Zero-Knowledge Solvency: Protecting Household Energy Privacy with Bulletproofs
How Pedersen commitments and range proofs allow households to trade surplus solar energy and verify solvency without exposing raw consumption data.
“A household should be able to prove it can pay its energy bill without revealing how much power its children's bedrooms consume at 2 AM.”
The Privacy Problem in Prosumer Markets
Smart-meter data collected at 10-second resolution reveals intimate details of household life: when people wake up, when appliances run, whether the home is occupied. In a prosumer energy market where households trade surplus solar generation directly with neighbours, broadcasting raw energy balances would expose consumption patterns to every market participant. This is not a theoretical concern — academic studies have shown that 15-minute smart-meter readings allow accurate inference of occupancy patterns, appliance types, and even demographic characteristics. A cryptographically sound privacy layer is therefore not optional; it is a precondition for household participation in prosumer markets.
Pedersen Commitments
A Pedersen commitment to a value v with blinding factor r is C = v·G + r·H, where G and H are independent generator points on an elliptic curve. The commitment is perfectly hiding (the same value committed with a different r is computationally indistinguishable) and computationally binding (finding two values that produce the same commitment requires solving the discrete logarithm problem). In the energy market context, each household commits to its net energy balance b ∈ ℤ without revealing b. The settlement protocol then operates on commitments: C_1 + C_2 = (v_1 + v_2)·G + (r_1 + r_2)·H, preserving additive homomorphism so that the grid operator can verify that total injections balance total consumption.
Bulletproofs for Range Verification
Pedersen commitments alone do not prevent a household from claiming a negative energy balance (effectively counterfeiting energy credits). Range proofs are required to verify that the committed value v ∈ [0, 2^n) without revealing v. Bulletproofs (Bünz et al., 2018) achieve this with proof size O(log n) and verification time O(n), making them practical for 64-bit energy values. The Bulletproof inner-product argument reduces the range check v = Σ_{i=0}^{n-1} a_i · 2^i, a_i ∈ {0,1} to a single scalar product verification, compressing what would be n individual bit-range proofs into a single 675-byte proof regardless of n.
Solvency Without Disclosure
Solvency in the energy market means: at settlement, the household's committed energy balance is non-negative (it has not consumed more than it generated plus purchased). To prove solvency without revealing the balance, the household publishes a Pedersen commitment C = b·G + r·H together with a Bulletproof range proof attesting b ≥ 0. The settlement smart contract (or verifier node) checks the proof in O(log b_max) time. If the proof passes, the household is solvent. Crucially, the verifier learns nothing about b beyond the fact that it is non-negative — the same assurance a bank provides when it confirms your account is in credit without showing your statement.
Stub Status and Roadmap
The ZK solvency module in Sovereign-AMM is currently a typed stub (engine/stubs/crypto_zk_proofs.py) that raises NotImplementedError with a full docstring describing the commitment and proof interfaces. The interface is: commit(value: int, blinding: int) → bytes, prove_range(commitment: bytes, value: int, blinding: int, n_bits: int) → bytes, and verify_range(commitment: bytes, proof: bytes, n_bits: int) → bool. A full implementation would depend on a Rust Bulletproofs library via PyO3 bindings — outside the scope of the current Python-only constraint. The ADR at docs/adr/002-zk-solvency-design.md records this decision and provides the integration plan for a future production deployment.