9 Security

Every step is carried out by the efficient algorithm that runs the adversary with the extractors and inspects the chain; the chain has polynomially many leaves, and the union bound collects the negligible events.

Uniqueness of openings. By Proposition 3.3(b), no efficient algorithm outputs two distinct OrchardZSA notes with equal extracted commitments other than $\perp$, within one branch of Definition 3.2 or across the two; the sign ambiguity of extraction is handled in its proof by the Ironwood Guide’s Lemma “Coordinate extraction identifies opposite points”. An Orchard note is the native-branch OrchardZSA note with the same components, by the case split of that definition. Hence (i), and an opening found in the native branch excludes one in the custom branch.

Induction. The claim is proved for the leaves in the order of Definition 7.4, the hypothesis being (ii) and (iii) for all earlier leaves. A position beyond the appended leaves holds ${\mathrm{𝖴𝗇𝖼𝗈𝗆𝗆𝗂𝗍𝗍𝖾𝖽}}^{\mathrm{𝖮𝗋𝖼𝗁𝖺𝗋𝖽}}=2$, which by the Ironwood Guide’s Lemma “Uncommitted leaves” is the extracted commitment of no note, since in both branches $\mathrm{𝖼𝗆𝗑}$ is $\perp$ or the extraction of a point. Every appended leaf is of one of three kinds.

Orchard-protocol Action. The witness of the Action that appended the leaf creates a note whose commitment ${\mathrm{𝖭𝗈𝗍𝖾𝖢𝗈𝗆𝗆𝗂𝗍}}^{\mathrm{𝖮𝗋𝖼𝗁𝖺𝗋𝖽}}$, by the unweakened condition A2, extracts to the leaf. That commitment is the native branch of ${\mathrm{𝖭𝗈𝗍𝖾𝖢𝗈𝗆𝗆𝗂𝗍}}^{\mathrm{𝖮𝗋𝖼𝗁𝖺𝗋𝖽𝖹𝖲𝖠}}$ (Definition 3.2), so the leaf has an opening with $\mathrm{𝖠𝗌𝗌𝖾𝗍𝖡𝖺𝗌𝖾}=V^{\mathrm{𝖮𝗋𝖼𝗁𝖺𝗋𝖽}}$, and by (i) no other. This holds for leaves appended before OrchardZSA and after it.

OrchardZSA Action. Let the witness have $\mathrm{𝖠𝗌𝗌𝖾𝗍𝖡𝖺𝗌𝖾}=B$. If $B=V^{\mathrm{𝖮𝗋𝖼𝗁𝖺𝗋𝖽}}$ there is nothing to show. Otherwise $\mathrm{𝗂𝗌}\mathrm{\_}\mathrm{𝗇𝖺𝗍𝗂𝗏𝖾}\mathrm{\_}\mathrm{𝖺𝗌𝗌𝖾𝗍}=0$ by C1, so the first disjunct of A3^′ fails, and the unweakened A3^′ gives a valid path from ${\mathrm{𝖤𝗑𝗍𝗋𝖺𝖼𝗍}}_{\mathbb{P}}({\mathrm{𝖼𝗆}}^{\mathrm{𝗈𝗅𝖽}})$ to the anchor $\mathrm{𝑟𝑡}$ of the Action Group. By check (4) of Construction 7.10, the anchor is the root of the tree in the final treestate of an earlier block. By the Ironwood Guide’s Proposition “Membership soundness”, and since ${\mathrm{𝖼𝗆}}^{\mathrm{𝗈𝗅𝖽}}\ne \perp$ by the unweakened A1^′, the value ${\mathrm{𝖤𝗑𝗍𝗋𝖺𝖼𝗍}}_{\mathbb{P}}({\mathrm{𝖼𝗆}}^{\mathrm{𝗈𝗅𝖽}})$ is a leaf appended by an earlier transaction. By A1^′, the consumed note, of Asset Base $B$, opens that leaf, and by (i) it is its opening. By the hypothesis, $B$ is the Asset Base derived from the $\mathrm{𝗂𝗌𝗌𝗎𝖾𝗋}$ and an $\mathrm{𝖺𝗌𝗌𝖾𝗍𝖣𝖾𝗌𝖼𝖧𝖺𝗌𝗁}$ of an earlier accepted Issuance Action whose Issue Notes precede that leaf. By A2^′, the created note carries the same $B$ and opens the new leaf, and by (i) it is its opening. The case covers Split Actions: A3^′ demands the path for every consumed note with $\mathrm{𝗂𝗌}\mathrm{\_}\mathrm{𝗇𝖺𝗍𝗂𝗏𝖾}\mathrm{\_}\mathrm{𝖺𝗌𝗌𝖾𝗍}=0$, whatever its value and $\mathrm{𝗌𝗉𝗅𝗂𝗍}\mathrm{\_}\mathrm{𝖿𝗅𝖺𝗀}$, and C3 forbids $\mathrm{𝗌𝗉𝗅𝗂𝗍}\mathrm{\_}\mathrm{𝖿𝗅𝖺𝗀}=1$ with $\mathrm{𝗂𝗌}\mathrm{\_}\mathrm{𝗇𝖺𝗍𝗂𝗏𝖾}\mathrm{\_}\mathrm{𝖺𝗌𝗌𝖾𝗍}=1$.

Issue Note. Rule (I4) derives the Asset Base from the bundle’s $\mathrm{𝗂𝗌𝗌𝗎𝖾𝗋}$ and the action’s $\mathrm{𝖺𝗌𝗌𝖾𝗍𝖣𝖾𝗌𝖼𝖧𝖺𝗌𝗁}$ by Construction 2.10; rule (I6) makes the validator compute the commitment from that base and the published fields (Remark 6.14), with the fixed derivation of $\mathrm{𝗋𝖼𝗆}$; its commitment is not $\perp$ except with negligible probability, by Proposition 3.3(c), its Asset Base being a custom one (Proposition 2.13). The Issue Note therefore opens the leaf, and by (i) it is its opening; its Asset Base is the derived one, which differs from $V^{\mathrm{𝖮𝗋𝖼𝗁𝖺𝗋𝖽}}$ except with negligible probability (Proposition 2.13), and its own Issuance Action includes the leaf. □

For a witness with $\mathrm{𝖠𝗌𝗌𝖾𝗍𝖡𝖺𝗌𝖾}=V^{\mathrm{𝖮𝗋𝖼𝗁𝖺𝗋𝖽}}$ there is nothing to show. The exemption of A3^′ applies only to such consumed notes, since C1 makes $\mathrm{𝗂𝗌}\mathrm{\_}\mathrm{𝗇𝖺𝗍𝗂𝗏𝖾}\mathrm{\_}\mathrm{𝖺𝗌𝗌𝖾𝗍}=1$ exactly when $\mathrm{𝖠𝗌𝗌𝖾𝗍𝖡𝖺𝗌𝖾}=V^{\mathrm{𝖮𝗋𝖼𝗁𝖺𝗋𝖽}}$. Otherwise, as in the proof of Lemma 9.3, A3^′ and the Ironwood Guide’s Proposition “Membership soundness” make the consumed note an opening of a leaf of the treestate at the anchor, appended by an earlier transaction; A1^′ fixes its Asset Base as the witnessed one; and Lemma 9.3(ii) applies to that leaf. The only place where an Asset Base not derived by a validator could enter an Action is a consumed note without a membership proof, which C1 and A3^′ confine to $V^{\mathrm{𝖮𝗋𝖼𝗁𝖺𝗋𝖽}}$; Proposition 4.1 shows that the confinement is necessary (ZIP 226, “Circuit Statement”, “Asset Base Equality” and the modified Merkle path condition). □

Witnessed Asset Bases. By Corollary 9.4, each is $V^{\mathrm{𝖮𝗋𝖼𝗁𝖺𝗋𝖽}}$ or

for the Asset Digest $D$ of an accepted Issuance Action.

Asset Bases of burn pairs. By rule (T4) every burn pair of an accepted transaction has an Asset Base in the domain of its input state, and by Lemma 7.7 every such Asset Base is $\mathrm{𝖦𝗋𝗈𝗎𝗉𝖧𝖺𝗌𝗁}(\text{z.cash:OrchardZSA},D)$ for the Asset Digest $D$ of an accepted Issuance Action. Rule (B1) alone does not give this.

Premise and balance. Every input $(\text{z.cash:OrchardZSA},D)$ differs from the inputs of $V^{\mathrm{𝖮𝗋𝖼𝗁𝖺𝗋𝖽}}$ and $R^{\mathrm{𝖮𝗋𝖼𝗁𝖺𝗋𝖽}}$ (Lemma 2.8). Each such input is computable from the chain, by searching its Issuance Actions for one whose derived Asset Base is the point. So the algorithm that runs the adversary with the extractors, and outputs the accepted bundles together with these inputs whenever it finds them, outputs bundles whose set $𝔅$ meets the premise on the bases of §5.3; by the two preceding steps it fails to find an input only with negligible probability. Parts (a) and (b) of Proposition 5.6 then give (i) and (ii), the congruences modulo $p_{\mathrm{𝖵𝖾𝗌𝗍𝖺}}$ being lifted to integers by Lemma 5.5, whose hypotheses hold for every bundle of a valid block. A Split Action contributes $v^{\prime }=0$ by A4^′, so the value of a copied note never enters these sums. No other term of $\mathrm{𝖻𝗏𝗄}$ carries a Custom Asset (Remark 5.3).

Part (iii). Claims 2 and 3 of Proposition 2.13: distinct Asset Identifiers have distinct Asset Bases, and no Asset Base of a Custom Asset equals $V^{\mathrm{𝖮𝗋𝖼𝗁𝖺𝗋𝖽}}$, except with negligible probability, under Assumption 2.9 and the Ironwood Guide’s Assumption “GroupHash as a random oracle”. □

By Lemma 9.3(i), the opening of a leaf appended by an Action is the note that the Action’s witness creates, and the opening of a leaf appended by issuance is the Issue Note.

(a) Three cases cover every pair of leaves.

Two Action outputs. The note created by an accepted Action, of either protocol, has $\rho$ equal to that Action’s published nullifier (A2^′ with ${\rho }^{\mathrm{𝗇𝖾𝗐}}:={\mathrm{𝗇𝖿}}^{\mathrm{𝗈𝗅𝖽}}$, or A2), and the published nullifiers, real and split, are pairwise distinct by the nullifier-set rule, check (5) of Construction 7.10.

Two Issue Notes. Their elements $\rho$ are pairwise distinct by Proposition 6.9, under Assumption 6.8.

An Action output and an Issue Note. It suffices that no accepted Action publishes a nullifier equal to the $\rho$ of an Issue Note of the chain, in whichever order the two occur; Proposition 6.9 covers only the Action outputs fixed before the issued value. Let an efficient algorithm ${𝒜}^{\prime }$, running the adversary with the extractors, find such a pair with probability $ϵ$. The published nullifier is ${\mathrm{𝖤𝗑𝗍𝗋𝖺𝖼𝗍}}_{\mathbb{P}}(Q)$, where by A5^′ (or A5)

the second for a split nullifier, with $s$ computed from the witness. By the unweakened A1^′ (or A1), ${\mathrm{𝖼𝗆}}^{\mathrm{𝗈𝗅𝖽}}\ne \perp$ is, by the unfolding of the Ironwood Guide’s Construction “Sinsemilla hash on Pallas” used in the proof of Proposition 4.5(i), an integer combination of values of $\mathrm{𝖦𝗋𝗈𝗎𝗉𝖧𝖺𝗌𝗁}$ with coefficients computable from the witness; so is $Q$. A reduction to the Ironwood Guide’s Assumption “Discrete logarithms on Pallas” receives a challenge $Y$ to a base $G$, programs every value of $\mathrm{𝖦𝗋𝗈𝗎𝗉𝖧𝖺𝗌𝗁}$ as $[a]G$ for a fresh uniform scalar $a$, as in the proof of that volume’s Lemma “Relations among fixed generators”, chooses uniformly one of the at most $q$ queries to the oracle of personalisation Zcash_ExpandSeed, and answers it with a uniform $64$-byte string $u$ conditioned on $\mathrm{ToBase}(u)={\mathrm{𝖤𝗑𝗍𝗋𝖺𝖼𝗍}}_{\mathbb{P}}(Y+[b]G)$, for a uniform scalar $b$. If ${𝒜}^{\prime }$ succeeds at that query, then ${\mathrm{𝖤𝗑𝗍𝗋𝖺𝖼𝗍}}_{\mathbb{P}}(Q)={\mathrm{𝖤𝗑𝗍𝗋𝖺𝖼𝗍}}_{\mathbb{P}}(Y+[b]G)$, so $Q=\pm (Y+[b]G)$ by the Ironwood Guide’s Lemma “Coordinate extraction identifies opposite points”; with $Q=[c]G$ for the computed $c$, the reduction outputs $\pm c-b$, the discrete logarithm of $Y$. The programmed answer differs from a uniform one in that its reduction is the $x$-coordinate of a point, up to the statistical distance of $\mathrm{ToBase}$ from uniform, below $2^{-257}$ (Proposition 4.5); success requires the issued $\rho$ to be such a coordinate in any case, and, given that it is one, the two distributions of $\rho$ are within negligible statistical distance. The reduction therefore succeeds with probability at least $ϵ/q$ less a negligible term, and $ϵ$ is negligible.

Notes with distinct $\rho$ are distinct.

(b) The steps of the proof of the Ironwood Guide’s Lemma “One nullifier per note” apply, with A1^′ in place of A1 and A5^′ with $\mathrm{𝗌𝗉𝗅𝗂𝗍}\mathrm{\_}\mathrm{𝖿𝗅𝖺𝗀}=0$, which sets ${\psi }^{\mathrm{𝗇𝖿}}={\psi }^{\mathrm{𝗈𝗅𝖽}}$ and publishes ${\mathrm{𝖣𝖾𝗋𝗂𝗏𝖾𝖭𝗎𝗅𝗅𝗂𝖿𝗂𝖾𝗋}}_{\mathrm{𝗇𝗄}}({\rho }^{\mathrm{𝗈𝗅𝖽}},{\psi }^{\mathrm{𝗈𝗅𝖽}},{\mathrm{𝖼𝗆}}^{\mathrm{𝗈𝗅𝖽}})$, in place of A5; A7 is unchanged. Two real spends, of either protocol, whose consumed notes have the same extracted commitment consume the same note, by Proposition 3.3(b), with the same $\mathrm{𝗇𝗄}$, by the Ironwood Guide’s Proposition “Binding of $\mathrm{𝗂𝗏𝗄}$ to $(\mathrm{𝖺𝗄},\mathrm{𝗇𝗄})$”, and publish the same nullifier. The nullifier-set rule rejects a repeated nullifier within a transaction and across the chain.

(c) The value $v^{\prime }=0$ is the notation of A4^′ for $\mathrm{𝗌𝗉𝗅𝗂𝗍}\mathrm{\_}\mathrm{𝖿𝗅𝖺𝗀}=1$. The nullifier is the split nullifier of A5^′, and by Proposition 4.5(i), which holds for every ${\psi }^{\mathrm{𝗇𝖿}}$, including one that the adversary chooses, it is not the nullifier of the copied note, except with negligible probability. A split nullifier that equals the nullifier of some other note only prevents the later spend of that note; it creates no value, and the note is not thereby consumed in the sense of Definition 9.1(c). (ZIP 226, “Split Notes”; ZIP 227, “Computation of $\rho$”; protocol specification, §“Nullifier Sets”.) □

Induction over the transactions of the chain. Write $U_B$ for the left-hand side.

Base. Before the first transaction of the OrchardZSA activation block the issuance state is the empty map (Definition 7.1), whose balances read $0$, and every leaf was appended by an Orchard-protocol Action, so by Lemma 9.3(iii) no committed note has a Custom Asset Base: $U_B=0$.

Step. Let $T$ be a transaction of the chain, $B\ne V^{\mathrm{𝖮𝗋𝖼𝗁𝖺𝗋𝖽}}$, and let the claim hold before $T$. The leaves that $T$ appends open uniquely (Lemma 9.3(i)) to notes distinct from the openings of all other leaves (Lemma 9.6(a)), and each is unconsumed when appended.

Orchard-protocol Actions of $T$. They create native notes only (Lemma 9.3(iii)). A note that such an Action consumes is a native note; by Lemma 9.3(i) it is not the opening of a leaf of Asset Base $B$. They leave $U_B$ unchanged.

The Action Group of $T$ and its burn set. Let $R_B$ be its real spends witnessing $B$, and $A_B$ all its Actions witnessing $B$. A note of Asset Base $B$ consumed by an Action of $T$ is consumed by an Action witnessing $B$, by A1^′. The consumed notes of $R_B$ are committed, by A3^′ with C1 and the Ironwood Guide’s Proposition “Membership soundness”, as in the proof of Lemma 9.3; and they were unconsumed before $T$ and are pairwise distinct, by Lemma 9.6(b). Split Actions are not real spends and remove no note from $U_B$; each contributes $v^{\prime }=0$ (Definition 9.1(c), Lemma 9.6(c)). Every Action of $A_B$ creates one note of Asset Base $B$ whose leaf $T$ appends (Definition 7.4). Hence $U_B$ changes by

the first equality because $v_i^{\prime }=v_i^{\mathrm{𝗈𝗅𝖽}}$ on $R_B$ and $v_i^{\prime }=0$ on $A_B\setminus R_B$, and the second by Theorem 9.5(i), whose premise on burn-pair bases rests on (T4) and Lemma 7.7. Rule (T4) lowers the balance of $B$ by the same $v_B$. No transparent term carries $B$ (Remark 5.3).

The Issuance Bundle of $T$. Each Issue Note of Asset Base $B$, that is of an Issuance Action whose derived base is $B$ by (I4), enters the tree after the Action outputs (Definition 7.4) with its public value and unconsumed, and no Action of $T$ consumes it: a consumed note of $T$ opens a leaf of an earlier block, and by Lemma 9.6(a) that opening is not the Issue Note. Rule (I6) raises the balance of $B$ by exactly that value; a reference note adds $0$ to both sides. Issuance Actions of other Asset Bases write other entries.

Both sides therefore change equally, and the claim holds after $T$. The bounds follow from $U_B\ge 0$ and Proposition 7.9, and the behaviour after finalisation from Proposition 7.8. □

Reduction. Let an accepted Issuance Action change the entry at an Asset Base $B$ of an Asset of the honest issuer, with Asset Identifier $({\mathrm{𝗂𝗌𝗌𝗎𝖾𝗋}}_h,h)$. Rule (I4) derives $B$ from the bundle’s $\mathrm{𝗂𝗌𝗌𝗎𝖾𝗋}$ and the action’s $\mathrm{𝖺𝗌𝗌𝖾𝗍𝖣𝖾𝗌𝖼𝖧𝖺𝗌𝗁}$. If $(\mathrm{𝗂𝗌𝗌𝗎𝖾𝗋},\mathrm{𝖺𝗌𝗌𝖾𝗍𝖣𝖾𝗌𝖼𝖧𝖺𝗌𝗁})\ne ({\mathrm{𝗂𝗌𝗌𝗎𝖾𝗋}}_h,h)$, two distinct Asset Identifiers have the Asset Base $B$, which claim 2 of Proposition 2.13 excludes, under Assumption 2.9 and the Ironwood Guide’s Assumption “GroupHash as a random oracle”, except with negligible probability. So the bundle’s $\mathrm{𝗂𝗌𝗌𝗎𝖾𝗋}$ is the honest $\mathrm{𝗂𝗄}\mathrm{\_}\mathrm{𝖾𝗇𝖼𝗈𝖽𝗂𝗇𝗀}$. Rules (I2) and (I3) then require a signature valid under the honest $\mathrm{𝗂𝗄}$ on the transaction’s $\mathrm{𝖲𝗂𝗀𝖧𝖺𝗌𝗁}$.

If the honest issuer made no signature on that digest, the reduction, which answers the honest issuer’s signing through the signing oracle of the EUF-CMA experiment, outputs the digest and the signature of the chain, a forgery against Assumption 2.3. If it made one, on a transaction $T_h$, then the two transactions have equal $\mathrm{𝖲𝗂𝗀𝖧𝖺𝗌𝗁}$, and Assumption 6.13, which for the withdrawn digest rests on the Ironwood Guide’s Assumption “Collision resistance of BLAKE2b” (Remark 8.2), makes their Issuance Bundles’ effecting data equal ($\mathrm{𝗂𝗌𝗌𝗎𝖾𝗋}$ and, per Issuance Action, $\mathrm{𝖺𝗌𝗌𝖾𝗍𝖣𝖾𝗌𝖼𝖧𝖺𝗌𝗁}$, $\mathrm{𝖿𝗂𝗇𝖺𝗅𝗂𝗓𝖾}$ and every field of every Issue Note), and their burn sets and nullifiers ${\mathrm{𝗇𝖿}}_{0,0}$ equal. Every change of the entry, the finalisation bit included, is therefore one that the issuer authorised; this is (i).

Part (ii) is Proposition 6.16, by rule (I1) and the nullifier set on ${\mathrm{𝗇𝖿}}_{0,0}$. Burns of the issuer’s Assets by note holders are outside the claim: rule (T4) only lowers the balance (ZIP 227, “Specification: Consensus Rule Changes” and “Issuance Authorization Signature Scheme”). □

For each of the two specifications, the hybrids $H_0$ to $H_{10}$ below change the probability that the adversary outputs $1$ by a negligible amount (Crypto Guide, §“The hybrid argument”, Lemma “Hybrid lemma”; each hybrid is reached in polynomially many steps, one key or one Action at a time), and the two hybrids $H_{10}$ are identically distributed. Every reduction runs the experiment with the adversary and samples every value that its hop does not concern. The keys involved are those of (Q1), the keys of the dummy consumed notes and the keys of dummy created notes.

Hybrid $H_0$ is the real bundle.

Hybrid $H_1$ (proof). The aggregate proof is the output of the simulator of Assumption 4.10 on the primary inputs, which are public, $\mathrm{𝖾𝗇𝖺𝖻𝗅𝖾𝖹𝖲𝖠}$ included; the witnesses satisfy Definition 4.6 by hypothesis. The cost is the statistical distance of that assumption. From $H_1$ on, a witness enters the game only through the public fields computed from it.

Hybrid $H_2$ (keys). Each key of (Q1) and each dummy key is replaced as in game $G_2$ of the proof of the Ironwood Guide’s Theorem “Privacy of an Action” (its Lemmas “Rejection in key generation” and “Independence of domain-separated expansions”, and Assumption “Joint hiding of the viewing keys”), so that $\mathrm{𝖺𝗌𝗄}$, $\mathrm{𝗇𝗄}$, $\mathrm{𝗂𝗏𝗄}$, $\mathrm{𝖽𝗄}$ and $\mathrm{𝗈𝗏𝗄}$ of each key are independent and $\mathrm{𝖽𝗄}$ and $\mathrm{𝗈𝗏𝗄}$ uniform. The public all-zero key is left unchanged.

Hybrid $H_3$ (randomisers). Each randomiser ${\alpha }_i$ is replaced by a uniform scalar, as in game $G_4$ of that proof (Ironwood Guide, Lemma “Distance of GenRandom from uniform”, and Assumption “The RedPallas hash as a random oracle”). Then ${\mathrm{𝗋𝗌𝗄}}_i=\mathrm{𝖺𝗌𝗄}+{\alpha }_i$ is uniform and independent of $\mathrm{𝖺𝗌𝗄}$, the public $\mathrm{𝖺𝗌𝗄}$ of the all-zero key included, and each ${\mathrm{𝗋𝗄}}_i$ is a uniform point independent of $\mathrm{𝖺𝗄}$.

Hybrid $H_4$ (signatures). Every spend-authorisation signature and the binding signature are replaced by simulated signatures under ${\mathrm{𝗋𝗄}}_i$ and $\mathrm{𝖻𝗏𝗄}$, programming the RedPallas hash, by the Crypto Guide’s Lemma “Signature simulation” (§“Security in the random oracle model and the forking lemma”). Its simulator applies to RedPallas, a Schnorr signature whose challenge is the RedPallas hash of the nonce commitment, the validating key and the message (Ironwood Guide, Construction “RedPallas”); the costs are the abort probability of the lemma and the statistical distance of the reduced hash output from a uniform scalar. No signing key enters the game from $H_4$ on: neither ${\mathrm{𝗋𝗌𝗄}}_i$ nor $\mathrm{𝖻𝗌𝗄}$.

Hybrid $H_5$ (value commitments). After $H_4$, each trapdoor ${\mathrm{𝗋𝖼𝗏}}_i$ enters the game only through ${\mathrm{𝖼𝗏}}_i^{\mathrm{𝗇𝖾𝗍}}$. Each ${\mathrm{𝖼𝗏}}_i^{\mathrm{𝗇𝖾𝗍}}$ is replaced by an independent uniform point, by perfect hiding for every Asset Base (Lemma 3.9(i)); the key $\mathrm{𝖻𝗏𝗄}$ is computed from these points, the public burn set and the balancing value by Definition 5.4. The hop is perfect.

Hybrid $H_6$ (split nullifiers). Each split nullifier is replaced by the $x$-coordinate of a uniform point, by Proposition 4.5(ii), at cost ${ϵ}_{\mathrm{𝖾𝗑𝗉𝖺𝗇𝖽}}+{ϵ}_{\mathrm{𝖳𝗈𝖡𝖺𝗌𝖾}}+\delta$ each. That proposition holds against an adversary that knows the copied note and $\mathrm{𝗇𝗄}$, so the reduction samples every key itself; it holds in particular for the public key of a reference note, and for a copied note that the same bundle spends.

Hybrid $H_7$ (nullifiers of consumed notes). For each key that consumes a real or dummy note, $\mathrm{𝗇𝗄}$ enters the game after $H_6$ only through the nullifiers of those notes, ${\mathrm{𝖤𝗑𝗍𝗋𝖺𝖼𝗍}}_{\mathbb{P}}([{\mathrm{𝖯𝖱𝖥}}_{\mathrm{𝗇𝗄}}^{\mathrm{𝗇𝖿𝖮𝗋𝖼𝗁𝖺𝗋𝖽}}(\rho )+\psi ]K^{\mathrm{𝖮𝗋𝖼𝗁𝖺𝗋𝖽}}+{\mathrm{𝖼𝗆}}^{\mathrm{𝗈𝗅𝖽}})$, where ${\mathrm{𝖼𝗆}}^{\mathrm{𝗈𝗅𝖽}}$ depends on the Asset Base. As in hybrids $H_4$ and $H_5$ of the proof of the Ironwood Guide’s Proposition “Nullifier unlinkability” and in game $G_5$, the PRF is replaced by a random function (Assumption “Poseidon is a PRF”) and each multiplier of $K^{\mathrm{𝖮𝗋𝖼𝗁𝖺𝗋𝖽}}$ by a uniform scalar, so each nullifier is the $x$-coordinate of a uniform point whatever ${\mathrm{𝖼𝗆}}^{\mathrm{𝗈𝗅𝖽}}$ is. The real consumed notes of one key have pairwise distinct $\rho$ by the definition of the experiment, which in a valid chain holds by Lemma 9.6(a), and a dummy consumed note has a key of its own.

Hybrid $H_8$ (outgoing ciphertexts). Each $C_{\mathrm{𝗈𝗎𝗍}}$ is replaced by the encryption of a fixed string under an independent uniform key, as in game $G_3$ (Ironwood Guide, Proposition “Confidentiality of the outgoing ciphertext”).

Hybrid $H_9$ (ephemeral keys and note ciphertexts). For each created note, $\mathrm{𝖾𝗉𝗄}$ is replaced by a uniform non-identity point and $C_{\mathrm{𝖾𝗇𝖼}}$ by the encryption of a fixed plaintext of the common length, keeping every note commitment, by steps (1) to (4) of the proof of the Ironwood Guide’s Proposition “Confidentiality and key privacy of note encryption”, as in game $G_6$. The common length is the hypothesis of (Q2) on the plaintext encoding.

After $H_9$, the seed $\mathrm{𝗋𝗌𝖾𝖾𝖽}$ of each created note enters the game only through $\psi$ and $\mathrm{𝗋𝖼𝗆}$, that is through $\mathrm{𝖼𝗆}$. With $\mathrm{𝗋𝖼𝗆}$ a PRF-expansion output of $\mathrm{𝗋𝗌𝖾𝖾𝖽}$ under an assigned lead byte, as for either derivation of Definition 3.5, the argument of the proof of the Ironwood Guide’s Proposition “Hiding under the derived trapdoor” places $\mathrm{𝗋𝖼𝗆}$ within negligible distance of a uniform scalar independent of the rest of the game.

Hybrid $H_{10}$ (note commitments). Each $\mathrm{𝖼𝗆𝗑}$ is replaced by the $x$-coordinate of a uniform point, by hiding with one output distribution for both branches (Proposition 3.3(a)), as in game $G_7$.

In $H_{10}$ every public field is a uniform value independent of the specification, a simulated proof or signature on public values, or a function of the leakage of Definition 9.10: the value commitments, nullifiers and extracted commitments are uniform, each $\mathrm{𝖾𝗉𝗄}$ is a uniform non-identity point, the ciphertexts encrypt fixed strings under fresh keys, each ${\mathrm{𝗋𝗄}}_i$ is uniform, and $\mathrm{𝖻𝗏𝗄}$ is a function of these and of the common burn set and balancing value. The two hybrids $H_{10}$ are therefore identically distributed, and the advantage is at most the sum of the costs for both specifications, which is negligible. □