11

Double spends are prevented by the use of key images, which are sent along with each output being spent in a transaction, and which are checked for uniqueness before allowing the transaction. In the Cryptonote protocol, an output's private key can be used to uniquely generate a key image in such a way that a miner can check a purported key image really is ...


10

Each transaction generates a key image. In the CryptoNote protocol, key images used more than once are rejected by the blockchain as double-spends. When a new transaction is received, the miner need only verify that the key image does not already exist in the database. When your wallet is scanning the blockchain, it must check each transaction output in ...


8

Looks like it was being exploited on Bytecoin For example, these 2 transactions spend the output 26e8958fc2b227b045c3f489f2ef98f0d5dfac05d3c63339b13802886d53fc05 twice! http://chainradar.com/bcn/transaction/cef289d7fab6e35ac123db8a3f06f7675b48067e0dff185c72b140845b8b3b23 http://chainradar.com/bcn/transaction/...


7

Given a finite group of integers, any group element Z in a group of order n, Z^n will always equal the identity element (order == number of elements in group). ECC has an equivalent abstraction - multiplying any point in a finite group by the order of the group will result in the identity element. The identity element is analogous to zero in the set of ...


7

RingCT does not create fake outputs. Here is a good dumbed-down explanation of its principle: ELI5: How does RingCT work? Therefore there is no difference between "normal" transactions and RingCT ones in terms of double-spend prevention: it is handled in the exact same way using key images.


4

First one to get in a block wins, there can be no other way as far as I understand. I mean, who has the authority to say which one came first? For this, we have PoW and the blockchain - to avoid having to rely on "someone said this came first". Until it's mined, it's undefined.


4

The above answer by Lee Clagett is also helpful for understanding how the exploit on Bytecoin took place, which is different and less effective than the exploit discovered by MRL. The attacker first transferred funds from a valid Ed25519 point to a low-order point. Let us denote this low-order point as P. The signature for double-spend checking consists of a ...


3

It depends heavily on how much work has to be (provably) redone. If you act upon a transaction that has just hit the txpool, there is not work yet to be redone by a miner, so it's cheap. Same as for bitcoin. This assumes that the attacker is able to send a tx to your pool, while sending a different tx spending at least an identical input to mining pools. As ...


1

1st (1 Monero) + 3rd (100 Monero) = 4th_Mine (90 Monero) + range proof balancing (11 Monero) 2nd (1 Monero) + 3rd (100 Monero) = 5th_Mine (90 Monero) + range proof balancing (11 Monero) Let's call these TX1 and TX2 and lay them out a little more accurately. The outputs either being spent or created are denoted by oN. Each real spend output appears in ...


1

As I understand it, if a mining operator was to attain 51% of the network, they can perform a double spend. This is one thing they could do, yes. But would this be detected? You cannot detect a 51% attack occurring. To perform a 51% attack, you'd have to mine a secret chain with greater difficulty than the main chain, then replay this secret chain on ...


Only top voted, non community-wiki answers of a minimum length are eligible