Bitcoin Transaction Protocol Question (maybe specific to Coursera Bitcoin Lecture) In the Coursera course "Bitcoin and Cryptocurrency Technologies" course, a coin called ScroogeCoin was introduced. 

This coin is similar to bitcoin in that each transaction consists of a set of inputs and outputs. Inputs point to outputs from previous transactions with corresponding signatures, and outputs contain the value and address the value is applied to.

The protocol checks that (sum of input values) - (sum of output values) >= 0, and this difference is the transaction fee. 

I feel that this condition is too loose and there may be a potential problem. For example, suppose Alice has a coin of value 50 and spends 100, while Bob has a coin of value 100 and spends 50. Both of these are in the same transaction. Then the protocol would allow this to pass. 

I feel that the protocol should check instead

For all addresses, (sum of input values from address) - (sum of output values that is spending from address) >= 0

This is because the original protocol allows spending from someone else's address. This sounds like something that can be exploited e.g. an implicit money transfer from Bob to Alice is hidden. We can assume Alice and Bob are colluding to achieve this.

Is this benign?
It doesn't matter whose coins are funding (inputs) for the transaction the validation check still works.


  (sum of input values) - (sum of output values) >= 0


There's nothing that states sum of input values on a per user basis. As long as the total value of the inputs, no matter who or where they come from, exceeds or equals the total value of the outputs the transaction passes the check.

Update: It's not an exploit. Each transaction input is treated separately and the condition to spend each input must be met separately. If Alice supplies an input tx then she'll also have to supply a scriptSig for that single input to prove she's entitled to spend it. Likewise with Bob's transaction, he'll have to supply a completely separate scriptSig that proves he's entitled to spend his input transaction.

Alice can't spend Bob's transaction and vice-versa (unless it's a multisig, spend by anyone etc) no matter how they are combined as inputs.