Topic: Whirlpool surge cycles (Samourai/Sparrow) (Read 549 times)

A good place to start is https://www.coinjoins.org/ - It's an open source project documenting comparisons of protocols and their clients.

Why don't they create rounds larger than 5-8 inputs?  zkSNACKs' coordinator creates coinjoins with 150-400 inputs, which provides much greater anonymity per transaction.


This is an enormous waste of block space and less private compared to skipping tx0 and creating your equal sized denominations directly from the coinjoin transaction itself (like JoinMarket's coinjoins and Wasabi 1.0's ZeroLink implementation).


The count of coinjoin transactions is not a good way to measure its popularity since some coinjoin transactions can have more or less inputs/outputs than others and more or less value mixed.  For example, users of the WabiSabi coinjoin protocol mix 3x as much new BTC and remix >10x total BTC compared to Whirlpool despite creating 1/6 of the amount of coinjoin transactions.  This is preferred since it is far more private and block space efficient to create larger sized coinjoins than smaller sized coinjoins.



Wasabi Wallet, BTCPay Server, or Trezor are your best choices since they support the WabiSabi coinjoin protocol and are prepackaged with Tor enabled by default. Like o_e_l_e_o mentioned, you need to be aware of how toxic change works.  Whirlpool coinjoins create toxic change that can be tracked when it is spent in a future transaction.  WabiSabi coinjoins eliminate toxic change by decomposing your input value into various sized denominations.  Additionally, Whirlpool exposes common input ownership from coins you use in tx0 transactions.  WabiSabi coinjoins also prevent common input ownership association, allowing multiple inputs to be registered privately by a user into a single round.


Whirlwind scammed their users, what makes you think they didn't also sell their data?


Whirlwind scammed their users, there's no excuse to give up custody of your funds or data.


The WabiSabi coinjoin protocol allows you to coinjoin from a hardware wallet.  Trezor already supports this.


The flat pool entry fee structure is designed to incentivize worst privacy practices.  Since fees are not collected directly based on volume, it is cheaper to participate in a smaller pool and create more outputs than participate in a larger pool and create less outputs. Additionally, it incentivizes revealing common inputs ownership of premix UTXOs since it is cheaper to consolidate them to enter the pool once than to enter the pool with each UTXO individually.  Samourai has never explained why they purposely chose a fee structure that heavily penalizes the most private usage of their protocol.

Because of this backwards design, you can easily link premix inputs to postmix outputs in many cases.  Notice how this Whirlpool tx0 premix creates 70 outputs for 0.05 BTC - https://mempool.space/tx/63679c9ec82f246811acbab0c04cc0fc77ba050e1b6c23661d78afcfc13cf8aa

Notice how every single input of this Whirlpool exit transaction is a direct descendant of rounds created by the aforementioned premix transaction: https://mempool.space/tx/ce2f84f7c5ff74fb1da103acb7b279bd34f02f5e9e3a2e1b6417ce8b9b7392db

When many inputs used in the postmix exit transaction are created directly from a round that the premix transaction entered, it makes it trivial to trace the user through Whirlpool.  Fortunately, the user abandoned Whirlpool and upgraded to using the WabiSabi coinjoin protocol instead, which made him completely untraceable: https://mempool.space/address/bc1qjjw5gaglkycu2lm5fskl7qhktk0hec4a5me3da

Correct. Although note there are not two separate sliders as the GitHub post you linked. Rather, there is one slider, which affects both Tx0 and the premix UTXOs: https://github.com/sparrowwallet/sparrow/issues/895#issuecomment-1477389172

Also correct.

Yes. There are three fees you need to consider altogether. The first is the fee to Whirlpool itself, which is a flat fee depending on the pool you are joining. This fee is dependent only on the pool you join and does not change with the amount you are coinjoining, so becomes cheaper overall if you coinjoin more in one go. The second fee is the network fee for Tx0, which splits your initial input(s) in to the necessary size to join the pool in question. The more premix inputs you create the larger and more expensive Tx0 will be, but it will still be much cheaper to create one Tx0 creating 20 premix inputs than it would be to create four Tx0s creating 5 premix inputs each. And then the last fee is the additional amount attached to each premix input to pay for its first mix. This is the only one that doesn't get cheaper the more you coinjoin, and will scale linearly with the number of premix inputs you create, as each one needs to pay for its first coinjoin.

But then of course once you've done all that, you get unlimited free remixes.

All right, so what the Sparrow's Premix Fee Rate do is to set 2 things. First, to set the Tx0 miner fee, and second, for the miner fee contribution (premixer, the one who pays the fee of the coinjoin tx).

Things started to get clear after I read your explanation and Introducing Whirlpool Surge Cycles.


So in the event that the on-chain fees dropped while the user had broadcasted/initiated the transaction with some set of Cycle Priority(miner fee contribution). Whirlpool coordinator adjusts/make-use-of the, if there are any, excess transaction fees by adding up more input/output. With a minimum of 5-inputs/5-outputs and a maximum of 8-inputs/8-outputs.

Anyway, the reason I am trying to figure out is that I recently made my first coinjoin transaction and barely know about Coinjoin at all, and the result was unexpected since it cost some hidden fees, like other experienced. I thought the unadjustable premix fee rate was the culprit since it only able spent 5 times of the mempool fee rate. Turns out, it's just how it works. I also didn't consider the miner fees. Reading up all about that I also found a site to help calculate detailed Whirlpool fees: https://bitcoiner.guide/wpfees/. So yeah that's about it.  

Each Whirlpool coinjoin has two inputs which are brand new entries to the pool, and these are the two that pay that transaction fee for the coinjoin. In a 5-input-5-output coinjoin, then 3 UTXOs will be free remixes. In an 8-and-8 coinjoin, then it will be 6 UTXOs which will be free remixes. So yeah, if there is a majority of 5-and-5 coinjoins, then the relative speed of free remixes will be slower than if there was a majority of 8-and-8, for example.

Having said that, I don't know if it is these new larger coinjoins, if it is more and more people using Whirlpool, if it is just my own bias, or some combination of all of these, but I am getting more free remixes more quickly these days than I did, say, a year ago.

So that is what the Sparrow's Premix Fee Rate is supposed to do, right? Things that make the postmix-ed UTXOs able to be remixed repeatedly and the coinjoin that has more than 5-input-5-output is come from that premix fee, if the current pool participant/condition has a low fee that would reduce the number of inputs and postmix remix rounds availability. Am I understand it correctly?

No, the coins remain under your control in either Samourai (mobile) or Sparrow (desktop), but with the obvious risk that these are hot wallets.

The central coordinator keeps track of all previous coinjoin outputs. As long as your wallet is online and connected to the coordinator, then any of your previous coinjoin outputs which you have spent are eligible to be included in a future coinjoin for free, with the new entrants paying the transaction fee as I described above. The coordinator sets this up, but your wallet signs the transaction for your input. Your wallet also doesn't need to remain online 24/7. You can shut down your phone or computer for days or even weeks at a time, and when you start it back up your unspent coinjoin outputs will still be eligible to be selected for new coinjoins.

The biggest downside to this is time. Your first mix is almost instant, since you are paying the fee. After that, free remixes can take a long time, since you depend on new volume entering the pool to create new coinjoins, and random chance that your outputs are selected. There is no time limit to how long you can wait or how many free remixes you can have, but sometimes you can be waiting over a week for a single remix.

Does this mean I forfeit the ownership of my coins as long as they stay in the pool? The thing I really like with Joinmarket is that coins never leave my house. We saw how terribly this involved with ChipMixer, when you woke up and the German authorities have had your coins seized without you knowing anything. I've had, fortunately, only a small amount seized, but I put myself in the position of people who lost thousands, and it must have been awful. Whirlwind tries to minimize the consequences of this by dividing custody into multiple trustworthy forum members, but it doesn't eliminate it completely, and it's yet to implement this shared custody.

We're far from ideal mixing, but we've got worse comparably to the last years with the shut down of CM, the censoring Wasabi and the overcrowded mempool. Mixing is now inferior and more expensive.

It's the only other option at the moment, since you shouldn't go anywhere near Wasabi for obvious reasons.

In terms of being cheaper - it's variable, and difficult to compare exactly. The fees for Whirlpool are all flat, as opposed to based on amounts or number of coinjoins. You have to pay a fee to join the pool, which depends on which pool you are joining. So if I join the 0.01 BTC pool, then my Tx0 pays a 50,000 sat fee. But I pay that fee regardless of whether I enroll one UTXO or one hundred UTXOs. Then each input needs to pay the transaction fee for its first coinjoin. So if we take the 0.01 BTC pool transaction I linked to in the first post, you'll see two inputs paying more than 0.01 BTC - one paying 5,000 sats more, and one paying 15,000 sats more. But then once you are in the pool and coinjoined once, you get unlimited free coinjoins for as long as you are happy to leave your coins in the pool.

So in summary, if you coinjoin a small number of UTXOs a small number of times, your relative fees are high. But if you coinjoin lots of UTXOs lots of times, the relative fees are much smaller.

In my experience, it isn't simplicity, but competition. I simply can't compete makers with hundreds of times more money than I have, and with a fortune locked in fidelity bonds. If you want to be a maker, you need serious amount of money, which comes with even more serious awareness of the protocol and the security measures you need to take.

Unfortunately, being a taker with current fees isn't very attractive. You still have to pay for the entire coinjoin transaction (makers don't pay their inputs), so it comes quite expensive. I haven't tried Whirlpool, but it sounds like the second best to coinjoin. Is it cheaper than Joinmarket?

That. If this continues as it's going, and implements blinded certificates, I don't think Joinmarket or Whirlpool will be even competitive.

In terms of trust, there is no denying that you need to trust Whirlwind more since you need to deposit coins to their service, as opposed to Whirlpool where you stay in custody of your coins. There is also the issue of trusting the service not to log what you are doing, which can be prevented with Whirlpool by using your own node and Tor. This could change in the future though, as Whirlwind have talked about decentralizing their service and implementing blinded certificates, which would eliminate any trust requirements.

In terms of privacy to an outside observer, then at the moment it depends on how you use them, but in the future I would say Whirlwind will provide better privacy than Whirlpool. If you coinjoin on Whirlpool, then your privacy is dependent on how many times you let the coins be mixed before you spend them. Assuming 5-input and 5-output coinjoins, then after one mix your backwards looking anonymity set is a maximum of 5. After two mixes, a maximum of 25. After three mixes, a maximum of 125. And so on. I say maximum, because if other people in the coinjoin do something stupid and deanonymize their coins, than that lowers your anonymity set. If you leave your coins in Whirlpool for months and months and end up with 10+ remixes then that's a very good anonymity set, but if you just let them be coinjoined once or twice before you spend them then that's not a very good anonymity set. This same principle applies to any coinjoin implementation. Whirlwind, on the other hand, currently has an anonymity set of 414 as long as you don't deposit huge amounts, and this is only going to grow. In the future, you will be able to get an anonymity set with Whirlwind of 10,000 or more.

How would you compare the coin mixing via  coinjoin  (Sparrow/Samourai) and Whirlwind in term of trust? I'm aware that both of them are centralized services but they might have traps and pitfalls which are not known for me.

I'm more or less aware of technicalities used by both of services and think their mixing  provide almost equivalent privacy but the trust has the matter for me.

P.S. I'm active user of Sparrow.

I wasn't aware that I was losing such an interesting piece of software up until now. This week will be impossible for me, but I'll try it out in the coming weeks and I'll let you know how it went! This is a nice alternative to mixers as you are the sole "owner" of the process  (or at least, you control some variable of it). I'll try to have it running on a docker image and report back. Once again, thank you for this!

Yes, indeed. It's been ages since I set it up so I can't comment on that side specifically, but I don't remember any major hurdles by just following the installation guide. I am obviously on Linux which it is designed for - I imagine trying to install on Windows would be more challenging.

Once you have it set up, you can be either a maker (also called a yield generator) or a taker. Most people run as takers only, because it is much simpler. As a taker, you decide which outputs you want to coinjoin, how many other outputs you want to include in your coinjoin, how many coinjoins you want to perform, and so on. You pay the transaction fee and a small fee to each of the other inputs joining your coinjoin, usually in the order of 5-300 sats depending on the size of your inputs. You can do PayJoins to an external address, and you can also do a series of internal coinjoins in a so called "Tumbler" to mix your coins back to your own wallet. It's very versatile. You can also run it via testnet (instructions are on their guides) to get familiar with it first.

If you want to be a maker, then there is further software to set up, but you essentially post your outputs on an orderbook and other users will pay you to use your outputs in one of their coinjoins. You get to mix your outputs and you get paid a little for the trouble. Be aware that there are risks and drawbacks to doing this, such as if you don't set up your configuration properly then you can end up with many small outputs that you have to consolidate, which obviously costs as well as decreases your privacy. You can actually view the JoinMarket orderbook here: https://nixbitcoin.org/orderbook/

I've also heard good things about this implementation, but I haven't tried it myself yet, so cannot vouch for it directly: https://github.com/joinmarket-webui/jam

Sparrow have an official guide available here which is fairly comprehensive: https://sparrowwallet.com/docs/mixing-whirlpool.html. As I said above, if you do use Sparrow, you must link it to your own node and connect via Tor, but this is very simple to do.

Wasn't aware of this project, seems interesting! I've checked their GitHub and it has a ton of information, I'll have to invest some time in trying to make sure that I set it up correctly. Thank you for that! Have you been using it for a while? Could you share some feedback?
If JoinMarket proves to be way to technical for me I guess I'll end up using either of those. Sparrow seems a balanced option and after a quick Google search I managed to find good guides in using Whirlpool with it, so if everything fails, this would be a nice 2nd option.
At the end of the day this is what concerns me (fully understand what's the concept behind the implementation), so I guess it will take some time before I run any coinjoins. The path is more clear to me however, so thank you for that.

The best method is to set up and use JoinMarket - https://github.com/JoinMarket-Org/joinmarket-clientserver

You run the software yourself via your own node, connect to other users in a peer to peer manner over Tor, and there is no centralized coordinator. It also gives you the most options in terms of customizing your fees, size of your coinjoins, size of your outputs, and so on. It is the best coinjoin implementation at present. However, it is also the most technical to set up and use. There are very good guides on their GitHub, and I have no doubt that a technically minded user such as yourself would be able to get it set up and running, but it will take a bit of time and work to do so.

The other option is using Samourai's Whirlpool, as is being discussed in this thread. Whirlpool does use a central coordinator, so it is absolutely vital that you use it with your own node and Tor to keep your privacy from the central coordinator. Your best options at the moment for connecting to Whirlpool are either Samourai wallet on mobile or Sparrow wallet on desktop. There are some other wallets starting to develop Whirlpool access as well, but I haven't tried or reviewed them so I won't recommend them. Again, there are good guides and both wallets provide a nice friendly GUI so they are much easier to set up and use than JoinMarket.

Regardless of which one you choose, I would spend some time reading about that specific implementation works, how it handles things like toxic change, and the steps you need to take to not mess up and negate the privacy it provides.

Nice dashboard, bookmarked! I might be wrong, but I suppose you're an avid user of coin-join usage. What would be the best method that one could apply to run a coin-join? I suppose using Sparrow Wallet would be the best bet?

Basically, when you first enroll coins in to Whirlpool, it does so with what it thinks will be a safe fee for relatively quick confirmation of a 5-input-5-output coinjoin. If, when those coins actually come to be coinjoined, it turns out that fee is higher than necessary, it will enroll additional inputs in order to lower the overall fee rate back to a more appropriate level.

See the "Samourai Whirlpool" box in the final third of the boxes here: https://bitcoin.clarkmoody.com/dashboard/. 7,657 transactions coinjoins over the last 30 days.

Pretty neat upgrade. I don't really understand why this is possible without additional fees, but glad to hear it is working anyway.

btw, is there a statistic showing how many coin-join tx whirlpool is running per day? Just curious to see how popular their service has become.

You're right, off-chain mixing doesn't make much sense in a world where it is still possible for a single individual to make economically viable transactions on a base layer, without having to rely on a pool of co-signers and fee share payers. Mixing through Lightning Network and similar solutions is no different conceptually from CoinSwap but leaves even more traces in the blockchain. You exchange two unrelated UTXOs or transaction histories, but some of your off-chain activity may reveal the real purpose of the transaction and give an observer additional information about transaction participants. The more tools a user employs to facilitate a private transaction, the greater the chance of messing up things and lowering the anonymity set. This is why I support this new Whirlpool feature: your behavior doesn't change, whereas your anonymity increases, and you get additional privacy for free.