E.g. say you have two customers with a balance of 100. You report the total is 100— so 100 BTC has gone missing.
When customer A logs in you give them one root and show them their balance (and B has a balance of 0). When customer B logs in— oops balances just update— you show them a new root, and in that one B has a balance of 100.
So you need to pin the commitments strongly enough so that the prover can't swap them out at will.
Comments
E.g. say you have two customers with a balance of 100. You report the total is 100— so 100 BTC has gone missing.
When customer A logs in you give them one root and show them their balance (and B has a balance of 0). When customer B logs in— oops balances just update— you show them a new root, and in that one B has a balance of 100.
So you need to pin the commitments strongly enough so that the prover can't swap them out at will.
Thanks, I get it now. Hadn't thought of that.
Of course, if many people were connected at the same time, this would quickly become perilous gymnastics for the exchange.