 Hello everyone, I'm Yan Xuzia from Shanghai Jiao Tong University. I'm glad to present our work, a universally comprehensible non-interactive aggregate cash system. This is a joint work with Shi Fengsun, Hong Shengzhou, and Da Wu Gu. In Bitcoin, an attacker can anonymize transactions by clustering and analyzing transaction graph. To prevent the transaction graph from being revealed, there is an approach called CoinJoin to break the linkability. The core idea of CoinJoin is to aggregate the transaction in the same time period. In each aggregate transaction, for each output coin, others cannot know which input coin is its source. Therefore, the transaction graph cannot be recovered. Mimo-Wimbo is a solution that uses CoinJoin to break linkability. Besides CoinJoin, Mimo-Wimbo also uses Peterson commitment to achieve a non-confidentiality. More specifically, in Mimo-Wimbo, the sender and the receiver interact to generate a transaction and send the transaction to the aggregation layer. Then these transactions will be aggregated into a big aggregate transaction. The aggregate transaction will be submitted to the ledger. Mimo-Wimbo also has a beautiful feature called cut-through. This means that if this coin is spined by this coin, then the two coins in the aggregate transaction will be cut, and the storage cores on-chain will be saved. Mimo-Wimbo has a drawback that impacts the usage of Mimo-Wimbo in practice. The sender and the receiver must interact to generate a transaction, which means that the two parties have to be online at the same time. This is because that in each transaction, a signature under the access E is needed. However, each party holds a part of the signing key. So the two party needs to interact to generate the signature. In our work, we aimed to avoid the drawback of Mimo-Wimbo. Mimo-Wimbo was objected to an aggregate cash system. We designed an aggregate cash system that can support non-interactive payments. So we call it non-interactive aggregate cash system, NICS for short. Then we formalize an ideal functionality for NICS. Finally, we prove that our scheme can securely realize the ideal functionality under the universal compensation framework in a hybrid model. We find that in the Mimo-Wimbo, the signature under E has two functions. The first is to prove that the transaction is balanced, and the second is to prove that the sender knows the spending keys of the input coins. In our work, we separate the two functions by adding the notion of address to achieve non-interaction. We also use the signature under E to prove that the transaction is balanced. But we use the signature and an address to prove that the sender knows the spending key of the input coin. Given the initial idea of adding address to achieve non-interaction, there are still some challenges. First, how to bind a commitment and an address. Second, how to bind the proof of the ownership of input coins with the transaction. Third, how to non-interactively transfer the private information of the output coins to the receiver. Finally, how to maintain the important feature cast through. We also define the ideal functionality for NICS. Unlike the original ledger, the ideal functionality for NICS submits the aggregate transaction into the ledger, now the individual transactions. For a transaction, the party not involved in it can only obtain the coin identifications, which hide the coin values and relevant parties. Please see our talk at Azure Script 2022 for more details of our work. I'm looking forward to see you at that time. Thank you.