2

Is there a way to provide a 'proof of burn' in Monero?

Let's say I wanted to prove I sent some Monero coins to an address that no one has the private keys for.

Improve this question

1 Answer 1

Reset to default
4

There is a tradition in Monero that when you want to come up with a public key for which there is no known private key, you calculate that public key as H = hash_to_point(G), which in hex is 8b655970153799af2aeadc9ff1add0ea6c7251d54154cfa92c173a0dd39c1f94.

Therefore providing proof of payment to any wallet with H as the public spend key would be proof of burn.

If we set the private view key of that wallet to the number 1, then the public view key of the wallet will be G, which in hex is 5866666666666666666666666666666666666666666666666666666666666666

The wallet address for that combination of public view and spend keys is: 46uVWiE1d4kWJM3aAoCpHVgDCm5higshGVJBb4ZNpTYARp8rLcCdcA1J8QgRfFWTzmJ8QgRfFWTzmJ8QgRfFWTzmCag5CXT

The stagenet equivalent address is 577XbZ8yGfrWJM3aAoCpHVgDCm5higshGVJBb4ZNpTYARp8rLcCdcA1J8QgRfFWTzmJ8QgRfFWTzmJ8QgRfFWTzmCbXF9hd

The private view key, if you'd like to monitor that wallet, would be 0100000000000000000000000000000000000000000000000000000000000000.

You can use the "prove" feature in the Monero GUI to produce a proof (that will start with the string "OutProofV1") which will prove that you've sent a certain amount of funds to the address.

Of course, this solution means that anyone can monitor that account for incoming funds because the private view key is known.

You can burn funds to a wallet that also has no known private view key by using "H" for both the private view and private spend keys.

The mainnet wallet address for that would be: 46uVWiE1d4kWJM3aAoCpHVgDCm5higshGVJBb4ZNpTYARr4wKeg8fqzWJM3aAoCpHVgDCm5higshGVJBb4ZNpTYAHiN5zud

and the equivalent stagenet address would be:

577XbZ8yGfrWJM3aAoCpHVgDCm5higshGVJBb4ZNpTYARr4wKeg8fqzWJM3aAoCpHVgDCm5higshGVJBb4ZNpTYAHo2TYq6

Note: For historical reasons, Monero has defined H using a slightly different hash_to_point function than is currently used in RingCT. The hash_to_point used for the calculation of H historically has been hash_to_point_simple(G) = 8 * (the bytes of keccak(G) interpreted as an EC point). See How was the generator H for the RingCT scheme chosen?

Improve this answer
2
  • "There is a tradition in Monero that when you want to come up with a public key for which there is no known private key, you calculate that public key as H" First I ever hear about that alleged tradition :)
    – user36303
    Commented Jan 18, 2019 at 1:36
  • @user36303 I'm referring to the same H used for the blinding factors in RingCT. A similar scheme was used when coding the StringCT prototypes, where multiple variants of H were required. H was calculated similarly in Greg Maxwell's CT paper, but using a different hash function (sha256 instead of keccak). Perhaps I'm going a little over the top by referring to this as a "tradition"? :)
    – knaccc
    Commented Jan 18, 2019 at 1:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.