Bulletproofs

Bulletproofs are short, non-interactive zero-knowledge proofs that need no trusted setup. They became famous for shrinking the range proofs in confidential transactions, but the underlying technique can prove any arithmetic-circuit statement. Their headline property is logarithmic proof size: where the old Borromean range proofs grew linearly and weighed kilobytes, a Bulletproof for the same 64-bit range is under 700 bytes, and proving many outputs at once adds only a little. They were introduced in 2017 by Bünz, Bootle, Boneh, Poelstra, Wuille and Maxwell — and the name comes from being short and requiring no setup, like a bullet.

The heart of a Bulletproof is the inner-product argument. To prove a statement like 'this committed value's bits are all 0/1 and sum to the value', the prover encodes it as a relationship between two vectors and then proves their inner product is correct. The clever part is a recursive halving: each round folds two length-m vectors into one length-m/2 vector, so after log2(m) rounds the proof collapses to a constant number of group elements. Non-interactivity comes from the Fiat-Shamir heuristic, which replaces the verifier's random challenges with hashes of the transcript. Security rests only on the discrete-logarithm assumption — no pairing-friendly curve and no ceremony required, which is a major practical advantage over Groth16-style SNARKs.

The trade-off is verification cost. A Bulletproof is small but its verifier does work linear in the circuit size — it must perform a large multi-exponentiation — so verification is slower than a constant-time SNARK verifier. This matters at chain scale: nodes verify every proof. The mitigation is batch verification, combining many proofs into one big multi-exponentiation that amortises the cost, which is why Monero verifies blocks of Bulletproofs together rather than one at a time.

Monero deployed Bulletproofs in October 2018, replacing Borromean range proofs and reducing typical transaction size by roughly 80% with corresponding fee savings; a refined variant, Bulletproofs+, later trimmed size and proving time further and was adopted in 2022. Beyond range proofs, Bulletproofs have been used for confidential smart contracts, verifiable shuffles and other general statements, though for very large circuits succinct SNARKs with constant verification often win.