From https://monero.stackexchange.com/a/4169/4112, from a question asking whether one-time addresses can be reused:

Secondly, and this is even worse in my opinion, sending to the same stealth address will "burn" all outputs except one.

This makes me wonder. If I, Mallory, buy 0.05 XMR, and start sending around transactions of 0.000001 XMR to random existing stealth addresses (one of which is Bob):

  1. Is this possible?
  2. Which transaction will "burn", and which TXO will Bob be able to spend?

(If this appears to be a vulnerability, requiring the TX-public-key (R) to be unique might resolve this)

  1. Yes, it's possible.

  2. In theory, the person spending it could choose which to spend. This is possible because outputs are referenced by block height & index so even if one-time public key is the same, you could specify one or the other. You won't be allowed to spend the same key twice, because it will have the same key image, but you could pick which one to spend. All other instances of the same key would be burned. In practice, the one picked by the wallet output-picking algorithm. Also, example of what can happen if key image check has a flaw.

(If this appears to be a vulnerability, requiring the TX-public-key (R) to be unique might resolve this)

That wouldn't resolve it. In fact, you could entirely omit the TX-public key but then you'd have to find some other way of communicating the shared secret to your recipient. Protocol enforces only what happens between outputs (one-time public keys). The sender could announce his TX key anywhere, it doesn't have to be the blockchain but it's a practical way of not losing it, and with it the possibility to recover the funds should the TX key be lost. To understand why, see Stealth addresses: where do they come from?

On a second thought, even if you copied existing P, the receiving wallet wouldn't even see it unless you copied the TX key R as well. The wallet could in theory spend it in place of the other, but in practice it wouldn't even see it. So yeah, requiring the TX key to be unique would resolve it but IMO it would be better to enforce outputs to be unique since we don't put any restriction on TX key R as it is not fundamental - it's just a secret message really.

  • "In theory, the person spending it could choose which to spend.", how does that work, on a protocol/cryptography-level? How does one identify the TXO? Isn't that the (previous) destination address? – rubdos Dec 1 '17 at 21:56
  • 1
    This might be of interest =) Example of spending both, due to flaw in key image check. Outputs are referenced by block height & index so even if P is the same, you could specify one or the other. You won't be allowed to spend the same P twice, because it will have the same key image, but you could pick which P to spend. – JollyMort Dec 1 '17 at 22:17
  • Aha, so now only one part of the question remains: which P is picked by the official wallet? – rubdos Dec 1 '17 at 22:47
  • Your second thought doesn't still resolve it; burning money indeed requires to copy R over (which is perfectly possible). Which one is the one the wallet picks up? It perhaps even shows both in the current balance? – rubdos Dec 2 '17 at 7:31
  • I know; For the wallet, I don't know - the answer would be buried in the source code. It could be detecting the double and dealing with it, or it could be showing balance from both and then when one gets spent, balance of both would be deducted. – JollyMort Dec 2 '17 at 8:45

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.