Monero contributor has opened a pull request that changes how nodes relay transactions coming from Tor and I2P, according to the project's GitHub.
The patch addresses a privacy weakness that could allow an observer to connect a transaction to the anonymity network it came from due to the timing of its broadcast.
The pull request, numbered 11743, was opened on November 13 and is still pending review. It's an alternative to an earlier proposal from November 8, reworked after feedback from another Monero developer.
How does it work?
The issue lies in a mechanism where a node receives a transaction over Tor or I2P and then passes it to the regular Monero network.
Technically, the transaction stays private on its way in, though it's a different story once it reaches public peers.
With the change, a node would only accept Tor and I2P transactions on incoming connections. Transactions arriving on outgoing anonymity connections would simply be ignored.
Accepted transactions would wait for a random delay first. After that, they go through Dandelion++, Monero's existing relay protocol that hides where a transaction started.
The sender also loses one option. Currently, a sender can ask for an immediate broadcast. Under the new rules, nodes ignore that request on Tor and I2P connections, so nobody can skip the delay.
The reason is that timing is one of the easiest ways to trace a transaction. If a transaction shows up on the public network right after it arrives from Tor, an observer watching both sides can link the two.
Not a new idea
The idea itself isn't new: an earlier pull request by vtnerd suggested a similar randomized delay for transactions moving from Tor and I2P to the public network.
Realistically, the change is somewhat small in terms of code, but it closes a gap that matters for users who rely on Tor or I2P to hide their location.
When the patch lands in a release is yet to be confirmed. The PR is also labeled for a backport, so it might reach the current release branch as well.
