One of the most challenging parts of making an anonymous currency is dealing with change. After Darksend completes mixing on multiple sessions, a user has anonymous funds, but it's possible that after a purchase the change from a purchase could be recombined with that users funds. This is a type of linkage called "forward linking". In the real world when you buy something from a merchant, you would give $100 to the merchant, then the merchant would provide you $4 in change. In the world of crypto, that $100 is split into $96 and $4. Afterward, you can always see they were once the same $100. So what if you could make a crypto-currency that pays change just like the real world? Change Contracts User A wants to buy a laptop from Merchant B for $96 (in dollars to make it easier). 1: User (A) publishes a message to Merchant (B), saying I'll pay you $100 if you pay me back $4 2: (B) signs this message, returning it to (A). This is the contract. 3: A makes TX1 (pay $100 to B, only good if B pays A). A provides TX1 to B 4. B makes TX2 (pay $4 to A, only if A pays B). B provides TX2 to A 5. A & B make TX3 (A pays B $96) and TX4 (B pays A $4) 6. A & B publish TX3 & TX4 If TX3 & TX4 are both published, then the change went through. If either is not published A or B can publish TX1 or TX2 to ensure they receive the money. TX1 & TX2 will link the payments from the CScript, so this is not ideal. But it ensures the system remain trustless. With change contracts, you'll receive money in change that has absolutely no relationship to the money you paid. This will be done in two separate, unlinkable transactions. Due to this happening regularly on the network, a high quality mixing of funds will take place, making it much like traditional cash. This will be done at a protocol level, almost completely automatically. As a merchant, You'll receive "change contracts" and approve them, this will complete steps 1 to 4 automatically. However, once you sign and publish TX1 and TX2, there is no way to back out, so a merchant must make sure the payment is correct for the mechanize being purchased. After all is said and done, this is akin to a vendor paying you change from their drawer. Surely a huge improvement in the anonymity of Darkcoin. Thanks to UdjinM6 for helping out with the concept!