The NEAR Intents saga just got much more crazy on further investigation.
Much is missing from Intents, but key enabling component turns out to be stolen proprietary DFINITY tech. Iâm stunned.
Whatâs worse, is that to take the tech, they used someone DFINITY fired in the summer of 2021, who was linked to a number of attempts to harm the project.
Now, GitHub is showing that after two and a half years, NEAR is suddenly trying to do an emergency downgrade from our algorithms (links at the bottom) for reasons we can only guess at.
This will take time to digest, and there are legal implications, so Iâll just give you the simple background:
1) May 16, 2021, I I announced on X work to integrate the Internet Computer with Ethereum using âchain keyâ cryptography, and I followed up with a Medium post:
https://medium.com/dfinity/internet-computer-ethereum-integration-explained-6967456e35f9
The industry widely reported on our work that month.
https://decrypt.co/72256/how-dfinitys-internet-computer-will-integrate-ethereum
2) This was when the relevant technical work began, and NEAR has taken a subset of it. We assembled a team of cryptographers to develop the novel cryptography required because it was non-trivial work.
3) The first relevant paper DFINITY published was âOn the security of ECDSA with additive key derivation and presignatures,â final version April 27, 2022.
This paper describes the algorithm that NEAR took.
This scheme enables cooperating computers to i) create a public ECDSA key, for example an Ethereum or Bitcoin address, and ii) create signatures against that key, typically to enable onchain software implementing DeFi, apps and services to sign transactions on behalf of a human, without them having to sign, or hold a key themselves. Our work enables signing to take place three times faster than is otherwise possible, without loss of security.
Chain Abstraction and Intents needed such a scheme to exist: when a group of computers implement this scheme, you canât just steal the private key from one of them, and instead must steal private key âsharesâ from some portion of them. Plus, the computers can continue to sign cooperatively even if some go offline or lose their shares. Without threshold signing, this kind of custody arrangement would be impossible.
The Internet Computer runs this algo on decentralized âfiduciary subnetsâ, which are effectively a new form of blockchain used to scale the network that derive additional security from main âNNSâ governance blockchain. These fiduciary subnets are comprised of nodes from ~50 independent parties and are highly secure.
NEAR reportedly runs this across 8 server machines, and nobody can get more info.
4) There's a simple reason for this. This key component that NEAR took cannot enable high-performance \decentralized\ signing on its own. It only enables signing by cooperating computers, which is why Intents relies on something akin to a server cluster.
If they wanted to be decentralized too, they'd have had to try and replicate the Internet Computer's design, a much bigger tasks, reflected by â
âDesign and analysis of a distributed ECDSA signing serviceâ, February 16, 2023:
EMarch, 2021, we published a paper describing how to setup these sharing schemes in a a decentralized way, which lies at the heart of the Internet Computer network:
5) Creating this kinda science takes a lot of time, work and investment in R&D. For example, I remember asking Dan Boneh for a way to setup sharing in the way the foregoing paper describes in May 2015. He thought it might not even be possible. It took another 6 years before we had it.
DFINITY is committed to delivering real decentralization using advanced computer science and math, and protecting user safety â and these things take time, effort and expenditure.
6) By 2024, we were in the process of productizing the science and making it usable on the Internet Computer, which also involved finding ways of enabling Internet Computer nodes to connect to the nodes of other networks.
7) We were naturally shocked and disheartened by the appearance of a NEAR blog post announcing âChain Abstractionâ, which addressed exactly the same challenge and opportunity. We took the announcement at face value and were not aware that it wasnât a decentralized system.
https://near.org/blog/why-chain-abstraction-is-the-next-frontier-for-web3
8) At some point we became aware that they had recruited the person we fired in 2021 to lead this work. But, this individual had minimal cryptography expertise, so we did not expect that NEARâs announcement would come to much. This guy had worked his way into DFINITY during COVID and boasted to colleagues âIâve been fired from every job Iâve ever had, and always for a causeâ. We were not worried.
9) We underestimated the threat. It seems his team simply took an open source threshold cryptography library from a Swiss cryptographer, and added our inventions, thereby quickly gaining the ability to deploy our ECDSA work. NEAR is not worried about decentralization or user safety as far as we can see, and just ran this over 8 servers. There wasnât anything stopping them bringing this to market quicklyâŚ
NEAR Intents uses Chain Abstraction (powered by our proprietary tech) to custody assets on different chains, and then Intents basically just uses a market maker paid by them to swap them across chains according to people's wishes. It's not decentralized, of course, and NEAR has scary backdoors, which make all this possible.
10) By stealing our proprietary work, licensed for the Internet Computer only, NEAR beat the Internet Computer to the punch with their Chain Abstraction and Intents architectures. This was demoralizing and disruptive for the DFINITY team and the ICP community, and also massively diminished the opportunity we expected the Internet Computer could unlock for the world. NEARâs social media hype machine effectively sold to the world that their system was a) developed by them and did not infringe any rights, and b) was decentralized and safe. Both are false.
However, needless to say, you cannot just steal proprietary tech from another project because you want to make money, and use it to get a jump on an attractive opportunity. Both civil and criminal laws prevent this kind of behavior, and the damages that can be awarded by courts are immense (especially in US courts, which award both direct and punitive damages).
There is a really good reason for these laws. They exist so that organizations like DFINITY can do fundamental, first-principles research, which takes a long time and is costly but unlocks real benefits for the world at large, without having the benefits and purpose stolen from them.
Here, DFINITY and ICP holders have been harmed, the Internet Computer economy and ecosystem has been harmed, and beyond financial harms, the world has gotten a dangerous shim implementation of multi-chain.
Whatâs a shame, is that had NEAR asked for a partnership, then we would have shared the technology with them if the terms were fair and we were referenced as the source of the work. We like NEAR and I have nothing against Ilia, but this is too much.
Something has to be worked out.
Further reading:
- Maybe some people in the Internet Computer community were ahead of us with their suspicions: https://x.com/ajki76/status/2101467163399737545
- NEAR is now trying to downgrade from our algorithm to a simpler version that is three times slower (it signs in 3 rounds, whereas ours signs in 1 round). This doesnât change the fact that theyâve been using our proprietary work for two and a half years and probably reflects them being worried about what they did:
https://github.com/near/mpc/pull/4503 https://github.com/near/mpc/issues/4324
- NEAR managed to hire two engineers from DFINITY to work on Chain Abstraction and Intents. GitHub reveals they were carefully mining the Internet Computer repo from the beginning. They surely knew what they were doing: https://github.com/near/NEPs/issues/516#:~:text=There%20is%20some%20prior%20work%20where%20it%20is%20possible%20to%20save%20some%20execution%20context
