[tromp]

In a Mimblewimble [1] blockchain, values are hidden inside Pedersen commitments, blind * G + value * H, and inputs can be seen to match outputs of a transaction if the latter minus the former is of the form blind*G (the difference in value is 0). But this form is a public key that the transactors can produce a signature for! This is way simpler than a bulletproof. BUT, bulletproofs are needed to show that the output values are in a certain range, to prevent overflow in value arithmetic.

[1] https://www.youtube.com/watch?v=BMiM0rabRjc

[jlrubin]

Correct -- the bulletproofs are only for the range proofs, but thought that was a bit too involved for my tldr :)