Say Alice wants to send 2 Grin to Bob.
A simple transaction looks like the following. Alice spends a 5 Grin output, Bob receives 2 Grin and Alice receives 3 Grin in change.
5 Grin -> 2 Grin 3 Grin
Even with hidden values the structure leaks “direction” with one output presumably a “change” output.
Alice has ownership of the spent output and the new change output and further analysis may reveal this shared ownership.
If the change output is identified then the direction of flow of value is also known based on the other output.
Thinking about “payment channels” got me wondering if we could make a relatively small adjustment to the structure of the transaction.
Bob (recipient) provides an additional output to be spent and consolidated with the new output. Alice receives change as before.
5 Grin -> 3 Grin 1 Grin 3 Grin
Bob receives 2 Grin as before but consolidated with an additional spent output.
This new transaction no longer leaks any information about “direction” and we cannot infer anything about who paid who.
Alice and Bob both spend a single output and receive a single output in return.
If this was in fact reversed and Bob were paying Alice the structure (and ownership of inputs and outputs) of the transaction would be identical.
This is conceptually similar to a “payment channel” being funded and subsequently closed.
Note: This is not a payment channel and is simply a single transaction.
Then I read about PayJoin and P2EP and it clicked that this is exactly the same thing.
tl;dr PayJoin is a limited form of CoinJoin with only two participants.
What would be involved in supporting this in Grin?
We already need both parties to interact to build the transaction via a shared slate.
It does not appear to be a significant change to the process if we were to allow Bob to (optionally) add this additional input.
This would result in a minimal increase in the size of a transaction (one additional input) and in fact a reduction in the transaction fee due to output consolidation.
Is there any reason Bob would not want to consolidate with an existing output (assuming this was not done naively)?
I’m not aware of this being discussed previously in the context of Grin/MW, but could be mistaken.