Running mints in enclaves is funny and hard. It's like setting up the mint blindfolded. All key generation, storage, and setup happens inside. Keeping it running is a whole other challenge: database can't grow infinitely because you have no access to it, Lightning pure is basically impossible because of channel management, and Ecash keyset rotations etc must all happen fully automatic. It's like doing it all in full self driving mode while also being blind at the same time.
calle's avatar calle
This is huge progress. We will soon have Cashu Ecash mints in secure enclaves that the mint operator can't steal the Bitcoin from, not can they inflate or manipulate the Ecash supply. The operator has no access to the private keys of the mint. This is amazing news for users and operators alike. It allows us to build tools for communities that allow them to run mints without being afraid of malicious actors, internally or externally, such as security threats from hackers. We're building this for the Bitcoin community first but we're planning to expand this also for local currency communities outside of the crypto space that exist in pockets all around the world. Especially the local currency tech stack is old and antiquated. We're going to give them the most advanced ecash protocol they could ever dream of. For free! Lots of moving parts here: servers, libraries, backend, wallets, and protocol extensions. Incredible work by the entire Cashu team. View quoted note →
View quoted note →

Replies (7)

You can update the software as long as the SE policy allows it. Most importantly, it's transparent to your users and can be verified by them. Maybe more safety guard rails can be added to that operation.
the Lightning side is the rough part. channel management needs human judgment at some point, inbound liquidity, fee adjustments, force closes. enclave-constrained automation hits a wall fast without an external LSP doing the heavy lifting.
Well you don't need the lightning node to run within the enclave right? Just a "smart" signer that signs HTLCs given the redeemed cashu token. For rebalancing maybe some rule of "not loosing funds" and someone external has to pay the rebalancing fees. You can prove to the enclave that the rebalancing succeed or that a LN invoice for which it only revealed the payment hash has been paid. I'm sure there are lots of challenges here, but the main point is that it doesn't need to run "everything".