Would you do a coinjoin if you had a 50-50 chance of winning a small sum from the person with whom you were coinjoining?

Here, waxwing describes a method of using Bitcoin script to give transaction participants even odds of winning a small sum from each other. You could see a world where coinjoining could be kind of fun, and hey, maybe you win something (plus you get privacy)!

See his nostr note for details:

Nothing about the two transactions shown is strange. The first is 2 in 2 out, the second is 1 in, 2 out; normal payments [1]. If you examine their witness you'll see they're like 90% of other taproot transactions, just keypath, no scripts involved.

But in fact, this is a bet. Two parties flipped a fair coin for the winnings (a small chunk of the input funds). Not literally; they used cryptography to get an exactly 50% chance of winning without having to trust the other. They were both running signet nodes (in fact I had one on my laptop at home and another on a VPS), and used decoy packets in BIP324 (bitcoin p2p encrypted transport) to communicate, so no one could even know the negotiation was happening (side note: this idea feels like it should be useful in many other contexts, and it's surprisingly easy to set up, with a very simple patch to your bitcoind).

So we have a fair bet inside a coinjoin; you could think of it as a randomized payjoin if you like, but, the transfer of funds is not for some goods and services but, just a wager, and it's perfectly fair because of a cryptographic trick that was discussed on delving [2] though it's changed from what was written there.

Payments inside coinjoins break subset sum analysis; this is just another kind of payment. Amongst other virtues of such a system is that it creates economic activity between peers without middlemen which is vital to Bitcoin's general pseudonymity.

The implementation is at https://github.com/AdamISZ/babilonia . The repo is currently 95% AI-written so not very readable (still not unreadable, but, y'know how it is) but I have a paper that I've nearly finished that is human written and human readable for those interested in the mechanics.

[1] In fact those familiar with details of payjoins will see something specific about the 1st transaction that makes it like a payjoin. But it isn't hard to remove that, and anyway, it's only a watermark for 'this is a payjoin', not for what it actually is...

[2] https://delvingbitcoin.org/t/emulating-op-rand/1409/7