Standards

Chapter 8 / 15

Encrypted Token (ERC-8227)

Private balances with selective disclosure.

ERC-8227 is Covenant's encrypted fungible token standard. Balances are stored as ciphertexts; transfers are homomorphic additions that never expose amounts on-chain. selective_disclosure lets the owner grant viewing access to specific parties (auditors, regulators) without exposing data to everyone.

private_token.cov
encrypted token PrivateToken {
    name:     "Private Token";
    symbol:   "PT";
    decimals: 18;
    supply:   1_000_000;
    owner:    msg.sender;
}
private_token_auditable.cov — with selective disclosure
encrypted token AuditableToken {
    name:     "Auditable Token";
    symbol:   "AT";
    decimals: 18;
    supply:   10_000_000;
    owner:    msg.sender;

    // Parties that can view any balance
    auditors: [address; 8];

    selective_disclosure {
        // Balance visible to the account holder
        reveal balance to self;
        // Balance visible to listed auditors
        reveal balance to self.auditors;
        // Total supply always public
        reveal totalSupply to public;
    }
}
Reading a private balance
// Off-chain — using covenant-sdk (TypeScript)

import { CovenantClient } from '@covenant-lang/sdk';

const client = new CovenantClient({ rpc: 'https://rpc.example.com' });
const token  = client.contract('0xABC...', 'AuditableToken');

// Decrypt caller's own balance (requires caller's decryption key)
const myBalance = await token.balanceOf(myAddress, { decrypt: true });

// Auditor reading another account (requires auditor key)
const balance = await token.balanceOf(
    targetAddress,
    { decrypt: true, as: auditorAddress }
);

Annotations

encrypted tokenis the ERC-8227 form of token. It generates a homomorphic transfer function in addition to standard ERC-20 selectors.
selective_disclosureis a block that configures which parties receive a decryption key fragment for which fields.
reveal X to Ygrants Y the ability to call the chain's disclosure precompile and obtain the plaintext of X.
Transfersare handled by fhe_add / fhe_sub on ciphertexts — the chain validates balance constraints via ZK range proofs without decrypting.

Key takeaways