What information can be reversed engineered from the StateRef's received by a non-validating notary?

Question

A non-validating notary receives inputs in the form of Corda StateRefs. What information can be reversed engineered from a StateRef and what additional information would an attacker need to be successful in doing so?

Answer 1

You can deduce the following information from a StateRef:

• That the transaction with identifier StateRef.id has at least StateRef.index outputs
• That all the StateRefs with the same StateRef.id were produced by the same transaction