Privacy in zk-rollups: validity rollups versus truly private zk-zk rollups
Thread482 words
Argues most zk-rollups use succinctness for scaling, not the zero-knowledge property, so they offer no privacy. Truly private rollups like Aztec encrypt inputs and outputs and prove correctness of each private transaction.
Key claims
Most zk-rollups provide no privacy guarantee and are better called validity rollups
Private rollups verify a zk proof per private transaction, hiding senders, recipients and values
0/ zk tech bears a lot of potential to improve user #privacy on public blockchain networks. However, many #zk-rollups are not be as private as you may think 🥷
a primer on privacy in the context of zk-rollups 👇
🧵 (0/15)
1/ how ZKPs are used and whether they actually preserve privacy is highly dependent on the use case and implementation of the technology
2/ in this context it’s worth noting that most zk-rollups don’t provide any privacy guarantee since they use zero-knowledge proofs for the efficiency of their verification, rather than privacy
3/ in other words, they leverage the succinctness property of zero knowledge proofs to scale throughput, while not necessarily leveraging the zero knowledge property to provide privacy to the full extent
4/ hence, some argue that "validity rollups" is the more correct term for most contemporary zk-rollups, as they use the proofs to attest for execution correctness, a.k.a. transaction validity
5/ but basically, these rollups simply bundle a large number of transactions together and submit them to the main blockchain as a single transaction, using zero-knowledge proofs to verify their validity, which is why we talk about validity proofs
6/ so to use more a technically terminology again, they only use the completeness and soundness properties of zero-knowledge proofs, but not their zero-knowledge property
7/ so while they may not initially share all the details of a transaction in the transaction hash, it is often decodable and not as private as users may think
8/ the primary reason for doing this is to be able to reconstruct the rollup chain in case of failure, which is more important to most rollup implementations than native privacy
9/ actually private zk-rollups are a different breed. As well as providing the scaling benefits, the transaction inputs/outputs are encrypted (via zk proofs)
10/ in this case, the zero-knowledge proof that proves the correctness of every transaction also proves that the encrypted data was correctly derived from the non-encrypted ‘plaintext’ data
11/ hovewer, the plaintext is known only to the users that constructed their private transactions. Hence, the rollup cannot simply process a list of transactions like before, as it must verify a list of zero-knowledge proofs that each validate a private transaction
12/ this extra layer of zero-knowledge proof verification is why they’re sometimes referred to as “zk-zk-rollups”). The result is reduced-cost transactions with full transaction privacy, even from the entity operating the rollup
13/ both the identities of senders/recipients are hidden, as well as the values being transferred. And despite this, users of the protocol can have complete confidence in the correctness of transactions (no double spending etc)...
14/ ...because only legitimate transactions can produce a valid zero-knowledge proof of correctness
15/ an example of a project building a truly privacy preserving zk-rollup as described above is @aztecnetwork
16/ want to know more about $AZTEC? 🥷
check my thread below 👇
x.com/expctchaos/status/1613189029004181504
What came next · since 02 Jun 2023
Since then
Zero has written 5 more pieces on Aztec since this one.