Enforcing that all kernels are different at consensus level?

[tromp]

@Kurt

If my understanding is correct, today Grin does not allow duplicate outputs so that the vulnerability can only happen if network participants do not validate correctly this rule, which is not trustlessly verifiable for new network participants since it cannot be checked for cut-through blocks where spent outputs are pruned and do not appear on the blockchain anymore.

Grin does not allow simultaneous duplicate utxo.
You cannot say that cut-through vulnerabilities could occur before the 1-week horizon, since the security model requires only a valid UTXO set and kernel history at the horizon.

tx2: P1_in = P_out and P2_in = vH + r’G ; P1_out = P_out and P2_out = P_out

This is illegal since it has an output P1_out equal to an input P1_in.

One of the problems of this vulnerability is not necessarily the ability to lose or win new money, but it is the fact that an owner of an UTXO actually sees their UTXO being spent by a third party without their authorization, which breaks the concept of ownership of UTXO as defined in Bitcoin.

In Grin, after I spend an output P that I once received from Alice, Alice can publish another tx that recreates output P without my knowledge. Do I “own” this? That’s questionable, since I didn’t agree to receive it and would never recreate this old output myself. (It’s true that if I run a wallet restore, my wallet would find this recreated output and claim it as owned, not realizing that I spent its duplicate earlier.)

There seems to be little point in this replay attack by Alice, except for being able to claim “Haha! I was able to replay your tx by paying you twice”. Even if you consider that a vulnerability, then surely it’s a pretty benign one.

By enforcing that no two same kernels are on the blockchain grin would be able to objectively claim that it has the same security and trust models to those of bitcoin: Each new participant that newly joins the network can be trustlessly convinced that proper ownership of coins have been achieved in grin since genesis block.

I would hesitate to complicate the consensus rules of Grin to safeguard us against payment replay attacks. At least until I can see how such attacks would do any actual damage. And especially if the new consensus rules break the desirable property that a tx in the mempool remains valid as long as its inputs are unspent.