A one time address is supposed to be, well, used only once.

If you send two transactions to the same one time address, will both transactions be accepted into the block chain? I know that if they were, only one would be spendable.

  • In Monero a public can be and should be re-use. It is a radically different cryptocurrency than Bitcoin. Hopefully someone more knowledgeable will be able to extend on that.
    – ant Bldel
    Aug 13, 2016 at 17:38
  • @antBldel I know. I'm talking about the one time-addresses, which shouldn't be reused. I know standard addresses are fine to reuse. Aug 13, 2016 at 17:41
  • To clarify, the question is about one-time addresses, i.e. stealth addresses, which are different than the public addresses. The public addresses can be reused freely, whereas the steatlh addresses cannot.
    – dEBRUYNE
    Aug 13, 2016 at 17:46
  • @dEBRUYNE Or at least they shouldn't. On reddit we where talking about, for example, what would happen if someone uses bad rng. Aug 13, 2016 at 17:50

2 Answers 2


First, to clarify again, the question is about one-time addresses, i.e. stealth addresses, which are different than the public addresses. The public addresses can be reused freely, whereas the stealth addresses cannot. For consistency, I'll only use the term stealth address (one-time address) in this answer.

To answer your question, we first need a bit of background. In Monero, key images prevent double spending in the blockchain. Key images are generated by the receiver (Bob) of a transaction, to see if the outputs that belong to him are spendable. Or to put differently, if they aren't already spent. The receiver wants to verify this, because he will most likely want to spend his funds somewhere in the future. From core-team member luigi1111's article:

To check if P is spent, Bob computes its "key image" and queries the blockchain to see if it is marked as spent. Key image I = xHp(P).

Note that P is Bob's stealth address, with P = Hs(rA)G + B.


  • P -- the final stealth address (one-time output key, the destination where funds will actually be sent);
  • Hs* -- a hashing algorithm that returns a scalar (i.e., the hash output is interpreted as an integer and reduced modulo l);
  • r -- the new random scalar Alice chose for this transaction;
  • A -- Bob's public view key;
  • G -- the standard Ed25519 base point;
  • B -- Bob's public spend key.

From the formulas we can infer that, if the sender (Alice) uses the same stealth address of the receiver (Bob) for two transactions, Bob's outputs of one of the transactions will be burned. That is, both transactions will generate the same key image for Bob. Therefore, only Bob's outputs of one of the transactions are subsequently spendable. Now back to your question, given that stealth addresses are randomly generated, is it highly unlikely that Alice received the funds she has subsequently sent to Bob on a reused stealth address as well. Therefore, the key images generated by Alice are unique and she would be able to send two different transactions to the same stealth address of Bob, which thus will both be accepted into the blockchain.

I previously mentioned that stealth addresses are randomly generated and therefore should not be able to collide, or put differently, reused. One may ask themselves, how would a stealth address appear twice? To answer this, I'll use the comment of reddit user TheKing01:

Technically, stealth address reuse is already possible if you're dumb. A sender can use a one time address more than once if they aren't careful. (It does help though that it is happening all inside simplewallet, so their is no chance for human error in this regard. Either using third party buggy clients or using a bad random number generator could be a problem though).

There is a good way to prevent this type of failure though; simply check if the one time address you are using is already on the block chain (this can be done automatically). If it is, you know there is a problem.

  • 1
    I'm TheKing01 :) Aug 13, 2016 at 20:23
  • Good to know! Did my post sufficiently answer your question?
    – dEBRUYNE
    Aug 13, 2016 at 20:30
  • yeah. I was wondering if the Monero blockchain would reject the transaction, which I think you answered. Aug 13, 2016 at 20:31
  • In my example it will reject the outputs of one of Bob's transactions, but will accept both of Alice's transaction.
    – dEBRUYNE
    Aug 13, 2016 at 20:33
  • Does this mean all key images are stored somewhere forever, for new key images to be checked against?
    – bekah
    Dec 11, 2016 at 23:28

If two outputs are sent to the same one time address, they will be accepted by the blockchain. However, only one of them may be spent. It is equivalent to burning coins. The wallet is setup so that, if it detects this, the largest value output is used (assuming the first one is not spent before the second one arrives).

  • 1
    Huh, it would be a good idea to change that (so that the block chain rejects one of them). Aug 13, 2016 at 19:35
  • The blockchain will reject the smallest one if the receiver tries to subsequently spend them.
    – dEBRUYNE
    Aug 13, 2016 at 19:51
  • 2
    The network will reject a spend of the second one. The creation of the second output is still accepted, and is arguably something that would be best forbidden. Whether the smallest one is the one that's prevented depends on whether the first one is already spent when the second one is received.
    – user36303
    Aug 13, 2016 at 21:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.