5

From https://monero.stackexchange.com/a/4169/4112, from a question asking whether one-time addresses can be reused:

Secondly, and this is even worse in my opinion, sending to the same stealth address will "burn" all outputs except one.

This makes me wonder. If I, Mallory, buy 0.05 XMR, and start sending around transactions of 0.000001 XMR to random existing stealth addresses (one of which is Bob):

  1. Is this possible?
  2. Which transaction will "burn", and which TXO will Bob be able to spend?

(If this appears to be a vulnerability, requiring the TX-public-key (R) to be unique might resolve this)

Improve this question

1 Answer 1

Reset to default
3

  1. Yes, it's possible.

  2. In theory, the person spending it could choose which to spend. This is possible because outputs are referenced by block height & index so even if one-time public key is the same, you could specify one or the other. You won't be allowed to spend the same key twice, because it will have the same key image, but you could pick which one to spend. All other instances of the same key would be burned. In practice, the one picked by the wallet output-picking algorithm. Also, example of what can happen if key image check has a flaw.

(If this appears to be a vulnerability, requiring the TX-public-key (R) to be unique might resolve this)

That wouldn't resolve it. In fact, you could entirely omit the TX-public key but then you'd have to find some other way of communicating the shared secret to your recipient. Protocol enforces only what happens between outputs (one-time public keys). The sender could announce his TX key anywhere, it doesn't have to be the blockchain but it's a practical way of not losing it, and with it the possibility to recover the funds should the TX key be lost. To understand why, see Stealth addresses: where do they come from?

On a second thought, even if you copied existing P, the receiving wallet wouldn't even see it unless you copied the TX key R as well. The wallet could in theory spend it in place of the other, but in practice it wouldn't even see it. So yeah, requiring the TX key to be unique would resolve it but IMO it would be better to enforce outputs to be unique since we don't put any restriction on TX key R as it is not fundamental - it's just a secret message really.

Improve this answer
6
  • "In theory, the person spending it could choose which to spend.", how does that work, on a protocol/cryptography-level? How does one identify the TXO? Isn't that the (previous) destination address?
    – rubdos
    Dec 1, 2017 at 21:56
  • 1
    This might be of interest =) Example of spending both, due to flaw in key image check. Outputs are referenced by block height & index so even if P is the same, you could specify one or the other. You won't be allowed to spend the same P twice, because it will have the same key image, but you could pick which P to spend.
    – JollyMort
    Dec 1, 2017 at 22:17
  • 1
    Aha, so now only one part of the question remains: which P is picked by the official wallet?
    – rubdos
    Dec 1, 2017 at 22:47
  • Your second thought doesn't still resolve it; burning money indeed requires to copy R over (which is perfectly possible). Which one is the one the wallet picks up? It perhaps even shows both in the current balance?
    – rubdos
    Dec 2, 2017 at 7:31
  • 1
    I'll refrain from marking this as resolved then, until someone digs it up. I've tried reading the source myself, but I think someone with knowledge of the source should do that.
    – rubdos
    Dec 2, 2017 at 10:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.