It's commitment to coin, or bulla's secret key, and serial number: commit(sk||sn) each coin, bulla has unique private secret key, and unique serial, preventing double spending can be implemented through validation that nullifier have never been seen, proof that nullifer isn't included under current nullifiers sparse merkle tree root.