Monero Traceability Heuristics: Wallet Application Bugs and the Mordinal-P2Pool Perspective

TL;DR

This paper analyzes Monero's traceability heuristics, focusing on wallet bugs and new developments like P2Pool and Mordinals, evaluating their effectiveness and historical impact from 2019 to 2023.

Contribution

It systematically describes and evaluates the effectiveness of various Monero traceability heuristics, including recent wallet bugs and emerging protocols.

Findings

Most heuristics have high precision.

The '10 Block Decoy Bug' significantly impacted traceability.

Effective ring size has decreased over time.

Abstract

Privacy-focused cryptoassets like Monero are intentionally difficult to trace. Over the years, several traceability heuristics have been proposed, most of which have been rendered ineffective with subsequent protocol upgrades. Between 2019 and 2023, Monero wallet application bugs "Differ By One" and "10 Block Decoy Bug" have been observed and identified and discussed in the Monero community. In addition, a decentralized mining pool named P2Pool has proliferated, and a controversial UTXO NFT imitation known as Mordinals has been tried for Monero. In this paper, we systematically describe the traceability heuristics that have emerged from these developments, and evaluate their quality based on ground truth, and through pairwise comparisons. We also explore the temporal perspective, and show which of these heuristics have been applicable over the past years, what fraction of decoys could be eliminated and what the remaining effective ring size is. Our findings illustrate that most of the heuristics have a high precision, that the "10 Block Decoy Bug" and the Coinbase decoy identification heuristics have had the most impact between 2019 and 2023, and that the former could be used to evaluate future heuristics, if they are also applicable during that time frame.