Zodl Adopts Oblivious HTTP to Combat Offchain Metadata Leaks in Zcash Wallets

Crypto privacy tools have long focused on obscuring financial activity onchain, yet identifying information can still leak around these transactions offchain. However, this critical vulnerability is beginning to receive renewed attention across the digital asset industry.

The team behind Zodl, a Zcash wallet formerly known as Zashi, has begun rolling out an update that transitions users to its own proprietary wallet servers. These servers are engineered so that a user’s Internet Protocol (IP) address and wallet requests never end up in the possession of the same operator. This privacy-enhancing feature arrives with the release of Zodl version 3.20.0 and requires no additional configuration from the user.

This shift marks a notable evolution in mobile wallet design. When Zashi’s private swaps were analyzed a year ago, its built-in Tor client was offered as an opt-in extra. While undeniably handy, network-level protection was treated as an optional setting rather than a baseline standard. Zodl’s new architecture flips this paradigm, making privacy the default starting point for all network interactions.

Understanding this development requires looking at the broader industry efforts currently underway to curb metadata leakage, which has quietly undermined blockchain privacy for years.

Nice IP Address You Have There

Mobile wallets are typically light wallets, meaning they do not store a full copy of the blockchain. Instead, they rely on a remote server to fetch data and broadcast transactions. Consequently, that server can easily log a user’s IP address, the specific data requested, and the exact timestamp of the query.

Within the Zcash ecosystem, this operational role typically falls to lightwalletd servers. Even when a user’s ZEC is fully shielded and encrypted onchain, connection patterns can still provide savvy observers with enough metadata to sketch out user identities and track behavioral patterns.

This risk is far from theoretical. In 2023, developer b10c documented an entity known as LinkingLion that systematically monitored which Bitcoin nodes announced new transactions first. That privileged vantage point potentially allowed the entity or group to link fresh Bitcoin transactions directly to the IP addresses behind them. Because LinkingLion showed signs of activity stretching back to 2018, the entity may have accumulated years of behavioral insights.

This kind of metadata tracking is not isolated to a single blockchain and has been applied broadly across the crypto landscape, including privacy-focused projects. For instance, b10c observed the same LinkingLion IP ranges connecting to Monero nodes as well.

Addressing these vulnerabilities requires a fundamental redesign of the infrastructure surrounding transactions. Zodl’s new wallet servers represent a tangible step forward in altering this underlying plumbing.

How Zodl’s New Servers Work

Previously, Zodl users seeking to protect their metadata faced a binary choice: manually enable Tor or simply trust the server operator to handle data responsibly.

The newly unveiled architecture addresses this by implementing Oblivious HTTP, an Internet Engineering Task Force (IETF) standard that splits a single communication exchange across two separate parties so that neither entity sees the full picture.

Under this operational flow, the wallet first seals each request with encryption that only Zodl’s gateway server can decrypt. This sealed request is then routed through an independent relay operated by infrastructure giants such as Cloudflare or Fastly. The relay strips away identifying information before handing the request onward, meaning the relay registers the user’s IP address but can never read the contents of the request.

Finally, Zodl’s gateway is the only entity that unseals the request before passing it along to lightwalletd. While Zodl learns the nature of the data being requested, the only address it observes is that of the relay. Put simply, Cloudflare or Fastly learns who is asking, and Zodl learns what is being asked, but neither party learns both pieces of information.

The open-source code supporting this system also incorporates additional defensive mechanisms, including size padding and unmatchable logs. Outgoing requests are padded up to fixed sizes, with transaction broadcasts rounded up to 16 kilobytes or more, while sensitive responses receive the same treatment to prevent traffic volume from revealing the nature of the fetched data.

Furthermore, system logs are structured to prevent correlation. The request IDs generated by the relay never land in Zodl’s logs in raw form. Instead, they are stored as cryptographic fingerprints generated via keyed-hash message authentication codes (HMACs) under a secret held strictly in volatile memory. This secret disappears whenever the gateway restarts, ensuring that nobody can later correlate Zodl’s logs against the records held by the relay.

Because this code is newly deployed, Zodl is phasing the servers in gradually over several days, meaning the feature is not yet live for all users. Nevertheless, its arrival signals a departure from the reigning metadata status quo in consumer crypto applications.

Trust Doesn’t Vanish

The fundamental compromise of Oblivious HTTP is that it only protects user privacy so long as the relay operator and Zodl do not collude. The relay also retains visibility into the timing of connections and the approximate volume of data moving through its infrastructure, even if the payload itself remains encrypted.

Discussing these trade-offs on the Zcash community forum, a critic argued that the launch framing overstated the system’s resilience. Because Cloudflare and Fastly are U.S.-based companies subject to domestic legal processes, the critic warned that the system could foster a false sense of security among users.

In response, Zodl contributor y4ss acknowledged the point, describing Oblivious HTTP as a better default setting rather than a complete substitute for anonymity networks like Tor or Nym when facing a sophisticated state adversary.

As y4ss noted earlier in the discussion, users whose threat models include aggressive legal pressure on infrastructure providers retain the option to stack Zodl’s built-in Tor support on top of the new system. In such configurations, the relay observes only a Tor exit node rather than the user’s actual network identity.

The primary victory of this implementation lies in its status as a default setting. When Ethereum’s Kohaku wallet was introduced, developers cheered a future where privacy features come built in rather than serving as an opt-in user experience encumbrance. Zodl has now shipped a practical version of this philosophy for network metadata, and because Oblivious HTTP adds only a single relay hop, it is lightweight enough to run continuously for all users.

Industry-Wide Push Against Metadata Leaks

Zodl’s architectural update arrives amid a broader, ecosystem-wide campaign to mitigate metadata leaks, with various development teams pursuing distinct technological solutions.

The most resource-intensive solutions currently deployed are mixnets. A mixnet shuffles traffic through multiple sequential relays, pads every packet to a uniform size, and injects decoy messages to prevent observers from correlating entry and exit traffic patterns.

Two Zcash wallets already integrate a mixnet developed by the Nym privacy network. Zingo offers it as an optional toggle, while Zkool allows users to route traffic to any Zcash node through the mixnet. Nym representatives have indicated ongoing discussions with the Zodl team regarding potential integration, and the project recently unveiled a software development kit designed to bring its mixnet to a wider array of wallets and decentralized applications. However, this robust privacy comes with a performance trade-off, as the routing process introduces latency.

Within the Ethereum ecosystem, the Ethereum Foundation’s Kohaku privacy wallet project has prioritized IP and remote procedure call (RPC) leak protection from its inception. A new Kohaku command-line tool routes all traffic except direct RPC calls through Tor by default, leaving Ethereum RPC traffic on the clearnet under the assumption that advanced users are operating their own nodes.

Simultaneously, an Ethereum Foundation proposal introduced in June provides wallets with a standardized mechanism to integrate anonymizing networks of their choice. Implementations utilizing Tor and Nym are already live on the mainnet, and the Privacy Pools version 2 web application has adopted the framework, allowing users to route RPC traffic through Tor simply by flipping a settings toggle.

Flashbots has also entered the privacy arena with the introduction of Flashnet, a research design aimed at anonymous transaction submission on Ethereum. The conceptual framework involves users submitting messages into random slots of a shared batch and splitting those messages into cryptographic pieces distributed across a network of servers. Reassembling the pieces reconstructs the batch without tying any individual message to its sender, offering an alternative that seeks to avoid the performance lag of mixnets and the weaker protections of traditional Tor setups.

In the Bitcoin ecosystem, core developers have likewise targeted the exact timing of transaction broadcasts. Bitcoin Core 31.0 introduced an opt-in private broadcast option that routes user transactions exclusively over Tor or I2P, ensuring that transaction recipients never learn the sender’s IP address. Each transaction is assigned a separate network connection to prevent multiple transactions from being linked together by an observer.

While this mechanism directly addresses the surveillance methods historically employed by entities like LinkingLion, it remains subject to ongoing battle-testing. Developers recently disclosed a bug that could inadvertently expose a Bitcoin sender’s IP address if a failed handshake forced a node to retry a broadcast without Tor, a vulnerability that was promptly patched in subsequent releases.

Whether Oblivious HTTP constitutes robust privacy depends entirely on the threat model. Against a resourceful state adversary, it is insufficient on its own—a limitation acknowledged by its developers. However, privacy defaults that require zero user setup reach the broadest possible audience, raising the baseline privacy floor across the entire consumer base.

An intriguing point of discussion remains the industry’s reliance on centralized cloud infrastructure. While Ethereum’s anon-rpc framework treats reliance on cloud-backed gateways, including Cloudflare, as an architectural vulnerability due to the potential for censorship or surveillance, Zodl leverages Cloudflare as a core component of its privacy-preserving split.

These divergent designs ultimately guard against different risks, with Oblivious HTTP focusing on limiting data collection and anon-rpc remaining wary of service interruption. Zodl also preserves user choice by allowing individuals to switch to community-operated servers within its advanced settings. Nevertheless, as crypto privacy defaults increasingly rely on a handful of major infrastructure providers, observers will continue to monitor this dependency vector.

As other wallet providers evaluate their own architectural roadmaps, the direction of travel across the digital asset industry appears increasingly unified. The battle for user privacy has officially expanded to the network layer, marking a critical evolution for decentralized finance.