From ba70b05217eb3ad8944ec2d8e0226dba1c829711 Mon Sep 17 00:00:00 2001 From: Percival Lucena Date: Wed, 19 Aug 2026 15:50:03 -0300 Subject: [PATCH 1/3] docs: add PoD pERC20 vs ERC-7984 comparison to Privacy Portal developer guide Documents how COTI's Privacy on Demand pERC20 compares with FHE-based confidential-token implementations of ERC-7984, covering 256-bit vs 64-bit numeric range, ~192-byte encrypted inputs vs multi-KB ZK proofs, exact encrypted allowances vs time-boxed operators, non-revealing failure, and the session-scoped garbled-circuit security model. Includes the six pTokens live on Avalanche Fuji and Ethereum Sepolia. Adds the page to SUMMARY.md navigation and cross-links it from PrivateERC20.sol. --- SUMMARY.md | 1 + .../developer-guide/privateERC20-ERC7984.md | 147 ++++++++++++++++++ .../developer-guide/privateerc20.sol.md | 2 + 3 files changed, 150 insertions(+) create mode 100644 coti-privacy-portal/developer-guide/privateERC20-ERC7984.md diff --git a/SUMMARY.md b/SUMMARY.md index 86a4d7b..97bef69 100644 --- a/SUMMARY.md +++ b/SUMMARY.md @@ -109,6 +109,7 @@ * [Transfer Private Tokens](coti-privacy-portal/user-guide/transfer-private-tokens.md) * [Developer Guide](coti-privacy-portal/developer-guide/README.md) * [PrivateERC20.sol](coti-privacy-portal/developer-guide/privateerc20.sol.md) + * [PoD pERC20 vs ERC-7984](coti-privacy-portal/developer-guide/privateERC20-ERC7984.md) * [Architecture](coti-privacy-portal/developer-guide/architecture.md) * [Creating a New PrivateERC20 Token](coti-privacy-portal/developer-guide/creating-a-new-privateerc20-token.md) * [Minting Tokens](coti-privacy-portal/developer-guide/minting-tokens.md) diff --git a/coti-privacy-portal/developer-guide/privateERC20-ERC7984.md b/coti-privacy-portal/developer-guide/privateERC20-ERC7984.md new file mode 100644 index 0000000..32bbf98 --- /dev/null +++ b/coti-privacy-portal/developer-guide/privateERC20-ERC7984.md @@ -0,0 +1,147 @@ +# PoD pERC20 vs ERC7984 + +**Confidential tokens on the chains you already use.** + +Privacy on Demand brings encrypted balances and encrypted transfers to any EVM chain — no privacy-native L1, no specialised rollup, no migration. Live today on Avalanche Fuji and Ethereum Sepolia. + +--- + +## Wrap the assets that actually exist + +PoD pERC20 is a 1:1 collateralised confidential wrapper. Lock WETH, get `p.ETH`. Lock USDC, get `p.USDC`. The private token mirrors the underlying exactly — same decimals, same supply, same value — and unwraps back on demand. + +That "same decimals" part is where PoD stands alone. + +**FHE-based confidential token standards store balances as 64-bit encrypted integers.** At 18 decimals, a 64-bit ceiling caps a token at roughly **18.4 whole units** before it overflows. A confidential 1:1 WETH wrapper is not difficult under that constraint — it is arithmetically impossible above ~18 ETH. + +PoD carries **full 256-bit precision** end to end: 18 decimals, `uint256` range, no ceiling worth naming. Four of the six pTokens live today are 18-decimal, including `p.ETH` and `p.AVAX`. + +> **If you want to wrap real liquidity confidentially, 256-bit is not a preference. It is the entry requirement.** + +--- + +## Deploy anywhere there is an Inbox + +Confidential tokens have historically meant moving to a privacy chain and asking your users to follow. PoD inverts that: the token lives on **your** chain, and the encrypted computation happens on COTI behind the scenes. + + +| | | +| :----------------------------- | :-------------------------------------------------------------- | +| **Chains supported** | Any EVM chain with a PoD Inbox deployed | +| **Live today** | Avalanche Fuji, Ethereum Sepolia | +| **Required of the host chain** | Nothing — no FHE precompiles, no custom opcodes, no forked EVM | +| **Required of the user** | A standard wallet | + +Your liquidity, your users, and your existing integrations stay exactly where they are. + +--- + +## Built for real transaction economics + +Confidentiality usually arrives with a size problem. FHE-based tokens attach a zero-knowledge input proof to every encrypted value — commonly **16–20 KB per input** — and offload multi-kilobyte ciphertext blobs off-chain. + +PoD's encrypted values are small enough to treat like ordinary transaction data. + + +| | **PoD pERC20** | **FHE-based confidential tokens** | +| :--------------- | :------------------- | :--------------------------------------- | +| Encrypted input | **~192 bytes** | ~16,000–20,000 bytes | +| On-chain balance | **2 storage slots** | Handle on-chain, multi-KB blob offloaded | +| Client-side work | **Encrypt and sign** | Generate a ZK proof, per transaction | +| Numeric range | **256-bit** | 64-bit | + +**Roughly two orders of magnitude smaller on input.** Confidential transfers that fit comfortably inside normal block economics, on chains that were never designed for privacy. + +--- + +## No proving in the browser + +FHE inputs require the user's device to generate a zero-knowledge proof before a transaction can even be submitted — seconds of computation, and a frozen UI while it runs. + +PoD asks the client to **encrypt and sign**. That is it. The wallet does what wallets already do, and the transaction goes out immediately. On mobile, on low-end hardware, and at scale, that difference compounds. + +--- + +## Precise, confidential approvals + +PoD keeps the allowance model developers already know — and encrypts it. + +- **Exact amounts.** Approve 50 tokens, not blanket authority over the balance. +- **Encrypted on-chain.** The allowance value is a ciphertext, readable only by the owner and the spender. +- **Standard semantics.** `approve` / `transferFrom`, the shape every integrator already knows. + +Blanket time-boxed operator models grant a spender full authority over a balance until expiry, and record that authority publicly. PoD grants a specific encrypted amount, and keeps the amount private. + +--- + +## Failure that reveals nothing + +When an encrypted transfer exceeds a balance, PoD resolves it inside the garbled circuit: the effective amount becomes zero and the request completes normally. **No revert, no error code, no observable difference** between a transfer that moved value and one that did not. + +Insufficient balances stay as private as sufficient ones. + +--- + +## A security model without a master key + +PoD's confidentiality rests on **garbled circuits with non-colluding parties** — a garbler and an evaluator that must both defect to compromise a session. + +The distinction that matters is what a worst case costs you. Threshold FHE systems protect a shared decryption key; if enough key-holders collude, **every transaction ever recorded becomes readable retroactively**. PoD has no such key. A compromise is scoped to a session, not to your history. + +**Privacy that does not accumulate a single point of catastrophic failure.** + +--- + +## Live on two public testnets + +Six confidential tokens, deployed and operating. + +**Avalanche Fuji** + + +| Token | Address | Decimals | +| :------- | :------------------------------------------- | :------: | +| `p.MTT` | `0x02f284a1968160E1d3e4bC2BA3261be49725E765` | 18 | +| `p.USDC` | `0x21576D8CCE47d044C5815bd59eca1F6DA94c65A5` | 6 | +| `p.AVAX` | `0x74d47cD68203066c97BA99787Fe1e0c68Ce42b04` | 18 | + +**Ethereum Sepolia** + + +| Token | Address | Decimals | +| :------- | :------------------------------------------- | :------: | +| `p.MTT` | `0x0510F0b32828D5fB472dE5A5bE30b370c5D1a056` | 18 | +| `p.USDC` | `0xD7B3D49F85000489708B7db5B0f1a8693Fc707f3` | 6 | +| `p.ETH` | `0xd33A363459c6Ee0C4F8504E380E8D3Aa4F209116` | 18 | + +Each pair is deployed by `PrivacyPortalFactory` as a minimal-proxy clone — **one portal and one pToken per asset**, so listing a new confidential token is a factory call, not an engineering project. + +--- + +## Explorer-native from day one + +PoD pTokens emit `ConfidentialTransfer` events and expose ERC-7984 metadata, so Blockscout and compatible explorers classify them as confidential tokens and index their activity automatically. Your users see a first-class token page, not an unrecognised contract. + +--- + +## Concurrency that keeps up with users + +Multiple transfers, mints, and burns from the same account can be in flight simultaneously. Each is tracked independently by request id, and a monotonic nonce guarantees results always apply in the correct order. **No queue, no serialisation, no waiting for one transfer to clear before starting the next.** + +--- + +## Why teams choose PoD pERC20 + + +| | | +| :--------------------------- | :------------------------------------------------------------------------ | +| **Wrap real assets** | 18-decimal confidential WETH and WAVAX — out of reach for 64-bit designs | +| **Keep your chain** | Runs on any EVM chain; no privacy L1, no migration | +| **Full precision** | 256-bit values, no supply ceiling | +| **Small on-chain footprint** | ~192-byte inputs, 2-slot balances | +| **Instant for users** | No client-side proof generation | +| **Private allowances** | Exact encrypted amounts, not public blanket authority | +| **No master key** | Session-scoped security, no retroactive exposure | +| **Ship fast** | Factory-deployed portal + token pair per asset | + +--- diff --git a/coti-privacy-portal/developer-guide/privateerc20.sol.md b/coti-privacy-portal/developer-guide/privateerc20.sol.md index 529360a..213390b 100644 --- a/coti-privacy-portal/developer-guide/privateerc20.sol.md +++ b/coti-privacy-portal/developer-guide/privateerc20.sol.md @@ -39,6 +39,8 @@ PrivateERC20 follows the ERC20 interface, but changes how data is stored and exp | Supports plain uint256 operations | Yes | Yes | | Supports encrypted operations | No | Yes (`itUint256`, `gtUint256` variants) | +For a comparison against the [ERC-7984](https://eips.ethereum.org/EIPS/eip-7984) confidential-token standard — and how COTI's Privacy on Demand `pERC20` compares with FHE-based implementations on encrypted-input size, numeric range, and allowance semantics — see [PoD pERC20 vs ERC-7984](privateERC20-ERC7984.md). + ### How it works #### Balances From e72de137440197ced6ba8d5dd9e7d4b85d52e034 Mon Sep 17 00:00:00 2001 From: Percival Lucena Date: Sun, 23 Aug 2026 16:36:10 -0300 Subject: [PATCH 2/3] docs: promote ERC-7984 comparison to a top-level COTI ERC-7984 product Moves the PoD pERC20 vs ERC-7984 page out of the Privacy Portal developer guide and republishes it as its own product section in the main hierarchy, split into seven sub-pages. - New section: COTI ERC-7984, listed after Privacy on Avalanche in SUMMARY.md - Sub-pages: precision and decimals, host-chain deployment, transaction economics, transfer semantics, security model, concurrency, deployed contracts - README carries the overview, a nav list, and the summary table - privateerc20.sol.md cross-link repointed at the new product Content is the same prose as before; no claims changed. Co-Authored-By: Claude Opus 5 --- SUMMARY.md | 9 +- coti-erc7984/README.md | 32 ++++ coti-erc7984/concurrency.md | 7 + coti-erc7984/deployed-contracts.md | 27 ++++ coti-erc7984/host-chain-deployment.md | 16 ++ coti-erc7984/precision-and-decimals.md | 15 ++ coti-erc7984/security-model.md | 11 ++ coti-erc7984/transaction-economics.md | 22 +++ coti-erc7984/transfer-semantics.md | 17 ++ .../developer-guide/privateERC20-ERC7984.md | 147 ------------------ .../developer-guide/privateerc20.sol.md | 2 +- 11 files changed, 156 insertions(+), 149 deletions(-) create mode 100644 coti-erc7984/README.md create mode 100644 coti-erc7984/concurrency.md create mode 100644 coti-erc7984/deployed-contracts.md create mode 100644 coti-erc7984/host-chain-deployment.md create mode 100644 coti-erc7984/precision-and-decimals.md create mode 100644 coti-erc7984/security-model.md create mode 100644 coti-erc7984/transaction-economics.md create mode 100644 coti-erc7984/transfer-semantics.md delete mode 100644 coti-privacy-portal/developer-guide/privateERC20-ERC7984.md diff --git a/SUMMARY.md b/SUMMARY.md index 97bef69..c8af35e 100644 --- a/SUMMARY.md +++ b/SUMMARY.md @@ -109,7 +109,6 @@ * [Transfer Private Tokens](coti-privacy-portal/user-guide/transfer-private-tokens.md) * [Developer Guide](coti-privacy-portal/developer-guide/README.md) * [PrivateERC20.sol](coti-privacy-portal/developer-guide/privateerc20.sol.md) - * [PoD pERC20 vs ERC-7984](coti-privacy-portal/developer-guide/privateERC20-ERC7984.md) * [Architecture](coti-privacy-portal/developer-guide/architecture.md) * [Creating a New PrivateERC20 Token](coti-privacy-portal/developer-guide/creating-a-new-privateerc20-token.md) * [Minting Tokens](coti-privacy-portal/developer-guide/minting-tokens.md) @@ -153,6 +152,14 @@ * [Cookbook: private investor allocations with PoD](privacy-on-avalanche/cookbook-private-investor-allocations.md) * [Tutorial: private Adder on Avalanche Fuji](privacy-on-avalanche/tutorial-private-adder-fuji.md) * [Tutorial: custom privacy logic with PoD](privacy-on-avalanche/tutorial-custom-logic.md) +* [COTI ERC-7984](coti-erc7984/README.md) + * [Precision and decimals](coti-erc7984/precision-and-decimals.md) + * [Host-chain deployment](coti-erc7984/host-chain-deployment.md) + * [Transaction economics](coti-erc7984/transaction-economics.md) + * [Transfer semantics](coti-erc7984/transfer-semantics.md) + * [Security model](coti-erc7984/security-model.md) + * [Concurrency](coti-erc7984/concurrency.md) + * [Deployed contracts](coti-erc7984/deployed-contracts.md) ## Security diff --git a/coti-erc7984/README.md b/coti-erc7984/README.md new file mode 100644 index 0000000..e6c364f --- /dev/null +++ b/coti-erc7984/README.md @@ -0,0 +1,32 @@ +# COTI ERC-7984 + +**Confidential tokens on the chains you already use.** + +Privacy on Demand brings encrypted balances and encrypted transfers to any EVM chain — no privacy-native L1, no specialised rollup, no migration. Live today on Avalanche Fuji and Ethereum Sepolia. + +COTI's implementation of the [ERC-7984](https://eips.ethereum.org/EIPS/eip-7984) confidential-token interface is the PoD `pERC20`: a 1:1 collateralised confidential wrapper deployed on the host chain, with the encrypted computation performed on COTI behind the scenes. It exposes ERC-7984 metadata and emits `ConfidentialTransfer` events, so explorers and integrators treat it as a first-class confidential token. + +This section compares that implementation against FHE-based implementations of the same standard, dimension by dimension. + +## In this section + +* [**Precision and decimals**](precision-and-decimals.md) — 256-bit values against the 64-bit ceiling, and why it decides whether a wrapper can mirror an 18-decimal asset. +* [**Host-chain deployment**](host-chain-deployment.md) — what the token requires of the chain it runs on, and what it requires of the user. +* [**Transaction economics**](transaction-economics.md) — encrypted-input size, on-chain footprint, and where the cryptographic work happens. +* [**Transfer semantics**](transfer-semantics.md) — encrypted allowances with standard `approve` / `transferFrom`, and failures that reveal nothing. +* [**Security model**](security-model.md) — garbled circuits with non-colluding parties, and why there is no master key to compromise. +* [**Concurrency**](concurrency.md) — multiple in-flight requests per account, ordered by a monotonic nonce. +* [**Deployed contracts**](deployed-contracts.md) — the six pTokens live on Avalanche Fuji and Ethereum Sepolia, and how new ones are listed. + +## Why teams choose COTI ERC-7984 + +| | | +| :--------------------------- | :------------------------------------------------------------------------ | +| **Wrap real assets** | 18-decimal confidential WETH and WAVAX — out of reach for 64-bit designs | +| **Keep your chain** | Runs on any EVM chain; no privacy L1, no migration | +| **Full precision** | 256-bit values, no supply ceiling | +| **Small on-chain footprint** | ~192-byte inputs, 2-slot balances | +| **Instant for users** | No client-side proof generation | +| **Private allowances** | Exact encrypted amounts, not public blanket authority | +| **No master key** | Session-scoped security, no retroactive exposure | +| **Ship fast** | Factory-deployed portal + token pair per asset | diff --git a/coti-erc7984/concurrency.md b/coti-erc7984/concurrency.md new file mode 100644 index 0000000..10dcbb4 --- /dev/null +++ b/coti-erc7984/concurrency.md @@ -0,0 +1,7 @@ +# Concurrency + +## Concurrency that keeps up with users + +Multiple transfers, mints, and burns from the same account can be in flight simultaneously. Each is tracked independently by request id, and a monotonic nonce guarantees results always apply in the correct order. **No queue, no serialisation, no waiting for one transfer to clear before starting the next.** + +For how asynchronous private operations settle in general, see [Async private operations](../privacy-on-demand/async-private-operations.md). diff --git a/coti-erc7984/deployed-contracts.md b/coti-erc7984/deployed-contracts.md new file mode 100644 index 0000000..7231a09 --- /dev/null +++ b/coti-erc7984/deployed-contracts.md @@ -0,0 +1,27 @@ +# Deployed contracts + +## Live on two public testnets + +Six confidential tokens, deployed and operating. + +**Avalanche Fuji** + +| Token | Address | Decimals | +| :------- | :------------------------------------------- | :------: | +| `p.MTT` | `0x02f284a1968160E1d3e4bC2BA3261be49725E765` | 18 | +| `p.USDC` | `0x21576D8CCE47d044C5815bd59eca1F6DA94c65A5` | 6 | +| `p.AVAX` | `0x74d47cD68203066c97BA99787Fe1e0c68Ce42b04` | 18 | + +**Ethereum Sepolia** + +| Token | Address | Decimals | +| :------- | :------------------------------------------- | :------: | +| `p.MTT` | `0x0510F0b32828D5fB472dE5A5bE30b370c5D1a056` | 18 | +| `p.USDC` | `0xD7B3D49F85000489708B7db5B0f1a8693Fc707f3` | 6 | +| `p.ETH` | `0xd33A363459c6Ee0C4F8504E380E8D3Aa4F209116` | 18 | + +Each pair is deployed by `PrivacyPortalFactory` as a minimal-proxy clone — **one portal and one pToken per asset**, so listing a new confidential token is a factory call, not an engineering project. + +## Explorer-native from day one + +PoD pTokens emit `ConfidentialTransfer` events and expose ERC-7984 metadata, so Blockscout and compatible explorers classify them as confidential tokens and index their activity automatically. Your users see a first-class token page, not an unrecognised contract. diff --git a/coti-erc7984/host-chain-deployment.md b/coti-erc7984/host-chain-deployment.md new file mode 100644 index 0000000..c2dac66 --- /dev/null +++ b/coti-erc7984/host-chain-deployment.md @@ -0,0 +1,16 @@ +# Host-chain deployment + +## Deploy anywhere there is an Inbox + +Confidential tokens have historically meant moving to a privacy chain and asking your users to follow. PoD inverts that: the token lives on **your** chain, and the encrypted computation happens on COTI behind the scenes. + +| | | +| :----------------------------- | :-------------------------------------------------------------- | +| **Chains supported** | Any EVM chain with a PoD Inbox deployed | +| **Live today** | Avalanche Fuji, Ethereum Sepolia | +| **Required of the host chain** | Nothing — no FHE precompiles, no custom opcodes, no forked EVM | +| **Required of the user** | A standard wallet | + +Your liquidity, your users, and your existing integrations stay exactly where they are. + +For the components behind the Inbox, see [Architecture and main components](../privacy-on-demand/architecture-and-components.md) in the Privacy on Demand section. diff --git a/coti-erc7984/precision-and-decimals.md b/coti-erc7984/precision-and-decimals.md new file mode 100644 index 0000000..30b50cb --- /dev/null +++ b/coti-erc7984/precision-and-decimals.md @@ -0,0 +1,15 @@ +# Precision and decimals + +## Wrap the assets that actually exist + +PoD `pERC20` is a 1:1 collateralised confidential wrapper. Lock WETH, get `p.ETH`. Lock USDC, get `p.USDC`. The private token mirrors the underlying exactly — same decimals, same supply, same value — and unwraps back on demand. + +That "same decimals" part is where PoD stands alone. + +**FHE-based confidential token standards store balances as 64-bit encrypted integers.** At 18 decimals, a 64-bit ceiling caps a token at roughly **18.4 whole units** before it overflows. A confidential 1:1 WETH wrapper is not difficult under that constraint — it is arithmetically impossible above ~18 ETH. + +PoD carries **full 256-bit precision** end to end: 18 decimals, `uint256` range, no ceiling worth naming. Four of the six pTokens live today are 18-decimal, including `p.ETH` and `p.AVAX`. + +> **If you want to wrap real liquidity confidentially, 256-bit is not a preference. It is the entry requirement.** + +The [deployed contracts](deployed-contracts.md) page lists the decimals of each live pToken. diff --git a/coti-erc7984/security-model.md b/coti-erc7984/security-model.md new file mode 100644 index 0000000..dea0620 --- /dev/null +++ b/coti-erc7984/security-model.md @@ -0,0 +1,11 @@ +# Security model + +## A security model without a master key + +PoD's confidentiality rests on **garbled circuits with non-colluding parties** — a garbler and an evaluator that must both defect to compromise a session. + +The distinction that matters is what a worst case costs you. Threshold FHE systems protect a shared decryption key; if enough key-holders collude, **every transaction ever recorded becomes readable retroactively**. PoD has no such key. A compromise is scoped to a session, not to your history. + +**Privacy that does not accumulate a single point of catastrophic failure.** + +For the underlying primitive, see [Garbled Circuits](../how-coti-works/advanced-topics/garbled-circuits.md). diff --git a/coti-erc7984/transaction-economics.md b/coti-erc7984/transaction-economics.md new file mode 100644 index 0000000..3c29706 --- /dev/null +++ b/coti-erc7984/transaction-economics.md @@ -0,0 +1,22 @@ +# Transaction economics + +## Built for real transaction economics + +Confidentiality usually arrives with a size problem. FHE-based tokens attach a zero-knowledge input proof to every encrypted value — commonly **16–20 KB per input** — and offload multi-kilobyte ciphertext blobs off-chain. + +PoD's encrypted values are small enough to treat like ordinary transaction data. + +| | **PoD pERC20** | **FHE-based confidential tokens** | +| :--------------- | :------------------- | :--------------------------------------- | +| Encrypted input | **~192 bytes** | ~16,000–20,000 bytes | +| On-chain balance | **2 storage slots** | Handle on-chain, multi-KB blob offloaded | +| Client-side work | **Encrypt and sign** | Generate a ZK proof, per transaction | +| Numeric range | **256-bit** | 64-bit | + +**Roughly two orders of magnitude smaller on input.** Confidential transfers that fit comfortably inside normal block economics, on chains that were never designed for privacy. + +## No proving in the browser + +FHE inputs require the user's device to generate a zero-knowledge proof before a transaction can even be submitted — seconds of computation, and a frozen UI while it runs. + +PoD asks the client to **encrypt and sign**. That is it. The wallet does what wallets already do, and the transaction goes out immediately. On mobile, on low-end hardware, and at scale, that difference compounds. diff --git a/coti-erc7984/transfer-semantics.md b/coti-erc7984/transfer-semantics.md new file mode 100644 index 0000000..9b3fd3c --- /dev/null +++ b/coti-erc7984/transfer-semantics.md @@ -0,0 +1,17 @@ +# Transfer semantics + +## Precise, confidential approvals + +PoD keeps the allowance model developers already know — and encrypts it. + +- **Exact amounts.** Approve 50 tokens, not blanket authority over the balance. +- **Encrypted on-chain.** The allowance value is a ciphertext, readable only by the owner and the spender. +- **Standard semantics.** `approve` / `transferFrom`, the shape every integrator already knows. + +Blanket time-boxed operator models grant a spender full authority over a balance until expiry, and record that authority publicly. PoD grants a specific encrypted amount, and keeps the amount private. + +## Failure that reveals nothing + +When an encrypted transfer exceeds a balance, PoD resolves it inside the garbled circuit: the effective amount becomes zero and the request completes normally. **No revert, no error code, no observable difference** between a transfer that moved value and one that did not. + +Insufficient balances stay as private as sufficient ones. diff --git a/coti-privacy-portal/developer-guide/privateERC20-ERC7984.md b/coti-privacy-portal/developer-guide/privateERC20-ERC7984.md deleted file mode 100644 index 32bbf98..0000000 --- a/coti-privacy-portal/developer-guide/privateERC20-ERC7984.md +++ /dev/null @@ -1,147 +0,0 @@ -# PoD pERC20 vs ERC7984 - -**Confidential tokens on the chains you already use.** - -Privacy on Demand brings encrypted balances and encrypted transfers to any EVM chain — no privacy-native L1, no specialised rollup, no migration. Live today on Avalanche Fuji and Ethereum Sepolia. - ---- - -## Wrap the assets that actually exist - -PoD pERC20 is a 1:1 collateralised confidential wrapper. Lock WETH, get `p.ETH`. Lock USDC, get `p.USDC`. The private token mirrors the underlying exactly — same decimals, same supply, same value — and unwraps back on demand. - -That "same decimals" part is where PoD stands alone. - -**FHE-based confidential token standards store balances as 64-bit encrypted integers.** At 18 decimals, a 64-bit ceiling caps a token at roughly **18.4 whole units** before it overflows. A confidential 1:1 WETH wrapper is not difficult under that constraint — it is arithmetically impossible above ~18 ETH. - -PoD carries **full 256-bit precision** end to end: 18 decimals, `uint256` range, no ceiling worth naming. Four of the six pTokens live today are 18-decimal, including `p.ETH` and `p.AVAX`. - -> **If you want to wrap real liquidity confidentially, 256-bit is not a preference. It is the entry requirement.** - ---- - -## Deploy anywhere there is an Inbox - -Confidential tokens have historically meant moving to a privacy chain and asking your users to follow. PoD inverts that: the token lives on **your** chain, and the encrypted computation happens on COTI behind the scenes. - - -| | | -| :----------------------------- | :-------------------------------------------------------------- | -| **Chains supported** | Any EVM chain with a PoD Inbox deployed | -| **Live today** | Avalanche Fuji, Ethereum Sepolia | -| **Required of the host chain** | Nothing — no FHE precompiles, no custom opcodes, no forked EVM | -| **Required of the user** | A standard wallet | - -Your liquidity, your users, and your existing integrations stay exactly where they are. - ---- - -## Built for real transaction economics - -Confidentiality usually arrives with a size problem. FHE-based tokens attach a zero-knowledge input proof to every encrypted value — commonly **16–20 KB per input** — and offload multi-kilobyte ciphertext blobs off-chain. - -PoD's encrypted values are small enough to treat like ordinary transaction data. - - -| | **PoD pERC20** | **FHE-based confidential tokens** | -| :--------------- | :------------------- | :--------------------------------------- | -| Encrypted input | **~192 bytes** | ~16,000–20,000 bytes | -| On-chain balance | **2 storage slots** | Handle on-chain, multi-KB blob offloaded | -| Client-side work | **Encrypt and sign** | Generate a ZK proof, per transaction | -| Numeric range | **256-bit** | 64-bit | - -**Roughly two orders of magnitude smaller on input.** Confidential transfers that fit comfortably inside normal block economics, on chains that were never designed for privacy. - ---- - -## No proving in the browser - -FHE inputs require the user's device to generate a zero-knowledge proof before a transaction can even be submitted — seconds of computation, and a frozen UI while it runs. - -PoD asks the client to **encrypt and sign**. That is it. The wallet does what wallets already do, and the transaction goes out immediately. On mobile, on low-end hardware, and at scale, that difference compounds. - ---- - -## Precise, confidential approvals - -PoD keeps the allowance model developers already know — and encrypts it. - -- **Exact amounts.** Approve 50 tokens, not blanket authority over the balance. -- **Encrypted on-chain.** The allowance value is a ciphertext, readable only by the owner and the spender. -- **Standard semantics.** `approve` / `transferFrom`, the shape every integrator already knows. - -Blanket time-boxed operator models grant a spender full authority over a balance until expiry, and record that authority publicly. PoD grants a specific encrypted amount, and keeps the amount private. - ---- - -## Failure that reveals nothing - -When an encrypted transfer exceeds a balance, PoD resolves it inside the garbled circuit: the effective amount becomes zero and the request completes normally. **No revert, no error code, no observable difference** between a transfer that moved value and one that did not. - -Insufficient balances stay as private as sufficient ones. - ---- - -## A security model without a master key - -PoD's confidentiality rests on **garbled circuits with non-colluding parties** — a garbler and an evaluator that must both defect to compromise a session. - -The distinction that matters is what a worst case costs you. Threshold FHE systems protect a shared decryption key; if enough key-holders collude, **every transaction ever recorded becomes readable retroactively**. PoD has no such key. A compromise is scoped to a session, not to your history. - -**Privacy that does not accumulate a single point of catastrophic failure.** - ---- - -## Live on two public testnets - -Six confidential tokens, deployed and operating. - -**Avalanche Fuji** - - -| Token | Address | Decimals | -| :------- | :------------------------------------------- | :------: | -| `p.MTT` | `0x02f284a1968160E1d3e4bC2BA3261be49725E765` | 18 | -| `p.USDC` | `0x21576D8CCE47d044C5815bd59eca1F6DA94c65A5` | 6 | -| `p.AVAX` | `0x74d47cD68203066c97BA99787Fe1e0c68Ce42b04` | 18 | - -**Ethereum Sepolia** - - -| Token | Address | Decimals | -| :------- | :------------------------------------------- | :------: | -| `p.MTT` | `0x0510F0b32828D5fB472dE5A5bE30b370c5D1a056` | 18 | -| `p.USDC` | `0xD7B3D49F85000489708B7db5B0f1a8693Fc707f3` | 6 | -| `p.ETH` | `0xd33A363459c6Ee0C4F8504E380E8D3Aa4F209116` | 18 | - -Each pair is deployed by `PrivacyPortalFactory` as a minimal-proxy clone — **one portal and one pToken per asset**, so listing a new confidential token is a factory call, not an engineering project. - ---- - -## Explorer-native from day one - -PoD pTokens emit `ConfidentialTransfer` events and expose ERC-7984 metadata, so Blockscout and compatible explorers classify them as confidential tokens and index their activity automatically. Your users see a first-class token page, not an unrecognised contract. - ---- - -## Concurrency that keeps up with users - -Multiple transfers, mints, and burns from the same account can be in flight simultaneously. Each is tracked independently by request id, and a monotonic nonce guarantees results always apply in the correct order. **No queue, no serialisation, no waiting for one transfer to clear before starting the next.** - ---- - -## Why teams choose PoD pERC20 - - -| | | -| :--------------------------- | :------------------------------------------------------------------------ | -| **Wrap real assets** | 18-decimal confidential WETH and WAVAX — out of reach for 64-bit designs | -| **Keep your chain** | Runs on any EVM chain; no privacy L1, no migration | -| **Full precision** | 256-bit values, no supply ceiling | -| **Small on-chain footprint** | ~192-byte inputs, 2-slot balances | -| **Instant for users** | No client-side proof generation | -| **Private allowances** | Exact encrypted amounts, not public blanket authority | -| **No master key** | Session-scoped security, no retroactive exposure | -| **Ship fast** | Factory-deployed portal + token pair per asset | - ---- diff --git a/coti-privacy-portal/developer-guide/privateerc20.sol.md b/coti-privacy-portal/developer-guide/privateerc20.sol.md index 213390b..731aa42 100644 --- a/coti-privacy-portal/developer-guide/privateerc20.sol.md +++ b/coti-privacy-portal/developer-guide/privateerc20.sol.md @@ -39,7 +39,7 @@ PrivateERC20 follows the ERC20 interface, but changes how data is stored and exp | Supports plain uint256 operations | Yes | Yes | | Supports encrypted operations | No | Yes (`itUint256`, `gtUint256` variants) | -For a comparison against the [ERC-7984](https://eips.ethereum.org/EIPS/eip-7984) confidential-token standard — and how COTI's Privacy on Demand `pERC20` compares with FHE-based implementations on encrypted-input size, numeric range, and allowance semantics — see [PoD pERC20 vs ERC-7984](privateERC20-ERC7984.md). +For a comparison against the [ERC-7984](https://eips.ethereum.org/EIPS/eip-7984) confidential-token standard — and how COTI's Privacy on Demand `pERC20` compares with FHE-based implementations on encrypted-input size, numeric range, and allowance semantics — see [COTI ERC-7984](../../coti-erc7984/README.md). ### How it works From ed3c0ad0df6a544839b4cacc75e35b062307a7e6 Mon Sep 17 00:00:00 2001 From: Percival Lucena Date: Sun, 23 Aug 2026 16:39:13 -0300 Subject: [PATCH 3/3] docs: drop the master-key security model page from COTI ERC-7984 Removes coti-erc7984/security-model.md along with its SUMMARY entry, the README nav item, and the "No master key" row from the summary table. Co-Authored-By: Claude Opus 5 --- SUMMARY.md | 1 - coti-erc7984/README.md | 2 -- coti-erc7984/deployed-contracts.md | 6 ++---- coti-erc7984/security-model.md | 11 ----------- 4 files changed, 2 insertions(+), 18 deletions(-) delete mode 100644 coti-erc7984/security-model.md diff --git a/SUMMARY.md b/SUMMARY.md index c8af35e..815dd5a 100644 --- a/SUMMARY.md +++ b/SUMMARY.md @@ -157,7 +157,6 @@ * [Host-chain deployment](coti-erc7984/host-chain-deployment.md) * [Transaction economics](coti-erc7984/transaction-economics.md) * [Transfer semantics](coti-erc7984/transfer-semantics.md) - * [Security model](coti-erc7984/security-model.md) * [Concurrency](coti-erc7984/concurrency.md) * [Deployed contracts](coti-erc7984/deployed-contracts.md) diff --git a/coti-erc7984/README.md b/coti-erc7984/README.md index e6c364f..2b70627 100644 --- a/coti-erc7984/README.md +++ b/coti-erc7984/README.md @@ -14,7 +14,6 @@ This section compares that implementation against FHE-based implementations of t * [**Host-chain deployment**](host-chain-deployment.md) — what the token requires of the chain it runs on, and what it requires of the user. * [**Transaction economics**](transaction-economics.md) — encrypted-input size, on-chain footprint, and where the cryptographic work happens. * [**Transfer semantics**](transfer-semantics.md) — encrypted allowances with standard `approve` / `transferFrom`, and failures that reveal nothing. -* [**Security model**](security-model.md) — garbled circuits with non-colluding parties, and why there is no master key to compromise. * [**Concurrency**](concurrency.md) — multiple in-flight requests per account, ordered by a monotonic nonce. * [**Deployed contracts**](deployed-contracts.md) — the six pTokens live on Avalanche Fuji and Ethereum Sepolia, and how new ones are listed. @@ -28,5 +27,4 @@ This section compares that implementation against FHE-based implementations of t | **Small on-chain footprint** | ~192-byte inputs, 2-slot balances | | **Instant for users** | No client-side proof generation | | **Private allowances** | Exact encrypted amounts, not public blanket authority | -| **No master key** | Session-scoped security, no retroactive exposure | | **Ship fast** | Factory-deployed portal + token pair per asset | diff --git a/coti-erc7984/deployed-contracts.md b/coti-erc7984/deployed-contracts.md index 7231a09..3a507ce 100644 --- a/coti-erc7984/deployed-contracts.md +++ b/coti-erc7984/deployed-contracts.md @@ -6,6 +6,7 @@ Six confidential tokens, deployed and operating. **Avalanche Fuji** + | Token | Address | Decimals | | :------- | :------------------------------------------- | :------: | | `p.MTT` | `0x02f284a1968160E1d3e4bC2BA3261be49725E765` | 18 | @@ -14,6 +15,7 @@ Six confidential tokens, deployed and operating. **Ethereum Sepolia** + | Token | Address | Decimals | | :------- | :------------------------------------------- | :------: | | `p.MTT` | `0x0510F0b32828D5fB472dE5A5bE30b370c5D1a056` | 18 | @@ -21,7 +23,3 @@ Six confidential tokens, deployed and operating. | `p.ETH` | `0xd33A363459c6Ee0C4F8504E380E8D3Aa4F209116` | 18 | Each pair is deployed by `PrivacyPortalFactory` as a minimal-proxy clone — **one portal and one pToken per asset**, so listing a new confidential token is a factory call, not an engineering project. - -## Explorer-native from day one - -PoD pTokens emit `ConfidentialTransfer` events and expose ERC-7984 metadata, so Blockscout and compatible explorers classify them as confidential tokens and index their activity automatically. Your users see a first-class token page, not an unrecognised contract. diff --git a/coti-erc7984/security-model.md b/coti-erc7984/security-model.md deleted file mode 100644 index dea0620..0000000 --- a/coti-erc7984/security-model.md +++ /dev/null @@ -1,11 +0,0 @@ -# Security model - -## A security model without a master key - -PoD's confidentiality rests on **garbled circuits with non-colluding parties** — a garbler and an evaluator that must both defect to compromise a session. - -The distinction that matters is what a worst case costs you. Threshold FHE systems protect a shared decryption key; if enough key-holders collude, **every transaction ever recorded becomes readable retroactively**. PoD has no such key. A compromise is scoped to a session, not to your history. - -**Privacy that does not accumulate a single point of catastrophic failure.** - -For the underlying primitive, see [Garbled Circuits](../how-coti-works/advanced-topics/garbled-circuits.md).