I know that to withdraw money from tornado cash, the sender has to send proof of (secret, nullifier). If it is verified by the contract, it withdraws money. To prevent double spending, the sender also sends the hash of the nullifier and if this nullifier is consumed by the contract, sender cannot withdraw any more.

My question is how the hash of the nullifier is enough to prevent double spending. Let's say "userA" sends (secretA,nullifierA) and hash of nullifierA. On the other hand there is a small chance that "userB" sends the same nullifier. If "userB" sends the proof of (secretB, nullifierA) and hash of nullifierA, userB wont be able to withdraw money because nullifierA is already consumed.

  • A nullifier allows to record a commitment as spent. Since you can in theory build 1 nullifier for each commitment and you need to make a deposit to create a new commitment. Dec 25, 2022 at 0:44

2 Answers 2


You can take a look at this resource on how does nullifier prevent double spending in tornado cash:



So you should use a random number as the nullifier.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.