For any given transaction, I would like to know which input corresponds to which output. I am specifically referring to the case where there are multiple inputs/outputs.
Is this possible? If yes, are there exceptions that you could elaborate on?
-
Hi The Hulk, I am attempting an answer, but could you elaborate what sort of correspondence you expect between inputs and outputs?– Murch ♦Dec 23, 2022 at 14:49
-
Hi Murch, let's assume a multi input/output transaction with 7 inputs and 3 outputs. The values of which input addresses where used to send an output value to address 1, which to address 2 and which to address 3? In case you're familiar with graph theory/network science, you can think of it in terms of a graph where nodes represent addresses and arcs represent transferred value. Given this context, which input addresses are connected to which output addresses?– AndreasDec 23, 2022 at 15:06
-
Thanks, I updated my answer– Murch ♦Dec 23, 2022 at 15:30
Add a comment
|
2 Answers
You can think of a transaction as a melting pot. All the inputs get melted down and recast into the outputs, so there is some of every input in each input. All inputs create all outputs together.
Exceptions would perhaps be if an input uses the SIGHASH_SINGLE flag that make inputs only commit to one output in the transaction instead of all outputs, or if an input declares SIGHASH_NONE that only commits to the inputs of a transaction but not the outputs. (See Raghav Sood's excellent explanation of the Signature Flags for more information.) These may appear in the context of multi-user transactions.
There may be other hints that may allow a surveillant to guess the ownership of outputs, though. E.g. if a transaction only spends one type of UTXOs for its inputs and creates two different output types of which one matches the inputs, that may be an indicator that the matching output is a change output. The Bitcoin Wiki has an excellent page on Privacy, further describing this and other privacy leaks.
If a transaction has multiple inputs and multiple outputs, but the values of some inputs (or subset sums of some inputs) directly correspond with amounts appearing in the outputs, it may be guessed that certain input sets funded the creation of specific outputs, but multiple users banded together to create a transaction. A colleague of mine, Felix Maurer wrote his master thesis “Anonymity in Bitcoin - Unlinkable transactions in cryptocurrencies” in 2016 on a topic closely related to that, but I could not quickly find the thesis online. IIRC it resulted in the paper Maurer et al (2017): Anonymous CoinJoin Transactions with Arbitrary Values which you may find interesting.
In general this is not possible.
In some cases, where the transaction creator doesn't care about privacy and, for example, the transaction has one input and two outputs, you can sometimes work out which of the two outputs is change
answered Dec 23, 2022 at 12:54
