Concepts

The terms below are used across the docs and the clients.

Pool

A single coinjoin round. A pool has an id, a denomination, a number of peers, a relay, a fee rate, a transport and an expiry time. The creator publishes it as a nostr event and the pool ends when the coinjoin is broadcast or the pool expires.

Pool creator

The peer who announces the pool. The creator makes a new nostr key pair for the pool and hands its private key to every peer who joins. Apart from that the creator is an ordinary peer.

Peer

A participant in a pool. Each peer contributes exactly one input and receives exactly one output.

Denomination

The value every output is based on, set in BTC by the creator. Each output is the denomination minus an equal share of the mining fee.

Relay

The nostr relay that carries all traffic for a pool. The creator picks it and it is part of the announcement. Any relay works, free or paid.

Transport

How a peer hides their IP address from the relay. tor is the default. The Electrum plugin also offers vpn, where every peer connects through the same Riseup VPN gateway.

Credentials

The message the creator sends to each peer who asks to join. It repeats the pool terms and includes the pool's private key, which every peer uses to read and write pool messages.

Output registration

The first phase of a round. Every peer sends a fresh address for their output.

Input registration

The second phase. Every peer builds a transaction with all registered outputs and their own single input, signs that input with SIGHASH_ALL|ANYONECANPAY and sends it as a PSBT.

Finalization

Each peer combines all signed inputs into one transaction, checks it and broadcasts it. Because every peer does this, the coinjoin goes out even if some peers go offline after signing.

Recovery

If some peers register an output but never sign an input, the round would stall. The peers who did sign re-register their output addresses with a ring signature over the signed inputs, which proves each address belongs to one of them without saying which. They then sign a smaller transaction with SIGHASH_ALL that leaves the missing peers out. See How it works.

aut-ct

Anonymous usage tokens from curve trees, a proof that you own a coin from a published set without saying which coin. A pool can require it to make flooding the pool with fake peers expensive. See Sybil resistance.

Keyset

The published set of coins that aut-ct proofs refer to. It is a file named autct-<height>-<min_sats>-<min_confs>-<depth>-<branching>.aks.

SIGHASH_ALL|ANYONECANPAY

A signature hash type (0x81). The signature commits to all outputs and to the one input being signed, but not to the other inputs. It lets every peer sign before the other inputs are known.

View this page as markdown