ROFL! Lets just take the mint's word for it whether they have reserves by checking the mint's published list of token hashes. What the?
Discussion
I don't get what the paper is trying to achieve with the r' = r + n trick but I'm trying
There is also a major mistake in the paper in that it assumes only the list of blind signatures is required for a proof of reserver but that completely ignores the fact that ecash can be spent from one person to another, adding entries in these lists that don't inflate the supply....
At least the mint can present the unsealed secret as evidence a token is invalidated, preventing someone from claiming the mint isn't presenting hashes of all of its tokens.
I think 3.2 and 3.3 is trying to implement a system similar to an auditable election ballot. Anyone that holds a token can verify the mint is recording his token and then add up the total balance of published tokens, and anyonr that holds an unaccounted-for token can provide proof of lack of reserve. This could work if channel balances on the lightning node are pubically verifiable, which they are not.