DAO to (Anonymous) DAO Transactions

Abstract: Blockchain assets are increasingly controlled by organizations rather than individuals. DAO treasuries, consortium wallets, and custodial exchanges rely on threshold authorization and multi-party key management, yet existing payment mechanisms still target single-user wallets, leaving no unified solution for organizational transfers. We formalize the problem of \emph{DAO-to-(anonymous)-DAO} transactions and present \textsc{Dao$^2$}, a framework that enables one threshold-controlled organization to pay another, optionally with recipient anonymity, while keeping received funds under distributed control. \textsc{Dao$^2$} combines three components: \emph{distributed key derivation} (DKD) for non-stealth child addresses, \emph{distributed stealth-address generation} (DSAG) for unlinkable one-time destinations, and \emph{threshold signatures} for authorization. For ordinary transfers, the receiver derives a non-stealth address via DKD; for anonymous transfers, it derives a stealth address via DSAG. The sender then threshold-signs the payment, and the receiver redeems the funds without reconstructing any master secret. We formally prove its security and evaluate a prototype. A complete anonymous DAO-to-DAO transaction for a typical-sized (e.g., 7-member) DAO finishes in under 27\,ms with less than 1.2\,KB of communication, and scales linearly with DAO size.

• The paper introduces a novel protocol (Dao²) that enables privacy-preserving, threshold-controlled asset transfers between DAOs while maintaining recipient unlinkability.
• It leverages three core cryptographic primitives—Distributed Key Derivation, Distributed Stealth Address Generation, and Threshold Signatures—to ensure secure multi-party operations.
• Empirical evaluation shows the protocol completes transfers in under 27 ms with minimal communication overhead, demonstrating its practical viability.

Privacy-Preserving DAO-to-DAO Transactions with Distributed Control

Problem Statement and Motivation

The paper "DAO to (Anonymous) DAO Transactions" (2604.04369) addresses the absence of cryptographic protocols for secure, privacy-preserving asset transfers between threshold-controlled organizations, such as DAOs, custodial exchanges, and consortium treasuries. Most blockchain payment architectures assume single-user wallets as payees, which disallows seamless recipient privacy and organizationally managed funds. The paper formalizes the requirement for direct organization-to-organization (org-to-org) transactions with the additional properties of recipient unlinkability, preservation of distributed key control, and no leakage of reconstructible master secrets.

A significant challenge arises since privacy-preserving payment techniques (stealth addresses, ring signatures, etc.) presuppose single-user control by long-term keys. They are incompatible with threshold-controlled organizations where funds must remain under multi-party authorization at all times. The use of hierarchical deterministic key derivation—ubiquitous in individual wallets via BIP32—does not generalize trivially to threshold settings due to potential secret reconstruction and incompatibility with distributed control. Therefore, a unified protocol is required for both non-anonymous and anonymous org-to-org transfers on mainstream blockchains and privacy-oriented ledgers.

Dao$^2$ Framework: Cryptographic Architecture

The proposed Dao$^2$ protocol composes three core primitives:

• Distributed Key Derivation (DKD): An extension of BIP32, enabling generation of non-hardened child keys in a threshold setting. Parties holding secret shares of a parent key deterministically derive additive child shares and addresses without reconstructing any master secret. DKD guarantees that the org's wallet, including newly received outputs, remains synchronous and auditable under threshold policy.
• Distributed Stealth Address Generation (DSAG): A multi-party ECDH protocol to generate unlinkable one-time addresses, compatible with threshold decryption and spending. Under DSAG, a sender subset and a receiver subset jointly compute an ECDH shared secret, derive a random offset, and create a stealth address; the corresponding distributed child key enables organizational-level detection and redemption. This generalizes CryptoNote-style stealth addresses to distributed receivers.
• Threshold Signatures (TSig): Shamir-based ECDSA (specifically 2-of-$n$ deployed in the evaluation), providing authorization for both outgoing payments and incoming redemption under multi-party distributed shares.

DKD enables basic DAO-to-DAO transfers (traceable but threshold-controlled). Combining DKD with DSAG supports DAO-to-anonymous-DAO—the key technical contribution. The protocol ensures that both derivation and anonymous spending remain organizational, never collapsing to any individual.

The system model strictly delineates sender- and receiver-side thresholds, adapts to both account-based and UTXO-based blockchains, and decouples the exposure of address derivation, stealth address generation, and spending. The protocol is proven to reduce to standard adversarial models (DL, DDH) and maintains robustness against sub-threshold adaptive corruption and Byzantine deviations.

Protocol Flow and Security Properties

A single Dao$^2$ transaction proceeds as follows:

1. Receiver-Side: DKD logic derives a child public key and new chain code under organizational control for the next incoming payment.
2. Sender-Side: Using the session descriptor, designated sender-side signers participate in DSAG, generating an unlinkable one-time destination. The senders threshold-sign the payment to this destination.
3. Blockchain: The network validates and commits the transaction.
4. Receiver-Side Recovery: Receiver-side parties detect outputs, reconstruct distributed stealth shares, verify consistency via public shares, and execute threshold redemption of the unlinked output. Local one-time shares are erased to provide forward secrecy.

Security claims:

• Correctness: All honest participants reconstruct and redeem outputs in a threshold manner deterministically aligned with the public chain transcript.
• Threshold Spending Security: No adversary controlling fewer than $t$ participants (sender or receiver) can forge signatures or extract spending keys for protected outputs.
• Recipient Unlinkability and Privacy: Under DDH, even with adversarial selection of receiver parameters, the public transcript reveals no information about the receiving DAO's identity. Multi-transaction unlinkability is computationally guaranteed unless an insider to the session is compromised.
• Robustness: The protocol resists all forms of undetectable state divergence or share malleation. Sharechecks and binding commitments prevent consistency violations through per-member verification and public-key aggregation.
• Forward Secrecy: If one-time shares are erased post-redemption, historical outputs remain cryptographically secure even after participant compromise.

Implementation and Quantitative Evaluation

The authors implement the algebraic core (DKD, DSAG, and threshold ECDSA) on secp256k1 and empirically evaluate computational and communication overheads for DAOs of size $n=3$ to $n=20$ (threshold $t=2$). Noteworthy quantitative outcomes:

• Full anonymous DAO-to-DAO transfer for $n=7$ completes in under 27 ms with <1.2 KB total communication overhead.
• Latency in both transaction generation and redemption phases scales linearly with DAO size but remains well below typical blockchain confirmation times.
• The protocol's cryptographic overhead is minimal compared to baseline chain operations. Overhead is dominated by DSAG (linearly growing EC multiplications and broadcasts), with DKD and TSig implementation effectively constant.

Key derivation depth does not impact per-step latency, as each DKD phase only involves local computation over fresh tags and chaincodes.

Implications, Limitations, and Future Directions

Theoretical Implications: The protocol demonstrates that privacy-oriented primitives (stealth addresses, one-time keys) can be made compatible with distributed organizational control without weakening threshold security. This tight integration is only possible due to careful algebraic matching between additive key derivation and share-compatibility under Lagrange reconstruction.

Practical Applicability: Dao$^2$ directly applies to DAO treasuries, consortium and custodial wallets, privacy-focused institutional escrow, on-chain governance, and custody scenarios desiring confidential org-to-org payments. It also generalizes seamlessly to classic single-user wallets, confirming design orthogonality.

Limitations and Open Problems:

• The practical model is blockchain-agnostic, but specific integration into Ethereum or Bitcoin will require mapping stealth outputs to their respective address spaces (including smart contract logic in account-based ledgers).
• Sender-side and off-chain metadata leakage (from e.g. session participation graphs) is not covered in the privacy model and would require network-level anonymity solutions.
• Static group/threshold structure is assumed; efficient support for proactive group evolution, membership changes, or batch payments is an open direction.
• Combining the protocol with confidential value transfer (e.g., amount hiding) and ring signature sender anonymity would increase overall privacy and is an open compositional challenge.
• Protocol asynchrony and minimal interactivity remain goals for future optimization.

Future AI Developments: Automated tooling for DAO wallet management, on-chain governance, and multi-party computation frameworks could integrate Dao$^2$0 primitives for privacy-preserving, auditable organizational finance, especially as AI-powered agents begin to manage or participate in DAO treasuries.

Conclusion

Dao$^2$1 closes a critical gap in the cryptographic design of organizational payment protocols, providing a modular, secure, and efficient construction for both traceable and anonymous DAO-to-DAO asset transfers without secret key revelation or privacy leakage. It achieves strong formal security under realistic adversary assumptions and demonstrates practical viability at real-world organization scales. This framework is a stepping stone towards fully confidential, programmable, and institutionally compliant digital assets in decentralized finance and beyond.