# How does a third-party verify that I have the XMR to make a payment?

Say I have 10 XMR but I want to pay out 11 XMR. How do nodes tell that I don't have enough XMR? Do I have to share my viewkey with them?

According to Section 4.3 of the CryptoNote white paper, transactions aren't directly signed by the sender's spending key. Instead, they are signed by the private key goes with the one-time public key.

For example, suppose Alice sends Bob 5 XMR via `pub`, a generated transaction public key. Bob can see that `pub` is for him using his private keys. Whenever Bob wants to use this XMR, he generates the private key, `priv`, using his keys and the transaction's random data. He signs future spending of this money with `priv`.

I think Alice can see that `priv` was used. However, she cannot uncover `priv`. Also, she cannot see the recipient of the transaction because it is sent to a new generated public key.

Moreover, assuming no other income, Bob cannot send 6 XMR to Carol. Nodes assert this by checking where a transaction's XMR come from via `pub`. That is, a node would see that `pub` is only for a transaction that moved 5 XMR and thus cannot sign a transaction for 6 XMR.

• Pre-RingCT the values of inputs and outputs were visible on the blockchain. This is no longer the case with RingCT transactions. Commented Mar 23, 2017 at 21:03

XMR first comes into existence in a coinbase transaction. A coinbase transaction exists for every single block that was ever mined. The value of the output of this coinbase transaction is transparent and publicly visible on the blockchain.

When you spend Monero, the amount you spend is concealed because Monero now uses RingCT. All the miners need to see is a mathematical proof which is included in the transaction which demonstrates that the sum of the values of the outputs of the transaction are equal to the sum of the values of the inputs of the transaction. Miners cannot know the real sum of inputs or outputs, they can only verify that the sums are equal and that therefore no XMR has been fabricated out of nowhere.

Only the private view key of the recipient can be used to determine the actual value of the outputs that the recipient has received. The miner did not need to know the actual amount received, so does not need to know the view key.

Say I have 10 XMR but I want to pay out 11 XMR. How do nodes tell that I don't have enough XMR? Do I have to share my viewkey with them?

Trick to understanding the answer is in understanding what it means to "have 10 XMR"?

Your wallet's balance is made up of multiple one-time keys, each containing some amount of XMR. Pre-RCT, the amount of each "container" was visible by everyone. You can't spend only a part of each container - you either spend it all or you don't. So all the nodes have to check is whether that container has already been spent and the mechanism to check that are key images.

Now that we've clarified what it means "to have", how do you send? To send XMR you must create one brand new one-time key as the container for the recipient and one for yourself (for the change). Then, the network checks that you've signed to empty enough of your old containers, and the total amount consumed must be equal to the total amount created. That's it. With RCT, the main difference is in that the verification of the sum(inputs)=sum(outputs) is performed without revealing actual amounts! Here's a very simple explanation.