Privacy tools can hide activity from the public yet still leak it to specific parties. Our five adversary archetypes reveal who can learn what an app promises to hide, and whom users must trust. They assess the live protocol and a released client, using source code, onchain data and observed behaviour.
Each project promises at least one private field: sender, recipient, amount, asset or the link between two actions. We rate that field against each adversary independently and report other exposed fields separately. An adversary is a capability that different people or companies may have.
Ratings
The ratings assume a careful user follows ordinary hygiene and the review’s advice, using settings offered by the assessed client. Each review names at least one client, usually the strongest functional released open-source client available.
- Green: the promised field stays hidden from this adversary.
- Yellow: protection is limited, private use can be denied, or keeping the field hidden takes substantial effort beyond the client’s options. A workaround must preserve ordinary use of the protocol.
- Red: the field is exposed with no reasonable workaround, or no usable, verifiable client supports private use. A custodian who can require disclosure to release funds also earns red.
When privacy depends on hiding among other users, the size of that group (anonymity set) affects the adversary who sees the later action.
Adversaries
- Public observer: reads public transactions and follows explicit links.
- Chain analyst: combines public data to correlate timing, amounts, gas payments and addresses.
- Network observer: sees traffic to third parties, including public RPCs and relayers. An operator’s own services count as the insider.
- Privileged insider: controls or serves part of the system, holds keys or plaintext, custodies funds, or delivers the client.
- Future adversary: archives public data, then runs the known quantum attacks and uses every key they recover. Other schemes stand until an attack on them is known, and the cell names the assumption that remains. Retained logs, insider keys and recorded traffic are outside this scenario.
The public observer, chain analyst and future adversary see the same public data with increasing ability.
Categories
Categories describe how a protocol tries to hide data. Pools, shielded ledgers and anonymous access usually promise to hide a link. Stealth addresses hide a recipient. Confidential amounts hide an amount. A project keeps its category even when it fails that promise.