Helius announced the launch of its permissionless Privacy Ring on the Solana mainnet on November 10. The feature encrypts the asset type and transaction amount, while the sender and recipient wallet addresses remain visible on the blockchain.
How the system works
The default prover for the Privacy Ring creates zero‑knowledge proofs inside an attested AWS Nitro enclave, an isolated computing environment. Transaction data, including asset, amount, blinding values and nullifier secrets, are supplied to the prover in plaintext. The enclave encrypts these inputs before sending them to the remote service, protecting them from the host operator.
Wallet integration details
Helius’s integration guide states that wallets must provide the full transaction data and nullifier keys to the prover. The TypeScript SDK leaves the final signing of the Solana transaction to the application’s signer, and the signing key remains with the wallet.
Two decryption options are documented: local decryption, which keeps the viewing key on the device, and delegated decryption, which shares a viewing key with an authorized provider. Delegated decryption allows the provider to read balances and transaction history but does not grant spending authority.
Trust and verification
AWS describes Nitro Enclaves as environments whose memory cannot be accessed by the parent instance’s processes or administrators. The enclave’s software image and cryptographic fingerprints are verified through an attestation process that checks the certificate chain, challenge response, and approved measurements.
Helius’s SDK verifies the enclave’s attestation against an approved policy before encrypting proof requests. Wallet developers can pin a specific release policy or use a network policy authenticated by the SDK’s signed signers. Policies are refreshed during attestation and expire after use.
Audits and security reviews
Helius reports that the programs and circuits used in the Privacy Ring have been audited by Certora, zkSecurity and OtterSec, with reports from Certora and zkSecurity already published and OtterSec’s report pending.
The launch provides wallet developers with the information needed to decide which code and deployment policies they trust to handle proof inputs, while noting that metadata such as request size and timing remains visible to the enclave’s host.
