ConfidentialConvert with Equality Proof (#6177)

Update lsfMPTNoConfidentialTransfer to lsfMPTPrivacy
Add flag lsmfMPTPrivacy to control the mutability of lsfMPTPrivacy.
disallow mutating lsfMPTPrivacy when lsfMPTPrivacy is not set.
disallow mutating lsfMPTPrivacy when there's confidential outstanding amount.

include/xrpl/protocol/ConfidentialTransfer.h

@@ -0,0 +1,282 @@
+#ifndef XRPL_PROTOCOL_CONFIDENTIALTRANSFER_H_INCLUDED
+#define XRPL_PROTOCOL_CONFIDENTIALTRANSFER_H_INCLUDED
+
+#include <xrpl/basics/Slice.h>
+#include <xrpl/protocol/Indexes.h>
+#include <xrpl/protocol/MPTIssue.h>
+#include <xrpl/protocol/Protocol.h>
+#include <xrpl/protocol/Rate.h>
+#include <xrpl/protocol/STLedgerEntry.h>
+#include <xrpl/protocol/STObject.h>
+#include <xrpl/protocol/Serializer.h>
+#include <xrpl/protocol/TER.h>
+#include <xrpl/protocol/TxFormats.h>
+#include <xrpl/protocol/detail/secp256k1.h>
+
+#include <secp256k1.h>
+
+namespace ripple {
+
+void
+addCommonZKPFields(
+    Serializer& s,
+    std::uint16_t txType,
+    AccountID const& account,
+    std::uint32_t sequence,
+    uint192 const& issuanceID,
+    std::uint64_t amount);
+
+uint256
+getClawbackContextHash(
+    AccountID const& account,
+    std::uint32_t sequence,
+    uint192 const& issuanceID,
+    std::uint64_t amount,
+    AccountID const& holder);
+
+uint256
+getConvertContextHash(
+    AccountID const& account,
+    std::uint32_t sequence,
+    uint192 const& issuanceID,
+    std::uint64_t amount);
+
+/**
+ * @brief Generates a new secp256k1 key pair.
+ */
+SECP256K1_API int
+secp256k1_elgamal_generate_keypair(
+    secp256k1_context const* ctx,
+    unsigned char* privkey,
+    secp256k1_pubkey* pubkey);
+
+/**
+ * @brief Encrypts a 64-bit amount using ElGamal.
+ */
+SECP256K1_API int
+secp256k1_elgamal_encrypt(
+    secp256k1_context const* ctx,
+    secp256k1_pubkey* c1,
+    secp256k1_pubkey* c2,
+    secp256k1_pubkey const* pubkey_Q,
+    uint64_t amount,
+    unsigned char const* blinding_factor);
+
+/**
+ * @brief Decrypts an ElGamal ciphertext to recover the amount.
+ */
+SECP256K1_API int
+secp256k1_elgamal_decrypt(
+    secp256k1_context const* ctx,
+    uint64_t* amount,
+    secp256k1_pubkey const* c1,
+    secp256k1_pubkey const* c2,
+    unsigned char const* privkey);
+
+/**
+ * @brief Homomorphically adds two ElGamal ciphertexts.
+ */
+SECP256K1_API int
+secp256k1_elgamal_add(
+    secp256k1_context const* ctx,
+    secp256k1_pubkey* sum_c1,
+    secp256k1_pubkey* sum_c2,
+    secp256k1_pubkey const* a_c1,
+    secp256k1_pubkey const* a_c2,
+    secp256k1_pubkey const* b_c1,
+    secp256k1_pubkey const* b_c2);
+
+/**
+ * @brief Homomorphically subtracts two ElGamal ciphertexts.
+ */
+SECP256K1_API int
+secp256k1_elgamal_subtract(
+    secp256k1_context const* ctx,
+    secp256k1_pubkey* diff_c1,
+    secp256k1_pubkey* diff_c2,
+    secp256k1_pubkey const* a_c1,
+    secp256k1_pubkey const* a_c2,
+    secp256k1_pubkey const* b_c1,
+    secp256k1_pubkey const* b_c2);
+
+/**
+ * @brief Generates the canonical encrypted zero for a given MPT token instance.
+ *
+ * This ciphertext represents a zero balance for a specific account's holding
+ * of a token defined by its MPTokenIssuanceID.
+ *
+ * @param[in]   ctx             A pointer to a valid secp256k1 context.
+ * @param[out]  enc_zero_c1     The C1 component of the canonical ciphertext.
+ * @param[out]  enc_zero_c2     The C2 component of the canonical ciphertext.
+ * @param[in]   pubkey          The ElGamal public key of the account holder.
+ * @param[in]   account_id      A pointer to the 20-byte AccountID.
+ * @param[in]   mpt_issuance_id A pointer to the 24-byte MPTokenIssuanceID.
+ *
+ * @return 1 on success, 0 on failure.
+ */
+SECP256K1_API int
+generate_canonical_encrypted_zero(
+    secp256k1_context const* ctx,
+    secp256k1_pubkey* enc_zero_c1,
+    secp256k1_pubkey* enc_zero_c2,
+    secp256k1_pubkey const* pubkey,
+    unsigned char const* account_id,      // 20 bytes
+    unsigned char const* mpt_issuance_id  // 24 bytes
+);
+
+/**
+ * Generates a cryptographically secure 32-byte scalar (private key).
+ * @return 1 on success, 0 on failure.
+ */
+SECP256K1_API int
+generate_random_scalar(
+    secp256k1_context const* ctx,
+    unsigned char* scalar_bytes);
+
+/**
+ * Computes the point M = amount * G.
+ * IMPORTANT: This function MUST NOT be called with amount = 0.
+ */
+SECP256K1_API int
+compute_amount_point(
+    secp256k1_context const* ctx,
+    secp256k1_pubkey* mG,
+    uint64_t amount);
+
+/**
+ * Builds the challenge hash input for the NON-ZERO amount case.
+ * Output buffer must be 253 bytes.
+ */
+SECP256K1_API void
+build_challenge_hash_input_nonzero(
+    unsigned char* hash_input,
+    secp256k1_pubkey const* c1,
+    secp256k1_pubkey const* c2,
+    secp256k1_pubkey const* pk,
+    secp256k1_pubkey const* mG,
+    secp256k1_pubkey const* T1,
+    secp256k1_pubkey const* T2,
+    unsigned char const* tx_context_id);
+
+/**
+ * Builds the challenge hash input for the ZERO amount case.
+ * Output buffer must be 220 bytes.
+ */
+SECP256K1_API void
+build_challenge_hash_input_zero(
+    unsigned char* hash_input,
+    secp256k1_pubkey const* c1,
+    secp256k1_pubkey const* c2,
+    secp256k1_pubkey const* pk,
+    secp256k1_pubkey const* T1,
+    secp256k1_pubkey const* T2,
+    unsigned char const* tx_context_id);
+
+/**
+ * @brief Proves that a commitment (C1, C2) encrypts a specific plaintext
+ * 'amount'.
+ */
+SECP256K1_API int
+secp256k1_equality_plaintext_prove(
+    secp256k1_context const* ctx,
+    unsigned char* proof,
+    secp256k1_pubkey const* c1,
+    secp256k1_pubkey const* c2,
+    secp256k1_pubkey const* pk_recipient,
+    uint64_t amount,
+    unsigned char const* randomness_r,
+    unsigned char const* tx_context_id);
+
+/**
+ * @brief Verifies the proof generated by secp256k1_equality_plaintext_prove.
+ */
+SECP256K1_API int
+secp256k1_equality_plaintext_verify(
+    secp256k1_context const* ctx,
+    unsigned char const* proof,
+    secp256k1_pubkey const* c1,
+    secp256k1_pubkey const* c2,
+    secp256k1_pubkey const* pk_recipient,
+    uint64_t amount,
+    unsigned char const* tx_context_id);
+
+// breaks a 66-byte encrypted amount into two 33-byte components
+// then parses each 33-byte component into 64-byte secp256k1_pubkey format
+bool
+makeEcPair(Slice const& buffer, secp256k1_pubkey& out1, secp256k1_pubkey& out2);
+
+// serialize two secp256k1_pubkey components back into compressed 66-byte form
+bool
+serializeEcPair(
+    secp256k1_pubkey const& in1,
+    secp256k1_pubkey const& in2,
+    Buffer& buffer);
+
+/**
+ * @brief Verifies that a buffer contains two valid, parsable EC public keys.
+ * @param buffer The input buffer containing two concatenated components.
+ * @return true if both components can be parsed successfully, false otherwise.
+ */
+bool
+isValidCiphertext(Slice const& buffer);
+
+TER
+homomorphicAdd(Slice const& a, Slice const& b, Buffer& out);
+
+TER
+homomorphicSubtract(Slice const& a, Slice const& b, Buffer& out);
+
+TER
+proveEquality(
+    Slice const& proof,
+    Slice const& encAmt,  // encrypted amount
+    Slice const& pubkey,
+    uint64_t const amount,
+    uint256 const& txHash,  // Transaction context data
+    std::uint32_t const spendVersion);
+
+// returns ciphertext and the blinding factor used
+std::pair<Buffer, Buffer>
+encryptAmount(uint64_t amt, Slice const& pubKeySlice);
+
+Buffer
+encryptCanonicalZeroAmount(
+    Slice const& pubKeySlice,
+    AccountID const& account,
+    MPTID const& mptId);
+
+TER
+verifyConfidentialSendProof(
+    Slice const& proof,
+    Slice const& encSenderBalance,
+    Slice const& encSenderAmt,
+    Slice const& encDestAmt,
+    Slice const& encIssuerAmt,
+    Slice const& senderPubKey,
+    Slice const& destPubKey,
+    Slice const& issuerPubKey,
+    std::uint32_t const version,
+    uint256 const& txHash);
+
+TER
+verifyEqualityProof(
+    uint64_t const amount,
+    Slice const& proof,
+    Slice const& pubKeySlice,
+    Slice const& ciphertext,
+    uint256 const& contextHash);
+
+TER
+verifyClawbackEqualityProof(
+    uint64_t const amount,
+    Slice const& proof,
+    Slice const& pubKeySlice,
+    Slice const& ciphertext,
+    uint256 const& contextHash);
+
+std::vector<Buffer>
+getEqualityProofs(Slice const& zkp);
+
+}  // namespace ripple
+
+#endif

include/xrpl/protocol/LedgerFormats.h

@@ -168,6 +168,7 @@ enum LedgerSpecificFlags {
     lsfMPTCanTrade = 0x00000010,
     lsfMPTCanTransfer = 0x00000020,
     lsfMPTCanClawback = 0x00000040,
+    lsfMPTCanPrivacy = 0x00000080,
 
     lsmfMPTCanMutateCanLock = 0x00000002,
     lsmfMPTCanMutateRequireAuth = 0x00000004,
@@ -177,6 +178,8 @@ enum LedgerSpecificFlags {
     lsmfMPTCanMutateCanClawback = 0x00000040,
     lsmfMPTCanMutateMetadata = 0x00010000,
     lsmfMPTCanMutateTransferFee = 0x00020000,
+    // if set, lsfMPTCanPrivacy can not be mutated
+    lsmfMPTCannotMutatePrivacy = 0x00040000,
 
     // ltMPTOKEN
     lsfMPTAuthorized = 0x00000002,

include/xrpl/protocol/Protocol.h

@@ -297,6 +297,20 @@ std::size_t constexpr permissionMaxSize = 10;
 /** The maximum number of transactions that can be in a batch. */
 std::size_t constexpr maxBatchTxCount = 8;
 
+/** EC ElGamal ciphertext length 33-byte */
+std::size_t constexpr ecGamalEncryptedLength = 33;
+
+/** EC ElGamal ciphertext length: two 33-byte components concatenated */
+std::size_t constexpr ecGamalEncryptedTotalLength = 66;
+
+/** Length of equality ZKProof */
+std::size_t constexpr ecEqualityProofLength = 98;
+
+/** Length of EC public key */
+std::size_t constexpr ecPubKeyLength = 64;
+
+/** Length of EC private key */
+std::size_t constexpr ecPrivKeyLength = 32;
 }  // namespace ripple
 
 #endif

include/xrpl/protocol/TER.h

@@ -122,6 +122,7 @@ enum TEMcodes : TERUnderlyingType {
     temARRAY_TOO_LARGE,
     temBAD_TRANSFER_FEE,
     temINVALID_INNER_BATCH,
+    temBAD_CIPHERTEXT,
 };
 
 //------------------------------------------------------------------------------
@@ -347,6 +348,7 @@ enum TECcodes : TERUnderlyingType {
     // backward compatibility with historical data on non-prod networks, can be
     // reclaimed after those networks reset.
     tecNO_DELEGATE_PERMISSION = 198,
+    tecBAD_PROOF = 199
 };
 
 //------------------------------------------------------------------------------

include/xrpl/protocol/TxFlags.h

@@ -132,8 +132,9 @@ constexpr std::uint32_t const tfMPTCanEscrow               = lsfMPTCanEscrow;
 constexpr std::uint32_t const tfMPTCanTrade                = lsfMPTCanTrade;
 constexpr std::uint32_t const tfMPTCanTransfer             = lsfMPTCanTransfer;
 constexpr std::uint32_t const tfMPTCanClawback             = lsfMPTCanClawback;
+constexpr std::uint32_t const tfMPTCanPrivacy              = lsfMPTCanPrivacy;
 constexpr std::uint32_t const tfMPTokenIssuanceCreateMask  =
-  ~(tfUniversal | tfMPTCanLock | tfMPTRequireAuth | tfMPTCanEscrow | tfMPTCanTrade | tfMPTCanTransfer | tfMPTCanClawback);
+  ~(tfUniversal | tfMPTCanLock | tfMPTRequireAuth | tfMPTCanEscrow | tfMPTCanTrade | tfMPTCanTransfer | tfMPTCanClawback | tfMPTCanPrivacy);
 
 // MPTokenIssuanceCreate MutableFlags:
 // Indicating specific fields or flags may be changed after issuance.
@@ -145,9 +146,13 @@ constexpr std::uint32_t const tmfMPTCanMutateCanTransfer = lsmfMPTCanMutateCanTr
 constexpr std::uint32_t const tmfMPTCanMutateCanClawback = lsmfMPTCanMutateCanClawback;
 constexpr std::uint32_t const tmfMPTCanMutateMetadata = lsmfMPTCanMutateMetadata;
 constexpr std::uint32_t const tmfMPTCanMutateTransferFee = lsmfMPTCanMutateTransferFee;
+
+// Issuer can mutate lsfMPTPrivacy by default unless lsmfMPTCannotMutatePrivacy is set.
+constexpr std::uint32_t const tmfMPTCannotMutatePrivacy = lsmfMPTCannotMutatePrivacy;
 constexpr std::uint32_t const tmfMPTokenIssuanceCreateMutableMask =
   ~(tmfMPTCanMutateCanLock | tmfMPTCanMutateRequireAuth | tmfMPTCanMutateCanEscrow | tmfMPTCanMutateCanTrade
-    | tmfMPTCanMutateCanTransfer | tmfMPTCanMutateCanClawback | tmfMPTCanMutateMetadata | tmfMPTCanMutateTransferFee);
+    | tmfMPTCanMutateCanTransfer | tmfMPTCanMutateCanClawback | tmfMPTCanMutateMetadata | tmfMPTCanMutateTransferFee
+    | tmfMPTCannotMutatePrivacy);
 
 // MPTokenAuthorize flags:
 constexpr std::uint32_t const tfMPTUnauthorize             = 0x00000001;
@@ -173,10 +178,12 @@ constexpr std::uint32_t const tmfMPTSetCanTransfer         = 0x00000100;
 constexpr std::uint32_t const tmfMPTClearCanTransfer       = 0x00000200;
 constexpr std::uint32_t const tmfMPTSetCanClawback         = 0x00000400;
 constexpr std::uint32_t const tmfMPTClearCanClawback       = 0x00000800;
+constexpr std::uint32_t const tmfMPTSetPrivacy             = 0x00001000;
+constexpr std::uint32_t const tmfMPTClearPrivacy           = 0x00002000;
 constexpr std::uint32_t const tmfMPTokenIssuanceSetMutableMask = ~(tmfMPTSetCanLock | tmfMPTClearCanLock |
     tmfMPTSetRequireAuth | tmfMPTClearRequireAuth | tmfMPTSetCanEscrow | tmfMPTClearCanEscrow |
     tmfMPTSetCanTrade | tmfMPTClearCanTrade | tmfMPTSetCanTransfer | tmfMPTClearCanTransfer |
-    tmfMPTSetCanClawback | tmfMPTClearCanClawback);
+    tmfMPTSetCanClawback | tmfMPTClearCanClawback | tmfMPTSetPrivacy | tmfMPTClearPrivacy);
 
 // MPTokenIssuanceDestroy flags:
 constexpr std::uint32_t const tfMPTokenIssuanceDestroyMask  = ~tfUniversal;

include/xrpl/protocol/detail/features.macro

@@ -16,6 +16,7 @@
 // Add new amendments to the top of this list.
 // Keep it sorted in reverse chronological order.
 
+XRPL_FEATURE(ConfidentialTransfer,       Supported::no,  VoteBehavior::DefaultNo)
 XRPL_FEATURE(LendingProtocol,            Supported::no,  VoteBehavior::DefaultNo)
 XRPL_FEATURE(PermissionDelegationV1_1,   Supported::no,  VoteBehavior::DefaultNo)
 XRPL_FIX    (DirectoryLimit,             Supported::yes, VoteBehavior::DefaultNo)

include/xrpl/protocol/detail/ledger_entries.macro

@@ -398,6 +398,9 @@ LEDGER_ENTRY(ltMPTOKEN_ISSUANCE, 0x007e, MPTokenIssuance, mpt_issuance, ({
     {sfPreviousTxnLgrSeq,        soeREQUIRED},
     {sfDomainID,                 soeOPTIONAL},
     {sfMutableFlags,             soeDEFAULT},
+    {sfIssuerElGamalPublicKey,   soeOPTIONAL},
+    {sfAuditorElGamalPublicKey,  soeOPTIONAL},
+    {sfConfidentialOutstandingAmount, soeDEFAULT},
 }))
 
 /** A ledger object which tracks MPToken
@@ -411,6 +414,11 @@ LEDGER_ENTRY(ltMPTOKEN, 0x007f, MPToken, mptoken, ({
     {sfOwnerNode,                soeREQUIRED},
     {sfPreviousTxnID,            soeREQUIRED},
     {sfPreviousTxnLgrSeq,        soeREQUIRED},
+    {sfConfidentialBalanceInbox, soeOPTIONAL},
+    {sfConfidentialBalanceSpending, soeOPTIONAL},
+    {sfConfidentialBalanceVersion, soeDEFAULT},
+    {sfIssuerEncryptedBalance,   soeOPTIONAL},
+    {sfHolderElGamalPublicKey,   soeOPTIONAL},
 }))
 
 /** A ledger object which tracks Oracle

include/xrpl/protocol/detail/sfields.macro

@@ -114,6 +114,7 @@ TYPED_SFIELD(sfInterestRate,             UINT32,    65) // 1/10 basis points (bi
 TYPED_SFIELD(sfLateInterestRate,         UINT32,    66) // 1/10 basis points (bips)
 TYPED_SFIELD(sfCloseInterestRate,        UINT32,    67) // 1/10 basis points (bips)
 TYPED_SFIELD(sfOverpaymentInterestRate,  UINT32,    68) // 1/10 basis points (bips)
+TYPED_SFIELD(sfConfidentialBalanceVersion, UINT32,  69)
 
 // 64-bit integers (common)
 TYPED_SFIELD(sfIndexNext,                UINT64,     1)
@@ -147,6 +148,7 @@ TYPED_SFIELD(sfSubjectNode,              UINT64,    28)
 TYPED_SFIELD(sfLockedAmount,             UINT64,    29, SField::sMD_BaseTen|SField::sMD_Default)
 TYPED_SFIELD(sfVaultNode,                UINT64,    30)
 TYPED_SFIELD(sfLoanBrokerNode,           UINT64,    31)
+TYPED_SFIELD(sfConfidentialOutstandingAmount, UINT64, 32, SField::sMD_BaseTen|SField::sMD_Default)
 
 // 128-bit
 TYPED_SFIELD(sfEmailHash,                UINT128,    1)
@@ -297,6 +299,19 @@ TYPED_SFIELD(sfAssetClass,               VL,        28)
 TYPED_SFIELD(sfProvider,                 VL,        29)
 TYPED_SFIELD(sfMPTokenMetadata,          VL,        30)
 TYPED_SFIELD(sfCredentialType,           VL,        31)
+TYPED_SFIELD(sfConfidentialBalanceInbox, VL,        32)
+TYPED_SFIELD(sfConfidentialBalanceSpending, VL,     33)
+TYPED_SFIELD(sfIssuerEncryptedBalance,   VL,        34)
+TYPED_SFIELD(sfIssuerElGamalPublicKey,   VL,        35)
+TYPED_SFIELD(sfHolderElGamalPublicKey,   VL,        36)
+TYPED_SFIELD(sfZKProof,                  VL,        37)
+TYPED_SFIELD(sfHolderEncryptedAmount,    VL,        38)
+TYPED_SFIELD(sfIssuerEncryptedAmount,    VL,        39)
+TYPED_SFIELD(sfSenderEncryptedAmount,    VL,        40)
+TYPED_SFIELD(sfDestinationEncryptedAmount, VL,      41)
+TYPED_SFIELD(sfAuditorEncryptedBalance,  VL,        42)
+TYPED_SFIELD(sfAuditorEncryptedAmount,   VL,        43)
+TYPED_SFIELD(sfAuditorElGamalPublicKey,  VL,        44)
 
 // account (common)
 TYPED_SFIELD(sfAccount,                  ACCOUNT,    1)

include/xrpl/protocol/detail/transactions.macro

@@ -722,6 +722,7 @@ TRANSACTION(ttMPTOKEN_ISSUANCE_SET, 56, MPTokenIssuanceSet,
     {sfMPTokenMetadata, soeOPTIONAL},
     {sfTransferFee, soeOPTIONAL},
     {sfMutableFlags, soeOPTIONAL},
+    {sfIssuerElGamalPublicKey, soeOPTIONAL},
 }))
 
 /** This transaction type authorizes a MPToken instance */
@@ -1058,6 +1059,82 @@ TRANSACTION(ttLOAN_PAY, 84, LoanPay,
     {sfAmount, soeREQUIRED, soeMPTSupported},
 }))
 
+/** This transaction type converts into confidential MPT balance. */
+#if TRANSACTION_INCLUDE
+#include <xrpld/app/tx/detail/ConfidentialConvert.h>
+#endif
+TRANSACTION(ttCONFIDENTIAL_CONVERT, 85, ConfidentialConvert,
+    Delegation::delegatable,
+    featureConfidentialTransfer,
+    noPriv,
+    ({
+    {sfMPTokenIssuanceID, soeREQUIRED},
+    {sfMPTAmount, soeREQUIRED},
+    {sfHolderElGamalPublicKey, soeOPTIONAL},
+    {sfHolderEncryptedAmount, soeREQUIRED},
+    {sfIssuerEncryptedAmount, soeREQUIRED},
+    {sfZKProof, soeREQUIRED},
+}))
+
+/** This transaction type merges MPT inbox. */
+#if TRANSACTION_INCLUDE
+#include <xrpld/app/tx/detail/ConfidentialMergeInbox.h>
+#endif
+TRANSACTION(ttCONFIDENTIAL_MERGE_INBOX, 86, ConfidentialMergeInbox,
+    Delegation::delegatable,
+    featureConfidentialTransfer,
+    noPriv,
+    ({
+    {sfMPTokenIssuanceID, soeREQUIRED},
+}))
+
+/** This transaction type converts back into public MPT balance. */
+#if TRANSACTION_INCLUDE
+#include <xrpld/app/tx/detail/ConfidentialConvertBack.h>
+#endif
+TRANSACTION(ttCONFIDENTIAL_CONVERT_BACK, 87, ConfidentialConvertBack,
+    Delegation::delegatable,
+    featureConfidentialTransfer,
+    noPriv,
+    ({
+    {sfMPTokenIssuanceID, soeREQUIRED},
+    {sfMPTAmount, soeREQUIRED},
+    {sfHolderEncryptedAmount, soeREQUIRED},
+    {sfIssuerEncryptedAmount, soeREQUIRED},
+    {sfZKProof, soeREQUIRED},
+}))
+
+#if TRANSACTION_INCLUDE
+#include <xrpld/app/tx/detail/ConfidentialSend.h>
+#endif
+TRANSACTION(ttCONFIDENTIAL_SEND, 88, ConfidentialSend,
+    Delegation::delegatable,
+    featureConfidentialTransfer,
+    noPriv,
+    ({
+    {sfMPTokenIssuanceID, soeREQUIRED},
+    {sfDestination, soeREQUIRED},
+    {sfSenderEncryptedAmount, soeREQUIRED},
+    {sfDestinationEncryptedAmount, soeREQUIRED},
+    {sfIssuerEncryptedAmount, soeREQUIRED},
+    {sfZKProof, soeREQUIRED},
+    {sfCredentialIDs, soeOPTIONAL},
+}))
+
+#if TRANSACTION_INCLUDE
+#include <xrpld/app/tx/detail/ConfidentialClawback.h>
+#endif
+TRANSACTION(ttCONFIDENTIAL_CLAWBACK, 89, ConfidentialClawback,
+    Delegation::delegatable,
+    featureConfidentialTransfer,
+    noPriv,
+    ({
+    {sfMPTokenIssuanceID, soeREQUIRED},
+    {sfHolder, soeREQUIRED},
+    {sfMPTAmount, soeREQUIRED},
+    {sfZKProof, soeREQUIRED},
+}))
+
 /** This system-generated transaction type is used to update the status of the various amendments.
 
     For details, see: https://xrpl.org/amendments.html

src/libxrpl/ledger/View.cpp

@@ -517,7 +517,8 @@ accountHolds(
         // Only if auth check is needed, as it needs to do an additional read
         // operation. Note featureSingleAssetVault will affect error codes.
         if (zeroIfUnauthorized == ahZERO_IF_UNAUTHORIZED &&
-            view.rules().enabled(featureSingleAssetVault))
+            (view.rules().enabled(featureSingleAssetVault) ||
+             view.rules().enabled(featureConfidentialTransfer)))
         {
             if (auto const err =
                     requireAuth(view, mptIssue, account, AuthType::StrongAuth);

src/libxrpl/protocol/TER.cpp

@@ -108,6 +108,7 @@ transResults()
         MAKE_ERROR(tecLIMIT_EXCEEDED,                "Limit exceeded."),
         MAKE_ERROR(tecPSEUDO_ACCOUNT,                "This operation is not allowed against a pseudo-account."),
         MAKE_ERROR(tecPRECISION_LOSS,                "The amounts used by the transaction cannot interact."),
+        MAKE_ERROR(tecBAD_PROOF,                     "Proof cannot be verified"),
 
         MAKE_ERROR(tefALREADY,                     "The exact transaction was already in this ledger."),
         MAKE_ERROR(tefBAD_ADD_AUTH,                "Not authorized to add account."),
@@ -200,6 +201,7 @@ transResults()
         MAKE_ERROR(temARRAY_TOO_LARGE,           "Malformed: Array is too large."),
         MAKE_ERROR(temBAD_TRANSFER_FEE,          "Malformed: Transfer fee is outside valid range."),
         MAKE_ERROR(temINVALID_INNER_BATCH,       "Malformed: Invalid inner batch transaction."),
+        MAKE_ERROR(temBAD_CIPHERTEXT,            "Malformed: Invalid ciphertext."),
 
         MAKE_ERROR(terRETRY,                  "Retry transaction."),
         MAKE_ERROR(terFUNDS_SPENT,            "DEPRECATED."),

src/test/app/MPToken_test.cpp

@@ -571,7 +571,8 @@ class MPToken_test : public beast::unit_test::suite
                  .err = temINVALID_FLAG});
 
             if (!features[featureSingleAssetVault] &&
-                !features[featureDynamicMPT])
+                !features[featureDynamicMPT] &&
+                !features[featureConfidentialTransfer])
             {
                 // test invalid flags - nothing is being changed
                 mptAlice.set(
@@ -2930,6 +2931,7 @@ class MPToken_test : public beast::unit_test::suite
                 tmfMPTSetCanTrade | tmfMPTClearCanTrade,
                 tmfMPTSetCanTransfer | tmfMPTClearCanTransfer,
                 tmfMPTSetCanClawback | tmfMPTClearCanClawback,
+                tmfMPTSetPrivacy | tmfMPTClearPrivacy,
                 tmfMPTSetCanLock | tmfMPTClearCanLock | tmfMPTClearCanTrade,
                 tmfMPTSetCanTransfer | tmfMPTClearCanTransfer |
                     tmfMPTSetCanEscrow | tmfMPTClearCanClawback};

src/test/jtx/mpt.h

@@ -8,6 +8,8 @@
 
 #include <xrpl/protocol/UintTypes.h>
 
+#include <cstdint>
+
 namespace ripple {
 namespace test {
 namespace jtx {
@@ -16,6 +18,10 @@ class MPTTester;
 
 auto const MPTDEXFlags = tfMPTCanTrade | tfMPTCanTransfer;
 
+// Generates a syntactically valid placeholder ciphertext
+ripple::Buffer
+generatePlaceholderCiphertext();
+
 // Check flags settings on MPT create
 class mptflags
 {
@@ -156,6 +162,78 @@ struct MPTSet
     std::optional<std::string> metadata = std::nullopt;
     std::optional<Account> delegate = std::nullopt;
     std::optional<uint256> domainID = std::nullopt;
+    std::optional<Buffer> pubKey = std::nullopt;
+    std::optional<TER> err = std::nullopt;
+};
+
+struct MPTConvert
+{
+    std::optional<Account> account = std::nullopt;
+    std::optional<MPTID> id = std::nullopt;
+    std::optional<std::uint64_t> amt = std::nullopt;
+    std::optional<std::string> proof = std::nullopt;
+    std::optional<Buffer> holderPubKey = std::nullopt;
+    std::optional<Buffer> holderEncryptedAmt = std::nullopt;
+    std::optional<Buffer> issuerEncryptedAmt = std::nullopt;
+    std::optional<Buffer> auditorEncryptedAmt = std::nullopt;
+    std::optional<std::uint32_t> ownerCount = std::nullopt;
+    std::optional<std::uint32_t> holderCount = std::nullopt;
+    std::optional<std::uint32_t> flags = std::nullopt;
+    std::optional<TER> err = std::nullopt;
+};
+
+struct MPTMergeInbox
+{
+    std::optional<Account> account = std::nullopt;
+    std::optional<MPTID> id = std::nullopt;
+    std::optional<std::uint32_t> ownerCount = std::nullopt;
+    std::optional<std::uint32_t> holderCount = std::nullopt;
+    std::optional<std::uint32_t> flags = std::nullopt;
+    std::optional<TER> err = std::nullopt;
+};
+
+struct MPTConfidentialSend
+{
+    std::optional<Account> account = std::nullopt;
+    std::optional<Account> dest = std::nullopt;
+    std::optional<MPTID> id = std::nullopt;
+    // amt is to generate encrypted amounts for testing purposes
+    std::optional<std::uint64_t> amt = std::nullopt;
+    std::optional<std::string> proof = std::nullopt;
+    std::optional<Buffer> senderEncryptedAmt = std::nullopt;
+    std::optional<Buffer> destEncryptedAmt = std::nullopt;
+    std::optional<Buffer> issuerEncryptedAmt = std::nullopt;
+    std::optional<std::vector<std::string>> credentials = std::nullopt;
+    std::optional<std::uint32_t> ownerCount = std::nullopt;
+    std::optional<std::uint32_t> holderCount = std::nullopt;
+    std::optional<std::uint32_t> flags = std::nullopt;
+    std::optional<TER> err = std::nullopt;
+};
+
+struct MPTConvertBack
+{
+    std::optional<Account> account = std::nullopt;
+    std::optional<MPTID> id = std::nullopt;
+    std::optional<std::uint64_t> amt = std::nullopt;
+    std::optional<std::string> proof = std::nullopt;
+    std::optional<Buffer> holderEncryptedAmt = std::nullopt;
+    std::optional<Buffer> issuerEncryptedAmt = std::nullopt;
+    std::optional<std::uint32_t> ownerCount = std::nullopt;
+    std::optional<std::uint32_t> holderCount = std::nullopt;
+    std::optional<std::uint32_t> flags = std::nullopt;
+    std::optional<TER> err = std::nullopt;
+};
+
+struct MPTConfidentialClawback
+{
+    std::optional<Account> account = std::nullopt;
+    std::optional<Account> holder = std::nullopt;
+    std::optional<MPTID> id = std::nullopt;
+    std::optional<std::uint64_t> amt = std::nullopt;
+    std::optional<std::string> proof = std::nullopt;
+    std::optional<std::uint32_t> ownerCount = std::nullopt;
+    std::optional<std::uint32_t> holderCount = std::nullopt;
+    std::optional<std::uint32_t> flags = std::nullopt;
     std::optional<TER> err = std::nullopt;
 };
 
@@ -166,8 +244,16 @@ class MPTTester
     std::unordered_map<std::string, Account> const holders_;
     std::optional<MPTID> id_;
     bool close_;
+    std::unordered_map<AccountID, Buffer> pubKeys;
+    std::unordered_map<AccountID, Buffer> privKeys;
 
 public:
+    enum EncryptedBalanceType {
+        ISSUER_ENCRYPTED_BALANCE,
+        HOLDER_ENCRYPTED_INBOX,
+        HOLDER_ENCRYPTED_SPENDING,
+    };
+
     MPTTester(Env& env, Account const& issuer, MPTInit const& constr = {});
     MPTTester(MPTInitDef const& constr);
     MPTTester(
@@ -205,6 +291,22 @@ public:
     static Json::Value
     setjv(MPTSet const& set = {});
 
+    void
+    convert(MPTConvert const& arg = MPTConvert{});
+
+    void
+    mergeInbox(MPTMergeInbox const& arg = MPTMergeInbox{});
+
+    void
+    send(MPTConfidentialSend const& arg = MPTConfidentialSend{});
+
+    void
+    convertBack(MPTConvertBack const& arg = MPTConvertBack{});
+
+    void
+    confidentialClaw(
+        MPTConfidentialClawback const& arg = MPTConfidentialClawback{});
+
     [[nodiscard]] bool
     checkDomainID(std::optional<uint256> expected) const;
 
@@ -215,6 +317,9 @@ public:
     [[nodiscard]] bool
     checkMPTokenOutstandingAmount(std::int64_t expectedAmount) const;
 
+    [[nodiscard]] bool
+    checkIssuanceConfidentialBalance(std::int64_t expectedAmount) const;
+
     [[nodiscard]] bool
     checkFlags(
         uint32_t const expectedFlags,
@@ -268,6 +373,14 @@ public:
     std::int64_t
     getBalance(Account const& account) const;
 
+    std::int64_t
+    getIssuanceConfidentialBalance() const;
+
+    std::optional<Buffer>
+    getEncryptedBalance(
+        Account const& account,
+        EncryptedBalanceType option = HOLDER_ENCRYPTED_INBOX) const;
+
     MPT
     operator[](std::string const& name) const;
 
@@ -276,6 +389,48 @@ public:
 
     operator Asset() const;
 
+    bool
+    printMPT(Account const& holder_) const;
+
+    void
+    generateKeyPair(Account const& account);
+
+    Buffer
+    getPubKey(Account const& account) const;
+
+    Buffer
+    getPrivKey(Account const& account) const;
+
+    std::pair<Buffer, Buffer>
+    encryptAmount(Account const& account, uint64_t amt) const;
+
+    uint64_t
+    decryptAmount(Account const& account, Buffer const& amt) const;
+
+    uint64_t
+    getDecryptedBalance(
+        Account const& account,
+        EncryptedBalanceType balanceType) const;
+
+    std::int64_t
+    getIssuanceOutstandingBalance() const;
+
+    Buffer
+    getClawbackProof(
+        Account const& holder,
+        std::uint64_t amount,
+        Buffer const& privateKey,
+        uint256 const& txHash) const;
+
+    Buffer
+    getConvertProof(
+        Account const& holder,
+        std::uint64_t amount,
+        uint256 const& ctxHash,
+        std::pair<Buffer, Buffer> holderCiphertext,
+        std::pair<Buffer, Buffer> issuerCiphertext,
+        std::optional<std::pair<Buffer, Buffer>> auditorCiphertext) const;
+
 private:
     using SLEP = SLE::const_pointer;
     bool

src/xrpld/app/tx/detail/ConfidentialClawback.cpp

@@ -0,0 +1,151 @@
+#include <xrpld/app/misc/DelegateUtils.h>
+#include <xrpld/app/tx/detail/ConfidentialClawback.h>
+
+#include <xrpl/ledger/View.h>
+#include <xrpl/protocol/ConfidentialTransfer.h>
+#include <xrpl/protocol/Feature.h>
+#include <xrpl/protocol/Indexes.h>
+#include <xrpl/protocol/LedgerFormats.h>
+#include <xrpl/protocol/TER.h>
+#include <xrpl/protocol/TxFlags.h>
+
+namespace ripple {
+
+NotTEC
+ConfidentialClawback::preflight(PreflightContext const& ctx)
+{
+    if (!ctx.rules.enabled(featureConfidentialTransfer))
+        return temDISABLED;
+
+    auto const account = ctx.tx[sfAccount];
+    auto const issuer = MPTIssue(ctx.tx[sfMPTokenIssuanceID]).getIssuer();
+
+    // Only issuer can clawback
+    if (account != issuer)
+        return temMALFORMED;
+
+    // Cannot clawback from self
+    if (account == ctx.tx[sfHolder])
+        return temMALFORMED;
+
+    auto const clawAmount = ctx.tx[sfMPTAmount];
+    if (clawAmount == 0 || clawAmount > maxMPTokenAmount)
+        return temBAD_AMOUNT;
+
+    if (ctx.tx[sfZKProof].length() != ecEqualityProofLength)
+        return temMALFORMED;
+
+    return tesSUCCESS;
+}
+
+TER
+ConfidentialClawback::preclaim(PreclaimContext const& ctx)
+{
+    // Check if sender account exists
+    auto const account = ctx.tx[sfAccount];
+    if (!ctx.view.exists(keylet::account(account)))
+        return terNO_ACCOUNT;
+
+    // Check if holder account exists
+    auto const holder = ctx.tx[sfHolder];
+    if (!ctx.view.exists(keylet::account(holder)))
+        return tecNO_TARGET;
+
+    // Check if MPT issuance exists
+    auto const mptIssuanceID = ctx.tx[sfMPTokenIssuanceID];
+    auto const sleIssuance = ctx.view.read(keylet::mptIssuance(mptIssuanceID));
+    if (!sleIssuance)
+        return tecOBJECT_NOT_FOUND;
+
+    // Sanity check: issuer must be the same as account
+    if (sleIssuance->getAccountID(sfIssuer) != account)
+        return tefINTERNAL;  // LCOV_EXCL_LINE
+
+    // Check if issuance has issuer ElGamal public key
+    if (!sleIssuance->isFieldPresent(sfIssuerElGamalPublicKey))
+        return tecNO_PERMISSION;
+
+    // Check if clawback is allowed
+    if (!sleIssuance->isFlag(lsfMPTCanClawback))
+        return tecNO_PERMISSION;
+
+    // Check holder's MPToken
+    auto const sleHolderMPToken =
+        ctx.view.read(keylet::mptoken(mptIssuanceID, holder));
+    if (!sleHolderMPToken)
+        return tecOBJECT_NOT_FOUND;
+
+    // Check if holder has confidential balances to claw back
+    if (!sleHolderMPToken->isFieldPresent(sfIssuerEncryptedBalance))
+        return tecNO_PERMISSION;
+
+    // Sanity check: claw amount can not exceed confidential outstanding amount
+    auto const amount = ctx.tx[sfMPTAmount];
+    if (amount > (*sleIssuance)[~sfConfidentialOutstandingAmount].value_or(0))
+        return tecINSUFFICIENT_FUNDS;
+
+    auto const ciphertext = (*sleHolderMPToken)[sfIssuerEncryptedBalance];
+    auto const pubKeySlice = (*sleIssuance)[sfIssuerElGamalPublicKey];
+
+    auto const contextHash = getClawbackContextHash(
+        account, ctx.tx[sfSequence], mptIssuanceID, amount, holder);
+    return verifyClawbackEqualityProof(
+        amount, ctx.tx[sfZKProof], pubKeySlice, ciphertext, contextHash);
+}
+
+TER
+ConfidentialClawback::doApply()
+{
+    auto const mptIssuanceID = ctx_.tx[sfMPTokenIssuanceID];
+    auto const holder = ctx_.tx[sfHolder];
+
+    auto sleIssuance = view().peek(keylet::mptIssuance(mptIssuanceID));
+    auto sleHolderMPToken = view().peek(keylet::mptoken(mptIssuanceID, holder));
+
+    if (!sleIssuance || !sleHolderMPToken)
+        return tecINTERNAL;
+
+    auto const clawAmount = ctx_.tx[sfMPTAmount];
+
+    Slice const holderPubKey = (*sleHolderMPToken)[sfHolderElGamalPublicKey];
+    Slice const issuerPubKey = (*sleIssuance)[sfIssuerElGamalPublicKey];
+
+    // Encrypt zero amount
+    Buffer encZeroForHolder;
+    Buffer encZeroForIssuer;
+    try
+    {
+        encZeroForHolder =
+            encryptCanonicalZeroAmount(holderPubKey, holder, mptIssuanceID);
+
+        encZeroForIssuer =
+            encryptCanonicalZeroAmount(issuerPubKey, holder, mptIssuanceID);
+    }
+    catch (std::exception const& e)
+    {
+        JLOG(ctx_.journal.error())
+            << "ConfidentialClawback: Failed to generate canonical zero: "
+            << e.what();
+        return tecINTERNAL;
+    }
+
+    // Set holder's confidential balances to encrypted zero
+    (*sleHolderMPToken)[sfConfidentialBalanceInbox] = encZeroForHolder;
+    (*sleHolderMPToken)[sfConfidentialBalanceSpending] = encZeroForHolder;
+    (*sleHolderMPToken)[sfIssuerEncryptedBalance] = encZeroForIssuer;
+    (*sleHolderMPToken)[sfConfidentialBalanceVersion] = 0;
+
+    // Decrease Global Confidential Outstanding Amount
+    auto const oldCOA = (*sleIssuance)[sfConfidentialOutstandingAmount];
+    (*sleIssuance)[sfConfidentialOutstandingAmount] = oldCOA - clawAmount;
+
+    // Decrease Global Total Outstanding Amount
+    auto const oldOA = (*sleIssuance)[sfOutstandingAmount];
+    (*sleIssuance)[sfOutstandingAmount] = oldOA - clawAmount;
+
+    view().update(sleHolderMPToken);
+    view().update(sleIssuance);
+
+    return tesSUCCESS;
+}
+}  // namespace ripple

src/xrpld/app/tx/detail/ConfidentialClawback.h

@@ -0,0 +1,29 @@
+#ifndef XRPL_TX_CONFIDENTIALCLAWSBACK_H_INCLUDED
+#define XRPL_TX_CONFIDENTIALCLAWSBACK_H_INCLUDED
+
+#include <xrpld/app/tx/detail/Transactor.h>
+
+namespace ripple {
+
+class ConfidentialClawback : public Transactor
+{
+public:
+    static constexpr ConsequencesFactoryType ConsequencesFactory{Normal};
+
+    explicit ConfidentialClawback(ApplyContext& ctx) : Transactor(ctx)
+    {
+    }
+
+    static NotTEC
+    preflight(PreflightContext const& ctx);
+
+    static TER
+    preclaim(PreclaimContext const& ctx);
+
+    TER
+    doApply() override;
+};
+
+}  // namespace ripple
+
+#endif

src/xrpld/app/tx/detail/ConfidentialConvert.cpp

@@ -0,0 +1,243 @@
+#include <xrpld/app/misc/DelegateUtils.h>
+#include <xrpld/app/tx/detail/ConfidentialConvert.h>
+
+#include <xrpl/ledger/View.h>
+#include <xrpl/protocol/ConfidentialTransfer.h>
+#include <xrpl/protocol/Feature.h>
+#include <xrpl/protocol/Indexes.h>
+#include <xrpl/protocol/LedgerFormats.h>
+#include <xrpl/protocol/TER.h>
+#include <xrpl/protocol/TxFlags.h>
+
+namespace ripple {
+
+NotTEC
+ConfidentialConvert::preflight(PreflightContext const& ctx)
+{
+    if (!ctx.rules.enabled(featureConfidentialTransfer))
+        return temDISABLED;
+
+    // issuer cannot convert
+    if (MPTIssue(ctx.tx[sfMPTokenIssuanceID]).getIssuer() == ctx.tx[sfAccount])
+        return temMALFORMED;
+
+    if (ctx.tx[sfHolderEncryptedAmount].length() !=
+            ecGamalEncryptedTotalLength ||
+        ctx.tx[sfIssuerEncryptedAmount].length() != ecGamalEncryptedTotalLength)
+        return temBAD_CIPHERTEXT;
+
+    if (ctx.tx[sfMPTAmount] > maxMPTokenAmount)
+        return temBAD_AMOUNT;
+
+    if (!isValidCiphertext(ctx.tx[sfHolderEncryptedAmount]) ||
+        !isValidCiphertext(ctx.tx[sfIssuerEncryptedAmount]))
+        return temBAD_CIPHERTEXT;
+
+    if (ctx.tx.isFieldPresent(sfHolderElGamalPublicKey) &&
+        ctx.tx[sfHolderElGamalPublicKey].length() != ecPubKeyLength)
+        return temMALFORMED;
+
+    auto const expectedCount =
+        ctx.tx.isFieldPresent(sfAuditorEncryptedAmount) ? 3 : 2;
+    if (ctx.tx[sfZKProof].size() != expectedCount * ecEqualityProofLength)
+        return temMALFORMED;
+
+    return tesSUCCESS;
+}
+
+TER
+ConfidentialConvert::preclaim(PreclaimContext const& ctx)
+{
+    // ensure that issuance exists
+    auto const sleIssuance =
+        ctx.view.read(keylet::mptIssuance(ctx.tx[sfMPTokenIssuanceID]));
+    if (!sleIssuance)
+        return tecOBJECT_NOT_FOUND;
+
+    if (!sleIssuance->isFlag(lsfMPTCanPrivacy))
+        return tecNO_PERMISSION;
+
+    // already checked in preflight, but should also check that issuer on the
+    // issuance isn't the account either
+    if (sleIssuance->getAccountID(sfIssuer) == ctx.tx[sfAccount])
+        return tefINTERNAL;  // LCOV_EXCL_LINE
+
+    // issuer has not uploaded their pub key yet
+    if (!sleIssuance->isFieldPresent(sfIssuerElGamalPublicKey))
+        return tecNO_PERMISSION;
+
+    auto const sleMptoken = ctx.view.read(
+        keylet::mptoken(ctx.tx[sfMPTokenIssuanceID], ctx.tx[sfAccount]));
+    if (!sleMptoken)
+        return tecOBJECT_NOT_FOUND;
+
+    auto const mptIssue = MPTIssue{ctx.tx[sfMPTokenIssuanceID]};
+    STAmount const mptAmount = STAmount(
+        MPTAmount{static_cast<MPTAmount::value_type>(ctx.tx[sfMPTAmount])},
+        mptIssue);
+    if (accountHolds(
+            ctx.view,
+            ctx.tx[sfAccount],
+            mptIssue,
+            FreezeHandling::fhZERO_IF_FROZEN,
+            AuthHandling::ahZERO_IF_UNAUTHORIZED,
+            ctx.j) < mptAmount)
+    {
+        return tecINSUFFICIENT_FUNDS;
+    }
+
+    // must have pk to convert
+    if (!sleMptoken->isFieldPresent(sfHolderElGamalPublicKey) &&
+        !ctx.tx.isFieldPresent(sfHolderElGamalPublicKey))
+        return tecNO_PERMISSION;
+
+    // can't update if there's already a pk
+    if (sleMptoken->isFieldPresent(sfHolderElGamalPublicKey) &&
+        ctx.tx.isFieldPresent(sfHolderElGamalPublicKey))
+        return tecDUPLICATE;
+
+    auto const holderPubKey = ctx.tx.isFieldPresent(sfHolderElGamalPublicKey)
+        ? ctx.tx[sfHolderElGamalPublicKey]
+        : (*sleMptoken)[sfHolderElGamalPublicKey];
+
+    auto const contextHash = getConvertContextHash(
+        ctx.tx[sfAccount],
+        ctx.tx[sfSequence],
+        ctx.tx[sfMPTokenIssuanceID],
+        ctx.tx[sfMPTAmount]);
+
+    bool const hasAuditor = ctx.tx.isFieldPresent(sfAuditorEncryptedAmount);
+
+    std::vector<Buffer> const zkps = getEqualityProofs(ctx.tx[sfZKProof]);
+
+    auto const& amount = ctx.tx[sfMPTAmount];
+
+    // we already checked proof size in preflight, still do sanity check here
+    // since we are going to access individual vector entries
+    auto const expectedCount = ctx.tx[sfZKProof].size() / ecEqualityProofLength;
+    if (zkps.size() != expectedCount)
+        return tecINTERNAL;  // LCOV_EXCL_LINE
+
+    // check equality proof
+    if (!isTesSuccess(verifyEqualityProof(
+            amount,
+            zkps[0],
+            holderPubKey,
+            ctx.tx[sfHolderEncryptedAmount],
+            contextHash)) ||
+        !isTesSuccess(verifyEqualityProof(
+            amount,
+            zkps[1],
+            (*sleIssuance)[sfIssuerElGamalPublicKey],
+            ctx.tx[sfIssuerEncryptedAmount],
+            contextHash)))
+    {
+        return tecBAD_PROOF;
+    }
+
+    // Verify Auditor proof if present
+    if (hasAuditor &&
+        !isTesSuccess(verifyEqualityProof(
+            amount,
+            zkps[2],
+            (*sleIssuance)[sfAuditorElGamalPublicKey],
+            ctx.tx[sfAuditorEncryptedAmount],
+            contextHash)))
+    {
+        return tecBAD_PROOF;
+    }
+
+    return tesSUCCESS;
+}
+
+TER
+ConfidentialConvert::doApply()
+{
+    auto const mptIssuanceID = ctx_.tx[sfMPTokenIssuanceID];
+
+    auto sleMptoken = view().peek(keylet::mptoken(mptIssuanceID, account_));
+    if (!sleMptoken)
+        return tecINTERNAL;
+
+    auto sleIssuance = view().peek(keylet::mptIssuance(mptIssuanceID));
+    if (!sleIssuance)
+        return tecINTERNAL;
+
+    auto const amtToConvert = ctx_.tx[sfMPTAmount];
+    auto const amt = (*sleMptoken)[~sfMPTAmount].value_or(0);
+
+    if (ctx_.tx.isFieldPresent(sfHolderElGamalPublicKey))
+        (*sleMptoken)[sfHolderElGamalPublicKey] =
+            ctx_.tx[sfHolderElGamalPublicKey];
+
+    (*sleMptoken)[sfMPTAmount] = amt - amtToConvert;
+    (*sleIssuance)[sfConfidentialOutstandingAmount] =
+        (*sleIssuance)[~sfConfidentialOutstandingAmount].value_or(0) +
+        amtToConvert;
+
+    Slice const holderEc = ctx_.tx[sfHolderEncryptedAmount];
+    Slice const issuerEc = ctx_.tx[sfIssuerEncryptedAmount];
+
+    // todo: we should check sfConfidentialBalanceSpending depending on if we
+    // encrypt zero amount
+    if (sleMptoken->isFieldPresent(sfIssuerEncryptedBalance) &&
+        sleMptoken->isFieldPresent(sfConfidentialBalanceInbox) &&
+        sleMptoken->isFieldPresent(sfConfidentialBalanceSpending))
+    {
+        // homomorphically add holder's encrypted balance
+        {
+            Buffer sum(ecGamalEncryptedTotalLength);
+            if (TER const ter = homomorphicAdd(
+                    holderEc, (*sleMptoken)[sfConfidentialBalanceInbox], sum);
+                !isTesSuccess(ter))
+                return tecINTERNAL;
+
+            (*sleMptoken)[sfConfidentialBalanceInbox] = sum;
+        }
+
+        // homomorphically add issuer's encrypted balance
+        {
+            Buffer sum(ecGamalEncryptedTotalLength);
+            if (TER const ter = homomorphicAdd(
+                    issuerEc, (*sleMptoken)[sfIssuerEncryptedBalance], sum);
+                !isTesSuccess(ter))
+                return tecINTERNAL;
+
+            (*sleMptoken)[sfIssuerEncryptedBalance] = sum;
+        }
+    }
+    else if (
+        !sleMptoken->isFieldPresent(sfIssuerEncryptedBalance) &&
+        !sleMptoken->isFieldPresent(sfConfidentialBalanceInbox) &&
+        !sleMptoken->isFieldPresent(sfConfidentialBalanceSpending))
+    {
+        (*sleMptoken)[sfConfidentialBalanceInbox] = holderEc;
+        (*sleMptoken)[sfIssuerEncryptedBalance] = issuerEc;
+        (*sleMptoken)[sfConfidentialBalanceVersion] = 0;
+
+        try
+        {
+            // encrypt sfConfidentialBalanceSpending with zero balance
+            Buffer out;
+            out =
+                encryptAmount(0, (*sleMptoken)[sfHolderElGamalPublicKey]).first;
+            (*sleMptoken)[sfConfidentialBalanceSpending] = out;
+        }
+        catch (std::exception const& e)
+        {
+            return tecINTERNAL;  // LCOV_EXCL_LINE
+        }
+    }
+    else
+    {
+        // both sfIssuerEncryptedBalance and sfConfidentialBalanceInbox should
+        // exist together
+        return tecINTERNAL;  // LCOV_EXCL_LINE
+    }
+
+    view().update(sleIssuance);
+    view().update(sleMptoken);
+    return tesSUCCESS;
+}
+
+}  // namespace ripple

src/xrpld/app/tx/detail/ConfidentialConvert.h

@@ -0,0 +1,29 @@
+#ifndef XRPL_TX_CONFIDENTIALCONVERT_H_INCLUDED
+#define XRPL_TX_CONFIDENTIALCONVERT_H_INCLUDED
+
+#include <xrpld/app/tx/detail/Transactor.h>
+
+namespace ripple {
+
+class ConfidentialConvert : public Transactor
+{
+public:
+    static constexpr ConsequencesFactoryType ConsequencesFactory{Normal};
+
+    explicit ConfidentialConvert(ApplyContext& ctx) : Transactor(ctx)
+    {
+    }
+
+    static NotTEC
+    preflight(PreflightContext const& ctx);
+
+    static TER
+    preclaim(PreclaimContext const& ctx);
+
+    TER
+    doApply() override;
+};
+
+}  // namespace ripple
+
+#endif

src/xrpld/app/tx/detail/ConfidentialConvertBack.cpp

@@ -0,0 +1,178 @@
+#include <xrpld/app/tx/detail/ConfidentialConvertBack.h>
+
+#include <xrpl/ledger/View.h>
+#include <xrpl/protocol/ConfidentialTransfer.h>
+#include <xrpl/protocol/Feature.h>
+#include <xrpl/protocol/Indexes.h>
+#include <xrpl/protocol/LedgerFormats.h>
+#include <xrpl/protocol/TER.h>
+#include <xrpl/protocol/TxFlags.h>
+
+namespace ripple {
+
+NotTEC
+ConfidentialConvertBack::preflight(PreflightContext const& ctx)
+{
+    if (!ctx.rules.enabled(featureConfidentialTransfer))
+        return temDISABLED;
+
+    // issuer cannot convert
+    if (MPTIssue(ctx.tx[sfMPTokenIssuanceID]).getIssuer() == ctx.tx[sfAccount])
+        return temMALFORMED;
+
+    if (ctx.tx[sfHolderEncryptedAmount].length() !=
+            ecGamalEncryptedTotalLength ||
+        ctx.tx[sfIssuerEncryptedAmount].length() != ecGamalEncryptedTotalLength)
+        return temBAD_CIPHERTEXT;
+
+    if (ctx.tx[sfMPTAmount] == 0 || ctx.tx[sfMPTAmount] > maxMPTokenAmount)
+        return temBAD_AMOUNT;
+
+    if (!isValidCiphertext(ctx.tx[sfHolderEncryptedAmount]) ||
+        !isValidCiphertext(ctx.tx[sfIssuerEncryptedAmount]))
+        return temBAD_CIPHERTEXT;
+
+    // todo: update with correct size of proof since it might also contain range
+    // proof
+    // if (ctx.tx[sfZKProof].length() != ecEqualityProofLength)
+    //     return temMALFORMED;
+
+    return tesSUCCESS;
+}
+
+TER
+ConfidentialConvertBack::preclaim(PreclaimContext const& ctx)
+{
+    // ensure that issuance exists
+    auto const sleIssuance =
+        ctx.view.read(keylet::mptIssuance(ctx.tx[sfMPTokenIssuanceID]));
+    if (!sleIssuance)
+        return tecOBJECT_NOT_FOUND;
+
+    if (!sleIssuance->isFlag(lsfMPTCanPrivacy))
+        return tecNO_PERMISSION;
+
+    // already checked in preflight, but should also check that issuer on the
+    // issuance isn't the account either
+    if (sleIssuance->getAccountID(sfIssuer) == ctx.tx[sfAccount])
+        return tefINTERNAL;  // LCOV_EXCL_LINE
+
+    auto const sleMptoken = ctx.view.read(
+        keylet::mptoken(ctx.tx[sfMPTokenIssuanceID], ctx.tx[sfAccount]));
+    if (!sleMptoken)
+        return tecOBJECT_NOT_FOUND;
+
+    if (!sleMptoken->isFieldPresent(sfConfidentialBalanceSpending) ||
+        !sleMptoken->isFieldPresent(sfHolderElGamalPublicKey))
+    {
+        return tecNO_PERMISSION;
+    }
+
+    // if the total circulating confidential balance is smaller than what the
+    // holder is trying to convert back, we know for sure this txn should
+    // fail
+    if ((*sleIssuance)[~sfConfidentialOutstandingAmount].value_or(0) <
+        ctx.tx[sfMPTAmount])
+    {
+        return tecINSUFFICIENT_FUNDS;
+    }
+
+    auto const mptIssuanceID = ctx.tx[sfMPTokenIssuanceID];
+    auto const account = ctx.tx[sfAccount];
+
+    // Check lock
+    MPTIssue const mptIssue(mptIssuanceID);
+    if (auto const ter = checkFrozen(ctx.view, account, mptIssue);
+        !isTesSuccess(ter))
+        return ter;
+
+    // Check auth
+    if (auto const ter = requireAuth(ctx.view, mptIssue, account);
+        !isTesSuccess(ter))
+        return ter;
+
+    // todo: need addtional parsing, the proof should contain multiple proofs
+    // auto checkEqualityProof = [&](auto const& encryptedAmount,
+    //                               auto const& pubKey) -> TER {
+    //     return proveEquality(
+    //         ctx.tx[sfZKProof],
+    //         encryptedAmount,
+    //         pubKey,
+    //         ctx.tx[sfMPTAmount],
+    //         ctx.tx.getTransactionID(),
+    //         (*sleMptoken)[~sfConfidentialBalanceVersion].value_or(0));
+    // };
+
+    // if (!isTesSuccess(checkEqualityProof(
+    //         ctx.tx[sfHolderEncryptedAmount],
+    //         (*sleMptoken)[sfHolderElGamalPublicKey])) ||
+    //     !isTesSuccess(checkEqualityProof(
+    //         ctx.tx[sfIssuerEncryptedAmount],
+    //         (*sleIssuance)[sfIssuerElGamalPublicKey])))
+    // {
+    //     return tecBAD_PROOF;
+    // }
+
+    // todo: also check range proof that
+    // sfHolderEncryptedAmount <= sfConfidentialBalanceSpending AND
+    // sfIssuerEncryptedAmount <= sfIssuerEncryptedBalance
+
+    return tesSUCCESS;
+}
+
+TER
+ConfidentialConvertBack::doApply()
+{
+    auto const mptIssuanceID = ctx_.tx[sfMPTokenIssuanceID];
+
+    auto sleMptoken = view().peek(keylet::mptoken(mptIssuanceID, account_));
+    if (!sleMptoken)
+        return tecINTERNAL;
+
+    auto sleIssuance = view().peek(keylet::mptIssuance(mptIssuanceID));
+    if (!sleIssuance)
+        return tecINTERNAL;
+
+    auto const amtToConvertBack = ctx_.tx[sfMPTAmount];
+    auto const amt = (*sleMptoken)[~sfMPTAmount].value_or(0);
+
+    (*sleMptoken)[sfMPTAmount] = amt + amtToConvertBack;
+    (*sleIssuance)[sfConfidentialOutstandingAmount] =
+        (*sleIssuance)[sfConfidentialOutstandingAmount] - amtToConvertBack;
+
+    // it's fine if it reaches max uint32, it just resets to 0
+    (*sleMptoken)[sfConfidentialBalanceVersion] =
+        (*sleMptoken)[~sfConfidentialBalanceVersion].value_or(0u) + 1u;
+
+    // homomorphically subtract holder's encrypted balance
+    {
+        Buffer res(ecGamalEncryptedTotalLength);
+        if (TER const ter = homomorphicSubtract(
+                (*sleMptoken)[sfConfidentialBalanceSpending],
+                ctx_.tx[sfHolderEncryptedAmount],
+                res);
+            !isTesSuccess(ter))
+            return tecINTERNAL;
+
+        (*sleMptoken)[sfConfidentialBalanceSpending] = res;
+    }
+
+    // homomorphically subtract issuer's encrypted balance
+    {
+        Buffer res(ecGamalEncryptedTotalLength);
+        if (TER const ter = homomorphicSubtract(
+                (*sleMptoken)[sfIssuerEncryptedBalance],
+                ctx_.tx[sfIssuerEncryptedAmount],
+                res);
+            !isTesSuccess(ter))
+            return tecINTERNAL;
+
+        (*sleMptoken)[sfIssuerEncryptedBalance] = res;
+    }
+
+    view().update(sleIssuance);
+    view().update(sleMptoken);
+    return tesSUCCESS;
+}
+
+}  // namespace ripple

src/xrpld/app/tx/detail/ConfidentialConvertBack.h

@@ -0,0 +1,29 @@
+#ifndef XRPL_TX_CONFIDENTIALCONVERTBACK_H_INCLUDED
+#define XRPL_TX_CONFIDENTIALCONVERTBACK_H_INCLUDED
+
+#include <xrpld/app/tx/detail/Transactor.h>
+
+namespace ripple {
+
+class ConfidentialConvertBack : public Transactor
+{
+public:
+    static constexpr ConsequencesFactoryType ConsequencesFactory{Normal};
+
+    explicit ConfidentialConvertBack(ApplyContext& ctx) : Transactor(ctx)
+    {
+    }
+
+    static NotTEC
+    preflight(PreflightContext const& ctx);
+
+    static TER
+    preclaim(PreclaimContext const& ctx);
+
+    TER
+    doApply() override;
+};
+
+}  // namespace ripple
+
+#endif

src/xrpld/app/tx/detail/ConfidentialMergeInbox.cpp

@@ -0,0 +1,92 @@
+#include <xrpld/app/tx/detail/ConfidentialMergeInbox.h>
+
+#include <xrpl/protocol/ConfidentialTransfer.h>
+#include <xrpl/protocol/Feature.h>
+#include <xrpl/protocol/Indexes.h>
+#include <xrpl/protocol/LedgerFormats.h>
+#include <xrpl/protocol/TER.h>
+#include <xrpl/protocol/TxFlags.h>
+
+namespace ripple {
+
+NotTEC
+ConfidentialMergeInbox::preflight(PreflightContext const& ctx)
+{
+    if (!ctx.rules.enabled(featureConfidentialTransfer))
+        return temDISABLED;
+
+    // issuer cannot merge
+    if (MPTIssue(ctx.tx[sfMPTokenIssuanceID]).getIssuer() == ctx.tx[sfAccount])
+        return temMALFORMED;
+
+    return tesSUCCESS;
+}
+
+TER
+ConfidentialMergeInbox::preclaim(PreclaimContext const& ctx)
+{
+    auto const sleIssuance =
+        ctx.view.read(keylet::mptIssuance(ctx.tx[sfMPTokenIssuanceID]));
+    if (!sleIssuance)
+        return tecOBJECT_NOT_FOUND;
+
+    if (!sleIssuance->isFlag(lsfMPTCanPrivacy))
+        return tecNO_PERMISSION;
+
+    // already checked in preflight, but should also check that issuer on the
+    // issuance isn't the account either
+    if (sleIssuance->getAccountID(sfIssuer) == ctx.tx[sfAccount])
+        return tefINTERNAL;  // LCOV_EXCL_LINE
+
+    auto const sleMptoken = ctx.view.read(
+        keylet::mptoken(ctx.tx[sfMPTokenIssuanceID], ctx.tx[sfAccount]));
+    if (!sleMptoken)
+        return tecOBJECT_NOT_FOUND;
+
+    if (!sleMptoken->isFieldPresent(sfConfidentialBalanceInbox) ||
+        !sleMptoken->isFieldPresent(sfConfidentialBalanceSpending))
+        return tecNO_PERMISSION;
+
+    return tesSUCCESS;
+}
+
+TER
+ConfidentialMergeInbox::doApply()
+{
+    auto const mptIssuanceID = ctx_.tx[sfMPTokenIssuanceID];
+    auto sleMptoken = view().peek(keylet::mptoken(mptIssuanceID, account_));
+    if (!sleMptoken)
+        return tecINTERNAL;
+
+    // homomorphically add holder's encrypted balance
+    Buffer sum(ecGamalEncryptedTotalLength);
+    if (TER const ter = homomorphicAdd(
+            (*sleMptoken)[sfConfidentialBalanceSpending],
+            (*sleMptoken)[sfConfidentialBalanceInbox],
+            sum);
+        !isTesSuccess(ter))
+        return tecINTERNAL;
+
+    (*sleMptoken)[sfConfidentialBalanceSpending] = sum;
+
+    try
+    {
+        Buffer zeroEncyption;
+        zeroEncyption = encryptCanonicalZeroAmount(
+            (*sleMptoken)[sfHolderElGamalPublicKey], account_, mptIssuanceID);
+        (*sleMptoken)[sfConfidentialBalanceInbox] = zeroEncyption;
+    }
+    catch (std::exception const& e)
+    {
+        return tecINTERNAL;
+    }
+
+    // it's fine if it reaches max uint32, it just resets to 0
+    (*sleMptoken)[sfConfidentialBalanceVersion] =
+        (*sleMptoken)[~sfConfidentialBalanceVersion].value_or(0u) + 1u;
+
+    view().update(sleMptoken);
+    return tesSUCCESS;
+}
+
+}  // namespace ripple

src/xrpld/app/tx/detail/ConfidentialMergeInbox.h

@@ -0,0 +1,29 @@
+#ifndef XRPL_TX_CONFIDENTIALMERGEINBOX_H_INCLUDED
+#define XRPL_TX_CONFIDENTIALMERGEINBOX_H_INCLUDED
+
+#include <xrpld/app/tx/detail/Transactor.h>
+
+namespace ripple {
+
+class ConfidentialMergeInbox : public Transactor
+{
+public:
+    static constexpr ConsequencesFactoryType ConsequencesFactory{Normal};
+
+    explicit ConfidentialMergeInbox(ApplyContext& ctx) : Transactor(ctx)
+    {
+    }
+
+    static NotTEC
+    preflight(PreflightContext const& ctx);
+
+    static TER
+    preclaim(PreclaimContext const& ctx);
+
+    TER
+    doApply() override;
+};
+
+}  // namespace ripple
+
+#endif

src/xrpld/app/tx/detail/ConfidentialSend.cpp

@@ -0,0 +1,238 @@
+#include <xrpld/app/misc/DelegateUtils.h>
+#include <xrpld/app/tx/detail/ConfidentialSend.h>
+
+#include <xrpl/ledger/CredentialHelpers.h>
+#include <xrpl/ledger/View.h>
+#include <xrpl/protocol/ConfidentialTransfer.h>
+#include <xrpl/protocol/Feature.h>
+#include <xrpl/protocol/Indexes.h>
+#include <xrpl/protocol/LedgerFormats.h>
+#include <xrpl/protocol/TER.h>
+#include <xrpl/protocol/TxFlags.h>
+
+namespace ripple {
+
+NotTEC
+ConfidentialSend::preflight(PreflightContext const& ctx)
+{
+    if (!ctx.rules.enabled(featureConfidentialTransfer))
+        return temDISABLED;
+
+    auto const account = ctx.tx[sfAccount];
+    auto const issuer = MPTIssue(ctx.tx[sfMPTokenIssuanceID]).getIssuer();
+
+    // ConfidentialSend only allows holder to holder, holder to second account,
+    // and second account to holder transfers. So issuer cannot be the sender.
+    if (account == issuer)
+        return temMALFORMED;
+
+    // Can not send to self
+    if (account == ctx.tx[sfDestination])
+        return temMALFORMED;
+
+    if (ctx.tx[sfSenderEncryptedAmount].length() !=
+            ecGamalEncryptedTotalLength ||
+        ctx.tx[sfDestinationEncryptedAmount].length() !=
+            ecGamalEncryptedTotalLength ||
+        ctx.tx[sfIssuerEncryptedAmount].length() != ecGamalEncryptedTotalLength)
+        return temBAD_CIPHERTEXT;
+
+    if (!isValidCiphertext(ctx.tx[sfSenderEncryptedAmount]) ||
+        !isValidCiphertext(ctx.tx[sfDestinationEncryptedAmount]) ||
+        !isValidCiphertext(ctx.tx[sfIssuerEncryptedAmount]))
+        return temBAD_CIPHERTEXT;
+
+    // if (ctx.tx[sfZKProof].length() != ecEqualityProofLength)
+    //     return temMALFORMED;
+
+    return tesSUCCESS;
+}
+
+TER
+ConfidentialSend::preclaim(PreclaimContext const& ctx)
+{
+    // Check if sender account exists
+    auto const account = ctx.tx[sfAccount];
+    if (!ctx.view.exists(keylet::account(account)))
+        return terNO_ACCOUNT;
+
+    // Check if destination account exists
+    auto const destination = ctx.tx[sfDestination];
+    if (!ctx.view.exists(keylet::account(destination)))
+        return tecNO_TARGET;
+
+    // Check if MPT issuance exists
+    auto const mptIssuanceID = ctx.tx[sfMPTokenIssuanceID];
+    auto const sleIssuance = ctx.view.read(keylet::mptIssuance(mptIssuanceID));
+    if (!sleIssuance)
+        return tecOBJECT_NOT_FOUND;
+
+    // Check if the issuance allows transfer
+    if (!sleIssuance->isFlag(lsfMPTCanTransfer))
+        return tecNO_AUTH;
+
+    // Check if issuance allows confidential transfer
+    if (!sleIssuance->isFlag(lsfMPTCanPrivacy))
+        return tecNO_PERMISSION;
+
+    // Check if issuance has issuer ElGamal public key
+    if (!sleIssuance->isFieldPresent(sfIssuerElGamalPublicKey))
+        return tecNO_PERMISSION;
+
+    // already checked in preflight, but should also check that issuer on the
+    // issuance isn't the account either
+    if (sleIssuance->getAccountID(sfIssuer) == ctx.tx[sfAccount])
+        return tefINTERNAL;  // LCOV_EXCL_LINE
+
+    // Check sender's MPToken
+    auto const sleSenderMPToken =
+        ctx.view.read(keylet::mptoken(mptIssuanceID, account));
+    if (!sleSenderMPToken)
+        return tecOBJECT_NOT_FOUND;
+
+    // Check sender's MPToken has necessary fields for confidential send
+    if (!sleSenderMPToken->isFieldPresent(sfHolderElGamalPublicKey) ||
+        !sleSenderMPToken->isFieldPresent(sfConfidentialBalanceSpending) ||
+        !sleSenderMPToken->isFieldPresent(sfIssuerEncryptedBalance))
+        return tecNO_PERMISSION;
+
+    // Check destination's MPToken
+    auto const sleDestinationMPToken =
+        ctx.view.read(keylet::mptoken(mptIssuanceID, destination));
+    if (!sleDestinationMPToken)
+        return tecOBJECT_NOT_FOUND;
+
+    // Check destination's MPToken has necessary fields for confidential send
+    if (!sleDestinationMPToken->isFieldPresent(sfHolderElGamalPublicKey) ||
+        !sleDestinationMPToken->isFieldPresent(sfConfidentialBalanceInbox) ||
+        !sleDestinationMPToken->isFieldPresent(sfIssuerEncryptedBalance))
+        return tecNO_PERMISSION;
+
+    // Check lock
+    MPTIssue const mptIssue(mptIssuanceID);
+    if (auto const ter = checkFrozen(ctx.view, account, mptIssue);
+        !isTesSuccess(ter))
+        return ter;
+
+    if (auto const ter = checkFrozen(ctx.view, destination, mptIssue);
+        !isTesSuccess(ter))
+        return ter;
+
+    // Check auth
+    if (auto const ter = requireAuth(ctx.view, mptIssue, account);
+        !isTesSuccess(ter))
+        return ter;
+
+    if (auto const ter = requireAuth(ctx.view, mptIssue, destination);
+        !isTesSuccess(ter))
+        return ter;
+
+    // todo: check zkproof. equality proof and range proof, combined or separate
+    // TBD. TER const terProof = verifyConfidentialSendProof(
+    //     ctx.tx[sfZKProof],
+    //     (*sleSender)[sfConfidentialBalanceSpending],
+    //     ctx.tx[sfSenderEncryptedAmount],
+    //     ctx.tx[sfDestinationEncryptedAmount],
+    //     ctx.tx[sfIssuerEncryptedAmount],
+    //     (*sleSender)[sfHolderElGamalPublicKey],
+    //     (*sleDestination)[sfHolderElGamalPublicKey],
+    //     (*sleIssuance)[sfIssuerElGamalPublicKey],
+    //     (*sleSender)[~sfConfidentialBalanceVersion].value_or(0),
+    //     ctx.tx.getTransactionID()
+    // );
+
+    // if (!isTesSuccess(terProof))
+    //     return tecBAD_PROOF;
+
+    return tesSUCCESS;
+}
+
+TER
+ConfidentialSend::doApply()
+{
+    auto const mptIssuanceID = ctx_.tx[sfMPTokenIssuanceID];
+    auto const destination = ctx_.tx[sfDestination];
+
+    auto sleSender = view().peek(keylet::mptoken(mptIssuanceID, account_));
+    auto sleDestination =
+        view().peek(keylet::mptoken(mptIssuanceID, destination));
+
+    auto sleDestAcct = view().peek(keylet::account(destination));
+
+    if (!sleSender || !sleDestination || !sleDestAcct)
+        return tecINTERNAL;
+
+    if (auto err = verifyDepositPreauth(
+            ctx_.tx,
+            ctx_.view(),
+            account_,
+            destination,
+            sleDestAcct,
+            ctx_.journal);
+        !isTesSuccess(err))
+        return err;
+
+    Slice const senderEc = ctx_.tx[sfSenderEncryptedAmount];
+    Slice const destEc = ctx_.tx[sfDestinationEncryptedAmount];
+    Slice const issuerEc = ctx_.tx[sfIssuerEncryptedAmount];
+
+    // Subtract from sender's spending balance
+    {
+        Slice const curSpending = (*sleSender)[sfConfidentialBalanceSpending];
+        Buffer newSpending(ecGamalEncryptedTotalLength);
+
+        if (TER const ter =
+                homomorphicSubtract(curSpending, senderEc, newSpending);
+            !isTesSuccess(ter))
+            return tecINTERNAL;
+
+        (*sleSender)[sfConfidentialBalanceSpending] = newSpending;
+    }
+
+    // Subtract from issuer's balance
+    {
+        Slice const curIssuerEnc = (*sleSender)[sfIssuerEncryptedBalance];
+        Buffer newIssuerEnc(ecGamalEncryptedTotalLength);
+
+        if (TER const ter =
+                homomorphicSubtract(curIssuerEnc, issuerEc, newIssuerEnc);
+            !isTesSuccess(ter))
+            return tecINTERNAL;
+
+        (*sleSender)[sfIssuerEncryptedBalance] = newIssuerEnc;
+    }
+
+    // Increment version
+    (*sleSender)[sfConfidentialBalanceVersion] =
+        (*sleSender)[~sfConfidentialBalanceVersion].value_or(0u) + 1u;
+
+    // Add to destination's inbox balance
+    {
+        Slice const curInbox = (*sleDestination)[sfConfidentialBalanceInbox];
+        Buffer newInbox(ecGamalEncryptedTotalLength);
+
+        if (TER const ter = homomorphicAdd(curInbox, destEc, newInbox);
+            !isTesSuccess(ter))
+            return tecINTERNAL;
+
+        (*sleDestination)[sfConfidentialBalanceInbox] = newInbox;
+    }
+
+    // Add to issuer's balance
+    {
+        Slice const curIssuerEnc = (*sleDestination)[sfIssuerEncryptedBalance];
+        Buffer newIssuerEnc(ecGamalEncryptedTotalLength);
+
+        if (TER const ter =
+                homomorphicAdd(curIssuerEnc, issuerEc, newIssuerEnc);
+            !isTesSuccess(ter))
+            return tecINTERNAL;
+
+        (*sleDestination)[sfIssuerEncryptedBalance] = newIssuerEnc;
+    }
+
+    view().update(sleSender);
+    view().update(sleDestination);
+    return tesSUCCESS;
+}
+}  // namespace ripple

src/xrpld/app/tx/detail/ConfidentialSend.h

@@ -0,0 +1,29 @@
+#ifndef XRPL_TX_CONFIDENTIALSEND_H_INCLUDED
+#define XRPL_TX_CONFIDENTIALSEND_H_INCLUDED
+
+#include <xrpld/app/tx/detail/Transactor.h>
+
+namespace ripple {
+
+class ConfidentialSend : public Transactor
+{
+public:
+    static constexpr ConsequencesFactoryType ConsequencesFactory{Normal};
+
+    explicit ConfidentialSend(ApplyContext& ctx) : Transactor(ctx)
+    {
+    }
+
+    static NotTEC
+    preflight(PreflightContext const& ctx);
+
+    static TER
+    preclaim(PreclaimContext const& ctx);
+
+    TER
+    doApply() override;
+};
+
+}  // namespace ripple
+
+#endif

src/xrpld/app/tx/detail/MPTokenAuthorize.cpp

@@ -74,6 +74,26 @@ MPTokenAuthorize::preclaim(PreclaimContext const& ctx)
                 sleMpt->isFlag(lsfMPTLocked))
                 return tecNO_PERMISSION;
 
+            if (ctx.view.rules().enabled(featureConfidentialTransfer))
+            {
+                auto const sleMptIssuance = ctx.view.read(
+                    keylet::mptIssuance(ctx.tx[sfMPTokenIssuanceID]));
+
+                // if there still existing encrypted balances of MPT in
+                // circulation
+                if (sleMptIssuance &&
+                    (*sleMptIssuance)[~sfConfidentialOutstandingAmount]
+                            .value_or(0) != 0)
+                {
+                    // this MPT still has encrypted balance, since we don't know
+                    // if it's non-zero or not, we won't allow deletion of
+                    // MPToken
+                    if (sleMpt->isFieldPresent(sfConfidentialBalanceInbox) ||
+                        sleMpt->isFieldPresent(sfConfidentialBalanceSpending))
+                        return tecHAS_OBLIGATIONS;
+                }
+            }
+
             return tesSUCCESS;
         }
 

src/xrpld/app/tx/detail/MPTokenIssuanceCreate.cpp

@@ -18,6 +18,16 @@ MPTokenIssuanceCreate::checkExtraFeatures(PreflightContext const& ctx)
         !ctx.rules.enabled(featureDynamicMPT))
         return false;
 
+    if (ctx.tx.isFlag(tfMPTCanPrivacy) &&
+        !ctx.rules.enabled(featureConfidentialTransfer))
+        return false;
+
+    // can not set tmfMPTCannotMutatePrivacy without featureConfidentialTransfer
+    auto const mutableFlags = ctx.tx[~sfMutableFlags];
+    if (mutableFlags && (*mutableFlags & tmfMPTCannotMutatePrivacy) &&
+        !ctx.rules.enabled(featureConfidentialTransfer))
+        return false;
+
     return true;
 }
 

src/xrpld/app/tx/detail/MPTokenIssuanceSet.cpp

@@ -28,22 +28,41 @@ struct MPTMutabilityFlags
 {
     std::uint32_t setFlag;
     std::uint32_t clearFlag;
-    std::uint32_t canMutateFlag;
+    std::uint32_t mutabilityFlag;
+    std::uint32_t targetFlag;
+    bool isCannotMutate = false;  // if true, cannot mutate by default.
 };
 
-static constexpr std::array<MPTMutabilityFlags, 6> mptMutabilityFlags = {
-    {{tmfMPTSetCanLock, tmfMPTClearCanLock, lsmfMPTCanMutateCanLock},
+static constexpr std::array<MPTMutabilityFlags, 7> mptMutabilityFlags = {
+    {{tmfMPTSetCanLock,
+      tmfMPTClearCanLock,
+      lsmfMPTCanMutateCanLock,
+      lsfMPTCanLock},
      {tmfMPTSetRequireAuth,
       tmfMPTClearRequireAuth,
-      lsmfMPTCanMutateRequireAuth},
-     {tmfMPTSetCanEscrow, tmfMPTClearCanEscrow, lsmfMPTCanMutateCanEscrow},
-     {tmfMPTSetCanTrade, tmfMPTClearCanTrade, lsmfMPTCanMutateCanTrade},
+      lsmfMPTCanMutateRequireAuth,
+      lsfMPTRequireAuth},
+     {tmfMPTSetCanEscrow,
+      tmfMPTClearCanEscrow,
+      lsmfMPTCanMutateCanEscrow,
+      lsfMPTCanEscrow},
+     {tmfMPTSetCanTrade,
+      tmfMPTClearCanTrade,
+      lsmfMPTCanMutateCanTrade,
+      lsfMPTCanTrade},
      {tmfMPTSetCanTransfer,
       tmfMPTClearCanTransfer,
-      lsmfMPTCanMutateCanTransfer},
+      lsmfMPTCanMutateCanTransfer,
+      lsfMPTCanTransfer},
      {tmfMPTSetCanClawback,
       tmfMPTClearCanClawback,
-      lsmfMPTCanMutateCanClawback}}};
+      lsmfMPTCanMutateCanClawback,
+      lsfMPTCanClawback},
+     {tmfMPTSetPrivacy,
+      tmfMPTClearPrivacy,
+      lsmfMPTCannotMutatePrivacy,
+      lsfMPTCanPrivacy,
+      true}}};
 
 NotTEC
 MPTokenIssuanceSet::preflight(PreflightContext const& ctx)
@@ -52,14 +71,34 @@ MPTokenIssuanceSet::preflight(PreflightContext const& ctx)
     auto const metadata = ctx.tx[~sfMPTokenMetadata];
     auto const transferFee = ctx.tx[~sfTransferFee];
     auto const isMutate = mutableFlags || metadata || transferFee;
+    auto const hasElGamalKey = ctx.tx.isFieldPresent(sfIssuerElGamalPublicKey);
+    auto const txFlags = ctx.tx.getFlags();
+
+    auto const mutatePrivacy = mutableFlags &&
+        ((*mutableFlags & (tmfMPTSetPrivacy | tmfMPTClearPrivacy)));
+
+    auto const hasDomain = ctx.tx.isFieldPresent(sfDomainID);
+    auto const hasHolder = ctx.tx.isFieldPresent(sfHolder);
 
     if (isMutate && !ctx.rules.enabled(featureDynamicMPT))
         return temDISABLED;
 
-    if (ctx.tx.isFieldPresent(sfDomainID) && ctx.tx.isFieldPresent(sfHolder))
+    if ((hasElGamalKey || mutatePrivacy) &&
+        !ctx.rules.enabled(featureConfidentialTransfer))
+        return temDISABLED;
+
+    if (hasDomain && hasHolder)
         return temMALFORMED;
 
-    auto const txFlags = ctx.tx.getFlags();
+    if (mutatePrivacy && hasHolder)
+        return temMALFORMED;
+
+    if (hasElGamalKey && hasHolder)
+        return temMALFORMED;
+
+    if (hasElGamalKey &&
+        ctx.tx[sfIssuerElGamalPublicKey].length() != ecPubKeyLength)
+        return temMALFORMED;
 
     // fails if both flags are set
     if ((txFlags & tfMPTLock) && (txFlags & tfMPTUnlock))
@@ -71,10 +110,11 @@ MPTokenIssuanceSet::preflight(PreflightContext const& ctx)
         return temMALFORMED;
 
     if (ctx.rules.enabled(featureSingleAssetVault) ||
-        ctx.rules.enabled(featureDynamicMPT))
+        ctx.rules.enabled(featureDynamicMPT) ||
+        ctx.rules.enabled(featureConfidentialTransfer))
     {
         // Is this transaction actually changing anything ?
-        if (txFlags == 0 && !ctx.tx.isFieldPresent(sfDomainID) && !isMutate)
+        if (txFlags == 0 && !hasDomain && !hasElGamalKey && !isMutate)
             return temMALFORMED;
     }
 
@@ -216,16 +256,32 @@ MPTokenIssuanceSet::preclaim(PreclaimContext const& ctx)
         return currentMutableFlags & mutableFlag;
     };
 
-    if (auto const mutableFlags = ctx.tx[~sfMutableFlags])
+    auto const mutableFlags = ctx.tx[~sfMutableFlags];
+    if (mutableFlags)
     {
         if (std::any_of(
                 mptMutabilityFlags.begin(),
                 mptMutabilityFlags.end(),
                 [mutableFlags, &isMutableFlag](auto const& f) {
-                    return !isMutableFlag(f.canMutateFlag) &&
-                        ((*mutableFlags & (f.setFlag | f.clearFlag)));
+                    bool const canMutate = f.isCannotMutate
+                        ? isMutableFlag(f.mutabilityFlag)
+                        : !isMutableFlag(f.mutabilityFlag);
+                    return canMutate &&
+                        (*mutableFlags & (f.setFlag | f.clearFlag));
                 }))
             return tecNO_PERMISSION;
+
+        if ((*mutableFlags & tmfMPTSetPrivacy) ||
+            (*mutableFlags & tmfMPTClearPrivacy))
+        {
+            std::uint64_t const confidentialOA =
+                (*sleMptIssuance)[~sfConfidentialOutstandingAmount].value_or(0);
+
+            // If there's any confidential outstanding amount, disallow toggling
+            // the lsfMPTCanPrivacy flag
+            if (confidentialOA > 0)
+                return tecNO_PERMISSION;
+        }
     }
 
     if (!isMutableFlag(lsmfMPTCanMutateMetadata) &&
@@ -245,6 +301,19 @@ MPTokenIssuanceSet::preclaim(PreclaimContext const& ctx)
             return tecNO_PERMISSION;
     }
 
+    // cannot update public key
+    if (ctx.tx.isFieldPresent(sfIssuerElGamalPublicKey) &&
+        sleMptIssuance->isFieldPresent(sfIssuerElGamalPublicKey))
+    {
+        return tecNO_PERMISSION;
+    }
+
+    if (ctx.tx.isFieldPresent(sfIssuerElGamalPublicKey) &&
+        !sleMptIssuance->isFlag(lsfMPTCanPrivacy))
+    {
+        return tecNO_PERMISSION;
+    }
+
     return tesSUCCESS;
 }
 
@@ -278,9 +347,9 @@ MPTokenIssuanceSet::doApply()
         for (auto const& f : mptMutabilityFlags)
         {
             if (mutableFlags & f.setFlag)
-                flagsOut |= f.canMutateFlag;
+                flagsOut |= f.targetFlag;
             else if (mutableFlags & f.clearFlag)
-                flagsOut &= ~f.canMutateFlag;
+                flagsOut &= ~f.targetFlag;
         }
 
         if (mutableFlags & tmfMPTClearCanTransfer)
@@ -332,6 +401,16 @@ MPTokenIssuanceSet::doApply()
         }
     }
 
+    if (auto const pubKey = ctx_.tx[~sfIssuerElGamalPublicKey])
+    {
+        // This is enforced in preflight.
+        XRPL_ASSERT(
+            sle->getType() == ltMPTOKEN_ISSUANCE,
+            "MPTokenIssuanceSet::doApply : modifying MPTokenIssuance");
+
+        sle->setFieldVL(sfIssuerElGamalPublicKey, *pubKey);
+    }
+
     view().update(sle);
 
     return tesSUCCESS;