John Tromp

It seems undesirable to promote number of consecutive donations since splitting up one donation in thousands of tiny ones is rather wasteful?!

What would make one-off donations less worthy of entry in the Hall of Fame?

A deep enough reorg can always invalidate a payment proof, whether it uses an index or a nonce. It's up to the sender to make sure that their proof is...

That's a good argument. The problem is that looking up an arbitrary kernel is expensive. The node doesn't maintain an index of all kernels. So to avoid making payment proof...

Nimble nodes will presumably rely on full nodes providing merkle membership proofs. Looking up a recent kernel might be free, but looking up an arbitrary kernel should cost some fee...

The payment proof commits to the receiver excess, so indeed you can compensate for any changes in or addition of inputs/outputs by adjusting the offset.

Good idea. I will add versioning.

> his blinding factors but you commit to them The receiver only commits to the excess, not any blinding factors. Btw, I don't quite see the point in output swapping....

They can change blinding factors along with the kernel offset, which preserves the excess. > Btw, I don't quite see the point in output swapping. Once the tx is broadcasted,...

The RFC has this equation 2. Verify that s\*G = R + e\*X, where e is the hash challenge of the i'th kernel. which has no blinding factors, only receiver's...