Sybil resistance¶
In a sybil attack one person fills most of a pool with fake peers. If every other peer in your pool is the same attacker, they know which output is yours. Fake peers can also join pools and never sign, which wastes everyone's time.
joinstr makes this more expensive with aut-ct, anonymous usage tokens from curve trees, written by Adam Gibson. It is optional and set per pool.
How it works¶
A pool that uses aut-ct names a keyset, a published list of taproot coins that meet some minimum value and age. To join, a peer proves that they control one coin in that list without revealing which one.
Each proof produces a key image that is the same every time the same coin is used for the same pool. The pool creator records key images and rejects a second join with one that was already used. So one coin buys one seat in a pool. An attacker needs as many qualifying coins as seats they want to fill.
The proof is bound to the pool with the context SHA256(pool id + pool public key), so it cannot be replayed in another pool. The creator's own key image is reserved when the pool is created.
The proving coin is never spent and never revealed. It does not have to be the coin you mix.
Keysets¶
A keyset file is named after the rules its coins meet.
For example autct-830000-100000-1-2-1024.aks lists taproot coins at block 830000 worth at least 100000 sats with at least one confirmation. A pool advertises its keyset by file name and every peer needs the same file.
Who supports it¶
| Client | aut-ct |
|---|---|
| Electrum plugin | Create and join |
| Sparrow | Create and join |
| Android app | Shows why an aut-ct pool cannot be joined |
| Web UI, daemon, Rust library | Not supported |
See Electrum plugin, aut-ct pools for setup.
Limits¶
- An attacker with many qualifying coins can still fill a pool. aut-ct raises the cost, it does not remove the attack.
- The latest
autctrelease, v0.1.4, cannot prove ownership of a coin whose taproot output key has an odd y coordinate. The fix is on the aut-ctmasterbranch and not yet released. - Ring signatures in the recovery phase are a separate mechanism. They limit the damage when peers drop out and work in any pool whose inputs are P2WPKH.