Topic: Consolidation of mixed outputs - page 2. (Read 1044 times)

Ah, now I see: this privacy-enhancing technique is often referred to as "change avoidance" where you are actively practicing careful coin control not to create unnecessary outputs. The downside of this is that you have to do all these adjustments manually while doing some mathematical calculations in your head, trying to figure out which step doesn't break your anonymity set. I would like to see bitcoin wallets that have some in-built fee adjustment mechanism aimed at guarding my privacy. For example, when I make a transaction and accidentally create unspendable small outputs as change, a wallet warns me about that and offers me to slightly increase or decrease the fee rate.


In other words, OP_RETURN outputs are no longer part of bitcoin supply.

This txid nicely shows why not to do this: the $11 worth of "dust" they burned 9 years ago is now worth $3800. So keep it, guard it, label it. Then Lock it (in Bitcoin Core) or Freeze it (in Electrum) so you don't accidentally consolidate it. And then wait:

Yeah, what Loyce said. Or, you can absolutely create transactions which spend all the inputs as a fee, with 0 BTC in the outputs. Here are a few examples:

https://mempool.space/tx/9dc862cee6597a1748e4a1304be17c082a075eae243ce54432b47d5c300345a9
https://mempool.space/tx/8c307f3efe1b384f3b8528d3ed9ec62e0323358457826bd6731d64de9e3b7935
https://mempool.space/tx/eb31ca1a4cbd97c2770983164d7560d2d03276ae1aee26f12d7c2c6424252f29

Because these all only create OP_RETURN outputs which are not stored in the UTXO set they therefore don't clog up anything.

O_e_l_e_o's "add on any dust to the fee" was meant to happen before you have dust in your wallet. So, for example, instead of sending 1 Bitcoin with 1000 sat fee and 1000 sat change, you send 1 Bitcoin with 2000 sat fee and no change.

Please explain to a technically incompetent person what you mean when you say "gift." As far as I know, there is no direct way exists to convert an unspent output to a transaction fee without also creating another output. A transaction fee is a difference between inputs' aggregated value and outputs' aggregated value. So, in order to donate miners all my inputs, I would need to create a transaction with zero outputs, which is likely against consensus rules. On the other hand, even if it is possible to create an output of zero value, then it still won't solve the problem of clogging up with unspendable UTXOs (instead of small amount UTXOs, the blockchain will be spammed with zero amount UTXOs).

I believe the idea is that if you do this long enough (this is the catch, though), statistically, you'll get as much out of the lottery as you put in. So if you deposit a thousand 1,000 sat UTXOs, eventually, you're guaranteed to win a whole 1,000,000 sat pool.
But it's a little bit like the Martingale strategy [1], where there is a very slim chance that you need e.g. to play this proposed lottery millions of times, even though you'll eventually win an even larger jackpot of e.g. 1BTC. But for that you would statistically need to also deposit 100,000 times, if you only send 1,000 sat every time. If this is once per day, it would still take you over 270 years to win that 1BTC and get all your deposits back.

This is a great idea, honestly, just gift those dust outputs to the honest miners that nicely secure the whole network. Makes sense!

[1] https://en.wikipedia.org/wiki/Martingale_(betting_system)

I find a proper burn address (like 1BitcoinEaterAddressDontSendf59kuE) already a better choice than Satoshi's.
But yes, that means unnecessary tx if one wants to burn and the other 2 options are much much better.

Two downsides to this: It still clogs up the UTXO set each node has to keep with a bunch of dust outputs, and they eventually will be spent when quantum computing advances to a sufficient degree to break the ECDLP and all the early P2PK addresses become vulnerable. A better option would be to simply add on any dust to the fee. Then it creates no unnecessary UTXOs, and at least it goes to honest miners rather than some future dishonest criminal. If you really wanted to burn the dust instead, then an OP_RETURN output is both unspendable and does not add to the UTXO set.

That's actually a pretty good idea. Instead of leaving it to a centralized entity (such as a 3rd party service) or to a smart contract - which will probably get hacked anyway - this algorithm could be built directly into the Bitcoin Core codebase.

The downside of this though is that it'll make the software more like some money-making machine instead of a node for verifying bitcoin blocks & transactions (it's intended purpose).


Or, how about a variation of LoyceV's suggestion: Instead of holding a "lottery", all dust (where dust is defined to be anything below 10000 satoshis)  could be detected by  the Bitcoin Core wallet and auto-spent to one of Satoshi's addresses (since we know that he will never return, it won't be spent).

This would obviously be an opt-in setting on the Preferences page, and would be a very effective way to burn dust (provided that other wallets follow suit) butit has the disadvantage of putting a backdoor inside the blockchain, so it's probably a bad idea in its present state.

Personally, I have never partaken in lotteries, let alone provably-fair ones,  because both statistics and probability theory clearly shows that the chances of winning in such lotteries are rather slim. Why spend money on things that will likely turn out to be unpleasant for your person? Anyway, what problem are we trying to solve by creating a relatively random algorithm to consolidate unconnected UTXOs? If the goal of this approach is to get rid of annoying small chunks of Bitcoin clogging up the blockchain, making it a neat place for everyday transactions, then yes, I would buy that. Today there are no effective ways to clear the blockchain, especially which would also offer chances to win the jackpot for janitor job.

Can this be used as a mechanism to provide a certain level of anonymity for users that have chosen to give up some of their UTXOs for a greater good? I highly doubt it. The biggest concern is that this service is run by someone who has custody over funds. If a platform is custodial, what prevents its owners from running away with collected jackpot? If it works perfectly anonymizing all outgoing transactions, how can we catch owners that turned out to be malicious?

I use Chipmixer's vouchers to join chips from different sessions, but like BlackHatCoiner said, if the change can be linked back to the wallet I use for my forum account I usually just consolidate it in one transaction.  Unfortunately I haven't had to worry about his other concern of appearing wealthy.    Any change that I may have from my IRL identity wallet I'll send in a different transaction, and consolidate the chips using vouchers.  To o_e_l_e_o's point about rounding up and the value of a chip, I usually just save the dust to consolidate with a later session.

As for exchanges and privacy (and possibly anonymity) I've been on the fence about ShapShift from the start.  They looked pretty suspicious to me at first, but I may give them a try sooner or later.  The only thing you need for an account is a seed-phrase and a password.  The app will generate a Bip39 seed which can be restored in Electrum with the appropriate derivation path, and Ethereum wallets for ETH and tokens.  You can also use MetaMask or a hardware wallet to establish and login to an account.  They don't even ask for an email address.  I haven't looked to deep into the fees or trade limits, but it seems like a viable solution for small trades.

Doesn't really matter if enough people use it. If I deposit to ChipMixer and someone tries to follow my coins, they will eventually see them be pooled and the split in to one of their classical funding transactions which creates ~50 outputs all of 0.008 BTC (or some other chip size). If I withdraw from ChipMixer, then the coins come directly from one of these classical funding transactions, and so again are easy to identify. In both cases, all an adversary can tell is that I used ChipMixer; they can't like input to output or vice versa. The same would be true of this mining pool set up. You could identify transactions spending all the inputs as fees, and you could see where this mining pool sent all its coinbase rewards, but you couldn't link the two together.

Doesn't really solve the problem of dust outputs being too small to spend or a user screwing up their privacy by creating a single transaction linking a bunch of different dust outputs. Combine this idea with the SIGHASH_NONE and SIGHASH_ANYONECANPAY set up we've discussed previously regarding dust outputs, and you might be on to something.

It varies per exchanger, this one keeps each deposit address as a fixed exchange pair. I haven't tried it though, address recycling isn't recommended.

Not sure if you guys will believe me or not, Once I sent some Doge to the previous deposit address on Fixedfloat. I thought it was gone. Their support was offline, The transaction page expired, and I lost hope. Then a few hours later their support back online and manually send me my doges. Old days.

https://prnt.sc/sQbBwrOoQcy4

When you mentioned "small inputs", I assumed the amounts are too small for most mixers.
I know only one mixer that gives up to 20 deposit addresses to use, which could also work for small amounts.

To quote myself:
I don't trust most instant exchangers at all, but especially for the small amounts we're talking about here, I don't mind risking it. BestChange lists a few exchangers with low minimum. If you use different coins (or LN) on different exchangers (through Tor) with random email addresses (when needed), it will be quite difficult to link your transactions. Obviously, you shouldn't reuse addresses and use self-hosted wallets.

Assuming you mean sending multiple transactions to different ChipMixer sessions, getting Vouchers and Redeeming them into a single CM session is unlinked. But since each session has only one deposit address, you shouldn't send multiple deposits to that address (obviously).

You shouldn't deposit multiple times to the same address, but you can easily create a new exchange each time you have change to send somewhere. Even better if you use different services.

CM raised the minimum chip size to 4 mBTC I think around the end of 2017, when Bitcoin transaction fees were high enough to waste most of a 1 mBTC chip on fees. I've never seen chips under 1 mBTC.

As long as they don't ask KYC, you can just create a new account once in a while. Or even each time. Or don't use an account at all, all you need is a throw-away email address.

The way I read it, it doesn't say you can't have more than one account, but you can't use it to get around the limits. Even without account, you can spend $1000 per month. And since we're talking about small change here, that "ought to be enough for anyone" (not plagiarism, just a famous quote from someone who may or may not have said it).

---

---

Hypothetical: what if someone creates a Change Consolidation Lottery? It would work like this: you go to the website, get a deposit address, send your change/dust, and the service collects it. When enough inputs are piled up, a (provably fair) lottery is drawn. Higher deposits are more likely to win of course. The winner receives the total pool (minus transaction and service fees) back to the address their deposit came from.
If enough people use it, it will be difficult to link transactions.

So if all of a sudden a new pool(s) appear(s) and they include TXs that nobody has seen in the mempool you don't think that is going to look a little odd?
1st time / block it happens there would be some discussion about it here and elsewhere.  If it keeps happening they people are going to look at the address where the block reward went and start looking where those TXs go. Possibly not even the government or for any malicious reasons. Just people trying to figure out what these odd blocks are doing.

The best way to hide is in plain site.

-Dave

That's true, the government can also take you to a detention camp and beat the shit out of you until you show them all your transactions, but it's all a matter of how far are they willing to go? mining pools are unregulated for the most part because their business model is very complicated, they deal with no banks, and most of them operate in places where most governments like the U.S or EU countries don't have power own, like China.

But then, even if we were to go with the assumption that a said government will go as far as doing what you suggested, you can still use a passthrough running on some server, that way, you break the connection between Nicehash and the pool, nicehash will tell your government that you mined to server xyz (which at least in theory nobody knows about), from there, unless they find a way to get into your server, they won't know where the hashrate went to, unless they contact every mining pool on planet earth.

The second and better option would be using a decentralized mining pool like P2pool where the blocktemplate is generated by your own node, you connect Nicehash to your node or one of the public nodes, there is no company called p2pool which governments can ask for information, so the link between your incoming hashrate and outgoing hashrate is broken, it will be extremely difficult to anyone to link the pieces back together.

One way which they can track you is by asking Nicehash for the total hashrate you pointed and then attempt to estimate how much "BTC" would have come out of it, and then they would track addresses that received a similar amount, but given that there will probably be a few hundred thousand miners getting that same sum of outputs, it will be extremely difficult to narrow it down to just you.

Another thing they might filter is the addresses that didn't receive BTC before the hash rental took place, this will someone reduce the size of the circle, but it will still be very, very unlikely to know exactly.

Also, creating a decentralized mining rental marketplace won't be all that difficult, that way, you kind of break the chain at the first step of the way, making it even more difficult for anyone to track you.

With that said, I am not saying this is the perfect solution for privacy, the efforts and cost are higher than the traditional ways mentioned in other comments, the hash rental method is really like exchanging BTC for tomatoes and then selling the tomatoes for BTC to someone who lives on the other side of the world, it will take more effort and will cost more, it will also be a lot slower, but it will be more effective than going to supermarket to buy tomatoes with your BTC and then sell it back to them for BTC.

Building on the miner idea, here's another one which just occurred to me:

I create a transaction which spends all the coins I want to mix as a fee. I then send that transaction in private to a mining pool who is offering this service. They keep that transaction secret and eventually include it in a block that they mine, thereby claiming all my bitcoin for themselves. At a later date, they then send me an equivalent amount of bitcoin (minus 1% or whatever) to a brand new address I supply them with from their pool of mining rewards as part of one of their regular distribution-of-rewards-to-individual-miners transactions.

Other than the obvious trusting of a third party, there would be two main risks for such a set up that I can see. If you were trying to mix a sufficiently large amount of coins, then some individual miner in the pool, after learning about your transaction from the pool, may be incentivized to go off and attempt to solo mine a block in an attempt to steal your deposit. Secondly, in the event of a chain re-org, then if the block including your transaction loses, your transaction would return to being unconfirmed but would also have been exposed to the wider network, allowing other pools to attempt to mine it.

You are putting a lot of faith in CM. It is impossible to know if CM is being run by an intelligence agency or government. If they are not a honeypot, it is impossible to know if an intelligence agency has been able to compromise their servers in a way that will allow them to gather information about inputs and outputs.

That would probably make it difficult for blockchain analysis companies to track the flow of your coin via mass surveillance, however, if a government were to inquire with nicehash as to what happened to your particular deposit, that same government could go to the pool you mined on and ask for information about where your mining payouts were sent to.

That's a pretty cool and creative idea, of course it comes from a long-time mining connoisseur, I like it! You basically sell those UTXOs for hashpower, which generates a similar amount of BTC back; no actual connection, especially nothing that could be analyzed on-chain. I know that you could also deposit through LN on NiceHash, but not sure what the minimum deposit size is on other hashrate rental platforms. This is interesting when it comes to the topic of consolidation / having lots of inputs you want to mix together and get a larger output out of it, without accidentally linking those UTXOs together.