The write-up
Can you undo a CoinJoin? Prove it and take the sats.
A host sends one coin (U0) through a realistic JoinMarket history and locks a bounty behind a Bitcoin contract. Name every tip in the committed wallet and claim the bounty yourself: no judge. Guess wrong and you lose your entry fee. A setup proof establishes a wallet-scoped answer; a public audit checks the result without revealing it, subject to cut-and-choose soundness.