Dagher et al. [DBB+15] introduced the Provisions protocol which allows Bitcoin exchanges to prove that they are solvent without revealing any additional information.
The protocol crucially relies on range proofs to prevent an exchange from inserting fake accounts with negative balances. These range proofs, which take up over 13GB, are the main contributors to the proof sizes of almost 18GB for a large exchange with 2 million customers. The proof size is in fact linear in the number of customers. Since in this protocol, one party (the exchange) has to construct many range proofs at once, the general Bulletproofs protocol from Section 4.3 is a natural replacement for the NIZK proof used in Provisions. With the proof size listed in Section 6, we obtain that the range proofs would take up less than 2kB with our protocol. Additionally, the other parts of the proof could be similarly compressed using the protocol from Section 5. The proof would then be dominated by one commitment per customer, with size 62MB. This is roughly 300 times smaller then the current implementation.
参考资料：
[1] 论文《Bulletproofs-Short Proofs for Confidential Transactions》