Data Structures for Private Token Transfers in TEE-Based Networks

Abstract: Trusted execution environment (TEE) based confidential smart contract networks promise privacy but remain vulnerable to storage access pattern attacks that can link senders and recipients in token transfers. When contracts update recipient balances during transfers, the unique storage keys accessed reveal transaction relationships even when data is encrypted. This paper introduces two novel data structures to address this vulnerability: the Delayed Write Buffer (DWB) and the Bitwise-Trie of Bucketed Entries (BTBE). The DWB delays recipient balance updates by buffering pending transfers and randomly settling entries, breaking the direct correlation between transfer execution and recipient storage access. The BTBE further enhances privacy by grouping addresses into constant-sized buckets, preventing flooding attacks and creating anonymity sets for balance queries. Additionally, we present a private notification system enabling real-time, privacy-preserving push notifications for confidential contracts. Our domain-specific approach leverages the unique characteristics of token transfers -- asymmetric balance updates and tolerance for delayed settlement -- to achieve practical performance with probabilistic anonymity guarantees.

• The paper introduces novel DWB and BTBE structures to decouple storage access from immediate transfers in TEE-based networks, achieving probabilistic unlinkability.
• It leverages randomized buffering and bucketed aggregation to balance efficiency with enhanced privacy, while controlling gas overhead.
• Experimental results show that tuning system parameters yields effective anonymity sets, mitigating access-pattern attacks in token transfers.

Data Structures for Private Token Transfers in TEE-Based Networks

Motivation and Problem Statement

Hardware-based Trusted Execution Environments (TEEs) integrated with smart contract platforms provide robust data confidentiality but remain susceptible to storage access-pattern attacks. In these systems, even with encrypted data, unique storage key accesses during token transfers can be observed by adversaries—allowing them to correlate senders and recipients by tracking which addresses’ balances are read or written. Recent work demonstrated the practical severity of these vulnerabilities in networks such as Secret Network, showing that naïve implementations offer only a façade of privacy. Conventional mitigations, such as decoy recipients or generic ORAM overlays, face critical efficiency and usability challenges in blockchain settings. Therefore, there is a pressing need for specialized, efficient data structures that obfuscate access patterns associated with token transfers.

Proposed Data Structures: DWB and BTBE

The authors introduce two novel constructions—Delayed Write Buffer (DWB) and Bitwise-Trie of Bucketed Entries (BTBE)—which exploit the asymmetry and domain specificity of token transactions to probabilistically decouple storage access from immediate transfer events, achieving practical unlinkability.

Delayed Write Buffer (DWB)

The DWB is a fixed-size buffer acting as an intermediate staging area for incoming transfers. Instead of accessing the recipient’s stored balance immediately during a transfer, the contract buffers the event in the DWB, deferring settlement. Each time the buffer reaches capacity, a random entry is selected and 'settled': its information is applied to the recipient’s persistent storage, and the slot can be reused. This randomization and delayed application disrupt the direct correlation between transfer events and storage accesses.

Figure 1: An example transaction using a DWB, showing the order of read/write storage access operations. Notice how Bob's entry was randomly selected from the buffer to be settled in order to insert the new entry for Carol.

To mitigate flushing vulnerabilities—where an adversary floods the buffer with transfers to a victim to force immediate settlement—entries are enforced to be unique per recipient, and repeated transfers to the same address are accumulated within a linked list optimized for constant-time operations.

Figure 2: Repeated transfers to the same recipient accumulate in a linked list per DWB entry, ensuring that only insertion patterns change, not storage access patterns.

From an information-theoretic perspective, the probability that a given transfer’s settlement results in storage access to the recipient’s account after $n$ subsequent transfers is $P = 1 - \left(\frac{k-1}{k}\right)^n$ for a buffer of size $k$.

Figure 3: Probability a transfer has settled, and thus the recipient's storage area has been accessed, after $n$ subsequent transfer executions.

As $k$ increases, the adversary requires substantially more transfer observations to confidently associate a transaction with a recipient storage access. The practical tradeoff is a fixed gas overhead governed by $k$.

Bitwise-Trie of Bucketed Entries (BTBE)

To further diffuse the leakage potential from storage operations, particularly during balance queries and settlements, the BTBE groups users’ balances into fixed-size buckets. These buckets are organized as a bitwise trie, where leading bits from a key-derived hash route users deterministically to a bucket, and each bucket serves as a small anonymity set.

Figure 4: Example of inserting a new entry in the BTBE, illustrating multiple node splits and routing determined by the recipient's address hash.

This design mitigates bucket-flooding attacks and ensures that storage access granularity cannot be trivially reduced to single-user writes or reads, complementing DWB’s temporal unlinkability with structural anonymity. The average query and modification time for a balance is $O(\log N)$ (where $N$ is the number of users), and actual storage writes are dispersed across buckets rather than keyed exclusively to individual accounts.

Private Push Notification Framework

A critical component of programmable privacy is user notification without leaking identities or activity patterns. The paper specifies a cryptographic privacy-preserving push notification system built on the Tendermint event infrastructure. Unique, single-use notification IDs are derived via HKDF and HMAC from internal contract secrets and recipient addresses. Three operating modes—Counter, TxHash, and Bloom—allow clients to balance between usability, performance, and side-channel robustness. All notifications are encrypted with ChaCha20-Poly1305, and constant-size log attributes with decoys ensure traffic analysis resistance.

Numerical Results and Performance

The reference implementation, deployed to Secret Network and tested on major token upgrade events, demonstrates:

• Gas overhead for DWB is proportional to buffer width $k$; BTBE’s overhead scales with trie height and bucket size.
• In the worst-case observed, total gas usage increased by 26% relative to baseline contracts—a measured and acceptable tradeoff given the resulting privacy benefits.
• With $k=64$, after 100 transfer executions, there is only an 80% chance that a given transfer entry has been settled—significantly impeding adversaries seeking to correlate events. Achieving 99% certainty requires nearly 300 observations, representing a substantial effective anonymity set.

Security Analysis and Limitations

The proposed system achieves unlinkability between sender and recipient at the storage layer under typical system loads. Nonetheless, query-based attacks (where a malicious node operator infers a client’s account address by repeated queries) remain possible. DWB anonymity erodes during periods of low volume, and the approach does not protect against all protocol-level side channels. The notification framework, while robust, admits certain tradeoffs between privacy and device-side computation, particularly in its counter mode. The system’s overall security assumes correct and constant-time implementation of all logic to preclude timing channels.

Implications and Future Directions

This work demonstrates that domain-specific privacy in TEE-based token contracts can approach the unlinkability guarantees of heavy-weight generic ORAM at a fraction of the computational and I/O overhead. The DWB and BTBE constructions apply asymmetric, delayed, and bucketed access indirection to mask transfer relationships efficiently. Practical deployment across major assets indicates feasibility for real-world confidential finance.

Looking forward, further privacy gains could be realized by integrating these domain-specific strategies with selective zk-SNARK-based auditing, dynamic buffer management, or even hardware-level ORAM in hybrid approaches. Adaptive anonymization policies responsive to transaction volume and composability with cross-contract applications represent promising avenues for research in confidential smart contract engineering.

Conclusion

The paper establishes that, through domain-specific buffering (DWB) and bucketed aggregation (BTBE), private token transfers on TEE-based networks can overcome critical access-pattern vulnerabilities that expose transfer relationships in naïve designs. The approach balances probabilistic unlinkability, architectural efficiency, and practical deployability, advancing the state of programmable privacy for token contracts. The integration of private real-time notifications completes the confidential user experience, while maintaining compatibility and moderate overheads. This contributes significant new techniques to privacy-preserving blockchain systems and establishes a foundation for future improvements in both theory and practice.