spl_token_confidential_transfer_proof_generation

Module burn

Source
Expand description

Generates the zero-knowledge proofs required for a confidential burn.

A confidential burn operation removes tokens from a user’s confidential balance and decreases the token’s total supply. This process requires three distinct zero-knowledge proofs to ensure the operation is valid, the user is solvent, and the token supply is updated correctly.

§Protocol Flow and Proof Components

  1. Encrypt Burn Amount: The burn amount is encrypted in a grouped (twisted) ElGamal ciphertext. This single operation prepares the burn_amount to be simultaneously subtracted from the user’s account and recorded in the mint’s pending_burn accumulator, which will later be subtracted from the total supply.

  2. Homomorphic Calculation: The client homomorphically computes their new encrypted balance by subtracting the source-encrypted component of the burn_amount from their current available_balance ciphertext.

  3. Generate Proofs: The user generates three proofs:

    • Batched Grouped Ciphertext Validity Proof: This proof certifies that the grouped ElGamal ciphertext for the burn_amount is well-formed and was correctly encrypted for the source, supply, and auditor public keys.

    • Ciphertext-Commitment Equality Proof: This proof provides the cryptographic link needed for the solvency check. After the user’s new balance is computed homomorphically, the prover no longer knows the associated Pedersen opening. To perform a range proof, the prover creates a new Pedersen commitment for their remaining_balance (for which they know the opening) and uses this proof to certify that the ciphertext and the new commitment hide the same value.

    • Range Proof (BatchedRangeProofU128): This proof is the core solvency check. It certifies that the user’s remaining_balance is non-negative (i.e., in the range [0, 2^64)), which makes it cryptographically impossible to burn more tokens than one possesses. It also proves the burn_amount itself is a valid 48-bit number.

Structs§

BurnProofData
The proof data required for a confidential burn instruction

Functions§

burn_split_proof_data