Title. This is probably a remarkably stupid question, but I digress. Now, I understand the point of rangeproofs, but I don't understand why they're actually necessary.

So, rangeproofs prevent a malicious user from committing to a negative number in the Pedersen Commitment. But going by that protocol (example implementation), successfully committing to a negative number should be impossible (or at least unreasonably expensive) if you choose a prime for g. Roots (which is what a negative exponent is) of any prime number are always going to be irrational, which means that you can't convert them back into an integer unless you multiply by g-n which brings them back to 1. Unless g2 < q (which can be prevented by simply choosing a g which doesn't fit that rule), then it's barely even possible to commit to -1 because mod q only allows for 1 valid number, let alone anything higher which requires exponentially higher numbers to reach a valid integer. This means that you can simply reject any commitment that equals 1.

Not only that, but the discrete logarithm problem should mean that the chances of successfully getting 1 at all are essentially non-existent in the first place.

So, in short, I don't understand why rangeproofs are necessary. By my understanding, the commitment system in and of itself should be resistant against committing to negative numbers

Title. This is probably a remarkably stupid question, but I digress. Now, I understand the point of rangeproofs, but I don't understand why they're actually necessary.

So, rangeproofs prevent a malicious user from committing to a negative number in the Pedersen Commitment. But going by that protocol (example implementation), successfully committing to a negative number should be impossible (or at least unreasonably expensive) if you choose a prime for g. Roots (which is what a negative exponent is) of any prime number are always going to be irrational, which means that you can't convert them back into an integer unless you multiply by g^-n which brings them back to 1. Unless g² < q (which can be prevented by simply choosing a g which doesn't fit that rule), then it's barely even possible to commit to -1 because mod q only allows for 1 valid number, let alone anything higher which requires exponentially higher numbers to reach a valid integer. This means that you can simply reject any commitment that equals 1.

Not only that, but the discrete logarithm problem should mean that the chances of successfully getting 1 at all are essentially non-existent in the first place.

So, in short, I don't understand why rangeproofs are necessary. By my understanding, the commitment system in and of itself should be resistant against committing to negative numbers