Processor (#259)

* Initial work on a message box * Finish message-box (untested) * Expand documentation * Embed the recipient in the signature challenge Prevents a message from A -> B from being read as from A -> C. * Update documentation by bifurcating sender/receiver * Panic on receiving an invalid signature If we've received an invalid signature in an authenticated system, a service is malicious, critically faulty (equivalent to malicious), or the message layer has been compromised (or is otherwise critically faulty). Please note a receiver who handles a message they shouldn't will trigger this. That falls under being critically faulty. * Documentation and helper methods SecureMessage::new and SecureMessage::serialize. Secure Debug for MessageBox. * Have SecureMessage not be serialized by default Allows passing around in-memory, if desired, and moves the error from decrypt to new (which performs deserialization). Decrypt no longer has an error since it panics if given an invalid signature, due to this being intranet code. * Explain and improve nonce handling Includes a missing zeroize call. * Rebase to latest develop Updates to transcript 0.2.0. * Add a test for the MessageBox * Export PrivateKey and PublicKey * Also test serialization * Add a key_gen binary to message_box * Have SecureMessage support Serde * Add encrypt_to_bytes and decrypt_from_bytes * Support String ser via base64 * Rename encrypt/decrypt to encrypt_bytes/decrypt_to_bytes * Directly operate with values supporting Borsh * Use bincode instead of Borsh By staying inside of serde, we'll support many more structs. While bincode isn't canonical, we don't need canonicity on an authenticated, internal system. * Turn PrivateKey, PublicKey into structs Uses Zeroizing for the PrivateKey per #150. * from_string functions intended for loading from an env * Use &str for PublicKey from_string (now from_str) The PrivateKey takes the String to take ownership of its memory and zeroize it. That isn't needed with PublicKeys. * Finish updating from develop * Resolve warning * Use ZeroizingAlloc on the key_gen binary * Move message-box from crypto/ to common/ * Move key serialization functions to ser * add/remove functions in MessageBox * Implement Hash on dalek_ff_group Points * Make MessageBox generic to its key Exposes a &'static str variant for internal use and a RistrettoPoint variant for external use. * Add Private to_string as deprecated Stub before more competent tooling is deployed. * Private to_public * Test both Internal and External MessageBox, only use PublicKey in the pub API * Remove panics on invalid signatures Leftover from when this was solely internal which is now unsafe. * Chicken scratch a Scanner task * Add a write function to the DKG library Enables writing directly to a file. Also modifies serialize to return Zeroizing<Vec<u8>> instead of just Vec<u8>. * Make dkg::encryption pub * Remove encryption from MessageBox * Use a 64-bit block number in Substrate We use a 64-bit block number in general since u32 only works for 120 years (with a 1 second block time). As some chains even push the 1 second threshold, especially ones based on DAG consensus, this becomes potentially as low as 60 years. While that should still be plenty, it's not worth wondering/debating. Since Serai uses 64-bit block numbers elsewhere, this ensures consistency. * Misc crypto lints * Get the scanner scratch to compile * Initial scanner test * First few lines of scheduler * Further work on scheduler, solidify API * Define Scheduler TX format * Branch creation algorithm * Document when the branch algorithm isn't perfect * Only scanned confirmed blocks * Document Coin * Remove Canonical/ChainNumber from processor The processor should be abstracted from canonical numbers thanks to the coordinator, making this unnecessary. * Add README documenting processor flow * Use Zeroize on substrate primitives * Define messages from/to the processor * Correct over-specified versioning * Correct build re: in_instructions::primitives * Debug/some serde in crypto/ * Use a struct for ValidatorSetInstance * Add a processor key_gen task Redos DB handling code. * Replace trait + impl with wrapper struct * Add a key confirmation flow to the key gen task * Document concerns on key_gen * Start on a signer task * Add Send to FROST traits * Move processor lib.rs to main.rs Adds a dummy main to reduce clippy dead_code warnings. * Further flesh out main.rs * Move the DB trait to AsRef<[u8]> * Signer task * Remove a panic in bitcoin when there's insufficient funds Unchecked underflow. * Have Monero's mine_block mine one block, not 10 It was initially a nicety to deal with the 10 block lock. C::CONFIRMATIONS should be used for that instead. * Test signer * Replace channel expects with log statements The expects weren't problematic and had nicer code. They just clutter test output. * Remove the old wallet file It predates the coordinator design and shouldn't be used. * Rename tests/scan.rs to tests/scanner.rs * Add a wallet test Complements the recently removed wallet file by adding a test for the scanner, scheduler, and signer together. * Work on a run function Triggers a clippy ICE. * Resolve clippy ICE The issue was the non-fully specified lambda in signer. * Add KeyGenEvent and KeyGenOrder Needed so we get KeyConfirmed messages from the key gen task. While we could've read the CoordinatorMessage to see that, routing through the key gen tasks ensures we only handle it once it's been successfully saved to disk. * Expand scanner test * Clarify processor documentation * Have the Scanner load keys on boot/save outputs to disk * Use Vec<u8> for Block ID Much more flexible. * Panic if we see the same output multiple times * Have the Scanner DB mark itself as corrupt when doing a multi-put This REALLY should be a TX. Since we don't have a TX API right now, this at least offers detection. * Have DST'd DB keys accept AsRef<[u8]> * Restore polling all signers Writes a custom future to do so. Also loads signers on boot using what the scanner claims are active keys. * Schedule OutInstructions Adds a data field to Payment. Also cleans some dead code. * Panic if we create an invalid transaction Saves the TX once it's successfully signed so if we do panic, we have a copy. * Route coordinator messages to their respective signer Requires adding key to the SignId. * Send SignTransaction orders for all plans * Add a timer to retry sign_plans when prepare_send fails * Minor fmt'ing * Basic Fee API * Move the change key into Plan * Properly route activation_number * Remove ScannerEvent::Block It's not used under current designs * Nicen logs * Add utilities to get a block's number * Have main issue AckBlock Also has a few misc lints. * Parse instructions out of outputs * Tweak TODOs and remove an unwrap * Update Bitcoin max input/output quantity * Only read one piece of data from Monero Due to output randomization, it's infeasible. * Embed plan IDs into the TXs they create We need to stop attempting signing if we've already signed a protocol. Ideally, any one of the participating signers should be able to provide a proof the TX was successfully signed. We can't just run a second signing protocol though as a single malicious signer could complete the TX signature, and publish it, yet not complete the secondary signature. The TX itself has to be sufficient to show that the TX matches the plan. This is done by embedding the ID, so matching addresses/amounts plans are distinguished, and by allowing verification a TX actually matches a set of addresses/amounts. For Monero, this will need augmenting with the ephemeral keys (or usage of a static seed for them). * Don't use OP_RETURN to encode the plan ID on Bitcoin We can use the inputs to distinguih identical-output plans without issue. * Update OP_RETURN data access It's not required to be the last output. * Add Eventualities to Monero An Eventuality is an effective equivalent to a SignableTransaction. That is declared not by the inputs it spends, yet the outputs it creates. Eventualities are also bound to a 32-byte RNG seed, enabling usage of a hash-based identifier in a SignableTransaction, allowing multiple SignableTransactions with the same output set to have different Eventualities. In order to prevent triggering the burning bug, the RNG seed is hashed with the planned-to-be-used inputs' output keys. While this does bind to them, it's only loosely bound. The TX actually created may use different inputs entirely if a forgery is crafted (which requires no brute forcing). Binding to the key images would provide a strong binding, yet would require knowing the key images, which requires active communication with the spend key. The purpose of this is so a multisig can identify if a Transaction the entire group planned has been executed by a subset of the group or not. Once a plan is created, it can have an Eventuality made. The Eventuality's extra is able to be inserted into a HashMap, so all new on-chain transactions can be trivially checked as potential candidates. Once a potential candidate is found, a check involving ECC ops can be performed. While this is arguably a DoS vector, the underlying Monero blockchain would need to be spammed with transactions to trigger it. Accordingly, it becomes a Monero blockchain DoS vector, when this code is written on the premise of the Monero blockchain functioning. Accordingly, it is considered handled. If a forgery does match, it must have created the exact same outputs the multisig would've. Accordingly, it's argued the multisig shouldn't mind. This entire suite of code is only necessary due to the lack of outgoing view keys, yet it's able to avoid an interactive protocol to communicate key images on every single received output. While this could be locked to the multisig feature, there's no practical benefit to doing so. * Add support for encoding Monero address to instructions * Move Serai's Monero address encoding into serai-client serai-client is meant to be a single library enabling using Serai. While it was originally written as an RPC client for Serai, apps actually using Serai will primarily be sending transactions on connected networks. Sending those transactions require proper {In, Out}Instructions, including proper address encoding. Not only has address encoding been moved, yet the subxt client is now behind a feature. coin integrations have their own features, which are on by default. primitives are always exposed. * Reorganize file layout a bit, add feature flags to processor * Tidy up ETH Dockerfile * Add Bitcoin address encoding * Move Bitcoin::Address to serai-client's * Comment where tweaking needs to happen * Add an API to check if a plan was completed in a specific TX This allows any participating signer to submit the TX ID to prevent further signing attempts. Also performs some API cleanup. * Minimize FROST dependencies * Use a seeded RNG for key gen * Tweak keys from Key gen * Test proper usage of Branch/Change addresses Adds a more descriptive error to an error case in decoys, and pads Monero payments as needed. * Also test spending the change output * Add queued_plans to the Scheduler queued_plans is for payments to be issued when an amount appears, yet the amount is currently pre-fee. One the output is actually created, the Scheduler should be notified of the amount it was created with, moving from queued_plans to plans under the actual amount. Also tightens debug_asserts to asserts for invariants which may are at risk of being exclusive to prod. * Add missing tweak_keys call * Correct decoy selection height handling * Add a few log statements to the scheduler * Simplify test's get_block_number * Simplify, while making more robust, branch address handling in Scheduler * Have fees deducted from payments Corrects Monero's handling of fees when there's no change address. Adds a DUST variable, as needed due to 1_00_000_000 not being enough to pay its fee on Monero. * Add comment to Monero * Consolidate BTC/XMR prepare_send code These aren't fully consolidated. We'd need a SignableTransaction trait for that. This is a lot cleaner though. * Ban integrated addresses The reasoning why is accordingly documented. * Tidy TODOs/dust handling * Update README TODO * Use a determinisitic protocol version in Monero * Test rebuilt KeyGen machines function as expected * Use a more robust KeyGen entropy system * Add DB TXNs Also load entropy from env * Add a loop for processing messages from substrate Allows detecting if we're behind, and if so, waiting to handle the message * Set Monero MAX_INPUTS properly The previous number was based on an old hard fork. With the ring size having increased, transactions have since got larger. * Distinguish TODOs into TODO and TODO2s TODO2s are for after protonet * Zeroize secret share repr in ThresholdCore write * Work on Eventualities Adds serialization and stops signing when an eventuality is proven. * Use a more robust DB key schema * Update to {k, p}256 0.12 * cargo +nightly clippy * cargo update * Slight message-box tweaks * Update to recent Monero merge * Add a Coordinator trait for communication with coordinator * Remove KeyGenHandle for just KeyGen While KeyGen previously accepted instructions over a channel, this breaks the ack flow needed for coordinator communication. Now, KeyGen is the direct object with a handle() function for messages. Thankfully, this ended up being rather trivial for KeyGen as it has no background tasks. * Add a handle function to Signer Enables determining when it's finished handling a CoordinatorMessage and therefore creating an acknowledgement. * Save transactions used to complete eventualities * Use a more intelligent sleep in the signer * Emit SignedTransaction with the first ID *we can still get from our node* * Move Substrate message handling into the new coordinator recv loop * Add handle function to Scanner * Remove the plans timer Enables ensuring the ordring on the handling of plans. * Remove the outputs function which panicked if a precondition wasn't met The new API only returns outputs upon satisfaction of the precondition. * Convert SignerOrder::SignTransaction to a function * Remove the key_gen object from sign_plans * Refactor out get_fee/prepare_send into dedicated functions * Save plans being signed to the DB * Reload transactions being signed on boot * Stop reloading TXs being signed (and report it to peers) * Remove message-box from the processor branch We don't use it here yet. * cargo +nightly fmt * Move back common/zalloc * Update subxt to 0.27 * Zeroize ^1.5, not 1 * Update GitHub workflow * Remove usage of SignId in completed
2025-12-09 04:39:24 +00:00 · 2023-03-16 22:59:40 -04:00
parent f374cd7398
commit ba82dac18c
99 changed files with 6022 additions and 1794 deletions
--- a/coins/monero/Cargo.toml
+++ b/coins/monero/Cargo.toml
@@ -18,7 +18,7 @@ lazy_static = "1"
 thiserror = "1"

 rand_core = "0.6"
-rand_chacha = { version = "0.3", optional = true }
+rand_chacha = "0.3"
 rand = "0.8"
 rand_distr = "0.4"

@@ -41,11 +41,11 @@ dleq = { path = "../../crypto/dleq", version = "0.3", features = ["serialize"],
 monero-generators = { path = "generators", version = "0.2" }

 hex = "0.4"
-serde = { version = "1.0", features = ["derive"] }
-serde_json = "1.0"
+serde = { version = "1", features = ["derive"] }
+serde_json = "1"

 base58-monero = "1"
-monero-epee-bin-serde = "1.0"
+monero-epee-bin-serde = "1"

 digest_auth = "0.3"
 reqwest = { version = "0.11", features = ["json"] }
@@ -63,4 +63,4 @@ monero-rpc = "0.3"
 frost = { package = "modular-frost", path = "../../crypto/frost", version = "0.6", features = ["tests"] }

 [features]
-multisig = ["rand_chacha", "transcript", "frost", "dleq"]
+multisig = ["transcript", "frost", "dleq"]
--- a/coins/monero/src/block.rs
+++ b/coins/monero/src/block.rs
@@ -1,6 +1,9 @@
 use std::io::{self, Read, Write};

-use crate::{serialize::*, transaction::Transaction};
+use crate::{
+  serialize::*,
+  transaction::{Input, Transaction},
+};

 #[derive(Clone, PartialEq, Eq, Debug)]
 pub struct BlockHeader {
@@ -45,6 +48,13 @@ pub struct Block {
 }

 impl Block {
+  pub fn number(&self) -> usize {
+    match self.miner_tx.prefix.inputs.get(0) {
+      Some(Input::Gen(number)) => (*number).try_into().unwrap(),
+      _ => panic!("invalid block, miner TX didn't have a Input::Gen"),
+    }
+  }
+
  pub fn write<W: Write>(&self, w: &mut W) -> io::Result<()> {
    self.header.write(w)?;
    self.miner_tx.write(w)?;
--- a/coins/monero/src/lib.rs
+++ b/coins/monero/src/lib.rs
@@ -3,21 +3,23 @@
 //! A modern Monero transaction library intended for usage in wallets. It prides
 //! itself on accuracy, correctness, and removing common pit falls developers may
 //! face.
-
+//!
 //! monero-serai contains safety features, such as first-class acknowledgement of
 //! the burning bug, yet also a high level API around creating transactions.
 //! monero-serai also offers a FROST-based multisig, which is orders of magnitude
 //! more performant than Monero's.
-
+//!
 //! monero-serai was written for Serai, a decentralized exchange aiming to support
 //! Monero. Despite this, monero-serai is intended to be a widely usable library,
 //! accurate to Monero. monero-serai guarantees the functionality needed for Serai,
 //! yet will not deprive functionality from other users, and may potentially leave
 //! Serai's umbrella at some point.
-
+//!
 //! Various legacy transaction formats are not currently implemented, yet
 //! monero-serai is still increasing its support for various transaction types.

+use std::io;
+
 use lazy_static::lazy_static;
 use rand_core::{RngCore, CryptoRng};

@@ -34,6 +36,7 @@ use curve25519_dalek::{
 pub use monero_generators::H;

 mod serialize;
+use serialize::{read_byte, read_u16};

 /// RingCT structs and functionality.
 pub mod ringct;
@@ -80,6 +83,45 @@ impl Protocol {
      Protocol::Custom { bp_plus, .. } => *bp_plus,
    }
  }
+
+  pub(crate) fn write<W: io::Write>(&self, w: &mut W) -> io::Result<()> {
+    match self {
+      Protocol::v14 => w.write_all(&[0, 14]),
+      Protocol::v16 => w.write_all(&[0, 16]),
+      Protocol::Custom { ring_len, bp_plus } => {
+        // Custom, version 0
+        w.write_all(&[1, 0])?;
+        w.write_all(&u16::try_from(*ring_len).unwrap().to_le_bytes())?;
+        w.write_all(&[u8::from(*bp_plus)])
+      }
+    }
+  }
+
+  pub(crate) fn read<R: io::Read>(r: &mut R) -> io::Result<Protocol> {
+    Ok(match read_byte(r)? {
+      // Monero protocol
+      0 => match read_byte(r)? {
+        14 => Protocol::v14,
+        16 => Protocol::v16,
+        _ => Err(io::Error::new(io::ErrorKind::Other, "unrecognized monero protocol"))?,
+      },
+      // Custom
+      1 => match read_byte(r)? {
+        0 => Protocol::Custom {
+          ring_len: read_u16(r)?.into(),
+          bp_plus: match read_byte(r)? {
+            0 => false,
+            1 => true,
+            _ => Err(io::Error::new(io::ErrorKind::Other, "invalid bool serialization"))?,
+          },
+        },
+        _ => {
+          Err(io::Error::new(io::ErrorKind::Other, "unrecognized custom protocol serialization"))?
+        }
+      },
+      _ => Err(io::Error::new(io::ErrorKind::Other, "unrecognized protocol serialization"))?,
+    })
+  }
 }

 lazy_static! {
--- a/coins/monero/src/rpc.rs
+++ b/coins/monero/src/rpc.rs
@@ -501,10 +501,8 @@ impl Rpc {
      reason: String,
    }

-    let mut buf = Vec::with_capacity(2048);
-    tx.write(&mut buf).unwrap();
    let res: SendRawResponse = self
-      .rpc_call("send_raw_transaction", Some(json!({ "tx_as_hex": hex::encode(&buf) })))
+      .rpc_call("send_raw_transaction", Some(json!({ "tx_as_hex": hex::encode(tx.serialize()) })))
      .await?;

    if res.status != "OK" {
--- a/coins/monero/src/serialize.rs
+++ b/coins/monero/src/serialize.rs
@@ -67,14 +67,18 @@ pub(crate) fn read_byte<R: Read>(r: &mut R) -> io::Result<u8> {
  Ok(read_bytes::<_, 1>(r)?[0])
 }

-pub(crate) fn read_u64<R: Read>(r: &mut R) -> io::Result<u64> {
-  read_bytes(r).map(u64::from_le_bytes)
+pub(crate) fn read_u16<R: Read>(r: &mut R) -> io::Result<u16> {
+  read_bytes(r).map(u16::from_le_bytes)
 }

 pub(crate) fn read_u32<R: Read>(r: &mut R) -> io::Result<u32> {
  read_bytes(r).map(u32::from_le_bytes)
 }

+pub(crate) fn read_u64<R: Read>(r: &mut R) -> io::Result<u64> {
+  read_bytes(r).map(u64::from_le_bytes)
+}
+
 pub(crate) fn read_varint<R: Read>(r: &mut R) -> io::Result<u64> {
  let mut bits = 0;
  let mut res = 0;
--- a/coins/monero/src/transaction.rs
+++ b/coins/monero/src/transaction.rs
@@ -44,6 +44,12 @@ impl Input {
    }
  }

+  pub fn serialize(&self) -> Vec<u8> {
+    let mut res = vec![];
+    self.write(&mut res).unwrap();
+    res
+  }
+
  pub fn read<R: Read>(r: &mut R) -> io::Result<Input> {
    Ok(match read_byte(r)? {
      255 => Input::Gen(read_varint(r)?),
@@ -82,6 +88,12 @@ impl Output {
    Ok(())
  }

+  pub fn serialize(&self) -> Vec<u8> {
+    let mut res = Vec::with_capacity(8 + 1 + 32);
+    self.write(&mut res).unwrap();
+    res
+  }
+
  pub fn read<R: Read>(r: &mut R) -> io::Result<Output> {
    let amount = read_varint(r)?;
    let view_tag = match read_byte(r)? {
@@ -172,6 +184,12 @@ impl TransactionPrefix {
    w.write_all(&self.extra)
  }

+  pub fn serialize(&self) -> Vec<u8> {
+    let mut res = vec![];
+    self.write(&mut res).unwrap();
+    res
+  }
+
  pub fn read<R: Read>(r: &mut R) -> io::Result<TransactionPrefix> {
    let mut prefix = TransactionPrefix {
      version: read_varint(r)?,
@@ -219,6 +237,12 @@ impl Transaction {
    }
  }

+  pub fn serialize(&self) -> Vec<u8> {
+    let mut res = Vec::with_capacity(2048);
+    self.write(&mut res).unwrap();
+    res
+  }
+
  pub fn read<R: Read>(r: &mut R) -> io::Result<Transaction> {
    let prefix = TransactionPrefix::read(r)?;
    let mut signatures = vec![];
--- a/coins/monero/src/wallet/decoys.rs
+++ b/coins/monero/src/wallet/decoys.rs
@@ -42,6 +42,10 @@ async fn select_n<'a, R: RngCore + CryptoRng>(
  used: &mut HashSet<u64>,
  count: usize,
 ) -> Result<Vec<(u64, [EdwardsPoint; 2])>, RpcError> {
+  if height >= rpc.get_height().await? {
+    Err(RpcError::InternalError("decoys being requested from too young blocks"))?;
+  }
+
  let mut iters = 0;
  let mut confirmed = Vec::with_capacity(count);
  // Retries on failure. Retries are obvious as decoys, yet should be minimal
--- a/coins/monero/src/wallet/mod.rs
+++ b/coins/monero/src/wallet/mod.rs
@@ -28,7 +28,9 @@ pub(crate) mod decoys;
 pub(crate) use decoys::Decoys;

 mod send;
-pub use send::{Fee, TransactionError, Change, SignableTransaction, SignableTransactionBuilder};
+pub use send::{
+  Fee, TransactionError, Change, SignableTransaction, SignableTransactionBuilder, Eventuality,
+};
 #[cfg(feature = "multisig")]
 pub(crate) use send::InternalPayment;
 #[cfg(feature = "multisig")]
--- a/coins/monero/src/wallet/scan.rs
+++ b/coins/monero/src/wallet/scan.rs
@@ -219,6 +219,10 @@ impl SpendableOutput {
    self.output.commitment()
  }

+  pub fn arbitrary_data(&self) -> &[Vec<u8>] {
+    self.output.arbitrary_data()
+  }
+
  pub fn write<W: Write>(&self, w: &mut W) -> io::Result<()> {
    self.output.write(w)?;
    w.write_all(&self.global_index.to_le_bytes())
--- a/coins/monero/src/wallet/send/builder.rs
+++ b/coins/monero/src/wallet/send/builder.rs
@@ -1,6 +1,6 @@
 use std::sync::{Arc, RwLock};

-use zeroize::{Zeroize, ZeroizeOnDrop};
+use zeroize::{Zeroize, ZeroizeOnDrop, Zeroizing};

 use crate::{
  Protocol,
@@ -15,6 +15,7 @@ struct SignableTransactionBuilderInternal {
  protocol: Protocol,
  fee: Fee,

+  r_seed: Option<Zeroizing<[u8; 32]>>,
  inputs: Vec<SpendableOutput>,
  payments: Vec<(MoneroAddress, u64)>,
  change_address: Option<Change>,
@@ -25,7 +26,19 @@ impl SignableTransactionBuilderInternal {
  // Takes in the change address so users don't miss that they have to manually set one
  // If they don't, all leftover funds will become part of the fee
  fn new(protocol: Protocol, fee: Fee, change_address: Option<Change>) -> Self {
-    Self { protocol, fee, inputs: vec![], payments: vec![], change_address, data: vec![] }
+    Self {
+      protocol,
+      fee,
+      r_seed: None,
+      inputs: vec![],
+      payments: vec![],
+      change_address,
+      data: vec![],
+    }
+  }
+
+  fn set_r_seed(&mut self, r_seed: Zeroizing<[u8; 32]>) {
+    self.r_seed = Some(r_seed);
  }

  fn add_input(&mut self, input: SpendableOutput) {
@@ -85,6 +98,11 @@ impl SignableTransactionBuilder {
    ))))
  }

+  pub fn set_r_seed(&mut self, r_seed: Zeroizing<[u8; 32]>) -> Self {
+    self.0.write().unwrap().set_r_seed(r_seed);
+    self.shallow_copy()
+  }
+
  pub fn add_input(&mut self, input: SpendableOutput) -> Self {
    self.0.write().unwrap().add_input(input);
    self.shallow_copy()
@@ -115,6 +133,7 @@ impl SignableTransactionBuilder {
    let read = self.0.read().unwrap();
    SignableTransaction::new(
      read.protocol,
+      read.r_seed.clone(),
      read.inputs.clone(),
      read.payments.clone(),
      read.change_address.clone(),
--- a/coins/monero/src/wallet/send/mod.rs
+++ b/coins/monero/src/wallet/send/mod.rs
@@ -1,8 +1,10 @@
 use core::{ops::Deref, fmt};
+use std::io;

 use thiserror::Error;

-use rand_core::{RngCore, CryptoRng};
+use rand_core::{RngCore, CryptoRng, SeedableRng};
+use rand_chacha::ChaCha20Rng;
 use rand::seq::SliceRandom;

 use zeroize::{Zeroize, ZeroizeOnDrop, Zeroizing};
@@ -19,7 +21,11 @@ use dalek_ff_group as dfg;
 use frost::FrostError;

 use crate::{
-  Protocol, Commitment, random_scalar,
+  Protocol, Commitment, hash, random_scalar,
+  serialize::{
+    read_byte, read_bytes, read_u64, read_scalar, read_point, read_vec, write_byte, write_scalar,
+    write_point, write_raw_vec, write_vec,
+  },
  ringct::{
    generate_key_image,
    clsag::{ClsagError, ClsagInput, Clsag},
@@ -156,7 +162,7 @@ async fn prepare_inputs<R: RngCore + CryptoRng>(
    rng,
    rpc,
    ring_len,
-    rpc.get_height().await.map_err(TransactionError::RpcError)? - 10,
+    rpc.get_height().await.map_err(TransactionError::RpcError)? - 1,
    inputs,
  )
  .await
@@ -204,10 +210,30 @@ impl Fee {
  }
 }

+#[derive(Clone, PartialEq, Eq, Debug, Zeroize)]
+pub(crate) enum InternalPayment {
+  Payment((MoneroAddress, u64)),
+  Change(Change, u64),
+}
+
+/// The eventual output of a SignableTransaction.
+///
+/// If the SignableTransaction has a Change with a view key, this will also have the view key.
+/// Accordingly, it must be treated securely.
+#[derive(Clone, PartialEq, Eq, Debug, Zeroize)]
+pub struct Eventuality {
+  protocol: Protocol,
+  r_seed: Zeroizing<[u8; 32]>,
+  inputs: Vec<EdwardsPoint>,
+  payments: Vec<InternalPayment>,
+  extra: Vec<u8>,
+}
+
 /// A signable transaction, either in a single-signer or multisig context.
 #[derive(Clone, PartialEq, Eq, Debug, Zeroize, ZeroizeOnDrop)]
 pub struct SignableTransaction {
  protocol: Protocol,
+  r_seed: Option<Zeroizing<[u8; 32]>>,
  inputs: Vec<SpendableOutput>,
  payments: Vec<InternalPayment>,
  data: Vec<Vec<u8>>,
@@ -250,22 +276,19 @@ impl Change {
  }
 }

-#[derive(Clone, PartialEq, Eq, Debug, Zeroize)]
-pub(crate) enum InternalPayment {
-  Payment((MoneroAddress, u64)),
-  Change(Change, u64),
-}
-
 impl SignableTransaction {
  /// Create a signable transaction.
  ///
-  /// Up to 16 outputs may be present, including the change output.
+  /// `r_seed` refers to a seed used to derive the transaction's ephemeral keys (colloquially
+  /// called Rs). If None is provided, one will be automatically generated.
  ///
-  /// If the change address is specified, leftover funds will be sent to it.
+  /// Up to 16 outputs may be present, including the change output. If the change address is
+  /// specified, leftover funds will be sent to it.
  ///
-  /// Each chunk of data must not exceed MAX_ARBITRARY_DATA_SIZE.
+  /// Each chunk of data must not exceed MAX_ARBITRARY_DATA_SIZE and will be embedded in TX extra.
  pub fn new(
    protocol: Protocol,
+    r_seed: Option<Zeroizing<[u8; 32]>>,
    inputs: Vec<SpendableOutput>,
    mut payments: Vec<(MoneroAddress, u64)>,
    change_address: Option<Change>,
@@ -351,27 +374,46 @@ impl SignableTransaction {
      payments.push(InternalPayment::Change(change, in_amount - out_amount));
    }

-    Ok(SignableTransaction { protocol, inputs, payments, data, fee })
+    Ok(SignableTransaction { protocol, r_seed, inputs, payments, data, fee })
  }

-  fn prepare_transaction<R: RngCore + CryptoRng>(
-    &mut self,
-    rng: &mut R,
+  pub fn fee(&self) -> u64 {
+    self.fee
+  }
+
+  #[allow(clippy::type_complexity)]
+  fn prepare_payments(
+    seed: &Zeroizing<[u8; 32]>,
+    inputs: &[EdwardsPoint],
+    payments: &mut Vec<InternalPayment>,
    uniqueness: [u8; 32],
-  ) -> (Transaction, Scalar) {
+  ) -> (EdwardsPoint, Vec<Zeroizing<Scalar>>, Vec<SendOutput>, Option<[u8; 8]>) {
+    let mut rng = {
+      // Hash the inputs into the seed so we don't re-use Rs
+      // Doesn't re-use uniqueness as that's based on key images, which requires interactivity
+      // to generate. The output keys do not
+      // This remains private so long as the seed is private
+      let mut r_uniqueness = vec![];
+      for input in inputs {
+        r_uniqueness.extend(input.compress().to_bytes());
+      }
+      ChaCha20Rng::from_seed(hash(
+        &[b"monero-serai_outputs".as_ref(), seed.as_ref(), &r_uniqueness].concat(),
+      ))
+    };
+
    // Shuffle the payments
-    self.payments.shuffle(rng);
+    payments.shuffle(&mut rng);

    // Used for all non-subaddress outputs, or if there's only one subaddress output and a change
-    let tx_key = Zeroizing::new(random_scalar(rng));
+    let tx_key = Zeroizing::new(random_scalar(&mut rng));
    let mut tx_public_key = tx_key.deref() * &ED25519_BASEPOINT_TABLE;

    // If any of these outputs are to a subaddress, we need keys distinct to them
    // The only time this *does not* force having additional keys is when the only other output
    // is a change output we have the view key for, enabling rewriting rA to aR
    let mut has_change_view = false;
-    let subaddresses = self
-      .payments
+    let subaddresses = payments
      .iter()
      .filter(|payment| match *payment {
        InternalPayment::Payment(payment) => payment.0.is_subaddress(),
@@ -391,14 +433,14 @@ impl SignableTransaction {
    // We need additional keys if we have any subaddresses
    let mut additional = subaddresses;
    // Unless the above change view key path is taken
-    if (self.payments.len() == 2) && has_change_view {
+    if (payments.len() == 2) && has_change_view {
      additional = false;
    }
    let modified_change_ecdh = subaddresses && (!additional);

    // If we're using the aR rewrite, update tx_public_key from rG to rB
    if modified_change_ecdh {
-      for payment in &self.payments {
+      for payment in &*payments {
        match payment {
          InternalPayment::Payment(payment) => {
            // This should be the only payment and it should be a subaddress
@@ -412,9 +454,10 @@ impl SignableTransaction {
    }

    // Actually create the outputs
-    let mut outputs = Vec::with_capacity(self.payments.len());
+    let mut additional_keys = vec![];
+    let mut outputs = Vec::with_capacity(payments.len());
    let mut id = None;
-    for (o, mut payment) in self.payments.drain(..).enumerate() {
+    for (o, mut payment) in payments.drain(..).enumerate() {
      // Downcast the change output to a payment output if it doesn't require special handling
      // regarding it's view key
      payment = if !modified_change_ecdh {
@@ -430,7 +473,7 @@ impl SignableTransaction {
      let (output, payment_id) = match payment {
        InternalPayment::Payment(payment) => {
          // If this is a subaddress, generate a dedicated r. Else, reuse the TX key
-          let dedicated = Zeroizing::new(random_scalar(&mut *rng));
+          let dedicated = Zeroizing::new(random_scalar(&mut rng));
          let use_dedicated = additional && payment.0.is_subaddress();
          let r = if use_dedicated { &dedicated } else { &tx_key };

@@ -438,9 +481,13 @@ impl SignableTransaction {
          if modified_change_ecdh {
            debug_assert_eq!(tx_public_key, output.R);
          }
-          // If this used tx_key, randomize its R
-          if !use_dedicated {
-            output.R = dfg::EdwardsPoint::random(&mut *rng).0;
+
+          if use_dedicated {
+            additional_keys.push(dedicated);
+          } else {
+            // If this used tx_key, randomize its R
+            // This is so when extra is created, there's a distinct R for it to use
+            output.R = dfg::EdwardsPoint::random(&mut rng).0;
          }
          (output, payment_id)
        }
@@ -466,6 +513,92 @@ impl SignableTransaction {
      id = id.or(Some(rand));
    }

+    (tx_public_key, additional_keys, outputs, id)
+  }
+
+  #[allow(non_snake_case)]
+  fn extra(
+    tx_key: EdwardsPoint,
+    additional: bool,
+    Rs: Vec<EdwardsPoint>,
+    id: Option<[u8; 8]>,
+    data: &mut Vec<Vec<u8>>,
+  ) -> Vec<u8> {
+    #[allow(non_snake_case)]
+    let Rs_len = Rs.len();
+    let mut extra = Extra::new(tx_key, if additional { Rs } else { vec![] });
+
+    if let Some(id) = id {
+      let mut id_vec = Vec::with_capacity(1 + 8);
+      PaymentId::Encrypted(id).write(&mut id_vec).unwrap();
+      extra.push(ExtraField::Nonce(id_vec));
+    }
+
+    // Include data if present
+    let extra_len = Extra::fee_weight(Rs_len, id.is_some(), data.as_ref());
+    for part in data.drain(..) {
+      let mut arb = vec![ARBITRARY_DATA_MARKER];
+      arb.extend(part);
+      extra.push(ExtraField::Nonce(arb));
+    }
+
+    let mut serialized = Vec::with_capacity(extra_len);
+    extra.write(&mut serialized).unwrap();
+    serialized
+  }
+
+  /// Returns the eventuality of this transaction.
+  /// The eventuality is defined as the TX extra/outputs this transaction will create, if signed
+  /// with the specified seed. This eventuality can be compared to on-chain transactions to see
+  /// if the transaction has already been signed and published.
+  pub fn eventuality(&self) -> Option<Eventuality> {
+    let inputs = self.inputs.iter().map(|input| input.key()).collect::<Vec<_>>();
+    let (tx_key, additional, outputs, id) = Self::prepare_payments(
+      self.r_seed.as_ref()?,
+      &inputs,
+      &mut self.payments.clone(),
+      // Lie about the uniqueness, used when determining output keys/commitments yet not the
+      // ephemeral keys, which is want we want here
+      // While we do still grab the outputs variable, it's so we can get its Rs
+      [0; 32],
+    );
+    #[allow(non_snake_case)]
+    let Rs = outputs.iter().map(|output| output.R).collect();
+    drop(outputs);
+
+    let additional = !additional.is_empty();
+    let extra = Self::extra(tx_key, additional, Rs, id, &mut self.data.clone());
+
+    Some(Eventuality {
+      protocol: self.protocol,
+      r_seed: self.r_seed.clone()?,
+      inputs,
+      payments: self.payments.clone(),
+      extra,
+    })
+  }
+
+  fn prepare_transaction<R: RngCore + CryptoRng>(
+    &mut self,
+    rng: &mut R,
+    uniqueness: [u8; 32],
+  ) -> (Transaction, Scalar) {
+    // If no seed for the ephemeral keys was provided, make one
+    let r_seed = self.r_seed.clone().unwrap_or_else(|| {
+      let mut res = Zeroizing::new([0; 32]);
+      rng.fill_bytes(res.as_mut());
+      res
+    });
+
+    let (tx_key, additional, outputs, id) = Self::prepare_payments(
+      &r_seed,
+      &self.inputs.iter().map(|input| input.key()).collect::<Vec<_>>(),
+      &mut self.payments,
+      uniqueness,
+    );
+    // This function only cares if additional keys were necessary, not what they were
+    let additional = !additional.is_empty();
+
    let commitments = outputs.iter().map(|output| output.commitment.clone()).collect::<Vec<_>>();
    let sum = commitments.iter().map(|commitment| commitment.mask).sum();

@@ -473,34 +606,19 @@ impl SignableTransaction {
    let bp = Bulletproofs::prove(rng, &commitments, self.protocol.bp_plus()).unwrap();

    // Create the TX extra
-    let extra = {
-      let mut extra = Extra::new(
-        tx_public_key,
-        if additional { outputs.iter().map(|output| output.R).collect() } else { vec![] },
-      );
-
-      if let Some(id) = id {
-        let mut id_vec = Vec::with_capacity(1 + 8);
-        PaymentId::Encrypted(id).write(&mut id_vec).unwrap();
-        extra.push(ExtraField::Nonce(id_vec));
-      }
-
-      // Include data if present
-      for part in self.data.drain(..) {
-        let mut arb = vec![ARBITRARY_DATA_MARKER];
-        arb.extend(part);
-        extra.push(ExtraField::Nonce(arb));
-      }
-
-      let mut serialized =
-        Vec::with_capacity(Extra::fee_weight(outputs.len(), id.is_some(), self.data.as_ref()));
-      extra.write(&mut serialized).unwrap();
-      serialized
-    };
+    let extra = Self::extra(
+      tx_key,
+      additional,
+      outputs.iter().map(|output| output.R).collect(),
+      id,
+      &mut self.data,
+    );

+    let mut fee = self.inputs.iter().map(|input| input.commitment().amount).sum::<u64>();
    let mut tx_outputs = Vec::with_capacity(outputs.len());
    let mut ecdh_info = Vec::with_capacity(outputs.len());
    for output in &outputs {
+      fee -= output.commitment.amount;
      tx_outputs.push(Output {
        amount: 0,
        key: output.dest.compress(),
@@ -521,7 +639,7 @@ impl SignableTransaction {
        signatures: vec![],
        rct_signatures: RctSignatures {
          base: RctBase {
-            fee: self.fee,
+            fee,
            ecdh_info,
            commitments: commitments.iter().map(|commitment| commitment.calculate()).collect(),
          },
@@ -579,3 +697,128 @@ impl SignableTransaction {
    Ok(tx)
  }
 }
+
+impl Eventuality {
+  /// Enables building a HashMap of Extra -> Eventuality for efficiently checking if an on-chain
+  /// transaction may match this eventuality.
+  /// This extra is cryptographically bound to:
+  /// 1) A specific set of inputs (via their output key)
+  /// 2) A specific seed for the ephemeral keys
+  pub fn extra(&self) -> &[u8] {
+    &self.extra
+  }
+
+  pub fn matches(&self, tx: &Transaction) -> bool {
+    if self.payments.len() != tx.prefix.outputs.len() {
+      return false;
+    }
+
+    // Verify extra.
+    // Even if all the outputs were correct, a malicious extra could still cause a recipient to
+    // fail to receive their funds.
+    // This is the cheapest check available to perform as it does not require TX-specific ECC ops.
+    if self.extra != tx.prefix.extra {
+      return false;
+    }
+
+    // Also ensure no timelock was set.
+    if tx.prefix.timelock != Timelock::None {
+      return false;
+    }
+
+    // Generate the outputs. This is TX-specific due to uniqueness.
+    let (_, _, outputs, _) = SignableTransaction::prepare_payments(
+      &self.r_seed,
+      &self.inputs,
+      &mut self.payments.clone(),
+      uniqueness(&tx.prefix.inputs),
+    );
+
+    for (o, (expected, actual)) in outputs.iter().zip(tx.prefix.outputs.iter()).enumerate() {
+      // Verify the output, commitment, and encrypted amount.
+      if (&Output {
+        amount: 0,
+        key: expected.dest.compress(),
+        view_tag: Some(expected.view_tag).filter(|_| matches!(self.protocol, Protocol::v16)),
+      } != actual) ||
+        (Some(&expected.commitment.calculate()) != tx.rct_signatures.base.commitments.get(o)) ||
+        (Some(&expected.amount) != tx.rct_signatures.base.ecdh_info.get(o))
+      {
+        return false;
+      }
+    }
+
+    true
+  }
+
+  pub fn write<W: io::Write>(&self, w: &mut W) -> io::Result<()> {
+    self.protocol.write(w)?;
+    write_raw_vec(write_byte, self.r_seed.as_ref(), w)?;
+    write_vec(write_point, &self.inputs, w)?;
+
+    fn write_payment<W: io::Write>(payment: &InternalPayment, w: &mut W) -> io::Result<()> {
+      match payment {
+        InternalPayment::Payment(payment) => {
+          w.write_all(&[0])?;
+          write_vec(write_byte, payment.0.to_string().as_bytes(), w)?;
+          w.write_all(&payment.1.to_le_bytes())
+        }
+        InternalPayment::Change(change, amount) => {
+          w.write_all(&[1])?;
+          write_vec(write_byte, change.address.to_string().as_bytes(), w)?;
+          if let Some(view) = change.view.as_ref() {
+            w.write_all(&[1])?;
+            write_scalar(view, w)?;
+          } else {
+            w.write_all(&[0])?;
+          }
+          w.write_all(&amount.to_le_bytes())
+        }
+      }
+    }
+    write_vec(write_payment, &self.payments, w)?;
+
+    write_vec(write_byte, &self.extra, w)
+  }
+
+  pub fn serialize(&self) -> Vec<u8> {
+    let mut buf = Vec::with_capacity(128);
+    self.write(&mut buf).unwrap();
+    buf
+  }
+
+  pub fn read<R: io::Read>(r: &mut R) -> io::Result<Eventuality> {
+    fn read_address<R: io::Read>(r: &mut R) -> io::Result<MoneroAddress> {
+      String::from_utf8(read_vec(read_byte, r)?)
+        .ok()
+        .and_then(|str| MoneroAddress::from_str_raw(&str).ok())
+        .ok_or(io::Error::new(io::ErrorKind::Other, "invalid address"))
+    }
+
+    fn read_payment<R: io::Read>(r: &mut R) -> io::Result<InternalPayment> {
+      Ok(match read_byte(r)? {
+        0 => InternalPayment::Payment((read_address(r)?, read_u64(r)?)),
+        1 => InternalPayment::Change(
+          Change {
+            address: read_address(r)?,
+            view: match read_byte(r)? {
+              0 => None,
+              1 => Some(Zeroizing::new(read_scalar(r)?)),
+              _ => Err(io::Error::new(io::ErrorKind::Other, "invalid change payment"))?,
+            },
+          },
+          read_u64(r)?,
+        ),
+        _ => Err(io::Error::new(io::ErrorKind::Other, "invalid payment"))?,
+      })
+    }
+
+    Ok(Eventuality {
+      protocol: Protocol::read(r)?,
+      r_seed: Zeroizing::new(read_bytes::<_, 32>(r)?),
+      inputs: read_vec(read_point, r)?,
+      payments: read_vec(read_payment, r)?,
+      extra: read_vec(read_byte, r)?,
+    })
+  }
+}
--- a/coins/monero/src/wallet/send/multisig.rs
+++ b/coins/monero/src/wallet/send/multisig.rs
@@ -39,6 +39,7 @@ use crate::{
 /// FROST signing machine to produce a signed transaction.
 pub struct TransactionMachine {
  signable: SignableTransaction,
+
  i: Participant,
  transcript: RecommendedTranscript,

@@ -52,6 +53,7 @@ pub struct TransactionMachine {

 pub struct TransactionSignMachine {
  signable: SignableTransaction,
+
  i: Participant,
  transcript: RecommendedTranscript,

@@ -93,15 +95,22 @@ impl SignableTransaction {
    // multiple times, already breaking privacy there

    transcript.domain_separate(b"monero_transaction");
+
    // Include the height we're using for our data
    // The data itself will be included, making this unnecessary, yet a lot of this is technically
    // unnecessary. Anything which further increases security at almost no cost should be followed
    transcript.append_message(b"height", u64::try_from(height).unwrap().to_le_bytes());
+
    // Also include the spend_key as below only the key offset is included, so this transcripts the
    // sum product
    // Useful as transcripting the sum product effectively transcripts the key image, further
    // guaranteeing the one time properties noted below
    transcript.append_message(b"spend_key", keys.group_key().0.compress().to_bytes());
+
+    if let Some(r_seed) = &self.r_seed {
+      transcript.append_message(b"r_seed", r_seed);
+    }
+
    for input in &self.inputs {
      // These outputs can only be spent once. Therefore, it forces all RNGs derived from this
      // transcript (such as the one used to create one time keys) to be unique
@@ -111,6 +120,7 @@ impl SignableTransaction {
      // to determine RNG seeds and therefore the true spends
      transcript.append_message(b"input_shared_key", input.key_offset().to_bytes());
    }
+
    for payment in &self.payments {
      match payment {
        InternalPayment::Payment(payment) => {
@@ -162,6 +172,7 @@ impl SignableTransaction {

    Ok(TransactionMachine {
      signable: self,
+
      i: keys.params().i(),
      transcript,

@@ -208,6 +219,7 @@ impl PreprocessMachine for TransactionMachine {
    (
      TransactionSignMachine {
        signable: self.signable,
+
        i: self.i,
        transcript: self.transcript,

@@ -324,6 +336,7 @@ impl SignMachine<Transaction> for TransactionSignMachine {
      sorted_images.sort_by(key_image_sort);

      self.signable.prepare_transaction(
+        // Technically, r_seed is used for the transaction keys if it's provided
        &mut ChaCha20Rng::from_seed(self.transcript.rng_seed(b"transaction_keys_bulletproofs")),
        uniqueness(
          &sorted_images
--- a/coins/monero/tests/add_data.rs
+++ b/coins/monero/tests/add_data.rs
@@ -1,6 +1,6 @@
 use monero_serai::{
-  wallet::{TransactionError, extra::MAX_ARBITRARY_DATA_SIZE},
  transaction::Transaction,
+  wallet::{TransactionError, extra::MAX_ARBITRARY_DATA_SIZE},
 };

 mod runner;
--- a/coins/monero/tests/eventuality.rs
+++ b/coins/monero/tests/eventuality.rs
@@ -0,0 +1,79 @@
+use curve25519_dalek::constants::ED25519_BASEPOINT_POINT;
+
+use monero_serai::{
+  transaction::Transaction,
+  wallet::{
+    Eventuality,
+    address::{AddressType, AddressMeta, MoneroAddress},
+  },
+};
+
+mod runner;
+
+test!(
+  eventuality,
+  (
+    |_, mut builder: Builder, _| async move {
+      // Add a standard address, a payment ID address, a subaddress, and a guaranteed address
+      // Each have their own slight implications to eventualities
+      builder.add_payment(
+        MoneroAddress::new(
+          AddressMeta::new(Network::Mainnet, AddressType::Standard),
+          ED25519_BASEPOINT_POINT,
+          ED25519_BASEPOINT_POINT,
+        ),
+        1,
+      );
+      builder.add_payment(
+        MoneroAddress::new(
+          AddressMeta::new(Network::Mainnet, AddressType::Integrated([0xaa; 8])),
+          ED25519_BASEPOINT_POINT,
+          ED25519_BASEPOINT_POINT,
+        ),
+        2,
+      );
+      builder.add_payment(
+        MoneroAddress::new(
+          AddressMeta::new(Network::Mainnet, AddressType::Subaddress),
+          ED25519_BASEPOINT_POINT,
+          ED25519_BASEPOINT_POINT,
+        ),
+        3,
+      );
+      builder.add_payment(
+        MoneroAddress::new(
+          AddressMeta::new(
+            Network::Mainnet,
+            AddressType::Featured { subaddress: false, payment_id: None, guaranteed: true },
+          ),
+          ED25519_BASEPOINT_POINT,
+          ED25519_BASEPOINT_POINT,
+        ),
+        4,
+      );
+      builder.set_r_seed(Zeroizing::new([0xbb; 32]));
+      let tx = builder.build().unwrap();
+      let eventuality = tx.eventuality().unwrap();
+      assert_eq!(
+        eventuality,
+        Eventuality::read::<&[u8]>(&mut eventuality.serialize().as_ref()).unwrap()
+      );
+      (tx, eventuality)
+    },
+    |_, mut tx: Transaction, _, eventuality: Eventuality| async move {
+      // 4 explicitly outputs added and one change output
+      assert_eq!(tx.prefix.outputs.len(), 5);
+
+      // The eventuality's available extra should be the actual TX's
+      assert_eq!(tx.prefix.extra, eventuality.extra());
+
+      // The TX should match
+      assert!(eventuality.matches(&tx));
+
+      // Mutate the TX
+      tx.rct_signatures.base.commitments[0] += ED25519_BASEPOINT_POINT;
+      // Verify it no longer matches
+      assert!(!eventuality.matches(&tx));
+    },
+  ),
+);
--- a/coins/monero/tests/runner.rs
+++ b/coins/monero/tests/runner.rs
@@ -12,12 +12,12 @@ use tokio::sync::Mutex;

 use monero_serai::{
  random_scalar,
+  rpc::Rpc,
  wallet::{
    ViewPair, Scanner,
    address::{Network, AddressType, AddressSpec, AddressMeta, MoneroAddress},
    SpendableOutput,
  },
-  rpc::Rpc,
 };

 pub fn random_address() -> (Scalar, ViewPair, MoneroAddress) {
--- a/coins/monero/tests/send.rs
+++ b/coins/monero/tests/send.rs
@@ -1,6 +1,6 @@
 use monero_serai::{
-  wallet::{extra::Extra, address::SubaddressIndex, ReceivedOutput, SpendableOutput},
  transaction::Transaction,
+  wallet::{extra::Extra, address::SubaddressIndex, ReceivedOutput, SpendableOutput},
  rpc::Rpc,
 };

--- a/coins/monero/tests/wallet2_compatibility.rs
+++ b/coins/monero/tests/wallet2_compatibility.rs
@@ -19,12 +19,12 @@ use monero_rpc::{

 use monero_serai::{
  transaction::Transaction,
+  rpc::Rpc,
  wallet::{
    address::{Network, AddressSpec, SubaddressIndex, MoneroAddress},
    extra::{MAX_TX_EXTRA_NONCE_SIZE, Extra},
    Scanner,
  },
-  rpc::Rpc,
 };

 mod runner;