Data Structures for Private Token Transfers in TEE-Based Networks

Benjamin Adams; Blake Regalia

REVIEW 3 major objections 4 minor 25 references

Data Structures for Private Token Transfers in TEE-Based Networks

T0 review · 3 major / 4 minor · reviewed 2026-07-11 · grok-4.5

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Domain-specific buffers and bucketed tries break sender-recipient links in TEE token transfers by delaying and randomizing storage writes, at roughly 26 percent gas overhead.

desk verdict Practical, already-deployed fix for TEE token access-pattern leaks; anonymity is real but traffic-dependent and the settling model is idealized. read the letter →

arxiv 2607.04032 v1 pith:EOVTHI2W submitted 2026-07-04 cs.CR

Blake Regalia , Benjamin Adams This is my paper · ORCID

classification cs.CR

keywords privatetokentransfersTEEsmartcontractsstorageaccesspatternsDelayedWriteBufferbucketedbalanceswrite-onlyORAMconfidentialnotificationsSecretNetwork

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

TEE confidential smart contracts encrypt data but still leak who paid whom: when a transfer updates a recipient's balance, the unique storage key that is touched reveals the relationship. This paper shows that two purpose-built structures solve the leak for the common case of token transfers. A Delayed Write Buffer holds pending recipient credits and settles a random entry later, so the write no longer coincides with the transfer that created it; a Bitwise-Trie of constant-size address buckets further hides which balance is touched and blocks flooding attacks. Because token transfers are asymmetric (senders must be checked immediately, recipients can wait) and tolerate delayed settlement, the design stays practical: a reference implementation raised gas by about 26 percent, upgraded forty-two mainnet tokens securing more than ten million dollars, and supplies probabilistic anonymity sets whose size grows with subsequent transfer volume. A matching private-notification channel lets recipients learn of credits without polling or revealing identity.

What carries the argument

The Delayed Write Buffer (DWB): a fixed-capacity table that is fully read and rewritten on every transfer, accumulates repeated credits to the same recipient, and settles a privately chosen random entry (or performs a matching phony write) so that recipient storage is never touched at the moment of the transfer; complemented by the Bitwise-Trie of Bucketed Entries (BTBE) that places balances into constant-size anonymity sets.

What would settle it

On a live network running the DWB with known capacity k, measure the fraction of transfers whose recipient storage key is first accessed within n subsequent executions; if that fraction systematically exceeds the claimed geometric probability 1-((k-1)/k)^n under normal load, the privacy claim fails.

Watch

Extended reading notes

Core claim

Storage-access-pattern attacks that link senders and recipients of encrypted token transfers can be defeated, with practical overhead, by a fixed-width Delayed Write Buffer that randomly settles distinct recipient entries together with a Bitwise-Trie that stores balances in constant-size address buckets; the combination yields probabilistic anonymity sets whose size is governed by the geometric settling probability and has already been deployed on mainnet.

Load-bearing premise

The anonymity set stays large only while the buffer remains full and later transfer volume is high enough that the chance an entry has settled stays uncertain; quiet periods shrink that set and weaken the guarantee.

Editorial extensions

If this is right

Token contracts on TEE platforms can stop linking senders to recipients via storage keys without switching to general ORAM or multi-round protocols.
Existing SNIP-20-style interfaces remain usable; only the internal storage layout changes, so wallets and dApps need no rewrite.
Gas cost rises by a fixed, predictable factor (observed worst-case ~26 percent), making the privacy upgrade affordable for high-value bridged assets.
Recipients can receive real-time push notifications of credits without revealing their identity or forcing nodes to be polled.
Flooding and flush attacks that previously emptied anonymity sets are blocked by accumulation and constant-size buckets.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

The same asymmetric-buffer idea could be reused for other one-way state updates (allowances, escrow releases, NFT ownership) where only one party must be checked immediately.
Adaptive buffer resizing or quiet-period decoy traffic would be a natural next engineering step once low-activity degradation is observed in production.
Because the structures live entirely inside the contract, they remain portable to any TEE chain that already encrypts its key-value store.
Combining the DWB with a lightweight zk audit of the settlement stream could give stronger public verifiability without restoring access-pattern leakage.

Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

The one thing to know is that this is a working systems fix for the sender-recipient linkage attack Jean et al. showed on Secret Network SNIP-20 tokens. Instead of decoys or full ORAM they built two domain-specific structures that exploit the fact that token transfers are asymmetric and can tolerate delayed settlement of the recipient side.

What is new is the Delayed Write Buffer: a fixed-width table that is fully read/written every transfer, with random private settlement of one entry to make room, accumulation of repeats to the same recipient, and phony writes so the storage pattern stays constant whether or not a real settle or owner entry exists. The BTBE then buckets balances under a secret-keyed bitwise trie so even the eventual settle hits a constant-size anonymity set rather than a single key. They also specify a clean private push-notification scheme using seeds, counters/TxHash/Bloom modes, and constant-size padded events. The math for ideal settling probability is elementary and correct; they give the closed form and the n≈336 figure for 99.5 % at k=64. Gas is measured at +26 % worst-case, and they actually upgraded 42 mainnet tokens covering >$10 M with a lazy migration. That is real evidence.

The soft spot the stress-test correctly flags is that the geometric model assumes every subsequent transfer settles a uniform random entry. In the actual rules a settle only occurs on insertion of a new distinct recipient (or forced owner settle); accumulation plus phony writes suppress eviction. Effective rate can therefore be lower than 1/k, and low organic volume lets an adversary dominate unknown slots more easily. The paper itself notes the low-activity weakening in §6.5 but supplies neither a refined model with insertion fraction nor mainnet measurements of realized n. Query privacy is only partially addressed and there is no game-based definition. These are genuine limitations for a systems paper, not fatal ones; the constructions still break the direct correlation that existed before.

This is for people building or auditing confidential contracts on Secret/Oasis/Phala-style platforms, or anyone looking for lightweight write-only alternatives to ORAM on asymmetric workloads. The thinking is clear, the requirements R1–R6 are honest, and the deployment data is concrete. I would bring it to a systems reading group, cite the DWB/BTBE constructions if I work in the area, and I would definitely send it to peer review rather than desk-reject.

Referee Report

3 major / 4 minor

Summary. The paper addresses storage-access-pattern linkage of senders and recipients in TEE-based confidential token contracts (e.g., Secret Network SNIP-20). It introduces two domain-specific structures: the Delayed Write Buffer (DWB), a fixed-capacity table that buffers pending recipient updates and randomly settles one entry per transfer once saturated, and the Bitwise-Trie of Bucketed Entries (BTBE), which groups balances/histories into constant-size buckets under a secret-keyed hash trie. Together with phony writes, constant-time search, accumulation of repeated recipients, and a private push-notification scheme (Counter/TxHash/Bloom modes), the design aims to break direct storage-key correlation while preserving the ERC-20-like interface. A reference implementation was deployed to 42 mainnet tokens securing >USD 10 M, with measured worst-case gas overhead of 26 % relative to the naïve baseline. Privacy is claimed via the elementary geometric settling probability 1-((k-1)/k)^n (illustrated for k=64 yielding n≈336 at 99.5 % confidence).

Significance. If the probabilistic unlinkability holds under realistic traffic, the work supplies a practical, low-overhead alternative to full ORAM for the narrow but economically important case of token transfers. Strengths include a live mainnet deployment, open reference code, explicit constant-time and phony-write rules that address the stated side-channel requirements (R4–R5), and a complementary notification system that removes polling. The domain-specific exploitation of asymmetric balance updates and delayed settlement is a genuine engineering contribution that existing general-purpose ORAM literature does not target. The result is therefore of immediate interest to TEE-based programmable-privacy platforms even if the anonymity analysis remains conditional.

major comments (3)

[§3.9 / Fig. 3] §3.9 and Fig. 3 present the settling probability P=1-((k-1)/k)^n under the modelling assumption that every subsequent transfer independently selects a uniform random buffer entry to settle. Requirements R2–R3 and §3.4, however, state that an entry is settled only when a new distinct recipient must be inserted (accumulation otherwise occurs in place, and phony writes are used). Consequently the effective per-execution settling rate is the insertion fraction f≤1/k, not 1/k; the claimed anonymity-set sizes (e.g., n=336 for 99.5 % confidence at k=64) are therefore optimistic. A refined expression that incorporates f, or at least a mainnet measurement of realised settlement intervals, is required before the quantitative privacy claim can be accepted.
[§2 Requirements / §6.3] The security argument is given only as an informal list of requirements R1–R6 and the geometric formula. No game-based definition of unlinkability (or even a precise adversary model that captures adaptive flush/flooding attacks under partial buffer knowledge) appears, nor is there a reduction showing that the DWB+BTBE construction meets such a definition. Without this, it is impossible to assess whether the constant-time and phony-write mechanisms close all side channels that a network-level observer can exploit.
[§6.5] §6.5 correctly notes that low-activity periods shrink settlement intervals and weaken anonymity, yet the paper supplies neither an adaptive buffer-resizing mechanism nor any empirical distribution of inter-settlement times drawn from the 42 upgraded mainnet tokens. Because the central quantitative claim rests on sustained high volume, this omission leaves the practical privacy guarantee unsubstantiated.

minor comments (4)

[§4 / §6.2] The BTBE rebalancing example (Fig. 4) is helpful, but the text never states the concrete bucket capacity used in the mainnet deployment or the resulting worst-case trie height; both affect the gas figures reported in §6.2.
[§3.3] Notation for the owner versus message sender is introduced late (§3.3 footnote); a short glossary or earlier definition would improve readability.
[§5.3 / Appendix A] Appendix A algorithms are useful, yet the main text never cross-references the precise nonce-construction or AAD choices that prevent traffic analysis; a one-sentence pointer would help.
[§1.1] Several references (e.g., [15] Jean-Louis et al.) are cited for the original access-pattern attack; a short comparison table of gas and anonymity-set size versus the decoy and ORAM alternatives they proposed would strengthen the related-work discussion.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity: anonymity probabilities follow from an explicit free design parameter k under a stated random-eviction model; nothing is fitted then re-presented as a prediction.

full rationale

The paper’s load-bearing privacy claim is the geometric settling probability P = 1-((k-1)/k)^n (Section 3.9, Figure 3) and the resulting anonymity-set sizes (e.g., n≈336 for 99.5% at k=64). That formula is the direct mathematical consequence of the stated mechanism—uniform random selection of one of k buffer slots on each subsequent transfer—not a quantity fitted to data and then “predicted.” Buffer width k is an explicit free design choice, not derived from the privacy claim itself. The DWB/BTBE constructions are motivated by domain requirements R1–R6 and by prior ORAM literature (Path ORAM, WO-ORAM, Burst ORAM) that the authors do not claim as their own uniqueness theorems; there is no self-citation chain that forces the result. Gas overhead (~26%) and mainnet deployment figures are empirical measurements, not circular re-labelings of inputs. Modeling caveats (accumulation, low-volume periods, §6.5) affect whether the geometric model holds in practice; they are correctness/assumption issues, not definitional circularity. The derivation is therefore self-contained against its own stated premises.

Assumptions & free parameters 2 free parameters · 4 assumptions · 2 invented entities

The privacy claim rests on a small set of domain assumptions about TEEs and private randomness, plus two free design parameters (buffer width and bucket size) chosen for engineering convenience. No new physical or cryptographic primitives are postulated; DWB and BTBE are pure data-structure inventions whose security reduces to the stated axioms.

free parameters (2)

DWB capacity k = 64 (example)
Chosen by the implementer (example k=64); directly controls the anonymity-set size via the settling formula and the fixed gas overhead.
BTBE bucket capacity
Constant size of each leaf table; trades storage and rebalance frequency against anonymity-set size for balance writes.

assumptions (4)

domain assumption The TEE enclave and its sealed storage are trusted; an observer outside the enclave sees only which encrypted keys are accessed, not plaintext.
Stated throughout the introduction and threat model; without it access-pattern privacy is meaningless.
domain assumption Secret VRF (or equivalent private randomness) supplies an unpredictable, unbiasable index for buffer eviction on every execution.
Required for the random-settlement step of DWB (Section 3); if the index is predictable the attacker can force settlement of chosen entries.
domain assumption Token recipients tolerate delayed settlement of incoming balances (asymmetric update).
Core domain insight used to justify buffering rather than immediate ORAM writes (Section 1.2).
ad hoc to paper All pre-settlement operations (search, accumulation, phony-write selection) execute in constant time independent of buffer contents.
Requirement R4; the paper asserts constant-time search but does not supply a machine-checked constant-time proof.

invented entities (2)

Delayed Write Buffer (DWB)
purpose: Fixed-width encrypted table that absorbs recipient credits and randomly settles one entry per transfer, breaking immediate access-pattern linkage.
Novel data structure introduced in Section 3; security reduces to private randomness and constant-time operations rather than a new hardness assumption.
Bitwise-Trie of Bucketed Entries (BTBE)
purpose: Secret-keyed trie that groups addresses into constant-size buckets so that balance writes reveal only an anonymity set of size equal to the bucket capacity.
Novel secondary structure of Section 4; independent of DWB but complementary.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Data Structures for Private Token Transfers in TEE-Based Networks." pith.science (2026). https://pith.science/paper/EOVTHI2W

@misc{pith2026260704032,
  author       = {Pith},
  title        = {Pith review of: Data Structures for Private Token Transfers in TEE-Based Networks},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/EOVTHI2W}},
  note         = {Machine review of arXiv:2607.04032}
}

read the original abstract

Trusted execution environment (TEE) based confidential smart contract networks promise privacy but remain vulnerable to storage access pattern attacks that can link senders and recipients in token transfers. When contracts update recipient balances during transfers, the unique storage keys accessed reveal transaction relationships even when data is encrypted. This paper introduces two novel data structures to address this vulnerability: the Delayed Write Buffer (DWB) and the Bitwise-Trie of Bucketed Entries (BTBE). The DWB delays recipient balance updates by buffering pending transfers and randomly settling entries, breaking the direct correlation between transfer execution and recipient storage access. The BTBE further enhances privacy by grouping addresses into constant-sized buckets, preventing flooding attacks and creating anonymity sets for balance queries. Additionally, we present a private notification system enabling real-time, privacy-preserving push notifications for confidential contracts. Our domain-specific approach leverages the unique characteristics of token transfers -- asymmetric balance updates and tolerance for delayed settlement -- to achieve practical performance with probabilistic anonymity guarantees.

Figures

Figures reproduced from arXiv: 2607.04032 by the authors.

**Figure 1.** An example transaction using a DWB, showing the order of read/write storage access operations. Notice how Bob’s entry was randomly selected from the buffer to be settled in order to insert the new entry for Carol. First, a new transfer event is saved to storage, keyed by a globally unique transfer event ID. Next, the contract loads the entire DWB from storage, selects an entry at random, and settles it. At this poin… view at source ↗

**Figure 2.** Repeated transfers to the same recipient accumulate in a linked list of transaction events per DWB entry. Notice how insertions do not dereference previous items in the list. Thus, updating the list does not produce storage access patterns. With this approach, an entry in the DWB can accumulate events ad infinitum. The storage areas associated with transaction history events are only ever accessed a single time ac… view at source ↗

**Figure 3.** Probability a transfer has settled, and thus the recipient’s storage area has been accessed, after n subsequent transfer executions. 4 Bitwise-Trie of Bucketed Entries (BTBE) We introduce a secondary data structure to improve the privacy of accessing users’ stored balances during token transfers, complementing the benefits described above from the DWB. The Bitwise-Trie of Bucketed Entries (BTBE) manages a tree of c… view at source ↗

Figures from the paper (1 more)

**Figure 4.** Figure 4: Example of inserting a new entry in the BTBE. 1. Bucket #0 is full, resulting in a leaf node split. 2. The inserted entry’s hash routes it to Bucket #0, which is again full, resulting in another leaf node split. 3. The inserted entry’s hash routes it to Bucket #2, whic…

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

25 extracted references · 1 canonical work pages

[1]

In: Annual international cryptology conference

Bellare, M., Canetti, R., Krawczyk, H.: Keying hash functions for message au- thentication. In: Annual international cryptology conference. pp. 1–15. Springer (1996)

1996
[2]

Cryptology ePrint Archive (2024)

Benarroch, D., Gillespie, B., Lai, Y.T., Miller, A.: SoK: Programmable privacy in distributed systems. Cryptology ePrint Archive (2024)

2024
[3]

Bernstein, D.J.: Cache-timing attacks on AES (2005), retrieved from https://paperhub.s3.amazonaws.com/4089cd9ff9eb1087b12e16977d4c2ac0.pdf

2005
[4]

In: International workshop on fast software encryption

Bernstein, D.J.: The poly1305-aes message-authentication code. In: International workshop on fast software encryption. pp. 32–49. Springer (2005)

2005
[5]

Commu- nications of the ACM13(7), 422–426 (1970)

Bloom, B.H.: Space/time trade-offs in hash coding with allowable errors. Commu- nications of the ACM13(7), 422–426 (1970)

1970
[6]

Brown, D.R.L.: SEC 2: Recommended elliptic curve domain parameters (2010), https://www.secg.org/sec2-v2.pdf

2010
[7]

Buchman, E.: Tendermint: Byzantine fault tolerance in the age of blockchains. Ph.D. thesis, University of Guelph (2016)

2016
[8]

arXiv preprint arXiv:1804.05141 (2018)

Cheng, R., Zhang, F., Kos, J., He, W., Hynes, N., Johnson, N., Juels, A., Miller, A., Song, D.: Ekiden: A platform for confidentiality-preserving, trustworthy, and performant smart contract execution. arXiv preprint arXiv:1804.05141 (2018)

arXiv 2018

Show all 25 references

[9]

In: 23rd USENIX Security Symposium (USENIX Security 14)

Dautrich, J., Stefanov, E., Shi, E.: Burst ORAM: Minimizing ORAM response times for bursty access patterns. In: 23rd USENIX Security Symposium (USENIX Security 14). pp. 749–764 (2014)

2014
[10]

In: 2021 IEEE international conference on blockchain (blockchain)

Desai, H., Kantarcioglu, M.: Secauctee: securing auction smart contracts us- ing trusted execution environments. In: 2021 IEEE international conference on blockchain (blockchain). pp. 448–455. IEEE (2021)

2021
[11]

ACM computing surveys (CSUR)35(2), 114–131 (2003)

Eugster, P.T., Felber, P.A., Guerraoui, R., Kermarrec, A.M.: The many faces of publish/subscribe. ACM computing surveys (CSUR)35(2), 114–131 (2003)

2003
[12]

In: Proceedings of the nineteenth annual ACM symposium on Theory of computing

Goldreich, O.: Towards a theory of software protection and simulation by oblivious RAMs. In: Proceedings of the nineteenth annual ACM symposium on Theory of computing. pp. 182–194 (1987)

1987
[13]

Journal of the ACM (JACM)43(3), 431–473 (1996)

Goldreich, O., Ostrovsky, R.: Software protection and simulation on oblivious RAMs. Journal of the ACM (JACM)43(3), 431–473 (1996)

1996
[14]

In: Network and Distributed Sys- tem Security (NDSS) Symposium

Islam, M.S., Kuzu, M., Kantarcioglu, M.: Access pattern disclosure on searchable encryption: Ramification, attack and mitigation. In: Network and Distributed Sys- tem Security (NDSS) Symposium. vol. 20, p. 12 (2012)

2012
[15]

Proceedings on Privacy Enhancing Technologies2024, 617–634 (2024)

Jean-Louis, N., Li, Y., Ji, Y., Malvai, H., Yurek, T., Bellemare, S., Miller, A.: SGXonerated: Finding (and partially fixing) privacy flaws in TEE-based smart contract platforms without breaking the TEE. Proceedings on Privacy Enhancing Technologies2024, 617–634 (2024). https:...

2024 doi
[16]

In: Annual international cryptology conference

Kocher, P., Jaffe, J., Jun, B.: Differential power analysis. In: Annual international cryptology conference. pp. 388–397. Springer (1999)

1999
[17]

In: Annual Cryptology Conference

Krawczyk, H.: Cryptographic extraction and key derivation: The hkdf scheme. In: Annual Cryptology Conference. pp. 631–648. Springer (2010)

2010
[18]

Proceedings on Privacy Enhancing Technologies3, 711–731 (2022)

Li, R., Wang, Q., Wang, Q., Galindo, D., Ryan, M.: SoK: TEE-assisted confidential smart contract. Proceedings on Privacy Enhancing Technologies3, 711–731 (2022)

2022
[19]

Journal of the ACM (JACM)15(4), 514–534 (1968)

Morrison, D.R.: PATRICIA-practical algorithm to retrieve information coded in alphanumeric. Journal of the ACM (JACM)15(4), 514–534 (1968)

1968
[20]

In: Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security

Roche, D.S., Aviv, A., Choi, S.G., Mayberry, T.: Deterministic, stash-free write- only ORAM. In: Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security. pp. 507–521 (2017) Data Structures for Private Token Transfers in TEE-Based Networks 17

2017
[21]

IEEE Security & Privacy21(4), 94–98 (2023)

Smart, N.: Computing on encrypted data. IEEE Security & Privacy21(4), 94–98 (2023)

2023
[22]

In: Proceedings of the 2013 ACM SIGSAC conference on Computer & communications security

Stefanov, E., van Dijk, M., Shi, E., Fletcher, C., Ren, L., Yu, X., Devadas, S.: Path ORAM: an extremely simple oblivious RAM protocol. In: Proceedings of the 2013 ACM SIGSAC conference on Computer & communications security. pp. 299–310 (2013)

2013
[23]

In: Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security

Wang, X., Chan, H., Shi, E.: Circuit oram: On tightness of the goldreich-ostrovsky lower bound. In: Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security. pp. 850–861 (2015)

2015
[24]

Woetzel, C.: Secret network: A privacy-preserving secret contract & decentral- ized application platform (2021), https://www.cryptowhitepapersonline.com/wp- content/uploads/2023/08/secret.pdf

2021
[25]

contract_internal_secret

Yin, H., Zhou, S., Jiang, J.: Phala network: A confidential smart contract network based on polkadot. Phala Network (2019) A Private notification algorithms A.1 Contract internal secret derivation Contract initialization must establish an internal secret with high entropy, un-...

2019

Pith tools

Reviewed July 11, 2026 · model on record in the stance chip above.

[1] [1]

In: Annual international cryptology conference

Bellare, M., Canetti, R., Krawczyk, H.: Keying hash functions for message au- thentication. In: Annual international cryptology conference. pp. 1–15. Springer (1996)

1996

[2] [2]

Cryptology ePrint Archive (2024)

Benarroch, D., Gillespie, B., Lai, Y.T., Miller, A.: SoK: Programmable privacy in distributed systems. Cryptology ePrint Archive (2024)

2024

[3] [3]

Bernstein, D.J.: Cache-timing attacks on AES (2005), retrieved from https://paperhub.s3.amazonaws.com/4089cd9ff9eb1087b12e16977d4c2ac0.pdf

2005

[4] [4]

In: International workshop on fast software encryption

Bernstein, D.J.: The poly1305-aes message-authentication code. In: International workshop on fast software encryption. pp. 32–49. Springer (2005)

2005

[5] [5]

Commu- nications of the ACM13(7), 422–426 (1970)

Bloom, B.H.: Space/time trade-offs in hash coding with allowable errors. Commu- nications of the ACM13(7), 422–426 (1970)

1970

[6] [6]

Brown, D.R.L.: SEC 2: Recommended elliptic curve domain parameters (2010), https://www.secg.org/sec2-v2.pdf

2010

[7] [7]

Buchman, E.: Tendermint: Byzantine fault tolerance in the age of blockchains. Ph.D. thesis, University of Guelph (2016)

2016

[8] [8]

arXiv preprint arXiv:1804.05141 (2018)

Cheng, R., Zhang, F., Kos, J., He, W., Hynes, N., Johnson, N., Juels, A., Miller, A., Song, D.: Ekiden: A platform for confidentiality-preserving, trustworthy, and performant smart contract execution. arXiv preprint arXiv:1804.05141 (2018)

arXiv 2018