rpc: sendrawtransaction help privacy note #16467

jonatack commented at 10:19 AM on July 26, 2019: member

In sendrawtransaction RPCHelpMan, mention unconditionality and privacy as per http://www.erisian.com.au/bitcoin-core-dev/log-2019-07-25.html#l-522

before

$ bitcoin-cli help sendrawtransaction
sendrawtransaction "hexstring" ( maxfeerate )

Submits raw transaction (serialized, hex-encoded) to local node and network.

Also see createrawtransaction and signrawtransactionwithkey calls.

(...)

after

$ bitcoin-cli help sendrawtransaction
sendrawtransaction "hexstring" ( maxfeerate )

Submit a raw transaction (serialized, hex-encoded) to local node and network.

Note that the transaction will be sent unconditionally to all peers, so using this
for manual rebroadcast may degrade privacy by leaking the transaction's origin, as
nodes will normally not rebroadcast non-wallet transactions already in their mempool.

Also see createrawtransaction and signrawtransactionwithkey calls.

(...)

fanquake added the label RPC/REST/ZMQ on Jul 26, 2019

in src/rpc/rawtransaction.cpp:764 in 8ea017d576 outdated

 760 | @@ -761,6 +761,7 @@ static UniValue sendrawtransaction(const JSONRPCRequest& request)
 761 |  {
 762 |      RPCHelpMan{"sendrawtransaction",
 763 |                  "\nSubmits raw transaction (serialized, hex-encoded) to local node and network.\n"
 764 | +                "Note that using this for manual rebroadcast may represent a privacy leak.\n"

MarcoFalke commented at 12:49 PM on July 26, 2019:

Maybe explain why? (The tx will be sent unconditionally to all peers)

jonatack commented at 3:11 PM on July 26, 2019:

Thanks for reviewing. I was trying to make the smallest possible change but agree with you. Done, updated commit message and PR description.

jonatack force-pushed on Jul 26, 2019

MarcoFalke commented at 5:21 PM on July 26, 2019: member

unsigned ACK 1b41b1a78baa197daa6978095b8207a1f219a536 (only looked at the diff on GitHub for 5 seconds)

in src/rpc/rawtransaction.cpp:765 in 1b41b1a78b outdated

 759 | @@ -760,7 +760,9 @@ static UniValue signrawtransactionwithkey(const JSONRPCRequest& request)
 760 |  static UniValue sendrawtransaction(const JSONRPCRequest& request)
 761 |  {
 762 |      RPCHelpMan{"sendrawtransaction",
 763 | -                "\nSubmits raw transaction (serialized, hex-encoded) to local node and network.\n"
 764 | +                "\nSubmit a raw transaction (serialized, hex-encoded) to local node and network.\n"
 765 | +                "Note that the transaction will be sent unconditionally to all peers, so using\n"
 766 | +                "this for manual rebroadcast may represent a privacy leak.\n"

laanwj commented at 2:05 PM on July 27, 2019:

maybe add reason why "as nodes will not normally ever re-broadcast transactions already in their mempool"

MarcoFalke commented at 2:25 PM on July 27, 2019:

Though, this is about to change soon. (hopefully)

jonatack commented at 2:51 PM on July 27, 2019:

Thank you for reviewing; good idea! Added (after checking spelling of re-broadcast vs rebroadcast, wasn't sure myself), updated commit message and PR description.

MarcoFalke commented at 2:57 PM on July 27, 2019:

Also, not true for wallet txs today

jonatack force-pushed on Jul 27, 2019

Relaxo143 commented at 4:43 PM on July 27, 2019: none

How does rebroadcasting a tx degrade privacy?

jonatack commented at 5:13 PM on July 27, 2019: member

@Relaxo143: It can have the effect of announcing that it is your own txn, see discussion at http://www.erisian.com.au/bitcoin-core-dev/log-2019-07-25.html#l-389

rpc: sendrawtransaction unconditionality/privacy note

In sendrawtransaction RPCHelpMan, mention unconditionality and privacy
as per http://www.erisian.com.au/bitcoin-core-dev/log-2019-07-25.html#l-522

Thank you to MarcoFalke and laanwj for their review and suggestions.

07e01d6258

jonatack force-pushed on Jul 27, 2019

jonatack commented at 5:45 PM on July 27, 2019: member

Updated PR and description to address @Relaxo143's (good) question and @MarcoFalke feedback.

Relaxo143 commented at 10:46 AM on July 28, 2019: none

Maybe a policy could be implemented so that nodes rebroadcast even transactions which are already in their mempools for let's say up to 10 times. That will prevent privacy leakages and also limit abuse. After the node hears the tx for the eleventh time it will no longer resend it.

promag commented at 9:54 PM on July 28, 2019: member

ACK 07e01d6258831fd2dfef959a405b3dfe4e88c3c1.

(restarted appveyor)

fanquake added the label Docs on Jul 28, 2019

laanwj commented at 12:13 PM on July 29, 2019: member

ACK 07e01d6258831fd2dfef959a405b3dfe4e88c3c1

laanwj merged this on Jul 29, 2019

laanwj closed this on Jul 29, 2019

laanwj referenced this in commit f735851be2 on Jul 29, 2019

jonatack deleted the branch on Jul 29, 2019

Munkybooty referenced this in commit bf085ba5a2 on Nov 16, 2021

Munkybooty referenced this in commit 53b0cd295a on Nov 18, 2021

Munkybooty referenced this in commit f6a74f481a on Nov 24, 2021

Munkybooty referenced this in commit b7295e3e18 on Nov 30, 2021

Munkybooty referenced this in commit acec016fc2 on Dec 15, 2021

MarcoFalke locked this on Dec 16, 2021