PaperlayerView exact revision on arXiv

Source-linked AI summary

The Anonymity Gap: Understanding Real Privacy in Shielded UTXO-based Protocols for DeFi

Hanze Guo, Stefanos Chaliasos, Yebo Feng, Jiahua Xu

arXiv:2608.22987v1cs.CR

TL;DR

Shielded UTXO-based DeFi protocols create a provenance-based privacy measurement problem because assets can be repeatedly re-spent within hidden state. The paper develops a layered, non-heuristic recursive analysis using public traces and constraints, finding substantial anonymity reductions relative to temporal baselines and implications for users and protocol designers.

  • Problem

    Existing privacy analysis lacks a unified framework for recursive provenance in deployed shielded UTXO-based DeFi protocols.

  • Method

    The paper recursively traces feasible commitments through historical hidden-state transitions across note, proof, and transaction layers using public protocol traces and constraints.

  • Results

    40.1%–59.0% mean Anonymity Set Size reductions are found for Railgun deployments relative to their temporal baselines.

  • Takeaways & Limitations

    The analysis reveals interpretable anonymity-loss patterns and implications for user behavior and future privacy-protocol design.

  • Takeaways & Limitations

    The study reports feasible address sets without user or entity attribution and uses a conservative pruning operator that upper-bounds exact jointly feasible candidate sets.

Abstract

from arXiv · show

Shielded UTXO-based protocols are becoming a core form of privacy infrastructure for DeFi. Unlike mixers that organize privacy mainly around deposits and withdrawals, these protocols allow assets, once inside the shielded pool, to continue moving and being re-spent within the hidden state, and to become public only when users withdraw or interact with public DeFi protocols. Their anonymity is therefore no longer a flat pool-size problem, but a provenance problem that propagates across the note/UTXO, proof, and transaction layers. Yet, a unified analysis framework for this setting is still missing. We propose a layered system model and an analysis pipeline that uses prior history as the temporal baseline, applies cumulative pruning and cross-proof propagation to each proof's Commitment Set, and recursively traces the survivors through historical hidden-state transitions to derive the final transaction-level Anonymity Set Size. We evaluate our methodology on the complete on-chain histories of all four Railgun production deployments and five independent Hinkal pools across six EVM chains, analyzing 186,356 unshielding spend transactions. Using only public protocol traces and constraints, our non-heuristic analysis yields mean Anonymity Set Size reductions of 40.1%-59.0% relative to each deployment's temporal baseline; 3,679 transactions retain at most 10 addresses, including 1,228 singletons. Public token constraints are the strongest and most stable source of pruning in both protocols, while the effects of tree number, proof roots, and value constraints vary with protocol design and historical state. Together with representative cases, these results reveal interpretable anonymity-loss patterns and implications for user behavior and future protocol design.

1 Introduction

The paper frames shielded UTXO-based DeFi protocols as evolving privacy infrastructure whose anonymity must be analyzed through recursive provenance rather than one-hop mixer matching. It introduces a layered, non-heuristic framework and evaluates anonymity loss across Railgun and Hinkal deployments.

  • Motivation: Shielded UTXO-based protocols support richer hidden-state operations than mixers organized around separate deposits and withdrawals.Assets can remain hidden, recur as new notes, and continue through later private transitions.
  • Motivation: The paper identifies recursive provenance across note, proof, and transaction layers as the central challenge for measuring deployed anonymity.The proof layer captures private-state relations, while the transaction layer exposes entry and exit addresses.
  • Framework: The framework defines transaction-level Anonymity Set Size and proof-level Commitment Set Size within a layered system model.These metrics connect feasible proof sources to transaction-level anonymity.
  • Framework: The analysis combines four-stage pruning with cross-layer lifting and recursively traces feasible hidden-state histories to shielding addresses.It starts from temporal baselines and propagates public constraints without address clustering or behavioral heuristics.
  • Results: 40.1%–59.0% mean Anonymity Set Size reductions are reported for Railgun deployments relative to temporal baselines, alongside a separate 48.9%–57.4% range for Hinkal pools.The evaluation covers all four Railgun production deployments and five independent Hinkal pools.
  • Results: The paper presents an eight-pattern anonymity-loss taxonomy supported by case studies and discusses implications for user behavior, interfaces, and protocol design.The taxonomy spans proof-level specialization, proof-structure effects, and transaction-level aggregation.

2 Background

Shielded UTXO-based DeFi protocols represent value as discrete notes and preserve hidden state through commitment-nullifier transitions, token encoding, recipient discovery, and DeFi-facing execution. The paper distinguishes this target class from adjacent commitment-nullifier systems and protocols with different public constraints.

  • Commitment-Nullifier State: Shielded UTXO-based protocols represent value as discrete notes whose commitments enter an append-only accumulator, typically a Merkle tree.Private spending uses note-derived nullifiers and zero-knowledge proofs tied to recorded public Merkle roots.
  • Shielded Transfer: Private transitions consume existing notes and create new ones while proving input, output, and protocol consistency without revealing witnesses.This allows value to remain hidden and continue through later private transitions.
  • Token-Encoded Notes: Token-encoded notes support multiple assets in one hidden-state machine and enforce token consistency in private transitions.The token may be exposed directly or inferred from transaction-specific public constraints.
  • Recipient Discovery: Recipient discovery lets users recover another user’s note through recipient-bound public data derived from a public key and commitment.Without such data, recovery information must be conveyed off-protocol.
  • DeFi-Facing Design: DeFi-facing designs let shielded state feed broader on-chain financial activity instead of requiring withdrawal before external use.Railgun and Hinkal support external calls, including private swaps, lending, and staking.
  • Scope: The target class combines all five defining features and includes Railgun, Hinkal, and Nocturne, while adjacent systems differ in scope or exposed constraints.Tornado Cash Nova and Zcash share hidden-state machinery, whereas Umbra requires a distinct anonymity model.

3 System Model and Privacy Metrics

The system model spans note, proof, and transaction layers, defining how shielded assets are created, consumed, transferred, and released. Privacy metrics count feasible hidden commitments and trace them to potential shielding addresses using temporal baselines.

  • Note Layer: A shielded pool represents value as notes, which are created by shielding and consumed through nullifiers during spending actions.Notes correspond one-to-one with on-chain commitments, while nullifiers prevent double spending without revealing the consumed commitment or note attributes.
  • Proof Layer: Proofs consume same-token notes, enforce value balance, and may release public value or create new commitments for continued shielded use.The model distinguishes Proof 2 for full unshielding, Proof 3 for internal shielded transfers, and Proof 4 for partial unshielding with the remainder kept inside the pool.
  • Transaction Layer: Each commitment has a creation classification that distinguishes shield commitments from proof-created commitments while allowing combined shielding and spending transactions to depend on both public and shielded inputs.Proof-created commitments have a unique creating proof, denoted π(c).
  • Transaction Layer: Transactions define the execution boundary: internal spend transactions contain only Proof 3, whereas unshielding spend transactions include Proof 2 or Proof 4 and carry the Anonymity Set Size.Commitments created within a transaction cannot serve as inputs to proofs in that same transaction; unshielding addresses are the public exit points.
  • Privacy Metrics: The Commitment Set Size |Ω(i)| counts commitments feasible as hidden inputs to proof πi after protocol-visible constraints, while the temporal baseline includes commitments present at transaction start.Commitments created during the containing transaction are excluded from the baseline.
  • Privacy Metrics: The Anonymity Set Size |A(T)| counts shielding addresses that could have originated an unshielding transaction’s released funds, relative to a baseline of preceding shield addresses.Potential addresses are obtained by tracing feasible commitments and directly attached predecessor relations back to shield transactions; redA(T) = 1−|A(T)|/|A0(T)|.

4 Non-Heuristic Provenance Analysis

The analysis pipeline combines cumulative public-constraint pruning, cross-proof propagation, and recursive provenance tracing to derive transaction-level anonymity from proof-level candidate sets.

  • Local pruning: Cumulative pruning applies tree number, proof-root coverage, token consistency, and value feasibility to each proof’s temporal-baseline candidates.These stages produce successive feasible sets Ω1(i) through Ω4(i), with structurally inapplicable stages acting as the identity.
  • Local pruning: Tree-number pruning retains only commitments in the Merkle tree referenced by the private spend.The proof’s public tree reference excludes time-eligible commitments from other trees.
  • Local pruning: Proof-root pruning removes commitments inserted after the largest leaf index covered by the authenticated root snapshot.Survivors satisfy the prefix condition ℓ(c) ≤ ℓmax(πi).
  • Local pruning: Token pruning intersects candidate token labels with the proof’s permitted token set and removes branches unable to supply the required inputs.Candidate labels may narrow through public creation traces and cross-proof propagation.
  • Local pruning: Value pruning conservatively removes candidates that cannot satisfy public token and amount relations, then extracts branch-local mandatory commitments.The reported sets upper-bound exact jointly feasible candidate sets because exhaustive input-tuple solving is not performed at every fixpoint update.
  • Cross-proof propagation: Cross-proof propagation revisits affected proofs until mandatory inputs and narrowed created-commitment labels reach a fixpoint.The resulting Ω(i) and token-guarded family Σ(i) feed closure lifting.
  • Closure-based lifting: Closure lifting recursively follows feasible hidden-state dependencies from surviving commitments to terminal shield transactions and their shielding addresses.Address sets are then unioned within each unshielding transaction to obtain A(T).

5 Results

The evaluation reconstructs complete Railgun and selected Hinkal histories, then measures how cumulative constraints and provenance lifting reduce proof- and transaction-level anonymity sets. Reductions vary across deployments and proof structures, while token constraints remain persistent and deeper ancestry generally weakens final reduction.

  • Dataset and evaluation: 186,356 unshielding spend transactions are analyzed across all four Railgun deployments and five Hinkal pools on six EVM chains.Railgun histories cover every recorded commitment, nullifier, proof, shield, spend, and tree rollover within the observation window.
  • Commitment-set results: 82.2%–38.2% Railgun and 72.8%–80.4% Hinkal mean Commitment Set Size reductions are obtained relative to temporal baselines.The Railgun values correspond to Ethereum, Arbitrum, Polygon, and BNB Chain; Hinkal values correspond to Ethereum, Arbitrum, Polygon, Base, and Optimism.
  • Constraint effects: Public token constraints are a major persistent filter, whereas tree number, proof roots, and value constraints vary with protocol design and historical state.Tree number is especially effective after Railgun rollovers, while proof-root effects are limited in the selected Hinkal pools.
  • Transaction-level results: 3,679 transactions retain at most ten shielding addresses, including 1,228 singletons, across the evaluated protocols.Railgun contributes 2,968 such transactions and 920 singletons; Hinkal contributes 711 and 308, respectively.
  • Transaction-level results: 40.1%–59.0% Railgun and 48.9%–57.4% Hinkal mean Anonymity Set Size reductions are obtained relative to each deployment’s temporal baseline.These reductions persist throughout the observation window rather than arising only from a few extreme transactions.
  • Proof composition: 53.4%–74.1% reductions for Railgun Proof 2-only transactions exceed the 38.4%–56.7% reductions for Proof 4-only transactions.Proof 4-only transactions generally retain broader feasible histories because they release funds while continuing to create shielded commitments.
  • Transaction aggregation: A single broad proof can offset pruning in other proofs because transaction-level anonymity is the deduplicated union of proof-level address sets.Final privacy therefore depends on proof-set widths and overlaps rather than the most strongly pruned proof alone.
  • Provenance depth: 12.3%–43.6% Railgun reductions occur in the deepest ancestry quartile versus 54.5%–66.0% in the shallowest.Deeper feasible ancestry generally accumulates more historical shielding addresses during closure lifting.

6 Discussion

Protocol design choices shape how much history remains in an anonymity domain and how strongly public information prunes provenance. The discussion links these tradeoffs to user guidance and privacy-preserving redesigns.

  • Performance–Anonymity Tradeoffs: Railgun partitions history through fixed-depth trees and rollover, whereas Hinkal preserves continuity in a growing logical tree without evaluated tree rollovers.Tree height, capacity, and rollover policy jointly affect maintenance cost and retained anonymity history.
  • Performance–Anonymity Tradeoffs: Historical-root retention trades state cost and proof flexibility against stale-root exposure and effective anonymity history.Hinkal retains the latest 200 roots, while Railgun accepts historical roots indefinitely.
  • Implications for Protocol Designers: Railgun preserves commitment-tree state across V1–V2 transitions, whereas each Hinkal contract generation starts an independent pool and restarts anonymity accumulation.Twenty-three of Hinkal’s 37 nonempty pools contain fewer than 1,000 commitments.
  • Performance–Anonymity Tradeoffs: 96.2% of Ethereum unshielding spend transactions publicly release one token, and token restriction reduces the mean shielding-address baseline from 485 to 198 before complete closure leaves 197.Public token information persists as privacy loss across commitment, proof, and transaction layers.
  • Implications for Users: Users should favor fresh roots, regenerate delayed proofs, and prefer mature active pools when compatible alternatives exist.Withdrawing from an old pool and shielding into a new one creates a public boundary without carrying over old anonymity history.
  • Toward Better Privacy Protocols: Private migration proofs and hidden token identity are proposed to preserve provenance across upgrades and reduce deterministic asset-based history partitioning.These designs introduce requirements involving double-spending prevention, root finality, synchronization, circuit size, and liquidity.

7 Related Work

Prior privacy analysis commonly relies on heuristic attribution, while structural analyses exploit public candidate relationships. This paper positions its approach as a non-heuristic baseline that traces protocol-visible provenance without user attribution.

  • Heuristic attribution-based privacy analysis: Heuristic studies use timing, address reuse, graph proximity, and amount patterns to link withdrawals to deposits or estimate anonymity loss.One Railgun study uniquely linked 17.65% of withdrawals to one deposit and reported a 3.42-bit median anonymity loss.
  • Heuristic attribution-based privacy analysis: The paper supplies a non-heuristic baseline that isolates protocol-visible anonymity loss and recursively traces feasible provenance without user attribution.Heuristic attribution and probability-weighted metrics can be layered on top of this baseline.
  • Non-heuristic structure-based privacy analysis: Ring-based systems provide a structural precedent in which public candidate membership enables eliminations to propagate across subsequent transactions.Monero research combines such structure-only reasoning with, in some cases, heuristic inference.

8 Conclusion

The paper presents a three-layer, non-heuristic framework for measuring feasible provenance in shielded UTXO-based DeFi protocols. Across complete Railgun and Hinkal histories, it finds substantial transaction-level anonymity reductions relative to temporal baselines.

  • 8 Conclusion: The framework recursively traces feasible commitments through hidden-state histories and aggregates them into transaction-level Anonymity Set Size using public traces and protocol rules.It is grounded in note, proof, and transaction layers and excludes user or entity attribution.
  • 8 Conclusion: 40.1%–59.0% mean Anonymity Set Size reductions occur across the evaluated Railgun deployments and Hinkal pools relative to the temporal baseline.The framework can also be instantiated for broader commitment-nullifier privacy protocols according to their public semantics.

Ethical Considerations

The study analyzes public blockchain and protocol data without changing protocol state, using non-attributive methods. Its results are dual use, so the authors limit incremental harm by reporting feasible address sets rather than identities and excluding off-chain attribution signals.

  • The analysis passively uses public, append-only blockchain data and protocol semantics without submitting transactions or changing protocol state.
  • The study uses no non-public data or human participants and makes no identity, ownership, behavioral, or probabilistic attributions.
  • The results are dual use: feasible address sets may narrow provenance, while the measurements help users assess effective anonymity and designers mitigate privacy loss.The authors limit incremental harm by not combining results with off-chain attribution signals, although others could do so.

Open Science

The paper provides an anonymized artifact and formalizes conservative cross-proof propagation as a fixpoint computation over public constraints and shared semantic state.

  • Open Science: The anonymized artifact includes code, prepared inputs, frozen outputs, and workflows for reproducing pruning, closure, anonymity metrics, and closure depth.The data cover the observation window ending July 30, 2026.
  • Propagation semantics: Propagation uses a canonical public-trace order rather than assuming cryptographic proofs were verified separately or sequentially.Relations jointly authenticated by one cryptographic proof may still be analyzed in an order exposed by the trace.
  • Propagation state: Each propagated proof state preserves its structural domain while contracting through reservations or narrower token–value interpretations.The invariant is M(i) ⊆ Ω(i) ⊆ Ω2(i).
  • Guarded propagation: Public creation relations constrain projected labels, while cross-branch sets retain commitments as globally mandatory only when every surviving token interpretation forces them.Created commitments may carry narrower token and value interpretations into later proofs.
  • Propagation channels: Cross-proof propagation reserves mandatory commitments and forwards narrowed token or value labels to affected proofs until no further state shrinkage occurs.A fair work queue revisits proofs after reservations or projected-label contractions.
  • Fixpoint procedure: The procedure initializes from structural pruning, refreshes only after notified updates, and terminates if all guarded interpretations become infeasible.Unresolved hidden assignments alone do not remove candidates during initialization.

C Protocol Instantiations

The study instantiates its model against Railgun and Hinkal using public deployment, contract, event, and proof-call information, while preserving protocol-specific evidence boundaries.

  • Railgun: Railgun V1 and V2 are reconstructed as one continuous production history when V2 preserves the existing commitment-tree state through the same proxy.The analysis inspects deployment records, contracts, and public V2 circuit sources.
  • Railgun: Each Railgun JoinSplit proof relation uses one tree and authenticated root, consumes one token, and may create private commitments plus one plaintext output.The public output commitment is excluded from Merkle insertion, so ki counts only private outputs.
  • Railgun: Railgun reconstruction uses public events for Shield commitments, nullifiers, proof-created commitments, and Unshield outputs, while excluding administrative events.V2 additionally enforces the common-token relation used in pruning.
  • Hinkal: Hinkal pools are modeled independently from observable proof-call boundaries and contract-enforced transitions without inferring unavailable circuit constraints.The Hinkal mapping treats the missing verifier-input assembler and circuit sources as an evidence boundary.
  • Hinkal: A unified Hinkal call is analytically projected into distinct input-bearing proof relations without claiming that its cryptographic proof contains separate proofs.The call may combine private inputs and outputs with Shield, Unshield, or external execution.
  • Hinkal: Hinkal constraints use exact public token addresses, root-covered prefixes, and contract-enforced value equations; persistent authorization state can supply historical predecessors for public outflows.Closure preserves permitted cross-token predecessors and excludes fee-only branches from public address sets.

D Reconstruction and Analysis Validation

Validation uses fail-closed checks and independent reconstruction across complete Railgun and Hinkal datasets before reporting Commitment Set and Anonymity Set results.

  • Validation boundaries: Any missing or inconsistent input terminates the analysis, and representative Railgun and Hinkal checks validate the executed datasets.Independent depth records match all 169,840 Railgun and 16,516 Hinkal unshielding transactions.
  • Trace integrity: Trace admission requires exact decoded proof relations, authenticated roots, unique creating proofs, contiguous insertions, and reconstructed root-covered prefixes.Missing roots, tree mismatches, or inconsistent identifiers fail before pruning.
  • Propagation consistency: Propagation validation synchronizes projected token/value labels after upstream changes and rejects empty token sets or incomplete value maps.Hinkal closure independently reconstructs local Value-stage sets and validates chronological mandatory-input reservations.
  • Closure lifting: Closure validation requires terminal Shield sources to precede the analyzed proof and deduplicates reached shielding transactions and addresses during lifting.Within-transaction contributing proofs are combined into one transaction-level anonymity set.
  • Protocol-specific boundaries: Railgun V1 validation is limited to contract-visible semantics because its circuit is unavailable, although every decoded V1 call is checked.The evidence boundary covers 3,452 spend transactions containing 4,482 proof relations.
  • Protocol-specific boundaries: Hinkal validation replays external-execution state changes in ledger order and retains all permitted predecessors when the public trace allows multiple transitions.It also validates Shield provenance and fee-only branches against contract semantics and asset transfers.

F Supporting Anonymity-Set Analyses

Supporting analyses examine Hinkal’s temporal Commitment and Anonymity Set evolution, token ancestry, proof composition, and closure depth using transaction-level comparisons.

  • Hinkal Commitment Set Size: Hinkal Commitment Set Size plots compare the temporal baseline with cumulative Proof Root, Token, and propagated final sets across equal-count block-order bins.Each selected pool has one long-lived tree, so Tree Number is inapplicable.
  • Token partition: The token-pure Ethereum cohort has a mean temporal shielding-address baseline of 484.98, 197.73 after public-token restriction, and 197.47 after complete closure.The result indicates that token partitioning persists from commitment candidates to address-level provenance.
  • Proof composition: Proof-composition analysis partitions unshielding transactions into Proof 2-only, Proof 4-only, and mixed classes, distinguishing one- versus multiple-proof contributors.The strata are descriptive rather than causal.
  • Closure depth: Closure depth measures the longest feasible path from a contributing proof to a Shield source and ranks one-contributor transactions into four near-equal quartiles.This separates depth from within-transaction union.
  • Hinkal Anonymity Set Size: Hinkal Anonymity Set Size plots compare the temporal baseline with the final transaction-level union after closure lifting.The curves use equal-count transaction bins with percentile shading and timeline labels.
  • Closure depth: Reduction declines from Q1 to Q4 on every Railgun chain and on every Hinkal chain, although Base and Optimism rebound in Q4.The comparison covers complete chain cohorts with matching depth records.
Loading 2608.22987v1…