Roman Semenov: Tornado Cash – Keeping Your Ethereum Transactions Private #395

Transcript

this is epicenter episode 395 with guest roman seminov welcome to epicenter the podcast for you and your crypto founders builders and thought leaders i'm sebastian quiche and i'm here with felika ernst today we're speaking with roman semenov he's co-founder of tornado cache it's a fully decentralized protocol for private transactions on ethereum but before we talk to roman i'd like to tell you about our sponsors this week exodus is an easy to use wallet which supports hundreds of assets and has native apps for all platforms

including ios and android it's fully non-custodial and they're firm believers of not your keys not your coins go to exodus.com and give it a try parasop just came out with a huge update that's even faster and more liquid it's cheaper than new swap and it comes with a new gas token that can cut your gas fees by up to 50 percent periswap is now multi-chain and has expanded the polygon and binance smart chain and you can start trading at paraswap.io epicenter and solana is a next-generation blockchain with lightning fast blocks and fees less than one cent per transaction scalability is perhaps the biggest single challenge preventing crypto from becoming the backbone of the financial system go to solana.com to learn more

so rama thanks for joining us today tell us a bit about yourself what's your background and how did you get involved in crypto my background is i learned studied physics originally but then i got into programming i found founded a few startups web services then i got into blockchain i think four years ago worked on ethereum scalability solutions at this time it was plasma but then switched to zk snarks and privacy what did you do in physics i'm a physicist by training also it's uh quantum statistics and field theory so the black holes small particles some whole

stuff when you um got started on the privacy side of ethereum applications what kind of drew you to that i started by learning zk snarks to do some scalability stuff and they can also be applied to oracle's and other things but one of the main applications are is privacy so i've built a few privacy projects on ethereum hackathons and then we just decided to build something for production the thing that you built for production was tornado cash right so tell us about tornado cash in a in a nutshell so we'll dive deep into how it actually works in a bit but

um what problem is it that tornado solves the privacy because by default all ethereum transactions are public and not many people are comfortable with all their like financial history being public so it solves this problem can you describe in a nutshell how that works how do i make my transaction not public if you have a ethereum wallet if you just transfer some funds to a new wallet uh the wallets can be connected like everyone can see that funds went to this new address but with tornado cash you can put your funds into tornado pool and when you do this tornado cache

generates a private node for you this node will be used to access your funds later it's kind of similar to a private key then when you want to withdraw you generate a new address and use this private note to withdraw your funds to this new address and nobody will see how your old address is connected to a new one the way i see tornado gas is it's like this black box where you throw funds into it and then on the other end you can withdraw funds and there's no way of knowing where those transactions are connected because you know they're everything is obfuscated by the cryptography in tornado cache can you walk us through some of the like

usage scenarios like what does a user use tornado cache for like who are your users if you want to get a new identity on blockchain you can put your some of your funds to tornado cash pool then withdraw to your fresh address and use it for some things that you don't want to be connected with your previous identity when people deposit into tornado cache they're given a zero knowledge based note that allows them to withdraw as much as they put in minus a fee this kind of hinges on the fact um that other people use that service as well so

right so basically if if i'm the only one who uses tornado cash it's no good because everyone knows exactly one person put money in and exactly one person pulled money out so what do you recommend to users of tornado cash so i assume it's advisable to leave to not withdraw immediately after depositing correct you can imagine tornado cash pool as a bag of coins that are all the same and some people come along and throw a new coin into this bag and then some other people come and take the coin take some coins from this bag so there is some activity like people come and go but for example if someone puts a coin into this bag and then

someone else immediately takes coin out someone can think that probably this is like the same person it is better if you mix with the crowd so you put your funds into the pool wait until at least few more people interact with this pool and then take some funds out so basically it's better to use the protocol when there's like a lot of noise to kind of obfuscate the lineage between your your deposit transaction and your withdrawal transaction yeah and there are also fixed denominations right so basically there's different points for different increments of tokens yeah and those pools are completely

separate this is done because for example if we would allow any amounts if you put some specific amount like 1.33 ether in there and then take out the same amount people can see that probably this is like the same user so what's the typical daily volume that goes through your protocol and how many um users interact with it it's usually dozens you can check the actual stats on the we have the dune analytics dashboard it can be accessed from tornado cache app it's in the main menu but basically it's uh dozens of transactions

for each pool and the total number of transactions are around like 10 000 plus plus and which tokens do you support so i assume ether is supported but um what about other tokens ether is the most popular one and it provides the best anonymity set but turn the cache also supports dye cdye and wrapped btc and people can also use those but there are fewer users so less anonymity at the moment i assume this only works for tokens which reasonably liquid right so basically where there's um quite a lot of demand

for obfuscating the origin of these coins do you have an idea of how to extend that to less liquid coins the easiest solution is you can exchange less liquid coins to ether use tornado cash for ether and then you can exchange back to those coins basically the assets that are chosen for tornado cash pools are the ones where people want to hold their funds for example if a user wants to hold their funds a long time internet akash maybe someone is not comfortable holding heath and more comfortable holding

stable coins for example some users don't want to be exposed to its volatility they can use dipole to put their money there for a few months for example is there a way have you thought of i don't know like technically how feasible this is but for the tornado cash smart contract to also include uh in addition to the privacy aspect some sort of automated market maker uh type of application that would allow users to basically swap tokens so like you could have like one person with depositing eth and wanting to withdraw die and you could have maybe like another in the same pool wanting to do the inverse and you could just basically kind of

like have those users like uh swap their tokens for one another it's not easy to do this uh while preserving privacy so uh automated market makers are not very friendly with like privacy solutions because for example in solution that you described those two assets can change their relative value for example when you deposited they were like the same but maybe when you withdraw one of them are now 10 times more expensive and it will be hard to do this like matching and exchange let's get to our sponsor exodus exodus

is a fantastic cryptocurrency wallet that strikes the right balance between ease of use security and great features you can get exodus on the iphone desktop app web app android whatever platform you use it's a non-custodial wallet and that is so critical because what's the point of crypto if you don't control your own assets with exodus you always do they're old school and they've been around since 2015 over 1.2 million users rely on exodus so you know that they've stood the test of time they have support for over 100 different crypto assets and from within exodus you can easily change one different asset to the other they also allow you to buy

crypto with fiat and they even have a great offer where you can buy up to 500 worth of crypto through their ios app and pay just one dollar in fee so go to exodus.com epicenter and check out their wallet we want to thank exodus for their amazing support of app center so let's talk about um how eternity cash works under the hood so we already mentioned that there's different pools like for 110 or 100 eth talk about the smart contract and the particular zero knowledge technologies that tornado cache uses i wanted to ask you how deep do you want to go this is a fairly technical podcast you can go technical so there are basically two actions

deposit and withdraw there is also anonymity mining but we can talk about this later uh when you deposit the front end generates some random bytes to be precise like 62 bytes but that doesn't matter like some random array of bytes computes their hash and sends your eth along with this hash to the smart contract it calls deposit function and then smart contracts inserts this hash into the merkle tree and the hash function is used pederson hash it's more snark friendly than regular sha 3 or whatever and then the interesting part happens when you

withdraw like deposit is simple but it's quite expensive because this hash function is pretty expensive in solidity in since you insert into merkle tree you need to compute a lot of those but the operation itself is somewhat simple when you withdraw the front end takes the same array of bytes and splits it into the first part is called secret and the second part is called nullifier this time we hash only this last part nullifier hash and using the snark we prove that we can take this

random array of bytes your key and if we hash all of it we get your commitment and if we hash only the second part of it we get your nullifier and also it proves that this commitment the hash of all this key is present in the miracle tree of deposits so the inputs for snarks is merkel root when you are using zero knowledge some inputs are private and some inputs are public the public inputs are sent on chain to check them against some smart contract data and private inputs are only present when the user

generates snark proof so the public input is merkel root and smart contract will check that merkel route used for this snark proof is the same that he has on the smart contract like for tree of deposits merkel path is private so the external observer only sees that the node is present in this merkle tree but doesn't know where exactly it is located which leaf exactly it is and also smart contract can verify that all hashes were computed correctly because it is proven with this snark also hash of the second part nullifier hash is also

public and it is used to prevent double spends when user withdraws funds the smart contract verifies that this nullifier hash is not present already in this array of nullifier hashes and if it is present then it means the same note was already withdrawn and interesting part is that nullifier hash is not cannot be linked to commitment to hash of all this value because those are computed from different bytes and they seem completely random to external observer so you already alluded to the fact that these transactions are

pretty costly on chain can you give us an idea of how much um they cost at say a hundred quay so deposit costs a little bit more than 1 million of gas so this will be it depends on either price too but i guess like 200 or something like this and withdrawal is cheaper withdrawal only computes like verifies snarkproof and it costs around 400 000 guys you can only withdraw in the same increments that you've put in right you can't just say i put in 100 eath and then i'll just withdraw

a 0.1 of an ether or one each whenever i need one each you have to deposit and withdraw the same increments exactly yeah with current implementation yes is there a plan to make this more efficient because obviously depositing at say 200 euros per transaction or 200 per deposit is pretty expensive and only pays for pretty large sum so basically if i want to um obfuscate say a hundred thousand dollars that may be worth it but but if it's only one eth or something it's probably unfeasible right yes there are many ways to improve the current solution when we developed

tornado cache we were thinking about what the simplest solution we can make to solve privacy and roll it out to mainnet faster but now we are thinking about how we can made make this convenient and cheap so currently tornado cache solves privacy in the simplest but not very easy to use way there are many ways to improve it for example it can be done more similar to zcash with transactions inside the shielded pool so to allow users to deposit any amount uh into the pool do transactions to

some other users like for example you can deposit three eth send one each to someone else privately then withdraw one if or whatever and also using layer two technology it can be made much cheaper than it currently is and uh this privacy pool will be can be very layer two friendly i'd say because since you already need to enter the privacy pool and then exit the privacy pool when you are done you can in the same transaction basically enter layer 2 as well with good enough integrations

privacy can be done in such a way that your deposits fund deposit funds into the privacy pool and magically all transactions inside this privacy pool are done already on layer 2 and are cheap and fast so if i understand correctly which is saying is that you could deposit funds into tornado cash and then those funds would essentially come out in a layer 2. does that mean that you would need to have different pools for every uh layer two solution or uh would there be a way to somehow have like one big pool that like sends funds in one of several layer twos which kind of like increase privacy i guess it will result in a separate anonymity

pull for each layer too because it's very hard to synchronize different layer two solutions and prevent double spins for example if someone sends funds in one layer two and then send the same funds in different layer two it will likely result in the different polls i have a couple more technical questions as to how the protocol actually works um so when i withdraw from the pool um after having waited say a couple of days i would use a fresh address right because i mean this is kind of the point of all of this how do i pay for gas

from a fresh address right because basically if it's a fresh address i i won't have any ease to pay for gas so how's the standard for this we have a relayer network and basically how this works is instead of sending your snark proof and all the call data to ethereum you send the same data to relayer and three layer submits this for you on chain and then gets part of your deposit as a compensation all the parameters including relayer fee and which relayer should receive it are included in snare proof so if

anything changes in this data the snare proof becomes invalid so relayer cannot change anything and the worst thing that it can do is just don't do its job and like don't send the transaction in which case you just like choose a new one but this is a pretty rare occasion because if free layers misbehave they will just get deleted from ui so when you're looking for a flight you go to a flight aggregator to see all the different places where you can buy the flight to get all the options and make sure you get the best price for your travel plans

and when you're making a defy swap just do the same and use paraswap it beats the market prices across all the major dexes because it aggregates them and thanks to their network of professional market makers you get zero slippage on your trades so they just pushed a huge update that's even faster more liquid thanks to a brand new algorithm pair swap is now multi-chain and has expanded polygon and binance smart chain so go and check it out give paraswap a try at pairswap.io epicenter so last year a paper came out in academic paper on misuses of tornado cash or basically user faults mostly where they looked at

the 3 000 tornado cash deposit and withdrawals until that date and found that through just looking at the graph they could actually match up 400 of these basically because people used um the same deposit and withdrawal address people did these immediately one after the other and so on so this is already quite a large chunk of users that maybe some of these were test transactions but i assume some of the the users genuinely messed up do you think you could make it easier for people to use this correctly or do you think you could make it harder for people to mess up and we all know this is really difficult because people like messing up for this article i i think like the most

of the transactions that withdraw to the same address were probably just tests but in general i agree we need to educate people better on how to correctly use tornado cache to preserve privacy but the best way to solve this would be to make a wallet that takes care of all those things for the user for example the most obvious thing is hiding ipaddress because ip can be considered public information all those intermediate internet service providers and many other nodes in the network can see it

and wallet could submit all the requests through tor for example and also like the wallet is the would be the most convenient way to solve this but it's a lot of work so you also need to connect to um to an ethereum endpoint right so basically most wallets actually just um connect to inferior also basically inferior fura if you don't mask your ip they they typically know who you are and which transactions you've sent to the network right yes for users it's correct to assume that everyone knows their ip address unless they use vpn or something like this but if you

just want to prevent your neighbor from looking inside your wallet it can be fine like every users decide for himself which level of unlimitedness he wants like whether he wants to just hide his financial history from general public or he maybe doesn't trust governments at all and want nobody to be able to see his uh financials the project goes uh at lengths when you're like on the website and reading the documentation it really goes at length to ensure that every aspect of tornado cache uh is decentralized so

there are no like admin keys to administer the smart contract um the website and the interface are hosted on ipfs and there's like all of this uh documentation around like how the project aims to be fully decentralized what kind of constraints does this impose on you as a developer and perhaps also on users and was there ever you know a thought that perhaps you should do this also as like an anonymous founder was this ever considered and if not why not anonymous founders making it as anonymous is harder because it's harder to hire and people basically trust way less to anonymous funders than public figures as for immutable smart

contracts it introduces a lot of complexity but users trust more when they see that the system cannot be changed for example one of the difficulty we had is introducing anonymity mining because if the contracts would be still updatable the anonymity mining could be much much simpler but since we couldn't change already existing smart contracts we had to introduce quite a few new mechanisms to work around this which new mechanisms for example there is some intermediate step the tornado cache smart contract like

core smart contracts don't save at which block each deposits was made and for anonymity mining this information is needed to compute the reward size because it's based on time the deposits spent in the pool so we had a separate contract that contains merkel tree of all deposits and all withdrawals but with block number information so it mostly duplicates the court smart contract state but it's like extra stuff and also someone needs to upload updates to this tree it is done trustlessly so you cannot upload incorrect information

but still someone has to do it and pay for gas what's the role of the torn token i mean you use that for anonymity uh incentivization or anonymity mining right torn token is used for making governance decision for tornado cache protocol and currently there are a few ways to get torn old users got torn as airdrop so the people that used turner cache in the past before torn token was released got their turn voucher that they can change to turn token and new users uh get torn

tokens as a reward via anonymity mining so basically turn tokens are distributed to users that use ternarycation the past and in present so people that use it the most have the most voting power in the governance and what kind of governance decisions does the dow take there were some proposals for example to update anonymity mining mechanism because at the moment of release it was too expensive and basically broken because it cost too much but then the more efficient one was developed that

is ten times cheaper in terms of gas and governance was used to deploy this new contract and migrate all the data there also there was proposal for new pools new bigger pools for dicey dye and wbtc were introduced and currently there is one more active proposal uh to do a community fund for tonight so community decided to set up multiseek to be able to quickly make some decisions that don't need this big governance voting but basically like it's smaller decisions than

governance usually makes and i need to know that tornado cash team doesn't have a vote in its own governance because all team tokens are under wasting so currently community makes all these uh decisions without us how long are the tokens rested for it's for three three years but first cliff like first unlock is after one year so this would be around december so this community pool what kind of of initiatives or applications do you hope to see uh this pool funding i think they want to reward some

contributors to turn out a cache ecosystem so maybe some people that write manuals or make videos or maybe even sponsor hackathons or something like this let's get to our sponsor solana now this is a special ad for me to read because i've been a deep supporter of this project since meeting the solana team back in 2018. i invest personally in the project and my company course one is super deeply involved in the solana ecosystem including running the biggest validator so what's so cool about solana well we all know that scalability is the single most important issue facing the blockchain industry today and the solana blockchain is an amazing

solution for it the network supports thousands of transactions per second with 400 millisecond block times and over 500 validators the special thing about solana is also that it's not a chartered blockchain it's a single blockchain hyper-optimized for performance so that makes it really easy to maintain composability between all of the apps on solana so that they work together seamlessly now and forever the solano ecosystem is growing at a rapid pace and it's a great place to build your project or just get involved with the community so go to solana.com epicenter to learn more and so tell us a little bit about this ecosystem like what exists out there in the tornado cache ecosystem and what

kind of things would you like to see develop because it seems like a pretty i mean to me anyways it seems like a pretty straightforward thing like it's an enemy pool but what kind of things can we build on top of that there are a few simple things that come to mind like uh not a solution but more like we like documentation for example uh so some things like some simple things are needed to be done uh but in terms of more complex there are a few proposals about how to manage change or some people call it dust for example if you withdraw one ether and then spend half of it for something now you have half

ether sitting in some address and you can't do much with it like you cannot make it private again and everything you do with it will be connected with your previous transactions that that spent this half liter uh so there are a few proposals how to make those like small pieces private again so one of the things that i thought was really interesting uh on the trinitycast website is the the compliance tool when i saw it it's like is are they talking about regulatory compliance or the is there some other form of compliance that i'm not getting here but yeah it is a tool to sort of you know ensure that

transactions and special users can be compliant with their local tax regulation what's the compliance tool and why did you choose to build this into tornado cache compliance tool allows to prove the link between deposit and withdrawal and basically it gives a tornado cache user a freedom to disclose his information to someone so the financial information is not forced to be like completely hidden and user has now power to decide who they want to see this information for example if they want to send those private funds to an exchange

and then exchange asks them about origin of funds or something like this they can easily prove where the funds come from and pass all this check this can be used for tax compliance or kyc or things like this but nobody except the user has the power to disclose it yeah i remember a while ago there were exchanges who weren't allowing users to um send mixed tokens to them for if i think it was an issue with with them the wazabi wallet and finance but i'm sure there were also other exchanges

who put similar measures in place is that correct i'm actually not aware about this so can't really comment much but i didn't hear about like mass restrictions of like this when you use this compliance tool i guess as a user you provide some sort of of an attestation that will allow a third party to read the information about the origin of the transaction doesn't that sort of open up a vulnerability though where by sharing it with one user you effectively open the possibility for this information to be made fully public because once you've shared with one user that this other party that other party can

effectively share that information with the world and thus making transaction anonymity and tornado cash obsolete how does one protect themselves against attack on their privacy and i mean is it am i even correct in assuming that this is the case this is correct so the best way would be to only share your private information to other people you trust that they don't lick it most people will probably use this you know in the case of like exchanges requesting uh some sort of origin of funds for kyc or uh for tax purposes or something or things like that so it assumes that you have to sort of trust that these third parties are either not going

to get hacked or um won't disclose the information yeah correct i'm curious are you familiar with uh the upcoming uh mika regulatory proposal in europe and the provisions in there for sort of privacy coins and uh anonymous transactions nope in europe uh there's a regulatory proposal called markets and crypto assets that in its current drafting uh aims to make uh privacy coins forbidden you know if that would be the case then regulated exchanges could be forced you know and this is just like my interpretation of it but you know regulated exchanges could be forced to like either refuse deposits from addresses

that have interacted with these protocols or even stopped trading uh privacy coins like cash etc do you feel that perhaps protocols like tornado cache you know in the future could end up in the in the sites of you know national or supranational regulators that you know want to make these kinds of transactions or these kinds of anonymous uh crypto protocols uh forbidden i don't think so because it's very easy for exchange to ask about origin of funds and for user to prove where those funds come from when users showed the compliance report to an exchange

the funds are no longer private for this exchange like they can see where they come from so i don't see any problems here okay so let's talk about um the larger ecosystem for a little bit so basically if you look at tornado cache um and other privacy preserving solutions i mean you've got solutions that have their own blockchains like zcash and monero and then you have things that kind of go on top of ethereum um such as ck money so basically tornado if you look at it it's a well-designed mixer but at its core it's it's a mixer so basically if you look at ck money which has this ck sd cache like shield

clearly the use cases for that are much broader and encompass many more things than tornado does so my question here is what does your roadmap look like and how do you plan to position your yourself in the new presence of things like zk money i think most solutions uh move in the similar direction and try to be like similar to z cash which was uh like one of the first researchers in this area so i guess most solutions will look like this and the original tornado cache implementation was

the like fast way to do privacy but in the future it should also be pretty similar like allow transactions and stuff and as for separate blockchains currently ethereum privacy has lower transaction count mostly because the ethereum is much more expensive than manera for example but with new releases of layer 2 technology in this year this can change like the separate blockchains the only thing they can do is to transfer money privately but on ethereum transfer and money privately would be only one of many features in the ecosystem so i think privacy

coins as a separate blockchain is less convenient for most users so you also move in the direction of shields and layer twos and this is the general direction for tornado yeah so before we wrap up here you know what uh is on the road map here and also where can users learn more about ternary cache and perhaps getting involved tornadic cache development is in big part is decided by governance and the community governance holds more than half of all torn tokens and people can get involved by going into form and participating in

discussions and steering international direction that they think is the best thank you so much for joining us roman this was very elucidating i think privacy is something that gets talked about increasingly more but i i think it's it's very necessary that we become more sensitive to these issues i think uh like usually what happens is people don't much care about privacy until something bad happens and some big service leaks some private data and then suddenly people realize uh that they actually want the privacy or maybe events similar what happened with

uh snowden when someone comes along and actually shows people how important it is people suddenly start caring about it i think that's very true and i think those are great closing words thank you so much for coming on thanks for having me thank you ramen thank you for joining us on this week's episode we release new episodes every week you can find and subscribe to the show on itunes spotify youtube soundcloud or wherever you listen to podcasts and if you have a google home or alexa device you can tell it to listen to the latest episode of the epicenter podcast go to epicenter tv subscribe for a full list of places where you can watch and listen

and while you're there be sure to sign up for the newsletter so you get new episodes in your inbox as they're released if you want to interact with us guests or other podcast listeners you can follow us on twitter and please leave us a review on itunes it helps people find the show and we're always happy to read them so thanks so much and we look forward to being back next week you