Introduce a subaddress capable scanner type

coins/monero/src/wallet/address.rs

@@ -4,15 +4,10 @@ use thiserror::Error;
 
 use zeroize::Zeroize;
 
-use curve25519_dalek::{
-  constants::ED25519_BASEPOINT_TABLE,
-  edwards::{EdwardsPoint, CompressedEdwardsY},
-};
+use curve25519_dalek::edwards::{EdwardsPoint, CompressedEdwardsY};
 
 use base58_monero::base58::{encode_check, decode_check};
 
-use crate::wallet::ViewPair;
-
 #[derive(Clone, Copy, PartialEq, Eq, Debug, Zeroize)]
 pub enum Network {
   Mainnet,
@@ -130,16 +125,6 @@ pub struct Address {
   pub view: EdwardsPoint,
 }
 
-impl ViewPair {
-  pub fn address(&self, network: Network, kind: AddressType) -> Address {
-    Address {
-      meta: AddressMeta { network, kind },
-      spend: self.spend,
-      view: &self.view * &ED25519_BASEPOINT_TABLE,
-    }
-  }
-}
-
 impl ToString for Address {
   fn to_string(&self) -> String {
     let mut data = vec![self.meta.to_byte()];

coins/monero/src/wallet/mod.rs

@@ -1,6 +1,12 @@
+use std::collections::HashMap;
+
 use zeroize::{Zeroize, ZeroizeOnDrop};
 
-use curve25519_dalek::{scalar::Scalar, edwards::EdwardsPoint};
+use curve25519_dalek::{
+  constants::ED25519_BASEPOINT_TABLE,
+  scalar::Scalar,
+  edwards::{EdwardsPoint, CompressedEdwardsY},
+};
 
 use crate::{hash, hash_to_scalar, serialize::write_varint, transaction::Input};
 
@@ -8,6 +14,7 @@ mod extra;
 pub(crate) use extra::{PaymentId, ExtraField, Extra};
 
 pub mod address;
+use address::{Network, AddressType, AddressMeta, Address};
 
 mod scan;
 pub use scan::SpendableOutput;
@@ -87,6 +94,101 @@ pub(crate) fn commitment_mask(shared_key: Scalar) -> Scalar {
 
 #[derive(Clone, Zeroize, ZeroizeOnDrop)]
 pub struct ViewPair {
-  pub spend: EdwardsPoint,
-  pub view: Scalar,
+  spend: EdwardsPoint,
+  view: Scalar,
+}
+
+impl ViewPair {
+  pub fn new(spend: EdwardsPoint, view: Scalar) -> ViewPair {
+    ViewPair { spend, view }
+  }
+
+  pub(crate) fn subaddress(&self, index: (u32, u32)) -> Scalar {
+    if index == (0, 0) {
+      return Scalar::zero();
+    }
+
+    hash_to_scalar(
+      &[
+        b"SubAddr\0".as_ref(),
+        &self.view.to_bytes(),
+        &index.0.to_le_bytes(),
+        &index.1.to_le_bytes(),
+      ]
+      .concat(),
+    )
+  }
+}
+
+#[derive(Clone)]
+pub struct Scanner {
+  pair: ViewPair,
+  network: Network,
+  guaranteed: bool,
+  pub(crate) subaddresses: HashMap<CompressedEdwardsY, (u32, u32)>,
+}
+
+impl Zeroize for Scanner {
+  fn zeroize(&mut self) {
+    self.pair.zeroize();
+    self.network.zeroize();
+    self.guaranteed.zeroize();
+    for (mut key, mut value) in self.subaddresses.drain() {
+      key.zeroize();
+      value.zeroize();
+    }
+  }
+}
+
+impl Drop for Scanner {
+  fn drop(&mut self) {
+    self.zeroize();
+  }
+}
+
+impl ZeroizeOnDrop for Scanner {}
+
+impl Scanner {
+  pub fn from_view(pair: ViewPair, network: Network, guaranteed: bool) -> Scanner {
+    let mut subaddresses = HashMap::new();
+    subaddresses.insert(pair.spend.compress(), (0, 0));
+    Scanner { pair, network, guaranteed, subaddresses }
+  }
+
+  pub fn address(&self) -> Address {
+    Address::new(
+      AddressMeta {
+        network: self.network,
+        kind: if self.guaranteed {
+          AddressType::Featured(false, None, true)
+        } else {
+          AddressType::Standard
+        },
+      },
+      self.pair.spend,
+      &self.pair.view * &ED25519_BASEPOINT_TABLE,
+    )
+  }
+
+  pub fn subaddress(&mut self, index: (u32, u32)) -> Address {
+    if index == (0, 0) {
+      return self.address();
+    }
+
+    let spend = self.pair.spend + (&self.pair.subaddress(index) * &ED25519_BASEPOINT_TABLE);
+    self.subaddresses.insert(spend.compress(), index);
+
+    Address::new(
+      AddressMeta {
+        network: self.network,
+        kind: if self.guaranteed {
+          AddressType::Featured(true, None, true)
+        } else {
+          AddressType::Subaddress
+        },
+      },
+      spend,
+      self.pair.view * spend,
+    )
+  }
 }

coins/monero/src/wallet/scan.rs

@@ -8,9 +8,7 @@ use crate::{
   Commitment,
   serialize::{read_byte, read_u32, read_u64, read_bytes, read_scalar, read_point},
   transaction::{Timelock, Transaction},
-  wallet::{
-    ViewPair, PaymentId, Extra, uniqueness, shared_key, amount_decryption, commitment_mask,
-  },
+  wallet::{PaymentId, Extra, Scanner, uniqueness, shared_key, amount_decryption, commitment_mask},
 };
 
 #[derive(Clone, PartialEq, Eq, Debug, Zeroize, ZeroizeOnDrop)]
@@ -19,9 +17,13 @@ pub struct SpendableOutput {
   pub o: u8,
 
   pub key: EdwardsPoint,
+  // Absolute difference between the spend key and the key in this output, inclusive of any
+  // subaddress offset
   pub key_offset: Scalar,
   pub commitment: Commitment,
 
+  // Metadata to know how to process this output
+
   // Does not have to be an Option since the 0 subaddress is the main address
   pub subaddress: (u32, u32),
   // Can be an Option, as extra doesn't necessarily have a payment ID, yet all Monero TXs should
@@ -92,24 +94,24 @@ impl SpendableOutput {
   }
 }
 
-impl Transaction {
-  pub fn scan(&self, view: &ViewPair, guaranteed: bool) -> Timelocked {
-    let extra = Extra::deserialize(&mut Cursor::new(&self.prefix.extra));
+impl Scanner {
+  pub fn scan(&self, tx: &Transaction) -> Timelocked {
+    let extra = Extra::deserialize(&mut Cursor::new(&tx.prefix.extra));
     let keys;
     let extra = if let Ok(extra) = extra {
       keys = extra.keys();
       extra
     } else {
-      return Timelocked(self.prefix.timelock, vec![]);
+      return Timelocked(tx.prefix.timelock, vec![]);
     };
     let payment_id = extra.payment_id();
 
     let mut res = vec![];
-    for (o, output) in self.prefix.outputs.iter().enumerate() {
+    for (o, output) in tx.prefix.outputs.iter().enumerate() {
       for key in &keys {
         let (view_tag, key_offset, payment_id_xor) = shared_key(
-          Some(uniqueness(&self.prefix.inputs)).filter(|_| guaranteed),
-          &view.view,
+          if self.guaranteed { Some(uniqueness(&tx.prefix.inputs)) } else { None },
+          &self.pair.view,
           key,
           o,
         );
@@ -128,7 +130,10 @@ impl Transaction {
         }
 
         // P - shared == spend
-        if (output.key - (&key_offset * &ED25519_BASEPOINT_TABLE)) != view.spend {
+        let subaddress = self
+          .subaddresses
+          .get(&(output.key - (&key_offset * &ED25519_BASEPOINT_TABLE)).compress());
+        if subaddress.is_none() {
           continue;
         }
 
@@ -140,7 +145,7 @@ impl Transaction {
           commitment.amount = output.amount;
         // Regular transaction
         } else {
-          let amount = match self.rct_signatures.base.ecdh_info.get(o) {
+          let amount = match tx.rct_signatures.base.ecdh_info.get(o) {
             Some(amount) => amount_decryption(*amount, key_offset),
             // This should never happen, yet it may be possible with miner transactions?
             // Using get just decreases the possibility of a panic and lets us move on in that case
@@ -151,18 +156,18 @@ impl Transaction {
           commitment = Commitment::new(commitment_mask(key_offset), amount);
           // If this is a malicious commitment, move to the next output
           // Any other R value will calculate to a different spend key and are therefore ignorable
-          if Some(&commitment.calculate()) != self.rct_signatures.base.commitments.get(o) {
+          if Some(&commitment.calculate()) != tx.rct_signatures.base.commitments.get(o) {
             break;
           }
         }
 
         if commitment.amount != 0 {
           res.push(SpendableOutput {
-            tx: self.hash(),
+            tx: tx.hash(),
             o: o.try_into().unwrap(),
 
             key: output.key,
-            key_offset,
+            key_offset: key_offset + self.pair.subaddress(*subaddress.unwrap()),
             commitment,
 
             subaddress: (0, 0),
@@ -175,6 +180,6 @@ impl Transaction {
       }
     }
 
-    Timelocked(self.prefix.timelock, res)
+    Timelocked(tx.prefix.timelock, res)
   }
 }