MACI and Quadratic Funding

Transcript

and now let's welcome chaoma from Imperial foundation with the workshop Macy and quadratic funding Oklahoma State [Music] yeah so today I will talk about the Macy and the its application on the quadratic funding my fault consists of two parts the first part is about the introduction to the

Macy and its background the second part is one of the major application of the missing which is for the for drawing a family so the message stands for the minimal anti-volution infrastructure the idea is the original purpose by vitalik Amazon has little research by Barry and Kobe then it's developed by a Milling Developers all right so the major issue that makes you want to solve is the library issue so suppose we have some online elections let's say the user want to vote for some multiple options and how can we avoid the user just to drive offline so which time is for example the RS can pay the

book for some money and buy both key to vote for Alex preference so this kind of attack is something we're going to avoid so the basic idea is we just encrypt every message after the encryption you can imagine all the message just looks like a random Stream So from the outside of point of view you have no idea what is the content of this message and also we will allow the user to change his voting key so this is also important I will explain later and after the encryption how do we guarantee the more messages processed correctly and the final tally result is computed correctly so this is done by the zero knowledge proof we can guarantee us all the conversations done

correctly and the major application is like a clear dot sum and purify their all-existing projects and the audience funding and utilizing machine as an underlying infrastructure and here's the original article from the vitality so the solution is like this there are both basically two stage the first stage is some kind of kosa process and all the user just to register your voting key on some register smart contract and you can use the whatever the key message or like white list or whatever measure you want so this is done by once after the sign up is finished where is the next stage is just the voting so we can have

multiple voting period and when the user root he will just encrypt his voting message by the coordinators public key I will explain what is the coordinator means so basically you can imagine this process is looks like you encrypt your message and send to the the voting smart contract so this is a Samsung what is a valid message here but it's just some technical detail you can just ignore it so we'll explain why with this way the RS cannot drive both so here's the both strategy during the sign up Bobby sign up with his voting key and during the voting period Bob will vote for some

options then Bob can send another message to just change his voting key so after he changed his voting he during the whole process he can just vote with his new key and all his voting will just override the previous mode it means the previous vote will become invalid the system will only accept the latest key with the latest vote so in this case let's say the book first vote for the message and changes key to a new key and vote for another message with new key so from Alex point of view Alice has no way to know Bob has ever changed his skill or not because all the messages encrypted and the Bob cannot prove it he

didn't send such things so this basically breaks the trust routine fiber and variety so this is how the mix can stop the fabric so of course in this case both can still give others the correctly but the boat cannot prove it so basically their trust is just no longer exist so I as I just explained the trust coordinator is some third party starts the party who is responsible to just process all the voting message so here I list the what they can do and what they cannot do so the first thing they can do is they can decrypt all the messages to some valid command or invalid commands if the users and the invalid message for example we just

encrypted by another key or just to arbitrary random message the book of the collinear can still make a proof to show this message is invalid and adjust silently know it when you do the tally so basically this is what the coordinator can do of course the coordinate can also withhold all the processing so which means the coordinator can just stop the liveness of the system and another more serious issue is we have trusted the coordinator we are not collude with the drivers because coordinator has the power to decrypt all the messages so if they code with the driver it means the driver can know which message is from who and who changes the key so this is definitely

the trust assumption we have to assume one of the trust the coordinator cannot do he cannot censor the message because all the voting message is understood smart contract and he has no way to store people sending the message to a Smart contract so he cannot censor it and also he cannot compute the message or tell your result incorrectly this is guaranteed by the zero launch proof and the best smart contract so here a smart contract is try to ensure the correct order of the message so the coordinator will not just ignore some of the message so basically the smart contract allows the coordinator process message one by one with the correct order and zero knowledgeable just the guarantee the

coordinator cannot fix the roof or fix the competition so here is a basically architecture design in the right picture you can just acknowledge and the left side is the workflow so basically there are two two states the first stage is the sign up stage and the user will just sign up in a sign up stage by for their voting key this can be done once and the second stage is the voting so for example it can be multiple run you know for example in the round one for this week we are losing for some different projects and the next week it's a new run we are voting for a new like let's say attorney project so basically this is how the workflow of the message goes so after each of them won't impured and

there is the first phase is voting so after the voting data in the past it's a time for the coordinator to process all the messages so because of jkb he will process all the message and credit the proof after the proof is created it will submit the proof to the Unchained verifier and until referral verify everything is correctly and if everything is correctly the Unchained verifier will updated the latest status and the final tally result the commitment of the tally result so basically this is how the messy workflow going and the the next part I'm talking about the for joining something so basically uh from the traditional funding when the

donor just uh voting for one key he basically contributes one dollar for it and if the donor wants to vote for straight tea he just contribute to three dollars so this is how the traditional funding goes and for the quadratic funding it's slightly different so imagine my user like a English is this picture one user donor just donate one one ticket which means he contributes one dollar and another user he votes for Street ticket in this case he has to contribute the three Square which is the nine dollars so this is one way for the quadratic funding so basically it means the marginal interest you are strongly want to vote for something is proportional to the month the marginal

cost you have to pay and this will make everything quadratic so like this example uh use a square the bottom one a big square is whatever the final something is a project you will accept and you can see the green box is the matching book so basically we will also have a matching board will match whatever the donors contribute basically maybe their spirit so in this case a one donor one ticket the other known as three ticket so the total is four ticket and we'll match in the sixth store to make it as a four square which is 16 so this is a normal project you family the mechanism some attacking factors for example there

are two cases the first cases there are still two donors as before one donor works for one ticket and the other donor vote was train ticket so total for tickets so the maximum will match six six dollars and in the second cases there are still two donors one donor will vote for two kids and he paid four dollars and the the other donor also vote for two tickets he paid four dollars so in this case the matching Pro will match eight dollars still for tickets 16 dollars as you can see in this case we'll extract more money in front of Public Funding so there's a kind of attack let's say two users collude with each other but we just support our project behind so we contribute our own money through this

project and we just contribute each of us contribute a large amount of money so this can extract a lot of money from the public goods so this is kind of attack we're trying to avoid or try to minimize their their risk and the idea is also proposed by Vitality in this post which he calls the airwise coordination subsidy so intuitively if you say look at the Box the green square is the individual contribution from all the individual donors and the area is what the individual contribution the how much dollar is contributes and the side side length is a ticket and the error is the

contribution of the dollars and all the yellow rectangular is a matching in front of the public fund to this so make it a square so that's what I just explained the normal quadratical body sorry quadrolic family like these two like this these two uh green square their contribution zero correlation is kind of large so they're corresponding the yellow yellow triangle is a large area they will extract more money right so the idea is single we just multiply the scaling Factor on each of the small rectangular so the final contribution from the Public Funding is the area of

the rectangular times the scaling Vector so for example in this big biggest yellow rectangular wait times are smaller scaling factor that is the amount of the contribution from the public code and if you you with the area times the scaling Factor added together is whatever the public something will match for this specific project of course the the number here is I just make it up give you some intuition the actual formula is different and we can prove with the actual formula there's a maximum upper bound the malicious user can extract from the Public Funding

[Music] so the first thing is as we know from the xenology proof everything happening is a sign in the field you can imagine this is a big integer both modulus and some more prime number so basically this is how the numbers were treated with the integers kind of but the user like a correlation when we capture the correlation from two donors actually the float Point like 0.1.3.5 so the first thing is we have to emulate the float number by the integers so the idea is simple for example the integer one two three four five and if we use the last three digits to represent the fruit and the first two digit to represent the

integer part so one two three four five means 12.505 so with this uh analogy uh here are some rules for division in multiplication and addition subtraction for example for division we'll divide of our two your first time the ones 1000 divided by two you get five hundred so five hundred and er analogy is just 0.5 so this is how we do a emulation for the float number and uh secondly something I learned when I developed the circle here we are using Circle programming language basically is the second comparator cannot allow user to put the input signal it's kind of like a variable you put a signal in any expression control

flow array size or array index so this is uh you can imagine when you're dwelling Hardware circuit design you have to know the circuit that shape when socket size before you are actually running so basically you have to know everything the shape of circuit at a compiler time so in this case for example women trade the integer division we will have to choose the division algorithm with a fixed maximum speed lens to avoid any unknown signals and also when we do the correlation coefficient for example we have the four users U1 U2 u3 u4 they try to voting and their corresponding correlation as six

one xc1273 until CS Revolt so one way is to let's say you have a bunch of users we have to is a long correlation array bypass because we have where we have the upper limit for three the average amount of how many messages we can we can process so when you trade everything in your batch if you first of course for batch size we can fix it for example each batch is 100 message or 100 users that's fine but for the when you when you try to indicate the best you have to indicate the index starting index of the batch and the batch size but if we're trying to manage from the coefficient

array to the user array basically from the right side the C12 sales report to the right side from One D 1D array to the 2D array array index so instead we're just doing the other direction we we do the mapping from the uh the user pair like a UI ug to the uh correlation Matrix on The Matrix so sorry correlation once you're right so in this in this case we just assuming the uh therefore in this case for users

you want you to use three UVO and we have two batches so in reality of course you have a large user base and a several matches and each user batch you can imagine is a sub trade of the local trade for the users and we can hash each batch to get a upper Leaf node which is kind of the leaf node of the of the circle tree and we just for each batch we provide the miracle growth with the hash of the batch so in this case we don't we can avoid this unknown uh like an input signal in enzyme expression or like for Loop or in the arranged exercise and this is the illustration so basically when you calculating it it's a correlation Matrix you can calculate it for each batch like B1 to B1 B1 for B2

or b2w and b2b2 so this is how we deal with this kind of scenarios so this last two slides just um uh lesson I learned so thank you so that's all from today's talk if you have a question you just uh you know how do you when you do kyc to users how do you protect their products like if they have to do devices yeah so for the QVC partner so actually this is not the design of the music we make it just a

separate component so basically uh whoever runs this programming they will design your sign up or give us a process either white listing or just uh probably you have to check it and don't record the identity so this part is uh I would say not the infrastructure of missing we just don't make it the modularized so you can plug in and with different kind of capacity process or the sign up process where I'm mostly focused on the second stage the basically the voting tally yeah [Music] we so so the data of the user where do

you where is the store also the data user will store So currently in our demo uh actually from basic point of view the Euros data is stored in the sign up contract or the missing contract so basically when you do the key message you just the register your voting it it's kind of the public key but it's it [Music] and also with the balance initial balance so basically it's a hash of the initial balance and the public key into the local tree thank you and also for the foreign [Music]

so basically uh you for example for this project this user goes for V1 this user was 4v2 so V1 plus three two times together so one project and it was at the same time we have multiple projects for each three users we will calculate the contribution of their current their pair for each of the projects added together we give some number and then we use some protocol constant m capital M over M plus their number so basically make it between zero and one and uh you can check this uh I should get some barcode but that is if you search for the printerwise coordination subsidy and

with metallic keywords you can see the exact formula thank you honestly when you try to handle the flopping one number uh is it uh the cluster model numbers numbers is it the first anonymous oh yeah right yes yeah it's a frozen number but I will fix some let's say four digit size so basically it's an accuracy is up to four digits and is it

possible for the sign a sign right exactly oh so here because everything is positive and the correlation is important so we don't need to worry about signpets so thanks any other questions I think that's pretty much it thank you ciao man