Private Shared State (FHE)

Components

• Fully Homomorphic Encryption scheme (for example TFHE or BFV) supporting the target state-transition circuit on encrypted data.
• Shared public key generated via distributed key generation by a threshold decryption committee; the matching secret is never assembled in one place.
• Fully Homomorphic Encryption coprocessor evaluates state transitions on ciphertexts and emits updated encrypted state plus a correctness proof.
• Threshold decryption committee jointly decrypts scoped read requests for participants or auditors.
• On-chain state store holds encrypted balances and commitments; a verifier contract anchors the correctness proof.
• Regulatory disclosure path issues threshold-controlled decryption keys scoped to a specific position or time window.

Protocol

1. user The threshold committee runs a distributed key generation and publishes the shared Fully Homomorphic Encryption public key.
2. user Each party deposits assets; balances are encrypted under the shared key and posted as on-chain ciphertexts.
3. user A party submits an encrypted state-transition request (transfer, trade, margin call).
4. prover The coprocessor evaluates the transition homomorphically on ciphertexts and produces the updated encrypted state plus a correctness proof.
5. contract The verifier contract checks the proof and commits the new encrypted state root.
6. auditor Regulators or participants request scoped reads; the committee performs threshold decryption bound to the approved scope.

Guarantees & threat model

Guarantees:

• No plaintext is exposed during computation, including to the coprocessor operator, under the threshold-committee assumption.
• State correctness is enforced by the coprocessor's correctness proof verified on-chain.
• Settlement finality anchored to Ethereum L1 or an L2.
• Scoped auditability via threshold-controlled decryption for specific positions or windows.

Threat model:

• Hardness of the underlying lattice assumption and correct parameter choice.
• Honest-threshold behaviour of the decryption committee. A breach above the threshold leaks all encrypted state bulk-decryption capability.
• Coprocessor correctness. A malicious coprocessor without a correctness proof could post invalid state; the proof-verifier contract mitigates this.
• Metadata about callers, contract addresses, and timing remains visible on-chain.
• Sender and receiver addresses are not hidden by default; address unlinkability requires composition with stealth addresses.

Trade-offs

• Fully Homomorphic Encryption computation overhead is high per operation; batching and coprocessor-level optimisations are required to reach useful throughput.
• The threshold committee must be online for any read; offline committee degrades to unavailability, not privacy loss.
• Ciphertext size and on-chain storage cost are larger than plaintext or commitment-only state.
• Tooling and developer experience are less mature than Solidity with plaintext state; constrained language subsets and specific coprocessor APIs apply.

Example

• Three banks share a tokenised-bond collateral pool on an Ethereum L2 with Fully Homomorphic Encryption support. Each bank's deposit is encrypted under the shared key; on-chain state is fully ciphertext. A margin call triggers the coprocessor to evaluate aggregate collateral coverage homomorphically and emit the updated encrypted state. The regulator uses a threshold-controlled decryption key to audit one bank's position without learning the others.

See also

• Zama
• Fhenix
• Zama fhEVM documentation