Zcash × Nym

Nym dVPN — 2-hop, multiple exits

Distinct WireGuard peers registered at several exits split the sync and broadcasts across exit IPs. Given per-request rotation this restores request-request unlinkability at the destination. Fast, but no mixing — network-observer exposure is unchanged.

✅IP hidden · P1@L2✅Req-unlink · P2@L2❌Local net · P1@L3L❌Global net · P1@L3G✅Fast sync
dVPN (WireGuard)
ClientEntry GWExit AExit BExit Clightwalletd

One client connected to one entry gateway; batches take dVPN routes to different exit gateways, all reaching a single lightwalletd. Most traffic is downloads (blocks: lightwalletd → exit → entry → client) with some uploads (client → entry → exit → lightwalletd).

ClientEntry GWExit GWlightwalletd
dVPN (WireGuard) (no mixing)

Per-actor assessment & trade-offs

L2Compromised lightwalletd✅P1✅P2

Sees

  • Requests from many exit gateways

Can't see

  • Client IP
  • A complete per-client profile (requests split across exits)

Residual / countermeasure

  • P2 holds given per-request exit rotation together with the §5 baseline hygiene (request timing and start-of-sync height can otherwise re-enable linkability). The anonymity set broadens to all clients reaching that lightwalletd via Nym.
L3LLocal network observer

Sees

  • Sync fingerprint (same as single-exit — no cover, timing preserved)
L3GGlobal network observer

Sees

  • End-to-end flow correlation (same as single-exit)

Pros

  • lightwalletd sees traffic from all exit gateways, not the client
  • Fast dVPN compact-block speeds

Cons / mitigations

  • Only useful when many users share the same set of exit gateways

Fit

  • Fast compact-block sync while hiding IP
  • Pair with mixnet broadcast for timing safety (see Recommendation)

Latency model

Regional (40)Continental (120)Intercontinental (300)
Exit A · dVPN (WireGuard)360 ms (3 hops)
Exit B · dVPN (WireGuard)360 ms (3 hops)
Exit C · dVPN (WireGuard)360 ms (3 hops)
Geographic propagation (speed-of-light)
Baseline hygiene applies here tooWhatever the transport, the wallet still owes the same Layer-2 discipline: randomize request times, obfuscate the start height, and never broadcast on reaching the tip.Full detail →

Content from the Nym × Zcash reference doc. Latency figures are an illustrative model (not measured).