Hi all!
Question from digging on the difference between Quantus and ZEC:
Is it possible for a wormhole to lead into a shielded pool ZEC style?
The high level mechanism would be combining the properties of wormhole addresses with being able to stay fully shielded and perform transfers within the shielded pool.
Even if it was undesirable for some other reason, I’d want to understand if it was cryptographically feasible.
Thanks!
Hello Joey! Thanks for the message. Yes it is possible to have a shielded pool style system after proof-of-burn. The advantages of this are that, within the pool
amounts are hidden
senders are hidden
destinations are hidden
The disadvantage is that such opacity re-introduces scaling issues, specifically
wallets (esp. mobile) have no way of efficiently querying for their own txs and must therefore download every shielded transaction and attempt to decrypt it
miners cannot prioritize the transactions without revealing some public amount, such as a gas fee, which breaks ledger indistinguishability
We see privacy and scalability being in a fairly fundamental tension with each other. The issues with amounts and destinations being public do exist with shielded pools as well, but at the boundaries.
As a thought experiment, consider a whale sending 100x the amount of any other transaction into the privacy system, either a shielded pool or a wormhole. If the whale exits the shielded pool or wormhole with a similar amount, then the balances will be easily linked, defeating the purpose of the privacy tool.
If instead the whale exits the shielded pool in many smaller transactions, privacy can be preserved. In the wormhole case, the equivalent to this is doing many wormhole transactions, each one with many outputs, breaking the large amount into smaller and smaller outputs until they are normal sized.
So I think the systems end up being roughly equivalent from this point of view. In the wormhole case, a blockchain observer would witness this progressive degradation of size until it became indistinguishable from the other wormhole txs. In the shielded pool case, this degradation would not be visible.
I think this is a reasonable price to pay for scalability. What do you think?
I’d have to better understand the technical tradeoffs of exactly how much less efficient the indexing would be for example, versus how much privacy is lost.
One undeniable and strong benefit of introducing a shielded pool would be making this system a strict technical improvement over other tokens, versus a new point in the tradeoff space which is more nebulous to reason about and communicate
I appreciate the desire for a free lunch, but the scaling tradeoffs are significant. If we consider pre-Tachyon ZEC or XMR, a mobile wallet must manually download every (shielded) transaction and attempt to decrypt it. It has no way of anticipating what a transaction to itself might look like, privacy concerns aside. From Sean Bowe’s article:
”Recipients identify incoming payments by trial decrypting every transaction until they identify payments sent to them. This simply does not scale.”
post-Tachyon, this issue is addressed, but with different tradeoffs. Specifically, the sender of a shielded transaction must inform the receiver with an out-of-band message. This removes the trial-decryption issue entirely, but also removes the ability for a user to recover their wallet with only a seed phrase. A user must also have copy of all unspent out-of-band messages to fully recover their balance. In my opinion, this severely degrades the user experience. It’s hard enough getting people to back up a seed phrase.
In comparison, Monero’s FCMP++ does nothing to address this scaling issue. It primarily improves privacy by replacing ring signatures with zk proofs, making it more similar to ZEC.
So having normal looking outputs to normal looking addresses lets users have a normal wallet experience. Fast sync, simple backup, less moving parts.
I don’t see it as a free lunch and understand it has scaling constraints.
Was suggesting it could be a stronger comparative advantage from a narrative perspective even if it does sacrifice scalability.
A toy illustration:
Scaling Score:
Privacy Score:
Quantus + Shielded is Pareto Optimal relative to ZEC/XMR vs Quantus as-is is a debatable point on the tradeoff frontier, even with quantum resistance. It may well be the best choice and some users would see that, however it isn’t trivially and obviously a pareto improvement.
Nontechnical users (read: almost everyone) can easily understand pareto efficiency but not complex tradeoffs that would make it difficult to surpass a huge network effect of existing alternatives
I do see why the narrative you propose would be desirable.
It’s not obvious how to make it happen because there doesn’t seem to be a natural way to preserve plausible deniability with a shielded pool. In the ZEC model, you enter the shielded pool by creating an encrypted note. I suppose we could have all transactions create encrypted notes and make the non-shielded ones have fake notes, but it seems like an awkward solution.
On the scalability side, we have to account for the post-quantum keys / signatures / proofs all being larger, which creates a significant scaling tradeoff to begin with. The proof aggregation in principle could be used with a shielded pool, which could reclaim scalability in the same way.
So I think it comes down to “how much is plausible deniability worth”? It’s a unique property and quite powerful, because it cuts two ways. You can deny having spent the funds or still having them.
Thoughts?
Plausible deniability seems extremely valuable yes. Its interesting that the fake encrypted notes would work similarly to wormholes as a facade to add yet another layer of plausible deniability.
Main point being that any and all levels of privacy and security will nonlinearly compound with each other. Scalability is important but in practice seems to be secondary to net new functionality.
As a case study there are N “eth killers” but very few have achieved any level of adoption because being faster alone isn’t a strong value proposition vs incumbent network effects