Skip to content

POC for making better CoinJoins with an SMT solver

License

Notifications You must be signed in to change notification settings

csH7KmCC9/coinjoin-smt

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

66 Commits
 
 
 
 
 
 
 
 

Repository files navigation

Install prerequisites

pip3 install pysmt
pysmt-install --z3

Set up example CoinJoin amount, taker, inputs, txfees, and cjfees (optional)

Change the global variables prefixed with example_. Each party (i.e. participant in the CoinJoin) must be assigned a unique integer ID. -1 is reserved as a party ID for unused outputs.

Find a good CoinJoin

./prototype.py

This will first build an SMT problem to encode the CoinJoin constraints with an initial constraint of up to 3 * len(parties) (i.e. 3 times as many outputs as there are parties, enough for 1 output in the main CoinJoin amount and 2 change outputs for all parties) CoinJoin outputs and no constraint on the number of uniquely-identifiable outputs. Then it will solve the problem with an SMT solver and recover the model, or a set of variable assignments for which the problem is satisfiable. This tells us how many outputs the CoinJoin transaction will have, which outputs belong to which party ID, and how many satoshis each output gets.

Then, the constrained maximum number of uniquely-identifiable outputs is gradually decremented and the problem is re-generated and solved again with the new constraint, repeatedly, until the minimum number of uniquely-identifiable outputs that can be achieved using at most 3 * len(parties) outputs is found.

Finally, the constrained maximum number of uniquely-identifiable outputs is fixed at the discovered minimum and instead the constrained maximum number of outputs (initially 3 * len(parties)) is decremented, the problem re-generated and solved again with the new constraint, repeatedly, until we discover the minimum number of outputs with which we can achieve the discovered minimum achievable number of uniquely-identifiable outputs.

Note that the choice of 3 * len(parties) is totally arbitrary here; we could choose more or fewer. The optimization procedure is also arbitrary. There is nothing that says we have to minimize unique outputs at all costs--indeed, since the taker pays most of the fees but the makers enjoy the privacy benefits, a more judicious tradeoff is probably appropriate.

About

POC for making better CoinJoins with an SMT solver

Resources

License

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published

Languages