search

Samourai-Wallet / whirlpool-client-cli

Command line Whirlpool client
Other
16 stars 13 forks source link

Feature request: Whirlpool to address #4

Open Technifocal opened 5 years ago

Technifocal commented 5 years ago

As of current it is trivial to identify that an address is controlled by a hot wallet: if it is an output of a whirlpool, it's part of the whirlpool's mnemonic.

A feature I would like to see is the ability to provide an address to the API of whirlpool-client-cli that makes the last mixsTarget round spend to that address. For privacy's sake, the address would have to be the same type of address that whirlpool-client-cli generates internally (bech 32).

This would confuse potential watchers of the blockchain if the address is a cold wallet (I.E. fully offline) or simply a UTXO that has hit it's mixsTarget/gone offline.

Technifocal commented 5 years ago

This would additionally have the benefit of being to take one large UTXO and pushing it to cold storage anonymously/privately.

For example, a third party application via the API could:

  1. Receive transactions from users via a payment processor such as BTCPayServer
  2. Spend all input UTXOs into tx0, splitting into X many UTXOs for mixing
  3. Set each UTXO to a random mixsTarget between 10 and 1,000
  4. Set each UTXO to be a unique outputAddress from a cold wallet zpub (sequentially, for example)
  5. Start mixing, all funds end up privately mixed into a cold wallet address

Obviously timing attacks could potentially be used on both the inputs and outputs to correlate which UTXOs are owned by each user, however this threat model exists with all Bitcoin mixers (that I've seen).