As I've been diving deep into privacy for blockchains over the last months, I naturally assumed that everyone in web3 is familiar with how @TornadoCash works - at least at a high level.
I was recently surprised that many had no clue.
Here's my CT explainer of Tornado Cash 🧵
1
1
8
808
Let's start with the "why":
Recall that transactions on public blockchains (e.g. Ethereum) can be traced back to the genesis/coinbase. The goal of TC is to break this linkage.
The two key smart contract functions are `deposit` & `withdraw`. Let's dive in!
↩️
1
1
86
To `deposit` funds, the user generates private randomness and computes a cryptographic commitment to it. Upon deposit, the commitment is published and appended to a Merkle Tree stored in the contract. The funds sent by the user are added to the shielding pool.
Is it secure?
↩️
1
2
49
To `withdraw` funds, the user must create a zero-knowledge proof (actual ZK!) attesting to:
1. Knowledge of the randomness used in generating the commitment
2. Membership in the Merkle Tree of commitments
They also publish part of their randomness to prevent double spending
↩️
Feb 3, 2025 · 7:26 PM UTC
1
1
285
The TC design ensures the following security properties (informal):
1. Only coins deposited into the contract can be withdrawn
2. No coin can be withdrawn twice
3. An attacker who doesn't know the randomness cannot prevent a coin owner from withdrawing it
Hungry for more info?
↩️
1
1
116
Our @NPLabs_ team has written about Tornado and even designed some modifications. See the 1st part of the blog post for a detailed description of its cryptography:
np.engineering/posts/tornado…
Were you looking for some code instead? We've got you covered :)
np.engineering/posts/tornado…
1
111