Algorithm 4 Withdrawal protocol.

Client A sends [Withdraw, k, ${\mathrm{T}}_{\mathrm{A}}$.offCounter, $\sigma$] to Bank-server (BS), where [k, ${\mathrm{T}}_{\mathrm{A}}$.offCounter, $\sigma$] ← ${\mathrm{T}}_{\mathrm{A}}$.Withdraw(k). Upon receiving [Withdraw, k, ${\mathrm{T}}_{\mathrm{A}}$.offCounter, $\sigma$] from A, BS performs the following steps: (a) Abort if ${\mathrm{T}}_{\mathrm{A}}$.offCounter ≠ BS.${\mathrm{onCounter}}_{\mathrm{A}}$ + 1 or SigVerify([k, ${\mathrm{T}}_{\mathrm{A}}$.offCounter], $\sigma$, ${\mathrm{T}}_{\mathrm{A}}$.pbk) ≠ 1. (b) BS.onBal${}_{\mathrm{A}}\leftarrow$ BS.${\mathrm{onBal}}_{\mathrm{A}}$ + k. (c) BS.onCounter${}_{\mathrm{A}}\leftarrow$ BS.${\mathrm{onCounter}}_{\mathrm{A}}$ + 1. (d) Send [WithdrawConfirmed] to A.