Explain in detail the mechanism, innovation and limitations of Ethereum's reversible transaction standard ERC20/721R
The irreversible nature of blockchain transactions was once described as the only inferior imitation of God's "time" by humans. However, it is precisely because of the irreversibility that a large number of hacking funds are stolen and there is no solution. It is also called web2 The most successful transition to web3: Hacking.
The latest paper released by researchers at Stanford University (kkwang@cs.stanford.edu, etc.) on the 9.9th recently realized twoThe standard name for reversible transactions is ERC20R/ERC721R. It introduces a "decentralized court" mechanism. When the assets are stolen, the victim can apply for freezing the assets, and the "decentralized court" can decide whether to freeze the assets by voting. After the assets are frozen, the "court" will decide based on the evidence of both parties Determine ownership of assets to resolve disputes.
However, from irreversible to reversible, it is accompanied by a large number of complicated problems
Who can initiate? How to deal with malicious false accusation of blocking funds
How to freeze? The high-speed flow of funds and the wide range of incidents involved, how to notarize malicious poisoning?
Who can arbitrate? Malicious judges, what about bribing judges?
first level title
1. A brief history of the development of reversible transactions
In 2020, a total of 7.8 billion U.S. dollars will be stolen on the blockchain, and by 2021, a total of 14 billion U.S. dollars will be stolen. In the past year, more than 100 million U.S. dollars of NFTs have been stolen due to phishing and other issues.
This shows how valuable the standard will be once such a problem can really be solved.
In fact, as early as 2015, there was a discussion proposal to make transactions reversible. In these years, some projects have tried to use it, and Vitalik and one of the original authors of ERC20 have also participated in it.
In 2015, Reversecoin was the world's first encrypted token with reversible transactions, which introduced a timeout between transaction initiation and confirmation. Each account has an offline key pair that enables the owner to reverse transactions or confirm transactions instantly. But that doesn't stop many modern hacks: the attacker either steals the confirmation key, or tricks the user into using the confirmation key to reconfirm a malicious transaction.
In 2018, one of the co-creators of the ERC-20 standard (Dean Eigenmann) proposed the concept of a reversible ICO, where investors can get a refund amount that is inversely proportional to the most recent investment time. While this prevents spoofing of individual tokens when they are issued, it does not protect against subsequent malicious transactions of tokens.
In 2022, there will also be refunds-for-nfts (refundable ERC721r standard)
The most important idea in this paper is to draw on the 2018first level title
2. The realization principle of ERC20/721R
The core of the concept of the thesis is: Token based on "decentralized court" governance
Tokens implemented based on the ERC20/721R standard are eligible to be revoked within a short period of time after their transactions are released on the chain. But after the dispute period, the transaction can no longer be reversed. And during a short dispute period, the sender can request a revocation of the transaction by convincing a discretely drawn set of judges to first freeze the disputed asset and then convincing them to reverse the transaction.
It seems that a sentence is enough to describe,But in fact, there are many risks in the middle
Before decision-making: who can propose and who can freeze? Random freezes will sever trust and block funds
In decision-making: who can participate, on-chain or off-chain? Judges can be bribed, judges' impartiality motives
After the decision: How to return the currency crossing? Funds can be scattered and innocent people can be affected
secondary title
2.1. Participating roles of the ERC20/721R standard
A total of 4 roles are involved in it,Victim, Governance Contract, Judge Group, Asset Contract
A victim is a victim, that is, a historical holder of its Token, who can initiate a freeze request to the governance contract.
Governance is the implementation of the decentralized court of the governance contract, which can concurrently serve as the governance of multiple 20/721R.
Judges are a group of judges, each time a judge is randomly selected to vote, and initiate operations such as freezing/unfreezing/returning funds on asset contracts
ERC20/721R must use this standard in order to record historical fund transfer records and realize the retrospective algorithm of frozen objects
Governance is the people who eat melons, which can clean up invalid historical data in the contract, thereby reducing the consumption of gas fees
Through the core process role can be seen
Basically, as long as the Victim victim initiates and meets certain governance contract opening conditions (such as the amount/handling fee reaching the standard), the freeze can be initiated, resulting in the inability of funds to flow. Therefore, the economic model reward and punishment mechanism in the governance contract is very much in need of design , otherwise either the judge is exhausted, or the blocked funds in the malicious freeze
Expandable reading: The impact of capital blockage on system operation
【Contract Interpretation】CryptoPunk is the world's earliest decentralized NFT trading market
Secondly, there are two core issues in the realization of reversible transactions that need special attention
How to ensure reliable restitution after arbitration
secondary title
2.2. Judgment process of ERC20/721R standard
As can be seen from the flow chart of the paper, there are five main links
Theft: After the hacker steals, the money may be quickly laundered and transferred to multiple addresses, exchanged, and even destroyed
Appeal: Initiating a freeze requires payment of a challenge deposit, which will also become a source of income for the governance contract
Draw judges: its composition is randomly selected from the judge library, which can follow the idea of POS-like pledge to participate in block generation
Freezing: Once the judge decides to freeze, the smart contract will calculate the address and amount that should be frozen
first level title
secondary title
3.1 How to deal with malicious judges?
From the above operation process, it can be seen that
Judges have great power to make decisions, so how to select judges, how to compensate judges, and how to deter judges who misbehave maliciously, such as judges who accept bribes or make wrong decisions on controversial transactions, are governance problems.
First of all, the behavior of the judge can only be carried out through the governance contract, and its behavior is limited. Although this contract has not been realized, it also mentions some design ideas, basically referring to the process of POS pledge block production
The principle of secret voting: the members of the judges are not disclosed until the number of votes is large enough to avoid actively seeking bribes from judges.
The principle of dynamic judges: With the size of the disputed transaction, the number of judges required increases, and the scope and cost of bribing judges increase.
Judge SBT principle: use the real identity in the off-chain real world to participate in the judge pool, and let wrong judgments affect their real identity
Decision-making separation principle: Whether the decision of the judge is agreed or disagreed, the proceeds can be shared with the proposal fee.
Work supervision principle: if the judge fails to vote in time for many times, the pledge will be fined and refunded
secondary title
3.2. How to achieve reliable freezing?
From the above description, it can be seen that judges rely on reality and decentralized voting decisions, but the cornerstone of their behavior is that the funds have been frozen, so that they have time to analyze and make decisions.
Therefore, how 20/721R can effectively find the object and amount to be frozen is the most difficult part of this paper, and it is also the most innovative part of this paper.
3.2.1. For ERC721R
This logic is relatively simple, because the flow of funds is inseparable, only the address may be diverse.
Of course, even 721 is not simple, because as a historical holder, I may not immediately discover the loss of funds, and even if it is only 1 minute, it may cause the NFT to be transferred to other innocent users.
So ERC721R defines a set of contract data storage specially used to record transaction history,
For freezing: the frozen[tokenId] object is defined to lock the Id and continue to transfer
For the victim address: determine the fund loss party based on historical transaction records (stored in the contract)
On the whole, compared with the traditional 721, 721R records the following data, and you can always know the NFT circulation method
Of course, you might say, isn’t this what you can know by looking at the historical records of NFT contracts?
Extended reading on-chain data analysis:
However, the method of recording transaction history in the paper is not only to find out the range of disputed transactions, but also as a restriction on malicious judges. Yes, in the face of extremely high judge rights, once the NFT has passed the dispute period, Or after there has been a previous evaluation and audit, it is impossible to initiate a transaction cancellation order.
3.2.2. For ERC20R
The freezing functionality of an ERC-20 contract is much more complex. The problem is that between the theft and the freeze request, tokens may have been transferred to multiple accounts, and each account may receive funds differently. As shown below
In the figure, V is the victim is a victim, a0 is the hacker, and a1-a11 are all addresses involved in the case before freezing the request. The figure shows the scene links where various funds may be manipulated.
Scenario 1: Funds may be destroyed. For example, a8 is transferred to a different ecology through a cross-chain bridge or withdrawn from a currency exchange. Naturally, it cannot be retrieved at this time
Scenario 2: Funds may overlap, and a1 may be the long-term storage address of a0, so many stolen assets are here. Before it can be judged, only the amount involved in the case can be frozen, not the entire amount
Scenario 3: Funds may circulate. If a4 is transferred to a0 again, it is necessary to judge whether the funds are clean
In the end, the amount of the entire a1-11 should be included in the frozen calculation, and the paper proposes a set of algorithms to calculate.
The core idea is to define the locking obligation of each node based on the upper and lower fund transfers. For example, if V loses 100, and there are exactly 50 in a0, the 50 will be frozen first, and then the remaining 50 will be used as the obligations of a1, 2, and 3, and the operation will continue freeze. The amount of obligation assumed is calculated from the record of the transfer from a0 to a123. Therefore, even if it is poisoned, such as transferring 1 block to the currency exchange, it will not freeze the part of the currency exchange that exceeds the obligation of the disputed funds.
first level title
4. Summary
So far, the implementation has been basically described, so is this method really good?
From the perspective of the author
The author believes that this is also a major trend in the current web3 industry. More and more high-end web2 talents are pouring into this upsurge of the times, and are vying to solve some industry-leading protocol layer problems. Although it is a good thing, the overall human investment is not enough. Balance, the status quo of fat protocols and thin applications is still a bit top-heavy, avoiding the important and paying attention to the light. It is good for cutting-edge scholars to go to the forefront of protocol research, so should the project party do better after getting the ICO?
Expandable reading: a win-win case for protocols and applications
From the perspective of the thesis goal
The author believes that the biggest problem is not simply the accuracy of the freezing algorithm, but how compatible and exchangeable delayed Tokens and non-delayed Tokens are, that is, reversible transactions are actually poisonous. Once the disputed funds are transferred across protocols, they will be reverse transaction. For the exchange, it should wait for the funds to pass the dispute period before performing the real transfer and exchange. Such subversion of the infrastructure is likely to hinder the development of applications on it.
From the anti-black effect
First of all, whether the agreement itself can be accepted by the society is a challenge. Secondly, the judge will also follow the balanced design of the pledge economy. In the end, there is still the risk of bribing some miners to interfere or even hinder the reordering transaction. Moreover, the most important thing is the truly credible on-chain It is difficult to verify the data off the chain, the transaction was stolen, not the transaction was reversed. So the author is not entirely optimistic about the anti-black effect.
From the point of view of contract realization
Indeed, the contract algorithm design of Stanford University researchers is highly sophisticated, and it is indeed a rare spectacle to implement the algorithm in the smart contract. While endowing the algorithm with trust, the problem it brings is the high cost of tokens.
Each transfer itself is only a modification of two standard NFT balances, but now it is necessary to record each history record, freeze status, and freeze execution involves a large number of balance changes to sub-addresses, which will make it extremely expensive.
[Source Code Interpretation] What exactly is the NFT you bought?
[Source Code Interpretation] What exactly is the NFT you bought?
Like and follow 14, bring you value from a technical perspective
Like and follow 14, bring you value from a technical perspective
