3

Basically, I'd like to have unique records which can be transferred between parties without anyone knowing who owns a particular record until a transfer occurs, at which time only the recipient can tell who owned the record.

Mostly, I'm curious as to whether something like this is even theoretically possible. I'm especially interested in knowing whether or not someone has accomplished it.

user9657
  • 33
  • 1
  • 3

4 Answers4

4

If your NFT is ERC721 compliant, then no, according to the non-finalised ERC721 Standard, this is not possible. A requirement of the standard is that your NFT token contract contain the following function.

function ownerOf(uint256 _tokenId) external view returns (address);

The function takes a single argument (the tokenId) and returns the address of the token owner.

AnAllergyToAnalogy
  • 3,553
  • 11
  • 23
  • Right, thank you for pointing to the standard. I'd be open to considering a custom NFT format as needed. – user9657 Mar 28 '18 at 00:57
  • Of course, there is no requirement that your token adhere to any standard, but you should be aware that non-compliance will be a barrier to having your token adopted by other projects or marketplaces. But if you don't intend for your token to be used or traded outside of your own ecosystem, then compliance to standards probably isn't important. – AnAllergyToAnalogy Mar 28 '18 at 01:18
  • Moreover nobody tell you what the function has to be. You are free to do whatever you require. If you want that it be usable by some users and not by other, as far as the interface specification are respected, nobody can say to you you are wrong. In othe word: in the IERC20 it is expected to have a balanceOf(address). But if you write on line 1 “require (msg.sender = Vitalik Buterin);” it is ok from the point of view of the standard – Rick Park Jan 10 '19 at 21:13
  • There's also nothing stopping you from creating an NFT where the owner is set to something like Tornado protocol, although until a sufficient amount of NFTs are added to the protocol, it would be trivial to find the owner. That's the one problem with obfuscation tech on Ethereum, it doesn't provide any true privacy for the earliest of adopters. – jon.bray.eth Mar 13 '21 at 21:58
2

To add to @anAllergyToAnalogy's answer.

Even if your token is not ERC721 compliant you are basically asking whether it's possible to store secret information in the blockchain. You probably know that the answer is pretty much "no".

You can think of all sorts of solutions but they typically involve encryption before sending to the blockchain and the contract itself wouldn't have access to the information without help from outside. And in that case the point of using Ethereum is a bit lost.

Lauri Peltonen
  • 29,391
  • 3
  • 20
  • 57
  • Thank you for your response. Right, I'm definitely going to be pursuing one of those solutions involving encryption. I don't think this completely negates the point of using Ethereum, particularly if this is only used to disguise particular fields or provide some record which the owner can reveal at a later time. – user9657 Mar 28 '18 at 00:59
1

zknifty is a working example of non-fungible tokens (NFTs) based on zk-SNARK proofs. However, it was not designed for privacy as its goal is to "compress" several transactions into one proof (i.e. it minimizes the stored data on the smart contract). The basic idea is that the smart contract stores only the root of a Merkle tree of which any change fulfill the following requirements:

  • The actual owner of the token to be transferred signed a message
  • This message is composed of the token ID and the receiver address
  • The signature is valid
  • The token transfer is reflected in the new merkle tree

The preimage of the leaves of this tree contain the owner's public key and the identifier of NFTs. It does provide some privacy since only the root the tree is stored on the contract and it is not possible to gain knowledge from these proofs.

There are some caveats though:

  • As this project was not designed for privacy, leaves do not contain a nounce and hence can be guessed by brute-force; i.e. h(token ID || receiver address) with a known set of token ID and addresses.
  • Since you are asking this question for Ethereum, an Ethereum transaction always contain the sender address which might be an issue.

Disclaimer: I am not the author of zknifty

DurandA
  • 130
  • 6
-2

I wouldn't rule it out.

A lot will depend on the precise formulation of assurances the system is meant to present. For example, "until a transfer occurs, at which time only the recipient can tell who owned the record."

So far so good. Now, is the recipient meant to be cloaked from everyone else so this process can repeat, or is it okay for the ownership of the asset to be revealed from this point forward? In other words, is only the original owner a secret, or the whole chain of custody? Is there any advantage in concealing the seller from the buyer?

I incline to think it's theoretically possible but non-trivial. It's about designing processes for obfuscation and deobfuscation of the facts and formulating proofs.

Hope it helps.

Rob Hitchens
  • 55,151
  • 11
  • 89
  • 145
  • Thank you for your response. For this particular use case, I'd be looking to disguise the entire chain of custody. I suppose this would be impossible, no? – user9657 Mar 28 '18 at 01:02
  • I've learned to never say "no" because some clever guy will come along with a solution. It's not trivial. – Rob Hitchens Mar 28 '18 at 01:13