Are any developers working on anonymous mixing? Is it achievable through the development of either smart contracts or dapps? Is information leakage reduced or eliminated?


It is achievable in a trustless manner as a smart contract using ring signatures.

How it could work

One such scheme would look like this.

  1. A group of people who wish to mix their funds would all submit funds from their origin address as well as public key to the smart contract.
  2. Each member would use the set of public keys to create a ring signature of their desired destination address that they want to send their funds to.
  3. The smart contract would distribute funds to the destination addresses once all signatures were verified.

This glosses over a few issues which must be addressed.

Decoupling Origin and Destination Addresses

The origin and destination addresses must be fully decoupled. If the destination address already has funds this is not a problem because then the signature can just be submitted by the destination address. However, we should not make this assumption since this service is useful for funding brand new addresses.

Whisper is likely a good tool to solve this problem. If each mixing pool designates a topic then the ring signatures could be published using an anonymous message on whisper with the appropriate topic. The pool could provide an incentive for others to report these signatures in.

Denial of Service

If some members of the pool do not submit their signed destination addresses then there may not be enough valid pool members to mix funds such that the decoupling of addresses is statistically significant.

This can be addressed with two mechanisms.

First when a pool fails to reach critical mass, it will wait in a queue to either be combined with another failed pool or new members.

Second anyone who fails to submit their ring signature will have their funds locked for some period of time. This mechanism might be best implemented with some sort of exponential time decay value as well so that repeated failures cause this length of time to grow quickly.

These two mechanisms greatly increase the cost of performing a DOS attack.

Verification of Ring Signatures

Ring signature verification is expensive. Somewhere in the neighborhood of 3 million gas for a signature composed of just 3 public keys.

This can be solved with something like the ethereum-computation-market which is a proof of concept for fully trustless and verifiable off chain computation. Computations are performed for a small fee off chain. In the event of a dispute, the results are verifiable to determine who is being dishonest.

Is anyone working on it?


  • In the wikipedia link ring signatures are described as signatures where it is unclear who of the participants singed. In step 2 you say every member should chose one destination address and sign it. How does the contract make sure that every member only picks ONE destination address when it is not clear who signed those? – mKoeppelmann Feb 9 '16 at 6:01
  • Ring signatures have the nice property that you can detect duplicates. IE, it would not be possible for a participant to submit two destination addresses as the second submitted signed address would be detected as a duplicate. – Piper Merriam Feb 10 '16 at 6:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.