# How does one burn and provide a proof-of-burn in Monero?

Is there a way to provide a 'proof of burn' in Monero?

Let's say I wanted to prove I sent some Monero coins to an address that no one has the private keys for.

There is a tradition in Monero that when you want to come up with a public key for which there is no known private key, you calculate that public key as H = hash_to_point(G), which in hex is `8b655970153799af2aeadc9ff1add0ea6c7251d54154cfa92c173a0dd39c1f94`.

Therefore providing proof of payment to any wallet with H as the public spend key would be proof of burn.

If we set the private view key of that wallet to the number 1, then the public view key of the wallet will be G, which in hex is `5866666666666666666666666666666666666666666666666666666666666666`

The wallet address for that combination of public view and spend keys is: `46uVWiE1d4kWJM3aAoCpHVgDCm5higshGVJBb4ZNpTYARp8rLcCdcA1J8QgRfFWTzmJ8QgRfFWTzmJ8QgRfFWTzmCag5CXT`

The stagenet equivalent address is `577XbZ8yGfrWJM3aAoCpHVgDCm5higshGVJBb4ZNpTYARp8rLcCdcA1J8QgRfFWTzmJ8QgRfFWTzmJ8QgRfFWTzmCbXF9hd`

The private view key, if you'd like to monitor that wallet, would be `0100000000000000000000000000000000000000000000000000000000000000`.

You can use the "prove" feature in the Monero GUI to produce a proof (that will start with the string "OutProofV1") which will prove that you've sent a certain amount of funds to the address.

Of course, this solution means that anyone can monitor that account for incoming funds because the private view key is known.

You can burn funds to a wallet that also has no known private view key by using "H" for both the private view and private spend keys.

The mainnet wallet address for that would be: `46uVWiE1d4kWJM3aAoCpHVgDCm5higshGVJBb4ZNpTYARr4wKeg8fqzWJM3aAoCpHVgDCm5higshGVJBb4ZNpTYAHiN5zud`

and the equivalent stagenet address would be:

`577XbZ8yGfrWJM3aAoCpHVgDCm5higshGVJBb4ZNpTYARr4wKeg8fqzWJM3aAoCpHVgDCm5higshGVJBb4ZNpTYAHo2TYq6`

Note: For historical reasons, Monero has defined H using a slightly different hash_to_point function than is currently used in RingCT. The hash_to_point used for the calculation of H historically has been hash_to_point_simple(G) = 8 * (the bytes of keccak(G) interpreted as an EC point). See How was the generator H for the RingCT scheme chosen?

• "There is a tradition in Monero that when you want to come up with a public key for which there is no known private key, you calculate that public key as H" First I ever hear about that alleged tradition :) Jan 18, 2019 at 1:36
• @user36303 I'm referring to the same H used for the blinding factors in RingCT. A similar scheme was used when coding the StringCT prototypes, where multiple variants of H were required. H was calculated similarly in Greg Maxwell's CT paper, but using a different hash function (sha256 instead of keccak). Perhaps I'm going a little over the top by referring to this as a "tradition"? :) Jan 18, 2019 at 1:41