Some users of the Ethereum mixer Tornado Cash are accidentally blowing their cover, according to new research

Some users of Tornado Cash — an Ethereum-based mixer that uses zero-knowledge proofs to let users withdraw funds anonymously — are apparently mishandling the tool and thus risk revealing their identities, according to new research.

Tornado Cash, which launched in August 2019, features four mixer contracts. Each lets users deposit a fixed amount — 0.1 ETH, 1ETH, 10 ETH or 100 ETH — along with a pool of other users who have deposited the same amount. When a user withdraws their assets, the protocol is supposed to make it impossible to link their withdrawal address to the one they used for the deposit. In theory, this leaves their identity indistinguishable from others in the pool who have not yet withdrawn their funds.

But the authors of the new study —  a group of university and industry researchers based in Hungary and Canada — say Tornado Cash users are mishandling the system in various ways that compromise the anonymity the system is designed to achieve. 

The researchers collected all the addresses that made deposits and withdrawals using Tornado Cash as of April 2020. By exploiting apparently careless mistakes by users, they were able to link almost 400 withdrawals — out of a total of around 3,000 total withdrawals — back to specific deposits.

The most common error that Tornado Cash users end up making is simple: they apply the same address for deposits and withdrawals. Not only does this reveal a link between that particular user's deposit and withdrawal, the paper said, but it could also undermine the privacy of other users in the mixer since it cuts down the number of anonymous deposits. 

The researchers also found that many users are making transactions between their own addresses or using the same address to withdraw multiple deposits. In fact, approximately 33% of withdrawals from the 0.1 ETH mixer contract used the same address for more than one withdrawal, they found. 

The mistakes didn't stop there. The study's authors observed that most users left their deposits in the mixer contracts for less than a day, which makes it easier for outside observers to infer identities because they can anticipate when certain deposits will be withdrawn.

Attackers can also use gas prices to pair up a deposit and a withdrawal, the researchers found. Since wallets like Metamask automatically set gas prices as multiples of Gwei, if a deposit and a withdrawal both have the same gas price that is not an integer number of Gwei, it is likely that they are manually set by the same user.

Testing the limits?

Tornado Cash's cofounder Roman Storm suspects that there may be a different explanation than users simply making careless mistakes: most of the transactions that share the same address for withdrawals and deposits could be test transactions rather than actual usage, he said. 

But the degree to which the transactions reflect testing efforts versus serious usage is hard to discern, according to the paper's coauthor Mikerah Quintyne-Collins, who is also the founder of Toronto-based blockchain privacy R&D startup HashCloak. "That being said, even if these were test transactions, they affect the anonymity set of the mixer for others."

Testers should take the necessary steps to protect their fellow users by making sure that they don't reuse the same withdrawal address or remove their assets too quickly, she said. This way, they avoid further contaminating the ETH pool by introducing more withdrawals that could be easily deanonymized.

Roman also noted that such vulnerabilities could become less severe once Tornado Cash attracts more users because it will be harder to link withdrawals to past deposits as the number of active deposits increases. 

According to data provided by Dune Analytics, there have been a total of 4,868 deposits and 4,228 withdrawals for all four contracts since the beginning of this year. At the time of writing, there are 3,312; 1,834; 1,632 and 464 active user deposits in the four mixers, respectively, Tornado Cash's website shows.

However, Quintyne-Collins stressed this would depend on whether the new users are able to apply the tool properly. “As the anonymity set of the mixer is based on everyone's behavior, if other people are misusing the mixer, then you still encounter the same problems as brought forth in the paper,” she said.