Privacy Guarantees

Shielded Vote provides several layers of privacy protection.

What is hidden

• Your identity — The delegation step moves voting rights to an unlinkable hotkey. All subsequent voting transactions use this hotkey, with no on-chain link back to your spending key.

• Your total balance — Vote splitting decomposes your weight into multiple shares submitted at different times, preventing balance reconstruction via timing analysis.

• Individual vote amounts — Each share is an El Gamal ciphertext. The plaintext amount is never revealed. Only the aggregate per (proposal, decision) is decrypted at tally time.

• Which vote commitment a share came from — ZKP #3 proves the share is in the vote commitment tree without revealing which entry. Blinded share commitments prevent observers from recomputing shares_hash from on-chain ciphertexts and linking revealed shares back to a specific vote commitment.

• Your real nullifiers — Governance nullifiers are derived via a domain-separated Poseidon hash with nk, so they cannot be linked to your on-chain nullifiers.

What is revealed

• Aggregate vote totals per (proposal, decision) — this is the point of voting

• That you voted — a governance nullifier is published (but unlinkable to your identity)

• The number of share submissions — visible on-chain, but unlinkable to specific voters when mixed across the server

Trust assumptions

• Election authority — Holds ea_sk. Must honestly decrypt the aggregate and publish a correctness proof. Cannot decrypt individual shares without additional work (each share is individually encrypted, but in principle the EA could decrypt them). Privacy against the EA relies on vote splitting.

• Share submission servers — Learn the encrypted share and vote decision, but not the plaintext amount or the voter's identity. Their main trust requirement is not leaking timing metadata.

Post-quantum considerations

The governance hotkey address is never published, so a quantum adversary cannot learn the delegated amount. Vote splits remain unlinkable to a quantum adversary. However, a quantum adversary could break the El Gamal encryption to see individual share amounts. Delegation amounts would also be visible. Post-quantum delegation is out of current scope.