Creating a private cryptocurrency without trusted setup

Question

I am interested in creating a cryptocurrency that keeps the sender, the receiver and the amount private and does not require a trusted setup.

• I have already read the Zerocash protocol but It uses zk-SNARKs which require trusted setup.
• I have also read the Bulletproofs protocol which creates short proofs and without a trusted setup so it would be great to use it.

The problem is that Zerocash creates commitments and calculates the address public key using a hash function. I would like not to have to prove that a hash function was computed correctly because the proof would be long and slow.
The second problem is that in Zerocash, the sender proves that he owns that address private key and some random numbers such that when combined, they create a commitment that exists in the Merkle-tree of previously created coin commitments. I cannot find any protocol for proving set membership of a commitment C ϵ S that I know it’s opening; I can only find the opposite (i.e. to prove that one item x ϵ S is the opening of a commitment C).

1. Is it possible to prove that I know an opening x of a commitment C ϵ S without revealing neither the x nor the C and without a trusted setup?
2. Is it possible to create/link the address public and the address private without a hash function such that the sender can create that commitment with the address public and the receiver can prove the above with the address private key? What type of commitment would be possible?
3. How Is possible to fit the coin’s value and the nullifiers to all this? Does a cryptocurrency like that exist?

P.S.
Links to technical papers are welcome.
If this questing best fits in bitcoin.stackexchange.com please let me know.

Answer 1

The cryptocurrency you're describing does currently exist and implements, among other features, using unique Spend/View Keys in Monero (XMR). It capitalizes on a number of clever cryptographic techniques to implement a hardened total anonymization of source/destination (Ring Signatures/Stealth Addresses) and quantity (Ring Confidential Transactions/Bulletproofs).

It has also focused on maintaining a robust decentralized network via the (previously CryptoNote, GPU-optimized) RandomX PoW algorithm (CPU-optimized) that is highly ASIC-resistant, maintaining an optimal network dissemination by preventing any mining dominance by any centralized entity.

The original PoW and subsequent whitepapers can all be found at the webpage for the Monero Research Lab: https://web.getmonero.org/resources/research-lab/