Celar is an EVM-equivalent Layer 1 blockchain where balances, amounts, and contract state are encrypted with protocol-level threshold fully homomorphic encryption (FHE). It adds stealth addresses for recipient privacy and a zero-knowledge shielded pool for trustless privacy, while total supply remains publicly auditable.

How is Celar different from other privacy blockchains?

Privacy is built into the protocol's data plane rather than added as an application. Smart contracts compute directly on encrypted values via TFHE precompiles with standard Solidity tooling, transfers are branchless so success and failure are indistinguishable to observers, and the decryption key exists only as shares across the committee, so no single seat holds it. The configuration is 50 seats with a threshold of 12 — run and verified end-to-end in a test ceremony, not yet securing value: up to 12 seats learn nothing, and 13 colluding seats could reconstruct the key. Whitepaper §7.1 states the configuration and its limits.

Is Celar compatible with Ethereum tooling?

Yes. Celar is fully EVM-equivalent with zero new opcodes — standard EVM semantics, the Solidity toolchain, the Ethereum address model, and JSON-RPC all work unmodified. Confidential features enter only through precompiles, including encrypted types like euint64 and ConfidentialERC20 tokens.

CELAR — The Confidential Layer 1 | Encrypted Smart Contracts with Threshold FHE

128-BIT SECURITY TARGET λ

NO SINGLE KEY HOLDER

50 SEATS THRESHOLD 12

192 B SHIELDED-POOL PROOFS

≤ 3 S LAPTOP PROVING TARGET

F < N/3 BFT INSTANT FINALITY

ZERO NEW OPCODES

PQ CONFIDENTIALITY · CLASSICAL AUTH

128-BIT SECURITY TARGET λ

NO SINGLE KEY HOLDER

50 SEATS THRESHOLD 12

192 B SHIELDED-POOL PROOFS

≤ 3 S LAPTOP PROVING TARGET

F < N/3 BFT INSTANT FINALITY

ZERO NEW OPCODES

PQ CONFIDENTIALITY · CLASSICAL AUTH

01/ PRIVACY STACK

Three tiers of confidentiality. One chain.

Privacy on Celar is not an add-on contract — it is the protocol's data plane. Every tier is specified against explicit adversary classes, with a published leakage matrix instead of adjectives.

TIER_01 / FHE STATE

Encrypted smart-contract state

Amounts, balances, and contract values are TFHE ciphertexts evaluated on-chain via programmable bootstrapping. ConfidentialERC20 out of the box.

Branchless transfers — failure indistinguishable from success
On-chain ACLs: no decryption without owner or contract grant
Supply remains publicly auditable at all times

TIER_02 / STEALTH LAYER

Unlinkable recipients & relayers

Dual-key stealth addresses (ERC-5564 pattern) give every payment a fresh one-time address; bonded relayers obfuscate senders.

DDH-based unlinkability across payments
One-byte view tags for fast wallet scanning
Rogue-key registration griefing closed with dual Schnorr PoKs

TIER_03 / ZK SHIELDED POOL

Trustless against unbounded collusion

A Groth16 shielded pool over BLS12-381: sender, recipient, and amount privacy that survives even a fully colluding validator set.

192-byte proofs, ~3-pairing verification
Fixed 2-in/2-out circuit; dummy inputs indistinguishable
Committee-independent and recovery-free by construction

02/ BUILD

Fully EVM-equivalent. Zero new opcodes.

Standard EVM semantics, Solidity toolchain, address model, and JSON-RPC. Confidential features enter only through precompiles — existing contracts, wallets, and tooling work unmodified.

/01Encrypted types in Solidityeuint8…euint64 and ebool via a TFHE.sol standard library; handles in storage, ciphertexts in the FHE data plane.
/02Branchless rule, tool-enforcedNo revert may depend on encrypted data — enforced at compile time and re-checked by bytecode analysis at deployment. Violating contracts are rejected.
/03Backend-agnostic precompile ABISwapping the FHE backend is a node-level change, invisible to deployed contracts.
/04No gas fingerprintingFHE operations meter a separate fee dimension in flat per-class tiers — realized gas never leaks encrypted control flow.

CONFIDENTIALVAULT.SOL● COMPILES → PRECOMPILES

import {TFHE, euint64, ebool} from "celar/TFHE.sol";

contract ConfidentialVault {
  mapping(address => euint64) private bal;

  function transfer(address to, euint64 amt) external {
    ebool ok = TFHE.and(
      TFHE.le(amt, bal[msg.sender]),   // funds check
      TFHE.le(amt, TFHE.sub(MAX, bal[to])) // overflow guard
    );
    euint64 m = TFHE.select(ok, amt, ZERO);
    bal[msg.sender] = TFHE.sub(bal[msg.sender], m);
    bal[to]         = TFHE.add(bal[to], m);
    // no revert, no branch, no leakage —
    // outcome visible only to the owner via re-encryption
  }
}

03/ BRANCHLESS

A transfer that never tells.

Every confidential transfer is consensus-valid whether or not it succeeds. Uniform gas tier, no revert, no event difference — an external observer learns nothing from the outcome.

STEP_01

ok₁ = ⟦a⟧ ≤ ⟦balₛ⟧

Encrypted comparison: does the sender have the funds? The answer stays encrypted.

STEP_02

ok₂ = overflow guard

A second encrypted check protects the recipient balance; ok = ok₁ ∧ ok₂.

STEP_03

m = select(ok, ⟦a⟧, ⟦0⟧)

The moved amount is the value — or an encrypted zero. No branch ever executes.

STEP_04

balₛ −= m; balᵣ += m

Balances update identically in both worlds. Only the sender learns the outcome, via self re-encryption.

Fair ordering, no MEV market. Block ordering is deterministic from threshold-derived, tx-set-bound VRF randomness — no continuous priority auction, content-blind inclusion, and (v2) a threshold-encrypted mempool where ordering-by-content becomes impossible rather than forbidden.

04/ THRESHOLD KMS

No single party ever holds the key.

The TFHE secret key exists only as shares across the committee; no single seat holds it. Decryption and re-encryption require a threshold quorum of seats to cooperate. The committee configuration is 50 seats, threshold 12 — run and verified end-to-end in a test ceremony, and not yet securing value. Up to 12 seats learn nothing; 13 colluding seats could reconstruct the key, and we publish that rather than hide it. Larger committees are not reachable on this engine, and no work is scoped to reach them. Whitepaper §7.1 states the configuration and its limits.

◆ Genesis

Publicly verifiable DKG

A robust distributed key generation with published transcripts and on-chain complaint resolution produces linear shares — plus the CRS for input proofs. Misbehaving parties are excluded before genesis.

KEY VECTOR NEVER RECONSTRUCTED — ANYWHERE, EVER

◆ Decryption

Noise-flooded threshold decryption

Authorized reveals combine t partial decryptions, each flooded with calibrated noise so repeated decryptions stay safe under adversarially influenced ciphertexts (IND-CPA-D), with per-epoch query budgets.

σ_flood ≥ 2^λstat · B_eval · BUDGET Q_max

◆ Epochs

Proactive refresh

Proactive refresh is implemented and validated: the committee re-randomizes every share without changing the key. Once attested erasure of superseded shares is built, refresh will also limit how long an attacker has to assemble a quorum. Seat rotation on staggered terms is designed but deferred.

CAPTURE BOUND · SEE HEALTH DASHBOARD

◆ Accountability

Attributable slashing & recovery

Every partial decryption is a signed, self-contained fraud proof — unauthorized service is severely slashed. Disaster recovery is a sealed resharing-only quorum behind an on-chain, timelocked activation predicate: public by construction, never covert.

NO COVERT DECRYPTION PATH — G6

05/ LEAKAGE

What each tier actually hides.

Most privacy chains market adjectives. Celar publishes a consolidated leakage matrix against named adversary classes — including its declared v1 non-goals.

Data item	Public tier	FHE tier (v1)	ZK pool (v2)
Amount	Visible	Hidden*	Hidden
Balances / state	Visible	Hidden*	N/A — notes
Sender identity	Visible	Relayer-obfuscated	Hidden
Recipient identity	Visible	One-time stealth addr	Hidden
Transfer success / failure	Visible	Hidden — branchless	Contents hidden
Contract call target	Visible	Visible — v1.x roadmap	N/A — pool precompile

* Hidden unless the FHE-tier trust assumption fails (a coalition at or above the decryption quorum). ZK-pool entries hold against unbounded collusion. Full matrix with adversary classes 𝒜₁–𝒜₅ is shared with reviewers in the data room.

06/ POST-QUANTUM

Encrypted today. Still encrypted after quantum.

Post-quantum confidentiality, classical anonymity and authentication. Celar's confidentiality rests on lattice hardness, not elliptic curves. Amounts, balances, and contract state recorded today stay confidential even against an adversary who stores them until a cryptographically-relevant quantum computer exists. Its anonymity and authentication layers are classical — and we say so.

Layer	Primitive	Post-quantum
Amounts, balances, contract state	TFHE / CGGI (LWE / RLWE)	Secure — already lattice
Threshold decryption & re-encryption	LWE-based threshold	Secure
Input proofs	(R)LWE ZKPoK	Secure
Hashing	Poseidon2, Keccak-256	Secure — 2× margin
Identity & signatures	secp256k1 ECDSA	Shor → ML-DSA
Stealth addressing	secp256k1 ECDH	Shor → lattice KEM
Re-encryption target	X25519	Shor → PQ KEM
Shielded-pool proofs	Groth16 / BLS12-381	Shor → STARK / lattice SNARK

Harvest now, decrypt later. Under an adversary recording chain data today to break it later, the tiers diverge sharply. FHE-tier amounts and state stay hidden — a future quantum computer does not open them. But shielded-pool anonymity does not survive: once BLS12-381 discrete log falls, recorded pool transactions can be retroactively de-anonymised. Amounts stay hidden; the transaction graph does not. This asymmetry is our sharpest quantum exposure, and we publish it rather than imply it.

Migration of the identity, signature, and ZK layers is a planned hard-fork track, gated on NIST PQC maturity — not a launch deliverable. Crypto-agility is built where it matters: the versioned proof envelope admits a PQ proof system without a curve reversal, and the handle-based precompile ABI is scheme-agnostic. Full per-layer analysis →

07/ TOKEN

Security priced in closed form.

Issuance, staking, and the privacy guarantee are bound together by a published health rule: the cost of corrupting a decryption quorum must stay at least 2× the value shielded on-chain — recomputed continuously, constitutionally enforced.

Genesis supply

10⁹ tokens, 9 decimals. Supply publicly auditable per block (G5).

~11.7%

Year-1 nominal APR

≈ 4.7% real + fee income at the σ* = 0.60 staking target; real yield is the headline figure.

1.5%

Issuance floor

i(y) = max(1.5%, 7% · 0.8ʸ). Governance may lower the floor, never raise it.

ℋ ≥ 2

Health rule

Corruption cost ≥ 2× shielded value at risk — the security–economic binding constraint.

Genesis allocation

TGE FLOAT ≈ 9% · INSIDER ALLOCATIONS VEST IN TRANSPARENT BALANCES · BURNSHARE ≥ 0.5 · 21-DAY UNBONDING

Community / ecosystem — 37%

Investors — 20% · 1y cliff + 24mo

Team — 18% · 1y cliff + 36mo

Foundation — 15%

Liquidity / public — 6%

Genesis validators — 4%

Community / ecosystem 37%

Investors 20%1-year cliff + 24-month vest

Team 18%1-year cliff + 36-month vest

Foundation 15%

Liquidity / public 6%

Genesis validator program 4%

08/ GUARANTEES

Six guarantees. Stated, not implied.

Ledger integrity

BFT safety under f < n/3 with instant finality; the supply invariant is machine-checked every block.

FHE-tier confidentiality

Amounts, balances, and contract state stay hidden against any coalition below the decryption quorum.

Recipient unlinkability

Stealth addresses and relayer indirection reduce the observer's view to relayer, one-time address, tier, and time.

Pool privacy vs. unbounded collusion

Shielded-pool anonymity holds even if every validator colludes — cryptography, not committee trust.

Supply auditability

Total supply is publicly verifiable at all times: encrypted state can never mint or hide inflation.

No covert decryption path

Every decryption requires owner or contract authorization; partials are designed to be signed and attributable so violations can be proven and slashed, and the only recovery path is public-by-construction.