Innova's Five-Layer Privacy Stack, Explained Layer by Layer
Pedersen amounts, Lelantus sender privacy, Stealth receivers, Dandelion++ network, and NullStake staking — Innova's five independent privacy primitives, layer by layer.
Why five layers?
A transaction on a public ledger leaks information on at least five distinct axes: the amount, the sender, the receiver, the network origin of the broadcast, and (on a Proof-of-Stake chain) the staker's position in consensus. A privacy protocol that hides only one of these is not private — it's obfuscated on one axis and legible on the others.
Innova treats each leak as a separate problem and stacks a purpose-built primitive against each. The result is five independent privacy layers, each defeating a specific class of de-anonymization attack.
Overview
| Layer | Protects | Core mechanism | Status |
|---|---|---|---|
| 1 | Amount | Pedersen commitments + Bulletproof range proofs | Live |
| 2 | Sender | Lelantus one-out-of-many proofs (+ FCMP++ scheduled) | Lelantus live; FCMP++ scheduled at block 7,320,000 |
| 3 | Receiver | Stealth addresses + Silent Payments + Silent Shielding | Live |
| 4 | Network origin | Dandelion++ relay protocol | Live |
| 5 | Staked amount | NullStake V1/V2 zero-knowledge kernel proofs | Scheduled at block 9,500,000 (V1) / 10,000,000 (V2) |
Layers are independent by design — a weakness in one does not compromise any other. The layers that are currently live compose via Dynamic Selective Privacy (DSP): 8 modes that let users choose which currently-available privacy layers are active per transaction, trading privacy for transaction size and fee cost.
Live today vs. scheduled
Live today on mainnet: Pedersen amount hiding, Lelantus sender privacy, Stealth / Silent Payments / Silent Shielding, Dandelion++ network privacy, and transparent staking. The user can transact with full amount/sender/receiver/network privacy today using z_send privacy mode 7.
Scheduled (soft-fork activation pending): FCMP++ sender-privacy upgrade at block 7,320,000; NullStake V1 private staking at block 9,500,000 (IIP-0009); NullStake V2 Poseidon2+BPAC at block 10,000,000 (IIP-0010). Until activation, Lelantus remains the sender-privacy mechanism and staking is transparent.
Layer 1 — Pedersen commitments + Bulletproofs
What's hidden: transaction amounts.
Pedersen commitments replace public amounts with C = v·H + r·G, where v is the amount, r is a blinding factor, and G, H are independent elliptic curve generators. The commitment hides v but is additively homomorphic, so the chain can verify sum(inputs) - sum(outputs) = fee algebraically — proving value conservation without learning any individual amount.
Bulletproofs solve the "negative amount" problem. A malicious spender could commit to a negative value and mint money from nothing. Bulletproof range proofs demonstrate the committed value lies within [0, 2⁶⁴), in ~672 bytes per proof, non-interactively. Multiple outputs can aggregate into one proof.
This construction matches Monero's RingCT base layer — it's the gold standard, and Innova adopts it directly.
Layer 2 — Lelantus, with FCMP++ as the evolution
What's hidden: the sender's input among many candidate inputs.
Lelantus one-out-of-many proofs. The spender proves "the spent coin is one member of a set of N unspent outputs" without revealing which one. Using a sigma protocol over commitment differences, the proof demonstrates knowledge of the opening of exactly one commitment that is a commitment to zero. N can be the entire shielded pool — the anonymity set grows as more users shield coins.
FCMP++ — the full-chain evolution. Lelantus's anonymity set is the shielded pool. FCMP++ (Full-Chain Membership Proofs with Curves) extends the set to every output ever created. The proof demonstrates membership in a Merkle-style tree with dual-curve construction alternating secp256k1 and Ed25519 at each level. Tree arity is 256, maximum depth 8 — supporting ~1.8 × 10¹⁹ outputs (effectively unlimited).
FCMP++ has a defined activation (block 7,320,000 in IDAG docs) and soft-fork migration framework. When active, it makes Layer 2's anonymity set whole-chain rather than whole-pool.
Layer 3 — Receiver privacy
What's hidden: the receiver's identity and address association.
Three mechanisms compose at this layer:
Stealth addresses. The recipient publishes a meta-address (S, B) with scan and spend keys. The sender generates ephemeral r, derives shared secret ss = r·S, and computes a one-time destination P = Hash(ss)·G + B. Each transaction produces a unique, unlinkable on-chain output. The receiver scans with their scan key and detects matches.
Silent Payments. An evolution of stealth addresses that eliminates the need for the ephemeral key R in the transaction. The sender derives the one-time output from the sum of input public keys plus the recipient's reusable silent-payment address. The address is published once and reused indefinitely without creating on-chain linkage between payments.
Silent Shielding. A single atomic operation that combines silent-payment address derivation with a direct transfer into the shielded pool. Eliminates the two-step pattern (generate address, then shield) that creates a brief visible window in other implementations.
Layer 4 — Dandelion++ network privacy
What's hidden: the IP origin of the transaction broadcast.
Cryptographic privacy is defeated if the adversary watching peer-to-peer gossip can identify the originating node. Dandelion++ defeats this with two-phase propagation:
- Stem phase: the transaction is forwarded to exactly one randomly selected peer, which forwards to one peer, with a biased coin flip at each hop deciding whether to continue the stem.
- Fluff phase: when the stem ends, the transaction is broadcast to all peers via standard flood-fill.
From an observer's perspective, the transaction appears to originate wherever fluff began — not where it was actually created. Innova rotates stem relay partners at randomized intervals to prevent long-term path analysis.
Dandelion++ is network-layer and composes orthogonally with every other layer. It should be used together with (not instead of) Tor for maximum network-level privacy.
Layer 5 — NullStake private staking (scheduled)
What will be hidden: stake amounts and staker identity in consensus.
On a public-stake chain, every validator's balance is visible. Adversaries enumerate validators by stake size to target whales for coercion, bribery, or regulatory action. Public balances also expose governance weight directly.
NullStake will replace public balances with zero-knowledge kernel proofs. The staker proves: the committed stake exceeds the minimum threshold, the UTXO is mature and unspent, the stake hash meets the difficulty target, and the nullifier is fresh — all without revealing amounts.
Two versions are specified:
- NullStake V1 — Sigma protocol, ~1.8 KB proofs, scheduled at block 9,500,000 (IIP-0009).
- NullStake V2 — Poseidon2 + Bulletproof Aggregate Commitment (BPAC), ~720 bytes proofs, scheduled at block 10,000,000 (IIP-0010). Verification is ~55% of V1.
Until activation, Innova uses transparent staking (genesis-available). The CLI commands (z_stake, z_getstakingstatus) exist in the current client but reject shielded-stake submissions until the activation block is reached.
Both include viewing-key auditability by design: post-activation, stakers will be able to delegate read access to regulators, auditors, or custodians without exposing other stakers. The chain sees ZK proofs; auditors see specific authorized records; everyone else sees nothing.
How the layers compose — Dynamic Selective Privacy
The five layers are independent, and users select which layers are active per transaction via Dynamic Selective Privacy (DSP). Eight modes cover the combinations:
| Mode | Bits (S·R·A) | Sender | Receiver | Amount | Use case |
|---|---|---|---|---|---|
| 0 | 0·0·0 | Off | Off | Off | Transparent (compliance reporting) |
| 1 | 1·0·0 | On | Off | Off | Sender-only privacy |
| 2 | 0·1·0 | Off | On | Off | Receiver-only privacy |
| 3 | 1·1·0 | On | On | Off | Sender + receiver hidden |
| 4 | 0·0·1 | Off | Off | On | Amount-only privacy |
| 5 | 1·0·1 | On | Off | On | Sender + amount hidden |
| 6 | 0·1·1 | Off | On | On | Receiver + amount hidden |
| 7 | 1·1·1 | On | On | On | Full privacy (default) |
Dandelion++ (Layer 4) is implicit in every mode — network-origin protection is always on. NullStake (Layer 5) is orthogonal to DSP; it applies to the staking path rather than the transaction path.
How this compares to established privacy stacks
| Chain | Amount | Sender | Receiver | Anonymity set | Trusted setup | Private staking |
|---|---|---|---|---|---|---|
| Monero (RingCT) | Yes | Yes (ring of 16) | Yes (stealth) | 16 | No | No |
| Zcash Sapling | Yes | Yes (shielded pool) | Yes (shielded pool) | Full pool | Yes (ceremony) | No |
| Innova (live) | Yes | Lelantus pool | Stealth + Silent | Shielded pool | None claimed | Transparent only (today) |
| Innova (post-activation) | Yes | Lelantus + FCMP++ | Stealth + Silent | Whole chain (with FCMP++) | None claimed | Yes (NullStake V1/V2) |
The distinctive properties of the post-activation target: whole-chain anonymity set path (via FCMP++), no ceremony trust dependency, and native privacy on the staking side — not just the transaction side.
What's next in the Innova silo
- FCMP++ Explained
- NullStake: Zero-Knowledge Private Staking
- Dynamic Selective Privacy: the 8 modes in practice (upcoming)
- IDAG consensus: GHOSTDAG, DAGKNIGHT Phase 4, PoS finality (upcoming)
Or browse the Innova product page for testnet and architecture.
More from Innova
FCMP++ Explained: Full-Chain Membership Proofs, Designed for Innova
FCMP++ (Full-Chain Membership Proofs with Curves) proves a spent output is one member of the entire UTXO set without revealing which — replacing classical ring signatures with whole-chain anonymity. Innova's construction uses dual-curve Merkle trees (secp256k1 + Ed25519), arity 256, max depth 8. Activation is scheduled at block 7,320,000; not yet live on mainnet.
NullStake: Zero-Knowledge Private Staking Designed for Innova
NullStake is Innova's designed zero-knowledge private staking protocol, with two generations scheduled for activation. V1 (Sigma protocol, ~1.8 KB proofs) activates at block 9,500,000 via IIP-0009. V2 (Poseidon2 + BPAC, ~720 bytes) activates at block 10,000,000 via IIP-0010. Until then, Innova uses transparent staking.