Some thoughts:
Why did you pick a modp group instead of an EC group?
Why doesn't Bob send y? Y is derivable from what Bob sends. (Your zero knowledge claim is at least a bit wrong, since Bob is sending correlated numbers and, in fact, y can be derived from them.)
Bob's sent values can be rewritten as y2^b, y2^c, and y^-1 * f_1 * f_2, which makes me wonder why f_3 is sent.
Why does Bob prove knowledge of x+b+c? Can you clarify the spoofing attack?
What prevents double spending if the tracker is malicious?