Trying to get my head around exactly how “zero knowledge” an accumulator like this would be.
Say we had a tx that spends a single output and produces two outputs.
And a block containing that single tx along with a single coinbase reward output.
We would have an accumulator prior to the block representing a UTXO set with say 1,000,000 unspent outputs.
We would remove a single output from the accumulator.
Then add three new outputs to the accumulator.
Now if our txs (and blocks) still reveal the outputs created (I’m assuming here that they do, along with their associated rangeproofs etc.), then -
- We do not know exactly which output was spent in this tx.
- But - we have accumulators representing before and after the spend (i.e. they differ by a single output).
So if we have all the outputs in the UTXO set it would seem to be possible to just brute-force one accumulator and determine which output needs to be removed to produce the correct result.
Presumably this is kind of slow for a UTXO set with 1,000,000 unspent outputs in it, but its not impossible.
And I guess this gets exponentially harder to do if the tx spends multiple outputs. You would need to try all combinations of two outputs for example.
So is this truly “zero knowledge”?
Os it just really expensive to do (rapidly approaching impossible for larger txs)?