script/research/antisapling/antisapling.md: Plan of attack added

script/research/antisapling/antisapling.md

@@ -15,3 +15,23 @@
 
 ## deterministic nonce
 - serial number can be derived from previous serial number, again loose nonce allow grinding attack, by picking favouring seed, nonce pair for higher probability of winning.
+
+# Plan of attack
+
+- Reward and value:
+    HE is already used to validate minted_coin_value = burnt_coin_value + reward using their value commitments, so no need to constrain it.
+    Code block: https://github.com/darkrenaissance/darkfi/blob/master/src/contract/consensus/src/entrypoint/proposal_reward_v1.rs#L135-L143
+
+- Headstart:
+    Constrain headstart in reward proof and validators calculate it ad-hoc to verify it.
+
+- Burnt coin constrain:
+    Constrain burnt coin nullifier in reward proof, so we ensure same coin is used in burn and reward steps of the sequence.
+
+- Mint coin constrain:
+    Constrain minted coin poseidon in reward proof, so we ensure same coin is used in reward and mint steps of the sequence.
+
+- Lottery seed:
+    Minted coin serial to be derived from burnt coin serial: minted_serial = poseidon_hash(NONCE_PREFIX, secret_key, burnt_coin_serial, ZERRO).
+    Deterministic function code block: https://github.com/darkrenaissance/darkfi/blob/master/src/consensus/lead_coin.rs#L231-L240
+    Use minted coin serial to calculate lottery seed in proof: SEED = seed = poseidon_hash(SEED_PREFIX, minted_serial, ZERO);