[Paper Review] Bridging Sapling: Private Cross-Chain Transfers

Aleixo Sanchez, Alistair Stewart+1 more|arXiv (Cornell University)|Apr 22, 2022

Blockchain Technology Applications and Security4 citations

TL;DR

Zclaim is a trustless, privacy-preserving cross-chain transfer protocol that enables private asset migration from Zcash to other blockchains using ZK-SNARKs and a dynamic set of intermediaries. By integrating with the Sapling protocol and employing a splitting-based obfuscation strategy, it ensures that no single intermediary can infer the total transferred amount, achieving strong anonymity while maintaining compatibility with Zcash's shielded transaction model.

ABSTRACT

Interoperability is one of the main challenges of blockchain technologies, which are generally designed as self-contained systems. Interoperability schemes for privacy-focused blockchains are particularly hard to design: they must integrate with the unique privacy features of the underlying blockchain so as to prove statements about specific transactions in protocols designed to obfuscate them. This has led to users being forced to weaken their privacy, e.g. by using centralised exchanges, to move assets from one chain to another. We present ZCLAIM, a framework for trustless cross-chain asset migration based on the Zcash privacy-protecting protocol. ZCLAIM integrates with an implementation of the Sapling version of Zcash on a smart-contract capable issuing chain in order to attain private cross-chain transfers. We show that a tokenised representation can be created via a set of collateralised intermediaries without relying on or revealing the total amount to any third party.

Motivation & Objective

• To address the lack of private, trustless cross-chain interoperability for privacy-focused blockchains like Zcash.
• To enable users to move assets between chains without compromising the privacy guarantees of Zcash's shielded transactions.
• To design a framework that allows issuing and redeeming wrapped assets on a smart-contract chain while hiding the total transfer amount from intermediaries.
• To maintain strong anonymity in cross-chain transfers by preventing any single intermediary from learning the full transaction value.
• To provide a scalable, decentralized alternative to centralized exchanges for moving private assets across chains.

Proposed method

• Integrates with an implementation of the Sapling protocol on a smart-contract-capable issuing chain to enable private cross-chain transfers.
• Introduces new transfer types with accompanying zk-SNARKs to support issuing and redeeming wrapped assets in a privacy-preserving manner.
• Employs a splitting-based obfuscation strategy where the total value is divided into multiple parts, each sent via separate transactions to hide the full amount.
• Uses a dynamic set of economically incentivized, trustless intermediaries (vaults) to facilitate asset migration without requiring trust in any single entity.
• Applies a probabilistic splitting procedure that ensures the number of possible values for the number of parts remains bounded below by log₂k, preserving anonymity.
• Relies on note commitment verification and a relay system to ensure correctness and consistency across chains, independent of the underlying blockchain implementation.

(a) Issue

Experimental results

Research questions

• RQ1 Can a trustless cross-chain transfer protocol be built that preserves the privacy of Zcash's shielded transactions across different blockchains?
• RQ2 How can the total value of a cross-chain transfer be hidden from intermediaries while still enabling correct issuance and redemption of wrapped assets?
• RQ3 What cryptographic and economic mechanisms can ensure that no single intermediary can infer the full transaction amount in a private cross-chain transfer?
• RQ4 To what extent does the splitting strategy used in Zclaim maintain anonymity under realistic attack models?
• RQ5 How can the protocol be adapted to work with other implementations of the Sapling protocol on different blockchains?

Key findings

• Zclaim successfully maintains strong privacy in cross-chain transfers by ensuring that no single intermediary can infer the total transferred amount, even when collaborating with others.
• The protocol achieves substantial anonymity through a splitting-based obfuscation technique that limits the information leakage about the total value to less than a constant factor of the maximum possible value.
• The number of possible values for the number of transaction parts (n) is bounded below by log₂k, ensuring that the anonymity set remains large even for large transfers.
• The ratio of the probability of observing a specific value under total value disclosure to its prior probability is upper bounded, demonstrating that information leakage is limited.
• The protocol is compatible with any blockchain that supports the Sapling protocol and smart contracts, including Tezos and Ethereum, with minimal modifications to the relay and verification logic.
• Zclaim has been adapted to the newer Orchard version of Zcash and is being extended to support multi-asset shielded pools, indicating its extensibility to future Zcash upgrades.

(b) Redeem