryptographic techniques including cryptographic snitching where if one node does try to collude maliciously with other nodes, then the other nodes can actually see that malicious behavior, generate a cryptographic proof of the bad behavior

and then use that to both penalize the malicious node and to get a bounty or a reward themselves. And this is really you know at the heart of everything that Shutter does. Thank you so much for having us. Just as kind of a mandatory shameless plug. If you are interested in learning more about Shutter and our work, please go to Shutter s h u t t e r dot network and you can find all the information there.

If you're interested in encrypted mempools, just do a quick search for EIP 8105 or lucid l u c i d encrypted mempools. And of course, uh you know, this isn't something >> [cough] >> Excuse me. This isn't something that we can implement alone. And so if you are a wallet, a protocol developer, a block builder, if you even just a a user on Ethereum, you know, please think about how you can contribute

to implementing encrypted mempools, whether it's on a technical level or merely just hopping on X and saying that you're bullish on encrypted mempools for censorship resistance and preventing toxic MEV. I'm bullish. >> [laughter] >> on it. Thank you so much, guys. Yeah, thank you. Thank you.