Tornado Cash: A Force For Good Or Evil?

By BlockSense

When cryptocurrency first emerged with the creation of Bitcoin in 2009, it was regarded as a highly innovative form of technology due to the unique values associated with it. Never before had there been a decentralized form of currency with the potential to wipe out intermediaries like banks entirely when processing transactions. Bitcoin offered its users a unique promise- the privilege of privacy and anonymity in a world heavily regulated by governments and federal agencies (the intentions of whom are still up for debate).

As time went on, various use cases for both blockchain technology and cryptocurrency in general emerged. Among these was the emergence of Tornado Cash, a popular privacy solution built on Ethereum. Working slightly differently from a standard coin mixer, Tornado Cash is used to achieve the same goal of hiding a transaction trace. In this way, a user can prevent someone else from piecing together clues from their transaction history in an attempt to uncover their identity. Although this service is highly beneficial to those who value their privacy, it can also be very useful for malicious actors wanting to cover their tracks after an exploit.

This dual nature brings forth layers of doubt surrounding the morality of Tornado Cash. Who benefits more from using Tornado Cash? The average man concerned about his privacy, or a criminal with millions of dollars worth of stolen funds? At the end of the day, can it be argued that Tornado Cash is doing more harm than good?

Before we discuss this, let us try to understand the technology used by the protocol in carrying out its service.

How Does Tornado Cash Work?

To combat this paradox of privacy and transparency, users can take the help of the Ethereum-based privacy solution Tornado Cash. Tornado Cash uses a type of zero-knowledge proof known as zk-SNARKs to achieve this.

Initially, a user is provided with a randomly generated key known as a note. The hash of this note is then supplied to the Tornado Cash smart contract along with the amount of Ether a user wishes to send. Now, imagine hundreds of users are doing the same thing, each person submitting the hash of their unique key along with a fixed amount of money. You can think of this as the smart contract containing a pool of a large sum along with many hashes of notes.

When a user decides to withdraw their amount, they can simply submit the hash they had initially shown to the Tornado Cash smart contract. The existence of this hash will prove that their money was deposited. Once the provided hash matches with that of a note present in the pool, money can be withdrawn to a recipient address.

The amount deposited and withdrawn is the same, but the ERC20 tokens that make up that value are different each time. In this way, the on-chain link between source and destination addresses is broken- meaning there is no way to link the withdrawal to the deposit.

Tornado Cash In The News

In recent times, it seems that almost every analysis report for a major or minor hack in the blockchain space has some mention of Tornado Cash. Big names like Liquid Global, Poly Network, and Kucoin have all faced exploits in the past, with losses equating to millions of dollars worth of funds. In each scenario, the attacker was seen utilizing the privacy solution Tornado Cash in an attempt to get away with their loot. In most cases, this is where the trail goes cold, preventing the attacker from being caught.

Ensuring The Common Man’s Privacy or Facilitating Criminal Activity?

A question that arises amidst its growing popularity is regarding who to consider as the true users of Tornado Cash. It can be argued that privacy is an important concept to any person operating in the blockchain space. The majority of people who consider themselves members of the blockchain community are believers in the values of anonymity and decentralization. In a world of regulations, a platform like Tornado Cash helps keep the common man assured that his activity isn’t being tracked for someone else’s benefit.

However, we cannot refute the claim that Tornado Cash is often the first line of action in an attacker’s getaway scheme. This has become common to the point where users are concerned that using Tornado Cash for their personal use may tie them to criminal activity. While no one will be able to connect a user’s withdrawal to their deposit, it will be clear that the withdrawal came from Tornado Cash and hence create grounds for suspicion.

The Bottom Line

References

https://soliditydeveloper.com/tornado.cash/

https://tornado.cash/Tornado.cash_whitepaper_v1.4.pdf

Enjoyed reading this piece? Subscribe to our newsletter to get instantly notified of new stories directly in your inbox at https://blockapex.medium.com/subscribe.