Encrypted amounts, verified by the network.
CIPHER is an interface to Confidential Balances, a Token-2022 extension built into Solana. Amounts are encrypted with twisted ElGamal, and validators verify zero-knowledge proofs about those ciphertexts without learning what they contain. There is no custom contract in the middle and no bridge — the proof verification is a native Solana program.
Lifecycle
- 01
Unlock
Your wallet signs one fixed message. CIPHER derives an ElGamal keypair and an AES key from that signature, in your browser. The keys are bound to your wallet, not to any single asset, and they are the Solana standard derivation — the same wallet produces the same keys in any compatible client.
- 02
Shield
A deposit moves tokens from your public balance into your encrypted balance. No proof is needed: the amount is leaving a balance that was already public, so it is stated in plaintext. What becomes private is your balance from that point on.
- 03
Send
A confidential transfer encrypts the amount to you, to the recipient, and to the mint’s auditor if one is configured. Three zero-knowledge proofs are generated on your device: an equality proof over your new balance, a validity proof over the encrypted amounts, and a range proof showing nothing went negative and nothing overflowed.
- 04
Receive
Incoming private funds land in a separate pending balance, so a credit arriving mid-operation cannot invalidate a proof you already built. Applying it decrypts the pending amount locally, adds it to your available balance, and writes back a fresh encrypted balance.
- 05
Unshield
A withdrawal proves that your encrypted balance covers the plaintext amount being credited, without revealing the balance. The amount becomes publicly visible the moment it lands.
Two keys, two jobs
Your confidential account holds its balance twice. The ElGamal ciphertext is the authoritative one: the program does homomorphic arithmetic on it, and the proofs are built against it. Recovering a value from it means solving a discrete logarithm, which is deliberately not cheap.
Alongside it sits the same available balance encrypted under your AES key, which decrypts instantly. That is what CIPHER renders. It is why your private balance appears as fast as a public one, and why the pending balance — which has no AES form — is the slower of the two to read.
Auditors
A mint issuer may configure an auditor ElGamal key. On such a mint, every confidential transfer additionally encrypts the amount to that key, so the auditor can decrypt transfer amounts. An auditor cannot move funds and cannot decrypt account balances.
CIPHER reads this from the mint rather than assuming it, shows it in the asset details, and says so again before you confirm a transfer. An audited mint is never presented the same way as one with no auditor.
The privacy boundary
- Your confidential balance
- Transfer amounts
- Pending balance amounts
- Your wallet address
- The mint and token accounts involved
- That a transfer occurred, and when
- Shield and unshield amounts
- Network fees
Confidential Balances provide amount and balance confidentiality. They do not provide anonymity. An observer can still see which accounts transacted and when, and can correlate that with anything else they know about those accounts. If your threat model requires hiding who is transacting rather than how much, this is not the right tool.