spec: update for changes to money coin attributes

doc/src/spec/contract/dao/scheme.md

@@ -476,7 +476,7 @@ $$ \begin{aligned}
   b_\t{UD} &∈ 𝔽ₚ \\
   v_\t{DAO} &∈ 𝔽ₚ \\
   τ_\t{DAO} &∈ 𝔽ₚ \\
-  ζ_\t{DAO} &∈ 𝔽ₚ \\
+  b_\t{DAO} &∈ 𝔽ₚ \\
   \t{esk} &∈ 𝔽ₚ \\
 \end{aligned} $$
 
@@ -493,11 +493,11 @@ where $𝒫 $ matches the value in `DAO::exec()`, and $p.𝒜  = 𝒜 $.
 
 **DAO change coin integrity**   denote the last coin in the
 `Money::transfer()` outputs by $C_\t{DAO}$. Then check
-$$ C_\t{DAO} = \t{Coin}(d.\t{PK}, v_\t{DAO}, τ_\t{DAO}, ζ_\t{DAO},
-                        \t{CID}_\t{DAO}, 𝒟 ) $$
+$$ C_\t{DAO} = \t{Coin}(d.\t{PK}, v_\t{DAO}, τ_\t{DAO},
+                        \t{CID}_\t{DAO}, 𝒟 , b_\t{DAO}) $$
 
 **Verifiable DAO change coin note encryption**  
-let $𝐧 = (v_\t{DAO}, τ_\t{DAO}, ζ_\t{DAO})$, and verify
+let $𝐧 = (v_\t{DAO}, τ_\t{DAO}, b_\t{DAO})$, and verify
 $𝒟_\t{enc} = \t{ElGamal}.\t{Encrypt}(𝐧, \t{esk}, d.\t{PK})$.
 
 Then we do the same for each output coin of `Money::transfer()`.
@@ -513,7 +513,7 @@ Attach a proof $πₖ$ such that the following relations hold:
   **Coin integrity**   $C = \t{Coin}(c)$
 
   **Verifiable output coin note encryption**  
-let $𝐧 = (c.v, c.τ, c.ζ, c.\t{SH}, c.\t{UD})$, and verify
+let $𝐧 = (c.v, c.τ, c.\t{SH}, c.\t{UD}, c.n)$, and verify
 $a = \t{ElGamal}.\t{Encrypt}(𝐧, \t{esk}, d.\t{PK})$.
 
 ### Signatures

doc/src/spec/contract/money/model.md

@@ -13,9 +13,8 @@ The coin contains the main parameters that define the `Money::transfer()` operat
      key is used in the nullifier.
   2. Authorizes the creation of the nullifier by the receiver.
 * The core parameters are the value $v$ and the token ID $τ$.
-* The serial $ζ$ is randomly selected, and guarantees uniqueness of the coin
-  which is used in the nullifier. This simultaneously acts as the coin's random
-  blinding factor.
+* The blinding factor $b$ is randomly selected, and guarantees uniqueness of the coin
+  which is used in the nullifier.
 * To enable protocol owned liquidity, we define the spend hook $\t{SH}$
   which adds a constraint that when the coin is spent, it must be called by
   the contract specified. The user data $\t{UD}$ can then be used by the parent
@@ -27,9 +26,9 @@ $$ \begin{aligned}
   \t{Attrs}_\t{Coin}.\t{PK} &∈ ℙₚ \\
   \t{Attrs}_\t{Coin}.v &∈ ℕ₆₄ \\
   \t{Attrs}_\t{Coin}.τ &∈ 𝔽ₚ \\
-  \t{Attrs}_\t{Coin}.ζ &∈ 𝔽ₚ \\
   \t{Attrs}_\t{Coin}.\t{SH} &∈ 𝔽ₚ \\
   \t{Attrs}_\t{Coin}.\t{UD} &∈ 𝔽ₚ \\
+  \t{Attrs}_\t{Coin}.b &∈ 𝔽ₚ \\
 \end{aligned} $$
 
 ```rust
@@ -37,7 +36,7 @@ $$ \begin{aligned}
 ```
 
 $$ \t{Coin} : \t{Attrs}_\t{Coin} → 𝔽ₚ $$
-$$ \t{Coin}(p) = \t{Bulla}(\mathcal{X}(p.\t{PK}), \mathcal{Y}(p.\t{PK}), ℕ₆₄2𝔽ₚ(p.v), p.τ, p.ζ, p.\t{SH}, p.\t{UD}) $$
+$$ \t{Coin}(p) = \t{Bulla}(\mathcal{X}(p.\t{PK}), \mathcal{Y}(p.\t{PK}), ℕ₆₄2𝔽ₚ(p.v), p.τ, p.\t{SH}, p.\t{UD}, p.b) $$
 
 ## Inputs and Outputs