Skip to content

Commit 41e4e49

Browse files
redshiftzeroredshiftzero
authored
flesh out privacy properties section (#58)
* privacy properties: move into main section * privacy properties: expand privacy properties * refactor: use nextra callout to render privacy info
1 parent 3de1093 commit 41e4e49

File tree

5 files changed

+114
-35
lines changed

5 files changed

+114
-35
lines changed

‎pages/_meta.json

+6
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,12 @@
3535
"breadcrumb": false
3636
}
3737
},
38+
"privacy": {
39+
"title": "Privacy Features",
40+
"theme": {
41+
"breadcrumb": false
42+
}
43+
},
3844
"web": "Using Penumbra on the web",
3945
"pcli": "Using Penumbra from the command line",
4046
"node": "Running a node",

‎pages/dev/_meta.json

+2-3
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,5 @@
99
"parameter_setup": "Zero-knowledge proofs",
1010
"rpc": "RPC access",
1111
"ibc": "Testing IBC",
12-
"build": "Compiling from source",
13-
"privacy": "Privacy"
14-
}
12+
"build": "Compiling from source"
13+
}

‎pages/dev/privacy.md

-31
This file was deleted.

‎pages/interchain-privacy.mdx

+1-1
Original file line numberDiff line numberDiff line change
@@ -82,7 +82,7 @@ linking different inbound transfers if the same address was used multiple times.
8282
Instead, Penumbra clients should automatically generate a new IBC deposit
8383
address for each transfer to ensure deposits are not linkable. This is not a
8484
problem for transfers _within_ Penumbra, where addresses are not revealed
85-
anyways.
85+
anyways. For further details on the provided privacy properties, see [Privacy Features](/privacy#ibc-transfers).
8686

8787
#### Inspecting Addresses
8888

‎pages/privacy.mdx

+105
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,105 @@
1+
import { Callout, FileTree, Steps, Cards, Card, Tabs } from 'nextra/components'
2+
3+
# Privacy Features
4+
5+
This document describes the privacy features of the Penumbra protocol for typical user actions.
6+
7+
## Transfers within Penumbra
8+
9+
Transfers within Penumbra's shielded pool do not reveal:
10+
11+
<Callout type="info" emoji="🔒">Asset Type</Callout>
12+
13+
<Callout type="info" emoji="💰">Amount</Callout>
14+
15+
<Callout type="info" emoji="👤">Sender or Recipient Identity</Callout>
16+
17+
Transfers are also unlinkable to each other.
18+
19+
## Submitting swap intents
20+
21+
Initiating a swap does not reveal:
22+
23+
<Callout type="info" emoji="👤">Identity of the swapper</Callout>
24+
25+
<Callout type="info" emoji="💰">Pre-paid claim fee</Callout>
26+
27+
A swap does reveal:
28+
29+
<Callout type="warning" emoji="💰">Input assets and amounts in the swap</Callout>
30+
31+
<Callout type="warning" emoji="💰">Output assets and amounts in the swap</Callout>
32+
33+
## Claiming swap outputs
34+
35+
Claiming a swap does not reveal:
36+
37+
<Callout type="info" emoji="💰">Amounts minted of each asset type in the trading pair</Callout>
38+
39+
<Callout type="info" emoji="👤">Identity of the claimant</Callout>
40+
41+
An observer of the chain will see that an anonymous account minted shielded outputs of a swap in a specific trading pair, but those outputs can't be linked to the claimant.
42+
43+
## Providing liquidity to the DEX
44+
45+
Market makers that open liquidity positions reveal:
46+
47+
<Callout type="warning" emoji="💰">Amount of liquidity provided</Callout>
48+
49+
<Callout type="warning" emoji="💰">Bounds in which the liquidity is concentrated</Callout>
50+
51+
The liquidity positions are not linked to:
52+
53+
<Callout type="info" emoji="👤">Identity of the market maker</Callout>
54+
55+
If a market maker opens multiple positions they wish to be unlinkable, they can do so by opening multiple positions across different transactions.
56+
57+
## Delegator Voting
58+
59+
A delegator vote does not reveal:
60+
61+
<Callout type="info" emoji="👤">Address of the voter</Callout>
62+
63+
A delegator vote does reveal:
64+
65+
<Callout type="warning" emoji="💰">Voting power (the amount and asset type of the staked note that's used for voting)</Callout>
66+
67+
<Callout type="warning" emoji="👤">Vote</Callout>
68+
69+
<Callout type="warning" emoji="💻">Identity of the validator (equivalent to the asset type)</Callout>
70+
71+
<Callout type="warning" emoji="👤">Proposal being voted on</Callout>
72+
73+
## Staking
74+
75+
Delegating does not reveal:
76+
77+
<Callout type="info" emoji="👤">Address of the delegator</Callout>
78+
79+
Delegating does reveal:
80+
81+
<Callout type="warning" emoji="💻">Identity of the validator being delegated to (equivalent to the asset type)</Callout>
82+
83+
<Callout type="warning" emoji="💰">Delegation amount</Callout>
84+
85+
## IBC Transfers
86+
87+
Inbound IBC transfers reveal:
88+
89+
<Callout type="warning" emoji="🔗">Source chain of the funds</Callout>
90+
91+
<Callout type="warning" emoji="💰">Amount and denomination of the funds</Callout>
92+
93+
<Callout type="warning" emoji="🔗">Deposit address on the Penumbra chain</Callout>
94+
95+
The boundary between Penumbra's private shielded pool and the public transparent ecosystem is the boundary between the Penumbra zone and the rest of the Cosmos ecosystem. IBC transfers into Penumbra effectively disappear into the shielded pool via the IBC deposit address. Since Penumbra shielded addresses are not linkable, the IBC deposit address is not linked to any other address in Penumbra. Clients should generate a new IBC deposit address for each IBC transfer to a Penumbra shielded address to prevent linking multiple IBC transfers.
96+
97+
Outbound IBC withdrawals reveal:
98+
99+
<Callout type="warning" emoji="💰">Amount and denomination of the withdrawal</Callout>
100+
101+
<Callout type="warning" emoji="🔗">Address on the destination chain that the withdrawal is sent to</Callout>
102+
103+
<Callout type="warning" emoji="👤">Sender/return address on the Penumbra chain (in case the funds need to be returned to the user)</Callout>
104+
105+
The return address is typically configured to be a one-time only Penumbra shielded address. Alternatively, Penumbra transparent addresses can be used for the return address for maximum compatibility with Cosmos chains. However, multiple IBC withdrawals that use a Penumbra transparent return address can be linked due to there being a single transparent address per Penumbra wallet. Users can avoid this privacy leak by using a new wallet for each IBC transfer to a Penumbra transparent address.

0 commit comments

Comments
 (0)