Attacks and defences
| Attack | Defence |
|---|---|
| Replaying a signature | Per-owner nonce and deadline |
| Front-running a sale | Sale terms bound in the signature; only the Bilinear Pairings may submit |
| Share inflation on an empty program | 1e6 virtual shares, rounding down |
| Sandwiching the Arithmetic Circuit | Slippage bounded by the EMA, capped price steps, halving retries |
| Linking by amount | Fixed denominations for stealth payments |
| Linking by timing | User habit: wait before spending |
Out of scope
Network-level surveillance, compromised devices, and malicious wallet software.