[nullc]

E.g. say you have two customers with a balance of 100. You report the total is 100— so 100 BTC has gone missing.

When customer A logs in you give them one root and show them their balance (and B has a balance of 0). When customer B logs in— oops balances just update— you show them a new root, and in that one B has a balance of 100.

So you need to pin the commitments strongly enough so that the prover can't swap them out at will.

[infruset]

Thanks, I get it now. Hadn't thought of that.

Of course, if many people were connected at the same time, this would quickly become perilous gymnastics for the exchange.