FCMP++: how full-chain membership proofs replace rings

Today a Monero input hides among 16 outputs: the one really spent and 15 decoys chosen by the wallet. FCMP++ — full-chain membership proofs — replaces the ring with a zero-knowledge proof that the output being spent is one of every output on the chain, without saying which. The Monero project's post introducing it, of 27 April 2024, put the anonymity set at 100,000,000 outputs against 16. The stressnet release notes of 2026 speak of more than 150 million.

That ends the statistics of decoy selection described in how Monero privacy works. With every output in the set, there is no ring to analyse, and no question of whether the decoys look like real spends.

How the proof works

The outputs are kept in a curve tree, the construction published as Curve Trees (IACR ePrint 2022/756): a Merkle-style tree whose layers alternate between two elliptic curves that form a cycle, so that each layer's commitments can be proved over efficiently in the next. Monero's pair of curves, Helios and Selene, was proposed by tevador. The proofs are Generalized Bulletproofs, and they use Eagen's elliptic-curve divisors (ePrint 2022/596) for the curve arithmetic inside the proof.

The ++ is the other half. A membership proof alone says only that an output is in the tree. SA+L — spend authorisation and linkability — proves that the spender holds the output's key and ties the input to its key image, so the double-spend check works as it does now. The post notes that this design is independent of Seraphis.

Beyond the size of the set, the post lists three gains: transaction chaining, signing a transaction that spends an output before that output is on the chain; outgoing view keys, so a wallet can show what it sent as well as what it received; and forward secrecy, so that an adversary who can solve the discrete logarithm problem — with a quantum computer, say — still cannot tell which output a past input spent.

Carrot: the addresses that come with it

FCMP++ arrives with a new addressing protocol, Carrot, specified by jeffro256. Existing addresses keep working, since the specification is backward compatible, but wallets created under it get a new key hierarchy: a prove-spend key, a view-balance secret that finds both received and outgoing enotes, a generate-image key, an incoming view key and a generate-address secret. The view key guide has what that split means for view-only wallets. Each enote carries a 3-byte view tag.

The specification also names what it defends against: the Janus attack, in which a sender crafts an output to test whether two addresses belong to one wallet; and the burning bug, in which two outputs sent to the same one-time key leave only one spendable, which Carrot mitigates without the wallet having to keep state. It adds address-conditional forward secrecy and confirmation of payment IDs.

The reviews

The cryptography has been reviewed piece by piece, and the audits folder of monero-oxide's fcmp++ branch records each review, disagreements included. Veridise reviewed the choice of the Helios and Selene curves, which was changed to a pair with a secure twist, and audited the full-chain membership proof crates, with parts of the circuits formally verified with Picus. Cypher Stack reviewed the composition and wrote security proofs for SA+L and for Generalized Bulletproofs; a flaw later found in the Generalized Bulletproofs protocol was fixed, and the fix reviewed and the code audited again by zkSecurity. For the divisor proofs, Cypher Stack at first could not independently affirm Veridise's security proofs, then judged the equations of SLVer Bullet, a paper it derived separately, equivalent to them.

The stressnet

FCMP++ is tested on a network of its own, the stressnet, built from the seraphis-migration/monero repository. Its alpha releases ran from the first, of 27 September 2025, to 1.6 on 4 February 2026. Beta 1.0 followed on 28 April 2026, 2.0 on 27 May 2026 and 3.0 on 25 September 2026, and the beta 3 network forked from testnet on 5 October 2026 at block 3,102,800.

Beta 3.1, of 26 October 2026, is the latest as of 6 November 2026. Its notes record a change that completely prevents Carrot outputs from appearing in ring signatures, closing what they call a detectable inflation vulnerability, exposed for the 24 hours after the network's initial hard fork — the kind of fault a stress network is there to find. The same notes list what does not work yet: hardware wallets, multisig and transaction proofs. And they are plain about the network's own privacy: the anonymity set of running a node on it is in the dozens at best, against thousands on the main network, so it is for testing, not for anything that needs hiding.

On the main network

In the main repository, monero-project/monero, the work is arriving in parts. The curve tree builder was merged on 24 September 2026 (#10724) and tree building in the database on 2 November 2026 (#11425); consensus verification (#11440) is still open. The README already lists Rust 1.85 as a dependency for the FCMP++ cryptography, and its network-upgrade table has a row for the next upgrade with no height and no date. No date has been announced. The release the project recommends, v0.18.5.4 of 17 October 2026, does not include FCMP++.