Defined observable behavior tests; passing does not establish anonymity.
SC-002 · HIGH · Broadcast payload linked to a transport session
Observed behavior: Accepted submission and identical mempool bytes observed within the configured window.
Possible consequence: The RPC observer can associate these submitted bytes with this connection; this does not identify a person.
Affected component: lightwalletd broadcast transport
Investigation: Review the server trust model and whether an independent broadcast path reduces the observer's linkability.
Inspect current evidence (3 events)
[
{
"elapsed_ns": 6625116,
"event_hash": "18949f6b205606f8a667d10d6f9a16db3209db7e8933804ddc50808210caa758",
"metadata": {
"payload_sha256": "451f0b35eff84b9297c2485224e675d5c4e9f0ab06d5a4f427e759b9cf965d3d",
"payload_size": 210
},
"method": "SendTransaction",
"mode": "upstream",
"phase": "request",
"previous_hash": "0000000000000000000000000000000000000000000000000000000000000000",
"schema_version": 1,
"sequence": 1,
"session": "63720a6f0a73422cd74878bbf9941b3d997ddba1bcd7ce3f7ef17d83fbb6da40",
"timestamp_ns": 1792833701706218035
},
{
"elapsed_ns": 9325016,
"event_hash": "686569c614c7cbedd3a67d8c83aacbb920464032edc84573a2033631a0109e23",
"metadata": {
"error_code": 0,
"request_sequence": 1
},
"method": "SendTransaction",
"mode": "upstream",
"phase": "response",
"previous_hash": "18949f6b205606f8a667d10d6f9a16db3209db7e8933804ddc50808210caa758",
"schema_version": 1,
"sequence": 2,
"session": "63720a6f0a73422cd74878bbf9941b3d997ddba1bcd7ce3f7ef17d83fbb6da40",
"timestamp_ns": 1792833701708917955
},
{
"elapsed_ns": 116070042,
"event_hash": "fe4fda2cae508fcc4f348d2041dcfdf024854f29284ed884a184af941365b512",
"metadata": {
"height": 0,
"payload_sha256": "451f0b35eff84b9297c2485224e675d5c4e9f0ab06d5a4f427e759b9cf965d3d",
"payload_size": 210
},
"method": "GetMempoolStream",
"mode": "upstream",
"phase": "response",
"previous_hash": "02343308cfc23b7bd9966097082f239a8ae91d6eb0740e140560817793b44237",
"schema_version": 1,
"sequence": 5,
"session": "63720a6f0a73422cd74878bbf9941b3d997ddba1bcd7ce3f7ef17d83fbb6da40",
"timestamp_ns": 1792833701815663121
}
]Complete JSON result
{
"correlation_window_seconds": 30,
"evidence_modes": [
"upstream"
],
"evidence_root": "ebbe688ff80f903adf4703be229ed92ec3949ba81d171ebab815175bf90460e1",
"findings": [
{
"affected_component": "lightwalletd broadcast transport",
"evidence": [
{
"elapsed_ns": 6625116,
"event_hash": "18949f6b205606f8a667d10d6f9a16db3209db7e8933804ddc50808210caa758",
"metadata": {
"payload_sha256": "451f0b35eff84b9297c2485224e675d5c4e9f0ab06d5a4f427e759b9cf965d3d",
"payload_size": 210
},
"method": "SendTransaction",
"mode": "upstream",
"phase": "request",
"previous_hash": "0000000000000000000000000000000000000000000000000000000000000000",
"schema_version": 1,
"sequence": 1,
"session": "63720a6f0a73422cd74878bbf9941b3d997ddba1bcd7ce3f7ef17d83fbb6da40",
"timestamp_ns": 1792833701706218035
},
{
"elapsed_ns": 9325016,
"event_hash": "686569c614c7cbedd3a67d8c83aacbb920464032edc84573a2033631a0109e23",
"metadata": {
"error_code": 0,
"request_sequence": 1
},
"method": "SendTransaction",
"mode": "upstream",
"phase": "response",
"previous_hash": "18949f6b205606f8a667d10d6f9a16db3209db7e8933804ddc50808210caa758",
"schema_version": 1,
"sequence": 2,
"session": "63720a6f0a73422cd74878bbf9941b3d997ddba1bcd7ce3f7ef17d83fbb6da40",
"timestamp_ns": 1792833701708917955
},
{
"elapsed_ns": 116070042,
"event_hash": "fe4fda2cae508fcc4f348d2041dcfdf024854f29284ed884a184af941365b512",
"metadata": {
"height": 0,
"payload_sha256": "451f0b35eff84b9297c2485224e675d5c4e9f0ab06d5a4f427e759b9cf965d3d",
"payload_size": 210
},
"method": "GetMempoolStream",
"mode": "upstream",
"phase": "response",
"previous_hash": "02343308cfc23b7bd9966097082f239a8ae91d6eb0740e140560817793b44237",
"schema_version": 1,
"sequence": 5,
"session": "63720a6f0a73422cd74878bbf9941b3d997ddba1bcd7ce3f7ef17d83fbb6da40",
"timestamp_ns": 1792833701815663121
}
],
"network_acceptance_reported": true,
"observed_behavior": "Accepted submission and identical mempool bytes observed within the configured window.",
"payload_sha256": "451f0b35eff84b9297c2485224e675d5c4e9f0ab06d5a4f427e759b9cf965d3d",
"possible_privacy_consequence": "The RPC observer can associate these submitted bytes with this connection; this does not identify a person.",
"rule_id": "SC-002",
"severity": "HIGH",
"suggested_investigation": "Review the server trust model and whether an independent broadcast path reduces the observer's linkability.",
"title": "Broadcast payload linked to a transport session"
}
],
"limitations": [
"Defined tests cover SC-001 through SC-004; SC-005 requires a compatible saved baseline.",
"A transport peer identifies a connection, not a person or wallet.",
"Local fixture replay is not consensus validation or network acceptance.",
"Transaction SHA-256 fingerprints are not Zcash transaction IDs.",
"No violation observed does not establish anonymity."
],
"payment_policy": null,
"policy": "strict",
"rules": [
{
"coverage": "broadcast-observed",
"covered": true,
"executed": true,
"rule_id": "SC-002"
}
],
"schema_version": 1,
"status": "FAIL",
"sync_policy": null
}