The range-proof construction used for current Monero confidential output amounts. It reduces proof size relative to the earlier Bulletproofs construction.
Also called: Bulletproofs plus.
The problem a range proof solves
A Monero output includes a commitment to its amount. Nodes must establish that the hidden value is within the allowed range, even though they cannot read it. A Bulletproofs+ proof supplies that evidence without revealing the value.
The range proof works alongside the transaction balance check. These answer different questions: whether output values are allowed, and whether the payment conserves value after accounting for its fee. Both matter for a valid transaction.
References: Bulletproofs+ paper, IACR 2020/735 · Monero source: ringct/rctSigs.cpp
Recipient and change outputs
For a payment with a recipient output and a change output, the wallet produces commitments for both values. The transaction can aggregate its range proof over several output commitments instead of attaching an independent full proof to each output.
A node verifies the supplied proof against those commitments. Changing a committed output is not just an edit to a displayed amount. The proof and other transaction checks must still agree with the resulting data.
References: Monero source: ringct/rctSigs.cpp · Monero source: cryptonote_core/blockchain.cpp
Smaller proofs with Bulletproofs+
Bulletproofs+ is a later construction than the original Bulletproofs. Its weighted inner-product argument reduces proof size. Like Bulletproofs, it does not require a trusted setup ceremony.
The paper describes the proof construction, while Monero's RingCT code defines how it is encoded and checked in transactions. A proof-size figure from a paper is not necessarily the size of an entire Monero payment, which also carries signatures and other fields.
References: Bulletproofs+ paper, IACR 2020/735 · Monero source: ringct/rctSigs.cpp
Range proofs do not hide everything
Bulletproofs+ does not choose decoys or hide the receiving address. CLSAG and one-time output-key derivation serve those other roles. It also does not conceal a wallet's IP address.
A smaller proof reduces the data needed for the proof itself. It does not establish that every transaction will have the same weight or fee. Input and output counts and the rest of the transaction format still matter.
References: Monero source: ringct/rctSigs.cpp · Monero source: cryptonote_core/blockchain.cpp
Related glossary terms
Practical guides
Technical baseline: v0.18.5.4. Reviewed 2026-11-08 UTC.