Full-Chain Membership Proofs replace ring signatures with a cryptographic argument that the spender owns one of every Monero output ever created — without revealing which one.
Today, when a Monero user spends an output, they sign a ring signature proving that they own one of 16 outputs — the real one plus 15 decoys selected by the wallet. The ring is small enough that statistical analysis can sometimes narrow down the real spender by studying decoy distributions.
FCMP++ replaces that 16-member ring with a single succinct proof that the spender owns one of every output ever created on Monero. The proof itself stays small (~2-3 KB) regardless of how large the chain grows, because it uses a logarithmic-size structure called a Curve Tree.
Statistical de-anonymization that worked against 16-member rings simply has no signal to operate on when the anonymity set is the entire chain — and the chain grows every block.
For users, the surface change is invisible. Existing Monero addresses keep working. Wallets keep behaving the same way. Transactions keep settling in roughly two minutes.
What changes is the underlying cryptographic guarantee. Three things at once:
The anonymity set becomes the entire chain. Every output ever created on Monero is a member of every input's anonymity set — not 16 selected decoys. Temporal heuristics (which output is "the real one" based on age) lose all power. Output poisoning (flooding known outputs to corrupt rings) loses all power. There are no rings.
Forward secrecy against quantum adversaries. Transactions made under FCMP++ stay private even if a future quantum computer breaks the elliptic-curve discrete logarithm problem. A quantum attacker cannot retroactively trace these transactions.
Backward compatibility. Existing 95-character Monero addresses remain valid forever. Users do not migrate funds. Sending to legacy addresses continues to work. The upgrade is invisible at the address layer.
FCMP++ ships in the same hard fork as CARROT, a new addressing protocol maintained by jeffro256. CARROT becomes the default addressing protocol post-FCMP++, adding security and usability features at the wallet layer while remaining compatible with existing addresses.
The two upgrades are coordinated: FCMP++ rewires how spends are proved; CARROT rewires how addresses are derived. Together they constitute the largest privacy and addressing upgrade in Monero's history.
FCMP++ rests on four pieces of recent cryptographic research:
Curve Trees — a logarithmic-size membership proof structure. Proving membership in a set of size N takes a proof of size O(log N). At N = 150M+, the proof is a few kilobytes.
Generalized Bulletproofs — optimized inner-product arguments that compress the membership proof further while keeping verification cheap.
Eagen's elliptic curve divisors — accelerated proof construction. The technique cut proof generation time on the stressnet by roughly 5x (a 128-input transaction went from ~5m30s to ~1m).
Helios + Selene — a curve cycle towering Ed25519 (Monero's existing curve). The towered construction means FCMP++ inherits the existing Monero anonymity set rather than restarting from zero. Every output back to genesis is a member of every future ring.
The stressnet exposes the full FCMP++ proof construction, but several user-facing wallet features still require additional integration before mainnet activation. As of stressnet release v1.6, the following are not yet supported:
These are wallet- and tooling-layer concerns, not protocol-layer concerns. The cryptographic core of FCMP++ is implemented and stress-tested; the remaining work is integration breadth.
This page is fact-checked against primary upstream sources. We do not cite crypto-news aggregators that have repeatedly published incorrect activation dates.