Sergey Gorbunov on TEEs and the Arc Privacy Sector

Sergey Gorbunov is the co-founder of Interop Labs, the team behind the Axelar cross-chain protocol, which Circle acquired to build ARC, a new EVM-compatible L1 blockchain designed for institutional finance. ARC uses USDC as its gas token, targets high transaction throughput through fast consensus, and has a public testnet live with mainnet expected but no specific launch date given. The original Interop Labs team joined Circle for this purpose, while the Axelar public network continues under stewardship from a separate team at Common Prefix.

ARC includes a privacy layer called the privacy sector, a private execution environment running in parallel with the public chain. Gorbunov chose trusted execution environments over zero-knowledge proofs, multi-party computation, or homomorphic encryption primarily on product grounds. He argues that pure cryptographic approaches currently lack the composability, developer tooling, debugging support, and enterprise infrastructure integration that TEEs provide, and that the failure of most existing privacy environments to gain adoption follows directly from their inability to compose with existing developer stacks. Running a blockchain system in production requires roughly twenty additional tools alongside the main system, including data logging, analytics, performance monitors, and accounting systems, and composability with those corporate systems is far more complex for pure cryptographic solutions.

Each ARC validator runs two parallel EVM execution environments simultaneously, one over public state and one over private state inside a TEE. Both environments produce a state root included in the block and finalized through consensus. Rather than trusting TEE attestations alone, ARC requires every validator to redo the same computation inside its own TEE, with consensus reached on the encrypted output using the standard BFT two-thirds majority threshold. ARC does not use threshold cryptography at this stage. Transactions can in principle cross the public-private boundary within the same block space, but any call from the public space to the private space risks leaking information, so ARC is rolling out cross-boundary calls incrementally, starting with asset transfers before allowing full flexibility.

On the cryptographic alternatives, FHE suffers from extraordinary performance overhead because every bit of computation must be encoded in large arrays of numbers and because FHE requires running worst-case runtime on any possible encrypted input since revealing whether an input has terminated leaks information. ZK alone is insufficient for privacy in multi-party smart contracts because someone must know the data to generate the proof, and FHE alone provides no integrity, meaning results cannot be included in a blockchain without rerunning computation or adding a ZK proof on top. Gorbunov also notes that ZK systems likely contain more unknown vulnerabilities than TEE-based systems, observing that only roughly a few dozen to a hundred people fully understand the Zcash implementation across its math, cryptography, and systems layers.

The main drawback of TEEs is the assumption that the hardware is a trustworthy black box, and certain TEEs have been subject to side-channel attacks requiring physical access and electrical probes on the CPU. Gorbunov acknowledged that the entire trust model rests on trusting TEEs as the root assumption, and noted the design is not locked to a single TEE vendor. ARC uses AWS Nitro Enclaves as a starting point. Oblivious RAM can be used to protect against software-layer side-channel attacks, and TEEs could be complemented by additional environments running homomorphic encryption or oblivious RAM for use cases requiring stronger security without hardware assumptions. His description of the privacy sector on Twitter as the last privacy layer in Web3 drew community pushback over TEE security assumptions, and a public architectural critique of the TEE-based design was published by Ian Meyer.

State data in the privacy sector is encrypted using AES or a variant, a deliberate choice to use standard libraries rather than custom cryptography. Transactions entering and leaving the system use a hybrid of classical and post-quantum secure public encryption, while state stored on the blockchain uses symmetric encryption, which Gorbunov considers post-quantum secure because no public key is exposed. ARC will have post-quantum secure encryption for blockchain-stored state from day one, directly addressing capture-now-reveal-later attacks, though Gorbunov acknowledges that TEE hardware environments themselves would also need to be post-quantum secure and some work remains with TEE hardware providers on that front.

On governance, any unmasking action requires a two-thirds majority among validators at the protocol layer. ARC includes explicit view keys allowing developers to authorize specific parties such as accountants to access financial data, and developers can expose data to auditors or check against sanction lists as programmable application-level features. Governance rules determining who can propose disclosure are described as to be determined. Circle will vet both validators and RPC nodes, with validators expected to be established institutional partners rather than permissionless participants. Gorbunov predicts 2026 may become the year of privacy not in a positive sense but because the full loss of privacy becomes more real as AI agents scale, arguing that failure to protect confidentiality allows AI companies to use that data to outperform those who do not protect it.