Hi all, I’m Kai, an independent developer. I just submitted a ZCG application for Tells: Grant Application - Tells: a privacy checkup for Zcash wallets · Issue #462 · ZcashCommunityGrants/zcashcommunitygrants · GitHub
Tells is a privacy checkup for Zcash wallets. You give it a viewing key, it scans your history on your own machine, and it shows which of your deposits and withdrawals someone watching the chain could link by amount, timing or address reuse. It can also check a withdrawal before you send it and suggest a safer way to make it.
It works today as an open-source TypeScript library, a CLI and a static page:
Try it: Tells: a privacy checkup for Zcash wallets (includes a real testnet wallet scanned with the CLI, every finding linked to its transactions)
Code: GitHub - luoy16002-svg/tells: A privacy checkup for Zcash wallets: finds the round trips, quick exits and fingerprint amounts that link shielded activity, and checks a withdrawal before you make it. · GitHub (MIT)
Two-minute demo: https://youtu.be/hVBEgmB9V_4
The grant ($24,000, four milestones over about four months) would pay for:
- tells-core, a Rust crate with the same rules and test vectors, so wallets built on librustzcash can run the check before they build a transparent or TEX transaction
- scanning in the browser with WebZjs, so nobody needs a terminal
- an integration example in a wallet, reviewed with its maintainers
- counting look-alike deposits as well, a weekly aggregate measure of how linkable pool crossings are on mainnet, and a round of testing with real users
Why I think it matters: Quesnelle (2017) linked 31.5% of the coins entering the shielded pool to later exits by amount and time alone. Wallets warn about transparent addresses in general, but none of them tells you “this withdrawal mirrors the deposit you made an hour ago” before you send it.
I’d like feedback, especially from wallet developers: where in your send flow would a check like this fit, and what would make you trust its warnings?