Is it possible to prove ETH balance without revealing the holding address?

Question

I want to prove that I own an amount of ETH without revealing the address which holds it. I don't know if this is possible at all, whether with zk-snarks technology or any other way. I've found nothing on this and I'm not knowledgeable enough to figure out by myself. Does anyone can shed some light on this? Thanks!

Answer 1

It should be possible with a ZKP.

without revealing the address

That's the "zero-knowledge" part.

The ZKP part will be challenging in itself but I foresee another problem.

prove that I own an amount

An account balance will tend to leak meta-data. A precise balance will narrow the field to addresses that have exactly the same balance which would often be exactly one. Oh oh ... it is probably merely a matter of searching for the account with the balance that matches the "secret". So, you will need to obfuscate that further. For example, "balance of at least x". This will further complicate the ZKP you would need to construct.

Not trivial. I might summarize the challenge by saying that Ethereum is optimized for transparency so this sort of thing is awkward.

Hope it helps.

Answer 2

Here is a rough outline of 2 different methods.

#1 Provisions

The following paper presents a protocol along with security proofs (see the proof of assets section): [CCS15] Provisions: Privacy-preserving proofs of solvency for Bitcoin exchanges

The protocol involves Pedersen commitments (common in the crypo[currency|graphy] space) and a custom zero-knowledge proof. The idea is that you (the prover) hide your account inside a set of other accounts and through a zero-knowledge proof the verifier can be convinced that you own an account in the set with a balance within some range.

Here is a rough outline of what the prover (you) does:

1. Construct a set of Ethereum accounts, within which must reside the account that you own and would like to prove has a certain balance
2. Produce Pedersen commitments to a) your account balance and b) to zero for each of the other accounts in the set; publish these commitments on chain
3. Produce Pedersen commitments to a) the private key underlying your account and b) to zero for each of the other accounts in the set; also publish these on chain
4. Calculate a handful of additional variables related to the zero-knowledge part of the protocol and publish these on chain (this part of the protocol ensures the Pedersen commitments were produced correctly)

Here is a rough outline of what the verifier does:

1. Checks that the balances for the accounts given by the prover match those on chain
2. Verifies in zero-knowledge that the Pedersen commitments were constructed correctly
3. Adds together all the Pedersen commitments related to the balances, which gives a Pedersen commitment to the prover's account balance
4. The final Pedersen commitment can be used to do a range proof (show the account balance is between 2 values) but the details if this are not in the paper

Note the paper uses Bitcoin as the example but since Ethereum uses the same elliptic curve the protocol is the same. Note also that the accounts' addresses are unfortunately not possible to use, one must use the public keys of the accounts which you can get from the tx signatures for those accounts.

#2 zk-SNARK

The idea here is similar to the one above except that it uses a zk-SNARK to do all the work.

What the prover does:

1. Construct a set of Ethereum accounts, within which must reside the account that you own and would like to prove has a certain balance
2. Run the zk-SNARK
3. Post the resulting proof string + public inputs for the snark on chain

The zk-SNARK:

• Public inputs: set of accounts (addresses, not public keys), set of ETH balances for the accounts, min balance for range proof, max balance for range proof
• Private inputs: prover's private key, index in the set where the prover's address is
• Computation:
  1. construct the public address for the private key (unfortunately this is not a good computation to do inside a snark because it uses the keccak hash)
  2. verify that the constructed address matches the one in the set at the given index
  3. verify that the balance for that address is between the min and max amounts

What the verifier does:

1. Checks that the balances for the accounts given by the prover match those on chain
2. Verifies the zk-SNARK proof