Tornado cash. Non-custodial private transactions on Ethereum.
Go to file
2019-07-15 18:33:46 +03:00
circuits Snark test 2019-07-12 19:35:15 +03:00
contracts other way to lookup a root 2019-07-15 18:33:46 +03:00
lib move unused tree args to the right and provide defaults 2019-07-13 12:14:27 +03:00
migrations fix small bug 2019-07-13 01:26:27 +03:00
scripts cli (wip) 2019-07-13 14:58:19 +03:00
test off-by-one fix and tests 2019-07-15 18:04:48 +03:00
.editorconfig Move contracts to repository root 2019-07-12 12:53:44 +03:00
.env.example mixer deploy WIP 2019-07-12 18:04:45 +03:00
.gitattributes add dummy test 2019-07-10 19:58:21 +03:00
.gitignore tests 2019-07-12 22:11:37 +03:00
cli.js cli fix 2019-07-15 14:57:14 +03:00
package-lock.json downgrade web3 to fix cli withdraw 2019-07-13 17:55:35 +03:00
package.json downgrade web3 to fix cli withdraw 2019-07-13 17:55:35 +03:00
README.md typo 2019-07-13 18:02:00 +03:00
truffle-config.js cli 2019-07-13 17:45:08 +03:00

Requirements

  1. node v11.15.0
  2. npm install -g npx

Usage

  1. npm i
  2. cp .env.example .env
  3. npm run build:circuit
  4. npm run build:contract
  5. npx run ganache-cli
  6. npm run migrate:dev
  7. ./cli.js deposit
  8. ./cli.js withdraw <note from previous step> <destination eth address>

Testing truffle

  1. npm i
  2. npm run build:circuit
  3. npm run build:contract
  4. npm run test - it may fail for the first time, just run one more time.

Testing js

  1. npm i
  2. npm run build:circuit
  3. cd scripts
  4. node test_snark.js

Deploy

  1. npx truffle migrate --network kovan --reset

Specs:

  • Deposit gas cost: deposit 903472
  • Withdraw gas cost: 727821
  • Circuit constraints: 22617
  • Circuit proving time: 8965ms
  • Serverless, executed entirely in the browser

Security risks:

  • Cryptographic tools used by mixer (zkSNARKS, Pedersen commitment, MiMC hash) are not yet extensively audited by cryptographic experts and may be vulnerable
    • Note: we use MiMC hash only for merkle tree, so even if a preimage attack on MiMC is discovered, it will not allow to deanonymize users or drain mixer funds
  • Relayer is frontrunnable. When relayer submits a transaction someone can see it in tx pool and frontrun it with higher gas price to get the fee and drain relayer funds.
    • Workaround: we can set high gas price so that (almost) all fee is used on gas. The relayer will not receive profit this way, but this approach is acceptable until we develop more sophisticated system that prevents frontrunning
  • Bugs in contract. Even though we have an extensive experience in smart contract security audits, we can still make mistakes. An external audit is needed to reduce probablility of bugs
  • Nullifier griefing. when you submit a withdraw transaction you reveal the nullifier for your note. If someone manages to make a deposit with the same nullifier and withdraw it while your transaction is still in tx pool, your note will be considered spent since it has the same nullifier and it will prevent you from withdrawing your funds
    • This attack doesnt't provide any profit for the attacker
    • This can be solved by storing block number for merkle root history, and only allowing to withdraw using merkle roots that are older than N ~10-20 blocks. It will slightly reduce anonymity set (by not counting users that deposited in last N blocks), but provide a safe period for mining your withdrawal transactions.