# New IceCube data and color octet neutrino interpretation of the PeV energy
events

A. N. Akay<EMAIL_ADDRESS>TOBB University of Economics and Technology,
06560, Ankara, Turkey.  O. Cakir<EMAIL_ADDRESS>Ankara
University, Faculty of Sciences, Department of Physics, 06100, Tandogan,
Ankara, Turkey.  Y. O. Gunaydin<EMAIL_ADDRESS>Kahramanmaras Sutcu
Imam University, Faculty of Sciences and Letter, Department of Physics,
Kahramanmaras, Turkey  U. Kaya<EMAIL_ADDRESS>TOBB University of Economics
and Technology, 06560, Ankara, Turkey.  M. Sahin<EMAIL_ADDRESS>Usak University, Faculty of Sciences and Literature, Department of Physics,
64200, Usak, Turkey.  S. Sultansoy<EMAIL_ADDRESS>TOBB University of
Economics and Technology, 06560, Ankara, Turkey.  National Academy of
Sciences, Institute of Physics, Baku, Azerbaijan.

###### Abstract

IceCube collaboration has published two papers on ultrahigh energy neutrinos
observation, recently. They have used the data collected in two years in their
first publication, which reveals observation of two PeV energy neutrino
events. The second publication of the collaboration including more data has
also confirmed main features of the former paper. In literature, various
interpretations of the IceCube data have been proposed. In this study, it is
shown that PeV energy neutrino events observed by the IceCube collaboration
can be interpreted as resonance production of color octet neutrinos with
masses in $500-800$ GeV range.

## 1\. Introduction

Observation of two $PeV$ energy neutrino events by the IceCube collaboration
Aartsen2013 (1) has led to plenty of papers on the possible interpretations of
these events (see review Anchordoqui2014 (2) and references therein). As
mentioned in Ref. Aartsen2013 (1): “ The events were discovered in a search
for ultrahigh energy neutrinos using data corresponding to $615.9$ days
effective live time and probability of observing two or more candidate events
under the atmospheric background-only hypothesis is $2.9\times 10^{-3}$
($2.8\sigma$)”.

Recent publication Aartsen2014 (3), which includes three years of IceCube
data, has confirmed main features of previous two years data AartsenScience
(4) (for discussion of IceCube data see Section 2): concerning $PeV$ region
one more events is observed, and there are no events between $0.4\>PeV$ and
$1\>PeV$, as well as above $2.5\>PeV$. These features may follow either from “
mono-energetic” neutrino source in $PeV$ region or from $TeV$ scale resonance
in neutrino-nucleon scattering (or both). The gap in $0.4\div 1.0\>PeV$ region
certainly means that excesses observed in $1\div 2.5\>PeV$ and $0.03\div
0.4\>PeV$ regions have different origins.

In Section 2 we present a brief summary of the IceCube results, emphasizing
the gap between $0.4\>PeV$ and $1\>PeV$ as well as zero result for energies
above $2.5\>PeV$. Color octet neutrino ($\nu_{8}$) phenomenology is considered
in Section 3. Section 4 is devoted to $\nu_{8}$ interpretation of $PeV$
neutrino events. In Section 5 leptoquark interpretation of $PeV$ events is
reconsidered taking into account new IceCube data. Finally we give some
concluding remarks in Section 6.

## 2\. New IceCube data

As mentioned in previous section first two $PeV$ events were observed by
IceCube within $615.9$ days effective live time. Results of two-year dataset
[4], namely, $28$ high-energy neutrino events within $662$ days effective live
time, are grouped in Anchordoqui2014 (2) as following (there is a misprint in
the first item, $50\>TeV$ should be replaced by $30\>TeV$):

$\bullet\,26$ events from $50\>TeV$ to $1\>PeV$, which includes the $\sim 10$
atmospheric background events;

$\bullet\,2$ events from $1\>PeV$ to $2\>PeV$;

$\bullet\,$zero events above $2\>PeV$, say from $2\>PeV$ to $10\>PeV$, with a
background of zero events.

In a similar manner, results of three-year dataset Aartsen2014 (3),
corresponding to 988 days effective live time, can be grouped as:

$\bullet\>33$ events from $30\>TeV$ to $0.4\>PeV$, which includes the $\sim
10$ atmospheric background events;

$\bullet\>$zero events from $0.4\>PeV$ to $1\>PeV$, with a background of $0.2$
events;

$\bullet\,3$ events from $1\>PeV$ to $2.5\>PeV$, with a background of $0.02$
events;

$\bullet\>$zero events above $2.5\>PeV$, say from $2.5\>PeV$ to $10\>PeV$,
with a background of zero events.

As mentioned in the Introduction, these features may be followed from:

$\bullet\,$"mono-energetic" neutrino source(s) in $PeV$ region (see
Anchordoqui2014 (2) and references therein), i.e. blazars or gamma ray bursts
(GRB’s);

$\bullet\,$or from $TeV$ scale resonance in neutrino-nucleon scattering,
namely, leptoquarks or leptogluons (first interpretation has been considered
in Barger (5) and second one in Akay2014 (6));

$\bullet\,$or both.

Let us repeat that the gap in $0.4\div 1.0\>PeV$ region certainly means that
excesses observed in $1\div 2.5\>PeV$ and $0.03\div 0.4\>PeV$ regions have
different origins.

All the three $PeV$ energy events (event ID’s $14$, $20$ and $35$ in
Aartsen2014 (3)) has shower type event topology. Two events observed in first
two years have deposited energies $1041_{-144}^{+132}\>PeV$ and
$1141_{-133}^{+143}\>PeV$. Third event observed during third year has
deposited energy $2004_{-262}^{+236}\>PeV$.

## 3\. Phenomenology of color octet neutrinos

Color octet (decuplet) neutrinos and leptons as well as color sextet
($15-plet$) quarks are predicted by preonic models with colored preons Souza
(7, 8, 9, 10). There are two strong arguments favoring preon models: inflation
of “fundamental” particles and free parameters in the SM (other BSM models,
including SUSY, drastically increase the number of free parameters) and mixing
of “fundamental” quarks and leptons. The first one, namely “inflation”,
historically results in discovery of new level of matter two times during the
last century: periodical table of chemical elements was clarified by
Rutherford experiment, inflation of hadrons results in quark model (see Table
1 from Sahin2011 (11)).

Recently, color octet leptons have been come to forefront again Sahin2010 (12,
13, 14, 15, 16). It should be noted that concerning preon models color octet
neutrinos has the same status as color octet leptons, and the status of both
of them is similar to exited leptons and neutrinos, which are widely
investigated by ATLAS and CMS collaborations Aad2013ATLAS (17, 18, 19, 20).

Fermion-scalar and three-fermion models (see Sultansoy1998 (10) and references
therein):

Keeping a minimal scheme in mind, we make two assumptions: i) There is no
parastatistics, ii) Preons are colored objects. According to the first
assumption the SM fermions should contain odd number of fermionic preons,
which lead to fermion-scalar models or three fermion models. The second
assumption means that preons are color triplets.

Leptons: In the framework of fermion-scalar models, leptons would be a bound
state of one fermionic preon and one scalar anti-preon

$l=(F\overline{S})=1\oplus 8$

then each SM lepton has one colour octet partner. In a three fermion model,
the color decomposition

$l=(FFF)=1\oplus 8\oplus 8\oplus 10$

predicts the existence of two color octet and one color decouplet partners.

Quarks: In fermion-scalar models, anti-quarks are consist of one fermionic and
one scalar preons which means that each SM anti-quark has one colored sextet
partner

$\overline{q}=(FS)=\overline{3}\oplus 6$

According to the three fermion models

$q=(F\overline{F}F)=3\oplus\overline{3}\oplus\overline{6}\oplus 15$

therefore, for each SM quark one anti-triplet, one anti-sextet and one 15-plet
partners are predicted.

In this paper we consider color octet neutrinos in the framework of fermion-
scalar models. The interaction lagrangian for color octet neutrinos is given
by

$L=\frac{1}{2\Lambda}\underset{l}{\sum}\\{\bar{v}_{l8}^{a}g_{s}G_{\mu\nu}^{a}\sigma^{\mu\nu}(\eta_{L}\nu_{lL}+\eta_{R}\nu_{lR})+h.c.\\}.$
(1)

Here, $\Lambda$ is compositeness scale, $G_{\mu\nu}^{a}$ is field strength
tensor for gluon, index $a=1,2,...,8$ denotes the color, $g_{s}$ is the gauge
coupling, $\eta_{L}$ and $\eta_{R}$ are the chirality factors, $\nu_{lL}$ and
$\nu_{lR}$ denote left and right spinor components of neutrino
($l=e,$$\mu,\tau$), $\sigma^{\mu\nu}$ is the antisymmetric tensor. According
to neutrino chirality conservation, $\eta_{L}\eta_{R}=0$. We set $\eta_{R}=0$
in this analysis.

According to PDG PDG (21) current exclusion limit for color octet neutrino is
$M_{\nu_{8}}>110$$GeV$ assuming $\nu_{8}\rightarrow\nu+g$ decay. This value is
obtained from Tevatron data, a rough estimation shows that $M_{\nu_{8}}$ below
$400\,GeV$could be excluded by current LHC data.

## 4\. Color octet neutrino as the source of IceCube PeV events

Feynman diagram for resonant $\nu_{8}$ production in $\nu N$ scattering is
given in Figure 1.

Figure 1: Resonant $\nu_{8}$ production in the ultra high energy neutrino
nucleon scattering.

In order to perform numerical calculations we implement color octet neutrino
interaction lagrangian, given in Eq. 1, into the CalcHEP software CALCHEP
(22). In Fig. 2 we present $\nu_{8}$ production cross-section as a function of
incoming cosmic neutrino energy for different $\nu_{8}$ mass values. For
numerical calculations we set $\Lambda=m_{\nu_{8}}$ together with $CTEQ6L$
CTEQ6L (23) parton distributions. It should be noted that resonance cross-
section is proportional to $(\eta_{L}/\Lambda)^{2}$ .

Figure 2: $\nu_{8}$ production cross section in $\nu N$ scattering.

In order to obtain $\nu_{8}$ production rate distribution the cross-section
given in Fig. 2 should be convoluted with ultra high energy neutrino flux.
According to Aartsen2014 (3) the best fit power law for extraterrestrial
neutrino flux is

$E^{2}\phi(E)=1.5\times
10^{-8}(E/100\>TeV)^{-0.3}\>GeV\>cm^{-2}\>s^{-1}\>sr^{-1}$ (2)

for each neutrino species. For the calculation of production rate distribution
we use

$dN_{\nu_{8}}/dE_{\nu}=nt\Omega\sigma_{\nu_{8}}\phi(E)$ (3)

where $t=988$ days is the time exposure, $n=6\times 10^{38}$ is the effective
number of target nucleons in IceCube and $\Omega=4\pi$.

In $\nu_{8}$ interpretation, there are three possible sources of $PeV$ events
namely $\nu_{e_{8}}$, $\nu_{\mu_{8}}$ and $\nu_{\tau_{8}}$. Real picture
depends on $\nu_{8}$ mass hierarchy. Below we assume that masses of color
octet neutrinos are close to each other. Production rate distribution
$dN_{\nu_{8}}/dE_{\nu}$ is given in Fig. 3.

Figure 3: Production rate distribution $dN_{\nu_{8}}/dE_{\nu}$ from the
$\nu_{8}$ cross-section convoluted with extraterrestrial neutrino flux.

Up to this stage, procedure is similar to leptoquark case that considered in
Barger (5) and rough estimations for $\nu_{8}$ case performed in Akay2014 (6).
Concerning $\nu_{8}$ interpretation, in fact essential part of energy is
carried by neutrino, therefore it is invisible, and IceCube shower is formed
by gluon. For this reason gluon rate distribution, presented in Fig. 4, is
more appropriate for IceCube data analysis.

Figure 4: Event rate distribution $dN_{\nu_{8}}/dE_{g}$ from the gluon energy
distribution convoluted with extraterrestrial neutrino flux.

Let us turn to interpretation of IceCube $PeV$ energy events. As mentioned in
Section 2, there are $3$ events in $1-2.5\>PeV$ region, whereas there are no
events in $0.4-1\>PeV$ region and above $2.5\>PeV$. In our analysis, we use
$3$ observed events as a basic point. Then referring to Fig. 2 from
Aartsen2014 (3), we use $2.5\>(3.5)$ events as upper limit for
$0.4-1\>(2.5-10)\>PeV$ regions. In Table 1 we present expected number of
events in different energy regions normalized to $3$ events observed in
$1-2.5\>PeV$ region. Last column contains values of $\eta_{L}$ which provides
exactly $3$ events in $1-2.5\>PeV$ region.

Table 1: Number of events for different masses of color octet neutrinos $m_{\nu_{8},}GeV$ | $0-0.4\>PeV$ | $0.4-1.0\>PeV$ | $1.0-2.5\>PeV$ | $2.5-10\>PeV$ | $\eta_{L}$
---|---|---|---|---|---
$500$ | $4.8$ | $2.3$ | $3.0$ | $2.4$ | $0.4$
$600$ | $3.4$ | $2.2$ | $3.0$ | $2.7$ | $0.6$
$700$ | $2.4$ | $2.0$ | $3.0$ | $3.0$ | $0.9$
$800$ | $1.9$ | $1.9$ | $3.0$ | $3.3$ | $1.2$

It is seen that color octet neutrinos with mass values between $500$ and
$800\>GeV$ provide correct interpretation of IceCube data, whereas masses
above $800\>GeV$ lead to excess of events above $2.5\>PeV$. Mass value
corresponding to $\eta_{L}=1$ is approximately $740\>GeV$.

## 5\. Comments on leptoquark interpretations of $PeV$ events

Leptoquark interpretation of two $PeV$ events observed within first 2 years
IceCube data Aartsen2013 (1) was proposed in Barger (5). As the result,
authors mention that scalar leptoquark of charge $-1/3$, which couples to the
first generation quarks and the third generation leptons, with a mass around
$600\>GeV$ and coupling $f_{L}=1$ provides correct description of the data. In
this section we reconsider their results using new (3 years) IceCube data.
Using Fig. 3 from Barger (5) we estimate number of events for different mass
values and energy regions. Similar to Table 1 we use $3$ observed PeV energy
events as a basic point. Results are presented in Table 2.

Table 2: Number of events for different masses of leptoquarks $m_{\nu_{LQ},}GeV$ | $0-0.4\>PeV$ | $0.4-1.0\>PeV$ | $1.0-2.5\>PeV$ | $2.5-10\>PeV$ | $f_{L}$
---|---|---|---|---|---
$500$ | $2.5$ | $6.4$ | $3.0$ | $1.2$ | $1.0$
$600$ | $0.5$ | $3.9$ | $3.0$ | $1.1$ | $1.3$
$700$ | $0$ | $2.1$ | $3.0$ | $1.0$ | $1.7$
$800$ | $0$ | $1.1$ | $3.0$ | $0.9$ | $2.2$

It is seen that leptoquark interpretation is in conflict with new IceCube data
if $m_{\nu_{LQ}}$ is below $650\>\,GeV$, because it leads to excess of events
in $0.4-1\>PeV$ energy region. Leptoquark with mass above $650\>GeV$ is in
agreement with data, however coupling constant $f_{L}$ should be larger than
$1.5$.

## 6\. Conclusion

Observation of $PeV$ energy neutrino events in the IceCube experiment may lead
to serious consequences both for astrophysics and particle physics. In the
light of our calculations, color octet neutrinos with masses in $500-800\>GeV$
range give rational interpretation of the IceCube results on $PeV$ energy
neutrinos. In addition, scalar leptoquark with mass $650-700\>GeV$ also
provide reasonable mechanisms for IceCube data. Correctness of both
interpretations may be checked in near future using forthcoming IceCube and
LHC data.

## References

  * (1) M. G. Aartsen et al. [IceCube Collaboration], Phys. Rev. Lett. 111, 021103 (2013); arXiv:1304.5356 [astroph.HE].
  * (2) L. A. Anchordoqui et al., Journal of High Energy Astrophysics 1-2 (2014) 1-30; arXiv:1312.6587v3 [astro-ph.HE].
  * (3) M. G. Aartsen et al. [IceCube Collaboration], Phys. Rev. Lett. 113 (2014) 101101; arXiv:1405.5303 [astroph.HE].
  * (4) M. G. Aartsen et al. [IceCube Collaboration], Science 342, 1242856 (2013); arXiv:1311.5238v2 [astro-ph.HE].
  * (5) V. Barger and W. -Y. Keung, Phys. Lett. B 727, 190(2013); arXiv:1305.6907 [hep-ph].
  * (6) A.N. Akay, U. Kaya and S. Sultansoy; arXiv:1402.1681 [hep-ph].
  * (7) I.A D’Souza, C. S. Kalman, PREONS: Models of Leptons, Quarks and Gauge Bosons as Composite Object,World Scientific Publishing Co., (1992).
  * (8) A. Celikel and M. Kantar, Turk. J. Phys. 22, 401 (1998).
  * (9) J. L. Hewett and T. G. Rizzo, Phys. Rev. D 56, 5709 (1997); arXiv:hep-ph/9703337.
  * (10) A. Celikel, M. Kantar, and S. Sultansoy, Phys. Lett. B 443, 359 (1998).
  * (11) M. Sahin, S. Sultansoy, S. Turkoz, Phys. Rev. D 83, 054022 (2011); arXiv:1009.5405 [hep-ph].
  * (12) M. Sahin, S. Sultansoy, and S. Turkoz, Phys. Lett. B 689, 172 (2010); arXiv:1001.4505 [hep-ph].
  * (13) A. N. Akay, H. Karadeniz, M. Sahin, and S. Sultansoy, Europhys. Lett. 95, 31001 (2011); arXiv:1012.0189 [hep-ph].
  * (14) T. Mandal and S. Mitra, Phys. Rev. D 87, 095008 (2013); arXiv:1211.6394 [hep-ph].
  * (15) D. G. Netto, D. L. Val, K. Mawatari, I. Wigmore, and T. Plehn, Phys. Rev. D 87, 094023 (2013); arXiv:1303.0845 [hep-ph].
  * (16) M. Sahin, Acta Phys. Pol. B 45 (2014) 1811-1831; arXiv:1302.5747 [hep-ph].
  * (17) G. Aad et al. (ATLAS Collaboration), New J. Phys. 15 (2013) 093011; arXiv:1308.1364 [hep-ex].
  * (18) G. Aad et al. (ATLAS Collaboration), Phys. Lett. B 728 (2014) 562-578; arXiv:1309.3230 [hep-ex].
  * (19) S. Chatrhyan et al. (CMS Colloboration), Phys. Lett. B 720 (2013) 309; arXiv:1210.2422 [hep-ex].
  * (20) V. Khachatryan et al. (CMS Colloboration), arXiv:1406.5171 [hep-ex].
  * (21) J. Beringer et al. (Particle Data Group), Phys. Rev. D 86, 010001 (2012).
  * (22) A. Belyaev, N.D. Christensen, A. Pukhov, Comput. Phys. Commun. 184, 1729 (2013); arXiv:1207.6082 [hep-ph].
  * (23) J. Pumplin et al., JHEP 0207, 012 (2002); arXiv:hep-ph/0201195.


# Anonymity Analysis of the Umbra Stealth Address Scheme on Ethereum

Alex M. Kovács<EMAIL_ADDRESS>and  István András Seres
0000-0003-0143-4057<EMAIL_ADDRESS>Eötvös Loránd
UniversityPázmány Péter stny. 1/CBudapestPestHungary1117

(2023; 20 February 2007; 12 March 2009; 5 June 2009)

###### Abstract.

Stealth addresses are a privacy-enhancing technology that provides recipient
anonymity on blockchains. In this work, we investigate the recipient anonymity
and unlinkability guarantees of Umbra, the most widely used implementation of
the stealth address scheme on Ethereum and on its three off-chain scalability
solutions, e.g., Arbitrum, Optimism, and Polygon. We define and evaluate four
heuristics to uncover the real recipients of stealth payments. We find that
for the majority of Umbra payments, it is straightforward to establish the
recipient, hence nullifying the benefits of using Umbra. Specifically, we find
the real recipient of $48.5\%$, $25.8\%$, $65.7\%$, and $52.6\%$ of all Umbra
transactions on the Ethereum main net, Polygon, Arbitrum, and Optimism
networks, respectively. Finally, we suggest easily implementable
countermeasures to evade our deanonymization and linking attacks.

Ethereum, decentralized finance, recipient anonymity, unlinkability, stealth
address scheme.

††copyright: acmcopyright††journalyear: 2023††doi: XXXXXXX.XXXXXXX††journal:
TOG††journalvolume: 37††journalnumber: 4††article: 111††publicationmonth:
8††ccs: Security and Privacy Privacy-preserving protocols

##  1\. Introduction

Decentralized finance (DeFi) offers a radically new financial system, i.e., it
is an open, trustless, composable, and transparent financial system built on
top of blockchains. The transparent nature of DeFi aids trustlessness and
public verifiability. However, the lack of financial privacy is undesirable in
most applications. Therefore, the DeFi ecosystem on Ethereum offers several
deployed privacy-enhancing solutions, such as mixers (e.g., Tornado Cash
(Pertsev et al., 2019)), confidential transactions (e.g., AZTEC (Williamson,
2018)) or stealth addresses (e.g., Umbra (DiFrancesco and Solomon, 2021).
Previous work has thoroughly analyzed the anonymity guarantees provided by
Tornado Cash (Béres et al., 2021; Wang et al., 2023; Wu et al., 2022). In this
work, we study the recipient anonymity and unlinkability guarantees provided
by the Umbra stealth address scheme.

Stealth addresses (or seldom Elliptic-curve Diffie–Hellman (ECDH) addresses)
are a prevalent privacy-enhancing technology for cryptocurrencies. They were
first proposed by Peter Todd on the Bitcoin mailing list in 2014 (Todd, 2014).
Stealth addresses allow a payment sender to transfer assets _non-
interactively_ to a recipient in a recipient anonymous way. In a nutshell,
senders generate a computationally random-looking address, i.e., a stealth
address. Subsequently, the sender can pay the recipient by transferring funds
to the freshly generated stealth address. Specifically, no party other than
the transacting parties can establish the actual recipient of a transaction
using stealth addresses. However, the recipient can detect on the blockchain
that a specific stealth address belongs to them, and crucially they are the
only ones who can spend the funds at the stealth address. In conclusion,
stealth addresses allow the sender to obfuscate its economic relationship with
the recipient.

Stealth addresses are standardized for Bitcoin in the Bitcoin Improvement
Proposal (BIP) 47 (Ranvier, 2015) and Ethereum in the Ethereum Improvement
Proposal (EIP) 5564 (Wahrstätter et al., 2022). Even though the BIP47 did not
gain significant traction in the Bitcoin ecosystem (Möser and Böhme, 2017),
stealth addresses remain a popular privacy-enhancing technique for public
blockchains as they are implemented and deployed in Monero (Noether and
Noether, 2014) and Ethereum (Wood et al., 2014) as well.

This paper aims to analyze the recipient anonymity guarantees achieved by the
most popular stealth address implementation on Ethereum: Umbra111See:
https://app.umbra.cash/.. Umbra is currently deployed on Ethereum and its
numerous layer-2 scalability solutions such as Polygon, Arbitrum, and
Optimism. Umbra is the second most popular privacy-enhancing technology used
on Ethereum and its layer-2 systems after the AZTEC protocol with $413$ daily
users versus $1866$ daily users on March 20th, 2023222See:
https://dune.com/intake/umbra-protocol,333See:
https://dune.com/gm365/aztec-v2.. In this work, our goal is to identify
erroneous idioms of use that allow any blockchain analysts to reduce the
theoretical recipient anonymity and unlinkability guarantees provided by the
stealth address cryptographic scheme.

In this work, we make the following contributions.

  * •

We identify four heuristics enabled by user behavior that can reduce or
nullify the recipient anonymity or unlinkability guarantees of the Umbra
stealth address scheme, see Section 6.

  * •

We evalaute the efficacy of the identified heuristics in uncovering and
linking Umbra stealth payment recipients, see Section 7. Our results are
reproducible as our code is open-source. It is available at the following
repository: https://github.com/alekszkovacs/UmbraAnonymityAnalysis.

  * •

We suggest counter-measures to our proposed heuristics. We make suggestions to
stealth wallet providers and developers.

The rest of this paper is organized as follows. In Section 2, we describe the
cryptographic details of stealth addresses and, in particular, the relevant
implementation details of the Umbra stealth address scheme. In Section 3, we
introduce our system and threat models. In Section 4, we detail our data
collection methods. We present empirical Umbra usage statistics in Section 5.
In Section 6, we define several heuristics aimed at deanonymizing Umbra
recipients. We evaluate the efficacy of these heuristics in Section 7.
Finally, we conclude our paper in Section 8.

##  2\. Background

Hereby, we describe the stealth address protocol used by Umbra.

###  2.1. Notations

When we uniformly at random sample $r$ from a set $S$, we write $r\in_{R}S$.
We assume the existence of a prime-order cyclic group $\mathbb{G}$
($|\mathbb{G}|=p$), where the discrete logarithm and the (decisional and
computational) Diffie-Hellman assumptions hold. The finite group $\mathbb{G}$
is generated by $G$, i.e., $\mathbb{G}=\langle G\rangle$. In our applications,
$\mathbb{G}$ is an elliptic curve group over a finite field $\mathbb{F}_{q}$
in which we denote the group operation additively. Secret keys are typically
sampled from $\mathbb{F}^{*}_{q}$, while public keys are elliptic curve points
in $\mathbb{G}$. A secure cryptographic hash function is denoted as
$H(\cdot)$. Ethereum addresses are obtained by hashing the corresponding
public key. Ethereum addresses are typed in $\mathsf{bold}$; sender,
recipient, registrant, and stealth addresses are denoted as
$\mathsf{s},\mathsf{r},\mathsf{reg},\mathsf{st}$, respectively.

###  2.2. Stealth Addresses

Umbra applies the dual-key stealth address protocol; see Figure 1. In the
applied stealth address scheme, the recipients use two key pairs: a spending
and a viewing public/private key pair. The benefit of this approach is that
recipients can separate the concerns of detecting incoming stealth payments
and spending them. For instance, this allows recipients to accept stealth
payments while keeping their spending private key off-chain, e.g., in cold
storage. Additionally, this architecture enables recipients to outsource the
detection of stealth payments to a trusted party since the detection of
payments only relies on the secret viewing key and the spending public key.
However, the trusted third party cannot spend the funds, as one also needs the
spending private key to redeem the funds at the stealth address. On the other
hand, this scanning approach does not provide privacy against the trusted
third party.

The dual-key stealth address generation algorithm Recipient: generates
$s,v\in_{R}\mathbb{F}_{q}$. Publishes
$(\mathsf{pk}^{view}_{\mathsf{r}},\mathsf{pk}^{spend}_{\mathsf{r}})=(vG,sG)$.
Sender: publishes $\mathsf{pk}_{\mathsf{s}}\in\mathbb{G}$ on the blockchain.
Input:
$(\mathsf{pk}_{\mathsf{s}},(\mathsf{pk}^{view}_{\mathsf{r}},\mathsf{pk}^{spend}_{\mathsf{r}}))$.
(1) The sender $\mathcal{S}$ generates an ephemeral key pair $(r,R)=(r,rG),$
where $r\in_{R}\mathbb{F}_{p}$. (2) $\mathcal{S}$ computes shared secret
$c=H(r\cdot\mathsf{pk}^{view}_{\mathsf{r}})$. (3) $\mathcal{S}$ sends funds to
the stealth address $\mathsf{st}$ derived from the public key
$\mathsf{pk}^{stealth}:=cG+\mathsf{pk}^{spend}_{\mathsf{r}}$. Return:
$(R,\mathsf{pk}^{stealth})$. A naïve (linear) stealth payment detection
algorithm Input:
$(\mathsf{pk}^{view}_{\mathsf{r}},\mathsf{pk}^{spend}_{\mathsf{r}}),\\{(R_{i},\mathsf{pk}^{stealth}_{i})\\}^{n}_{i=1}$.
(1) Let $\mathsf{incomingPayments}:=\\{\\}$ (2) Recipient checks
$H(vR_{i})G+\mathsf{pk}^{spend}_{\mathsf{r}}\stackrel{{\scriptstyle?}}{{=}}\mathsf{pk}^{stealth}_{i}$
for each $i\in[1,n]$. • If it holds
$\mathsf{incomingPayments}.append(\mathsf{pk}^{stealth}_{i})$. Return:
$\mathsf{incomingPayments}$. Figure 1. The dual-key stealth address protocol.

Recently, several novel cryptographic schemes were proposed to improve the
linear scanning problem of stealth addresses (Beck et al., 2021; Madathil et
al., 2021; Liu and Tromer, 2022). Nonetheless, this problem is still not
entirely settled, as current solutions are unsatisfactory. Specifically, Fuzzy
Message Detection (Beck et al., 2021) does not provide sufficient levels of
privacy (Seres et al., 2022). Private Signaling assumes non-colluding scanning
servers or trusted execution environments (Madathil et al., 2021; Jakkamsetti
et al., 2023). Both of them are strong assumptions. Oblivious Message
Retrieval (OMR) and its latest variant apply fully homomorphic encryption in
an elegant way (Liu and Tromer, 2022; Liu et al., 2023). Therefore, OMR uses
large ($\approx 1$GB) detection keys that are impractical for resource-
constrained devices. At the time of writing, OMR is being developed and soon
to be deployed by the Zcash Foundation.

##  3\. Umbra: System and Threat models

###  3.1. Umbra: a system model

Umbra, Ethereum’s most popular stealth address scheme, consists of the
following five system components.

Figure 2. A schematic depiction of the Umbra stealth address scheme. A
recipient first registers its viewing and spending public keys in the Stealth
Key Registry. Later, the sender can read these public keys from the registry
and send assets to a freshly generated pseudorandom stealth address. Finally,
the recipient scans the blockchain for any incoming stealth payments and
subsequently withdraws the received assets to an address they own.

  1. (1)

Senders: look up viewing and spending keys
$(\mathsf{pk}^{view}_{\mathsf{r}},\mathsf{pk}^{spend}_{\mathsf{r}})$ of their
recipients $\mathsf{r}$ in a registry and generate stealth addresses for their
recipients, see Figure 1. Subsequently, senders transfer crypto assets, e.g.,
ETH, or ERC20 tokens, to the stealth address for their recipients.

  2. (2)

Recipients: write their viewing and spending keys to a registry contract.
Later, occasionally, they scan the blockchain for incoming stealth payments.
Currently, they need to check every stealth address to see whether it belongs
to them. Alternatively, recipients can outsource this computation.

  3. (3)

Registry of stealth public keys: it is a smart contract that stores all the
recipients’ viewing and spending keys.

  4. (4)

Umbra smart contract: facilitates the asset transfer between sender and
recipient. Additionally, for every stealth payment, it emits a so-called
Announcement event containing $(R,\mathsf{pk}^{stealth})$, cf. Figure 1. Later
these events can be scanned by recipients to detect incoming stealth payments.

  5. (5)

Relayers: in the special cases of ERC20 tokens, relayers are paid to withdraw
assets from the stealth addresses. This is because those stealth addresses do
not hold ether, hence cannot send transactions as they cannot pay for the
occurring withdrawal transaction fees.

The Umbra stealth address scheme entails the following steps.

  1. (1)

Recipient registers public keys: recipients register their stealth public
viewing and spending keys from an Ethereum address $\mathsf{reg}$ in the
registry smart contract.

  2. (2)

Sender reads registry: senders read viewing and spending public keys
$(\mathsf{pk}^{view}_{\mathsf{r}},\mathsf{pk}^{spend}_{\mathsf{r}})$ of their
recipients in the stealth public key registry contract.

  3. (3)

Sender transfers assets: senders generate a pseudorandom stealth address
$\mathsf{st}$ given the viewing and spending public keys
$(\mathsf{pk}^{view}_{\mathsf{r}},\mathsf{pk}^{spend}_{\mathsf{r}})$ and
subsequently transfer assets to the derived stealth address $\mathsf{st}$.

  4. (4)

Recipient scans the blockchain: recipients intermittently scan the
Announcement events emitted by the Umbra contract for incoming stealth
payments. Typically, users do not leave assets residing at stealth address
$\mathsf{st}$, rather, they withdraw them to a recipient address $\mathsf{r}$.

  5. (5)

Recipient withdraws assets: either the Umbra smart contract forwards assets to
the stealth address or stores assets in the case of ERC20 tokens. In the
latter case, recipients use relayers (not depicted in Figure 2) to withdraw
funds held by the Umbra smart contract. Finally, recipients withdraw funds
from the stealth address $\mathsf{st}$ to the recipient address $\mathsf{r}$.

###  3.2. Threat model

The adversary aims to link the Umbra stealth payment recipients $\mathsf{r}$
to entities previously registered from some address $\mathsf{reg}$ in the
Registry contract. We assume the adversary can access the Ethereum blockchain,
recording all transactions and smart contracts. Specifically, the adversary
can read the code of the Umbra and Registry smart contracts and all
transactions that call these smart contracts. However, we do not assume that
the adversary can deanonymize Umbra users off-chain, e.g., by running a
relayer node. A potent adversary on the peer-to-peer layer could certainly
link IP addresses or other identifying information to Umbra users whenever
they withdraw their assets from their stealth addresses. Nonetheless, our
adversary solely relies on the public blockchain data to decrease the
recipient anonymity and unlinkability guarantees of Umbra.

###  3.3. Anonymity notions

Stealth address schemes provide two types of privacy notions: recipient
anonymity and recipient unlinkability. Informally, recipient anonymity
guarantees that an observer cannot uncover the identity of a recipient better
than randomly guessing. A weaker notion is recipient unlinkability, which
dictates that it must be indistinguishable whether or not two stealth payments
are sent to the same user. For a formal, game-based definition of these
privacy notions, we refer the reader to (Backes et al., 2013). Hereby, due to
space constraints, we only provide a definition for recipient unlinkability;
recipient anonymity can be defined analogously.

The recipient unlinkability $\mathcal{G}^{RU}_{\mathcal{A},\Pi}(\lambda)$ game
(1) Adversary $\mathcal{A}$ selects target recipients
$\mathsf{r}_{0},\mathsf{r}_{1}$ and a target sender $\mathsf{s}$. (2)
Challenger $\mathcal{C}$ instructs sender $\mathsf{s}$ to send a stealth
payment to $\mathsf{r}_{c}$ for $c\xleftarrow{\$}\\{0,1\\}$. (3) $\mathcal{C}$
generates randomly a challenge bit $b\xleftarrow{\$}\\{0,1\\}$. If $b=0$,
$\mathcal{C}$ instructs $\mathsf{s}$ to send a stealth payment to
$\mathsf{r}_{c}$. Otherwise, instructs $\mathsf{s}$ to send a stealth payment
to $\mathsf{r}_{1-c}$. (4) $\mathcal{A}$ observes the blockchain and outputs
$b^{\prime}$. Return: $1$, iff. $b=b^{\prime}$, otherwise $0$. Figure 3. The
security game for the anonymity notion of recipient unlinkability.

###### Definition 3.1 (Recipient unlinkability (RU)).

An anonymous communication protocol $\Pi$ satisfies recipient unlinkability if
for all PPT adversaries $\mathcal{A}$ there is a negligible function
$\mathsf{negl}(\cdot)$ such that

(1)
$\Pr[\mathcal{G}^{RU}_{\mathcal{A},\Pi}(\lambda)=1]\leq\frac{1}{2}+\mathsf{negl}(\lambda),$

where the privacy game $\mathcal{G}^{RU}_{\mathcal{A},\Pi}(\lambda)$ is
defined in Figure 3.

##  4\. Data collection

We were primarily interested in three main types of transactions in relation
to the Umbra stealth address scheme on a given network.

  * •

Stealth key registrations. We collected every transaction that registered
public keys in the stealth key registry.

  * •

Umbra sends and withdraws. Every incoming (sent stealth payments) and outgoing
(withdrawn stealth payments) transactions of the Umbra smart contract had been
collected.

  * •

Registrant, sender, and withdrawer transactions. For every address that
interacted with either the Stealth Key Registry or the Umbra smart contract,
we collected every transaction that was sent or received by these addresses.

We obtained these transactions using the APIs of the Etherscan blockchain
explorers for the investigated four blockchains, i.e., Ethereum L1 444See:
https://etherscan.io/, Arbitrum 555See: https://arbiscan.io/, Polygon 666See:
https://polygonscan.com/, and Optimism 777See:
https://optimistic.etherscan.io/. Additionally, the measurements of Section 5
were obtained from the https://dune.com blockchain analytics website.

##  5\. Umbra activity

At the time of writing, Umbra facilitated the transfer of more than $155$
million U.S. dollars worth of cryptoassets (ether and ERC20s) across all
chains where it is deployed888See: https://dune.com/intake/umbra-protocol..
Interestingly, Umbra became more popular on Layer 2s, such as Arbitrum,
Optimism, or Polygon, than it is on mainnet Ethereum, see Figure 4. We observe
a sharp increase in Umbra usage after the previously most popular on-chain
privacy-enhancing technology, i.e., Tornado Cash, was banned in the U.S. As of
July 2023, there are nearly $70,000$ registered users in the stealth key
registries of Umbra across all chains.

Figure 4. Increasing popularity of the Umbra Stealth Address scheme on
Ethereum and various Layer-2 systems. Notably, Layer-2 deployments of Umbra
surpass the mainnet deployment in demand. The red vertical line shows the date
when Tornado Cash contracts were sanctioned by OFAC.

We analyzed the usage patterns of Umbra users. First, we had suspected that
certain users might use Umbra as a recipient anonymous payment processor. This
could have been justified if, for instance, there are Umbra payments occurring
in large numbers on a specific day of each month. Interestingly, we could not
find such behavior on any of the deployed chains. See two typical activity
heatmaps of Umbra users in Figure 5. We found that numerous Umbra sender
addresses are very active (i.e., send dozens of Umbra transactions) in a short
time period (e.g., weeks or a few days) and afterward they do not interact
with Umbra anymore.

Figure 5. Umbra activity heatmaps for two Umbra users on the Polygon network.
Observe that most of their activity is concentrated in a short time period.
The user on the left sent $650$ Umbra transactions, while the user on the
right sent $34,081$ Umbra transactions.

##  6\. Uncovering Umbra payment recipients

Here, we define our heuristics to identify Umbra payment recipients. We remark
that our ultimate goal is to link stealth addresses to their actual
recipients, i.e., addresses registered to the Umbra stealth key registry.
Additionally, we provide heuristics that only reduce the anonymity guarantees
of Umbra but do not uncover the actual recipient of an Umbra stealth payment
deterministically.

###  6.1. Registrant address reuse

Users typically withdraw their funds (Ether or ERC20 tokens) from stealth
address $\mathsf{st}$ to recipient address $\mathsf{r}$. If the recipient
address $\mathsf{r}$ is an address already interacted with the stealth key
registry, then we can heuristically link the stealth address $\mathsf{st}$ to
the registrant address $\mathsf{reg}$. In some cases, we can also determine
the ENS (Ethereum Name Registry) address(es) owned by the recipient since, in
the early days of Umbra, only ENS users could register as recipients.

###### Heuristic 6.1.

If a recipient address $\mathsf{r}$ is also a registrant address
$\mathsf{reg}$, we link the corresponding stealth address $\mathsf{st}$ to
$\mathsf{reg}$.

To refine this heuristic, we only consider recipient addresses $\mathsf{r}$
where the whole amount was transferred from the stealth address $\mathsf{st}$.
If this is not the case, i.e., multiple transactions originate from the
stealth address potentially with different recipients, then we cannot
confidently tell which recipient address (if at all) is the same entity as the
owner of the stealth address. Note, we only need to check multiple outgoing
withdraw transactions in the case of ether stealth transactions because, for
ERC20 tokens, Umbra dictates the withdrawal of the entire stealth payment
amount.

Figure 6. A schematic depiction of Heuristic 6.1 (Registrant address reuse),
and Heuristic 6.2 (Same sender and receiver).

###  6.2. Same sender and receiver

When the sender $\mathsf{s}$ of a stealth payment is the same as the recipient
$\mathsf{r}$ to where funds are withdrawn, then we heuristically link the
corresponding stealth address $\mathsf{st}$ as being the same entity as the
$\mathsf{s}$ (and hence the $\mathsf{r}$) address. We speculate that these
stealth payments are primarily issued for testing purposes.

###### Heuristic 6.2.

If the sender $\mathsf{s}$ of a stealth payment and the recipient address
$\mathsf{r}$ of a withdraw transaction are the same, then we link the stealth
address $\mathsf{st}$ and $\mathsf{s}$ as being the same entity.

Similarly, in this heuristic, we check whether the whole amount was withdrawn
from the stealth address $\mathsf{st}$ to $\mathsf{r}$. If yes, then we apply
the heuristic and conclude that $\mathsf{s}$, $\mathsf{st}$, and $\mathsf{r}$
addresses are owned by the same entity. Otherwise, we do not apply the
heuristic. If there are multiple withdraw transactions from a stealth address
with possibly multiple recipient addresses, then we cannot confidently link
the actual owner of the stealth address $\mathsf{st}$ to the sender address
$\mathsf{s}$ even if one of the recipient addresses is the same as the
$\mathsf{s}$.

Figure 7. A schematic depiction of Heuristic 6.3 (Collector pattern), and
Heuristic 6.4 (Unique maxPriorityFeePerGas). Both of these heuristics forfeit
the unlinkability guarantee provided by Umbra, as these heuristics enable one
to link the recipients of multiple stealth payments.

###  6.3. Collector pattern

A stealth address scheme should provide recipient anonymity and recipient
unlinkability. Recipient unlinkability dictates that the adversary should not
be able to tell whether or not two messages (or payments) are sent to the same
user. An anonymous communication system satisfies recipient unlinkability if
the adversary cannot do better than randomly guessing whether two messages are
sent to the same user (Backes et al., 2013). The following heuristic aims to
break the recipient unlinkability guarantees of Umbra.

Umbra users can forfeit the recipient unlinkability guarantees the stealth
address scheme provides. If a set of stealth addresses
$\\{\mathsf{st}_{i}\\}^{n}_{i=0}$ have sent their funds directly to the same
recipient address $\mathsf{r}$, then we can cluster the stealth addresses
$\\{\mathsf{st}_{i}\\}^{n}_{i=0}$ as they are likely owned by the same entity.
This implies that the recipients of these stealth payments are likely to be
the same entity. Note that this heuristic is not able to link a recipient
$\mathsf{r}$ or stealth address $\mathsf{st}$ to a registrant address
$\mathsf{reg}$ in the Umbra stealth key registry. Nonetheless, it already
uncovers important information about a set of stealth addresses.

###### Heuristic 6.3.

If a user withdraws funds from a set of stealth addresses
$\\{\mathsf{st}_{i}\\}^{n}_{i=0}$ to the very same recipient address
$\mathsf{r}$, then we cluster all these addresses
($\\{\mathsf{st}_{i}\\}^{n}_{i=0}$ and $\mathsf{r}$) together as they are
likely controlled by the same entity.

We acknowledge the possibility of false positives output by Heuristic 6.3. For
instance, it might be that the recipient address $\mathsf{r}$ is a business
that provides services in exchange for ether or ERC20 tokens, and Umbra users
with stealth addresses are paying for them. We refine this heuristic as
follows in order to avoid false positives. First, we only consider stealth
addresses from where there is only a single withdrawal transaction, i.e., the
whole amount is withdrawn to a recipient address in one transaction. If there
were multiple transactions from a stealth address, then it is more likely that
they are rather payment transactions and not withdrawal transactions. We
remark that one only needs to check this condition in the case of ether
transactions because, for ERC20 tokens, users must withdraw all the amount
from the Umbra contract in one transaction.

###  6.4. Unique max priority fee

In contrast to the previous Heuristic 6.3 (collector pattern), it is possible
to link stealth addresses even if a user withdraws from a stealth address
$\mathsf{st}_{i}$ to a different recipient address $\mathsf{r}_{i}$ for
$i\in[1,n]$.

Ethereum uses a novel transaction fee mechanism called EIP-1559 (Buterin et
al., 2019) that was deployed on August 5, 2021, as part of the London hard
fork update. For our discussion, the only relevant part of the EIP-1559
transaction fee mechanism design is the maxPriorityFeePerGas field of Ethereum
transactions. This is the only part of an Ethereum transaction set by the user
(wallet) concerning transaction fees. The larger the transaction fee
maxPriorityFeePerGas is, the sooner a validator includes the transaction in a
new block. Typically, users (rather their wallet softwares) set
maxPriorityFeePerGas automatically. However, users can modify the
maxPriorityFeePerGas field manually and leave a chosen setting for an extended
period of time. Hence, if a wallet owns multiple addresses and users apply
“unique” maxPriorityFeePerGas fees, then the sender addresses of these
transactions can be clustered together as they are likely owned by the same
entity.

###### Heuristic 6.4.

If two or more withdraw transactions from
$\mathsf{st}_{i}\rightarrow\mathsf{r}_{i}$ uses the same “unique”
maxPriorityFeePerGas, then we link all these stealth addresses
$\\{\mathsf{st}_{i}\\}^{n}_{i=1}$ together.

To make this Heuristic sensible, we need to choose when we consider a
maxPriorityFeePerGas value “unique” in our dataset. Obviously, if a value is
encountered dozens of times, then we cannot consider it unique, e.g., this is
the case with round number as maxPriorityFeePerGas values. To limit the number
of false positives, we considered a maxPriorityFeePerGas values “unique” if
not more than five transactions apply that maxPriorityFeePerGas value. Note
that this Heuristic does not apply to Umbra stealth payments that transfer
ERC-20 tokens. Tokens are withdrawn by relayers on behalf of Umbra recipients.
Therefore, token withdrawal transactions’ maxPriorityFeePerGas field is not
set by Umbra recipients but rather by the relayers.

##  7\. Evaluation

In this section, we evaluate the effectiveness of our heuristics in
identifying Umbra payment recipients.

###  7.1. Heuristic 6.1

The first heuristic is the most successful in identifying the true recipients
of Umbra payments; $48,25\%$ of Umbra payments (both ether and ERC20 token
transfers) on the main Ethereum network can be trivially linked to stealth key
registry transactions as the withdrawer address, and the registrant addresses
are the same. We observe similarly high percentages for the other networks,
i.e., $25,79\%$, $65,61\%$, $52,57\%$ for Polygon, Arbitrum, and Optimism,
respectively.

###  7.2. Heuristic 6.2

This heuristic (same sender and withdrawer address) performs worse than the
first heuristic. However, it still identifies a handful of Umbra withdraw
transactions, i.e., $2,61\%$, $1,15\%$, $1,87\%$, and $0,85\%$ of Umbra
payments are deanonymized on the Ethereum L1, Polygon, Arbitrum, and Optimism
networks, respectively, thanks to this heuristic.

###  7.3. Heuristic 6.3

The collector pattern heuristic breaks the recipient unlinkability guarantee
of Umbra payments. As Figure 8 shows, several Umbra users withdraw multiple
incoming payments to a _single_ withdraw address. The largest whale is a user
on the Arbitrum network who collected $481$ stealth payments to a unique
withdrawer address.

| Mainnet | Polygon | Arbitrum | Optimism
---|---|---|---|---
Heuristic 6.3 |  $8.48$ bits |  $9.86$ bits |  $8.86$ bits |  $8.83$ bits
Entropy |  $12.53$ bits |  $14.86$ bits |  $13.36$ bits |  $13.29$ bits
Table 1. Most users withdraw multiple incoming stealth payments to a single
address. This user behavior, formulated as “collector pattern” in Heuristic
6.3, greatly reduces the Shannon entropy of stealth payment recipients.

If $n$ stealth payments are occurring on a network, an adversary ideally has
$\log_{2}(n)$ bits of uncertainty about the recipients of stealth payments.
However, with the help of the “collector pattern” heuristic, we can
heuristically conclude that several stealth payments are likely received by
the same user, hence, decreasing the entropy of this distribution, see Table
1. For instance, in the case of Arbitrum, naïvely, there is a $13,36$ bits of
entropy in the recipients’ distribution. The application of Heuristic 6.3
reduces this to $8.86$ bits.

Figure 8. This figure displays the number of withdrawer addresses with a given
number of withdraw transactions from stealth addresses. Users tend to reuse
withdraw addresses to collect stealth payments from multiple stealth
addresses. Note that this is a log-log figure.

###  7.4. Heuristic 6.4

Previous work had already successfully applied the heuristic of unique
transaction fees in the context of linking Tornado cash deposit and withdraw
transactions (Béres et al., 2021). Interestingly, in our case, we did not find
Umbra withdraw transactions with the same unique priority fees. We attribute
this phenomena as one of the beneficial outcomes of the EIP-1559 transaction
fee mechanism.

| Mainnet | Polygon | Arbitrum | Optimism
---|---|---|---|---
Heuristic 6.1. | $4671$ | $15075$ | $12488$ | $8391$
Heuristic 6.2. | $253$ | $670$ | $356$ | $135$
Total linked | $4696$ | $15084$ | $12513$ | $8403$
Total withdrawn | $9680$ | $58454$ | $19033$ | $15963$
Table 2. Performance of the identified heuristics for uncovering Umbra payment
recipients. Three of our heuristics could link the $48.5\%$, $25.8\%$,
$65.7\%$, and $52.6\%$ of all Umbra transactions on the Ethereum L1, Polygon,
Arbitrum, and Optimism networks, respectively.

###  7.5. Countermeasures

A common root cause of Heuristic 6.1, 6.2, and 6.3 is the ability to reuse
user addresses. Generally speaking, one should always avoid the reuse of
addresses even in an account-based cryptocurrency as it facilitates user
profiling and address clustering (Möser and Narayanan, 2022). The use of
unique addresses is especially important when one uses privacy-enhancing
technologies (Béres et al., 2021; Wang et al., 2023; Wu et al., 2022). One
must use different addresses for different types of on-chain activities.
Developers of stealth address wallets should never allow users to reuse
addresses or to withdraw funds from a stealth address to a registrant address.

##  8\. Conclusion and future directions

In this work, we analyzed the recipient anonymity and unlinkability guarantees
provided by the second most used privacy-enhancing overlay in the Ethereum
DeFi ecosystem. We identified four heuristics that enabled us to link the
majority of Umbra recipients on the Ethereum mainnet. Finally, we suggested
several countermeasures that would prevent one from our identified heuristics.
Future work should investigate the interplay between Ethereum’s cross-chain
ecosystem and the deployed privacy-enhancing technologies on these chains. For
instance, Ethereum and its L2s use the same address format. We also observed
that users tend to reuse their addresses across different networks. We suspect
that this address reuse could lead to cross-chain heuristics that could
further decrease the recipient anonymity guarantees of Umbra. Another venue
for future work could be to apply the heuristics of (Victor, 2020) to enhance
our deanonymization and linking capabilities.

###### Acknowledgements.

We are grateful to Ben DiFrancesco, Matt Solomon, and Soptq for insightful
discussions.

## References

  * (1)
  * Backes et al. (2013) Michael Backes, Aniket Kate, Praveen Manoharan, Sebastian Meiser, and Esfandiar Mohammadi. 2013\.  AnoA: A framework for analyzing anonymous communication protocols. In _2013 IEEE 26th Computer Security Foundations Symposium_. IEEE, 163–178.
  * Beck et al. (2021) Gabrielle Beck, Julia Len, Ian Miers, and Matthew Green. 2021\.  Fuzzy message detection. In _Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security_. 1507–1528.
  * Béres et al. (2021) Ferenc Béres, István A Seres, András A Benczúr, and Mikerah Quintyne-Collins. 2021\.  Blockchain is watching you: Profiling and deanonymizing ethereum users. In _2021 IEEE International Conference on Decentralized Applications and Infrastructures (DAPPS)_. IEEE, 69–78.
  * Buterin et al. (2019) Vitalik Buterin, Eric Conner, Rick Dudley, Matthew Slipper, Ian Norden, and Abdelhamid Bakhta. 2019\.  EIP-1559: Fee market change for ETH 1.0 chain.  _Published online_ (2019).
  * DiFrancesco and Solomon (2021) Benjamin DiFrancesco and Matthew Solomon. 2021.  The Umbra protocol.  _URL: https://github.com/ScopeLift/umbra-protocol_ (2021).
  * Jakkamsetti et al. (2023) Sashidhar Jakkamsetti, Zeyu Liu, and Varun Madathil. 2023\.  Scalable Private Signaling.  _Cryptology ePrint Archive_ (2023).
  * Liu and Tromer (2022) Zeyu Liu and Eran Tromer. 2022.  Oblivious message retrieval. In _Annual International Cryptology Conference_. Springer, 753–783.
  * Liu et al. (2023) Zeyu Liu, Eran Tromer, and Yunhao Wang. 2023.  Group Oblivious Message Retrieval.  _Cryptology ePrint Archive_ (2023).
  * Madathil et al. (2021) Varun Madathil, Alessandra Scafuro, István András Seres, Omer Shlomovits, and Denis Varlakov. 2021\.  Private Signaling.  _IACR Cryptol. ePrint Arch._ 2021 (2021), 853.
  * Möser and Böhme (2017) Malte Möser and Rainer Böhme. 2017.  Anonymous alone? measuring bitcoin’s second-generation anonymization techniques. In _2017 IEEE European Symposium on Security and Privacy Workshops (EuroS &PW)_. IEEE, 32–41.
  * Möser and Narayanan (2022) Malte Möser and Arvind Narayanan. 2022.  Resurrecting address clustering in Bitcoin. In _International Conference on Financial Cryptography and Data Security_. Springer, 386–403.
  * Noether and Noether (2014) Shen Noether and Sarang Noether. 2014.  Monero is not that mysterious.  _Technical report_ (2014).
  * Pertsev et al. (2019) Alexey Pertsev, Roman Semenov, and Roman Storm. 2019\.  Tornado Cash Privacy Solution Version 1.4.  (2019).
  * Ranvier (2015) Justus Ranvier. 2015\.  Bip47: Reusable Payment Codes for Hierarchical Deterministic Wallets.  _https://github.com/bitcoin/bips/blob/master/bip-0047.mediawiki_ (2015).
  * Seres et al. (2022) István András Seres, Balázs Pejó, and Péter Burcsi. 2022.  The Effect of False Positives: Why Fuzzy Message Detection Leads to Fuzzy Privacy Guarantees?. In _International Conference on Financial Cryptography and Data Security_. Springer, 123–148.
  * Todd (2014) Peter Todd. 2014\.  Stealth Addresses. 2014.  _URL: https://lists. linuxfoundation. org/pipermail/bitcoin-dev/2014-January/004020. html (visited on 2017-02-10). APPENDIX Multisignature transactions (←) Overall share (in%)(→) per block 0.2 0.4 0.6 0.8_ 1, 50 (2014), 100.
  * Victor (2020) Friedhelm Victor. 2020\.  Address clustering heuristics for Ethereum. In _Financial Cryptography and Data Security: 24th International Conference, FC 2020, Kota Kinabalu, Malaysia, February 10–14, 2020 Revised Selected Papers 24_. Springer, 617–633.
  * Wahrstätter et al. (2022) Toni Wahrstätter, Matt Solomon, Ben DiFrancesco, and Vitalik Buterin. 2022.  EIP5564: Non-Interactive Stealth Address Generation.  _https://github.com/ethereum/EIPs/blob/master/EIPS/eip-5564.md_ (2022).
  * Wang et al. (2023) Zhipeng Wang, Stefanos Chaliasos, Kaihua Qin, Liyi Zhou, Lifeng Gao, Pascal Berrang, Benjamin Livshits, and Arthur Gervais. 2023\.  On how zero-knowledge proof blockchain mixers improve, and worsen user privacy. In _Proceedings of the ACM Web Conference 2023_. 2022–2032.
  * Williamson (2018) Zachary J Williamson. 2018\.  The aztec protocol.  _URL: https://github. com/AztecProtocol/AZTEC_ (2018).
  * Wood et al. (2014) Gavin Wood et al. 2014\.  Ethereum: A secure decentralised generalised transaction ledger.  _Ethereum project yellow paper_ 151, 2014 (2014), 1–32.
  * Wu et al. (2022) Mike Wu, Will McTighe, Kaili Wang, Istvan A Seres, Nick Bax, Manuel Puebla, Mariano Mendez, Federico Carrone, Tomás De Mattey, Herman O Demaestri, et al. 2022\.  Tutela: An open-source tool for assessing user-privacy on ethereum and tornado cash.  _arXiv preprint arXiv:2201.06811_ (2022).