Balances that
stay private on a
public chain.
Homomorphically-encrypted balance vault. Every deposit adds to your encrypted balance through Paillier addition — without ever revealing the prior amount. Third-party observers see that you moved, not how much.
Your encrypted vault
Deposit, withdraw, and transfer — all balance state homomorphically encrypted on-chain via Paillier. Connect MetaMask to interact.
Testnet only — never use production funds.
Your balance is an opaque Paillier ciphertext. Only you (with the key) or the organizer can decrypt.
How it works
On-chain addition without decryption. Deposit N ETH → the contract computes E(balance) + E(N) = E(balance + N). No one sees the previous or new balance.
function deposit() external payable { bytes memory current = _encryptedBalance[msg.sender]; _encryptedBalance[msg.sender] = Paillier.addPlaintext( publicKey, current, g, msg.value // plaintext amount ); totalLocked += msg.value; }
The Paillier reference vault uses one organizer holding the private key. The canonical EC-ElGamal vault (v0.7.1) uses a Schnorr organizer. Stage 4 replaces the single organizer with a FROST threshold signing committee — 2-of-3 PoC verified end-to-end on Arbitrum Sepolia; production share distribution via DKG ceremony triggers once the validator cohort reaches sufficient scale on testnet.
- ✓ Homomorphic addition on-chain (no off-chain compute)
- ✓ Per-user replay-protected nonce
- ✓ 2048-bit Paillier (Stage 1 reference) · 128-bit ECDLP via BN254 EC-ElGamal (Stage 2 production)
- ✓ TFHE attestation on every withdraw (Stage 2 Part 2 — verify-only Rust worker on tfhe-rs v1.6.0)
- ! Single organizer in current deployment — superseded by FROST committee at Stage 4