Paper 2024/2001

Xiezhi: Toward Succinct Proofs of Solvency

Abstract

A proof of solvency (or proof of reserves) is a zero-knowledge proof produced by a centralized cryptocurrency exchange to demonstrate that it holds enough cryptocurrency to cover all customer balances, while revealing nothing beyond solvency itself. A key challenge in building practical end-to-end proofs of solvency is the cryptographic mismatch between asset keys and modern succinct non-interactive arguments of knowledge (SNARKs): many deployed account-based cryptocurrency systems use secp256k1, whereas efficient SNARKs are built over pairing-friendly curves such as bls12-381. Bridging these two settings is therefore necessary for any private end-to-end construction. We introduce Xiezhi, an end-to-end proof of solvency protocol that avoids directly translating keys across curves (which is expensive) and instead transfers asset-ownership claims into the SNARK-friendly setting with much lower proving overhead. A Rust prototype over bls12-381 shows that the reusable key-ownership phase remains practical for real-world exchanges, while the recurring asset proof has constant-size proofs and constant-time verification. For liabilities, the column-wise range proof scales linearly in proving time but keeps proof size and auditor verification independent of the number of users for fixed precision; with 32-bit balances, proofs are below 10 KB and verify in under 8 ms. These results indicate that Xiezhi offers practical end-to-end private proofs of solvency with substantially lower proving overhead than prior circuit-based end-to-end approaches.