Technically, this is very cool work. But one thing the paper overlooks is divisibility. How does one make change with zerocoin? It appears that the trapdoors allow only a whole coin to be spent, with no recourse for spending a partial coin. Needless to say, non-divisibility will make a practical deployment difficult.
As I understand it you basically deposit and withdrawal BTC in the ZeroCoin ether (much like a mixer service) using standard denominations, then you make you actual arbitrary denominated transactions with your new Bitcoins.
There can be multiple denominations of ZeroCoins, but it's in everyone's interest for the set of denominations to be small, otherwise you lose anonymity.
Why? Why not simply set a minimum quantum for transactions in Zerocoin, like the penny or the satoshi? Or why not redeem the Zerocoin for a Bitcoin, which is divisible and which would be free of (traceable) history.
