The spec draft can be found here
Zk assets aka zcash shielded assets (previously UDAs). bring private stable coins, wrapped Bitcoin and Eth, and other tokens to Zcash with the same privacy as shielded transactions, Indeed, no one can tell the difference between a shielded zec transaction and a zk-asset transaction.
As a follow up on the successful user defined assets panel at Zcon2 and requests that I do more than research and suggest ideas, I wrote up a quick draft spec for zk-assets. Various people have contributed to the draft and much of the work and ideas are due to others. In particular, I’d like to thank Str4d and Daira for the circuit techniques showing this was feasible and Nuttycom for some of the economic ideas.
V0 of the spec is the core technical protocol. V1 considers possible economic mechanisms and discusses how much they are needed and what the trade offs are.
As ECC, ZFND, and the zcash community as a whole start looking at what to develop after Halo2/Orchard, its good to have concrete options. The question is which do we prioritize.
[Edit, as a clarification. The engineers at ECC and ZFND have been working their ass off. So I’d imagine there’s going to be some much deserved down time after Halo2/Orchard. The question is, once thats done and everyone moves on to whats next, well whats next for core protocol changes? This isn’t a demand to hurry up and do something now, its a request as a community we explicitly decide what we are doing next rather than just going forward on the existing momentum]
I think it’s important to have some type of programmability in Zcash and this is a step I would personally be okay with Zcash making if the community shows a desire for it.
This is a good start to help move the conversation around ZDAs forward, well done.
I’m personally in favor of the concept of UDAs for the benefits they can bring to everyday Zcash users. Fees for transactions and greater use of the shielded pool is a net benefit for all Zcash users.
If zk-asset transactions and zec transactions must look the same for privacy
How confident are we that we can’t achieve good privacy for ZDAs by having a separate (but consistent) higher fee? For instance the default of Z-Z is 0.00001 while a default for shielded is 0.001? There would be a different set of transactions to hide among but if use is high it could still provide strong privacy because all ZDA transactions would use the same fee.
Its cryptographically feasible to make zk-asset transactions look different from zec ones (e.g., have two different circuits). If its feasible engineering wise in Zcashd and Zebra, then we could make the fees larger. The privacy loss to zk-assets would be small. However, zec transactions wouldn’t benefit from the larger anonymity set.
The question is, how do we set the fee? Zcash doesn’t have a fee market really. Fees are kinda arbitrary and blocks something like 95% empty. So for now, you’d pay the minimum. The question is what premium should zk-assets pay as a fee. And should it be the same for shielded doge and USDC?
From my initial discussions with people, it seemed there was more interest in issuance fees and the economic benefit of per TX fees wasn’t worth privacy cost and the problem of having to set the same fee premium for all zk-assets.
Why do we want ZDA transfers to have higher fees? Is the zec being used to mint these ZDAs being burned? Doesn’t more fees going to miners means more selling pressure on zec?
If the computing and storage cost of including a ZSA is the same as ZEC transaction, there is no reason to differentiate the default fee of those. My consideration is not only about the privacy cost, but the UX cost for everyday users who just want to use digital cash.
Zcash is already complicated enough to talk about in the dinner table
Since ZDAs require Zcash to operate the primary idea behind a higher fee schedule for ZDAs is the more ZDAs “consume” Zcash to operate then it’s better for Zcash holders because higher ZDA use generates higher demand for Zcash itself.
Plus it could also discourage the “free rider” problem. If the fee is higher then it could encourage a user to use Zcash instead of just issuing a new token on Zcash for the same fees.
The UX is handled by the wallets. Any wallet that wants to support ZDAs will need to re-do thier user interface and backend anyway to display/trade/issue the ZDAs. Whether the fee is 0.00001 or 0.001 the UX for the user would probably not be a substantial difference.
I haven’t seen any data that more fees = higher selling pressure for any coin. When fees spike in Bitcoin or Ethereum does it negatively impact the price? Do miners sell more or the they hold more because they are getting higher fees? I personally haven’t seen that correlation but would be happy to see hard data in the subject.
Market price is a result of supply and demand. Demand is driven by innovation and increasing use cases for Zcash will probably have a greater impact on Zcash market rates than a marginally higher mining fee would.
Keep in mind the entire case for ZDAs hinges on two important concepts:
Higher shielded usage of Zcash provides stronger privacy for all shielded users.
More use of Zcash block space (for ZDAs) can benefit Zcash itself by creating more demand for Zcash coins.
@zoren@tokidoki There’re two separate questions about zk-assets and fees. @Shawn gives an excellent summary of the discussion so far, but that discussion has conflated two different questions. 1) Is building zk-assets harmful to Zcash and 2) if zk-assets are helpful, can we make them even more helpful to zec holders?
The first concern does not stand up to scrutiny but has generated most of the discussion. There will be private shielded assets on other chains and one of them will have credible privacy tech. By refusing to develop zk-assets, we only ensure that when one of those chains succeeds, we don’t have comparable features. Imagine a world in which Monero adds custom assets and we haven’t because we were concerned about fairness, free riders, or whales dumping. But framing the entire discussion around “are zk-assets secretly bad for Zcash?” is a set up for exactly that mistake.
The second question is more reasonable: given basic zk-assets, can we improve the economics of them to benefit zec holders more than merely needing to buy zec for tx fees, getting increased usage of the chain, increased anonymity, and (hopefuly) better support for shielded usage? At it’s most extreme, the question asks a hypothetical: assume Zcash as a chain is incredibly successful, if you’re a zec holder who cares only about coin appreciation (and I think most of the zcash community isn’t that and that’s a good thing), then “what’s in it for me if most of the transactions are in zk-assets, not zec?” Do we have an answer to the zec holder? Do we need one? Do we need one now or just a “we have these plans for better economics for zk-assets v2?” The spec discusses a couple of ways to do this.
I should note, the framing of question two is also a logical trap. It assumes Zcash as a chain with only ZEC on it will be successful. But as I said, we will see credible privacy technologies used on other chains both for private native coins and private tokens/stable coins. So part of the answer for “what’s in it for me?” is the continued relevance of Zcash in such a world unlike in the one without zk-assets. We are behind the curve here and should catch up.
Think ZDAs are a great idea for Zcash. Also like to see programmability. (zecpages by far is the best thing about Zcash IMHO)
I take issue with arbitrarily increasing the fees for a subset of users on the network. Is that even a thing on any of the EVM chains?
Would also like a description of what a “free rider” on the network would be. If someone only wants to use zkUSD and only hold enough zec for transaction, then we want to suck some capital out of them?
First of all it’s not arbitrary, it would be set from day one of ZDAs and users can choose to accept it or not. Secondly, If we are taking about zBTC then the rate comparison in the users mind wouldn’t be “is it more expensive than a ZEC Tx?” it would be: “Is it cheaper/faster/more private than using Wasabi or Tornado cash?” to achieve some privacy for thier BTC holdings.
It’s important to note that no other EVM chains have a fixed-fee for all transactions like Zcash. If network use goes up or down on Ethereum then the rate changes accordingly. With ZDAs the rate has to be set to maintain maximum privacy benefits because fees are transparent.
So, since the rate is fixed for privacy, what should that rate be? ZDAs are essentially borrowing Zcash block space and privacy benefits for something other than Zcash , so why set the rate to do so the same as a normal Zcash transaction?
Isn’t it true that fee on Zcash will turn into Bitcoin-like simple auction as the blocks are full? So, I don’t see why we need to complicate it for ZSA. I mean, if we expect Zcash usage will increase as ZSAs are used, the fee market will adjust accordingly. IF Zcash the chain is used more and there is concern of future problems, we can react then. Also, if the free riding problem indeed exists and result in security concern for a blockchain, we will see it occur somewhere else first.
What I am trying to get at is this: Let’s get ZSAs released first and not add to more reasons to delay it. The probability of Zcash the chain to become a ghost chain increases as time goes on.
The answer for me is crystal clear, ZSA/UDA or whatever you want to call it. A lot of people are interested in Zcash the tech but they have no way of building something on top of it, and that’s just sad.
No, this is simply not true. As I mentioned before Zcash uses a fixed fee and needs to continue to do so to maintain privacy for transactions. Unique transaction fees = privacy leak.
I agree. Let’s get version 1.0 out there and we can tweak later as needed.
While I do agree Zcash has and continues to set the standard for digital privacy, I don’t agree that ship 'n tweak later for the sake of competition was how it happened. I don’t hang out in Ethereum, I can’t speak much to this really so you’ll have to explain why leveraging our ability to directly compete with it in such a way justifies rushing this.
My understanding is this is not enforced at consensus level. That’s why reducing the fee as in ZIP-313(?) did not require consensus-level code change. Ledger still uses Bitcoin-like fee for Zcash t-addr transaction. So, it’s reasonable to assume that fees will follow Bitcoin-style auction when blocks are full.
I think most people in this forum agree on this.
I don’t think anyone expects Zcash to compete with Ethereum. If anything, everyone wants to have a bridge to Ethereum. The competition is with other privacy chain especially those who spend all their money on marketing and just copies the tech. smh
It was and continues to happen on Ethereum. See upcoming EIP-1559 which is completely changing the gas fees/burn mechanic in response to network conditions. I doubt the development team envisioned the need to do EIP-1559 when Ethereum Frontier was launched in 2015.
Will ZDAs be so popular that they fill up blocks? What’s the best way to solve if so, faster blocks, higher fees, burn fees, Zk rollups? What other options do we have?
If we wait for the “perfect, forever valid” solution we will never ship anything because until we know how the network will use ZDAs we have nothing to reference as “the” silver bullet.
That’s also a good point. Perhaps I am getting ahead of myself and worrying about things that can be solved without a consensus level change.
If I recall correctly, Zcash specifies a minimum fee. Because blocks are something like 95% empty, thats mostly all anyone pays. So for now the question of fees for zk-assets is not related to block capacity. At some point we will need a fee market if things like zk-assets get zcash’s chain to be mostly full. We can do fees with something like EIP1559 and avoid privacy issues (since everyone pays the same fee based on how full previous blocks are). The question then is “is it worth making zk-asset fees higher?” I.e. do we want the increased anonymity set of zk-asset users to benefit zec users
I hope so although I know that some in ECC does not want t-address to go anywhere, so I guess let’s see what happens.
My understanding is t-addr will become a huge liability in the future for Zcash, not only on the privacy or maintenance side but more importantly on scalability. I am not aware of any way to allow a billion people to transact on legacy bitcoin scripts.
Has anyone tried zecpaperwallet and successfully imported that private key into a full node? I wanted to try generating a paper wallet on an air-gapped laptop, then sending a small amount of ZEC to it, then finally importing the private key into a zec full node installation so i can then access those funds again. Just curious if anyone has done this. If its reliable, I wanted to move all my holdings to a shielded paper wallet and finally move off of T addresses. Also, if i do this i was thinking of writing up a step by step guide for anyone looking to do the same.
Update: I used zecpaperwallet to generate a pdf with the paper wallet details for cold storage. I then used zecwallet lite on iOS to send a small amount of ZEC to the paper wallet’s shielded address. Now I have successfully imported the private key of the paper wallet on Zecwallet fullnode for Windows 10 and its just running the process now. I documented all of it with screen captures so I will be putting it up soon. I’ll provide the link when its ready. I think there is a strong need for people with significant amounts of ZEC to be able to put it in cold storage but they may not know how to easily regain access to the funds so hopefully a guide like the one I am making will allow more people to feel safe putting their ZEC into cold storage and at the same time get into the shielded pool.
