Helius encrypts Solana transfers without removing operator trust

Helius launched its permissionless Privacy Ring on Solana mainnet on Nov. 10 with encrypted payment assets and amounts, while sender and recipient wallet addresses remain visible.

Its documented default prover, the service that constructs zero-knowledge proofs, adds a hardware requirement where secret transaction inputs are processed inside an attested AWS Nitro enclave, an isolated computing environment.

Solana can check that a transfer satisfies the protocol’s rules, but protecting the inputs while that proof is made depends on the prover’s isolation, code, and deployment policies.

The practical question for wallet developers integrating the launch is which of those protections their software can verify.

Helius’s wallet integration guide says proof generation needs plaintext inputs covering the complete transaction data and nullifier keys. It identifies an attested AWS Nitro enclave as the SDKs’ default prover.

The protocol specification lists private inputs including the asset, amount, blinding values, and nullifier secret for notes being spent, along with paths proving those notes belong to the state tree. The proof also includes output assets, amounts, and blinding values.

Those inputs become readable to the proving code inside the enclave, and the documented client protects them from the host operator by encrypting requests to a key held by the attested enclave.

The nullifier secret also derives the markers used to prevent repeat spending. In the native wallet integration, the wallet retains the signing key, and the TypeScript SDK leaves signing of the finished Solana transaction with the application’s signer.

Helius documents local decryption, which keeps the viewing key on the device, and delegated decryption, which shares a viewing key with an authorized provider. Delegation gives that provider read access to balances and history, without granting spending authority.

AWS describes Nitro Enclaves as isolated environments whose memory the parent instance’s processes or administrators cannot access. Enclaves have no persistent storage, interactive access, or external networking.

AWS’s signed document contains cryptographic fingerprints of its image and software. The documented Privacy Rings checks verify the certificate chain, challenge response and freshness, approved measurements, and the binding of the request-encryption key.

The tagged SDK refuses a remote prover request without one, before making an HTTP call. A wallet can pin a reviewed release policy or use a network policy authenticated by the SDK’s pinned signers. Signed policies refresh during attestation and expire after use.