E.g. say you have two customers with a balance of 100. You report the total is 100— so 100 BTC has gone missing. When customer A logs in you give them one roo

E.g. say you have two customers with a balance of 100. You report the total is 100— so 100 BTC has gone missing. When customer A logs in you give them one root and show them their balance (and B has a balance of 0). When customer B logs in— oops balances just update— you show them a new root, and in that one B has a balance of 100. So you need to pin the commitments strongly enough so that the prover can't swap them out at will.