Here I explore the alternative path for transaction privacy. The privacy is weaker than the one using zk-SNARK with commitments and nullifiers, but the ledger transitions proofs may have better performance and it's worth exploring.

The idea is to use the Lelantus Spark private transaction scheme (it's also used in Zcoin, known as Firo) over the Grumpkin elliptic curve using Poseidon2 hash function (over the scalar field of BN254) to obfuscate the output consumed.

Let's focus on verification complexity for now in order to assess how a zk-rollup built on Lelantus would perform.

Address

An address key in Lelantus is a tuple $(addr_{in}, addr_{full}, addr_{sk})$; they are computed with $F$, $G$ and $H$ independent generators of Grumpkin as:

1. $s_1, s_2, r \overset{{\scriptscriptstyle\$}}{\leftarrow} \mathbb F$ the scalar field of Grumpkin.
2. $addr_{in} = (s_1,s_2F+rG)$ incoming key used to identify the received funds.
3. $addr_{full} = (s_1, s_2, rG, s_2F+rG)$ full key used to identify outgoing funds and for some operations.
4. $addr_{sk} = (s_1,s_2,r)$ the secret key used to spend the coins in transactions.

Public addresses can be derived from these elements and are of form $(d,Q_1,Q_2)$.

Coins

Each coin is represented by:

1. A serial number used to obfuscate the destination address: $kF+Q_2$.
2. A recovery key $K=Hash(\text{KEY}||k)\cdot Hash (d)$
3. A value commitment: $C = vG'+Hash(\text{VAL}||k)H'$
4. A range proof proving that the value $v$ behind the commitment $C$ is positive (for example, of 64 bits)
5. An encrypted message under the key generated from $key= Hash(\text{KEY}||Q_1)$: $message = Encrypt(key, \text{r},(v,d,k,m))$ where $m$ is arbitrary data and $\text{r}$ I don't know (I didn't find any reference elsewhere in the paper…).

Verification

Let's suppose we don't have mint transactions in the zk-rollup for simplicity. Each time the verifier receives an elliptic curve point, they have to check that the point is indeed on the curve.

Then the verification is reduced to: