Pricing Personalized Preferences for Privacy Protection in Constant Function Market Makers

We adopt the personalized local differential privacy (PLDP) framework (Definition 2.2) of Chen et al. (2016) for CFMMs. A user $i$ with a trade of selling $\Delta_{i}$ units of X ($\Delta_{i}<0$ implies buying X) specifies their desired privacy level $\varepsilon_{i}\in\mathbb{R}_{\geq 0}$ (lower $\varepsilon_{i}$ implies better privacy) and a masking interval $\tau_{i}=[l_{i},u_{i}]$ to mask their trade within, such that $l_{i},u_{i}\in\mathbb{R}$ and $\Delta_{i}\in\tau_{i}$. While we adopt the privacy notion of Chen et al. (2016), our motivation is different – they use the model for spatial data collection and study the error of aggregate statistics. In contrast, we use it to mask trades in CFMMs and study the economic implications. We study mechanisms that add noise to the market state with each user’s data separately.

Privacy is not free. In the context of data collection, it causes error in the aggregate statistics, and in the context of CFMMs, it creates additional arbitrage opportunities.Consider a simple example. At a point in time, a CFMM’s spot price is $p$. The price on an external market (with in infinite liquidity, say, an off-chain exchange) is $\hat{p}>p$. Then an arbitrageur can buy some $X$ from the CFMM and sell it to the external market, raising the CFMM’s spot price to $\hat{p}$ under the ‘optimal’ arbitrage (Angeris and Chitra, 2020). If the CFMM uses a noise-adding privacy protection mechanism and has non-zero curvature, then its spot price is distorted from $\hat{p}$ for the privacy of the trade. Then, the arbitrager has an additional arbitrage opportunity to profit off the CFMM by moving the spot price again to $\hat{p}$. To be sustainable, the CFMM must charge an additional fee for privacy preservation to account for this additional arbitrage. However, finding this fee amount without knowing $\hat{p}$ is not trivial.

We call a private CFMM mechanism priceable (Definition 4.2) if there exists a fee, independent of the true price, that pays for the additional arbitrage. We show that a noisy CFMM mechanism is priceable if and only if the noise is zero-mean in the asset amount. The proof is technical, but intuitively, a zero-mean noise does not create additional liquidity in expectation. Pricing the additional arbitrage at the post-trade spot price ensures that an arbitrageur does not gain in expectation, regardless of the true price.

We also define truthfulness of a noise-adding CFMM mechanism, such that a trader without innate privacy requirements has the incentive to leave the CFMM spot price at the external market price $\hat{p}$ in one trade (Definition 4.1). We show that zero-mean noise distribution is necessary for truthfulness. With the right privacy fee, a zero-mean noise distribution leads to a truthful mechanism. This ensures that the noisy CFMM’s spot price will closely follow the price on an external exchange as long as arbitragers are present.

For priceable mechanisms, we formulate the privacy fee as a function of the CFMM state, the trading function, and the trader’s privacy requirements. We show that a more liquid (Definition 4.9) CFMM requires a smaller privacy fee. In fact, the privacy fee of a trade is inversely proportional to the liquidity (Proposition 4.10). This aligns with the fee-liquidity relationship of Frongillo and Waggoner (2018) in an information aggregation context.

A CFMM is an automated market-maker parameterized by a trading function $f$. We focus the scenario where a CFMM trades between a volatile asset $X$ and a stable numeraire asset $Y$, which is the context in which CFMMs are most often employed. A liquidity provider endows the CFMM with nonnegative reserves $(x,y)\in\mathbb{R}^{2}_{+}$ of each asset. A CFMM with reserves $x,y$ and trading function $f$ accepts any trade $(\Delta_{x},\Delta_{y})$ that results in reserves $x+\Delta_{x},y-\Delta_{y}$ if and only if $f(x+\Delta_{x},y-\Delta_{y})=f(x,y)$. The following characterization of trading functions is standard in the literature and is required to ensure that the CFMM works as intended.

This characterization implies that given any level curve of the trading function $f$, the amount $x$ of asset $X$ in the reserves, uniquely determines the amount of $Y$, which we denote $\mathcal{Y}(x)$ when the level curve of the function $f$ is clear from the context.

Commonly studied CFMMs include the constant product $f(x,y)=xy$, used by, for example, the exchange Uniswap (Adams et al., 2020), and $f(x,y)=2-e^{-x}-e^{-y}$ which implements the Logarithmic Market Scoring Rule (LMSR) (Hanson, 2007).

CFMMs, in practice, charge a “trading fee” to all trades which is a percentage of the trade size. For simplicity, we assume that any fee is not added to the CFMM reserves – it is taken by the LP.

An important quantity for the analysis of CFMMs is the price it provides for an infinitesimal trade, referred to as its spot price.

Assumption 1 implies the price offered to a trader is never better than the spot price. This has an important implication: when the price at the external market deviates, arbitragers align the CFMM’s spot price with it. In this sense, a CFMM is a “truthful” mechanism – that an arbitrager cannot do better by “reporting” a false price to the CFMM. We make an additional assumption.

The traditional notion of DP is for a centralized model (“global” DP), where a trusted data curator holds all users’ accurate data and reveals aggregate statistics to queries with the constraint that it cannot be inverted to infer any specific user’s data. We consider here a different notion of privacy, called personalized local differential privacy (Chen et al., 2016), wherein each user’s data is privatized (usually by adding noise) before being stored with the mechanism. The privacy guarantee is given by a parameter $\varepsilon$; higher $\varepsilon$ implies worse privacy protection.

Observe that traditional local differential privacy (LDP) (Kasiviswanathan et al., 2011) is a special case of PLDP where all users have the same $\tau$ and $\epsilon.$

A larger masking interval $\tau$ implies stronger privacy, and within that interval, a smaller $\varepsilon$ corresponds to a better privacy guarantee. For example, $\varepsilon=0$ corresponds to the case that all points in masking interval $\tau$ produce the same distribution of the algorithm’s output.

We adopt the following attack model, which was first given by Angeris et al. (2021), and also used by Chitra et al. (2022).

1. (1)

   Eavesdropper Eve knows the trading function of the CFMM.

2. (2)

   Eve knows when trader Tod makes a transaction with the CFMM.

3. (3)

   Eve can query the spot price of CFMM.

4. (4)

   Eve can query whether a given non-zero trade is valid.

5. (5)

   Eve can do (3) and (4) before and after Tod’s trade.

Angeris et al. (2021) showed that this much information is sufficient for Eve to infer exactly the amount traded by Tod in a traditional CFMM.

We borrow here the model of some private smart contract systems (such as Hawk (Kosba et al., 2016)), which delegate private computation to a “manager,” that can be implemented via trusted execution environments (TEE) or multiparty computation (MPC) protocols, as in, e.g., Banerjee et al. (2021) and Baum et al. (2022). We specifically require a way for the CFMM to maintain private state, and to execute code on that private state. This private information includes not only the CFMM reserves but also a private account $\mathcal{H}$, used in the mechanism discussed below. We also require a source of unpredictable (pseudo)randomness, such as the output of a VRF (Micali et al., 1999).

We also assume the existence of arbitrageurs, who may trade on the CFMM and on external, highly liquid exchanges, and that arbitrageurs are aware of the market price on external exchanges.

The noisy CFMM randomly distorts its state after every trade.

Noisy CFMM Mechanism

1. (1)

   The CFMM maintains a “hidden” private account $\mathcal{H}$ of reserves. This account is used to make “noise trades”as follows.

2. (2)

   At some point in time, the CFMM state is $(x,\mathcal{Y}(x)).$

3. (3)

   Trader $i$ makes a trade selling $\Delta_{i}$ units of X to the CFMM and specifies their privacy requirements $(\tau_{i},\varepsilon_{i})$ such that $\Delta_{i}\in\tau_{i}.$

4. (4)

   Trader $i$ gets $\mathcal{Y}(x)-\mathcal{Y}(x+\Delta_{i})$ units of $Y$ in exchange for $\Delta_{i}$ units of X, and pays a fee, which is the sum of a “trading fee” and a “privacy fee” $\gamma_{i}.$ The fee is not added to the CFMM state.

5. (5)

   The CFMM immediately makes a random trade of $\eta_{i}\sim\mathcal{D}_{i}$ units of $X$ with the hidden account $\mathcal{H}$.

6. (6)

   The new CFMM state is $x^{\prime}=x+\Delta_{i}+\eta_{i}$, $y^{\prime}=\mathcal{Y}(x^{\prime})$ . This state can be queried by the next trader (and Eve, via the attack of §3.1).

We assume that an external operator supports the CFMM to ensure that $\mathcal{H}$ never runs dry, but if $\mathcal{H}$ cannot support the maximum possible noise for a trade request, the CFMM rejects the request.

We use noise trade distributions of bounded support – we will give examples in § 4.1. We consider noise trade distributions which, for a given CFMM, depend only on the trade amount $\Delta_{i}$ and privacy specification $(\tau_{i},\varepsilon_{i}).$ Importantly, it is independent of the CFMM state. This setting is standard in the DP literature. The privacy fee $\gamma_{i}$ depends on the CFMM state and the noise trade distribution $\mathcal{D}_{i}$.

Since our mechanism must also supports non-private trades as traditional CFMMs do, the noise trade $\eta_{i}$ and the privacy fee $\gamma_{i}$ are zero when $\varepsilon_{i}=\infty$ or $\tau_{i}=\{\Delta_{i}\}$ for user $i$.

In this paper, we study the case where an external market with infinite liquidity exists, and arbitrageurs can trade both with the CFMM and the external market. We consider the external market price as the “true” price. This setting is standard in DeFi literature on CFMMs, for example, in Goyal et al. (2023); Evans et al. (2021); Milionis et al. (2022). Our result also holds when arbitrageurs trade on private knowledge of future or true prices, which is important when a bigger external market does not exist. Whenever the CFMM spot price deviates from the true price, an arbitrageur makes a risk-less profit by aligning CFMM’s spot price with the true price.

We now illustrate the additional arbitrage problem with the noisy CFMM mechanism. Suppose for the moment that the privacy fee were zero and that Tod has exclusive access to the CFMM. Tod can exploit the noisy CFMM mechanism in the following manner.

We first discuss a noise distribution from the LDP literature, which is well-suited for our application.

Importantly, the noise is zero-mean and of bounded magnitude. Kairouz et al. (2014) showed that in the high privacy regime, i.e., for all $\varepsilon$ less than some $\varepsilon^{*},$ the binary mechanism is optimal for minimizing the ‘information loss’ due to privacy.

We are interested in designing noise distributions that minimize the privacy fee. Observe that the privacy fee is a convex (linear) function of $\mathcal{D}(\eta)$ for all $\eta$ for all state $\tilde{x}$ and trade $\tilde{\Delta}$. The privacy requirements can be expressed as convex constraints in $\mathcal{D}(\eta)$, as in Kairouz et al. (2014). The mean being zero is also a linear constraint. Given a state and trading function, we can give a convex program to find the “cheapest” noise trade distribution that preserves $(\tau,\varepsilon)$-PLDP. However, since noise distributions have to be independent of the CFMM state, finding a distribution that works reasonably well for all states is not obvious and is the subject of future work.

Notice from Definition 4.5 that the privacy fee is zero in a region where the spot price is constant. This matches the intuition that the constant sum CFMM provides privacy for free due to its lack of curvature – it has “infinite” liquidity at a price point. We define liquidity at a price as follows.

For a given trade, the privacy fee captures the additional arbitrage profit that can be captured by reversing the associated noise trade. Intuitively, this quantity is larger if the noise trade creates a larger “impact” on the CFMM spot price. This impact is larger when the liquidity is smaller. We illustrate this intuition with an example of the widely adopted constant product “Uniswap” CFMM and the binary mechanism in Appendix B. This intuition holds more generally and formally, as in the following result.

This result shows that more liquid CFMMs are better suited for the needs of privacy-seeking traders. However, these CFMMs are prone to larger divergence loss, and also require larger capital investment from LPs. A holistic analysis of the design trade-offs of a noisy CFMM mechanism, possibly with custom-made trading functions, is the subject of future work.