What Is Bulletproofs?

Bulletproofs were introduced in a 2017 paper published by researchers from Stanford University, University College London and Blockstream. In confidential transactions, amounts are hidden with Pedersen commitments, but the network must still be able to verify that the hidden amounts are non-negative and that no coins are created out of thin air. Bulletproofs prove, without revealing the amount, that the value lies within a range such as 0 to 2 to the power of 64.

Earlier range proofs increased transaction size significantly. In Bulletproofs, the proof size grows logarithmically, not linearly, with the number of bits being proven, and multiple proofs can be aggregated. The best-known use case is Monero: after adopting Bulletproofs in 2018, Monero saw transaction sizes and fees fall markedly, and the network later moved to the improved Bulletproofs+ version. Mimblewimble-based projects such as Grin also use these proofs.

Unlike zk-SNARKs, Bulletproofs do not require a trusted setup, which removes the risk of secret setup parameters being abused. On the other hand, verification time grows linearly with the size of the statement being proven and is slower than with zk-SNARKs. For this reason, Bulletproofs are generally preferred for relatively simple statements such as range proofs.