What is the counter measure against dust attack, in case somebody tries to deanonymize me?
Is there a possibility how to prevent somebody to send you intentional small dust, so that he can track your UTXOs?
I think there is no counter measure to 1. So if 1 already happens, how to deal with this in the most possible clean way and with as little leaked information as possible?
A deanonymizing dust attack works by sending dust to large amounts of addresses. The assumption is that when people send transactions/perform consolidations in the future, dust from multiple addresses will be grouped into a single transaction, thus revealing many addresses controlled by a single entity, since the dust would be swept in a single tx.
(this is somewhat of a simplification, since most parties interested in performing such attacks will also be using other data to group together multiple independent txs).
The best way to prevent against this attack is to:
This will lead to some utxo bloat, but if you are reusing your addresses, you can spend the dust when spending another utxo from the same address. If you are not reusing addresses, simply never spend it.
Some wallets, such as the Samourai Wallet (no affiliation), provide an option to mark dust as unspendable. For systems that you build, you will have to ignore such outputs yourself.
To add to Raghav's answer:
Practically, as a typical user, it can be difficult to deal with a dust attack. There is no way to stop or disallow the receiving of a transaction, so the user can only react to the attack after it has occurred. The good thing is, by taking the proper actions a user can easily and effectively mitigate against the attack. In a perfect world of well-informed users and good wallet software, the attack would be futile, and a waste of resources to attempt.
On the downside, the attack can be very effective if not mitigated. The more addresses a wallet has used in the past, the more damaging the attack can be, as an attacker stands to potentially link a great number of addresses all to one user, destroying anonymity.
As Raghav mentioned, some wallets allow the user to manually select UTXOs for spending, or to mark inputs as 'unspendable dust', but many wallets have no such option. In many cases, the UTXO selection is completely hidden from the end user, in an effort to make the wallet more simple to use.
If you receive some dust to one or more of your addresses, your wallet does not allow for manual UTXO selection, and you'd like to counter the attack, then you'll need to import your seed phrase into some new wallet software that allows you to select UTXOs manually. If you'd like to continue using the original wallet software afterwards, you could follow this workflow:
