ZSA Guide Zcash Shielded Assets: asset identity, issuance, transfer, and burn 4 OrchardZSA Actions and Action Groups 6 Issuance of Custom Assets

5 Burn and the binding signature

This section defines the burn set and the OrchardZSA bundle that it completes (§5.1); constructs the binding validating key, which subtracts the burnt amounts Asset by Asset (§5.2); and proves that a verifying binding signature forces per-Asset balance whenever every witnessed Asset Base and every Asset Base of a burn pair is a group-hash output at a suitably distinct input (§5.3). The premise on the bases concerns a single bundle; it is discharged for valid chains in “Security” (§9). The constructions are taken from ZIP 226 and ZIP 227, both Draft. The Orchard binding signature that they extend is that of the Ironwood Guide, §“The binding signature”, and is cited, not restated.

5.1 Burn sets and OrchardZSA bundles

Definition 5.1 (Burn set).

Burn destroys a stated amount of a Custom Asset (Definition 1.5): it sends nothing to any address, lowers the amount of the Asset in circulation, and publishes the Asset Base and the amount, so that the destruction is publicly verifiable. A burn set $\mathsf{assetBurn}$ is a finite set of pairs $(\mathsf{AssetBase},v)$ with $\mathsf{AssetBase}\in\mathcal{E}^{*}$ and $v\in\mathbb{Z}$ . The author of a transaction adds one pair for each Custom Asset that the transaction burns, $v$ being the amount burnt. The constant

\mathsf{MAX\_BURN\_VALUE}:=2^{63}-1=9\,223\,372\,036\,854\,775\,807

bounds the amount of one Custom Asset burnt in one transaction, so that every burnt amount is representable in a signed $64$ -bit balance field. A burn set is valid when it satisfies the following rules.

(B1)

For every pair, $\mathsf{AssetBase}\neq V^{\mathsf{Orchard}}$ : the Native Asset Base (Definition 2.15), of ZEC and of TAZ alike, is never burnt.
(B2)

For every pair, $0<v\leq\mathsf{MAX\_BURN\_VALUE}$ .
(B3)

Every Asset Base occurs in at most one pair. The burnt amount $v_{B}$ of a point $B$ is therefore well defined: the $v$ of the pair with $\mathsf{AssetBase}=B$ , or $0$ if there is none.

Rules (B1) to (B3) constrain the pairs only. Rule (B1) excludes the one point $V^{\mathsf{Orchard}}$ and no other, and no rule requires $\mathsf{AssetBase}$ to be the Asset Base of an issued Asset. The state rule that a burn cannot exceed the amount of the Asset in circulation is ZIP 227’s; it is rule (T4) of Construction 7.3, in “State transition of a transaction” (§7.2) (ZIP 226, “Burn Mechanism”, “Additional Consensus Rules for the assetBurn set” and “Rationale for MAX_BURN_VALUE”; ZIP 227, “Specification: Consensus Rule Changes”). Class: specified; the carrier of the burn set is stated in “Transaction formats” (§8.1).

Definition 5.2 (OrchardZSA bundle).

The OrchardZSA bundle of a transaction consists of at most one Action Group (Definition 4.13), one burn set $\mathsf{assetBurn}$ satisfying (B1) to (B3), one balancing value $v^{\mathsf{balance}}$ and one binding signature. It extends the Ironwood Guide’s Definition “Bundle” by the burn set; its anchor, flags and proof are those of the Action Group. ZIP 226 places one burn set in the transaction, and ZIP 227 limits the transaction to at most one Action Group, so the two readings coincide (ZIP 226, “Burn Mechanism”; ZIP 227, “Specification: Consensus Rule Changes”). Class: the structure is specified; its encoding, one burn set per Action Group in withdrawn ZIP 230, belongs to the carrier and is classified in Remark 8.1.

Remark 5.3 (No transparent pool for Custom Assets).

ZIPs 226 and 227 leave the transparent protocol unchanged and single-asset. Transparent inputs and outputs, and the Ironwood Guide’s transparent transaction value pool (Definition “Transparent transaction value pool”), carry the Native Asset only; Custom Assets have no transparent value pool and cannot be unshielded by a transfer. ZIP 226 conditions this on future consensus changes, which no ZIP specifies (ZIP 226, “Burn Mechanism”, note; “Rationale for Value Balance Verification”: “All Custom Assets are contained within the shielded pool, and cannot be unshielded via a regular transfer”). Structurally, the binding validating key of the next subsection (Definition 5.4) has, besides the Actions’ net value commitments, only the balancing value at $V^{\mathsf{Orchard}}$ and one burn term per pair; a non-zero net amount of a Custom Asset in a bundle can therefore be absorbed only by a burn pair of that Asset. The computational statement is Proposition 5.6. Class: specified.

5.2 The binding validating key

Definition 5.4 (Binding validating key of an OrchardZSA bundle).

Let an OrchardZSA bundle have $n$ Actions with net value commitments $\mathsf{cv}^{\mathsf{net}}_{1},\dots,\mathsf{cv}^{\mathsf{net}}_{n}$ (Definition 3.8), trapdoors $\mathsf{rcv}_{1},\dots,\mathsf{rcv}_{n}$ , balancing value $v^{\mathsf{balance}}$ and burn set $\mathsf{assetBurn}$ . The binding signing key is unchanged:

\mathsf{bsk}:=\mathsf{rcv}_{1}+\dots+\mathsf{rcv}_{n}\in\mathbb{F}_{p_{\mathsf% {Vesta}}}

(Ironwood Guide, Definition “Binding signing key”). The verifier computes, from public fields only, the binding validating key

\mathsf{bvk}:=\Bigl{(}\sum_{i=1}^{n}\mathsf{cv}^{\mathsf{net}}_{i}\Bigr{)}-[v^% {\mathsf{balance}}]\,V^{\mathsf{Orchard}}-\sum_{(\mathsf{AssetBase},v)\in% \mathsf{assetBurn}}[v]\,\mathsf{AssetBase},

where the subtracted points are the zero-trapdoor commitments

\mathsf{ValueCommit}^{\mathsf{OrchardZSA}}_{0}(V^{\mathsf{Orchard}},v^{\mathsf% {balance}})\quad\text{and}\quad\mathsf{ValueCommit}^{\mathsf{OrchardZSA}}_{0}(% \mathsf{AssetBase},v),

each signed integer entering as its residue modulo $p_{\mathsf{Vesta}}$ . Against the Ironwood Guide’s Definition “Binding validating key” two things are new: the bases of the Actions’ commitments vary, being the witnessed Asset Bases, and one burn term is subtracted per pair.

The balancing value keeps the meaning of the Ironwood Guide’s Definitions “Transparent transaction value pool” and “Balancing value”: the net flow of ZEC between the pool and the transparent transaction value pool, a signed integer in $\{-2^{63},\dots,2^{63}-1\}$ . It enters $\mathsf{bvk}$ at $V^{\mathsf{Orchard}}$ only. Its meaning rests on the key of ZIP 226; its encoding, the field valueBalanceOrchard of withdrawn ZIP 230, belongs to the carrier.

The binding signature is that of the Ironwood Guide’s Construction “Binding signature”, the binding-signature instance of RedPallas on the base $R^{\mathsf{Orchard}}$ (Ironwood Guide, §“The RedPallas signature scheme”): the author signs $\mathsf{SigHash}$ with $\mathsf{bsk}$ , and the verifier MUST validate the signature on $\mathsf{SigHash}$ under $\mathsf{bvk}$ . Here $\mathsf{SigHash}$ is the signature digest of the transaction (Ironwood Guide, Definition “Signature digest”) as modified for OrchardZSA; the modifications and their class are stated in “Transaction digests and the signature message” (§8.2, Remark 8.3) (ZIP 226, “Value Balance Verification” and “Value Commitment”; protocol specification, §“Balance and Binding Signature (Orchard)”). Class: specified; the signed message is not.

For an honestly constructed bundle each $\mathsf{cv}^{\mathsf{net}}_{i}$ equals $[v^{\prime}_{i}-v^{\mathsf{new}}_{i}]\,\mathsf{AssetBase}_{i}+[\mathsf{rcv}_{i% }]\,R^{\mathsf{Orchard}}$ , by condition A4^′ of Definition 4.6. By the additive homomorphism (Crypto Guide, §“The Pedersen commitment”, Theorem “Additive homomorphism”), the trapdoor terms sum to $[\mathsf{bsk}]\,R^{\mathsf{Orchard}}$ , and the value terms group by Asset Base. When the net values of each Custom Asset sum to its burnt amount and those of ZEC to $v^{\mathsf{balance}}$ , every value term cancels, so $\mathsf{bvk}=[\mathsf{bsk}]\,R^{\mathsf{Orchard}}$ , the pair $(\mathsf{bsk},\mathsf{bvk})$ is a key pair of the instance, and the honest signature is accepted, as in the paragraph after the Ironwood Guide’s Construction “Binding signature”. In the notation of ZIP 226, with $S_{\mathsf{CA}}$ the indices of the Actions of Custom Assets, a correctly constructed bundle satisfies

\sum_{j\in S_{\mathsf{CA}}}\mathsf{cv}^{\mathsf{net}}_{j}-\sum_{(\mathsf{% AssetBase},v)\in\mathsf{assetBurn}}[v]\,\mathsf{AssetBase}=\Bigl{[}\sum_{j\in S% _{\mathsf{CA}}}\mathsf{rcv}_{j}\Bigr{]}\,R^{\mathsf{Orchard}}

(ZIP 226, “Rationale for Value Balance Verification”). For a Split Action $v^{\prime}=0$ , so the value of the copied note never enters $\mathsf{bvk}$ : the commitment $[0-v^{\mathsf{new}}]\,\mathsf{AssetBase}+[\mathsf{rcv}]\,R^{\mathsf{Orchard}}$ cancels against the value of the notes of the same Asset consumed by real spends in other Actions (ZIP 226, “Split Notes”).

The key $\mathsf{bvk}$ is computed from the Actions’ commitments, the balancing value and the burn set, and of these only the burn set names an Asset, by publishing each burnt Asset Base with its amount. The hiding of the Actions’ Asset Bases is Theorem 9.11, in “Security”.

5.3 Per-Asset balance

Lemma 5.5 (Modular per-Asset balance is integer balance).

Let $n\leq 62\,500$ . For $1\leq i\leq n$ let $v^{\prime}_{i}$ and $v^{\mathsf{new}}_{i}$ be integers in $\{0,\dots,2^{64}-1\}$ and $\mathsf{AssetBase}_{i}$ a point. Let $\mathsf{assetBurn}$ satisfy (B2) and (B3), with burnt amounts $v_{B}$ , and let $v^{\mathsf{balance}}$ be an integer in $\{-2^{63},\dots,2^{63}-1\}$ . For a point $B$ put

	$\displaystyle c_{B}$	$\displaystyle:=\sum_{i:\,\mathsf{AssetBase}_{i}=B}(v^{\prime}_{i}-v^{\mathsf{% new}}_{i})-v_{B}$	$\displaystyle(B\neq V^{\mathsf{Orchard}}),$
	$\displaystyle c_{V^{\mathsf{Orchard}}}$	$\displaystyle:=\sum_{i:\,\mathsf{AssetBase}_{i}=V^{\mathsf{Orchard}}}(v^{% \prime}_{i}-v^{\mathsf{new}}_{i})-v^{\mathsf{balance}},$

rule (B1) giving $v_{V^{\mathsf{Orchard}}}=0$ for a valid burn set. If $c_{B}\equiv 0\pmod{p_{\mathsf{Vesta}}}$ , then $c_{B}=0$ as an integer.

The hypotheses hold for every OrchardZSA bundle of a valid block. Every Action carries its own $32$ -byte nullifier (Ironwood Guide, Definition “Action description”; protocol specification, §“Action Description Encoding and Consensus”), and a block, hence a transaction, holds at most $2\,000\,000$ bytes (protocol specification, §“Block Header Encoding and Consensus”), so

n\leq 2\,000\,000/32=62\,500<2^{16}

whatever the carrier. The values are $64$ -bit by Definition 3.1, with $v^{\prime}\in\{0,v^{\mathsf{old}}\}$ by the notation of Definition 4.6; burnt amounts are bounded by (B2), and the balancing value by Definition 5.4. No carrier-specific bound on the number of Actions is needed. Status (Definition 1.3): proved here; conditional on no unspecified object.

Proof.

The argument is that of the Ironwood Guide’s Lemma “Modular balance is integer balance”. Each difference $v^{\prime}_{i}-v^{\mathsf{new}}_{i}$ has absolute value at most $2^{64}-1$ , and $n\leq 2^{16}-1$ . For $B\neq V^{\mathsf{Orchard}}$ , rule (B2) gives $0\leq v_{B}\leq 2^{63}-1$ , so

|c_{B}|\leq(2^{16}-1)(2^{64}-1)+(2^{63}-1)=1\,208\,916\,596\,242\,592\,319\,86% 4\,832;

for $V^{\mathsf{Orchard}}$ , with $|v^{\mathsf{balance}}|\leq 2^{63}$ ,

|c_{V^{\mathsf{Orchard}}}|\leq(2^{16}-1)(2^{64}-1)+2^{63}=1\,208\,916\,596\,24% 2\,592\,319\,864\,833,

the upper end of the range in the protocol specification, §“Balance and Binding Signature (Orchard)”. Both bounds are below $2^{80}<2^{253}\leq(p_{\mathsf{Vesta}}-1)/2$ (Ironwood Guide, §“Fields, groups, and encodings”; protocol specification, §“Pallas and Vesta”). The hypothesis makes $c_{B}$ a multiple of $p_{\mathsf{Vesta}}$ , the order of the Pallas group, and the only such multiple of absolute value below $p_{\mathsf{Vesta}}$ is $0$ . □

The protocol specification’s argument in §“Balance and Binding Signature (Orchard)” bounds the number of Actions by $2^{16}-1$ through a separate consensus rule, which it notes is redundant given the $2$ MB transaction size limit; the lemma uses the block size itself.

Fix an OrchardZSA bundle as in Definition 5.4, and let $\mathfrak{B}$ be the set of points consisting of $V^{\mathsf{Orchard}}$ , the Asset Bases of the Actions and the Asset Bases of the burn pairs. An opening of $\mathsf{cv}^{\mathsf{net}}_{i}$ is a triple $(B_{i},u_{i},r_{i})$ of a point $B_{i}\in\mathfrak{B}$ , an integer $u_{i}$ and a scalar $r_{i}\in\mathbb{F}_{p_{\mathsf{Vesta}}}$ with

\mathsf{cv}^{\mathsf{net}}_{i}=[u_{i}\bmod p_{\mathsf{Vesta}}]\,B_{i}+[r_{i}]% \,R^{\mathsf{Orchard}}.

For openings, $c_{B}$ is defined for $B\in\mathfrak{B}$ as in Lemma 5.5, with $B_{i}$ in place of $\mathsf{AssetBase}_{i}$ and $u_{i}$ in place of $v^{\prime}_{i}-v^{\mathsf{new}}_{i}$ . The set $\mathfrak{B}$ meets the premise on the bases when every $B\in\mathfrak{B}$ other than $V^{\mathsf{Orchard}}$ is given with an input $x_{B}$ of $\mathsf{GroupHash}$ such that $B=\mathsf{GroupHash}(x_{B})$ and $x_{B}$ differs from the inputs $(\texttt{z.cash:Orchard-cv},\texttt{v})$ of $V^{\mathsf{Orchard}}$ and $(\texttt{z.cash:Orchard-cv},\texttt{r})$ of $R^{\mathsf{Orchard}}$ . As in the Ironwood Guide, a binding signature under a point $X$ is a signature valid under $X$ in the binding-signature instance of RedPallas.

Proposition 5.6 (Per-Asset balance and key knowledge).

For the bundle fixed above:

(i)

Identity. If $\mathsf{cv}^{\mathsf{net}}_{i}=[v^{\prime}_{i}-v^{\mathsf{new}}_{i}]\,\mathsf{% AssetBase}_{i}+[\mathsf{rcv}_{i}]\,R^{\mathsf{Orchard}}$ for every $i$ , and $\mathsf{bsk}:=\sum_{i}\mathsf{rcv}_{i}$ , then

$\mathsf{bvk}-[\mathsf{bsk}]\,R^{\mathsf{Orchard}}=\sum_{B\in\mathfrak{B}}[c_{B% }]\,B;$

hence $c_{B}\equiv 0\pmod{p_{\mathsf{Vesta}}}$ for every $B\in\mathfrak{B}$ implies $\mathsf{bvk}=[\mathsf{bsk}]\,R^{\mathsf{Orchard}}$ .
(ii)

Knowledge. Given openings of every $\mathsf{cv}^{\mathsf{net}}_{i}$ and $b\in\mathbb{F}_{p_{\mathsf{Vesta}}}$ with $\mathsf{bvk}=[b]\,R^{\mathsf{Orchard}}$ ,

$\sum_{B\in\mathfrak{B}}[c_{B}]\,B+\Bigl{[}\sum_{i=1}^{n}r_{i}-b\Bigr{]}\,R^{% \mathsf{Orchard}}=\mathcal{O}.$

If $\mathfrak{B}$ meets the premise on the bases and some $c_{B}$ is non-zero modulo $p_{\mathsf{Vesta}}$ , this is a non-trivial relation among values of $\mathsf{GroupHash}$ at distinct inputs.

Consequently, under the Ironwood Guide’s Assumptions “Discrete logarithms on Pallas”, “GroupHash as a random oracle” and “The RedPallas hash as a random oracle”, an efficient party that outputs a bundle whose set $\mathfrak{B}$ meets the premise on the bases, openings of every net value commitment and a binding signature under the resulting $\mathsf{bvk}$ on a message of its choice satisfies $c_{B}\equiv 0\pmod{p_{\mathsf{Vesta}}}$ for every $B\in\mathfrak{B}$ , and knows $b=\sum_{i}r_{i}$ , except with negligible probability. The statement holds for every message and does not depend on the signed message.

Under Assumption 4.9 in addition, let an efficient adversary output OrchardZSA bundles of valid blocks, hence with at most $62\,500$ Actions each, whose Action proofs and binding signatures verify and whose witnessed and burn-pair Asset Bases meet the premise on the bases. Then, except with negligible probability, as integers:

(a)

for every Asset Base $B\neq V^{\mathsf{Orchard}}$ , $\sum_{i:\,\mathsf{AssetBase}_{i}=B}(v^{\prime}_{i}-v^{\mathsf{new}}_{i})=v_{B}$ , which is $0$ when $B$ is not burnt;
(b)

$\sum_{i:\,\mathsf{AssetBase}_{i}=V^{\mathsf{Orchard}}}(v^{\prime}_{i}-v^{% \mathsf{new}}_{i})=v^{\mathsf{balance}}$ ;
(c)

no burn pair has an Asset Base that no Action witnesses;
(d)

the signer knows the trapdoor sum $\sum_{i}\mathsf{rcv}_{i}$ .

Here $\mathsf{AssetBase}_{i}$ , $v^{\prime}_{i}$ , $v^{\mathsf{new}}_{i}$ and $\mathsf{rcv}_{i}$ are read from the extracted witnesses. Status (Definition 1.3): proved here for the specified $\mathsf{bvk}$ ; conditional on Assumption 4.9, which concerns the designed but unspecified circuit, and not on Assumption 6.13. The premise on the bases is discharged for every accepted bundle of a valid chain only in “Security”, in Theorem 9.5: for witnessed bases by Corollary 9.4, for burn-pair bases by rule (T4) of Construction 7.3 and Lemma 7.7. ZIP 226 argues per-Asset balance in rationale only (“Rationale for Value Balance Verification”), and that argument stays designed but unspecified.

Proof.

(i) Expand each $\mathsf{cv}^{\mathsf{net}}_{i}$ and apply the additive homomorphism (Crypto Guide, §“The Pedersen commitment”, Theorem “Additive homomorphism”):

\sum_{i=1}^{n}\mathsf{cv}^{\mathsf{net}}_{i}=\sum_{B\in\mathfrak{B}}\Bigl{[}% \sum_{i:\,\mathsf{AssetBase}_{i}=B}(v^{\prime}_{i}-v^{\mathsf{new}}_{i})\Bigr{% ]}\,B+[\mathsf{bsk}]\,R^{\mathsf{Orchard}}.

By (B3) each Asset Base of a burn pair occurs in exactly one subtracted term $[v_{B}]\,B$ , and by (B1) none of them is $V^{\mathsf{Orchard}}$ , whose only subtracted term is $[v^{\mathsf{balance}}]\,V^{\mathsf{Orchard}}$ . Subtracting these terms as in Definition 5.4 and grouping by base gives the identity. If every $c_{B}$ vanishes modulo $p_{\mathsf{Vesta}}$ , the right-hand side is $\mathcal{O}$ .

(ii) With the openings in place of the honest values, the same grouping gives $\mathsf{bvk}=\sum_{B}[c_{B}]\,B+[\sum_{i}r_{i}]\,R^{\mathsf{Orchard}}$ ; equating with $[b]\,R^{\mathsf{Orchard}}$ gives the relation. Its coefficients are scalars modulo $p_{\mathsf{Vesta}}$ . Under the premise, the base $V^{\mathsf{Orchard}}$ is the value at its input, and each other $B\in\mathfrak{B}$ at $x_{B}$ . The points of $\mathfrak{B}$ are pairwise distinct, so the chosen inputs are pairwise distinct, one per point; two distinct inputs with one value would themselves be a relation of the same kind. The inputs differ from that of $R^{\mathsf{Orchard}}$ , by the premise and since the inputs of $V^{\mathsf{Orchard}}$ and $R^{\mathsf{Orchard}}$ differ in the message. A non-zero $c_{B}$ makes the relation non-trivial.

Consequence. Let an efficient party $\mathcal{A}$ output, with probability $\epsilon$ , a bundle meeting the premise, openings, a message and a binding signature on it under the resulting $\mathsf{bvk}$ , with some $c_{B}$ non-zero modulo $p_{\mathsf{Vesta}}$ ; the event is efficiently decidable from the output. The value $b$ is extracted exactly as in the proof of the Ironwood Guide’s Proposition “Balance and key knowledge”: if $\mathsf{bvk}=\mathcal{O}$ , then $b:=0$ ; otherwise special soundness with forking in the random-oracle model for the RedPallas hash yields $b$ with $\mathsf{bvk}=[b]\,R^{\mathsf{Orchard}}$ (Crypto Guide, §“Binding signatures as a proof of knowledge of a discrete logarithm”, Theorem “The binding signature is a proof of knowledge of $\log_{P}B$ ”). Key prefixing places $\mathsf{bvk}$ in the critical query, so the openings and the bases of the first run satisfy the hypothesis of part (ii) for it. Part (ii) then outputs a non-trivial relation among values of $\mathsf{GroupHash}$ at distinct inputs, which the Ironwood Guide’s Lemma “Relations among fixed generators” excludes except with negligible probability; so $\epsilon$ is negligible. In the model of that volume’s Assumption “GroupHash as a random oracle” the inputs $x_{B}$ may equally be read from the queries of $\mathcal{A}$ : a point that equals the value at an input $\mathcal{A}$ never queried occurs with probability at most $1/p_{\mathsf{Vesta}}$ for each point. For Asset Bases of Custom Assets, Lemma 2.8 places every input under z.cash:OrchardZSA apart from those of $V^{\mathsf{Orchard}}$ and $R^{\mathsf{Orchard}}$ . When every $c_{B}$ vanishes, the relation reduces to $[\sum_{i}r_{i}-b]\,R^{\mathsf{Orchard}}=\mathcal{O}$ , and $R^{\mathsf{Orchard}}$ has prime order $p_{\mathsf{Vesta}}$ , so $b=\sum_{i}r_{i}$ .

Bundles. The adversary outputs polynomially many bundles, and the union bound reduces the claim to one of them, as in the proof of the Ironwood Guide’s Theorem “Balance”. The algorithm that runs the adversary with the extractor of Assumption 4.9 outputs, for that bundle, the triples $(\mathsf{AssetBase}_{i},\,v^{\prime}_{i}-v^{\mathsf{new}}_{i},\,\mathsf{rcv}_{% i})$ read from the witnesses; by A4^′ of Definition 4.6 each is an opening of $\mathsf{cv}^{\mathsf{net}}_{i}$ , except with the negligible probability that a witness fails the relation. The bundle’s binding signature verifies on $\mathsf{SigHash}$ under $\mathsf{bvk}$ , so the algorithm is a party of the consequence, and every $c_{B}$ vanishes modulo $p_{\mathsf{Vesta}}$ and $b=\sum_{i}\mathsf{rcv}_{i}$ , which is (d). The hypotheses of Lemma 5.5 hold for the witnesses, the bundle being in a valid block, and the lemma lifts each congruence to an equality of integers, which is (a) and (b). A burn pair of base $B$ that no Action witnesses has $c_{B}=-v_{B}$ , with $0<v_{B}<p_{\mathsf{Vesta}}$ by (B2), so $c_{B}\not\equiv 0$ ; this is (c). □

The premise on the bases cannot be dropped, for witnessed bases or for the bases of burn pairs. For witnessed bases this is Proposition 4.1. For burn pairs, let $B$ be the Asset Base of an issued Asset and $0<v\leq\mathsf{MAX\_BURN\_VALUE}$ . Split Actions of base $B$ contribute $v^{\prime}=0$ , so Actions of base $B$ whose net values sum to $-2v$ create $2v$ units of $B$ from nothing. The pair $([-2]\,B,v)$ satisfies (B2) and (B3), and (B1) unless $[-2]\,B=V^{\mathsf{Orchard}}$ , a relation that Lemma “Relations among fixed generators” of the Ironwood Guide excludes except with negligible probability. With balancing value $0$ and $t:=\sum_{i}\mathsf{rcv}_{i}$ , Definitions 3.8 and 5.4 give

\mathsf{bvk}=[-2v]\,B+[t]\,R^{\mathsf{Orchard}}-[v]\,\bigl{(}[-2]\,B\bigr{)}=[% t]\,R^{\mathsf{Orchard}},

whose discrete logarithm the author knows, so the binding signature verifies. Likewise, with balancing value $0$ , ZEC Actions whose net values sum to $-v$ and the pair $([-1]\,V^{\mathsf{Orchard}},v)$ give

\mathsf{bvk}=[-v]\,V^{\mathsf{Orchard}}+[t]\,R^{\mathsf{Orchard}}-[v]\,\bigl{(% }[-1]\,V^{\mathsf{Orchard}}\bigr{)}=[t]\,R^{\mathsf{Orchard}}:

an amount of $v$ zatoshi of ZEC appears from nothing, and (B1) does not exclude the pair, since $[-1]\,V^{\mathsf{Orchard}}\neq V^{\mathsf{Orchard}}$ in a group of odd order. Rule (B1) excludes only $V^{\mathsf{Orchard}}$ ; the premise on burn-pair bases is discharged by the issuance state, through rule (T4) of Construction 7.3 and Lemma 7.7, not by the burn rules (ZIP 226, “Rationale for Split Notes”, on inputs that are a multiple or linear combination of an existing Asset Base; ZIP 226, “Additional Consensus Rules for the assetBurn set”).

Remark 5.7 (Homomorphism across Asset Bases).

ZIP 226, “Rationale for Value Balance Verification”, states that the relation between $\mathsf{bvk}$ and $\mathsf{bsk}$ holds “if and only if”, per Custom Asset, the net values sum to the burnt amount ( $0$ if absent) and, for ZEC, to the balancing value, and that the commitments “add up homomorphically only with respect to the same value base point”. Neither is a literal statement about the Pallas group. The group is cyclic of prime order $p_{\mathsf{Vesta}}$ (protocol specification, §“Pallas and Vesta”), so any two non-identity bases satisfy $B^{\prime}=[\lambda]\,B$ for some $\lambda$ ; commitments to distinct bases add homomorphically as group elements; and $\sum_{B}[c_{B}]\,B=\mathcal{O}$ has non-zero solutions $(c_{B})$ . The “if” direction is part (i) of Proposition 5.6. The “only if” direction holds computationally, for group-hash bases and an efficient signer, as part (ii) and its consequence prove, and then as integers by Lemma 5.5. The argument of the ZIP is rationale and keeps its class (Definition 1.3).