_pERC20Labs

We build privacy

1. pERC20: EIP-8287-Draft-

[_pERC20Labs @_pERC20]

We just dropped something big:

pERC20 — an experimental protocol bringing truly private asset issuance and trading to Ethereum.

The private DeFi revolution isn't coming. It's already here.

https://t.co/82NtNXBqSN

[_pERC20Labs @_pERC20]

@EliBenSasson Who control OVK for users? Sir

[_pERC20Labs @_pERC20]

Privacy101 — How Private Money Works？

Privacy is becoming foundational infrastructure for blockchains. More projects are looking at the @Zcash protocol — still the strongest privacy design we have — as their reference. But the spec is dense. This series walks through it from §3.1, focusing on Orchard.
---

Chapter 1 — Orchard key components (§3.1 in https://t.co/0HXOVpApn6)

1 . Spending key (sk)
The root private key. Ultimate control over the account — backup this to recover everything.

2. ask / ak (spend authorizing key / validating key)
Derived from sk. ask is re-randomized into a one-time key pair (rsk, rk) used solely for each spendAuthSig.

Core purpose: a delegated prover may need private data (e.g. ak, nk) to build the proof — enough to view incoming notes — but cannot spend the user's notes without ask, which only the user holds to derive rsk and sign.

3. Full viewing key (ak, nk, rivk)
Derived from sk. From it you can derive the keys to view incoming and outgoing shielded activity. Does not let you spend.

nk (nullifier deriving key)
Computed from nk and the note contents — one note, one nf, spend once. Zcash's June 2026 Orchard attack broke exactly this rule: https://t.co/os9tRrpSlc

rivk
Derived from sk. Commit_ivk randomness — used with (ak, nk) to derive ivk, dk, and ovk.

4. Incoming viewing key (dk, ivk)
Decrypts incoming note ciphertexts.

5. Outgoing viewing key (ovk)
Decrypts outgoing payment details — what you sent, to whom, how much. Useful for compliance and audit: view your own sends without spend authority.

6. Shielded payment address (d, pkd)
What you share to receive funds. Users can generate many unlinkable shielded addresses to improve anonymity, while reusing the same viewing keys to scan and decrypt them all.

👉Next: How does the IVK work?

[_pERC20Labs @_pERC20]

Big week 🌂☂️🍆🍇🐙

[Solana @solana]

Big week ♠️♥️♣️♦️

[_pERC20Labs @_pERC20]

@zayn4pf ✅

[_pERC20Labs @_pERC20]

Congratulations. Privacy need the fastest speed for settlement.

[Keone Hon @keoneHD]

MIP-12 - reduce Monad block times by decreasing the vote pacing from 400ms to 300ms - has been published by @category_xyz

The vote pacing determines the min block time. Reducing it allows the network to proceed faster if quorum has been achieved

The tech has already supported this improvement, but mainnet launched with an extra buffer. With this change and others, you’ll see the network continue to harden and streamline

[_pERC20Labs @_pERC20]

Qucikly understand the Verifying the Soundness of @Zcash’s Circulating Supply:

Q1. Can you check a shielded pool's balance directly?

No. A shielded pool hides every amount, so you can't open it up and add the coins together. If someone secretly printed extra ZEC inside, you'd have no way to spot it just by looking.

Q2. So how does Ironwood keep the total supply honest?

Two simple rules:

1. Lock the old pool. After the upgrade, no new coins can be created or moved inside the old pool. The only thing you can do is take your money out.
2. Cap the exit. A pool can never pay out more than was put into it. That "put-in" number is already public and tracked by every node.

So even if fake ZEC is hiding in the old pool, only the real, legitimate amount can ever come out.

Q3. If fake coins really exist, are honest users protected?

Only the ones who move out early. Withdrawals are first-come, first-served against that fixed cap. Once the cap is used up, whatever is left in the old pool is stuck forever — even if it's real. So everyone, honest or not, has a reason to rush out first. It turns into a race.

Q4. How would we know if fake coins were ever made?

Watch what happens during the rush:

If everyone gets their money out → no extra coins existed. Clean.
If the cap runs dry while real users still can't withdraw → that gap is proof someone printed fake ZEC.

Note: we also spent some time researching how to make the total supply of private assets verifiable. So far, we have not found the most direct way to do so.

[zooko🛡🦓🦓🦓 ⓩ @zooko]

https://t.co/pYEkPgqxfG

[_pERC20Labs @_pERC20]

@hosseeb team's next step is a new turnstile and a fresh shielded pool in the coming upgrade, which will confirm the shielded pool was not inflated."

Yeah, the market needs it. And currently, the most important thing for all privacy protocols — including us — is to make the shielded supply publicly verifiable.

Don't trust, just verify.

[Haseeb ＞|＜ @hosseeb]

There's a lot of confusion about the recently patched Zcash bug. Here's how to actually understand it.

If the bug had been exploited before the patch (very unlikely it was), it would have looked like the shielded pool getting drained. Whoever minted the counterfeit shielded ZEC would want to sell fast, before anyone else found the same bug. And remember, the market for ZEC is almost entirely transparent ZEC, not shielded. You can't dump freshly minted shielded ZEC on Binance or Coinbase without unshielding it first.

The losers in that scenario are shielded holders who sit still. The transparent portion of Zcash is fully visible, so it's trivial to enforce that transparent ZEC never exceeds max supply. If you try to unshield more than the cap, you'll get stopped at the door.

So if you hold transparent ZEC (anyone trading, on an exchange, or doing price discovery on ZEC) there's no marginal effect on you. The loss falls entirely on shielded holders.

The team's next step is a new turnstile and a fresh shielded pool in the coming upgrade, which will confirm the shielded pool was not inflated. Think of it as taking headcount at the end of the field trip--that will make sure no extra kids snuck onto the bus.

But while AI found this bug, AI will also deliver the fix for the whole category: formal verification. I'm very bullish on this as the path to harden all software across the industry. Formally verified cryptography can't have implementation bugs by construction.

Right now AI is surfacing vulnerabilities across all our software--browsers, OSes, and blockchains are no exception. We're in the awkward adolescence where every wart is getting magnified and put on full display. But formally verified software is the only path forward for mission-critical software, and Zcash has put it front and center on their roadmap to deliver.

Privacy is too important not to.

(Dragonfly holds $ZEC and continues to. I'm personally an investor in ZODL.)

[_pERC20Labs @_pERC20]

There are things that naturally belong to the Privacy World.

We bring them into being. Then we forge the bridge — so they may live in harmony with the Open World.

Privacy without isolation.
Openness without violation.

We do not hide from the light.
We teach the light how to respect the dark.

This is our creation.

[_pERC20Labs @_pERC20]

@dapangdun @cryptunez @lulu70191243 一切皆有可能

[_pERC20Labs @_pERC20]

@cryptunez let's build for this. @lulu70191243

[tunez @cryptunez]

If you could transact on Monad privately, what features would be the most important for you and why?

[_pERC20Labs @_pERC20]

It seems these are the most viral tweets from @ethresearchbot recently, influenced by the @Zcash bug (https://t.co/wFVeIx9f11)
(since pERC20(https://t.co/f2UW0cpQfl) is also built on the Orchard protocol).

Some are skeptical, some are excited, and some are taking a wait-and-see approach.

In fact, pERC20 rewrote the entire constraint system in circom and adopted the Groth16 scheme.

Let's look forward to the big event happening this month.

[ethresearchbot @ethresearchbot]

New EIP!

pERC20 - Privacy-Native Fungible Tokens

🔗 https://t.co/DBDudAF6I7

Highlights:
- Not ERC-20 compatible by design: pERC20 removes public balance/allowance concepts (no balanceOf/approve/allowance/transferFrom) and replaces transfers with a ZK note-based interface (transfer(PrivacyCall)), because public balances would defeat the privacy goal.
- Privacy-native from issuance: tokens are always represented as encrypted ZK-UTXO notes (Orchard-style actions with Groth16 proofs); there is no “public-to-private shielding” step—transfers are note→note and amounts/participants are private by default.
- Public, on-chain verifiable supply: totalSupply remains public and is updated only through controlled mint(amount, ...) and burn(amount, ...); transfers must conserve value (valueBalance == 0), enabling “no invisible inflation” while keeping balances private.
- Built-in compliance via frozen-root binding: every action commits to the contract’s cmxFrozenRoot, and the ZK circuit must prove the spent note commitment is NOT in the blacklist SMT. Admin can update the root (setFrozenRoot) to freeze/unfreeze specific notes without revealing normal users’ balances.
- Security-critical invariants and checks: implementations must prevent double-spends with nullifiers and must range-check each public field (< Fr) to avoid nf + Fr-style bypasses; the core bundle execution must not be publicly callable to prevent unaccounted supply changes; signature points must be curve/field validated and replay protection must bind chainId + contract + note data.

ELI5:
This EIP proposes a new kind of token standard for Ethereum where people’s token amounts and who they pay are hidden by default. Instead of keeping a public “balance” per account like ERC-20, the token exists as many encrypted “notes” (like digital cash bills) that can be spent with zero-knowledge proofs. Everyone can still see the total number of tokens that exist (totalSupply) so the issuer can’t secretly create extra tokens. It also adds an optional-but-built-in “freeze list” mechanism: the token contract keeps a public fingerprint (root) of a blacklist, and the zero-knowledge proof must show you are not spending a frozen note.

[_pERC20Labs @_pERC20]

@LaLiLuLeL0x @ethresearchbot Definitely agree, sir. We try to achieve that.

[_pERC20Labs @_pERC20]

@wehuihuihui 平台上线的时候，只公布 pERC20.sol 参考了 ERC20 的 EIP，因为只是标准接口提案。

[_pERC20Labs @_pERC20]

We just dropped something big:

pERC20 — an experimental protocol bringing truly private asset issuance and trading to Ethereum.

The private DeFi revolution isn't coming. It's already here.

https://t.co/82NtNXBqSN

[_pERC20Labs @_pERC20]

@whitesocks256 Yes

[_pERC20Labs @_pERC20]

@tulipking Hi, Sir. We just reuse the orchard protocol and rewrote the proof system with circom. As we know, evm isn’t halo2 compatibility.

[_pERC20Labs @_pERC20]

Qucikly understand the multiple-spend vulnerability in @Zcash :

1. Due to a circuit bug, the attacker can bypass the diversified address integrity constraint with a different nk.
2. The attacker can then generate different nf_old values with different nk for the same note (cm_old).

The multiple-spend works because nodes only check nf_old to prevent duplicate spending.

Besides fixing the bug, could we use the tuple (nf_old, rk) as the unique identifier for a note? Both are unique per note and it could reduce the risk further.@zooko

[zooko🛡🦓🦓🦓 ⓩ @zooko]

https://t.co/v7BiOdzU9E

[_pERC20Labs @_pERC20]

Somebody FUDs, somebody builds, somebody believes.

[Dev 🧪 @zkDragon]

&gt; fud zcash for not being used by criminals and NK exit liquidity
&gt; see patched bug and shielded pool only up, no FSH
&gt; NK only FSHs
&gt; still no mass exits 2 days post patch
&gt; conclude NK has bank run the pool

Really don’t think this theory is it guys

[_pERC20Labs @_pERC20]

@zayn4pf @cryptunez @lulu70191243 It's my honor.

[_pERC20Labs @_pERC20]

@zayn4pf @cryptunez @lulu70191243 👌

[_pERC20Labs @_pERC20]

@Natalia26234884 @ethresearchbot The note commitment(cmx) is a public info for each transaction, so we know it.