#34533 wallet: resubmit transactions with private broadcast if enabled

• Prevent periodic wallet rebroadcasts from leaking transactions over standard connections
• Preserves origin privacy for users who explicitly enable private broadcast

Updates the wallet rebroadcast logic to respect `-privatebroadcast=1`. When enabled, periodic rebroadcasts of unconfirmed wallet transactions use the private broadcast mechanism rather than standard broadcast to all connected peers.

Problem: When `-privatebroadcast` is enabled, transactions initially sent privately can later be leaked over standard broadcast during periodic wallet rebroadcasts (every 12–36 hours), defeating the privacy benefits for users who rely on private broadcast.

P2 · privacy

• P2 because periodic rebroadcasts can deanonymize users who opted into private broadcast
• Prevents unconfirmed transactions from leaking to all peers during resubmission sweeps

Prevents wallet rebroadcasts from deanonymizing users who explicitly enable `-privatebroadcast`. Citing pablomartin4btc: 'This is necessary to support the private transaction broadcast mechanism introduced in #29415 when transactions are rebroadcast or resubmitted'. Because transaction origin privacy is an explicit priority within the wallet domain, fixing this gap is strategically important.

Membership: Modifies transaction resubmission in src/wallet/wallet.cpp.

Factors: security/stability 2, bug 0, performance 0, user value 2, leverage 1

P3 · new feature

• P3 because it routes wallet traffic through existing private broadcast facilities
• P2P wire protocols and core network relay mechanics are unchanged

The PR routes wallet resubmissions through the private broadcast subsystem rather than changing p2p wire protocols or connection mechanisms directly. While necessary for end-to-end privacy across the P2P boundary, the core P2P relay logic is not being changed.

Membership: Tagged with Private Broadcast label; affects how transactions leave the node over p2p network connections.

Factors: security/stability 1, bug 0, performance 0, user value 1, leverage 1

• Needs rebase against master before code review is worthwhile
• Author has been inactive for over four months

The branch has merge conflicts against master and the author has been silent for over 140 days.

Author status: silent since 2026-04-28 (rebased to draft; inactive for >140 days)

Open concerns:

• achow101 pointed out that private broadcast dispatches individual transactions to random peers, which breaks or indefinitely delays rebroadcasting dependent transactions (e.g., CPFP) without package support or mempool synchronization.
• Disagreement on how to handle transactions if the node is restarted with -privatebroadcast disabled (w0xlt noted lack of per-transaction tracking, though agreed to keep it simple).

Resolved concerns:

• Misleading log message printing txid instead of wtxid was addressed in the first commit.

• Concept supported to complete private broadcast coverage for wallet transactions (pablomartin4btc, w0xlt)
• Unaddressed objection: dispatches can split dependent transactions and break CPFP rebroadcasts (achow101)
• Suggested that package private broadcast could address the CPFP rebroadcast failures (andrewtoth)

Concept supported, but achow101 raised blocking concerns regarding CPFP failures without package private broadcast.

Reviewers generally approve the privacy rationale, but achow101 and instagibbs noted that without package relay or coordination between parent and child broadcasts, dependent transactions can get permanently stuck or delayed during rebroadcast. The author acknowledged this issue but has not implemented a resolution.

• pablomartin4btc Concept ACK: 'This is necessary to support the private transaction broadcast mechanism introduced in #29415'
• w0xlt ACKed after discussing per-transaction tracking
• andrewtoth ACKed and suggested #34707 might help handle CPFP failures
• achow101: 'I'm not convinced that this is ready for the wallet until there is support for private broadcasting of packages'
• vasild agreed that CPFP handling is an issue ('Correct. Possible solutions to that...')

Review verdicts (DrahtBot): 0 (+2)

• Stale ACK: w0xlt, andrewtoth
• Concept ACK: pablomartin4btc

File list not available for this run.

PR 34533 ensures that when -privatebroadcast=1 is enabled, periodic wallet transaction rebroadcasts use private broadcast connections instead of broadcasting to all peers. This fixes a privacy leak where privately broadcast transactions are subsequently revealed to all connected peers upon rebroadcast. Reviewers support the privacy motivation, but achow101 raised unresolved concerns that unconfirmed package/CPFP transactions will fail to rebroadcast without package-aware private relay. The PR is currently marked draft, has merge conflicts, and the author has been silent for over 140 days.