Issuers, auditors and clawback

Confidential Transfers hide numbers from the public. They do not hide them from the token's issuer. Before holding a confidential token, know what its issuer can do.

Switch it on. The issuer decides whether a token supports confidential balances. Once on, it stays on. No later transaction can switch it off.

Read balances. Every confidential balance is also locked under the issuer's key. The issuer can open that copy and read it. It cannot spend from it.

Name an auditor. The issuer can register one auditor key. Every balance is then locked under that key too. The auditor, such as a regulator, can check balances directly without asking the issuer.

There is a simpler route as well: the issuer can share its own key with an auditor. That auditor then sees everything the issuer sees and has to trust what the issuer hands over.

Freeze and claw back. The issuer keeps the same controls it has over public balances. A confidential clawback is blunt, though. It takes the holder's whole confidential balance, not a chosen amount.

Issue through a second account. The issuer's own account cannot hold a confidential balance. To put confidential tokens into circulation, the issuer sends tokens to a second account it controls. That account converts them and pays them out.

Check a token's settings before you hold it. A confidential token with clawback on can still be taken back.

Enabling. The flag is Can Hold Confidential Balance, lsfMPTCanHoldConfidentialBalance (0x00000080) on MPTokenIssuance.

• It can be set at creation with MPTokenIssuanceCreate.
• It can be set later with MPTokenIssuanceSet and tfMPTSetCanHoldConfidentialBalance. That route also needs the DynamicMPT amendment.
• The issuance's transfer fee must be 0.
• If the issuer marks the flag immutable without enabling it, the token can never support confidential transfers.

Keys. IssuerEncryptionKey and the optional AuditorEncryptionKey are 33-byte compressed ElGamal public keys. They can only be registered with MPTokenIssuanceSet. An auditor key must arrive in the same transaction as the issuer key. No key can be registered after any confidential balance is in circulation. Issuer and auditor keys cannot be changed or cleared.

Auditing models.

Second account. The issuer funds a separate holder account with a public balance. That account runs ConfidentialMPTConvert. The ledger treats it as a regular holder, so its balance counts toward OutstandingAmount.

Clawback. ConfidentialMPTClawback has Holder, MPTAmount and a 64-byte ZKProof. The issuer decrypts its mirror copy off the ledger and submits the plaintext total. The proof shows IssuerEncryptedBalance decrypts to that amount.

• It needs both the Can Clawback and Can Hold Confidential Balance flags.
• On success each encrypted copy resets to the canonical encrypted zero. The tokens leave circulation.
• The proof goes stale if the holder's balance changes first. xrpl.org recommends locking the holder with tfMPTLock, then clawing back.

Related: Freeze, Deep Freeze and Clawback, Multi-Purpose Tokens.