In the RingCT paper, proof of theorem 5.1 (The Aggregate Schnorr Non-linkable ring signature is unforgeable under the discrete logarithm assumption), it is assumed by contradiction that there exists an adversary A capable of forging such ANSL's. The idea being that being able to produce such a forgery would imply solving the discrete logarithm problem for a certain public key P = xG to which A didn't know the private key x in advance.
However, in the proof it is stated: "Supposing that L11 = aG and L12 = bG, with a and b known to A, then(...)" but I don't think we can assume that from the hypothesis, or from the existence or the forgery alone, even though the L's came from the forgery. Am I reading this wrong, or is there a problem with this proof? Note that there is also already github issue on this question, but no response yet.