Flash Freezing Flash Boys: Per-transaction encryption to fight malicious MEV

Malicious MEV attacks airs a important menace to traders connected Ethereum. Our latest research shows that astir 2,000 sandwich attacks hap regular and much than $2 cardinal is extracted from the web each month. Even traders who execute ample WETH, WBTC oregon unchangeable swaps stay astatine hazard and tin suffer a important information of their trades. 

MEV thrives due to the fact that of the transparent quality of blockchains, wherever transaction information is disposable earlier transactions are executed and finalized. One way toward mitigating MEV is mempool encryption, peculiarly done the usage of threshold encryption. In our earlier articles, we examined 2 antithetic models for threshold-encrypted mempools. Shutter, 1 of the archetypal projects to use threshold encryption to support the mempool, introduced a per-epoch setup. Batched threshold encryption (BTE), a newer model, decrypts aggregate transactions with a azygous cardinal to trim connection costs and rise throughput.

In this piece, we analyse Flash Freezing Flash Boys (F3B) by H. Zhang et al. (2022), a recently projected threshold encryption plan that applies encryption connected a per-transaction basis. We research its mechanics, explicate its scaling properties arsenic concerns latency and memory, and sermon the reasons it has not yet been deployed successful practice.

How Flash Freezing Flash Boys implements per-transaction encryption

Flash Freezing Flash Boys addresses limitations successful aboriginal threshold encryption systems that relied connected per-epoch setups. Projects specified arsenic FairBlock and the aboriginal versions of Shutter utilized a azygous cardinal to encrypt each transaction wrong a selected epoch. An epoch is simply a fixed fig of blocks, e.g., 32 blocks connected Ethereum. This created a vulnerability wherever immoderate transactions that neglect to beryllium included successful the specified artifact ends would inactive beryllium decrypted with the remainder of the batch. This would exposure delicate information and unfastened up MEV opportunities to validators, frankincense making them susceptible to front-running.

F3B applies threshold encryption connected a per-transaction basis, which ensures that each transaction remains confidential until it reaches finality. The wide travel of the F3B protocol is shown successful the fig below. The idiosyncratic encrypts the transaction with a cardinal that lone the designated threshold committee, known arsenic the Secret Management Committee (SMC), tin access. The transaction ciphertext and the encrypted cardinal are sent to the statement radical arsenic a brace (Step 1). Thus, nodes tin store and bid transactions portion retaining each required decryption metadata for punctual post-finality reconstruction and execution. Meanwhile, the SMC prepares its decryption shares but withholds them until the statement commits the transaction (Step 2). Once a transaction is finalized and the SMC releases capable valid shares (Step 3), the statement radical decrypts the transaction and executes it (Step 4).

Per-transaction encryption had agelong remained impractical owed to its dense computational load for encryption and decryption arsenic good arsenic the retention request from ample encrypted payloads. F3B addresses this by threshold-encrypting lone a lightweight symmetric cardinal alternatively of the afloat transaction. The transaction itself is encrypted with this symmetric key. This attack tin trim the magnitude of information that needs to beryllium asymmetrically encrypted by up to ~10 times for a elemental swap transaction. 

Comparison of antithetic cryptographic implementations of F3B and their latency overhead

Flash Freezing Flash Boys tin beryllium implemented with 1 of 2 cryptographic protocols, either TDH2 oregon PVSS. The quality lies successful who bears the setup load and however often the committee operation is fixed, with corresponding advantages and disadvantages successful flexibility, latency and retention overhead.

TDH2 (Threshold Diffie-Hellman 2) relies connected a committee that runs a distributed cardinal procreation (DKG) process to nutrient idiosyncratic cardinal shares on with a corporate nationalist key. Then, a idiosyncratic creates a caller symmetric key, encrypts their transaction with it, and encrypts that symmetric cardinal to the committee’s nationalist key. The statement radical writes this encrypted brace onto the chain. After the concatenation reaches the required fig of confirmations, committee members people partial decryptions of the encrypted symmetric cardinal unneurotic with NIZK (Non-Interactive Zero-Knowledge) proofs, which are required to forestall chosen-ciphertext attacks, wherever attackers taxable malformed ciphertexts to effort to instrumentality trustees into leaking accusation during decryption. NIZKs warrant the user’s ciphertext is well-formed and decryptable, and besides that trustees submitted close decryption shares.  Consensus verifies the proofs and, erstwhile a threshold of valid shares is available, reconstructs and decrypts the symmetric key, decrypts the transaction, and past executes it.

The 2nd scheme, PVSS (Publicly Verifiable Secret Sharing), follows a antithetic path. Instead of the committee moving a DKG successful each epoch, committee members each person a semipermanent backstage cardinal and a corresponding nationalist key, which is stored connected the blockchain and accessible to immoderate user. For each transaction, users prime a random polynomial and usage Shamir’s concealed sharing to make concealed shares, which are past encrypted for each chosen trustee utilizing the respective nationalist key. The symmetric cardinal is obtained by hashing the reconstructed secret. The encrypted shares are each accompanied by an NIZK proof, which allows anyone to verify that each shares were derived from the aforesaid secret, on with a nationalist polynomial commitment, a grounds that binds the share-secret relationship. The consequent steps of transaction inclusion, post-finality stock release, cardinal reconstruction, decryption and execution are akin to those successful the TDH2 scheme. 

The TDH2 protocol is much businesslike owed to a fixed committee and constant-size threshold-encryption data. PVSS, by contrast, gives users much flexibility, since they tin prime the committee members liable for their transaction. However, this comes astatine the outgo of larger public-key ciphertexts and higher computational overhead owed to per-trustee encryption. In the greater strategy of things, the prototype implementation of the F3B protocol connected simulated proof-of-stake Ethereum showed that it has minimal show overhead. With a committee of 128 trustees, the hold incurred aft finality is lone 197 sclerosis for TDH2 and 205 sclerosis for PVSS, which is equivalent to 0.026% and 0.027% of Ethereum’s 768-second finality time. Storage overhead is conscionable 80 bytes per transaction for TDH2, portion PVSS’s overhead grows linearly with the fig of trustees owed to per-member shares, proofs and commitments. These results corroborate that F3B could present its privateness guarantees with negligible interaction connected Ethereum’s show and capacity.

Incentives and punishments successful the Flash Freezing Flash Boys protocol

F3B incentivizes honorable behaviour among Secret Management Committee trustees done a staking mechanics with locked collateral. Fees motivate trustees to enactment online and support the level of show the protocol requires. A slashing astute declaration ensures that if anyone submits impervious of a violation, which demonstrates that decryption was performed prematurely, the offending trustee’s involvement is forfeited. In TDH2, specified impervious consists of a trustee’s decryption stock that tin beryllium publically verified against the transaction ciphertext. Meanwhile, successful PVSS, the proofs dwell of a decrypted stock unneurotic with a trustee-specific NIZK impervious that authenticates it. This mechanics penalizes provable premature disclosure of decryption shares, expanding the outgo of detectable misbehavior. However, it does not forestall trustees from colluding privately off-chain to reconstruct and decrypt transaction information without publishing immoderate shares. As a result, the protocol inactive relies connected the presumption that bulk of committee members behave honestly. 

Because encrypted transactions cannot beryllium executed immediately, different onslaught vector is for a malicious idiosyncratic to flood the blockchain with non-executable transactions to dilatory down confirmation times. This is simply a imaginable onslaught aboveground communal to each encrypted mempool schemes. F3B requires that users marque a retention deposit for each encrypted transaction, which makes spamming costly. The strategy deducts the deposit upfront and refunds lone portion of it erstwhile the transaction executes successfully.

Challenges to deploying F3B connected Ethereum