Merge branch 'develop' into crypto-tweaks

2025-12-09 04:39:24 +00:00 · 2023-03-16 16:43:04 -04:00
parent 669d2dbffc f4e2da2767
commit caf37527eb
173 changed files with 29638 additions and 3517 deletions
--- a/coins/monero/Cargo.toml
+++ b/coins/monero/Cargo.toml
@@ -14,6 +14,7 @@ rustdoc-args = ["--cfg", "docsrs"]
 [dependencies]
 lazy_static = "1"
 thiserror = "1"
+crc = "3"

 rand_core = "0.6"
 rand_chacha = { version = "0.3", optional = true }
@@ -24,11 +25,10 @@ zeroize = { version = "^1.5", features = ["zeroize_derive"] }
 subtle = "^2.4"

 sha3 = "0.10"
-blake2 = { version = "0.10", optional = true }

 curve25519-dalek = { version = "^3.2", features = ["std"] }

-group = { version = "0.12" }
+group = "0.12"
 dalek-ff-group = { path = "../../crypto/dalek-ff-group", version = "0.1" }
 multiexp = { path = "../../crypto/multiexp", version = "0.2", features = ["batch"] }

@@ -56,8 +56,9 @@ monero-generators = { path = "generators", version = "0.1" }
 hex-literal = "0.3"

 tokio = { version = "1", features = ["full"] }
+monero-rpc = "0.3"

 frost = { package = "modular-frost", path = "../../crypto/frost", version = "0.5", features = ["ed25519", "tests"] }

 [features]
-multisig = ["rand_chacha", "blake2", "transcript", "frost", "dleq"]
+multisig = ["rand_chacha", "transcript", "frost", "dleq"]
--- a/coins/monero/LICENSE
+++ b/coins/monero/LICENSE
@@ -1,6 +1,6 @@
 MIT License

-Copyright (c) 2022 Luke Parker
+Copyright (c) 2022-2023 Luke Parker

 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
--- a/coins/monero/generators/LICENSE
+++ b/coins/monero/generators/LICENSE
@@ -1,6 +1,6 @@
 MIT License

-Copyright (c) 2022 Luke Parker
+Copyright (c) 2022-2023 Luke Parker

 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
--- a/coins/monero/generators/src/varint.rs
+++ b/coins/monero/generators/src/varint.rs
@@ -1,7 +1,7 @@
-use std::io;
+use std::io::{self, Write};

 const VARINT_CONTINUATION_MASK: u8 = 0b1000_0000;
-pub(crate) fn write_varint<W: io::Write>(varint: &u64, w: &mut W) -> io::Result<()> {
+pub(crate) fn write_varint<W: Write>(varint: &u64, w: &mut W) -> io::Result<()> {
  let mut varint = *varint;
  while {
    let mut b = u8::try_from(varint & u64::from(!VARINT_CONTINUATION_MASK)).unwrap();
--- a/coins/monero/src/block.rs
+++ b/coins/monero/src/block.rs
@@ -1,3 +1,5 @@
+use std::io::{self, Read, Write};
+
 use crate::{serialize::*, transaction::Transaction};

 #[derive(Clone, PartialEq, Eq, Debug)]
@@ -10,7 +12,7 @@ pub struct BlockHeader {
 }

 impl BlockHeader {
-  pub fn serialize<W: std::io::Write>(&self, w: &mut W) -> std::io::Result<()> {
+  pub fn write<W: Write>(&self, w: &mut W) -> io::Result<()> {
    write_varint(&self.major_version, w)?;
    write_varint(&self.minor_version, w)?;
    write_varint(&self.timestamp, w)?;
@@ -18,7 +20,13 @@ impl BlockHeader {
    w.write_all(&self.nonce.to_le_bytes())
  }

-  pub fn deserialize<R: std::io::Read>(r: &mut R) -> std::io::Result<BlockHeader> {
+  pub fn serialize(&self) -> Vec<u8> {
+    let mut serialized = vec![];
+    self.write(&mut serialized).unwrap();
+    serialized
+  }
+
+  pub fn read<R: Read>(r: &mut R) -> io::Result<BlockHeader> {
    Ok(BlockHeader {
      major_version: read_varint(r)?,
      minor_version: read_varint(r)?,
@@ -37,9 +45,9 @@ pub struct Block {
 }

 impl Block {
-  pub fn serialize<W: std::io::Write>(&self, w: &mut W) -> std::io::Result<()> {
-    self.header.serialize(w)?;
-    self.miner_tx.serialize(w)?;
+  pub fn write<W: Write>(&self, w: &mut W) -> io::Result<()> {
+    self.header.write(w)?;
+    self.miner_tx.write(w)?;
    write_varint(&self.txs.len().try_into().unwrap(), w)?;
    for tx in &self.txs {
      w.write_all(tx)?;
@@ -47,10 +55,16 @@ impl Block {
    Ok(())
  }

-  pub fn deserialize<R: std::io::Read>(r: &mut R) -> std::io::Result<Block> {
+  pub fn serialize(&self) -> Vec<u8> {
+    let mut serialized = vec![];
+    self.write(&mut serialized).unwrap();
+    serialized
+  }
+
+  pub fn read<R: Read>(r: &mut R) -> io::Result<Block> {
    Ok(Block {
-      header: BlockHeader::deserialize(r)?,
-      miner_tx: Transaction::deserialize(r)?,
+      header: BlockHeader::read(r)?,
+      miner_tx: Transaction::read(r)?,
      txs: (0 .. read_varint(r)?).map(|_| read_bytes(r)).collect::<Result<_, _>>()?,
    })
  }
--- a/coins/monero/src/lib.rs
+++ b/coins/monero/src/lib.rs
@@ -56,7 +56,6 @@ mod tests;
 #[derive(Clone, Copy, PartialEq, Eq, Debug, Zeroize)]
 #[allow(non_camel_case_types)]
 pub enum Protocol {
-  Unsupported(usize),
  v14,
  v16,
  Custom { ring_len: usize, bp_plus: bool },
@@ -66,7 +65,6 @@ impl Protocol {
  /// Amount of ring members under this protocol version.
  pub fn ring_len(&self) -> usize {
    match self {
-      Protocol::Unsupported(_) => panic!("Unsupported protocol version"),
      Protocol::v14 => 11,
      Protocol::v16 => 16,
      Protocol::Custom { ring_len, .. } => *ring_len,
@@ -77,7 +75,6 @@ impl Protocol {
  /// This method will likely be reworked when versions not using Bulletproofs at all are added.
  pub fn bp_plus(&self) -> bool {
    match self {
-      Protocol::Unsupported(_) => panic!("Unsupported protocol version"),
      Protocol::v14 => false,
      Protocol::v16 => true,
      Protocol::Custom { bp_plus, .. } => *bp_plus,
--- a/coins/monero/src/ringct/bulletproofs/mod.rs
+++ b/coins/monero/src/ringct/bulletproofs/mod.rs
@@ -1,5 +1,7 @@
 #![allow(non_snake_case)]

+use std::io::{self, Read, Write};
+
 use rand_core::{RngCore, CryptoRng};

 use zeroize::Zeroize;
@@ -35,6 +37,7 @@ impl Bulletproofs {
  pub(crate) fn fee_weight(plus: bool, outputs: usize) -> usize {
    let fields = if plus { 6 } else { 9 };

+    // TODO: Shouldn't this use u32/u64?
    #[allow(non_snake_case)]
    let mut LR_len = usize::try_from(usize::BITS - (outputs - 1).leading_zeros()).unwrap();
    let padded_outputs = 1 << LR_len;
@@ -93,11 +96,11 @@ impl Bulletproofs {
    }
  }

-  fn serialize_core<W: std::io::Write, F: Fn(&[EdwardsPoint], &mut W) -> std::io::Result<()>>(
+  fn write_core<W: Write, F: Fn(&[EdwardsPoint], &mut W) -> io::Result<()>>(
    &self,
    w: &mut W,
    specific_write_vec: F,
-  ) -> std::io::Result<()> {
+  ) -> io::Result<()> {
    match self {
      Bulletproofs::Original(bp) => {
        write_point(&bp.A, w)?;
@@ -126,16 +129,22 @@ impl Bulletproofs {
    }
  }

-  pub(crate) fn signature_serialize<W: std::io::Write>(&self, w: &mut W) -> std::io::Result<()> {
-    self.serialize_core(w, |points, w| write_raw_vec(write_point, points, w))
+  pub(crate) fn signature_write<W: Write>(&self, w: &mut W) -> io::Result<()> {
+    self.write_core(w, |points, w| write_raw_vec(write_point, points, w))
  }

-  pub fn serialize<W: std::io::Write>(&self, w: &mut W) -> std::io::Result<()> {
-    self.serialize_core(w, |points, w| write_vec(write_point, points, w))
+  pub fn write<W: Write>(&self, w: &mut W) -> io::Result<()> {
+    self.write_core(w, |points, w| write_vec(write_point, points, w))
  }

-  /// Deserialize non-plus Bulletproofs.
-  pub fn deserialize<R: std::io::Read>(r: &mut R) -> std::io::Result<Bulletproofs> {
+  pub fn serialize(&self) -> Vec<u8> {
+    let mut serialized = vec![];
+    self.write(&mut serialized).unwrap();
+    serialized
+  }
+
+  /// Read Bulletproofs.
+  pub fn read<R: Read>(r: &mut R) -> io::Result<Bulletproofs> {
    Ok(Bulletproofs::Original(OriginalStruct {
      A: read_point(r)?,
      S: read_point(r)?,
@@ -151,8 +160,8 @@ impl Bulletproofs {
    }))
  }

-  /// Deserialize Bulletproofs+.
-  pub fn deserialize_plus<R: std::io::Read>(r: &mut R) -> std::io::Result<Bulletproofs> {
+  /// Read Bulletproofs+.
+  pub fn read_plus<R: Read>(r: &mut R) -> io::Result<Bulletproofs> {
    Ok(Bulletproofs::Plus(PlusStruct {
      A: read_point(r)?,
      A1: read_point(r)?,
--- a/coins/monero/src/ringct/clsag/mod.rs
+++ b/coins/monero/src/ringct/clsag/mod.rs
@@ -1,6 +1,7 @@
 #![allow(non_snake_case)]

 use core::ops::Deref;
+use std::io::{self, Read, Write};

 use lazy_static::lazy_static;
 use thiserror::Error;
@@ -313,13 +314,13 @@ impl Clsag {
    (ring_len * 32) + 32 + 32
  }

-  pub fn serialize<W: std::io::Write>(&self, w: &mut W) -> std::io::Result<()> {
+  pub fn write<W: Write>(&self, w: &mut W) -> io::Result<()> {
    write_raw_vec(write_scalar, &self.s, w)?;
    w.write_all(&self.c1.to_bytes())?;
    write_point(&self.D, w)
  }

-  pub fn deserialize<R: std::io::Read>(decoys: usize, r: &mut R) -> std::io::Result<Clsag> {
+  pub fn read<R: Read>(decoys: usize, r: &mut R) -> io::Result<Clsag> {
    Ok(Clsag { s: read_raw_vec(read_scalar, decoys, r)?, c1: read_scalar(r)?, D: read_point(r)? })
  }
 }
--- a/coins/monero/src/ringct/clsag/multisig.rs
+++ b/coins/monero/src/ringct/clsag/multisig.rs
@@ -41,18 +41,17 @@ impl ClsagInput {
    // Doesn't domain separate as this is considered part of the larger CLSAG proof

    // Ring index
-    transcript.append_message(b"ring_index", [self.decoys.i]);
+    transcript.append_message(b"real_spend", [self.decoys.i]);

    // Ring
-    let mut ring = vec![];
-    for pair in &self.decoys.ring {
+    for (i, pair) in self.decoys.ring.iter().enumerate() {
      // Doesn't include global output indexes as CLSAG doesn't care and won't be affected by it
      // They're just a unreliable reference to this data which will be included in the message
      // if in use
-      ring.extend(pair[0].compress().to_bytes());
-      ring.extend(pair[1].compress().to_bytes());
+      transcript.append_message(b"member", [u8::try_from(i).expect("ring size exceeded 255")]);
+      transcript.append_message(b"key", pair[0].compress().to_bytes());
+      transcript.append_message(b"commitment", pair[1].compress().to_bytes())
    }
-    transcript.append_message(b"ring", ring);

    // Doesn't include the commitment's parts as the above ring + index includes the commitment
    // The only potential malleability would be if the G/H relationship is known breaking the
--- a/coins/monero/src/ringct/mod.rs
+++ b/coins/monero/src/ringct/mod.rs
@@ -1,4 +1,5 @@
 use core::ops::Deref;
+use std::io::{self, Read, Write};

 use zeroize::Zeroizing;

@@ -35,7 +36,7 @@ impl RctBase {
    1 + 8 + (outputs * (8 + 32))
  }

-  pub fn serialize<W: std::io::Write>(&self, w: &mut W, rct_type: u8) -> std::io::Result<()> {
+  pub fn write<W: Write>(&self, w: &mut W, rct_type: u8) -> io::Result<()> {
    w.write_all(&[rct_type])?;
    match rct_type {
      0 => Ok(()),
@@ -50,10 +51,7 @@ impl RctBase {
    }
  }

-  pub fn deserialize<R: std::io::Read>(
-    outputs: usize,
-    r: &mut R,
-  ) -> std::io::Result<(RctBase, u8)> {
+  pub fn read<R: Read>(outputs: usize, r: &mut R) -> io::Result<(RctBase, u8)> {
    let rct_type = read_byte(r)?;
    Ok((
      if rct_type == 0 {
@@ -96,46 +94,43 @@ impl RctPrunable {
      (inputs * (Clsag::fee_weight(protocol.ring_len()) + 32))
  }

-  pub fn serialize<W: std::io::Write>(&self, w: &mut W) -> std::io::Result<()> {
+  pub fn write<W: Write>(&self, w: &mut W) -> io::Result<()> {
    match self {
      RctPrunable::Null => Ok(()),
      RctPrunable::Clsag { bulletproofs, clsags, pseudo_outs, .. } => {
-        write_vec(Bulletproofs::serialize, bulletproofs, w)?;
-        write_raw_vec(Clsag::serialize, clsags, w)?;
+        write_vec(Bulletproofs::write, bulletproofs, w)?;
+        write_raw_vec(Clsag::write, clsags, w)?;
        write_raw_vec(write_point, pseudo_outs, w)
      }
    }
  }

-  pub fn deserialize<R: std::io::Read>(
-    rct_type: u8,
-    decoys: &[usize],
-    r: &mut R,
-  ) -> std::io::Result<RctPrunable> {
+  pub fn serialize(&self) -> Vec<u8> {
+    let mut serialized = vec![];
+    self.write(&mut serialized).unwrap();
+    serialized
+  }
+
+  pub fn read<R: Read>(rct_type: u8, decoys: &[usize], r: &mut R) -> io::Result<RctPrunable> {
    Ok(match rct_type {
      0 => RctPrunable::Null,
      5 | 6 => RctPrunable::Clsag {
        bulletproofs: read_vec(
-          if rct_type == 5 { Bulletproofs::deserialize } else { Bulletproofs::deserialize_plus },
+          if rct_type == 5 { Bulletproofs::read } else { Bulletproofs::read_plus },
          r,
        )?,
-        clsags: (0 .. decoys.len())
-          .map(|o| Clsag::deserialize(decoys[o], r))
-          .collect::<Result<_, _>>()?,
+        clsags: (0 .. decoys.len()).map(|o| Clsag::read(decoys[o], r)).collect::<Result<_, _>>()?,
        pseudo_outs: read_raw_vec(read_point, decoys.len(), r)?,
      },
-      _ => Err(std::io::Error::new(
-        std::io::ErrorKind::Other,
-        "Tried to deserialize unknown RCT type",
-      ))?,
+      _ => Err(io::Error::new(io::ErrorKind::Other, "Tried to deserialize unknown RCT type"))?,
    })
  }

-  pub(crate) fn signature_serialize<W: std::io::Write>(&self, w: &mut W) -> std::io::Result<()> {
+  pub(crate) fn signature_write<W: Write>(&self, w: &mut W) -> io::Result<()> {
    match self {
      RctPrunable::Null => panic!("Serializing RctPrunable::Null for a signature"),
      RctPrunable::Clsag { bulletproofs, .. } => {
-        bulletproofs.iter().try_for_each(|bp| bp.signature_serialize(w))
+        bulletproofs.iter().try_for_each(|bp| bp.signature_write(w))
      }
    }
  }
@@ -152,17 +147,19 @@ impl RctSignatures {
    RctBase::fee_weight(outputs) + RctPrunable::fee_weight(protocol, inputs, outputs)
  }

-  pub fn serialize<W: std::io::Write>(&self, w: &mut W) -> std::io::Result<()> {
-    self.base.serialize(w, self.prunable.rct_type())?;
-    self.prunable.serialize(w)
+  pub fn write<W: Write>(&self, w: &mut W) -> io::Result<()> {
+    self.base.write(w, self.prunable.rct_type())?;
+    self.prunable.write(w)
  }

-  pub fn deserialize<R: std::io::Read>(
-    decoys: Vec<usize>,
-    outputs: usize,
-    r: &mut R,
-  ) -> std::io::Result<RctSignatures> {
-    let base = RctBase::deserialize(outputs, r)?;
-    Ok(RctSignatures { base: base.0, prunable: RctPrunable::deserialize(base.1, &decoys, r)? })
+  pub fn serialize(&self) -> Vec<u8> {
+    let mut serialized = vec![];
+    self.write(&mut serialized).unwrap();
+    serialized
+  }
+
+  pub fn read<R: Read>(decoys: Vec<usize>, outputs: usize, r: &mut R) -> io::Result<RctSignatures> {
+    let base = RctBase::read(outputs, r)?;
+    Ok(RctSignatures { base: base.0, prunable: RctPrunable::read(base.1, &decoys, r)? })
  }
 }
--- a/coins/monero/src/rpc.rs
+++ b/coins/monero/src/rpc.rs
@@ -27,7 +27,6 @@ pub struct JsonRpcResponse<T> {
 #[derive(Deserialize, Debug)]
 struct TransactionResponse {
  tx_hash: String,
-  block_height: Option<usize>,
  as_hex: String,
  pruned_as_hex: String,
 }
@@ -46,6 +45,8 @@ pub enum RpcError {
  ConnectionError,
  #[error("invalid node")]
  InvalidNode,
+  #[error("unsupported protocol version ({0})")]
+  UnsupportedProtocol(usize),
  #[error("transactions not found")]
  TransactionsNotFound(Vec<[u8; 32]>),
  #[error("invalid point ({0})")]
@@ -212,7 +213,7 @@ impl Rpc {
      {
        13 | 14 => Protocol::v14,
        15 | 16 => Protocol::v16,
-        version => Protocol::Unsupported(version),
+        protocol => Err(RpcError::UnsupportedProtocol(protocol))?,
      },
    )
  }
@@ -248,10 +249,12 @@ impl Rpc {
    txs
      .txs
      .iter()
-      .map(|res| {
-        let tx = Transaction::deserialize(&mut std::io::Cursor::new(rpc_hex(
-          if !res.as_hex.is_empty() { &res.as_hex } else { &res.pruned_as_hex },
-        )?))
+      .enumerate()
+      .map(|(i, res)| {
+        let tx = Transaction::read::<&[u8]>(
+          &mut rpc_hex(if !res.as_hex.is_empty() { &res.as_hex } else { &res.pruned_as_hex })?
+            .as_ref(),
+        )
        .map_err(|_| match hash_hex(&res.tx_hash) {
          Ok(hash) => RpcError::InvalidTransaction(hash),
          Err(err) => err,
@@ -265,6 +268,12 @@ impl Rpc {
          }
        }

+        // This does run a few keccak256 hashes, which is pointless if the node is trusted
+        // In exchange, this provides resilience against invalid/malicious nodes
+        if tx.hash() != hashes[i] {
+          Err(RpcError::InvalidNode)?;
+        }
+
        Ok(tx)
      })
      .collect()
@@ -274,40 +283,71 @@ impl Rpc {
    self.get_transactions(&[tx]).await.map(|mut txs| txs.swap_remove(0))
  }

-  pub async fn get_transaction_block_number(&self, tx: &[u8]) -> Result<Option<usize>, RpcError> {
-    let txs: TransactionsResponse =
-      self.rpc_call("get_transactions", Some(json!({ "txs_hashes": [hex::encode(tx)] }))).await?;
-
-    if !txs.missed_tx.is_empty() {
-      Err(RpcError::TransactionsNotFound(
-        txs.missed_tx.iter().map(|hash| hash_hex(hash)).collect::<Result<_, _>>()?,
-      ))?;
+  /// Get the hash of a block from the node by the block's numbers.
+  /// This function does not verify the returned block hash is actually for the number in question.
+  pub async fn get_block_hash(&self, number: usize) -> Result<[u8; 32], RpcError> {
+    #[derive(Deserialize, Debug)]
+    struct BlockHeaderResponse {
+      hash: String,
+    }
+    #[derive(Deserialize, Debug)]
+    struct BlockHeaderByHeightResponse {
+      block_header: BlockHeaderResponse,
    }

-    Ok(txs.txs[0].block_height)
+    let header: BlockHeaderByHeightResponse =
+      self.json_rpc_call("get_block_header_by_height", Some(json!({ "height": number }))).await?;
+    rpc_hex(&header.block_header.hash)?.try_into().map_err(|_| RpcError::InvalidNode)
  }

-  pub async fn get_block(&self, height: usize) -> Result<Block, RpcError> {
+  /// Get a block from the node by its hash.
+  /// This function does not verify the returned block actually has the hash in question.
+  pub async fn get_block(&self, hash: [u8; 32]) -> Result<Block, RpcError> {
    #[derive(Deserialize, Debug)]
    struct BlockResponse {
      blob: String,
    }

-    let block: BlockResponse =
-      self.json_rpc_call("get_block", Some(json!({ "height": height }))).await?;
-    Ok(
-      Block::deserialize(&mut std::io::Cursor::new(rpc_hex(&block.blob)?))
-        .expect("Monero returned a block we couldn't deserialize"),
-    )
+    let res: BlockResponse =
+      self.json_rpc_call("get_block", Some(json!({ "hash": hex::encode(hash) }))).await?;
+
+    // TODO: Verify the TXs included are actually committed to by the header
+    Block::read::<&[u8]>(&mut rpc_hex(&res.blob)?.as_ref()).map_err(|_| RpcError::InvalidNode)
  }

-  pub async fn get_block_transactions(&self, height: usize) -> Result<Vec<Transaction>, RpcError> {
-    let block = self.get_block(height).await?;
+  pub async fn get_block_by_number(&self, number: usize) -> Result<Block, RpcError> {
+    match self.get_block(self.get_block_hash(number).await?).await {
+      Ok(block) => {
+        // Make sure this is actually the block for this number
+        match block.miner_tx.prefix.inputs[0] {
+          Input::Gen(actual) => {
+            if usize::try_from(actual).unwrap() == number {
+              Ok(block)
+            } else {
+              Err(RpcError::InvalidNode)
+            }
+          }
+          _ => Err(RpcError::InvalidNode),
+        }
+      }
+      e => e,
+    }
+  }
+
+  pub async fn get_block_transactions(&self, hash: [u8; 32]) -> Result<Vec<Transaction>, RpcError> {
+    let block = self.get_block(hash).await?;
    let mut res = vec![block.miner_tx];
    res.extend(self.get_transactions(&block.txs).await?);
    Ok(res)
  }

+  pub async fn get_block_transactions_by_number(
+    &self,
+    number: usize,
+  ) -> Result<Vec<Transaction>, RpcError> {
+    self.get_block_transactions(self.get_block_hash(number).await?).await
+  }
+
  /// Get the output indexes of the specified transaction.
  pub async fn get_o_indexes(&self, hash: [u8; 32]) -> Result<Vec<u64>, RpcError> {
    #[derive(Serialize, Debug)]
@@ -370,8 +410,9 @@ impl Rpc {
    Ok(distributions.distributions.swap_remove(0).distribution)
  }

-  /// Get the specified outputs from the RingCT (zero-amount) pool, but only return them if they're
-  /// unlocked.
+  /// Get the specified outputs from the RingCT (zero-amount) pool, but only return them if their
+  /// timelock has been satisfied. This is distinct from being free of the 10-block lock applied to
+  /// all Monero transactions.
  pub async fn get_unlocked_outputs(
    &self,
    indexes: &[u64],
@@ -407,13 +448,8 @@ impl Rpc {
        &outs
          .outs
          .iter()
-          .map(|out| {
-            rpc_hex(&out.txid)
-              .expect("Monero returned an invalidly encoded hash")
-              .try_into()
-              .expect("Monero returned an invalid sized hash")
-          })
-          .collect::<Vec<_>>(),
+          .map(|out| rpc_hex(&out.txid)?.try_into().map_err(|_| RpcError::InvalidNode))
+          .collect::<Result<Vec<_>, _>>()?,
      )
      .await?;

@@ -466,7 +502,7 @@ impl Rpc {
    }

    let mut buf = Vec::with_capacity(2048);
-    tx.serialize(&mut buf).unwrap();
+    tx.write(&mut buf).unwrap();
    let res: SendRawResponse = self
      .rpc_call("send_raw_transaction", Some(json!({ "tx_as_hex": hex::encode(&buf) })))
      .await?;
--- a/coins/monero/src/serialize.rs
+++ b/coins/monero/src/serialize.rs
@@ -1,4 +1,4 @@
-use std::io;
+use std::io::{self, Read, Write};

 use curve25519_dalek::{
  scalar::Scalar,
@@ -11,11 +11,11 @@ pub(crate) fn varint_len(varint: usize) -> usize {
  ((usize::try_from(usize::BITS - varint.leading_zeros()).unwrap().saturating_sub(1)) / 7) + 1
 }

-pub(crate) fn write_byte<W: io::Write>(byte: &u8, w: &mut W) -> io::Result<()> {
+pub(crate) fn write_byte<W: Write>(byte: &u8, w: &mut W) -> io::Result<()> {
  w.write_all(&[*byte])
 }

-pub(crate) fn write_varint<W: io::Write>(varint: &u64, w: &mut W) -> io::Result<()> {
+pub(crate) fn write_varint<W: Write>(varint: &u64, w: &mut W) -> io::Result<()> {
  let mut varint = *varint;
  while {
    let mut b = u8::try_from(varint & u64::from(!VARINT_CONTINUATION_MASK)).unwrap();
@@ -29,15 +29,15 @@ pub(crate) fn write_varint<W: io::Write>(varint: &u64, w: &mut W) -> io::Result<
  Ok(())
 }

-pub(crate) fn write_scalar<W: io::Write>(scalar: &Scalar, w: &mut W) -> io::Result<()> {
+pub(crate) fn write_scalar<W: Write>(scalar: &Scalar, w: &mut W) -> io::Result<()> {
  w.write_all(&scalar.to_bytes())
 }

-pub(crate) fn write_point<W: io::Write>(point: &EdwardsPoint, w: &mut W) -> io::Result<()> {
+pub(crate) fn write_point<W: Write>(point: &EdwardsPoint, w: &mut W) -> io::Result<()> {
  w.write_all(&point.compress().to_bytes())
 }

-pub(crate) fn write_raw_vec<T, W: io::Write, F: Fn(&T, &mut W) -> io::Result<()>>(
+pub(crate) fn write_raw_vec<T, W: Write, F: Fn(&T, &mut W) -> io::Result<()>>(
  f: F,
  values: &[T],
  w: &mut W,
@@ -48,7 +48,7 @@ pub(crate) fn write_raw_vec<T, W: io::Write, F: Fn(&T, &mut W) -> io::Result<()>
  Ok(())
 }

-pub(crate) fn write_vec<T, W: io::Write, F: Fn(&T, &mut W) -> io::Result<()>>(
+pub(crate) fn write_vec<T, W: Write, F: Fn(&T, &mut W) -> io::Result<()>>(
  f: F,
  values: &[T],
  w: &mut W,
@@ -57,25 +57,25 @@ pub(crate) fn write_vec<T, W: io::Write, F: Fn(&T, &mut W) -> io::Result<()>>(
  write_raw_vec(f, values, w)
 }

-pub(crate) fn read_bytes<R: io::Read, const N: usize>(r: &mut R) -> io::Result<[u8; N]> {
+pub(crate) fn read_bytes<R: Read, const N: usize>(r: &mut R) -> io::Result<[u8; N]> {
  let mut res = [0; N];
  r.read_exact(&mut res)?;
  Ok(res)
 }

-pub(crate) fn read_byte<R: io::Read>(r: &mut R) -> io::Result<u8> {
+pub(crate) fn read_byte<R: Read>(r: &mut R) -> io::Result<u8> {
  Ok(read_bytes::<_, 1>(r)?[0])
 }

-pub(crate) fn read_u64<R: io::Read>(r: &mut R) -> io::Result<u64> {
+pub(crate) fn read_u64<R: Read>(r: &mut R) -> io::Result<u64> {
  read_bytes(r).map(u64::from_le_bytes)
 }

-pub(crate) fn read_u32<R: io::Read>(r: &mut R) -> io::Result<u32> {
+pub(crate) fn read_u32<R: Read>(r: &mut R) -> io::Result<u32> {
  read_bytes(r).map(u32::from_le_bytes)
 }

-pub(crate) fn read_varint<R: io::Read>(r: &mut R) -> io::Result<u64> {
+pub(crate) fn read_varint<R: Read>(r: &mut R) -> io::Result<u64> {
  let mut bits = 0;
  let mut res = 0;
  while {
@@ -100,12 +100,12 @@ pub(crate) fn read_varint<R: io::Read>(r: &mut R) -> io::Result<u64> {
 // for now. There's also further edge cases as noted by
 // https://github.com/monero-project/monero/issues/8438, where some scalars had an archaic
 // reduction applied
-pub(crate) fn read_scalar<R: io::Read>(r: &mut R) -> io::Result<Scalar> {
+pub(crate) fn read_scalar<R: Read>(r: &mut R) -> io::Result<Scalar> {
  Scalar::from_canonical_bytes(read_bytes(r)?)
    .ok_or_else(|| io::Error::new(io::ErrorKind::Other, "unreduced scalar"))
 }

-pub(crate) fn read_point<R: io::Read>(r: &mut R) -> io::Result<EdwardsPoint> {
+pub(crate) fn read_point<R: Read>(r: &mut R) -> io::Result<EdwardsPoint> {
  let bytes = read_bytes(r)?;
  CompressedEdwardsY(bytes)
    .decompress()
@@ -114,14 +114,14 @@ pub(crate) fn read_point<R: io::Read>(r: &mut R) -> io::Result<EdwardsPoint> {
    .ok_or_else(|| io::Error::new(io::ErrorKind::Other, "invalid point"))
 }

-pub(crate) fn read_torsion_free_point<R: io::Read>(r: &mut R) -> io::Result<EdwardsPoint> {
+pub(crate) fn read_torsion_free_point<R: Read>(r: &mut R) -> io::Result<EdwardsPoint> {
  read_point(r)
    .ok()
    .filter(|point| point.is_torsion_free())
    .ok_or_else(|| io::Error::new(io::ErrorKind::Other, "invalid point"))
 }

-pub(crate) fn read_raw_vec<R: io::Read, T, F: Fn(&mut R) -> io::Result<T>>(
+pub(crate) fn read_raw_vec<R: Read, T, F: Fn(&mut R) -> io::Result<T>>(
  f: F,
  len: usize,
  r: &mut R,
@@ -133,7 +133,7 @@ pub(crate) fn read_raw_vec<R: io::Read, T, F: Fn(&mut R) -> io::Result<T>>(
  Ok(res)
 }

-pub(crate) fn read_vec<R: io::Read, T, F: Fn(&mut R) -> io::Result<T>>(
+pub(crate) fn read_vec<R: Read, T, F: Fn(&mut R) -> io::Result<T>>(
  f: F,
  r: &mut R,
 ) -> io::Result<Vec<T>> {
--- a/coins/monero/src/tests/address.rs
+++ b/coins/monero/src/tests/address.rs
@@ -33,9 +33,9 @@ fn standard_address() {
  let addr = MoneroAddress::from_str(Network::Mainnet, STANDARD).unwrap();
  assert_eq!(addr.meta.network, Network::Mainnet);
  assert_eq!(addr.meta.kind, AddressType::Standard);
-  assert!(!addr.meta.kind.subaddress());
+  assert!(!addr.meta.kind.is_subaddress());
  assert_eq!(addr.meta.kind.payment_id(), None);
-  assert!(!addr.meta.kind.guaranteed());
+  assert!(!addr.meta.kind.is_guaranteed());
  assert_eq!(addr.spend.compress().to_bytes(), SPEND);
  assert_eq!(addr.view.compress().to_bytes(), VIEW);
  assert_eq!(addr.to_string(), STANDARD);
@@ -46,9 +46,9 @@ fn integrated_address() {
  let addr = MoneroAddress::from_str(Network::Mainnet, INTEGRATED).unwrap();
  assert_eq!(addr.meta.network, Network::Mainnet);
  assert_eq!(addr.meta.kind, AddressType::Integrated(PAYMENT_ID));
-  assert!(!addr.meta.kind.subaddress());
+  assert!(!addr.meta.kind.is_subaddress());
  assert_eq!(addr.meta.kind.payment_id(), Some(PAYMENT_ID));
-  assert!(!addr.meta.kind.guaranteed());
+  assert!(!addr.meta.kind.is_guaranteed());
  assert_eq!(addr.spend.compress().to_bytes(), SPEND);
  assert_eq!(addr.view.compress().to_bytes(), VIEW);
  assert_eq!(addr.to_string(), INTEGRATED);
@@ -59,9 +59,9 @@ fn subaddress() {
  let addr = MoneroAddress::from_str(Network::Mainnet, SUBADDRESS).unwrap();
  assert_eq!(addr.meta.network, Network::Mainnet);
  assert_eq!(addr.meta.kind, AddressType::Subaddress);
-  assert!(addr.meta.kind.subaddress());
+  assert!(addr.meta.kind.is_subaddress());
  assert_eq!(addr.meta.kind.payment_id(), None);
-  assert!(!addr.meta.kind.guaranteed());
+  assert!(!addr.meta.kind.is_guaranteed());
  assert_eq!(addr.spend.compress().to_bytes(), SUB_SPEND);
  assert_eq!(addr.view.compress().to_bytes(), SUB_VIEW);
  assert_eq!(addr.to_string(), SUBADDRESS);
@@ -83,13 +83,14 @@ fn featured() {

        let subaddress = (features & SUBADDRESS_FEATURE_BIT) == SUBADDRESS_FEATURE_BIT;

-        let mut id = [0; 8];
-        OsRng.fill_bytes(&mut id);
-        let id = Some(id).filter(|_| (features & INTEGRATED_FEATURE_BIT) == INTEGRATED_FEATURE_BIT);
+        let mut payment_id = [0; 8];
+        OsRng.fill_bytes(&mut payment_id);
+        let payment_id = Some(payment_id)
+          .filter(|_| (features & INTEGRATED_FEATURE_BIT) == INTEGRATED_FEATURE_BIT);

        let guaranteed = (features & GUARANTEED_FEATURE_BIT) == GUARANTEED_FEATURE_BIT;

-        let kind = AddressType::Featured(subaddress, id, guaranteed);
+        let kind = AddressType::Featured { subaddress, payment_id, guaranteed };
        let meta = AddressMeta::new(network, kind);
        let addr = MoneroAddress::new(meta, spend, view);

@@ -99,9 +100,9 @@ fn featured() {
        assert_eq!(addr.spend, spend);
        assert_eq!(addr.view, view);

-        assert_eq!(addr.subaddress(), subaddress);
-        assert_eq!(addr.payment_id(), id);
-        assert_eq!(addr.guaranteed(), guaranteed);
+        assert_eq!(addr.is_subaddress(), subaddress);
+        assert_eq!(addr.payment_id(), payment_id);
+        assert_eq!(addr.is_guaranteed(), guaranteed);
      }
    }
  }
@@ -150,16 +151,20 @@ fn featured_vectors() {
    assert_eq!(addr.spend, spend);
    assert_eq!(addr.view, view);

-    assert_eq!(addr.subaddress(), vector.subaddress);
+    assert_eq!(addr.is_subaddress(), vector.subaddress);
    assert_eq!(vector.integrated, vector.payment_id.is_some());
    assert_eq!(addr.payment_id(), vector.payment_id);
-    assert_eq!(addr.guaranteed(), vector.guaranteed);
+    assert_eq!(addr.is_guaranteed(), vector.guaranteed);

    assert_eq!(
      MoneroAddress::new(
        AddressMeta::new(
          network,
-          AddressType::Featured(vector.subaddress, vector.payment_id, vector.guaranteed)
+          AddressType::Featured {
+            subaddress: vector.subaddress,
+            payment_id: vector.payment_id,
+            guaranteed: vector.guaranteed
+          }
        ),
        spend,
        view
--- a/coins/monero/src/tests/clsag.rs
+++ b/coins/monero/src/tests/clsag.rs
@@ -66,7 +66,7 @@ fn clsag() {
          Commitment::new(secrets.1, AMOUNT),
          Decoys {
            i: u8::try_from(real).unwrap(),
-            offsets: (1 ..= RING_LEN).into_iter().collect(),
+            offsets: (1 ..= RING_LEN).collect(),
            ring: ring.clone(),
          },
        )
@@ -110,11 +110,7 @@ fn clsag_multisig() {
    Arc::new(RwLock::new(Some(ClsagDetails::new(
      ClsagInput::new(
        Commitment::new(randomness, AMOUNT),
-        Decoys {
-          i: RING_INDEX,
-          offsets: (1 ..= RING_LEN).into_iter().collect(),
-          ring: ring.clone(),
-        },
+        Decoys { i: RING_INDEX, offsets: (1 ..= RING_LEN).collect(), ring: ring.clone() },
      )
      .unwrap(),
      mask_sum,
--- a/coins/monero/src/tests/mod.rs
+++ b/coins/monero/src/tests/mod.rs
@@ -1,3 +1,4 @@
 mod clsag;
 mod bulletproofs;
 mod address;
+mod seed;
--- a/coins/monero/src/tests/seed.rs
+++ b/coins/monero/src/tests/seed.rs
@@ -0,0 +1,177 @@
+use zeroize::Zeroizing;
+
+use rand_core::OsRng;
+
+use curve25519_dalek::scalar::Scalar;
+
+use crate::{
+  hash,
+  wallet::seed::{Seed, Language, classic::trim_by_lang},
+};
+
+#[test]
+fn test_classic_seed() {
+  struct Vector {
+    language: Language,
+    seed: String,
+    spend: String,
+    view: String,
+  }
+
+  let vectors = [
+    Vector {
+      language: Language::Chinese,
+      seed: "摇 曲 艺 武 滴 然 效 似 赏 式 祥 歌 买 疑 小 碧 堆 博 键 房 鲜 悲 付 喷 武".into(),
+      spend: "a5e4fff1706ef9212993a69f246f5c95ad6d84371692d63e9bb0ea112a58340d".into(),
+      view: "1176c43ce541477ea2f3ef0b49b25112b084e26b8a843e1304ac4677b74cdf02".into(),
+    },
+    Vector {
+      language: Language::English,
+      seed: "washing thirsty occur lectures tuesday fainted toxic adapt \
+               abnormal memoir nylon mostly building shrugged online ember northern \
+               ruby woes dauntless boil family illness inroads northern"
+        .into(),
+      spend: "c0af65c0dd837e666b9d0dfed62745f4df35aed7ea619b2798a709f0fe545403".into(),
+      view: "513ba91c538a5a9069e0094de90e927c0cd147fa10428ce3ac1afd49f63e3b01".into(),
+    },
+    Vector {
+      language: Language::Dutch,
+      seed: "setwinst riphagen vimmetje extase blief tuitelig fuiven meifeest \
+               ponywagen zesmaal ripdeal matverf codetaal leut ivoor rotten \
+               wisgerhof winzucht typograaf atrium rein zilt traktaat verzaagd setwinst"
+        .into(),
+      spend: "e2d2873085c447c2bc7664222ac8f7d240df3aeac137f5ff2022eaa629e5b10a".into(),
+      view: "eac30b69477e3f68093d131c7fd961564458401b07f8c87ff8f6030c1a0c7301".into(),
+    },
+    Vector {
+      language: Language::French,
+      seed: "poids vaseux tarte bazar poivre effet entier nuance \
+               sensuel ennui pacte osselet poudre battre alibi mouton \
+               stade paquet pliage gibier type question position projet pliage"
+        .into(),
+      spend: "2dd39ff1a4628a94b5c2ec3e42fb3dfe15c2b2f010154dc3b3de6791e805b904".into(),
+      view: "6725b32230400a1032f31d622b44c3a227f88258939b14a7c72e00939e7bdf0e".into(),
+    },
+    Vector {
+      language: Language::Spanish,
+      seed: "minero ocupar mirar evadir octubre cal logro miope \
+               opaco disco ancla litio clase cuello nasal clase \
+               fiar avance deseo mente grumo negro cordón croqueta clase"
+        .into(),
+      spend: "ae2c9bebdddac067d73ec0180147fc92bdf9ac7337f1bcafbbe57dd13558eb02".into(),
+      view: "18deafb34d55b7a43cae2c1c1c206a3c80c12cc9d1f84640b484b95b7fec3e05".into(),
+    },
+    Vector {
+      language: Language::German,
+      seed: "Kaliber Gabelung Tapir Liveband Favorit Specht Enklave Nabel \
+               Jupiter Foliant Chronik nisten löten Vase Aussage Rekord \
+               Yeti Gesetz Eleganz Alraune Künstler Almweide Jahr Kastanie Almweide"
+        .into(),
+      spend: "79801b7a1b9796856e2397d862a113862e1fdc289a205e79d8d70995b276db06".into(),
+      view: "99f0ec556643bd9c038a4ed86edcb9c6c16032c4622ed2e000299d527a792701".into(),
+    },
+    Vector {
+      language: Language::Italian,
+      seed: "cavo pancetta auto fulmine alleanza filmato diavolo prato \
+               forzare meritare litigare lezione segreto evasione votare buio \
+               licenza cliente dorso natale crescere vento tutelare vetta evasione"
+        .into(),
+      spend: "5e7fd774eb00fa5877e2a8b4dc9c7ffe111008a3891220b56a6e49ac816d650a".into(),
+      view: "698a1dce6018aef5516e82ca0cb3e3ec7778d17dfb41a137567bfa2e55e63a03".into(),
+    },
+    Vector {
+      language: Language::Portuguese,
+      seed: "agito eventualidade onus itrio holograma sodomizar objetos dobro \
+               iugoslavo bcrepuscular odalisca abjeto iuane darwinista eczema acetona \
+               cibernetico hoquei gleba driver buffer azoto megera nogueira agito"
+        .into(),
+      spend: "13b3115f37e35c6aa1db97428b897e584698670c1b27854568d678e729200c0f".into(),
+      view: "ad1b4fd35270f5f36c4da7166672b347e75c3f4d41346ec2a06d1d0193632801".into(),
+    },
+    Vector {
+      language: Language::Japanese,
+      seed: "ぜんぶ どうぐ おたがい せんきょ おうじ そんちょう じゅしん いろえんぴつ \
+               かほう つかれる えらぶ にちじょう くのう にちようび ぬまえび さんきゃく \
+               おおや ちぬき うすめる いがく せつでん さうな すいえい せつだん おおや"
+        .into(),
+      spend: "c56e895cdb13007eda8399222974cdbab493640663804b93cbef3d8c3df80b0b".into(),
+      view: "6c3634a313ec2ee979d565c33888fd7c3502d696ce0134a8bc1a2698c7f2c508".into(),
+    },
+    Vector {
+      language: Language::Russian,
+      seed: "шатер икра нация ехать получать инерция доза реальный \
+               рыжий таможня лопата душа веселый клетка атлас лекция \
+               обгонять паек наивный лыжный дурак стать ежик задача паек"
+        .into(),
+      spend: "7cb5492df5eb2db4c84af20766391cd3e3662ab1a241c70fc881f3d02c381f05".into(),
+      view: "fcd53e41ec0df995ab43927f7c44bc3359c93523d5009fb3f5ba87431d545a03".into(),
+    },
+    Vector {
+      language: Language::Esperanto,
+      seed: "ukazo klini peco etikedo fabriko imitado onklino urino \
+               pudro incidento kumuluso ikono smirgi hirundo uretro krii \
+               sparkado super speciala pupo alpinisto cvana vokegi zombio fabriko"
+        .into(),
+      spend: "82ebf0336d3b152701964ed41df6b6e9a035e57fc98b84039ed0bd4611c58904".into(),
+      view: "cd4d120e1ea34360af528f6a3e6156063312d9cefc9aa6b5218d366c0ed6a201".into(),
+    },
+    Vector {
+      language: Language::Lojban,
+      seed: "jetnu vensa julne xrotu xamsi julne cutci dakli \
+               mlatu xedja muvgau palpi xindo sfubu ciste cinri \
+               blabi darno dembi janli blabi fenki bukpu burcu blabi"
+        .into(),
+      spend: "e4f8c6819ab6cf792cebb858caabac9307fd646901d72123e0367ebc0a79c200".into(),
+      view: "c806ce62bafaa7b2d597f1a1e2dbe4a2f96bfd804bf6f8420fc7f4a6bd700c00".into(),
+    },
+    Vector {
+      language: Language::EnglishOld,
+      seed: "glorious especially puff son moment add youth nowhere \
+               throw glide grip wrong rhythm consume very swear \
+               bitter heavy eventually begin reason flirt type unable"
+        .into(),
+      spend: "647f4765b66b636ff07170ab6280a9a6804dfbaf19db2ad37d23be024a18730b".into(),
+      view: "045da65316a906a8c30046053119c18020b07a7a3a6ef5c01ab2a8755416bd02".into(),
+    },
+  ];
+
+  for vector in vectors {
+    let trim_seed = |seed: &str| {
+      seed
+        .split_whitespace()
+        .map(|word| trim_by_lang(word, vector.language))
+        .collect::<Vec<_>>()
+        .join(" ")
+    };
+
+    // Test against Monero
+    {
+      let seed = Seed::from_string(Zeroizing::new(vector.seed.clone())).unwrap();
+      assert_eq!(seed, Seed::from_string(Zeroizing::new(trim_seed(&vector.seed))).unwrap());
+
+      let spend: [u8; 32] = hex::decode(vector.spend).unwrap().try_into().unwrap();
+      // For classical seeds, Monero directly uses the entropy as a spend key
+      assert_eq!(
+        Scalar::from_canonical_bytes(*seed.entropy()),
+        Scalar::from_canonical_bytes(spend)
+      );
+
+      let view: [u8; 32] = hex::decode(vector.view).unwrap().try_into().unwrap();
+      // Monero then derives the view key as H(spend)
+      assert_eq!(
+        Scalar::from_bytes_mod_order(hash(&spend)),
+        Scalar::from_canonical_bytes(view).unwrap()
+      );
+
+      assert_eq!(Seed::from_entropy(vector.language, Zeroizing::new(spend)).unwrap(), seed);
+    }
+
+    // Test against ourself
+    {
+      let seed = Seed::new(&mut OsRng, vector.language);
+      assert_eq!(seed, Seed::from_string(Zeroizing::new(trim_seed(&seed.to_string()))).unwrap());
+      assert_eq!(seed, Seed::from_entropy(vector.language, seed.entropy()).unwrap());
+      assert_eq!(seed, Seed::from_string(seed.to_string()).unwrap());
+    }
+  }
+}
--- a/coins/monero/src/transaction.rs
+++ b/coins/monero/src/transaction.rs
@@ -1,4 +1,5 @@
 use core::cmp::Ordering;
+use std::io::{self, Read, Write};

 use zeroize::Zeroize;

@@ -27,7 +28,7 @@ impl Input {
    1 + 1 + 1 + (8 * ring_len) + 32
  }

-  pub fn serialize<W: std::io::Write>(&self, w: &mut W) -> std::io::Result<()> {
+  pub fn write<W: Write>(&self, w: &mut W) -> io::Result<()> {
    match self {
      Input::Gen(height) => {
        w.write_all(&[255])?;
@@ -43,7 +44,7 @@ impl Input {
    }
  }

-  pub fn deserialize<R: std::io::Read>(r: &mut R) -> std::io::Result<Input> {
+  pub fn read<R: Read>(r: &mut R) -> io::Result<Input> {
    Ok(match read_byte(r)? {
      255 => Input::Gen(read_varint(r)?),
      2 => Input::ToKey {
@@ -51,10 +52,9 @@ impl Input {
        key_offsets: read_vec(read_varint, r)?,
        key_image: read_torsion_free_point(r)?,
      },
-      _ => Err(std::io::Error::new(
-        std::io::ErrorKind::Other,
-        "Tried to deserialize unknown/unused input type",
-      ))?,
+      _ => {
+        Err(io::Error::new(io::ErrorKind::Other, "Tried to deserialize unknown/unused input type"))?
+      }
    })
  }
 }
@@ -72,7 +72,7 @@ impl Output {
    1 + 1 + 32 + 1
  }

-  pub fn serialize<W: std::io::Write>(&self, w: &mut W) -> std::io::Result<()> {
+  pub fn write<W: Write>(&self, w: &mut W) -> io::Result<()> {
    write_varint(&self.amount, w)?;
    w.write_all(&[2 + u8::from(self.view_tag.is_some())])?;
    w.write_all(&self.key.to_bytes())?;
@@ -82,13 +82,13 @@ impl Output {
    Ok(())
  }

-  pub fn deserialize<R: std::io::Read>(r: &mut R) -> std::io::Result<Output> {
+  pub fn read<R: Read>(r: &mut R) -> io::Result<Output> {
    let amount = read_varint(r)?;
    let view_tag = match read_byte(r)? {
      2 => false,
      3 => true,
-      _ => Err(std::io::Error::new(
-        std::io::ErrorKind::Other,
+      _ => Err(io::Error::new(
+        io::ErrorKind::Other,
        "Tried to deserialize unknown/unused output type",
      ))?,
    };
@@ -119,7 +119,7 @@ impl Timelock {
    }
  }

-  fn serialize<W: std::io::Write>(&self, w: &mut W) -> std::io::Result<()> {
+  fn write<W: Write>(&self, w: &mut W) -> io::Result<()> {
    write_varint(
      &match self {
        Timelock::None => 0,
@@ -163,21 +163,21 @@ impl TransactionPrefix {
      extra
  }

-  pub fn serialize<W: std::io::Write>(&self, w: &mut W) -> std::io::Result<()> {
+  pub fn write<W: Write>(&self, w: &mut W) -> io::Result<()> {
    write_varint(&self.version, w)?;
-    self.timelock.serialize(w)?;
-    write_vec(Input::serialize, &self.inputs, w)?;
-    write_vec(Output::serialize, &self.outputs, w)?;
+    self.timelock.write(w)?;
+    write_vec(Input::write, &self.inputs, w)?;
+    write_vec(Output::write, &self.outputs, w)?;
    write_varint(&self.extra.len().try_into().unwrap(), w)?;
    w.write_all(&self.extra)
  }

-  pub fn deserialize<R: std::io::Read>(r: &mut R) -> std::io::Result<TransactionPrefix> {
+  pub fn read<R: Read>(r: &mut R) -> io::Result<TransactionPrefix> {
    let mut prefix = TransactionPrefix {
      version: read_varint(r)?,
      timelock: Timelock::from_raw(read_varint(r)?),
-      inputs: read_vec(Input::deserialize, r)?,
-      outputs: read_vec(Output::deserialize, r)?,
+      inputs: read_vec(Input::read, r)?,
+      outputs: read_vec(Output::read, r)?,
      extra: vec![],
    };
    prefix.extra = read_vec(read_byte, r)?;
@@ -204,8 +204,8 @@ impl Transaction {
      RctSignatures::fee_weight(protocol, inputs, outputs)
  }

-  pub fn serialize<W: std::io::Write>(&self, w: &mut W) -> std::io::Result<()> {
-    self.prefix.serialize(w)?;
+  pub fn write<W: Write>(&self, w: &mut W) -> io::Result<()> {
+    self.prefix.write(w)?;
    if self.prefix.version == 1 {
      for sig in &self.signatures {
        write_scalar(&sig.0, w)?;
@@ -213,14 +213,14 @@ impl Transaction {
      }
      Ok(())
    } else if self.prefix.version == 2 {
-      self.rct_signatures.serialize(w)
+      self.rct_signatures.write(w)
    } else {
      panic!("Serializing a transaction with an unknown version");
    }
  }

-  pub fn deserialize<R: std::io::Read>(r: &mut R) -> std::io::Result<Transaction> {
-    let prefix = TransactionPrefix::deserialize(r)?;
+  pub fn read<R: Read>(r: &mut R) -> io::Result<Transaction> {
+    let prefix = TransactionPrefix::read(r)?;
    let mut signatures = vec![];
    let mut rct_signatures = RctSignatures {
      base: RctBase { fee: 0, ecdh_info: vec![], commitments: vec![] },
@@ -241,7 +241,7 @@ impl Transaction {
        .sum::<u64>()
        .saturating_sub(prefix.outputs.iter().map(|output| output.amount).sum());
    } else if prefix.version == 2 {
-      rct_signatures = RctSignatures::deserialize(
+      rct_signatures = RctSignatures::read(
        prefix
          .inputs
          .iter()
@@ -254,64 +254,56 @@ impl Transaction {
        r,
      )?;
    } else {
-      Err(std::io::Error::new(std::io::ErrorKind::Other, "Tried to deserialize unknown version"))?;
+      Err(io::Error::new(io::ErrorKind::Other, "Tried to deserialize unknown version"))?;
    }

    Ok(Transaction { prefix, signatures, rct_signatures })
  }

  pub fn hash(&self) -> [u8; 32] {
-    let mut serialized = Vec::with_capacity(2048);
+    let mut buf = Vec::with_capacity(2048);
    if self.prefix.version == 1 {
-      self.serialize(&mut serialized).unwrap();
-      hash(&serialized)
+      self.write(&mut buf).unwrap();
+      hash(&buf)
    } else {
-      let mut sig_hash = Vec::with_capacity(96);
+      let mut hashes = Vec::with_capacity(96);

-      self.prefix.serialize(&mut serialized).unwrap();
-      sig_hash.extend(hash(&serialized));
-      serialized.clear();
+      self.prefix.write(&mut buf).unwrap();
+      hashes.extend(hash(&buf));
+      buf.clear();

-      self
-        .rct_signatures
-        .base
-        .serialize(&mut serialized, self.rct_signatures.prunable.rct_type())
-        .unwrap();
-      sig_hash.extend(hash(&serialized));
-      serialized.clear();
+      self.rct_signatures.base.write(&mut buf, self.rct_signatures.prunable.rct_type()).unwrap();
+      hashes.extend(hash(&buf));
+      buf.clear();

      match self.rct_signatures.prunable {
-        RctPrunable::Null => serialized.resize(32, 0),
+        RctPrunable::Null => buf.resize(32, 0),
        _ => {
-          self.rct_signatures.prunable.serialize(&mut serialized).unwrap();
-          serialized = hash(&serialized).to_vec();
+          self.rct_signatures.prunable.write(&mut buf).unwrap();
+          buf = hash(&buf).to_vec();
        }
      }
-      sig_hash.extend(&serialized);
+      hashes.extend(&buf);

-      hash(&sig_hash)
+      hash(&hashes)
    }
  }

  /// Calculate the hash of this transaction as needed for signing it.
  pub fn signature_hash(&self) -> [u8; 32] {
-    let mut serialized = Vec::with_capacity(2048);
+    let mut buf = Vec::with_capacity(2048);
    let mut sig_hash = Vec::with_capacity(96);

-    self.prefix.serialize(&mut serialized).unwrap();
-    sig_hash.extend(hash(&serialized));
-    serialized.clear();
+    self.prefix.write(&mut buf).unwrap();
+    sig_hash.extend(hash(&buf));
+    buf.clear();

-    self
-      .rct_signatures
-      .base
-      .serialize(&mut serialized, self.rct_signatures.prunable.rct_type())
-      .unwrap();
-    sig_hash.extend(hash(&serialized));
-    serialized.clear();
+    self.rct_signatures.base.write(&mut buf, self.rct_signatures.prunable.rct_type()).unwrap();
+    sig_hash.extend(hash(&buf));
+    buf.clear();

-    self.rct_signatures.prunable.signature_serialize(&mut serialized).unwrap();
-    sig_hash.extend(hash(&serialized));
+    self.rct_signatures.prunable.signature_write(&mut buf).unwrap();
+    sig_hash.extend(hash(&buf));

    hash(&sig_hash)
  }
--- a/coins/monero/src/wallet/address.rs
+++ b/coins/monero/src/wallet/address.rs
@@ -24,26 +24,59 @@ pub enum AddressType {
  Standard,
  Integrated([u8; 8]),
  Subaddress,
-  Featured(bool, Option<[u8; 8]>, bool),
+  Featured { subaddress: bool, payment_id: Option<[u8; 8]>, guaranteed: bool },
+}
+
+#[derive(Clone, Copy, PartialEq, Eq, Debug, Zeroize)]
+pub struct SubaddressIndex {
+  pub(crate) account: u32,
+  pub(crate) address: u32,
+}
+
+impl SubaddressIndex {
+  pub const fn new(account: u32, address: u32) -> Option<SubaddressIndex> {
+    if (account == 0) && (address == 0) {
+      return None;
+    }
+    Some(SubaddressIndex { account, address })
+  }
+
+  pub fn account(&self) -> u32 {
+    self.account
+  }
+
+  pub fn address(&self) -> u32 {
+    self.address
+  }
+}
+
+/// Address specification. Used internally to create addresses.
+#[derive(Clone, Copy, PartialEq, Eq, Debug, Zeroize)]
+pub enum AddressSpec {
+  Standard,
+  Integrated([u8; 8]),
+  Subaddress(SubaddressIndex),
+  Featured { subaddress: Option<SubaddressIndex>, payment_id: Option<[u8; 8]>, guaranteed: bool },
 }

 impl AddressType {
-  pub fn subaddress(&self) -> bool {
-    matches!(self, AddressType::Subaddress) || matches!(self, AddressType::Featured(true, ..))
+  pub fn is_subaddress(&self) -> bool {
+    matches!(self, AddressType::Subaddress) ||
+      matches!(self, AddressType::Featured { subaddress: true, .. })
  }

  pub fn payment_id(&self) -> Option<[u8; 8]> {
    if let AddressType::Integrated(id) = self {
      Some(*id)
-    } else if let AddressType::Featured(_, id, _) = self {
-      *id
+    } else if let AddressType::Featured { payment_id, .. } = self {
+      *payment_id
    } else {
      None
    }
  }

-  pub fn guaranteed(&self) -> bool {
-    matches!(self, AddressType::Featured(_, _, true))
+  pub fn is_guaranteed(&self) -> bool {
+    matches!(self, AddressType::Featured { guaranteed: true, .. })
  }
 }

@@ -105,7 +138,7 @@ impl<B: AddressBytes> AddressMeta<B> {
      AddressType::Standard => bytes.0,
      AddressType::Integrated(_) => bytes.1,
      AddressType::Subaddress => bytes.2,
-      AddressType::Featured(..) => bytes.3,
+      AddressType::Featured { .. } => bytes.3,
    }
  }

@@ -114,7 +147,7 @@ impl<B: AddressBytes> AddressMeta<B> {
    AddressMeta { _bytes: PhantomData, network, kind }
  }

-  // Returns an incomplete type in the case of Integrated/Featured addresses
+  // Returns an incomplete instantiation in the case of Integrated/Featured addresses
  fn from_byte(byte: u8) -> Result<Self, AddressError> {
    let mut meta = None;
    for network in [Network::Mainnet, Network::Testnet, Network::Stagenet] {
@@ -123,7 +156,9 @@ impl<B: AddressBytes> AddressMeta<B> {
        _ if byte == standard => Some(AddressType::Standard),
        _ if byte == integrated => Some(AddressType::Integrated([0; 8])),
        _ if byte == subaddress => Some(AddressType::Subaddress),
-        _ if byte == featured => Some(AddressType::Featured(false, None, false)),
+        _ if byte == featured => {
+          Some(AddressType::Featured { subaddress: false, payment_id: None, guaranteed: false })
+        }
        _ => None,
      } {
        meta = Some(AddressMeta::new(network, kind));
@@ -134,16 +169,16 @@ impl<B: AddressBytes> AddressMeta<B> {
    meta.ok_or(AddressError::InvalidByte)
  }

-  pub fn subaddress(&self) -> bool {
-    self.kind.subaddress()
+  pub fn is_subaddress(&self) -> bool {
+    self.kind.is_subaddress()
  }

  pub fn payment_id(&self) -> Option<[u8; 8]> {
    self.kind.payment_id()
  }

-  pub fn guaranteed(&self) -> bool {
-    self.kind.guaranteed()
+  pub fn is_guaranteed(&self) -> bool {
+    self.kind.is_guaranteed()
  }
 }

@@ -168,7 +203,7 @@ impl<B: AddressBytes> ToString for Address<B> {
    let mut data = vec![self.meta.to_byte()];
    data.extend(self.spend.compress().to_bytes());
    data.extend(self.view.compress().to_bytes());
-    if let AddressType::Featured(subaddress, payment_id, guaranteed) = self.meta.kind {
+    if let AddressType::Featured { subaddress, payment_id, guaranteed } = self.meta.kind {
      // Technically should be a VarInt, yet we don't have enough features it's needed
      data.push(
        u8::from(subaddress) + (u8::from(payment_id.is_some()) << 1) + (u8::from(guaranteed) << 2),
@@ -201,7 +236,7 @@ impl<B: AddressBytes> Address<B> {
      .ok_or(AddressError::InvalidKey)?;
    let mut read = 65;

-    if matches!(meta.kind, AddressType::Featured(..)) {
+    if matches!(meta.kind, AddressType::Featured { .. }) {
      if raw[read] >= (2 << 3) {
        Err(AddressError::UnknownFeatures)?;
      }
@@ -210,8 +245,11 @@ impl<B: AddressBytes> Address<B> {
      let integrated = ((raw[read] >> 1) & 1) == 1;
      let guaranteed = ((raw[read] >> 2) & 1) == 1;

-      meta.kind =
-        AddressType::Featured(subaddress, Some([0; 8]).filter(|_| integrated), guaranteed);
+      meta.kind = AddressType::Featured {
+        subaddress,
+        payment_id: Some([0; 8]).filter(|_| integrated),
+        guaranteed,
+      };
      read += 1;
    }

@@ -226,7 +264,7 @@ impl<B: AddressBytes> Address<B> {
    if let AddressType::Integrated(ref mut id) = meta.kind {
      id.copy_from_slice(&raw[(read - 8) .. read]);
    }
-    if let AddressType::Featured(_, Some(ref mut id), _) = meta.kind {
+    if let AddressType::Featured { payment_id: Some(ref mut id), .. } = meta.kind {
      id.copy_from_slice(&raw[(read - 8) .. read]);
    }

@@ -247,16 +285,16 @@ impl<B: AddressBytes> Address<B> {
    self.meta.network
  }

-  pub fn subaddress(&self) -> bool {
-    self.meta.subaddress()
+  pub fn is_subaddress(&self) -> bool {
+    self.meta.is_subaddress()
  }

  pub fn payment_id(&self) -> Option<[u8; 8]> {
    self.meta.payment_id()
  }

-  pub fn guaranteed(&self) -> bool {
-    self.meta.guaranteed()
+  pub fn is_guaranteed(&self) -> bool {
+    self.meta.is_guaranteed()
  }
 }

--- a/coins/monero/src/wallet/decoys.rs
+++ b/coins/monero/src/wallet/decoys.rs
@@ -1,4 +1,6 @@
-use std::{sync::Mutex, collections::HashSet};
+use std::collections::HashSet;
+
+use futures::lock::{Mutex, MutexGuard};

 use lazy_static::lazy_static;

@@ -23,13 +25,16 @@ const TIP_APPLICATION: f64 = (LOCK_WINDOW * BLOCK_TIME) as f64;

 lazy_static! {
  static ref GAMMA: Gamma<f64> = Gamma::new(19.28, 1.0 / 1.61).unwrap();
+  // TODO: Expose an API to reset this in case a reorg occurs/the RPC fails/returns garbage
+  // TODO: Update this when scanning a block, as possible
  static ref DISTRIBUTION: Mutex<Vec<u64>> = Mutex::new(Vec::with_capacity(3000000));
 }

 #[allow(clippy::too_many_arguments)]
-async fn select_n<R: RngCore + CryptoRng>(
+async fn select_n<'a, R: RngCore + CryptoRng>(
  rng: &mut R,
  rpc: &Rpc,
+  distribution: &MutexGuard<'a, Vec<u64>>,
  height: usize,
  high: u64,
  per_second: f64,
@@ -61,7 +66,6 @@ async fn select_n<R: RngCore + CryptoRng>(

      let o = (age * per_second) as u64;
      if o < high {
-        let distribution = DISTRIBUTION.lock().unwrap();
        let i = distribution.partition_point(|s| *s < (high - 1 - o));
        let prev = i.saturating_sub(1);
        let n = distribution[i] - distribution[prev];
@@ -136,6 +140,8 @@ impl Decoys {
    height: usize,
    inputs: &[SpendableOutput],
  ) -> Result<Vec<Decoys>, RpcError> {
+    let mut distribution = DISTRIBUTION.lock().await;
+
    let decoy_count = ring_len - 1;

    // Convert the inputs in question to the raw output data
@@ -146,29 +152,19 @@ impl Decoys {
      outputs.push((real[real.len() - 1], [input.key(), input.commitment().calculate()]));
    }

-    let distribution_len = {
-      let distribution = DISTRIBUTION.lock().unwrap();
-      distribution.len()
-    };
-    if distribution_len <= height {
-      let extension = rpc.get_output_distribution(distribution_len, height).await?;
-      DISTRIBUTION.lock().unwrap().extend(extension);
+    if distribution.len() <= height {
+      let extension = rpc.get_output_distribution(distribution.len(), height).await?;
+      distribution.extend(extension);
    }
+    // If asked to use an older height than previously asked, truncate to ensure accuracy
+    // Should never happen, yet risks desyncing if it did
+    distribution.truncate(height + 1); // height is inclusive, and 0 is a valid height

-    let high;
-    let per_second;
-    {
-      let mut distribution = DISTRIBUTION.lock().unwrap();
-      // If asked to use an older height than previously asked, truncate to ensure accuracy
-      // Should never happen, yet risks desyncing if it did
-      distribution.truncate(height + 1); // height is inclusive, and 0 is a valid height
-
-      high = distribution[distribution.len() - 1];
-      per_second = {
-        let blocks = distribution.len().min(BLOCKS_PER_YEAR);
-        let outputs = high - distribution[distribution.len().saturating_sub(blocks + 1)];
-        (outputs as f64) / ((blocks * BLOCK_TIME) as f64)
-      };
+    let high = distribution[distribution.len() - 1];
+    let per_second = {
+      let blocks = distribution.len().min(BLOCKS_PER_YEAR);
+      let outputs = high - distribution[distribution.len().saturating_sub(blocks + 1)];
+      (outputs as f64) / ((blocks * BLOCK_TIME) as f64)
    };

    let mut used = HashSet::<u64>::new();
@@ -184,9 +180,18 @@ impl Decoys {
    // Select all decoys for this transaction, assuming we generate a sane transaction
    // We should almost never naturally generate an insane transaction, hence why this doesn't
    // bother with an overage
-    let mut decoys =
-      select_n(rng, rpc, height, high, per_second, &real, &mut used, inputs.len() * decoy_count)
-        .await?;
+    let mut decoys = select_n(
+      rng,
+      rpc,
+      &distribution,
+      height,
+      high,
+      per_second,
+      &real,
+      &mut used,
+      inputs.len() * decoy_count,
+    )
+    .await?;
    real.zeroize();

    let mut res = Vec::with_capacity(inputs.len());
@@ -224,8 +229,18 @@ impl Decoys {

          // Select new outputs until we have a full sized ring again
          ring.extend(
-            select_n(rng, rpc, height, high, per_second, &[], &mut used, ring_len - ring.len())
-              .await?,
+            select_n(
+              rng,
+              rpc,
+              &distribution,
+              height,
+              high,
+              per_second,
+              &[],
+              &mut used,
+              ring_len - ring.len(),
+            )
+            .await?,
          );
          ring.sort_by(|a, b| a.0.cmp(&b.0));
        }
--- a/coins/monero/src/wallet/extra.rs
+++ b/coins/monero/src/wallet/extra.rs
@@ -1,5 +1,5 @@
 use core::ops::BitXor;
-use std::io::{self, Read, Write, Cursor};
+use std::io::{self, Read, Write};

 use zeroize::Zeroize;

@@ -12,8 +12,16 @@ use crate::serialize::{

 pub const MAX_TX_EXTRA_NONCE_SIZE: usize = 255;

+pub const PAYMENT_ID_MARKER: u8 = 0;
+pub const ENCRYPTED_PAYMENT_ID_MARKER: u8 = 1;
+// Used as it's the highest value not interpretable as a continued VarInt
+pub const ARBITRARY_DATA_MARKER: u8 = 127;
+
+// 1 byte is used for the marker
+pub const MAX_ARBITRARY_DATA_SIZE: usize = MAX_TX_EXTRA_NONCE_SIZE - 1;
+
 #[derive(Clone, Copy, PartialEq, Eq, Debug, Zeroize)]
-pub(crate) enum PaymentId {
+pub enum PaymentId {
  Unencrypted([u8; 32]),
  Encrypted([u8; 8]),
 }
@@ -23,6 +31,7 @@ impl BitXor<[u8; 8]> for PaymentId {

  fn bitxor(self, bytes: [u8; 8]) -> PaymentId {
    match self {
+      // Don't perform the xor since this isn't intended to be encrypted with xor
      PaymentId::Unencrypted(_) => self,
      PaymentId::Encrypted(id) => {
        PaymentId::Encrypted((u64::from_le_bytes(id) ^ u64::from_le_bytes(bytes)).to_le_bytes())
@@ -32,21 +41,21 @@ impl BitXor<[u8; 8]> for PaymentId {
 }

 impl PaymentId {
-  pub(crate) fn serialize<W: Write>(&self, w: &mut W) -> io::Result<()> {
+  pub fn write<W: Write>(&self, w: &mut W) -> io::Result<()> {
    match self {
      PaymentId::Unencrypted(id) => {
-        w.write_all(&[0])?;
+        w.write_all(&[PAYMENT_ID_MARKER])?;
        w.write_all(id)?;
      }
      PaymentId::Encrypted(id) => {
-        w.write_all(&[1])?;
+        w.write_all(&[ENCRYPTED_PAYMENT_ID_MARKER])?;
        w.write_all(id)?;
      }
    }
    Ok(())
  }

-  fn deserialize<R: Read>(r: &mut R) -> io::Result<PaymentId> {
+  pub fn read<R: Read>(r: &mut R) -> io::Result<PaymentId> {
    Ok(match read_byte(r)? {
      0 => PaymentId::Unencrypted(read_bytes(r)?),
      1 => PaymentId::Encrypted(read_bytes(r)?),
@@ -57,7 +66,7 @@ impl PaymentId {

 // Doesn't bother with padding nor MinerGate
 #[derive(Clone, PartialEq, Eq, Debug, Zeroize)]
-pub(crate) enum ExtraField {
+pub enum ExtraField {
  PublicKey(EdwardsPoint),
  Nonce(Vec<u8>),
  MergeMining(usize, [u8; 32]),
@@ -65,7 +74,7 @@ pub(crate) enum ExtraField {
 }

 impl ExtraField {
-  fn serialize<W: Write>(&self, w: &mut W) -> io::Result<()> {
+  pub fn write<W: Write>(&self, w: &mut W) -> io::Result<()> {
    match self {
      ExtraField::PublicKey(key) => {
        w.write_all(&[1])?;
@@ -88,7 +97,7 @@ impl ExtraField {
    Ok(())
  }

-  fn deserialize<R: Read>(r: &mut R) -> io::Result<ExtraField> {
+  pub fn read<R: Read>(r: &mut R) -> io::Result<ExtraField> {
    Ok(match read_byte(r)? {
      1 => ExtraField::PublicKey(read_point(r)?),
      2 => ExtraField::Nonce({
@@ -110,52 +119,50 @@ impl ExtraField {
 }

 #[derive(Clone, PartialEq, Eq, Debug, Zeroize)]
-pub(crate) struct Extra(Vec<ExtraField>);
+pub struct Extra(Vec<ExtraField>);
 impl Extra {
-  pub(crate) fn keys(&self) -> Vec<EdwardsPoint> {
-    let mut keys = Vec::with_capacity(2);
+  pub fn keys(&self) -> Option<(EdwardsPoint, Option<Vec<EdwardsPoint>>)> {
+    let mut key = None;
+    let mut additional = None;
    for field in &self.0 {
      match field.clone() {
-        ExtraField::PublicKey(key) => keys.push(key),
-        ExtraField::PublicKeys(additional) => keys.extend(additional),
+        ExtraField::PublicKey(this_key) => key = key.or(Some(this_key)),
+        ExtraField::PublicKeys(these_additional) => {
+          additional = additional.or(Some(these_additional))
+        }
        _ => (),
      }
    }
-    keys
+    // Don't return any keys if this was non-standard and didn't include the primary key
+    key.map(|key| (key, additional))
  }

-  pub(crate) fn payment_id(&self) -> Option<PaymentId> {
+  pub fn payment_id(&self) -> Option<PaymentId> {
    for field in &self.0 {
      if let ExtraField::Nonce(data) = field {
-        return PaymentId::deserialize(&mut Cursor::new(data)).ok();
+        return PaymentId::read::<&[u8]>(&mut data.as_ref()).ok();
      }
    }
    None
  }

-  pub(crate) fn data(&self) -> Vec<Vec<u8>> {
-    let mut first = true;
+  pub fn data(&self) -> Vec<Vec<u8>> {
    let mut res = vec![];
    for field in &self.0 {
      if let ExtraField::Nonce(data) = field {
-        // Skip the first Nonce, which should be the payment ID
-        if first {
-          first = false;
-          continue;
+        if data[0] == ARBITRARY_DATA_MARKER {
+          res.push(data[1 ..].to_vec());
        }
-        res.push(data.clone());
      }
    }
    res
  }

-  pub(crate) fn new(mut keys: Vec<EdwardsPoint>) -> Extra {
+  pub(crate) fn new(key: EdwardsPoint, additional: Vec<EdwardsPoint>) -> Extra {
    let mut res = Extra(Vec::with_capacity(3));
-    if !keys.is_empty() {
-      res.push(ExtraField::PublicKey(keys[0]));
-    }
-    if keys.len() > 1 {
-      res.push(ExtraField::PublicKeys(keys.drain(1 ..).collect()));
+    res.push(ExtraField::PublicKey(key));
+    if !additional.is_empty() {
+      res.push(ExtraField::PublicKeys(additional));
    }
    res
  }
@@ -165,29 +172,35 @@ impl Extra {
  }

  #[rustfmt::skip]
-  pub(crate) fn fee_weight(outputs: usize, data: &[Vec<u8>]) -> usize {
+  pub(crate) fn fee_weight(outputs: usize, payment_id: bool, data: &[Vec<u8>]) -> usize {
    // PublicKey, key
    (1 + 32) +
    // PublicKeys, length, additional keys
    (1 + 1 + (outputs.saturating_sub(1) * 32)) +
    // PaymentId (Nonce), length, encrypted, ID
-    (1 + 1 + 1 + 8) +
+    (if payment_id { 1 + 1 + 1 + 8 } else { 0 }) +
    // Nonce, length, data (if existent)
    data.iter().map(|v| 1 + varint_len(v.len()) + v.len()).sum::<usize>()
  }

-  pub(crate) fn serialize<W: Write>(&self, w: &mut W) -> io::Result<()> {
+  pub fn write<W: Write>(&self, w: &mut W) -> io::Result<()> {
    for field in &self.0 {
-      field.serialize(w)?;
+      field.write(w)?;
    }
    Ok(())
  }

-  pub(crate) fn deserialize<R: Read>(r: &mut R) -> io::Result<Extra> {
+  pub fn serialize(&self) -> Vec<u8> {
+    let mut buf = vec![];
+    self.write(&mut buf).unwrap();
+    buf
+  }
+
+  pub fn read<R: Read>(r: &mut R) -> io::Result<Extra> {
    let mut res = Extra(vec![]);
    let mut field;
    while {
-      field = ExtraField::deserialize(r);
+      field = ExtraField::read(r);
      field.is_ok()
    } {
      res.0.push(field.unwrap());
--- a/coins/monero/src/wallet/mod.rs
+++ b/coins/monero/src/wallet/mod.rs
@@ -11,21 +11,26 @@ use curve25519_dalek::{

 use crate::{hash, hash_to_scalar, serialize::write_varint, transaction::Input};

-mod extra;
+pub mod extra;
 pub(crate) use extra::{PaymentId, ExtraField, Extra};

+/// Seed creation and parsing functionality.
+pub mod seed;
+
 /// Address encoding and decoding functionality.
 pub mod address;
-use address::{Network, AddressType, AddressMeta, MoneroAddress};
+use address::{Network, AddressType, SubaddressIndex, AddressSpec, AddressMeta, MoneroAddress};

 mod scan;
-pub use scan::{ReceivedOutput, SpendableOutput};
+pub use scan::{ReceivedOutput, SpendableOutput, Timelocked};

 pub(crate) mod decoys;
 pub(crate) use decoys::Decoys;

 mod send;
-pub use send::{Fee, TransactionError, SignableTransaction, SignableTransactionBuilder};
+pub use send::{Fee, TransactionError, Change, SignableTransaction, SignableTransactionBuilder};
+#[cfg(feature = "multisig")]
+pub(crate) use send::InternalPayment;
 #[cfg(feature = "multisig")]
 pub use send::TransactionMachine;

@@ -54,19 +59,20 @@ pub(crate) fn uniqueness(inputs: &[Input]) -> [u8; 32] {
 #[allow(non_snake_case)]
 pub(crate) fn shared_key(
  uniqueness: Option<[u8; 32]>,
-  s: &Scalar,
-  P: &EdwardsPoint,
+  ecdh: EdwardsPoint,
  o: usize,
 ) -> (u8, Scalar, [u8; 8]) {
  // 8Ra
-  let mut output_derivation = (s * P).mul_by_cofactor().compress().to_bytes().to_vec();
+  let mut output_derivation = ecdh.mul_by_cofactor().compress().to_bytes().to_vec();
+
+  let mut payment_id_xor = [0; 8];
+  payment_id_xor
+    .copy_from_slice(&hash(&[output_derivation.as_ref(), [0x8d].as_ref()].concat())[.. 8]);
+
  // || o
  write_varint(&o.try_into().unwrap(), &mut output_derivation).unwrap();

  let view_tag = hash(&[b"view_tag".as_ref(), &output_derivation].concat())[0];
-  let mut payment_id_xor = [0; 8];
-  payment_id_xor
-    .copy_from_slice(&hash(&[output_derivation.as_ref(), [0x8d].as_ref()].concat())[.. 8]);

  // uniqueness ||
  let shared_key = if let Some(uniqueness) = uniqueness {
@@ -106,21 +112,61 @@ impl ViewPair {
    ViewPair { spend, view }
  }

-  pub(crate) fn subaddress(&self, index: (u32, u32)) -> Scalar {
-    if index == (0, 0) {
-      return Scalar::zero();
-    }
+  pub fn spend(&self) -> EdwardsPoint {
+    self.spend
+  }

+  pub fn view(&self) -> EdwardsPoint {
+    self.view.deref() * &ED25519_BASEPOINT_TABLE
+  }
+
+  fn subaddress_derivation(&self, index: SubaddressIndex) -> Scalar {
    hash_to_scalar(&Zeroizing::new(
      [
        b"SubAddr\0".as_ref(),
        Zeroizing::new(self.view.to_bytes()).as_ref(),
-        &index.0.to_le_bytes(),
-        &index.1.to_le_bytes(),
+        &index.account().to_le_bytes(),
+        &index.address().to_le_bytes(),
      ]
      .concat(),
    ))
  }
+
+  fn subaddress_keys(&self, index: SubaddressIndex) -> (EdwardsPoint, EdwardsPoint) {
+    let scalar = self.subaddress_derivation(index);
+    let spend = self.spend + (&scalar * &ED25519_BASEPOINT_TABLE);
+    let view = self.view.deref() * spend;
+    (spend, view)
+  }
+
+  /// Returns an address with the provided specification.
+  pub fn address(&self, network: Network, spec: AddressSpec) -> MoneroAddress {
+    let mut spend = self.spend;
+    let mut view: EdwardsPoint = self.view.deref() * &ED25519_BASEPOINT_TABLE;
+
+    // construct the address meta
+    let meta = match spec {
+      AddressSpec::Standard => AddressMeta::new(network, AddressType::Standard),
+      AddressSpec::Integrated(payment_id) => {
+        AddressMeta::new(network, AddressType::Integrated(payment_id))
+      }
+      AddressSpec::Subaddress(index) => {
+        (spend, view) = self.subaddress_keys(index);
+        AddressMeta::new(network, AddressType::Subaddress)
+      }
+      AddressSpec::Featured { subaddress, payment_id, guaranteed } => {
+        if let Some(index) = subaddress {
+          (spend, view) = self.subaddress_keys(index);
+        }
+        AddressMeta::new(
+          network,
+          AddressType::Featured { subaddress: subaddress.is_some(), payment_id, guaranteed },
+        )
+      }
+    };
+
+    MoneroAddress::new(meta, spend, view)
+  }
 }

 /// Transaction scanner.
@@ -130,15 +176,14 @@ impl ViewPair {
 #[derive(Clone)]
 pub struct Scanner {
  pair: ViewPair,
-  network: Network,
-  pub(crate) subaddresses: HashMap<CompressedEdwardsY, (u32, u32)>,
+  // Also contains the spend key as None
+  pub(crate) subaddresses: HashMap<CompressedEdwardsY, Option<SubaddressIndex>>,
  pub(crate) burning_bug: Option<HashSet<CompressedEdwardsY>>,
 }

 impl Zeroize for Scanner {
  fn zeroize(&mut self) {
    self.pair.zeroize();
-    self.network.zeroize();

    // These may not be effective, unfortunately
    for (mut key, mut value) in self.subaddresses.drain() {
@@ -163,59 +208,24 @@ impl ZeroizeOnDrop for Scanner {}

 impl Scanner {
  /// Create a Scanner from a ViewPair.
-  /// The network is used for generating subaddresses.
  /// burning_bug is a HashSet of used keys, intended to prevent key reuse which would burn funds.
  /// When an output is successfully scanned, the output key MUST be saved to disk.
  /// When a new scanner is created, ALL saved output keys must be passed in to be secure.
  /// If None is passed, a modified shared key derivation is used which is immune to the burning
  /// bug (specifically the Guaranteed feature from Featured Addresses).
-  // TODO: Should this take in a DB access handle to ensure output keys are saved?
-  pub fn from_view(
-    pair: ViewPair,
-    network: Network,
-    burning_bug: Option<HashSet<CompressedEdwardsY>>,
-  ) -> Scanner {
+  pub fn from_view(pair: ViewPair, burning_bug: Option<HashSet<CompressedEdwardsY>>) -> Scanner {
    let mut subaddresses = HashMap::new();
-    subaddresses.insert(pair.spend.compress(), (0, 0));
-    Scanner { pair, network, subaddresses, burning_bug }
+    subaddresses.insert(pair.spend.compress(), None);
+    Scanner { pair, subaddresses, burning_bug }
  }

-  /// Return the main address for this view pair.
-  pub fn address(&self) -> MoneroAddress {
-    MoneroAddress::new(
-      AddressMeta::new(
-        self.network,
-        if self.burning_bug.is_none() {
-          AddressType::Featured(false, None, true)
-        } else {
-          AddressType::Standard
-        },
-      ),
-      self.pair.spend,
-      self.pair.view.deref() * &ED25519_BASEPOINT_TABLE,
-    )
-  }
-
-  /// Return the specified subaddress for this view pair.
-  pub fn subaddress(&mut self, index: (u32, u32)) -> MoneroAddress {
-    if index == (0, 0) {
-      return self.address();
-    }
-
-    let spend = self.pair.spend + (&self.pair.subaddress(index) * &ED25519_BASEPOINT_TABLE);
-    self.subaddresses.insert(spend.compress(), index);
-
-    MoneroAddress::new(
-      AddressMeta::new(
-        self.network,
-        if self.burning_bug.is_none() {
-          AddressType::Featured(true, None, true)
-        } else {
-          AddressType::Subaddress
-        },
-      ),
-      spend,
-      self.pair.view.deref() * spend,
-    )
+  /// Register a subaddress.
+  // There used to be an address function here, yet it wasn't safe. It could generate addresses
+  // incompatible with the Scanner. While we could return None for that, then we have the issue
+  // of runtime failures to generate an address.
+  // Removing that API was the simplest option.
+  pub fn register_subaddress(&mut self, subaddress: SubaddressIndex) {
+    let (spend, _) = self.pair.subaddress_keys(subaddress);
+    self.subaddresses.insert(spend.compress(), Some(subaddress));
  }
 }
--- a/coins/monero/src/wallet/scan.rs
+++ b/coins/monero/src/wallet/scan.rs
@@ -1,4 +1,5 @@
-use std::io::Cursor;
+use core::ops::Deref;
+use std::io::{self, Read, Write};

 use zeroize::{Zeroize, ZeroizeOnDrop};

@@ -10,7 +11,10 @@ use crate::{
  transaction::{Input, Timelock, Transaction},
  block::Block,
  rpc::{Rpc, RpcError},
-  wallet::{PaymentId, Extra, Scanner, uniqueness, shared_key, amount_decryption, commitment_mask},
+  wallet::{
+    PaymentId, Extra, address::SubaddressIndex, Scanner, uniqueness, shared_key, amount_decryption,
+    commitment_mask,
+  },
 };

 /// An absolute output ID, defined as its transaction hash and output index.
@@ -21,14 +25,18 @@ pub struct AbsoluteId {
 }

 impl AbsoluteId {
-  pub fn serialize(&self) -> Vec<u8> {
-    let mut res = Vec::with_capacity(32 + 1);
-    res.extend(self.tx);
-    res.push(self.o);
-    res
+  pub fn write<W: Write>(&self, w: &mut W) -> io::Result<()> {
+    w.write_all(&self.tx)?;
+    w.write_all(&[self.o])
  }

-  pub fn deserialize<R: std::io::Read>(r: &mut R) -> std::io::Result<AbsoluteId> {
+  pub fn serialize(&self) -> Vec<u8> {
+    let mut serialized = Vec::with_capacity(32 + 1);
+    self.write(&mut serialized).unwrap();
+    serialized
+  }
+
+  pub fn read<R: Read>(r: &mut R) -> io::Result<AbsoluteId> {
    Ok(AbsoluteId { tx: read_bytes(r)?, o: read_byte(r)? })
  }
 }
@@ -43,16 +51,20 @@ pub struct OutputData {
 }

 impl OutputData {
-  pub fn serialize(&self) -> Vec<u8> {
-    let mut res = Vec::with_capacity(32 + 32 + 40);
-    res.extend(self.key.compress().to_bytes());
-    res.extend(self.key_offset.to_bytes());
-    res.extend(self.commitment.mask.to_bytes());
-    res.extend(self.commitment.amount.to_le_bytes());
-    res
+  pub fn write<W: Write>(&self, w: &mut W) -> io::Result<()> {
+    w.write_all(&self.key.compress().to_bytes())?;
+    w.write_all(&self.key_offset.to_bytes())?;
+    w.write_all(&self.commitment.mask.to_bytes())?;
+    w.write_all(&self.commitment.amount.to_le_bytes())
  }

-  pub fn deserialize<R: std::io::Read>(r: &mut R) -> std::io::Result<OutputData> {
+  pub fn serialize(&self) -> Vec<u8> {
+    let mut serialized = Vec::with_capacity(32 + 32 + 32 + 8);
+    self.write(&mut serialized).unwrap();
+    serialized
+  }
+
+  pub fn read<R: Read>(r: &mut R) -> io::Result<OutputData> {
    Ok(OutputData {
      key: read_point(r)?,
      key_offset: read_scalar(r)?,
@@ -64,9 +76,8 @@ impl OutputData {
 /// The metadata for an output.
 #[derive(Clone, PartialEq, Eq, Debug, Zeroize, ZeroizeOnDrop)]
 pub struct Metadata {
-  // Does not have to be an Option since the 0 subaddress is the main address
  /// The subaddress this output was sent to.
-  pub subaddress: (u32, u32),
+  pub subaddress: Option<SubaddressIndex>,
  /// The payment ID included with this output.
  /// This will be gibberish if the payment ID wasn't intended for the recipient or wasn't included.
  // Could be an Option, as extra doesn't necessarily have a payment ID, yet all Monero TXs should
@@ -77,23 +88,42 @@ pub struct Metadata {
 }

 impl Metadata {
-  pub fn serialize(&self) -> Vec<u8> {
-    let mut res = Vec::with_capacity(4 + 4 + 8 + 1);
-    res.extend(self.subaddress.0.to_le_bytes());
-    res.extend(self.subaddress.1.to_le_bytes());
-    res.extend(self.payment_id);
-
-    res.extend(u32::try_from(self.arbitrary_data.len()).unwrap().to_le_bytes());
-    for part in &self.arbitrary_data {
-      res.extend([u8::try_from(part.len()).unwrap()]);
-      res.extend(part);
+  pub fn write<W: Write>(&self, w: &mut W) -> io::Result<()> {
+    if let Some(subaddress) = self.subaddress {
+      w.write_all(&[1])?;
+      w.write_all(&subaddress.account().to_le_bytes())?;
+      w.write_all(&subaddress.address().to_le_bytes())?;
+    } else {
+      w.write_all(&[0])?;
    }
-    res
+    w.write_all(&self.payment_id)?;
+
+    w.write_all(&u32::try_from(self.arbitrary_data.len()).unwrap().to_le_bytes())?;
+    for part in &self.arbitrary_data {
+      w.write_all(&[u8::try_from(part.len()).unwrap()])?;
+      w.write_all(part)?;
+    }
+    Ok(())
  }

-  pub fn deserialize<R: std::io::Read>(r: &mut R) -> std::io::Result<Metadata> {
+  pub fn serialize(&self) -> Vec<u8> {
+    let mut serialized = Vec::with_capacity(1 + 8 + 1);
+    self.write(&mut serialized).unwrap();
+    serialized
+  }
+
+  pub fn read<R: Read>(r: &mut R) -> io::Result<Metadata> {
+    let subaddress = if read_byte(r)? == 1 {
+      Some(
+        SubaddressIndex::new(read_u32(r)?, read_u32(r)?)
+          .ok_or_else(|| io::Error::new(io::ErrorKind::Other, "invalid subaddress in metadata"))?,
+      )
+    } else {
+      None
+    };
+
    Ok(Metadata {
-      subaddress: (read_u32(r)?, read_u32(r)?),
+      subaddress,
      payment_id: read_bytes(r)?,
      arbitrary_data: {
        let mut data = vec![];
@@ -132,18 +162,23 @@ impl ReceivedOutput {
    &self.metadata.arbitrary_data
  }

+  pub fn write<W: Write>(&self, w: &mut W) -> io::Result<()> {
+    self.absolute.write(w)?;
+    self.data.write(w)?;
+    self.metadata.write(w)
+  }
+
  pub fn serialize(&self) -> Vec<u8> {
-    let mut serialized = self.absolute.serialize();
-    serialized.extend(&self.data.serialize());
-    serialized.extend(&self.metadata.serialize());
+    let mut serialized = vec![];
+    self.write(&mut serialized).unwrap();
    serialized
  }

-  pub fn deserialize<R: std::io::Read>(r: &mut R) -> std::io::Result<ReceivedOutput> {
+  pub fn read<R: Read>(r: &mut R) -> io::Result<ReceivedOutput> {
    Ok(ReceivedOutput {
-      absolute: AbsoluteId::deserialize(r)?,
-      data: OutputData::deserialize(r)?,
-      metadata: Metadata::deserialize(r)?,
+      absolute: AbsoluteId::read(r)?,
+      data: OutputData::read(r)?,
+      metadata: Metadata::read(r)?,
    })
  }
 }
@@ -184,14 +219,19 @@ impl SpendableOutput {
    self.output.commitment()
  }

+  pub fn write<W: Write>(&self, w: &mut W) -> io::Result<()> {
+    self.output.write(w)?;
+    w.write_all(&self.global_index.to_le_bytes())
+  }
+
  pub fn serialize(&self) -> Vec<u8> {
-    let mut serialized = self.output.serialize();
-    serialized.extend(self.global_index.to_le_bytes());
+    let mut serialized = vec![];
+    self.write(&mut serialized).unwrap();
    serialized
  }

-  pub fn deserialize<R: std::io::Read>(r: &mut R) -> std::io::Result<SpendableOutput> {
-    Ok(SpendableOutput { output: ReceivedOutput::deserialize(r)?, global_index: read_u64(r)? })
+  pub fn read<R: Read>(r: &mut R) -> io::Result<SpendableOutput> {
+    Ok(SpendableOutput { output: ReceivedOutput::read(r)?, global_index: read_u64(r)? })
  }
 }

@@ -232,14 +272,19 @@ impl<O: Clone + Zeroize> Timelocked<O> {
 impl Scanner {
  /// Scan a transaction to discover the received outputs.
  pub fn scan_transaction(&mut self, tx: &Transaction) -> Timelocked<ReceivedOutput> {
-    let extra = Extra::deserialize(&mut Cursor::new(&tx.prefix.extra));
-    let keys;
+    let extra = Extra::read::<&[u8]>(&mut tx.prefix.extra.as_ref());
    let extra = if let Ok(extra) = extra {
-      keys = extra.keys();
      extra
    } else {
      return Timelocked(tx.prefix.timelock, vec![]);
    };
+
+    let (tx_key, additional) = if let Some((tx_key, additional)) = extra.keys() {
+      (tx_key, additional)
+    } else {
+      return Timelocked(tx.prefix.timelock, vec![]);
+    };
+
    let payment_id = extra.payment_id();

    let mut res = vec![];
@@ -257,11 +302,22 @@ impl Scanner {
      }
      let output_key = output_key.unwrap();

-      for key in &keys {
+      for key in [Some(Some(&tx_key)), additional.as_ref().map(|additional| additional.get(o))] {
+        let key = if let Some(Some(key)) = key {
+          key
+        } else if let Some(None) = key {
+          // This is non-standard. There were additional keys, yet not one for this output
+          // https://github.com/monero-project/monero/
+          //   blob/04a1e2875d6e35e27bb21497988a6c822d319c28/
+          //   src/cryptonote_basic/cryptonote_format_utils.cpp#L1062
+          // TODO: Should this return? Where does Monero set the trap handler for this exception?
+          continue;
+        } else {
+          break;
+        };
        let (view_tag, shared_key, payment_id_xor) = shared_key(
          if self.burning_bug.is_none() { Some(uniqueness(&tx.prefix.inputs)) } else { None },
-          &self.pair.view,
-          key,
+          self.pair.view.deref() * key,
          o,
        );

@@ -291,9 +347,12 @@ impl Scanner {
        // We will not have a torsioned key in our HashMap of keys, so we wouldn't identify it as
        // ours
        // If we did though, it'd enable bypassing the included burning bug protection
-        debug_assert!(output_key.is_torsion_free());
+        assert!(output_key.is_torsion_free());

-        let key_offset = shared_key + self.pair.subaddress(subaddress);
+        let mut key_offset = shared_key;
+        if let Some(subaddress) = subaddress {
+          key_offset += self.pair.subaddress_derivation(subaddress);
+        }
        // Since we've found an output to us, get its amount
        let mut commitment = Commitment::zero();

--- a/coins/monero/src/wallet/seed/classic.rs
+++ b/coins/monero/src/wallet/seed/classic.rs
@@ -0,0 +1,262 @@
+use core::ops::Deref;
+use std::collections::HashMap;
+
+use lazy_static::lazy_static;
+
+use zeroize::{Zeroize, Zeroizing};
+use rand_core::{RngCore, CryptoRng};
+
+use crc::{Crc, CRC_32_ISO_HDLC};
+
+use curve25519_dalek::scalar::Scalar;
+
+use crate::{
+  random_scalar,
+  wallet::seed::{SeedError, Language},
+};
+
+pub(crate) const CLASSIC_SEED_LENGTH: usize = 24;
+pub(crate) const CLASSIC_SEED_LENGTH_WITH_CHECKSUM: usize = 25;
+
+fn trim(word: &str, len: usize) -> Zeroizing<String> {
+  Zeroizing::new(word.chars().take(len).collect())
+}
+
+struct WordList {
+  word_list: Vec<String>,
+  word_map: HashMap<String, usize>,
+  trimmed_word_map: HashMap<String, usize>,
+  unique_prefix_length: usize,
+}
+
+impl WordList {
+  fn new(words: &'static str, prefix_length: usize) -> WordList {
+    let mut lang = WordList {
+      word_list: serde_json::from_str(words).unwrap(),
+      word_map: HashMap::new(),
+      trimmed_word_map: HashMap::new(),
+      unique_prefix_length: prefix_length,
+    };
+
+    for (i, word) in lang.word_list.iter().enumerate() {
+      lang.word_map.insert(word.clone(), i);
+      lang.trimmed_word_map.insert(trim(word, lang.unique_prefix_length).deref().clone(), i);
+    }
+
+    lang
+  }
+}
+
+lazy_static! {
+  static ref LANGUAGES: HashMap<Language, WordList> = HashMap::from([
+    (Language::Chinese, WordList::new(include_str!("./classic/zh.json"), 1)),
+    (Language::English, WordList::new(include_str!("./classic/en.json"), 3)),
+    (Language::Dutch, WordList::new(include_str!("./classic/nl.json"), 4)),
+    (Language::French, WordList::new(include_str!("./classic/fr.json"), 4)),
+    (Language::Spanish, WordList::new(include_str!("./classic/es.json"), 4)),
+    (Language::German, WordList::new(include_str!("./classic/de.json"), 4)),
+    (Language::Italian, WordList::new(include_str!("./classic/it.json"), 4)),
+    (Language::Portuguese, WordList::new(include_str!("./classic/pt.json"), 4)),
+    (Language::Japanese, WordList::new(include_str!("./classic/ja.json"), 3)),
+    (Language::Russian, WordList::new(include_str!("./classic/ru.json"), 4)),
+    (Language::Esperanto, WordList::new(include_str!("./classic/eo.json"), 4)),
+    (Language::Lojban, WordList::new(include_str!("./classic/jbo.json"), 4)),
+    (Language::EnglishOld, WordList::new(include_str!("./classic/ang.json"), 4)),
+  ]);
+}
+
+#[cfg(test)]
+pub(crate) fn trim_by_lang(word: &str, lang: Language) -> String {
+  if lang != Language::EnglishOld {
+    word.chars().take(LANGUAGES[&lang].unique_prefix_length).collect()
+  } else {
+    word.to_string()
+  }
+}
+
+fn checksum_index(words: &[Zeroizing<String>], lang: &WordList) -> usize {
+  let mut trimmed_words = Zeroizing::new(String::new());
+  for w in words {
+    *trimmed_words += &trim(w, lang.unique_prefix_length);
+  }
+
+  let crc = Crc::<u32>::new(&CRC_32_ISO_HDLC);
+  let mut digest = crc.digest();
+  digest.update(trimmed_words.as_bytes());
+
+  usize::try_from(digest.finalize()).unwrap() % words.len()
+}
+
+// Convert a private key to a seed
+fn key_to_seed(lang: Language, key: Zeroizing<Scalar>) -> ClassicSeed {
+  let bytes = Zeroizing::new(key.to_bytes());
+
+  // get the language words
+  let words = &LANGUAGES[&lang].word_list;
+  let list_len = u64::try_from(words.len()).unwrap();
+
+  // To store the found words & add the checksum word later.
+  let mut seed = Vec::with_capacity(25);
+
+  // convert to words
+  // 4 bytes -> 3 words. 8 digits base 16 -> 3 digits base 1626
+  let mut segment = [0; 4];
+  let mut indices = [0; 4];
+  for i in 0 .. 8 {
+    // convert first 4 byte to u32 & get the word indices
+    let start = i * 4;
+    // convert 4 byte to u32
+    segment.copy_from_slice(&bytes[start .. (start + 4)]);
+    // Actually convert to a u64 so we can add without overflowing
+    indices[0] = u64::from(u32::from_le_bytes(segment));
+    indices[1] = indices[0];
+    indices[0] /= list_len;
+    indices[2] = indices[0] + indices[1];
+    indices[0] /= list_len;
+    indices[3] = indices[0] + indices[2];
+
+    // append words to seed
+    for i in indices.iter().skip(1) {
+      let word = usize::try_from(i % list_len).unwrap();
+      seed.push(Zeroizing::new(words[word].clone()));
+    }
+  }
+  segment.zeroize();
+  indices.zeroize();
+
+  // create a checksum word for all languages except old english
+  if lang != Language::EnglishOld {
+    let checksum = seed[checksum_index(&seed, &LANGUAGES[&lang])].clone();
+    seed.push(checksum);
+  }
+
+  let mut res = Zeroizing::new(String::new());
+  for (i, word) in seed.iter().enumerate() {
+    if i != 0 {
+      *res += " ";
+    }
+    *res += word;
+  }
+  ClassicSeed(res)
+}
+
+// Convert a seed to bytes
+pub(crate) fn seed_to_bytes(words: &str) -> Result<(Language, Zeroizing<[u8; 32]>), SeedError> {
+  // get seed words
+  let words = words.split_whitespace().map(|w| Zeroizing::new(w.to_string())).collect::<Vec<_>>();
+  if (words.len() != CLASSIC_SEED_LENGTH) && (words.len() != CLASSIC_SEED_LENGTH_WITH_CHECKSUM) {
+    panic!("invalid seed passed to seed_to_bytes");
+  }
+
+  // find the language
+  let (matched_indices, lang_name, lang) = (|| {
+    let has_checksum = words.len() == CLASSIC_SEED_LENGTH_WITH_CHECKSUM;
+    let mut matched_indices = Zeroizing::new(vec![]);
+
+    // Iterate through all the languages
+    'language: for (lang_name, lang) in LANGUAGES.iter() {
+      matched_indices.zeroize();
+      matched_indices.clear();
+
+      let map_in_use = if has_checksum { &lang.trimmed_word_map } else { &lang.word_map };
+
+      // Iterate through all the words and see if they're all present
+      for word in &words {
+        let trimmed = trim(word, lang.unique_prefix_length);
+        let word = if has_checksum { &trimmed } else { word };
+
+        if let Some(index) = map_in_use.get(word.deref()) {
+          matched_indices.push(*index);
+        } else {
+          continue 'language;
+        }
+      }
+
+      if has_checksum {
+        if lang_name == &Language::EnglishOld {
+          Err(SeedError::EnglishOldWithChecksum)?;
+        }
+
+        // exclude the last word when calculating a checksum.
+        let last_word = words.last().unwrap().clone();
+        let checksum = words[checksum_index(&words[.. words.len() - 1], lang)].clone();
+
+        // check the trimmed checksum and trimmed last word line up
+        if trim(&checksum, lang.unique_prefix_length) != trim(&last_word, lang.unique_prefix_length)
+        {
+          Err(SeedError::InvalidChecksum)?;
+        }
+      }
+
+      return Ok((matched_indices, lang_name, lang));
+    }
+
+    Err(SeedError::UnknownLanguage)?
+  })()?;
+
+  // convert to bytes
+  let mut res = Zeroizing::new([0; 32]);
+  let mut indices = Zeroizing::new([0; 4]);
+  for i in 0 .. 8 {
+    // read 3 indices at a time
+    let i3 = i * 3;
+    indices[1] = matched_indices[i3];
+    indices[2] = matched_indices[i3 + 1];
+    indices[3] = matched_indices[i3 + 2];
+
+    let inner = |i| {
+      let mut base = (lang.word_list.len() - indices[i] + indices[i + 1]) % lang.word_list.len();
+      // Shift the index over
+      for _ in 0 .. i {
+        base *= lang.word_list.len();
+      }
+      base
+    };
+    // set the last index
+    indices[0] = indices[1] + inner(1) + inner(2);
+    if (indices[0] % lang.word_list.len()) != indices[1] {
+      Err(SeedError::InvalidSeed)?;
+    }
+
+    let pos = i * 4;
+    let mut bytes = u32::try_from(indices[0]).unwrap().to_le_bytes();
+    res[pos .. (pos + 4)].copy_from_slice(&bytes);
+    bytes.zeroize();
+  }
+
+  Ok((*lang_name, res))
+}
+
+#[derive(Clone, PartialEq, Eq, Zeroize)]
+pub struct ClassicSeed(Zeroizing<String>);
+impl ClassicSeed {
+  pub(crate) fn new<R: RngCore + CryptoRng>(rng: &mut R, lang: Language) -> ClassicSeed {
+    key_to_seed(lang, Zeroizing::new(random_scalar(rng)))
+  }
+
+  pub fn from_string(words: Zeroizing<String>) -> Result<ClassicSeed, SeedError> {
+    let (lang, entropy) = seed_to_bytes(&words)?;
+
+    // Make sure this is a valid scalar
+    let mut scalar = Scalar::from_canonical_bytes(*entropy);
+    if scalar.is_none() {
+      Err(SeedError::InvalidSeed)?;
+    }
+    scalar.zeroize();
+
+    // Call from_entropy so a trimmed seed becomes a full seed
+    Ok(Self::from_entropy(lang, entropy).unwrap())
+  }
+
+  pub fn from_entropy(lang: Language, entropy: Zeroizing<[u8; 32]>) -> Option<ClassicSeed> {
+    Scalar::from_canonical_bytes(*entropy).map(|scalar| key_to_seed(lang, Zeroizing::new(scalar)))
+  }
+
+  pub(crate) fn to_string(&self) -> Zeroizing<String> {
+    self.0.clone()
+  }
+
+  pub(crate) fn entropy(&self) -> Zeroizing<[u8; 32]> {
+    seed_to_bytes(&self.0).unwrap().1
+  }
+}
--- a/coins/monero/src/wallet/seed/classic/ang.json
+++ b/coins/monero/src/wallet/seed/classic/ang.json
--- a/coins/monero/src/wallet/seed/classic/de.json
+++ b/coins/monero/src/wallet/seed/classic/de.json
--- a/coins/monero/src/wallet/seed/classic/en.json
+++ b/coins/monero/src/wallet/seed/classic/en.json
--- a/coins/monero/src/wallet/seed/classic/eo.json
+++ b/coins/monero/src/wallet/seed/classic/eo.json
--- a/coins/monero/src/wallet/seed/classic/es.json
+++ b/coins/monero/src/wallet/seed/classic/es.json
--- a/coins/monero/src/wallet/seed/classic/fr.json
+++ b/coins/monero/src/wallet/seed/classic/fr.json
--- a/coins/monero/src/wallet/seed/classic/it.json
+++ b/coins/monero/src/wallet/seed/classic/it.json
--- a/coins/monero/src/wallet/seed/classic/ja.json
+++ b/coins/monero/src/wallet/seed/classic/ja.json
--- a/coins/monero/src/wallet/seed/classic/jbo.json
+++ b/coins/monero/src/wallet/seed/classic/jbo.json
--- a/coins/monero/src/wallet/seed/classic/nl.json
+++ b/coins/monero/src/wallet/seed/classic/nl.json
--- a/coins/monero/src/wallet/seed/classic/pt.json
+++ b/coins/monero/src/wallet/seed/classic/pt.json
--- a/coins/monero/src/wallet/seed/classic/ru.json
+++ b/coins/monero/src/wallet/seed/classic/ru.json
--- a/coins/monero/src/wallet/seed/classic/zh.json
+++ b/coins/monero/src/wallet/seed/classic/zh.json
--- a/coins/monero/src/wallet/seed/mod.rs
+++ b/coins/monero/src/wallet/seed/mod.rs
@@ -0,0 +1,92 @@
+use core::fmt;
+
+use zeroize::{Zeroize, ZeroizeOnDrop, Zeroizing};
+use rand_core::{RngCore, CryptoRng};
+
+use thiserror::Error;
+
+pub(crate) mod classic;
+use classic::{CLASSIC_SEED_LENGTH, CLASSIC_SEED_LENGTH_WITH_CHECKSUM, ClassicSeed};
+
+/// Error when decoding a seed.
+#[derive(Clone, Copy, PartialEq, Eq, Debug, Error)]
+pub enum SeedError {
+  #[error("invalid number of words in seed")]
+  InvalidSeedLength,
+  #[error("unknown language")]
+  UnknownLanguage,
+  #[error("invalid checksum")]
+  InvalidChecksum,
+  #[error("english old seeds don't support checksums")]
+  EnglishOldWithChecksum,
+  #[error("invalid seed")]
+  InvalidSeed,
+}
+
+#[derive(Clone, Copy, PartialEq, Eq, Debug, Hash)]
+pub enum Language {
+  Chinese,
+  English,
+  Dutch,
+  French,
+  Spanish,
+  German,
+  Italian,
+  Portuguese,
+  Japanese,
+  Russian,
+  Esperanto,
+  Lojban,
+  EnglishOld,
+}
+
+/// A Monero seed.
+// TODO: Add polyseed to enum
+#[derive(Clone, PartialEq, Eq, Zeroize, ZeroizeOnDrop)]
+pub enum Seed {
+  Classic(ClassicSeed),
+}
+
+impl fmt::Debug for Seed {
+  fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
+    match self {
+      Seed::Classic(_) => f.debug_struct("Seed::Classic").finish_non_exhaustive(),
+    }
+  }
+}
+
+impl Seed {
+  /// Create a new seed.
+  pub fn new<R: RngCore + CryptoRng>(rng: &mut R, lang: Language) -> Seed {
+    Seed::Classic(ClassicSeed::new(rng, lang))
+  }
+
+  /// Parse a seed from a String.
+  pub fn from_string(words: Zeroizing<String>) -> Result<Seed, SeedError> {
+    match words.split_whitespace().count() {
+      CLASSIC_SEED_LENGTH | CLASSIC_SEED_LENGTH_WITH_CHECKSUM => {
+        ClassicSeed::from_string(words).map(Seed::Classic)
+      }
+      _ => Err(SeedError::InvalidSeedLength)?,
+    }
+  }
+
+  /// Create a Seed from entropy.
+  pub fn from_entropy(lang: Language, entropy: Zeroizing<[u8; 32]>) -> Option<Seed> {
+    ClassicSeed::from_entropy(lang, entropy).map(Seed::Classic)
+  }
+
+  /// Convert a seed to a String.
+  pub fn to_string(&self) -> Zeroizing<String> {
+    match self {
+      Seed::Classic(seed) => seed.to_string(),
+    }
+  }
+
+  /// Return the entropy for this seed.
+  pub fn entropy(&self) -> Zeroizing<[u8; 32]> {
+    match self {
+      Seed::Classic(seed) => seed.entropy(),
+    }
+  }
+}
--- a/coins/monero/src/wallet/send/builder.rs
+++ b/coins/monero/src/wallet/send/builder.rs
@@ -5,8 +5,8 @@ use zeroize::{Zeroize, ZeroizeOnDrop};
 use crate::{
  Protocol,
  wallet::{
-    address::MoneroAddress, Fee, SpendableOutput, SignableTransaction, TransactionError,
-    extra::MAX_TX_EXTRA_NONCE_SIZE,
+    address::MoneroAddress, Fee, SpendableOutput, Change, SignableTransaction, TransactionError,
+    extra::MAX_ARBITRARY_DATA_SIZE,
  },
 };

@@ -17,14 +17,14 @@ struct SignableTransactionBuilderInternal {

  inputs: Vec<SpendableOutput>,
  payments: Vec<(MoneroAddress, u64)>,
-  change_address: Option<MoneroAddress>,
+  change_address: Option<Change>,
  data: Vec<Vec<u8>>,
 }

 impl SignableTransactionBuilderInternal {
  // Takes in the change address so users don't miss that they have to manually set one
  // If they don't, all leftover funds will become part of the fee
-  fn new(protocol: Protocol, fee: Fee, change_address: Option<MoneroAddress>) -> Self {
+  fn new(protocol: Protocol, fee: Fee, change_address: Option<Change>) -> Self {
    Self { protocol, fee, inputs: vec![], payments: vec![], change_address, data: vec![] }
  }

@@ -77,7 +77,7 @@ impl SignableTransactionBuilder {
    Self(self.0.clone())
  }

-  pub fn new(protocol: Protocol, fee: Fee, change_address: Option<MoneroAddress>) -> Self {
+  pub fn new(protocol: Protocol, fee: Fee, change_address: Option<Change>) -> Self {
    Self(Arc::new(RwLock::new(SignableTransactionBuilderInternal::new(
      protocol,
      fee,
@@ -104,7 +104,7 @@ impl SignableTransactionBuilder {
  }

  pub fn add_data(&mut self, data: Vec<u8>) -> Result<Self, TransactionError> {
-    if data.len() > MAX_TX_EXTRA_NONCE_SIZE {
+    if data.len() > MAX_ARBITRARY_DATA_SIZE {
      Err(TransactionError::TooMuchData)?;
    }
    self.0.write().unwrap().add_data(data);
@@ -117,7 +117,7 @@ impl SignableTransactionBuilder {
      read.protocol,
      read.inputs.clone(),
      read.payments.clone(),
-      read.change_address,
+      read.change_address.clone(),
      read.data.clone(),
      read.fee,
    )
--- a/coins/monero/src/wallet/send/mod.rs
+++ b/coins/monero/src/wallet/send/mod.rs
@@ -1,4 +1,4 @@
-use core::ops::Deref;
+use core::{ops::Deref, fmt};

 use thiserror::Error;

@@ -7,7 +7,13 @@ use rand::seq::SliceRandom;

 use zeroize::{Zeroize, ZeroizeOnDrop, Zeroizing};

-use curve25519_dalek::{constants::ED25519_BASEPOINT_TABLE, scalar::Scalar, edwards::EdwardsPoint};
+use group::Group;
+use curve25519_dalek::{
+  constants::{ED25519_BASEPOINT_POINT, ED25519_BASEPOINT_TABLE},
+  scalar::Scalar,
+  edwards::EdwardsPoint,
+};
+use dalek_ff_group as dfg;

 #[cfg(feature = "multisig")]
 use frost::FrostError;
@@ -23,8 +29,10 @@ use crate::{
  transaction::{Input, Output, Timelock, TransactionPrefix, Transaction},
  rpc::{Rpc, RpcError},
  wallet::{
-    address::MoneroAddress, SpendableOutput, Decoys, PaymentId, ExtraField, Extra, key_image_sort,
-    uniqueness, shared_key, commitment_mask, amount_encryption, extra::MAX_TX_EXTRA_NONCE_SIZE,
+    address::{Network, AddressSpec, MoneroAddress},
+    ViewPair, SpendableOutput, Decoys, PaymentId, ExtraField, Extra, key_image_sort, uniqueness,
+    shared_key, commitment_mask, amount_encryption,
+    extra::{ARBITRARY_DATA_MARKER, MAX_ARBITRARY_DATA_SIZE},
  },
 };

@@ -47,25 +55,22 @@ struct SendOutput {
 }

 impl SendOutput {
-  fn new<R: RngCore + CryptoRng>(
-    rng: &mut R,
+  #[allow(non_snake_case)]
+  fn internal(
    unique: [u8; 32],
    output: (usize, (MoneroAddress, u64)),
+    ecdh: EdwardsPoint,
+    R: EdwardsPoint,
  ) -> (SendOutput, Option<[u8; 8]>) {
    let o = output.0;
    let output = output.1;

-    let r = random_scalar(rng);
    let (view_tag, shared_key, payment_id_xor) =
-      shared_key(Some(unique).filter(|_| output.0.meta.kind.guaranteed()), &r, &output.0.view, o);
+      shared_key(Some(unique).filter(|_| output.0.is_guaranteed()), ecdh, o);

    (
      SendOutput {
-        R: if !output.0.meta.kind.subaddress() {
-          &r * &ED25519_BASEPOINT_TABLE
-        } else {
-          r * output.0.spend
-        },
+        R,
        view_tag,
        dest: ((&shared_key * &ED25519_BASEPOINT_TABLE) + output.0.spend),
        commitment: Commitment::new(commitment_mask(shared_key), output.1),
@@ -77,6 +82,32 @@ impl SendOutput {
        .map(|id| (u64::from_le_bytes(id) ^ u64::from_le_bytes(payment_id_xor)).to_le_bytes()),
    )
  }
+
+  fn new(
+    r: &Zeroizing<Scalar>,
+    unique: [u8; 32],
+    output: (usize, (MoneroAddress, u64)),
+  ) -> (SendOutput, Option<[u8; 8]>) {
+    let address = output.1 .0;
+    SendOutput::internal(
+      unique,
+      output,
+      r.deref() * address.view,
+      if !address.is_subaddress() {
+        r.deref() * &ED25519_BASEPOINT_TABLE
+      } else {
+        r.deref() * address.spend
+      },
+    )
+  }
+
+  fn change(
+    ecdh: EdwardsPoint,
+    unique: [u8; 32],
+    output: (usize, (MoneroAddress, u64)),
+  ) -> (SendOutput, Option<[u8; 8]>) {
+    SendOutput::internal(unique, output, ecdh, ED25519_BASEPOINT_POINT)
+  }
 }

 #[derive(Clone, PartialEq, Eq, Debug, Error)]
@@ -93,6 +124,8 @@ pub enum TransactionError {
  TooManyOutputs,
  #[error("too much data")]
  TooMuchData,
+  #[error("too many inputs/too much arbitrary data")]
+  TooLargeTransaction,
  #[error("not enough funds (in {0}, out {1})")]
  NotEnoughFunds(u64, u64),
  #[error("wrong spend private key")]
@@ -176,26 +209,71 @@ impl Fee {
 pub struct SignableTransaction {
  protocol: Protocol,
  inputs: Vec<SpendableOutput>,
-  payments: Vec<(MoneroAddress, u64)>,
+  payments: Vec<InternalPayment>,
  data: Vec<Vec<u8>>,
  fee: u64,
 }

+/// Specification for a change output.
+#[derive(Clone, PartialEq, Eq, Zeroize)]
+pub struct Change {
+  address: MoneroAddress,
+  view: Option<Zeroizing<Scalar>>,
+}
+
+impl fmt::Debug for Change {
+  fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
+    f.debug_struct("Change").field("address", &self.address).finish_non_exhaustive()
+  }
+}
+
+impl Change {
+  /// Create a change output specification from a ViewPair, as needed to maintain privacy.
+  pub fn new(view: &ViewPair, guaranteed: bool) -> Change {
+    Change {
+      address: view.address(
+        Network::Mainnet,
+        if !guaranteed {
+          AddressSpec::Standard
+        } else {
+          AddressSpec::Featured { subaddress: None, payment_id: None, guaranteed: true }
+        },
+      ),
+      view: Some(view.view.clone()),
+    }
+  }
+
+  /// Create a fingerprintable change output specification which will harm privacy. Only use this
+  /// if you know what you're doing.
+  pub fn fingerprintable(address: MoneroAddress) -> Change {
+    Change { address, view: None }
+  }
+}
+
+#[derive(Clone, PartialEq, Eq, Debug, Zeroize)]
+pub(crate) enum InternalPayment {
+  Payment((MoneroAddress, u64)),
+  Change(Change, u64),
+}
+
 impl SignableTransaction {
-  /// Create a signable transaction. If the change address is specified, leftover funds will be
-  /// sent to it. If the change address isn't specified, up to 16 outputs may be specified, using
-  /// any leftover funds as a bonus to the fee. The optional data field will be embedded in TX
-  /// extra.
+  /// Create a signable transaction.
+  ///
+  /// Up to 16 outputs may be present, including the change output.
+  ///
+  /// If the change address is specified, leftover funds will be sent to it.
+  ///
+  /// Each chunk of data must not exceed MAX_ARBITRARY_DATA_SIZE.
  pub fn new(
    protocol: Protocol,
    inputs: Vec<SpendableOutput>,
    mut payments: Vec<(MoneroAddress, u64)>,
-    change_address: Option<MoneroAddress>,
+    change_address: Option<Change>,
    data: Vec<Vec<u8>>,
    fee_rate: Fee,
  ) -> Result<SignableTransaction, TransactionError> {
    // Make sure there's only one payment ID
-    {
+    let mut has_payment_id = {
      let mut payment_ids = 0;
      let mut count = |addr: MoneroAddress| {
        if addr.payment_id().is_some() {
@@ -205,13 +283,14 @@ impl SignableTransaction {
      for payment in &payments {
        count(payment.0);
      }
-      if let Some(change) = change_address {
-        count(change);
+      if let Some(change) = change_address.as_ref() {
+        count(change.address);
      }
      if payment_ids > 1 {
        Err(TransactionError::MultiplePaymentIds)?;
      }
-    }
+      payment_ids == 1
+    };

    if inputs.is_empty() {
      Err(TransactionError::NoInputs)?;
@@ -221,55 +300,57 @@ impl SignableTransaction {
    }

    for part in &data {
-      if part.len() > MAX_TX_EXTRA_NONCE_SIZE {
+      if part.len() > MAX_ARBITRARY_DATA_SIZE {
        Err(TransactionError::TooMuchData)?;
      }
    }

-    // TODO TX MAX SIZE
-
-    // If we don't have two outputs, as required by Monero, add a second
-    let mut change = payments.len() == 1;
-    if change && change_address.is_none() {
+    // If we don't have two outputs, as required by Monero, error
+    if (payments.len() == 1) && change_address.is_none() {
      Err(TransactionError::NoChange)?;
    }
-    let outputs = payments.len() + usize::from(change);
+    let outputs = payments.len() + usize::from(change_address.is_some());
+    // Add a dummy payment ID if there's only 2 payments
+    has_payment_id |= outputs == 2;

    // Calculate the extra length
-    let extra = Extra::fee_weight(outputs, data.as_ref());
+    let extra = Extra::fee_weight(outputs, has_payment_id, data.as_ref());
+
+    // This is a extremely heavy fee weight estimation which can only be trusted for two things
+    // 1) Ensuring we have enough for whatever fee we end up using
+    // 2) Ensuring we aren't over the max size
+    let estimated_tx_size = Transaction::fee_weight(protocol, inputs.len(), outputs, extra);
+
+    // The actual limit is half the block size, and for the minimum block size of 300k, that'd be
+    // 150k
+    // wallet2 will only create transactions up to 100k bytes however
+    const MAX_TX_SIZE: usize = 100_000;
+
+    // This uses the weight (estimated_tx_size) despite the BP clawback
+    // The clawback *increases* the weight, so this will over-estimate, yet it's still safe
+    if estimated_tx_size >= MAX_TX_SIZE {
+      Err(TransactionError::TooLargeTransaction)?;
+    }

    // Calculate the fee.
-    let mut fee =
-      fee_rate.calculate(Transaction::fee_weight(protocol, inputs.len(), outputs, extra));
+    let fee = fee_rate.calculate(estimated_tx_size);

    // Make sure we have enough funds
    let in_amount = inputs.iter().map(|input| input.commitment().amount).sum::<u64>();
-    let mut out_amount = payments.iter().map(|payment| payment.1).sum::<u64>() + fee;
+    let out_amount = payments.iter().map(|payment| payment.1).sum::<u64>() + fee;
    if in_amount < out_amount {
      Err(TransactionError::NotEnoughFunds(in_amount, out_amount))?;
    }

-    // If we have yet to add a change output, do so if it's economically viable
-    if (!change) && change_address.is_some() && (in_amount != out_amount) {
-      // Check even with the new fee, there's remaining funds
-      let change_fee =
-        fee_rate.calculate(Transaction::fee_weight(protocol, inputs.len(), outputs + 1, extra)) -
-          fee;
-      if (out_amount + change_fee) < in_amount {
-        change = true;
-        out_amount += change_fee;
-        fee += change_fee;
-      }
-    }
-
-    if change {
-      payments.push((change_address.unwrap(), in_amount - out_amount));
-    }
-
-    if payments.len() > MAX_OUTPUTS {
+    if outputs > MAX_OUTPUTS {
      Err(TransactionError::TooManyOutputs)?;
    }

+    let mut payments = payments.drain(..).map(InternalPayment::Payment).collect::<Vec<_>>();
+    if let Some(change) = change_address {
+      payments.push(InternalPayment::Change(change, in_amount - out_amount));
+    }
+
    Ok(SignableTransaction { protocol, inputs, payments, data, fee })
  }

@@ -281,24 +362,109 @@ impl SignableTransaction {
    // Shuffle the payments
    self.payments.shuffle(rng);

+    // Used for all non-subaddress outputs, or if there's only one subaddress output and a change
+    let tx_key = Zeroizing::new(random_scalar(rng));
+    let mut tx_public_key = tx_key.deref() * &ED25519_BASEPOINT_TABLE;
+
+    // If any of these outputs are to a subaddress, we need keys distinct to them
+    // The only time this *does not* force having additional keys is when the only other output
+    // is a change output we have the view key for, enabling rewriting rA to aR
+    let mut has_change_view = false;
+    let subaddresses = self
+      .payments
+      .iter()
+      .filter(|payment| match *payment {
+        InternalPayment::Payment(payment) => payment.0.is_subaddress(),
+        InternalPayment::Change(change, _) => {
+          if change.view.is_some() {
+            has_change_view = true;
+            // It should not be possible to construct a change specification to a subaddress with a
+            // view key
+            debug_assert!(!change.address.is_subaddress());
+          }
+          change.address.is_subaddress()
+        }
+      })
+      .count() !=
+      0;
+
+    // We need additional keys if we have any subaddresses
+    let mut additional = subaddresses;
+    // Unless the above change view key path is taken
+    if (self.payments.len() == 2) && has_change_view {
+      additional = false;
+    }
+    let modified_change_ecdh = subaddresses && (!additional);
+
+    // If we're using the aR rewrite, update tx_public_key from rG to rB
+    if modified_change_ecdh {
+      for payment in &self.payments {
+        match payment {
+          InternalPayment::Payment(payment) => {
+            // This should be the only payment and it should be a subaddress
+            debug_assert!(payment.0.is_subaddress());
+            tx_public_key = tx_key.deref() * payment.0.spend;
+          }
+          InternalPayment::Change(_, _) => {}
+        }
+      }
+      debug_assert!(tx_public_key != (tx_key.deref() * &ED25519_BASEPOINT_TABLE));
+    }
+
    // Actually create the outputs
    let mut outputs = Vec::with_capacity(self.payments.len());
    let mut id = None;
-    for payment in self.payments.drain(..).enumerate() {
-      let (output, payment_id) = SendOutput::new(rng, uniqueness, payment);
+    for (o, mut payment) in self.payments.drain(..).enumerate() {
+      // Downcast the change output to a payment output if it doesn't require special handling
+      // regarding it's view key
+      payment = if !modified_change_ecdh {
+        if let InternalPayment::Change(change, amount) = &payment {
+          InternalPayment::Payment((change.address, *amount))
+        } else {
+          payment
+        }
+      } else {
+        payment
+      };
+
+      let (output, payment_id) = match payment {
+        InternalPayment::Payment(payment) => {
+          // If this is a subaddress, generate a dedicated r. Else, reuse the TX key
+          let dedicated = Zeroizing::new(random_scalar(&mut *rng));
+          let use_dedicated = additional && payment.0.is_subaddress();
+          let r = if use_dedicated { &dedicated } else { &tx_key };
+
+          let (mut output, payment_id) = SendOutput::new(r, uniqueness, (o, payment));
+          if modified_change_ecdh {
+            debug_assert_eq!(tx_public_key, output.R);
+          }
+          // If this used tx_key, randomize its R
+          if !use_dedicated {
+            output.R = dfg::EdwardsPoint::random(&mut *rng).0;
+          }
+          (output, payment_id)
+        }
+        InternalPayment::Change(change, amount) => {
+          // Instead of rA, use Ra, where R is r * subaddress_spend_key
+          // change.view must be Some as if it's None, this payment would've been downcast
+          let ecdh = tx_public_key * change.view.unwrap().deref();
+          SendOutput::change(ecdh, uniqueness, (o, (change.address, amount)))
+        }
+      };
+
      outputs.push(output);
      id = id.or(payment_id);
    }

    // Include a random payment ID if we don't actually have one
    // It prevents transactions from leaking if they're sending to integrated addresses or not
-    let id = if let Some(id) = id {
-      id
-    } else {
-      let mut id = [0; 8];
-      rng.fill_bytes(&mut id);
-      id
-    };
+    // Only do this if we only have two outputs though, as Monero won't add a dummy if there's
+    // more than two outputs
+    if outputs.len() <= 2 {
+      let mut rand = [0; 8];
+      rng.fill_bytes(&mut rand);
+      id = id.or(Some(rand));
+    }

    let commitments = outputs.iter().map(|output| output.commitment.clone()).collect::<Vec<_>>();
    let sum = commitments.iter().map(|commitment| commitment.mask).sum();
@@ -308,19 +474,27 @@ impl SignableTransaction {

    // Create the TX extra
    let extra = {
-      let mut extra = Extra::new(outputs.iter().map(|output| output.R).collect());
+      let mut extra = Extra::new(
+        tx_public_key,
+        if additional { outputs.iter().map(|output| output.R).collect() } else { vec![] },
+      );

-      let mut id_vec = Vec::with_capacity(1 + 8);
-      PaymentId::Encrypted(id).serialize(&mut id_vec).unwrap();
-      extra.push(ExtraField::Nonce(id_vec));
+      if let Some(id) = id {
+        let mut id_vec = Vec::with_capacity(1 + 8);
+        PaymentId::Encrypted(id).write(&mut id_vec).unwrap();
+        extra.push(ExtraField::Nonce(id_vec));
+      }

      // Include data if present
      for part in self.data.drain(..) {
-        extra.push(ExtraField::Nonce(part));
+        let mut arb = vec![ARBITRARY_DATA_MARKER];
+        arb.extend(part);
+        extra.push(ExtraField::Nonce(arb));
      }

-      let mut serialized = Vec::with_capacity(Extra::fee_weight(outputs.len(), self.data.as_ref()));
-      extra.serialize(&mut serialized).unwrap();
+      let mut serialized =
+        Vec::with_capacity(Extra::fee_weight(outputs.len(), id.is_some(), self.data.as_ref()));
+      extra.write(&mut serialized).unwrap();
      serialized
    };

--- a/coins/monero/src/wallet/send/multisig.rs
+++ b/coins/monero/src/wallet/send/multisig.rs
@@ -4,6 +4,8 @@ use std::{
  collections::HashMap,
 };

+use zeroize::Zeroizing;
+
 use rand_core::{RngCore, CryptoRng, SeedableRng};
 use rand_chacha::ChaCha20Rng;

@@ -29,7 +31,9 @@ use crate::{
  },
  transaction::{Input, Transaction},
  rpc::Rpc,
-  wallet::{TransactionError, SignableTransaction, Decoys, key_image_sort, uniqueness},
+  wallet::{
+    TransactionError, InternalPayment, SignableTransaction, Decoys, key_image_sort, uniqueness,
+  },
 };

 /// FROST signing machine to produce a signed transaction.
@@ -108,8 +112,19 @@ impl SignableTransaction {
      transcript.append_message(b"input_shared_key", input.key_offset().to_bytes());
    }
    for payment in &self.payments {
-      transcript.append_message(b"payment_address", payment.0.to_string().as_bytes());
-      transcript.append_message(b"payment_amount", payment.1.to_le_bytes());
+      match payment {
+        InternalPayment::Payment(payment) => {
+          transcript.append_message(b"payment_address", payment.0.to_string().as_bytes());
+          transcript.append_message(b"payment_amount", payment.1.to_le_bytes());
+        }
+        InternalPayment::Change(change, amount) => {
+          transcript.append_message(b"change_address", change.address.to_string().as_bytes());
+          if let Some(view) = change.view.as_ref() {
+            transcript.append_message(b"change_view_key", Zeroizing::new(view.to_bytes()));
+          }
+          transcript.append_message(b"change_amount", amount.to_le_bytes());
+        }
+      }
    }

    let mut key_images = vec![];
@@ -123,7 +138,7 @@ impl SignableTransaction {
      let clsag = ClsagMultisig::new(transcript.clone(), input.key(), inputs[i].clone());
      key_images.push((
        clsag.H,
-        keys.current_offset().unwrap_or(dfg::Scalar::zero()).0 + self.inputs[i].key_offset(),
+        keys.current_offset().unwrap_or_else(dfg::Scalar::zero).0 + self.inputs[i].key_offset(),
      ));
      clsags.push(AlgorithmMachine::new(clsag, offset).map_err(TransactionError::FrostError)?);
    }
@@ -248,7 +263,7 @@ impl SignMachine<Transaction> for TransactionSignMachine {
    // Find out who's included
    // This may not be a valid set of signers yet the algorithm machine will error if it's not
    commitments.remove(&self.i); // Remove, if it was included for some reason
-    let mut included = commitments.keys().into_iter().cloned().collect::<Vec<_>>();
+    let mut included = commitments.keys().cloned().collect::<Vec<_>>();
    included.push(self.i);
    included.sort_unstable();

--- a/coins/monero/tests/add_data.rs
+++ b/coins/monero/tests/add_data.rs
@@ -1,12 +1,15 @@
-use monero_serai::{rpc::Rpc, wallet::TransactionError, transaction::Transaction};
+use monero_serai::{
+  wallet::{TransactionError, extra::MAX_ARBITRARY_DATA_SIZE},
+  transaction::Transaction,
+};

 mod runner;

 test!(
-  add_single_data_less_than_255,
+  add_single_data_less_than_max,
  (
    |_, mut builder: Builder, addr| async move {
-      let arbitrary_data = vec![b'\0', 254];
+      let arbitrary_data = vec![b'\0'; MAX_ARBITRARY_DATA_SIZE - 1];

      // make sure we can add to tx
      let result = builder.add_data(arbitrary_data.clone());
@@ -15,8 +18,7 @@ test!(
      builder.add_payment(addr, 5);
      (builder.build().unwrap(), (arbitrary_data,))
    },
-    |rpc: Rpc, signed: Transaction, mut scanner: Scanner, data: (Vec<u8>,)| async move {
-      let tx = rpc.get_transaction(signed.hash()).await.unwrap();
+    |_, tx: Transaction, mut scanner: Scanner, data: (Vec<u8>,)| async move {
      let output = scanner.scan_transaction(&tx).not_locked().swap_remove(0);
      assert_eq!(output.commitment().amount, 5);
      assert_eq!(output.arbitrary_data()[0], data.0);
@@ -25,10 +27,10 @@ test!(
 );

 test!(
-  add_multiple_data_less_than_255,
+  add_multiple_data_less_than_max,
  (
    |_, mut builder: Builder, addr| async move {
-      let data = vec![b'\0', 254];
+      let data = vec![b'\0'; MAX_ARBITRARY_DATA_SIZE - 1];

      // Add tx multiple times
      for _ in 0 .. 5 {
@@ -39,8 +41,7 @@ test!(
      builder.add_payment(addr, 5);
      (builder.build().unwrap(), data)
    },
-    |rpc: Rpc, signed: Transaction, mut scanner: Scanner, data: Vec<u8>| async move {
-      let tx = rpc.get_transaction(signed.hash()).await.unwrap();
+    |_, tx: Transaction, mut scanner: Scanner, data: Vec<u8>| async move {
      let output = scanner.scan_transaction(&tx).not_locked().swap_remove(0);
      assert_eq!(output.commitment().amount, 5);
      assert_eq!(output.arbitrary_data(), vec![data; 5]);
@@ -49,24 +50,24 @@ test!(
 );

 test!(
-  add_single_data_more_than_255,
+  add_single_data_more_than_max,
  (
    |_, mut builder: Builder, addr| async move {
-      // Make a data that is bigger than 255 bytes
-      let mut data = vec![b'a'; 256];
+      // Make a data that is bigger than the maximum
+      let mut data = vec![b'a'; MAX_ARBITRARY_DATA_SIZE + 1];

      // Make sure we get an error if we try to add it to the TX
      assert_eq!(builder.add_data(data.clone()), Err(TransactionError::TooMuchData));

-      // Reduce data size and retry. The data will now be 255 bytes long, exactly
+      // Reduce data size and retry. The data will now be 255 bytes long (including the added
+      // marker), exactly
      data.pop();
      assert!(builder.add_data(data.clone()).is_ok());

      builder.add_payment(addr, 5);
      (builder.build().unwrap(), data)
    },
-    |rpc: Rpc, signed: Transaction, mut scanner: Scanner, data: Vec<u8>| async move {
-      let tx = rpc.get_transaction(signed.hash()).await.unwrap();
+    |_, tx: Transaction, mut scanner: Scanner, data: Vec<u8>| async move {
      let output = scanner.scan_transaction(&tx).not_locked().swap_remove(0);
      assert_eq!(output.commitment().amount, 5);
      assert_eq!(output.arbitrary_data(), vec![data]);
--- a/coins/monero/tests/runner.rs
+++ b/coins/monero/tests/runner.rs
@@ -1,4 +1,5 @@
 use core::ops::Deref;
+use std::collections::HashSet;

 use lazy_static::lazy_static;

@@ -10,10 +11,11 @@ use curve25519_dalek::{constants::ED25519_BASEPOINT_TABLE, scalar::Scalar};
 use tokio::sync::Mutex;

 use monero_serai::{
-  Protocol, random_scalar,
+  random_scalar,
  wallet::{
-    ViewPair,
-    address::{Network, AddressType, AddressMeta, MoneroAddress},
+    ViewPair, Scanner,
+    address::{Network, AddressType, AddressSpec, AddressMeta, MoneroAddress},
+    SpendableOutput,
  },
  rpc::Rpc,
 };
@@ -41,7 +43,7 @@ pub async fn mine_until_unlocked(rpc: &Rpc, addr: &str, tx_hash: [u8; 32]) {
  let mut height = rpc.get_height().await.unwrap();
  let mut found = false;
  while !found {
-    let block = rpc.get_block(height - 1).await.unwrap();
+    let block = rpc.get_block_by_number(height - 1).await.unwrap();
    found = match block.txs.iter().find(|&&x| x == tx_hash) {
      Some(_) => true,
      None => {
@@ -56,6 +58,22 @@ pub async fn mine_until_unlocked(rpc: &Rpc, addr: &str, tx_hash: [u8; 32]) {
  rpc.generate_blocks(addr, 9).await.unwrap();
 }

+// Mines 60 blocks and returns an unlocked miner TX output.
+#[allow(dead_code)]
+pub async fn get_miner_tx_output(rpc: &Rpc, view: &ViewPair) -> SpendableOutput {
+  let mut scanner = Scanner::from_view(view.clone(), Some(HashSet::new()));
+
+  // Mine 60 blocks to unlock a miner TX
+  let start = rpc.get_height().await.unwrap();
+  rpc
+    .generate_blocks(&view.address(Network::Mainnet, AddressSpec::Standard).to_string(), 60)
+    .await
+    .unwrap();
+
+  let block = rpc.get_block_by_number(start).await.unwrap();
+  scanner.scan(rpc, &block).await.unwrap().swap_remove(0).ignore_timelock().swap_remove(0)
+}
+
 pub async fn rpc() -> Rpc {
  let rpc = Rpc::new("http://127.0.0.1:18081".to_string()).unwrap();

@@ -73,7 +91,9 @@ pub async fn rpc() -> Rpc {

  // Mine 40 blocks to ensure decoy availability
  rpc.generate_blocks(&addr, 40).await.unwrap();
-  assert!(!matches!(rpc.get_protocol().await.unwrap(), Protocol::Unsupported(_)));
+
+  // Make sure we recognize the protocol
+  rpc.get_protocol().await.unwrap();

  rpc
 }
@@ -138,12 +158,12 @@ macro_rules! test {
        use monero_serai::{
          random_scalar,
          wallet::{
-            address::Network, ViewPair, Scanner, SignableTransaction,
+            address::{Network, AddressSpec}, ViewPair, Scanner, Change, SignableTransaction,
            SignableTransactionBuilder,
          },
        };

-        use runner::{random_address, rpc, mine_until_unlocked};
+        use runner::{random_address, rpc, mine_until_unlocked, get_miner_tx_output};

        type Builder = SignableTransactionBuilder;

@@ -169,33 +189,23 @@ macro_rules! test {
            keys[&Participant::new(1).unwrap()].group_key().0
          };

-          let view = ViewPair::new(spend_pub, Zeroizing::new(random_scalar(&mut OsRng)));
-
          let rpc = rpc().await;

-          let (addr, miner_tx) = {
-            let mut scanner =
-              Scanner::from_view(view.clone(), Network::Mainnet, Some(HashSet::new()));
-            let addr = scanner.address();
+          let view = ViewPair::new(spend_pub, Zeroizing::new(random_scalar(&mut OsRng)));
+          let addr = view.address(Network::Mainnet, AddressSpec::Standard);

-            // mine 60 blocks to unlock a miner tx
-            let start = rpc.get_height().await.unwrap();
-            rpc.generate_blocks(&addr.to_string(), 60).await.unwrap();
-
-            let block = rpc.get_block(start).await.unwrap();
-            (
-              addr,
-              scanner.scan(
-                &rpc,
-                &block
-              ).await.unwrap().swap_remove(0).ignore_timelock().swap_remove(0)
-            )
-          };
+          let miner_tx = get_miner_tx_output(&rpc, &view).await;

          let builder = SignableTransactionBuilder::new(
            rpc.get_protocol().await.unwrap(),
            rpc.get_fee().await.unwrap(),
-            Some(random_address().2),
+            Some(Change::new(
+              &ViewPair::new(
+                &random_scalar(&mut OsRng) * &ED25519_BASEPOINT_TABLE,
+                Zeroizing::new(random_scalar(&mut OsRng))
+              ),
+              false
+            )),
          );

          let sign = |tx: SignableTransaction| {
@@ -247,7 +257,7 @@ macro_rules! test {
            mine_until_unlocked(&rpc, &random_address().2.to_string(), signed.hash()).await;
            let tx = rpc.get_transaction(signed.hash()).await.unwrap();
            let scanner =
-              Scanner::from_view(view.clone(), Network::Mainnet, Some(HashSet::new()));
+              Scanner::from_view(view.clone(), Some(HashSet::new()));
            ($first_checks)(rpc.clone(), tx, scanner, state).await
          });
          #[allow(unused_variables, unused_mut, unused_assignments)]
@@ -268,7 +278,7 @@ macro_rules! test {
            #[allow(unused_assignments)]
            {
              let scanner =
-                Scanner::from_view(view.clone(), Network::Mainnet, Some(HashSet::new()));
+                Scanner::from_view(view.clone(), Some(HashSet::new()));
              carried_state =
                Box::new(($checks)(rpc.clone(), tx, scanner, state).await);
            }
--- a/coins/monero/tests/scan.rs
+++ b/coins/monero/tests/scan.rs
@@ -0,0 +1,300 @@
+use rand::RngCore;
+
+use monero_serai::{transaction::Transaction, wallet::address::SubaddressIndex};
+
+mod runner;
+
+test!(
+  scan_standard_address,
+  (
+    |_, mut builder: Builder, _| async move {
+      let view = runner::random_address().1;
+      let scanner = Scanner::from_view(view.clone(), Some(HashSet::new()));
+      builder.add_payment(view.address(Network::Mainnet, AddressSpec::Standard), 5);
+      (builder.build().unwrap(), scanner)
+    },
+    |_, tx: Transaction, _, mut state: Scanner| async move {
+      let output = state.scan_transaction(&tx).not_locked().swap_remove(0);
+      assert_eq!(output.commitment().amount, 5);
+    },
+  ),
+);
+
+test!(
+  scan_subaddress,
+  (
+    |_, mut builder: Builder, _| async move {
+      let subaddress = SubaddressIndex::new(0, 1).unwrap();
+
+      let view = runner::random_address().1;
+      let mut scanner = Scanner::from_view(view.clone(), Some(HashSet::new()));
+      scanner.register_subaddress(subaddress);
+
+      builder.add_payment(view.address(Network::Mainnet, AddressSpec::Subaddress(subaddress)), 5);
+      (builder.build().unwrap(), (scanner, subaddress))
+    },
+    |_, tx: Transaction, _, mut state: (Scanner, SubaddressIndex)| async move {
+      let output = state.0.scan_transaction(&tx).not_locked().swap_remove(0);
+      assert_eq!(output.commitment().amount, 5);
+      assert_eq!(output.metadata.subaddress, Some(state.1));
+    },
+  ),
+);
+
+test!(
+  scan_integrated_address,
+  (
+    |_, mut builder: Builder, _| async move {
+      let view = runner::random_address().1;
+      let scanner = Scanner::from_view(view.clone(), Some(HashSet::new()));
+
+      let mut payment_id = [0u8; 8];
+      OsRng.fill_bytes(&mut payment_id);
+
+      builder.add_payment(view.address(Network::Mainnet, AddressSpec::Integrated(payment_id)), 5);
+      (builder.build().unwrap(), (scanner, payment_id))
+    },
+    |_, tx: Transaction, _, mut state: (Scanner, [u8; 8])| async move {
+      let output = state.0.scan_transaction(&tx).not_locked().swap_remove(0);
+      assert_eq!(output.commitment().amount, 5);
+      assert_eq!(output.metadata.payment_id, state.1);
+    },
+  ),
+);
+
+test!(
+  scan_featured_standard,
+  (
+    |_, mut builder: Builder, _| async move {
+      let view = runner::random_address().1;
+      let scanner = Scanner::from_view(view.clone(), Some(HashSet::new()));
+      builder.add_payment(
+        view.address(
+          Network::Mainnet,
+          AddressSpec::Featured { subaddress: None, payment_id: None, guaranteed: false },
+        ),
+        5,
+      );
+      (builder.build().unwrap(), scanner)
+    },
+    |_, tx: Transaction, _, mut state: Scanner| async move {
+      let output = state.scan_transaction(&tx).not_locked().swap_remove(0);
+      assert_eq!(output.commitment().amount, 5);
+    },
+  ),
+);
+
+test!(
+  scan_featured_subaddress,
+  (
+    |_, mut builder: Builder, _| async move {
+      let subaddress = SubaddressIndex::new(0, 2).unwrap();
+
+      let view = runner::random_address().1;
+      let mut scanner = Scanner::from_view(view.clone(), Some(HashSet::new()));
+      scanner.register_subaddress(subaddress);
+
+      builder.add_payment(
+        view.address(
+          Network::Mainnet,
+          AddressSpec::Featured {
+            subaddress: Some(subaddress),
+            payment_id: None,
+            guaranteed: false,
+          },
+        ),
+        5,
+      );
+      (builder.build().unwrap(), (scanner, subaddress))
+    },
+    |_, tx: Transaction, _, mut state: (Scanner, SubaddressIndex)| async move {
+      let output = state.0.scan_transaction(&tx).not_locked().swap_remove(0);
+      assert_eq!(output.commitment().amount, 5);
+      assert_eq!(output.metadata.subaddress, Some(state.1));
+    },
+  ),
+);
+
+test!(
+  scan_featured_integrated,
+  (
+    |_, mut builder: Builder, _| async move {
+      let view = runner::random_address().1;
+      let scanner = Scanner::from_view(view.clone(), Some(HashSet::new()));
+      let mut payment_id = [0u8; 8];
+      OsRng.fill_bytes(&mut payment_id);
+
+      builder.add_payment(
+        view.address(
+          Network::Mainnet,
+          AddressSpec::Featured {
+            subaddress: None,
+            payment_id: Some(payment_id),
+            guaranteed: false,
+          },
+        ),
+        5,
+      );
+      (builder.build().unwrap(), (scanner, payment_id))
+    },
+    |_, tx: Transaction, _, mut state: (Scanner, [u8; 8])| async move {
+      let output = state.0.scan_transaction(&tx).not_locked().swap_remove(0);
+      assert_eq!(output.commitment().amount, 5);
+      assert_eq!(output.metadata.payment_id, state.1);
+    },
+  ),
+);
+
+test!(
+  scan_featured_integrated_subaddress,
+  (
+    |_, mut builder: Builder, _| async move {
+      let subaddress = SubaddressIndex::new(0, 3).unwrap();
+
+      let view = runner::random_address().1;
+      let mut scanner = Scanner::from_view(view.clone(), Some(HashSet::new()));
+      scanner.register_subaddress(subaddress);
+
+      let mut payment_id = [0u8; 8];
+      OsRng.fill_bytes(&mut payment_id);
+
+      builder.add_payment(
+        view.address(
+          Network::Mainnet,
+          AddressSpec::Featured {
+            subaddress: Some(subaddress),
+            payment_id: Some(payment_id),
+            guaranteed: false,
+          },
+        ),
+        5,
+      );
+      (builder.build().unwrap(), (scanner, payment_id, subaddress))
+    },
+    |_, tx: Transaction, _, mut state: (Scanner, [u8; 8], SubaddressIndex)| async move {
+      let output = state.0.scan_transaction(&tx).not_locked().swap_remove(0);
+      assert_eq!(output.commitment().amount, 5);
+      assert_eq!(output.metadata.payment_id, state.1);
+      assert_eq!(output.metadata.subaddress, Some(state.2));
+    },
+  ),
+);
+
+test!(
+  scan_guaranteed_standard,
+  (
+    |_, mut builder: Builder, _| async move {
+      let view = runner::random_address().1;
+      let scanner = Scanner::from_view(view.clone(), None);
+
+      builder.add_payment(
+        view.address(
+          Network::Mainnet,
+          AddressSpec::Featured { subaddress: None, payment_id: None, guaranteed: true },
+        ),
+        5,
+      );
+      (builder.build().unwrap(), scanner)
+    },
+    |_, tx: Transaction, _, mut state: Scanner| async move {
+      let output = state.scan_transaction(&tx).not_locked().swap_remove(0);
+      assert_eq!(output.commitment().amount, 5);
+    },
+  ),
+);
+
+test!(
+  scan_guaranteed_subaddress,
+  (
+    |_, mut builder: Builder, _| async move {
+      let subaddress = SubaddressIndex::new(1, 0).unwrap();
+
+      let view = runner::random_address().1;
+      let mut scanner = Scanner::from_view(view.clone(), None);
+      scanner.register_subaddress(subaddress);
+
+      builder.add_payment(
+        view.address(
+          Network::Mainnet,
+          AddressSpec::Featured {
+            subaddress: Some(subaddress),
+            payment_id: None,
+            guaranteed: true,
+          },
+        ),
+        5,
+      );
+      (builder.build().unwrap(), (scanner, subaddress))
+    },
+    |_, tx: Transaction, _, mut state: (Scanner, SubaddressIndex)| async move {
+      let output = state.0.scan_transaction(&tx).not_locked().swap_remove(0);
+      assert_eq!(output.commitment().amount, 5);
+      assert_eq!(output.metadata.subaddress, Some(state.1));
+    },
+  ),
+);
+
+test!(
+  scan_guaranteed_integrated,
+  (
+    |_, mut builder: Builder, _| async move {
+      let view = runner::random_address().1;
+      let scanner = Scanner::from_view(view.clone(), None);
+      let mut payment_id = [0u8; 8];
+      OsRng.fill_bytes(&mut payment_id);
+
+      builder.add_payment(
+        view.address(
+          Network::Mainnet,
+          AddressSpec::Featured {
+            subaddress: None,
+            payment_id: Some(payment_id),
+            guaranteed: true,
+          },
+        ),
+        5,
+      );
+      (builder.build().unwrap(), (scanner, payment_id))
+    },
+    |_, tx: Transaction, _, mut state: (Scanner, [u8; 8])| async move {
+      let output = state.0.scan_transaction(&tx).not_locked().swap_remove(0);
+      assert_eq!(output.commitment().amount, 5);
+      assert_eq!(output.metadata.payment_id, state.1);
+    },
+  ),
+);
+
+test!(
+  scan_guaranteed_integrated_subaddress,
+  (
+    |_, mut builder: Builder, _| async move {
+      let subaddress = SubaddressIndex::new(1, 1).unwrap();
+
+      let view = runner::random_address().1;
+      let mut scanner = Scanner::from_view(view.clone(), None);
+      scanner.register_subaddress(subaddress);
+
+      let mut payment_id = [0u8; 8];
+      OsRng.fill_bytes(&mut payment_id);
+
+      builder.add_payment(
+        view.address(
+          Network::Mainnet,
+          AddressSpec::Featured {
+            subaddress: Some(subaddress),
+            payment_id: Some(payment_id),
+            guaranteed: true,
+          },
+        ),
+        5,
+      );
+      (builder.build().unwrap(), (scanner, payment_id, subaddress))
+    },
+    |_, tx: Transaction, _, mut state: (Scanner, [u8; 8], SubaddressIndex)| async move {
+      let output = state.0.scan_transaction(&tx).not_locked().swap_remove(0);
+      assert_eq!(output.commitment().amount, 5);
+      assert_eq!(output.metadata.payment_id, state.1);
+      assert_eq!(output.metadata.subaddress, Some(state.2));
+    },
+  ),
+);
--- a/coins/monero/tests/send.rs
+++ b/coins/monero/tests/send.rs
@@ -1,6 +1,7 @@
 use monero_serai::{
-  wallet::{ReceivedOutput, SpendableOutput},
+  wallet::{extra::Extra, address::SubaddressIndex, ReceivedOutput, SpendableOutput},
  transaction::Transaction,
+  rpc::Rpc,
 };

 mod runner;
@@ -49,3 +50,69 @@ test!(
    },
  ),
 );
+
+test!(
+  // Ideally, this would be single_R, yet it isn't feasible to apply allow(non_snake_case) here
+  single_r_subaddress_send,
+  (
+    // Consume this builder for an output we can use in the future
+    // This is needed because we can't get the input from the passed in builder
+    |_, mut builder: Builder, addr| async move {
+      builder.add_payment(addr, 1000000000000);
+      (builder.build().unwrap(), ())
+    },
+    |_, tx: Transaction, mut scanner: Scanner, _| async move {
+      let mut outputs = scanner.scan_transaction(&tx).not_locked();
+      outputs.sort_by(|x, y| x.commitment().amount.cmp(&y.commitment().amount));
+      assert_eq!(outputs[0].commitment().amount, 1000000000000);
+      outputs
+    },
+  ),
+  (
+    |rpc: Rpc, _, _, mut outputs: Vec<ReceivedOutput>| async move {
+      let change_view = ViewPair::new(
+        &random_scalar(&mut OsRng) * &ED25519_BASEPOINT_TABLE,
+        Zeroizing::new(random_scalar(&mut OsRng)),
+      );
+
+      let mut builder = SignableTransactionBuilder::new(
+        rpc.get_protocol().await.unwrap(),
+        rpc.get_fee().await.unwrap(),
+        Some(Change::new(&change_view, false)),
+      );
+      builder.add_input(SpendableOutput::from(&rpc, outputs.swap_remove(0)).await.unwrap());
+
+      // Send to a subaddress
+      let sub_view = ViewPair::new(
+        &random_scalar(&mut OsRng) * &ED25519_BASEPOINT_TABLE,
+        Zeroizing::new(random_scalar(&mut OsRng)),
+      );
+      builder.add_payment(
+        sub_view
+          .address(Network::Mainnet, AddressSpec::Subaddress(SubaddressIndex::new(0, 1).unwrap())),
+        1,
+      );
+      (builder.build().unwrap(), (change_view, sub_view))
+    },
+    |_, tx: Transaction, _, views: (ViewPair, ViewPair)| async move {
+      // Make sure the change can pick up its output
+      let mut change_scanner = Scanner::from_view(views.0, Some(HashSet::new()));
+      assert!(change_scanner.scan_transaction(&tx).not_locked().len() == 1);
+
+      // Make sure the subaddress can pick up its output
+      let mut sub_scanner = Scanner::from_view(views.1, Some(HashSet::new()));
+      sub_scanner.register_subaddress(SubaddressIndex::new(0, 1).unwrap());
+      let sub_outputs = sub_scanner.scan_transaction(&tx).not_locked();
+      assert!(sub_outputs.len() == 1);
+      assert_eq!(sub_outputs[0].commitment().amount, 1);
+
+      // Make sure only one R was included in TX extra
+      assert!(Extra::read::<&[u8]>(&mut tx.prefix.extra.as_ref())
+        .unwrap()
+        .keys()
+        .unwrap()
+        .1
+        .is_none());
+    },
+  ),
+);
--- a/coins/monero/tests/wallet2_compatibility.rs
+++ b/coins/monero/tests/wallet2_compatibility.rs
@@ -0,0 +1,245 @@
+use std::{
+  collections::{HashSet, HashMap},
+  str::FromStr,
+};
+
+use rand_core::{OsRng, RngCore};
+
+use serde::Deserialize;
+use serde_json::json;
+
+use monero_rpc::{
+  monero::{
+    Amount, Address,
+    cryptonote::{hash::Hash, subaddress::Index},
+    util::address::PaymentId,
+  },
+  TransferOptions, WalletClient,
+};
+
+use monero_serai::{
+  transaction::Transaction,
+  wallet::{
+    address::{Network, AddressSpec, SubaddressIndex, MoneroAddress},
+    extra::{MAX_TX_EXTRA_NONCE_SIZE, Extra},
+    Scanner,
+  },
+  rpc::Rpc,
+};
+
+mod runner;
+
+async fn make_integrated_address(payment_id: [u8; 8]) -> String {
+  #[derive(Deserialize, Debug)]
+  struct IntegratedAddressResponse {
+    integrated_address: String,
+  }
+
+  let rpc = Rpc::new("http://127.0.0.1:6061".to_string()).unwrap();
+  let res = rpc
+    .json_rpc_call::<IntegratedAddressResponse>(
+      "make_integrated_address",
+      Some(json!({ "payment_id": hex::encode(payment_id) })),
+    )
+    .await
+    .unwrap();
+
+  res.integrated_address
+}
+
+async fn initialize_rpcs() -> (WalletClient, Rpc, monero_rpc::monero::Address) {
+  let wallet_rpc =
+    monero_rpc::RpcClientBuilder::new().build("http://127.0.0.1:6061").unwrap().wallet();
+  let daemon_rpc = runner::rpc().await;
+
+  let address_resp = wallet_rpc.get_address(0, None).await;
+  let wallet_rpc_addr = if address_resp.is_ok() {
+    address_resp.unwrap().address
+  } else {
+    wallet_rpc.create_wallet("wallet".to_string(), None, "English".to_string()).await.unwrap();
+    let addr = wallet_rpc.get_address(0, None).await.unwrap().address;
+    daemon_rpc.generate_blocks(&addr.to_string(), 70).await.unwrap();
+    addr
+  };
+  (wallet_rpc, daemon_rpc, wallet_rpc_addr)
+}
+
+async fn from_wallet_rpc_to_self(spec: AddressSpec) {
+  // initialize rpc
+  let (wallet_rpc, daemon_rpc, wallet_rpc_addr) = initialize_rpcs().await;
+
+  // make an addr
+  let (_, view_pair, _) = runner::random_address();
+  let addr = Address::from_str(&view_pair.address(Network::Mainnet, spec).to_string()[..]).unwrap();
+
+  // refresh & make a tx
+  wallet_rpc.refresh(None).await.unwrap();
+  let tx = wallet_rpc
+    .transfer(
+      HashMap::from([(addr, Amount::ONE_XMR)]),
+      monero_rpc::TransferPriority::Default,
+      TransferOptions::default(),
+    )
+    .await
+    .unwrap();
+  let tx_hash: [u8; 32] = tx.tx_hash.0.try_into().unwrap();
+
+  // unlock it
+  runner::mine_until_unlocked(&daemon_rpc, &wallet_rpc_addr.to_string(), tx_hash).await;
+
+  // create the scanner
+  let mut scanner = Scanner::from_view(view_pair, Some(HashSet::new()));
+  if let AddressSpec::Subaddress(index) = spec {
+    scanner.register_subaddress(index);
+  }
+
+  // retrieve it and confirm
+  let tx = daemon_rpc.get_transaction(tx_hash).await.unwrap();
+  let output = scanner.scan_transaction(&tx).not_locked().swap_remove(0);
+
+  match spec {
+    AddressSpec::Subaddress(index) => assert_eq!(output.metadata.subaddress, Some(index)),
+    AddressSpec::Integrated(payment_id) => {
+      assert_eq!(output.metadata.payment_id, payment_id);
+      assert_eq!(output.metadata.subaddress, None);
+    }
+    _ => assert_eq!(output.metadata.subaddress, None),
+  }
+  assert_eq!(output.commitment().amount, 1000000000000);
+}
+
+async_sequential!(
+  async fn receipt_of_wallet_rpc_tx_standard() {
+    from_wallet_rpc_to_self(AddressSpec::Standard).await;
+  }
+
+  async fn receipt_of_wallet_rpc_tx_subaddress() {
+    from_wallet_rpc_to_self(AddressSpec::Subaddress(SubaddressIndex::new(0, 1).unwrap())).await;
+  }
+
+  async fn receipt_of_wallet_rpc_tx_integrated() {
+    let mut payment_id = [0u8; 8];
+    OsRng.fill_bytes(&mut payment_id);
+    from_wallet_rpc_to_self(AddressSpec::Integrated(payment_id)).await;
+  }
+);
+
+test!(
+  send_to_wallet_rpc_standard,
+  (
+    |_, mut builder: Builder, _| async move {
+      // initialize rpc
+      let (wallet_rpc, _, wallet_rpc_addr) = initialize_rpcs().await;
+
+      // add destination
+      builder.add_payment(
+        MoneroAddress::from_str(Network::Mainnet, &wallet_rpc_addr.to_string()).unwrap(),
+        1000000,
+      );
+      (builder.build().unwrap(), (wallet_rpc,))
+    },
+    |_, tx: Transaction, _, data: (WalletClient,)| async move {
+      // confirm receipt
+      data.0.refresh(None).await.unwrap();
+      let transfer =
+        data.0.get_transfer(Hash::from_slice(&tx.hash()), None).await.unwrap().unwrap();
+      assert_eq!(transfer.amount.as_pico(), 1000000);
+      assert_eq!(transfer.subaddr_index, Index { major: 0, minor: 0 });
+    },
+  ),
+);
+
+test!(
+  send_to_wallet_rpc_subaddress,
+  (
+    |_, mut builder: Builder, _| async move {
+      // initialize rpc
+      let (wallet_rpc, _, _) = initialize_rpcs().await;
+
+      // make the addr
+      let (subaddress, index) = wallet_rpc.create_address(0, None).await.unwrap();
+
+      builder.add_payment(
+        MoneroAddress::from_str(Network::Mainnet, &subaddress.to_string()).unwrap(),
+        1000000,
+      );
+      (builder.build().unwrap(), (wallet_rpc, index))
+    },
+    |_, tx: Transaction, _, data: (WalletClient, u32)| async move {
+      // confirm receipt
+      data.0.refresh(None).await.unwrap();
+      let transfer =
+        data.0.get_transfer(Hash::from_slice(&tx.hash()), None).await.unwrap().unwrap();
+      assert_eq!(transfer.amount.as_pico(), 1000000);
+      assert_eq!(transfer.subaddr_index, Index { major: 0, minor: data.1 });
+
+      // Make sure only one R was included in TX extra
+      assert!(Extra::read::<&[u8]>(&mut tx.prefix.extra.as_ref())
+        .unwrap()
+        .keys()
+        .unwrap()
+        .1
+        .is_none());
+    },
+  ),
+);
+
+test!(
+  send_to_wallet_rpc_integrated,
+  (
+    |_, mut builder: Builder, _| async move {
+      // initialize rpc
+      let (wallet_rpc, _, _) = initialize_rpcs().await;
+
+      // make the addr
+      let mut payment_id = [0u8; 8];
+      OsRng.fill_bytes(&mut payment_id);
+      let addr = make_integrated_address(payment_id).await;
+
+      builder.add_payment(MoneroAddress::from_str(Network::Mainnet, &addr).unwrap(), 1000000);
+      (builder.build().unwrap(), (wallet_rpc, payment_id))
+    },
+    |_, tx: Transaction, _, data: (WalletClient, [u8; 8])| async move {
+      // confirm receipt
+      data.0.refresh(None).await.unwrap();
+      let transfer =
+        data.0.get_transfer(Hash::from_slice(&tx.hash()), None).await.unwrap().unwrap();
+      assert_eq!(transfer.amount.as_pico(), 1000000);
+      assert_eq!(transfer.subaddr_index, Index { major: 0, minor: 0 });
+      assert_eq!(transfer.payment_id.0, PaymentId::from_slice(&data.1));
+    },
+  ),
+);
+
+test!(
+  send_to_wallet_rpc_with_arb_data,
+  (
+    |_, mut builder: Builder, _| async move {
+      // initialize rpc
+      let (wallet_rpc, _, wallet_rpc_addr) = initialize_rpcs().await;
+
+      // add destination
+      builder.add_payment(
+        MoneroAddress::from_str(Network::Mainnet, &wallet_rpc_addr.to_string()).unwrap(),
+        1000000,
+      );
+
+      // Make 2 data that is the full 255 bytes
+      for _ in 0 .. 2 {
+        // Subtract 1 since we prefix data with 127
+        let data = vec![b'a'; MAX_TX_EXTRA_NONCE_SIZE - 1];
+        assert!(builder.add_data(data).is_ok());
+      }
+
+      (builder.build().unwrap(), (wallet_rpc,))
+    },
+    |_, tx: Transaction, _, data: (WalletClient,)| async move {
+      // confirm receipt
+      data.0.refresh(None).await.unwrap();
+      let transfer =
+        data.0.get_transfer(Hash::from_slice(&tx.hash()), None).await.unwrap().unwrap();
+      assert_eq!(transfer.amount.as_pico(), 1000000);
+      assert_eq!(transfer.subaddr_index, Index { major: 0, minor: 0 });
+    },
+  ),
+);