1

Let's say I have three outputs that I own: 1st output with 1 Monero, 2nd output with 1 Monero, 3rd output with 100 Monero.

The logic of range proofs supposes that the amount of input Monero equals to the amount of output Monero.

What prevents me from creating two separate transactions that are spending outputs 1st and 2nd (and specifying corresponding Key Images, as usual), both of them are specifying the 3rd output as a "fake input" despite the fact I know all secret info, but the amount of output Monero in both of them, let's say, 90 Monero and 11 Monero are used for "balancing" the entire amount of outputs.

1st (1 Monero) + 3rd (100 Monero) = 4th_Mine (90 Monero) + range proof balancing (11 Monero)

2nd (1 Monero) + 3rd (100 Monero) = 5th_Mine (90 Monero) + range proof balancing (11 Monero)

In these two cases, I spent two outputs that originally had 1 Monero each but supposedly succeeded in creating a total output of 180 Monero.

1

1st (1 Monero) + 3rd (100 Monero) = 4th_Mine (90 Monero) + range proof balancing (11 Monero)

2nd (1 Monero) + 3rd (100 Monero) = 5th_Mine (90 Monero) + range proof balancing (11 Monero)

Let's call these TX1 and TX2 and lay them out a little more accurately.

The outputs either being spent or created are denoted by oN. Each real spend output appears in its own ring of decoy outputs, dN. For each created output there is a range proof bN.

TX1:
  Input rings:
    [o1, dN, dN, dN]
    [o3, dN, dN, dN]

  Key images:
    k1, k3

  Created outputs:
    o4, o5

  Range proofs:
    b4, b5

TX2:
  Input rings:
    [o2, dN, dN, dN]
    [o3, dN, dN, dN]

  Key images:
    k2, k3

  Created outputs:
    o6, o7

  Range proofs:
    b6, b7

In these two cases, I spent two outputs that originally had 1 Monero each but supposedly succeeded in creating a total output of 180 Monero.

But no. Only one of the above transactions will work, the other will be rejected.

What can prevent me from creating [these] two separate transactions...

The key image k3. As soon as a transaction is seen using kN, no subsequent transaction will be accepted trying to use the same key image. This is our double-spend protection.

The logic of range proofs supposes that the amount of input Monero equals to the amount of output Monero.

Not quite. The purpose of the range proofs are to ensure the outputs are within a non-negative range (e.g. [0, ..., 264-1]), they have nothing to do with double-spending. They aid in the balancing, only so far as to ensure none of the values used are negative, which could introduce a hidden inflation.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.