This project implements the means necessary to allow a user to anonymously vote in Democracy Referenda. With our solution, a user delegates the Geode, a TEE empowered by Intel SGX, to vote on their behalf. The user then privately submits their vote to the Geode, and the Geode votes in the referendum according to the votes received from the users who delegated it.
The vote submitted by Geode is a Mixed vote, a vote type we introduce in the chain to allow the Geode to have votes for both sides of the proposal. We added the necessary logic to handle this type of vote in ./chain. And it has been integrated into a demo chain built from Substrate Node Template
Here is a diff of the modified Democracy Pallet from the original one for a quick glimpse.
The code for the front-end providing the interface for voting through the Geode is in ./front-end. It's built on top of the Polkassembly
The Geode code runs entirely in an Intel SGX enclave, ensuring that the voting preferences of users are not leaked. Users call the “submit_vote” RPC method and inform Geode of their voting option for a particular referendum (a vote will be accepted only if the sender delegated Geode in advance). For each referendum, Geode sets a deadline a couple of blocks before the referendum ends (for now, the deadline is set to 10 blocks before the referendum ends.) When the deadline is met, Geode stops accepting voting options and starts counting the votes for that particular referendum. If a user delegates the Geode but doesn’t vote, the Geode counts the vote as half approve and half disapprove. Once counting is done, Geode builds a Mixed vote and submits it to the chain. More information regarding the internal doing of Geode can be found in Geode Design Document.
Instructions on how to run the chain and front-end code are in their respective folders.
- Currently, the Geode pays the fee for submitting the vote extrinsic. In the future, we could deduct part of this fee from the locked balance of all the accounts that delegated the Geode. We could also deduct a fee for Geode maintenance.
- Because we want to maintain the privacy of voting, we are unable to store the voting data outside the enclave, i.e., we cannot back it up. To enable backup, we could run a secondary Geode synchronized with the primary Geode. Communications between the two would only be decrypted inside the Intel SGX enclave to ensure privacy.
- While users’ votes are not public anymore, the delegations are, and votes can be deducted based on what Geode votes at the end. To increase the chances of having voting options anonymous, the frond-end could display suggestions for choosing balance and conviction values that are most likely to hide the preference of the user.