Is there a way to provide a 'proof of burn' in Monero?
Let's say I wanted to prove I sent some Monero coins to an address that no one has the private keys for.
There is a tradition in Monero that when you want to come up with a public key for which there is no known private key, you calculate that public key as H = hash_to_point(G), which in hex is
Therefore providing proof of payment to any wallet with H as the public spend key would be proof of burn.
If we set the private view key of that wallet to the number 1, then the public view key of the wallet will be G, which in hex is
The wallet address for that combination of public view and spend keys is:
The stagenet equivalent address is
The private view key, if you'd like to monitor that wallet, would be
You can use the "prove" feature in the Monero GUI to produce a proof (that will start with the string "OutProofV1") which will prove that you've sent a certain amount of funds to the address.
Of course, this solution means that anyone can monitor that account for incoming funds because the private view key is known.
You can burn funds to a wallet that also has no known private view key by using "H" for both the private view and private spend keys.
The mainnet wallet address for that would be:
and the equivalent stagenet address would be:
Note: For historical reasons, Monero has defined H using a slightly different hash_to_point function than is currently used in RingCT. The hash_to_point used for the calculation of H historically has been hash_to_point_simple(G) = 8 * (the bytes of keccak(G) interpreted as an EC point). See How was the generator H for the RingCT scheme chosen?