## 2 Backgrounds and Related Works
### Blockchain Basic  
In this section, we briefly review basic blockchain theory. Readers can find a more detailed explanation in, e.g., [18]. We assume that a sufficient number of nodes try to update their blockchain copies throughout this study. We also assume that the blockchain uses an underlying cryptocurrency as a rewarding medium of incentivizing nodes to maintain the blockchain system. Blockchain is a kind of state machine that records previous states or interactions with users. Specifically, miners (who try to compute a new block and connect it to the existing blockchain for a reward) of the blockchain network collect _transactions_ to form a block \(B^{[n]}\). Miners try to find _proofs of rights_ (its meaning will be explained shortly) to connect \(B^{[n]}\) to the blockchain \(\mathbb{BC}^{[n-1]}\) that records all states and interactions with users up to the \(n-1\)-th state. Here, the block \(B^{[n]}\) determines a state change that will be made to the \(n\)-th state. This process can be described as follows:  
\[\mathbb{BC}^{[n]}=\mathbb{BC}^{[n-1]}||B^{[n]}, \tag{1}\]  
where \(||\) means the concatenation. Let  
\[t^{[n]}=(t_{1}^{[n]},t_{2}^{[n]},\cdots,t_{c^{[n]}}^{[n]}) \tag{2}\]  
be the collection of transactions collected in the block \(B^{[n]}\) (\(c^{[n]}\) is the number of transactions in \(B^{[n]}\)). Those \(t_{i}^{[n]}\)'s are for cryptocurrency transfers, smart contract executions/creations, etc. To prevent the block from being arbitrarily modified after it is connected to the blockchain, or the creation of a block from being monopolized by a specific miner, the blockchain includes the hash value of the last connected block in a new block and allows the miner to connect his or her block \(B^{[n]}\) to \(\mathbb{BC}^{[n-1]}\) only if the hash value \(h^{[n]}\) of \(B^{[n]}\) satisfies a prespecified condition. This statement is described by the following equation:  
\[h^{[n]}=H(h^{[n-1]}||t^{[n]}||r^{[n]})\in\mathcal{C}, \tag{3}\]  
where \(H\) is a cryptographic hash function, \(\mathcal{C}\) is a set representing the prespecified condition that the hash value \(h^{[n]}\) of \(B^{[n]}\) must satisfy, and \(r^{[n]}\) is the nonce number that satisfies (3). In Bitcoin, \(H\) is SHA256 [19] and \(\mathcal{C}\) is the set of 256-bitstreams that are smaller than a very small number. From now on, we shall assume that \(H\) refers to the SHA256 hash function and call that the miner who finds \(r^{[n]}\) satisfying (3) has a proof of rights to connect \(B^{[n]}\), which is formed by \(h^{[n-1]}||t^{[n]}||r^{[n]}\), to \(\mathbb{BC}^{[n-1]}\). Bitcoin follows the UTXO ledger model. The transaction included in the Bitcoin block relates to the cryptocurrency transfer, and the main content of it is to re-allocate the cryptocurrencies allocated to the _addresses_ in the input field to the addresses in the output field. Here, the term address is the public information used to receive cryptocurrencyand is determined by the hash value of the public key associated with the private key required to use the cryptocurrency transmitted to the address. Through this process, the cryptocurrencies allocated to the addresses in the input field are spent and hence no longer usable, and the cryptocurrencies allocated to the addresses in the output field are newly created. This explains the core idea of the UTXO ledger model, and is similar to using _check_ in everyday life. Considering this, in this study, we express the cryptocurrency assigned to the address in the UTXO-based blockchain as UTXO-Check or UC. Each UC is determined by the remittance address \(addr\) and the location \(loc\) in the blockchain where the transaction is recorded. We use the following notation to represent this dependency:  
\[UC=UC(addr,loc). \tag{4}\]  
We note that each UC has a unique cryptocurrency value, which is entirely determined by \(addr\) and \(loc\).