Are Secure Private Transactions on Public Blockchains Really Possible? Help Us Find Out.

The world of blockchain technology is really split in two today. On the one hand, there are big public networks like Ethereum with billions of dollars of investment and millions of users. On the other hand, there are thousands of private blockchains run by enterprises. Enterprise use of public blockchains is very limited because there is no privacy for business transactions or contracts.

Our goal at EY is to bridge this gap between public and private blockchains by enabling secure private transactions over public networks using Zero Knowledge Proofs. And we think we have done it.

What we are showing (below) is a supply chain solution based on EY’s Ops Chain platform that is used today by private networks for managing and tracking supply chain operations, but all executed on the public network with zero knowledge proofs. What you see here is a prototype (We call it the Ops Chain Public Edition Prototype) and we’d like your help in finding the holes in our work. This platform leverages Nightfall to provide privacy

Can you tell us who sold what to whom and how much it cost?

Aim of the Grand Challenge

There are products travelling through a supply chain process from supplier to manufacturer to pharmacy with the help of a transporter. The aim is to find how many of what products are sent to manufacturer and then how many products of each does the manufacturer assemble to create how many number of final products in order to send to Pharmacy. Also who has paid how much to whom for each of the services provided. The diagram below provides a good illustration of the question.

What are the ZKP Protocols used and what do they accomplish?

In this work, we use an approach that provides a solution using Zero Knowledge Proofs. Any asset that needs to be tracked is tokenised into a non-fungible token commitment while any payment that needs to be made against this asset is tokenised into a fungible token commitment. Processes are built over the movement of these token commitments using business logic executed through smart contracts. But to maintain privacy for business operations regarding what asset has been transferred between which two parties and how much was paid for it, we use 7 different ZKP protocols.

The zero knowledge proofs for these protocols are generated off chain while the verification of these proofs happen on chain.

The protocols are:

• Fungible Token Mint : Creates a fungible token commitment on the blockchain that holds value equivalent to the amount deposited to the OpsCoinShield.sol smart contract. The amount deposited can be in the form of any ERC20 token such as Ether. In this example, we use Dollar Tokens created using OpsCoin.sol for depositing. Privacy - Minting is intended to be done from a known address and the value of minted token commitment is known. From the moment the token commitment is minted, nothing about what happened to it after is revealed.

• Fungible Token Transfer : Any fungible token commitment can be transferred from an owner to a recipient. Privacy - Transferring is intended to be done from an anonymous address of the sender, the recipient as well as the value of the token commitment transferred isn't revealed.

• Fungible Token Burn : Enables to withdraw the value held in a fungible token commitment back into an ERC20 token such as Ether or Dollar Tokens. In this example, Dollar tokens created using OpsCoin.sol will be withdrawn. Privacy - Burning is intended to be done from a public address and the amount withdrawn is known.

• Non-Fungible Token Mint : Creates a Non-Fungible token commitment on the blockchain that represents an asset by holding the asset hash derived from storing the asset's meta data on swarm. Privacy - Minting is intended to be from a known address, whilst the asset represented by the asset hash in the token commitment isn't revealed.

• Non-Fungible Token Transfer : Any Non-Fungible token commitment can be transferred from an owner to a recipient. Privacy - Transferring is intended to be done from an anonymous address of the sender. The recipient as well as the asset held by the token commitment aren't revealed.

• Non-Fungible Token Join : The assets stored on swarm are hierarchical in nature. This protocol enables an asset token commitment to be joined with another asset token commitment. The joined asset along with it's meta data is stored in swarm and a new token commitment is created on the blockchain using the resulting hash that represents this combined asset on the swarm while nullifying the original individual token commitments. Once joined, the new token commitment can be kept by the current owner or transferred to another recipient. Privacy - The sender, the recipient, the first asset that was joined, the second asset that was joined and the joined asset are not revealed.

• Non-Fungible Token Split : This protocol enables an asset token commitment to be split into multiple asset token commitments. These new assets along with their meta data are stored in swarm and new token commitments are created on the blockchain using the resulting hashes that represent these split assets on the swarm while nullifying the original token commitment. Once split, the new token commitments can be kept by the current owner or transferred to another recipient. Privacy - The sender, the recipient, the original asset split and the split assets are not revealed.

These protocols are used in the movement of all assets and payments on a public blockchain to ensure privacy.

Contracts

• Verifier.sol : This smart contract verifies the zero knowledge proofs for all protocols specified, returning a boolean on success or failure.

• OpsCoin.sol : This is an ERC20 token smart contract that mints Public Dollar Tokens used in this example. Private Dollar Tokens can be minted by depositing these Public Dollar Tokens to the OpsCoinShield.sol smart contract. Also, Private Dollar tokens can be burnt to withdraw Public Dollar Tokens using the OpsCoinShield.sol contract.

• OpsCoinShield.sol : This smart contract acts as a shield by hiding the association of fungible token commitments and their nullifiers. In order to mint, transfer or burn, a transaction is sent to this smart contract which then verifies the proof by calling Verifier.sol and adds the relevant token commitments to the token commitments list tree and nullifiers to the nullifiers list array.

• TokenShield.sol : This smart contract acts as a shield by hiding the association of non-fungible token commitments and their nullifiers. In order to mint, transfer, join or split, a transaction is sent to this smart contract which then verifies the proof by calling Verifier.sol and adds the relevant token commitments to the token commitments list tree, nullifiers to the nullifiers list array and double spend preventifiers to the double spend preventifiers list array. The double spend preventifier does what its named after, ensuring no two token commitments hold the same asset.

Data Store

Swarm - Swarm is used as an off chain distributed storage for asset meta data. The hash returned after storage of an asset is used to represent an asset uniquely and is used in the making of the token commitment that represents this asset.

The swarm public gateway run by Ethereum foundation is used here. https://swarm-gateways.net/

Information required to get you started on answering the challenge

List of Ethereum Addresses

• Coinbase - 0xad70676fdfd0e04d62a3c2d623de04dd8940c642
• Supplier 1 - 0x70623d1c3a316ae22be376374e25476bd308e263
• Supplier 2 - 0x5292606982b9f0db32c56686741f76d133d4c924
• Transporter - 0x6b9e39a04251070a8c5db2ffc8a0ba7972a41478
• Manufacturer - 0x8ae3eff37db50fac1da0d79965154d9cb7523eeb
• Pharmacy - 0xf9ff784b87688e4c32c588f882caf13c6167d70f

List of Contract Addresses

• OpsCoin: 0x09b2d8b8741538abf56f47be76e37aed31f00e0d
• OpsCoinShield: 0xe8d9f21b6b351c6bf993b1105497fe42d30df8bf
• TokenShield: 0xeb7160d9fba402219ea868bc311e7d98688d3180
• FT Mint & Burn Verifier: 0x6b98f17897a5086ff3e7357290b36022798d8850
• FT Transfer Verifier: 0xcb4ccc716abe1b5be15870e2bfa12bf5f0b501e6
• NFT Mint Verifier: 0xc5daef66b7752d9c5920c15e9e0145aa839843f3
• NFT Transfer Verifier: 0x8d993aaf8e92c2027a5358b9914392050b03356d
• NFT Join Verifier: 0xf8cb6400dcf523bf6397a79bccd35a6af1a88edd
• NFT Split Verifier: 0xb065dcb7651b448e042a0acc729ae64d2ea3ba51

List of Anonymous Ethereum Addresses of the above players

• 0x5a812eb611c72c9b94fbb6876b5f49bcc6e41945
• 0xb61499e29eb7947c59ed82cf9c360d01dd9e5e0c
• 0xa9f91a59b1b5d76334de878dd5dc7627ee748e35
• 0x81caa8ddc289fb7310d2ce1c5e8231f1d7ee9754
• 0x04734be5baa73c907527f03b0a938587f2d3ce61
• 0xc767957dccc903e9969d9bd00c429547de752798
• 0x2250ddc2609d2dcc525a8cdbf8ef20da0b9e408a
• 0x056bd6e88c761faa26cc927ef3fcd907dea77d3b
• 0x9f4abe21c039737a92c4c93715578a4bd344d4ab
• 0x700ec2a9d659a7af8dd9e4c583d782f308878624
• 0x5aba0f87d89f5b96eeb0c16233c357231ebb909b
• 0x643e47ba204d3b4b98e8c2210c104240d37ea7aa
• 0x5e84ed0071e5df742a8052411d5bd292f9294cff
• 0x16a0dcfaf9a495f60afa5aaa298af662f4b97e98

Other relevant information

• First Block: 6477282

• Last Block: 6485984

• First Tx Hash: 0x5e608f6caca686b3a3e7a901efdfcc94bc9a593891d7b8f910273ff56f9f1822

• Last Tx Hash 0x83007c1a4af2ef1487fe020c1ea2f343c552d187a2f6aac52720abbefe5470e7

Limitations

• The usage of the terms 'fungible' and 'non-fungible' for token commitments means that the token commitments hold fungible or non-fungible assets by nature. It does not imply that the token commitments are tokens themselves that are ERC20 or ERC720 standard compatible.
• It can be noted that inputs to proof verification are of 64 bits in length. Generally, this length is not secure against brute force attacks. In the later iterations of this work, these will be changed to 256 bits.
• Various performance improvements can be made to make the contracts more cost efficient such as using trees in place of arrays to hold nullifiers or double spend preventifiers. Upcoming iterations of the work will address this.
• The maximum number of token commitments that the merkle tree currently holds is 256. The next iteration will increment this for practical use.
• The usage of the term 'public dollar tokens' implies that OpsCoin is a stable coin that represents a dollar.
• Some of the work for fungible token here is inspired by ZCash