How Tornado Cash Relayer trustless protocol works?

Question

As anyone can see by the official GitHub repo, to became a Tornado Cash relayer, you need to install a node waiting for ZK Notes of the users. The node will provide them money they want to reclaim, keeping a fee.

Does anyone know how the workflow of this procedure exactly works?

Documentation says you need to host your relayer node then provide some information opening an Issue in the Tornado repo and they accept you.

But what is the security protocol?

What if, for example, I were accepted as a relayer node, then change my software with a malicious one that steals all the money from the users' notes?

I am extremely sure that this cannot happen, can anyone provide a technical explanation of why?

Answer 1

A relayer cannot steal money, as the Tornado smart contract will not allow this. Here is what Tornado FAQ say:

Relayers are used to withdraw to an account with no ETH balance. The relayer sends a withdrawal transaction and takes a part of the deposit as compensation (the protocol itself does not collect any fees). The relayer cannot change any withdrawal data including recipient address. The Tornado Cash initial developers do not control or play any role in relaying transactions, the relay network is independent and run by community.

So a relayer just publish other people's transactions, pay for gas, and receives a small fee forthis, but he cannot modify the transactions, thus cannot reroute the funds.

A Tornado withdrawal transaction consists of the following parts:

1. a zero-knowledge proof of transaction validity
2. the root of the Merkle tree where the deposit to be withdrawn is registered
3. the nullifier hash of the deposit
4. the recipient address funds are to be sent to
5. the relayer address fee is to be sent to
6. the fee amount
7. the amount of ether to be sent to the recpipient by the relayer as a partial fee refund (needed when ERC20 tokens are withdrawn, so the repicient could use this ether to pay for gas when moveing the tokens further)

The zero knowledge proof guarantees that the deposit with given nullifier and amount actually exists in the Merkle tree with given root, and that the one who generated the proof knew the secret deposit key and agreed with all the transaction parameters.

Relayers are needed, because in case a user would pay for the gas by himself, the origins of the ether used to pay for the gas might be traced thus deanonymizing the user.