Connect with us


Track Me If You Can — How Bitcoin Forward-Looking Anonymity Sets Work

Avatar photo



Track Me If You Can — How Bitcoin Forward-Looking Anonymity Sets Work

Let’s talk about Whirlpool “forward-looking anonymity sets” — the crowd in which you are hiding in.

To date you may be familiar with the Whirlpool CoinJoin implementation which is available on the Samourai Wallet mobile app, or Sparrow Wallet desktop app. When you participate in a Whirlpool CoinJoin you gain privacy by collaborating in a multiparty transaction which leaves anyone looking on-chain scratching their head while trying to decipher where your bitcoin has gone.

A Whirlpool CoinJoin is just like any other bitcoin transaction, made up of inputs and outputs. However each input is provided by a different bitcoin wallet, and each output is returned to one of the participating wallets. This transaction is organized by Samourai Wallet’s central Whirlpool coordinator, all the time without the coordinator knowing which input belongs to which output (“blinded”), and without you ever giving up custody of your bitcoin.

Let’s say it’s the end of the month and I’ve just been paid by my employer. Before I spend any of my bitcoin I first wish to use Whirlpool to gain some forward-looking privacy. After all, the bitcoin blockchain is a public ledger and I feel it my right for my employer to not know what I get up to in my private life, including them knowing my spending habits.

I enter Whirlpool, providing one of the inputs and participate in a transaction which looks like this:

  • 5 x Input UTXOs.
  • 5 x Output UTXOs.
  • Each input UTXO belongs to one of the five participating wallets.
  • Each output UTXO belongs to one of the five participating wallets.
  • All output UTXOs are equal.

Observing on-chain it is impossible to determine which one of the five outputs is mine. The reason why it is “impossible” is because all deterministic links are broken between the input and output side of the transaction. So if my sneaky employer were to decide they were going to try and spy on my spending habits after I was paid, they would see that I’ve “entered” Whirlpool and would now have to assume I am hiding in a crowd of five, right? Well I could actually be hiding in a crowd larger than five. Enter Whirlpool forward-looking anonymity sets …

Whirlpool Forward-Looking Anonymity Sets

When you use Whirlpool, depending on the pool size you choose, your bitcoin is broken up into smaller pieces in one of the following denomination sizes: 0.5 BTC, 0.05 BTC, 0.01 BTC, or 0.001 BTC. Due to Whirlpool’s architecture, outputs which remain in these pool denomination sizes are free to be remixed at no additional cost to the user (more on that later).

After my first mix, if I or one of my mixing peers remixes, the crowd which I am hiding in (forward-looking anonymity set) increases from five to nine.

My equal output UTXO does not need to remix for the crowd in which I am hiding in to grow. Whether it is my UTXO which remixes or one of my mixing peers, there is no way to tell on-chain which UTXO from the first mix has been remixed. There are now nine equal outputs connected to my first mix, so my spying employer would have to assume I could be any one of them.

Submit your 2022 Austin Neighborhood Feedback

This next graphic demonstrates how the crowd in which I am hiding can grow without me remixing. After my first mix, my UTXO, the red circle, remains in a Whirlpool pool denomination size and has not been remixed. However two of my mixing peers have continued to remix and there are now four more CoinJoins associated with my first mix. To calculate my new forward-looking anonymity set, here I would count up the equal-output UTXOs (orange circles) plus my own equal-output UTXO (red circle) and I arrive at a crowd of 21.

On-chain the orange circles are indistinguishable from my red circle, therefore my employer would have to pursue all 21 different leads should they wish to track me since “entering” Whirlpool. Even if they were to try to keep tabs, they could not say with any certainty which of the 21 UTXOs I am.

How Is Remixing Free?

Before discussing further about forward-looking anonymity sets and looking at some real world examples, for the uninitiated it’s worth breaking down exactly how remixing is free in Whirlpool.

When you first “enter” Whirlpool, your Samourai or Sparrow Wallet broadcasts what is termed the “Transaction Zero,” or Tx0 for short. This is a pre-transaction before “jumping in the pool,” and it does three things:

  1. Pre-mix UTXO/s: breaks up your bitcoin into smaller-denomination UTXOs, plus a little extra.
  2. Fixed Pool Fee: pays Samourai or Sparrow Wallet for coordinating the Whirlpool transaction.
  3. Doxxic Change: returns to you any bitcoin which is too small to be mixed. This is called doxxic as it is still associated with the previous history your bitcoin has.1

Have a look here at this real world Tx0 in the following block explorers:

Transaction ID: bcb4d9dfde37215f2ede6142c651981e22f70e549c03cd341a71dffe8b2dce57

  • (double-click on the blue circle to expand the transaction, then zoom out)

In the graphic below note that 3 x premix UTXOs have been created in this Tx0, all owned by the same wallet and destined to each be mixed in the 0.001 pool. Also note each of these UTXOs is of slightly more value than the chosen pool size. Hold that thought!

It’s worth mentioning here a highly important aspect of a Tx0; management of Doxxic change. Doxxic change is your bitcoin which still holds any previously associated history, however is too small to be Whirlpooled1. The Tx0, by design, returns the Doxxic change to a different area in your wallet than your bitcoin which has been mixed. This means it is impossible to shoot yourself in the foot by accidentally creating a transaction in the future where you spend your mixed bitcoin in the same transaction as your Doxxic change. Doing so would unwind the privacy benefits of CoinJoining.

Now you’re ready to mix. One by one your pre-mix UTXOs are selected by the Whirlpool coordinator to participate in their first CoinJoin. One of your pre-mix UTXO will be one of five inputs in the CoinJoin transaction.

The Whirlpool coordinator also organizes a second pre-mix UTXO to participate (“peer pre-mix UTXO”)2. This additional peer pre-mix UTXO is from another user’s wallet which has just gone through the same process you have when you entered Whirlpool. Remember how when you create your transaction zero your bitcoin is broken up into multiple pool-size denominated UTXOs, plus a little extra? Well if you add up the “little extra” of the pre-mix UTXO and the peer pre-mix UTXO, that is what pays the miner fees for the CoinJoin transaction. In the graphic below the amount to be paid to the bitcoin miners is 907 sats plus 907 sats, totaling 1,814 sats.

Now it’s the remixer’s time to shine. The Whirlpool coordinator selects at random three remixing UTXOs which have already undergone their first mix. The three remixing UTXOs are sat in their respective wallets and importantly remain in Whirlpool’s “unspent capacity” as they have not been spent by their owners. So long as their associated wallet is online communicating with the Whirlpool coordinator, they are eligible for remixing.

Submit your 2022 Austin Neighborhood Feedback

So to recap:

  • Your pre-mix UTXO: pays for CoinJoin miner fees
  • Peer pre-mix UTXO: pays for CoinJoin miner fees
  • Remixing UTXOs: participates in the CoinJoin for free (also termed a “freerider”)

Once the CoinJoin has been organized between five separate wallets, the transaction is broadcast to the Bitcoin network automatically. Five inputs into the transaction have been destroyed, creating five fresh indistinguishable equal outputs. All equal outputs are now eligible for remixing if their owners so please.

Although remixing UTXOs are termed “freeriders,” they are integral to Whirlpool’s architecture not only in providing forward-looking anonymity for the pre-mixers who are paying the CoinJoin transaction miner fees, but they are also increasing the forward-looking anonymity set for their previous mixing peers.

It is also important to note that your UTXOs (whether a pre-mix one, or remixing one) will always be mixed in their own CoinJoin transaction. Multiple UTXOs in your wallet will never be mixed in the same Whirlpool CoinJoin transaction together, as this provides the best anon-set guarantees and also prevents users or entities Sybil attacking Whirlpool.

TLDR: The new liquidity “entering” Whirlpool covers the mining fee for every Whirlpool CoinJoin transaction. Those UTXOs who have already “entered” Whirlpool and have undergone their first mix (paying the fixed pool fee plus miner fee) do not pay a single satoshi more to participate in remixes, so long as they remain in their pool denomination size / unspent capacity.

Whirlpool Forward-Looking Anonymity Sets Continued

Theory is all well and great, but how can you as a Whirlpool user calculate the size of the crowd you are hiding in? Try using OXT’s transaction graph visualizer to search for your first mix CoinJoin transaction, then:

  1. Manually expand each output which is remixed.
  2. Mark in orange any UTXO which is unspent (remaining in a Whirlpool pool-size denomination).
  3. Mark in orange any UTXO which is spent (leaving Whirlpool).

Add up the orange lines to get your forward-looking anonymity set (33 in this example below).

This works well for smaller numbers, but Whirlpool mixes occur frequently (average of 211 mixes per day in the 0.001 pool so far during 2022). Manually counting forward-looking anonymity sets can quickly become impossible. Queue Whirlpool Stat Tool …

Whirlpool Stats Tool was made by the Samourai Wallet developers to allow users to verify themselves the anonymity sets which are achieved by using Whirlpool. Using a set of python scripts, it quickly calculates the forward-looking anonymity set for you. Enter in a transaction ID for your first mix and it’ll tell you the size of the crowd you’re hiding in since your Whirlpool CoinJoin occurred.

Because I run a RoninDojo node, Whirlpool Stats Tool is pre-installed and easy to use by following the guide on their wiki.

Using the tool over the last 93 days I have been monitoring the forward-looking anonymity set of this Whirlpool CoinJoin transaction ID:

Submit your 2022 Austin Neighborhood Feedback


Let’s see how large the crowd its participants are hiding in is:

28 days after mix: forward-looking anonymity set = 1,644

35 days after mix: forward-looking anonymity set = 6,722

93 days after mix: forward-looking anonymity set = 35,214 (as shown in Whirlpool Stats Tool on my RoninDojo below).

Hiding in a crowd of 35,000 it is now impossible (dare I say it) for anyone, including a chain surveillance company, to determine where the original mix participant’s bitcoin is. Perhaps they’ve already left Whirlpool and spent their bitcoin, or maybe they have stuck around to get free remixes.

What I find interesting about this particular transaction ID is that as of the time of writing this article, one of the outputs remains unspent (just like the red circle of the earlier graphic). This unspent output has remained this way since the transaction was confirmed into block 728,735 on March 24, 2022.

Even though this UTXO has not moved, it has benefited from Whirlpool’s architecture as three of the other participants went on to remix. This allowed this unspent output of 0.001 BTC to gain a larger forward-looking anonymity set without remixing itself. If none of the outputs from this transaction went on to remix, the forward-looking anonymity set would remain at five.

It’s important to remember that all deterministic links are broken after one mix, but you get greater privacy benefits if you, or other peers remix. Let’s look at some more forward-looking anonymity set stats from some CoinJoins …

Submit your 2022 Austin Neighborhood Feedback

More Whirlpool Forward-Looking Anonymity Set Examples

Transaction ID:


Two days after mix: forward-looking anonymity set = 77

Transaction ID:


Seven days after mix: forward-looking anonymity set = 380

Transaction ID:


Ten days after mix: forward-looking anonymity set = 1,466

Privacy Farming

After entering Whirlpool your first mix is quick, and the CoinJoin you have participated in has worked as designed by breaking all deterministic links. Now you’re itching to get some free remixes but wondering “How many remixes can I expect in one week?” This is a common question asked by new Whirlpool users who naively only count their privacy gains in terms of how many mix cycles each of their UTXOs has participated in.

Remixing does of course increase your own forward-looking anonymity set, but don’t forget that other mixing peers who remix increase your forward-looking privacy too.

“But how many remixes can I expect in one week?!” Before answering we need to consider the following:

Submit your 2022 Austin Neighborhood Feedback
  1. New users who enter Whirlpool pay for the CoinJoin cycle. So only when new liquidity comes into Whirlpool do you have a chance at remixing.
  2. Other users (“freeriders”) are also waiting to get free remixes. The Whirlpool coordinator selects freeriders at random to participate in remixes, so there is somewhat of a competition as everybody wants to be picked.
  3. Each Whirlpool pool size has different behavior characteristics.

Let’s explore these one by one.

Here are the weekly CoinJoin cycle frequencies per pool size for 2022.

Unsurprisingly the 0.001 BTC pool is the most active pool in terms of cycle count.

How much freerider competition is there in each pool? To get this stat (and many others including cycle frequencies) you can use the Telegram Whirlbot.

For each CoinJoin the Whirlpool coordinator picks three freeriders at random to participate.2

As a freerider there is more competition in the smaller pools, with more frequent CoinJoin cycles. The larger pools have the opposite, less freerider competition, with less frequent CoinJoin cycles.

Finally let’s turn our thoughts to the behavior characteristics of each pool based on historical Whirlpool usage. If you have been a Whirlpool user for some time you’ll have likely noticed the smaller pools are most consistently used on a daily basis with a steady stream of liquidity. If I were to guess, this is because they are the lowest barrier to entry and most likely to be used for everyday spending. The larger pools on the other hand, though almost never quiet, see larger peaks and troughs of new liquidity — and when it rains, it pours.

So now you understand that the remixes you’d see in one week depend on new liquidity entering Whirlpool, random selection by the coordinator, and characteristics of which pool size you are using. Based on average Whirlpool usage to date during 2022 your wallet will likely get anything from 5-25 remixes per week. Though coordinator selection is random, so you could in theory get less or more, and that would still be classified as normal.

One way to consider all of this is that awaiting remixes is like yield farming for bitcoin privacy, and those who are patient and continue to keep their bitcoin remixing until they need to spend in the future are being paid interest in the form of increased anonymity. Patience pays.

Be Eligible To Remix 24/7

To be a freerider you’ll want your wallet to be in communication with the Whirlpool coordinator 24/7. That way when a mix is about to occur, you have a chance at being picked by the coordinator for inclusion as a remixer. You’ll therefore want to do one of the following:

Submit your 2022 Austin Neighborhood Feedback
  1. Leave the Whirlpool service screen open and active on your Samourai Wallet mobile app. This is the least practical and some Android devices can kill background services, so some but not all users have positive results achieving remixes this way.
  2. Run the Whirlpool GUI desktop application on your computer (linked to your Samourai Wallet). This is by far the lowest barrier to entry option for Samourai users, and has greater reliability for connections over the Tor network. By leaving your computer turned on, with the Whirlpool GUI desktop application running, you’re eligible for remixing.
  3. Run a RoninDojo node. After linking your Samourai Wallet to your node’s backend, you can turn off your phone or computer and you’ll always be eligible for remixing. A slightly larger barrier to entry, but the benefits far outweigh the hurdles.
  4. Mix on the Sparrow Wallet desktop application. Sparrow integrated Whirlpool into their wallet software in September 2021, sharing the same liquidity pool as Samourai Wallet users. Sparrow has a wealth of other features and also allows you to mix to cold storage. For remixing eligibility, ensure your computer remains on with the Sparrow application running.

Whirlpool Unspent Capacity: A True Measure Of Whirlpool’s Success?

Whirlpool unspent capacity is the current amount of bitcoin which has mixed, not been spent and is eligible for remixing. You can monitor this metric in Clark Moody’s dashboard:

You can also get a breakdown of the unspent capacity per pool size using the Bitcoin KPIs website. To me the Whirlpool unspent bitcoin value is interesting, and with it remaining above 4,000 BTC for the last seven months shows a level of confidence in Whirlpool and Samourai/Sparrow’s wallet software. What I find more interesting is the volume coming in and out of Whirlpool over the last 30 days (shown in Clark Moody’s dashboard as “Tx0 Volume” and “Spent Cycle Output” respectively). This is what feeds the privacy gains that Whirlpool provides, for both the new liquidity entering, and the freeriders remixing, even if there is a deficit between the two values. Samourai Wallet is branded “a bitcoin wallet for the streets,” and their founders are advocates of actually using bitcoin rather than “HODLing to the grave.” Monitoring these large flows of bitcoin go in and out of Whirlpool shows there is demand for forward-looking privacy when making on-chain transactions, of which Whirlpool is successful in achieving for its users.

Care About Your Bitcoin Privacy? Read More

The Easiest Way To Whirlpool Your Bitcoin And Preserve Privacy – Bitcoin Magazine article by Econoalchemist.

Bitcoin Privacy Series – seven short introductory videos.

Understanding Bitcoin Privacy with OXT – a four-part article series.


1. for the purposes of describing the Whirlpool flow in this article, this point has been simplified. Change may also be returned to you if the amount which you are attempting to send into Whirlpool goes above the maximum limit enforced by the Whirlpool coordinator. Discounting the coordinator pool fee output, the 0.001 BTC pool has a 25 x UTXO maximum Tx0 limit, and the 0.01 BTC / 0.05 BTC / 0.5 BTC pool has a 70 x UTXO maximum Tx0 limit.

2. for the purposes of describing the Whirlpool flow in this article, this point has been simplified. While it is most common for a Whirlpool CoinJoin transaction to be made up of two pre-mix UTXOs, it is also possible for a Whirlpool CoinJoin transaction to constitute three pre-mix UTXOs.

This is a guest post by Brother Rabbit. Opinions expressed are entirely their own and do not necessarily reflect those of BTC Inc. or Bitcoin Magazine.

Read More

Submit your 2022 Austin Neighborhood Feedback

Continue Reading
Click to comment


El Salvador Takes First Step To Issue Bitcoin Volcano Bonds

Avatar photo



El Salvador Takes First Step To Issue Bitcoin Volcano Bonds

El Salvador’s Minister of the Economy Maria Luisa Hayem Brevé submitted a digital assets issuance bill to the country’s legislative assembly, paving the way for the launch of its bitcoin-backed “volcano” bonds.

First announced one year ago today, the pioneering initiative seeks to attract capital and investors to El Salvador. It was revealed at the time the plans to issue $1 billion in bonds on the Liquid Network, a federated Bitcoin sidechain, with the proceedings of the bonds being split between a $500 million direct allocation to bitcoin and an investment of the same amount in building out energy and bitcoin mining infrastructure in the region.

A sidechain is an independent blockchain that runs parallel to another blockchain, allowing for tokens from that blockchain to be used securely in the sidechain while abiding by a different set of rules, performance requirements, and security mechanisms. Liquid is a sidechain of Bitcoin that allows bitcoin to flow between the Liquid and Bitcoin networks with a two-way peg. A representation of bitcoin used in the Liquid network is referred to as L-BTC. Its verifiably equivalent amount of BTC is managed and secured by the network’s members, called functionaries.

“Digital securities law will enable El Salvador to be the financial center of central and south America,” wrote Paolo Ardoino, CTO of cryptocurrency exchange Bitfinex, on Twitter.

Bitfinex is set to be granted a license in order to be able to process and list the bond issuance in El Salvador.

The bonds will pay a 6.5% yield and enable fast-tracked citizenship for investors. The government will share half the additional gains with investors as a Bitcoin Dividend once the original $500 million has been monetized. These dividends will be dispersed annually using Blockstream’s asset management platform.

The act of submitting the bill, which was hinted at earlier this year, kickstarts the first major milestone before the bonds can see the light of day. The next is getting it approved, which is expected to happen before Christmas, a source close to President Nayib Bukele told Bitcoin Magazine. The bill was submitted on November 17 and presented to the country’s Congress today. It is embedded in full below.

Read More

Submit your 2022 Austin Neighborhood Feedback

Continue Reading


How I’ll Talk To Family Members About Bitcoin This Thanksgiving

Avatar photo



How I’ll Talk To Family Members About Bitcoin This Thanksgiving

This is an opinion editorial by Joakim Book, a Research Fellow at the American Institute for Economic Research, contributor and copy editor for Bitcoin Magazine and a writer on all things money and financial history.

I don’t.

That’s it. That’s the article.

In all sincerity, that is the full message: Just don’t do it. It’s not worth it.

You’re not an excited teenager anymore, in desperate need of bragging credits or trying out your newfound wisdom. You’re not a preaching priestess with lost souls to save right before some imminent arrival of the day of reckoning. We have time.

Instead: just leave people alone. Seriously. They came to Thanksgiving dinner to relax and rejoice with family, laugh, tell stories and zone out for a day — not to be ambushed with what to them will sound like a deranged rant in some obscure topic they couldn’t care less about. Even if it’s the monetary system, which nobody understands anyway.

Get real.

If you’re not convinced of this Dale Carnegie-esque social approach, and you still naively think that your meager words in between bites can change anybody’s view on anything, here are some more serious reasons for why you don’t talk to friends and family about Bitcoin the protocol — but most certainly not bitcoin, the asset:

Submit your 2022 Austin Neighborhood Feedback
  • Your family and friends don’t want to hear it. Move on.
  • For op-sec reasons, you don’t want to draw unnecessary attention to the fact that you probably have a decent bitcoin stack. Hopefully, family and close friends should be safe enough to confide in, but people talk and that gossip can only hurt you.
  • People find bitcoin interesting only when they’re ready to; everyone gets the price they deserve. Like Gigi says in “21 Lessons:”

“Bitcoin will be understood by you as soon as you are ready, and I also believe that the first fractions of a bitcoin will find you as soon as you are ready to receive them. In essence, everyone will get ₿itcoin at exactly the right time.”

It’s highly unlikely that your uncle or mother-in-law just happens to be at that stage, just when you’re about to sit down for dinner.

  • Unless you can claim youth, old age or extreme poverty, there are very few people who genuinely haven’t heard of bitcoin. That means your evangelizing wouldn’t be preaching to lost, ignorant souls ready to be saved but the tired, huddled and jaded masses who could care less about the discovery that will change their societies more than the internal combustion engine, internet and Big Government combined. Big deal.
  • What is the case, however, is that everyone in your prospective audience has already had a couple of touchpoints and rejected bitcoin for this or that standard FUD. It’s a scam; seems weird; it’s dead; let’s trust the central bankers, who have our best interest at heart.
    No amount of FUD busting changes that impression, because nobody holds uninformed and fringe convictions for rational reasons, reasons that can be flipped by your enthusiastic arguments in-between wiping off cranberry sauce and grabbing another turkey slice.
  • It really is bad form to talk about money — and bitcoin is the best money there is. Be classy.

Now, I’m not saying to never ever talk about Bitcoin. We love to talk Bitcoin — that’s why we go to meetups, join Twitter Spaces, write, code, run nodes, listen to podcasts, attend conferences. People there get something about this monetary rebellion and have opted in to be part of it. Your unsuspecting family members have not; ambushing them with the wonders of multisig, the magically fast Lightning transactions or how they too really need to get on this hype train, like, yesterday, is unlikely to go down well.

However, if in the post-dinner lull on the porch someone comes to you one-on-one, whisky in hand and of an inquisitive mind, that’s a very different story. That’s personal rather than public, and it’s without the time constraints that so usually trouble us. It involves clarifying questions or doubts for somebody who is both expressively curious about the topic and available for the talk. That’s rare — cherish it, and nurture it.

Last year I wrote something about the proper role of political conversations in social settings. Since November was also election month, it’s appropriate to cite here:

“Politics, I’m starting to believe, best belongs in the closet — rebranded and brought out for the specific occasion. Or perhaps the bedroom, with those you most trust, love, and respect. Not in public, not with strangers, not with friends, and most certainly not with other people in your community. Purge it from your being as much as you possibly could, and refuse to let political issues invade the areas of our lives that we cherish; politics and political disagreements don’t belong there, and our lives are too important to let them be ruled by (mostly contrived) political disagreements.”

If anything, those words seem more true today than they even did then. And I posit to you that the same applies for bitcoin.

Everyone has some sort of impression or opinion of bitcoin — and most of them are plain wrong. But there’s nothing people love more than a savior in white armor, riding in to dispel their errors about some thing they are freshly out of fucks for. Just like politics, nobody really cares.

Leave them alone. They will find bitcoin in their own time, just like all of us did.

This is a guest post by Joakim Book. Opinions expressed are entirely their own and do not necessarily reflect those of BTC Inc or Bitcoin Magazine.

Read More

Submit your 2022 Austin Neighborhood Feedback
Continue Reading


RGB Magic: Client-Side Contracts On Bitcoin

Avatar photo



RGB Magic: Client-Side Contracts On Bitcoin

This is an opinion editorial by Federico Tenga, a long time contributor to Bitcoin projects with experience as start-up founder, consultant and educator.

The term “smart contracts” predates the invention of the blockchain and Bitcoin itself. Its first mention is in a 1994 article by Nick Szabo, who defined smart contracts as a “computerized transaction protocol that executes the terms of a contract.” While by this definition Bitcoin, thanks to its scripting language, supported smart contracts from the very first block, the term was popularized only later by Ethereum promoters, who twisted the original definition as “code that is redundantly executed by all nodes in a global consensus network”

While delegating code execution to a global consensus network has advantages (e.g. it is easy to deploy unowed contracts, such as the popularly automated market makers), this design has one major flaw: lack of scalability (and privacy). If every node in a network must redundantly run the same code, the amount of code that can actually be executed without excessively increasing the cost of running a node (and thus preserving decentralization) remains scarce, meaning that only a small number of contracts can be executed.

But what if we could design a system where the terms of the contract are executed and validated only by the parties involved, rather than by all members of the network? Let us imagine the example of a company that wants to issue shares. Instead of publishing the issuance contract publicly on a global ledger and using that ledger to track all future transfers of ownership, it could simply issue the shares privately and pass to the buyers the right to further transfer them. Then, the right to transfer ownership can be passed on to each new owner as if it were an amendment to the original issuance contract. In this way, each owner can independently verify that the shares he or she received are genuine by reading the original contract and validating that all the history of amendments that moved the shares conform to the rules set forth in the original contract.

This is actually nothing new, it is indeed the same mechanism that was used to transfer property before public registers became popular. In the U.K., for example, it was not compulsory to register a property when its ownership was transferred until the ‘90s. This means that still today over 15% of land in England and Wales is unregistered. If you are buying an unregistered property, instead of checking on a registry if the seller is the true owner, you would have to verify an unbroken chain of ownership going back at least 15 years (a period considered long enough to assume that the seller has sufficient title to the property). In doing so, you must ensure that any transfer of ownership has been carried out correctly and that any mortgages used for previous transactions have been paid off in full. This model has the advantage of improved privacy over ownership, and you do not have to rely on the maintainer of the public land register. On the other hand, it makes the verification of the seller’s ownership much more complicated for the buyer.

Title deed of unregistered real estate propriety

Source: Title deed of unregistered real estate propriety

How can the transfer of unregistered properties be improved? First of all, by making it a digitized process. If there is code that can be run by a computer to verify that all the history of ownership transfers is in compliance with the original contract rules, buying and selling becomes much faster and cheaper.

Secondly, to avoid the risk of the seller double-spending their asset, a system of proof of publication must be implemented. For example, we could implement a rule that every transfer of ownership must be committed on a predefined spot of a well-known newspaper (e.g. put the hash of the transfer of ownership in the upper-right corner of the first page of the New York Times). Since you cannot place the hash of a transfer in the same place twice, this prevents double-spending attempts. However, using a famous newspaper for this purpose has some disadvantages:

  1. You have to buy a lot of newspapers for the verification process. Not very practical.
  2. Each contract needs its own space in the newspaper. Not very scalable.
  3. The newspaper editor can easily censor or, even worse, simulate double-spending by putting a random hash in your slot, making any potential buyer of your asset think it has been sold before, and discouraging them from buying it. Not very trustless.

For these reasons, a better place to post proof of ownership transfers needs to be found. And what better option than the Bitcoin blockchain, an already established trusted public ledger with strong incentives to keep it censorship-resistant and decentralized?

If we use Bitcoin, we should not specify a fixed place in the block where the commitment to transfer ownership must occur (e.g. in the first transaction) because, just like with the editor of the New York Times, the miner could mess with it. A better approach is to place the commitment in a predefined Bitcoin transaction, more specifically in a transaction that originates from an unspent transaction output (UTXO) to which the ownership of the asset to be issued is linked. The link between an asset and a bitcoin UTXO can occur either in the contract that issues the asset or in a subsequent transfer of ownership, each time making the target UTXO the controller of the transferred asset. In this way, we have clearly defined where the obligation to transfer ownership should be (i.e in the Bitcoin transaction originating from a particular UTXO). Anyone running a Bitcoin node can independently verify the commitments and neither the miners nor any other entity are able to censor or interfere with the asset transfer in any way.

Submit your 2022 Austin Neighborhood Feedback
transfer of ownership of utxo

Since on the Bitcoin blockchain we only publish a commitment of an ownership transfer, not the content of the transfer itself, the seller needs a dedicated communication channel to provide the buyer with all the proofs that the ownership transfer is valid. This could be done in a number of ways, potentially even by printing out the proofs and shipping them with a carrier pigeon, which, while a bit impractical, would still do the job. But the best option to avoid the censorship and privacy violations is establish a direct peer-to-peer encrypted communication, which compared to the pigeons also has the advantage of being easy to integrate with a software to verify the proofs received from the counterparty.

This model just described for client-side validated contracts and ownership transfers is exactly what has been implemented with the RGB protocol. With RGB, it is possible to create a contract that defines rights, assigns them to one or more existing bitcoin UTXO and specifies how their ownership can be transferred. The contract can be created starting from a template, called a “schema,” in which the creator of the contract only adjusts the parameters and ownership rights, as is done with traditional legal contracts. Currently, there are two types of schemas in RGB: one for issuing fungible tokens (RGB20) and a second for issuing collectibles (RGB21), but in the future, more schemas can be developed by anyone in a permissionless fashion without requiring changes at the protocol level.

To use a more practical example, an issuer of fungible assets (e.g. company shares, stablecoins, etc.) can use the RGB20 schema template and create a contract defining how many tokens it will issue, the name of the asset and some additional metadata associated with it. It can then define which bitcoin UTXO has the right to transfer ownership of the created tokens and assign other rights to other UTXOs, such as the right to make a secondary issuance or to renominate the asset. Each client receiving tokens created by this contract will be able to verify the content of the Genesis contract and validate that any transfer of ownership in the history of the token received has complied with the rules set out therein.

So what can we do with RGB in practice today? First and foremost, it enables the issuance and the transfer of tokenized assets with better scalability and privacy compared to any existing alternative. On the privacy side, RGB benefits from the fact that all transfer-related data is kept client-side, so a blockchain observer cannot extract any information about the user’s financial activities (it is not even possible to distinguish a bitcoin transaction containing an RGB commitment from a regular one), moreover, the receiver shares with the sender only blinded UTXO (i. e. the hash of the concatenation between the UTXO in which she wish to receive the assets and a random number) instead of the UTXO itself, so it is not possible for the payer to monitor future activities of the receiver. To further increase the privacy of users, RGB also adopts the bulletproof cryptographic mechanism to hide the amounts in the history of asset transfers, so that even future owners of assets have an obfuscated view of the financial behavior of previous holders.

In terms of scalability, RGB offers some advantages as well. First of all, most of the data is kept off-chain, as the blockchain is only used as a commitment layer, reducing the fees that need to be paid and meaning that each client only validates the transfers it is interested in instead of all the activity of a global network. Since an RGB transfer still requires a Bitcoin transaction, the fee saving may seem minimal, but when you start introducing transaction batching they can quickly become massive. Indeed, it is possible to transfer all the tokens (or, more generally, “rights”) associated with a UTXO towards an arbitrary amount of recipients with a single commitment in a single bitcoin transaction. Let’s assume you are a service provider making payouts to several users at once. With RGB, you can commit in a single Bitcoin transaction thousands of transfers to thousands of users requesting different types of assets, making the marginal cost of each single payout absolutely negligible.

Another fee-saving mechanism for issuers of low value assets is that in RGB the issuance of an asset does not require paying fees. This happens because the creation of an issuance contract does not need to be committed on the blockchain. A contract simply defines to which already existing UTXO the newly issued assets will be allocated to. So if you are an artist interested in creating collectible tokens, you can issue as many as you want for free and then only pay the bitcoin transaction fee when a buyer shows up and requests the token to be assigned to their UTXO.

Furthermore, because RGB is built on top of bitcoin transactions, it is also compatible with the Lightning Network. While it is not yet implemented at the time of writing, it will be possible to create asset-specific Lightning channels and route payments through them, similar to how it works with normal Lightning transactions.


RGB is a groundbreaking innovation that opens up to new use cases using a completely new paradigm, but which tools are available to use it? If you want to experiment with the core of the technology itself, you should directly try out the RGB node. If you want to build applications on top of RGB without having to deep dive into the complexity of the protocol, you can use the rgb-lib library, which provides a simple interface for developers. If you just want to try to issue and transfer assets, you can play with Iris Wallet for Android, whose code is also open source on GitHub. If you just want to learn more about RGB you can check out this list of resources.

This is a guest post by Federico Tenga. Opinions expressed are entirely their own and do not necessarily reflect those of BTC Inc or Bitcoin Magazine.

Read More

Submit your 2022 Austin Neighborhood Feedback

Continue Reading