4

As I understand it, when you send ETH into Tornado Cash, you have a piece of information that you can later submit from any address to retrieve your ETH.

In this case, if I can retrieve it from anywhere, so can anyone. This is the archetypical example of MEV, so I want to know how Tornado Cash can protect against it?

Improve this question

3 Answers 3

Reset to default
5

The proof you submit can only be used to redeem the eth to the wallet the owner specified, when the proof was created.
Front running the relayer by stealing that proof wont do much. The relayer and the user will still get the funds while you're just burning gas!

The relayer fee, address and withdraw address are part of the circuit as public inputs. Which means that trying to verify other public inputs with then what that proof was generated with, will fail.

This is a good article with a section about not being able to frontrun this :) https://www.rareskills.io/post/how-does-tornado-cash-work

Improve this answer
1
  • The rest of the proof is verifying that the secret note is part of the merkle tree of valid deposits. That secret note is a private input of the circuit and wont be revealed ofc!
    – Jimjim.eth
    Oct 2 at 22:43
3

TC txs are not able to be front-run as the info needed to withdraw the eth is not generated on chain. User deposits into TCs smart contract with a 'note commitment', this 'note' was generated locally, usually by the TC frontend in the browser. For withdrawals, the user generates a zk-SNARK proof using the original secret note. This proof validates that the user knows a note corresponding to an existing on-chain commitment

Improve this answer
-2

This is the archetypical example of MEV, so I want to know how Tornado Cash can protect against it?

This is not what MEV means. Please read the description of MEV here.

TornadoCash is not subject to MEV attacks, because it does not do trading.

Improve this answer
4
  • Okay maybe the terminology is not 100% sound, but frontrunning transactions is part of MEV, at least according to this blog. As you are submitting a piece of information to receive ETH, any account can submit that piece of information and run away with the funds that will be received. My question is how exactly Tornado Cash prevents this, as their use case is exactly to let any account retrieve the funds.
    – vrwim
    Oct 2 at 12:44
  • 2
    His question focuses on why Tornado Cash (TC) txs can't be front-run, given that front-running is a form of MEV @vrwim TC txs are not able to be front-run as the info needed to withdraw the eth is not generated on chain. User deposits into TCs smart contract with a 'note commitment', this 'note' was generated locally, usually by the TC frontend in the browser. For withdrawals, the user generates a zk-SNARK proof using the original secret note. This proof validates that the user knows a note corresponding to an existing on-chain commitment.
    – Another0xDev
    Oct 2 at 12:48
  • 1
    Thank you @Another0xDev! If you post this as an answer, I will accept it.
    – vrwim
    Oct 2 at 12:50
  • 1
    There is nothing to frontrun, so the question does not make sense.
    – Mikko Ohtamaa
    Oct 2 at 18:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.