How privacy is lost

Nimbus's proofs reveal nothing about the notes they spend or create. Privacy is still lost in other ways: through what the protocol makes public on purpose, through network metadata, and through patterns across many transactions. This page lists each one with where it comes from.

What the protocol publishesCopy Anchor Link

Registration links your wallets to your identityCopy Anchor Link

Registering publishes your identity commitment with your platform wallet as a signer and your main wallet as the fee payer, and the user registry's bind links the two wallets. From then on, anyone can tell that those wallets belong to one Nimbus account. See the platform wallet.

The public side of deposits and withdrawalsCopy Anchor Link

A deposit shows the depositing platform wallet, the token and the amount. Since the platform wallet is tied to your identity, a deposit is attributable to you.

A withdrawal shows the destination, the token and the amount, and not who withdrew. A relayer submits it, so no wallet of yours signs it, and the chain does not record which notes or which identity paid for it. Three things undo that: withdrawing to an address already tied to you, submitting the withdrawal yourself, which puts your wallet on chain as the fee payer, and the escape hatch, which discloses the note's owner and your platform wallet.

The chain records no link between a deposit and a withdrawal, but amounts and timing can suggest one.

The relayer tipCopy Anchor Link

A tip's amount and token are public. Paying it in the token you moved tells observers which token moved.

Program-owned notesCopy Anchor Link

Spending a note owned by a Solana address publishes that address and which inputs it owns. Anyone who knows such a note, its creator for instance, can also compute its nullifier and see when it is spent.

The escape hatchCopy Anchor Link

An escape-hatch exit discloses twelve of the note's fields, including its owner and, for an identity-owned note, the platform wallet. See the escape hatch.

The recipient learns the senderCopy Anchor Link

When a transfer spends an identity-owned note of the same token, each new note records the sender's identity commitment in its "funded by" field. The recipient reads it, and because registration is public, can follow it to the sender's wallets.

Network metadataCopy Anchor Link

Like any online service, the requests your device makes carry its network address and the time they are sent. See metadata and network privacy.

Patterns across transactionsCopy Anchor Link

The protocol hides each transaction's contents, but an observer can still compare transactions with each other. Four patterns narrow the set of notes yours could be.

Matching amounts and times. A deposit and a withdrawal of similar amounts close together suggest the same person, even though the chain records no link between them. The fewer other deposits of that size in between, the stronger the suggestion.

Withdrawing to a known address. A withdrawal's destination is public. If that address is already tied to you, the withdrawal is too, whatever happened inside the pool.

Using what few others use. Inside the pool every token shares one tree, so a token's identity stays private there, but deposits and withdrawals of a token only you use are public and easy to pair. A pool index few people use has its own small tree, so a spend from it has few candidates. See the anonymity set.

Keeping a schedule. Transactions at recognisable times, such as the same hour every week, can be grouped by their timing alone.

Privacy practices lists what you can do about each.

RelatedCopy Anchor Link