Defined observable behavior tests; passing does not establish anonymity.
SC-002 · HIGH · Broadcast payload linked to a transport session
Observed behavior: Accepted submission and identical mempool bytes observed within the configured window.
Possible consequence: The RPC observer can associate these submitted bytes with this connection; this does not identify a person.
Affected component: lightwalletd broadcast transport
Investigation: Review the server trust model and whether an independent broadcast path reduces the observer's linkability.
Inspect current evidence (3 events)
[
{
"elapsed_ns": 6792311,
"event_hash": "11fbf52c05c1e9d17fdc5e7124c9288145bf9b5238816609e4978bace2fcf97a",
"metadata": {
"payload_sha256": "09d5467388d7c269f897bf2c11f0c073b7e4e0770d3e3ebdc7a8be27a39feefb",
"payload_size": 2373
},
"method": "SendTransaction",
"mode": "upstream",
"phase": "request",
"previous_hash": "0000000000000000000000000000000000000000000000000000000000000000",
"schema_version": 1,
"sequence": 1,
"session": "fd94c44afe8b6202f94853cf8b521a5d1d7142e1f5d3e5614cf1e895e37080f1",
"timestamp_ns": 1792833756578734878
},
{
"elapsed_ns": 28710945,
"event_hash": "77376e2a6585441ad211da6641757bd98f4ec279a1cea73932d03b17e11e4015",
"metadata": {
"error_code": 0,
"request_sequence": 1
},
"method": "SendTransaction",
"mode": "upstream",
"phase": "response",
"previous_hash": "11fbf52c05c1e9d17fdc5e7124c9288145bf9b5238816609e4978bace2fcf97a",
"schema_version": 1,
"sequence": 2,
"session": "fd94c44afe8b6202f94853cf8b521a5d1d7142e1f5d3e5614cf1e895e37080f1",
"timestamp_ns": 1792833756600653622
},
{
"elapsed_ns": 135680517,
"event_hash": "8cb01e7e18f1c10853495f6a695926ed221d8957afaef68a100c3d7d4bfff806",
"metadata": {
"height": 0,
"payload_sha256": "09d5467388d7c269f897bf2c11f0c073b7e4e0770d3e3ebdc7a8be27a39feefb",
"payload_size": 2373
},
"method": "GetMempoolStream",
"mode": "upstream",
"phase": "response",
"previous_hash": "a638f7d47e1426bccfa341e637a6c6003276d0d7faec1d514e8bb4933eb524f8",
"schema_version": 1,
"sequence": 5,
"session": "fd94c44afe8b6202f94853cf8b521a5d1d7142e1f5d3e5614cf1e895e37080f1",
"timestamp_ns": 1792833756707623354
}
]Complete JSON result
{
"correlation_window_seconds": 30,
"evidence_modes": [
"upstream"
],
"evidence_root": "edf6cc3fe8bb8491826913c00ef8420a9c9a31b987c5ca66e9463ef3c15704d7",
"findings": [
{
"affected_component": "lightwalletd broadcast transport",
"evidence": [
{
"elapsed_ns": 6792311,
"event_hash": "11fbf52c05c1e9d17fdc5e7124c9288145bf9b5238816609e4978bace2fcf97a",
"metadata": {
"payload_sha256": "09d5467388d7c269f897bf2c11f0c073b7e4e0770d3e3ebdc7a8be27a39feefb",
"payload_size": 2373
},
"method": "SendTransaction",
"mode": "upstream",
"phase": "request",
"previous_hash": "0000000000000000000000000000000000000000000000000000000000000000",
"schema_version": 1,
"sequence": 1,
"session": "fd94c44afe8b6202f94853cf8b521a5d1d7142e1f5d3e5614cf1e895e37080f1",
"timestamp_ns": 1792833756578734878
},
{
"elapsed_ns": 28710945,
"event_hash": "77376e2a6585441ad211da6641757bd98f4ec279a1cea73932d03b17e11e4015",
"metadata": {
"error_code": 0,
"request_sequence": 1
},
"method": "SendTransaction",
"mode": "upstream",
"phase": "response",
"previous_hash": "11fbf52c05c1e9d17fdc5e7124c9288145bf9b5238816609e4978bace2fcf97a",
"schema_version": 1,
"sequence": 2,
"session": "fd94c44afe8b6202f94853cf8b521a5d1d7142e1f5d3e5614cf1e895e37080f1",
"timestamp_ns": 1792833756600653622
},
{
"elapsed_ns": 135680517,
"event_hash": "8cb01e7e18f1c10853495f6a695926ed221d8957afaef68a100c3d7d4bfff806",
"metadata": {
"height": 0,
"payload_sha256": "09d5467388d7c269f897bf2c11f0c073b7e4e0770d3e3ebdc7a8be27a39feefb",
"payload_size": 2373
},
"method": "GetMempoolStream",
"mode": "upstream",
"phase": "response",
"previous_hash": "a638f7d47e1426bccfa341e637a6c6003276d0d7faec1d514e8bb4933eb524f8",
"schema_version": 1,
"sequence": 5,
"session": "fd94c44afe8b6202f94853cf8b521a5d1d7142e1f5d3e5614cf1e895e37080f1",
"timestamp_ns": 1792833756707623354
}
],
"network_acceptance_reported": true,
"observed_behavior": "Accepted submission and identical mempool bytes observed within the configured window.",
"payload_sha256": "09d5467388d7c269f897bf2c11f0c073b7e4e0770d3e3ebdc7a8be27a39feefb",
"possible_privacy_consequence": "The RPC observer can associate these submitted bytes with this connection; this does not identify a person.",
"rule_id": "SC-002",
"severity": "HIGH",
"suggested_investigation": "Review the server trust model and whether an independent broadcast path reduces the observer's linkability.",
"title": "Broadcast payload linked to a transport session"
}
],
"limitations": [
"Defined tests cover SC-001 through SC-004; SC-005 requires a compatible saved baseline.",
"A transport peer identifies a connection, not a person or wallet.",
"Local fixture replay is not consensus validation or network acceptance.",
"Transaction SHA-256 fingerprints are not Zcash transaction IDs.",
"No violation observed does not establish anonymity."
],
"payment_policy": null,
"policy": "strict",
"rules": [
{
"coverage": "broadcast-observed",
"covered": true,
"executed": true,
"rule_id": "SC-002"
}
],
"schema_version": 1,
"status": "FAIL",
"sync_policy": null
}