Walletwasabi: Show warning when merging too many UTXO? [Research]

[Transisto]

If someone sends more than X mixed coins at once wallet could show a warning of the sort:

_Sending too many mixed coins to the same address increase the probability of finding correlation with pre-mix coins._

In the same way as we currently show this:

That arbitrary amount of UTXO is very hard to find and should be based on:

• number of pre-mix UTXO
• conservative real anonset
• timing of the mix (did it participate in all consecutive CJ?)

IMO The best long term solution would be to come up with and evolve a formula that calculate the resulting anon-set of a transaction depending on the chosen UXTOs and show this warning if it's below an arbitrary threshold.

[MaxHillebrand]

@avivmilner, can you share some of the recent research in this regard?

[AvivMilner]

A majority of individuals using wasabi merge mixed coins (~75%). The average number of coins merged was roughly 15 (!) coins and the median number was 13 (!) and the mode was 3 coins.

Note that 25% of individuals didn't merge their coins directly after the mix, so you could call them "merge of 1" if you want to be technical. This would skew the results to suggest the average is closer to <10. Either way, when you merge your coins, you should know that if you merge more than 10 or so coins you have reduced your anonset by 50% or more.

Where does this number come from? Well, we consider the anonset to be the participants on the left hand side, and those participants fall into a variety of categories (small users, medium users, large users and whales). If you Spent a single wasabi utxo, you could be any of the users. If you merge 2, you now restrict yourself from the users that just arrive with the minimum amount. Once you go over 10 merged coins, you are now limiting yourself to a user pool of people with >1 BTC and this is probably somewhere in the 50% or less pool.

If you merge 100 UTXOs you are probably in the <1% pool. So the anonymity set would be 1% of whatever you believe it to be.

In summary @MaxHillebrand - a warning should appear with 10+ coins being merged. _"You are trying to merge a lot of coins, this may hurt your privacy. Please consider breaking down your payment into smaller amounts!"_

[nopara73]

@AvivMilner If the user merges but then mixes again that should not be counted. Did you consider this while doing the stats?

[AvivMilner]

We only checked to see where users spent the coin up to two transactions (the first spends the Wasabi UTXO, and the second after that) and we did not see anybody re-mixing their coins. This was not a large enough pool to observe how much something like this might happen, but my intuition is not often.