The week a smart contract was sanctioned

Part 3 of Zero Knowledge, Full Proof, a series on zero-knowledge proofs and privacy on-chain.

On 8 August, the US Treasury’s Office of Foreign Assets Control (OFAC) added Tornado Cash to its sanctions list [1]. According to the Treasury, the mixer has been used to launder “more than $7 billion worth of virtual currency” since 2019, including “over $455 million” stolen by the Lazarus Group, a hacking group sponsored by North Korea [1]. Mixers have been sanctioned before: OFAC designated Blender.io in May [1]. What is new is what Tornado Cash is. It is not a company that holds its users’ money. It is a set of smart contracts on Ethereum, and in May 2020 its developers handed the keys that could change those contracts to an address nobody controls, so that no one can modify or switch them off [2].

Part 1 of this series described zero-knowledge proofs as a way to check a claim without seeing the data behind it. Tornado Cash is the best-known application of that idea to money, and the three weeks since the sanctions are a lesson in what the mathematics can and cannot do.

Three weeks in August

The effects spread well beyond the contracts. On the day of the designation, GitHub took down the project’s code and suspended the accounts of several contributors [3], and Circle froze at least 75,000 USDC held at the listed addresses [4]. The next day, Infura and Alchemy, two of the most widely used services for reaching the chain, cut off the Tornado Cash website, although the contracts still answered anyone who called them directly [5]. On 10 August, the Dutch fiscal investigation service, FIOD, arrested a 29-year-old man in Amsterdam on suspicion of helping to conceal criminal money flows through Tornado Cash [6]. Then the front ends of lending and trading applications began screening addresses. dYdX blocked accounts with links to the mixer [7]. Aave’s front end briefly blocked wallets that had merely been sent small, unsolicited amounts from it [8]. And on 20 August it emerged that Uniswap’s front end had blocked 253 addresses over the preceding months, mostly for stolen funds or mixers [9].

How a mixer uses a zero-knowledge proof

Tornado Cash’s design fits in a three-page whitepaper [10]. A deposit is a transfer of a fixed amount of ETH (each pool takes one amount, such as 0.1, 1, 10 or 100 ETH, and some pools take tokens such as DAI [11]) together with a commitment. The depositor picks two random numbers, a nullifier k and a secret r, and publishes only their hash, C = H(k, r). The contract adds C as a new leaf of a Merkle tree of height 20, which holds every deposit made so far [10]. Both hashes, a Pedersen hash for the commitment and MiMC for the tree, were chosen because they are cheap to compute inside a circuit, the problem from part 2.

To withdraw, possibly weeks later and to a fresh address, the user submits a zk-SNARK proving that they know the k and r behind one of the leaves, without saying which, and reveals the hash of the nullifier, H(k) [10]. The contract checks the proof, checks that this nullifier hash has never been used, and pays out. It is the same nullifier idea Zcash uses, from part 1: it stops a deposit from being withdrawn twice while revealing nothing about which deposit it was. The proofs are Groth16 [10], and their parameters come from a trusted-setup ceremony held in May 2020 with 1,114 contributions, the largest of its kind at the time [12].

Why the proof is not the whole story

The proof guarantees that a withdrawal could have come from any deposit in its pool. The privacy a user actually gets is smaller, because people leave traces that no proof can hide. Two studies published in January put numbers on this [11], [13]. Between them they look for four kinds of trace.

The first is address reuse: a withdrawal to the address that made the deposit, or to one visibly linked to it.

The second is a distinctive gas price: a user who sets an unusual fee on both the deposit and the withdrawal has signed both.

The third is a pattern across pools: depositing 0.1, 1 and 10 ETH into three different pools from one address, then withdrawing the same three amounts to another address, stands out, even though each proof reveals nothing.

The fourth is anonymity mining: claiming the TORN rewards for leaving a deposit in the pool reveals exactly how many blocks it sat there, which narrows the candidates.

Tutela, the first study, found that of about 97,300 Tornado Cash deposits, some 42,800 were potentially exposed by at least one of these heuristics, and that the effective anonymity set of a pool shrank by 37% on average [11]. The second, by Wang and colleagues, found that combining its heuristics made it about 52% more likely, on average, to link a withdrawal to the right depositor, and that anonymity mining did not always help, because the rewards attracted users who reused addresses [13].

The lesson reaches beyond mixers. A zero-knowledge proof hides its witness perfectly. It cannot hide the behaviour around it.

Mixers and privacy coins

Tornado Cash adds privacy on top of a public chain, as an application. Privacy coins build it into the protocol itself. The difference decides who stands out.

	Tornado Cash	Zcash	Monero
Privacy is	opt-in, per deposit	opt-in, shielded addresses	on for everyone
What is hidden	the link from deposit to withdrawal	sender, receiver and amount, when shielded	sender, receiver and amount
Main technique	a zk-SNARK	zk-SNARKs	ring signatures, stealth addresses, RingCT

Zcash’s shielded transactions, described in part 1, hide the sender, the receiver and the amount, but shielding is optional. Its NU5 upgrade on 31 May added a new shielded pool, Orchard, built on the Halo 2 proof system, which needs no trusted setup [14]. Monero takes the other path: it hides the sender with ring signatures, the receiver with stealth addresses and the amount with confidential transactions, for every transaction by default [15]. Its upgrade on 13 August raised the ring size, the number of possible senders mixed into each input, from 11 to 16 [16].

In January, Haseeb Qureshi of Dragonfly gave four reasons why privacy coins had not taken off [17]. First, people want privacy for the assets they already hold, such as bitcoin, ether and stablecoins, not a separate coin. Second, privacy still has too much friction to be the default. Third, most people, judging by what they do rather than what they say, do not care much. Fourth, regulators go after privacy coins first. He also noted that fewer than 10% of ZEC was shielded [17].

August put these trade-offs in sharp relief. Opt-in privacy makes the people who opt in conspicuous, and in a mixer the only cover a user has is the other users: when the pool itself was sanctioned, every deposit in it became suspect on the same day. Default privacy avoids the conspicuous user, but it makes the whole coin the target, which is Qureshi’s fourth reason.

What the sanctions leave open

Three weeks on, three questions remain open.

The first is legal: whether code that no one controls can be sanctioned at all. The Treasury’s release treats Tornado Cash as an entity and prohibits US persons from transactions involving it [1]. Coin Center, a policy group, argues the opposite: “By treating autonomous code as a ‘person’ OFAC exceeds its statutory authority” [18].

The second is practical. The contracts cannot be stopped, but almost everything around them can: the code host, the stablecoin issuer, the node providers and the front ends, each of which acted within days. Censorship resistance at the base layer does not extend to the services most people use to reach it.

The third is for anyone building with zero-knowledge proofs. The cryptography was not what failed in August. What proved fragile was everything around it: who else is in the pool, what users reveal at the edges, and which intermediaries they depend on.

What comes next

Tornado Cash’s proofs rest on the parameters from its 2020 ceremony, and in May Zcash launched a new shielded pool on a proof system that needs no ceremony at all. Part 4 asks what a trusted setup actually is, why projects go to such lengths to run one, and what a large quantum computer would do to the proofs built on it.

References

1. US Department of the Treasury. U.S. Treasury sanctions notorious virtual currency mixer Tornado Cash. Press release, 8 August 2022. home.treasury.gov. Archived copy: 10 August 2022.
2. Alfredo de Candia. Tornado Cash becomes trustless. The Cryptonomist, 21 May 2020. en.cryptonomist.ch.
3. Thomas Claburn. GitHub courts controversy by suspending Tornado Cash developers and reneging on cookie commitments. The Register, 10 August 2022. theregister.com.
4. Osato Avan-Nomayo and Aislinn Keely. Circle freezes USDC funds in Tornado Cash's US Treasury-sanctioned wallets. The Block, 8 August 2022. theblock.co.
5. Osato Avan-Nomayo. Infura and Alchemy are now blocking access to Tornado Cash. The Block, 9 August 2022. theblock.co. Archived copy: 16 August 2022.
6. FIOD. Arrest of suspected developer of Tornado Cash. Press release, 12 August 2022. fiod.nl.
7. Vishal Chawla. dYdX confirms blocking user accounts tied to Tornado Cash. The Block, 11 August 2022. theblock.co.
8. Osato Avan-Nomayo and Frank Chaparro. Aave says on-chain wallet address censorship would require DAO consensus. The Block, 15 August 2022. Archived copy.
9. Tim Copeland. Uniswap has blocked 253 crypto addresses related to stolen funds or sanctions. The Block, 20 August 2022. theblock.co.
10. Alexey Pertsev, Roman Semenov and Roman Storm. Tornado Cash privacy solution, version 1.4. 17 December 2019. PDF.
11. Mike Wu, Will McTighe, Kaili Wang, Istvan A. Seres, Nick Bax, Manuel Puebla, Mariano Mendez, Federico Carrone, Tomás De Mattey, Herman O. Demaestri, Mariano Nicolini and Pedro Fontana. Tutela: an open-source tool for assessing user-privacy on Ethereum and Tornado Cash. January 2022. arXiv:2201.06811.
12. Mike Orcutt. Ethereum mixer Tornado Cash completes its trusted set-up ceremony. The Block, 13 May 2020. theblock.co.
13. Zhipeng Wang, Stefanos Chaliasos, Kaihua Qin, Liyi Zhou, Lifeng Gao, Pascal Berrang, Ben Livshits and Arthur Gervais. On how zero-knowledge proof blockchain mixers improve, and worsen user privacy. January 2022. arXiv:2201.09035v1.
14. Electric Coin Company. NU5 activates on mainnet, eliminating trusted setup and launching a new era for Zcash. 31 May 2022. electriccoin.co. Archived copy: 4 August 2022.
15. The Monero Project. What is Monero (XMR)? getmonero.org.
16. sethforprivacy. Monero will undergo a network upgrade on 13th August, 2022. The Monero Project, 20 April 2022. getmonero.org.
17. Haseeb Qureshi. Why privacy coins haven't taken off. Dragonfly Research, 28 January 2022. medium.com. Archived copy: 20 August 2022.
18. Jerry Brito and Peter Van Valkenburgh. Analysis: what is and what is not a sanctionable entity in the Tornado Cash case. Coin Center, 15 August 2022. coincenter.org.