## 3 Proposed Method
### Process Design
#### 3.4.4 Verification Stage of Transaction Legitimacy  
In order to describe the change of the note world state before and after the transaction, assume that the current note world state is shown in Table 2. The Note Commitments table in the BTPP method maintains the mapping relationship between the hash of note and its stealth address, while the Nullifier table maintains the stealth address of the invalid note. The verification of transaction legitimacy includes the ownership and legitimacy verification of the input notes, the legitimacy verification of the transaction amount, and the correctness verification of the payment note. The entire process corresponds to steps 6 to 11 in Figure 2, the specific process of which is described below. 1. Verify the sender's ownership of the input notes (1) The sender [PERSON] sends to the verification network the hash \(h_{\text{in}}=[h_{1},h_{2}]\) of the input note \(note_{\text{in}}\), the corresponding confirmation key \(t_{\text{in}}=[t_{1},t_{2}]\), and the hash \(h_{\text{out}}=[h_{4},h_{5}]\) of the output notes \(note_{4}\), \(notes\); (2) The verification nodes calculate the corresponding stealth addresses \({T_{1}}^{\prime}=t_{1}\cdot\text{G}\) and \({T_{2}}^{\prime}=t_{2}\cdot\text{G}\) by the confirmation keys \(t_{1}\) and \(t_{2}\) and find the stealth addresses \(T_{1}\) and \(T_{2}\) corresponding to the note hash values \(h_{1}\) and \(h_{2}\) through the Note Commitments table, then determines [PERSON]'s ownership of \(note_{1}\) by whether \({T_{1}}^{\prime}\) and \(T_{1}\) are equal. [PERSON]'s ownership of \(note_{2}\) is determined by whether \({T_{2}}^{\prime}\) and \(T_{2}\) are equal. The whole verification process is shown in Equation (17): \[ \begin{array}{l}OVerify(t_{1},T_{1})\to 1/0\\ OVerify(t_{2},T_{2})\to 1/0\end{array} \] (17)
2. Verify the legality of the input notes The legitimacy verification of input notes is to detect whether there is a \"double spend\" problem with the input notes. Since the Note Commitments table maintains the binding relationship between the notes and their stealth addresses, while the Nullifier table maintains the stealth addresses of the invalid notes, the legitimacy of the input notes can be verified by determining whether the stealth addresses \(T_{1}\) and \(T_{2}\) bound to the input notes \(note_{1}\) and \(note_{2}\) exist in the Nullifier table, as shown in Equation (18): \[ \begin{array}{l}NfVerify(nullifier,T_{1})\to 1/0\\ NfVerify(nullifier,T_{2})\to 1/0\end{array} \] (18)
3. Verify the legality of the transaction amounts (1) [PERSON] publishes the commitments \(C_{\text{b}}=[C_{1},C_{2},C_{5}]\) and the range proof \(\pi_{5}\) to the verification network; (2) [PERSON] publishes the commitment \(C_{\text{a}}=[C_{4}]\), \(K\) and range proof \(\pi_{4}\) to the verification network; (3) The verification nodes verify the balance of the transaction input-output amounts, as shown in Equation (19): \[C_{1}+C_{2}=C_{5}+C_{\text{a}}+K\] (19)
4. The verification nodes verify that the transaction output amounts are non-negative, as shown in Equation (20): \[ \begin{array}{l}RangeVerify(\pi_{4},C_{4})\to 1/0\\ RangeVerify(\pi_{5},C_{5})\to 1/0\end{array} \] (20)
4. The recipient verifies the correctness of the payment note (1) [PERSON] encrypts \(note_{4}\) using [PERSON]'s public key \(pk_{\text{a}}\) to generate \(note_{4}^{\text{enc}}\) and sends it to [PERSON]; (2) [PERSON] decrypts \(note_{4}^{\text{enc}}\) using the private key \(sk_{\text{a}}\) to obtain the payment note \(note_{4}\) and verifies ownership of \(note_{4}\) and the specific information of the note, completing the verification of the correctness of \(note_{4}\): \[OVerify(t_{4},T_{4})\to 1/0\] (21) \begin{table}
\begin{tabular}{c c} \hline \hline
**Note Commitments** & **Nullifier Set** \\ \hline \((h_{1}=Hash(note_{1})\to T_{1})\) & \\ \((h_{2}=Hash(note_{2})\to T_{2})\) & \\ \((h_{3}=Hash(note_{3})\to T_{3})\) & \\ \hline \hline \end{tabular}
\end{table} 
Table 2: The world state of the note before the transaction. 3.