Status update & RFC: ZEC-NAM shielded airdrop protocol

Here’s the ELI5 version (well, as best I can):

To be eligible for the airdrop, you need to prove how much unspent shielded ZEC you had at the time of the snapshot. The protocol also needs to guarantee that you can only do this once, i.e. so that you can’t just have 1.0 shielded ZEC and prove you have it 100 times in order to get 100 ZEC worth of airdrop rewards.

In every Zcash shielded transaction, you prove that you own a ZEC note (without revealing which one), and you reveal its nullifier. The consensus rules enforce all the nullifiers to be unique, which is what prevents double-spending the same note. A note is spent once its nullifier has been added to the nullifier set.

In the original airdrop design, you would basically do what you normally do when you’re producing a shielded transaction: you prove you own a note, you reveal its nullifier and its value, but you don’t produce the signatures needed to actually spend it. The airdrop protocol verifies that proof and, after checking that the nullifier is unique, gives you your airdrop funds.

But there’s a privacy leak in that design: claiming the airdrop reward reveals the real nullifier of your note. When you eventually spend the note in a shielded transaction, it will reveal the same nullifier as you already revealed in the airdrop reward claim, so the two actions can be linked together.

The proposed fix to that is: instead of revealing your note’s actual nullifier to claim the airdrop reward, you reveal a different kind of nullifier for the note, which is unlikable to the note’s actual nullifier and which is used to prevent double-claiming airdrop rewards. But, since you’re not revealing the actual nullifier, in order to check that your note is unspent at the time of the snapshot, you also need to use a zero-knowledge proof to prove that your nullifier is not in the nullifier set at the time of the snapshot.

In other words, you’re producing a proof that “I had x amount of unspent ZEC at the time of the snapshot”, but (in the new design) without revealing any of your notes’ actual nullifiers.

17 Likes