But, isn't remixing supposed to not merge inputs and outputs? If I am known to own 10 / 100 inputs of a coinjoin, and after the coinjoin, I use these coinjoined inputs for the next round, essentially merging the outputs into one, then you can make out the owner.
With WabiSabi, it isn't known how many inputs of a coinjoin you control. Since input consolidation is private, you could own 1 input, or your could own 10 inputs, there's no way to tell.
In this Sparrow coinjoin[1], on the other hand, while there are remixes, you cannot tell who's who, because there are no input and output collaborations.
Sparrow coinjoins can be tracked if postmix UTXOs are merged since you can link a single participant to multiple rounds:
The first is the fee to Whirlpool itself, which is a flat fee depending on the pool you are joining.
The flat pool entry fee structure is designed to incentivize worst privacy practices. Since fees are not collected directly based on volume, it is cheaper to participate in a smaller pool and create more outputs than participate in a larger pool and create less outputs. Additionally, it incentivizes revealing common inputs ownership of premix UTXOs since it is cheaper to consolidate them to enter the pool once than to enter the pool with each UTXO individually. Samourai has never explained why they purposely chose a fee structure that heavily penalizes the most private usage of their protocol.
Because of this backwards design, you can easily link premix inputs to postmix outputs in many cases. Notice how this Whirlpool tx0 premix creates 70 outputs for 0.05 BTC -
https://mempool.space/tx/63679c9ec82f246811acbab0c04cc0fc77ba050e1b6c23661d78afcfc13cf8aaNotice how every single input of this Whirlpool exit transaction is a direct descendant of rounds created by the aforementioned premix transaction:
https://mempool.space/tx/ce2f84f7c5ff74fb1da103acb7b279bd34f02f5e9e3a2e1b6417ce8b9b7392dbWhen many inputs used in the postmix exit transaction are created directly from a round that the premix transaction entered, it makes it trivial to trace the user through Whirlpool. Fortunately, the user abandoned Whirlpool and upgraded to using the WabiSabi coinjoin protocol instead, which made him completely untraceable:
https://mempool.space/address/bc1qjjw5gaglkycu2lm5fskl7qhktk0hec4a5me3daAs you can see, the user mixed with both Whirlpool and WabiSabi, but only WabiSabi made him untraceable.
You are wrong, a mixer is a trusted third party, they do not provide you privacy.
Disprove my claim by de-anonymizing this 0.001 BTC Mixtum deposit:
https://mempool.space/tx/a2415334ad8b4f5d6e20175772f00a216cc889e8d5e0c972ec5ac216f18b0f06. If you can't, then I have successfully made myself untraceable to you, and therefore gained some privacy.
[1]
https://kycp.org/#/0db15af0cad74e54f5dcbdd6809806ec2b25f20642ac5e9f1e513198240264c1[/quote]
If you deposited to Coinbase you would have gained the same privacy from me, you trusting someone else with that information is not a solution.