Defined observable behavior tests; passing does not establish anonymity.
SC-002 · HIGH · Broadcast payload linked to a transport session
Observed behavior: Accepted submission and identical mempool bytes observed within the configured window.
Possible consequence: The RPC observer can associate these submitted bytes with this connection; this does not identify a person.
Affected component: lightwalletd broadcast transport
Investigation: Review the server trust model and whether an independent broadcast path reduces the observer's linkability.
Inspect current evidence (3 events)
[
{
"elapsed_ns": 114225670,
"event_hash": "221acd7a4689996da0ce19cf3b06c0d019ce4e00cba4520ff2aaaa381974295a",
"metadata": {
"payload_sha256": "46e0cc42e1d9fd0a6a8d47f6d46df0b40cef04c2e7049865d2d48d22dced0bf0",
"payload_size": 2373
},
"method": "SendTransaction",
"mode": "upstream",
"phase": "request",
"previous_hash": "0000000000000000000000000000000000000000000000000000000000000000",
"schema_version": 1,
"sequence": 1,
"session": "d34b8c4dc38fff5f63b589879638a070b1c5aff5aeab33d2ce0795d7ff9a7788",
"timestamp_ns": 1792833791911861329
},
{
"elapsed_ns": 135283412,
"event_hash": "bcc7b6dde74b40e958e2873034b78f48921c5f645b62820267deab6e5799235c",
"metadata": {
"error_code": 0,
"request_sequence": 1
},
"method": "SendTransaction",
"mode": "upstream",
"phase": "response",
"previous_hash": "221acd7a4689996da0ce19cf3b06c0d019ce4e00cba4520ff2aaaa381974295a",
"schema_version": 1,
"sequence": 2,
"session": "d34b8c4dc38fff5f63b589879638a070b1c5aff5aeab33d2ce0795d7ff9a7788",
"timestamp_ns": 1792833791932919201
},
{
"elapsed_ns": 245296751,
"event_hash": "fe4fe986ab29908e795241150c0c72899c997232c9cb593bc18c4f967b13ef69",
"metadata": {
"height": 0,
"payload_sha256": "46e0cc42e1d9fd0a6a8d47f6d46df0b40cef04c2e7049865d2d48d22dced0bf0",
"payload_size": 2373
},
"method": "GetMempoolStream",
"mode": "upstream",
"phase": "response",
"previous_hash": "3fe23618c516cfbc1decdd21ec2a097921e74c1ea9ae3c4c6f6079960b1e0cec",
"schema_version": 1,
"sequence": 4,
"session": "d34b8c4dc38fff5f63b589879638a070b1c5aff5aeab33d2ce0795d7ff9a7788",
"timestamp_ns": 1792833792042932570
}
]Complete JSON result
{
"correlation_window_seconds": 30,
"evidence_modes": [
"upstream"
],
"evidence_root": "82985a6c62e416f4050ef76ad3714930bf0248be4d114e5ac7634b046bb3c12d",
"findings": [
{
"affected_component": "lightwalletd broadcast transport",
"evidence": [
{
"elapsed_ns": 114225670,
"event_hash": "221acd7a4689996da0ce19cf3b06c0d019ce4e00cba4520ff2aaaa381974295a",
"metadata": {
"payload_sha256": "46e0cc42e1d9fd0a6a8d47f6d46df0b40cef04c2e7049865d2d48d22dced0bf0",
"payload_size": 2373
},
"method": "SendTransaction",
"mode": "upstream",
"phase": "request",
"previous_hash": "0000000000000000000000000000000000000000000000000000000000000000",
"schema_version": 1,
"sequence": 1,
"session": "d34b8c4dc38fff5f63b589879638a070b1c5aff5aeab33d2ce0795d7ff9a7788",
"timestamp_ns": 1792833791911861329
},
{
"elapsed_ns": 135283412,
"event_hash": "bcc7b6dde74b40e958e2873034b78f48921c5f645b62820267deab6e5799235c",
"metadata": {
"error_code": 0,
"request_sequence": 1
},
"method": "SendTransaction",
"mode": "upstream",
"phase": "response",
"previous_hash": "221acd7a4689996da0ce19cf3b06c0d019ce4e00cba4520ff2aaaa381974295a",
"schema_version": 1,
"sequence": 2,
"session": "d34b8c4dc38fff5f63b589879638a070b1c5aff5aeab33d2ce0795d7ff9a7788",
"timestamp_ns": 1792833791932919201
},
{
"elapsed_ns": 245296751,
"event_hash": "fe4fe986ab29908e795241150c0c72899c997232c9cb593bc18c4f967b13ef69",
"metadata": {
"height": 0,
"payload_sha256": "46e0cc42e1d9fd0a6a8d47f6d46df0b40cef04c2e7049865d2d48d22dced0bf0",
"payload_size": 2373
},
"method": "GetMempoolStream",
"mode": "upstream",
"phase": "response",
"previous_hash": "3fe23618c516cfbc1decdd21ec2a097921e74c1ea9ae3c4c6f6079960b1e0cec",
"schema_version": 1,
"sequence": 4,
"session": "d34b8c4dc38fff5f63b589879638a070b1c5aff5aeab33d2ce0795d7ff9a7788",
"timestamp_ns": 1792833792042932570
}
],
"network_acceptance_reported": true,
"observed_behavior": "Accepted submission and identical mempool bytes observed within the configured window.",
"payload_sha256": "46e0cc42e1d9fd0a6a8d47f6d46df0b40cef04c2e7049865d2d48d22dced0bf0",
"possible_privacy_consequence": "The RPC observer can associate these submitted bytes with this connection; this does not identify a person.",
"rule_id": "SC-002",
"severity": "HIGH",
"suggested_investigation": "Review the server trust model and whether an independent broadcast path reduces the observer's linkability.",
"title": "Broadcast payload linked to a transport session"
}
],
"limitations": [
"Defined tests cover SC-001 through SC-004; SC-005 requires a compatible saved baseline.",
"A transport peer identifies a connection, not a person or wallet.",
"Local fixture replay is not consensus validation or network acceptance.",
"Transaction SHA-256 fingerprints are not Zcash transaction IDs.",
"No violation observed does not establish anonymity."
],
"payment_policy": null,
"policy": "strict",
"rules": [
{
"coverage": "broadcast-observed",
"covered": true,
"executed": true,
"rule_id": "SC-002"
}
],
"schema_version": 1,
"status": "FAIL",
"sync_policy": null
}