Helius launched confidential transfers on Solana mainnet, hiding assets and amounts while leaving wallet addresses visible. The default prover handles secret inputs inside an AWS Nitro enclave, so privacy still depends on code review and deployment policy.
Helius launched its permissionless Privacy Ring on Solana mainnet on Nov. 10, encrypting payment assets and amounts. Sender and recipient wallet addresses remain visible.
The documented default prover, the service that builds zero-knowledge proofs, processes secret transaction inputs inside an attested AWS Nitro enclave, an isolated computing environment. Verifying a proof on Solana confirms the protocol's rules were met, but protecting the inputs while the proof is made depends on the prover's isolation, code, and deployment policies.
What the prover sees and what the wallet keeps
According to Helius's wallet integration guide, proof generation needs plaintext inputs covering the complete transaction data and nullifier keys. The documented client shields those inputs from the host operator by encrypting requests to a key held by the attested enclave.
The wallet, however, keeps signing authority. In the native wallet integration, the TypeScript SDK leaves signing of the finished Solana transaction with the application's signer.
Helius also documents delegated decryption, which shares a viewing key with an authorized provider. That arrangement gives the provider read access to balances and history, without granting spending authority.
Where deployment trust remains
Wallets can check attestation before they send anything. The documented checks cover the certificate chain, challenge response and freshness, approved measurements, and the encryption-key binding, and the tagged SDK refuses a remote prover request without a policy.
Still, the Nitro deployment guide says clients cannot read the AWS KMS key policy and rely on the operator's deployment for that guarantee. Even correctly encrypted requests leave metadata visible to the parent, such as paths, queries, timing, and sizes.
On audits, Helius's launch announcement says Certora, zkSecurity, and OtterSec audited programs and circuits. Its security page, however, marks OtterSec as awaiting a report.
The launch leaves wallet developers deciding which code and deployment policy they approve to handle proof inputs.
Source: CryptoSlate
Trading involves risk.
Risk Disclaimer
