Transaction schedule

When migration is enabled, a node will send up to 5 transactions for inclusion in each block with height a multiple of 500 (that is, they are sent immediately after seeing a block with height 499, modulo 500). Up to the limit of 5, as many transactions are sent as are needed to migrate the remaining funds (possibly with a remainder less than 0.01 ZEC left unmigrated).

Nodes SHOULD NOT send migration transactions during initial block download, or if the timestamp of the triggering block (with height 499, modulo 500) is more than three hours in the past according to the node's adjusted local clock.

Note: the 500-block interval has not been altered as a result of the halving of target block spacing to 75 seconds with the Blossom upgrade. 5

The migration transactions to be sent in a particular batch can take significant time to generate, and this time depends on the speed of the user's computer. If they were generated only after a block is seen at the target height minus 1, then this could leak information. Therefore, for target height N, implementations SHOULD start generating the transactions at around height N-5 (provided that block's timestamp is not more than three hours in the past). Each migration transaction SHOULD specify an anchor at height N-10 for each Sprout JoinSplit description (and therefore only notes created before this anchor are eligible for migration).

Open questions:

• does this reliably give sufficient time to generate the transactions?
• what happens to a batch if the anchor is invalidated -- should it be regenerated, or cancelled?

How much to send in each transaction

If the remaining amount to be migrated is less than 0.01 ZEC, end the migration.

Otherwise, the amount to send in each transaction is chosen according to the following distribution:

1. Choose an integer exponent uniformly in the range 6 to 8 inclusive.
2. Choose an integer mantissa uniformly in the range 1 to 99 inclusive.
3. Calculate amount := (mantissa * 10^exponent) zatoshi.
4. If amount is greater than the amount remaining to send, repeat from step 1.

Implementations MAY optimize this procedure by selecting the exponent and mantissa based on the amount remaining to avoid repetition, but the resulting distribution MUST be identical.

The amount chosen includes the 0.0001 ZEC fee for this transaction, i.e. the value of the Sapling output will be 0.0001 ZEC less.

Other design decisions

We assume use of the normal wallet note selection algorithm and change handling. Change is sent back to the default address, which is the z-address of the first selected Sprout note. The number of JoinSplits will therefore be the same as for a normal transaction sending the same amount with the same wallet state. Only the vpub_new of the last JoinSplit will be nonzero. There will always be exactly one Sapling Output.

The expiry delta for migration transactions MUST be 450 blocks. Since these transactions are sent when the block height is 499 modulo 500, their expiry height will be 451 blocks later, i.e. nExpiryHeight will be 450 modulo 500.

The fee for each migration transaction MUST be 0.0001 ZEC. This fee is taken from the funds to be migrated.

Some wallets by default add a "developer fee" to each transaction, directed to the developer(s) of the wallet. This is typically implemented by adding the developer address as an explicit output, so if migration transactions are generated internally by zcashd, they will not include the developer fee. We strongly recommend not patching the zcashd code to add the developer fee output to migration transactions, because doing so partitions the anonymity set between users of that wallet and other users.

There MUST NOT be any transparent inputs or outputs, or Sapling Spends, in a migration transaction.

The lock_time field MUST be set to 0 (unused).

When creating Sapling shielded Outputs, the outgoing viewing key ovk SHOULD be chosen in the same way as for a transfer sent from a t-address.

A node SHOULD treat migration transactions in the same way as transactions submitted over the RPC interface.

Open questions

The above strategy has several "magic number" parameters:

• the interval between batches (500 blocks)
• the maximum number of transactions in a batch (5)
• the distribution of exponents (uniform integer in 6..8)
• the distribution of mantissae (uniform integer in 1..99).

These have been chosen by guesswork. Should we change any of them?

In particular, if the amount to migrate is large, then this strategy can result in fairly large amounts (up to 99 ZEC, worth USD ~6700 at time of writing) transferred in each transaction. This leaks the fact that the transaction was sent by a user who has at least that amount.

The strategy does not migrate any remaining fractional amount less than 0.01 ZEC (worth USD ~0.68 at time of writing). Is this reasonable?

In deciding the amount to send in each transaction, the strategy does not take account of the values of individual Sprout notes, only the total amount remaining to migrate. Can a strategy that is sensitive to individual note values improve privacy?

An adversary may attempt to interfere with the view of the block chain seen by a subset of nodes that are performing migrations, in order to cause those nodes to send migration batches at a different time, so that they may be distinguished. Is there anything further we can do to mitigate this vulnerability?

RPC calls

Nodes MUST maintain a boolean state variable during their execution, to determine whether migration is enabled. The default when a node starts, is set by a configuration option:

-migration=0/1

The destination z-address can optionally be set by another option:

-migrationdestaddress=<zaddr>

If this option is not present then the migration destination address is the address for Sapling account 0, with the default diversifier 3.

The state variable can also be set for a running node using the following RPC method:

z_setmigration true/false

It is intentional that the only option associated with the migration is the destination z-address. Other options could potentially distinguish users.

Nodes MUST also support the following RPC call to return the current status of the migration:

z_getmigrationstatus

Returns:

{
  "enabled": true|false,
  "destination_address": "zaddr",
  "unmigrated_amount": nnn.n,
  "unfinalized_migrated_amount": nnn.n,
  "finalized_migrated_amount": nnn.n,
  "finalized_migration_transactions": nnn,
  "time_started": ttt, // Unix timestamp
  "migration_txids": [txids]
}

The destination_address field MAY be omitted if the -migrationaddress parameter is not set and no default address has yet been generated.

The values of unmigrated_amount and migrated_amount MUST take into account failed transactions, that were not mined within their expiration height.

The values of unfinalized_migrated_amount and finalized_migrated_amount are the total amounts sent to the Sapling destination address in migration transactions, excluding fees.

migration_txids is a list of strings representing transaction IDs of all known migration transactions involving this wallet, as lowercase hexadecimal in RPC byte order. A given transaction is defined as a migration transaction iff it has:

• one or more Sprout JoinSplits with nonzero vpub_new field; and
• no Sapling Spends, and;
• one or more Sapling Outputs.

Note: it is possible that manually created transactions involving this wallet will be recognized as migration transactions and included in migration_txids.

The value of time_started is the earliest Unix timestamp of any known migration transaction involving this wallet; if there is no such transaction, then the field is absent.

A transaction is finalized iff it has at least 10 confirmations. TODO: subject to change, if the recommended number of confirmations changes.