Skip to content

Commit 119daf8

Browse files
nikerzetic-aflabsnikerzetic-aflabs
authored
feat: add FCC section and overview (#1266)
2 parents 958685b + e1e2651 commit 119daf8

5 files changed

Lines changed: 288 additions & 0 deletions

File tree

‎docs/fcc/1-overview.mdx‎

Lines changed: 179 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,179 @@
1+
---
2+
sidebar_position: 1
3+
slug: overview
4+
title: Flare Confidential Compute
5+
authors: [nikerzetic]
6+
description: Flare Confidential Compute (FCC) extends the Flare blockchain with Trusted Execution Environments (TEEs) to enable secure off-chain computation, cross-chain payments, and fast data attestation.
7+
tags: [intermediate, ethereum, fdc]
8+
keywords:
9+
[
10+
flare-tee,
11+
ethereum,
12+
tee,
13+
trusted-execution-environment,
14+
evm,
15+
flare-network,
16+
flare-confidential-compute,
17+
fcc,
18+
]
19+
unlisted: false
20+
---
21+
22+
import ThemedImage from "@theme/ThemedImage";
23+
import useBaseUrl from "@docusaurus/useBaseUrl";
24+
25+
**F**lare **C**onfidential **C**ompute **(FCC)** extends the Flare blockchain with [Trusted Execution Environments (TEEs)](https://en.wikipedia.org/wiki/Trusted_execution_environment) to enable secure off-chain computation, cross-chain transaction signing, and fast data attestation.
26+
FCC provides infrastructure for building custom, secure TEE integrations through a system of **Flare Compute Extensions (FCE)**; useful for dealing with private data.
27+
It also delivers two built-in system applications: **Protocol Managed Wallets (PMW)** and a new generation of the [Flare Data Connector (FDC)](/fdc/overview).
28+
29+
## Key Features
30+
31+
- **Secure Offchain Computation:** TEE machines run verifiable code in hardware-isolated environments, ensuring computation integrity even if the machine operator is untrusted.
32+
- **Cross-Chain Transaction Signing:** Protocol Managed Wallets enable programmable assembly and signing of transactions on external blockchains (XRPL, BTC) through smart contract calls on Flare.
33+
- **Fast Data Attestation:** A new TEE-based FDC enables rapid attestation of external data, where TEE machine signatures serve as proof of data provider consensus.
34+
- **Extensible Architecture:** Developers can build custom Flare Compute Extensions that run arbitrary computations within TEE machines, with results verifiable onchain.
35+
- **Decentralized Consensus:** Instructions are relayed to TEE machines only after reaching a 50%+ signature weight from Flare's data providers, leveraging the same [signing policy](/network/fsp) used across the Flare Systems Protocol.
36+
- **Private Key Management:** TEE machines securely generate, store, back up, and restore private keys, enabling multi-signature wallet operations across blockchains.
37+
38+
:::danger
39+
Although the Flare confidential compute is in the final stages of development, it is not yet publicly available.
40+
Stay tuned for that and the upcoming guides.
41+
:::
42+
43+
## Architecture
44+
45+
```mermaid
46+
graph TB
47+
48+
subgraph FCCSystem["FCC System"]
49+
FC["<b>FCC Contracts</b>
50+
Extensions
51+
Registration & attestation
52+
Instruction emission
53+
Private key administration"]
54+
DP["<b>Data Providers & Cosigners</b>
55+
Instruction relaying
56+
Instruction augmentation
57+
FDC verification"]
58+
TEE["<b>TEE Machines</b>
59+
Identity
60+
Instruction verification
61+
Private key management
62+
Custom logic per extension"]
63+
end
64+
65+
Users["<b>Users</b> <p>Smart contracts Direct users</p>"] --> FC
66+
EW["<b>External World</b> <p>Blockchains Web2, exchanges, ...</p>"] -- "Flare Data Connector" --> DP
67+
FC -- "instructions" --> DP
68+
DP -- "signed instructions" --> TEE
69+
TEE -- "registration & attestation" --> FC
70+
TEE -- "relaying results" --> FC
71+
DP -- "Flare Data Connector" --> TEE
72+
TEE -- "relaying results" --> EW
73+
74+
style FCCSystem stroke-dasharray: 5 5
75+
```
76+
77+
The system comprises three core components:
78+
79+
1. **Smart Contracts** on the Flare blockchain govern the underlying logic.
80+
This includes the management of compute extensions, the registration and attestation of TEE machines, the issuance of instructions for secure relay to TEE machines, and the administration of private keys generated and stored within TEEs.
81+
82+
2. **Data Providers and Cosigners** function as instruction relayers.
83+
They parse instruction events from smart contracts, augment them with external data, sign them, and transmit them to TEE machines.
84+
Cosigners provide an additional layer of authorization for sensitive operations like payments and key management.
85+
86+
3. **TEE Machines** verify that instructions carry adequate consensus (threshold signature weight) from data providers and cosigners.
87+
Upon successful verification, the TEE machine executes the corresponding computation and signs the result with a relevant private key.
88+
Results include signed payment transactions for external blockchains, signed attestations, or other computation outputs usable within smart contracts.
89+
90+
## Flare Compute Extensions
91+
92+
Applications within FCC are organized as **Flare Compute Extensions (FCE)**.
93+
Each compute extension represents an isolated set of functionalities running on TEE machines, extending the concept of smart contracts into TEE environments.
94+
A compute extension is defined by:
95+
96+
- **Supported code versions**: Each code version is a hash of the Docker image running in the confidential VM and must be reproducible.
97+
- **Registered TEE machines**: Machines running supported code versions that have been registered with an onchain attestation proof.
98+
99+
The FCC infrastructure provides the following for all compute extensions:
100+
101+
- **Identity**: Each TEE machine has a unique identity (TEE id) defined by a private key generated at boot.
102+
- **Onchain Registration**: TEE machines register within a compute extension by proving they run a supported code version, verified through machine attestation and the FDC.
103+
- **Result Verification**: Data and computation results signed by a registered TEE identity can be trusted and verified onchain.
104+
- **Instruction Relaying**: Function calls on TEE machines are triggered through instruction events on Flare's smart contracts, securely relayed by data providers.
105+
- **Private Key Management**: Compute extensions support secure key generation, backup, and restoration across TEE machines.
106+
107+
### Deployment
108+
109+
```mermaid
110+
graph TB
111+
ExtUsers(["Users, data providers, cosigners"]) --> ExternalAPI
112+
113+
subgraph Firewall
114+
Owner(["Owner"]) -- "/configure" --> TEEMachine
115+
subgraph TEEMachine["TEE Machine"]
116+
subgraph Docker["Docker Container"]
117+
ExtApp["Extension app"] <--> FlareApp["Flare TEE app"]
118+
end
119+
end
120+
TEEMachine -- "actions & results" --> InternalAPI["Internal API"]
121+
InternalAPI --> Proxy
122+
Proxy --> REDIS["REDIS"]
123+
Proxy --> Indexer["C-chain indexer"]
124+
Indexer --> FlareNode["Flare node"]
125+
end
126+
127+
ExternalAPI["External API"] <==> Proxy
128+
style Firewall stroke-dasharray: 5 5
129+
```
130+
131+
Each TEE deployment consists of two main components:
132+
133+
- **TEE Machine:** Runs inside a confidential virtual machine and is not publicly accessible.
134+
It sits behind a firewall and has a single configuration endpoint used by the owner.
135+
The TEE machine pulls actions from the proxy at its own pace, processes them, and pushes results back.
136+
137+
- **TEE Proxy:** A publicly accessible server that acts as the interface between the outside world and the TEE machine.
138+
It receives signed instructions from data providers, manages action queues, stores results, and serves them to external users.
139+
The proxy also monitors the Flare C-chain for signing policy updates.
140+
141+
## Flare Confidential Compute Extensions
142+
143+
Applications within FCC are organized as **Flare Compute Extensions (FCE)**.
144+
Each compute extension represents an isolated set of functionalities running on TEE machines, extending the concept of smart contracts into TEE environments.
145+
A compute extension is defined by:
146+
147+
- **Supported code versions:** Each code version is a hash of the Docker image running in the confidential VM and must be reproducible.
148+
- **Registered TEE machines:** Machines running supported code versions that have been registered with an onchain attestation proof.
149+
150+
The FCC infrastructure provides the following for all compute extensions:
151+
152+
- **Identity:** Each TEE machine has a unique identity (TEE id) defined by a private key generated at boot.
153+
- **Onchain Registration:** TEE machines register within a compute extension by proving they run a supported code version, verified through machine attestation and the FDC.
154+
- **Result Verification:** Data and computation results signed by a registered TEE identity can be trusted and verified onchain.
155+
- **Instruction Relaying:** Function calls on TEE machines are triggered through instruction events on Flare's smart contracts, securely relayed by data providers.
156+
- **Private Key Management:** Compute extensions support secure key generation, backup, and restoration across TEE machines.
157+
158+
## System Applications
159+
160+
### Protocol Managed Wallets (PMW)
161+
162+
PMW enables programmable assembly, signing, and execution of transactions on external blockchains through smart contract calls on Flare.
163+
This introduces blockchain abstraction and external execution capabilities on Flare.
164+
165+
Key capabilities:
166+
167+
- **Multisig Operations:** Wallets represent sets of private keys across multiple TEE machines, acting as signers on k-of-n native multisig accounts on external blockchains (XRPL, BTC), where any k of the n keys are sufficient to authorize a transaction.
168+
- **Nonce Management:** Each payment instruction is issued with a unique nonce.
169+
On UTXO blockchains, nonces are emulated through transaction chaining.
170+
- **Reissuance and Nullification:** Transactions can be reissued with different fees, or nullified by consuming the nonce with a minimal-fee transaction.
171+
- **Execution Proofs:** FDC attestation proofs verify whether a payment was executed as expected, enabling protocols to automatically mitigate failed payments.
172+
173+
### Flare Data Connector (FDC)
174+
175+
The TEE-based FDC achieves fast attestation by issuing instruction events containing attestation requests.
176+
Data providers parse these requests, perform attestations using their existing data provision capabilities, and augment instructions with attestation responses.
177+
178+
Each TEE machine that receives a threshold weight of signatures from data providers and cosigners signs the attestation response with its TEE identity key.
179+
Since TEE machine identities are verified on-chain during registration, their signatures serve as proof of data provider consensus usable within smart contracts.

‎sidebars.ts‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -222,6 +222,13 @@ const sidebars: SidebarsConfig = {
222222
},
223223
],
224224
},
225+
{
226+
type: "category",
227+
label: "FCC",
228+
collapsed: true,
229+
link: { type: "doc", id: "fcc/overview" },
230+
items: [],
231+
},
225232
{
226233
type: "category",
227234
label: "FAssets",

‎src/css/custom.css‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -345,6 +345,7 @@ div[class^="searchBar_"] div[class*="hitFooter"] a:hover {
345345
.menu__link[href*="/network/overview"]::before,
346346
.menu__link[href*="/run-node"]::before,
347347
.menu__link[href*="/ftso/overview"]::before,
348+
.menu__link[href*="/fcc/overview"]::before,
348349
.menu__link[href*="/fdc/overview"]::before,
349350
.menu__link[href*="/fassets/overview"]::before,
350351
.menu__link[href*="/fxrp/overview"]::before,
@@ -391,6 +392,17 @@ div[class^="searchBar_"] div[class*="hitFooter"] a:hover {
391392
background-image: url("/img/ui/ftso.dark.svg");
392393
}
393394

395+
.menu__link[href*="/fcc/overview"]::before {
396+
width: 26px;
397+
height: 26px;
398+
background-size: 26px 26px;
399+
background-image: url("/img/ui/fcc.light.svg");
400+
}
401+
402+
[data-theme="dark"] .menu__link[href*="/fcc/overview"]::before {
403+
background-image: url("/img/ui/fcc.dark.svg");
404+
}
405+
394406
.menu__link[href*="/fdc/overview"]::before {
395407
width: 26px;
396408
height: 26px;

‎static/img/ui/fcc.dark.svg‎

Lines changed: 45 additions & 0 deletions
Loading

0 commit comments

Comments
 (0)