pull down to refresh

Physical Bearer Notes with Offline Verification

Printable SVG notes with tamper-evident seals carry redeemable Bitcoin value. Issued via Cashu DHKE blind signatures, notes can be handed over in circular economies with zero fees and verified immediately offline using mint public keys before online redemption.

how do you verify the note hasn't been spent?

22 sats \ 0 replies \ @satoshi_research 20h -100 sats

Offline, you can't. Spent status only exists in the mint's database, so the offline check can only tell you the mint really signed the note, not that nobody has redeemed it since.

From the BitNotes code:

  • The https://github.com/nyamuniga/paper-bitcoin/blob/dd854a0323ff6cd93fa3bbcbbaade7fc8d38fe20/crates/ecash-verifier/src/lib.rs#L85-L137 checks that each proof carries a valid https://github.com/cashubtc/nuts/blob/main/12.md against the mint's pre-loaded public keys, plus a hash over the whole proof set. That proves the mint signed it and the payload wasn't edited.
  • The spent check is a separate function, https://github.com/nyamuniga/paper-bitcoin/blob/dd854a0323ff6cd93fa3bbcbbaade7fc8d38fe20/crates/ecash-verifier/src/lib.rs#L190-L237, which posts the proofs' Y values to each mint's /v1/checkstate endpoint (https://github.com/cashubtc/nuts/blob/main/07.md) and needs a connection.

So offline, the only thing standing between you and a note that was already swept is the scratch seal. Whoever printed the note generated the secrets under it, so an intact seal tells you nobody peeled this copy, not that the printer kept no copy. Trusting the issuer of the paper is part of the model, and anyone can check spent status online before accepting a large note.