3

Basically, I'd like to have unique records which can be transferred between parties without anyone knowing who owns a particular record until a transfer occurs, at which time only the recipient can tell who owned the record.

Mostly, I'm curious as to whether something like this is even theoretically possible. I'm especially interested in knowing whether or not someone has accomplished it.

Improve this question

4 Answers 4

Reset to default
-2

I wouldn't rule it out.

A lot will depend on the precise formulation of assurances the system is meant to present. For example, "until a transfer occurs, at which time only the recipient can tell who owned the record."

So far so good. Now, is the recipient meant to be cloaked from everyone else so this process can repeat, or is it okay for the ownership of the asset to be revealed from this point forward? In other words, is only the original owner a secret, or the whole chain of custody? Is there any advantage in concealing the seller from the buyer?

I incline to think it's theoretically possible but non-trivial. It's about designing processes for obfuscation and deobfuscation of the facts and formulating proofs.

Hope it helps.

Improve this answer
2
  • Thank you for your response. For this particular use case, I'd be looking to disguise the entire chain of custody. I suppose this would be impossible, no?
    – user9657
    Commented Mar 28, 2018 at 1:02
  • I've learned to never say "no" because some clever guy will come along with a solution. It's not trivial.
    – Rob Hitchens
    Commented Mar 28, 2018 at 1:13
4

If your NFT is ERC721 compliant, then no, according to the non-finalised ERC721 Standard, this is not possible. A requirement of the standard is that your NFT token contract contain the following function.

function ownerOf(uint256 _tokenId) external view returns (address);

The function takes a single argument (the tokenId) and returns the address of the token owner.

Improve this answer
4
  • Right, thank you for pointing to the standard. I'd be open to considering a custom NFT format as needed.
    – user9657
    Commented Mar 28, 2018 at 0:57
  • Of course, there is no requirement that your token adhere to any standard, but you should be aware that non-compliance will be a barrier to having your token adopted by other projects or marketplaces. But if you don't intend for your token to be used or traded outside of your own ecosystem, then compliance to standards probably isn't important.
    – AnAllergyToAnalogy
    Commented Mar 28, 2018 at 1:18
  • Moreover nobody tell you what the function has to be. You are free to do whatever you require. If you want that it be usable by some users and not by other, as far as the interface specification are respected, nobody can say to you you are wrong. In othe word: in the IERC20 it is expected to have a balanceOf(address). But if you write on line 1 “require (msg.sender = Vitalik Buterin);” it is ok from the point of view of the standard 😉
    – Rick Park
    Commented Jan 10, 2019 at 21:13
  • There's also nothing stopping you from creating an NFT where the owner is set to something like Tornado protocol, although until a sufficient amount of NFTs are added to the protocol, it would be trivial to find the owner. That's the one problem with obfuscation tech on Ethereum, it doesn't provide any true privacy for the earliest of adopters.
    – jon.bray.eth
    Commented Mar 13, 2021 at 21:58
2

To add to @anAllergyToAnalogy's answer.

Even if your token is not ERC721 compliant you are basically asking whether it's possible to store secret information in the blockchain. You probably know that the answer is pretty much "no".

You can think of all sorts of solutions but they typically involve encryption before sending to the blockchain and the contract itself wouldn't have access to the information without help from outside. And in that case the point of using Ethereum is a bit lost.

Improve this answer
1
  • Thank you for your response. Right, I'm definitely going to be pursuing one of those solutions involving encryption. I don't think this completely negates the point of using Ethereum, particularly if this is only used to disguise particular fields or provide some record which the owner can reveal at a later time.
    – user9657
    Commented Mar 28, 2018 at 0:59
1

zknifty is a working example of non-fungible tokens (NFTs) based on zk-SNARK proofs. However, it was not designed for privacy as its goal is to "compress" several transactions into one proof (i.e. it minimizes the stored data on the smart contract). The basic idea is that the smart contract stores only the root of a Merkle tree of which any change fulfill the following requirements:

  • The actual owner of the token to be transferred signed a message
  • This message is composed of the token ID and the receiver address
  • The signature is valid
  • The token transfer is reflected in the new merkle tree

The preimage of the leaves of this tree contain the owner's public key and the identifier of NFTs. It does provide some privacy since only the root the tree is stored on the contract and it is not possible to gain knowledge from these proofs.

There are some caveats though:

  • As this project was not designed for privacy, leaves do not contain a nounce and hence can be guessed by brute-force; i.e. h(token ID || receiver address) with a known set of token ID and addresses.
  • Since you are asking this question for Ethereum, an Ethereum transaction always contain the sender address which might be an issue.

Disclaimer: I am not the author of zknifty

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.