FCMP++ Explained: How Monero's Full-Chain Membership Proofs Work

Since 2014, Monero has hidden the sender of every transaction behind a ring: the real input plus a handful of decoys, now 16 members in total. FCMP++ (Full-Chain Membership Proofs, “plus plus”) is the upgrade designed to replace rings entirely, making every eligible output on the blockchain part of every transaction’s anonymity set. This guide explains how it works, what comes with it, and exactly where it stands in November 2026.

Why rings needed replacing

Rings have served Monero well, but their weaknesses are well documented (see our ring signature and decoy selection guides in this category):

• The anonymity set is small. 16 members per input, set by consensus.
• Decoys are chosen by the sender. If the selection algorithm does not match real spending behaviour, statistics can narrow the field. Research published on getmonero.org in 2025 estimated that timing analysis gives an attacker roughly a 1-in-4.2 guess instead of 1-in-16.
• Adversary-owned outputs shrink rings. Spam floods, like the suspected one in March 2024, can reduce the effective ring size.
• Bugs in decoy code have twice exposed users before being fixed.

Raising the ring size would help a little, but transaction size and verification cost grow roughly linearly with the ring. To include everything, Monero needed a different kind of proof.

What FCMP++ does, in one sentence

Instead of saying “I am spending one of these 16 outputs”, an FCMP++ transaction says “I am spending one of the outputs in this big set of all spendable outputs, and here is a zero-knowledge proof”, without revealing which one.

The getmonero.org announcement from April 2024 described this as expanding each input’s anonymity set from 16 to around 100,000,000 outputs. The chain has kept growing since, and press coverage of the 2026 stressnet cites more than 150 million.

Key point: Key images stay. Each spend still publishes a key image, so double-spend protection works exactly as before. What changes is how the spender proves the input exists.

How it works, without the heavy maths

FCMP++ is a composition of several cryptographic building blocks, designed by Luke Parker (kayabaNerve) and refined with Monero researchers and developers.

1. Curve Trees: putting every output into a tree

Every output, once it unlocks, is inserted into a giant Merkle tree built using a technique called Curve Trees. The tree’s root is a small value that commits to the whole set. Nodes maintain this tree in their database alongside the blockchain; the draft integration added new database tables and a migration that inserts all existing outputs.

To prove membership, you prove you know a path from your output up to the root, which needs only a handful of layers even for hundreds of millions of leaves.

2. Helios and Selene: a curve cycle

Proving a Merkle path in zero knowledge efficiently requires alternating between two elliptic curves whose arithmetic fits neatly inside each other. FCMP++ uses a purpose-built pair called Helios and Selene, which form a “tower cycle” over Monero’s existing Ed25519 curve. The getmonero.org contest announcement notes that this design is what lets Monero reuse its existing anonymity set: old outputs join the tree without anyone needing to move their funds.

3. Generalized Bulletproofs: the proof system

The membership proof itself uses Generalized Bulletproofs, an extension of the Bulletproofs family Monero already uses for range proofs. There is no trusted setup. In June 2026, the security firm zkSecurity reviewed the generalized-bulletproofs code for MAGIC Grants, covering both the implementation and the formal soundness argument, and reported several findings for the developers to address.

4. Re-randomised outputs and SA+L

The spender takes their real output and re-randomises it, producing a disguised version that can be proven to sit in the tree without revealing which leaf it came from. A separate component, Spend Authorization + Linkability (SA+L), proves the spender owns the output and ties it to the correct key image.

SA+L is the ”++” part. The original full-chain membership proof idea, presented at MoneroKon 2023, assumed it would ship with or after Seraphis. Adding SA+L made FCMP++ work directly on today’s transaction format instead.

5. Elliptic curve divisors

Verifying many curve operations inside the proof is expensive. FCMP++ uses research on elliptic curve divisors to make this cheaper. In 2025 the Monero Project ran an optimisation contest: the winning ec-divisors entry sped that library up by over 95%, and the helioselene winner achieved a weighted 22% speedup on desktop hardware. The project said this made a former pain point negligible.

Benefits beyond a bigger anonymity set

Forward secrecy deserves a note. If a large quantum computer ever appears, it could break the elliptic-curve maths Monero relies on. With today’s rings, such an attacker could in principle go back and deanonymise historical transactions. FCMP++ with Carrot is designed so that, in many cases, even that attacker could not recover who paid whom. It does not make Monero fully quantum-proof; it limits retroactive damage to privacy.

Carrot: the addressing protocol that ships with it

FCMP++ changes the consensus rules. Carrot (“Cryptonote Address on Rerandomizable-RingCT-Output Transactions”), led by developer jeffro256, changes how wallets build and recognise outputs. Per its specification:

• No forced migration. Standard addresses, subaddresses and integrated addresses keep working, and old seeds restore as before.
• Fixes for all wallets: protection against the Janus attack, which tries to link two of your subaddresses, and against the “burning bug”.
• 3-byte view tags for faster scanning, up from today’s 1 byte.
• A new optional key hierarchy for new wallets, with tiers such as generate-address, view-received, view-all and master. The view-all tier is a true view-only wallet that also sees outgoing payments.
• Stronger forward secrecy for wallets on the new hierarchy.

Tip: You will not need a new address on fork day. If you later want the new features, you can create a new Carrot-style wallet and move funds at your own pace.

What happened to Seraphis and Jamtis?

For several years the roadmap pointed toward Seraphis, a new transaction protocol, paired with Jamtis, a new address format with 196-character addresses starting with xmra. Together they would have delivered larger anonymity sets, better wallet tiers and Janus protection, but they required everyone to adopt new addresses and migrate funds to a new output format.

FCMP++ changed the calculation. It delivers a far larger anonymity set than Seraphis’s planned bigger rings, works with existing outputs, and with Carrot it covers most of Jamtis’s wallet features without new addresses. Comments on the Jamtis specification now mark it obsolete and say the Seraphis consensus model was dropped in favour of FCMP++. A variant called Jamtis-RCT could still be added later, and Carrot outputs are designed to look the same on-chain as Jamtis-style ones.

Seraphis work was not wasted. The Seraphis wallet library, with its faster asynchronous scanner, is being adapted for FCMP++ wallets, and developers report scanning speedups of 25-60% depending on node type. The getmonero.org roadmap still lists “Seraphis codebase and Jamtis” under coming soon, without dates.

FCMP++ status as of November 2026

Here is the verified timeline of public milestones.

What v3.1 fixed

The 26 October release notes describe a fix for a detectable inflation vulnerability on the stressnet: Carrot outputs could appear in legacy ring signatures. The bug was exposed in the 24 hours after the stressnet hard fork. This is exactly the kind of problem a stressnet exists to find. It affected only the test network, never mainnet. The release also added DoS protection in Tx relay v2, faster wallet scanning, and DoS protection in wallet-side tree building.

What remains before mainnet

The FCMP++ integration lead’s community-funded proposal lays out the path:

1. Alpha stressnet (done)
2. Beta stressnet (in progress, now at v3.1)
3. Finish code review and audits
4. Testnet
5. Mainnet

Open items mentioned include fee and scaling rules, multisig support for the new tree, hardware wallet integration, finishing integration documentation, and getting the remaining cryptography pull requests audited. On GitHub, the “fcmp++ hf” milestone in the main repository has no due date. At its last update in August 2026 it showed 26 issues closed and 13 open.

Warning: As of November 2026, no mainnet activation date or block height has been announced. Treat any website, video or “exchange notice” claiming FCMP++ is already live on mainnet, or that you must “migrate” coins through some service, as misinformation or a scam. Official announcements come from getmonero.org and the monero-project GitHub.

Meanwhile, mainnet runs the v0.18 “Fluorine Fermi” line, with v0.18.5.4 released on 17 October 2026 as a bug-fix point release. The stressnet builds already carry v0.19 version numbers, which signals the release line FCMP++ is expected to ship in.

What users should do now

1. Nothing urgent. Your coins and addresses are fine. There is nothing to migrate today.
2. Keep software updated on the v0.18.5.x line until a v0.19 mainnet release is announced.
3. Watch official channels: getmonero.org, the monero-project GitHub releases, and your wallet developer’s announcements. See News & Analysis for ongoing coverage.
4. Technical users can help: running a stressnet node or wallet and reporting bugs speeds up the path to mainnet.
5. Plan for fork day: when a height is set, update your node and wallet before that block, as with every past Monero network upgrade.

Summary

FCMP++ is the most significant change to Monero’s privacy model since RingCT. It swaps 16-member rings for a proof over the whole chain, ending decoy selection and its weaknesses, while Carrot adds full view-only wallets, Janus protection and forward secrecy without forcing new addresses. Seraphis and Jamtis were set aside because FCMP++ reaches most of their goals with far less disruption. In November 2026 the upgrade is in its beta stressnet phase, at v3.1, with audits and a testnet still ahead and no mainnet date announced.

For the building blocks FCMP++ keeps and replaces, read the rest of the Technology category.