Quantum Money where not even the Bank can counterfeit

Question

The Quantum Money system proposed in "Quantum Copy-Protection and Quantum Money" has the following properties:

1. The bank can produce bank notes in the form of quantum states.
2. Anyone can verify that one of these quantum states is a valid bank note without destroying the quantum state.
3. No one except the bank can produce more bank notes, even if they already have some.

All assuming that the actors only have polynomial time quantum computers.

My question is if you can take this step further and make it so that even the bank is unable to forge bills.

What do I mean by this? The quantum money protocol I am looking for would have an integer parameter $k$, and the bank could only create $k$ valid bank notes.

(This might seem impossible since the bank could just run the protocol again to get $k$ more bank notes. A way to prevent this would be to require it to produce a random classical string $s$ of bits that it releases publicly, such that it can not run the protocol again and produce the same $s$ with non-negligible probability.)

Answer 1

There are proposals for quantum money where it appears that not even the bank can produce two copies of a quantum money state with the same serial number. See

• Farhi et al's paper Quantum Money from Knots,

• Mark Zhandry's paper Quantum Lightning Never Strikes the Same State Twice,

• Daniel Kane's paper Quantum Money from Modular Forms.

In order to make sure that the bank can only produce $k$ banknotes, one would need to have the bank publish the serial numbers of exactly $k$ banknotes in some secure location. Otherwise it could make as many bank notes as it wants (although they would all have different serial numbers).