We previously saw how the Bulletproofs Inner Product Argument (IPA) works: it lets us prove that we know a secret vector without revealing it.

That’s neat, but what can we actually do with it?

→ Range proofs!

Bulletproofs are the backbone of modern range proofs: they allow us to prove that a secret value lies within a given range, without revealing the value itself.

Don’t worry if you haven’t read the previous IPA articles, you can think of the IPA as a black box that proves an inner product relation without exposing the vectors. Though… if you do want to understand it, go read Breaking Down Bulletproofs (part 1) and Unfolding the Bulletproofs Magic (part 2).

Here’s a quick overview of what we’ll go through today 😅

(this diagram comes from the excellent Dalek Bulletproofs documentation)

Nooo! 🥲 Don’t stop here! I promise that by the end of this article, this strange-looking graph will make perfect sense.

A motivating example

A great use case is confidential transfers.

Imagine you want to send money to a friend, but you don’t want anyone else to see how much. You still need to prove that the transfer makes sense: you’re not sending a negative amount or exceeding your balance.

In many privacy-preserving systems (for example, when balances are represented by homomorphic commitments), this requires proving that both the amount and the resulting balance stay within valid ranges, preventing overflows/underflows, without revealing their actual values.

For instance:

• the maximum amount you can transfer is 100
• the maximum balance allowed is 1000

You would produce two range proofs:

1. Transfer amount is valid: 0 ≤ amount ≤ 100
2. Resulting balance is valid: 0 ≤ balance - amount ≤ 1000

If both hold, your transfer is correct… without revealing the actual numbers.