Merge branch 'develop' into crypto-tweaks

coins/monero/src/wallet/address.rs

@@ -24,26 +24,59 @@ pub enum AddressType {
   Standard,
   Integrated([u8; 8]),
   Subaddress,
-  Featured(bool, Option<[u8; 8]>, bool),
+  Featured { subaddress: bool, payment_id: Option<[u8; 8]>, guaranteed: bool },
+}
+
+#[derive(Clone, Copy, PartialEq, Eq, Debug, Zeroize)]
+pub struct SubaddressIndex {
+  pub(crate) account: u32,
+  pub(crate) address: u32,
+}
+
+impl SubaddressIndex {
+  pub const fn new(account: u32, address: u32) -> Option<SubaddressIndex> {
+    if (account == 0) && (address == 0) {
+      return None;
+    }
+    Some(SubaddressIndex { account, address })
+  }
+
+  pub fn account(&self) -> u32 {
+    self.account
+  }
+
+  pub fn address(&self) -> u32 {
+    self.address
+  }
+}
+
+/// Address specification. Used internally to create addresses.
+#[derive(Clone, Copy, PartialEq, Eq, Debug, Zeroize)]
+pub enum AddressSpec {
+  Standard,
+  Integrated([u8; 8]),
+  Subaddress(SubaddressIndex),
+  Featured { subaddress: Option<SubaddressIndex>, payment_id: Option<[u8; 8]>, guaranteed: bool },
 }
 
 impl AddressType {
-  pub fn subaddress(&self) -> bool {
-    matches!(self, AddressType::Subaddress) || matches!(self, AddressType::Featured(true, ..))
+  pub fn is_subaddress(&self) -> bool {
+    matches!(self, AddressType::Subaddress) ||
+      matches!(self, AddressType::Featured { subaddress: true, .. })
   }
 
   pub fn payment_id(&self) -> Option<[u8; 8]> {
     if let AddressType::Integrated(id) = self {
       Some(*id)
-    } else if let AddressType::Featured(_, id, _) = self {
-      *id
+    } else if let AddressType::Featured { payment_id, .. } = self {
+      *payment_id
     } else {
       None
     }
   }
 
-  pub fn guaranteed(&self) -> bool {
-    matches!(self, AddressType::Featured(_, _, true))
+  pub fn is_guaranteed(&self) -> bool {
+    matches!(self, AddressType::Featured { guaranteed: true, .. })
   }
 }
 
@@ -105,7 +138,7 @@ impl<B: AddressBytes> AddressMeta<B> {
       AddressType::Standard => bytes.0,
       AddressType::Integrated(_) => bytes.1,
       AddressType::Subaddress => bytes.2,
-      AddressType::Featured(..) => bytes.3,
+      AddressType::Featured { .. } => bytes.3,
     }
   }
 
@@ -114,7 +147,7 @@ impl<B: AddressBytes> AddressMeta<B> {
     AddressMeta { _bytes: PhantomData, network, kind }
   }
 
-  // Returns an incomplete type in the case of Integrated/Featured addresses
+  // Returns an incomplete instantiation in the case of Integrated/Featured addresses
   fn from_byte(byte: u8) -> Result<Self, AddressError> {
     let mut meta = None;
     for network in [Network::Mainnet, Network::Testnet, Network::Stagenet] {
@@ -123,7 +156,9 @@ impl<B: AddressBytes> AddressMeta<B> {
         _ if byte == standard => Some(AddressType::Standard),
         _ if byte == integrated => Some(AddressType::Integrated([0; 8])),
         _ if byte == subaddress => Some(AddressType::Subaddress),
-        _ if byte == featured => Some(AddressType::Featured(false, None, false)),
+        _ if byte == featured => {
+          Some(AddressType::Featured { subaddress: false, payment_id: None, guaranteed: false })
+        }
         _ => None,
       } {
         meta = Some(AddressMeta::new(network, kind));
@@ -134,16 +169,16 @@ impl<B: AddressBytes> AddressMeta<B> {
     meta.ok_or(AddressError::InvalidByte)
   }
 
-  pub fn subaddress(&self) -> bool {
-    self.kind.subaddress()
+  pub fn is_subaddress(&self) -> bool {
+    self.kind.is_subaddress()
   }
 
   pub fn payment_id(&self) -> Option<[u8; 8]> {
     self.kind.payment_id()
   }
 
-  pub fn guaranteed(&self) -> bool {
-    self.kind.guaranteed()
+  pub fn is_guaranteed(&self) -> bool {
+    self.kind.is_guaranteed()
   }
 }
 
@@ -168,7 +203,7 @@ impl<B: AddressBytes> ToString for Address<B> {
     let mut data = vec![self.meta.to_byte()];
     data.extend(self.spend.compress().to_bytes());
     data.extend(self.view.compress().to_bytes());
-    if let AddressType::Featured(subaddress, payment_id, guaranteed) = self.meta.kind {
+    if let AddressType::Featured { subaddress, payment_id, guaranteed } = self.meta.kind {
       // Technically should be a VarInt, yet we don't have enough features it's needed
       data.push(
         u8::from(subaddress) + (u8::from(payment_id.is_some()) << 1) + (u8::from(guaranteed) << 2),
@@ -201,7 +236,7 @@ impl<B: AddressBytes> Address<B> {
       .ok_or(AddressError::InvalidKey)?;
     let mut read = 65;
 
-    if matches!(meta.kind, AddressType::Featured(..)) {
+    if matches!(meta.kind, AddressType::Featured { .. }) {
       if raw[read] >= (2 << 3) {
         Err(AddressError::UnknownFeatures)?;
       }
@@ -210,8 +245,11 @@ impl<B: AddressBytes> Address<B> {
       let integrated = ((raw[read] >> 1) & 1) == 1;
       let guaranteed = ((raw[read] >> 2) & 1) == 1;
 
-      meta.kind =
-        AddressType::Featured(subaddress, Some([0; 8]).filter(|_| integrated), guaranteed);
+      meta.kind = AddressType::Featured {
+        subaddress,
+        payment_id: Some([0; 8]).filter(|_| integrated),
+        guaranteed,
+      };
       read += 1;
     }
 
@@ -226,7 +264,7 @@ impl<B: AddressBytes> Address<B> {
     if let AddressType::Integrated(ref mut id) = meta.kind {
       id.copy_from_slice(&raw[(read - 8) .. read]);
     }
-    if let AddressType::Featured(_, Some(ref mut id), _) = meta.kind {
+    if let AddressType::Featured { payment_id: Some(ref mut id), .. } = meta.kind {
       id.copy_from_slice(&raw[(read - 8) .. read]);
     }
 
@@ -247,16 +285,16 @@ impl<B: AddressBytes> Address<B> {
     self.meta.network
   }
 
-  pub fn subaddress(&self) -> bool {
-    self.meta.subaddress()
+  pub fn is_subaddress(&self) -> bool {
+    self.meta.is_subaddress()
   }
 
   pub fn payment_id(&self) -> Option<[u8; 8]> {
     self.meta.payment_id()
   }
 
-  pub fn guaranteed(&self) -> bool {
-    self.meta.guaranteed()
+  pub fn is_guaranteed(&self) -> bool {
+    self.meta.is_guaranteed()
   }
 }
 

coins/monero/src/wallet/decoys.rs

@@ -1,4 +1,6 @@
-use std::{sync::Mutex, collections::HashSet};
+use std::collections::HashSet;
+
+use futures::lock::{Mutex, MutexGuard};
 
 use lazy_static::lazy_static;
 
@@ -23,13 +25,16 @@ const TIP_APPLICATION: f64 = (LOCK_WINDOW * BLOCK_TIME) as f64;
 
 lazy_static! {
   static ref GAMMA: Gamma<f64> = Gamma::new(19.28, 1.0 / 1.61).unwrap();
+  // TODO: Expose an API to reset this in case a reorg occurs/the RPC fails/returns garbage
+  // TODO: Update this when scanning a block, as possible
   static ref DISTRIBUTION: Mutex<Vec<u64>> = Mutex::new(Vec::with_capacity(3000000));
 }
 
 #[allow(clippy::too_many_arguments)]
-async fn select_n<R: RngCore + CryptoRng>(
+async fn select_n<'a, R: RngCore + CryptoRng>(
   rng: &mut R,
   rpc: &Rpc,
+  distribution: &MutexGuard<'a, Vec<u64>>,
   height: usize,
   high: u64,
   per_second: f64,
@@ -61,7 +66,6 @@ async fn select_n<R: RngCore + CryptoRng>(
 
       let o = (age * per_second) as u64;
       if o < high {
-        let distribution = DISTRIBUTION.lock().unwrap();
         let i = distribution.partition_point(|s| *s < (high - 1 - o));
         let prev = i.saturating_sub(1);
         let n = distribution[i] - distribution[prev];
@@ -136,6 +140,8 @@ impl Decoys {
     height: usize,
     inputs: &[SpendableOutput],
   ) -> Result<Vec<Decoys>, RpcError> {
+    let mut distribution = DISTRIBUTION.lock().await;
+
     let decoy_count = ring_len - 1;
 
     // Convert the inputs in question to the raw output data
@@ -146,29 +152,19 @@ impl Decoys {
       outputs.push((real[real.len() - 1], [input.key(), input.commitment().calculate()]));
     }
 
-    let distribution_len = {
-      let distribution = DISTRIBUTION.lock().unwrap();
-      distribution.len()
-    };
-    if distribution_len <= height {
-      let extension = rpc.get_output_distribution(distribution_len, height).await?;
-      DISTRIBUTION.lock().unwrap().extend(extension);
+    if distribution.len() <= height {
+      let extension = rpc.get_output_distribution(distribution.len(), height).await?;
+      distribution.extend(extension);
     }
+    // If asked to use an older height than previously asked, truncate to ensure accuracy
+    // Should never happen, yet risks desyncing if it did
+    distribution.truncate(height + 1); // height is inclusive, and 0 is a valid height
 
-    let high;
-    let per_second;
-    {
-      let mut distribution = DISTRIBUTION.lock().unwrap();
-      // If asked to use an older height than previously asked, truncate to ensure accuracy
-      // Should never happen, yet risks desyncing if it did
-      distribution.truncate(height + 1); // height is inclusive, and 0 is a valid height
-
-      high = distribution[distribution.len() - 1];
-      per_second = {
-        let blocks = distribution.len().min(BLOCKS_PER_YEAR);
-        let outputs = high - distribution[distribution.len().saturating_sub(blocks + 1)];
-        (outputs as f64) / ((blocks * BLOCK_TIME) as f64)
-      };
+    let high = distribution[distribution.len() - 1];
+    let per_second = {
+      let blocks = distribution.len().min(BLOCKS_PER_YEAR);
+      let outputs = high - distribution[distribution.len().saturating_sub(blocks + 1)];
+      (outputs as f64) / ((blocks * BLOCK_TIME) as f64)
     };
 
     let mut used = HashSet::<u64>::new();
@@ -184,9 +180,18 @@ impl Decoys {
     // Select all decoys for this transaction, assuming we generate a sane transaction
     // We should almost never naturally generate an insane transaction, hence why this doesn't
     // bother with an overage
-    let mut decoys =
-      select_n(rng, rpc, height, high, per_second, &real, &mut used, inputs.len() * decoy_count)
-        .await?;
+    let mut decoys = select_n(
+      rng,
+      rpc,
+      &distribution,
+      height,
+      high,
+      per_second,
+      &real,
+      &mut used,
+      inputs.len() * decoy_count,
+    )
+    .await?;
     real.zeroize();
 
     let mut res = Vec::with_capacity(inputs.len());
@@ -224,8 +229,18 @@ impl Decoys {
 
           // Select new outputs until we have a full sized ring again
           ring.extend(
-            select_n(rng, rpc, height, high, per_second, &[], &mut used, ring_len - ring.len())
-              .await?,
+            select_n(
+              rng,
+              rpc,
+              &distribution,
+              height,
+              high,
+              per_second,
+              &[],
+              &mut used,
+              ring_len - ring.len(),
+            )
+            .await?,
           );
           ring.sort_by(|a, b| a.0.cmp(&b.0));
         }

coins/monero/src/wallet/extra.rs

@@ -1,5 +1,5 @@
 use core::ops::BitXor;
-use std::io::{self, Read, Write, Cursor};
+use std::io::{self, Read, Write};
 
 use zeroize::Zeroize;
 
@@ -12,8 +12,16 @@ use crate::serialize::{
 
 pub const MAX_TX_EXTRA_NONCE_SIZE: usize = 255;
 
+pub const PAYMENT_ID_MARKER: u8 = 0;
+pub const ENCRYPTED_PAYMENT_ID_MARKER: u8 = 1;
+// Used as it's the highest value not interpretable as a continued VarInt
+pub const ARBITRARY_DATA_MARKER: u8 = 127;
+
+// 1 byte is used for the marker
+pub const MAX_ARBITRARY_DATA_SIZE: usize = MAX_TX_EXTRA_NONCE_SIZE - 1;
+
 #[derive(Clone, Copy, PartialEq, Eq, Debug, Zeroize)]
-pub(crate) enum PaymentId {
+pub enum PaymentId {
   Unencrypted([u8; 32]),
   Encrypted([u8; 8]),
 }
@@ -23,6 +31,7 @@ impl BitXor<[u8; 8]> for PaymentId {
 
   fn bitxor(self, bytes: [u8; 8]) -> PaymentId {
     match self {
+      // Don't perform the xor since this isn't intended to be encrypted with xor
       PaymentId::Unencrypted(_) => self,
       PaymentId::Encrypted(id) => {
         PaymentId::Encrypted((u64::from_le_bytes(id) ^ u64::from_le_bytes(bytes)).to_le_bytes())
@@ -32,21 +41,21 @@ impl BitXor<[u8; 8]> for PaymentId {
 }
 
 impl PaymentId {
-  pub(crate) fn serialize<W: Write>(&self, w: &mut W) -> io::Result<()> {
+  pub fn write<W: Write>(&self, w: &mut W) -> io::Result<()> {
     match self {
       PaymentId::Unencrypted(id) => {
-        w.write_all(&[0])?;
+        w.write_all(&[PAYMENT_ID_MARKER])?;
         w.write_all(id)?;
       }
       PaymentId::Encrypted(id) => {
-        w.write_all(&[1])?;
+        w.write_all(&[ENCRYPTED_PAYMENT_ID_MARKER])?;
         w.write_all(id)?;
       }
     }
     Ok(())
   }
 
-  fn deserialize<R: Read>(r: &mut R) -> io::Result<PaymentId> {
+  pub fn read<R: Read>(r: &mut R) -> io::Result<PaymentId> {
     Ok(match read_byte(r)? {
       0 => PaymentId::Unencrypted(read_bytes(r)?),
       1 => PaymentId::Encrypted(read_bytes(r)?),
@@ -57,7 +66,7 @@ impl PaymentId {
 
 // Doesn't bother with padding nor MinerGate
 #[derive(Clone, PartialEq, Eq, Debug, Zeroize)]
-pub(crate) enum ExtraField {
+pub enum ExtraField {
   PublicKey(EdwardsPoint),
   Nonce(Vec<u8>),
   MergeMining(usize, [u8; 32]),
@@ -65,7 +74,7 @@ pub(crate) enum ExtraField {
 }
 
 impl ExtraField {
-  fn serialize<W: Write>(&self, w: &mut W) -> io::Result<()> {
+  pub fn write<W: Write>(&self, w: &mut W) -> io::Result<()> {
     match self {
       ExtraField::PublicKey(key) => {
         w.write_all(&[1])?;
@@ -88,7 +97,7 @@ impl ExtraField {
     Ok(())
   }
 
-  fn deserialize<R: Read>(r: &mut R) -> io::Result<ExtraField> {
+  pub fn read<R: Read>(r: &mut R) -> io::Result<ExtraField> {
     Ok(match read_byte(r)? {
       1 => ExtraField::PublicKey(read_point(r)?),
       2 => ExtraField::Nonce({
@@ -110,52 +119,50 @@ impl ExtraField {
 }
 
 #[derive(Clone, PartialEq, Eq, Debug, Zeroize)]
-pub(crate) struct Extra(Vec<ExtraField>);
+pub struct Extra(Vec<ExtraField>);
 impl Extra {
-  pub(crate) fn keys(&self) -> Vec<EdwardsPoint> {
-    let mut keys = Vec::with_capacity(2);
+  pub fn keys(&self) -> Option<(EdwardsPoint, Option<Vec<EdwardsPoint>>)> {
+    let mut key = None;
+    let mut additional = None;
     for field in &self.0 {
       match field.clone() {
-        ExtraField::PublicKey(key) => keys.push(key),
-        ExtraField::PublicKeys(additional) => keys.extend(additional),
+        ExtraField::PublicKey(this_key) => key = key.or(Some(this_key)),
+        ExtraField::PublicKeys(these_additional) => {
+          additional = additional.or(Some(these_additional))
+        }
         _ => (),
       }
     }
-    keys
+    // Don't return any keys if this was non-standard and didn't include the primary key
+    key.map(|key| (key, additional))
   }
 
-  pub(crate) fn payment_id(&self) -> Option<PaymentId> {
+  pub fn payment_id(&self) -> Option<PaymentId> {
     for field in &self.0 {
       if let ExtraField::Nonce(data) = field {
-        return PaymentId::deserialize(&mut Cursor::new(data)).ok();
+        return PaymentId::read::<&[u8]>(&mut data.as_ref()).ok();
       }
     }
     None
   }
 
-  pub(crate) fn data(&self) -> Vec<Vec<u8>> {
-    let mut first = true;
+  pub fn data(&self) -> Vec<Vec<u8>> {
     let mut res = vec![];
     for field in &self.0 {
       if let ExtraField::Nonce(data) = field {
-        // Skip the first Nonce, which should be the payment ID
-        if first {
-          first = false;
-          continue;
+        if data[0] == ARBITRARY_DATA_MARKER {
+          res.push(data[1 ..].to_vec());
         }
-        res.push(data.clone());
       }
     }
     res
   }
 
-  pub(crate) fn new(mut keys: Vec<EdwardsPoint>) -> Extra {
+  pub(crate) fn new(key: EdwardsPoint, additional: Vec<EdwardsPoint>) -> Extra {
     let mut res = Extra(Vec::with_capacity(3));
-    if !keys.is_empty() {
-      res.push(ExtraField::PublicKey(keys[0]));
-    }
-    if keys.len() > 1 {
-      res.push(ExtraField::PublicKeys(keys.drain(1 ..).collect()));
+    res.push(ExtraField::PublicKey(key));
+    if !additional.is_empty() {
+      res.push(ExtraField::PublicKeys(additional));
     }
     res
   }
@@ -165,29 +172,35 @@ impl Extra {
   }
 
   #[rustfmt::skip]
-  pub(crate) fn fee_weight(outputs: usize, data: &[Vec<u8>]) -> usize {
+  pub(crate) fn fee_weight(outputs: usize, payment_id: bool, data: &[Vec<u8>]) -> usize {
     // PublicKey, key
     (1 + 32) +
     // PublicKeys, length, additional keys
     (1 + 1 + (outputs.saturating_sub(1) * 32)) +
     // PaymentId (Nonce), length, encrypted, ID
-    (1 + 1 + 1 + 8) +
+    (if payment_id { 1 + 1 + 1 + 8 } else { 0 }) +
     // Nonce, length, data (if existent)
     data.iter().map(|v| 1 + varint_len(v.len()) + v.len()).sum::<usize>()
   }
 
-  pub(crate) fn serialize<W: Write>(&self, w: &mut W) -> io::Result<()> {
+  pub fn write<W: Write>(&self, w: &mut W) -> io::Result<()> {
     for field in &self.0 {
-      field.serialize(w)?;
+      field.write(w)?;
     }
     Ok(())
   }
 
-  pub(crate) fn deserialize<R: Read>(r: &mut R) -> io::Result<Extra> {
+  pub fn serialize(&self) -> Vec<u8> {
+    let mut buf = vec![];
+    self.write(&mut buf).unwrap();
+    buf
+  }
+
+  pub fn read<R: Read>(r: &mut R) -> io::Result<Extra> {
     let mut res = Extra(vec![]);
     let mut field;
     while {
-      field = ExtraField::deserialize(r);
+      field = ExtraField::read(r);
       field.is_ok()
     } {
       res.0.push(field.unwrap());

coins/monero/src/wallet/mod.rs

@@ -11,21 +11,26 @@ use curve25519_dalek::{
 
 use crate::{hash, hash_to_scalar, serialize::write_varint, transaction::Input};
 
-mod extra;
+pub mod extra;
 pub(crate) use extra::{PaymentId, ExtraField, Extra};
 
+/// Seed creation and parsing functionality.
+pub mod seed;
+
 /// Address encoding and decoding functionality.
 pub mod address;
-use address::{Network, AddressType, AddressMeta, MoneroAddress};
+use address::{Network, AddressType, SubaddressIndex, AddressSpec, AddressMeta, MoneroAddress};
 
 mod scan;
-pub use scan::{ReceivedOutput, SpendableOutput};
+pub use scan::{ReceivedOutput, SpendableOutput, Timelocked};
 
 pub(crate) mod decoys;
 pub(crate) use decoys::Decoys;
 
 mod send;
-pub use send::{Fee, TransactionError, SignableTransaction, SignableTransactionBuilder};
+pub use send::{Fee, TransactionError, Change, SignableTransaction, SignableTransactionBuilder};
+#[cfg(feature = "multisig")]
+pub(crate) use send::InternalPayment;
 #[cfg(feature = "multisig")]
 pub use send::TransactionMachine;
 
@@ -54,19 +59,20 @@ pub(crate) fn uniqueness(inputs: &[Input]) -> [u8; 32] {
 #[allow(non_snake_case)]
 pub(crate) fn shared_key(
   uniqueness: Option<[u8; 32]>,
-  s: &Scalar,
-  P: &EdwardsPoint,
+  ecdh: EdwardsPoint,
   o: usize,
 ) -> (u8, Scalar, [u8; 8]) {
   // 8Ra
-  let mut output_derivation = (s * P).mul_by_cofactor().compress().to_bytes().to_vec();
+  let mut output_derivation = ecdh.mul_by_cofactor().compress().to_bytes().to_vec();
+
+  let mut payment_id_xor = [0; 8];
+  payment_id_xor
+    .copy_from_slice(&hash(&[output_derivation.as_ref(), [0x8d].as_ref()].concat())[.. 8]);
+
   // || o
   write_varint(&o.try_into().unwrap(), &mut output_derivation).unwrap();
 
   let view_tag = hash(&[b"view_tag".as_ref(), &output_derivation].concat())[0];
-  let mut payment_id_xor = [0; 8];
-  payment_id_xor
-    .copy_from_slice(&hash(&[output_derivation.as_ref(), [0x8d].as_ref()].concat())[.. 8]);
 
   // uniqueness ||
   let shared_key = if let Some(uniqueness) = uniqueness {
@@ -106,21 +112,61 @@ impl ViewPair {
     ViewPair { spend, view }
   }
 
-  pub(crate) fn subaddress(&self, index: (u32, u32)) -> Scalar {
-    if index == (0, 0) {
-      return Scalar::zero();
-    }
+  pub fn spend(&self) -> EdwardsPoint {
+    self.spend
+  }
 
+  pub fn view(&self) -> EdwardsPoint {
+    self.view.deref() * &ED25519_BASEPOINT_TABLE
+  }
+
+  fn subaddress_derivation(&self, index: SubaddressIndex) -> Scalar {
     hash_to_scalar(&Zeroizing::new(
       [
         b"SubAddr\0".as_ref(),
         Zeroizing::new(self.view.to_bytes()).as_ref(),
-        &index.0.to_le_bytes(),
-        &index.1.to_le_bytes(),
+        &index.account().to_le_bytes(),
+        &index.address().to_le_bytes(),
       ]
       .concat(),
     ))
   }
+
+  fn subaddress_keys(&self, index: SubaddressIndex) -> (EdwardsPoint, EdwardsPoint) {
+    let scalar = self.subaddress_derivation(index);
+    let spend = self.spend + (&scalar * &ED25519_BASEPOINT_TABLE);
+    let view = self.view.deref() * spend;
+    (spend, view)
+  }
+
+  /// Returns an address with the provided specification.
+  pub fn address(&self, network: Network, spec: AddressSpec) -> MoneroAddress {
+    let mut spend = self.spend;
+    let mut view: EdwardsPoint = self.view.deref() * &ED25519_BASEPOINT_TABLE;
+
+    // construct the address meta
+    let meta = match spec {
+      AddressSpec::Standard => AddressMeta::new(network, AddressType::Standard),
+      AddressSpec::Integrated(payment_id) => {
+        AddressMeta::new(network, AddressType::Integrated(payment_id))
+      }
+      AddressSpec::Subaddress(index) => {
+        (spend, view) = self.subaddress_keys(index);
+        AddressMeta::new(network, AddressType::Subaddress)
+      }
+      AddressSpec::Featured { subaddress, payment_id, guaranteed } => {
+        if let Some(index) = subaddress {
+          (spend, view) = self.subaddress_keys(index);
+        }
+        AddressMeta::new(
+          network,
+          AddressType::Featured { subaddress: subaddress.is_some(), payment_id, guaranteed },
+        )
+      }
+    };
+
+    MoneroAddress::new(meta, spend, view)
+  }
 }
 
 /// Transaction scanner.
@@ -130,15 +176,14 @@ impl ViewPair {
 #[derive(Clone)]
 pub struct Scanner {
   pair: ViewPair,
-  network: Network,
-  pub(crate) subaddresses: HashMap<CompressedEdwardsY, (u32, u32)>,
+  // Also contains the spend key as None
+  pub(crate) subaddresses: HashMap<CompressedEdwardsY, Option<SubaddressIndex>>,
   pub(crate) burning_bug: Option<HashSet<CompressedEdwardsY>>,
 }
 
 impl Zeroize for Scanner {
   fn zeroize(&mut self) {
     self.pair.zeroize();
-    self.network.zeroize();
 
     // These may not be effective, unfortunately
     for (mut key, mut value) in self.subaddresses.drain() {
@@ -163,59 +208,24 @@ impl ZeroizeOnDrop for Scanner {}
 
 impl Scanner {
   /// Create a Scanner from a ViewPair.
-  /// The network is used for generating subaddresses.
   /// burning_bug is a HashSet of used keys, intended to prevent key reuse which would burn funds.
   /// When an output is successfully scanned, the output key MUST be saved to disk.
   /// When a new scanner is created, ALL saved output keys must be passed in to be secure.
   /// If None is passed, a modified shared key derivation is used which is immune to the burning
   /// bug (specifically the Guaranteed feature from Featured Addresses).
-  // TODO: Should this take in a DB access handle to ensure output keys are saved?
-  pub fn from_view(
-    pair: ViewPair,
-    network: Network,
-    burning_bug: Option<HashSet<CompressedEdwardsY>>,
-  ) -> Scanner {
+  pub fn from_view(pair: ViewPair, burning_bug: Option<HashSet<CompressedEdwardsY>>) -> Scanner {
     let mut subaddresses = HashMap::new();
-    subaddresses.insert(pair.spend.compress(), (0, 0));
-    Scanner { pair, network, subaddresses, burning_bug }
+    subaddresses.insert(pair.spend.compress(), None);
+    Scanner { pair, subaddresses, burning_bug }
   }
 
-  /// Return the main address for this view pair.
-  pub fn address(&self) -> MoneroAddress {
-    MoneroAddress::new(
-      AddressMeta::new(
-        self.network,
-        if self.burning_bug.is_none() {
-          AddressType::Featured(false, None, true)
-        } else {
-          AddressType::Standard
-        },
-      ),
-      self.pair.spend,
-      self.pair.view.deref() * &ED25519_BASEPOINT_TABLE,
-    )
-  }
-
-  /// Return the specified subaddress for this view pair.
-  pub fn subaddress(&mut self, index: (u32, u32)) -> MoneroAddress {
-    if index == (0, 0) {
-      return self.address();
-    }
-
-    let spend = self.pair.spend + (&self.pair.subaddress(index) * &ED25519_BASEPOINT_TABLE);
-    self.subaddresses.insert(spend.compress(), index);
-
-    MoneroAddress::new(
-      AddressMeta::new(
-        self.network,
-        if self.burning_bug.is_none() {
-          AddressType::Featured(true, None, true)
-        } else {
-          AddressType::Subaddress
-        },
-      ),
-      spend,
-      self.pair.view.deref() * spend,
-    )
+  /// Register a subaddress.
+  // There used to be an address function here, yet it wasn't safe. It could generate addresses
+  // incompatible with the Scanner. While we could return None for that, then we have the issue
+  // of runtime failures to generate an address.
+  // Removing that API was the simplest option.
+  pub fn register_subaddress(&mut self, subaddress: SubaddressIndex) {
+    let (spend, _) = self.pair.subaddress_keys(subaddress);
+    self.subaddresses.insert(spend.compress(), Some(subaddress));
   }
 }

coins/monero/src/wallet/scan.rs

@@ -1,4 +1,5 @@
-use std::io::Cursor;
+use core::ops::Deref;
+use std::io::{self, Read, Write};
 
 use zeroize::{Zeroize, ZeroizeOnDrop};
 
@@ -10,7 +11,10 @@ use crate::{
   transaction::{Input, Timelock, Transaction},
   block::Block,
   rpc::{Rpc, RpcError},
-  wallet::{PaymentId, Extra, Scanner, uniqueness, shared_key, amount_decryption, commitment_mask},
+  wallet::{
+    PaymentId, Extra, address::SubaddressIndex, Scanner, uniqueness, shared_key, amount_decryption,
+    commitment_mask,
+  },
 };
 
 /// An absolute output ID, defined as its transaction hash and output index.
@@ -21,14 +25,18 @@ pub struct AbsoluteId {
 }
 
 impl AbsoluteId {
-  pub fn serialize(&self) -> Vec<u8> {
-    let mut res = Vec::with_capacity(32 + 1);
-    res.extend(self.tx);
-    res.push(self.o);
-    res
+  pub fn write<W: Write>(&self, w: &mut W) -> io::Result<()> {
+    w.write_all(&self.tx)?;
+    w.write_all(&[self.o])
   }
 
-  pub fn deserialize<R: std::io::Read>(r: &mut R) -> std::io::Result<AbsoluteId> {
+  pub fn serialize(&self) -> Vec<u8> {
+    let mut serialized = Vec::with_capacity(32 + 1);
+    self.write(&mut serialized).unwrap();
+    serialized
+  }
+
+  pub fn read<R: Read>(r: &mut R) -> io::Result<AbsoluteId> {
     Ok(AbsoluteId { tx: read_bytes(r)?, o: read_byte(r)? })
   }
 }
@@ -43,16 +51,20 @@ pub struct OutputData {
 }
 
 impl OutputData {
-  pub fn serialize(&self) -> Vec<u8> {
-    let mut res = Vec::with_capacity(32 + 32 + 40);
-    res.extend(self.key.compress().to_bytes());
-    res.extend(self.key_offset.to_bytes());
-    res.extend(self.commitment.mask.to_bytes());
-    res.extend(self.commitment.amount.to_le_bytes());
-    res
+  pub fn write<W: Write>(&self, w: &mut W) -> io::Result<()> {
+    w.write_all(&self.key.compress().to_bytes())?;
+    w.write_all(&self.key_offset.to_bytes())?;
+    w.write_all(&self.commitment.mask.to_bytes())?;
+    w.write_all(&self.commitment.amount.to_le_bytes())
   }
 
-  pub fn deserialize<R: std::io::Read>(r: &mut R) -> std::io::Result<OutputData> {
+  pub fn serialize(&self) -> Vec<u8> {
+    let mut serialized = Vec::with_capacity(32 + 32 + 32 + 8);
+    self.write(&mut serialized).unwrap();
+    serialized
+  }
+
+  pub fn read<R: Read>(r: &mut R) -> io::Result<OutputData> {
     Ok(OutputData {
       key: read_point(r)?,
       key_offset: read_scalar(r)?,
@@ -64,9 +76,8 @@ impl OutputData {
 /// The metadata for an output.
 #[derive(Clone, PartialEq, Eq, Debug, Zeroize, ZeroizeOnDrop)]
 pub struct Metadata {
-  // Does not have to be an Option since the 0 subaddress is the main address
   /// The subaddress this output was sent to.
-  pub subaddress: (u32, u32),
+  pub subaddress: Option<SubaddressIndex>,
   /// The payment ID included with this output.
   /// This will be gibberish if the payment ID wasn't intended for the recipient or wasn't included.
   // Could be an Option, as extra doesn't necessarily have a payment ID, yet all Monero TXs should
@@ -77,23 +88,42 @@ pub struct Metadata {
 }
 
 impl Metadata {
-  pub fn serialize(&self) -> Vec<u8> {
-    let mut res = Vec::with_capacity(4 + 4 + 8 + 1);
-    res.extend(self.subaddress.0.to_le_bytes());
-    res.extend(self.subaddress.1.to_le_bytes());
-    res.extend(self.payment_id);
-
-    res.extend(u32::try_from(self.arbitrary_data.len()).unwrap().to_le_bytes());
-    for part in &self.arbitrary_data {
-      res.extend([u8::try_from(part.len()).unwrap()]);
-      res.extend(part);
+  pub fn write<W: Write>(&self, w: &mut W) -> io::Result<()> {
+    if let Some(subaddress) = self.subaddress {
+      w.write_all(&[1])?;
+      w.write_all(&subaddress.account().to_le_bytes())?;
+      w.write_all(&subaddress.address().to_le_bytes())?;
+    } else {
+      w.write_all(&[0])?;
     }
-    res
+    w.write_all(&self.payment_id)?;
+
+    w.write_all(&u32::try_from(self.arbitrary_data.len()).unwrap().to_le_bytes())?;
+    for part in &self.arbitrary_data {
+      w.write_all(&[u8::try_from(part.len()).unwrap()])?;
+      w.write_all(part)?;
+    }
+    Ok(())
   }
 
-  pub fn deserialize<R: std::io::Read>(r: &mut R) -> std::io::Result<Metadata> {
+  pub fn serialize(&self) -> Vec<u8> {
+    let mut serialized = Vec::with_capacity(1 + 8 + 1);
+    self.write(&mut serialized).unwrap();
+    serialized
+  }
+
+  pub fn read<R: Read>(r: &mut R) -> io::Result<Metadata> {
+    let subaddress = if read_byte(r)? == 1 {
+      Some(
+        SubaddressIndex::new(read_u32(r)?, read_u32(r)?)
+          .ok_or_else(|| io::Error::new(io::ErrorKind::Other, "invalid subaddress in metadata"))?,
+      )
+    } else {
+      None
+    };
+
     Ok(Metadata {
-      subaddress: (read_u32(r)?, read_u32(r)?),
+      subaddress,
       payment_id: read_bytes(r)?,
       arbitrary_data: {
         let mut data = vec![];
@@ -132,18 +162,23 @@ impl ReceivedOutput {
     &self.metadata.arbitrary_data
   }
 
+  pub fn write<W: Write>(&self, w: &mut W) -> io::Result<()> {
+    self.absolute.write(w)?;
+    self.data.write(w)?;
+    self.metadata.write(w)
+  }
+
   pub fn serialize(&self) -> Vec<u8> {
-    let mut serialized = self.absolute.serialize();
-    serialized.extend(&self.data.serialize());
-    serialized.extend(&self.metadata.serialize());
+    let mut serialized = vec![];
+    self.write(&mut serialized).unwrap();
     serialized
   }
 
-  pub fn deserialize<R: std::io::Read>(r: &mut R) -> std::io::Result<ReceivedOutput> {
+  pub fn read<R: Read>(r: &mut R) -> io::Result<ReceivedOutput> {
     Ok(ReceivedOutput {
-      absolute: AbsoluteId::deserialize(r)?,
-      data: OutputData::deserialize(r)?,
-      metadata: Metadata::deserialize(r)?,
+      absolute: AbsoluteId::read(r)?,
+      data: OutputData::read(r)?,
+      metadata: Metadata::read(r)?,
     })
   }
 }
@@ -184,14 +219,19 @@ impl SpendableOutput {
     self.output.commitment()
   }
 
+  pub fn write<W: Write>(&self, w: &mut W) -> io::Result<()> {
+    self.output.write(w)?;
+    w.write_all(&self.global_index.to_le_bytes())
+  }
+
   pub fn serialize(&self) -> Vec<u8> {
-    let mut serialized = self.output.serialize();
-    serialized.extend(self.global_index.to_le_bytes());
+    let mut serialized = vec![];
+    self.write(&mut serialized).unwrap();
     serialized
   }
 
-  pub fn deserialize<R: std::io::Read>(r: &mut R) -> std::io::Result<SpendableOutput> {
-    Ok(SpendableOutput { output: ReceivedOutput::deserialize(r)?, global_index: read_u64(r)? })
+  pub fn read<R: Read>(r: &mut R) -> io::Result<SpendableOutput> {
+    Ok(SpendableOutput { output: ReceivedOutput::read(r)?, global_index: read_u64(r)? })
   }
 }
 
@@ -232,14 +272,19 @@ impl<O: Clone + Zeroize> Timelocked<O> {
 impl Scanner {
   /// Scan a transaction to discover the received outputs.
   pub fn scan_transaction(&mut self, tx: &Transaction) -> Timelocked<ReceivedOutput> {
-    let extra = Extra::deserialize(&mut Cursor::new(&tx.prefix.extra));
-    let keys;
+    let extra = Extra::read::<&[u8]>(&mut tx.prefix.extra.as_ref());
     let extra = if let Ok(extra) = extra {
-      keys = extra.keys();
       extra
     } else {
       return Timelocked(tx.prefix.timelock, vec![]);
     };
+
+    let (tx_key, additional) = if let Some((tx_key, additional)) = extra.keys() {
+      (tx_key, additional)
+    } else {
+      return Timelocked(tx.prefix.timelock, vec![]);
+    };
+
     let payment_id = extra.payment_id();
 
     let mut res = vec![];
@@ -257,11 +302,22 @@ impl Scanner {
       }
       let output_key = output_key.unwrap();
 
-      for key in &keys {
+      for key in [Some(Some(&tx_key)), additional.as_ref().map(|additional| additional.get(o))] {
+        let key = if let Some(Some(key)) = key {
+          key
+        } else if let Some(None) = key {
+          // This is non-standard. There were additional keys, yet not one for this output
+          // https://github.com/monero-project/monero/
+          //   blob/04a1e2875d6e35e27bb21497988a6c822d319c28/
+          //   src/cryptonote_basic/cryptonote_format_utils.cpp#L1062
+          // TODO: Should this return? Where does Monero set the trap handler for this exception?
+          continue;
+        } else {
+          break;
+        };
         let (view_tag, shared_key, payment_id_xor) = shared_key(
           if self.burning_bug.is_none() { Some(uniqueness(&tx.prefix.inputs)) } else { None },
-          &self.pair.view,
-          key,
+          self.pair.view.deref() * key,
           o,
         );
 
@@ -291,9 +347,12 @@ impl Scanner {
         // We will not have a torsioned key in our HashMap of keys, so we wouldn't identify it as
         // ours
         // If we did though, it'd enable bypassing the included burning bug protection
-        debug_assert!(output_key.is_torsion_free());
+        assert!(output_key.is_torsion_free());
 
-        let key_offset = shared_key + self.pair.subaddress(subaddress);
+        let mut key_offset = shared_key;
+        if let Some(subaddress) = subaddress {
+          key_offset += self.pair.subaddress_derivation(subaddress);
+        }
         // Since we've found an output to us, get its amount
         let mut commitment = Commitment::zero();
 

coins/monero/src/wallet/seed/classic.rs

@@ -0,0 +1,262 @@
+use core::ops::Deref;
+use std::collections::HashMap;
+
+use lazy_static::lazy_static;
+
+use zeroize::{Zeroize, Zeroizing};
+use rand_core::{RngCore, CryptoRng};
+
+use crc::{Crc, CRC_32_ISO_HDLC};
+
+use curve25519_dalek::scalar::Scalar;
+
+use crate::{
+  random_scalar,
+  wallet::seed::{SeedError, Language},
+};
+
+pub(crate) const CLASSIC_SEED_LENGTH: usize = 24;
+pub(crate) const CLASSIC_SEED_LENGTH_WITH_CHECKSUM: usize = 25;
+
+fn trim(word: &str, len: usize) -> Zeroizing<String> {
+  Zeroizing::new(word.chars().take(len).collect())
+}
+
+struct WordList {
+  word_list: Vec<String>,
+  word_map: HashMap<String, usize>,
+  trimmed_word_map: HashMap<String, usize>,
+  unique_prefix_length: usize,
+}
+
+impl WordList {
+  fn new(words: &'static str, prefix_length: usize) -> WordList {
+    let mut lang = WordList {
+      word_list: serde_json::from_str(words).unwrap(),
+      word_map: HashMap::new(),
+      trimmed_word_map: HashMap::new(),
+      unique_prefix_length: prefix_length,
+    };
+
+    for (i, word) in lang.word_list.iter().enumerate() {
+      lang.word_map.insert(word.clone(), i);
+      lang.trimmed_word_map.insert(trim(word, lang.unique_prefix_length).deref().clone(), i);
+    }
+
+    lang
+  }
+}
+
+lazy_static! {
+  static ref LANGUAGES: HashMap<Language, WordList> = HashMap::from([
+    (Language::Chinese, WordList::new(include_str!("./classic/zh.json"), 1)),
+    (Language::English, WordList::new(include_str!("./classic/en.json"), 3)),
+    (Language::Dutch, WordList::new(include_str!("./classic/nl.json"), 4)),
+    (Language::French, WordList::new(include_str!("./classic/fr.json"), 4)),
+    (Language::Spanish, WordList::new(include_str!("./classic/es.json"), 4)),
+    (Language::German, WordList::new(include_str!("./classic/de.json"), 4)),
+    (Language::Italian, WordList::new(include_str!("./classic/it.json"), 4)),
+    (Language::Portuguese, WordList::new(include_str!("./classic/pt.json"), 4)),
+    (Language::Japanese, WordList::new(include_str!("./classic/ja.json"), 3)),
+    (Language::Russian, WordList::new(include_str!("./classic/ru.json"), 4)),
+    (Language::Esperanto, WordList::new(include_str!("./classic/eo.json"), 4)),
+    (Language::Lojban, WordList::new(include_str!("./classic/jbo.json"), 4)),
+    (Language::EnglishOld, WordList::new(include_str!("./classic/ang.json"), 4)),
+  ]);
+}
+
+#[cfg(test)]
+pub(crate) fn trim_by_lang(word: &str, lang: Language) -> String {
+  if lang != Language::EnglishOld {
+    word.chars().take(LANGUAGES[&lang].unique_prefix_length).collect()
+  } else {
+    word.to_string()
+  }
+}
+
+fn checksum_index(words: &[Zeroizing<String>], lang: &WordList) -> usize {
+  let mut trimmed_words = Zeroizing::new(String::new());
+  for w in words {
+    *trimmed_words += &trim(w, lang.unique_prefix_length);
+  }
+
+  let crc = Crc::<u32>::new(&CRC_32_ISO_HDLC);
+  let mut digest = crc.digest();
+  digest.update(trimmed_words.as_bytes());
+
+  usize::try_from(digest.finalize()).unwrap() % words.len()
+}
+
+// Convert a private key to a seed
+fn key_to_seed(lang: Language, key: Zeroizing<Scalar>) -> ClassicSeed {
+  let bytes = Zeroizing::new(key.to_bytes());
+
+  // get the language words
+  let words = &LANGUAGES[&lang].word_list;
+  let list_len = u64::try_from(words.len()).unwrap();
+
+  // To store the found words & add the checksum word later.
+  let mut seed = Vec::with_capacity(25);
+
+  // convert to words
+  // 4 bytes -> 3 words. 8 digits base 16 -> 3 digits base 1626
+  let mut segment = [0; 4];
+  let mut indices = [0; 4];
+  for i in 0 .. 8 {
+    // convert first 4 byte to u32 & get the word indices
+    let start = i * 4;
+    // convert 4 byte to u32
+    segment.copy_from_slice(&bytes[start .. (start + 4)]);
+    // Actually convert to a u64 so we can add without overflowing
+    indices[0] = u64::from(u32::from_le_bytes(segment));
+    indices[1] = indices[0];
+    indices[0] /= list_len;
+    indices[2] = indices[0] + indices[1];
+    indices[0] /= list_len;
+    indices[3] = indices[0] + indices[2];
+
+    // append words to seed
+    for i in indices.iter().skip(1) {
+      let word = usize::try_from(i % list_len).unwrap();
+      seed.push(Zeroizing::new(words[word].clone()));
+    }
+  }
+  segment.zeroize();
+  indices.zeroize();
+
+  // create a checksum word for all languages except old english
+  if lang != Language::EnglishOld {
+    let checksum = seed[checksum_index(&seed, &LANGUAGES[&lang])].clone();
+    seed.push(checksum);
+  }
+
+  let mut res = Zeroizing::new(String::new());
+  for (i, word) in seed.iter().enumerate() {
+    if i != 0 {
+      *res += " ";
+    }
+    *res += word;
+  }
+  ClassicSeed(res)
+}
+
+// Convert a seed to bytes
+pub(crate) fn seed_to_bytes(words: &str) -> Result<(Language, Zeroizing<[u8; 32]>), SeedError> {
+  // get seed words
+  let words = words.split_whitespace().map(|w| Zeroizing::new(w.to_string())).collect::<Vec<_>>();
+  if (words.len() != CLASSIC_SEED_LENGTH) && (words.len() != CLASSIC_SEED_LENGTH_WITH_CHECKSUM) {
+    panic!("invalid seed passed to seed_to_bytes");
+  }
+
+  // find the language
+  let (matched_indices, lang_name, lang) = (|| {
+    let has_checksum = words.len() == CLASSIC_SEED_LENGTH_WITH_CHECKSUM;
+    let mut matched_indices = Zeroizing::new(vec![]);
+
+    // Iterate through all the languages
+    'language: for (lang_name, lang) in LANGUAGES.iter() {
+      matched_indices.zeroize();
+      matched_indices.clear();
+
+      let map_in_use = if has_checksum { &lang.trimmed_word_map } else { &lang.word_map };
+
+      // Iterate through all the words and see if they're all present
+      for word in &words {
+        let trimmed = trim(word, lang.unique_prefix_length);
+        let word = if has_checksum { &trimmed } else { word };
+
+        if let Some(index) = map_in_use.get(word.deref()) {
+          matched_indices.push(*index);
+        } else {
+          continue 'language;
+        }
+      }
+
+      if has_checksum {
+        if lang_name == &Language::EnglishOld {
+          Err(SeedError::EnglishOldWithChecksum)?;
+        }
+
+        // exclude the last word when calculating a checksum.
+        let last_word = words.last().unwrap().clone();
+        let checksum = words[checksum_index(&words[.. words.len() - 1], lang)].clone();
+
+        // check the trimmed checksum and trimmed last word line up
+        if trim(&checksum, lang.unique_prefix_length) != trim(&last_word, lang.unique_prefix_length)
+        {
+          Err(SeedError::InvalidChecksum)?;
+        }
+      }
+
+      return Ok((matched_indices, lang_name, lang));
+    }
+
+    Err(SeedError::UnknownLanguage)?
+  })()?;
+
+  // convert to bytes
+  let mut res = Zeroizing::new([0; 32]);
+  let mut indices = Zeroizing::new([0; 4]);
+  for i in 0 .. 8 {
+    // read 3 indices at a time
+    let i3 = i * 3;
+    indices[1] = matched_indices[i3];
+    indices[2] = matched_indices[i3 + 1];
+    indices[3] = matched_indices[i3 + 2];
+
+    let inner = |i| {
+      let mut base = (lang.word_list.len() - indices[i] + indices[i + 1]) % lang.word_list.len();
+      // Shift the index over
+      for _ in 0 .. i {
+        base *= lang.word_list.len();
+      }
+      base
+    };
+    // set the last index
+    indices[0] = indices[1] + inner(1) + inner(2);
+    if (indices[0] % lang.word_list.len()) != indices[1] {
+      Err(SeedError::InvalidSeed)?;
+    }
+
+    let pos = i * 4;
+    let mut bytes = u32::try_from(indices[0]).unwrap().to_le_bytes();
+    res[pos .. (pos + 4)].copy_from_slice(&bytes);
+    bytes.zeroize();
+  }
+
+  Ok((*lang_name, res))
+}
+
+#[derive(Clone, PartialEq, Eq, Zeroize)]
+pub struct ClassicSeed(Zeroizing<String>);
+impl ClassicSeed {
+  pub(crate) fn new<R: RngCore + CryptoRng>(rng: &mut R, lang: Language) -> ClassicSeed {
+    key_to_seed(lang, Zeroizing::new(random_scalar(rng)))
+  }
+
+  pub fn from_string(words: Zeroizing<String>) -> Result<ClassicSeed, SeedError> {
+    let (lang, entropy) = seed_to_bytes(&words)?;
+
+    // Make sure this is a valid scalar
+    let mut scalar = Scalar::from_canonical_bytes(*entropy);
+    if scalar.is_none() {
+      Err(SeedError::InvalidSeed)?;
+    }
+    scalar.zeroize();
+
+    // Call from_entropy so a trimmed seed becomes a full seed
+    Ok(Self::from_entropy(lang, entropy).unwrap())
+  }
+
+  pub fn from_entropy(lang: Language, entropy: Zeroizing<[u8; 32]>) -> Option<ClassicSeed> {
+    Scalar::from_canonical_bytes(*entropy).map(|scalar| key_to_seed(lang, Zeroizing::new(scalar)))
+  }
+
+  pub(crate) fn to_string(&self) -> Zeroizing<String> {
+    self.0.clone()
+  }
+
+  pub(crate) fn entropy(&self) -> Zeroizing<[u8; 32]> {
+    seed_to_bytes(&self.0).unwrap().1
+  }
+}

coins/monero/src/wallet/seed/mod.rs

@@ -0,0 +1,92 @@
+use core::fmt;
+
+use zeroize::{Zeroize, ZeroizeOnDrop, Zeroizing};
+use rand_core::{RngCore, CryptoRng};
+
+use thiserror::Error;
+
+pub(crate) mod classic;
+use classic::{CLASSIC_SEED_LENGTH, CLASSIC_SEED_LENGTH_WITH_CHECKSUM, ClassicSeed};
+
+/// Error when decoding a seed.
+#[derive(Clone, Copy, PartialEq, Eq, Debug, Error)]
+pub enum SeedError {
+  #[error("invalid number of words in seed")]
+  InvalidSeedLength,
+  #[error("unknown language")]
+  UnknownLanguage,
+  #[error("invalid checksum")]
+  InvalidChecksum,
+  #[error("english old seeds don't support checksums")]
+  EnglishOldWithChecksum,
+  #[error("invalid seed")]
+  InvalidSeed,
+}
+
+#[derive(Clone, Copy, PartialEq, Eq, Debug, Hash)]
+pub enum Language {
+  Chinese,
+  English,
+  Dutch,
+  French,
+  Spanish,
+  German,
+  Italian,
+  Portuguese,
+  Japanese,
+  Russian,
+  Esperanto,
+  Lojban,
+  EnglishOld,
+}
+
+/// A Monero seed.
+// TODO: Add polyseed to enum
+#[derive(Clone, PartialEq, Eq, Zeroize, ZeroizeOnDrop)]
+pub enum Seed {
+  Classic(ClassicSeed),
+}
+
+impl fmt::Debug for Seed {
+  fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
+    match self {
+      Seed::Classic(_) => f.debug_struct("Seed::Classic").finish_non_exhaustive(),
+    }
+  }
+}
+
+impl Seed {
+  /// Create a new seed.
+  pub fn new<R: RngCore + CryptoRng>(rng: &mut R, lang: Language) -> Seed {
+    Seed::Classic(ClassicSeed::new(rng, lang))
+  }
+
+  /// Parse a seed from a String.
+  pub fn from_string(words: Zeroizing<String>) -> Result<Seed, SeedError> {
+    match words.split_whitespace().count() {
+      CLASSIC_SEED_LENGTH | CLASSIC_SEED_LENGTH_WITH_CHECKSUM => {
+        ClassicSeed::from_string(words).map(Seed::Classic)
+      }
+      _ => Err(SeedError::InvalidSeedLength)?,
+    }
+  }
+
+  /// Create a Seed from entropy.
+  pub fn from_entropy(lang: Language, entropy: Zeroizing<[u8; 32]>) -> Option<Seed> {
+    ClassicSeed::from_entropy(lang, entropy).map(Seed::Classic)
+  }
+
+  /// Convert a seed to a String.
+  pub fn to_string(&self) -> Zeroizing<String> {
+    match self {
+      Seed::Classic(seed) => seed.to_string(),
+    }
+  }
+
+  /// Return the entropy for this seed.
+  pub fn entropy(&self) -> Zeroizing<[u8; 32]> {
+    match self {
+      Seed::Classic(seed) => seed.entropy(),
+    }
+  }
+}

coins/monero/src/wallet/send/builder.rs

@@ -5,8 +5,8 @@ use zeroize::{Zeroize, ZeroizeOnDrop};
 use crate::{
   Protocol,
   wallet::{
-    address::MoneroAddress, Fee, SpendableOutput, SignableTransaction, TransactionError,
-    extra::MAX_TX_EXTRA_NONCE_SIZE,
+    address::MoneroAddress, Fee, SpendableOutput, Change, SignableTransaction, TransactionError,
+    extra::MAX_ARBITRARY_DATA_SIZE,
   },
 };
 
@@ -17,14 +17,14 @@ struct SignableTransactionBuilderInternal {
 
   inputs: Vec<SpendableOutput>,
   payments: Vec<(MoneroAddress, u64)>,
-  change_address: Option<MoneroAddress>,
+  change_address: Option<Change>,
   data: Vec<Vec<u8>>,
 }
 
 impl SignableTransactionBuilderInternal {
   // Takes in the change address so users don't miss that they have to manually set one
   // If they don't, all leftover funds will become part of the fee
-  fn new(protocol: Protocol, fee: Fee, change_address: Option<MoneroAddress>) -> Self {
+  fn new(protocol: Protocol, fee: Fee, change_address: Option<Change>) -> Self {
     Self { protocol, fee, inputs: vec![], payments: vec![], change_address, data: vec![] }
   }
 
@@ -77,7 +77,7 @@ impl SignableTransactionBuilder {
     Self(self.0.clone())
   }
 
-  pub fn new(protocol: Protocol, fee: Fee, change_address: Option<MoneroAddress>) -> Self {
+  pub fn new(protocol: Protocol, fee: Fee, change_address: Option<Change>) -> Self {
     Self(Arc::new(RwLock::new(SignableTransactionBuilderInternal::new(
       protocol,
       fee,
@@ -104,7 +104,7 @@ impl SignableTransactionBuilder {
   }
 
   pub fn add_data(&mut self, data: Vec<u8>) -> Result<Self, TransactionError> {
-    if data.len() > MAX_TX_EXTRA_NONCE_SIZE {
+    if data.len() > MAX_ARBITRARY_DATA_SIZE {
       Err(TransactionError::TooMuchData)?;
     }
     self.0.write().unwrap().add_data(data);
@@ -117,7 +117,7 @@ impl SignableTransactionBuilder {
       read.protocol,
       read.inputs.clone(),
       read.payments.clone(),
-      read.change_address,
+      read.change_address.clone(),
       read.data.clone(),
       read.fee,
     )

coins/monero/src/wallet/send/mod.rs

@@ -1,4 +1,4 @@
-use core::ops::Deref;
+use core::{ops::Deref, fmt};
 
 use thiserror::Error;
 
@@ -7,7 +7,13 @@ use rand::seq::SliceRandom;
 
 use zeroize::{Zeroize, ZeroizeOnDrop, Zeroizing};
 
-use curve25519_dalek::{constants::ED25519_BASEPOINT_TABLE, scalar::Scalar, edwards::EdwardsPoint};
+use group::Group;
+use curve25519_dalek::{
+  constants::{ED25519_BASEPOINT_POINT, ED25519_BASEPOINT_TABLE},
+  scalar::Scalar,
+  edwards::EdwardsPoint,
+};
+use dalek_ff_group as dfg;
 
 #[cfg(feature = "multisig")]
 use frost::FrostError;
@@ -23,8 +29,10 @@ use crate::{
   transaction::{Input, Output, Timelock, TransactionPrefix, Transaction},
   rpc::{Rpc, RpcError},
   wallet::{
-    address::MoneroAddress, SpendableOutput, Decoys, PaymentId, ExtraField, Extra, key_image_sort,
-    uniqueness, shared_key, commitment_mask, amount_encryption, extra::MAX_TX_EXTRA_NONCE_SIZE,
+    address::{Network, AddressSpec, MoneroAddress},
+    ViewPair, SpendableOutput, Decoys, PaymentId, ExtraField, Extra, key_image_sort, uniqueness,
+    shared_key, commitment_mask, amount_encryption,
+    extra::{ARBITRARY_DATA_MARKER, MAX_ARBITRARY_DATA_SIZE},
   },
 };
 
@@ -47,25 +55,22 @@ struct SendOutput {
 }
 
 impl SendOutput {
-  fn new<R: RngCore + CryptoRng>(
-    rng: &mut R,
+  #[allow(non_snake_case)]
+  fn internal(
     unique: [u8; 32],
     output: (usize, (MoneroAddress, u64)),
+    ecdh: EdwardsPoint,
+    R: EdwardsPoint,
   ) -> (SendOutput, Option<[u8; 8]>) {
     let o = output.0;
     let output = output.1;
 
-    let r = random_scalar(rng);
     let (view_tag, shared_key, payment_id_xor) =
-      shared_key(Some(unique).filter(|_| output.0.meta.kind.guaranteed()), &r, &output.0.view, o);
+      shared_key(Some(unique).filter(|_| output.0.is_guaranteed()), ecdh, o);
 
     (
       SendOutput {
-        R: if !output.0.meta.kind.subaddress() {
-          &r * &ED25519_BASEPOINT_TABLE
-        } else {
-          r * output.0.spend
-        },
+        R,
         view_tag,
         dest: ((&shared_key * &ED25519_BASEPOINT_TABLE) + output.0.spend),
         commitment: Commitment::new(commitment_mask(shared_key), output.1),
@@ -77,6 +82,32 @@ impl SendOutput {
         .map(|id| (u64::from_le_bytes(id) ^ u64::from_le_bytes(payment_id_xor)).to_le_bytes()),
     )
   }
+
+  fn new(
+    r: &Zeroizing<Scalar>,
+    unique: [u8; 32],
+    output: (usize, (MoneroAddress, u64)),
+  ) -> (SendOutput, Option<[u8; 8]>) {
+    let address = output.1 .0;
+    SendOutput::internal(
+      unique,
+      output,
+      r.deref() * address.view,
+      if !address.is_subaddress() {
+        r.deref() * &ED25519_BASEPOINT_TABLE
+      } else {
+        r.deref() * address.spend
+      },
+    )
+  }
+
+  fn change(
+    ecdh: EdwardsPoint,
+    unique: [u8; 32],
+    output: (usize, (MoneroAddress, u64)),
+  ) -> (SendOutput, Option<[u8; 8]>) {
+    SendOutput::internal(unique, output, ecdh, ED25519_BASEPOINT_POINT)
+  }
 }
 
 #[derive(Clone, PartialEq, Eq, Debug, Error)]
@@ -93,6 +124,8 @@ pub enum TransactionError {
   TooManyOutputs,
   #[error("too much data")]
   TooMuchData,
+  #[error("too many inputs/too much arbitrary data")]
+  TooLargeTransaction,
   #[error("not enough funds (in {0}, out {1})")]
   NotEnoughFunds(u64, u64),
   #[error("wrong spend private key")]
@@ -176,26 +209,71 @@ impl Fee {
 pub struct SignableTransaction {
   protocol: Protocol,
   inputs: Vec<SpendableOutput>,
-  payments: Vec<(MoneroAddress, u64)>,
+  payments: Vec<InternalPayment>,
   data: Vec<Vec<u8>>,
   fee: u64,
 }
 
+/// Specification for a change output.
+#[derive(Clone, PartialEq, Eq, Zeroize)]
+pub struct Change {
+  address: MoneroAddress,
+  view: Option<Zeroizing<Scalar>>,
+}
+
+impl fmt::Debug for Change {
+  fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
+    f.debug_struct("Change").field("address", &self.address).finish_non_exhaustive()
+  }
+}
+
+impl Change {
+  /// Create a change output specification from a ViewPair, as needed to maintain privacy.
+  pub fn new(view: &ViewPair, guaranteed: bool) -> Change {
+    Change {
+      address: view.address(
+        Network::Mainnet,
+        if !guaranteed {
+          AddressSpec::Standard
+        } else {
+          AddressSpec::Featured { subaddress: None, payment_id: None, guaranteed: true }
+        },
+      ),
+      view: Some(view.view.clone()),
+    }
+  }
+
+  /// Create a fingerprintable change output specification which will harm privacy. Only use this
+  /// if you know what you're doing.
+  pub fn fingerprintable(address: MoneroAddress) -> Change {
+    Change { address, view: None }
+  }
+}
+
+#[derive(Clone, PartialEq, Eq, Debug, Zeroize)]
+pub(crate) enum InternalPayment {
+  Payment((MoneroAddress, u64)),
+  Change(Change, u64),
+}
+
 impl SignableTransaction {
-  /// Create a signable transaction. If the change address is specified, leftover funds will be
-  /// sent to it. If the change address isn't specified, up to 16 outputs may be specified, using
-  /// any leftover funds as a bonus to the fee. The optional data field will be embedded in TX
-  /// extra.
+  /// Create a signable transaction.
+  ///
+  /// Up to 16 outputs may be present, including the change output.
+  ///
+  /// If the change address is specified, leftover funds will be sent to it.
+  ///
+  /// Each chunk of data must not exceed MAX_ARBITRARY_DATA_SIZE.
   pub fn new(
     protocol: Protocol,
     inputs: Vec<SpendableOutput>,
     mut payments: Vec<(MoneroAddress, u64)>,
-    change_address: Option<MoneroAddress>,
+    change_address: Option<Change>,
     data: Vec<Vec<u8>>,
     fee_rate: Fee,
   ) -> Result<SignableTransaction, TransactionError> {
     // Make sure there's only one payment ID
-    {
+    let mut has_payment_id = {
       let mut payment_ids = 0;
       let mut count = |addr: MoneroAddress| {
         if addr.payment_id().is_some() {
@@ -205,13 +283,14 @@ impl SignableTransaction {
       for payment in &payments {
         count(payment.0);
       }
-      if let Some(change) = change_address {
-        count(change);
+      if let Some(change) = change_address.as_ref() {
+        count(change.address);
       }
       if payment_ids > 1 {
         Err(TransactionError::MultiplePaymentIds)?;
       }
-    }
+      payment_ids == 1
+    };
 
     if inputs.is_empty() {
       Err(TransactionError::NoInputs)?;
@@ -221,55 +300,57 @@ impl SignableTransaction {
     }
 
     for part in &data {
-      if part.len() > MAX_TX_EXTRA_NONCE_SIZE {
+      if part.len() > MAX_ARBITRARY_DATA_SIZE {
         Err(TransactionError::TooMuchData)?;
       }
     }
 
-    // TODO TX MAX SIZE
-
-    // If we don't have two outputs, as required by Monero, add a second
-    let mut change = payments.len() == 1;
-    if change && change_address.is_none() {
+    // If we don't have two outputs, as required by Monero, error
+    if (payments.len() == 1) && change_address.is_none() {
       Err(TransactionError::NoChange)?;
     }
-    let outputs = payments.len() + usize::from(change);
+    let outputs = payments.len() + usize::from(change_address.is_some());
+    // Add a dummy payment ID if there's only 2 payments
+    has_payment_id |= outputs == 2;
 
     // Calculate the extra length
-    let extra = Extra::fee_weight(outputs, data.as_ref());
+    let extra = Extra::fee_weight(outputs, has_payment_id, data.as_ref());
+
+    // This is a extremely heavy fee weight estimation which can only be trusted for two things
+    // 1) Ensuring we have enough for whatever fee we end up using
+    // 2) Ensuring we aren't over the max size
+    let estimated_tx_size = Transaction::fee_weight(protocol, inputs.len(), outputs, extra);
+
+    // The actual limit is half the block size, and for the minimum block size of 300k, that'd be
+    // 150k
+    // wallet2 will only create transactions up to 100k bytes however
+    const MAX_TX_SIZE: usize = 100_000;
+
+    // This uses the weight (estimated_tx_size) despite the BP clawback
+    // The clawback *increases* the weight, so this will over-estimate, yet it's still safe
+    if estimated_tx_size >= MAX_TX_SIZE {
+      Err(TransactionError::TooLargeTransaction)?;
+    }
 
     // Calculate the fee.
-    let mut fee =
-      fee_rate.calculate(Transaction::fee_weight(protocol, inputs.len(), outputs, extra));
+    let fee = fee_rate.calculate(estimated_tx_size);
 
     // Make sure we have enough funds
     let in_amount = inputs.iter().map(|input| input.commitment().amount).sum::<u64>();
-    let mut out_amount = payments.iter().map(|payment| payment.1).sum::<u64>() + fee;
+    let out_amount = payments.iter().map(|payment| payment.1).sum::<u64>() + fee;
     if in_amount < out_amount {
       Err(TransactionError::NotEnoughFunds(in_amount, out_amount))?;
     }
 
-    // If we have yet to add a change output, do so if it's economically viable
-    if (!change) && change_address.is_some() && (in_amount != out_amount) {
-      // Check even with the new fee, there's remaining funds
-      let change_fee =
-        fee_rate.calculate(Transaction::fee_weight(protocol, inputs.len(), outputs + 1, extra)) -
-          fee;
-      if (out_amount + change_fee) < in_amount {
-        change = true;
-        out_amount += change_fee;
-        fee += change_fee;
-      }
-    }
-
-    if change {
-      payments.push((change_address.unwrap(), in_amount - out_amount));
-    }
-
-    if payments.len() > MAX_OUTPUTS {
+    if outputs > MAX_OUTPUTS {
       Err(TransactionError::TooManyOutputs)?;
     }
 
+    let mut payments = payments.drain(..).map(InternalPayment::Payment).collect::<Vec<_>>();
+    if let Some(change) = change_address {
+      payments.push(InternalPayment::Change(change, in_amount - out_amount));
+    }
+
     Ok(SignableTransaction { protocol, inputs, payments, data, fee })
   }
 
@@ -281,24 +362,109 @@ impl SignableTransaction {
     // Shuffle the payments
     self.payments.shuffle(rng);
 
+    // Used for all non-subaddress outputs, or if there's only one subaddress output and a change
+    let tx_key = Zeroizing::new(random_scalar(rng));
+    let mut tx_public_key = tx_key.deref() * &ED25519_BASEPOINT_TABLE;
+
+    // If any of these outputs are to a subaddress, we need keys distinct to them
+    // The only time this *does not* force having additional keys is when the only other output
+    // is a change output we have the view key for, enabling rewriting rA to aR
+    let mut has_change_view = false;
+    let subaddresses = self
+      .payments
+      .iter()
+      .filter(|payment| match *payment {
+        InternalPayment::Payment(payment) => payment.0.is_subaddress(),
+        InternalPayment::Change(change, _) => {
+          if change.view.is_some() {
+            has_change_view = true;
+            // It should not be possible to construct a change specification to a subaddress with a
+            // view key
+            debug_assert!(!change.address.is_subaddress());
+          }
+          change.address.is_subaddress()
+        }
+      })
+      .count() !=
+      0;
+
+    // We need additional keys if we have any subaddresses
+    let mut additional = subaddresses;
+    // Unless the above change view key path is taken
+    if (self.payments.len() == 2) && has_change_view {
+      additional = false;
+    }
+    let modified_change_ecdh = subaddresses && (!additional);
+
+    // If we're using the aR rewrite, update tx_public_key from rG to rB
+    if modified_change_ecdh {
+      for payment in &self.payments {
+        match payment {
+          InternalPayment::Payment(payment) => {
+            // This should be the only payment and it should be a subaddress
+            debug_assert!(payment.0.is_subaddress());
+            tx_public_key = tx_key.deref() * payment.0.spend;
+          }
+          InternalPayment::Change(_, _) => {}
+        }
+      }
+      debug_assert!(tx_public_key != (tx_key.deref() * &ED25519_BASEPOINT_TABLE));
+    }
+
     // Actually create the outputs
     let mut outputs = Vec::with_capacity(self.payments.len());
     let mut id = None;
-    for payment in self.payments.drain(..).enumerate() {
-      let (output, payment_id) = SendOutput::new(rng, uniqueness, payment);
+    for (o, mut payment) in self.payments.drain(..).enumerate() {
+      // Downcast the change output to a payment output if it doesn't require special handling
+      // regarding it's view key
+      payment = if !modified_change_ecdh {
+        if let InternalPayment::Change(change, amount) = &payment {
+          InternalPayment::Payment((change.address, *amount))
+        } else {
+          payment
+        }
+      } else {
+        payment
+      };
+
+      let (output, payment_id) = match payment {
+        InternalPayment::Payment(payment) => {
+          // If this is a subaddress, generate a dedicated r. Else, reuse the TX key
+          let dedicated = Zeroizing::new(random_scalar(&mut *rng));
+          let use_dedicated = additional && payment.0.is_subaddress();
+          let r = if use_dedicated { &dedicated } else { &tx_key };
+
+          let (mut output, payment_id) = SendOutput::new(r, uniqueness, (o, payment));
+          if modified_change_ecdh {
+            debug_assert_eq!(tx_public_key, output.R);
+          }
+          // If this used tx_key, randomize its R
+          if !use_dedicated {
+            output.R = dfg::EdwardsPoint::random(&mut *rng).0;
+          }
+          (output, payment_id)
+        }
+        InternalPayment::Change(change, amount) => {
+          // Instead of rA, use Ra, where R is r * subaddress_spend_key
+          // change.view must be Some as if it's None, this payment would've been downcast
+          let ecdh = tx_public_key * change.view.unwrap().deref();
+          SendOutput::change(ecdh, uniqueness, (o, (change.address, amount)))
+        }
+      };
+
       outputs.push(output);
       id = id.or(payment_id);
     }
 
     // Include a random payment ID if we don't actually have one
     // It prevents transactions from leaking if they're sending to integrated addresses or not
-    let id = if let Some(id) = id {
-      id
-    } else {
-      let mut id = [0; 8];
-      rng.fill_bytes(&mut id);
-      id
-    };
+    // Only do this if we only have two outputs though, as Monero won't add a dummy if there's
+    // more than two outputs
+    if outputs.len() <= 2 {
+      let mut rand = [0; 8];
+      rng.fill_bytes(&mut rand);
+      id = id.or(Some(rand));
+    }
 
     let commitments = outputs.iter().map(|output| output.commitment.clone()).collect::<Vec<_>>();
     let sum = commitments.iter().map(|commitment| commitment.mask).sum();
@@ -308,19 +474,27 @@ impl SignableTransaction {
 
     // Create the TX extra
     let extra = {
-      let mut extra = Extra::new(outputs.iter().map(|output| output.R).collect());
+      let mut extra = Extra::new(
+        tx_public_key,
+        if additional { outputs.iter().map(|output| output.R).collect() } else { vec![] },
+      );
 
-      let mut id_vec = Vec::with_capacity(1 + 8);
-      PaymentId::Encrypted(id).serialize(&mut id_vec).unwrap();
-      extra.push(ExtraField::Nonce(id_vec));
+      if let Some(id) = id {
+        let mut id_vec = Vec::with_capacity(1 + 8);
+        PaymentId::Encrypted(id).write(&mut id_vec).unwrap();
+        extra.push(ExtraField::Nonce(id_vec));
+      }
 
       // Include data if present
       for part in self.data.drain(..) {
-        extra.push(ExtraField::Nonce(part));
+        let mut arb = vec![ARBITRARY_DATA_MARKER];
+        arb.extend(part);
+        extra.push(ExtraField::Nonce(arb));
       }
 
-      let mut serialized = Vec::with_capacity(Extra::fee_weight(outputs.len(), self.data.as_ref()));
-      extra.serialize(&mut serialized).unwrap();
+      let mut serialized =
+        Vec::with_capacity(Extra::fee_weight(outputs.len(), id.is_some(), self.data.as_ref()));
+      extra.write(&mut serialized).unwrap();
       serialized
     };
 

coins/monero/src/wallet/send/multisig.rs

@@ -4,6 +4,8 @@ use std::{
   collections::HashMap,
 };
 
+use zeroize::Zeroizing;
+
 use rand_core::{RngCore, CryptoRng, SeedableRng};
 use rand_chacha::ChaCha20Rng;
 
@@ -29,7 +31,9 @@ use crate::{
   },
   transaction::{Input, Transaction},
   rpc::Rpc,
-  wallet::{TransactionError, SignableTransaction, Decoys, key_image_sort, uniqueness},
+  wallet::{
+    TransactionError, InternalPayment, SignableTransaction, Decoys, key_image_sort, uniqueness,
+  },
 };
 
 /// FROST signing machine to produce a signed transaction.
@@ -108,8 +112,19 @@ impl SignableTransaction {
       transcript.append_message(b"input_shared_key", input.key_offset().to_bytes());
     }
     for payment in &self.payments {
-      transcript.append_message(b"payment_address", payment.0.to_string().as_bytes());
-      transcript.append_message(b"payment_amount", payment.1.to_le_bytes());
+      match payment {
+        InternalPayment::Payment(payment) => {
+          transcript.append_message(b"payment_address", payment.0.to_string().as_bytes());
+          transcript.append_message(b"payment_amount", payment.1.to_le_bytes());
+        }
+        InternalPayment::Change(change, amount) => {
+          transcript.append_message(b"change_address", change.address.to_string().as_bytes());
+          if let Some(view) = change.view.as_ref() {
+            transcript.append_message(b"change_view_key", Zeroizing::new(view.to_bytes()));
+          }
+          transcript.append_message(b"change_amount", amount.to_le_bytes());
+        }
+      }
     }
 
     let mut key_images = vec![];
@@ -123,7 +138,7 @@ impl SignableTransaction {
       let clsag = ClsagMultisig::new(transcript.clone(), input.key(), inputs[i].clone());
       key_images.push((
         clsag.H,
-        keys.current_offset().unwrap_or(dfg::Scalar::zero()).0 + self.inputs[i].key_offset(),
+        keys.current_offset().unwrap_or_else(dfg::Scalar::zero).0 + self.inputs[i].key_offset(),
       ));
       clsags.push(AlgorithmMachine::new(clsag, offset).map_err(TransactionError::FrostError)?);
     }
@@ -248,7 +263,7 @@ impl SignMachine<Transaction> for TransactionSignMachine {
     // Find out who's included
     // This may not be a valid set of signers yet the algorithm machine will error if it's not
     commitments.remove(&self.i); // Remove, if it was included for some reason
-    let mut included = commitments.keys().into_iter().cloned().collect::<Vec<_>>();
+    let mut included = commitments.keys().cloned().collect::<Vec<_>>();
     included.push(self.i);
     included.sort_unstable();