💻 computer science

DAO to (Anonymous) DAO Transactions

This paper introduces \textsc{Dao $^2$ }, a framework that enables secure, threshold-authorized transactions between organizations (DAOs) with optional recipient anonymity and distributed fund control, utilizing distributed key derivation, stealth-address generation, and threshold signatures to achieve low-latency, scalable transfers without reconstructing master secrets.

Original authors: Minfeng Qi, Lin Zhong, Qin Wang

Published 2026-04-17

📖 6 min read🧠 Deep dive

CC BY 4.0

Original authors: Minfeng Qi, Lin Zhong, Qin Wang

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

The Big Picture: The Problem

Imagine a world where money isn't just held by individuals, but by clubs, committees, or organizations (called DAOs).

The Old Way: In the current crypto world, if a club wants to send money, it usually acts like a single person. But in reality, a club has rules: "We need 3 out of 5 members to agree before we spend."
The Problem: Existing crypto systems are like sending a letter to a specific house address. If a club sends money to another club, the public ledger shows exactly who sent it and who received it. If the receiving club wants to stay anonymous (like a secret society), they can't just use a normal address, because that address belongs to the whole group, and using it repeatedly reveals their identity.
The Dilemma: How can a group send money to another group anonymously, while ensuring that the receiving group still needs multiple members to unlock and spend that money later?

The Solution: DAO2

The authors built DAO2, a new system that acts like a secure, anonymous, multi-key mail service for organizations.

Think of it as a three-part magic trick:

1. The "Magic Mailbox" (Distributed Key Derivation)

Imagine a club has a master key that is cut into 5 pieces. No single person has the whole key.

The Challenge: If they get a new piece of mail, they need a new mailbox, but they can't rebuild the master key to make it.
The Solution: DAO2 uses a special rule (like a mathematical recipe) where every member takes their own piece of the key and adds a tiny, secret "stamp" to it.
The Result: They all end up with pieces of a new key for a new mailbox. They never had to put their pieces together to see the master key. It's like everyone adding a drop of paint to a bucket to change the color, without ever seeing the original paint can.

2. The "Ghost Address" (Distributed Stealth-Address Generation)

Now, the sender wants to send money to this new mailbox without anyone knowing it belongs to that specific club.

The Challenge: If the sender just sends it to the new address, people can still link it back to the club.
The Solution: The sender and receiver work together (without revealing their secrets) to create a "Ghost Address."
- Imagine the sender writes a letter and puts it in a box.
- The receiver has a special scanner.
- The sender creates a unique, one-time address that looks like a random string of numbers to the public.
- Only the receiver's "scanner" (using their secret pieces) can look at the blockchain, say "Oh, that random string is actually for us," and claim the money.
- To the outside world, it looks like the money went to a ghost.

3. The "Group Lock" (Threshold Signatures)

Once the receiver claims the money, it's sitting in their vault. But remember, this is a club, not a person.

The Challenge: They need to spend the money later, but they can't let one person do it.
The Solution: The "Ghost Address" they just claimed is automatically set up as a Group Lock.
- To spend the money later, the club members must gather again.
- They use their secret pieces to "sign" the transaction.
- The blockchain sees a valid signature and releases the funds, but it doesn't know it took 3 people to do it; it just sees a valid transaction.

How It Works in Real Life (The Analogy)

Imagine Club A wants to send a donation to Club B (a secret charity).

Preparation: Club B has a "Master Key" split among its 7 members. They use the Magic Mailbox rule to generate a new, unique "Child Key" for this specific donation. They tell Club A the public part of this Child Key.
The Secret Handshake: Club A and Club B use the Ghost Address trick. Club A mixes their secret with Club B's public key to create a one-time, untraceable address. To the public, it looks like a random address. Only Club B's members can scan the blockchain and realize, "Hey, that random address is actually for us!"
The Transfer: Club A signs the transaction. It looks like a normal payment to the public.
The Claim: Club B's members scan the blockchain, find the "Ghost Address," and use their secret pieces to reconstruct the key to that specific address.
Spending: Now the money is in Club B's vault. To spend it later, they just need to gather their members and sign again. The money stays under the club's control the whole time.

Why Is This a Big Deal?

Privacy for Groups: Before this, if a group wanted to hide who they were, they had to break their own rules (e.g., have one person hold the money). DAO2 lets them stay anonymous and keep their group rules.
Speed: The authors tested it. Even with 7 members, the whole process takes less than 27 milliseconds (faster than a human blink).
Scalability: It works whether the group has 3 people or 20 people. The cost goes up linearly, but it's still very fast.

The "Secret Sauce"

The paper's main achievement is connecting three complex math concepts that usually don't talk to each other:

Splitting keys (so no one person is in charge).
Stealth addresses (so no one knows who received the money).
Group signing (so the group can spend the money later).

They figured out how to make these three work together in a single, seamless flow without anyone ever having to reveal their private secrets.

Summary

DAO2 is a new way for organizations to send and receive crypto money. It allows a group to receive funds anonymously (so no one knows who they are) while ensuring that the funds remain locked behind a "group key" that requires multiple members to unlock. It's like sending a secret package to a secret society, where the package can only be opened if three members of the society are present, all without the post office ever knowing who the society is.

1. Problem Statement

The paper addresses a critical gap in blockchain asset management: how to transfer assets between Decentralized Autonomous Organizations (DAOs) while preserving recipient privacy and maintaining distributed control.

Context: Blockchain assets are increasingly managed by organizations (DAOs, consortiums, custodians) using threshold signatures and multi-party key management, rather than single-user wallets.
The Conflict: Existing privacy mechanisms (like stealth addresses) assume a single recipient with a single scanning key. They fail in organizational settings because:
1. Privacy vs. Control: Standard stealth addresses cannot be easily managed by a group without reconstructing a master secret, which violates the "no single point of failure" principle of DAOs.
2. Key Derivation: Hierarchical Deterministic (HD) wallets (e.g., BIP32) allow single users to derive child keys. However, existing distributed key derivation (DKD) schemes do not support generating unlinkable (stealth) addresses for anonymous transfers while keeping the resulting funds under threshold control.
Core Question: How can one DAO pay another DAO such that the recipient remains anonymous (unlinkable to their public identity) and the received funds remain under the organization's distributed threshold control, without ever reconstructing a master secret?

2. Methodology: The DAO2 Framework

The authors propose DAO2, a unified framework that integrates three cryptographic primitives to solve this problem. The framework supports two modes:

DAO-to-DAO: Standard transfers using distributed key derivation (non-stealth).
DAO-to-Anonymous-DAO: Privacy-preserving transfers using distributed stealth addresses.

The system operates on the secp256k1 elliptic curve and relies on Shamir's Secret Sharing for threshold reconstruction.

Core Components

Distributed Key Derivation (DKD):
- Adapts BIP32-style non-hardened derivation to a threshold setting.
- Mechanism: DAO members locally update their secret shares ( $b_j$ ) using a scalar offset ( $\omega$ ) derived from the parent chain code and public key via HMAC-SHA512.
- Result: A new child public key ( $B^{(k)}$ ) is derived without any party reconstructing the parent secret. This allows the DAO to maintain a hierarchical wallet structure.
Distributed Stealth-Address Generation (DSAG):
- Converts the derived child public key into an unlinkable, one-time destination address.
- Mechanism:
  - The sender (DAO1) and receiver (DAO2) perform a distributed Elliptic Curve Diffie-Hellman (ECDH) exchange.
  - Sender shares compute partial secrets $\Omega_i = a_i B^{(k)}$ .
  - Receiver shares compute partial secrets $\Omega'_j = b^{(k)}_j A$ .
  - Both sides aggregate these to the same shared secret $\Omega = a B^{(k)} = b^{(k)} A$ .
  - A stealth offset $\rho = H(\Omega \parallel \xi)$ is computed, where $\xi$ is a public label.
  - The one-time destination is $D^{(k)} = B^{(k)} + \rho G$ .
- Recovery: The receiver derives one-time secret shares $d^{(k)}_j = b^{(k)}_j + \rho$ locally. These shares satisfy the same threshold reconstruction property as the original keys, allowing the DAO to spend the funds later without reconstructing the master secret.
Threshold Signatures:
- Used for both the outgoing payment authorization (by the sender DAO) and the redemption of received funds (by the receiver DAO).
- The framework uses a 2-out-of-n instantiation (e.g., 2-out-of-3) as a practical balance between security and efficiency, though it is agnostic to the specific threshold value.

Protocol Flow

Setup: DAOs generate threshold keys and public parameters.
Transaction Generation (Sender):
- Receiver provides a session descriptor (derived child public key $B^{(k)}$ ).
- Sender performs DSAG to generate the stealth address $D^{(k)}$ .
- Sender threshold-signs the transaction to $D^{(k)}$ .
Detection & Redemption (Receiver):
- Receiver scans the blockchain for transactions matching their derived keys.
- Upon finding a match, the receiver reconstructs the shared secret $\Omega$ and computes the offset $\rho$ .
- Receiver updates their local shares to $d^{(k)}_j$ (one-time spending shares).
- Receiver threshold-signs the redemption transaction.

3. Key Contributions

Formalization: The first formal definition of the DAO-to-(Anonymous)-DAO transaction problem.
Unified Framework (DAO2): An end-to-end protocol combining DKD, DSAG, and Threshold Signatures. It is the first system to allow an organization to receive funds anonymously while retaining distributed control over the received assets.
Security Proofs: Formal proofs for:
- Transaction Correctness: Ensuring funds land in the correct wallet.
- Threshold Spending Security: Unforgeability against sub-threshold adversaries.
- Recipient Privacy & Unlinkability: Proven under the Decisional Diffie-Hellman (DDH) assumption and Random Oracle Model.
- Forward Secrecy: Achieved via one-time share erasure and one-way chaincode evolution.
Generality: The framework naturally degrades to standard single-user stealth address payments when $n=1$ , proving it is a principled extension rather than a disjoint solution.

4. Experimental Results

The authors implemented a prototype on secp256k1 using Python.

Performance:
- A complete anonymous transaction for a 7-member DAO (threshold 2) completes in < 27 ms of computation time.
- Communication overhead is < 1.2 KB per transaction.
- Latency scales linearly with the number of DAO members ( $n$ ). Even for $n=20$ , latency remains under 75 ms.
Scalability:
- DKD Cost: Constant time (approx. 2.5 ms) regardless of derivation depth, confirming no cumulative performance degradation.
- DSAG Cost: Linear growth due to per-member EC scalar multiplications, but remains negligible compared to blockchain consensus times (seconds/minutes).
Comparison: DAO2 adds a privacy premium of roughly 7.5x over plain threshold signing (at $n=3$ ), which is considered acceptable given the privacy benefits.

5. Significance and Impact

Bridging the Gap: DAO2 solves the "missing intersection" between threshold signatures, stealth addresses, and hierarchical key derivation. Prior work treated these as separate primitives; DAO2 integrates them into a coherent system.
Institutional Privacy: It enables DAO treasuries, consortiums, and custodial services to conduct private transactions, protecting sensitive financial relationships and organizational strategies from public blockchain analysis.
Practical Viability: The low latency and linear scaling demonstrate that privacy-preserving organizational transfers are computationally feasible for real-world deployment on major blockchains (Bitcoin, Ethereum).
Future Directions: The paper outlines extensions for proactive secret sharing (dynamic membership), batch processing, cross-chain interoperability, and integration with confidential transactions (hiding amounts).

In summary, DAO2 provides the cryptographic infrastructure necessary for the next generation of institutional blockchain finance, allowing organizations to interact with the blockchain with the same level of privacy and control previously reserved for individual users.