Zether: Towards Privacy in a Smart Contract World

01 Claim ledger

What the paper is allowed to say

Each row is a sentence already in the study. The status is the same on every row: a model claim, not a live measurement.

1. Claim 01 · Paper model

   The defect

   A public contract ledger publishes amounts and addresses. A private payment that leaves that ledger has to be a new chain, or a contract that hides the amount inside a proof.

2. Claim 02 · Paper model

   The proposal

   Zether is a contract for confidential transfers and confidential anonymous transfers, with balances as commitments and a proof that the spend is well formed.

3. Claim 03 · Paper model

   The amount is hidden. The proof is what the contract checks.

   Anonymity among a set is a further mode, not the same as confidentiality of the amount.

4. Claim 04 · Paper model

   The bound

   This is not a deployed mixer and not an instruction for hiding funds.

02 Three cuts

Observation, model, falsifier

A desk does not stop at the summary. Each claim is cut three ways, using only this study's own assumptions and checks. Nothing here is a new figure.

1. 01 The defect

   Observation

   What the study says

   A public contract ledger publishes amounts and addresses. A private payment that leaves that ledger has to be a new chain, or a contract that hides the amount inside a proof.

   Model

   What has to hold

   The anonymity set is whoever is in the contract, not 'the chain'.

   Falsifier

   What would retire it

   What is hidden: the amount, the sender, or both?

2. 02 The proposal

   Observation

   What the study says

   Zether is a contract for confidential transfers and confidential anonymous transfers, with balances as commitments and a proof that the spend is well formed.

   Model

   What has to hold

   The anonymity set is whoever is in the contract, not 'the chain'.

   Falsifier

   What would retire it

   What does a failed proof reveal?

3. 03 The amount is hidden. The proof is what the contract checks.

   Observation

   What the study says

   Anonymity among a set is a further mode, not the same as confidentiality of the amount.

   Model

   What has to hold

   The anonymity set is whoever is in the contract, not 'the chain'.

   Falsifier

   What would retire it

   What is hidden: the amount, the sender, or both?

4. 04 The bound

   Observation

   What the study says

   This is not a deployed mixer and not an instruction for hiding funds.

   Model

   What has to hold

   This is not a deployed mixer and not an instruction for hiding funds.

   Falsifier

   What would retire it

   What is hidden: the amount, the sender, or both?

03 Sequence

One action, as an operating tape

1. 01Lock a balance in the contract.
2. 02Transfer by publishing a proof and updating commitments.
3. 03The contract accepts the proof or it does not. It does not see the amount.
4. 04Who is in the anonymity set?

04 Load-bearing

The argument, and where a pitch drops it

1. What the paper is for

   The cut

   A private-payments pitch on a public chain is this shape or it is a trusted operator. Ask what the contract verifies and what an observer still sees.

   Why it carries weight

   If this cut is skipped, the paper's name is being used without the mechanism that makes the name mean anything.

   Where it is dropped

   The anonymity set is whoever is in the contract, not 'the chain'.

2. What happened after

   The cut

   Later systems changed the proof system. The split between a public verifier and a hidden amount is the idea that stayed.

   Why it carries weight

   If this cut is skipped, the paper's name is being used without the mechanism that makes the name mean anything.

   Where it is dropped

   A later client, parameter or reward formula is a different object from this paragraph.

05 Register

What has to be true

• Model · Not re-measured

  This is not a deployed mixer and not an instruction for hiding funds.

• Model · Not re-measured

  The anonymity set is whoever is in the contract, not 'the chain'.

• Model · Not re-measured

  A bug in the statement being proved is a bug in the privacy.

06 Divergence

What happened after the paper

Later systems changed the proof system. The split between a public verifier and a hidden amount is the idea that stayed.

A later client, parameter set, or reward formula is a different object. Cite this paper for the mechanism. Cite a primary release for the network. This desk has not re-run the proof.

07 Pre-mortem

What to check before you use the idea

1. Kill test 1What is hidden: the amount, the sender, or both?
2. Kill test 2Who is in the anonymity set?
3. Kill test 3What does a failed proof reveal?
4. 0 of 3 marked on this browser. A mark is a reading note, not a pass, a rating, or a recommendation.

08 Anatomy

The paper, in the order a builder needs

09 Lexicon

Terms, opened into the record

Commitment

A published value that binds an amount without showing it.

Anonymity set

The accounts the sender could be.

10 Repository

Every linked record on this page

Underlined words open a page that already exists: a concept, a protocol profile, a failure record, or another paper. If a word is not underlined, this desk does not have a record for it.

No repository match in this text.

11 Related

The next papers, as theses

• Zerocash · 2014

  Zerocash: Decentralized Anonymous Payments from Bitcoin

  The 2014 paper that showed how a payment ledger can hide sender, receiver and amount, while still letting the network check that coins were not created or double-spent. Zcash is an implementation of this line of work, not a co-author of the paper.

• Bulletproofs · 2018

  Bulletproofs: Short Proofs for Confidential Transactions and More

  Range proofs whose size grows logarithmically, with no trusted setup. They made confidential amounts practical to verify. They are not, by themselves, a private payment system.