I know Blocksci is no longer in active development, but while reading some documentation on identifying change addresses, I found the following:
change.locktime = <blocksci.heuristics.change.ChangeHeuristic object>
Bitcoin Core sets the locktime to the current block height to prevent fee sniping.
If an output has been spent and it matches this transaction’s locktime behavior, it is
possibly the change output. (This heuristic will return unspent outputs as potential
candidates.)
Source: https://citp.github.io/BlockSci/reference/heuristics/change.html#blocksci.heuristics.change.power_of_ten_value
From what I understand, the lock time is usually set to current block + 1 to prevent fee sniping attacks, where miners do this by re-mining the current block but with a higher fee transaction.
However, I’m having a hard time understanding how Blocksci ties the lock time to whether the address has changed or not. If the transaction lock time is 100,000 and one specific output also has a lock time of 100,000, does that mean it could be a change output? But why? If you have a change result you may not want to use immediately, why would the lock time be the same as the initial transaction?