10

I'm thinking of this as a way of verifying total coin supply.

I've seen another thread about a command to add up all coinbase tx's to do the same, but I'm curious about the utxo approach. Thanks

9

I don't think a utxo method is possible, because the blockchain is opaque. There are no unspent transaction outputs on the Monero blockchain, in other words.

There are no unspent transaction outputs on the Monero blockchain, in other words.

The above is a generalization, that isn't true in all cases. There are certain instances where an output can be shown to be provably spent. Nevertheless, the vast majority of outputs on the blockchain are not able to be provably spent.

Additionally, since RingCT, amounts in each new RingCT output are masked.

  • 1
    There are, but you don't know which. They get potentially spent every time they're used in someone's ring signature Only with the spend key, you're able to tell if it was actually spent or not. That's also the reason we can't purge unspent outputs - because we can't know which are unspent – JollyMort Oct 9 '16 at 8:02
  • I'm picturing all utxo's in this 'mixing pool' which the monero network inherantly is if i understand correctly. So is there not a way to get a snapshot of that mixing pool just to verify the total number of coins in that pool? I understand that at any point in time it is unclear where exactly those coins exist, and also that at any point in time, according to the network, they kind of exist in multiple places at once. It seems though that there should be a way to verify total quantity in that mixing pool, rather than going back and adding up all coinbase tx's. Appreciate the answers! – gdoober Oct 9 '16 at 10:36
  • @JollyMort Did you rather mean "can not purge spent transaction"? I mean the type of purging that is done after the client downloads whole chain and verifies all transactions (but is such verification ever possible in Monero?) and then purges the spent ones and only keep the unspent to be able to verify new transactions... but maybe I am way off here. – Kozuch Dec 22 '17 at 21:53
  • "Can't purge spent outputs" is true. But if you don't know what is spent and what is not (and you don't), then it becomes "Can't purge any output" :) Without ring signatures, you could purge unspent as you could tell them apart but then we'd lose untraceability and there's still the problem of validating current state of blockchain... unspent must come with proof as to why it's unspent and why it has rights to a balance - that's recorded in previous spent outputs :) – JollyMort Dec 22 '17 at 22:31
7

If I understand well, the "mixing pool" is basically the entire blockchain, ie, every output on it. Not every coin, but every output appearing on the blockchain, spent or unspent (you can't tell them apart). Note sum(outputs) > sum(coinbase). It's just the matter of matching an amount being actually sent with the amount of an output found on the blockchain and then "mix". Note that nothing is actually mixed as in coinjoin or other solutions. The extra outputs are not "real" so those didn't move but you can't tell the difference unless you have the keys to the real one. That's why we split into denominations, to make this work smoothly and have enough matching ones available for each amount. To verify the total available supply, just adding the outputs won't work as each ring signature has a few, and only 1 gets spent. Every one of them will appear many times on the blockchain.

So, adding up outputs can't tell you anything, as you can't really know which of those to add up. If you add up all of them, because some are spent, you will get the wrong value (larger than supply).

  • lol wrote this as a comment in the wrong box, but I guess it qualifies as an answer too – JollyMort Oct 10 '16 at 21:14
  • I worded that poorly when I said the pool was the network. Thanks for clarifying. Edit, wasn't done lol. One statement has me confused. "but every output appearing on the blockchain, spent or unspent". The part that confuses me is the unspent....so the pool of potential mixing candidates will grow with every transaction ever recorded? That would seem to create eventually a massive pool. I take it the size of the pool of mixins won't cause a delay as it gets bigger? – gdoober Oct 10 '16 at 21:14
  • Yes it will get bigger. But the pool is the actual transactions done by the users, not a separate thing. Whenever you send Monero, your outputs are available for someone to mix with. It's the blockchain, and it will grow, yes, there's no way around it - all cryptocurrencies "suffer" from this – JollyMort Oct 11 '16 at 18:51
  • If I understand this correctly the inability to see UTXOs comes from the untracebility/unlinkability of Monero transactions - the wallet addresses can not be traced from transaction to transaction (to transaction etc.) so you can never know if the ballance of a given "wallet address" (correctly stealth address) has not been spent in some future transaction later in the blockchain. Am I right? – Kozuch Dec 22 '17 at 22:04
  • Well, "stealth address" can refer to one-time key, in which case it's NOT the wallet address. In fact, wallet address never appears on the blockchain, but unique public one-time keys do. Every time you receive, a brand-new one is created. This alone would still allow knowing which one-time got spent. Ring signatures make it unknowable (making it untraceable) as when you spend, the output is ringed together with random others just to obfuscate. It's not possible to tell which one is "real" but only that whichever it is - it hasn't been used before (double-spend protection, see "key image"). – JollyMort Dec 22 '17 at 22:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.