Replay protection
Prevent both spending a note twice and reusing a wallet authorization.
Protocol behavior is proposed. This release is an interface preview; no funds or wallet signatures are accepted.
Two different attacks
A note nullifier prevents a second spend of the same note. That is not enough when a proxy chooses notes after the wallet signs an intent: a malicious proxy could try to fund the same signed payment with a different set of notes.
A transaction nullifier makes the authorization itself single-use. It binds the account identity, virtual chain context, and nonce to secret nullifying material. The settlement contract records it independently from note nullifiers.
Required checks
- Reject previously recorded transaction nullifiers.
- Reject duplicate nonzero note nullifiers both within a transaction and across transactions.
- Domain-separate networks and protocol versions.
- Constrain packed fields so distinct chain IDs and nonces cannot collide through truncation.
- Keep wallet nonce responses consistent with accepted private state.
Failure behavior
A reverted action must not appear successful in the wallet. Clients need to distinguish an unsubmitted proof, a pending transaction, an on-chain revert, and a confirmed state transition before retrying.