  Public verification of quantum money has been one of the central objects in
quantum cryptography ever since Wiesner's pioneering idea of using quantum
mechanics to construct banknotes against counterfeiting. So far, we do not know
any publicly-verifiable quantum money scheme that is provably secure from
standard assumptions.
  In this work, we provide both negative and positive results for publicly
verifiable quantum money.
  **In the first part, we give a general theorem, showing that a certain
natural class of quantum money schemes from lattices cannot be secure. We use
this theorem to break the recent quantum money scheme of Khesin, Lu, and Shor.
  **In the second part, we propose a framework for building quantum money and
quantum lightning we call invariant money which abstracts some of the ideas of
quantum money from knots by Farhi et al.(ITCS'12). In addition to formalizing
this framework, we provide concrete hard computational problems loosely
inspired by classical knowledge-of-exponent assumptions, whose hardness would
imply the security of quantum lightning, a strengthening of quantum money where
not even the bank can duplicate banknotes.
  **We discuss potential instantiations of our framework, including an oracle
construction using cryptographic group actions and instantiations from
rerandomizable functional encryption, isogenies over elliptic curves, and
knots.
