MACI - Private Voting

[Music] hello everyone and welcome to the circuit breaker PSC ethereum Foundation Workshop mayy private voting joining us today is Alex who will be taking us through this session and with that I'll pass over to Alex to get the session started thanks s hey guys um I'm Alex or control C3 in the crypto world uh happy to have you here guys and um yeah so today uh we're going to be talking about Macy um and this is a open source project from the PAC team within ntino foundation and we do basically just ZK research building UPS or Primitives um yeah let me see okay right so we'll just quickly uh we'll go through what Macy is why private voting is important how Macy works and uh what to build with it which I think is what you guys are much most interested with and how to use it uh if you have any questions like feel free to drop them uh in the chat and uh I'll do my best to answer everything okay so Macy um stands for minimal antic collusion infrastructure and in an act show he enables a private PS um the main properties of Macy are collusion resistance so only a coordinator which is the entity running the poll uh can be certain of the validity of a vote um you are not able to prove uh within any doubt how you voted and that helps with preventing bribery um privacy aspect is only yourself as a voter and the coordinator can decre to certain vote um votes cannot be censored um even the trusted Ator whether it's trusted or not they won't be able to uh censor any of the posts that have been sent um once you cast the vote you cannot edit it or delete it but you can nullify it but no one else can do that for yourself and finally um there is no way to produce a false output by the coordinator um yeah so why do we need private voting um so prary is a very problem in most um protocols that do quad funding quad voting especially when for instance the quary funding we have uh there is a financial incentive to bribe someone uh and being a more democratic way of allocating uh let's say funds in the context of qu funding uh people make a difference more than uh people with a lot of money so the majority of people can vote for a project and uh the result might be better than just one person with a lot of money coming there and voting more or putting more money into a pot um in this case if you can easily collude uh then all of these funds uh might be misallocated and in general I say as well that um you could can be easily influenced by uh people's opinion so let's say you're voting or something and you see how other the people are voting that might affect uh the vote um yeah so going back to the prary problem is that with Macy you cannot really prove how you voted um you could show to the briber okay yes I voted for this option and I voted this gave this vote but they really have no way to verify that that vote is valid or need that they you casted another vote which over bribes that vote so in the end why would they bribe you if there is no guarantee and yeah the goal is to um have more democratic approach and safe in terms of the architecture um mayy It's Made of um three different uh components let's say we have the smart contracts which uh work on evm compatible chains we have some circuits which are used by the coordinator to generate proves uh that the messages were processed correctly and all of the votes uh were Ted correctly so the result of a poll is correct and then we have um some time Cape utilities um for instance we have a clone of the smart contract uh which is used to replicate the state of chain and generate inputs for the dkn circuits uh we have a CLI an SDK to interact with the protocol and some of the Primitives and typ classes representing some of the objects you use to interact with Macy also reside in this um TPT utilities okay so how use would use Macy um user technically can do three things with Macy um a user can register a user can vote and finally they can and should verify that the results are correct um in ma we don't identify users by the eum address even if all the voting happens on chain we use what is called the ma public key um you can see here there's a a public key and a private key which is um basically the Public Public key is a point on analytic curve in our case the baby jup jup curve and this is calized so that is easier to uh just easier to handle by users and when you register you would need to uh pass certain conditions that's up to the person running the um the Mac instance um but let's forget about that for now but in general you register so you come you send a smart contract transaction with your public key and that's your identity this identity is not tied to your address so you AR able to send votes which we really call U encrypted messages and you can send that from anywhere at the same time anyone can send a vote um but only votes sent by people that register are going to be considered on top of course of the validation that the vote is valid um so these votes are encrypted which is um one of the cool things about Macy so you cannot see anything on chain uh this are decrypted with a share key uh which is generated using a random key and a coordinator public key and when I'm talk about Keys here I'm referring to this Macy keys so these points on the lied curve um because we send this random key public key together with the message the coordinator is able to reverse the process and generate the share key back to the crypted to prevent of course um anyone from sending messages on your behalf we do um sign them using U the mive private key cool um so skipping ahead we have all the processing which I'll talk about later and finally the user will come um take whatever was published uh by the coordinator which is like the T result and they will um verify on chain so there's utilities uh to do that um so looking into vote um basically the vote as mentioned is a uh is an object so in this object we have the state index which is um basically the position in the medical tree of your sign up you're given this when you sign up so you will know that there's your public key uh there's the vot option and the vote weight so you can say I'm voting for option three and I'm allocating five votes uh by default V Macy are quadratic 14 so basically you are assign a amount of voice credits and that depends really on how you want it to be it can be customized but imagine where everyone has the same credits let's say you have 100 credits you cast a vot using five uh a v weight of five and that would be 25 because of the uh quadratic volting um because of qu voting and um yeah like there's few other things inside and nons uh which tracks the order of messages and um yeah I talked about that before so we skip ahead we um everyone votes and then it's up to the coordinator to uh process all of these folds so because we want users to save money when submitting V we don't uh use normal medical trees on chain but we use what is called an accumulator que so each sign up or message are added to this queue and basically the difference with a noral medical tree is that you would not compute the route after each insertion uh but that would be the job of the coordinator so the gas cost for that uh would end up being on them um fast forwarding we copy this state of the smart contracts um and we start processing the messages by we I mean the coordinator because he needs they need their private key to be able to decrypt the messages using their private key and the F public key um SC through this we generate CK KN proofs and then we submit an on chain um the coordinator cannot sensor vote um so talk about this there is a number of messages been sent the number of user that stand up and all all of that is recorded on chain so if they try to um submit data that is not valid um the proof will not validate and users would not okay so the trust assumptions um are that there there has to be a coordinator for now and they we assume they only but they can actually um collude so they could decrypt the messages and collude with briers or they could also decide to not um finish a round but what I cannot do is they cannot sensor and that's thanks to the smart contracts and they cannot perform incorrect processing and that is thanks to the uh zero knowledge part of ma the source of Truth here um is the Smart contract so the data is recorded on the smart contract so there is no way to sensor or publish um wrong proofs um yeah in terms of challenges um if you do decide to um build something on Macy uh you probably figure out that Macy is quite a complex protocol and it can take some time to understand we working hard on improving the experience but that is not um that's not perfect uh but it's in going in the right direction um as a user you might find it a bit costly to use um and as a coordinator as well some of the cost can be a bit High yeah um because of the Z snar ZK snar processing is St of chain uh which kind of really is the beauty of it but Ma is quite complex so the circuit logic it's complex and the number of constraints of the circuits can be very large depending on how many users you want to support how many messages you want to allow and how many projects you want to uh allow voters to vote for so generating proofs can take a very long time and finally um Cil um Sy is another problem and that is true for every C in qu reporting protocol um and yeah it would be great if um contributors could try and integrate a protocol uh for like like a proof of human protocol or some ways of gatekeeping uh users and something to mention is because we don't get keep who can vote and of course these votes sent by someone that it's um not registered will not be counted but still um they will account for space in the medical tree so if there is enough financial incentive someone might be able to spam the uh poll um so yeah the most important part for you guys is what can you build um we're kind of open to any anything really and we like to see people experimenting um so there's quite a bit of qu finding application being built so probably focus on that uh but maybe like building a dow voting app so new ways to gatee keep users better Cil protection resistance even something as simple as building an app to privately vote on which movie to watch um some front ends which you can use to um balish round so from the coordinator perspective or some front end you can use to contribute you're free to pick any of these or discuss with us anything that you think uh makes sense to build for instance you could take some of the Primitives like message encryption and just build something else why not um in terms of other the repo looks uh we we have one repo so everything is in one repo you probably won't need to touch the TK s circuits um but whatever is all liting in blue is the U typescript code um CLI is where the SDK resids so there are commands which you can use to interact with Ma on a front end or if you just want to interact with CLI you can do through there um core is the copy of the smart contracts which do the processing and crypto and domain objects are some of the T utilities and classes that we use finally the contracts is where you want to look if you need to implement some C assistance some gatekeeping and some new features okay um so I just wanted to walk through like a end to end usage of Macy um won't go into too many details a lot of this stuff is on our documentation website and um yeah so because we use um zero knowledge we need and we use the gr 16 proven system we need what is called the verification key um so we have two main circuits you may see the circuits that process the messages and the circuits that Tes the vot uh for each of these circuits we run a trusted setup and we have a set of trusted um proven Keys that's Z key as well as um a set of verification Keys um to be able to verify proofs and chain you need the verification key and so the first step of any ma deployment is to deploy a registry hold in these Keys um in this uh contract we're going to be storing this uh verification key and then when the time comes to verify the other smart contract will query it and use this to just verify the proof um yeah so the main part is then deploying uh Macy and all of the Contra factories um if you do take a look at the contracts folder uh you'll see that there are um a few contracts so we'll have the Macy one which is where you go and sign up and which manages uh polls you have a poll contract which is where you vote um you will have a message processor which is the Smart contract used by the coordinator to um submit proofs and um commitments to the data and the T T bolt which is where the coordinator will submit proofs for the taling of the results and user will go and to verify them um some of the parameters are explained well all the parameters are explained in the documentation but here when you deploy M you can set the state depth which is basically saying how deep is the m tree holding the signups at date of 10 with a quinary mro tree so five leaves per note will be roughly 1 million maybe signups which is a lot um so yeah this deployment to Macy in this example will support 1 million botters okay so after we deploy Macy we can uh deploy a PO here you need to specify the public key of the coordinator uh you can also generate these Keys using the cine it's like a gen ma key utility the T that for you and together with the uh with this key we also say how long we want the poll to run and some of the other parameters like how many messages are allowed in this case by saying two we're only allowing five to the^ two so 25 messages but again all of this is explained in our talks Okay cool so the user part sign up you as a user come send your public key from whatever ethereum address in this case because we allow anyone to sign up in this test you get you are given this state index if you remember before that was useful for uh creating a message so with this publish command we use the user public and private Keys uh the state index uh and the nons which we start from one and then Thea weight and the option index as you see on chain uh basically the data is just aside from the first part which is just the message type which is one everything else is encrypted so no one really can see what's there um yeah so let's again imagine 10 20 users sign up there are 50 Vols being casted and whatnot the poll finishes um here the coordinator will do the margin of the trees as we said before and they will generate the proofs um the up this is this file um which is a just a Json file which holds the result um I kind of closed here theal but that's where you will see for each of the vote options so let's say there were 20 projects you will see how many votes each project got which is like the sum of the individual both the valot ones the total spent voice credits um so how many voice credits in total were spent by the BS and how many will spend per each option so this should be published by coordinator and user can just submit it on chain and um see whether this verifies or not and yeah they can do this using um the C again just call very ver ify say which po we trying to verify and pass this um here we're basically um verifying that the commitments so like the mer root of the message tree of the state tree which all the sign up is correct and all of the calculation were correct and this cannot be fooled okay um right so to conclude with um we believe that uh private voting is very very important especially when everything is going digital nowadays and we think Macy uh can help make this more secure but we need the help of uh you whether you decide to um participate in acon building something or you feel at some point to come into our GitHub or Discord and try to do some open source contributions uh everything we build the PC is open source as we believe that's the way to go and it's just it's just great to be building in public getting the feedback from you guys and being able to make something better and hoping this helps someone at some point um yeah I'm sure the presentation uh slide will be shared so there will be this uh link and QR to join the Discord we have a public Channel where you can discuss of information P or other PC projects and here there's some uh useful links like our documentation website the repo CLR fund which is a quadratic uh funding protocol built on top of Macy and that is built by an external team um the demo code which is what I showed in the end to end examples and yeah just some of the project ideas which we discussed today and some post by vitalic which is one of the original um ideator of uh Macy yeah I think that's kind everything I want to say and if you have any questions you know you can ask now or we can talk on Discord awesome cheers thank you Alex yeah if anybody has any questions feel free to type them in the chat or take yourself off mute and you can ask uh ask Alex here directly uh Kaa ask how can we get these links I can share the presentation in Discord maybe in the if Global is that right yeah yeah that that's fine yeah sweet sweet sweet yeah and for those hackers if you haven't already please connect your hacker dashboard to to Discord so you can access those the partner specific channels it's and the question is is there a track for Macy I believe there is yeah yes so as PC we have five projects actually so yeah um ma is one of them and is one price for one project yeah and some of the stuff we don't where is it here or you know feel free to just propose anything yeah yeah and I just uh sent a link for the uh the PSC prizes page as well so you should see all that okay got nice thank you do we have any other questions I guess Alex did you share what your Discord are you going to be answering questions in Discord Channel as well or is that um mostly G to be uh uh Vivian or I'll be there I'll be there um okay okay I'll turn notification on actually always disabled for disco stuff but yeah um it's control C free there same way here so just ping me there or what not I'll uh I'll answer yeah yeah I imagine you're going to get quite a few questions especially for this event yeah looking forward to that um yeah for the workshop does anybody El have any other question questions and if not uh awesome well cheers Alex thank you for the great presentation uh on Macy and thank you all hackers for for attending as well so reminder hack begins tomorrow and yeah Alex and the team will be on Discord so if you have any questions feel free to ask them in the partner psse channel so cheers thank y'all have a good rest of your day bye [Music]