4 ms·
In practice if they applied that "tainted address" logic strictly it would empower anyone who controls a blacklisted address to take down the entire system just
by nybble41 5y ago
In practice if they applied that "tainted address" logic strictly it would empower anyone who controls a blacklisted address to take down the entire system just by sending small amounts unsolicited to random addresses. Or not-so-random addresses—nothing prevents anyone from "donating" some crypto to, say, the address where Coinbase keeps customers' funds, thus "tainting" every withdrawal from that exchange.
It's also relatively easy to escape this sort of analysis by exchanging the coins somewhere outside the jurisdiction where they're blacklisted. A simple swap like Bitcoin → Monero → Bitcoin is enough to seriously complicate any attempt to trace the resulting coins back to a blacklisted address.
Still, keeping these donation in publicly-known receiving addresses wasn't exactly smart. A better system would be to use a different address for each donation. That would have made it difficult to identify any address to blacklist in the first place, and even if any were blacklisted the rest would remain protected (provided you don't spend them in the same transaction).
- tromp 5y ago> nothing prevents anyone from "donating" some crypto to, say, the address where Coinbase keeps customers' funds, thus "tainting" every withdrawal from that exchange. Coinbase keeps customer's funds in a set of utxo's with many different addresses, and know which of those are tainted and untainted. Withdrawals can be expected to come from spending untainted ones. Your proposed donation will just add a tainted utxo to the set which won't be credited to anyone's balance and won't be spent for withdrawals.
- nybble41 5y agoYou assume Coinbase keeps track of which addresses are considered "tainted" in every jurisdiction world-wide, in real-time. It's not as if there is a single list, and if you're doing something risky you could transfer a portion to Coinbase, or perhaps another service which isn't so rigorous about tracking specific UTxOs, in hopes that they mix it with their other funds before it ends up on any blacklist. Coinbase naturally has a custom system but most wallets do not show UTxOs at all—just totals. If the funds are available they have a chance of being used.
- tromp 5y agoI assume they have enough buffers that just-received outputs don't have to be spent on withdrawals for quite awhile, giving them time to subject it to taint analysis.
- nybble41 5y agoCoinbase might, but there are plenty of other high-profile targets who are unlikely to perform any "taint analysis" on the contents of their wallet. Like I said, most wallet software doesn't even present UTxOs as distinct entities in the UI. Anything sent to that address is considered fair game to be used as an input for the next transaction.