FeedMeAttack.md

Assuming design: https://gist.github.com/DavidBurkett/ba41f314b12566987dc9ba3534c6c773

Setup

Alice creates 2 outputs for Bob:

OB1 = { v1, Kr1 = B + HASH32(T_RECEIVE||t1)*G}
OB2 = { v2, Kr2 = B + HASH32(T_RECEIVE||t2)*G}

where v₂ > v₁.

Bob spends O_B¹ to Alice, creating output O_A¹ in tx₁, and spends O_B² to Charlie, creating output O_C in tx₂:

tx1: {in: OB1; kern: k1; out: OA}
tx2: {in: OB2; kern: k2; out: OC}

Both transactions are broadcast at the same time.

Attack

Alice, a miner, sees both transactions, and realizes she has an opportunity to receive v₂ coins instead of v₁.

She modifies tx₁, creating tx₁':

tx1': {in: OB2; kern: k1; out: OA'} where O_A' consists a new commitment for v₂ coins.

She knows the blinding factor of O_B², since she created it, so generating a new commitment and balancing the kernel excess is trivial.

She generates a new rangeproof for O_A', committing to the same output data (i.e. {v'||n'||Ks||Kr||Ke||ρ}) as O_A

Stealth Offset

Now everything validates except for the stealth excess equation (i.e. t'*G = (ΣKs - ΣKr) - ΣE')

Alice does not know K_r¹ or K_r², but she does know the difference between the 2:

kr2 - kr1 = HASH32(T_RECEIVE||t2) - HASH32(T_RECEIVE||t1)

To make the stealth offset equation balance, she can just increase the stealth offset for tx₁' by kr2 - kr1