preserve privacy of swap users by obfuscating ETH contract somehow

[noot]

on the ETH side, if someone decodes the bytecode of the smart contract, they would be able to see that the participants were using a Swap contract and thus Alice now owns some monero.

I'm not sure of a good way around this, but definitely something that needs to be considered.

[alxs]

Is obfuscating smart contracts even a thing? Sounds pretty hard tbh, especially considering that Bob needs to verify the smart contract on his side.

[noot]

yeah I have no idea if this is possible or not, probably not unless we somehow throw it in some privacy-preserving L2 rollup or such (if that even exists). I just opened this to keep it in mind

[alxs]

Otherwise we can probably always resort to the 'hard' DLEQ option, i.e. doing it the Monero way on both sides - which would preserve privacy.

[Crypt0-Bear]

Onne possible solution could be zkSNARKs shielded pool similar to torndado.cash. It would still show money coming into the contract but would help add a bigger anonymity set since all the ETH could be pooled into the contract and it would help obfuscate the transaction flow between specific eth coming in and out.

[kayabaNerve]

Instead of shielding the contract, which shouldn't be considered possible UNLESS you aim to replicate Taproot on BTC though I do believe this would be sufficiently suspicious on Ethereum, I'd be more interested if instead of specifying an address, you specify deposit info in order to directly enter a protocol such as Tornado Cash. Tornado Cash specifically isn't ideal due to the denomination system, yet something like AZTEC (zero research on them from my end) may be more pliable? It'd raise gas fees for the relayer yet offer ETH privacy. It does require relayers to be effective thhouugh, see #33.

[0xTARC]

All of the options I'm aware of on Ethereum are:

1. Aztec Protocol

   • Use Aztec Connect to privately interact with any ETH Layer 1 Smart Contract. Provides transactional privacy. No actor can know who is doing something or how much is being transacted.
   • They also have grants! I think they'd be ecstatic about funding this development
   • You can see dapps that have currently integrated Aztec Connect here
   • Requires users to bridge to get zk assets

2. Railgun

   • Allows users to create txns with transactional privacy, without leaving Layer 1.
   • Good docs & friendly team in discord to help out. Docs on private cross contract calls..
   • Does not require any bridging. Does require users to "shield" assets within the Railgun contract, and pay small fee to Railgun DAO on withdraw txns.

3. Obscuro

   • Obscuro provides transactional AND computational privacy. Fully EVM compatible.
   • Requires deploying the contract on Obscuro's privacy preserving L2.
   • Very early, idk if there's even a mainnet yet
   • Requires users to bridge to the L2 to interact with the contract. You also have to inherit the security model of the L2 (node operators running TEE hardware. unsure of other details).

I think Obscuro is way too early and the fact that you can only interact with the contract on their L2 make it not very ETH native.

Would need more research to give an opinion on Railgun vs Aztec for this use-case

Would be fun to look at building a poc for one of these for an upcoming hackathon

[kayabaNerve]

With regards to Obscuro, it's not just the bridge which runs in a TEE. The entire privacy model does. SGX, the TEE they use, has been broken several times and cannot be argued as a privacy solution. It's a layer of additional security. No more, no less.

[noot]

@0xTARC thanks for the detailed comment! Would definitely be good to explore this issue more, I think Aztec or Railgun could be good solutions. I haven't looked into Railgun too much tbh, but I'll make a point of doing that.

At a high level, any sort of shielded pool should work. Funds will be "owned" by the contract, and the swap participants can validate the amounts transferred in the ETH locking step via a private view key or equivalent.

However, I think the simplest thing that can be achieved here is confidentiality of swap amounts. If the contract is modified to allow for relayers for both ETH locks and claims, then it could also achieve (better) anonymity for swap participants.

Let me know if you end up working on this or doing any more research, would love to chat about it!