Remove sp-crypto-ec-utils patch reintroduced in latest rebase

b892b0122e for reasoning.

.github/actions/bitcoin/action.yml

@@ -5,14 +5,14 @@ inputs:
   version:
     description: "Version to download and run"
     required: false
-    default: "27.0"
+    default: 24.0.1
 
 runs:
   using: "composite"
   steps:
     - name: Bitcoin Daemon Cache
       id: cache-bitcoind
-      uses: actions/cache@13aacd865c20de90d75de3b17ebe84f7a17d57d2
+      uses: actions/cache@704facf57e6136b1bc63b828d79edcd491f0ee84
       with:
         path: bitcoin.tar.gz
         key: bitcoind-${{ runner.os }}-${{ runner.arch }}-${{ inputs.version }}
@@ -37,4 +37,11 @@ runs:
 
     - name: Bitcoin Regtest Daemon
       shell: bash
-      run: PATH=$PATH:/usr/bin ./orchestration/dev/networks/bitcoin/run.sh -txindex -daemon
+      run: |
+        RPC_USER=serai
+        RPC_PASS=seraidex
+
+        bitcoind -txindex -regtest \
+          -rpcuser=$RPC_USER -rpcpassword=$RPC_PASS \
+          -rpcbind=127.0.0.1 -rpcbind=$(hostname) -rpcallowip=0.0.0.0/0 \
+          -daemon

.github/actions/build-dependencies/action.yml

@@ -1,6 +1,12 @@
 name: build-dependencies
 description: Installs build dependencies for Serai
 
+inputs:
+  github-token:
+    description: "GitHub token to install Protobuf with"
+    require: true
+    default:
+
 runs:
   using: "composite"
   steps:
@@ -14,36 +20,22 @@ runs:
         sudo apt autoremove -y
         sudo apt clean
         docker system prune -a --volumes
-      if: runner.os == 'Linux'
 
-    - name: Remove unused packages
+    - name: Install apt dependencies
       shell: bash
-      run: |
-        (gem uninstall -aIx) || (exit 0)
-        brew uninstall --force "*msbuild*" "*powershell*" "*nuget*" "*bazel*" "*ansible*" "*terraform*" "*heroku*" "*aws*" azure-cli
-        brew uninstall --force "*nodejs*" "*npm*" "*yarn*" "*java*" "*kotlin*" "*golang*" "*swift*" "*julia*" "*fortran*" "*android*"
-        brew uninstall --force "*apache2*" "*nginx*" "*firefox*" "*chromium*" "*chrome*" "*edge*"
-        brew uninstall --force "*qemu*" "*sql*" "*texinfo*" "*imagemagick*"
-        brew cleanup
-      if: runner.os == 'macOS'
+      run: sudo apt install -y ca-certificates
 
-    - name: Install dependencies
-      shell: bash
-      run: |
-        if [ "$RUNNER_OS" == "Linux" ]; then
-          sudo apt install -y ca-certificates protobuf-compiler
-        elif [ "$RUNNER_OS" == "Windows" ]; then
-          choco install protoc
-        elif [ "$RUNNER_OS" == "macOS" ]; then
-          brew install protobuf
-        fi
+    - name: Install Protobuf
+      uses: arduino/setup-protoc@a8b67ba40b37d35169e222f3bb352603327985b6
+      with:
+        repo-token: ${{ inputs.github-token }}
 
     - name: Install solc
       shell: bash
       run: |
         cargo install svm-rs
-        svm install 0.8.26
-        svm use 0.8.26
+        svm install 0.8.16
+        svm use 0.8.16
 
     # - name: Cache Rust
     #   uses: Swatinem/rust-cache@a95ba195448af2da9b00fb742d14ffaaf3c21f43

.github/actions/monero-wallet-rpc/action.yml

@@ -5,14 +5,14 @@ inputs:
   version:
     description: "Version to download and run"
     required: false
-    default: v0.18.3.4
+    default: v0.18.2.0
 
 runs:
   using: "composite"
   steps:
     - name: Monero Wallet RPC Cache
       id: cache-monero-wallet-rpc
-      uses: actions/cache@13aacd865c20de90d75de3b17ebe84f7a17d57d2
+      uses: actions/cache@704facf57e6136b1bc63b828d79edcd491f0ee84
       with:
         path: monero-wallet-rpc
         key: monero-wallet-rpc-${{ runner.os }}-${{ runner.arch }}-${{ inputs.version }}
@@ -41,9 +41,4 @@ runs:
 
     - name: Monero Wallet RPC
       shell: bash
-      run: |
-        ./monero-wallet-rpc --allow-mismatched-daemon-version \
-          --daemon-address 0.0.0.0:18081 --daemon-login serai:seraidex \
-          --disable-rpc-login --rpc-bind-port 18082 \
-          --wallet-dir ./ \
-          --detach
+      run: ./monero-wallet-rpc --disable-rpc-login --rpc-bind-port 6061 --allow-mismatched-daemon-version --wallet-dir ./ --detach

.github/actions/monero/action.yml

@@ -5,16 +5,16 @@ inputs:
   version:
     description: "Version to download and run"
     required: false
-    default: v0.18.3.4
+    default: v0.18.2.0
 
 runs:
   using: "composite"
   steps:
     - name: Monero Daemon Cache
       id: cache-monerod
-      uses: actions/cache@13aacd865c20de90d75de3b17ebe84f7a17d57d2
+      uses: actions/cache@704facf57e6136b1bc63b828d79edcd491f0ee84
       with:
-        path: /usr/bin/monerod
+        path: monerod
         key: monerod-${{ runner.os }}-${{ runner.arch }}-${{ inputs.version }}
 
     - name: Download the Monero Daemon
@@ -37,10 +37,8 @@ runs:
         wget https://downloads.getmonero.org/cli/$FILE
         tar -xvf $FILE
 
-        sudo mv monero-x86_64-linux-gnu-${{ inputs.version }}/monerod /usr/bin/monerod
-        sudo chmod 777 /usr/bin/monerod
-        sudo chmod +x /usr/bin/monerod
+        mv monero-x86_64-linux-gnu-${{ inputs.version }}/monerod monerod
 
     - name: Monero Regtest Daemon
       shell: bash
-      run: PATH=$PATH:/usr/bin ./orchestration/dev/networks/monero/run.sh --detach
+      run: ./monerod --regtest --offline --fixed-difficulty=1 --detach

.github/actions/test-dependencies/action.yml

@@ -2,26 +2,33 @@ name: test-dependencies
 description: Installs test dependencies for Serai
 
 inputs:
+  github-token:
+    description: "GitHub token to install Protobuf with"
+    require: true
+    default:
+
   monero-version:
     description: "Monero version to download and run as a regtest node"
     required: false
-    default: v0.18.3.4
+    default: v0.18.2.0
 
   bitcoin-version:
     description: "Bitcoin version to download and run as a regtest node"
     required: false
-    default: "27.1"
+    default: 24.0.1
 
 runs:
   using: "composite"
   steps:
     - name: Install Build Dependencies
       uses: ./.github/actions/build-dependencies
+      with:
+        github-token: ${{ inputs.github-token }}
 
     - name: Install Foundry
-      uses: foundry-rs/foundry-toolchain@8f1998e9878d786675189ef566a2e4bf24869773
+      uses: foundry-rs/foundry-toolchain@cb603ca0abb544f301eaed59ac0baf579aa6aecf
       with:
-        version: nightly-f625d0fa7c51e65b4bf1e8f7931cd1c6e2e285e9
+        version: nightly-09fe3e041369a816365a020f715ad6f94dbce9f2
         cache: false
 
     - name: Run a Monero Regtest Node

.github/nightly-version

@@ -1 +1 @@
-nightly-2024-07-01
+nightly-2023-12-04

.github/workflows/coins-tests.yml

@@ -0,0 +1,37 @@
+name: coins/ Tests
+
+on:
+  push:
+    branches:
+      - develop
+    paths:
+      - "common/**"
+      - "crypto/**"
+      - "coins/**"
+
+  pull_request:
+    paths:
+      - "common/**"
+      - "crypto/**"
+      - "coins/**"
+
+  workflow_dispatch:
+
+jobs:
+  test-coins:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac
+
+      - name: Test Dependencies
+        uses: ./.github/actions/test-dependencies
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Run Tests
+        run: |
+          GITHUB_CI=true RUST_BACKTRACE=1 cargo test --all-features \
+            -p bitcoin-serai \
+            -p ethereum-serai \
+            -p monero-generators \
+            -p monero-serai

.github/workflows/common-tests.yml

@@ -21,14 +21,13 @@ jobs:
 
       - name: Build Dependencies
         uses: ./.github/actions/build-dependencies
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Run Tests
         run: |
           GITHUB_CI=true RUST_BACKTRACE=1 cargo test --all-features \
             -p std-shims \
             -p zalloc \
-            -p patchable-async-sleep \
             -p serai-db \
-            -p serai-env \
-            -p serai-task \
-            -p simple-request
+            -p serai-env

.github/workflows/coordinator-tests.yml

@@ -7,10 +7,11 @@ on:
     paths:
       - "common/**"
       - "crypto/**"
-      - "networks/**"
+      - "coins/**"
       - "message-queue/**"
+      - "orchestration/message-queue/**"
       - "coordinator/**"
-      - "orchestration/**"
+      - "orchestration/coordinator/**"
       - "tests/docker/**"
       - "tests/coordinator/**"
 
@@ -18,10 +19,11 @@ on:
     paths:
       - "common/**"
       - "crypto/**"
-      - "networks/**"
+      - "coins/**"
       - "message-queue/**"
+      - "orchestration/message-queue/**"
       - "coordinator/**"
-      - "orchestration/**"
+      - "orchestration/coordinator/**"
       - "tests/docker/**"
       - "tests/coordinator/**"
 
@@ -35,6 +37,8 @@ jobs:
 
       - name: Install Build Dependencies
         uses: ./.github/actions/build-dependencies
+        with:
+          github-token: ${{ inputs.github-token }}
 
       - name: Run coordinator Docker tests
-        run: GITHUB_CI=true RUST_BACKTRACE=1 cargo test --all-features -p serai-coordinator-tests
+        run: cd tests/coordinator && GITHUB_CI=true RUST_BACKTRACE=1 cargo test

.github/workflows/crypto-tests.yml

@@ -23,6 +23,8 @@ jobs:
 
       - name: Build Dependencies
         uses: ./.github/actions/build-dependencies
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Run Tests
         run: |
@@ -35,10 +37,6 @@ jobs:
             -p multiexp \
             -p schnorr-signatures \
             -p dleq \
-            -p generalized-bulletproofs \
-            -p generalized-bulletproofs-circuit-abstraction \
-            -p ec-divisors \
-            -p generalized-bulletproofs-ec-gadgets \
             -p dkg \
             -p modular-frost \
             -p frost-schnorrkel

.github/workflows/daily-deny.yml

@@ -12,7 +12,7 @@ jobs:
       - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac
 
       - name: Advisory Cache
-        uses: actions/cache@13aacd865c20de90d75de3b17ebe84f7a17d57d2
+        uses: actions/cache@704facf57e6136b1bc63b828d79edcd491f0ee84
         with:
           path: ~/.cargo/advisory-db
           key: rust-advisory-db

.github/workflows/full-stack-tests.yml

@@ -17,6 +17,8 @@ jobs:
 
       - name: Install Build Dependencies
         uses: ./.github/actions/build-dependencies
+        with:
+          github-token: ${{ inputs.github-token }}
 
       - name: Run Full Stack Docker tests
-        run: GITHUB_CI=true RUST_BACKTRACE=1 cargo test --all-features -p serai-full-stack-tests
+        run: cd tests/full-stack && GITHUB_CI=true RUST_BACKTRACE=1 cargo test

.github/workflows/lint.yml

@@ -9,24 +9,21 @@ on:
 
 jobs:
   clippy:
-    strategy:
-      matrix:
-        os: [ubuntu-latest, macos-13, macos-14, windows-latest]
-    runs-on: ${{ matrix.os }}
-
+    runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac
 
       - name: Get nightly version to use
         id: nightly
-        shell: bash
         run: echo "version=$(cat .github/nightly-version)" >> $GITHUB_OUTPUT
 
       - name: Build Dependencies
         uses: ./.github/actions/build-dependencies
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Install nightly rust
-        run: rustup toolchain install ${{ steps.nightly.outputs.version }} --profile minimal -t wasm32-unknown-unknown -c clippy
+        run: rustup toolchain install ${{ steps.nightly.outputs.version }} --profile minimal -t wasm32-unknown-unknown -c rust-src -c clippy
 
       - name: Run Clippy
         run: cargo +${{ steps.nightly.outputs.version }} clippy --all-features --all-targets -- -D warnings -A clippy::items_after_test_module
@@ -37,8 +34,7 @@ jobs:
       # The above clippy run will cause it to be updated, so checking there's
       # no differences present now performs the desired check
       - name: Verify lockfile
-        shell: bash
-        run: git diff | wc -l | LC_ALL="en_US.utf8" grep -x -e "^[ ]*0"
+        run: git diff | wc -l | grep -x "0"
 
   deny:
     runs-on: ubuntu-latest
@@ -46,7 +42,7 @@ jobs:
       - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac
 
       - name: Advisory Cache
-        uses: actions/cache@13aacd865c20de90d75de3b17ebe84f7a17d57d2
+        uses: actions/cache@704facf57e6136b1bc63b828d79edcd491f0ee84
         with:
           path: ~/.cargo/advisory-db
           key: rust-advisory-db
@@ -64,7 +60,6 @@ jobs:
 
       - name: Get nightly version to use
         id: nightly
-        shell: bash
         run: echo "version=$(cat .github/nightly-version)" >> $GITHUB_OUTPUT
 
       - name: Install nightly rust
@@ -73,14 +68,13 @@ jobs:
       - name: Run rustfmt
         run: cargo +${{ steps.nightly.outputs.version }} fmt -- --check
 
-      - name: Install foundry
-        uses: foundry-rs/foundry-toolchain@8f1998e9878d786675189ef566a2e4bf24869773
-        with:
-          version: nightly-41d4e5437107f6f42c7711123890147bc736a609
-          cache: false
-
-      - name: Run forge fmt
-        run: FOUNDRY_FMT_SORT_INPUTS=false FOUNDRY_FMT_LINE_LENGTH=100 FOUNDRY_FMT_TAB_WIDTH=2 FOUNDRY_FMT_BRACKET_SPACING=true FOUNDRY_FMT_INT_TYPES=preserve forge fmt --check $(find . -iname "*.sol")
+  dockerfiles:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac
+      - name: Verify Dockerfiles are up to date
+        # Runs the file which generates them and checks the diff has no lines
+        run: cd orchestration && ./dockerfiles.sh && git diff | wc -l | grep -x "0"
 
   machete:
     runs-on: ubuntu-latest
@@ -90,25 +84,3 @@ jobs:
         run: |
           cargo install cargo-machete
           cargo machete
-
-  slither:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac
-      - name: Slither
-        run: |
-          python3 -m pip install solc-select
-          solc-select install 0.8.26
-          solc-select use 0.8.26
-
-          python3 -m pip install slither-analyzer
-
-          slither --include-paths ./networks/ethereum/schnorr/contracts/Schnorr.sol
-          slither --include-paths ./networks/ethereum/schnorr/contracts ./networks/ethereum/schnorr/contracts/tests/Schnorr.sol
-          slither processor/ethereum/deployer/contracts/Deployer.sol
-          slither processor/ethereum/erc20/contracts/IERC20.sol
-
-          cp networks/ethereum/schnorr/contracts/Schnorr.sol processor/ethereum/router/contracts/
-          cp processor/ethereum/erc20/contracts/IERC20.sol processor/ethereum/router/contracts/
-          cd processor/ethereum/router/contracts
-          slither Router.sol

.github/workflows/message-queue-tests.yml

@@ -8,7 +8,7 @@ on:
       - "common/**"
       - "crypto/**"
       - "message-queue/**"
-      - "orchestration/**"
+      - "orchestration/message-queue/**"
       - "tests/docker/**"
       - "tests/message-queue/**"
 
@@ -17,7 +17,7 @@ on:
       - "common/**"
       - "crypto/**"
       - "message-queue/**"
-      - "orchestration/**"
+      - "orchestration/message-queue/**"
       - "tests/docker/**"
       - "tests/message-queue/**"
 
@@ -31,6 +31,8 @@ jobs:
 
       - name: Install Build Dependencies
         uses: ./.github/actions/build-dependencies
+        with:
+          github-token: ${{ inputs.github-token }}
 
       - name: Run message-queue Docker tests
-        run: GITHUB_CI=true RUST_BACKTRACE=1 cargo test --all-features -p serai-message-queue-tests
+        run: cd tests/message-queue && GITHUB_CI=true RUST_BACKTRACE=1 cargo test

.github/workflows/mini-tests.yml

@@ -21,6 +21,8 @@ jobs:
 
       - name: Build Dependencies
         uses: ./.github/actions/build-dependencies
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Run Tests
         run: GITHUB_CI=true RUST_BACKTRACE=1 cargo test --all-features -p mini-serai

.github/workflows/monero-tests.yaml

@@ -5,12 +5,12 @@ on:
     branches:
       - develop
     paths:
-      - "networks/monero/**"
+      - "coins/monero/**"
       - "processor/**"
 
   pull_request:
     paths:
-      - "networks/monero/**"
+      - "coins/monero/**"
       - "processor/**"
 
   workflow_dispatch:
@@ -24,24 +24,11 @@ jobs:
 
       - name: Test Dependencies
         uses: ./.github/actions/test-dependencies
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Run Unit Tests Without Features
-        run: |
-          GITHUB_CI=true RUST_BACKTRACE=1 cargo test --package monero-io --lib
-          GITHUB_CI=true RUST_BACKTRACE=1 cargo test --package monero-generators --lib
-          GITHUB_CI=true RUST_BACKTRACE=1 cargo test --package monero-primitives --lib
-          GITHUB_CI=true RUST_BACKTRACE=1 cargo test --package monero-mlsag --lib
-          GITHUB_CI=true RUST_BACKTRACE=1 cargo test --package monero-clsag --lib
-          GITHUB_CI=true RUST_BACKTRACE=1 cargo test --package monero-borromean --lib
-          GITHUB_CI=true RUST_BACKTRACE=1 cargo test --package monero-bulletproofs --lib
-          GITHUB_CI=true RUST_BACKTRACE=1 cargo test --package monero-serai --lib
-          GITHUB_CI=true RUST_BACKTRACE=1 cargo test --package monero-rpc --lib
-          GITHUB_CI=true RUST_BACKTRACE=1 cargo test --package monero-simple-request-rpc --lib
-          GITHUB_CI=true RUST_BACKTRACE=1 cargo test --package monero-address --lib
-          GITHUB_CI=true RUST_BACKTRACE=1 cargo test --package monero-wallet --lib
-          GITHUB_CI=true RUST_BACKTRACE=1 cargo test --package monero-seed --lib
-          GITHUB_CI=true RUST_BACKTRACE=1 cargo test --package polyseed --lib
-          GITHUB_CI=true RUST_BACKTRACE=1 cargo test --package monero-wallet-util --lib
+        run: GITHUB_CI=true RUST_BACKTRACE=1 cargo test --package monero-serai --lib
 
       # Doesn't run unit tests with features as the tests workflow will
 
@@ -50,7 +37,7 @@ jobs:
     # Test against all supported protocol versions
     strategy:
       matrix:
-        version: [v0.17.3.2, v0.18.3.4]
+        version: [v0.17.3.2, v0.18.2.0]
 
     steps:
       - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac
@@ -58,20 +45,15 @@ jobs:
       - name: Test Dependencies
         uses: ./.github/actions/test-dependencies
         with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
           monero-version: ${{ matrix.version }}
 
       - name: Run Integration Tests Without Features
-        run: |
-          GITHUB_CI=true RUST_BACKTRACE=1 cargo test --package monero-serai --test '*'
-          GITHUB_CI=true RUST_BACKTRACE=1 cargo test --package monero-simple-request-rpc --test '*'
-          GITHUB_CI=true RUST_BACKTRACE=1 cargo test --package monero-wallet --test '*'
-          GITHUB_CI=true RUST_BACKTRACE=1 cargo test --package monero-wallet-util --test '*'
+        # Runs with the binaries feature so the binaries build
+        # https://github.com/rust-lang/cargo/issues/8396
+        run: GITHUB_CI=true RUST_BACKTRACE=1 cargo test --package monero-serai --features binaries --test '*'
 
       - name: Run Integration Tests
         # Don't run if the the tests workflow also will
-        if: ${{ matrix.version != 'v0.18.3.4' }}
-        run: |
-          GITHUB_CI=true RUST_BACKTRACE=1 cargo test --package monero-serai --all-features --test '*'
-          GITHUB_CI=true RUST_BACKTRACE=1 cargo test --package monero-simple-request-rpc --test '*'
-          GITHUB_CI=true RUST_BACKTRACE=1 cargo test --package monero-wallet --all-features --test '*'
-          GITHUB_CI=true RUST_BACKTRACE=1 cargo test --package monero-wallet-util --all-features --test '*'
+        if: ${{ matrix.version != 'v0.18.2.0' }}
+        run: GITHUB_CI=true RUST_BACKTRACE=1 cargo test --package monero-serai --all-features --test '*'

.github/workflows/msrv.yml

@@ -1,259 +0,0 @@
-name: Weekly MSRV Check
-
-on:
-  schedule:
-    - cron: "0 0 * * 0"
-  workflow_dispatch:
-
-jobs:
-  msrv-common:
-    name: Run cargo msrv on common
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac
-
-      - name: Install Build Dependencies
-        uses: ./.github/actions/build-dependencies
-
-      - name: Install cargo msrv
-        run: cargo install --locked cargo-msrv
-
-      - name: Run cargo msrv on common
-        run: |
-          cargo msrv verify --manifest-path common/zalloc/Cargo.toml
-          cargo msrv verify --manifest-path common/std-shims/Cargo.toml
-          cargo msrv verify --manifest-path common/env/Cargo.toml
-          cargo msrv verify --manifest-path common/db/Cargo.toml
-          cargo msrv verify --manifest-path common/task/Cargo.toml
-          cargo msrv verify --manifest-path common/request/Cargo.toml
-          cargo msrv verify --manifest-path common/patchable-async-sleep/Cargo.toml
-
-  msrv-crypto:
-    name: Run cargo msrv on crypto
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac
-
-      - name: Install Build Dependencies
-        uses: ./.github/actions/build-dependencies
-
-      - name: Install cargo msrv
-        run: cargo install --locked cargo-msrv
-
-      - name: Run cargo msrv on crypto
-        run: |
-          cargo msrv verify --manifest-path crypto/transcript/Cargo.toml
-
-          cargo msrv verify --manifest-path crypto/ff-group-tests/Cargo.toml
-          cargo msrv verify --manifest-path crypto/dalek-ff-group/Cargo.toml
-          cargo msrv verify --manifest-path crypto/ed448/Cargo.toml
-
-          cargo msrv verify --manifest-path crypto/multiexp/Cargo.toml
-
-          cargo msrv verify --manifest-path crypto/dleq/Cargo.toml
-          cargo msrv verify --manifest-path crypto/ciphersuite/Cargo.toml
-          cargo msrv verify --manifest-path crypto/schnorr/Cargo.toml
-
-          cargo msrv verify --manifest-path crypto/evrf/generalized-bulletproofs/Cargo.toml
-          cargo msrv verify --manifest-path crypto/evrf/circuit-abstraction/Cargo.toml
-          cargo msrv verify --manifest-path crypto/evrf/divisors/Cargo.toml
-          cargo msrv verify --manifest-path crypto/evrf/ec-gadgets/Cargo.toml
-          cargo msrv verify --manifest-path crypto/evrf/embedwards25519/Cargo.toml
-          cargo msrv verify --manifest-path crypto/evrf/secq256k1/Cargo.toml
-
-          cargo msrv verify --manifest-path crypto/dkg/Cargo.toml
-          cargo msrv verify --manifest-path crypto/frost/Cargo.toml
-          cargo msrv verify --manifest-path crypto/schnorrkel/Cargo.toml
-
-  msrv-networks:
-    name: Run cargo msrv on networks
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac
-
-      - name: Install Build Dependencies
-        uses: ./.github/actions/build-dependencies
-
-      - name: Install cargo msrv
-        run: cargo install --locked cargo-msrv
-
-      - name: Run cargo msrv on networks
-        run: |
-          cargo msrv verify --manifest-path networks/bitcoin/Cargo.toml
-
-          cargo msrv verify --manifest-path networks/ethereum/build-contracts/Cargo.toml
-          cargo msrv verify --manifest-path networks/ethereum/schnorr/Cargo.toml
-          cargo msrv verify --manifest-path networks/ethereum/alloy-simple-request-transport/Cargo.toml
-          cargo msrv verify --manifest-path networks/ethereum/relayer/Cargo.toml --features parity-db
-
-          cargo msrv verify --manifest-path networks/monero/io/Cargo.toml
-          cargo msrv verify --manifest-path networks/monero/generators/Cargo.toml
-          cargo msrv verify --manifest-path networks/monero/primitives/Cargo.toml
-          cargo msrv verify --manifest-path networks/monero/ringct/mlsag/Cargo.toml
-          cargo msrv verify --manifest-path networks/monero/ringct/clsag/Cargo.toml
-          cargo msrv verify --manifest-path networks/monero/ringct/borromean/Cargo.toml
-          cargo msrv verify --manifest-path networks/monero/ringct/bulletproofs/Cargo.toml
-          cargo msrv verify --manifest-path networks/monero/Cargo.toml
-          cargo msrv verify --manifest-path networks/monero/rpc/Cargo.toml
-          cargo msrv verify --manifest-path networks/monero/rpc/simple-request/Cargo.toml
-          cargo msrv verify --manifest-path networks/monero/wallet/address/Cargo.toml
-          cargo msrv verify --manifest-path networks/monero/wallet/Cargo.toml
-          cargo msrv verify --manifest-path networks/monero/verify-chain/Cargo.toml
-
-  msrv-message-queue:
-    name: Run cargo msrv on message-queue
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac
-
-      - name: Install Build Dependencies
-        uses: ./.github/actions/build-dependencies
-
-      - name: Install cargo msrv
-        run: cargo install --locked cargo-msrv
-
-      - name: Run cargo msrv on message-queue
-        run: |
-          cargo msrv verify --manifest-path message-queue/Cargo.toml --features parity-db
-
-  msrv-processor:
-    name: Run cargo msrv on processor
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac
-
-      - name: Install Build Dependencies
-        uses: ./.github/actions/build-dependencies
-
-      - name: Install cargo msrv
-        run: cargo install --locked cargo-msrv
-
-      - name: Run cargo msrv on processor
-        run: |
-          cargo msrv verify --manifest-path processor/view-keys/Cargo.toml
-
-          cargo msrv verify --manifest-path processor/primitives/Cargo.toml
-          cargo msrv verify --manifest-path processor/messages/Cargo.toml
-
-          cargo msrv verify --manifest-path processor/scanner/Cargo.toml
-
-          cargo msrv verify --manifest-path processor/scheduler/primitives/Cargo.toml
-          cargo msrv verify --manifest-path processor/scheduler/smart-contract/Cargo.toml
-          cargo msrv verify --manifest-path processor/scheduler/utxo/primitives/Cargo.toml
-          cargo msrv verify --manifest-path processor/scheduler/utxo/standard/Cargo.toml
-          cargo msrv verify --manifest-path processor/scheduler/utxo/transaction-chaining/Cargo.toml
-
-          cargo msrv verify --manifest-path processor/key-gen/Cargo.toml
-          cargo msrv verify --manifest-path processor/frost-attempt-manager/Cargo.toml
-          cargo msrv verify --manifest-path processor/signers/Cargo.toml
-          cargo msrv verify --manifest-path processor/bin/Cargo.toml --features parity-db
-
-          cargo msrv verify --manifest-path processor/bitcoin/Cargo.toml
-
-          cargo msrv verify --manifest-path processor/ethereum/primitives/Cargo.toml
-          cargo msrv verify --manifest-path processor/ethereum/test-primitives/Cargo.toml
-          cargo msrv verify --manifest-path processor/ethereum/erc20/Cargo.toml
-          cargo msrv verify --manifest-path processor/ethereum/deployer/Cargo.toml
-          cargo msrv verify --manifest-path processor/ethereum/router/Cargo.toml
-          cargo msrv verify --manifest-path processor/ethereum/Cargo.toml
-
-          cargo msrv verify --manifest-path processor/monero/Cargo.toml
-
-  msrv-coordinator:
-    name: Run cargo msrv on coordinator
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac
-
-      - name: Install Build Dependencies
-        uses: ./.github/actions/build-dependencies
-
-      - name: Install cargo msrv
-        run: cargo install --locked cargo-msrv
-
-      - name: Run cargo msrv on coordinator
-        run: |
-          cargo msrv verify --manifest-path coordinator/tributary-sdk/tendermint/Cargo.toml
-          cargo msrv verify --manifest-path coordinator/tributary-sdk/Cargo.toml
-          cargo msrv verify --manifest-path coordinator/cosign/Cargo.toml
-          cargo msrv verify --manifest-path coordinator/substrate/Cargo.toml
-          cargo msrv verify --manifest-path coordinator/tributary/Cargo.toml
-          cargo msrv verify --manifest-path coordinator/p2p/Cargo.toml
-          cargo msrv verify --manifest-path coordinator/p2p/libp2p/Cargo.toml
-          cargo msrv verify --manifest-path coordinator/Cargo.toml
-
-  msrv-substrate:
-    name: Run cargo msrv on substrate
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac
-
-      - name: Install Build Dependencies
-        uses: ./.github/actions/build-dependencies
-
-      - name: Install cargo msrv
-        run: cargo install --locked cargo-msrv
-
-      - name: Run cargo msrv on substrate
-        run: |
-          cargo msrv verify --manifest-path substrate/primitives/Cargo.toml
-
-          cargo msrv verify --manifest-path substrate/coins/primitives/Cargo.toml
-          cargo msrv verify --manifest-path substrate/coins/pallet/Cargo.toml
-
-          cargo msrv verify --manifest-path substrate/dex/pallet/Cargo.toml
-
-          cargo msrv verify --manifest-path substrate/economic-security/pallet/Cargo.toml
-
-          cargo msrv verify --manifest-path substrate/genesis-liquidity/primitives/Cargo.toml
-          cargo msrv verify --manifest-path substrate/genesis-liquidity/pallet/Cargo.toml
-
-          cargo msrv verify --manifest-path substrate/in-instructions/primitives/Cargo.toml
-          cargo msrv verify --manifest-path substrate/in-instructions/pallet/Cargo.toml
-
-          cargo msrv verify --manifest-path substrate/validator-sets/pallet/Cargo.toml
-          cargo msrv verify --manifest-path substrate/validator-sets/primitives/Cargo.toml
-
-          cargo msrv verify --manifest-path substrate/emissions/primitives/Cargo.toml
-          cargo msrv verify --manifest-path substrate/emissions/pallet/Cargo.toml
-
-          cargo msrv verify --manifest-path substrate/signals/primitives/Cargo.toml
-          cargo msrv verify --manifest-path substrate/signals/pallet/Cargo.toml
-
-          cargo msrv verify --manifest-path substrate/abi/Cargo.toml
-          cargo msrv verify --manifest-path substrate/client/Cargo.toml
-
-          cargo msrv verify --manifest-path substrate/runtime/Cargo.toml
-          cargo msrv verify --manifest-path substrate/node/Cargo.toml
-
-  msrv-orchestration:
-    name: Run cargo msrv on orchestration
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac
-
-      - name: Install Build Dependencies
-        uses: ./.github/actions/build-dependencies
-
-      - name: Install cargo msrv
-        run: cargo install --locked cargo-msrv
-
-      - name: Run cargo msrv on message-queue
-        run: |
-          cargo msrv verify --manifest-path orchestration/Cargo.toml
-
-  msrv-mini:
-    name: Run cargo msrv on mini
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac
-
-      - name: Install Build Dependencies
-        uses: ./.github/actions/build-dependencies
-
-      - name: Install cargo msrv
-        run: cargo install --locked cargo-msrv
-
-      - name: Run cargo msrv on mini
-        run: |
-          cargo msrv verify --manifest-path mini/Cargo.toml

.github/workflows/networks-tests.yml

@@ -1,52 +0,0 @@
-name: networks/ Tests
-
-on:
-  push:
-    branches:
-      - develop
-    paths:
-      - "common/**"
-      - "crypto/**"
-      - "networks/**"
-
-  pull_request:
-    paths:
-      - "common/**"
-      - "crypto/**"
-      - "networks/**"
-
-  workflow_dispatch:
-
-jobs:
-  test-networks:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac
-
-      - name: Test Dependencies
-        uses: ./.github/actions/test-dependencies
-
-      - name: Run Tests
-        run: |
-          GITHUB_CI=true RUST_BACKTRACE=1 cargo test --all-features \
-            -p bitcoin-serai \
-            -p build-solidity-contracts \
-            -p ethereum-schnorr-contract \
-            -p alloy-simple-request-transport \
-            -p serai-ethereum-relayer \
-            -p monero-io \
-            -p monero-generators \
-            -p monero-primitives \
-            -p monero-mlsag \
-            -p monero-clsag \
-            -p monero-borromean \
-            -p monero-bulletproofs \
-            -p monero-serai \
-            -p monero-rpc \
-            -p monero-simple-request-rpc \
-            -p monero-address \
-            -p monero-wallet \
-            -p monero-seed \
-            -p polyseed \
-            -p monero-wallet-util \
-            -p monero-serai-verify-chain

.github/workflows/no-std.yml

@@ -7,14 +7,14 @@ on:
     paths:
       - "common/**"
       - "crypto/**"
-      - "networks/**"
+      - "coins/**"
       - "tests/no-std/**"
 
   pull_request:
     paths:
       - "common/**"
       - "crypto/**"
-      - "networks/**"
+      - "coins/**"
       - "tests/no-std/**"
 
   workflow_dispatch:
@@ -27,9 +27,11 @@ jobs:
 
       - name: Install Build Dependencies
         uses: ./.github/actions/build-dependencies
+        with:
+          github-token: ${{ inputs.github-token }}
 
       - name: Install RISC-V Toolchain
         run: sudo apt update && sudo apt install -y gcc-riscv64-unknown-elf gcc-multilib && rustup target add riscv32imac-unknown-none-elf
 
       - name: Verify no-std builds
-        run: CFLAGS=-I/usr/include cargo build --target riscv32imac-unknown-none-elf -p serai-no-std-tests
+        run: cd tests/no-std && CFLAGS=-I/usr/include cargo build --target riscv32imac-unknown-none-elf

.github/workflows/pages.yml

@@ -1,90 +0,0 @@
-# MIT License
-#
-# Copyright (c) 2022 just-the-docs
-#
-# Permission is hereby granted, free of charge, to any person obtaining a copy
-# of this software and associated documentation files (the "Software"), to deal
-# in the Software without restriction, including without limitation the rights
-# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-# copies of the Software, and to permit persons to whom the Software is
-# furnished to do so, subject to the following conditions:
-#
-# The above copyright notice and this permission notice shall be included in all
-# copies or substantial portions of the Software.
-#
-# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-# SOFTWARE.
-
-# This workflow uses actions that are not certified by GitHub.
-# They are provided by a third-party and are governed by
-# separate terms of service, privacy policy, and support
-# documentation.
-
-# Sample workflow for building and deploying a Jekyll site to GitHub Pages
-name: Deploy Jekyll site to Pages
-
-on:
-  push:
-    branches:
-      - "develop"
-    paths:
-      - "docs/**"
-
-  # Allows you to run this workflow manually from the Actions tab
-  workflow_dispatch:
-
-# Sets permissions of the GITHUB_TOKEN to allow deployment to GitHub Pages
-permissions:
-  contents: read
-  pages: write
-  id-token: write
-
-# Allow one concurrent deployment
-concurrency:
-  group: "pages"
-  cancel-in-progress: true
-
-jobs:
-  # Build job
-  build:
-    runs-on: ubuntu-latest
-    defaults:
-      run:
-        working-directory: docs
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v3
-      - name: Setup Ruby
-        uses: ruby/setup-ruby@v1
-        with:
-          bundler-cache: true
-          cache-version: 0
-          working-directory: "${{ github.workspace }}/docs"
-      - name: Setup Pages
-        id: pages
-        uses: actions/configure-pages@v3
-      - name: Build with Jekyll
-        run: bundle exec jekyll build --baseurl "${{ steps.pages.outputs.base_path }}"
-        env:
-          JEKYLL_ENV: production
-      - name: Upload artifact
-        uses: actions/upload-pages-artifact@v1
-        with:
-          path: "docs/_site/"
-
-  # Deployment job
-  deploy:
-    environment:
-      name: github-pages
-      url: ${{ steps.deployment.outputs.page_url }}
-    runs-on: ubuntu-latest
-    needs: build
-    steps:
-      - name: Deploy to GitHub Pages
-        id: deployment
-        uses: actions/deploy-pages@v2

.github/workflows/processor-tests.yml

@@ -7,10 +7,11 @@ on:
     paths:
       - "common/**"
       - "crypto/**"
-      - "networks/**"
+      - "coins/**"
       - "message-queue/**"
+      - "orchestration/message-queue/**"
       - "processor/**"
-      - "orchestration/**"
+      - "orchestration/processor/**"
       - "tests/docker/**"
       - "tests/processor/**"
 
@@ -18,10 +19,11 @@ on:
     paths:
       - "common/**"
       - "crypto/**"
-      - "networks/**"
+      - "coins/**"
       - "message-queue/**"
+      - "orchestration/message-queue/**"
       - "processor/**"
-      - "orchestration/**"
+      - "orchestration/processor/**"
       - "tests/docker/**"
       - "tests/processor/**"
 
@@ -35,6 +37,8 @@ jobs:
 
       - name: Install Build Dependencies
         uses: ./.github/actions/build-dependencies
+        with:
+          github-token: ${{ inputs.github-token }}
 
       - name: Run processor Docker tests
-        run: GITHUB_CI=true RUST_BACKTRACE=1 cargo test --all-features -p serai-processor-tests
+        run: cd tests/processor && GITHUB_CI=true RUST_BACKTRACE=1 cargo test

.github/workflows/reproducible-runtime.yml

@@ -31,6 +31,8 @@ jobs:
 
       - name: Install Build Dependencies
         uses: ./.github/actions/build-dependencies
+        with:
+          github-token: ${{ inputs.github-token }}
 
       - name: Run Reproducible Runtime tests
-        run: GITHUB_CI=true RUST_BACKTRACE=1 cargo test --all-features -p serai-reproducible-runtime-tests
+        run: cd tests/reproducible-runtime && GITHUB_CI=true RUST_BACKTRACE=1 cargo test

.github/workflows/tests.yml

@@ -7,7 +7,7 @@ on:
     paths:
       - "common/**"
       - "crypto/**"
-      - "networks/**"
+      - "coins/**"
       - "message-queue/**"
       - "processor/**"
       - "coordinator/**"
@@ -17,7 +17,7 @@ on:
     paths:
       - "common/**"
       - "crypto/**"
-      - "networks/**"
+      - "coins/**"
       - "message-queue/**"
       - "processor/**"
       - "coordinator/**"
@@ -33,41 +33,18 @@ jobs:
 
       - name: Build Dependencies
         uses: ./.github/actions/build-dependencies
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Run Tests
         run: |
           GITHUB_CI=true RUST_BACKTRACE=1 cargo test --all-features \
             -p serai-message-queue \
             -p serai-processor-messages \
-            -p serai-processor-key-gen \
-            -p serai-processor-view-keys \
-            -p serai-processor-frost-attempt-manager \
-            -p serai-processor-primitives \
-            -p serai-processor-scanner \
-            -p serai-processor-scheduler-primitives \
-            -p serai-processor-utxo-scheduler-primitives \
-            -p serai-processor-utxo-scheduler \
-            -p serai-processor-transaction-chaining-scheduler \
-            -p serai-processor-smart-contract-scheduler \
-            -p serai-processor-signers \
-            -p serai-processor-bin \
-            -p serai-bitcoin-processor \
-            -p serai-processor-ethereum-primitives \
-            -p serai-processor-ethereum-test-primitives \
-            -p serai-processor-ethereum-deployer \
-            -p serai-processor-ethereum-router \
-            -p serai-processor-ethereum-erc20 \
-            -p serai-ethereum-processor \
-            -p serai-monero-processor \
+            -p serai-processor \
             -p tendermint-machine \
-            -p tributary-sdk \
-            -p serai-cosign \
-            -p serai-coordinator-substrate \
-            -p serai-coordinator-tributary \
-            -p serai-coordinator-p2p \
-            -p serai-coordinator-libp2p-p2p \
+            -p tributary-chain \
             -p serai-coordinator \
-            -p serai-orchestrator \
             -p serai-docker-tests
 
   test-substrate:
@@ -77,6 +54,8 @@ jobs:
 
       - name: Build Dependencies
         uses: ./.github/actions/build-dependencies
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Run Tests
         run: |
@@ -87,16 +66,9 @@ jobs:
             -p serai-dex-pallet \
             -p serai-validator-sets-primitives \
             -p serai-validator-sets-pallet \
-            -p serai-genesis-liquidity-primitives \
-            -p serai-genesis-liquidity-pallet \
-            -p serai-emissions-primitives \
-            -p serai-emissions-pallet \
-            -p serai-economic-security-pallet \
             -p serai-in-instructions-primitives \
             -p serai-in-instructions-pallet \
-            -p serai-signals-primitives \
             -p serai-signals-pallet \
-            -p serai-abi \
             -p serai-runtime \
             -p serai-node
 
@@ -107,6 +79,8 @@ jobs:
 
       - name: Build Dependencies
         uses: ./.github/actions/build-dependencies
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Run Tests
         run: GITHUB_CI=true RUST_BACKTRACE=1 cargo test --all-features -p serai-client

.gitignore

@@ -1,7 +1,3 @@
 target
-Dockerfile
-Dockerfile.fast-epoch
-!orchestration/runtime/Dockerfile
-.test-logs
-
 .vscode
+.test-logs

Cargo.toml

@@ -1,26 +1,10 @@
 [workspace]
 resolver = "2"
 members = [
-  # Version patches
-  "patches/parking_lot_core",
-  "patches/parking_lot",
-  "patches/zstd",
-  "patches/rocksdb",
-
-  # std patches
-  "patches/matches",
-  "patches/is-terminal",
-
-  # Rewrites/redirects
-  "patches/option-ext",
-  "patches/directories-next",
-
   "common/std-shims",
   "common/zalloc",
-  "common/patchable-async-sleep",
   "common/db",
   "common/env",
-  "common/task",
   "common/request",
 
   "crypto/transcript",
@@ -31,101 +15,44 @@ members = [
   "crypto/ciphersuite",
 
   "crypto/multiexp",
+
   "crypto/schnorr",
   "crypto/dleq",
-
-  "crypto/evrf/secq256k1",
-  "crypto/evrf/embedwards25519",
-  "crypto/evrf/generalized-bulletproofs",
-  "crypto/evrf/circuit-abstraction",
-  "crypto/evrf/divisors",
-  "crypto/evrf/ec-gadgets",
-
   "crypto/dkg",
   "crypto/frost",
   "crypto/schnorrkel",
 
-  "networks/bitcoin",
-
-  "networks/ethereum/build-contracts",
-  "networks/ethereum/schnorr",
-  "networks/ethereum/alloy-simple-request-transport",
-  "networks/ethereum/relayer",
-
-  "networks/monero/io",
-  "networks/monero/generators",
-  "networks/monero/primitives",
-  "networks/monero/ringct/mlsag",
-  "networks/monero/ringct/clsag",
-  "networks/monero/ringct/borromean",
-  "networks/monero/ringct/bulletproofs",
-  "networks/monero",
-  "networks/monero/rpc",
-  "networks/monero/rpc/simple-request",
-  "networks/monero/wallet/address",
-  "networks/monero/wallet",
-  "networks/monero/wallet/seed",
-  "networks/monero/wallet/polyseed",
-  "networks/monero/wallet/util",
-  "networks/monero/verify-chain",
+  "coins/bitcoin",
+  "coins/ethereum",
+  "coins/monero/generators",
+  "coins/monero",
 
   "message-queue",
 
   "processor/messages",
+  "processor",
 
-  "processor/key-gen",
-  "processor/view-keys",
-  "processor/frost-attempt-manager",
-
-  "processor/primitives",
-  "processor/scanner",
-  "processor/scheduler/primitives",
-  "processor/scheduler/utxo/primitives",
-  "processor/scheduler/utxo/standard",
-  "processor/scheduler/utxo/transaction-chaining",
-  "processor/scheduler/smart-contract",
-  "processor/signers",
-
-  "processor/bin",
-  "processor/bitcoin",
-  "processor/ethereum/primitives",
-  "processor/ethereum/test-primitives",
-  "processor/ethereum/deployer",
-  "processor/ethereum/router",
-  "processor/ethereum/erc20",
-  "processor/ethereum",
-  "processor/monero",
-
-  "coordinator/tributary-sdk/tendermint",
-  "coordinator/tributary-sdk",
-  "coordinator/cosign",
-  "coordinator/substrate",
+  "coordinator/tributary/tendermint",
   "coordinator/tributary",
-  "coordinator/p2p",
-  "coordinator/p2p/libp2p",
   "coordinator",
 
+  "substrate/tree-cleanup/is-terminal",
+  "substrate/tree-cleanup/option-ext",
+  "substrate/tree-cleanup/directories-next",
+  "substrate/tree-cleanup/bandersnatch_vrfs",
+  "substrate/tree-cleanup/w3f-bls",
+
   "substrate/primitives",
 
   "substrate/coins/primitives",
   "substrate/coins/pallet",
 
-  "substrate/dex/pallet",
+  "substrate/in-instructions/primitives",
+  "substrate/in-instructions/pallet",
 
   "substrate/validator-sets/primitives",
   "substrate/validator-sets/pallet",
 
-  "substrate/genesis-liquidity/primitives",
-  "substrate/genesis-liquidity/pallet",
-
-  "substrate/emissions/primitives",
-  "substrate/emissions/pallet",
-
-  "substrate/economic-security/pallet",
-
-  "substrate/in-instructions/primitives",
-  "substrate/in-instructions/pallet",
-
   "substrate/signals/primitives",
   "substrate/signals/pallet",
 
@@ -136,8 +63,6 @@ members = [
 
   "substrate/client",
 
-  "orchestration",
-
   "mini",
 
   "tests/no-std",
@@ -154,32 +79,18 @@ members = [
 # to the extensive operations required for Bulletproofs
 [profile.dev.package]
 subtle = { opt-level = 3 }
+curve25519-dalek = { opt-level = 3 }
 
 ff = { opt-level = 3 }
 group = { opt-level = 3 }
 
 crypto-bigint = { opt-level = 3 }
-secp256k1 = { opt-level = 3 }
-curve25519-dalek = { opt-level = 3 }
 dalek-ff-group = { opt-level = 3 }
 minimal-ed448 = { opt-level = 3 }
 
 multiexp = { opt-level = 3 }
 
-secq256k1 = { opt-level = 3 }
-embedwards25519 = { opt-level = 3 }
-generalized-bulletproofs = { opt-level = 3 }
-generalized-bulletproofs-circuit-abstraction = { opt-level = 3 }
-ec-divisors = { opt-level = 3 }
-generalized-bulletproofs-ec-gadgets = { opt-level = 3 }
-
-dkg = { opt-level = 3 }
-
-monero-generators = { opt-level = 3 }
-monero-borromean = { opt-level = 3 }
-monero-bulletproofs = { opt-level = 3 }
-monero-mlsag = { opt-level = 3 }
-monero-clsag = { opt-level = 3 }
+monero-serai = { opt-level = 3 }
 
 [profile.release]
 panic = "unwind"
@@ -188,32 +99,38 @@ panic = "unwind"
 # https://github.com/rust-lang-nursery/lazy-static.rs/issues/201
 lazy_static = { git = "https://github.com/rust-lang-nursery/lazy-static.rs", rev = "5735630d46572f1e5377c8f2ba0f79d18f53b10c" }
 
-parking_lot_core = { path = "patches/parking_lot_core" }
-parking_lot = { path = "patches/parking_lot" }
-# wasmtime pulls in an old version for this
-zstd = { path = "patches/zstd" }
-# Needed for WAL compression
-rocksdb = { path = "patches/rocksdb" }
+# subxt *can* pull these off crates.io yet there's no benefit to this
+sp-core-hashing = { git = "https://github.com/serai-dex/polkadot-sdk", branch = "experimental" }
+sp-std = { git = "https://github.com/serai-dex/polkadot-sdk", branch = "experimental" }
 
 # is-terminal now has an std-based solution with an equivalent API
-is-terminal = { path = "patches/is-terminal" }
+is-terminal = { path = "substrate/tree-cleanup/is-terminal" }
 # So does matches
-matches = { path = "patches/matches" }
+matches = { path = "substrate/tree-cleanup/matches" }
 
 # directories-next was created because directories was unmaintained
 # directories-next is now unmaintained while directories is maintained
 # The directories author pulls in ridiculously pointless crates and prefers
 # copyleft licenses
+# Serai's polkadot-sdk consolidated to directories-next, as directories-next is
+# acceptable and because we couldn't consolidate to directories without forking
+# wasmtime
 # The following two patches resolve everything
-option-ext = { path = "patches/option-ext" }
-directories-next = { path = "patches/directories-next" }
+option-ext = { path = "substrate/tree-cleanup/option-ext" }
+directories-next = { path = "substrate/tree-cleanup/directories-next" }
 
-# The official pasta_curves repo doesn't support Zeroize
-pasta_curves = { git = "https://github.com/kayabaNerve/pasta_curves", rev = "a46b5be95cacbff54d06aad8d3bbcba42e05d616" }
+# mach is unmaintained, so this wraps mach2 as mach
+mach = { path = "substrate/tree-cleanup/mach" }
+
+# cargo believes the following are in-tree despite no features activating them
+# We provide empty crates to not only prove they're unused, yet also clean up
+# our Cargo.lock
+w3f-bls = { path = "substrate/tree-cleanup/w3f-bls" }
+[patch."https://github.com/w3f/ring-vrf"]
+bandersnatch_vrfs = { path = "substrate/tree-cleanup/bandersnatch_vrfs" }
 
 [workspace.lints.clippy]
 unwrap_or_default = "allow"
-map_unwrap_or = "allow"
 borrow_as_ptr = "deny"
 cast_lossless = "deny"
 cast_possible_truncation = "deny"
@@ -241,6 +158,7 @@ manual_instant_elapsed = "deny"
 manual_let_else = "deny"
 manual_ok_or = "deny"
 manual_string_new = "deny"
+map_unwrap_or = "deny"
 match_bool = "deny"
 match_same_arms = "deny"
 missing_fields_in_debug = "deny"
@@ -252,7 +170,6 @@ range_plus_one = "deny"
 redundant_closure_for_method_calls = "deny"
 redundant_else = "deny"
 string_add_assign = "deny"
-string_slice = "deny"
 unchecked_duration_subtraction = "deny"
 uninlined_format_args = "deny"
 unnecessary_box_returns = "deny"

README.md

@@ -5,16 +5,13 @@ Bitcoin, Ethereum, DAI, and Monero, offering a liquidity-pool-based trading
 experience. Funds are stored in an economically secured threshold-multisig
 wallet.
 
-[Getting Started](spec/Getting%20Started.md)
+[Getting Started](docs/Getting%20Started.md)
 
 ### Layout
 
 - `audits`: Audits for various parts of Serai.
 
-- `spec`: The specification of the Serai protocol, both internally and as
-  networked.
-
-- `docs`: User-facing documentation on the Serai protocol.
+- `docs`: Documentation on the Serai protocol.
 
 - `common`: Crates containing utilities common to a variety of areas under
   Serai, none neatly fitting under another category.
@@ -24,7 +21,7 @@ wallet.
   infrastructure, to our IETF-compliant FROST implementation, to a DLEq proof as
   needed for Bitcoin-Monero atomic swaps.
 
-- `networks`: Various libraries intended for usage in Serai yet also by the
+- `coins`: Various coin libraries intended for usage in Serai yet also by the
   wider community. This means they will always support the functionality Serai
   needs, yet won't disadvantage other use cases when possible.
 

audits/Cypher Stack coins bitcoin August 2023/README.md

@@ -0,0 +1,6 @@
+# Cypher Stack /coins/bitcoin Audit, August 2023
+
+This audit was over the /coins/bitcoin folder. It is encompassing up to commit
+5121ca75199dff7bd34230880a1fdd793012068c.
+
+Please see https://github.com/cypherstack/serai-btc-audit for provenance.

audits/Cypher Stack networks bitcoin August 2023/README.md

@@ -1,7 +0,0 @@
-# Cypher Stack /networks/bitcoin Audit, August 2023
-
-This audit was over the `/networks/bitcoin` folder (at the time located at
-`/coins/bitcoin`). It is encompassing up to commit
-5121ca75199dff7bd34230880a1fdd793012068c.
-
-Please see https://github.com/cypherstack/serai-btc-audit for provenance.

coins/bitcoin/Cargo.toml

@@ -3,10 +3,10 @@ name = "bitcoin-serai"
 version = "0.3.0"
 description = "A Bitcoin library for FROST-signing transactions"
 license = "MIT"
-repository = "https://github.com/serai-dex/serai/tree/develop/networks/bitcoin"
+repository = "https://github.com/serai-dex/serai/tree/develop/coins/bitcoin"
 authors = ["Luke Parker <lukeparker5132@gmail.com>", "Vrx <vrx00@proton.me>"]
 edition = "2021"
-rust-version = "1.80"
+rust-version = "1.74"
 
 [package.metadata.docs.rs]
 all-features = true
@@ -18,14 +18,16 @@ workspace = true
 [dependencies]
 std-shims = { version = "0.1.1", path = "../../common/std-shims", default-features = false }
 
-thiserror = { version = "2", default-features = false }
+thiserror = { version = "1", default-features = false, optional = true }
 
 zeroize = { version = "^1.5", default-features = false }
 rand_core = { version = "0.6", default-features = false }
 
-bitcoin = { version = "0.32", default-features = false }
+bitcoin = { version = "0.31", default-features = false, features = ["no-std"] }
 
 k256 = { version = "^0.13.1", default-features = false, features = ["arithmetic", "bits"] }
+
+transcript = { package = "flexible-transcript", path = "../../crypto/transcript", version = "0.3", default-features = false, features = ["recommended"], optional = true }
 frost = { package = "modular-frost", path = "../../crypto/frost", version = "0.8", default-features = false, features = ["secp256k1"], optional = true }
 
 hex = { version = "0.4", default-features = false, optional = true }
@@ -34,7 +36,7 @@ serde_json = { version = "1", default-features = false, optional = true }
 simple-request = { path = "../../common/request", version = "0.1", default-features = false, features = ["tls", "basic-auth"], optional = true }
 
 [dev-dependencies]
-secp256k1 = { version = "0.29", default-features = false, features = ["std"] }
+secp256k1 = { version = "0.28", default-features = false, features = ["std"] }
 
 frost = { package = "modular-frost", path = "../../crypto/frost", features = ["tests"] }
 
@@ -44,7 +46,7 @@ tokio = { version = "1", features = ["macros"] }
 std = [
   "std-shims/std",
 
-  "thiserror/std",
+  "thiserror",
 
   "zeroize/std",
   "rand_core/std",
@@ -53,6 +55,8 @@ std = [
   "bitcoin/serde",
 
   "k256/std",
+
+  "transcript/std",
   "frost",
 
   "hex/std",

coins/bitcoin/src/crypto.rs

@@ -40,12 +40,14 @@ mod frost_crypto {
 
   use bitcoin::hashes::{HashEngine, Hash, sha256::Hash as Sha256};
 
+  use transcript::Transcript;
+
   use k256::{elliptic_curve::ops::Reduce, U256, Scalar};
 
   use frost::{
     curve::{Ciphersuite, Secp256k1},
     Participant, ThresholdKeys, ThresholdView, FrostError,
-    algorithm::{Hram as HramTrait, Algorithm, IetfSchnorr as FrostSchnorr},
+    algorithm::{Hram as HramTrait, Algorithm, Schnorr as FrostSchnorr},
   };
 
   use super::*;
@@ -80,17 +82,16 @@ mod frost_crypto {
   ///
   /// This must be used with a ThresholdKeys whose group key is even. If it is odd, this will panic.
   #[derive(Clone)]
-  pub struct Schnorr(FrostSchnorr<Secp256k1, Hram>);
-  impl Schnorr {
+  pub struct Schnorr<T: Sync + Clone + Debug + Transcript>(FrostSchnorr<Secp256k1, T, Hram>);
+  impl<T: Sync + Clone + Debug + Transcript> Schnorr<T> {
     /// Construct a Schnorr algorithm continuing the specified transcript.
-    #[allow(clippy::new_without_default)]
-    pub fn new() -> Schnorr {
-      Schnorr(FrostSchnorr::ietf())
+    pub fn new(transcript: T) -> Schnorr<T> {
+      Schnorr(FrostSchnorr::new(transcript))
     }
   }
 
-  impl Algorithm<Secp256k1> for Schnorr {
-    type Transcript = <FrostSchnorr<Secp256k1, Hram> as Algorithm<Secp256k1>>::Transcript;
+  impl<T: Sync + Clone + Debug + Transcript> Algorithm<Secp256k1> for Schnorr<T> {
+    type Transcript = T;
     type Addendum = ();
     type Signature = [u8; 64];
 

coins/bitcoin/src/rpc.rs

@@ -195,13 +195,13 @@ impl Rpc {
         // If this was already successfully published, consider this having succeeded
         if let RpcError::RequestError(Error { code, .. }) = e {
           if code == RPC_VERIFY_ALREADY_IN_CHAIN {
-            return Ok(tx.compute_txid());
+            return Ok(tx.txid());
           }
         }
         Err(e)?
       }
     };
-    if txid != tx.compute_txid() {
+    if txid != tx.txid() {
       Err(RpcError::InvalidResponse("returned TX ID inequals calculated TX ID"))?;
     }
     Ok(txid)
@@ -215,7 +215,7 @@ impl Rpc {
     let tx: Transaction = encode::deserialize(&bytes)
       .map_err(|_| RpcError::InvalidResponse("node sent an improperly serialized transaction"))?;
 
-    let mut tx_hash = *tx.compute_txid().as_raw_hash().as_byte_array();
+    let mut tx_hash = *tx.txid().as_raw_hash().as_byte_array();
     tx_hash.reverse();
     if hash != &tx_hash {
       Err(RpcError::InvalidResponse("node replied with a different transaction"))?;

coins/bitcoin/src/tests/crypto.rs

@@ -3,6 +3,7 @@ use rand_core::OsRng;
 use secp256k1::{Secp256k1 as BContext, Message, schnorr::Signature};
 
 use k256::Scalar;
+use transcript::{Transcript, RecommendedTranscript};
 use frost::{
   curve::Secp256k1,
   Participant,
@@ -24,7 +25,8 @@ fn test_algorithm() {
     *keys = keys.offset(Scalar::from(offset));
   }
 
-  let algo = Schnorr::new();
+  let algo =
+    Schnorr::<RecommendedTranscript>::new(RecommendedTranscript::new(b"bitcoin-serai sign test"));
   let sig = sign(
     &mut OsRng,
     &algo,
@@ -37,7 +39,7 @@ fn test_algorithm() {
     .verify_schnorr(
       &Signature::from_slice(&sig)
         .expect("couldn't convert produced signature to secp256k1::Signature"),
-      &Message::from_digest_slice(Hash::hash(MESSAGE).as_ref()).unwrap(),
+      &Message::from(Hash::hash(MESSAGE)),
       &x_only(&keys[&Participant::new(1).unwrap()].group_key()),
     )
     .unwrap()

coins/bitcoin/src/wallet/mod.rs

@@ -4,7 +4,7 @@ use std_shims::{
   io::{self, Write},
 };
 #[cfg(feature = "std")]
-use std::io::{Read, BufReader};
+use std_shims::io::Read;
 
 use k256::{
   elliptic_curve::sec1::{Tag, ToEncodedPoint},
@@ -18,11 +18,11 @@ use frost::{
 };
 
 use bitcoin::{
-  consensus::encode::serialize, key::TweakedPublicKey, OutPoint, ScriptBuf, TxOut, Transaction,
-  Block,
+  consensus::encode::serialize, key::TweakedPublicKey, address::Payload, OutPoint, ScriptBuf,
+  TxOut, Transaction, Block,
 };
 #[cfg(feature = "std")]
-use bitcoin::{hashes::Hash, consensus::encode::Decodable, TapTweakHash};
+use bitcoin::consensus::encode::Decodable;
 
 use crate::crypto::x_only;
 #[cfg(feature = "std")]
@@ -33,40 +33,12 @@ mod send;
 #[cfg(feature = "std")]
 pub use send::*;
 
-/// Tweak keys to ensure they're usable with Bitcoin's Taproot upgrade.
+/// Tweak keys to ensure they're usable with Bitcoin.
 ///
-/// This adds an unspendable script path to the key, preventing any outputs received to this key
-/// from being spent via a script. To have keys which have spendable script paths, further offsets
-/// from this position must be used.
-///
-/// After adding an unspendable script path, the key is incremented until its even. This means the
-/// existence of the unspendable script path may not provable, without an understanding of the
-/// algorithm used here.
+/// Taproot keys, which these keys are used as, must be even. This offsets the keys until they're
+/// even.
 #[cfg(feature = "std")]
 pub fn tweak_keys(keys: &ThresholdKeys<Secp256k1>) -> ThresholdKeys<Secp256k1> {
-  // Adds the unspendable script path per
-  // https://github.com/bitcoin/bips/blob/master/bip-0341.mediawiki#cite_note-23
-  let keys = {
-    use k256::elliptic_curve::{
-      bigint::{Encoding, U256},
-      ops::Reduce,
-      group::GroupEncoding,
-    };
-    let tweak_hash = TapTweakHash::hash(&keys.group_key().to_bytes().as_slice()[1 ..]);
-    /*
-      https://github.com/bitcoin/bips/blob/master/bip-0340.mediawiki#cite_ref-13-0 states how the
-      bias is negligible. This reduction shouldn't ever occur, yet if it did, the script path
-      would be unusable due to a check the script path hash is less than the order. That doesn't
-      impact us as we don't want the script path to be usable.
-    */
-    keys.offset(<Secp256k1 as Ciphersuite>::F::reduce(U256::from_be_bytes(
-      *tweak_hash.to_raw_hash().as_ref(),
-    )))
-  };
-
-  // This doesn't risk re-introducing a script path as you'd have to find a preimage for the tweak
-  // hash with whatever increment, or manipulate the key so that the tweak hash and increment
-  // equals the desired offset, yet manipulating the key would change the tweak hash
   let (_, offset) = make_even(keys.group_key());
   keys.offset(Scalar::from(offset))
 }
@@ -74,12 +46,12 @@ pub fn tweak_keys(keys: &ThresholdKeys<Secp256k1>) -> ThresholdKeys<Secp256k1> {
 /// Return the Taproot address payload for a public key.
 ///
 /// If the key is odd, this will return None.
-pub fn p2tr_script_buf(key: ProjectivePoint) -> Option<ScriptBuf> {
+pub fn address_payload(key: ProjectivePoint) -> Option<Payload> {
   if key.to_encoded_point(true).tag() != Tag::CompressedEvenY {
     return None;
   }
 
-  Some(ScriptBuf::new_p2tr_tweaked(TweakedPublicKey::dangerous_assume_tweaked(x_only(&key))))
+  Some(Payload::p2tr_tweaked(TweakedPublicKey::dangerous_assume_tweaked(x_only(&key))))
 }
 
 /// A spendable output.
@@ -117,17 +89,11 @@ impl ReceivedOutput {
   /// Read a ReceivedOutput from a generic satisfying Read.
   #[cfg(feature = "std")]
   pub fn read<R: Read>(r: &mut R) -> io::Result<ReceivedOutput> {
-    let offset = Secp256k1::read_F(r)?;
-    let output;
-    let outpoint;
-    {
-      let mut buf_r = BufReader::with_capacity(0, r);
-      output =
-        TxOut::consensus_decode(&mut buf_r).map_err(|_| io::Error::other("invalid TxOut"))?;
-      outpoint =
-        OutPoint::consensus_decode(&mut buf_r).map_err(|_| io::Error::other("invalid OutPoint"))?;
-    }
-    Ok(ReceivedOutput { offset, output, outpoint })
+    Ok(ReceivedOutput {
+      offset: Secp256k1::read_F(r)?,
+      output: TxOut::consensus_decode(r).map_err(|_| io::Error::other("invalid TxOut"))?,
+      outpoint: OutPoint::consensus_decode(r).map_err(|_| io::Error::other("invalid OutPoint"))?,
+    })
   }
 
   /// Write a ReceivedOutput to a generic satisfying Write.
@@ -158,7 +124,7 @@ impl Scanner {
   /// Returns None if this key can't be scanned for.
   pub fn new(key: ProjectivePoint) -> Option<Scanner> {
     let mut scripts = HashMap::new();
-    scripts.insert(p2tr_script_buf(key)?, Scalar::ZERO);
+    scripts.insert(address_payload(key)?.script_pubkey(), Scalar::ZERO);
     Some(Scanner { key, scripts })
   }
 
@@ -170,17 +136,14 @@ impl Scanner {
   ///
   /// This means offsets are surjective, not bijective, and the order offsets are registered in
   /// may determine the validity of future offsets.
-  ///
-  /// The offsets registered must be securely generated. Arbitrary offsets may introduce a script
-  /// path into the output, allowing the output to be spent by satisfaction of an arbitrary script
-  /// (not by the signature of the key).
   pub fn register_offset(&mut self, mut offset: Scalar) -> Option<Scalar> {
     // This loop will terminate as soon as an even point is found, with any point having a ~50%
     // chance of being even
     // That means this should terminate within a very small amount of iterations
     loop {
-      match p2tr_script_buf(self.key + (ProjectivePoint::GENERATOR * offset)) {
-        Some(script) => {
+      match address_payload(self.key + (ProjectivePoint::GENERATOR * offset)) {
+        Some(address) => {
+          let script = address.script_pubkey();
           if self.scripts.contains_key(&script) {
             None?;
           }
@@ -203,7 +166,7 @@ impl Scanner {
         res.push(ReceivedOutput {
           offset: *offset,
           output: output.clone(),
-          outpoint: OutPoint::new(tx.compute_txid(), vout),
+          outpoint: OutPoint::new(tx.txid(), vout),
         });
       }
     }

coins/bitcoin/src/wallet/send.rs

@@ -7,7 +7,9 @@ use thiserror::Error;
 
 use rand_core::{RngCore, CryptoRng};
 
-use k256::Scalar;
+use transcript::{Transcript, RecommendedTranscript};
+
+use k256::{elliptic_curve::sec1::ToEncodedPoint, Scalar};
 use frost::{curve::Secp256k1, Participant, ThresholdKeys, FrostError, sign::*};
 
 use bitcoin::{
@@ -16,12 +18,12 @@ use bitcoin::{
   absolute::LockTime,
   script::{PushBytesBuf, ScriptBuf},
   transaction::{Version, Transaction},
-  OutPoint, Sequence, Witness, TxIn, Amount, TxOut,
+  OutPoint, Sequence, Witness, TxIn, Amount, TxOut, Address,
 };
 
 use crate::{
   crypto::Schnorr,
-  wallet::{ReceivedOutput, p2tr_script_buf},
+  wallet::{ReceivedOutput, address_payload},
 };
 
 #[rustfmt::skip]
@@ -44,7 +46,7 @@ pub enum TransactionError {
   #[error("fee was too low to pass the default minimum fee rate")]
   TooLowFee,
   #[error("not enough funds for these payments")]
-  NotEnoughFunds { inputs: u64, payments: u64, fee: u64 },
+  NotEnoughFunds,
   #[error("transaction was too large")]
   TooLargeTransaction,
 }
@@ -59,11 +61,7 @@ pub struct SignableTransaction {
 }
 
 impl SignableTransaction {
-  fn calculate_weight_vbytes(
-    inputs: usize,
-    payments: &[(ScriptBuf, u64)],
-    change: Option<&ScriptBuf>,
-  ) -> (u64, u64) {
+  fn calculate_weight(inputs: usize, payments: &[(Address, u64)], change: Option<&Address>) -> u64 {
     // Expand this a full transaction in order to use the bitcoin library's weight function
     let mut tx = Transaction {
       version: Version(2),
@@ -88,42 +86,16 @@ impl SignableTransaction {
         // The script pub key is not of a fixed size and does have to be used here
         .map(|payment| TxOut {
           value: Amount::from_sat(payment.1),
-          script_pubkey: payment.0.clone(),
+          script_pubkey: payment.0.script_pubkey(),
         })
         .collect(),
     };
     if let Some(change) = change {
       // Use a 0 value since we're currently unsure what the change amount will be, and since
       // the value is fixed size (so any value could be used here)
-      tx.output.push(TxOut { value: Amount::ZERO, script_pubkey: change.clone() });
+      tx.output.push(TxOut { value: Amount::ZERO, script_pubkey: change.script_pubkey() });
     }
-
-    let weight = tx.weight();
-
-    // Now calculate the size in vbytes
-
-    /*
-      "Virtual transaction size" is weight ceildiv 4 per
-      https://github.com/bitcoin/bips/blob/master/bip-0141.mediawiki
-
-      https://github.com/bitcoin/bitcoin/blob/306ccd4927a2efe325c8d84be1bdb79edeb29b04
-        /src/policy/policy.cpp#L295-L298
-      implements this almost as expected, with an additional consideration to signature operations
-
-      Signature operations (the second argument of the following call) do not count Taproot
-      signatures per https://github.com/bitcoin/bips/blob/master/bip-0342.mediawiki#cite_ref-11-0
-
-      We don't risk running afoul of the Taproot signature limit as it allows at least one per
-      input, which is all we use
-    */
-    (
-      weight.to_wu(),
-      u64::try_from(bitcoin::policy::get_virtual_tx_size(
-        i64::try_from(weight.to_wu()).unwrap(),
-        0i64,
-      ))
-      .unwrap(),
-    )
+    u64::from(tx.weight())
   }
 
   /// Returns the fee necessary for this transaction to achieve the fee rate specified at
@@ -149,10 +121,10 @@ impl SignableTransaction {
   /// If data is specified, an OP_RETURN output will be added with it.
   pub fn new(
     mut inputs: Vec<ReceivedOutput>,
-    payments: &[(ScriptBuf, u64)],
-    change: Option<ScriptBuf>,
+    payments: &[(Address, u64)],
+    change: Option<&Address>,
     data: Option<Vec<u8>>,
-    fee_per_vbyte: u64,
+    fee_per_weight: u64,
   ) -> Result<SignableTransaction, TransactionError> {
     if inputs.is_empty() {
       Err(TransactionError::NoInputs)?;
@@ -187,7 +159,10 @@ impl SignableTransaction {
     let payment_sat = payments.iter().map(|payment| payment.1).sum::<u64>();
     let mut tx_outs = payments
       .iter()
-      .map(|payment| TxOut { value: Amount::from_sat(payment.1), script_pubkey: payment.0.clone() })
+      .map(|payment| TxOut {
+        value: Amount::from_sat(payment.1),
+        script_pubkey: payment.0.script_pubkey(),
+      })
       .collect::<Vec<_>>();
 
     // Add the OP_RETURN output
@@ -201,33 +176,49 @@ impl SignableTransaction {
       })
     }
 
-    let (mut weight, vbytes) = Self::calculate_weight_vbytes(tx_ins.len(), payments, None);
+    let mut weight = Self::calculate_weight(tx_ins.len(), payments, None);
+    let mut needed_fee = fee_per_weight * weight;
 
-    let mut needed_fee = fee_per_vbyte * vbytes;
+    // "Virtual transaction size" is weight ceildiv 4 per
+    // https://github.com/bitcoin/bips/blob/master/bip-0141.mediawiki
+
+    // https://github.com/bitcoin/bitcoin/blob/306ccd4927a2efe325c8d84be1bdb79edeb29b04/
+    //  src/policy/policy.cpp#L295-L298
+    // implements this as expected
+
+    // Technically, it takes whatever's greater, the weight or the amount of signature operations
+    // multiplied by DEFAULT_BYTES_PER_SIGOP (20)
+    // We only use 1 signature per input, and our inputs have a weight exceeding 20
+    // Accordingly, our inputs' weight will always be greater than the cost of the signature ops
+    let vsize = weight.div_ceil(4);
+    debug_assert_eq!(
+      u64::try_from(bitcoin::policy::get_virtual_tx_size(
+        weight.try_into().unwrap(),
+        tx_ins.len().try_into().unwrap()
+      ))
+      .unwrap(),
+      vsize
+    );
     // Technically, if there isn't change, this TX may still pay enough of a fee to pass the
     // minimum fee. Such edge cases aren't worth programming when they go against intent, as the
     // specified fee rate is too low to be valid
     // bitcoin::policy::DEFAULT_MIN_RELAY_TX_FEE is in sats/kilo-vbyte
-    if needed_fee < ((u64::from(bitcoin::policy::DEFAULT_MIN_RELAY_TX_FEE) * vbytes) / 1000) {
+    if needed_fee < ((u64::from(bitcoin::policy::DEFAULT_MIN_RELAY_TX_FEE) * vsize) / 1000) {
       Err(TransactionError::TooLowFee)?;
     }
 
     if input_sat < (payment_sat + needed_fee) {
-      Err(TransactionError::NotEnoughFunds {
-        inputs: input_sat,
-        payments: payment_sat,
-        fee: needed_fee,
-      })?;
+      Err(TransactionError::NotEnoughFunds)?;
     }
 
     // If there's a change address, check if there's change to give it
     if let Some(change) = change {
-      let (weight_with_change, vbytes_with_change) =
-        Self::calculate_weight_vbytes(tx_ins.len(), payments, Some(&change));
-      let fee_with_change = fee_per_vbyte * vbytes_with_change;
+      let weight_with_change = Self::calculate_weight(tx_ins.len(), payments, Some(change));
+      let fee_with_change = fee_per_weight * weight_with_change;
       if let Some(value) = input_sat.checked_sub(payment_sat + fee_with_change) {
         if value >= DUST {
-          tx_outs.push(TxOut { value: Amount::from_sat(value), script_pubkey: change });
+          tx_outs
+            .push(TxOut { value: Amount::from_sat(value), script_pubkey: change.script_pubkey() });
           weight = weight_with_change;
           needed_fee = fee_with_change;
         }
@@ -257,28 +248,54 @@ impl SignableTransaction {
 
   /// Returns the TX ID of the transaction this will create.
   pub fn txid(&self) -> [u8; 32] {
-    let mut res = self.tx.compute_txid().to_byte_array();
+    let mut res = self.tx.txid().to_byte_array();
     res.reverse();
     res
   }
 
-  /// Returns the transaction, sans witness, this will create if signed.
-  pub fn transaction(&self) -> &Transaction {
-    &self.tx
+  /// Returns the outputs this transaction will create.
+  pub fn outputs(&self) -> &[TxOut] {
+    &self.tx.output
   }
 
   /// Create a multisig machine for this transaction.
   ///
   /// Returns None if the wrong keys are used.
-  pub fn multisig(self, keys: &ThresholdKeys<Secp256k1>) -> Option<TransactionMachine> {
+  pub fn multisig(
+    self,
+    keys: &ThresholdKeys<Secp256k1>,
+    mut transcript: RecommendedTranscript,
+  ) -> Option<TransactionMachine> {
+    transcript.domain_separate(b"bitcoin_transaction");
+    transcript.append_message(b"root_key", keys.group_key().to_encoded_point(true).as_bytes());
+
+    // Transcript the inputs and outputs
+    let tx = &self.tx;
+    for input in &tx.input {
+      transcript.append_message(b"input_hash", input.previous_output.txid);
+      transcript.append_message(b"input_output_index", input.previous_output.vout.to_le_bytes());
+    }
+    for payment in &tx.output {
+      transcript.append_message(b"output_script", payment.script_pubkey.as_bytes());
+      transcript.append_message(b"output_amount", payment.value.to_sat().to_le_bytes());
+    }
+
     let mut sigs = vec![];
-    for i in 0 .. self.tx.input.len() {
+    for i in 0 .. tx.input.len() {
+      let mut transcript = transcript.clone();
+      // This unwrap is safe since any transaction with this many inputs violates the maximum
+      // size allowed under standards, which this lib will error on creation of
+      transcript.append_message(b"signing_input", u32::try_from(i).unwrap().to_le_bytes());
+
       let offset = keys.clone().offset(self.offsets[i]);
-      if p2tr_script_buf(offset.group_key())? != self.prevouts[i].script_pubkey {
+      if address_payload(offset.group_key())?.script_pubkey() != self.prevouts[i].script_pubkey {
         None?;
       }
 
-      sigs.push(AlgorithmMachine::new(Schnorr::new(), keys.clone().offset(self.offsets[i])));
+      sigs.push(AlgorithmMachine::new(
+        Schnorr::new(transcript),
+        keys.clone().offset(self.offsets[i]),
+      ));
     }
 
     Some(TransactionMachine { tx: self, sigs })
@@ -291,7 +308,7 @@ impl SignableTransaction {
 /// This will panic if either `cache` is called or the message isn't empty.
 pub struct TransactionMachine {
   tx: SignableTransaction,
-  sigs: Vec<AlgorithmMachine<Secp256k1, Schnorr>>,
+  sigs: Vec<AlgorithmMachine<Secp256k1, Schnorr<RecommendedTranscript>>>,
 }
 
 impl PreprocessMachine for TransactionMachine {
@@ -320,7 +337,7 @@ impl PreprocessMachine for TransactionMachine {
 
 pub struct TransactionSignMachine {
   tx: SignableTransaction,
-  sigs: Vec<AlgorithmSignMachine<Secp256k1, Schnorr>>,
+  sigs: Vec<AlgorithmSignMachine<Secp256k1, Schnorr<RecommendedTranscript>>>,
 }
 
 impl SignMachine<Transaction> for TransactionSignMachine {
@@ -358,7 +375,7 @@ impl SignMachine<Transaction> for TransactionSignMachine {
     msg: &[u8],
   ) -> Result<(TransactionSignatureMachine, Self::SignatureShare), FrostError> {
     if !msg.is_empty() {
-      panic!("message was passed to the TransactionSignMachine when it generates its own");
+      panic!("message was passed to the TransactionMachine when it generates its own");
     }
 
     let commitments = (0 .. self.sigs.len())
@@ -400,7 +417,7 @@ impl SignMachine<Transaction> for TransactionSignMachine {
 
 pub struct TransactionSignatureMachine {
   tx: Transaction,
-  sigs: Vec<AlgorithmSignatureMachine<Secp256k1, Schnorr>>,
+  sigs: Vec<AlgorithmSignatureMachine<Secp256k1, Schnorr<RecommendedTranscript>>>,
 }
 
 impl SignatureMachine<Transaction> for TransactionSignatureMachine {

coins/bitcoin/tests/runner.rs

@@ -1,15 +1,18 @@
-use std::sync::LazyLock;
+use std::sync::OnceLock;
 
 use bitcoin_serai::rpc::Rpc;
 
 use tokio::sync::Mutex;
 
-#[allow(dead_code)]
-pub(crate) static SEQUENTIAL: LazyLock<Mutex<()>> = LazyLock::new(|| Mutex::new(()));
+static SEQUENTIAL_CELL: OnceLock<Mutex<()>> = OnceLock::new();
+#[allow(non_snake_case)]
+pub fn SEQUENTIAL() -> &'static Mutex<()> {
+  SEQUENTIAL_CELL.get_or_init(|| Mutex::new(()))
+}
 
 #[allow(dead_code)]
 pub(crate) async fn rpc() -> Rpc {
-  let rpc = Rpc::new("http://serai:seraidex@127.0.0.1:8332".to_string()).await.unwrap();
+  let rpc = Rpc::new("http://serai:seraidex@127.0.0.1:18443".to_string()).await.unwrap();
 
   // If this node has already been interacted with, clear its chain
   if rpc.get_latest_block_number().await.unwrap() > 0 {
@@ -31,7 +34,7 @@ macro_rules! async_sequential {
     $(
       #[tokio::test]
       async fn $name() {
-        let guard = runner::SEQUENTIAL.lock().await;
+        let guard = runner::SEQUENTIAL().lock().await;
         let local = tokio::task::LocalSet::new();
         local.run_until(async move {
           if let Err(err) = tokio::task::spawn_local(async move { $body }).await {

coins/bitcoin/tests/wallet.rs

@@ -2,6 +2,8 @@ use std::collections::HashMap;
 
 use rand_core::{RngCore, OsRng};
 
+use transcript::{Transcript, RecommendedTranscript};
+
 use k256::{
   elliptic_curve::{
     group::{ff::Field, Group},
@@ -20,10 +22,11 @@ use bitcoin_serai::{
     hashes::Hash as HashTrait,
     blockdata::opcodes::all::OP_RETURN,
     script::{PushBytesBuf, Instruction, Instructions, Script},
+    address::NetworkChecked,
     OutPoint, Amount, TxOut, Transaction, Network, Address,
   },
   wallet::{
-    tweak_keys, p2tr_script_buf, ReceivedOutput, Scanner, TransactionError, SignableTransaction,
+    tweak_keys, address_payload, ReceivedOutput, Scanner, TransactionError, SignableTransaction,
   },
   rpc::Rpc,
 };
@@ -45,7 +48,7 @@ async fn send_and_get_output(rpc: &Rpc, scanner: &Scanner, key: ProjectivePoint)
       "generatetoaddress",
       serde_json::json!([
         1,
-        Address::from_script(&p2tr_script_buf(key).unwrap(), Network::Regtest).unwrap()
+        Address::<NetworkChecked>::new(Network::Regtest, address_payload(key).unwrap())
       ]),
     )
     .await
@@ -66,7 +69,7 @@ async fn send_and_get_output(rpc: &Rpc, scanner: &Scanner, key: ProjectivePoint)
   assert_eq!(outputs, scanner.scan_transaction(&block.txdata[0]));
 
   assert_eq!(outputs.len(), 1);
-  assert_eq!(outputs[0].outpoint(), &OutPoint::new(block.txdata[0].compute_txid(), 0));
+  assert_eq!(outputs[0].outpoint(), &OutPoint::new(block.txdata[0].txid(), 0));
   assert_eq!(outputs[0].value(), block.txdata[0].output[0].value.to_sat());
 
   assert_eq!(
@@ -92,11 +95,46 @@ fn sign(
 ) -> Transaction {
   let mut machines = HashMap::new();
   for i in (1 ..= THRESHOLD).map(|i| Participant::new(i).unwrap()) {
-    machines.insert(i, tx.clone().multisig(&keys[&i].clone()).unwrap());
+    machines.insert(
+      i,
+      tx.clone()
+        .multisig(&keys[&i].clone(), RecommendedTranscript::new(b"bitcoin-serai Test Transaction"))
+        .unwrap(),
+    );
   }
   sign_without_caching(&mut OsRng, machines, &[])
 }
 
+#[test]
+fn test_tweak_keys() {
+  let mut even = false;
+  let mut odd = false;
+
+  // Generate keys until we get an even set and an odd set
+  while !(even && odd) {
+    let mut keys = key_gen(&mut OsRng).drain().next().unwrap().1;
+    if is_even(keys.group_key()) {
+      // Tweaking should do nothing
+      assert_eq!(tweak_keys(&keys).group_key(), keys.group_key());
+
+      even = true;
+    } else {
+      let tweaked = tweak_keys(&keys).group_key();
+      assert_ne!(tweaked, keys.group_key());
+      // Tweaking should produce an even key
+      assert!(is_even(tweaked));
+
+      // Verify it uses the smallest possible offset
+      while keys.group_key().to_encoded_point(true).tag() == Tag::CompressedOddY {
+        keys = keys.offset(Scalar::ONE);
+      }
+      assert_eq!(tweaked, keys.group_key());
+
+      odd = true;
+    }
+  }
+}
+
 async_sequential! {
   async fn test_scanner() {
     // Test Scanners are creatable for even keys.
@@ -155,7 +193,7 @@ async_sequential! {
     assert_eq!(output.offset(), Scalar::ZERO);
 
     let inputs = vec![output];
-    let addr = || p2tr_script_buf(key).unwrap();
+    let addr = || Address::<NetworkChecked>::new(Network::Regtest, address_payload(key).unwrap());
     let payments = vec![(addr(), 1000)];
 
     assert!(SignableTransaction::new(inputs.clone(), &payments, None, None, FEE).is_ok());
@@ -168,7 +206,7 @@ async_sequential! {
     // No change
     assert!(SignableTransaction::new(inputs.clone(), &[(addr(), 1000)], None, None, FEE).is_ok());
     // Consolidation TX
-    assert!(SignableTransaction::new(inputs.clone(), &[], Some(addr()), None, FEE).is_ok());
+    assert!(SignableTransaction::new(inputs.clone(), &[], Some(&addr()), None, FEE).is_ok());
     // Data
     assert!(SignableTransaction::new(inputs.clone(), &[], None, Some(vec![]), FEE).is_ok());
     // No outputs
@@ -191,14 +229,14 @@ async_sequential! {
     );
 
     assert_eq!(
-      SignableTransaction::new(inputs.clone(), &[], Some(addr()), None, 0),
+      SignableTransaction::new(inputs.clone(), &[], Some(&addr()), None, 0),
       Err(TransactionError::TooLowFee),
     );
 
-    assert!(matches!(
+    assert_eq!(
       SignableTransaction::new(inputs.clone(), &[(addr(), inputs[0].value() * 2)], None, None, FEE),
-      Err(TransactionError::NotEnoughFunds { .. }),
-    ));
+      Err(TransactionError::NotEnoughFunds),
+    );
 
     assert_eq!(
       SignableTransaction::new(inputs, &vec![(addr(), 1000); 10000], None, None, FEE),
@@ -223,19 +261,20 @@ async_sequential! {
 
     // Declare payments, change, fee
     let payments = [
-      (p2tr_script_buf(key).unwrap(), 1005),
-      (p2tr_script_buf(offset_key).unwrap(), 1007)
+      (Address::<NetworkChecked>::new(Network::Regtest, address_payload(key).unwrap()), 1005),
+      (Address::<NetworkChecked>::new(Network::Regtest, address_payload(offset_key).unwrap()), 1007)
     ];
 
     let change_offset = scanner.register_offset(Scalar::random(&mut OsRng)).unwrap();
     let change_key = key + (ProjectivePoint::GENERATOR * change_offset);
-    let change_addr = p2tr_script_buf(change_key).unwrap();
+    let change_addr =
+      Address::<NetworkChecked>::new(Network::Regtest, address_payload(change_key).unwrap());
 
     // Create and sign the TX
     let tx = SignableTransaction::new(
       vec![output.clone(), offset_output.clone()],
       &payments,
-      Some(change_addr.clone()),
+      Some(&change_addr),
       None,
       FEE
     ).unwrap();
@@ -248,7 +287,7 @@ async_sequential! {
     // Ensure we can scan it
     let outputs = scanner.scan_transaction(&tx);
     for (o, output) in outputs.iter().enumerate() {
-      assert_eq!(output.outpoint(), &OutPoint::new(tx.compute_txid(), u32::try_from(o).unwrap()));
+      assert_eq!(output.outpoint(), &OutPoint::new(tx.txid(), u32::try_from(o).unwrap()));
       assert_eq!(&ReceivedOutput::read::<&[u8]>(&mut output.serialize().as_ref()).unwrap(), output);
     }
 
@@ -260,13 +299,13 @@ async_sequential! {
     for ((output, scanned), payment) in tx.output.iter().zip(outputs.iter()).zip(payments.iter()) {
       assert_eq!(
         output,
-        &TxOut { script_pubkey: payment.0.clone(), value: Amount::from_sat(payment.1) },
+        &TxOut { script_pubkey: payment.0.script_pubkey(), value: Amount::from_sat(payment.1) },
       );
       assert_eq!(scanned.value(), payment.1 );
     }
 
     // Make sure the change is correct
-    assert_eq!(needed_fee, u64::try_from(tx.vsize()).unwrap() * FEE);
+    assert_eq!(needed_fee, u64::from(tx.weight()) * FEE);
     let input_value = output.value() + offset_output.value();
     let output_value = tx.output.iter().map(|output| output.value.to_sat()).sum::<u64>();
     assert_eq!(input_value - output_value, needed_fee);
@@ -275,13 +314,13 @@ async_sequential! {
       input_value - payments.iter().map(|payment| payment.1).sum::<u64>() - needed_fee;
     assert_eq!(
       tx.output[2],
-      TxOut { script_pubkey: change_addr, value: Amount::from_sat(change_amount) },
+      TxOut { script_pubkey: change_addr.script_pubkey(), value: Amount::from_sat(change_amount) },
     );
 
     // This also tests send_raw_transaction and get_transaction, which the RPC test can't
     // effectively test
     rpc.send_raw_transaction(&tx).await.unwrap();
-    let mut hash = *tx.compute_txid().as_raw_hash().as_byte_array();
+    let mut hash = *tx.txid().as_raw_hash().as_byte_array();
     hash.reverse();
     assert_eq!(tx, rpc.get_transaction(&hash).await.unwrap());
     assert_eq!(expected_id, hash);
@@ -305,7 +344,7 @@ async_sequential! {
       &SignableTransaction::new(
         vec![output],
         &[],
-        Some(p2tr_script_buf(key).unwrap()),
+        Some(&Address::<NetworkChecked>::new(Network::Regtest, address_payload(key).unwrap())),
         Some(data.clone()),
         FEE
       ).unwrap()

coins/ethereum/.gitignore

@@ -0,0 +1,3 @@
+# solidity build outputs
+cache
+artifacts

coins/ethereum/Cargo.toml

@@ -0,0 +1,42 @@
+[package]
+name = "ethereum-serai"
+version = "0.1.0"
+description = "An Ethereum library supporting Schnorr signing and on-chain verification"
+license = "AGPL-3.0-only"
+repository = "https://github.com/serai-dex/serai/tree/develop/coins/ethereum"
+authors = ["Luke Parker <lukeparker5132@gmail.com>", "Elizabeth Binks <elizabethjbinks@gmail.com>"]
+edition = "2021"
+publish = false
+rust-version = "1.74"
+
+[package.metadata.docs.rs]
+all-features = true
+rustdoc-args = ["--cfg", "docsrs"]
+
+[lints]
+workspace = true
+
+[dependencies]
+thiserror = { version = "1", default-features = false }
+eyre = { version = "0.6", default-features = false }
+
+sha3 = { version = "0.10", default-features = false, features = ["std"] }
+
+group = { version = "0.13", default-features = false }
+k256 = { version = "^0.13.1", default-features = false, features = ["std", "ecdsa"] }
+frost = { package = "modular-frost", path = "../../crypto/frost", features = ["secp256k1", "tests"] }
+
+ethers-core = { version = "2", default-features = false }
+ethers-providers = { version = "2", default-features = false }
+ethers-contract = { version = "2", default-features = false, features = ["abigen", "providers"] }
+
+[dev-dependencies]
+rand_core = { version = "0.6", default-features = false, features = ["std"] }
+
+hex = { version = "0.4", default-features = false, features = ["std"] }
+serde = { version = "1", default-features = false, features = ["std"] }
+serde_json = { version = "1", default-features = false, features = ["std"] }
+
+sha2 = { version = "0.10", default-features = false, features = ["std"] }
+
+tokio = { version = "1", features = ["macros"] }

coins/ethereum/LICENSE

@@ -1,6 +1,6 @@
 AGPL-3.0-only license
 
-Copyright (c) 2023-2025 Luke Parker
+Copyright (c) 2022-2023 Luke Parker
 
 This program is free software: you can redistribute it and/or modify
 it under the terms of the GNU Affero General Public License Version 3 as

coins/ethereum/README.md

@@ -0,0 +1,9 @@
+# Ethereum
+
+This package contains Ethereum-related functionality, specifically deploying and
+interacting with Serai contracts.
+
+### Dependencies
+
+- solc
+- [Foundry](https://github.com/foundry-rs/foundry)

coins/ethereum/build.rs

@@ -0,0 +1,15 @@
+fn main() {
+  println!("cargo:rerun-if-changed=contracts");
+  println!("cargo:rerun-if-changed=artifacts");
+
+  #[rustfmt::skip]
+  let args = [
+    "--base-path", ".",
+    "-o", "./artifacts", "--overwrite",
+    "--bin", "--abi",
+    "--optimize",
+    "./contracts/Schnorr.sol"
+  ];
+
+  assert!(std::process::Command::new("solc").args(args).status().unwrap().success());
+}

coins/ethereum/contracts/Schnorr.sol

@@ -0,0 +1,36 @@
+//SPDX-License-Identifier: AGPLv3
+pragma solidity ^0.8.0;
+
+// see https://github.com/noot/schnorr-verify for implementation details
+contract Schnorr {
+  // secp256k1 group order
+  uint256 constant public Q =
+    0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364141;
+
+  // parity := public key y-coord parity (27 or 28)
+  // px := public key x-coord
+  // message := 32-byte message
+  // s := schnorr signature
+  // e := schnorr signature challenge
+  function verify(
+    uint8 parity,
+    bytes32 px,
+    bytes32 message,
+    bytes32 s,
+    bytes32 e
+  ) public view returns (bool) {
+    // ecrecover = (m, v, r, s);
+    bytes32 sp = bytes32(Q - mulmod(uint256(s), uint256(px), Q));
+    bytes32 ep = bytes32(Q - mulmod(uint256(e), uint256(px), Q));
+
+    require(sp != 0);
+    // the ecrecover precompile implementation checks that the `r` and `s`
+    // inputs are non-zero (in this case, `px` and `ep`), thus we don't need to
+    // check if they're zero.will make me 
+    address R = ecrecover(sp, parity, px, ep);
+    require(R != address(0), "ecrecover failed");
+    return e == keccak256(
+      abi.encodePacked(R, uint8(parity), px, block.chainid, message)
+    );
+  }
+}

coins/ethereum/src/contract.rs

@@ -0,0 +1,36 @@
+use thiserror::Error;
+use eyre::{eyre, Result};
+
+use ethers_providers::{Provider, Http};
+use ethers_contract::abigen;
+
+use crate::crypto::ProcessedSignature;
+
+#[derive(Error, Debug)]
+pub enum EthereumError {
+  #[error("failed to verify Schnorr signature")]
+  VerificationError,
+}
+
+abigen!(Schnorr, "./artifacts/Schnorr.abi");
+
+pub async fn call_verify(
+  contract: &Schnorr<Provider<Http>>,
+  params: &ProcessedSignature,
+) -> Result<()> {
+  if contract
+    .verify(
+      params.parity + 27,
+      params.px.to_bytes().into(),
+      params.message,
+      params.s.to_bytes().into(),
+      params.e.to_bytes().into(),
+    )
+    .call()
+    .await?
+  {
+    Ok(())
+  } else {
+    Err(eyre!(EthereumError::VerificationError))
+  }
+}

coins/ethereum/src/crypto.rs

@@ -0,0 +1,107 @@
+use sha3::{Digest, Keccak256};
+
+use group::Group;
+use k256::{
+  elliptic_curve::{
+    bigint::ArrayEncoding, ops::Reduce, point::DecompressPoint, sec1::ToEncodedPoint,
+  },
+  AffinePoint, ProjectivePoint, Scalar, U256,
+};
+
+use frost::{algorithm::Hram, curve::Secp256k1};
+
+pub fn keccak256(data: &[u8]) -> [u8; 32] {
+  Keccak256::digest(data).into()
+}
+
+pub fn hash_to_scalar(data: &[u8]) -> Scalar {
+  Scalar::reduce(U256::from_be_slice(&keccak256(data)))
+}
+
+pub fn address(point: &ProjectivePoint) -> [u8; 20] {
+  let encoded_point = point.to_encoded_point(false);
+  keccak256(&encoded_point.as_ref()[1 .. 65])[12 .. 32].try_into().unwrap()
+}
+
+pub fn ecrecover(message: Scalar, v: u8, r: Scalar, s: Scalar) -> Option<[u8; 20]> {
+  if r.is_zero().into() || s.is_zero().into() {
+    return None;
+  }
+
+  #[allow(non_snake_case)]
+  let R = AffinePoint::decompress(&r.to_bytes(), v.into());
+  #[allow(non_snake_case)]
+  if let Some(R) = Option::<AffinePoint>::from(R) {
+    #[allow(non_snake_case)]
+    let R = ProjectivePoint::from(R);
+
+    let r = r.invert().unwrap();
+    let u1 = ProjectivePoint::GENERATOR * (-message * r);
+    let u2 = R * (s * r);
+    let key: ProjectivePoint = u1 + u2;
+    if !bool::from(key.is_identity()) {
+      return Some(address(&key));
+    }
+  }
+
+  None
+}
+
+#[derive(Clone, Default)]
+pub struct EthereumHram {}
+impl Hram<Secp256k1> for EthereumHram {
+  #[allow(non_snake_case)]
+  fn hram(R: &ProjectivePoint, A: &ProjectivePoint, m: &[u8]) -> Scalar {
+    let a_encoded_point = A.to_encoded_point(true);
+    let mut a_encoded = a_encoded_point.as_ref().to_owned();
+    a_encoded[0] += 25; // Ethereum uses 27/28 for point parity
+    let mut data = address(R).to_vec();
+    data.append(&mut a_encoded);
+    data.append(&mut m.to_vec());
+    Scalar::reduce(U256::from_be_slice(&keccak256(&data)))
+  }
+}
+
+pub struct ProcessedSignature {
+  pub s: Scalar,
+  pub px: Scalar,
+  pub parity: u8,
+  pub message: [u8; 32],
+  pub e: Scalar,
+}
+
+#[allow(non_snake_case)]
+pub fn preprocess_signature_for_ecrecover(
+  m: [u8; 32],
+  R: &ProjectivePoint,
+  s: Scalar,
+  A: &ProjectivePoint,
+  chain_id: U256,
+) -> (Scalar, Scalar) {
+  let processed_sig = process_signature_for_contract(m, R, s, A, chain_id);
+  let sr = processed_sig.s.mul(&processed_sig.px).negate();
+  let er = processed_sig.e.mul(&processed_sig.px).negate();
+  (sr, er)
+}
+
+#[allow(non_snake_case)]
+pub fn process_signature_for_contract(
+  m: [u8; 32],
+  R: &ProjectivePoint,
+  s: Scalar,
+  A: &ProjectivePoint,
+  chain_id: U256,
+) -> ProcessedSignature {
+  let encoded_pk = A.to_encoded_point(true);
+  let px = &encoded_pk.as_ref()[1 .. 33];
+  let px_scalar = Scalar::reduce(U256::from_be_slice(px));
+  let e = EthereumHram::hram(R, A, &[chain_id.to_be_byte_array().as_slice(), &m].concat());
+  ProcessedSignature {
+    s,
+    px: px_scalar,
+    parity: &encoded_pk.as_ref()[0] - 2,
+    #[allow(non_snake_case)]
+    message: m,
+    e,
+  }
+}

coins/ethereum/src/lib.rs

@@ -0,0 +1,2 @@
+pub mod contract;
+pub mod crypto;

coins/ethereum/tests/contract.rs

@@ -0,0 +1,128 @@
+use std::{convert::TryFrom, sync::Arc, time::Duration, fs::File};
+
+use rand_core::OsRng;
+
+use ::k256::{
+  elliptic_curve::{bigint::ArrayEncoding, PrimeField},
+  U256,
+};
+
+use ethers_core::{
+  types::Signature,
+  abi::Abi,
+  utils::{keccak256, Anvil, AnvilInstance},
+};
+use ethers_contract::ContractFactory;
+use ethers_providers::{Middleware, Provider, Http};
+
+use frost::{
+  curve::Secp256k1,
+  Participant,
+  algorithm::IetfSchnorr,
+  tests::{key_gen, algorithm_machines, sign},
+};
+
+use ethereum_serai::{
+  crypto,
+  contract::{Schnorr, call_verify},
+};
+
+// TODO: Replace with a contract deployment from an unknown account, so the environment solely has
+// to fund the deployer, not create/pass a wallet
+pub async fn deploy_schnorr_verifier_contract(
+  chain_id: u32,
+  client: Arc<Provider<Http>>,
+  wallet: &k256::ecdsa::SigningKey,
+) -> eyre::Result<Schnorr<Provider<Http>>> {
+  let abi: Abi = serde_json::from_reader(File::open("./artifacts/Schnorr.abi").unwrap()).unwrap();
+
+  let hex_bin_buf = std::fs::read_to_string("./artifacts/Schnorr.bin").unwrap();
+  let hex_bin =
+    if let Some(stripped) = hex_bin_buf.strip_prefix("0x") { stripped } else { &hex_bin_buf };
+  let bin = hex::decode(hex_bin).unwrap();
+  let factory = ContractFactory::new(abi, bin.into(), client.clone());
+
+  let mut deployment_tx = factory.deploy(())?.tx;
+  deployment_tx.set_chain_id(chain_id);
+  deployment_tx.set_gas(500_000);
+  let (max_fee_per_gas, max_priority_fee_per_gas) = client.estimate_eip1559_fees(None).await?;
+  deployment_tx.as_eip1559_mut().unwrap().max_fee_per_gas = Some(max_fee_per_gas);
+  deployment_tx.as_eip1559_mut().unwrap().max_priority_fee_per_gas = Some(max_priority_fee_per_gas);
+
+  let sig_hash = deployment_tx.sighash();
+  let (sig, rid) = wallet.sign_prehash_recoverable(sig_hash.as_ref()).unwrap();
+
+  // EIP-155 v
+  let mut v = u64::from(rid.to_byte());
+  assert!((v == 0) || (v == 1));
+  v += u64::from((chain_id * 2) + 35);
+
+  let r = sig.r().to_repr();
+  let r_ref: &[u8] = r.as_ref();
+  let s = sig.s().to_repr();
+  let s_ref: &[u8] = s.as_ref();
+  let deployment_tx = deployment_tx.rlp_signed(&Signature { r: r_ref.into(), s: s_ref.into(), v });
+
+  let pending_tx = client.send_raw_transaction(deployment_tx).await?;
+
+  let mut receipt;
+  while {
+    receipt = client.get_transaction_receipt(pending_tx.tx_hash()).await?;
+    receipt.is_none()
+  } {
+    tokio::time::sleep(Duration::from_secs(6)).await;
+  }
+  let receipt = receipt.unwrap();
+  assert!(receipt.status == Some(1.into()));
+
+  let contract = Schnorr::new(receipt.contract_address.unwrap(), client.clone());
+  Ok(contract)
+}
+
+async fn deploy_test_contract() -> (u32, AnvilInstance, Schnorr<Provider<Http>>) {
+  let anvil = Anvil::new().spawn();
+
+  let provider =
+    Provider::<Http>::try_from(anvil.endpoint()).unwrap().interval(Duration::from_millis(10u64));
+  let chain_id = provider.get_chainid().await.unwrap().as_u32();
+  let wallet = anvil.keys()[0].clone().into();
+  let client = Arc::new(provider);
+
+  (chain_id, anvil, deploy_schnorr_verifier_contract(chain_id, client, &wallet).await.unwrap())
+}
+
+#[tokio::test]
+async fn test_deploy_contract() {
+  deploy_test_contract().await;
+}
+
+#[tokio::test]
+async fn test_ecrecover_hack() {
+  let (chain_id, _anvil, contract) = deploy_test_contract().await;
+  let chain_id = U256::from(chain_id);
+
+  let keys = key_gen::<_, Secp256k1>(&mut OsRng);
+  let group_key = keys[&Participant::new(1).unwrap()].group_key();
+
+  const MESSAGE: &[u8] = b"Hello, World!";
+  let hashed_message = keccak256(MESSAGE);
+
+  let full_message = &[chain_id.to_be_byte_array().as_slice(), &hashed_message].concat();
+
+  let algo = IetfSchnorr::<Secp256k1, crypto::EthereumHram>::ietf();
+  let sig = sign(
+    &mut OsRng,
+    &algo,
+    keys.clone(),
+    algorithm_machines(&mut OsRng, &algo, &keys),
+    full_message,
+  );
+  let mut processed_sig =
+    crypto::process_signature_for_contract(hashed_message, &sig.R, sig.s, &group_key, chain_id);
+
+  call_verify(&contract, &processed_sig).await.unwrap();
+
+  // test invalid signature fails
+  processed_sig.message[0] = 0;
+  assert!(call_verify(&contract, &processed_sig).await.is_err());
+}

coins/ethereum/tests/crypto.rs

@@ -0,0 +1,87 @@
+use k256::{
+  elliptic_curve::{bigint::ArrayEncoding, ops::Reduce, sec1::ToEncodedPoint},
+  ProjectivePoint, Scalar, U256,
+};
+use frost::{curve::Secp256k1, Participant};
+
+use ethereum_serai::crypto::*;
+
+#[test]
+fn test_ecrecover() {
+  use rand_core::OsRng;
+  use sha2::Sha256;
+  use sha3::{Digest, Keccak256};
+  use k256::ecdsa::{hazmat::SignPrimitive, signature::DigestVerifier, SigningKey, VerifyingKey};
+
+  let private = SigningKey::random(&mut OsRng);
+  let public = VerifyingKey::from(&private);
+
+  const MESSAGE: &[u8] = b"Hello, World!";
+  let (sig, recovery_id) = private
+    .as_nonzero_scalar()
+    .try_sign_prehashed_rfc6979::<Sha256>(&Keccak256::digest(MESSAGE), b"")
+    .unwrap();
+  #[allow(clippy::unit_cmp)] // Intended to assert this wasn't changed to Result<bool>
+  {
+    assert_eq!(public.verify_digest(Keccak256::new_with_prefix(MESSAGE), &sig).unwrap(), ());
+  }
+
+  assert_eq!(
+    ecrecover(hash_to_scalar(MESSAGE), recovery_id.unwrap().is_y_odd().into(), *sig.r(), *sig.s())
+      .unwrap(),
+    address(&ProjectivePoint::from(public.as_affine()))
+  );
+}
+
+#[test]
+fn test_signing() {
+  use frost::{
+    algorithm::IetfSchnorr,
+    tests::{algorithm_machines, key_gen, sign},
+  };
+  use rand_core::OsRng;
+
+  let keys = key_gen::<_, Secp256k1>(&mut OsRng);
+  let _group_key = keys[&Participant::new(1).unwrap()].group_key();
+
+  const MESSAGE: &[u8] = b"Hello, World!";
+
+  let algo = IetfSchnorr::<Secp256k1, EthereumHram>::ietf();
+  let _sig =
+    sign(&mut OsRng, &algo, keys.clone(), algorithm_machines(&mut OsRng, &algo, &keys), MESSAGE);
+}
+
+#[test]
+fn test_ecrecover_hack() {
+  use frost::{
+    algorithm::IetfSchnorr,
+    tests::{algorithm_machines, key_gen, sign},
+  };
+  use rand_core::OsRng;
+
+  let keys = key_gen::<_, Secp256k1>(&mut OsRng);
+  let group_key = keys[&Participant::new(1).unwrap()].group_key();
+  let group_key_encoded = group_key.to_encoded_point(true);
+  let group_key_compressed = group_key_encoded.as_ref();
+  let group_key_x = Scalar::reduce(U256::from_be_slice(&group_key_compressed[1 .. 33]));
+
+  const MESSAGE: &[u8] = b"Hello, World!";
+  let hashed_message = keccak256(MESSAGE);
+  let chain_id = U256::ONE;
+
+  let full_message = &[chain_id.to_be_byte_array().as_slice(), &hashed_message].concat();
+
+  let algo = IetfSchnorr::<Secp256k1, EthereumHram>::ietf();
+  let sig = sign(
+    &mut OsRng,
+    &algo,
+    keys.clone(),
+    algorithm_machines(&mut OsRng, &algo, &keys),
+    full_message,
+  );
+
+  let (sr, er) =
+    preprocess_signature_for_ecrecover(hashed_message, &sig.R, sig.s, &group_key, chain_id);
+  let q = ecrecover(sr, group_key_compressed[0] - 2, group_key_x, er).unwrap();
+  assert_eq!(q, address(&sig.R));
+}

coins/ethereum/tests/mod.rs

@@ -0,0 +1,2 @@
+mod contract;
+mod crypto;

coins/monero/Cargo.toml

@@ -0,0 +1,113 @@
+[package]
+name = "monero-serai"
+version = "0.1.4-alpha"
+description = "A modern Monero transaction library"
+license = "MIT"
+repository = "https://github.com/serai-dex/serai/tree/develop/coins/monero"
+authors = ["Luke Parker <lukeparker5132@gmail.com>"]
+edition = "2021"
+rust-version = "1.74"
+
+[package.metadata.docs.rs]
+all-features = true
+rustdoc-args = ["--cfg", "docsrs"]
+
+[lints]
+workspace = true
+
+[dependencies]
+std-shims = { path = "../../common/std-shims", version = "^0.1.1", default-features = false }
+
+async-trait = { version = "0.1", default-features = false }
+thiserror = { version = "1", default-features = false, optional = true }
+
+zeroize = { version = "^1.5", default-features = false, features = ["zeroize_derive"] }
+subtle = { version = "^2.4", default-features = false }
+
+rand_core = { version = "0.6", default-features = false }
+# Used to send transactions
+rand = { version = "0.8", default-features = false }
+rand_chacha = { version = "0.3", default-features = false }
+# Used to select decoys
+rand_distr = { version = "0.4", default-features = false }
+
+sha3 = { version = "0.10", default-features = false }
+pbkdf2 = { version = "0.12", features = ["simple"], default-features = false }
+
+curve25519-dalek = { version = "4", default-features = false, features = ["alloc", "zeroize", "precomputed-tables"] }
+
+# Used for the hash to curve, along with the more complicated proofs
+group = { version = "0.13", default-features = false }
+dalek-ff-group = { path = "../../crypto/dalek-ff-group", version = "0.4", default-features = false }
+multiexp = { path = "../../crypto/multiexp", version = "0.4", default-features = false, features = ["batch"] }
+
+# Needed for multisig
+transcript = { package = "flexible-transcript", path = "../../crypto/transcript", version = "0.3", default-features = false, features = ["recommended"], optional = true }
+dleq = { path = "../../crypto/dleq", version = "0.4", default-features = false, features = ["serialize"], optional = true }
+frost = { package = "modular-frost", path = "../../crypto/frost", version = "0.8", default-features = false, features = ["ed25519"], optional = true }
+
+monero-generators = { path = "generators", version = "0.4", default-features = false }
+
+async-lock = { version = "3", default-features = false, optional = true }
+
+hex-literal = "0.4"
+hex = { version = "0.4", default-features = false, features = ["alloc"] }
+serde = { version = "1", default-features = false, features = ["derive", "alloc"] }
+serde_json = { version = "1", default-features = false, features = ["alloc"] }
+
+base58-monero = { version = "2", default-features = false, features = ["check"] }
+
+# Used for the provided HTTP RPC
+digest_auth = { version = "0.3", default-features = false, optional = true }
+simple-request = { path = "../../common/request", version = "0.1", default-features = false, features = ["tls"], optional = true }
+tokio = { version = "1", default-features = false, optional = true }
+
+[build-dependencies]
+dalek-ff-group = { path = "../../crypto/dalek-ff-group", version = "0.4", default-features = false }
+monero-generators = { path = "generators", version = "0.4", default-features = false }
+
+[dev-dependencies]
+tokio = { version = "1", features = ["sync", "macros"] }
+
+frost = { package = "modular-frost", path = "../../crypto/frost", features = ["tests"] }
+
+[features]
+std = [
+  "std-shims/std",
+
+  "thiserror",
+
+  "zeroize/std",
+  "subtle/std",
+
+  "rand_core/std",
+  "rand/std",
+  "rand_chacha/std",
+  "rand_distr/std",
+
+  "sha3/std",
+  "pbkdf2/std",
+
+  "multiexp/std",
+
+  "transcript/std",
+  "dleq/std",
+
+  "monero-generators/std",
+
+  "async-lock?/std",
+
+  "hex/std",
+  "serde/std",
+  "serde_json/std",
+
+  "base58-monero/std",
+]
+
+cache-distribution = ["async-lock"]
+http-rpc = ["digest_auth", "simple-request", "tokio"]
+multisig = ["transcript", "frost", "dleq", "std"]
+binaries = ["tokio/rt-multi-thread", "tokio/macros", "http-rpc"]
+experimental = []
+
+default = ["std", "http-rpc"]

coins/monero/README.md

@@ -0,0 +1,49 @@
+# monero-serai
+
+A modern Monero transaction library intended for usage in wallets. It prides
+itself on accuracy, correctness, and removing common pit falls developers may
+face.
+
+monero-serai also offers the following features:
+
+- Featured Addresses
+- A FROST-based multisig orders of magnitude more performant than Monero's
+
+### Purpose and support
+
+monero-serai was written for Serai, a decentralized exchange aiming to support
+Monero. Despite this, monero-serai is intended to be a widely usable library,
+accurate to Monero. monero-serai guarantees the functionality needed for Serai,
+yet will not deprive functionality from other users.
+
+Various legacy transaction formats are not currently implemented, yet we are
+willing to add support for them. There aren't active development efforts around
+them however.
+
+### Caveats
+
+This library DOES attempt to do the following:
+
+- Create on-chain transactions identical to how wallet2 would (unless told not
+  to)
+- Not be detectable as monero-serai when scanning outputs
+- Not reveal spent outputs to the connected RPC node
+
+This library DOES NOT attempt to do the following:
+
+- Have identical RPC behavior when creating transactions
+- Be a wallet
+
+This means that monero-serai shouldn't be fingerprintable on-chain. It also
+shouldn't be fingerprintable if a targeted attack occurs to detect if the
+receiving wallet is monero-serai or wallet2. It also should be generally safe
+for usage with remote nodes.
+
+It won't hide from remote nodes it's monero-serai however, potentially
+allowing a remote node to profile you. The implications of this are left to the
+user to consider.
+
+It also won't act as a wallet, just as a transaction library. wallet2 has
+several *non-transaction-level* policies, such as always attempting to use two
+inputs to create transactions. These are considered out of scope to
+monero-serai.

coins/monero/build.rs

@@ -0,0 +1,67 @@
+use std::{
+  io::Write,
+  env,
+  path::Path,
+  fs::{File, remove_file},
+};
+
+use dalek_ff_group::EdwardsPoint;
+
+use monero_generators::bulletproofs_generators;
+
+fn serialize(generators_string: &mut String, points: &[EdwardsPoint]) {
+  for generator in points {
+    generators_string.extend(
+      format!(
+        "
+          dalek_ff_group::EdwardsPoint(
+            curve25519_dalek::edwards::CompressedEdwardsY({:?}).decompress().unwrap()
+          ),
+        ",
+        generator.compress().to_bytes()
+      )
+      .chars(),
+    );
+  }
+}
+
+fn generators(prefix: &'static str, path: &str) {
+  let generators = bulletproofs_generators(prefix.as_bytes());
+  #[allow(non_snake_case)]
+  let mut G_str = String::new();
+  serialize(&mut G_str, &generators.G);
+  #[allow(non_snake_case)]
+  let mut H_str = String::new();
+  serialize(&mut H_str, &generators.H);
+
+  let path = Path::new(&env::var("OUT_DIR").unwrap()).join(path);
+  let _ = remove_file(&path);
+  File::create(&path)
+    .unwrap()
+    .write_all(
+      format!(
+        "
+          pub(crate) static GENERATORS_CELL: OnceLock<Generators> = OnceLock::new();
+          pub fn GENERATORS() -> &'static Generators {{
+            GENERATORS_CELL.get_or_init(|| Generators {{
+              G: vec![
+                {G_str}
+              ],
+              H: vec![
+                {H_str}
+              ],
+            }})
+          }}
+        ",
+      )
+      .as_bytes(),
+    )
+    .unwrap();
+}
+
+fn main() {
+  println!("cargo:rerun-if-changed=build.rs");
+
+  generators("bulletproof", "generators.rs");
+  generators("bulletproof_plus", "generators_plus.rs");
+}

coins/monero/generators/Cargo.toml

@@ -1,12 +1,11 @@
 [package]
 name = "monero-generators"
 version = "0.4.0"
-description = "Monero's hash to point function and generators"
+description = "Monero's hash_to_point and generators"
 license = "MIT"
-repository = "https://github.com/serai-dex/serai/tree/develop/networks/monero/generators"
+repository = "https://github.com/serai-dex/serai/tree/develop/coins/monero/generators"
 authors = ["Luke Parker <lukeparker5132@gmail.com>"]
 edition = "2021"
-rust-version = "1.80"
 
 [package.metadata.docs.rs]
 all-features = true
@@ -21,27 +20,12 @@ std-shims = { path = "../../../common/std-shims", version = "^0.1.1", default-fe
 subtle = { version = "^2.4", default-features = false }
 
 sha3 = { version = "0.10", default-features = false }
-curve25519-dalek = { version = "4", default-features = false, features = ["alloc", "zeroize"] }
+
+curve25519-dalek = { version = "4", default-features = false, features = ["alloc", "zeroize", "precomputed-tables"] }
 
 group = { version = "0.13", default-features = false }
 dalek-ff-group = { path = "../../../crypto/dalek-ff-group", version = "0.4", default-features = false }
 
-monero-io = { path = "../io", version = "0.1", default-features = false }
-
-[dev-dependencies]
-hex = "0.4"
-
 [features]
-std = [
-  "std-shims/std",
-
-  "subtle/std",
-
-  "sha3/std",
-
-  "group/alloc",
-  "dalek-ff-group/std",
-
-  "monero-io/std"
-]
+std = ["std-shims/std", "subtle/std", "sha3/std", "dalek-ff-group/std"]
 default = ["std"]

coins/monero/generators/LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2024 Luke Parker
+Copyright (c) 2022-2023 Luke Parker
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

coins/monero/generators/README.md

@@ -0,0 +1,7 @@
+# Monero Generators
+
+Generators used by Monero in both its Pedersen commitments and Bulletproofs(+).
+An implementation of Monero's `ge_fromfe_frombytes_vartime`, simply called
+`hash_to_point` here, is included, as needed to generate generators.
+
+This library is usable under no-std when the `std` feature is disabled.

coins/monero/generators/src/hash_to_point.rs

@@ -1,20 +1,18 @@
 use subtle::ConditionallySelectable;
 
-use curve25519_dalek::edwards::EdwardsPoint;
+use curve25519_dalek::edwards::{EdwardsPoint, CompressedEdwardsY};
 
 use group::ff::{Field, PrimeField};
 use dalek_ff_group::FieldElement;
 
-use monero_io::decompress_point;
+use crate::hash;
 
-use crate::keccak256;
-
-/// Monero's `hash_to_ec` function.
+/// Monero's hash to point function, as named `ge_fromfe_frombytes_vartime`.
 pub fn hash_to_point(bytes: [u8; 32]) -> EdwardsPoint {
   #[allow(non_snake_case)]
   let A = FieldElement::from(486662u64);
 
-  let v = FieldElement::from_square(keccak256(&bytes)).double();
+  let v = FieldElement::from_square(hash(&bytes)).double();
   let w = v + FieldElement::ONE;
   let x = w.square() + (-A.square() * v);
 
@@ -49,5 +47,5 @@ pub fn hash_to_point(bytes: [u8; 32]) -> EdwardsPoint {
   let mut bytes = Y.to_repr();
   bytes[31] |= sign.unwrap_u8() << 7;
 
-  decompress_point(bytes).unwrap().mul_by_cofactor()
+  CompressedEdwardsY(bytes).decompress().unwrap().mul_by_cofactor()
 }

coins/monero/generators/src/lib.rs

@@ -0,0 +1,79 @@
+//! Generators used by Monero in both its Pedersen commitments and Bulletproofs(+).
+//!
+//! An implementation of Monero's `ge_fromfe_frombytes_vartime`, simply called
+//! `hash_to_point` here, is included, as needed to generate generators.
+
+#![cfg_attr(not(feature = "std"), no_std)]
+
+use std_shims::{sync::OnceLock, vec::Vec};
+
+use sha3::{Digest, Keccak256};
+
+use curve25519_dalek::edwards::{EdwardsPoint as DalekPoint, CompressedEdwardsY};
+
+use group::{Group, GroupEncoding};
+use dalek_ff_group::EdwardsPoint;
+
+mod varint;
+use varint::write_varint;
+
+mod hash_to_point;
+pub use hash_to_point::hash_to_point;
+
+fn hash(data: &[u8]) -> [u8; 32] {
+  Keccak256::digest(data).into()
+}
+
+static H_CELL: OnceLock<DalekPoint> = OnceLock::new();
+/// Monero's alternate generator `H`, used for amounts in Pedersen commitments.
+#[allow(non_snake_case)]
+pub fn H() -> DalekPoint {
+  *H_CELL.get_or_init(|| {
+    CompressedEdwardsY(hash(&EdwardsPoint::generator().to_bytes()))
+      .decompress()
+      .unwrap()
+      .mul_by_cofactor()
+  })
+}
+
+static H_POW_2_CELL: OnceLock<[DalekPoint; 64]> = OnceLock::new();
+/// Monero's alternate generator `H`, multiplied by 2**i for i in 1 ..= 64.
+#[allow(non_snake_case)]
+pub fn H_pow_2() -> &'static [DalekPoint; 64] {
+  H_POW_2_CELL.get_or_init(|| {
+    let mut res = [H(); 64];
+    for i in 1 .. 64 {
+      res[i] = res[i - 1] + res[i - 1];
+    }
+    res
+  })
+}
+
+const MAX_M: usize = 16;
+const N: usize = 64;
+const MAX_MN: usize = MAX_M * N;
+
+/// Container struct for Bulletproofs(+) generators.
+#[allow(non_snake_case)]
+pub struct Generators {
+  pub G: Vec<EdwardsPoint>,
+  pub H: Vec<EdwardsPoint>,
+}
+
+/// Generate generators as needed for Bulletproofs(+), as Monero does.
+pub fn bulletproofs_generators(dst: &'static [u8]) -> Generators {
+  let mut res = Generators { G: Vec::with_capacity(MAX_MN), H: Vec::with_capacity(MAX_MN) };
+  for i in 0 .. MAX_MN {
+    let i = 2 * i;
+
+    let mut even = H().compress().to_bytes().to_vec();
+    even.extend(dst);
+    let mut odd = even.clone();
+
+    write_varint(&i.try_into().unwrap(), &mut even).unwrap();
+    write_varint(&(i + 1).try_into().unwrap(), &mut odd).unwrap();
+    res.H.push(EdwardsPoint(hash_to_point(hash(&even))));
+    res.G.push(EdwardsPoint(hash_to_point(hash(&odd))));
+  }
+  res
+}

coins/monero/generators/src/varint.rs

@@ -0,0 +1,16 @@
+use std_shims::io::{self, Write};
+
+const VARINT_CONTINUATION_MASK: u8 = 0b1000_0000;
+pub(crate) fn write_varint<W: Write>(varint: &u64, w: &mut W) -> io::Result<()> {
+  let mut varint = *varint;
+  while {
+    let mut b = u8::try_from(varint & u64::from(!VARINT_CONTINUATION_MASK)).unwrap();
+    varint >>= 7;
+    if varint != 0 {
+      b |= VARINT_CONTINUATION_MASK;
+    }
+    w.write_all(&[b])?;
+    varint != 0
+  } {}
+  Ok(())
+}

coins/monero/src/bin/reserialize_chain.rs

@@ -0,0 +1,323 @@
+#[cfg(feature = "binaries")]
+mod binaries {
+  pub(crate) use std::sync::Arc;
+
+  pub(crate) use curve25519_dalek::{
+    scalar::Scalar,
+    edwards::{CompressedEdwardsY, EdwardsPoint},
+  };
+
+  pub(crate) use multiexp::BatchVerifier;
+
+  pub(crate) use serde::Deserialize;
+  pub(crate) use serde_json::json;
+
+  pub(crate) use monero_serai::{
+    Commitment,
+    ringct::RctPrunable,
+    transaction::{Input, Transaction},
+    block::Block,
+    rpc::{RpcError, Rpc, HttpRpc},
+  };
+
+  pub(crate) use tokio::task::JoinHandle;
+
+  pub(crate) async fn check_block(rpc: Arc<Rpc<HttpRpc>>, block_i: usize) {
+    let hash = loop {
+      match rpc.get_block_hash(block_i).await {
+        Ok(hash) => break hash,
+        Err(RpcError::ConnectionError(e)) => {
+          println!("get_block_hash ConnectionError: {e}");
+          continue;
+        }
+        Err(e) => panic!("couldn't get block {block_i}'s hash: {e:?}"),
+      }
+    };
+
+    // TODO: Grab the JSON to also check it was deserialized correctly
+    #[derive(Deserialize, Debug)]
+    struct BlockResponse {
+      blob: String,
+    }
+    let res: BlockResponse = loop {
+      match rpc.json_rpc_call("get_block", Some(json!({ "hash": hex::encode(hash) }))).await {
+        Ok(res) => break res,
+        Err(RpcError::ConnectionError(e)) => {
+          println!("get_block ConnectionError: {e}");
+          continue;
+        }
+        Err(e) => panic!("couldn't get block {block_i} via block.hash(): {e:?}"),
+      }
+    };
+
+    let blob = hex::decode(res.blob).expect("node returned non-hex block");
+    let block = Block::read(&mut blob.as_slice())
+      .unwrap_or_else(|e| panic!("couldn't deserialize block {block_i}: {e}"));
+    assert_eq!(block.hash(), hash, "hash differs");
+    assert_eq!(block.serialize(), blob, "serialization differs");
+
+    let txs_len = 1 + block.txs.len();
+
+    if !block.txs.is_empty() {
+      #[derive(Deserialize, Debug)]
+      struct TransactionResponse {
+        tx_hash: String,
+        as_hex: String,
+      }
+      #[derive(Deserialize, Debug)]
+      struct TransactionsResponse {
+        #[serde(default)]
+        missed_tx: Vec<String>,
+        txs: Vec<TransactionResponse>,
+      }
+
+      let mut hashes_hex = block.txs.iter().map(hex::encode).collect::<Vec<_>>();
+      let mut all_txs = vec![];
+      while !hashes_hex.is_empty() {
+        let txs: TransactionsResponse = loop {
+          match rpc
+            .rpc_call(
+              "get_transactions",
+              Some(json!({
+                "txs_hashes": hashes_hex.drain(.. hashes_hex.len().min(100)).collect::<Vec<_>>(),
+              })),
+            )
+            .await
+          {
+            Ok(txs) => break txs,
+            Err(RpcError::ConnectionError(e)) => {
+              println!("get_transactions ConnectionError: {e}");
+              continue;
+            }
+            Err(e) => panic!("couldn't call get_transactions: {e:?}"),
+          }
+        };
+        assert!(txs.missed_tx.is_empty());
+        all_txs.extend(txs.txs);
+      }
+
+      let mut batch = BatchVerifier::new(block.txs.len());
+      for (tx_hash, tx_res) in block.txs.into_iter().zip(all_txs) {
+        assert_eq!(
+          tx_res.tx_hash,
+          hex::encode(tx_hash),
+          "node returned a transaction with different hash"
+        );
+
+        let tx = Transaction::read(
+          &mut hex::decode(&tx_res.as_hex).expect("node returned non-hex transaction").as_slice(),
+        )
+        .expect("couldn't deserialize transaction");
+
+        assert_eq!(
+          hex::encode(tx.serialize()),
+          tx_res.as_hex,
+          "Transaction serialization was different"
+        );
+        assert_eq!(tx.hash(), tx_hash, "Transaction hash was different");
+
+        if matches!(tx.rct_signatures.prunable, RctPrunable::Null) {
+          assert_eq!(tx.prefix.version, 1);
+          assert!(!tx.signatures.is_empty());
+          continue;
+        }
+
+        let sig_hash = tx.signature_hash();
+        // Verify all proofs we support proving for
+        // This is due to having debug_asserts calling verify within their proving, and CLSAG
+        // multisig explicitly calling verify as part of its signing process
+        // Accordingly, making sure our signature_hash algorithm is correct is great, and further
+        // making sure the verification functions are valid is appreciated
+        match tx.rct_signatures.prunable {
+          RctPrunable::Null |
+          RctPrunable::AggregateMlsagBorromean { .. } |
+          RctPrunable::MlsagBorromean { .. } => {}
+          RctPrunable::MlsagBulletproofs { bulletproofs, .. } => {
+            assert!(bulletproofs.batch_verify(
+              &mut rand_core::OsRng,
+              &mut batch,
+              (),
+              &tx.rct_signatures.base.commitments
+            ));
+          }
+          RctPrunable::Clsag { bulletproofs, clsags, pseudo_outs } => {
+            assert!(bulletproofs.batch_verify(
+              &mut rand_core::OsRng,
+              &mut batch,
+              (),
+              &tx.rct_signatures.base.commitments
+            ));
+
+            for (i, clsag) in clsags.into_iter().enumerate() {
+              let (amount, key_offsets, image) = match &tx.prefix.inputs[i] {
+                Input::Gen(_) => panic!("Input::Gen"),
+                Input::ToKey { amount, key_offsets, key_image } => (amount, key_offsets, key_image),
+              };
+
+              let mut running_sum = 0;
+              let mut actual_indexes = vec![];
+              for offset in key_offsets {
+                running_sum += offset;
+                actual_indexes.push(running_sum);
+              }
+
+              async fn get_outs(
+                rpc: &Rpc<HttpRpc>,
+                amount: u64,
+                indexes: &[u64],
+              ) -> Vec<[EdwardsPoint; 2]> {
+                #[derive(Deserialize, Debug)]
+                struct Out {
+                  key: String,
+                  mask: String,
+                }
+
+                #[derive(Deserialize, Debug)]
+                struct Outs {
+                  outs: Vec<Out>,
+                }
+
+                let outs: Outs = loop {
+                  match rpc
+                    .rpc_call(
+                      "get_outs",
+                      Some(json!({
+                        "get_txid": true,
+                        "outputs": indexes.iter().map(|o| json!({
+                          "amount": amount,
+                          "index": o
+                        })).collect::<Vec<_>>()
+                      })),
+                    )
+                    .await
+                  {
+                    Ok(outs) => break outs,
+                    Err(RpcError::ConnectionError(e)) => {
+                      println!("get_outs ConnectionError: {e}");
+                      continue;
+                    }
+                    Err(e) => panic!("couldn't connect to RPC to get outs: {e:?}"),
+                  }
+                };
+
+                let rpc_point = |point: &str| {
+                  CompressedEdwardsY(
+                    hex::decode(point)
+                      .expect("invalid hex for ring member")
+                      .try_into()
+                      .expect("invalid point len for ring member"),
+                  )
+                  .decompress()
+                  .expect("invalid point for ring member")
+                };
+
+                outs
+                  .outs
+                  .iter()
+                  .map(|out| {
+                    let mask = rpc_point(&out.mask);
+                    if amount != 0 {
+                      assert_eq!(mask, Commitment::new(Scalar::from(1u8), amount).calculate());
+                    }
+                    [rpc_point(&out.key), mask]
+                  })
+                  .collect()
+              }
+
+              clsag
+                .verify(
+                  &get_outs(&rpc, amount.unwrap_or(0), &actual_indexes).await,
+                  image,
+                  &pseudo_outs[i],
+                  &sig_hash,
+                )
+                .unwrap();
+            }
+          }
+        }
+      }
+      assert!(batch.verify_vartime());
+    }
+
+    println!("Deserialized, hashed, and reserialized {block_i} with {txs_len} TXs");
+  }
+}
+
+#[cfg(feature = "binaries")]
+#[tokio::main]
+async fn main() {
+  use binaries::*;
+
+  let args = std::env::args().collect::<Vec<String>>();
+
+  // Read start block as the first arg
+  let mut block_i = args[1].parse::<usize>().expect("invalid start block");
+
+  // How many blocks to work on at once
+  let async_parallelism: usize =
+    args.get(2).unwrap_or(&"8".to_string()).parse::<usize>().expect("invalid parallelism argument");
+
+  // Read further args as RPC URLs
+  let default_nodes = vec![
+    "http://xmr-node.cakewallet.com:18081".to_string(),
+    "https://node.sethforprivacy.com".to_string(),
+  ];
+  let mut specified_nodes = vec![];
+  {
+    let mut i = 0;
+    loop {
+      let Some(node) = args.get(3 + i) else { break };
+      specified_nodes.push(node.clone());
+      i += 1;
+    }
+  }
+  let nodes = if specified_nodes.is_empty() { default_nodes } else { specified_nodes };
+
+  let rpc = |url: String| async move {
+    HttpRpc::new(url.clone())
+      .await
+      .unwrap_or_else(|_| panic!("couldn't create HttpRpc connected to {url}"))
+  };
+  let main_rpc = rpc(nodes[0].clone()).await;
+  let mut rpcs = vec![];
+  for i in 0 .. async_parallelism {
+    rpcs.push(Arc::new(rpc(nodes[i % nodes.len()].clone()).await));
+  }
+
+  let mut rpc_i = 0;
+  let mut handles: Vec<JoinHandle<()>> = vec![];
+  let mut height = 0;
+  loop {
+    let new_height = main_rpc.get_height().await.expect("couldn't call get_height");
+    if new_height == height {
+      break;
+    }
+    height = new_height;
+
+    while block_i < height {
+      if handles.len() >= async_parallelism {
+        // Guarantee one handle is complete
+        handles.swap_remove(0).await.unwrap();
+
+        // Remove all of the finished handles
+        let mut i = 0;
+        while i < handles.len() {
+          if handles[i].is_finished() {
+            handles.swap_remove(i).await.unwrap();
+            continue;
+          }
+          i += 1;
+        }
+      }
+
+      handles.push(tokio::spawn(check_block(rpcs[rpc_i].clone(), block_i)));
+      rpc_i = (rpc_i + 1) % rpcs.len();
+      block_i += 1;
+    }
+  }
+}
+
+#[cfg(not(feature = "binaries"))]
+fn main() {
+  panic!("To run binaries, please build with `--feature binaries`.");
+}

coins/monero/src/block.rs

@@ -0,0 +1,123 @@
+use std_shims::{
+  vec::Vec,
+  io::{self, Read, Write},
+};
+
+use crate::{
+  hash,
+  merkle::merkle_root,
+  serialize::*,
+  transaction::{Input, Transaction},
+};
+
+const CORRECT_BLOCK_HASH_202612: [u8; 32] =
+  hex_literal::hex!("426d16cff04c71f8b16340b722dc4010a2dd3831c22041431f772547ba6e331a");
+const EXISTING_BLOCK_HASH_202612: [u8; 32] =
+  hex_literal::hex!("bbd604d2ba11ba27935e006ed39c9bfdd99b76bf4a50654bc1e1e61217962698");
+
+#[derive(Clone, PartialEq, Eq, Debug)]
+pub struct BlockHeader {
+  pub major_version: u8,
+  pub minor_version: u8,
+  pub timestamp: u64,
+  pub previous: [u8; 32],
+  pub nonce: u32,
+}
+
+impl BlockHeader {
+  pub fn write<W: Write>(&self, w: &mut W) -> io::Result<()> {
+    write_varint(&self.major_version, w)?;
+    write_varint(&self.minor_version, w)?;
+    write_varint(&self.timestamp, w)?;
+    w.write_all(&self.previous)?;
+    w.write_all(&self.nonce.to_le_bytes())
+  }
+
+  pub fn serialize(&self) -> Vec<u8> {
+    let mut serialized = vec![];
+    self.write(&mut serialized).unwrap();
+    serialized
+  }
+
+  pub fn read<R: Read>(r: &mut R) -> io::Result<BlockHeader> {
+    Ok(BlockHeader {
+      major_version: read_varint(r)?,
+      minor_version: read_varint(r)?,
+      timestamp: read_varint(r)?,
+      previous: read_bytes(r)?,
+      nonce: read_bytes(r).map(u32::from_le_bytes)?,
+    })
+  }
+}
+
+#[derive(Clone, PartialEq, Eq, Debug)]
+pub struct Block {
+  pub header: BlockHeader,
+  pub miner_tx: Transaction,
+  pub txs: Vec<[u8; 32]>,
+}
+
+impl Block {
+  pub fn number(&self) -> usize {
+    match self.miner_tx.prefix.inputs.first() {
+      Some(Input::Gen(number)) => (*number).try_into().unwrap(),
+      _ => panic!("invalid block, miner TX didn't have a Input::Gen"),
+    }
+  }
+
+  pub fn write<W: Write>(&self, w: &mut W) -> io::Result<()> {
+    self.header.write(w)?;
+    self.miner_tx.write(w)?;
+    write_varint(&self.txs.len(), w)?;
+    for tx in &self.txs {
+      w.write_all(tx)?;
+    }
+    Ok(())
+  }
+
+  fn tx_merkle_root(&self) -> [u8; 32] {
+    merkle_root(self.miner_tx.hash(), &self.txs)
+  }
+
+  /// Serialize the block as required for the proof of work hash.
+  ///
+  /// This is distinct from the serialization required for the block hash. To get the block hash,
+  /// use the [`Block::hash`] function.
+  pub fn serialize_hashable(&self) -> Vec<u8> {
+    let mut blob = self.header.serialize();
+    blob.extend_from_slice(&self.tx_merkle_root());
+    write_varint(&(1 + u64::try_from(self.txs.len()).unwrap()), &mut blob).unwrap();
+
+    blob
+  }
+
+  pub fn hash(&self) -> [u8; 32] {
+    let mut hashable = self.serialize_hashable();
+    // Monero pre-appends a VarInt of the block hashing blobs length before getting the block hash
+    // but doesn't do this when getting the proof of work hash :)
+    let mut hashing_blob = Vec::with_capacity(8 + hashable.len());
+    write_varint(&u64::try_from(hashable.len()).unwrap(), &mut hashing_blob).unwrap();
+    hashing_blob.append(&mut hashable);
+
+    let hash = hash(&hashing_blob);
+    if hash == CORRECT_BLOCK_HASH_202612 {
+      return EXISTING_BLOCK_HASH_202612;
+    };
+
+    hash
+  }
+
+  pub fn serialize(&self) -> Vec<u8> {
+    let mut serialized = vec![];
+    self.write(&mut serialized).unwrap();
+    serialized
+  }
+
+  pub fn read<R: Read>(r: &mut R) -> io::Result<Block> {
+    Ok(Block {
+      header: BlockHeader::read(r)?,
+      miner_tx: Transaction::read(r)?,
+      txs: (0_usize .. read_varint(r)?).map(|_| read_bytes(r)).collect::<Result<_, _>>()?,
+    })
+  }
+}

coins/monero/src/lib.rs

@@ -0,0 +1,225 @@
+#![cfg_attr(docsrs, feature(doc_auto_cfg))]
+#![doc = include_str!("../README.md")]
+#![cfg_attr(not(feature = "std"), no_std)]
+
+#[cfg(not(feature = "std"))]
+#[macro_use]
+extern crate alloc;
+
+use std_shims::{sync::OnceLock, io};
+
+use rand_core::{RngCore, CryptoRng};
+
+use zeroize::{Zeroize, ZeroizeOnDrop};
+
+use sha3::{Digest, Keccak256};
+
+use curve25519_dalek::{constants::ED25519_BASEPOINT_TABLE, scalar::Scalar, edwards::EdwardsPoint};
+
+pub use monero_generators::H;
+
+mod merkle;
+
+mod serialize;
+use serialize::{read_byte, read_u16};
+
+/// UnreducedScalar struct with functionality for recovering incorrectly reduced scalars.
+mod unreduced_scalar;
+
+/// Ring Signature structs and functionality.
+pub mod ring_signatures;
+
+/// RingCT structs and functionality.
+pub mod ringct;
+use ringct::RctType;
+
+/// Transaction structs.
+pub mod transaction;
+/// Block structs.
+pub mod block;
+
+/// Monero daemon RPC interface.
+pub mod rpc;
+/// Wallet functionality, enabling scanning and sending transactions.
+pub mod wallet;
+
+#[cfg(test)]
+mod tests;
+
+static INV_EIGHT_CELL: OnceLock<Scalar> = OnceLock::new();
+#[allow(non_snake_case)]
+pub(crate) fn INV_EIGHT() -> Scalar {
+  *INV_EIGHT_CELL.get_or_init(|| Scalar::from(8u8).invert())
+}
+
+/// Monero protocol version.
+///
+/// v15 is omitted as v15 was simply v14 and v16 being active at the same time, with regards to the
+/// transactions supported. Accordingly, v16 should be used during v15.
+#[derive(Clone, Copy, PartialEq, Eq, Debug, Zeroize)]
+#[allow(non_camel_case_types)]
+pub enum Protocol {
+  v14,
+  v16,
+  Custom {
+    ring_len: usize,
+    bp_plus: bool,
+    optimal_rct_type: RctType,
+    view_tags: bool,
+    v16_fee: bool,
+  },
+}
+
+impl Protocol {
+  /// Amount of ring members under this protocol version.
+  pub fn ring_len(&self) -> usize {
+    match self {
+      Protocol::v14 => 11,
+      Protocol::v16 => 16,
+      Protocol::Custom { ring_len, .. } => *ring_len,
+    }
+  }
+
+  /// Whether or not the specified version uses Bulletproofs or Bulletproofs+.
+  ///
+  /// This method will likely be reworked when versions not using Bulletproofs at all are added.
+  pub fn bp_plus(&self) -> bool {
+    match self {
+      Protocol::v14 => false,
+      Protocol::v16 => true,
+      Protocol::Custom { bp_plus, .. } => *bp_plus,
+    }
+  }
+
+  // TODO: Make this an Option when we support pre-RCT protocols
+  pub fn optimal_rct_type(&self) -> RctType {
+    match self {
+      Protocol::v14 => RctType::Clsag,
+      Protocol::v16 => RctType::BulletproofsPlus,
+      Protocol::Custom { optimal_rct_type, .. } => *optimal_rct_type,
+    }
+  }
+
+  /// Whether or not the specified version uses view tags.
+  pub fn view_tags(&self) -> bool {
+    match self {
+      Protocol::v14 => false,
+      Protocol::v16 => true,
+      Protocol::Custom { view_tags, .. } => *view_tags,
+    }
+  }
+
+  /// Whether or not the specified version uses the fee algorithm from Monero
+  /// hard fork version 16 (released in v18 binaries).
+  pub fn v16_fee(&self) -> bool {
+    match self {
+      Protocol::v14 => false,
+      Protocol::v16 => true,
+      Protocol::Custom { v16_fee, .. } => *v16_fee,
+    }
+  }
+
+  pub(crate) fn write<W: io::Write>(&self, w: &mut W) -> io::Result<()> {
+    match self {
+      Protocol::v14 => w.write_all(&[0, 14]),
+      Protocol::v16 => w.write_all(&[0, 16]),
+      Protocol::Custom { ring_len, bp_plus, optimal_rct_type, view_tags, v16_fee } => {
+        // Custom, version 0
+        w.write_all(&[1, 0])?;
+        w.write_all(&u16::try_from(*ring_len).unwrap().to_le_bytes())?;
+        w.write_all(&[u8::from(*bp_plus)])?;
+        w.write_all(&[optimal_rct_type.to_byte()])?;
+        w.write_all(&[u8::from(*view_tags)])?;
+        w.write_all(&[u8::from(*v16_fee)])
+      }
+    }
+  }
+
+  pub(crate) fn read<R: io::Read>(r: &mut R) -> io::Result<Protocol> {
+    Ok(match read_byte(r)? {
+      // Monero protocol
+      0 => match read_byte(r)? {
+        14 => Protocol::v14,
+        16 => Protocol::v16,
+        _ => Err(io::Error::other("unrecognized monero protocol"))?,
+      },
+      // Custom
+      1 => match read_byte(r)? {
+        0 => Protocol::Custom {
+          ring_len: read_u16(r)?.into(),
+          bp_plus: match read_byte(r)? {
+            0 => false,
+            1 => true,
+            _ => Err(io::Error::other("invalid bool serialization"))?,
+          },
+          optimal_rct_type: RctType::from_byte(read_byte(r)?)
+            .ok_or_else(|| io::Error::other("invalid RctType serialization"))?,
+          view_tags: match read_byte(r)? {
+            0 => false,
+            1 => true,
+            _ => Err(io::Error::other("invalid bool serialization"))?,
+          },
+          v16_fee: match read_byte(r)? {
+            0 => false,
+            1 => true,
+            _ => Err(io::Error::other("invalid bool serialization"))?,
+          },
+        },
+        _ => Err(io::Error::other("unrecognized custom protocol serialization"))?,
+      },
+      _ => Err(io::Error::other("unrecognized protocol serialization"))?,
+    })
+  }
+}
+
+/// Transparent structure representing a Pedersen commitment's contents.
+#[allow(non_snake_case)]
+#[derive(Clone, PartialEq, Eq, Zeroize, ZeroizeOnDrop)]
+pub struct Commitment {
+  pub mask: Scalar,
+  pub amount: u64,
+}
+
+impl core::fmt::Debug for Commitment {
+  fn fmt(&self, fmt: &mut core::fmt::Formatter<'_>) -> Result<(), core::fmt::Error> {
+    fmt.debug_struct("Commitment").field("amount", &self.amount).finish_non_exhaustive()
+  }
+}
+
+impl Commitment {
+  /// A commitment to zero, defined with a mask of 1 (as to not be the identity).
+  pub fn zero() -> Commitment {
+    Commitment { mask: Scalar::ONE, amount: 0 }
+  }
+
+  pub fn new(mask: Scalar, amount: u64) -> Commitment {
+    Commitment { mask, amount }
+  }
+
+  /// Calculate a Pedersen commitment, as a point, from the transparent structure.
+  pub fn calculate(&self) -> EdwardsPoint {
+    (&self.mask * ED25519_BASEPOINT_TABLE) + (Scalar::from(self.amount) * H())
+  }
+}
+
+/// Support generating a random scalar using a modern rand, as dalek's is notoriously dated.
+pub fn random_scalar<R: RngCore + CryptoRng>(rng: &mut R) -> Scalar {
+  let mut r = [0; 64];
+  rng.fill_bytes(&mut r);
+  Scalar::from_bytes_mod_order_wide(&r)
+}
+
+pub(crate) fn hash(data: &[u8]) -> [u8; 32] {
+  Keccak256::digest(data).into()
+}
+
+/// Hash the provided data to a scalar via keccak256(data) % l.
+pub fn hash_to_scalar(data: &[u8]) -> Scalar {
+  let scalar = Scalar::from_bytes_mod_order(hash(data));
+  // Monero will explicitly error in this case
+  // This library acknowledges its practical impossibility of it occurring, and doesn't bother to
+  // code in logic to handle it. That said, if it ever occurs, something must happen in order to
+  // not generate/verify a proof we believe to be valid when it isn't
+  assert!(scalar != Scalar::ZERO, "ZERO HASH: {data:?}");
+  scalar
+}

coins/monero/src/merkle.rs

@@ -1,11 +1,11 @@
 use std_shims::vec::Vec;
 
-use crate::primitives::keccak256;
+use crate::hash;
 
 pub(crate) fn merkle_root(root: [u8; 32], leafs: &[[u8; 32]]) -> [u8; 32] {
   match leafs.len() {
     0 => root,
-    1 => keccak256([root, leafs[0]].concat()),
+    1 => hash(&[root, leafs[0]].concat()),
     _ => {
       let mut hashes = Vec::with_capacity(1 + leafs.len());
       hashes.push(root);
@@ -29,7 +29,7 @@ pub(crate) fn merkle_root(root: [u8; 32], leafs: &[[u8; 32]]) -> [u8; 32] {
         let mut paired_hashes = Vec::with_capacity(overage);
         while let Some(left) = rightmost.next() {
           let right = rightmost.next().unwrap();
-          paired_hashes.push(keccak256([left.as_ref(), &right].concat()));
+          paired_hashes.push(hash(&[left.as_ref(), &right].concat()));
         }
         drop(rightmost);
 
@@ -42,7 +42,7 @@ pub(crate) fn merkle_root(root: [u8; 32], leafs: &[[u8; 32]]) -> [u8; 32] {
       while hashes.len() > 1 {
         let mut i = 0;
         while i < hashes.len() {
-          new_hashes.push(keccak256([hashes[i], hashes[i + 1]].concat()));
+          new_hashes.push(hash(&[hashes[i], hashes[i + 1]].concat()));
           i += 2;
         }
 

coins/monero/src/ring_signatures.rs

@@ -0,0 +1,72 @@
+use std_shims::{
+  io::{self, *},
+  vec::Vec,
+};
+
+use zeroize::Zeroize;
+
+use curve25519_dalek::{EdwardsPoint, Scalar};
+
+use monero_generators::hash_to_point;
+
+use crate::{serialize::*, hash_to_scalar};
+
+#[derive(Clone, PartialEq, Eq, Debug, Zeroize)]
+pub struct Signature {
+  c: Scalar,
+  r: Scalar,
+}
+
+impl Signature {
+  pub fn write<W: Write>(&self, w: &mut W) -> io::Result<()> {
+    write_scalar(&self.c, w)?;
+    write_scalar(&self.r, w)?;
+    Ok(())
+  }
+
+  pub fn read<R: Read>(r: &mut R) -> io::Result<Signature> {
+    Ok(Signature { c: read_scalar(r)?, r: read_scalar(r)? })
+  }
+}
+
+#[derive(Clone, PartialEq, Eq, Debug, Zeroize)]
+pub struct RingSignature {
+  sigs: Vec<Signature>,
+}
+
+impl RingSignature {
+  pub fn write<W: Write>(&self, w: &mut W) -> io::Result<()> {
+    for sig in &self.sigs {
+      sig.write(w)?;
+    }
+    Ok(())
+  }
+
+  pub fn read<R: Read>(members: usize, r: &mut R) -> io::Result<RingSignature> {
+    Ok(RingSignature { sigs: read_raw_vec(Signature::read, members, r)? })
+  }
+
+  pub fn verify(&self, msg: &[u8; 32], ring: &[EdwardsPoint], key_image: &EdwardsPoint) -> bool {
+    if ring.len() != self.sigs.len() {
+      return false;
+    }
+
+    let mut buf = Vec::with_capacity(32 + (32 * 2 * ring.len()));
+    buf.extend_from_slice(msg);
+
+    let mut sum = Scalar::ZERO;
+
+    for (ring_member, sig) in ring.iter().zip(&self.sigs) {
+      #[allow(non_snake_case)]
+      let Li = EdwardsPoint::vartime_double_scalar_mul_basepoint(&sig.c, ring_member, &sig.r);
+      buf.extend_from_slice(Li.compress().as_bytes());
+      #[allow(non_snake_case)]
+      let Ri = (sig.r * hash_to_point(ring_member.compress().to_bytes())) + (sig.c * key_image);
+      buf.extend_from_slice(Ri.compress().as_bytes());
+
+      sum += sig.c;
+    }
+
+    sum == hash_to_scalar(&buf)
+  }
+}

coins/monero/src/ringct/borromean.rs

@@ -1,35 +1,26 @@
-#![cfg_attr(docsrs, feature(doc_auto_cfg))]
-#![doc = include_str!("../README.md")]
-#![deny(missing_docs)]
-#![cfg_attr(not(feature = "std"), no_std)]
-#![allow(non_snake_case)]
-
 use core::fmt::Debug;
 use std_shims::io::{self, Read, Write};
 
-use zeroize::Zeroize;
-
 use curve25519_dalek::{traits::Identity, Scalar, EdwardsPoint};
 
-use monero_io::*;
 use monero_generators::H_pow_2;
-use monero_primitives::{keccak256_to_scalar, UnreducedScalar};
 
-// 64 Borromean ring signatures, as needed for a 64-bit range proof.
-//
-// s0 and s1 are stored as `UnreducedScalar`s due to Monero not requiring they were reduced.
-// `UnreducedScalar` preserves their original byte encoding and implements a custom reduction
-// algorithm which was in use.
-#[derive(Clone, PartialEq, Eq, Debug, Zeroize)]
-struct BorromeanSignatures {
-  s0: [UnreducedScalar; 64],
-  s1: [UnreducedScalar; 64],
-  ee: Scalar,
+use crate::{hash_to_scalar, unreduced_scalar::UnreducedScalar, serialize::*};
+
+/// 64 Borromean ring signatures.
+///
+/// s0 and s1 are stored as `UnreducedScalar`s due to Monero not requiring they were reduced.
+/// `UnreducedScalar` preserves their original byte encoding and implements a custom reduction
+/// algorithm which was in use.
+#[derive(Clone, PartialEq, Eq, Debug)]
+pub struct BorromeanSignatures {
+  pub s0: [UnreducedScalar; 64],
+  pub s1: [UnreducedScalar; 64],
+  pub ee: Scalar,
 }
 
 impl BorromeanSignatures {
-  // Read a set of BorromeanSignatures.
-  fn read<R: Read>(r: &mut R) -> io::Result<BorromeanSignatures> {
+  pub fn read<R: Read>(r: &mut R) -> io::Result<BorromeanSignatures> {
     Ok(BorromeanSignatures {
       s0: read_array(UnreducedScalar::read, r)?,
       s1: read_array(UnreducedScalar::read, r)?,
@@ -37,8 +28,7 @@ impl BorromeanSignatures {
     })
   }
 
-  // Write the set of BorromeanSignatures.
-  fn write<W: Write>(&self, w: &mut W) -> io::Result<()> {
+  pub fn write<W: Write>(&self, w: &mut W) -> io::Result<()> {
     for s0 in &self.s0 {
       s0.write(w)?;
     }
@@ -60,41 +50,36 @@ impl BorromeanSignatures {
       );
       #[allow(non_snake_case)]
       let LV = EdwardsPoint::vartime_double_scalar_mul_basepoint(
-        &keccak256_to_scalar(LL.compress().as_bytes()),
+        &hash_to_scalar(LL.compress().as_bytes()),
         &keys_b[i],
         &self.s1[i].recover_monero_slide_scalar(),
       );
       transcript[(i * 32) .. ((i + 1) * 32)].copy_from_slice(LV.compress().as_bytes());
     }
 
-    keccak256_to_scalar(transcript) == self.ee
+    hash_to_scalar(&transcript) == self.ee
   }
 }
 
 /// A range proof premised on Borromean ring signatures.
-#[derive(Clone, PartialEq, Eq, Debug, Zeroize)]
+#[derive(Clone, PartialEq, Eq, Debug)]
 pub struct BorromeanRange {
-  sigs: BorromeanSignatures,
-  bit_commitments: [EdwardsPoint; 64],
+  pub sigs: BorromeanSignatures,
+  pub bit_commitments: [EdwardsPoint; 64],
 }
 
 impl BorromeanRange {
-  /// Read a BorromeanRange proof.
   pub fn read<R: Read>(r: &mut R) -> io::Result<BorromeanRange> {
     Ok(BorromeanRange {
       sigs: BorromeanSignatures::read(r)?,
       bit_commitments: read_array(read_point, r)?,
     })
   }
-
-  /// Write the BorromeanRange proof.
   pub fn write<W: Write>(&self, w: &mut W) -> io::Result<()> {
     self.sigs.write(w)?;
     write_raw_vec(write_point, &self.bit_commitments, w)
   }
 
-  /// Verify the commitment contains a 64-bit value.
-  #[must_use]
   pub fn verify(&self, commitment: &EdwardsPoint) -> bool {
     if &self.bit_commitments.iter().sum::<EdwardsPoint>() != commitment {
       return false;

coins/monero/src/ringct/bulletproofs/core.rs

@@ -0,0 +1,151 @@
+use std_shims::{vec::Vec, sync::OnceLock};
+
+use rand_core::{RngCore, CryptoRng};
+
+use subtle::{Choice, ConditionallySelectable};
+
+use curve25519_dalek::edwards::EdwardsPoint as DalekPoint;
+
+use group::{ff::Field, Group};
+use dalek_ff_group::{Scalar, EdwardsPoint};
+
+use multiexp::multiexp as multiexp_const;
+
+pub(crate) use monero_generators::Generators;
+
+use crate::{INV_EIGHT as DALEK_INV_EIGHT, H as DALEK_H, Commitment, hash_to_scalar as dalek_hash};
+pub(crate) use crate::ringct::bulletproofs::scalar_vector::*;
+
+#[inline]
+pub(crate) fn INV_EIGHT() -> Scalar {
+  Scalar(DALEK_INV_EIGHT())
+}
+
+#[inline]
+pub(crate) fn H() -> EdwardsPoint {
+  EdwardsPoint(DALEK_H())
+}
+
+pub(crate) fn hash_to_scalar(data: &[u8]) -> Scalar {
+  Scalar(dalek_hash(data))
+}
+
+// Components common between variants
+pub(crate) const MAX_M: usize = 16;
+pub(crate) const LOG_N: usize = 6; // 2 << 6 == N
+pub(crate) const N: usize = 64;
+
+pub(crate) fn prove_multiexp(pairs: &[(Scalar, EdwardsPoint)]) -> EdwardsPoint {
+  multiexp_const(pairs) * INV_EIGHT()
+}
+
+pub(crate) fn vector_exponent(
+  generators: &Generators,
+  a: &ScalarVector,
+  b: &ScalarVector,
+) -> EdwardsPoint {
+  debug_assert_eq!(a.len(), b.len());
+  (a * &generators.G[.. a.len()]) + (b * &generators.H[.. b.len()])
+}
+
+pub(crate) fn hash_cache(cache: &mut Scalar, mash: &[[u8; 32]]) -> Scalar {
+  let slice =
+    &[cache.to_bytes().as_ref(), mash.iter().copied().flatten().collect::<Vec<_>>().as_ref()]
+      .concat();
+  *cache = hash_to_scalar(slice);
+  *cache
+}
+
+pub(crate) fn MN(outputs: usize) -> (usize, usize, usize) {
+  let mut logM = 0;
+  let mut M;
+  while {
+    M = 1 << logM;
+    (M <= MAX_M) && (M < outputs)
+  } {
+    logM += 1;
+  }
+
+  (logM + LOG_N, M, M * N)
+}
+
+pub(crate) fn bit_decompose(commitments: &[Commitment]) -> (ScalarVector, ScalarVector) {
+  let (_, M, MN) = MN(commitments.len());
+
+  let sv = commitments.iter().map(|c| Scalar::from(c.amount)).collect::<Vec<_>>();
+  let mut aL = ScalarVector::new(MN);
+  let mut aR = ScalarVector::new(MN);
+
+  for j in 0 .. M {
+    for i in (0 .. N).rev() {
+      let bit =
+        if j < sv.len() { Choice::from((sv[j][i / 8] >> (i % 8)) & 1) } else { Choice::from(0) };
+      aL.0[(j * N) + i] = Scalar::conditional_select(&Scalar::ZERO, &Scalar::ONE, bit);
+      aR.0[(j * N) + i] = Scalar::conditional_select(&-Scalar::ONE, &Scalar::ZERO, bit);
+    }
+  }
+
+  (aL, aR)
+}
+
+pub(crate) fn hash_commitments<C: IntoIterator<Item = DalekPoint>>(
+  commitments: C,
+) -> (Scalar, Vec<EdwardsPoint>) {
+  let V = commitments.into_iter().map(|c| EdwardsPoint(c) * INV_EIGHT()).collect::<Vec<_>>();
+  (hash_to_scalar(&V.iter().flat_map(|V| V.compress().to_bytes()).collect::<Vec<_>>()), V)
+}
+
+pub(crate) fn alpha_rho<R: RngCore + CryptoRng>(
+  rng: &mut R,
+  generators: &Generators,
+  aL: &ScalarVector,
+  aR: &ScalarVector,
+) -> (Scalar, EdwardsPoint) {
+  let ar = Scalar::random(rng);
+  (ar, (vector_exponent(generators, aL, aR) + (EdwardsPoint::generator() * ar)) * INV_EIGHT())
+}
+
+pub(crate) fn LR_statements(
+  a: &ScalarVector,
+  G_i: &[EdwardsPoint],
+  b: &ScalarVector,
+  H_i: &[EdwardsPoint],
+  cL: Scalar,
+  U: EdwardsPoint,
+) -> Vec<(Scalar, EdwardsPoint)> {
+  let mut res = a
+    .0
+    .iter()
+    .copied()
+    .zip(G_i.iter().copied())
+    .chain(b.0.iter().copied().zip(H_i.iter().copied()))
+    .collect::<Vec<_>>();
+  res.push((cL, U));
+  res
+}
+
+static TWO_N_CELL: OnceLock<ScalarVector> = OnceLock::new();
+pub(crate) fn TWO_N() -> &'static ScalarVector {
+  TWO_N_CELL.get_or_init(|| ScalarVector::powers(Scalar::from(2u8), N))
+}
+
+pub(crate) fn challenge_products(w: &[Scalar], winv: &[Scalar]) -> Vec<Scalar> {
+  let mut products = vec![Scalar::ZERO; 1 << w.len()];
+  products[0] = winv[0];
+  products[1] = w[0];
+  for j in 1 .. w.len() {
+    let mut slots = (1 << (j + 1)) - 1;
+    while slots > 0 {
+      products[slots] = products[slots / 2] * w[j];
+      products[slots - 1] = products[slots / 2] * winv[j];
+      slots = slots.saturating_sub(2);
+    }
+  }
+
+  // Sanity check as if the above failed to populate, it'd be critical
+  for w in &products {
+    debug_assert!(!bool::from(w.is_zero()));
+  }
+
+  products
+}

coins/monero/src/ringct/bulletproofs/mod.rs

@@ -0,0 +1,229 @@
+#![allow(non_snake_case)]
+
+use std_shims::{
+  vec::Vec,
+  io::{self, Read, Write},
+};
+
+use rand_core::{RngCore, CryptoRng};
+
+use zeroize::{Zeroize, Zeroizing};
+
+use curve25519_dalek::edwards::EdwardsPoint;
+use multiexp::BatchVerifier;
+
+use crate::{Commitment, wallet::TransactionError, serialize::*};
+
+pub(crate) mod scalar_vector;
+pub(crate) mod core;
+use self::core::LOG_N;
+
+pub(crate) mod original;
+use self::original::OriginalStruct;
+
+pub(crate) mod plus;
+use self::plus::*;
+
+pub(crate) const MAX_OUTPUTS: usize = self::core::MAX_M;
+
+/// Bulletproofs enum, supporting the original and plus formulations.
+#[allow(clippy::large_enum_variant)]
+#[derive(Clone, PartialEq, Eq, Debug)]
+pub enum Bulletproofs {
+  Original(OriginalStruct),
+  Plus(AggregateRangeProof),
+}
+
+impl Bulletproofs {
+  fn bp_fields(plus: bool) -> usize {
+    if plus {
+      6
+    } else {
+      9
+    }
+  }
+
+  // https://github.com/monero-project/monero/blob/94e67bf96bbc010241f29ada6abc89f49a81759c/
+  //   src/cryptonote_basic/cryptonote_format_utils.cpp#L106-L124
+  pub(crate) fn calculate_bp_clawback(plus: bool, n_outputs: usize) -> (usize, usize) {
+    #[allow(non_snake_case)]
+    let mut LR_len = 0;
+    let mut n_padded_outputs = 1;
+    while n_padded_outputs < n_outputs {
+      LR_len += 1;
+      n_padded_outputs = 1 << LR_len;
+    }
+    LR_len += LOG_N;
+
+    let mut bp_clawback = 0;
+    if n_padded_outputs > 2 {
+      let fields = Bulletproofs::bp_fields(plus);
+      let base = ((fields + (2 * (LOG_N + 1))) * 32) / 2;
+      let size = (fields + (2 * LR_len)) * 32;
+      bp_clawback = ((base * n_padded_outputs) - size) * 4 / 5;
+    }
+
+    (bp_clawback, LR_len)
+  }
+
+  pub(crate) fn fee_weight(plus: bool, outputs: usize) -> usize {
+    #[allow(non_snake_case)]
+    let (bp_clawback, LR_len) = Bulletproofs::calculate_bp_clawback(plus, outputs);
+    32 * (Bulletproofs::bp_fields(plus) + (2 * LR_len)) + 2 + bp_clawback
+  }
+
+  /// Prove the list of commitments are within [0 .. 2^64).
+  pub fn prove<R: RngCore + CryptoRng>(
+    rng: &mut R,
+    outputs: &[Commitment],
+    plus: bool,
+  ) -> Result<Bulletproofs, TransactionError> {
+    if outputs.is_empty() {
+      Err(TransactionError::NoOutputs)?;
+    }
+    if outputs.len() > MAX_OUTPUTS {
+      Err(TransactionError::TooManyOutputs)?;
+    }
+    Ok(if !plus {
+      Bulletproofs::Original(OriginalStruct::prove(rng, outputs))
+    } else {
+      use dalek_ff_group::EdwardsPoint as DfgPoint;
+      Bulletproofs::Plus(
+        AggregateRangeStatement::new(outputs.iter().map(|com| DfgPoint(com.calculate())).collect())
+          .unwrap()
+          .prove(rng, &Zeroizing::new(AggregateRangeWitness::new(outputs).unwrap()))
+          .unwrap(),
+      )
+    })
+  }
+
+  /// Verify the given Bulletproofs.
+  #[must_use]
+  pub fn verify<R: RngCore + CryptoRng>(&self, rng: &mut R, commitments: &[EdwardsPoint]) -> bool {
+    match self {
+      Bulletproofs::Original(bp) => bp.verify(rng, commitments),
+      Bulletproofs::Plus(bp) => {
+        let mut verifier = BatchVerifier::new(1);
+        // If this commitment is torsioned (which is allowed), this won't be a well-formed
+        // dfg::EdwardsPoint (expected to be of prime-order)
+        // The actual BP+ impl will perform a torsion clear though, making this safe
+        // TODO: Have AggregateRangeStatement take in dalek EdwardsPoint for clarity on this
+        let Some(statement) = AggregateRangeStatement::new(
+          commitments.iter().map(|c| dalek_ff_group::EdwardsPoint(*c)).collect(),
+        ) else {
+          return false;
+        };
+        if !statement.verify(rng, &mut verifier, (), bp.clone()) {
+          return false;
+        }
+        verifier.verify_vartime()
+      }
+    }
+  }
+
+  /// Accumulate the verification for the given Bulletproofs into the specified BatchVerifier.
+  /// Returns false if the Bulletproofs aren't sane, without mutating the BatchVerifier.
+  /// Returns true if the Bulletproofs are sane, regardless of their validity.
+  #[must_use]
+  pub fn batch_verify<ID: Copy + Zeroize, R: RngCore + CryptoRng>(
+    &self,
+    rng: &mut R,
+    verifier: &mut BatchVerifier<ID, dalek_ff_group::EdwardsPoint>,
+    id: ID,
+    commitments: &[EdwardsPoint],
+  ) -> bool {
+    match self {
+      Bulletproofs::Original(bp) => bp.batch_verify(rng, verifier, id, commitments),
+      Bulletproofs::Plus(bp) => {
+        let Some(statement) = AggregateRangeStatement::new(
+          commitments.iter().map(|c| dalek_ff_group::EdwardsPoint(*c)).collect(),
+        ) else {
+          return false;
+        };
+        statement.verify(rng, verifier, id, bp.clone())
+      }
+    }
+  }
+
+  fn write_core<W: Write, F: Fn(&[EdwardsPoint], &mut W) -> io::Result<()>>(
+    &self,
+    w: &mut W,
+    specific_write_vec: F,
+  ) -> io::Result<()> {
+    match self {
+      Bulletproofs::Original(bp) => {
+        write_point(&bp.A, w)?;
+        write_point(&bp.S, w)?;
+        write_point(&bp.T1, w)?;
+        write_point(&bp.T2, w)?;
+        write_scalar(&bp.taux, w)?;
+        write_scalar(&bp.mu, w)?;
+        specific_write_vec(&bp.L, w)?;
+        specific_write_vec(&bp.R, w)?;
+        write_scalar(&bp.a, w)?;
+        write_scalar(&bp.b, w)?;
+        write_scalar(&bp.t, w)
+      }
+
+      Bulletproofs::Plus(bp) => {
+        write_point(&bp.A.0, w)?;
+        write_point(&bp.wip.A.0, w)?;
+        write_point(&bp.wip.B.0, w)?;
+        write_scalar(&bp.wip.r_answer.0, w)?;
+        write_scalar(&bp.wip.s_answer.0, w)?;
+        write_scalar(&bp.wip.delta_answer.0, w)?;
+        specific_write_vec(&bp.wip.L.iter().copied().map(|L| L.0).collect::<Vec<_>>(), w)?;
+        specific_write_vec(&bp.wip.R.iter().copied().map(|R| R.0).collect::<Vec<_>>(), w)
+      }
+    }
+  }
+
+  pub(crate) fn signature_write<W: Write>(&self, w: &mut W) -> io::Result<()> {
+    self.write_core(w, |points, w| write_raw_vec(write_point, points, w))
+  }
+
+  pub fn write<W: Write>(&self, w: &mut W) -> io::Result<()> {
+    self.write_core(w, |points, w| write_vec(write_point, points, w))
+  }
+
+  pub fn serialize(&self) -> Vec<u8> {
+    let mut serialized = vec![];
+    self.write(&mut serialized).unwrap();
+    serialized
+  }
+
+  /// Read Bulletproofs.
+  pub fn read<R: Read>(r: &mut R) -> io::Result<Bulletproofs> {
+    Ok(Bulletproofs::Original(OriginalStruct {
+      A: read_point(r)?,
+      S: read_point(r)?,
+      T1: read_point(r)?,
+      T2: read_point(r)?,
+      taux: read_scalar(r)?,
+      mu: read_scalar(r)?,
+      L: read_vec(read_point, r)?,
+      R: read_vec(read_point, r)?,
+      a: read_scalar(r)?,
+      b: read_scalar(r)?,
+      t: read_scalar(r)?,
+    }))
+  }
+
+  /// Read Bulletproofs+.
+  pub fn read_plus<R: Read>(r: &mut R) -> io::Result<Bulletproofs> {
+    use dalek_ff_group::{Scalar as DfgScalar, EdwardsPoint as DfgPoint};
+
+    Ok(Bulletproofs::Plus(AggregateRangeProof {
+      A: DfgPoint(read_point(r)?),
+      wip: WipProof {
+        A: DfgPoint(read_point(r)?),
+        B: DfgPoint(read_point(r)?),
+        r_answer: DfgScalar(read_scalar(r)?),
+        s_answer: DfgScalar(read_scalar(r)?),
+        delta_answer: DfgScalar(read_scalar(r)?),
+        L: read_vec(read_point, r)?.into_iter().map(DfgPoint).collect(),
+        R: read_vec(read_point, r)?.into_iter().map(DfgPoint).collect(),
+      },
+    }))
+  }
+}

coins/monero/src/ringct/bulletproofs/original.rs

@@ -0,0 +1,309 @@
+use std_shims::{vec::Vec, sync::OnceLock};
+
+use rand_core::{RngCore, CryptoRng};
+
+use zeroize::Zeroize;
+
+use curve25519_dalek::{scalar::Scalar as DalekScalar, edwards::EdwardsPoint as DalekPoint};
+
+use group::{ff::Field, Group};
+use dalek_ff_group::{ED25519_BASEPOINT_POINT as G, Scalar, EdwardsPoint};
+
+use multiexp::BatchVerifier;
+
+use crate::{Commitment, ringct::bulletproofs::core::*};
+
+include!(concat!(env!("OUT_DIR"), "/generators.rs"));
+
+static IP12_CELL: OnceLock<Scalar> = OnceLock::new();
+pub(crate) fn IP12() -> Scalar {
+  *IP12_CELL.get_or_init(|| inner_product(&ScalarVector(vec![Scalar::ONE; N]), TWO_N()))
+}
+
+#[derive(Clone, PartialEq, Eq, Debug)]
+pub struct OriginalStruct {
+  pub(crate) A: DalekPoint,
+  pub(crate) S: DalekPoint,
+  pub(crate) T1: DalekPoint,
+  pub(crate) T2: DalekPoint,
+  pub(crate) taux: DalekScalar,
+  pub(crate) mu: DalekScalar,
+  pub(crate) L: Vec<DalekPoint>,
+  pub(crate) R: Vec<DalekPoint>,
+  pub(crate) a: DalekScalar,
+  pub(crate) b: DalekScalar,
+  pub(crate) t: DalekScalar,
+}
+
+impl OriginalStruct {
+  pub(crate) fn prove<R: RngCore + CryptoRng>(
+    rng: &mut R,
+    commitments: &[Commitment],
+  ) -> OriginalStruct {
+    let (logMN, M, MN) = MN(commitments.len());
+
+    let (aL, aR) = bit_decompose(commitments);
+    let commitments_points = commitments.iter().map(Commitment::calculate).collect::<Vec<_>>();
+    let (mut cache, _) = hash_commitments(commitments_points.clone());
+
+    let (sL, sR) =
+      ScalarVector((0 .. (MN * 2)).map(|_| Scalar::random(&mut *rng)).collect::<Vec<_>>()).split();
+
+    let generators = GENERATORS();
+    let (mut alpha, A) = alpha_rho(&mut *rng, generators, &aL, &aR);
+    let (mut rho, S) = alpha_rho(&mut *rng, generators, &sL, &sR);
+
+    let y = hash_cache(&mut cache, &[A.compress().to_bytes(), S.compress().to_bytes()]);
+    let mut cache = hash_to_scalar(&y.to_bytes());
+    let z = cache;
+
+    let l0 = &aL - z;
+    let l1 = sL;
+
+    let mut zero_twos = Vec::with_capacity(MN);
+    let zpow = ScalarVector::powers(z, M + 2);
+    for j in 0 .. M {
+      for i in 0 .. N {
+        zero_twos.push(zpow[j + 2] * TWO_N()[i]);
+      }
+    }
+
+    let yMN = ScalarVector::powers(y, MN);
+    let r0 = (&(aR + z) * &yMN) + ScalarVector(zero_twos);
+    let r1 = yMN * sR;
+
+    let (T1, T2, x, mut taux) = {
+      let t1 = inner_product(&l0, &r1) + inner_product(&l1, &r0);
+      let t2 = inner_product(&l1, &r1);
+
+      let mut tau1 = Scalar::random(&mut *rng);
+      let mut tau2 = Scalar::random(&mut *rng);
+
+      let T1 = prove_multiexp(&[(t1, H()), (tau1, EdwardsPoint::generator())]);
+      let T2 = prove_multiexp(&[(t2, H()), (tau2, EdwardsPoint::generator())]);
+
+      let x =
+        hash_cache(&mut cache, &[z.to_bytes(), T1.compress().to_bytes(), T2.compress().to_bytes()]);
+
+      let taux = (tau2 * (x * x)) + (tau1 * x);
+
+      tau1.zeroize();
+      tau2.zeroize();
+      (T1, T2, x, taux)
+    };
+
+    let mu = (x * rho) + alpha;
+    alpha.zeroize();
+    rho.zeroize();
+
+    for (i, gamma) in commitments.iter().map(|c| Scalar(c.mask)).enumerate() {
+      taux += zpow[i + 2] * gamma;
+    }
+
+    let l = &l0 + &(l1 * x);
+    let r = &r0 + &(r1 * x);
+
+    let t = inner_product(&l, &r);
+
+    let x_ip =
+      hash_cache(&mut cache, &[x.to_bytes(), taux.to_bytes(), mu.to_bytes(), t.to_bytes()]);
+
+    let mut a = l;
+    let mut b = r;
+
+    let yinv = y.invert().unwrap();
+    let yinvpow = ScalarVector::powers(yinv, MN);
+
+    let mut G_proof = generators.G[.. a.len()].to_vec();
+    let mut H_proof = generators.H[.. a.len()].to_vec();
+    H_proof.iter_mut().zip(yinvpow.0.iter()).for_each(|(this_H, yinvpow)| *this_H *= yinvpow);
+    let U = H() * x_ip;
+
+    let mut L = Vec::with_capacity(logMN);
+    let mut R = Vec::with_capacity(logMN);
+
+    while a.len() != 1 {
+      let (aL, aR) = a.split();
+      let (bL, bR) = b.split();
+
+      let cL = inner_product(&aL, &bR);
+      let cR = inner_product(&aR, &bL);
+
+      let (G_L, G_R) = G_proof.split_at(aL.len());
+      let (H_L, H_R) = H_proof.split_at(aL.len());
+
+      let L_i = prove_multiexp(&LR_statements(&aL, G_R, &bR, H_L, cL, U));
+      let R_i = prove_multiexp(&LR_statements(&aR, G_L, &bL, H_R, cR, U));
+      L.push(L_i);
+      R.push(R_i);
+
+      let w = hash_cache(&mut cache, &[L_i.compress().to_bytes(), R_i.compress().to_bytes()]);
+      let winv = w.invert().unwrap();
+
+      a = (aL * w) + (aR * winv);
+      b = (bL * winv) + (bR * w);
+
+      if a.len() != 1 {
+        G_proof = hadamard_fold(G_L, G_R, winv, w);
+        H_proof = hadamard_fold(H_L, H_R, w, winv);
+      }
+    }
+
+    let res = OriginalStruct {
+      A: *A,
+      S: *S,
+      T1: *T1,
+      T2: *T2,
+      taux: *taux,
+      mu: *mu,
+      L: L.drain(..).map(|L| *L).collect(),
+      R: R.drain(..).map(|R| *R).collect(),
+      a: *a[0],
+      b: *b[0],
+      t: *t,
+    };
+    debug_assert!(res.verify(rng, &commitments_points));
+    res
+  }
+
+  #[must_use]
+  fn verify_core<ID: Copy + Zeroize, R: RngCore + CryptoRng>(
+    &self,
+    rng: &mut R,
+    verifier: &mut BatchVerifier<ID, EdwardsPoint>,
+    id: ID,
+    commitments: &[DalekPoint],
+  ) -> bool {
+    // Verify commitments are valid
+    if commitments.is_empty() || (commitments.len() > MAX_M) {
+      return false;
+    }
+
+    // Verify L and R are properly sized
+    if self.L.len() != self.R.len() {
+      return false;
+    }
+
+    let (logMN, M, MN) = MN(commitments.len());
+    if self.L.len() != logMN {
+      return false;
+    }
+
+    // Rebuild all challenges
+    let (mut cache, commitments) = hash_commitments(commitments.iter().copied());
+    let y = hash_cache(&mut cache, &[self.A.compress().to_bytes(), self.S.compress().to_bytes()]);
+
+    let z = hash_to_scalar(&y.to_bytes());
+    cache = z;
+
+    let x = hash_cache(
+      &mut cache,
+      &[z.to_bytes(), self.T1.compress().to_bytes(), self.T2.compress().to_bytes()],
+    );
+
+    let x_ip = hash_cache(
+      &mut cache,
+      &[x.to_bytes(), self.taux.to_bytes(), self.mu.to_bytes(), self.t.to_bytes()],
+    );
+
+    let mut w = Vec::with_capacity(logMN);
+    let mut winv = Vec::with_capacity(logMN);
+    for (L, R) in self.L.iter().zip(&self.R) {
+      w.push(hash_cache(&mut cache, &[L.compress().to_bytes(), R.compress().to_bytes()]));
+      winv.push(cache.invert().unwrap());
+    }
+
+    // Convert the proof from * INV_EIGHT to its actual form
+    let normalize = |point: &DalekPoint| EdwardsPoint(point.mul_by_cofactor());
+
+    let L = self.L.iter().map(normalize).collect::<Vec<_>>();
+    let R = self.R.iter().map(normalize).collect::<Vec<_>>();
+    let T1 = normalize(&self.T1);
+    let T2 = normalize(&self.T2);
+    let A = normalize(&self.A);
+    let S = normalize(&self.S);
+
+    let commitments = commitments.iter().map(EdwardsPoint::mul_by_cofactor).collect::<Vec<_>>();
+
+    // Verify it
+    let mut proof = Vec::with_capacity(4 + commitments.len());
+
+    let zpow = ScalarVector::powers(z, M + 3);
+    let ip1y = ScalarVector::powers(y, M * N).sum();
+    let mut k = -(zpow[2] * ip1y);
+    for j in 1 ..= M {
+      k -= zpow[j + 2] * IP12();
+    }
+    let y1 = Scalar(self.t) - ((z * ip1y) + k);
+    proof.push((-y1, H()));
+
+    proof.push((-Scalar(self.taux), G));
+
+    for (j, commitment) in commitments.iter().enumerate() {
+      proof.push((zpow[j + 2], *commitment));
+    }
+
+    proof.push((x, T1));
+    proof.push((x * x, T2));
+    verifier.queue(&mut *rng, id, proof);
+
+    proof = Vec::with_capacity(4 + (2 * (MN + logMN)));
+    let z3 = (Scalar(self.t) - (Scalar(self.a) * Scalar(self.b))) * x_ip;
+    proof.push((z3, H()));
+    proof.push((-Scalar(self.mu), G));
+
+    proof.push((Scalar::ONE, A));
+    proof.push((x, S));
+
+    {
+      let ypow = ScalarVector::powers(y, MN);
+      let yinv = y.invert().unwrap();
+      let yinvpow = ScalarVector::powers(yinv, MN);
+
+      let w_cache = challenge_products(&w, &winv);
+
+      let generators = GENERATORS();
+      for i in 0 .. MN {
+        let g = (Scalar(self.a) * w_cache[i]) + z;
+        proof.push((-g, generators.G[i]));
+
+        let mut h = Scalar(self.b) * yinvpow[i] * w_cache[(!i) & (MN - 1)];
+        h -= ((zpow[(i / N) + 2] * TWO_N()[i % N]) + (z * ypow[i])) * yinvpow[i];
+        proof.push((-h, generators.H[i]));
+      }
+    }
+
+    for i in 0 .. logMN {
+      proof.push((w[i] * w[i], L[i]));
+      proof.push((winv[i] * winv[i], R[i]));
+    }
+    verifier.queue(rng, id, proof);
+
+    true
+  }
+
+  #[must_use]
+  pub(crate) fn verify<R: RngCore + CryptoRng>(
+    &self,
+    rng: &mut R,
+    commitments: &[DalekPoint],
+  ) -> bool {
+    let mut verifier = BatchVerifier::new(1);
+    if self.verify_core(rng, &mut verifier, (), commitments) {
+      verifier.verify_vartime()
+    } else {
+      false
+    }
+  }
+
+  #[must_use]
+  pub(crate) fn batch_verify<ID: Copy + Zeroize, R: RngCore + CryptoRng>(
+    &self,
+    rng: &mut R,
+    verifier: &mut BatchVerifier<ID, EdwardsPoint>,
+    id: ID,
+    commitments: &[DalekPoint],
+  ) -> bool {
+    self.verify_core(rng, verifier, id, commitments)
+  }
+}

coins/monero/src/ringct/bulletproofs/plus/aggregate_range_proof.rs

@@ -1,85 +1,93 @@
-use std_shims::{vec, vec::Vec};
+use std_shims::vec::Vec;
 
 use rand_core::{RngCore, CryptoRng};
+
 use zeroize::{Zeroize, ZeroizeOnDrop, Zeroizing};
 
-use curve25519_dalek::{traits::Identity, scalar::Scalar, edwards::EdwardsPoint};
-
-use monero_primitives::{INV_EIGHT, Commitment, keccak256_to_scalar};
+use multiexp::{multiexp, multiexp_vartime, BatchVerifier};
+use group::{
+  ff::{Field, PrimeField},
+  Group, GroupEncoding,
+};
+use dalek_ff_group::{Scalar, EdwardsPoint};
 
 use crate::{
-  batch_verifier::BulletproofsPlusBatchVerifier,
-  core::{MAX_COMMITMENTS, COMMITMENT_BITS, multiexp, multiexp_vartime},
-  plus::{
-    ScalarVector, PointVector, GeneratorsList, BpPlusGenerators,
-    transcript::*,
-    weighted_inner_product::{WipStatement, WipWitness, WipProof},
-    padded_pow_of_2, u64_decompose,
+  Commitment,
+  ringct::{
+    bulletproofs::core::{MAX_M, N},
+    bulletproofs::plus::{
+      ScalarVector, PointVector, GeneratorsList, Generators,
+      transcript::*,
+      weighted_inner_product::{WipStatement, WipWitness, WipProof},
+      padded_pow_of_2, u64_decompose,
+    },
   },
 };
 
-// Figure 3 of the Bulletproofs+ Paper
+// Figure 3
 #[derive(Clone, Debug)]
-pub(crate) struct AggregateRangeStatement<'a> {
-  generators: BpPlusGenerators,
-  V: &'a [EdwardsPoint],
+pub(crate) struct AggregateRangeStatement {
+  generators: Generators,
+  V: Vec<EdwardsPoint>,
 }
 
-#[derive(Clone, Debug, Zeroize, ZeroizeOnDrop)]
-pub(crate) struct AggregateRangeWitness(Vec<Commitment>);
-
-impl AggregateRangeWitness {
-  pub(crate) fn new(commitments: Vec<Commitment>) -> Option<Self> {
-    if commitments.is_empty() || (commitments.len() > MAX_COMMITMENTS) {
-      return None;
-    }
-
-    Some(AggregateRangeWitness(commitments))
+impl Zeroize for AggregateRangeStatement {
+  fn zeroize(&mut self) {
+    self.V.zeroize();
+  }
+}
+
+#[derive(Clone, Debug, Zeroize, ZeroizeOnDrop)]
+pub(crate) struct AggregateRangeWitness {
+  values: Vec<u64>,
+  gammas: Vec<Scalar>,
+}
+
+impl AggregateRangeWitness {
+  pub(crate) fn new(commitments: &[Commitment]) -> Option<Self> {
+    if commitments.is_empty() || (commitments.len() > MAX_M) {
+      return None;
+    }
+
+    let mut values = Vec::with_capacity(commitments.len());
+    let mut gammas = Vec::with_capacity(commitments.len());
+    for commitment in commitments {
+      values.push(commitment.amount);
+      gammas.push(Scalar(commitment.mask));
+    }
+    Some(AggregateRangeWitness { values, gammas })
   }
 }
 
-/// Internal structure representing a Bulletproof+, as defined by Monero..
-#[doc(hidden)]
 #[derive(Clone, PartialEq, Eq, Debug, Zeroize)]
 pub struct AggregateRangeProof {
   pub(crate) A: EdwardsPoint,
   pub(crate) wip: WipProof,
 }
 
-struct AHatComputation {
-  y: Scalar,
-  d_descending_y_plus_z: ScalarVector,
-  y_mn_plus_one: Scalar,
-  z: Scalar,
-  z_pow: ScalarVector,
-  A_hat: EdwardsPoint,
-}
-
-impl<'a> AggregateRangeStatement<'a> {
-  pub(crate) fn new(V: &'a [EdwardsPoint]) -> Option<Self> {
-    if V.is_empty() || (V.len() > MAX_COMMITMENTS) {
+impl AggregateRangeStatement {
+  pub(crate) fn new(V: Vec<EdwardsPoint>) -> Option<Self> {
+    if V.is_empty() || (V.len() > MAX_M) {
       return None;
     }
 
-    Some(Self { generators: BpPlusGenerators::new(), V })
+    Some(Self { generators: Generators::new(), V })
   }
 
   fn transcript_A(transcript: &mut Scalar, A: EdwardsPoint) -> (Scalar, Scalar) {
-    let y = keccak256_to_scalar(
-      [transcript.to_bytes().as_ref(), A.compress().to_bytes().as_ref()].concat(),
-    );
-    let z = keccak256_to_scalar(y.to_bytes().as_ref());
+    let y = hash_to_scalar(&[transcript.to_repr().as_ref(), A.to_bytes().as_ref()].concat());
+    let z = hash_to_scalar(y.to_bytes().as_ref());
     *transcript = z;
     (y, z)
   }
 
   fn d_j(j: usize, m: usize) -> ScalarVector {
-    let mut d_j = Vec::with_capacity(m * COMMITMENT_BITS);
-    for _ in 0 .. (j - 1) * COMMITMENT_BITS {
+    let mut d_j = Vec::with_capacity(m * N);
+    for _ in 0 .. (j - 1) * N {
       d_j.push(Scalar::ZERO);
     }
-    d_j.append(&mut ScalarVector::powers(Scalar::from(2u8), COMMITMENT_BITS).0);
-    for _ in 0 .. (m - j) * COMMITMENT_BITS {
+    d_j.append(&mut ScalarVector::powers(Scalar::from(2u8), N).0);
+    for _ in 0 .. (m - j) * N {
       d_j.push(Scalar::ZERO);
     }
     ScalarVector(d_j)
@@ -87,27 +95,24 @@ impl<'a> AggregateRangeStatement<'a> {
 
   fn compute_A_hat(
     mut V: PointVector,
-    generators: &BpPlusGenerators,
+    generators: &Generators,
     transcript: &mut Scalar,
     mut A: EdwardsPoint,
-  ) -> AHatComputation {
+  ) -> (Scalar, ScalarVector, Scalar, Scalar, ScalarVector, EdwardsPoint) {
     let (y, z) = Self::transcript_A(transcript, A);
     A = A.mul_by_cofactor();
 
     while V.len() < padded_pow_of_2(V.len()) {
       V.0.push(EdwardsPoint::identity());
     }
-    let mn = V.len() * COMMITMENT_BITS;
+    let mn = V.len() * N;
 
-    // 2, 4, 6, 8... powers of z, of length equivalent to the amount of commitments
     let mut z_pow = Vec::with_capacity(V.len());
-    // z**2
-    z_pow.push(z * z);
 
     let mut d = ScalarVector::new(mn);
     for j in 1 ..= V.len() {
-      z_pow.push(*z_pow.last().unwrap() * z_pow[0]);
-      d = d + &(Self::d_j(j, V.len()) * (z_pow[j - 1]));
+      z_pow.push(z.pow(Scalar::from(2 * u64::try_from(j).unwrap()))); // TODO: Optimize this
+      d = d.add_vec(&Self::d_j(j, V.len()).mul(z_pow[j - 1]));
     }
 
     let mut ascending_y = ScalarVector(vec![y]);
@@ -119,8 +124,7 @@ impl<'a> AggregateRangeStatement<'a> {
     let mut descending_y = ascending_y.clone();
     descending_y.0.reverse();
 
-    let d_descending_y = d.clone() * &descending_y;
-    let d_descending_y_plus_z = d_descending_y + z;
+    let d_descending_y = d.mul_vec(&descending_y);
 
     let y_mn_plus_one = descending_y[0] * y;
 
@@ -131,24 +135,17 @@ impl<'a> AggregateRangeStatement<'a> {
 
     let neg_z = -z;
     let mut A_terms = Vec::with_capacity((generators.len() * 2) + 2);
-    for (i, d_y_z) in d_descending_y_plus_z.0.iter().enumerate() {
-      A_terms.push((neg_z, generators.generator(GeneratorsList::GBold, i)));
-      A_terms.push((*d_y_z, generators.generator(GeneratorsList::HBold, i)));
+    for (i, d_y_z) in d_descending_y.add(z).0.drain(..).enumerate() {
+      A_terms.push((neg_z, generators.generator(GeneratorsList::GBold1, i)));
+      A_terms.push((d_y_z, generators.generator(GeneratorsList::HBold1, i)));
     }
     A_terms.push((y_mn_plus_one, commitment_accum));
     A_terms.push((
-      ((y_pows * z) - (d.sum() * y_mn_plus_one * z) - (y_pows * (z * z))),
-      BpPlusGenerators::g(),
+      ((y_pows * z) - (d.sum() * y_mn_plus_one * z) - (y_pows * z.square())),
+      Generators::g(),
     ));
 
-    AHatComputation {
-      y,
-      d_descending_y_plus_z,
-      y_mn_plus_one,
-      z,
-      z_pow: ScalarVector(z_pow),
-      A_hat: A + multiexp_vartime(&A_terms),
-    }
+    (y, d_descending_y, y_mn_plus_one, z, ScalarVector(z_pow), A + multiexp_vartime(&A_terms))
   }
 
   pub(crate) fn prove<R: RngCore + CryptoRng>(
@@ -157,11 +154,13 @@ impl<'a> AggregateRangeStatement<'a> {
     witness: &AggregateRangeWitness,
   ) -> Option<AggregateRangeProof> {
     // Check for consistency with the witness
-    if self.V.len() != witness.0.len() {
+    if self.V.len() != witness.values.len() {
       return None;
     }
-    for (commitment, witness) in self.V.iter().zip(witness.0.iter()) {
-      if witness.calculate() != *commitment {
+    for (commitment, (value, gamma)) in
+      self.V.iter().zip(witness.values.iter().zip(witness.gammas.iter()))
+    {
+      if Commitment::new(**gamma, *value).calculate() != **commitment {
         return None;
       }
     }
@@ -174,56 +173,50 @@ impl<'a> AggregateRangeStatement<'a> {
     // Commitments aren't transmitted INV_EIGHT though, so this multiplies by INV_EIGHT to enable
     // clearing its cofactor without mutating the value
     // For some reason, these values are transcripted * INV_EIGHT, not as transmitted
-    let V = V.iter().map(|V| V * INV_EIGHT()).collect::<Vec<_>>();
+    let mut V = V.into_iter().map(|V| EdwardsPoint(V.0 * crate::INV_EIGHT())).collect::<Vec<_>>();
     let mut transcript = initial_transcript(V.iter());
-    let mut V = V.iter().map(EdwardsPoint::mul_by_cofactor).collect::<Vec<_>>();
+    V.iter_mut().for_each(|V| *V = V.mul_by_cofactor());
 
     // Pad V
     while V.len() < padded_pow_of_2(V.len()) {
       V.push(EdwardsPoint::identity());
     }
 
-    let generators = generators.reduce(V.len() * COMMITMENT_BITS);
+    let generators = generators.reduce(V.len() * N);
 
     let mut d_js = Vec::with_capacity(V.len());
-    let mut a_l = ScalarVector(Vec::with_capacity(V.len() * COMMITMENT_BITS));
+    let mut a_l = ScalarVector(Vec::with_capacity(V.len() * N));
     for j in 1 ..= V.len() {
       d_js.push(Self::d_j(j, V.len()));
-      #[allow(clippy::map_unwrap_or)]
-      a_l.0.append(
-        &mut u64_decompose(
-          *witness.0.get(j - 1).map(|commitment| &commitment.amount).unwrap_or(&0),
-        )
-        .0,
-      );
+      a_l.0.append(&mut u64_decompose(*witness.values.get(j - 1).unwrap_or(&0)).0);
     }
 
-    let a_r = a_l.clone() - Scalar::ONE;
+    let a_r = a_l.sub(Scalar::ONE);
 
     let alpha = Scalar::random(&mut *rng);
 
     let mut A_terms = Vec::with_capacity((generators.len() * 2) + 1);
     for (i, a_l) in a_l.0.iter().enumerate() {
-      A_terms.push((*a_l, generators.generator(GeneratorsList::GBold, i)));
+      A_terms.push((*a_l, generators.generator(GeneratorsList::GBold1, i)));
     }
     for (i, a_r) in a_r.0.iter().enumerate() {
-      A_terms.push((*a_r, generators.generator(GeneratorsList::HBold, i)));
+      A_terms.push((*a_r, generators.generator(GeneratorsList::HBold1, i)));
     }
-    A_terms.push((alpha, BpPlusGenerators::h()));
+    A_terms.push((alpha, Generators::h()));
     let mut A = multiexp(&A_terms);
     A_terms.zeroize();
 
     // Multiply by INV_EIGHT per earlier commentary
-    A *= INV_EIGHT();
+    A.0 *= crate::INV_EIGHT();
 
-    let AHatComputation { y, d_descending_y_plus_z, y_mn_plus_one, z, z_pow, A_hat } =
+    let (y, d_descending_y, y_mn_plus_one, z, z_pow, A_hat) =
       Self::compute_A_hat(PointVector(V), &generators, &mut transcript, A);
 
-    let a_l = a_l - z;
-    let a_r = a_r + &d_descending_y_plus_z;
+    let a_l = a_l.sub(z);
+    let a_r = a_r.add_vec(&d_descending_y).add(z);
     let mut alpha = alpha;
-    for j in 1 ..= witness.0.len() {
-      alpha += z_pow[j - 1] * witness.0[j - 1].mask * y_mn_plus_one;
+    for j in 1 ..= witness.gammas.len() {
+      alpha += z_pow[j - 1] * witness.gammas[j - 1] * y_mn_plus_one;
     }
 
     Some(AggregateRangeProof {
@@ -234,22 +227,23 @@ impl<'a> AggregateRangeStatement<'a> {
     })
   }
 
-  pub(crate) fn verify<R: RngCore + CryptoRng>(
+  pub(crate) fn verify<Id: Copy + Zeroize, R: RngCore + CryptoRng>(
     self,
     rng: &mut R,
-    verifier: &mut BulletproofsPlusBatchVerifier,
+    verifier: &mut BatchVerifier<Id, EdwardsPoint>,
+    id: Id,
     proof: AggregateRangeProof,
   ) -> bool {
     let Self { generators, V } = self;
 
-    let V = V.iter().map(|V| V * INV_EIGHT()).collect::<Vec<_>>();
+    let mut V = V.into_iter().map(|V| EdwardsPoint(V.0 * crate::INV_EIGHT())).collect::<Vec<_>>();
     let mut transcript = initial_transcript(V.iter());
-    let V = V.iter().map(EdwardsPoint::mul_by_cofactor).collect::<Vec<_>>();
+    V.iter_mut().for_each(|V| *V = V.mul_by_cofactor());
 
-    let generators = generators.reduce(V.len() * COMMITMENT_BITS);
+    let generators = generators.reduce(V.len() * N);
 
-    let AHatComputation { y, A_hat, .. } =
+    let (y, _, _, _, _, A_hat) =
       Self::compute_A_hat(PointVector(V), &generators, &mut transcript, proof.A);
-    WipStatement::new(generators, A_hat, y).verify(rng, verifier, transcript, proof.wip)
+    WipStatement::new(generators, A_hat, y).verify(rng, verifier, id, transcript, proof.wip)
   }
 }

coins/monero/src/ringct/bulletproofs/plus/mod.rs

@@ -1,12 +1,12 @@
 #![allow(non_snake_case)]
 
-use std_shims::sync::LazyLock;
+use group::Group;
+use dalek_ff_group::{Scalar, EdwardsPoint};
 
-use curve25519_dalek::{constants::ED25519_BASEPOINT_POINT, scalar::Scalar, edwards::EdwardsPoint};
-
-use monero_generators::{H, Generators};
-
-pub(crate) use crate::{scalar_vector::ScalarVector, point_vector::PointVector};
+mod scalar_vector;
+pub(crate) use scalar_vector::{ScalarVector, weighted_inner_product};
+mod point_vector;
+pub(crate) use point_vector::PointVector;
 
 pub(crate) mod transcript;
 pub(crate) mod weighted_inner_product;
@@ -24,50 +24,55 @@ pub(crate) fn padded_pow_of_2(i: usize) -> usize {
 
 #[derive(Clone, Copy, PartialEq, Eq, Hash, Debug)]
 pub(crate) enum GeneratorsList {
-  GBold,
-  HBold,
+  GBold1,
+  HBold1,
 }
 
+// TODO: Table these
 #[derive(Clone, Debug)]
-pub(crate) struct BpPlusGenerators {
-  g_bold: &'static [EdwardsPoint],
-  h_bold: &'static [EdwardsPoint],
+pub(crate) struct Generators {
+  g_bold1: &'static [EdwardsPoint],
+  h_bold1: &'static [EdwardsPoint],
 }
 
-include!(concat!(env!("OUT_DIR"), "/generators_plus.rs"));
+mod generators {
+  use std_shims::sync::OnceLock;
+  use monero_generators::Generators;
+  include!(concat!(env!("OUT_DIR"), "/generators_plus.rs"));
+}
 
-impl BpPlusGenerators {
+impl Generators {
   #[allow(clippy::new_without_default)]
   pub(crate) fn new() -> Self {
-    let gens = &GENERATORS;
-    BpPlusGenerators { g_bold: &gens.G, h_bold: &gens.H }
+    let gens = generators::GENERATORS();
+    Generators { g_bold1: &gens.G, h_bold1: &gens.H }
   }
 
   pub(crate) fn len(&self) -> usize {
-    self.g_bold.len()
+    self.g_bold1.len()
   }
 
   pub(crate) fn g() -> EdwardsPoint {
-    *H
+    dalek_ff_group::EdwardsPoint(crate::H())
   }
 
   pub(crate) fn h() -> EdwardsPoint {
-    ED25519_BASEPOINT_POINT
+    EdwardsPoint::generator()
   }
 
   pub(crate) fn generator(&self, list: GeneratorsList, i: usize) -> EdwardsPoint {
     match list {
-      GeneratorsList::GBold => self.g_bold[i],
-      GeneratorsList::HBold => self.h_bold[i],
+      GeneratorsList::GBold1 => self.g_bold1[i],
+      GeneratorsList::HBold1 => self.h_bold1[i],
     }
   }
 
   pub(crate) fn reduce(&self, generators: usize) -> Self {
     // Round to the nearest power of 2
     let generators = padded_pow_of_2(generators);
-    assert!(generators <= self.g_bold.len());
+    assert!(generators <= self.g_bold1.len());
 
-    BpPlusGenerators { g_bold: &self.g_bold[.. generators], h_bold: &self.h_bold[.. generators] }
+    Generators { g_bold1: &self.g_bold1[.. generators], h_bold1: &self.h_bold1[.. generators] }
   }
 }
 

coins/monero/src/ringct/bulletproofs/plus/point_vector.rs

@@ -1,16 +1,16 @@
 use core::ops::{Index, IndexMut};
 use std_shims::vec::Vec;
 
-use zeroize::Zeroize;
+use zeroize::{Zeroize, ZeroizeOnDrop};
 
-use curve25519_dalek::edwards::EdwardsPoint;
-
-use crate::scalar_vector::ScalarVector;
+use dalek_ff_group::EdwardsPoint;
 
 #[cfg(test)]
-use crate::core::multiexp;
+use multiexp::multiexp;
+#[cfg(test)]
+use crate::ringct::bulletproofs::plus::ScalarVector;
 
-#[derive(Clone, PartialEq, Eq, Debug, Zeroize)]
+#[derive(Clone, PartialEq, Eq, Debug, Zeroize, ZeroizeOnDrop)]
 pub(crate) struct PointVector(pub(crate) Vec<EdwardsPoint>);
 
 impl Index<usize> for PointVector {
@@ -27,15 +27,6 @@ impl IndexMut<usize> for PointVector {
 }
 
 impl PointVector {
-  pub(crate) fn mul_vec(&self, vector: &ScalarVector) -> Self {
-    assert_eq!(self.len(), vector.len());
-    let mut res = self.clone();
-    for (i, val) in res.0.iter_mut().enumerate() {
-      *val *= vector.0[i];
-    }
-    res
-  }
-
   #[cfg(test)]
   pub(crate) fn multiexp(&self, vector: &ScalarVector) -> EdwardsPoint {
     debug_assert_eq!(self.len(), vector.len());

coins/monero/src/ringct/bulletproofs/plus/scalar_vector.rs

@@ -0,0 +1,114 @@
+use core::{
+  borrow::Borrow,
+  ops::{Index, IndexMut},
+};
+use std_shims::vec::Vec;
+
+use zeroize::Zeroize;
+
+use group::ff::Field;
+use dalek_ff_group::Scalar;
+
+#[derive(Clone, PartialEq, Eq, Debug, Zeroize)]
+pub(crate) struct ScalarVector(pub(crate) Vec<Scalar>);
+
+impl Index<usize> for ScalarVector {
+  type Output = Scalar;
+  fn index(&self, index: usize) -> &Scalar {
+    &self.0[index]
+  }
+}
+
+impl IndexMut<usize> for ScalarVector {
+  fn index_mut(&mut self, index: usize) -> &mut Scalar {
+    &mut self.0[index]
+  }
+}
+
+impl ScalarVector {
+  pub(crate) fn new(len: usize) -> Self {
+    ScalarVector(vec![Scalar::ZERO; len])
+  }
+
+  pub(crate) fn add(&self, scalar: impl Borrow<Scalar>) -> Self {
+    let mut res = self.clone();
+    for val in &mut res.0 {
+      *val += scalar.borrow();
+    }
+    res
+  }
+
+  pub(crate) fn sub(&self, scalar: impl Borrow<Scalar>) -> Self {
+    let mut res = self.clone();
+    for val in &mut res.0 {
+      *val -= scalar.borrow();
+    }
+    res
+  }
+
+  pub(crate) fn mul(&self, scalar: impl Borrow<Scalar>) -> Self {
+    let mut res = self.clone();
+    for val in &mut res.0 {
+      *val *= scalar.borrow();
+    }
+    res
+  }
+
+  pub(crate) fn add_vec(&self, vector: &Self) -> Self {
+    debug_assert_eq!(self.len(), vector.len());
+    let mut res = self.clone();
+    for (i, val) in res.0.iter_mut().enumerate() {
+      *val += vector.0[i];
+    }
+    res
+  }
+
+  pub(crate) fn mul_vec(&self, vector: &Self) -> Self {
+    debug_assert_eq!(self.len(), vector.len());
+    let mut res = self.clone();
+    for (i, val) in res.0.iter_mut().enumerate() {
+      *val *= vector.0[i];
+    }
+    res
+  }
+
+  pub(crate) fn inner_product(&self, vector: &Self) -> Scalar {
+    self.mul_vec(vector).sum()
+  }
+
+  pub(crate) fn powers(x: Scalar, len: usize) -> Self {
+    debug_assert!(len != 0);
+
+    let mut res = Vec::with_capacity(len);
+    res.push(Scalar::ONE);
+    res.push(x);
+    for i in 2 .. len {
+      res.push(res[i - 1] * x);
+    }
+    res.truncate(len);
+    ScalarVector(res)
+  }
+
+  pub(crate) fn sum(mut self) -> Scalar {
+    self.0.drain(..).sum()
+  }
+
+  pub(crate) fn len(&self) -> usize {
+    self.0.len()
+  }
+
+  pub(crate) fn split(mut self) -> (Self, Self) {
+    debug_assert!(self.len() > 1);
+    let r = self.0.split_off(self.0.len() / 2);
+    debug_assert_eq!(self.len(), r.len());
+    (self, ScalarVector(r))
+  }
+}
+
+pub(crate) fn weighted_inner_product(
+  a: &ScalarVector,
+  b: &ScalarVector,
+  y: &ScalarVector,
+) -> Scalar {
+  a.inner_product(&b.mul_vec(y))
+}

coins/monero/src/ringct/bulletproofs/plus/transcript.rs

@@ -0,0 +1,24 @@
+use std_shims::{sync::OnceLock, vec::Vec};
+
+use dalek_ff_group::{Scalar, EdwardsPoint};
+
+use monero_generators::{hash_to_point as raw_hash_to_point};
+use crate::{hash, hash_to_scalar as dalek_hash};
+
+// Monero starts BP+ transcripts with the following constant.
+static TRANSCRIPT_CELL: OnceLock<[u8; 32]> = OnceLock::new();
+pub(crate) fn TRANSCRIPT() -> [u8; 32] {
+  // Why this uses a hash_to_point is completely unknown.
+  *TRANSCRIPT_CELL
+    .get_or_init(|| raw_hash_to_point(hash(b"bulletproof_plus_transcript")).compress().to_bytes())
+}
+
+pub(crate) fn hash_to_scalar(data: &[u8]) -> Scalar {
+  Scalar(dalek_hash(data))
+}
+
+pub(crate) fn initial_transcript(commitments: core::slice::Iter<'_, EdwardsPoint>) -> Scalar {
+  let commitments_hash =
+    hash_to_scalar(&commitments.flat_map(|V| V.compress().to_bytes()).collect::<Vec<_>>());
+  hash_to_scalar(&[TRANSCRIPT().as_ref(), &commitments_hash.to_bytes()].concat())
+}

coins/monero/src/ringct/bulletproofs/plus/weighted_inner_product.rs

@@ -1,21 +1,25 @@
-use std_shims::{vec, vec::Vec};
+use std_shims::vec::Vec;
 
 use rand_core::{RngCore, CryptoRng};
+
 use zeroize::{Zeroize, ZeroizeOnDrop};
 
-use curve25519_dalek::{scalar::Scalar, edwards::EdwardsPoint};
+use multiexp::{multiexp, multiexp_vartime, BatchVerifier};
+use group::{
+  ff::{Field, PrimeField},
+  GroupEncoding,
+};
+use dalek_ff_group::{Scalar, EdwardsPoint};
 
-use monero_primitives::{INV_EIGHT, keccak256_to_scalar};
-use crate::{
-  core::{multiexp, multiexp_vartime, challenge_products},
-  batch_verifier::BulletproofsPlusBatchVerifier,
-  plus::{ScalarVector, PointVector, GeneratorsList, BpPlusGenerators, padded_pow_of_2},
+use crate::ringct::bulletproofs::plus::{
+  ScalarVector, PointVector, GeneratorsList, Generators, padded_pow_of_2, weighted_inner_product,
+  transcript::*,
 };
 
-// Figure 1 of the Bulletproofs+ paper
+// Figure 1
 #[derive(Clone, Debug)]
 pub(crate) struct WipStatement {
-  generators: BpPlusGenerators,
+  generators: Generators,
   P: EdwardsPoint,
   y: ScalarVector,
 }
@@ -65,7 +69,7 @@ pub(crate) struct WipProof {
 }
 
 impl WipStatement {
-  pub(crate) fn new(generators: BpPlusGenerators, P: EdwardsPoint, y: Scalar) -> Self {
+  pub(crate) fn new(generators: Generators, P: EdwardsPoint, y: Scalar) -> Self {
     debug_assert_eq!(generators.len(), padded_pow_of_2(generators.len()));
 
     // y ** n
@@ -79,26 +83,16 @@ impl WipStatement {
   }
 
   fn transcript_L_R(transcript: &mut Scalar, L: EdwardsPoint, R: EdwardsPoint) -> Scalar {
-    let e = keccak256_to_scalar(
-      [
-        transcript.to_bytes().as_ref(),
-        L.compress().to_bytes().as_ref(),
-        R.compress().to_bytes().as_ref(),
-      ]
-      .concat(),
+    let e = hash_to_scalar(
+      &[transcript.to_repr().as_ref(), L.to_bytes().as_ref(), R.to_bytes().as_ref()].concat(),
     );
     *transcript = e;
     e
   }
 
   fn transcript_A_B(transcript: &mut Scalar, A: EdwardsPoint, B: EdwardsPoint) -> Scalar {
-    let e = keccak256_to_scalar(
-      [
-        transcript.to_bytes().as_ref(),
-        A.compress().to_bytes().as_ref(),
-        B.compress().to_bytes().as_ref(),
-      ]
-      .concat(),
+    let e = hash_to_scalar(
+      &[transcript.to_repr().as_ref(), A.to_bytes().as_ref(), B.to_bytes().as_ref()].concat(),
     );
     *transcript = e;
     e
@@ -107,6 +101,9 @@ impl WipStatement {
   // Prover's variant of the shared code block to calculate G/H/P when n > 1
   // Returns each permutation of G/H since the prover needs to do operation on each permutation
   // P is dropped as it's unused in the prover's path
+  // TODO: It'd still probably be faster to keep in terms of the original generators, both between
+  // the reduced amount of group operations and the potential tabling of the generators under
+  // multiexp
   #[allow(clippy::too_many_arguments)]
   fn next_G_H(
     transcript: &mut Scalar,
@@ -123,7 +120,7 @@ impl WipStatement {
     debug_assert_eq!(g_bold1.len(), h_bold1.len());
 
     let e = Self::transcript_L_R(transcript, L, R);
-    let inv_e = e.invert();
+    let inv_e = e.invert().unwrap();
 
     // This vartime is safe as all of these arguments are public
     let mut new_g_bold = Vec::with_capacity(g_bold1.len());
@@ -137,12 +134,57 @@ impl WipStatement {
       new_h_bold.push(multiexp_vartime(&[(e, h_bold.0), (inv_e, h_bold.1)]));
     }
 
-    let e_square = e * e;
-    let inv_e_square = inv_e * inv_e;
+    let e_square = e.square();
+    let inv_e_square = inv_e.square();
 
     (e, inv_e, e_square, inv_e_square, PointVector(new_g_bold), PointVector(new_h_bold))
   }
 
+  /*
+  This has room for optimization worth investigating further. It currently takes
+  an iterative approach. It can be optimized further via divide and conquer.
+
+  Assume there are 4 challenges.
+
+  Iterative approach (current):
+    1. Do the optimal multiplications across challenge column 0 and 1.
+    2. Do the optimal multiplications across that result and column 2.
+    3. Do the optimal multiplications across that result and column 3.
+
+  Divide and conquer (worth investigating further):
+    1. Do the optimal multiplications across challenge column 0 and 1.
+    2. Do the optimal multiplications across challenge column 2 and 3.
+    3. Multiply both results together.
+
+  When there are 4 challenges (n=16), the iterative approach does 28 multiplications
+  versus divide and conquer's 24.
+  */
+  fn challenge_products(challenges: &[(Scalar, Scalar)]) -> Vec<Scalar> {
+    let mut products = vec![Scalar::ONE; 1 << challenges.len()];
+
+    if !challenges.is_empty() {
+      products[0] = challenges[0].1;
+      products[1] = challenges[0].0;
+
+      for (j, challenge) in challenges.iter().enumerate().skip(1) {
+        let mut slots = (1 << (j + 1)) - 1;
+        while slots > 0 {
+          products[slots] = products[slots / 2] * challenge.0;
+          products[slots - 1] = products[slots / 2] * challenge.1;
+
+          slots = slots.saturating_sub(2);
+        }
+      }
+
+      // Sanity check since if the above failed to populate, it'd be critical
+      for product in &products {
+        debug_assert!(!bool::from(product.is_zero()));
+      }
+    }
+
+    products
+  }
+
   pub(crate) fn prove<R: RngCore + CryptoRng>(
     self,
     rng: &mut R,
@@ -156,27 +198,16 @@ impl WipStatement {
     if generators.len() != witness.a.len() {
       return None;
     }
-    let (g, h) = (BpPlusGenerators::g(), BpPlusGenerators::h());
+    let (g, h) = (Generators::g(), Generators::h());
     let mut g_bold = vec![];
     let mut h_bold = vec![];
     for i in 0 .. generators.len() {
-      g_bold.push(generators.generator(GeneratorsList::GBold, i));
-      h_bold.push(generators.generator(GeneratorsList::HBold, i));
+      g_bold.push(generators.generator(GeneratorsList::GBold1, i));
+      h_bold.push(generators.generator(GeneratorsList::HBold1, i));
     }
     let mut g_bold = PointVector(g_bold);
     let mut h_bold = PointVector(h_bold);
 
-    let mut y_inv = {
-      let mut i = 1;
-      let mut to_invert = vec![];
-      while i < g_bold.len() {
-        to_invert.push(y[i - 1]);
-        i *= 2;
-      }
-      Scalar::batch_invert(&mut to_invert);
-      to_invert
-    };
-
     // Check P has the expected relationship
     #[cfg(debug_assertions)]
     {
@@ -188,7 +219,7 @@ impl WipStatement {
         .zip(g_bold.0.iter().copied())
         .chain(witness.b.0.iter().copied().zip(h_bold.0.iter().copied()))
         .collect::<Vec<_>>();
-      P_terms.push((witness.a.clone().weighted_inner_product(&witness.b, &y), g));
+      P_terms.push((weighted_inner_product(&witness.a, &witness.b, &y), g));
       P_terms.push((witness.alpha, h));
       debug_assert_eq!(multiexp(&P_terms), P);
       P_terms.zeroize();
@@ -227,12 +258,14 @@ impl WipStatement {
       let d_l = Scalar::random(&mut *rng);
       let d_r = Scalar::random(&mut *rng);
 
-      let c_l = a1.clone().weighted_inner_product(&b2, &y);
-      let c_r = (a2.clone() * y_n_hat).weighted_inner_product(&b1, &y);
+      let c_l = weighted_inner_product(&a1, &b2, &y);
+      let c_r = weighted_inner_product(&(a2.mul(y_n_hat)), &b1, &y);
 
-      let y_inv_n_hat = y_inv.pop().unwrap();
+      // TODO: Calculate these with a batch inversion
+      let y_inv_n_hat = y_n_hat.invert().unwrap();
 
-      let mut L_terms = (a1.clone() * y_inv_n_hat)
+      let mut L_terms = a1
+        .mul(y_inv_n_hat)
         .0
         .drain(..)
         .zip(g_bold2.0.iter().copied())
@@ -240,11 +273,12 @@ impl WipStatement {
         .collect::<Vec<_>>();
       L_terms.push((c_l, g));
       L_terms.push((d_l, h));
-      let L = multiexp(&L_terms) * INV_EIGHT();
+      let L = multiexp(&L_terms) * Scalar(crate::INV_EIGHT());
       L_vec.push(L);
       L_terms.zeroize();
 
-      let mut R_terms = (a2.clone() * y_n_hat)
+      let mut R_terms = a2
+        .mul(y_n_hat)
         .0
         .drain(..)
         .zip(g_bold1.0.iter().copied())
@@ -252,7 +286,7 @@ impl WipStatement {
         .collect::<Vec<_>>();
       R_terms.push((c_r, g));
       R_terms.push((d_r, h));
-      let R = multiexp(&R_terms) * INV_EIGHT();
+      let R = multiexp(&R_terms) * Scalar(crate::INV_EIGHT());
       R_vec.push(R);
       R_terms.zeroize();
 
@@ -260,8 +294,8 @@ impl WipStatement {
       (e, inv_e, e_square, inv_e_square, g_bold, h_bold) =
         Self::next_G_H(&mut transcript, g_bold1, g_bold2, h_bold1, h_bold2, L, R, y_inv_n_hat);
 
-      a = (a1 * e) + &(a2 * (y_n_hat * inv_e));
-      b = (b1 * inv_e) + &(b2 * e);
+      a = a1.mul(e).add_vec(&a2.mul(y_n_hat * inv_e));
+      b = b1.mul(inv_e).add_vec(&b2.mul(e));
       alpha += (d_l * e_square) + (d_r * inv_e_square);
 
       debug_assert_eq!(g_bold.len(), a.len());
@@ -285,33 +319,34 @@ impl WipStatement {
 
     let mut A_terms =
       vec![(r, g_bold[0]), (s, h_bold[0]), ((ry * b[0]) + (s * y[0] * a[0]), g), (delta, h)];
-    let A = multiexp(&A_terms) * INV_EIGHT();
+    let A = multiexp(&A_terms) * Scalar(crate::INV_EIGHT());
     A_terms.zeroize();
 
     let mut B_terms = vec![(ry * s, g), (eta, h)];
-    let B = multiexp(&B_terms) * INV_EIGHT();
+    let B = multiexp(&B_terms) * Scalar(crate::INV_EIGHT());
     B_terms.zeroize();
 
     let e = Self::transcript_A_B(&mut transcript, A, B);
 
     let r_answer = r + (a[0] * e);
     let s_answer = s + (b[0] * e);
-    let delta_answer = eta + (delta * e) + (alpha * (e * e));
+    let delta_answer = eta + (delta * e) + (alpha * e.square());
 
     Some(WipProof { L: L_vec, R: R_vec, A, B, r_answer, s_answer, delta_answer })
   }
 
-  pub(crate) fn verify<R: RngCore + CryptoRng>(
+  pub(crate) fn verify<Id: Copy + Zeroize, R: RngCore + CryptoRng>(
     self,
     rng: &mut R,
-    verifier: &mut BulletproofsPlusBatchVerifier,
+    verifier: &mut BatchVerifier<Id, EdwardsPoint>,
+    id: Id,
     mut transcript: Scalar,
     mut proof: WipProof,
   ) -> bool {
-    let verifier_weight = Scalar::random(rng);
-
     let WipStatement { generators, P, y } = self;
 
+    let (g, h) = (Generators::g(), Generators::h());
+
     // Verify the L/R lengths
     {
       let mut lr_len = 0;
@@ -327,7 +362,7 @@ impl WipStatement {
     }
 
     let inv_y = {
-      let inv_y = y[0].invert();
+      let inv_y = y[0].invert().unwrap();
       let mut res = Vec::with_capacity(y.len());
       res.push(inv_y);
       while res.len() < y.len() {
@@ -336,49 +371,51 @@ impl WipStatement {
       res
     };
 
-    let mut e_is = Vec::with_capacity(proof.L.len());
-    for (L, R) in proof.L.iter_mut().zip(proof.R.iter_mut()) {
-      e_is.push(Self::transcript_L_R(&mut transcript, *L, *R));
-      *L = L.mul_by_cofactor();
-      *R = R.mul_by_cofactor();
-    }
+    let mut P_terms = vec![(Scalar::ONE, P)];
+    P_terms.reserve(6 + (2 * generators.len()) + proof.L.len());
+
+    let mut challenges = Vec::with_capacity(proof.L.len());
+    let product_cache = {
+      let mut es = Vec::with_capacity(proof.L.len());
+      for (L, R) in proof.L.iter_mut().zip(proof.R.iter_mut()) {
+        es.push(Self::transcript_L_R(&mut transcript, *L, *R));
+        *L = L.mul_by_cofactor();
+        *R = R.mul_by_cofactor();
+      }
+
+      let mut inv_es = es.clone();
+      let mut scratch = vec![Scalar::ZERO; es.len()];
+      group::ff::BatchInverter::invert_with_external_scratch(&mut inv_es, &mut scratch);
+      drop(scratch);
+
+      debug_assert_eq!(es.len(), inv_es.len());
+      debug_assert_eq!(es.len(), proof.L.len());
+      debug_assert_eq!(es.len(), proof.R.len());
+      for ((e, inv_e), (L, R)) in
+        es.drain(..).zip(inv_es.drain(..)).zip(proof.L.iter().zip(proof.R.iter()))
+      {
+        debug_assert_eq!(e.invert().unwrap(), inv_e);
+
+        challenges.push((e, inv_e));
+
+        let e_square = e.square();
+        let inv_e_square = inv_e.square();
+        P_terms.push((e_square, *L));
+        P_terms.push((inv_e_square, *R));
+      }
+
+      Self::challenge_products(&challenges)
+    };
 
     let e = Self::transcript_A_B(&mut transcript, proof.A, proof.B);
     proof.A = proof.A.mul_by_cofactor();
     proof.B = proof.B.mul_by_cofactor();
-    let neg_e_square = verifier_weight * -(e * e);
+    let neg_e_square = -e.square();
 
-    verifier.0.other.push((neg_e_square, P));
-
-    let mut challenges = Vec::with_capacity(proof.L.len());
-    let product_cache = {
-      let mut inv_e_is = e_is.clone();
-      Scalar::batch_invert(&mut inv_e_is);
-
-      debug_assert_eq!(e_is.len(), inv_e_is.len());
-      debug_assert_eq!(e_is.len(), proof.L.len());
-      debug_assert_eq!(e_is.len(), proof.R.len());
-      for ((e_i, inv_e_i), (L, R)) in
-        e_is.drain(..).zip(inv_e_is.drain(..)).zip(proof.L.iter().zip(proof.R.iter()))
-      {
-        debug_assert_eq!(e_i.invert(), inv_e_i);
-
-        challenges.push((e_i, inv_e_i));
-
-        let e_i_square = e_i * e_i;
-        let inv_e_i_square = inv_e_i * inv_e_i;
-        verifier.0.other.push((neg_e_square * e_i_square, *L));
-        verifier.0.other.push((neg_e_square * inv_e_i_square, *R));
-      }
-
-      challenge_products(&challenges)
-    };
-
-    while verifier.0.g_bold.len() < generators.len() {
-      verifier.0.g_bold.push(Scalar::ZERO);
-    }
-    while verifier.0.h_bold.len() < generators.len() {
-      verifier.0.h_bold.push(Scalar::ZERO);
+    let mut multiexp = P_terms;
+    multiexp.reserve(4 + (2 * generators.len()));
+    for (scalar, _) in &mut multiexp {
+      *scalar *= neg_e_square;
     }
 
     let re = proof.r_answer * e;
@@ -387,18 +424,23 @@ impl WipStatement {
       if i > 0 {
         scalar *= inv_y[i - 1];
       }
-      verifier.0.g_bold[i] += verifier_weight * scalar;
+      multiexp.push((scalar, generators.generator(GeneratorsList::GBold1, i)));
     }
 
     let se = proof.s_answer * e;
     for i in 0 .. generators.len() {
-      verifier.0.h_bold[i] += verifier_weight * (se * product_cache[product_cache.len() - 1 - i]);
+      multiexp.push((
+        se * product_cache[product_cache.len() - 1 - i],
+        generators.generator(GeneratorsList::HBold1, i),
+      ));
     }
 
-    verifier.0.other.push((verifier_weight * -e, proof.A));
-    verifier.0.g += verifier_weight * (proof.r_answer * y[0] * proof.s_answer);
-    verifier.0.h += verifier_weight * proof.delta_answer;
-    verifier.0.other.push((-verifier_weight, proof.B));
+    multiexp.push((-e, proof.A));
+    multiexp.push((proof.r_answer * y[0] * proof.s_answer, g));
+    multiexp.push((proof.delta_answer, h));
+    multiexp.push((-Scalar::ONE, proof.B));
+
+    verifier.queue(rng, id, multiexp);
 
     true
   }

coins/monero/src/ringct/bulletproofs/scalar_vector.rs

@@ -0,0 +1,114 @@
+use core::ops::{Add, Sub, Mul, Index};
+use std_shims::vec::Vec;
+
+use zeroize::{Zeroize, ZeroizeOnDrop};
+
+use group::ff::Field;
+use dalek_ff_group::{Scalar, EdwardsPoint};
+
+use multiexp::multiexp;
+
+#[derive(Clone, PartialEq, Eq, Debug, Zeroize, ZeroizeOnDrop)]
+pub(crate) struct ScalarVector(pub(crate) Vec<Scalar>);
+macro_rules! math_op {
+  ($Op: ident, $op: ident, $f: expr) => {
+    #[allow(clippy::redundant_closure_call)]
+    impl $Op<Scalar> for ScalarVector {
+      type Output = ScalarVector;
+      fn $op(self, b: Scalar) -> ScalarVector {
+        ScalarVector(self.0.iter().map(|a| $f((a, &b))).collect())
+      }
+    }
+
+    #[allow(clippy::redundant_closure_call)]
+    impl $Op<Scalar> for &ScalarVector {
+      type Output = ScalarVector;
+      fn $op(self, b: Scalar) -> ScalarVector {
+        ScalarVector(self.0.iter().map(|a| $f((a, &b))).collect())
+      }
+    }
+
+    #[allow(clippy::redundant_closure_call)]
+    impl $Op<ScalarVector> for ScalarVector {
+      type Output = ScalarVector;
+      fn $op(self, b: ScalarVector) -> ScalarVector {
+        debug_assert_eq!(self.len(), b.len());
+        ScalarVector(self.0.iter().zip(b.0.iter()).map($f).collect())
+      }
+    }
+
+    #[allow(clippy::redundant_closure_call)]
+    impl $Op<&ScalarVector> for &ScalarVector {
+      type Output = ScalarVector;
+      fn $op(self, b: &ScalarVector) -> ScalarVector {
+        debug_assert_eq!(self.len(), b.len());
+        ScalarVector(self.0.iter().zip(b.0.iter()).map($f).collect())
+      }
+    }
+  };
+}
+math_op!(Add, add, |(a, b): (&Scalar, &Scalar)| *a + *b);
+math_op!(Sub, sub, |(a, b): (&Scalar, &Scalar)| *a - *b);
+math_op!(Mul, mul, |(a, b): (&Scalar, &Scalar)| *a * *b);
+
+impl ScalarVector {
+  pub(crate) fn new(len: usize) -> ScalarVector {
+    ScalarVector(vec![Scalar::ZERO; len])
+  }
+
+  pub(crate) fn powers(x: Scalar, len: usize) -> ScalarVector {
+    debug_assert!(len != 0);
+
+    let mut res = Vec::with_capacity(len);
+    res.push(Scalar::ONE);
+    for i in 1 .. len {
+      res.push(res[i - 1] * x);
+    }
+    ScalarVector(res)
+  }
+
+  pub(crate) fn sum(mut self) -> Scalar {
+    self.0.drain(..).sum()
+  }
+
+  pub(crate) fn len(&self) -> usize {
+    self.0.len()
+  }
+
+  pub(crate) fn split(self) -> (ScalarVector, ScalarVector) {
+    let (l, r) = self.0.split_at(self.0.len() / 2);
+    (ScalarVector(l.to_vec()), ScalarVector(r.to_vec()))
+  }
+}
+
+impl Index<usize> for ScalarVector {
+  type Output = Scalar;
+  fn index(&self, index: usize) -> &Scalar {
+    &self.0[index]
+  }
+}
+
+pub(crate) fn inner_product(a: &ScalarVector, b: &ScalarVector) -> Scalar {
+  (a * b).sum()
+}
+
+impl Mul<&[EdwardsPoint]> for &ScalarVector {
+  type Output = EdwardsPoint;
+  fn mul(self, b: &[EdwardsPoint]) -> EdwardsPoint {
+    debug_assert_eq!(self.len(), b.len());
+    multiexp(&self.0.iter().copied().zip(b.iter().copied()).collect::<Vec<_>>())
+  }
+}
+
+pub(crate) fn hadamard_fold(
+  l: &[EdwardsPoint],
+  r: &[EdwardsPoint],
+  a: Scalar,
+  b: Scalar,
+) -> Vec<EdwardsPoint> {
+  let mut res = Vec::with_capacity(l.len() / 2);
+  for i in 0 .. l.len() {
+    res.push(multiexp(&[(a, l[i]), (b, r[i])]));
+  }
+  res
+}

coins/monero/src/ringct/clsag/mod.rs

@@ -0,0 +1,324 @@
+#![allow(non_snake_case)]
+
+use core::ops::Deref;
+use std_shims::{
+  vec::Vec,
+  io::{self, Read, Write},
+};
+
+use rand_core::{RngCore, CryptoRng};
+
+use zeroize::{Zeroize, ZeroizeOnDrop, Zeroizing};
+use subtle::{ConstantTimeEq, Choice, CtOption};
+
+use curve25519_dalek::{
+  constants::ED25519_BASEPOINT_TABLE,
+  scalar::Scalar,
+  traits::{IsIdentity, VartimePrecomputedMultiscalarMul},
+  edwards::{EdwardsPoint, VartimeEdwardsPrecomputation},
+};
+
+use crate::{
+  INV_EIGHT, Commitment, random_scalar, hash_to_scalar, wallet::decoys::Decoys,
+  ringct::hash_to_point, serialize::*,
+};
+
+#[cfg(feature = "multisig")]
+mod multisig;
+#[cfg(feature = "multisig")]
+pub use multisig::{ClsagDetails, ClsagAddendum, ClsagMultisig};
+#[cfg(feature = "multisig")]
+pub(crate) use multisig::add_key_image_share;
+
+/// Errors returned when CLSAG signing fails.
+#[derive(Clone, Copy, PartialEq, Eq, Debug)]
+#[cfg_attr(feature = "std", derive(thiserror::Error))]
+pub enum ClsagError {
+  #[cfg_attr(feature = "std", error("internal error ({0})"))]
+  InternalError(&'static str),
+  #[cfg_attr(feature = "std", error("invalid ring"))]
+  InvalidRing,
+  #[cfg_attr(feature = "std", error("invalid ring member (member {0}, ring size {1})"))]
+  InvalidRingMember(u8, u8),
+  #[cfg_attr(feature = "std", error("invalid commitment"))]
+  InvalidCommitment,
+  #[cfg_attr(feature = "std", error("invalid key image"))]
+  InvalidImage,
+  #[cfg_attr(feature = "std", error("invalid D"))]
+  InvalidD,
+  #[cfg_attr(feature = "std", error("invalid s"))]
+  InvalidS,
+  #[cfg_attr(feature = "std", error("invalid c1"))]
+  InvalidC1,
+}
+
+/// Input being signed for.
+#[derive(Clone, PartialEq, Eq, Debug, Zeroize, ZeroizeOnDrop)]
+pub struct ClsagInput {
+  // The actual commitment for the true spend
+  pub(crate) commitment: Commitment,
+  // True spend index, offsets, and ring
+  pub(crate) decoys: Decoys,
+}
+
+impl ClsagInput {
+  pub fn new(commitment: Commitment, decoys: Decoys) -> Result<ClsagInput, ClsagError> {
+    let n = decoys.len();
+    if n > u8::MAX.into() {
+      Err(ClsagError::InternalError("max ring size in this library is u8 max"))?;
+    }
+    let n = u8::try_from(n).unwrap();
+    if decoys.i >= n {
+      Err(ClsagError::InvalidRingMember(decoys.i, n))?;
+    }
+
+    // Validate the commitment matches
+    if decoys.ring[usize::from(decoys.i)][1] != commitment.calculate() {
+      Err(ClsagError::InvalidCommitment)?;
+    }
+
+    Ok(ClsagInput { commitment, decoys })
+  }
+}
+
+#[allow(clippy::large_enum_variant)]
+enum Mode {
+  Sign(usize, EdwardsPoint, EdwardsPoint),
+  Verify(Scalar),
+}
+
+// Core of the CLSAG algorithm, applicable to both sign and verify with minimal differences
+// Said differences are covered via the above Mode
+fn core(
+  ring: &[[EdwardsPoint; 2]],
+  I: &EdwardsPoint,
+  pseudo_out: &EdwardsPoint,
+  msg: &[u8; 32],
+  D: &EdwardsPoint,
+  s: &[Scalar],
+  A_c1: &Mode,
+) -> ((EdwardsPoint, Scalar, Scalar), Scalar) {
+  let n = ring.len();
+
+  let images_precomp = VartimeEdwardsPrecomputation::new([I, D]);
+  let D = D * INV_EIGHT();
+
+  // Generate the transcript
+  // Instead of generating multiple, a single transcript is created and then edited as needed
+  const PREFIX: &[u8] = b"CLSAG_";
+  #[rustfmt::skip]
+  const AGG_0: &[u8]  =       b"agg_0";
+  #[rustfmt::skip]
+  const ROUND: &[u8]  =       b"round";
+  const PREFIX_AGG_0_LEN: usize = PREFIX.len() + AGG_0.len();
+
+  let mut to_hash = Vec::with_capacity(((2 * n) + 5) * 32);
+  to_hash.extend(PREFIX);
+  to_hash.extend(AGG_0);
+  to_hash.extend([0; 32 - PREFIX_AGG_0_LEN]);
+
+  let mut P = Vec::with_capacity(n);
+  for member in ring {
+    P.push(member[0]);
+    to_hash.extend(member[0].compress().to_bytes());
+  }
+
+  let mut C = Vec::with_capacity(n);
+  for member in ring {
+    C.push(member[1] - pseudo_out);
+    to_hash.extend(member[1].compress().to_bytes());
+  }
+
+  to_hash.extend(I.compress().to_bytes());
+  to_hash.extend(D.compress().to_bytes());
+  to_hash.extend(pseudo_out.compress().to_bytes());
+  // mu_P with agg_0
+  let mu_P = hash_to_scalar(&to_hash);
+  // mu_C with agg_1
+  to_hash[PREFIX_AGG_0_LEN - 1] = b'1';
+  let mu_C = hash_to_scalar(&to_hash);
+
+  // Truncate it for the round transcript, altering the DST as needed
+  to_hash.truncate(((2 * n) + 1) * 32);
+  for i in 0 .. ROUND.len() {
+    to_hash[PREFIX.len() + i] = ROUND[i];
+  }
+  // Unfortunately, it's I D pseudo_out instead of pseudo_out I D, meaning this needs to be
+  // truncated just to add it back
+  to_hash.extend(pseudo_out.compress().to_bytes());
+  to_hash.extend(msg);
+
+  // Configure the loop based on if we're signing or verifying
+  let start;
+  let end;
+  let mut c;
+  match A_c1 {
+    Mode::Sign(r, A, AH) => {
+      start = r + 1;
+      end = r + n;
+      to_hash.extend(A.compress().to_bytes());
+      to_hash.extend(AH.compress().to_bytes());
+      c = hash_to_scalar(&to_hash);
+    }
+
+    Mode::Verify(c1) => {
+      start = 0;
+      end = n;
+      c = *c1;
+    }
+  }
+
+  // Perform the core loop
+  let mut c1 = CtOption::new(Scalar::ZERO, Choice::from(0));
+  for i in (start .. end).map(|i| i % n) {
+    // This will only execute once and shouldn't need to be constant time. Making it constant time
+    // removes the risk of branch prediction creating timing differences depending on ring index
+    // however
+    c1 = c1.or_else(|| CtOption::new(c, i.ct_eq(&0)));
+
+    let c_p = mu_P * c;
+    let c_c = mu_C * c;
+
+    let L = (&s[i] * ED25519_BASEPOINT_TABLE) + (c_p * P[i]) + (c_c * C[i]);
+    let PH = hash_to_point(&P[i]);
+    // Shouldn't be an issue as all of the variables in this vartime statement are public
+    let R = (s[i] * PH) + images_precomp.vartime_multiscalar_mul([c_p, c_c]);
+
+    to_hash.truncate(((2 * n) + 3) * 32);
+    to_hash.extend(L.compress().to_bytes());
+    to_hash.extend(R.compress().to_bytes());
+    c = hash_to_scalar(&to_hash);
+  }
+
+  // This first tuple is needed to continue signing, the latter is the c to be tested/worked with
+  ((D, c * mu_P, c * mu_C), c1.unwrap_or(c))
+}
+
+/// CLSAG signature, as used in Monero.
+#[derive(Clone, PartialEq, Eq, Debug)]
+pub struct Clsag {
+  pub D: EdwardsPoint,
+  pub s: Vec<Scalar>,
+  pub c1: Scalar,
+}
+
+impl Clsag {
+  // Sign core is the extension of core as needed for signing, yet is shared between single signer
+  // and multisig, hence why it's still core
+  pub(crate) fn sign_core<R: RngCore + CryptoRng>(
+    rng: &mut R,
+    I: &EdwardsPoint,
+    input: &ClsagInput,
+    mask: Scalar,
+    msg: &[u8; 32],
+    A: EdwardsPoint,
+    AH: EdwardsPoint,
+  ) -> (Clsag, EdwardsPoint, Scalar, Scalar) {
+    let r: usize = input.decoys.i.into();
+
+    let pseudo_out = Commitment::new(mask, input.commitment.amount).calculate();
+    let z = input.commitment.mask - mask;
+
+    let H = hash_to_point(&input.decoys.ring[r][0]);
+    let D = H * z;
+    let mut s = Vec::with_capacity(input.decoys.ring.len());
+    for _ in 0 .. input.decoys.ring.len() {
+      s.push(random_scalar(rng));
+    }
+    let ((D, p, c), c1) =
+      core(&input.decoys.ring, I, &pseudo_out, msg, &D, &s, &Mode::Sign(r, A, AH));
+
+    (Clsag { D, s, c1 }, pseudo_out, p, c * z)
+  }
+
+  /// Generate CLSAG signatures for the given inputs.
+  /// inputs is of the form (private key, key image, input).
+  /// sum_outputs is for the sum of the outputs' commitment masks.
+  pub fn sign<R: RngCore + CryptoRng>(
+    rng: &mut R,
+    mut inputs: Vec<(Zeroizing<Scalar>, EdwardsPoint, ClsagInput)>,
+    sum_outputs: Scalar,
+    msg: [u8; 32],
+  ) -> Vec<(Clsag, EdwardsPoint)> {
+    let mut res = Vec::with_capacity(inputs.len());
+    let mut sum_pseudo_outs = Scalar::ZERO;
+    for i in 0 .. inputs.len() {
+      let mut mask = random_scalar(rng);
+      if i == (inputs.len() - 1) {
+        mask = sum_outputs - sum_pseudo_outs;
+      } else {
+        sum_pseudo_outs += mask;
+      }
+
+      let mut nonce = Zeroizing::new(random_scalar(rng));
+      let (mut clsag, pseudo_out, p, c) = Clsag::sign_core(
+        rng,
+        &inputs[i].1,
+        &inputs[i].2,
+        mask,
+        &msg,
+        nonce.deref() * ED25519_BASEPOINT_TABLE,
+        nonce.deref() *
+          hash_to_point(&inputs[i].2.decoys.ring[usize::from(inputs[i].2.decoys.i)][0]),
+      );
+      clsag.s[usize::from(inputs[i].2.decoys.i)] =
+        (-((p * inputs[i].0.deref()) + c)) + nonce.deref();
+      inputs[i].0.zeroize();
+      nonce.zeroize();
+
+      debug_assert!(clsag
+        .verify(&inputs[i].2.decoys.ring, &inputs[i].1, &pseudo_out, &msg)
+        .is_ok());
+
+      res.push((clsag, pseudo_out));
+    }
+
+    res
+  }
+
+  /// Verify the CLSAG signature against the given Transaction data.
+  pub fn verify(
+    &self,
+    ring: &[[EdwardsPoint; 2]],
+    I: &EdwardsPoint,
+    pseudo_out: &EdwardsPoint,
+    msg: &[u8; 32],
+  ) -> Result<(), ClsagError> {
+    // Preliminary checks. s, c1, and points must also be encoded canonically, which isn't checked
+    // here
+    if ring.is_empty() {
+      Err(ClsagError::InvalidRing)?;
+    }
+    if ring.len() != self.s.len() {
+      Err(ClsagError::InvalidS)?;
+    }
+    if I.is_identity() {
+      Err(ClsagError::InvalidImage)?;
+    }
+
+    let D = self.D.mul_by_cofactor();
+    if D.is_identity() {
+      Err(ClsagError::InvalidD)?;
+    }
+
+    let (_, c1) = core(ring, I, pseudo_out, msg, &D, &self.s, &Mode::Verify(self.c1));
+    if c1 != self.c1 {
+      Err(ClsagError::InvalidC1)?;
+    }
+    Ok(())
+  }
+
+  pub(crate) fn fee_weight(ring_len: usize) -> usize {
+    (ring_len * 32) + 32 + 32
+  }
+
+  pub fn write<W: Write>(&self, w: &mut W) -> io::Result<()> {
+    write_raw_vec(write_scalar, &self.s, w)?;
+    w.write_all(&self.c1.to_bytes())?;
+    write_point(&self.D, w)
+  }
+
+  pub fn read<R: Read>(decoys: usize, r: &mut R) -> io::Result<Clsag> {
+    Ok(Clsag { s: read_raw_vec(read_scalar, decoys, r)?, c1: read_scalar(r)?, D: read_point(r)? })
+  }
+}

coins/monero/src/ringct/clsag/multisig.rs

@@ -0,0 +1,304 @@
+use core::{ops::Deref, fmt::Debug};
+use std_shims::io::{self, Read, Write};
+use std::sync::{Arc, RwLock};
+
+use rand_core::{RngCore, CryptoRng, SeedableRng};
+use rand_chacha::ChaCha20Rng;
+
+use zeroize::{Zeroize, ZeroizeOnDrop, Zeroizing};
+
+use curve25519_dalek::{scalar::Scalar, edwards::EdwardsPoint};
+
+use group::{ff::Field, Group, GroupEncoding};
+
+use transcript::{Transcript, RecommendedTranscript};
+use dalek_ff_group as dfg;
+use dleq::DLEqProof;
+use frost::{
+  dkg::lagrange,
+  curve::Ed25519,
+  Participant, FrostError, ThresholdKeys, ThresholdView,
+  algorithm::{WriteAddendum, Algorithm},
+};
+
+use crate::ringct::{
+  hash_to_point,
+  clsag::{ClsagInput, Clsag},
+};
+
+fn dleq_transcript() -> RecommendedTranscript {
+  RecommendedTranscript::new(b"monero_key_image_dleq")
+}
+
+impl ClsagInput {
+  fn transcript<T: Transcript>(&self, transcript: &mut T) {
+    // Doesn't domain separate as this is considered part of the larger CLSAG proof
+
+    // Ring index
+    transcript.append_message(b"real_spend", [self.decoys.i]);
+
+    // Ring
+    for (i, pair) in self.decoys.ring.iter().enumerate() {
+      // Doesn't include global output indexes as CLSAG doesn't care and won't be affected by it
+      // They're just a unreliable reference to this data which will be included in the message
+      // if in use
+      transcript.append_message(b"member", [u8::try_from(i).expect("ring size exceeded 255")]);
+      transcript.append_message(b"key", pair[0].compress().to_bytes());
+      transcript.append_message(b"commitment", pair[1].compress().to_bytes())
+    }
+
+    // Doesn't include the commitment's parts as the above ring + index includes the commitment
+    // The only potential malleability would be if the G/H relationship is known breaking the
+    // discrete log problem, which breaks everything already
+  }
+}
+
+/// CLSAG input and the mask to use for it.
+#[derive(Clone, Debug, Zeroize, ZeroizeOnDrop)]
+pub struct ClsagDetails {
+  input: ClsagInput,
+  mask: Scalar,
+}
+
+impl ClsagDetails {
+  pub fn new(input: ClsagInput, mask: Scalar) -> ClsagDetails {
+    ClsagDetails { input, mask }
+  }
+}
+
+/// Addendum produced during the FROST signing process with relevant data.
+#[derive(Clone, PartialEq, Eq, Zeroize, Debug)]
+pub struct ClsagAddendum {
+  pub(crate) key_image: dfg::EdwardsPoint,
+  dleq: DLEqProof<dfg::EdwardsPoint>,
+}
+
+impl WriteAddendum for ClsagAddendum {
+  fn write<W: Write>(&self, writer: &mut W) -> io::Result<()> {
+    writer.write_all(self.key_image.compress().to_bytes().as_ref())?;
+    self.dleq.write(writer)
+  }
+}
+
+#[allow(non_snake_case)]
+#[derive(Clone, PartialEq, Eq, Debug)]
+struct Interim {
+  p: Scalar,
+  c: Scalar,
+
+  clsag: Clsag,
+  pseudo_out: EdwardsPoint,
+}
+
+/// FROST algorithm for producing a CLSAG signature.
+#[allow(non_snake_case)]
+#[derive(Clone, Debug)]
+pub struct ClsagMultisig {
+  transcript: RecommendedTranscript,
+
+  pub(crate) H: EdwardsPoint,
+  // Merged here as CLSAG needs it, passing it would be a mess, yet having it beforehand requires
+  // an extra round
+  image: EdwardsPoint,
+
+  details: Arc<RwLock<Option<ClsagDetails>>>,
+
+  msg: Option<[u8; 32]>,
+  interim: Option<Interim>,
+}
+
+impl ClsagMultisig {
+  pub fn new(
+    transcript: RecommendedTranscript,
+    output_key: EdwardsPoint,
+    details: Arc<RwLock<Option<ClsagDetails>>>,
+  ) -> ClsagMultisig {
+    ClsagMultisig {
+      transcript,
+
+      H: hash_to_point(&output_key),
+      image: EdwardsPoint::identity(),
+
+      details,
+
+      msg: None,
+      interim: None,
+    }
+  }
+
+  fn input(&self) -> ClsagInput {
+    (*self.details.read().unwrap()).as_ref().unwrap().input.clone()
+  }
+
+  fn mask(&self) -> Scalar {
+    (*self.details.read().unwrap()).as_ref().unwrap().mask
+  }
+}
+
+pub(crate) fn add_key_image_share(
+  image: &mut EdwardsPoint,
+  generator: EdwardsPoint,
+  offset: Scalar,
+  included: &[Participant],
+  participant: Participant,
+  share: EdwardsPoint,
+) {
+  if image.is_identity().into() {
+    *image = generator * offset;
+  }
+  *image += share * lagrange::<dfg::Scalar>(participant, included).0;
+}
+
+impl Algorithm<Ed25519> for ClsagMultisig {
+  type Transcript = RecommendedTranscript;
+  type Addendum = ClsagAddendum;
+  type Signature = (Clsag, EdwardsPoint);
+
+  fn nonces(&self) -> Vec<Vec<dfg::EdwardsPoint>> {
+    vec![vec![dfg::EdwardsPoint::generator(), dfg::EdwardsPoint(self.H)]]
+  }
+
+  fn preprocess_addendum<R: RngCore + CryptoRng>(
+    &mut self,
+    rng: &mut R,
+    keys: &ThresholdKeys<Ed25519>,
+  ) -> ClsagAddendum {
+    ClsagAddendum {
+      key_image: dfg::EdwardsPoint(self.H) * keys.secret_share().deref(),
+      dleq: DLEqProof::prove(
+        rng,
+        // Doesn't take in a larger transcript object due to the usage of this
+        // Every prover would immediately write their own DLEq proof, when they can only do so in
+        // the proper order if they want to reach consensus
+        // It'd be a poor API to have CLSAG define a new transcript solely to pass here, just to
+        // try to merge later in some form, when it should instead just merge xH (as it does)
+        &mut dleq_transcript(),
+        &[dfg::EdwardsPoint::generator(), dfg::EdwardsPoint(self.H)],
+        keys.secret_share(),
+      ),
+    }
+  }
+
+  fn read_addendum<R: Read>(&self, reader: &mut R) -> io::Result<ClsagAddendum> {
+    let mut bytes = [0; 32];
+    reader.read_exact(&mut bytes)?;
+    // dfg ensures the point is torsion free
+    let xH = Option::<dfg::EdwardsPoint>::from(dfg::EdwardsPoint::from_bytes(&bytes))
+      .ok_or_else(|| io::Error::other("invalid key image"))?;
+    // Ensure this is a canonical point
+    if xH.to_bytes() != bytes {
+      Err(io::Error::other("non-canonical key image"))?;
+    }
+
+    Ok(ClsagAddendum { key_image: xH, dleq: DLEqProof::<dfg::EdwardsPoint>::read(reader)? })
+  }
+
+  fn process_addendum(
+    &mut self,
+    view: &ThresholdView<Ed25519>,
+    l: Participant,
+    addendum: ClsagAddendum,
+  ) -> Result<(), FrostError> {
+    if self.image.is_identity().into() {
+      self.transcript.domain_separate(b"CLSAG");
+      self.input().transcript(&mut self.transcript);
+      self.transcript.append_message(b"mask", self.mask().to_bytes());
+    }
+
+    self.transcript.append_message(b"participant", l.to_bytes());
+
+    addendum
+      .dleq
+      .verify(
+        &mut dleq_transcript(),
+        &[dfg::EdwardsPoint::generator(), dfg::EdwardsPoint(self.H)],
+        &[view.original_verification_share(l), addendum.key_image],
+      )
+      .map_err(|_| FrostError::InvalidPreprocess(l))?;
+
+    self.transcript.append_message(b"key_image_share", addendum.key_image.compress().to_bytes());
+    add_key_image_share(
+      &mut self.image,
+      self.H,
+      view.offset().0,
+      view.included(),
+      l,
+      addendum.key_image.0,
+    );
+
+    Ok(())
+  }
+
+  fn transcript(&mut self) -> &mut Self::Transcript {
+    &mut self.transcript
+  }
+
+  fn sign_share(
+    &mut self,
+    view: &ThresholdView<Ed25519>,
+    nonce_sums: &[Vec<dfg::EdwardsPoint>],
+    nonces: Vec<Zeroizing<dfg::Scalar>>,
+    msg: &[u8],
+  ) -> dfg::Scalar {
+    // Use the transcript to get a seeded random number generator
+    // The transcript contains private data, preventing passive adversaries from recreating this
+    // process even if they have access to commitments (specifically, the ring index being signed
+    // for, along with the mask which should not only require knowing the shared keys yet also the
+    // input commitment masks)
+    let mut rng = ChaCha20Rng::from_seed(self.transcript.rng_seed(b"decoy_responses"));
+
+    self.msg = Some(msg.try_into().expect("CLSAG message should be 32-bytes"));
+
+    #[allow(non_snake_case)]
+    let (clsag, pseudo_out, p, c) = Clsag::sign_core(
+      &mut rng,
+      &self.image,
+      &self.input(),
+      self.mask(),
+      self.msg.as_ref().unwrap(),
+      nonce_sums[0][0].0,
+      nonce_sums[0][1].0,
+    );
+    self.interim = Some(Interim { p, c, clsag, pseudo_out });
+
+    (-(dfg::Scalar(p) * view.secret_share().deref())) + nonces[0].deref()
+  }
+
+  #[must_use]
+  fn verify(
+    &self,
+    _: dfg::EdwardsPoint,
+    _: &[Vec<dfg::EdwardsPoint>],
+    sum: dfg::Scalar,
+  ) -> Option<Self::Signature> {
+    let interim = self.interim.as_ref().unwrap();
+    let mut clsag = interim.clsag.clone();
+    clsag.s[usize::from(self.input().decoys.i)] = sum.0 - interim.c;
+    if clsag
+      .verify(
+        &self.input().decoys.ring,
+        &self.image,
+        &interim.pseudo_out,
+        self.msg.as_ref().unwrap(),
+      )
+      .is_ok()
+    {
+      return Some((clsag, interim.pseudo_out));
+    }
+    None
+  }
+
+  fn verify_share(
+    &self,
+    verification_share: dfg::EdwardsPoint,
+    nonces: &[Vec<dfg::EdwardsPoint>],
+    share: dfg::Scalar,
+  ) -> Result<Vec<(dfg::Scalar, dfg::EdwardsPoint)>, ()> {
+    let interim = self.interim.as_ref().unwrap();
+    Ok(vec![
+      (share, dfg::EdwardsPoint::generator()),
+      (dfg::Scalar(interim.p), verification_share),
+      (-dfg::Scalar::ONE, nonces[0][0]),
+    ])
+  }
+}

coins/monero/src/ringct/hash_to_point.rs

@@ -0,0 +1,8 @@
+use curve25519_dalek::edwards::EdwardsPoint;
+
+pub use monero_generators::{hash_to_point as raw_hash_to_point};
+
+/// Monero's hash to point function, as named `ge_fromfe_frombytes_vartime`.
+pub fn hash_to_point(key: &EdwardsPoint) -> EdwardsPoint {
+  raw_hash_to_point(key.compress().to_bytes())
+}

coins/monero/src/ringct/mlsag.rs

@@ -1,11 +1,4 @@
-#![cfg_attr(docsrs, feature(doc_auto_cfg))]
-#![doc = include_str!("../README.md")]
-#![deny(missing_docs)]
-#![cfg_attr(not(feature = "std"), no_std)]
-#![allow(non_snake_case)]
-
 use std_shims::{
-  vec,
   vec::Vec,
   io::{self, Read, Write},
 };
@@ -14,43 +7,33 @@ use zeroize::Zeroize;
 
 use curve25519_dalek::{traits::IsIdentity, Scalar, EdwardsPoint};
 
-use monero_io::*;
-use monero_generators::{H, hash_to_point};
-use monero_primitives::keccak256_to_scalar;
+use monero_generators::H;
 
-/// Errors when working with MLSAGs.
-#[derive(Clone, Copy, PartialEq, Eq, Debug, thiserror::Error)]
+use crate::{hash_to_scalar, ringct::hash_to_point, serialize::*};
+
+#[derive(Clone, Copy, PartialEq, Eq, Debug)]
+#[cfg_attr(feature = "std", derive(thiserror::Error))]
 pub enum MlsagError {
-  /// Invalid ring (such as too small or too large).
-  #[error("invalid ring")]
+  #[cfg_attr(feature = "std", error("invalid ring"))]
   InvalidRing,
-  /// Invalid amount of key images.
-  #[error("invalid amount of key images")]
+  #[cfg_attr(feature = "std", error("invalid amount of key images"))]
   InvalidAmountOfKeyImages,
-  /// Invalid ss matrix.
-  #[error("invalid ss")]
+  #[cfg_attr(feature = "std", error("invalid ss"))]
   InvalidSs,
-  /// Invalid key image.
-  #[error("invalid key image")]
-  InvalidKeyImage,
-  /// Invalid ci vector.
-  #[error("invalid ci")]
+  #[cfg_attr(feature = "std", error("key image was identity"))]
+  IdentityKeyImage,
+  #[cfg_attr(feature = "std", error("invalid ci"))]
   InvalidCi,
 }
 
-/// A vector of rings, forming a matrix, to verify the MLSAG with.
 #[derive(Clone, PartialEq, Eq, Debug, Zeroize)]
 pub struct RingMatrix {
   matrix: Vec<Vec<EdwardsPoint>>,
 }
 
 impl RingMatrix {
-  /// Construct a ring matrix from an already formatted series of points.
-  fn new(matrix: Vec<Vec<EdwardsPoint>>) -> Result<Self, MlsagError> {
-    // Monero requires that there is more than one ring member for MLSAG signatures:
-    // https://github.com/monero-project/monero/blob/ac02af92867590ca80b2779a7bbeafa99ff94dcb/
-    // src/ringct/rctSigs.cpp#L462
-    if matrix.len() < 2 {
+  pub fn new(matrix: Vec<Vec<EdwardsPoint>>) -> Result<Self, MlsagError> {
+    if matrix.is_empty() {
       Err(MlsagError::InvalidRing)?;
     }
     for member in &matrix {
@@ -74,17 +57,16 @@ impl RingMatrix {
     RingMatrix::new(matrix)
   }
 
-  /// Iterate over the members of the matrix.
-  fn iter(&self) -> impl Iterator<Item = &[EdwardsPoint]> {
+  pub fn iter(&self) -> impl Iterator<Item = &[EdwardsPoint]> {
     self.matrix.iter().map(AsRef::as_ref)
   }
 
-  /// Get the amount of members in the ring.
+  /// Return the amount of members in the ring.
   pub fn members(&self) -> usize {
     self.matrix.len()
   }
 
-  /// Get the length of a ring member.
+  /// Returns the length of a ring member.
   ///
   /// A ring member is a vector of points for which the signer knows all of the discrete logarithms
   /// of.
@@ -94,15 +76,13 @@ impl RingMatrix {
   }
 }
 
-/// The MLSAG linkable ring signature, as used in Monero.
 #[derive(Clone, PartialEq, Eq, Debug, Zeroize)]
 pub struct Mlsag {
-  ss: Vec<Vec<Scalar>>,
-  cc: Scalar,
+  pub ss: Vec<Vec<Scalar>>,
+  pub cc: Scalar,
 }
 
 impl Mlsag {
-  /// Write a MLSAG.
   pub fn write<W: Write>(&self, w: &mut W) -> io::Result<()> {
     for ss in &self.ss {
       write_raw_vec(write_scalar, ss, w)?;
@@ -110,7 +90,6 @@ impl Mlsag {
     write_scalar(&self.cc, w)
   }
 
-  /// Read a MLSAG.
   pub fn read<R: Read>(mixins: usize, ss_2_elements: usize, r: &mut R) -> io::Result<Mlsag> {
     Ok(Mlsag {
       ss: (0 .. mixins)
@@ -120,7 +99,6 @@ impl Mlsag {
     })
   }
 
-  /// Verify a MLSAG.
   pub fn verify(
     &self,
     msg: &[u8; 32],
@@ -155,24 +133,23 @@ impl Mlsag {
         #[allow(non_snake_case)]
         let L = EdwardsPoint::vartime_double_scalar_mul_basepoint(&ci, ring_member_entry, s);
 
-        let compressed_ring_member_entry = ring_member_entry.compress();
-        buf.extend_from_slice(compressed_ring_member_entry.as_bytes());
+        buf.extend_from_slice(ring_member_entry.compress().as_bytes());
         buf.extend_from_slice(L.compress().as_bytes());
 
         // Not all dimensions need to be linkable, e.g. commitments, and only linkable layers need
         // to have key images.
         if let Some(ki) = ki {
-          if ki.is_identity() || (!ki.is_torsion_free()) {
-            Err(MlsagError::InvalidKeyImage)?;
+          if ki.is_identity() {
+            Err(MlsagError::IdentityKeyImage)?;
           }
 
           #[allow(non_snake_case)]
-          let R = (s * hash_to_point(compressed_ring_member_entry.to_bytes())) + (ci * ki);
+          let R = (s * hash_to_point(ring_member_entry)) + (ci * ki);
           buf.extend_from_slice(R.compress().as_bytes());
         }
       }
 
-      ci = keccak256_to_scalar(&buf);
+      ci = hash_to_scalar(&buf);
       // keep the msg in the buffer.
       buf.drain(msg.len() ..);
     }
@@ -184,9 +161,8 @@ impl Mlsag {
   }
 }
 
-/// Builder for a RingMatrix when using an aggregate signature.
-///
-/// This handles the formatting as necessary.
+/// An aggregate ring matrix builder, usable to set up the ring matrix to prove/verify an aggregate
+/// MLSAG signature.
 #[derive(Clone, PartialEq, Eq, Debug, Zeroize)]
 pub struct AggregateRingMatrixBuilder {
   key_ring: Vec<Vec<EdwardsPoint>>,
@@ -197,12 +173,12 @@ pub struct AggregateRingMatrixBuilder {
 impl AggregateRingMatrixBuilder {
   /// Create a new AggregateRingMatrixBuilder.
   ///
-  /// This takes in the transaction's outputs' commitments and fee used.
+  /// Takes in the transaction's outputs; commitments and fee.
   pub fn new(commitments: &[EdwardsPoint], fee: u64) -> Self {
     AggregateRingMatrixBuilder {
       key_ring: vec![],
       amounts_ring: vec![],
-      sum_out: commitments.iter().sum::<EdwardsPoint>() + (*H * Scalar::from(fee)),
+      sum_out: commitments.iter().sum::<EdwardsPoint>() + (H() * Scalar::from(fee)),
     }
   }
 
@@ -227,7 +203,7 @@ impl AggregateRingMatrixBuilder {
     Ok(())
   }
 
-  /// Build and return the [`RingMatrix`].
+  /// Build and return the [`RingMatrix`]
   pub fn build(mut self) -> Result<RingMatrix, MlsagError> {
     for (i, amount_commitment) in self.amounts_ring.drain(..).enumerate() {
       self.key_ring[i].push(amount_commitment);

coins/monero/src/ringct/mod.rs

@@ -0,0 +1,389 @@
+use core::ops::Deref;
+use std_shims::{
+  vec::Vec,
+  io::{self, Read, Write},
+};
+
+use zeroize::{Zeroize, Zeroizing};
+
+use curve25519_dalek::{constants::ED25519_BASEPOINT_TABLE, scalar::Scalar, edwards::EdwardsPoint};
+
+pub(crate) mod hash_to_point;
+pub use hash_to_point::{raw_hash_to_point, hash_to_point};
+
+/// MLSAG struct, along with verifying functionality.
+pub mod mlsag;
+/// CLSAG struct, along with signing and verifying functionality.
+pub mod clsag;
+/// BorromeanRange struct, along with verifying functionality.
+pub mod borromean;
+/// Bulletproofs(+) structs, along with proving and verifying functionality.
+pub mod bulletproofs;
+
+use crate::{
+  Protocol,
+  serialize::*,
+  ringct::{mlsag::Mlsag, clsag::Clsag, borromean::BorromeanRange, bulletproofs::Bulletproofs},
+};
+
+/// Generate a key image for a given key. Defined as `x * hash_to_point(xG)`.
+pub fn generate_key_image(secret: &Zeroizing<Scalar>) -> EdwardsPoint {
+  hash_to_point(&(ED25519_BASEPOINT_TABLE * secret.deref())) * secret.deref()
+}
+
+#[derive(Clone, PartialEq, Eq, Debug)]
+pub enum EncryptedAmount {
+  Original { mask: [u8; 32], amount: [u8; 32] },
+  Compact { amount: [u8; 8] },
+}
+
+impl EncryptedAmount {
+  pub fn read<R: Read>(compact: bool, r: &mut R) -> io::Result<EncryptedAmount> {
+    Ok(if !compact {
+      EncryptedAmount::Original { mask: read_bytes(r)?, amount: read_bytes(r)? }
+    } else {
+      EncryptedAmount::Compact { amount: read_bytes(r)? }
+    })
+  }
+
+  pub fn write<W: Write>(&self, w: &mut W) -> io::Result<()> {
+    match self {
+      EncryptedAmount::Original { mask, amount } => {
+        w.write_all(mask)?;
+        w.write_all(amount)
+      }
+      EncryptedAmount::Compact { amount } => w.write_all(amount),
+    }
+  }
+}
+
+#[derive(Clone, Copy, PartialEq, Eq, Debug, Zeroize)]
+pub enum RctType {
+  /// No RCT proofs.
+  Null,
+  /// One MLSAG for multiple inputs and Borromean range proofs (RCTTypeFull).
+  MlsagAggregate,
+  // One MLSAG for each input and a Borromean range proof (RCTTypeSimple).
+  MlsagIndividual,
+  // One MLSAG for each input and a Bulletproof (RCTTypeBulletproof).
+  Bulletproofs,
+  /// One MLSAG for each input and a Bulletproof, yet starting to use EncryptedAmount::Compact
+  /// (RCTTypeBulletproof2).
+  BulletproofsCompactAmount,
+  /// One CLSAG for each input and a Bulletproof (RCTTypeCLSAG).
+  Clsag,
+  /// One CLSAG for each input and a Bulletproof+ (RCTTypeBulletproofPlus).
+  BulletproofsPlus,
+}
+
+impl RctType {
+  pub fn to_byte(self) -> u8 {
+    match self {
+      RctType::Null => 0,
+      RctType::MlsagAggregate => 1,
+      RctType::MlsagIndividual => 2,
+      RctType::Bulletproofs => 3,
+      RctType::BulletproofsCompactAmount => 4,
+      RctType::Clsag => 5,
+      RctType::BulletproofsPlus => 6,
+    }
+  }
+
+  pub fn from_byte(byte: u8) -> Option<Self> {
+    Some(match byte {
+      0 => RctType::Null,
+      1 => RctType::MlsagAggregate,
+      2 => RctType::MlsagIndividual,
+      3 => RctType::Bulletproofs,
+      4 => RctType::BulletproofsCompactAmount,
+      5 => RctType::Clsag,
+      6 => RctType::BulletproofsPlus,
+      _ => None?,
+    })
+  }
+
+  pub fn compact_encrypted_amounts(&self) -> bool {
+    match self {
+      RctType::Null |
+      RctType::MlsagAggregate |
+      RctType::MlsagIndividual |
+      RctType::Bulletproofs => false,
+      RctType::BulletproofsCompactAmount | RctType::Clsag | RctType::BulletproofsPlus => true,
+    }
+  }
+}
+
+#[derive(Clone, PartialEq, Eq, Debug)]
+pub struct RctBase {
+  pub fee: u64,
+  pub pseudo_outs: Vec<EdwardsPoint>,
+  pub encrypted_amounts: Vec<EncryptedAmount>,
+  pub commitments: Vec<EdwardsPoint>,
+}
+
+impl RctBase {
+  pub(crate) fn fee_weight(outputs: usize, fee: u64) -> usize {
+    // 1 byte for the RCT signature type
+    1 + (outputs * (8 + 32)) + varint_len(fee)
+  }
+
+  pub fn write<W: Write>(&self, w: &mut W, rct_type: RctType) -> io::Result<()> {
+    w.write_all(&[rct_type.to_byte()])?;
+    match rct_type {
+      RctType::Null => Ok(()),
+      _ => {
+        write_varint(&self.fee, w)?;
+        if rct_type == RctType::MlsagIndividual {
+          write_raw_vec(write_point, &self.pseudo_outs, w)?;
+        }
+        for encrypted_amount in &self.encrypted_amounts {
+          encrypted_amount.write(w)?;
+        }
+        write_raw_vec(write_point, &self.commitments, w)
+      }
+    }
+  }
+
+  pub fn read<R: Read>(inputs: usize, outputs: usize, r: &mut R) -> io::Result<(RctBase, RctType)> {
+    let rct_type =
+      RctType::from_byte(read_byte(r)?).ok_or_else(|| io::Error::other("invalid RCT type"))?;
+
+    match rct_type {
+      RctType::Null | RctType::MlsagAggregate | RctType::MlsagIndividual => {}
+      RctType::Bulletproofs |
+      RctType::BulletproofsCompactAmount |
+      RctType::Clsag |
+      RctType::BulletproofsPlus => {
+        if outputs == 0 {
+          // Because the Bulletproofs(+) layout must be canonical, there must be 1 Bulletproof if
+          // Bulletproofs are in use
+          // If there are Bulletproofs, there must be a matching amount of outputs, implicitly
+          // banning 0 outputs
+          // Since HF 12 (CLSAG being 13), a 2-output minimum has also been enforced
+          Err(io::Error::other("RCT with Bulletproofs(+) had 0 outputs"))?;
+        }
+      }
+    }
+
+    Ok((
+      if rct_type == RctType::Null {
+        RctBase { fee: 0, pseudo_outs: vec![], encrypted_amounts: vec![], commitments: vec![] }
+      } else {
+        RctBase {
+          fee: read_varint(r)?,
+          pseudo_outs: if rct_type == RctType::MlsagIndividual {
+            read_raw_vec(read_point, inputs, r)?
+          } else {
+            vec![]
+          },
+          encrypted_amounts: (0 .. outputs)
+            .map(|_| EncryptedAmount::read(rct_type.compact_encrypted_amounts(), r))
+            .collect::<Result<_, _>>()?,
+          commitments: read_raw_vec(read_point, outputs, r)?,
+        }
+      },
+      rct_type,
+    ))
+  }
+}
+
+#[derive(Clone, PartialEq, Eq, Debug)]
+pub enum RctPrunable {
+  Null,
+  AggregateMlsagBorromean {
+    borromean: Vec<BorromeanRange>,
+    mlsag: Mlsag,
+  },
+  MlsagBorromean {
+    borromean: Vec<BorromeanRange>,
+    mlsags: Vec<Mlsag>,
+  },
+  MlsagBulletproofs {
+    bulletproofs: Bulletproofs,
+    mlsags: Vec<Mlsag>,
+    pseudo_outs: Vec<EdwardsPoint>,
+  },
+  Clsag {
+    bulletproofs: Bulletproofs,
+    clsags: Vec<Clsag>,
+    pseudo_outs: Vec<EdwardsPoint>,
+  },
+}
+
+impl RctPrunable {
+  pub(crate) fn fee_weight(protocol: Protocol, inputs: usize, outputs: usize) -> usize {
+    // 1 byte for number of BPs (technically a VarInt, yet there's always just zero or one)
+    1 + Bulletproofs::fee_weight(protocol.bp_plus(), outputs) +
+      (inputs * (Clsag::fee_weight(protocol.ring_len()) + 32))
+  }
+
+  pub fn write<W: Write>(&self, w: &mut W, rct_type: RctType) -> io::Result<()> {
+    match self {
+      RctPrunable::Null => Ok(()),
+      RctPrunable::AggregateMlsagBorromean { borromean, mlsag } => {
+        write_raw_vec(BorromeanRange::write, borromean, w)?;
+        mlsag.write(w)
+      }
+      RctPrunable::MlsagBorromean { borromean, mlsags } => {
+        write_raw_vec(BorromeanRange::write, borromean, w)?;
+        write_raw_vec(Mlsag::write, mlsags, w)
+      }
+      RctPrunable::MlsagBulletproofs { bulletproofs, mlsags, pseudo_outs } => {
+        if rct_type == RctType::Bulletproofs {
+          w.write_all(&1u32.to_le_bytes())?;
+        } else {
+          w.write_all(&[1])?;
+        }
+        bulletproofs.write(w)?;
+
+        write_raw_vec(Mlsag::write, mlsags, w)?;
+        write_raw_vec(write_point, pseudo_outs, w)
+      }
+      RctPrunable::Clsag { bulletproofs, clsags, pseudo_outs } => {
+        w.write_all(&[1])?;
+        bulletproofs.write(w)?;
+
+        write_raw_vec(Clsag::write, clsags, w)?;
+        write_raw_vec(write_point, pseudo_outs, w)
+      }
+    }
+  }
+
+  pub fn serialize(&self, rct_type: RctType) -> Vec<u8> {
+    let mut serialized = vec![];
+    self.write(&mut serialized, rct_type).unwrap();
+    serialized
+  }
+
+  pub fn read<R: Read>(
+    rct_type: RctType,
+    decoys: &[usize],
+    outputs: usize,
+    r: &mut R,
+  ) -> io::Result<RctPrunable> {
+    // While we generally don't bother with misc consensus checks, this affects the safety of
+    // the below defined rct_type function
+    // The exact line preventing zero-input transactions is:
+    // https://github.com/monero-project/monero/blob/00fd416a99686f0956361d1cd0337fe56e58d4a7/
+    //   src/ringct/rctSigs.cpp#L609
+    // And then for RctNull, that's only allowed for miner TXs which require one input of
+    // Input::Gen
+    if decoys.is_empty() {
+      Err(io::Error::other("transaction had no inputs"))?;
+    }
+
+    Ok(match rct_type {
+      RctType::Null => RctPrunable::Null,
+      RctType::MlsagAggregate => RctPrunable::AggregateMlsagBorromean {
+        borromean: read_raw_vec(BorromeanRange::read, outputs, r)?,
+        mlsag: Mlsag::read(decoys[0], decoys.len() + 1, r)?,
+      },
+      RctType::MlsagIndividual => RctPrunable::MlsagBorromean {
+        borromean: read_raw_vec(BorromeanRange::read, outputs, r)?,
+        mlsags: decoys.iter().map(|d| Mlsag::read(*d, 2, r)).collect::<Result<_, _>>()?,
+      },
+      RctType::Bulletproofs | RctType::BulletproofsCompactAmount => {
+        RctPrunable::MlsagBulletproofs {
+          bulletproofs: {
+            if (if rct_type == RctType::Bulletproofs {
+              u64::from(read_u32(r)?)
+            } else {
+              read_varint(r)?
+            }) != 1
+            {
+              Err(io::Error::other("n bulletproofs instead of one"))?;
+            }
+            Bulletproofs::read(r)?
+          },
+          mlsags: decoys.iter().map(|d| Mlsag::read(*d, 2, r)).collect::<Result<_, _>>()?,
+          pseudo_outs: read_raw_vec(read_point, decoys.len(), r)?,
+        }
+      }
+      RctType::Clsag | RctType::BulletproofsPlus => RctPrunable::Clsag {
+        bulletproofs: {
+          if read_varint::<_, u64>(r)? != 1 {
+            Err(io::Error::other("n bulletproofs instead of one"))?;
+          }
+          (if rct_type == RctType::Clsag { Bulletproofs::read } else { Bulletproofs::read_plus })(
+            r,
+          )?
+        },
+        clsags: (0 .. decoys.len()).map(|o| Clsag::read(decoys[o], r)).collect::<Result<_, _>>()?,
+        pseudo_outs: read_raw_vec(read_point, decoys.len(), r)?,
+      },
+    })
+  }
+
+  pub(crate) fn signature_write<W: Write>(&self, w: &mut W) -> io::Result<()> {
+    match self {
+      RctPrunable::Null => panic!("Serializing RctPrunable::Null for a signature"),
+      RctPrunable::AggregateMlsagBorromean { borromean, .. } |
+      RctPrunable::MlsagBorromean { borromean, .. } => {
+        borromean.iter().try_for_each(|rs| rs.write(w))
+      }
+      RctPrunable::MlsagBulletproofs { bulletproofs, .. } |
+      RctPrunable::Clsag { bulletproofs, .. } => bulletproofs.signature_write(w),
+    }
+  }
+}
+
+#[derive(Clone, PartialEq, Eq, Debug)]
+pub struct RctSignatures {
+  pub base: RctBase,
+  pub prunable: RctPrunable,
+}
+
+impl RctSignatures {
+  /// RctType for a given RctSignatures struct.
+  pub fn rct_type(&self) -> RctType {
+    match &self.prunable {
+      RctPrunable::Null => RctType::Null,
+      RctPrunable::AggregateMlsagBorromean { .. } => RctType::MlsagAggregate,
+      RctPrunable::MlsagBorromean { .. } => RctType::MlsagIndividual,
+      // RctBase ensures there's at least one output, making the following
+      // inferences guaranteed/expects impossible on any valid RctSignatures
+      RctPrunable::MlsagBulletproofs { .. } => {
+        if matches!(
+          self
+            .base
+            .encrypted_amounts
+            .first()
+            .expect("MLSAG with Bulletproofs didn't have any outputs"),
+          EncryptedAmount::Original { .. }
+        ) {
+          RctType::Bulletproofs
+        } else {
+          RctType::BulletproofsCompactAmount
+        }
+      }
+      RctPrunable::Clsag { bulletproofs, .. } => {
+        if matches!(bulletproofs, Bulletproofs::Original { .. }) {
+          RctType::Clsag
+        } else {
+          RctType::BulletproofsPlus
+        }
+      }
+    }
+  }
+
+  pub(crate) fn fee_weight(protocol: Protocol, inputs: usize, outputs: usize, fee: u64) -> usize {
+    RctBase::fee_weight(outputs, fee) + RctPrunable::fee_weight(protocol, inputs, outputs)
+  }
+
+  pub fn write<W: Write>(&self, w: &mut W) -> io::Result<()> {
+    let rct_type = self.rct_type();
+    self.base.write(w, rct_type)?;
+    self.prunable.write(w, rct_type)
+  }
+
+  pub fn serialize(&self) -> Vec<u8> {
+    let mut serialized = vec![];
+    self.write(&mut serialized).unwrap();
+    serialized
+  }
+
+  pub fn read<R: Read>(decoys: &[usize], outputs: usize, r: &mut R) -> io::Result<RctSignatures> {
+    let base = RctBase::read(decoys.len(), outputs, r)?;
+    Ok(RctSignatures { base: base.0, prunable: RctPrunable::read(base.1, decoys, outputs, r)? })
+  }
+}

coins/monero/src/rpc/http.rs

@@ -1,10 +1,7 @@
-#![cfg_attr(docsrs, feature(doc_auto_cfg))]
-#![doc = include_str!("../README.md")]
-#![deny(missing_docs)]
-
-use core::future::Future;
 use std::{sync::Arc, io::Read, time::Duration};
 
+use async_trait::async_trait;
+
 use tokio::sync::Mutex;
 
 use digest_auth::{WwwAuthenticateHeader, AuthContext};
@@ -13,7 +10,7 @@ use simple_request::{
   Response, Client,
 };
 
-use monero_rpc::{RpcError, Rpc};
+use crate::rpc::{RpcError, RpcConnection, Rpc};
 
 const DEFAULT_TIMEOUT: Duration = Duration::from_secs(30);
 
@@ -36,13 +33,13 @@ enum Authentication {
 ///
 /// Requires tokio.
 #[derive(Clone, Debug)]
-pub struct SimpleRequestRpc {
+pub struct HttpRpc {
   authentication: Authentication,
   url: String,
   request_timeout: Duration,
 }
 
-impl SimpleRequestRpc {
+impl HttpRpc {
   fn digest_auth_challenge(
     response: &Response,
   ) -> Result<Option<(WwwAuthenticateHeader, u64)>, RpcError> {
@@ -63,7 +60,7 @@ impl SimpleRequestRpc {
   ///
   /// A daemon requiring authentication can be used via including the username and password in the
   /// URL.
-  pub async fn new(url: String) -> Result<SimpleRequestRpc, RpcError> {
+  pub async fn new(url: String) -> Result<Rpc<HttpRpc>, RpcError> {
     Self::with_custom_timeout(url, DEFAULT_TIMEOUT).await
   }
 
@@ -74,7 +71,7 @@ impl SimpleRequestRpc {
   pub async fn with_custom_timeout(
     mut url: String,
     request_timeout: Duration,
-  ) -> Result<SimpleRequestRpc, RpcError> {
+  ) -> Result<Rpc<HttpRpc>, RpcError> {
     let authentication = if url.contains('@') {
       // Parse out the username and password
       let url_clone = url;
@@ -122,11 +119,11 @@ impl SimpleRequestRpc {
       Authentication::Unauthenticated(Client::with_connection_pool())
     };
 
-    Ok(SimpleRequestRpc { authentication, url, request_timeout })
+    Ok(Rpc(HttpRpc { authentication, url, request_timeout }))
   }
 }
 
-impl SimpleRequestRpc {
+impl HttpRpc {
   async fn inner_post(&self, route: &str, body: Vec<u8>) -> Result<Vec<u8>, RpcError> {
     let request_fn = |uri| {
       Request::post(uri)
@@ -279,16 +276,11 @@ impl SimpleRequestRpc {
   }
 }
 
-impl Rpc for SimpleRequestRpc {
-  fn post(
-    &self,
-    route: &str,
-    body: Vec<u8>,
-  ) -> impl Send + Future<Output = Result<Vec<u8>, RpcError>> {
-    async move {
-      tokio::time::timeout(self.request_timeout, self.inner_post(route, body))
-        .await
-        .map_err(|e| RpcError::ConnectionError(format!("{e:?}")))?
-    }
+#[async_trait]
+impl RpcConnection for HttpRpc {
+  async fn post(&self, route: &str, body: Vec<u8>) -> Result<Vec<u8>, RpcError> {
+    tokio::time::timeout(self.request_timeout, self.inner_post(route, body))
+      .await
+      .map_err(|e| RpcError::ConnectionError(format!("{e:?}")))?
   }
 }

coins/monero/src/rpc/mod.rs

@@ -0,0 +1,739 @@
+use core::fmt::Debug;
+#[cfg(not(feature = "std"))]
+use alloc::boxed::Box;
+use std_shims::{
+  vec::Vec,
+  io,
+  string::{String, ToString},
+};
+
+use async_trait::async_trait;
+
+use curve25519_dalek::edwards::{EdwardsPoint, CompressedEdwardsY};
+
+use serde::{Serialize, Deserialize, de::DeserializeOwned};
+use serde_json::{Value, json};
+
+use crate::{
+  Protocol,
+  serialize::*,
+  transaction::{Input, Timelock, Transaction},
+  block::Block,
+  wallet::{FeePriority, Fee},
+};
+
+#[cfg(feature = "http-rpc")]
+mod http;
+#[cfg(feature = "http-rpc")]
+pub use http::*;
+
+// Number of blocks the fee estimate will be valid for
+// https://github.com/monero-project/monero/blob/94e67bf96bbc010241f29ada6abc89f49a81759c/
+//   src/wallet/wallet2.cpp#L121
+const GRACE_BLOCKS_FOR_FEE_ESTIMATE: u64 = 10;
+
+#[derive(Deserialize, Debug)]
+pub struct EmptyResponse {}
+#[derive(Deserialize, Debug)]
+pub struct JsonRpcResponse<T> {
+  result: T,
+}
+
+#[derive(Deserialize, Debug)]
+struct TransactionResponse {
+  tx_hash: String,
+  as_hex: String,
+  pruned_as_hex: String,
+}
+#[derive(Deserialize, Debug)]
+struct TransactionsResponse {
+  #[serde(default)]
+  missed_tx: Vec<String>,
+  txs: Vec<TransactionResponse>,
+}
+
+#[derive(Clone, PartialEq, Eq, Debug)]
+#[cfg_attr(feature = "std", derive(thiserror::Error))]
+pub enum RpcError {
+  #[cfg_attr(feature = "std", error("internal error ({0})"))]
+  InternalError(&'static str),
+  #[cfg_attr(feature = "std", error("connection error ({0})"))]
+  ConnectionError(String),
+  #[cfg_attr(feature = "std", error("invalid node ({0})"))]
+  InvalidNode(String),
+  #[cfg_attr(feature = "std", error("unsupported protocol version ({0})"))]
+  UnsupportedProtocol(usize),
+  #[cfg_attr(feature = "std", error("transactions not found"))]
+  TransactionsNotFound(Vec<[u8; 32]>),
+  #[cfg_attr(feature = "std", error("invalid point ({0})"))]
+  InvalidPoint(String),
+  #[cfg_attr(feature = "std", error("pruned transaction"))]
+  PrunedTransaction,
+  #[cfg_attr(feature = "std", error("invalid transaction ({0:?})"))]
+  InvalidTransaction([u8; 32]),
+  #[cfg_attr(feature = "std", error("unexpected fee response"))]
+  InvalidFee,
+  #[cfg_attr(feature = "std", error("invalid priority"))]
+  InvalidPriority,
+}
+
+fn rpc_hex(value: &str) -> Result<Vec<u8>, RpcError> {
+  hex::decode(value).map_err(|_| RpcError::InvalidNode("expected hex wasn't hex".to_string()))
+}
+
+fn hash_hex(hash: &str) -> Result<[u8; 32], RpcError> {
+  rpc_hex(hash)?.try_into().map_err(|_| RpcError::InvalidNode("hash wasn't 32-bytes".to_string()))
+}
+
+fn rpc_point(point: &str) -> Result<EdwardsPoint, RpcError> {
+  CompressedEdwardsY(
+    rpc_hex(point)?.try_into().map_err(|_| RpcError::InvalidPoint(point.to_string()))?,
+  )
+  .decompress()
+  .ok_or_else(|| RpcError::InvalidPoint(point.to_string()))
+}
+
+// Read an EPEE VarInt, distinct from the VarInts used throughout the rest of the protocol
+fn read_epee_vi<R: io::Read>(reader: &mut R) -> io::Result<u64> {
+  let vi_start = read_byte(reader)?;
+  let len = match vi_start & 0b11 {
+    0 => 1,
+    1 => 2,
+    2 => 4,
+    3 => 8,
+    _ => unreachable!(),
+  };
+  let mut vi = u64::from(vi_start >> 2);
+  for i in 1 .. len {
+    vi |= u64::from(read_byte(reader)?) << (((i - 1) * 8) + 6);
+  }
+  Ok(vi)
+}
+
+#[async_trait]
+pub trait RpcConnection: Clone + Debug {
+  /// Perform a POST request to the specified route with the specified body.
+  ///
+  /// The implementor is left to handle anything such as authentication.
+  async fn post(&self, route: &str, body: Vec<u8>) -> Result<Vec<u8>, RpcError>;
+}
+
+// TODO: Make this provided methods for RpcConnection?
+#[derive(Clone, Debug)]
+pub struct Rpc<R: RpcConnection>(R);
+impl<R: RpcConnection> Rpc<R> {
+  /// Perform a RPC call to the specified route with the provided parameters.
+  ///
+  /// This is NOT a JSON-RPC call. They use a route of "json_rpc" and are available via
+  /// `json_rpc_call`.
+  pub async fn rpc_call<Params: Serialize + Debug, Response: DeserializeOwned + Debug>(
+    &self,
+    route: &str,
+    params: Option<Params>,
+  ) -> Result<Response, RpcError> {
+    let res = self
+      .0
+      .post(
+        route,
+        if let Some(params) = params {
+          serde_json::to_string(&params).unwrap().into_bytes()
+        } else {
+          vec![]
+        },
+      )
+      .await?;
+    let res_str = std_shims::str::from_utf8(&res)
+      .map_err(|_| RpcError::InvalidNode("response wasn't utf-8".to_string()))?;
+    serde_json::from_str(res_str)
+      .map_err(|_| RpcError::InvalidNode(format!("response wasn't json: {res_str}")))
+  }
+
+  /// Perform a JSON-RPC call with the specified method with the provided parameters
+  pub async fn json_rpc_call<Response: DeserializeOwned + Debug>(
+    &self,
+    method: &str,
+    params: Option<Value>,
+  ) -> Result<Response, RpcError> {
+    let mut req = json!({ "method": method });
+    if let Some(params) = params {
+      req.as_object_mut().unwrap().insert("params".into(), params);
+    }
+    Ok(self.rpc_call::<_, JsonRpcResponse<Response>>("json_rpc", Some(req)).await?.result)
+  }
+
+  /// Perform a binary call to the specified route with the provided parameters.
+  pub async fn bin_call(&self, route: &str, params: Vec<u8>) -> Result<Vec<u8>, RpcError> {
+    self.0.post(route, params).await
+  }
+
+  /// Get the active blockchain protocol version.
+  pub async fn get_protocol(&self) -> Result<Protocol, RpcError> {
+    #[derive(Deserialize, Debug)]
+    struct ProtocolResponse {
+      major_version: usize,
+    }
+
+    #[derive(Deserialize, Debug)]
+    struct LastHeaderResponse {
+      block_header: ProtocolResponse,
+    }
+
+    Ok(
+      match self
+        .json_rpc_call::<LastHeaderResponse>("get_last_block_header", None)
+        .await?
+        .block_header
+        .major_version
+      {
+        13 | 14 => Protocol::v14,
+        15 | 16 => Protocol::v16,
+        protocol => Err(RpcError::UnsupportedProtocol(protocol))?,
+      },
+    )
+  }
+
+  pub async fn get_height(&self) -> Result<usize, RpcError> {
+    #[derive(Deserialize, Debug)]
+    struct HeightResponse {
+      height: usize,
+    }
+    Ok(self.rpc_call::<Option<()>, HeightResponse>("get_height", None).await?.height)
+  }
+
+  pub async fn get_transactions(&self, hashes: &[[u8; 32]]) -> Result<Vec<Transaction>, RpcError> {
+    if hashes.is_empty() {
+      return Ok(vec![]);
+    }
+
+    let mut hashes_hex = hashes.iter().map(hex::encode).collect::<Vec<_>>();
+    let mut all_txs = Vec::with_capacity(hashes.len());
+    while !hashes_hex.is_empty() {
+      // Monero errors if more than 100 is requested unless using a non-restricted RPC
+      const TXS_PER_REQUEST: usize = 100;
+      let this_count = TXS_PER_REQUEST.min(hashes_hex.len());
+
+      let txs: TransactionsResponse = self
+        .rpc_call(
+          "get_transactions",
+          Some(json!({
+            "txs_hashes": hashes_hex.drain(.. this_count).collect::<Vec<_>>(),
+          })),
+        )
+        .await?;
+
+      if !txs.missed_tx.is_empty() {
+        Err(RpcError::TransactionsNotFound(
+          txs.missed_tx.iter().map(|hash| hash_hex(hash)).collect::<Result<_, _>>()?,
+        ))?;
+      }
+
+      all_txs.extend(txs.txs);
+    }
+
+    all_txs
+      .iter()
+      .enumerate()
+      .map(|(i, res)| {
+        let tx = Transaction::read::<&[u8]>(
+          &mut rpc_hex(if !res.as_hex.is_empty() { &res.as_hex } else { &res.pruned_as_hex })?
+            .as_ref(),
+        )
+        .map_err(|_| match hash_hex(&res.tx_hash) {
+          Ok(hash) => RpcError::InvalidTransaction(hash),
+          Err(err) => err,
+        })?;
+
+        // https://github.com/monero-project/monero/issues/8311
+        if res.as_hex.is_empty() {
+          match tx.prefix.inputs.first() {
+            Some(Input::Gen { .. }) => (),
+            _ => Err(RpcError::PrunedTransaction)?,
+          }
+        }
+
+        // This does run a few keccak256 hashes, which is pointless if the node is trusted
+        // In exchange, this provides resilience against invalid/malicious nodes
+        if tx.hash() != hashes[i] {
+          Err(RpcError::InvalidNode(
+            "replied with transaction wasn't the requested transaction".to_string(),
+          ))?;
+        }
+
+        Ok(tx)
+      })
+      .collect()
+  }
+
+  pub async fn get_transaction(&self, tx: [u8; 32]) -> Result<Transaction, RpcError> {
+    self.get_transactions(&[tx]).await.map(|mut txs| txs.swap_remove(0))
+  }
+
+  /// Get the hash of a block from the node by the block's numbers.
+  /// This function does not verify the returned block hash is actually for the number in question.
+  pub async fn get_block_hash(&self, number: usize) -> Result<[u8; 32], RpcError> {
+    #[derive(Deserialize, Debug)]
+    struct BlockHeaderResponse {
+      hash: String,
+    }
+    #[derive(Deserialize, Debug)]
+    struct BlockHeaderByHeightResponse {
+      block_header: BlockHeaderResponse,
+    }
+
+    let header: BlockHeaderByHeightResponse =
+      self.json_rpc_call("get_block_header_by_height", Some(json!({ "height": number }))).await?;
+    hash_hex(&header.block_header.hash)
+  }
+
+  /// Get a block from the node by its hash.
+  /// This function does not verify the returned block actually has the hash in question.
+  pub async fn get_block(&self, hash: [u8; 32]) -> Result<Block, RpcError> {
+    #[derive(Deserialize, Debug)]
+    struct BlockResponse {
+      blob: String,
+    }
+
+    let res: BlockResponse =
+      self.json_rpc_call("get_block", Some(json!({ "hash": hex::encode(hash) }))).await?;
+
+    let block = Block::read::<&[u8]>(&mut rpc_hex(&res.blob)?.as_ref())
+      .map_err(|_| RpcError::InvalidNode("invalid block".to_string()))?;
+    if block.hash() != hash {
+      Err(RpcError::InvalidNode("different block than requested (hash)".to_string()))?;
+    }
+    Ok(block)
+  }
+
+  pub async fn get_block_by_number(&self, number: usize) -> Result<Block, RpcError> {
+    #[derive(Deserialize, Debug)]
+    struct BlockResponse {
+      blob: String,
+    }
+
+    let res: BlockResponse =
+      self.json_rpc_call("get_block", Some(json!({ "height": number }))).await?;
+
+    let block = Block::read::<&[u8]>(&mut rpc_hex(&res.blob)?.as_ref())
+      .map_err(|_| RpcError::InvalidNode("invalid block".to_string()))?;
+
+    // Make sure this is actually the block for this number
+    match block.miner_tx.prefix.inputs.first() {
+      Some(Input::Gen(actual)) => {
+        if usize::try_from(*actual).unwrap() == number {
+          Ok(block)
+        } else {
+          Err(RpcError::InvalidNode("different block than requested (number)".to_string()))
+        }
+      }
+      _ => Err(RpcError::InvalidNode(
+        "block's miner_tx didn't have an input of kind Input::Gen".to_string(),
+      )),
+    }
+  }
+
+  pub async fn get_block_transactions(&self, hash: [u8; 32]) -> Result<Vec<Transaction>, RpcError> {
+    let block = self.get_block(hash).await?;
+    let mut res = vec![block.miner_tx];
+    res.extend(self.get_transactions(&block.txs).await?);
+    Ok(res)
+  }
+
+  pub async fn get_block_transactions_by_number(
+    &self,
+    number: usize,
+  ) -> Result<Vec<Transaction>, RpcError> {
+    self.get_block_transactions(self.get_block_hash(number).await?).await
+  }
+
+  /// Get the output indexes of the specified transaction.
+  pub async fn get_o_indexes(&self, hash: [u8; 32]) -> Result<Vec<u64>, RpcError> {
+    /*
+    TODO: Use these when a suitable epee serde lib exists
+
+    #[derive(Serialize, Debug)]
+    struct Request {
+      txid: [u8; 32],
+    }
+
+    #[derive(Deserialize, Debug)]
+    struct OIndexes {
+      o_indexes: Vec<u64>,
+    }
+    */
+
+    // Given the immaturity of Rust epee libraries, this is a homegrown one which is only validated
+    // to work against this specific function
+
+    // Header for EPEE, an 8-byte magic and a version
+    const EPEE_HEADER: &[u8] = b"\x01\x11\x01\x01\x01\x01\x02\x01\x01";
+
+    let mut request = EPEE_HEADER.to_vec();
+    // Number of fields (shifted over 2 bits as the 2 LSBs are reserved for metadata)
+    request.push(1 << 2);
+    // Length of field name
+    request.push(4);
+    // Field name
+    request.extend(b"txid");
+    // Type of field
+    request.push(10);
+    // Length of string, since this byte array is technically a string
+    request.push(32 << 2);
+    // The "string"
+    request.extend(hash);
+
+    let indexes_buf = self.bin_call("get_o_indexes.bin", request).await?;
+    let mut indexes: &[u8] = indexes_buf.as_ref();
+
+    (|| {
+      let mut res = None;
+      let mut is_okay = false;
+
+      if read_bytes::<_, { EPEE_HEADER.len() }>(&mut indexes)? != EPEE_HEADER {
+        Err(io::Error::other("invalid header"))?;
+      }
+
+      let read_object = |reader: &mut &[u8]| -> io::Result<Vec<u64>> {
+        let fields = read_byte(reader)? >> 2;
+
+        for _ in 0 .. fields {
+          let name_len = read_byte(reader)?;
+          let name = read_raw_vec(read_byte, name_len.into(), reader)?;
+
+          let type_with_array_flag = read_byte(reader)?;
+          let kind = type_with_array_flag & (!0x80);
+
+          let iters = if type_with_array_flag != kind { read_epee_vi(reader)? } else { 1 };
+
+          if (&name == b"o_indexes") && (kind != 5) {
+            Err(io::Error::other("o_indexes weren't u64s"))?;
+          }
+
+          let f = match kind {
+            // i64
+            1 => |reader: &mut &[u8]| read_raw_vec(read_byte, 8, reader),
+            // i32
+            2 => |reader: &mut &[u8]| read_raw_vec(read_byte, 4, reader),
+            // i16
+            3 => |reader: &mut &[u8]| read_raw_vec(read_byte, 2, reader),
+            // i8
+            4 => |reader: &mut &[u8]| read_raw_vec(read_byte, 1, reader),
+            // u64
+            5 => |reader: &mut &[u8]| read_raw_vec(read_byte, 8, reader),
+            // u32
+            6 => |reader: &mut &[u8]| read_raw_vec(read_byte, 4, reader),
+            // u16
+            7 => |reader: &mut &[u8]| read_raw_vec(read_byte, 2, reader),
+            // u8
+            8 => |reader: &mut &[u8]| read_raw_vec(read_byte, 1, reader),
+            // double
+            9 => |reader: &mut &[u8]| read_raw_vec(read_byte, 8, reader),
+            // string, or any collection of bytes
+            10 => |reader: &mut &[u8]| {
+              let len = read_epee_vi(reader)?;
+              read_raw_vec(
+                read_byte,
+                len.try_into().map_err(|_| io::Error::other("u64 length exceeded usize"))?,
+                reader,
+              )
+            },
+            // bool
+            11 => |reader: &mut &[u8]| read_raw_vec(read_byte, 1, reader),
+            // object, errors here as it shouldn't be used on this call
+            12 => {
+              |_: &mut &[u8]| Err(io::Error::other("node used object in reply to get_o_indexes"))
+            }
+            // array, so far unused
+            13 => |_: &mut &[u8]| Err(io::Error::other("node used the unused array type")),
+            _ => |_: &mut &[u8]| Err(io::Error::other("node used an invalid type")),
+          };
+
+          let mut bytes_res = vec![];
+          for _ in 0 .. iters {
+            bytes_res.push(f(reader)?);
+          }
+
+          let mut actual_res = Vec::with_capacity(bytes_res.len());
+          match name.as_slice() {
+            b"o_indexes" => {
+              for o_index in bytes_res {
+                actual_res.push(u64::from_le_bytes(
+                  o_index
+                    .try_into()
+                    .map_err(|_| io::Error::other("node didn't provide 8 bytes for a u64"))?,
+                ));
+              }
+              res = Some(actual_res);
+            }
+            b"status" => {
+              if bytes_res
+                .first()
+                .ok_or_else(|| io::Error::other("status wasn't a string"))?
+                .as_slice() !=
+                b"OK"
+              {
+                // TODO: Better handle non-OK responses
+                Err(io::Error::other("response wasn't OK"))?;
+              }
+              is_okay = true;
+            }
+            _ => continue,
+          }
+
+          if is_okay && res.is_some() {
+            break;
+          }
+        }
+
+        // Didn't return a response with a status
+        // (if the status wasn't okay, we would've already errored)
+        if !is_okay {
+          Err(io::Error::other("response didn't contain a status"))?;
+        }
+
+        // If the Vec was empty, it would've been omitted, hence the unwrap_or
+        // TODO: Test against a 0-output TX, such as the ones found in block 202612
+        Ok(res.unwrap_or(vec![]))
+      };
+
+      read_object(&mut indexes)
+    })()
+    .map_err(|_| RpcError::InvalidNode("invalid binary response".to_string()))
+  }
+
+  /// Get the output distribution, from the specified height to the specified height (both
+  /// inclusive).
+  pub async fn get_output_distribution(
+    &self,
+    from: usize,
+    to: usize,
+  ) -> Result<Vec<u64>, RpcError> {
+    #[derive(Deserialize, Debug)]
+    struct Distribution {
+      distribution: Vec<u64>,
+    }
+
+    #[derive(Deserialize, Debug)]
+    struct Distributions {
+      distributions: Vec<Distribution>,
+    }
+
+    let mut distributions: Distributions = self
+      .json_rpc_call(
+        "get_output_distribution",
+        Some(json!({
+          "binary": false,
+          "amounts": [0],
+          "cumulative": true,
+          "from_height": from,
+          "to_height": to,
+        })),
+      )
+      .await?;
+
+    Ok(distributions.distributions.swap_remove(0).distribution)
+  }
+
+  /// Get the specified outputs from the RingCT (zero-amount) pool, but only return them if their
+  /// timelock has been satisfied.
+  ///
+  /// The timelock being satisfied is distinct from being free of the 10-block lock applied to all
+  /// Monero transactions.
+  pub async fn get_unlocked_outputs(
+    &self,
+    indexes: &[u64],
+    height: usize,
+  ) -> Result<Vec<Option<[EdwardsPoint; 2]>>, RpcError> {
+    #[derive(Deserialize, Debug)]
+    struct Out {
+      key: String,
+      mask: String,
+      txid: String,
+    }
+
+    #[derive(Deserialize, Debug)]
+    struct Outs {
+      outs: Vec<Out>,
+    }
+
+    let outs: Outs = self
+      .rpc_call(
+        "get_outs",
+        Some(json!({
+          "get_txid": true,
+          "outputs": indexes.iter().map(|o| json!({
+            "amount": 0,
+            "index": o
+          })).collect::<Vec<_>>()
+        })),
+      )
+      .await?;
+
+    let txs = self
+      .get_transactions(
+        &outs.outs.iter().map(|out| hash_hex(&out.txid)).collect::<Result<Vec<_>, _>>()?,
+      )
+      .await?;
+
+    // TODO: https://github.com/serai-dex/serai/issues/104
+    outs
+      .outs
+      .iter()
+      .enumerate()
+      .map(|(i, out)| {
+        // Allow keys to be invalid, though if they are, return None to trigger selection of a new
+        // decoy
+        // Only valid keys can be used in CLSAG proofs, hence the need for re-selection, yet
+        // invalid keys may honestly exist on the blockchain
+        // Only a recent hard fork checked output keys were valid points
+        let Some(key) = CompressedEdwardsY(
+          rpc_hex(&out.key)?
+            .try_into()
+            .map_err(|_| RpcError::InvalidNode("non-32-byte point".to_string()))?,
+        )
+        .decompress() else {
+          return Ok(None);
+        };
+        Ok(
+          Some([key, rpc_point(&out.mask)?])
+            .filter(|_| Timelock::Block(height) >= txs[i].prefix.timelock),
+        )
+      })
+      .collect()
+  }
+
+  async fn get_fee_v14(&self, priority: FeePriority) -> Result<Fee, RpcError> {
+    #[derive(Deserialize, Debug)]
+    struct FeeResponseV14 {
+      status: String,
+      fee: u64,
+      quantization_mask: u64,
+    }
+
+    // https://github.com/monero-project/monero/blob/94e67bf96bbc010241f29ada6abc89f49a81759c/
+    //   src/wallet/wallet2.cpp#L7569-L7584
+    // https://github.com/monero-project/monero/blob/94e67bf96bbc010241f29ada6abc89f49a81759c/
+    //   src/wallet/wallet2.cpp#L7660-L7661
+    let priority_idx =
+      usize::try_from(if priority.fee_priority() == 0 { 1 } else { priority.fee_priority() - 1 })
+        .map_err(|_| RpcError::InvalidPriority)?;
+    let multipliers = [1, 5, 25, 1000];
+    if priority_idx >= multipliers.len() {
+      // though not an RPC error, it seems sensible to treat as such
+      Err(RpcError::InvalidPriority)?;
+    }
+    let fee_multiplier = multipliers[priority_idx];
+
+    let res: FeeResponseV14 = self
+      .json_rpc_call(
+        "get_fee_estimate",
+        Some(json!({ "grace_blocks": GRACE_BLOCKS_FOR_FEE_ESTIMATE })),
+      )
+      .await?;
+
+    if res.status != "OK" {
+      Err(RpcError::InvalidFee)?;
+    }
+
+    Ok(Fee { per_weight: res.fee * fee_multiplier, mask: res.quantization_mask })
+  }
+
+  /// Get the currently estimated fee from the node.
+  ///
+  /// This may be manipulated to unsafe levels and MUST be sanity checked.
+  // TODO: Take a sanity check argument
+  pub async fn get_fee(&self, protocol: Protocol, priority: FeePriority) -> Result<Fee, RpcError> {
+    // TODO: Implement wallet2's adjust_priority which by default automatically uses a lower
+    // priority than provided depending on the backlog in the pool
+    if protocol.v16_fee() {
+      #[derive(Deserialize, Debug)]
+      struct FeeResponse {
+        status: String,
+        fees: Vec<u64>,
+        quantization_mask: u64,
+      }
+
+      let res: FeeResponse = self
+        .json_rpc_call(
+          "get_fee_estimate",
+          Some(json!({ "grace_blocks": GRACE_BLOCKS_FOR_FEE_ESTIMATE })),
+        )
+        .await?;
+
+      // https://github.com/monero-project/monero/blob/94e67bf96bbc010241f29ada6abc89f49a81759c/
+      // src/wallet/wallet2.cpp#L7615-L7620
+      let priority_idx = usize::try_from(if priority.fee_priority() >= 4 {
+        3
+      } else {
+        priority.fee_priority().saturating_sub(1)
+      })
+      .map_err(|_| RpcError::InvalidPriority)?;
+
+      if res.status != "OK" {
+        Err(RpcError::InvalidFee)
+      } else if priority_idx >= res.fees.len() {
+        Err(RpcError::InvalidPriority)
+      } else {
+        Ok(Fee { per_weight: res.fees[priority_idx], mask: res.quantization_mask })
+      }
+    } else {
+      self.get_fee_v14(priority).await
+    }
+  }
+
+  pub async fn publish_transaction(&self, tx: &Transaction) -> Result<(), RpcError> {
+    #[allow(dead_code)]
+    #[derive(Deserialize, Debug)]
+    struct SendRawResponse {
+      status: String,
+      double_spend: bool,
+      fee_too_low: bool,
+      invalid_input: bool,
+      invalid_output: bool,
+      low_mixin: bool,
+      not_relayed: bool,
+      overspend: bool,
+      too_big: bool,
+      too_few_outputs: bool,
+      reason: String,
+    }
+
+    let res: SendRawResponse = self
+      .rpc_call("send_raw_transaction", Some(json!({ "tx_as_hex": hex::encode(tx.serialize()) })))
+      .await?;
+
+    if res.status != "OK" {
+      Err(RpcError::InvalidTransaction(tx.hash()))?;
+    }
+
+    Ok(())
+  }
+
+  // TODO: Take &Address, not &str?
+  pub async fn generate_blocks(
+    &self,
+    address: &str,
+    block_count: usize,
+  ) -> Result<Vec<[u8; 32]>, RpcError> {
+    #[derive(Debug, Deserialize)]
+    struct BlocksResponse {
+      blocks: Vec<String>,
+    }
+
+    let block_strs = self
+      .json_rpc_call::<BlocksResponse>(
+        "generateblocks",
+        Some(json!({
+          "wallet_address": address,
+          "amount_of_blocks": block_count
+        })),
+      )
+      .await?
+      .blocks;
+
+    let mut blocks = Vec::with_capacity(block_strs.len());
+    for block in block_strs {
+      blocks.push(hash_hex(&block)?);
+    }
+    Ok(blocks)
+  }
+}

coins/monero/src/serialize.rs

@@ -0,0 +1,167 @@
+use core::fmt::Debug;
+use std_shims::{
+  vec::Vec,
+  io::{self, Read, Write},
+};
+
+use curve25519_dalek::{
+  scalar::Scalar,
+  edwards::{EdwardsPoint, CompressedEdwardsY},
+};
+
+const VARINT_CONTINUATION_MASK: u8 = 0b1000_0000;
+
+mod sealed {
+  pub trait VarInt: TryInto<u64> + TryFrom<u64> + Copy {}
+  impl VarInt for u8 {}
+  impl VarInt for u32 {}
+  impl VarInt for u64 {}
+  impl VarInt for usize {}
+}
+
+// This will panic if the VarInt exceeds u64::MAX
+pub(crate) fn varint_len<U: sealed::VarInt>(varint: U) -> usize {
+  let varint_u64: u64 = varint.try_into().map_err(|_| "varint exceeded u64").unwrap();
+  ((usize::try_from(u64::BITS - varint_u64.leading_zeros()).unwrap().saturating_sub(1)) / 7) + 1
+}
+
+pub(crate) fn write_byte<W: Write>(byte: &u8, w: &mut W) -> io::Result<()> {
+  w.write_all(&[*byte])
+}
+
+// This will panic if the VarInt exceeds u64::MAX
+pub(crate) fn write_varint<W: Write, U: sealed::VarInt>(varint: &U, w: &mut W) -> io::Result<()> {
+  let mut varint: u64 = (*varint).try_into().map_err(|_| "varint exceeded u64").unwrap();
+  while {
+    let mut b = u8::try_from(varint & u64::from(!VARINT_CONTINUATION_MASK)).unwrap();
+    varint >>= 7;
+    if varint != 0 {
+      b |= VARINT_CONTINUATION_MASK;
+    }
+    write_byte(&b, w)?;
+    varint != 0
+  } {}
+  Ok(())
+}
+
+pub(crate) fn write_scalar<W: Write>(scalar: &Scalar, w: &mut W) -> io::Result<()> {
+  w.write_all(&scalar.to_bytes())
+}
+
+pub(crate) fn write_point<W: Write>(point: &EdwardsPoint, w: &mut W) -> io::Result<()> {
+  w.write_all(&point.compress().to_bytes())
+}
+
+pub(crate) fn write_raw_vec<T, W: Write, F: Fn(&T, &mut W) -> io::Result<()>>(
+  f: F,
+  values: &[T],
+  w: &mut W,
+) -> io::Result<()> {
+  for value in values {
+    f(value, w)?;
+  }
+  Ok(())
+}
+
+pub(crate) fn write_vec<T, W: Write, F: Fn(&T, &mut W) -> io::Result<()>>(
+  f: F,
+  values: &[T],
+  w: &mut W,
+) -> io::Result<()> {
+  write_varint(&values.len(), w)?;
+  write_raw_vec(f, values, w)
+}
+
+pub(crate) fn read_bytes<R: Read, const N: usize>(r: &mut R) -> io::Result<[u8; N]> {
+  let mut res = [0; N];
+  r.read_exact(&mut res)?;
+  Ok(res)
+}
+
+pub(crate) fn read_byte<R: Read>(r: &mut R) -> io::Result<u8> {
+  Ok(read_bytes::<_, 1>(r)?[0])
+}
+
+pub(crate) fn read_u16<R: Read>(r: &mut R) -> io::Result<u16> {
+  read_bytes(r).map(u16::from_le_bytes)
+}
+
+pub(crate) fn read_u32<R: Read>(r: &mut R) -> io::Result<u32> {
+  read_bytes(r).map(u32::from_le_bytes)
+}
+
+pub(crate) fn read_u64<R: Read>(r: &mut R) -> io::Result<u64> {
+  read_bytes(r).map(u64::from_le_bytes)
+}
+
+pub(crate) fn read_varint<R: Read, U: sealed::VarInt>(r: &mut R) -> io::Result<U> {
+  let mut bits = 0;
+  let mut res = 0;
+  while {
+    let b = read_byte(r)?;
+    if (bits != 0) && (b == 0) {
+      Err(io::Error::other("non-canonical varint"))?;
+    }
+    if ((bits + 7) > 64) && (b >= (1 << (64 - bits))) {
+      Err(io::Error::other("varint overflow"))?;
+    }
+
+    res += u64::from(b & (!VARINT_CONTINUATION_MASK)) << bits;
+    bits += 7;
+    b & VARINT_CONTINUATION_MASK == VARINT_CONTINUATION_MASK
+  } {}
+  res.try_into().map_err(|_| io::Error::other("VarInt does not fit into integer type"))
+}
+
+// All scalar fields supported by monero-serai are checked to be canonical for valid transactions
+// While from_bytes_mod_order would be more flexible, it's not currently needed and would be
+// inaccurate to include now. While casting a wide net may be preferable, it'd also be inaccurate
+// for now. There's also further edge cases as noted by
+// https://github.com/monero-project/monero/issues/8438, where some scalars had an archaic
+// reduction applied
+pub(crate) fn read_scalar<R: Read>(r: &mut R) -> io::Result<Scalar> {
+  Option::from(Scalar::from_canonical_bytes(read_bytes(r)?))
+    .ok_or_else(|| io::Error::other("unreduced scalar"))
+}
+
+pub(crate) fn read_point<R: Read>(r: &mut R) -> io::Result<EdwardsPoint> {
+  let bytes = read_bytes(r)?;
+  CompressedEdwardsY(bytes)
+    .decompress()
+    // Ban points which are either unreduced or -0
+    .filter(|point| point.compress().to_bytes() == bytes)
+    .ok_or_else(|| io::Error::other("invalid point"))
+}
+
+pub(crate) fn read_torsion_free_point<R: Read>(r: &mut R) -> io::Result<EdwardsPoint> {
+  read_point(r)
+    .ok()
+    .filter(EdwardsPoint::is_torsion_free)
+    .ok_or_else(|| io::Error::other("invalid point"))
+}
+
+pub(crate) fn read_raw_vec<R: Read, T, F: Fn(&mut R) -> io::Result<T>>(
+  f: F,
+  len: usize,
+  r: &mut R,
+) -> io::Result<Vec<T>> {
+  let mut res = vec![];
+  for _ in 0 .. len {
+    res.push(f(r)?);
+  }
+  Ok(res)
+}
+
+pub(crate) fn read_array<R: Read, T: Debug, F: Fn(&mut R) -> io::Result<T>, const N: usize>(
+  f: F,
+  r: &mut R,
+) -> io::Result<[T; N]> {
+  read_raw_vec(f, N, r).map(|vec| vec.try_into().unwrap())
+}
+
+pub(crate) fn read_vec<R: Read, T, F: Fn(&mut R) -> io::Result<T>>(
+  f: F,
+  r: &mut R,
+) -> io::Result<Vec<T>> {
+  read_raw_vec(f, read_varint(r)?, r)
+}

coins/monero/src/tests/address.rs

@@ -2,11 +2,12 @@ use hex_literal::hex;
 
 use rand_core::{RngCore, OsRng};
 
-use curve25519_dalek::{constants::ED25519_BASEPOINT_TABLE, scalar::Scalar};
+use curve25519_dalek::{constants::ED25519_BASEPOINT_TABLE, edwards::CompressedEdwardsY};
 
-use monero_io::decompress_point;
-
-use crate::{Network, AddressType, MoneroAddress};
+use crate::{
+  random_scalar,
+  wallet::address::{Network, AddressType, AddressMeta, MoneroAddress},
+};
 
 const SPEND: [u8; 32] = hex!("f8631661f6ab4e6fda310c797330d86e23a682f20d5bc8cc27b18051191f16d7");
 const VIEW: [u8; 32] = hex!("4a1535063ad1fee2dabbf909d4fd9a873e29541b401f0944754e17c9a41820ce");
@@ -27,49 +28,14 @@ const SUBADDRESS: &str =
 
 const FEATURED_JSON: &str = include_str!("vectors/featured_addresses.json");
 
-#[test]
-fn test_encoded_len_for_bytes() {
-  // For an encoding of length `l`, we prune to the amount of bytes which encodes with length `l`
-  // This assumes length `l` -> amount of bytes has a singular answer, which is tested here
-  use crate::base58check::*;
-  let mut set = std::collections::HashSet::new();
-  for i in 0 .. BLOCK_LEN {
-    set.insert(encoded_len_for_bytes(i));
-  }
-  assert_eq!(set.len(), BLOCK_LEN);
-}
-
-#[test]
-fn base58check() {
-  use crate::base58check::*;
-
-  assert_eq!(encode(&[]), String::new());
-  assert!(decode("").unwrap().is_empty());
-
-  let full_block = &[1, 2, 3, 4, 5, 6, 7, 8];
-  assert_eq!(&decode(&encode(full_block)).unwrap(), full_block);
-
-  let partial_block = &[1, 2, 3];
-  assert_eq!(&decode(&encode(partial_block)).unwrap(), partial_block);
-
-  let max_encoded_block = &[u8::MAX; 8];
-  assert_eq!(&decode(&encode(max_encoded_block)).unwrap(), max_encoded_block);
-
-  let max_decoded_block = "zzzzzzzzzzz";
-  assert!(decode(max_decoded_block).is_none());
-
-  let full_and_partial_block = &[1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11];
-  assert_eq!(&decode(&encode(full_and_partial_block)).unwrap(), full_and_partial_block);
-}
-
 #[test]
 fn standard_address() {
   let addr = MoneroAddress::from_str(Network::Mainnet, STANDARD).unwrap();
-  assert_eq!(addr.network(), Network::Mainnet);
-  assert_eq!(addr.kind(), &AddressType::Legacy);
-  assert!(!addr.is_subaddress());
-  assert_eq!(addr.payment_id(), None);
-  assert!(!addr.is_guaranteed());
+  assert_eq!(addr.meta.network, Network::Mainnet);
+  assert_eq!(addr.meta.kind, AddressType::Standard);
+  assert!(!addr.meta.kind.is_subaddress());
+  assert_eq!(addr.meta.kind.payment_id(), None);
+  assert!(!addr.meta.kind.is_guaranteed());
   assert_eq!(addr.spend.compress().to_bytes(), SPEND);
   assert_eq!(addr.view.compress().to_bytes(), VIEW);
   assert_eq!(addr.to_string(), STANDARD);
@@ -78,11 +44,11 @@ fn standard_address() {
 #[test]
 fn integrated_address() {
   let addr = MoneroAddress::from_str(Network::Mainnet, INTEGRATED).unwrap();
-  assert_eq!(addr.network(), Network::Mainnet);
-  assert_eq!(addr.kind(), &AddressType::LegacyIntegrated(PAYMENT_ID));
-  assert!(!addr.is_subaddress());
-  assert_eq!(addr.payment_id(), Some(PAYMENT_ID));
-  assert!(!addr.is_guaranteed());
+  assert_eq!(addr.meta.network, Network::Mainnet);
+  assert_eq!(addr.meta.kind, AddressType::Integrated(PAYMENT_ID));
+  assert!(!addr.meta.kind.is_subaddress());
+  assert_eq!(addr.meta.kind.payment_id(), Some(PAYMENT_ID));
+  assert!(!addr.meta.kind.is_guaranteed());
   assert_eq!(addr.spend.compress().to_bytes(), SPEND);
   assert_eq!(addr.view.compress().to_bytes(), VIEW);
   assert_eq!(addr.to_string(), INTEGRATED);
@@ -91,11 +57,11 @@ fn integrated_address() {
 #[test]
 fn subaddress() {
   let addr = MoneroAddress::from_str(Network::Mainnet, SUBADDRESS).unwrap();
-  assert_eq!(addr.network(), Network::Mainnet);
-  assert_eq!(addr.kind(), &AddressType::Subaddress);
-  assert!(addr.is_subaddress());
-  assert_eq!(addr.payment_id(), None);
-  assert!(!addr.is_guaranteed());
+  assert_eq!(addr.meta.network, Network::Mainnet);
+  assert_eq!(addr.meta.kind, AddressType::Subaddress);
+  assert!(addr.meta.kind.is_subaddress());
+  assert_eq!(addr.meta.kind.payment_id(), None);
+  assert!(!addr.meta.kind.is_guaranteed());
   assert_eq!(addr.spend.compress().to_bytes(), SUB_SPEND);
   assert_eq!(addr.view.compress().to_bytes(), SUB_VIEW);
   assert_eq!(addr.to_string(), SUBADDRESS);
@@ -107,8 +73,8 @@ fn featured() {
     [(Network::Mainnet, 'C'), (Network::Testnet, 'K'), (Network::Stagenet, 'F')]
   {
     for _ in 0 .. 100 {
-      let spend = &Scalar::random(&mut OsRng) * ED25519_BASEPOINT_TABLE;
-      let view = &Scalar::random(&mut OsRng) * ED25519_BASEPOINT_TABLE;
+      let spend = &random_scalar(&mut OsRng) * ED25519_BASEPOINT_TABLE;
+      let view = &random_scalar(&mut OsRng) * ED25519_BASEPOINT_TABLE;
 
       for features in 0 .. (1 << 3) {
         const SUBADDRESS_FEATURE_BIT: u8 = 1;
@@ -125,7 +91,8 @@ fn featured() {
         let guaranteed = (features & GUARANTEED_FEATURE_BIT) == GUARANTEED_FEATURE_BIT;
 
         let kind = AddressType::Featured { subaddress, payment_id, guaranteed };
-        let addr = MoneroAddress::new(network, kind, spend, view);
+        let meta = AddressMeta::new(network, kind);
+        let addr = MoneroAddress::new(meta, spend, view);
 
         assert_eq!(addr.to_string().chars().next().unwrap(), first);
         assert_eq!(MoneroAddress::from_str(network, &addr.to_string()).unwrap(), addr);
@@ -175,8 +142,14 @@ fn featured_vectors() {
       }
       _ => panic!("Unknown network"),
     };
-    let spend = decompress_point(hex::decode(vector.spend).unwrap().try_into().unwrap()).unwrap();
-    let view = decompress_point(hex::decode(vector.view).unwrap().try_into().unwrap()).unwrap();
+    let spend = CompressedEdwardsY::from_slice(&hex::decode(vector.spend).unwrap())
+      .unwrap()
+      .decompress()
+      .unwrap();
+    let view = CompressedEdwardsY::from_slice(&hex::decode(vector.view).unwrap())
+      .unwrap()
+      .decompress()
+      .unwrap();
 
     let addr = MoneroAddress::from_str(network, &vector.address).unwrap();
     assert_eq!(addr.spend, spend);
@@ -189,12 +162,14 @@ fn featured_vectors() {
 
     assert_eq!(
       MoneroAddress::new(
-        network,
-        AddressType::Featured {
-          subaddress: vector.subaddress,
-          payment_id: vector.payment_id,
-          guaranteed: vector.guaranteed
-        },
+        AddressMeta::new(
+          network,
+          AddressType::Featured {
+            subaddress: vector.subaddress,
+            payment_id: vector.payment_id,
+            guaranteed: vector.guaranteed
+          }
+        ),
         spend,
         view
       )

coins/monero/src/tests/bulletproofs/mod.rs

@@ -0,0 +1,94 @@
+use hex_literal::hex;
+use rand_core::OsRng;
+
+use curve25519_dalek::{scalar::Scalar, edwards::CompressedEdwardsY};
+use multiexp::BatchVerifier;
+
+use crate::{
+  Commitment, random_scalar,
+  ringct::bulletproofs::{Bulletproofs, original::OriginalStruct},
+};
+
+mod plus;
+
+#[test]
+fn bulletproofs_vector() {
+  let scalar = |scalar| Scalar::from_canonical_bytes(scalar).unwrap();
+  let point = |point| CompressedEdwardsY(point).decompress().unwrap();
+
+  // Generated from Monero
+  assert!(Bulletproofs::Original(OriginalStruct {
+    A: point(hex!("ef32c0b9551b804decdcb107eb22aa715b7ce259bf3c5cac20e24dfa6b28ac71")),
+    S: point(hex!("e1285960861783574ee2b689ae53622834eb0b035d6943103f960cd23e063fa0")),
+    T1: point(hex!("4ea07735f184ba159d0e0eb662bac8cde3eb7d39f31e567b0fbda3aa23fe5620")),
+    T2: point(hex!("b8390aa4b60b255630d40e592f55ec6b7ab5e3a96bfcdcd6f1cd1d2fc95f441e")),
+    taux: scalar(hex!("5957dba8ea9afb23d6e81cc048a92f2d502c10c749dc1b2bd148ae8d41ec7107")),
+    mu: scalar(hex!("923023b234c2e64774b820b4961f7181f6c1dc152c438643e5a25b0bf271bc02")),
+    L: vec![
+      point(hex!("c45f656316b9ebf9d357fb6a9f85b5f09e0b991dd50a6e0ae9b02de3946c9d99")),
+      point(hex!("9304d2bf0f27183a2acc58cc755a0348da11bd345485fda41b872fee89e72aac")),
+      point(hex!("1bb8b71925d155dd9569f64129ea049d6149fdc4e7a42a86d9478801d922129b")),
+      point(hex!("5756a7bf887aa72b9a952f92f47182122e7b19d89e5dd434c747492b00e1c6b7")),
+      point(hex!("6e497c910d102592830555356af5ff8340e8d141e3fb60ea24cfa587e964f07d")),
+      point(hex!("f4fa3898e7b08e039183d444f3d55040f3c790ed806cb314de49f3068bdbb218")),
+      point(hex!("0bbc37597c3ead517a3841e159c8b7b79a5ceaee24b2a9a20350127aab428713")),
+    ],
+    R: vec![
+      point(hex!("609420ba1702781692e84accfd225adb3d077aedc3cf8125563400466b52dbd9")),
+      point(hex!("fb4e1d079e7a2b0ec14f7e2a3943bf50b6d60bc346a54fcf562fb234b342abf8")),
+      point(hex!("6ae3ac97289c48ce95b9c557289e82a34932055f7f5e32720139824fe81b12e5")),
+      point(hex!("d071cc2ffbdab2d840326ad15f68c01da6482271cae3cf644670d1632f29a15c")),
+      point(hex!("e52a1754b95e1060589ba7ce0c43d0060820ebfc0d49dc52884bc3c65ad18af5")),
+      point(hex!("41573b06140108539957df71aceb4b1816d2409ce896659aa5c86f037ca5e851")),
+      point(hex!("a65970b2cc3c7b08b2b5b739dbc8e71e646783c41c625e2a5b1535e3d2e0f742")),
+    ],
+    a: scalar(hex!("0077c5383dea44d3cd1bc74849376bd60679612dc4b945255822457fa0c0a209")),
+    b: scalar(hex!("fe80cf5756473482581e1d38644007793ddc66fdeb9404ec1689a907e4863302")),
+    t: scalar(hex!("40dfb08e09249040df997851db311bd6827c26e87d6f0f332c55be8eef10e603"))
+  })
+  .verify(
+    &mut OsRng,
+    &[
+      // For some reason, these vectors are * INV_EIGHT
+      point(hex!("8e8f23f315edae4f6c2f948d9a861e0ae32d356b933cd11d2f0e031ac744c41f"))
+        .mul_by_cofactor(),
+      point(hex!("2829cbd025aa54cd6e1b59a032564f22f0b2e5627f7f2c4297f90da438b5510f"))
+        .mul_by_cofactor(),
+    ]
+  ));
+}
+
+macro_rules! bulletproofs_tests {
+  ($name: ident, $max: ident, $plus: literal) => {
+    #[test]
+    fn $name() {
+      // Create Bulletproofs for all possible output quantities
+      let mut verifier = BatchVerifier::new(16);
+      for i in 1 ..= 16 {
+        let commitments = (1 ..= i)
+          .map(|i| Commitment::new(random_scalar(&mut OsRng), u64::try_from(i).unwrap()))
+          .collect::<Vec<_>>();
+
+        let bp = Bulletproofs::prove(&mut OsRng, &commitments, $plus).unwrap();
+
+        let commitments = commitments.iter().map(Commitment::calculate).collect::<Vec<_>>();
+        assert!(bp.verify(&mut OsRng, &commitments));
+        assert!(bp.batch_verify(&mut OsRng, &mut verifier, i, &commitments));
+      }
+      assert!(verifier.verify_vartime());
+    }
+
+    #[test]
+    fn $max() {
+      // Check Bulletproofs errors if we try to prove for too many outputs
+      let mut commitments = vec![];
+      for _ in 0 .. 17 {
+        commitments.push(Commitment::new(Scalar::ZERO, 0));
+      }
+      assert!(Bulletproofs::prove(&mut OsRng, &commitments, $plus).is_err());
+    }
+  };
+}
+
+bulletproofs_tests!(bulletproofs, bulletproofs_max, false);
+bulletproofs_tests!(bulletproofs_plus, bulletproofs_plus_max, true);

coins/monero/src/tests/bulletproofs/plus/aggregate_range_proof.rs

@@ -0,0 +1,30 @@
+use rand_core::{RngCore, OsRng};
+
+use multiexp::BatchVerifier;
+use group::ff::Field;
+use dalek_ff_group::{Scalar, EdwardsPoint};
+
+use crate::{
+  Commitment,
+  ringct::bulletproofs::plus::aggregate_range_proof::{
+    AggregateRangeStatement, AggregateRangeWitness,
+  },
+};
+
+#[test]
+fn test_aggregate_range_proof() {
+  let mut verifier = BatchVerifier::new(16);
+  for m in 1 ..= 16 {
+    let mut commitments = vec![];
+    for _ in 0 .. m {
+      commitments.push(Commitment::new(*Scalar::random(&mut OsRng), OsRng.next_u64()));
+    }
+    let commitment_points = commitments.iter().map(|com| EdwardsPoint(com.calculate())).collect();
+    let statement = AggregateRangeStatement::new(commitment_points).unwrap();
+    let witness = AggregateRangeWitness::new(&commitments).unwrap();
+
+    let proof = statement.clone().prove(&mut OsRng, &witness).unwrap();
+    statement.verify(&mut OsRng, &mut verifier, (), proof);
+  }
+  assert!(verifier.verify_vartime());
+}

coins/monero/src/tests/bulletproofs/plus/weighted_inner_product.rs

@@ -2,14 +2,14 @@
 
 use rand_core::OsRng;
 
-use curve25519_dalek::{traits::Identity, scalar::Scalar, edwards::EdwardsPoint};
+use multiexp::BatchVerifier;
+use group::{ff::Field, Group};
+use dalek_ff_group::{Scalar, EdwardsPoint};
 
-use crate::{
-  batch_verifier::BulletproofsPlusBatchVerifier,
-  plus::{
-    ScalarVector, PointVector, GeneratorsList, BpPlusGenerators,
-    weighted_inner_product::{WipStatement, WipWitness},
-  },
+use crate::ringct::bulletproofs::plus::{
+  ScalarVector, PointVector, GeneratorsList, Generators,
+  weighted_inner_product::{WipStatement, WipWitness},
+  weighted_inner_product,
 };
 
 #[test]
@@ -18,33 +18,33 @@ fn test_zero_weighted_inner_product() {
   let P = EdwardsPoint::identity();
   let y = Scalar::random(&mut OsRng);
 
-  let generators = BpPlusGenerators::new().reduce(1);
+  let generators = Generators::new().reduce(1);
   let statement = WipStatement::new(generators, P, y);
   let witness = WipWitness::new(ScalarVector::new(1), ScalarVector::new(1), Scalar::ZERO).unwrap();
 
   let transcript = Scalar::random(&mut OsRng);
   let proof = statement.clone().prove(&mut OsRng, transcript, &witness).unwrap();
 
-  let mut verifier = BulletproofsPlusBatchVerifier::default();
-  statement.verify(&mut OsRng, &mut verifier, transcript, proof);
-  assert!(verifier.verify());
+  let mut verifier = BatchVerifier::new(1);
+  statement.verify(&mut OsRng, &mut verifier, (), transcript, proof);
+  assert!(verifier.verify_vartime());
 }
 
 #[test]
 fn test_weighted_inner_product() {
   // P = sum(g_bold * a, h_bold * b, g * (a * y * b), h * alpha)
-  let mut verifier = BulletproofsPlusBatchVerifier::default();
-  let generators = BpPlusGenerators::new();
+  let mut verifier = BatchVerifier::new(6);
+  let generators = Generators::new();
   for i in [1, 2, 4, 8, 16, 32] {
     let generators = generators.reduce(i);
-    let g = BpPlusGenerators::g();
-    let h = BpPlusGenerators::h();
+    let g = Generators::g();
+    let h = Generators::h();
     assert_eq!(generators.len(), i);
     let mut g_bold = vec![];
     let mut h_bold = vec![];
     for i in 0 .. i {
-      g_bold.push(generators.generator(GeneratorsList::GBold, i));
-      h_bold.push(generators.generator(GeneratorsList::HBold, i));
+      g_bold.push(generators.generator(GeneratorsList::GBold1, i));
+      h_bold.push(generators.generator(GeneratorsList::HBold1, i));
     }
     let g_bold = PointVector(g_bold);
     let h_bold = PointVector(h_bold);
@@ -68,7 +68,7 @@ fn test_weighted_inner_product() {
     #[allow(non_snake_case)]
     let P = g_bold.multiexp(&a) +
       h_bold.multiexp(&b) +
-      (g * a.clone().weighted_inner_product(&b, &y_vec)) +
+      (g * weighted_inner_product(&a, &b, &y_vec)) +
       (h * alpha);
 
     let statement = WipStatement::new(generators, P, y);
@@ -76,7 +76,7 @@ fn test_weighted_inner_product() {
 
     let transcript = Scalar::random(&mut OsRng);
     let proof = statement.clone().prove(&mut OsRng, transcript, &witness).unwrap();
-    statement.verify(&mut OsRng, &mut verifier, transcript, proof);
+    statement.verify(&mut OsRng, &mut verifier, (), transcript, proof);
   }
-  assert!(verifier.verify());
+  assert!(verifier.verify_vartime());
 }

coins/monero/src/tests/clsag.rs

@@ -1,4 +1,6 @@
 use core::ops::Deref;
+#[cfg(feature = "multisig")]
+use std::sync::{Arc, RwLock};
 
 use zeroize::Zeroizing;
 use rand_core::{RngCore, OsRng};
@@ -10,11 +12,16 @@ use transcript::{Transcript, RecommendedTranscript};
 #[cfg(feature = "multisig")]
 use frost::curve::Ed25519;
 
-use monero_generators::hash_to_point;
-use monero_primitives::{Commitment, Decoys};
-use crate::{ClsagContext, Clsag};
+use crate::{
+  Commitment, random_scalar,
+  wallet::Decoys,
+  ringct::{
+    generate_key_image,
+    clsag::{ClsagInput, Clsag},
+  },
+};
 #[cfg(feature = "multisig")]
-use crate::ClsagMultisig;
+use crate::ringct::clsag::{ClsagDetails, ClsagMultisig};
 
 #[cfg(feature = "multisig")]
 use frost::{
@@ -36,8 +43,8 @@ fn clsag() {
     let mut secrets = (Zeroizing::new(Scalar::ZERO), Scalar::ZERO);
     let mut ring = vec![];
     for i in 0 .. RING_LEN {
-      let dest = Zeroizing::new(Scalar::random(&mut OsRng));
-      let mask = Scalar::random(&mut OsRng);
+      let dest = Zeroizing::new(random_scalar(&mut OsRng));
+      let mask = random_scalar(&mut OsRng);
       let amount;
       if i == real {
         secrets = (dest.clone(), mask);
@@ -49,30 +56,27 @@ fn clsag() {
         .push([dest.deref() * ED25519_BASEPOINT_TABLE, Commitment::new(mask, amount).calculate()]);
     }
 
-    let (mut clsag, pseudo_out) = Clsag::sign(
+    let image = generate_key_image(&secrets.0);
+    let (clsag, pseudo_out) = Clsag::sign(
       &mut OsRng,
       vec![(
-        secrets.0.clone(),
-        ClsagContext::new(
-          Decoys::new((1 ..= RING_LEN).collect(), u8::try_from(real).unwrap(), ring.clone())
-            .unwrap(),
+        secrets.0,
+        image,
+        ClsagInput::new(
           Commitment::new(secrets.1, AMOUNT),
+          Decoys {
+            i: u8::try_from(real).unwrap(),
+            offsets: (1 ..= RING_LEN).collect(),
+            ring: ring.clone(),
+          },
         )
         .unwrap(),
       )],
-      Scalar::random(&mut OsRng),
+      random_scalar(&mut OsRng),
       msg,
     )
-    .unwrap()
     .swap_remove(0);
-
-    let image =
-      hash_to_point((ED25519_BASEPOINT_TABLE * secrets.0.deref()).compress().0) * secrets.0.deref();
     clsag.verify(&ring, &image, &pseudo_out, &msg).unwrap();
-
-    // make sure verification fails if we throw a random `c1` at it.
-    clsag.c1 = Scalar::random(&mut OsRng);
-    assert!(clsag.verify(&ring, &image, &pseudo_out, &msg).is_err());
   }
 }
 
@@ -81,15 +85,15 @@ fn clsag() {
 fn clsag_multisig() {
   let keys = key_gen::<_, Ed25519>(&mut OsRng);
 
-  let randomness = Scalar::random(&mut OsRng);
+  let randomness = random_scalar(&mut OsRng);
   let mut ring = vec![];
   for i in 0 .. RING_LEN {
     let dest;
     let mask;
     let amount;
     if i != u64::from(RING_INDEX) {
-      dest = &Scalar::random(&mut OsRng) * ED25519_BASEPOINT_TABLE;
-      mask = Scalar::random(&mut OsRng);
+      dest = &random_scalar(&mut OsRng) * ED25519_BASEPOINT_TABLE;
+      mask = random_scalar(&mut OsRng);
       amount = OsRng.next_u64();
     } else {
       dest = keys[&Participant::new(1).unwrap()].group_key().0;
@@ -99,15 +103,19 @@ fn clsag_multisig() {
     ring.push([dest, Commitment::new(mask, amount).calculate()]);
   }
 
-  let (algorithm, mask_send) = ClsagMultisig::new(
+  let mask_sum = random_scalar(&mut OsRng);
+  let algorithm = ClsagMultisig::new(
     RecommendedTranscript::new(b"Monero Serai CLSAG Test"),
-    ClsagContext::new(
-      Decoys::new((1 ..= RING_LEN).collect(), RING_INDEX, ring.clone()).unwrap(),
-      Commitment::new(randomness, AMOUNT),
-    )
-    .unwrap(),
+    keys[&Participant::new(1).unwrap()].group_key().0,
+    Arc::new(RwLock::new(Some(ClsagDetails::new(
+      ClsagInput::new(
+        Commitment::new(randomness, AMOUNT),
+        Decoys { i: RING_INDEX, offsets: (1 ..= RING_LEN).collect(), ring: ring.clone() },
+      )
+      .unwrap(),
+      mask_sum,
+    )))),
   );
-  mask_send.send(Scalar::random(&mut OsRng));
 
   sign(
     &mut OsRng,

coins/monero/src/tests/mod.rs

@@ -0,0 +1,5 @@
+mod unreduced_scalar;
+mod clsag;
+mod bulletproofs;
+mod address;
+mod seed;

coins/monero/src/tests/seed.rs

@@ -0,0 +1,407 @@
+use zeroize::Zeroizing;
+
+use rand_core::OsRng;
+
+use curve25519_dalek::scalar::Scalar;
+
+use crate::{
+  hash,
+  wallet::seed::{
+    Seed, SeedType,
+    classic::{self, trim_by_lang},
+    polyseed,
+  },
+};
+
+#[test]
+fn test_classic_seed() {
+  struct Vector {
+    language: classic::Language,
+    seed: String,
+    spend: String,
+    view: String,
+  }
+
+  let vectors = [
+    Vector {
+      language: classic::Language::Chinese,
+      seed: "摇 曲 艺 武 滴 然 效 似 赏 式 祥 歌 买 疑 小 碧 堆 博 键 房 鲜 悲 付 喷 武".into(),
+      spend: "a5e4fff1706ef9212993a69f246f5c95ad6d84371692d63e9bb0ea112a58340d".into(),
+      view: "1176c43ce541477ea2f3ef0b49b25112b084e26b8a843e1304ac4677b74cdf02".into(),
+    },
+    Vector {
+      language: classic::Language::English,
+      seed: "washing thirsty occur lectures tuesday fainted toxic adapt \
+               abnormal memoir nylon mostly building shrugged online ember northern \
+               ruby woes dauntless boil family illness inroads northern"
+        .into(),
+      spend: "c0af65c0dd837e666b9d0dfed62745f4df35aed7ea619b2798a709f0fe545403".into(),
+      view: "513ba91c538a5a9069e0094de90e927c0cd147fa10428ce3ac1afd49f63e3b01".into(),
+    },
+    Vector {
+      language: classic::Language::Dutch,
+      seed: "setwinst riphagen vimmetje extase blief tuitelig fuiven meifeest \
+               ponywagen zesmaal ripdeal matverf codetaal leut ivoor rotten \
+               wisgerhof winzucht typograaf atrium rein zilt traktaat verzaagd setwinst"
+        .into(),
+      spend: "e2d2873085c447c2bc7664222ac8f7d240df3aeac137f5ff2022eaa629e5b10a".into(),
+      view: "eac30b69477e3f68093d131c7fd961564458401b07f8c87ff8f6030c1a0c7301".into(),
+    },
+    Vector {
+      language: classic::Language::French,
+      seed: "poids vaseux tarte bazar poivre effet entier nuance \
+               sensuel ennui pacte osselet poudre battre alibi mouton \
+               stade paquet pliage gibier type question position projet pliage"
+        .into(),
+      spend: "2dd39ff1a4628a94b5c2ec3e42fb3dfe15c2b2f010154dc3b3de6791e805b904".into(),
+      view: "6725b32230400a1032f31d622b44c3a227f88258939b14a7c72e00939e7bdf0e".into(),
+    },
+    Vector {
+      language: classic::Language::Spanish,
+      seed: "minero ocupar mirar evadir octubre cal logro miope \
+               opaco disco ancla litio clase cuello nasal clase \
+               fiar avance deseo mente grumo negro cordón croqueta clase"
+        .into(),
+      spend: "ae2c9bebdddac067d73ec0180147fc92bdf9ac7337f1bcafbbe57dd13558eb02".into(),
+      view: "18deafb34d55b7a43cae2c1c1c206a3c80c12cc9d1f84640b484b95b7fec3e05".into(),
+    },
+    Vector {
+      language: classic::Language::German,
+      seed: "Kaliber Gabelung Tapir Liveband Favorit Specht Enklave Nabel \
+               Jupiter Foliant Chronik nisten löten Vase Aussage Rekord \
+               Yeti Gesetz Eleganz Alraune Künstler Almweide Jahr Kastanie Almweide"
+        .into(),
+      spend: "79801b7a1b9796856e2397d862a113862e1fdc289a205e79d8d70995b276db06".into(),
+      view: "99f0ec556643bd9c038a4ed86edcb9c6c16032c4622ed2e000299d527a792701".into(),
+    },
+    Vector {
+      language: classic::Language::Italian,
+      seed: "cavo pancetta auto fulmine alleanza filmato diavolo prato \
+               forzare meritare litigare lezione segreto evasione votare buio \
+               licenza cliente dorso natale crescere vento tutelare vetta evasione"
+        .into(),
+      spend: "5e7fd774eb00fa5877e2a8b4dc9c7ffe111008a3891220b56a6e49ac816d650a".into(),
+      view: "698a1dce6018aef5516e82ca0cb3e3ec7778d17dfb41a137567bfa2e55e63a03".into(),
+    },
+    Vector {
+      language: classic::Language::Portuguese,
+      seed: "agito eventualidade onus itrio holograma sodomizar objetos dobro \
+               iugoslavo bcrepuscular odalisca abjeto iuane darwinista eczema acetona \
+               cibernetico hoquei gleba driver buffer azoto megera nogueira agito"
+        .into(),
+      spend: "13b3115f37e35c6aa1db97428b897e584698670c1b27854568d678e729200c0f".into(),
+      view: "ad1b4fd35270f5f36c4da7166672b347e75c3f4d41346ec2a06d1d0193632801".into(),
+    },
+    Vector {
+      language: classic::Language::Japanese,
+      seed: "ぜんぶ どうぐ おたがい せんきょ おうじ そんちょう じゅしん いろえんぴつ \
+               かほう つかれる えらぶ にちじょう くのう にちようび ぬまえび さんきゃく \
+               おおや ちぬき うすめる いがく せつでん さうな すいえい せつだん おおや"
+        .into(),
+      spend: "c56e895cdb13007eda8399222974cdbab493640663804b93cbef3d8c3df80b0b".into(),
+      view: "6c3634a313ec2ee979d565c33888fd7c3502d696ce0134a8bc1a2698c7f2c508".into(),
+    },
+    Vector {
+      language: classic::Language::Russian,
+      seed: "шатер икра нация ехать получать инерция доза реальный \
+               рыжий таможня лопата душа веселый клетка атлас лекция \
+               обгонять паек наивный лыжный дурак стать ежик задача паек"
+        .into(),
+      spend: "7cb5492df5eb2db4c84af20766391cd3e3662ab1a241c70fc881f3d02c381f05".into(),
+      view: "fcd53e41ec0df995ab43927f7c44bc3359c93523d5009fb3f5ba87431d545a03".into(),
+    },
+    Vector {
+      language: classic::Language::Esperanto,
+      seed: "ukazo klini peco etikedo fabriko imitado onklino urino \
+               pudro incidento kumuluso ikono smirgi hirundo uretro krii \
+               sparkado super speciala pupo alpinisto cvana vokegi zombio fabriko"
+        .into(),
+      spend: "82ebf0336d3b152701964ed41df6b6e9a035e57fc98b84039ed0bd4611c58904".into(),
+      view: "cd4d120e1ea34360af528f6a3e6156063312d9cefc9aa6b5218d366c0ed6a201".into(),
+    },
+    Vector {
+      language: classic::Language::Lojban,
+      seed: "jetnu vensa julne xrotu xamsi julne cutci dakli \
+               mlatu xedja muvgau palpi xindo sfubu ciste cinri \
+               blabi darno dembi janli blabi fenki bukpu burcu blabi"
+        .into(),
+      spend: "e4f8c6819ab6cf792cebb858caabac9307fd646901d72123e0367ebc0a79c200".into(),
+      view: "c806ce62bafaa7b2d597f1a1e2dbe4a2f96bfd804bf6f8420fc7f4a6bd700c00".into(),
+    },
+    Vector {
+      language: classic::Language::EnglishOld,
+      seed: "glorious especially puff son moment add youth nowhere \
+               throw glide grip wrong rhythm consume very swear \
+               bitter heavy eventually begin reason flirt type unable"
+        .into(),
+      spend: "647f4765b66b636ff07170ab6280a9a6804dfbaf19db2ad37d23be024a18730b".into(),
+      view: "045da65316a906a8c30046053119c18020b07a7a3a6ef5c01ab2a8755416bd02".into(),
+    },
+  ];
+
+  for vector in vectors {
+    let trim_seed = |seed: &str| {
+      seed
+        .split_whitespace()
+        .map(|word| trim_by_lang(word, vector.language))
+        .collect::<Vec<_>>()
+        .join(" ")
+    };
+
+    // Test against Monero
+    {
+      let seed = Seed::from_string(Zeroizing::new(vector.seed.clone())).unwrap();
+      let trim = trim_seed(&vector.seed);
+      println!(
+        "{}. seed: {}, entropy: {:?}, trim: {trim}",
+        line!(),
+        *seed.to_string(),
+        *seed.entropy()
+      );
+      assert_eq!(seed, Seed::from_string(Zeroizing::new(trim)).unwrap());
+
+      let spend: [u8; 32] = hex::decode(vector.spend).unwrap().try_into().unwrap();
+      // For classical seeds, Monero directly uses the entropy as a spend key
+      assert_eq!(
+        Option::<Scalar>::from(Scalar::from_canonical_bytes(*seed.entropy())),
+        Option::<Scalar>::from(Scalar::from_canonical_bytes(spend)),
+      );
+
+      let view: [u8; 32] = hex::decode(vector.view).unwrap().try_into().unwrap();
+      // Monero then derives the view key as H(spend)
+      assert_eq!(
+        Scalar::from_bytes_mod_order(hash(&spend)),
+        Scalar::from_canonical_bytes(view).unwrap()
+      );
+
+      assert_eq!(
+        Seed::from_entropy(SeedType::Classic(vector.language), Zeroizing::new(spend), None)
+          .unwrap(),
+        seed
+      );
+    }
+
+    // Test against ourselves
+    {
+      let seed = Seed::new(&mut OsRng, SeedType::Classic(vector.language));
+      let trim = trim_seed(&seed.to_string());
+      println!(
+        "{}. seed: {}, entropy: {:?}, trim: {trim}",
+        line!(),
+        *seed.to_string(),
+        *seed.entropy()
+      );
+      assert_eq!(seed, Seed::from_string(Zeroizing::new(trim)).unwrap());
+      assert_eq!(
+        seed,
+        Seed::from_entropy(SeedType::Classic(vector.language), seed.entropy(), None).unwrap()
+      );
+      assert_eq!(seed, Seed::from_string(seed.to_string()).unwrap());
+    }
+  }
+}
+
+#[test]
+fn test_polyseed() {
+  struct Vector {
+    language: polyseed::Language,
+    seed: String,
+    entropy: String,
+    birthday: u64,
+    has_prefix: bool,
+    has_accent: bool,
+  }
+
+  let vectors = [
+    Vector {
+      language: polyseed::Language::English,
+      seed: "raven tail swear infant grief assist regular lamp \
+      duck valid someone little harsh puppy airport language"
+        .into(),
+      entropy: "dd76e7359a0ded37cd0ff0f3c829a5ae01673300000000000000000000000000".into(),
+      birthday: 1638446400,
+      has_prefix: true,
+      has_accent: false,
+    },
+    Vector {
+      language: polyseed::Language::Spanish,
+      seed: "eje fin parte célebre tabú pestaña lienzo puma \
+      prisión hora regalo lengua existir lápiz lote sonoro"
+        .into(),
+      entropy: "5a2b02df7db21fcbe6ec6df137d54c7b20fd2b00000000000000000000000000".into(),
+      birthday: 3118651200,
+      has_prefix: true,
+      has_accent: true,
+    },
+    Vector {
+      language: polyseed::Language::French,
+      seed: "valable arracher décaler jeudi amusant dresser mener épaissir risible \
+      prouesse réserve ampleur ajuster muter caméra enchère"
+        .into(),
+      entropy: "11cfd870324b26657342c37360c424a14a050b00000000000000000000000000".into(),
+      birthday: 1679314966,
+      has_prefix: true,
+      has_accent: true,
+    },
+    Vector {
+      language: polyseed::Language::Italian,
+      seed: "caduco midollo copione meninge isotopo illogico riflesso tartaruga fermento \
+      olandese normale tristezza episodio voragine forbito achille"
+        .into(),
+      entropy: "7ecc57c9b4652d4e31428f62bec91cfd55500600000000000000000000000000".into(),
+      birthday: 1679316358,
+      has_prefix: true,
+      has_accent: false,
+    },
+    Vector {
+      language: polyseed::Language::Portuguese,
+      seed: "caverna custear azedo adeus senador apertada sedoso omitir \
+      sujeito aurora videira molho cartaz gesso dentista tapar"
+        .into(),
+      entropy: "45473063711376cae38f1b3eba18c874124e1d00000000000000000000000000".into(),
+      birthday: 1679316657,
+      has_prefix: true,
+      has_accent: false,
+    },
+    Vector {
+      language: polyseed::Language::Czech,
+      seed: "usmrtit nora dotaz komunita zavalit funkce mzda sotva akce \
+      vesta kabel herna stodola uvolnit ustrnout email"
+        .into(),
+      entropy: "7ac8a4efd62d9c3c4c02e350d32326df37821c00000000000000000000000000".into(),
+      birthday: 1679316898,
+      has_prefix: true,
+      has_accent: false,
+    },
+    Vector {
+      language: polyseed::Language::Korean,
+      seed: "전망 선풍기 국제 무궁화 설사 기름 이론적 해안 절망 예선 \
+        지우개 보관 절망 말기 시각 귀신"
+        .into(),
+      entropy: "684663fda420298f42ed94b2c512ed38ddf12b00000000000000000000000000".into(),
+      birthday: 1679317073,
+      has_prefix: false,
+      has_accent: false,
+    },
+    Vector {
+      language: polyseed::Language::Japanese,
+      seed: "うちあわせ　ちつじょ　つごう　しはい　けんこう　とおる　てみやげ　はんとし　たんとう \
+      といれ　おさない　おさえる　むかう　ぬぐう　なふだ　せまる"
+        .into(),
+      entropy: "94e6665518a6286c6e3ba508a2279eb62b771f00000000000000000000000000".into(),
+      birthday: 1679318722,
+      has_prefix: false,
+      has_accent: false,
+    },
+    Vector {
+      language: polyseed::Language::ChineseTraditional,
+      seed: "亂 挖 斤 柄 代 圈 枝 轄 魯 論 函 開 勘 番 榮 壁".into(),
+      entropy: "b1594f585987ab0fd5a31da1f0d377dae5283f00000000000000000000000000".into(),
+      birthday: 1679426433,
+      has_prefix: false,
+      has_accent: false,
+    },
+    Vector {
+      language: polyseed::Language::ChineseSimplified,
+      seed: "啊 百 族 府 票 划 伪 仓 叶 虾 借 溜 晨 左 等 鬼".into(),
+      entropy: "21cdd366f337b89b8d1bc1df9fe73047c22b0300000000000000000000000000".into(),
+      birthday: 1679426817,
+      has_prefix: false,
+      has_accent: false,
+    },
+  ];
+
+  for vector in vectors {
+    let add_whitespace = |mut seed: String| {
+      seed.push(' ');
+      seed
+    };
+
+    let seed_without_accents = |seed: &str| {
+      seed
+        .split_whitespace()
+        .map(|w| w.chars().filter(char::is_ascii).collect::<String>())
+        .collect::<Vec<_>>()
+        .join(" ")
+    };
+
+    let trim_seed = |seed: &str| {
+      let seed_to_trim =
+        if vector.has_accent { seed_without_accents(seed) } else { seed.to_string() };
+      seed_to_trim
+        .split_whitespace()
+        .map(|w| {
+          let mut ascii = 0;
+          let mut to_take = w.len();
+          for (i, char) in w.chars().enumerate() {
+            if char.is_ascii() {
+              ascii += 1;
+            }
+            if ascii == polyseed::PREFIX_LEN {
+              // +1 to include this character, which put us at the prefix length
+              to_take = i + 1;
+              break;
+            }
+          }
+          w.chars().take(to_take).collect::<String>()
+        })
+        .collect::<Vec<_>>()
+        .join(" ")
+    };
+
+    // String -> Seed
+    let seed = Seed::from_string(Zeroizing::new(vector.seed.clone())).unwrap();
+    let trim = trim_seed(&vector.seed);
+    let add_whitespace = add_whitespace(vector.seed.clone());
+    let seed_without_accents = seed_without_accents(&vector.seed);
+    println!(
+      "{}. seed: {}, entropy: {:?}, trim: {}, add_whitespace: {}, seed_without_accents: {}",
+      line!(),
+      *seed.to_string(),
+      *seed.entropy(),
+      trim,
+      add_whitespace,
+      seed_without_accents,
+    );
+
+    // Make sure a version with added whitespace still works
+    let whitespaced_seed = Seed::from_string(Zeroizing::new(add_whitespace)).unwrap();
+    assert_eq!(seed, whitespaced_seed);
+    // Check trimmed versions works
+    if vector.has_prefix {
+      let trimmed_seed = Seed::from_string(Zeroizing::new(trim)).unwrap();
+      assert_eq!(seed, trimmed_seed);
+    }
+    // Check versions without accents work
+    if vector.has_accent {
+      let seed_without_accents = Seed::from_string(Zeroizing::new(seed_without_accents)).unwrap();
+      assert_eq!(seed, seed_without_accents);
+    }
+
+    let entropy = Zeroizing::new(hex::decode(vector.entropy).unwrap().try_into().unwrap());
+    assert_eq!(seed.entropy(), entropy);
+    assert!(seed.birthday().abs_diff(vector.birthday) < polyseed::TIME_STEP);
+
+    // Entropy -> Seed
+    let from_entropy =
+      Seed::from_entropy(SeedType::Polyseed(vector.language), entropy, Some(seed.birthday()))
+        .unwrap();
+    assert_eq!(seed.to_string(), from_entropy.to_string());
+
+    // Check against ourselves
+    {
+      let seed = Seed::new(&mut OsRng, SeedType::Polyseed(vector.language));
+      println!("{}. seed: {}, key: {:?}", line!(), *seed.to_string(), *seed.key());
+      assert_eq!(seed, Seed::from_string(seed.to_string()).unwrap());
+      assert_eq!(
+        seed,
+        Seed::from_entropy(
+          SeedType::Polyseed(vector.language),
+          seed.entropy(),
+          Some(seed.birthday())
+        )
+        .unwrap()
+      );
+    }
+  }
+}

coins/monero/src/tests/unreduced_scalar.rs

@@ -1,6 +1,6 @@
 use curve25519_dalek::scalar::Scalar;
 
-use crate::UnreducedScalar;
+use crate::unreduced_scalar::*;
 
 #[test]
 fn recover_scalars() {