Recommended Architecture for Native App Wallets

An IPR session per request, or to an SP-integrated lightwalletd where available. This is what protects broadcast timing against network observers (L3L/L3G) and gives per-request unlinkability at the destination.

Bulk, bandwidth-bound sync over the fast dVPN, ideally with exit rotation per request. Hides the client IP from the destination.

Decorrelate broadcast times from sync milestones and never broadcast on reaching the tip. This is a V2 (timing) countermeasure against the destination (L2): the mixnet shapes packet timing in transit, but the destination still sees the broadcast's wall-clock arrival time, so only the wallet can fix it.

Start a random number of blocks before the true resume point (or snap the start down to a standard checkpoint). This is a V3 (content / start-height) countermeasure against the destination (L2); it costs only re-downloaded blocks.

Access to the Nym network — in both dVPN and mixnet mode — requires NYM for bandwidth credentials. Acquire NYM ahead of time, e.g. swap ZEC for NYM with Nym’s swap API (https://swap.nym.com/).

Since the linking key is the start height (V3, content), it is enough to obfuscate the start. Both approaches cost only re-downloaded blocks and work in every configuration.

• Randomized overlap: start a random number of blocks before the true resume point, re-fetching blocks already held, so starts stop being exact pointers to previous ends and chaining degrades to approximate, deniable joins.
• Checkpoint snapping: round the start down to a standard checkpoint (an absolute height), so every client whose previous sync ended in the same checkpoint interval emits an identical start — the collision window grows from one block interval to the checkpoint spacing.

Broadcast timing is a V2 (timing) leak at the destination. In-transit mixing does not remove it — the destination still observes wall-clock arrival time — so the wallet must decorrelate broadcasts itself.

• Never send a broadcast over the sync transport or session.
• Decorrelate broadcast times from sync milestones — in particular, do not broadcast immediately upon reaching the tip.
• Use a randomized timer for broadcasts (the note's Defense B for migration rounds), extended to every broadcast.
• Destination splitting: sync from one lightwalletd and broadcast through another.

How aggressively to obfuscate the start is a design choice with a clear qualitative shape but no settled numbers. A larger overlap, or a wider checkpoint spacing, widens the collision window — and therefore the anonymity set of clients emitting an indistinguishable start — at the cost of more re-downloaded blocks. Both approaches cost only re-downloaded blocks and apply in every configuration.

• Trade-off: wider overlap / spacing ⇒ larger anonymity set, but more wasteful re-download.
• Open question: how to set the overlap distribution or the checkpoint spacing, and what each buys quantitatively in terms of anonymity-set size, is left open by the source note — presented here without fixed values.