Stealth Addresses vs ZK-Proof Addresses: Receiver Anonymity

No complex cryptography on-chain: The stealth address protocol (like ERC-5564) uses standard elliptic curve operations. The heavy lifting (scanning for spend keys) is done off-chain by the receiver's wallet. This results in lower gas costs and minimal protocol overhead compared to deploying and verifying ZK-SNARKs.

This matters for integrating privacy into high-throughput, cost-sensitive environments like Ethereum L2s (Arbitrum, Optimism) or payment-focused chains.

Unlinkable future transactions: Each payment to a stealth address generates a unique, one-time deposit address on the blockchain. Even if a sender's identity is later compromised, all their previous payments to you remain unlinkable. This provides strong protection against retrospective chain analysis.

This is critical for whistleblower platforms, anonymous donations (Gitcoin Grants), or any use case requiring persistent recipient anonymity over time.

Mandatory off-chain scanning: To discover funds sent to their stealth address, the receiver must constantly scan the blockchain or rely on a third-party service. This creates latency in fund discovery and adds operational complexity. If the scanning service is down, funds are effectively invisible.

This is a poor fit for merchant payment processing, real-time settlement, or IoT micropayments where immediate confirmation is required.

Vulnerable to network-level analysis: While on-chain addresses are unlinkable, the act of broadcasting the stealth address metadata (ephemeral public key) can leak sender-receiver relationships to network observers (e.g., block builders, MEV searchers). This requires additional protections like Dandelion++ or submitter anonymity.

This limits effectiveness in scenarios with high-value, targeted transactions where even metadata correlation is unacceptable.

Cryptographic guarantee of anonymity: Using zk-SNARKs (e.g., in Zcash's z-addresses or Aztec Protocol), a transaction proves validity without revealing sender, receiver, or amount. This provides stronger anonymity sets and resists even powerful network-level analysis.

This is the gold standard for institutional-grade privacy, regulatory-compliant confidential transactions, and shielding high-net-worth individual wallets.

No action required by the receiver: Funds sent to a shielded address (like a z-address) are immediately and privately credited. The recipient does not need to scan the chain or be online. This enables asynchronous, fire-and-forget private payments.

This is ideal for non-interactive airdrops,遗嘱 inheritances, or any scenario where the sender cannot coordinate with the receiver.

Expensive proof generation and verification: Creating a zk-SNARK proof is computationally intensive (seconds to minutes). On-chain verification, while faster, still incurs significant gas costs (100k+ gas vs. ~21k for a standard transfer). This creates a high barrier for frequent, small-value transactions.

This makes it prohibitive for privacy-preserving DeFi swaps, gaming microtransactions, or daily-use private wallets on high-fee networks.

Reliance on ceremony or fraud proofs: Most efficient zk-SNARK systems (Groth16) require a trusted setup ceremony (e.g., Zcash's Powers of Tau). Newer systems (PLONK, STARKs) reduce this but add other trade-offs. This introduces protocol risk and audit complexity.

This is a major consideration for protocol architects choosing dependencies, as it increases the attack surface and maintenance burden compared to the simpler cryptographic assumptions of stealth addresses.