Tornado Cash Deep Dive: Smart Contract Analysis & Code Walkthrough

[00:00:01]hey everyone uh welcome to Deep dive so this one is a little bit different than previous deep dabs in the past I've always had a guest um but this one couldn't find a guest so decided I would just do it myself um and this one also is different because it's not an oracle uh we've only in the past had oracles this one is not normal this one is on tornado cash which we thought would be good because it's kind of very very relevant um so I'm going to just this one I'll give kind of an overview of tornado cash and how it works and then I'll probably even Deep dive into the code a little bit at the end because it's actually really really short I don't think I'll be nearly an hour like I am most of them and then spuddy is behind you guys on the camera hey he'll be asking all the questions that will hopefully make this talk palatable for everyone so what is tornado Cash Tornado cash is a privacy tool it is Mo a lot of people consider it to be a mixer so you put ether in pull ether out you can't tell where it came from so you can change addresses and nobody knows where it came from um the big way I'll just sort of draw it here um so there's this smart contract which is um tornado cash and then what happens is so you'll have Alice Bob and his buddy and they each they'll each deposit one eighth and they'll place it into this smart contract and then to a bunch of random addresses so they probably newly minted these things [Music] and then they pull out these so each of them get 20. now as you guys can tell um I pin myself [Music] okay so as you can tell it's all the exact same amount of heat the reason is is that each one of these corresponds to each one of those people and addresses and if Alice had 10 and this person at 10 you would probably know with a high likelihood that that is LS that's actually so what they do is they actually just fix it at a deposit amount so each smart contract actually so there's a bunch of tornado tornado Cash Smart contracts some of them will be for one each some of them will be for point one each some of them will be for Tenny and you can go and pick um and there's sort of different liquidity in there um other things as far as best practices and how it works you can tell how is sort of anonymity achieved here the way that it's achieved is because we're all putting funds in and then you can't tell which ether goes to who so the more people you get in here the easier you can the harder it is to tell where it came from if Alice was the only one who put money in and then pulled it out it doesn't work like that uh everybody would know it's her in the same way if Alice deposits it and then one second later pulls it out you'd probably have no that that's probably Alice who did that so you want to put it in there and then wait sometime before you can pull it out and that's sort of the best practices of how it works um I think like in a nutshell that's actually just tornado cash so like if you wanted to stick at a super high level um this is it um it's it's not very complicated but what we're going to do here is get into why it actually is complicated and how this actually works so we'll work on a deposit [Music] okay Mike can you hear me too you're good yeah so whenever you place in uh we'll just use the one eighth example so whenever you deposit one eighth so it goes like this so you deposit but you have to deposit it with what's called a commitment um the commitment here so in in tornado cash V1 it's um the commitment is just it's the hash of um so you have a secret so you can just pick a random number that's like keep it keep it you know your seed phrase or whatever this is this is your secret um and then what's called a nullifier um a nullifier again just you can pick a random number that's both of these are kind of secret numbers but for purposes we're going to call them different things so you would input in a commitment with this and with this commitment what happens is you deposit it uh the smart contract makes sure that you transfer it one eighth and then it takes your commitments here and then with your commitment it places it into a Merkle tree so [Music] look over here and we're gonna draw it's Buddy yes does the contract give you the commitment when you you go to tornado cash you say because personal buddies never used it so uh does it uh does it give you the commitment yeah you he so like there's scripts that you can run like I I don't actually I don't need to but I've never actually used the front end uh so I've I've just I used the scripts and yeah so it can give you it can even give you a secret and it can tell you what that is too um but you might not want to use the automated tools to make your secret okay so um so when you yeah go there there's automated tools to give you those numbers you put in your wreath and you can wait and put them in on the other side which is what you're getting at yeah which and how it is so there's some other things that you actually have to keep track of whenever you're going to claim it so you don't just need your secret and then you can go and claim it um now because the problem is so this so in a Merkle tree it's the so Marco tree is like this and this will make sense so we're actually going to look at the code afterwards so it'll actually make more sense whenever like you're like why is he going into this so let's just do like a Merkel tree here so um these are the roots of the Merkle tree they're called um and this will be like uh so like zero X buddy so this will be spuddy's commitment this will be Alice this will be uh Bob and this will be Mike um you know it looks like a address it's about longer so bytes 32. and then the next one up so on the tree uh this this is the hash of these two and then at the very top this is the hash of the bottom these two sort of makes sense so far so you just take these ones in hash and get this take these two I shouldn't get this one so if you wanted to um whenever somebody gets a commitment what it does is it'll place his commitment in here we'll say this one was empty it placed it in here and then this hash changed and this has changed these ones didn't so now in the Merkle tree this is where it is now spotty's commitment is in this Merkle tree now what he could do what you could do is just kind of like somebody asked like with the secret you could come and say like hey I know the secret and I know the nullifier give me my eat then he could put that in his input in His function and go and claim it the problem is is everybody would see hey oh you'd see my address called he knew yes buddy put in the same commitment as buddy before yeah so that doesn't work um how do we actually keep it Anonymous here and so we need to use zero knowledge proofs um and so whenever we placed it in the mergo tree well we're actually going to prove with zero cash or with tornado cash to make sure that it's Anonymous you're going to prove a that you know this Secret so then you can get it so you know the secret and the nullifier but then you also know hey I know it's somewhere in this Merkle tree and that's that's actually what the code is doing so what it's saying is hey I know the secret and this one somewhere in this Merkle tree is my commitment and so whenever you're inputting it you need to actually keep track of so like for spuddies you would have this whole Merkle tree you would need to keep track of so that this route that you're so whenever you deposit it it actually returns to you the location in the Merkle tree you keep track of this you would need to know Alice's as well because you need to calculate out the hash all the way up so you need to know this one this one this one this one so you keep track of all of those they're called path elements um and path indices in the Myrtle tree so then you would input these as part of your proof so then you're like hey this is whenever I put in my secret and my nullifier it corresponds to this one in the Merkle tree and then it says okay so now all the smart contract tells which we'll get into how's your knowledge proofs work a little bit but basically you're you're not saying I know the secret you're saying I know the secret but you're also saying and it's somewhere in the Merkle tree but I'm not telling you where that's what you're telling it with um cash and then it allows you to pull it out so questions so far in the high level stuff I guess before we jump into the code no Mike yeah the zero knowledge stuff is still a little fuzzy to make threes can you hear me I think I might be freezing hopefully this reporting isn't bad okay Mike Owen any questions uh um he asked a question I don't even know if I have a question but I think I'm lagging I heard you're fine oh Okay so [Music] now we're gonna come and we're gonna actually look at some code hopefully I'm not too laggy um recording all right it's Buddy says for the recording it'll be fine sorry um okay so now I'm gonna share my screen here and we're going to get started okay so um for sharing my screen um the big thing that you guys should know so tornado caches code is down um this is a problem so I luckily I have some tornado cash code that was already on my computer um we can walk through it but I am going to update we're actually not going to walk through it because we're going to walk through it a fork of it and the reason is is that in the tornado core code um I can show you so down here in the dependencies you'll see that a lot of these um dependencies were actually specifically so like circumlib and and they pin various ones also it's super old um so whenever you do like an npmi it just breaks um same with running all their tests all their tests were broken but basically because a lot of these libraries have changed over time and they didn't actually keep up with it so tornado core is actually broken we can go over the contracts but it actually doesn't work anymore if you just wanted to like Fork it and run tests or make it work um but this person chi chang Liang who I actually have no idea who they are um they forked tornado cash and implemented Poseidon so Poseidon is the newer hash it's a newer hash function um that's more gas efficient and they put it in there um and they made all the tests work and updated all the dependencies so we're going to use their Library um because actually the code is exactly the same everything except for which hash function you're using so we'll walk through their code which like I said is is completely identical to um sorry wrong wrong okay so we'll clone this down [Music] get started um I'll do okay all right so that's in here but in tornado core you'll see this structure and it's it's actually the exact same as here um minus this one was built but there's two main structures in the tornado cash contracts there's um stuff the solidity contracts here and then there's the circum files these are the circuits this is where there's kind of the zero knowledge proofs the bread and butter um and we'll kind of get into that so in the solidity contracts first um the big file that you're actually going to want to know is tornado.soul so tornado [Music] tornado.soul this is where a lot of the functionality is um you'll see there's the deposit function there and this just takes the commitment or I guess we can back up even so in the Constructor so it takes a verifier so this verifier contract is here um you'll see it actually is a symbolic link because they we have to build it it's created not actually as part of the zero null proof process which we'll get into um the other things you need is a denomination so this is like 0.1 E20 that was the thing that we're talking about Merkel tree height um that's just how big your numerical tree is um they use 16 for tornado crash I think there's probably pros and cons of relative to gas and storage costs and then the Hatcher so um the internet we're going to be using Poseidon for ours but they used Mims for tornado cash I know the names are awful um but you you can basically just place that in uh the hasher also you'll look and you'll be like where on Earth is the hasher so in like the tornado contracts it'll be like I don't see the Hatcher contract anywhere where where on Earth did the hasher contract be and that's because they actually build it so you'll see down here in the scripts um it has compile hasher no space um and that's because it's like a pre-compiled one so circom uh you can actually do a lot of these pre-compiles that make these solidity files and it'll just be byte codes there is no solidity that matches any of this it's all just byte code and it does hatching functions in a crazy efficient way um which is why I guess I need to show to announce that those guys um so over here this is the group that makes all the circum stuff uh this is Iden three I think there are EF grantees so ethereum Foundation supports them um and they do all of the snark.js libraries they do anything you're doing with zero knowledge groups they're probably behind it in a lot of ways um I'll link to their website this is their their main repo and you can see here Jordy balina um I've watched this talk like a million times he I think he works at polygon now but yeah he he did a lot of the zero knowledge stuff for Biden and super great resource basically none of this would be but like you'd have to write your own zero knowledge circuits uh if it wasn't for those item guys so if you're wondering where the hasher contract is you just have to run a script which is weird when it says yeah whenever you're doing solidity files I know that took me a super long time to come so back to the tornado contract um so after you have the Constructor done you'll see this is a tiny contract for like halfway done with it um the next piece is the deposit so I explain to you guys what the commitment already is hopefully you guys understand that but yeah all you need is so process deposit here that's what um it takes your 18th uh so it just takes one Ethan puts in inserts so this is inserting it into your Merkle tree the commitment uh the Merkle tree insert that's this um somebody else wrote this um I think I think tornado like slightly edited it's just a just marble tree code so it's it's a Merkle Tree in solidity it's not nothing special to tornado cash you're just making a Merkle treat in even its history um next what you're gonna do so this is so then there's there's a few more functions there's just uh withdrawal which will show and then there's is spent and is spent arrayed to check if you already withdrew so that that's it um but what you're going to need is you're gonna need a few things so you're gonna need a proof so the proof is what we'll get into once we actually go look at the circum files um that's what you generate using zero knowledge proofs and that's where you need a bunch of that input you're gonna need the root so if you remember on my Merkle tree this was like the bottom route number of your marble tree where your thing is located uh you're gonna need your nullifier hash so this is a hash of your nullifier it's to make so they're gonna make they're going to verify that that matches so your nullifier needs to match and then you're going to need a few variables that aren't included in kind of that proving process mainly a recipient so what address are you sending this to and then there's also a relayer and a fee so the relayer in the fee with tornado cash as you can bet like maybe maybe you don't want to you know run a function to go claim your eth because then people might be able to see that you claimed it with you know even if you're sending it to somebody else you know you got to claim it with a wallet that has gas in it exactly how do you get the gas right so what you can use is called a relayer and say that you'll pay them a fee so you can say hey I'll pay you point you know I'll pay you one percent of it if you pull it out to my address and that works and that's actually included in the proof as well so um it's super cool because it allows you to have somebody else that has gas in their account pull it out for you um a lot of regulatory issues around being the relayer right obviously right but fun stuff um okay so now we'll get into the code and just go down it uh require that you know the fee has to be less than the amount that's easy uh require the nullifier hashes whenever you spend it so it keeps track of these nullifier hashes because at the end of this what it's going to do is say that the nullifier hash has already been sent out so you can't claim twice you basically this is what it's saying you can't go back and claim uh another one is it's going to say is known root so this is going to look in that Merkle tree for that route and basically it's just going to make sure that hey is your root a normal trade like that's just sort of a sanity check to begin with um and if so once those twos pass that okay now there's the known roots and then all of our hash then we're gonna do verify proof uh which we'll get to uh at the end which so we're going to skip over this for now just because that's the whole Magic of the circumfiles um but what you'll need is it obviously passes all that stuff into that function and then what it's going to do at the end is set an old fire hash equal to true so you can't withdrug in and then it's going to process withdraw meaning it's going to send out the money to the recipient and the relayer and that's it um at the end here there's two functions is spent and is spent array you can call and check on nullify hashes to see if the person has already claimed them cool I mean that that's it that's the tornado cash code it's super simple super special but what is what is this and let's kind of get into it a little bit here okay um so first I'm gonna run after you've npmied in your library now you can run npm run okay so let's see what build does okay so build is actually going to create a whole bunch of files uh and it's going to take a long time um but we'll kind of get into it and what it's doing is it's making all these elliptic curves and zero knowledge things and making it work and it's creating your verifier.soll file which you're going to use and which we'll get into it but what are circom files so circumfiles are the things that you're going to compile down into your verifier.sol for tornado cash the main one is called withdraw.circum and we'll just kind of walk through it they're actually not that hard to read um you'll see the verifiers the weird mathy thing that you have to read rating Circle isn't that difficult it's difficult in the sense that there's like very limited error messages and there's not even color coding on the files yet um because it's just a super new language but it's it's actually not that bad um to pay attention to so we'll walk down uh you can see okay so on withdraw what do we need Okay so so it's going to include a few libraries from poseidon.com so these are like the hasher libraries the circle library people make for you um but what's going to happen is you're going to need these inputs are what you actually need to input in so if you remember back from our tornado piece we have some inputs we have the proof and then the root nullifier has recipient relayer fee and so whenever you come over to the withdrawal you'll see the root you need to input it the nullifier hash recipient relay and fee you can see they actually don't take part in any applications they're just there um I I want to ask somebody I guess why that is like maybe it's just like if you add more things it confuses people but I actually don't know why they put it in and it's not saying important any conversation um and then what you're also going to need to put in so you can tell at the end here when it says component main public so which ones are public the root that nullifier has the recipient relayer and feed and you can remember these are public ones so people can see these whenever they're inputting it but the rest of the private ones are all handled via so the private ones you're just going to calculate a proof that you know them not necessarily show them to anybody and that that's where the zero knowledge stuff comes in so which one what do you need as far as [Music] the private ones and you need the nullifier and the path elements [Music] so the nullifier so what's it going to ask you um the nullifier basically you know the nullifier that you used in your earlier commitment it's going to make sure that that matches the nullifier hash that you put in publicly uh so therefore you need that and then it's also going to need those path elements and path indices those are the locations on your country so that way you can prove that hey use given these paths in this Merkle tree I can prove that mine is somewhere and that's all you sort of Need for inputs um we can walk through I mean we can even walk through the tornado 401 I mean now we're on a slightly different one but they updated it because like here they actually bring in the secret too so we we'll use the real ones so you can see the other ones are the exact same um I thought they looked different so uh you're bringing in the secrets and all of our hash and then what you're doing is you're making um you're checking here this triple equal sign make sure that the nullifier hatch that this hasher for this hasher is in like Mr Brown hasher matches the one that you put in publicly that way you can't be lying about it so it's going to Hash the secret and the the nullifier on its own and then calculate out the hash and make sure they're matching so that proves that you know the secret and that you know the normal fire now let's get on to verbal tree Checker uh Merkel treat Checker is basically it's going to go over to this circumfile which is this is a Merkle tree built in a circle and we'll just kind of skim through this but basically it's going to check that on your lease so the far one the far one so the commitment that you put so you remember somebody's commitment at that far root uh a that that's your commitment and then that the root is equal to your root so the one that you're pointing to is equal to the one [Music] and then here uh it's going to put in all of these so it's going to make sure that the elements are all the same so that the tree that you're trying to claim from is in fact all valid and that's about it um yeah um these other ones aren't used in anything um oh here we go yeah add hidden signals to make sure that tampering with recipients or fee will invalidate the start proof there you go um there you go I answered my own question by reading reading my contracts actually um so don't do that better stay on the safe side so yes purely mathematical so basically they're making sure that you don't mess with it um actually in the code which is cool cool we all learned something today okay so back to tornado um what happened so after we ran if you saw npm run build is done so we'll actually go up to now to our Poseidon library and we'll come to the verifier contracts and this is this was created by the circum Library people so whenever you run it's we can see the command here in the package um so you run npm run compile circuits and then it runs this quick setup script here which has like npx snork JS prepare and it's all these phases of zero knowledge grooves um and what it's going to do is it's ending with building this verifier solidity file and this is the verifier you'll see I'm not even going to attempt to walk you guys through this [Music] um because it's a whole bunch of matte that's above my head um at some points hopefully I can get into it but the only public function in here is the one at the very end which is verify proof this is the one that you call from your smart contract library and it needs your proof and then it verifies that all of those private inputs and public inputs that you had in there were valid and then it will either return true or false and that's sort of the magic of it so it generates all of those numbers up there based upon the keys and the inputs and then we'll return true somehow right now it's still magic to me but I'm sure there's somebody like Jordy Ballin Out There who wrote this that can explain to you how it actually works Okay so now I think that was about it for this Liberty code um which you can see too so if you if you want to use it via scribs how would you do that um so if you come down to tornado core there actually is a nice Library down here called clyde.js so this is like the client you can run like creating a deposit um so if you wanted to create a deposit you need to input a nullifier and a secret and then yeah it just will return to your deposit which is kind of cool um you'll see here like if you deposit you can even just run deposit a currency in an amount um it creates a nullifier out of a random number and a secret out of a random number um and then if it's it'll go through and actually make everything for you and then it'll spit out all the different things that you need to know um which is super cool so same here generate Miracle proof so you you got your deposit up there all you do is you run generator remarkable proof it'll make it'll sort of do the deposit and then it'll get so it returns to you that commitment that you're going to need and then it makes a new maple tree grabs all the leaves from it all the things that you need to input and it'll return to you those little things that you need down here at the end your route your path elements your path indices so sort of cool they've done a lot of work made it um made it work so kudos to them um anyway we'll see you guys can still here I just realized I'm like behind the mic um Mike could you hear me just fine yeah you sound great anyway I guess not we'll see uh anyway that's it thank you for listening we'll see what um what you guys think of that hopefully it was okay um if you have any questions happy to kind of answer it and yeah that would make sense I hope this helps some thanks