Paper 2022/083

Zef: Low-latency, Scalable, Private Payments

Mathieu Baudet, Alberto Sonnino, Mahimna Kelkar, and George Danezis


We introduce Zef, the first Byzantine-Fault Tolerant (BFT) protocol to support payments in anonymous digital coins at arbitrary scale. Zef follows the communication and security model of FastPay: both protocols are asynchronous, low-latency, linearly-scalable, and powered by partially-trusted sharded authorities. In contrast with FastPay, user accounts in Zef are uniquely-identified and safely removable. Zef coins are bound to an account by a digital certificate and otherwise stored off-chain by their owners. To create and redeem coins, users interact with the protocol via privacy-preserving operations: Zef uses randomized commitments and NIZK proofs to hide coin values; and, created coins are made unlinkable using the blind and randomizable threshold anonymous credentials of Coconut. Besides the detailed specifications and our analysis of the protocol, we are making available an open-source implementation of Zef in Rust. Our extensive benchmarks on AWS confirm textbook linear scalability and demonstrate a confirmation time under one second at nominal capacity. Compared to existing anonymous payment systems based on a blockchain, this represents a latency speedup of three orders of magnitude, with no theoretical limit on throughput.

Available format(s)
Cryptographic protocols
Publication info
Preprint. MINOR revision.
Contact author(s)
mathieu baudet @ zefchain com
asonnino @ fb com
mahimna @ cs cornell edu
g danezis @ ucl ac uk
2022-03-10: revised
2022-01-23: received
See all versions
Short URL
Creative Commons Attribution


      author = {Mathieu Baudet and Alberto Sonnino and Mahimna Kelkar and George Danezis},
      title = {Zef: Low-latency, Scalable, Private Payments},
      howpublished = {Cryptology ePrint Archive, Paper 2022/083},
      year = {2022},
      note = {\url{}},
      url = {}
Note: In order to protect the privacy of readers, does not use cookies or embedded third party content.