Does the ZeroCoin protocol fulfill its promise of anonymity? Zerocoin is a new cryptographic extension to Bitcoin that (if adopted) would bring true cryptographic anonymity to Bitcoin.

Has anyone seriously analyzed the protocol and verified it works as advertised?
This is the zerocoin paper, but as far as I can tell, they haven't released source code yet, so all we can really do is speculate.

The single largest problem it has is that a zerocoin spend requires about 100x more disk space/bandwidth/cpu than a normal bitcoin transaction. However, the intended use case is that you use normal bitcoin transactions most of the time, then run through zerocoin when you want more anonymity.

Second, because all zerocoins are indistinguishable, they must either 


all be the same denomination, which sucks for people making very large transactions and for people making very small transactions, or
Have a handful of predefined denominations, like 1-zerocoins, 10-zerocoins, etc. The problem with this is that it reduces your anonymity set.


As far as security/anonymity goes, I believe that they have a workable system unless there's some problem with their zero-knowledge proof, which I've repeated below.