In Shielded Bitcoin, spent notes are recorded in an on-chain nullifier set to prevent double-spending