Kleros and Social Recovery - A Snapshot of Solutions

According to some estimations, between 3 and 4 million Bitcoins are lost forever on the chain due to lost private keys. This traditional story ties in with the tale of the deflationary nature of Bitcoin. While bullish for the Bitcoin community, the question of lost private keys, exploits, hacks and phishing attacks presents a real risk for the financial markets of the future. The outcry for resolving the issue of loss of funds due to these problems is becoming focal in the world of crypto given its astronomical growth and the inclusion of less technically minded folk in the past years.

The issue with recovery of assets is its subjective nature requiring human judgement, especially in the case of a trustless and pseudonymous environment such as Web3. The key concerns that need to be addressed in order for asset recovery to be effective could be encapsulated as such:

• Why should a transaction be reversed?
• Is the requestor the real owner of the assets?
• Is the reason for the claim reasonable (e.g. is a mistaken address an acceptable reason for the reversal?)
• How can the claim be enforced?

In our conversations with industry partners regarding the search for solutions to the issue of asset recovery, we identified four emerging solutions, all of which are very exciting and quite promising.

Asset-level recovery

'Asset' level protection is a mechanism exclusively possible within the Web3 ecosystem. By taking advantage of its programable nature, these solutions build recovery mechanisms right into the asset contracts themselves.

Notable solutions in this vein are Lossless Protocol working on ERC-20 tokens, who have built a framework for creating native LERC-20 tokens, enabling trades which can be frozen and restored to the rightful owner by a decentralized voting committee. This also enables wrapping already created tokens within their framework and opting into their protection by design.

For NFTs/ERC-721s, NFT Protect has created a Kleros-secured solution that allows any NFT to be secured from thefts, phishing attacks and mistaken transfers. Their solution is currenty targeting a Göerli launch in the coming month and a Mainnet release soon after.

Wallet Recovery

This solution has been around for some time with the so-called Smart Contract Wallet recovery. Wallets like Gnosis Safes, Argent, and Loopring enable Guardians or other keysigners to restore wallet ownership to the right addresses by depending on trusted contacts to do so. R&D is underway to replace trusted Guardians with trustless guardians, potentially linking them to a robust court process powered by Kleros.

EOA Wallet Recovery

EOA stands for Externally Owned Accounts, meaning your traditional Ethereum address and not a specific wallet contract. The best example of this are your usual Metamask browser extensions. Wallet recovery for these addresses has been deemed impossible unless you had their physical backups, but with the emergence of solutions like Safient, this is finally becoming possible. Safient stores encrypted secrets as shards in their decentralized network using MPC technology (more on the topic can be found on Safient's blog here).

MPC (multiparty computation) is a ground breaking advancement in cryptography  that allows for keys to be secured by individual fragments, which are separately generated by multiple, non-trusting computers. Safient integrated Kleros to authorize recovery requests if a person is able to provide convincing proof to the Court of Kleros that they are indeed rightful owner of the keys.

Lastly, under very specific circumstances, there is a possibility for a fourth and arguably the most audacious category of asset recovery solutions to emerge - consensus-before-consensus solutions.

Protection by Consensus

When the private keys of an account have been compromised, these solutions can use the consensus among vigilante node operators to decrease the chances of a malicious transaction from occurring.

The Consensus Layer Withdrawal Protection (CLWP) project is the first living, breathing example of such a project. Their aim is to protect Ethereum validators securing the Ethereum network from having their 32 ETH stakes withdrawn by would-be attackers who managed to compromise their keys in the lock-up period since Ethereum staking was enabled.

With the Shapella fork, validators had a real worry whether their keys were potentially compromised, since only then validator withdrawals were enabled. CLWP made use of this bought time by using GitHub and Kleros Curate to form a Kleros-secured consensus around who the legitimate key holders and withdrawal messages are. Once consensus has been reached, this list of withdrawal messages (more accurately, the change withdrawal address messages) was to be adopted by the node network that adopts the CLWP consensus and broadcast on the Ethereum network as soon as the block height for enabling those withdrawals was reached, helping legitimate validator owners to frontrun any attackers' attempt to withdraw the funds.

This approach proved to be immensely effective, due to the fact that it took a load off of the shoulders of validators and presented a turnkey solution in case of potential security breaches.

With the Shapella fork complete, CLWP did an amazing job in securing the Ethereum network and the validators, culminating in a celebration across the ecosystem.

These four different categories of solutions represent distinct ways of enabling a more protected environment for users in Web3 and coupled with the developments around ERC-4337 will mark the beginning of a huge improvement in user experience and security for all actors in the ecosystem.

Follow our Twitter and join our Telegram for updates on more interesting developments in this field in the months to come.