zooko

Thanks for writing this. I think it is an important point that the safety of "mixing" schemes (including ringsigs) depends on the nature of the "decoy" inputs. I'd like to see a more

When designing Zcash 1.0 (“Sapling”) we were concerned about this possibility hitting Zcash: What we decided to do about it for Zcash 1.0 Sapling was just recalculate the difficulty factor more frequently

(I'm not one of the authors of that paper.) As far as I know there's nothing incorrect in the paper that needs to be retracted. You can see one of the authors of the paper — Andrew Miller — being interviewed