Abstract
<title>Abstract</title> <p>Account-model blockchains such as Ethereum bind a persistent identity to a mutable balance, so every transfer openly reveals both parties and the transferred amount. Confidentiality in this setting demands three mutually constraining properties at once: balance privacy, transaction-amount indistinguishability, and sender-receiver unlinkability. Prior designs satisfy only a subset: UTXO schemes hide transactionlevel relationships yet maintain no persistent balances, while account-model schemes either expose identities in the clear, require a trusted setup for their proofs, or offer only partial, non-unified security arguments. No existing work reconciles all three properties in a single model by reduction to a standard assumption. We propose HERMES (Halo2-Enhanced Rollup Maze ElGamal Shield), a unified game-based framework that establishes all three privacy guarantees by reduction to the Decisional Diffie-Hellman (DDH) assumption without trusted setup. Its contributions are fourfold: (i) a unified DDH framework that proves the three properties with explicit reduction tightness, a combination no prior work achieves; (ii) a formalization of commitment-coherent encryption (CCE) with a complete algebraic-leakage taxonomy, proving that independent per-ciphertext randomization is the unique path to full leakage closure under DDH; (iii) a triple-key separation architecture whose formal compromise-radius analysis bounds the impact of any single-key compromise to that key’s role; and (iv) concrete parameter selection on BN254 guided by explicit security bounds, where dual-generator exponential ElGamal achieves sub-millisecond (≈ 320 μs) performance, validating practical deployability. A reference implementation confirms that trustlessly verifiable private accounts are practical for account-model blockchains.</p>