[Paper Review] zkFi: Privacy-Preserving and Regulation Compliant Transactions using Zero Knowledge Proofs

Chaudhary, Amit|arXiv (Cornell University)|Jul 2, 2023

Privacy, Security, and Data ProtectionSocial Sciences3 citations

TL;DR

This paper introduces zkFi, a middleware solution enabling privacy-preserving and regulation-compliant transactions across multi-chain DeFi and web3 applications using zero-knowledge proofs (ZKPs). It abstracts ZKP complexity via a plug-and-play SDK, supports account abstraction with MetaMask Snaps, and integrates built-in AML compliance through selective de-anonymization, enabling developers to focus on core functionality without deep ZKP expertise.

ABSTRACT

We propose a middleware solution designed to facilitate seamless integration of privacy using zero-knowledge proofs within various multi-chain protocols, encompassing domains such as DeFi, gaming, social networks, DAOs, e-commerce, and the metaverse. Our design achieves two divergent goals. zkFi aims to preserve consumer privacy while achieving regulation compliance through zero-knowledge proofs. These ends are simultaneously achievable. zkFi protocol is designed to function as a plug-and-play solution, offering developers the flexibility to handle transactional assets while abstracting away the complexities associated with zero-knowledge proofs. Notably, specific expertise in zero-knowledge proofs (ZKP) is optional, attributed to zkFi's modular approach and software development kit (SDK) availability.

Motivation & Objective

• To address the dual challenge of user privacy and regulatory compliance in blockchain applications.
• To reduce the complexity of integrating zero-knowledge proofs (ZKPs) for developers building on multi-chain EVM protocols.
• To enable seamless integration of privacy and compliance without sacrificing user experience or developer flexibility.
• To provide a modular, composable middleware solution that abstracts low-level ZKP implementation details.
• To support mainstream adoption of blockchain by offering a secure, compliant, and user-friendly privacy infrastructure.

Proposed method

• The system uses zkSNARKs, specifically Groth16, to generate succinct, non-interactive proofs of knowledge without revealing sensitive data.
• It employs a Merkle tree data structure to commit and verify user asset balances, enabling efficient inclusion proofs without exposing indices or pre-images.
• A trusted setup ceremony (powers-of-tau) generates cryptographic parameters required for ZKP soundness, with secrets destroyed post-setup to prevent manipulation.
• The protocol supports account abstraction and integrates with MetaMask Snaps to improve user experience and wallet interoperability.
• It implements selective de-anonymization via a compliance module that allows authorities to trace illicit activity when necessary, ensuring AML compliance.
• The SDK abstracts ZKP logic, enabling developers to plug in privacy features without requiring expertise in zero-knowledge cryptography.

Experimental results

Research questions

• RQ1 Can a privacy-preserving blockchain solution be built that simultaneously satisfies user privacy and regulatory compliance requirements?
• RQ2 How can zero-knowledge proofs be abstracted into a developer-friendly middleware to enable easy integration across multi-chain DeFi and web3 applications?
• RQ3 What architectural patterns can balance strong privacy with traceability for anti-money laundering (AML) compliance?
• RQ4 How can user experience be preserved in privacy-preserving applications without compromising security or decentralization?
• RQ5 Can a plug-and-play SDK reduce the barrier to entry for developers wanting to implement ZKP-based privacy without deep cryptographic knowledge?

Key findings

• The zkFi middleware enables developers to integrate privacy and compliance into their applications with minimal code changes, abstracting away complex ZKP logic.
• The system achieves end-to-end privacy by using zkSNARKs to prove transaction validity without revealing sender, receiver, amount, or smart contract data.
• Built-in compliance via selective de-anonymization allows authorized entities to trace malicious actors while preserving privacy for legitimate users.
• The use of a Merkle tree with commitment hashing ensures efficient and secure verification of user asset states without exposing indices or pre-images.
• Integration with MetaMask Snaps and account abstraction improves UX, making privacy features accessible to non-technical users.
• The SDK-based approach reduces development overhead and enables rapid deployment of privacy features across EVM-based blockchains like Ethereum, Polygon, Optimism, and Arbitrum.