Skip to main content

Overview

When a user registers their X25519 key after already having encrypted token accounts in MXE-only mode, those existing balances remain in MXE-only mode. getNetworkEncryptionToSharedEncryptionConverterFunction upgrades them to Shared mode - re-encrypting the balance under both the Arcium MPC key and the user’s X25519 key, enabling local balance queries in the future.
This step is only necessary if you deposited tokens before registering your X25519 key (i.e., before calling register({ confidential: true })). Deposits made after X25519 registration automatically use Shared mode.

Usage

Parameters

Address[]
required
An array of SPL or Token-2022 mint addresses to convert. Only accounts in MXE-only mode with an initialized balance will be converted. Others are automatically skipped and reported in result.skipped.
Uint8Array
32 bytes of optional metadata stored with each conversion transaction. Defaults to all zeros.
ConvertToSharedHooks
Optional per-mint + overall lifecycle hooks. Each per-mint conversion is an MPC step (onPreSend, onPostSend, onMonitorStarted, onFinalized).
MicroLamportsPerAcu
Optional Arcium compute-unit priority fee.

Return Value

  • converted - mints that were successfully upgraded, mapped to their transaction signature
  • skipped - mints that were not processed, mapped to the reason they were skipped
Skip reasons:
  • "non_existent" - No encrypted token account exists for this mint
  • "not_initialised" - The token account exists but is not initialized
  • "already_shared" - The token account is already in Shared mode (no-op)
  • "balance_not_initialised" - The Arcium balance has not been initialized yet

Example

Rotate Mint Encryption Key

If a per-mint X25519 key may have been compromised, use the mint X25519 rotator from @umbra-privacy/sdk/account:
This is an MPC operation — it re-encrypts the on-chain balance under the new per-mint key. The account must already be in Shared mode. See Recovery & Rotation for details on when and how to rotate keys.

When to Call This

A typical onboarding flow checks whether conversion is needed after completing registration:

Error Handling

Conversion processes each mint sequentially. If a transaction fails or is cancelled mid-way, any mints already converted will have their signatures in result.converted - they are not rolled back.
Conversion is idempotent for mints that are already in Shared mode - they are returned in result.skipped with reason "already_shared". It is safe to call convert() repeatedly with the same mint list.
See Error Handling for a full reference of all error types.

How It Works

The conversion follows the dual-instruction pattern. For each eligible token account:
  1. The handler instruction queues a re-encryption computation on Arcium
  2. Arcium MPC decrypts the MXE-only balance and re-encrypts it under both the MPC key and the user’s X25519 key
  3. The callback instruction updates the on-chain account to Shared mode
After conversion, future balance queries will be able to decrypt locally using the user’s X25519 private key.