Recommended Architecture for Native App Wallets

An IPR session per request, or to an SP-integrated lightwalletd where available. This is what protects broadcast timing against network observers (L3L/L3G) and gives per-request unlinkability at the destination.

Bulk, bandwidth-bound sync over the fast dVPN, ideally with exit rotation per request. Hides the client IP from the destination.

Decorrelate broadcast times from sync milestones and never broadcast on reaching the tip. This is a V2 (timing) countermeasure against the destination (L2): the mixnet shapes packet timing in transit, but the destination still sees the broadcast's wall-clock arrival time, so only the wallet can fix it.

Round each requested range's start down, and its end up, to grid multiples, so every wallet resuming in the same cell emits an identical request. This is a V3 (content / start-height) countermeasure against the destination (L2); it costs only re-downloaded cover blocks.

Access to the Nym network — in both dVPN and mixnet mode — requires NYM for bandwidth credentials. Acquire NYM ahead of time, e.g. swap ZEC for NYM with Nym’s swap API (https://swap.nym.com/).

Since the linking key is the requested range (V3, content), above all its start height, the fix is to make ranges collide: quantize every requested range to a network-wide grid, so that every client resuming anywhere in the same grid cell emits exactly the same request.

• Grid snapping: round the range start down, and its end up, to multiples of a standard grid spacing (absolute heights). The spacing scales with the range length on the ladder S_j = 144·2^j, never below one day of blocks (1152), so the collision window grows from one block interval to at least a day.
• Deterministic emission: the quantized range goes on the wire as ascending, disjoint grid cells, with no random sizes, no overlap, no shuffling. Every wallet in the cell says exactly the same thing; per-wallet variation inside a collision set is a distinguishing dimension, not protection.

The cost is re-downloaded cover blocks only: for catch-ups above a day, typically 1.5x to 2x the blocks actually needed, never more than 3x; below a day the cost is bounded in absolute terms, at most one grid cell (~0.5 MB of compact blocks).

Broadcast timing is a V2 (timing) leak at the destination. In-transit mixing does not remove it (the destination still observes wall-clock arrival time), so the wallet must decorrelate broadcasts itself.

• Never send a broadcast over the sync transport or session.
• Decorrelate broadcast times from sync milestones; in particular, do not broadcast immediately upon reaching the tip.
• Use a randomized timer for broadcasts.
• Destination splitting: sync from one lightwalletd and broadcast through another.
• Build the transaction when the timer fires, with expiry derived from a tip fetched at that moment: a transaction's expiry height is visible on-chain to everyone (V3), and an expiry derived from a stale tip reveals the wallet's last sync height.

The parameters are part of the protocol, not per-wallet tuning: the mechanism works by every wallet emitting the identical rule.

• Defaults: the grid parameters (ladder S_j = 144·2^j, one-day floor of 1152 blocks) nest with ZIP 318's 144-block anchor grid, and the broadcast delays (exponential, mean 144 blocks, capped at 576 blocks) are ZIP 318's transfer-scheduling parameters, so wallet broadcasts pool with migration traffic. A wallet that customises its grid floor, split rule, or delay distribution becomes recognisably different from the rest of the crowd.
• Anonymity sets: anonymity by collision is only as strong as the crowd that collides. The size of the collision sets grows with the number of wallets emitting the identical rule.