# Aragon and Aztec -- Private Voting Sprint
:::info
submission https://prop.house/nouns/private-voting-research-sprint
:::

<!-- example of a comment
of multiple lines
-->

## Title (max. 80 characters)
**Aragon and Aztec will develop an optimal private voting solution for NounsDAO**

## TL;DR (max. 120 characters)

State-of-the-art DAO private voting with minimal off-chain dependency via Ethereum storage proofs and time-lapse encryption

----
----

## Summary
:::warning
:pushpin: **Forenote**

The full proposal consists of this page and the [detailed sections](#More-Details) linked at the bottom of the page. Readers are encouraged to review them to understand the proposal more throughly.
:::

:::info
For more information, contact:
- Alex Kampa @ Aragon ([e-mail] / [@alexkampa](https://t.me/alexkampa)) or
- Savio Sou @ Aztec ([e-mail] / [@Globallager](https://t.me/Globallager))
:::

Utilizing zero-knowledge (ZK) for privacy has been challenging until recently due to the computational intensity of generating zero knowledge proofs (ZKP). Now, with the emergence of domain-specific languages like Noir, which leverages advancement in ZK technologies like UltraPlonk, we are now able to offer a **one-step voting process** for NousDAO NFT holders with minimal off-chain dependencies.

We would be excited to introduce this cutting edge voting process to the Nouns DAO. We are confident that our approach ensures **privacy and fairness** by making it impossible to link a voter with their voting choice and prohibiting the tallying of results before the end of the voting period. Our voting process also **prioritizes user experience while still maintaining privacy**.

To best serve the needs and preferences of NounsDAO, we propose an incremental approach that operates in **three distinct phases**. This approach limits the risk of any single phase and allows for future extensions and optimizations. In three months' time, we will be building the best solution the industry can provide, taking into account the tradeoffs and unique needs of NounsDAO.

In summary, this proposal almost completely fulfills all the [requirements of the call](https://hackmd.io/SVyDLBq7QSWNl0LaYIuqHA). The only exception is native multisig support, which can be added at a later stage.

<!--
:::
Zero-knowledge (ZK) cryptography can enable interesting use cases in the context of decentralized blockchains. Many L2s are utilizing this form of cryptography for the purpose of scaling Ethereum throughput, but **utilizing ZK for privacy has a unique set of challenges**.

For users to truly benefit from censorship-resistant private voting on Ethereum, the user will likely need to **generate zero-knowledge proofs (ZKP) on their own device**. Those proofs would allow users to prove that they are a member of the set of allowed voters (e.g., 'all Nouns holders at the time of the proposal submission') without exposing which exact Nouns holder they are.

For years, the computational cost to generate ZKPs has been incredibly high. It has in turn **blocked most consumer devices out** from handling the necessary computation overhead within any reasonable amount of time, making private voting infeasible.

With the advancement in ZK technologies like **UltraPlonk** and the emergence of domain-specific languages that make use of them like **Noir**, we are now able to offer a **one-step voting process** per NFT holder with minimal off-chain actions.

This approach ensures **privacy and fairness** by making it impossible to link a voter with their voting choice and prohibiting the tallying of results before the end of the voting period. We are confident that this approach **prioritizes user experience while also maximizing privacy**.

Our incremental approach operates in **3 distinct phases**. This limits the risk of any one phase and allows for future extensions and optimizations. In 3 months time, we will be building the optimal solution that the state of the art is capable to deliver.

-->

## Team

This is a joint proposal by the Aragon ZK Research guild and the Aztec Network team. We are partnering on this proposal because we believe that our teams bring the right mixture of domain-specific knowledge in DAO governance, privacy, and zero-knowledge cryptography to deliver the best possible solution for NounsDAO’s private voting needs.

### Aragon

The Aragon ZK Research Guild is a part of Aragon, a leading provider of on-chain infrastructure for creating and managing DAOs. Members of our team has been working on privacy-preserving technology for DAOs since 2019. As part of our ongoing collaboration with Aztec, we have made direct contributions to the Noir language through the Aztec Grants program. If this proposal is funded, AZKR’s portion of the funding will go to the Aragon DAO to fund teams building technology aligned with the Aragon Manifesto.

### Aztec
Aztec's goal is to take the original promise of Ethereum – a decentralized and verifiable world computer – and expand its capability immensely by making it fully encrypted. To enable this new world of verifiable encryption, we’ve developed a universal language for zero knowledge called Noir. If this proposal is funded, Aztec’s portion of the funding will go towards funding public goods like the Protocol Guild and/or Gitcoin funding rounds.

## Research Approach and Nouns Voting Experience

We explored many different approaches while preparing this proposal, and considered the tradeoffs that NounsDAO requires. We selected validating Ethereum storage proofs using Noir because we believe this provides the optimal solution, maximizing privacy and minimizing off-chain dependencies. The use of **Ethereum storage proofs** means that **the census does not need to be generated off-chain**, as it directly corresponds to the set of token holders stored in Ethereum's state, which is **a game-changer for DAOs operating entirely on-chain**. This solution provides a state-of-the-art combination of decentralization, user experience, and privacy.

The implementation of our proposal will be done in three phases:

1. **MVP** -- The *Minimal Viable Product* of on-chain private voting: voters are anonymous, their voting choice is simply encrypted (e.g. with Multi-Party Computation (MPC) for each proposal), and the gas is paid by the user.
2. **Adding a delay-relayer service** -- With a delay-relayer service, gas will be paid by a third party and the submission of the vote will come via batching of votes by the relayer. This protects a voter from accidentally leaking their address or the number of Nouns they’re using to vote. Crucially, this relayer is opt-in for Nouns voters and not mandatory.
3. **Adding a time-lapse service** -- The time-lapse service will allow voters to encrypt their votes using the same public key generated at the onset of the proposal. Once the proposal voting is complete, the time-lapse service exposes the corresponding private key, allowing for the decryption of the tallied votes, not addresses. This eliminates the need for MPC for each proposal. Moreover, the development and deployment of such a service may benefit many web3 projects looking to implement private voting.

With the time-lapse service, anyone will be able to trustlessly decrypt the ballots and compute the result of the vote and the corresponding proof, and anyone will be able to send the result and proof to the contract.

By default, Nouns holders will be able to cast votes for the NFTs they own, or for tokens that have been delegated to them. We believe the proposed solution is optimal given NounsDAO's requirement for minimal off-chain dependencies and the request for simplicity in the end user's experience. However, we are constrained by the current state of ZK tech, and know there is still room for improvement once recursive ZK proofs become available.

Potential improvements and additions to the design include:

- Native multisig support
- Ballot batching to reduce gas costs
- A more trustless design of the time-lapse service
- Improved security of the delay-relayer by using the time lapse service
- Private gas payment
- \>3 voting options (Yes, No, Abstain, and others)

We believe this voting solution will significantly improve the voting experience of Noun holders and we look forward to hearing from the NounsDAO community. For any questions and comments, reach out to Alex or Savio at their contact information at the top. Thank you!

See [Further Work](/L6oniVQNRh2eT2nLjOfKLA) for more details.

## More Details
:::warning
:pushpin: **Note**

We encourage readers to review the individual sections linked below, as they will aid in gaining a complete understanding of the proposal.
:::

### More about the team
* [Aragon ZK Research Guild](https://research.aragon.org/about)
* [Aztec Team](https://aztec.network/careers)
* [The Noir Programming Language](https://noir-lang.org/index.html)

### Proposal details
* [Timing and Impact](https://hackmd.io/@aFgwLUmqRw6FBma4HqKN7A/S1zoTPhCi/edit)
* [Main Features, Formal Properties and Requirement Checklist](https://hackmd.io/@aFgwLUmqRw6FBma4HqKN7A/HJbOcw2Cj/edit)
* [Infrastructural Components and Technologies Used](https://hackmd.io/@aFgwLUmqRw6FBma4HqKN7A/BJm9hv20o)
* [Technical Description](https://hackmd.io/@aFgwLUmqRw6FBma4HqKN7A/Syfjtv2Aj/edit)
* [Nouns NFT contract analysis](/Z8T0iV_-RD2p_plOKMRorw)
* [Further Work](https://hackmd.io/L6oniVQNRh2eT2nLjOfKLA)