Partnered With:

zkPass and L2IV release Web3’s first zero-knowledge-based accredited investor certificate

Read this article in 17 Minutes

Recently, L2IV and zkPass jointly released a research report, providing an in-depth analysis of how to use the zkPass protocol to prove that you are a legal accredited investor in order to legally purchase almost all securities and receive airdrops.

Original Title: Proof of accredited investorship with zkPass, Part I

Original Author: Weikeng Chen, L2IV

The strict regulation of cryptocurrencies (or anything similar to securities) in the United States aims to protect consumers. Registering securities provides important legal protections, such as the right to recover. However, these regulations come with heavy compliance costs - many cryptocurrency projects limit themselves to accredited investors only when serving US customers (such as Aleo's testnet reward policy and Coinlist's exclusive staking fund for US users), or simply refuse US tax residents altogether to ensure safety. This is a problem that exists in both web2 and web3. Hong Kong banks often refuse to provide many financial products to US residents.

In other words, a side effect of consumer protection is that it deprives consumers of some opportunities to "get rich". Individuals may not be able to participate in token pre-sales. More importantly, many web3 projects are now conducting airdrops (such as Celestia, Arbitrum, Optimism), but explicitly exclude US residents. We don't know how many US developers have lost their eligibility for airdrops due to tax residency, but it is certainly regrettable to hear about such situations.

However, the Securities Act of 1933 did provide an exception - accredited investors, as defined in the above figure from Investopedia. This is Rule 501 of Regulation D. It provides accredited investor status to individuals based on their income.

(6) Any natural person who had an individual income in excess of $200,000 in each of the two most recent years or joint income with that person's spouse or spousal equivalent in excess of $300,000 in each of those years and has a reasonable expectation of reaching the same income level in the current year;

For people in the technology industry, reaching the income benchmark is relatively easy. According to data from levels.fyi, except for entry-level positions, software engineers at top IT companies such as Amazon SDE II, Google L4, Facebook E3, and Microsoft Senior SDE typically qualify for high salaries after working for a few years. In other words, if you meet another software professional in San Francisco or Seattle, it's very likely that he/she is already a recognized investor.

But now the question is: how do they prove it?

The traditional solution in web2 is to perform KYC - requesting submission of income proof documents such as tax forms or pay stubs. This is not suitable for web3 and, in fact, we believe it is unsustainable even for web2.

· Lack of scalability. Due to the fact that income proof is "unstructured data" and varies from employer to employer, it usually requires manual verification. However, since pay stubs are easily falsified, the best way for landlords to verify authenticity is to call the employer for verification - a type of unsolicited call that is rarely welcome - or to conduct a comprehensive background check, which can cost hundreds of dollars.

· Lack of reliability. There are many online articles teaching people, especially landlords, how to detect signs of forged pay stubs. However, an educated adult can easily forge a perfect pay stub. Nowadays, one does not need to be James Bond to create a fake pay stub. In addition to pay stubs, forged IDs are not uncommon: an underage college student may already have a fake ID for buying alcohol (see this article). Law-abiding citizens like us have no idea how much trust we put into every day.

· Lack of privacy. Too much information has been leaked. The salary slip reveals the home address. The tax form reveals marital status, number of children, and other sources of income. The credit report is the worst: it includes current and previous addresses, current and previous employers, and other information far beyond "I am an accredited investor".

However, the culture of Web3 is completely different from Web2.

可扩展：自动化，去中介

translates to

Scalable: Automation, Decentralization

· In Web2, there are clerks and cashiers. In Web3, it's smart contracts.

· Transactions are processed in a transparent and automated manner by a network of over thousands of nodes. This process operates 24/7 and typically takes less than a minute. As anyone can create smart contracts, there is little to no monopoly and fees are usually reasonable.

· So the question is: how do you prove that you are an accredited investor in web3 or for smart contracts?

Reliable: Decentralized, Minimal Trust

· In traditional society, many rely on the belief that people are honest until proven guilty.

· Many states in the United States allow voters without identification to vote by signing an affidavit. However, even if identification is required, it does not add much security. Most states' REAL IDs do not have chips, and forging one does not require cracking any cryptography.

· Our real world is an optimistic rollback. You question people by calling the regional prosecutor. Fraud proof is centralized, and the so-called "data availability" is almost non-existent for ordinary people, so they cannot generate fraud proof. However, web3 needs to open verification to everyone.

· So the question is: how do you reliably prove that you are an accredited investor in web3?

Protecting Privacy: Autonomy, Anonymity

· When creating an account on a web2 website, you may be asked to provide a phone number and at least one email address. For credit card payments, a zip code is the minimum requirement, but a billing address is often needed. In the United States, the widespread existence of websites for people search (which is a legal business activity) such as TruthFinder, PeopleFinder, and Spokeo makes privacy almost hopeless.

· Web3 is a culture that defaults to privacy protection. 0x addresses are not related to individuals' real-world identities. The blockchain doesn't care who you are, it only cares about your intentions.

· So the question is: How do you prove that you are an accredited investor in web3 without revealing details about your life?

This prompts us to rethink how our world should operate. If I need to prove that I am an accredited investor,

· Why do I need to submit my salary statement?

· Why do I have to disclose my home address?

· Why do I have to provide tax forms to prove my taxable income?

· How many people will be able to see these documents?

On the other hand, the people who are going to verify these files are also struggling.

This example illustrates the limitations of current data protection laws.

However, these data protection laws have not made users "owners of the data".

In order to return ownership to users, zkPass needs to solve the following problems:

With zkPass, everything can be different. The identity of recognized investors can be made into a Soul Binding Token (SBT), which users can prove ownership of with a few clicks through Metamask.

This sounds like a PBA card for airdrop customs clearance, but it can be even more convenient. In fact, you don't even need to click on Metamask - a dApp that knows the user's address can use Alchemy or Ankr to automatically determine if the user owns this SBT and silently remove any barriers, as if the dApp has already recognized you as a VIP.

· ZK coprocessor: Verifiable On-Chain Data· ZK bridge: Verifiable Cross-Chain Data

zkPass: The Technology Stack for Data Ownership

· HTTPS web connections (using 3P-TLS)

Data processing:

· RISC Zero

· Groth16

On-chain identity.· Off-chain verification

· Banks and governments: Nagarik App, ANZ Bank, Australian myGovID.

· Education: Coursera, Hubspot Academy

· Video Games: GOG.com

· Cryptocurrency exchanges: OKX, Binance

· Social media platforms: Instagram, Twitter, Quora, Tiktok, Medium, Reddit, Discord.

Our partnership: RISC Zero backend and PDF proof

We have established a partnership with zkPass to create interactive proofs for taxable income reported to the IRS. This income is sourced from the IRS website and is used to establish accredited investor status through the most commonly used income tests for individuals.

· Using the zkPass 3P-TLS protocol for verification, he/she has received the account summary for the past two years, which will be two PDF files from the IRS Transcript Delivery System (TDS). Due to the sensitive personal information contained in the account summary, such as the last four digits of the social security number and abbreviated home address, the summary will not be disclosed to the data requester. The following PDF is my 2022 IRS account summary, as shown below.

· Using the zkPass data processing protocol, this is the RISC Zero backend, proving the digests of these two accounts:

Matching user's personal profile.Recently, the IRS issued a new guidance on cryptocurrency taxation.

Taxable income exceeds $200,000 USD.

This can be illustrated using the following figure.

· Users use encrypted network traffic to connect to the validator for regular HTTPS connections. The validator acts as a network proxy, or in layman's terms, a VPN.

· After the HTTPS connection is terminated, the verifier requires the user to generate a zero-knowledge proof about the encrypted traffic data. The verifier independently verifies the integrity of the TLS connection through PKI certificates.

· As we discussed above, zkPass supports multiple proofs. Several backends, including RISC Zero that we use, can be used to generate this zero-knowledge proof. This is usually an optimization for performance. RISC Zero is suitable for proofs involving RAM model computation rather than circuit model computation.

zkPass is a protocol for 3P-TLS that has been studied for many years, starting with TLSNotary over a decade ago (now a PSE project sponsored by the Ethereum Foundation). This progress includes academic work such as BlindCA (IEEE S&P 2019), DECO (ACM CCS 2020), Oblivious TLS (CT-RSA 2021), MPCAuth (IEEE S&P 2023), and DiStefano of Brave browser.

Next, zkPass will use the RISC Zero backend to read PDF files.