Where to Hide: Wormholes, Beacon Deposits, and the Cost of Deniability

I start by reminding everyone of the definition of plausible deniability and why it is a very desirable property! Then I explain how wormholes (designed to provide privacy with plausible deniability) derive a burn address from a user secret, where non-inflation rests on 160-bit collision resistance. One collision mints the same deposit twice. That gives us only an unsatisfying 80 bits of security. Then, I make a formal argument why without longer addresses it is impossible to fix the low security problem.

After that I pitch EIP-8222 as an alternative, which adds a two-phase deposit and withdrawal to the staking contract, with 256-bit long commitments that never touch execution-layer addresses, so security reduces to the proof soundness. Finally, I close by explaining how "the extremely lean chain" proposal by Vitalik reaches a similar destination as a byproduct of state minimization.

Speakers: Pierre

Track: Privacy & Consent