Questions:

does it make sense to have diversified address? Same account can provide distinct addresses to different payers?
does the user have same account across all subpools?
- If don't think there's any way to restrict this. If two subpools don't want overlapping account identifier, they can do it outside the protocol and add/remove accounts from identity subtree. The protocol should not worry about distinct identities across subpools.
forced exists: Subpool owner can only freeze an account (i.e. account cannot send txs anymore), they cannot seize the funds. Account owner still owns the funds. Subpool owner will want to kick the funds out of the pool, so the stablecoin issuer can do whatever they wish with the funds (or finally seize it, by blacklisting the address in stablecoin's smart contract). Now the account owner may not corporate to withdraw, hoping they have get KYC'd with some other subpool and use their funds again. Therefore, the subpool owner would like to "force" their withdrawal. How to do this?

TODOs:

The note commitment must include the note position. The merkle tree must be a position merkle tree. This is to guarantee uniques of a nullifier for a valid note commitment.
- For instance, a sender can craft two valid output notes across two different transactions with the same note commitment. An output note is valid as long as there exists a valid tx proof for its corresponding tx and it's not invalid if there exists a diplicate note commitment. However, if nullifier is direct map from note commitment (or the note) and the nullifier key then the receiver will not be able to spend the second (valid) note. Therefore, nullifier is a function of note commitment, nullifier key, and note commitment's position in the NC tree.

TODOs/Questions to take care of post i0 #2

Description