[9mit3t2m9h9a]

A person who monitors transactions and immediately submits a competing transaction with ridiculously high transaction fee (50% of the payoff) may have a chance to induce miners to include his illicit transaction in the new block instead of the legitimate payment.

Maybe illicit CRS can be a problem for some kinds of checks, but I guess you could feed first Linux kernel commits in the 2016 to some randomness extractor to get something that is harder to manipulate freely.

[abhv]

I believe it is not possible to submit a competing transaction to spend, the identity of the seller (via seller's public key) is included in the script.

The CRS issue is that off-chain, a malicious Verifier (buyer) may learn about the witness, i.e., either enc key or solution.