zkSessions: DeFi + Privacy - Privacy, DEXs, and DeFi ... Oh My!

Transcript

i want to welcome guillermo back we decided to re-record this talk because as you were giving it you had a fire alarm going that was as well i mean i thought it was exciting yeah it was exciting however and that really gave that rave beat that we were all looking for it's indoors so it's pretty loud that's the tricky thing is it's um it is hard to hear you i think otherwise tania you know but it was actually really hard to follow and so we thought we would just give it a go and do it again so thanks for coming back no of course of course absolutely um it's it's certainly a party to say at least um but yeah i hopefully you know as

exciting as it is to have like a background beat i think it's better for everyone involved if they can actually understand like something of what i'm saying because the slides might make no sense without it but maybe not i don't know i have no idea cool cool so your talk it's going to be about privacy dexes and defy oh my which i am very excited to hear again um please do take it away all right sounds great so yeah so um this actually follows uh zack's talk almost in uh in a purposeful way i think you know it's very weird but it turns out this is quite topically relevant for exactly what zach was saying so i guess um originally i meant this to be kind of the contentious talk of the quarter as uh as being like oh yeah you know we

have all these things sorry here's a bunch of stuff that you can't do but i think a better view of this talk is you know that kind of gives uh you can you can think of a space of d5 overall as a graph right and zac gives you know in some sense there's a region of that which can be private right and i give a region of d5 which cannot be private under most uh like privacy assumptions right and then there's going to be some remaining region which fits in neither of those two camps which we do not know if it's either private or not and so the idea is kind of to to show that a lot of the primitives that we use specifically these constant function market makers like unit swap or balance or ramp stable

um cannot be private in their current incarnation and actually require quite a bit of thought to make them private uh in ways that doesn't completely um destroy either the structure of causal function market makers or more specifically kind of a user experience um okay so i guess you know with with that um we can sorry so i'll do a very quick intro to constant function market makers and i guess more generally amms um but i suspect most people are pretty familiar with unit swap but i'm going to give a much more generic intro where it turns out that the constant function market maker itself won't matter it just matters that it has some you know trading function that describes it so

in particular a constant function market maker is just a contract with some reserves of coin a and coin b and we'll call them r alpha and our beta but the specifics don't matter too much and then the constant vector market maker is defined by the trading function or the invariant which we will just simply call phi right and phi here is just a function of the reserves a and uh results of alpha and the reserves of beta and in this case you know as we know traders are allowed to remove some amount of coin alpha from the reserves or beta right so long as fee of so long as the the function of the reserves remains constant remains equal to whatever it was previously so you know as we all know in the case of unit swap

right or or constant product markets or whatever you want to call them right essentially we have that the function of the reserve is simply the product of the reserve so the trader can trade with the reserve in such a way that the product of the reserves previously before they traded and the product of the reserves after they're traded is equal so and it's not hard to show but essentially it means that the the price of alpha versus with respect to the acid beta etc right is going to be equal to the ratio of the reserves this isn't super difficult and we'll see exactly what this corresponds to in a second so the price of a constant function market maker in general can be kind of interpreted as

the slope of the trading function so here the blue line is the hyperbola drawn which simply says here are all the points at which the reserves of alpha and the reserves of beta are you know their product is equal to in this case two right and so we can interpret the marginal price of buying an asset as essentially being uh the slope of that hyperbola at every point so in this case if the assets have reserves alpha equal to one and reserves beta equal to then essentially what we're saying is the price of alpha with respect to beta is approximately two to one um more generally speaking it's just a geometric interpretation of what the marginal price is and we'll use this in

a second to show kind of why privacy is not possible but the idea is pretty simple so we're just going to take the tangent line as the marginal price so as more generally speaking right of course you know our constant function here need not just be the product right it could be something like the sum and here is called a constant sum market or m stable as well which implements this essentially says look here is the function that has to remain constant it's the sum of the reserves similarly balancer gets a little bit more complicated and it says something like the weighted geometric mean of the reserves has to stay constant and ker gets even more complicated right where it's something like it's some interpolation between the constant

product market or unit swap right and m stable uh in in this case the interpolation is kind of non-linear so it's rather it's a little bit more complicated than just a simple interpolation but the idea is kind of the same it has a simple form for its function v um the point here though is that the specifics of the individual functions don't matter it simply matters that we can write an amm as its trading function and the trading function has some properties you know one of which is that the tangent of the graph that it draws is going to be equal to the market sort of to the marginal price of one asset with respect to another so we can now finally get on to the more important question which is can we make it private so

here's the bad news sorry i'm gonna get this out of the way but the answer is no well more specifically the answer is no without actually implementing a bunch of major changes so even if you have a pretty weak adversary right you're kind of screwed sorry i'm just a bearer of bad news here i don't make the rules the rules were made you know a few years ago when hayden started in uniform and this is what the rules tell us um so we're going to consider an adversary in this case eve and eve is not going to be allowed to access any external balances right so it cannot access she cannot access a cfm reserve she can't access anything about cfm um but she can read public data so for

example she can query the cfm and ask what the marginal price at right now is and of course check if a trade is feasible this is kind of just normal ui stuff that says look i can go to unislop and i can see is the trade that i'm proposing feasible and similarly how much will that trade cost me we'll also assume of course that she can interact with the cfm contract in some way in this case by checking if trade is feasible and she can potentially also kind of make a trade if necessary and we'll assume that the trading cfm trading function is actually known so in the case of unisa for example we're just assuming that we know that the trades have to be such that the product of the reserves is equal to a constant um or whatever it may be and here eve

our eavesdropper simply wants to know alice's trade so here alice makes a trade and eva's kind of eavesdropping uh without knowledge of the exact trade but she's looking to reconstruct what alice did there so here's the result if eve happens to know when alice trades then sorry it's game over you don't really get a choice on that and the reason why is because eve will know the price of the asset before i illustrated and after alice traded right and it turns out just even if she just knows also you know the existence of any one non-zero trade that's feasible this is going to give a very simple system of equations that eve can solve in order to exactly reconstruct alice's trade

the thing actually that's kind of interesting about that is like you know you might think that oh you know of course you're given the marginal price so that gives you a lot of information but it turns out even if the marginal price isn't revealed this is still really bad because eve can essentially approximate it by querying ever smaller trades if you remember from calculus right the slope is defined as you know you take two points and you slowly make them closer to each other right what's the slope of that line so here the tangent hyperplane which we care about is going to be the price of the asset at the current reserves are right and so here's what she does she takes a trade of size four and afterwards there's a trade of size two

and then she's straight sized one to his trade of size point four and so on and so forth and she can kind of approximate arbitrarily well what the price of the asset will be given just that she can check whether a trade is feasible or not uh and even if she couldn't just check if she has to perform a trade she could still use it to approximate um the price the marginal price of the asset so of course you know this is all the bad news um there are some good news and there are a few solutions so we can kind of take a chance at here um so what we're going to do is we're going to look at kind of where the proof fails what does the proof assume uh which kind of ends up screwing us in the end and then see if we can somehow

change you know the classic constant function market makers or unisop or whatever there's a way that the proof fails um so one example is that we assume that there's no randomness in our query right so there's you know the the things that we see are the true things they aren't just like the true things with some noise and the other thing that is really really important is that eve knows when alice traded um this turns out to be it seems like an unreasonable assumption but it turns it to be very useful for kind of you know ensuring the solvency of a bunch of uh decentralized finance systems but we only get super into that actually tarun you know with the knowledge of hindsight true and actually talks about it in the

discussion section so i'm going to use the knowledge of hindsight or i guess in this case um oh to call it a depression knowledge or something like that knowledge of the future um yeah four side thank you so four side is 20 20. um so okay so if we start with you know the first part essentially it says look i can add noise to any one of eaves or alice's queries right so we're going to add randomness to the price that's reported by cfm or add randomness to what trades are accepted or i guess the values at which trades are accepted so this will prevent you from guessing the exact marginal price right and it turns out if you're kind of careful about it you can show that if you choose the noise in the right way

then eve cannot know the true price change there's a bit of a problem though and essentially the downside is that the noise that you need to add is approximately of the size of the trade that alice makes this could be very bad right because at some point someone's going to end up losing if for example you know your noise says the price is actually lower than it should be then the lps end up losing or if it's more expensive than it should be then the agents end up losing so this could end up actually being potentially very expensive for both traders or lps again because it's roughly speaking proportional to the trade size that we want to hide um another thing you could do is you could change the order of the different orders they order the different orders that's a weird thing but anyway so

we can batch the the orders the centralized exchange right and then if we just batch the orders and execute them all at once then it prevents eve from knowing what trade is alice's specifically this is a few downsides one is it's important that the batch trade is much larger than alice's trade right because in otherwise eve knows that most of the trade was alice in the first place and so she can obviously reconstruct that and the other problem is that it can be very very very slow in practice right if you need you need some amount of time to aggregate all the trays into one big chunk and then afterwards execute it uh this is potentially bad for price discovery or a bunch of other possibilities so kind of the conclusion uh and in general speaking is that privacy is

really damn hard right so and kind of more explicitly we should get out of this the current implementations of cfm as they are right now just cannot be private you can't just hide all the quantities that are available to cfms and then be like okay cool we're done um another problem is that you know we've talked about cfm specifically but the proof applies in many many cases right whenever you know the price impact function of a given automated market maker decentralized exchange or whatever d5 primitive you want right you can essentially use the same argument to have eve be able to tell apart alice's trade so there are some reasonable solutions of course right and kind of one of them is this weird notion where you can add noise to the price that has its downsides but of course it

has its upside that it's private and then similarly we can batch uh orders in the decks or whatever it is right and that also gives you kind of a reasonable thing but with a slightly different trade-off than just adding noise and kind of the question that i want to pose very generally to the community is maybe there actually are better mechanisms right maybe cfms as they are right now are just like simply not the best thing for privacy maybe there is slightly better implementations of cfms which kind of do a combination of a bunch of things that mostly preserve privacy in ways that don't degrade the user experience this is totally not clear to me and this is an obviously open research question and all of these terms have even yet to be defined in any way that's

reasonable but it is an interesting thing to think about and kind of finally uh i would acknowledge uh the people you should blame in case that this presentation has either any typos or is completely entirely wrong that's true in alex we're supposed to check it i think they did check it and in fact they got some messages about it but my point is you shouldn't blame me you should blame them if you find some error in the presentation and i want to give a huge shout out to the zk sessions team including anna for you know having put this whole thing together and for having me re-record this after for whatever reason there was a fire alarm test going on right outside of my apartment amazing very cool thank you so much for the re-recording okay what we'll do now is we'll probably cut it together

with the actual questions that were taken from the day um that's great so yeah i guess we'll do a little cut now thanks sounds phenomenal mccara asked would differential privacy help with relaxing some of these results so yes so differential privacy will help and this is kind of what i meant uh when i was describing the fact that you could add noise to the marginal price uh or add noise to kind of what what a reasonable or what a sorry not reasonable a feasible trade would be so if you add noise there it's kind of going to be much harder obviously for eve to reconstruct the exact quantities because she's inverting some problem that now has noise in the input data so it's going to have noise in the output data um i think that cool hopefully that

answers the question um when i asked uh schumer asked do you think that cfm is the cfmm is here to stay um fingers crossed i mean it would be kind of interesting about what so it see if i seem to meet kind of this weird niche in between order books uh which which you know are are the classical and and you know there's a bunch of crazy papers published in the 80s and people one noble prize is over all of it and all this stuff but hopefully cfm's are here to say because in a lot of ways they're much simpler a to analyze and be to actually kind of run so hopefully that makes uh some sense i suspect they will be and maybe not in this incantation or in this instance of cfments but in the in

the near future they hopefully move to like those potentially like slightly more complicated cfms where you know you you tune your cfm to specific circumstances or you might add slightly more complicated components that make it perform better in practice you know potentially less uh maybe not less than permanent losses the wrong thing but you know kind of less of the bad properties bad properties people have and more of the good properties that people want um um oh what is so i guess there's a question here by rahul which might be good too go ahead no i think this is about like the age of the attendees i don't i don't know if that's super relevant did you have a was there a different question there oh what is different

privacy yeah what does it mean so what is the friendship so here's a silly thought experiment um differential privacy is you give a bunch of people a um a survey right and you don't want to know you what you want is you only care about the average statistics you only care about you know roughly speaking i think some people have have roughly answered this but uh you only care about the average uh price for example you only care about the average of you know people's ages right but you don't want to know any one person's age because it's bad for you it's a liability for you to know any individual person's age so what you do is you tell everyone here's the deal i'm going to give you a coin and you're going to flip it right and if you flip it to whatever let's say heads or something

like that then you're going to just give me a uniformly random age between 0 and 100 right if you don't flip and it should be gaussian but let's assume uniform right uh and if you so if you flip heads you should do that if you flip tails you should report your true age right and the idea then is that you know you can't it's very hard for you to tell apart you know the the the people who were truly reporting their age from people who were not truly reporting their age right you you have of course there's always some information leak so to speak right but the the point is how likely uh that the info you can control how much information is leaked by any one person by kind of controlling how the

distribution uh how how someone reports the distribution based on whether they got heads or tails so the idea is sorry here's the deal with information is if you report anything truthful you're always going to be leaking information the idea here is you can leak just enough information that you know what you want to know without knowing anything very specific about any one person with high probability yeah that's great thanks everybody for the great questions