What Happens If a Monero Ring Signature Contains a Spent Output?

31 October 2026

A ring signature that includes a spent output remains valid for the transaction being signed, but it creates a measurable privacy risk for the sender. The Monero network does not reject the transaction, but future analysis can expose which output in the ring was the real one.

How the Network Treats Spent Outputs in Rings

Monero's consensus rules check that the transaction's key image (a unique cryptographic fingerprint of the spent output) has not been used before. This prevents double-spending. The other outputs in the ring - the decoys - are not checked for being spent. The network only verifies that each decoy exists in the blockchain and has not been spent by the current transaction. A decoy that was already spent in a previous transaction is still valid as a decoy.

The consequence is that the ring signature itself passes all validation rules. The transaction confirms normally and the recipient receives the funds. From a protocol perspective, including a spent output is not an error.

The Privacy Problem

The purpose of ring signatures is to make it computationally infeasible for an observer to determine which of the ring members is the real spender. If one of the decoys is already spent, the set of plausible signers shrinks. An attacker who knows which outputs in the ring have been spent can eliminate them as candidates. As more spent outputs appear in rings, the effective ring size decreases, and the real spender becomes easier to identify.

For example, with the default ring size of 16, if 4 decoys are spent, the attacker knows the real output is among the remaining 12. Over many transactions, patterns emerge. A wallet that repeatedly includes the same spent decoys may be linking transactions to the same user.

Why spent outputs enter rings

The Monero wallet selects decoys from the blockchain using a decoy selection algorithm. The algorithm tries to pick outputs that look plausible as spending candidates - recent outputs, outputs of similar age, and outputs that have not been spent by the wallet itself. However, it does not know which outputs other wallets have already spent. The blockchain records spent outputs only through their key images, and the wallet does not maintain a complete list of all spent outputs across the entire network.

Two common scenarios produce spent decoys:

1. The decoy selection algorithm picks an output that was spent by another user between the time the wallet last updated its list of unspent outputs and the moment the transaction is constructed. This is rare but possible if the wallet's view of the blockchain is slightly stale.

2. A user intentionally or accidentally includes a spent output they control. If you create a transaction from a wallet that has already spent one of its own outputs, and that output is selected as a decoy, it is already spent on the blockchain. This typically happens when the wallet's internal state is corrupted or when a user manually constructs a transaction.

Does it affect your transaction's confirmations?

No. The transaction confirms and the recipient sees the funds. The only effect is a reduction in your privacy relative to an observer who can identify which outputs in the ring have been spent. That observer must have access to a full node that tracks all spent outputs - essentially, a blockchain analyzer. Casual observers, such as a remote node you connect to, do not automatically perform this analysis, but they can if they choose to.

Mitigation

The Monero development team has discussed improvements to decoy selection that would avoid picking known spent outputs, but as of this writing, no mandatory protocol change exists. The wallet's decoy selection algorithm, as implemented in the reference wallet (monero-wallet-cli and monero-gui), attempts to minimize this risk by preferring outputs that are unlikely to have been spent, such as very recent ones. However, it cannot guarantee zero spent decoys.

If you run your own full node, you can monitor the decoys your wallet selects by inspecting the transaction before broadcasting. Tools like the monero-wallet-cli command print_ring show the ring members for each input. Checking whether any of those outputs appear as spent in your node's database is possible, though not built into the wallet interface.

For the average user, the practical risk is low. Spent decoys are uncommon with the default wallet software, and even when they occur, the attacker needs to correlate them across multiple transactions to reliably de-anonymize you. The ring signature still provides plausible deniability unless almost all decoys are spent.

Relationship to other privacy coins

Zcash's shielded transactions do not have this problem because zero-knowledge proofs hide which note is being spent, and the network does not reveal which notes are used as decoys. Bitcoin's CoinJoin protocols, by contrast, have no decoy mechanism - the inputs and outputs are fully visible, so spent outputs are irrelevant to the privacy model.

Monero's ring signature design deliberately trades perfect privacy for efficiency and simplicity. Including spent outputs is a known weakness that the community continues to evaluate. No major wallet or exchange has reported a systematic de-anonymization attack exploiting this weakness, but the theoretical risk remains.

Back to privacy coins