<jeffro256> @tevador re jeffro256/carrot #16#issuecomment-6372088894: would it be an acceptable change to Jamtis to have s^ctx_sr bind to enote_type, and not have k_a bind to it?

<jpk68:matrix.org> Was this already known?

<jpk68:matrix.org> monero-project/monero #11586#issuecomment-6381396369

<jeffro256> Yes, if I understand it correctly.

<jeffro256> The mitigation is to reject making an OutProof to an address which shares your main view pubkey, but doesn't share the spend pubkey (i.e. isn't your address)

<jeffro256> The code doesn't reject this yet, but this was on my TODO when tackling this

<jeffro256> Oh wait, this is slightly different

<jeffro256> The mitigation here would be this jeffro256/carrot #16