OpenZeppelin has added confidential token contracts to its Stellar library, allowing wrapped SEP-41 assets to move within a system whose verifier does not guarantee witness privacy.
Version v0.8.0 places existing SEP-41 tokens in a contract-based layer. Users move tokens into that layer, transfer value within it and later redeem the underlying assets. The library includes six Noir circuits for proof-checked operations; deposits, merges and spender revocations do not require a proof circuit.
The ledger still identifies both parties to a transfer. Deposits and withdrawals expose amounts through transfers of the underlying token. The verifier accepts a non-zero-knowledge form of UltraHonk proof, which does not guarantee that witness values remain hidden. OpenZeppelin’s documentation says it has not established whether other parts of a proof might reveal those values.
Auditing is account-specific. Each account selects an auditor during registration. For accounts bound to that auditor’s key, the auditor can decrypt relevant transfer amounts. Certain events and checkpoints can also help reconstruct some balances, rather than providing universal access to every account’s balance.
Optional compliance features can freeze accounts. A deployment must opt into the ConfidentialClawback trait to seize tokens. If a clawback occurs, its amount is public; the tokens may move immediately or remain in the pool for later extraction, depending on the selected destination.
OpenZeppelin says its audited contracts and proof circuits are ready for Stellar mainnet. The company has framed the package for institutional and commercial use, saying privacy constraints have kept some activity off public ledgers. A selective-disclosure layer could let a holder share one chosen detail with a recipient while keeping other activity private, but that layer and a client SDK are not part of this release. OpenZeppelin says more SDK packages and integration guides will follow, without giving a schedule.
