What are the privacy implications of revealing one xpub in a multisig setup?

Question

What information can a third party derive about a multisig wallet if one of the xpubs in the setup is known?

This could be relevant for a few reasons:

1. For a collaborative custody setup such as Unchained, would using an xpub that is already used in a private wallet setup reveal information about that wallet?
2. In general, if the same key is used in multiple multisig wallets, can those wallets be linked by a third party?
3. An advantage of multisig is that if one private key is compromised, that is not enough to steal funds (assuming quorum>1) but would an attacker be able to see a wallet balance?

Answer 1

In a multisig setup, all of the xpubs are needed to generate wallet addresses, which may make it seem like revealing one xpub does not reveal any information about the wallet. However (based on poking around on the block explorer) I think the situation is more like the following:

1. Each xpub is used to derive a sequence of public keys which are used in the spending script. These public keys are revealed at spending time, so while the full set of wallet addresses/UTXOs cannot be generated from one xpub, someone who knows one xpub could find transactions on the blockchain that spent from the multisig wallet.
2. Similarly, using the same xpub in multiple multisig wallets setups means that transactions from the different wallets could potentially be linked together - in particular transactions spending from the same address index in each. e.g. if one setup uses xpub1, xpub2, xpub3 and the other xpub1, xpub4, xpub5, then the spending script for address index k in the two wallets will contain something like (pubkey1k, pubkey2k, pubkey3k) and (pubkey1k, pubkey4k, pubkey5k) - so they are linked by having the same pubkey1k in each.
3. The solution to avoiding the above issues would be to use different derivation paths, which would generate different xpubs from the same private key, e.g. using different account numbers in the derivation path for a private vs. collaborative custody setup. (For this reason, revealing a multisig xpub would not reveal info about single-sig wallet and vice versa).