Silent Payments: sending

josibake commented at 4:37 pm on August 2, 2023: member

This PR is part of integrating silent payments into Bitcoin Core. Status and tracking for the project is managed in #28536

This PR depends on #28122 and is marked as a draft until it is merged. If interested in those commits, please review on #28122

Sending

Silent Payments logic

The main focus of this PR is:

Applying the Taptweak to a taproot internal private key (this is a copy-paste of the code for applying the taptweak in the signing process)
Getting a private key from a given scriptPubKey
Creating silent payment outputs
Applying the created scriptPubKeys back to the vector of CRecipients

The functions are then used together to create silent payment outputs during CreateTransactionInternal.

Final steps

The last commits ensure that:

Coin selection is silent payments aware and knows to exclude taproot script path spends and inputs with unknown witness when funding a transaction which pays to a silent payment address
The change output type is correctly chosen when paying to a silent payment address
Functional tests

DrahtBot commented at 4:37 pm on August 2, 2023: contributor

The following sections might be updated with supplementary metadata relevant to reviewers and maintainers.

Code Coverage & Benchmarks

For details see: https://corecheck.dev/bitcoin/bitcoin/pulls/28201.

Reviews

See the guideline for information on the review process. A summary of reviews will appear here.

Conflicts

Reviewers, this pull request conflicts with the following ones:

#33163 (BIP360: Includes the following: by jbride)
#33034 (wallet: Store transactions in a separate sqlite table by achow101)
#32896 (wallet, rpc: add v3 transaction creation and wallet support by ishaanam)
#32763 (wallet: Replace CWalletTx::mapValue and vOrderForm with explicit class members by achow101)
#32579 (headerssync: Preempt unrealistic unit test behavior by hodlinator)
#32523 (wallet: Remove isminetypes by achow101)
#31974 (Drop testnet3 by Sjors)
#28333 (wallet: Construct ScriptPubKeyMans with all data rather than loaded progressively by achow101)
#27260 (Enhanced error messages for invalid network prefix during address parsing. by portlandhodl)

If you consider this pull request important, please also help to review the conflicting pull requests. Ideally, start with the one that should be merged first.

DrahtBot added the label CI failed on Aug 2, 2023

josibake renamed this:
~~Silent Payments: implement sending~~
Silent Payments: sending
on Aug 3, 2023

josibake force-pushed on Aug 3, 2023

DrahtBot removed the label CI failed on Aug 3, 2023

josibake commented at 9:50 am on August 3, 2023: member

Maybe add a quick summary in the description with the main implementation differences relative to #24897. It seems a big one is that this doesn’t require an index!

updated! I added the summary in #27827 and added links back to the parent PR in each of the child PRs.

in src/wallet/spend.cpp:942 in 181e329a1d outdated

899+    assert(tx_outpoints.size() > 0);
900+    CKey scalar_ecdh_input = PrepareScalarECDHInput(input_private_keys, tx_outpoints);
901+    std::vector<SilentPaymentRecipient> silent_payment_recipients = GroupSilentPaymentAddresses(silent_payment_destinations);
902+    std::vector<CRecipient> outputs;
903+    for (const auto& recipient : silent_payment_recipients) {
904+        Sender sender{scalar_ecdh_input, recipient};

josibake commented at 10:29 am on August 8, 2023:

This does not need to be a struct, it can just be a function.

in test/functional/wallet_silentpayments_sending.py:110 in e6f7458324 outdated

86+            address=SILENT_PAYMENT_ADDRESS,
87+            amount=21,
88+        )
89+        assert txid
90+
91+    def test_deterministic_send(self):

BrandonOdiwuor commented at 5:32 pm on August 9, 2023:

Incorporating logs within the test is crucial for offering transparent insight into the test’s progression, simplifying the identification of problems, and enhancing comprehension of the test’s overall behavior.

in test/functional/wallet_silentpayments_sending.py:160 in e6f7458324 outdated

122+                assert output["scriptPubKey"]["address"] == "bcrt1p5num3dvry0ffusg3s7v2j5fy025p95jtn6js65jlruwc69r9je2s6qfsj7"
123+                break
124+        else:
125+            assert False
126+
127+    def test_address_reuse(self):

BrandonOdiwuor commented at 5:34 pm on August 9, 2023:

Also consider adding logs to this test as the ones above

josibake force-pushed on Aug 30, 2023

josibake force-pushed on Aug 31, 2023

josibake force-pushed on Sep 8, 2023

josibake force-pushed on Sep 11, 2023

DrahtBot added the label CI failed on Sep 11, 2023

josibake force-pushed on Sep 11, 2023

josibake force-pushed on Sep 12, 2023

josibake force-pushed on Sep 14, 2023

DrahtBot removed the label CI failed on Sep 14, 2023

DrahtBot added the label Needs rebase on Sep 19, 2023

josibake force-pushed on Sep 21, 2023

DrahtBot added the label CI failed on Sep 21, 2023

DrahtBot removed the label Needs rebase on Sep 21, 2023

DrahtBot removed the label CI failed on Sep 21, 2023

josibake commented at 4:30 pm on September 26, 2023: member

Note: send does not work, but sendall, sendtoaddress does

josibake force-pushed on Oct 2, 2023

DrahtBot added the label CI failed on Oct 2, 2023

josibake force-pushed on Oct 3, 2023

DrahtBot removed the label CI failed on Oct 4, 2023

DrahtBot added the label Needs rebase on Oct 16, 2023

josibake force-pushed on Jan 15, 2024

DrahtBot removed the label Needs rebase on Jan 15, 2024

DrahtBot commented at 9:36 pm on January 17, 2024: contributor

🚧 At least one of the CI tasks failed. Make sure to run all tests locally, according to the documentation.

Possibly this is due to a silent merge conflict (the changes in this pull request being incompatible with the current code in the target branch). If so, make sure to rebase on the latest commit of the target branch.

Leave a comment here, if you need help tracking down a confusing failure.

Debug: https://github.com/bitcoin/bitcoin/runs/20505330863

DrahtBot added the label CI failed on Jan 17, 2024

josibake force-pushed on Jan 19, 2024

josibake commented at 2:30 pm on January 19, 2024: member

Rebased https://github.com/bitcoin/bitcoin/commit/3f4b0f77c7f2ff52b9c84bf1c5a70281a066cfe2 -> https://github.com/bitcoin/bitcoin/commit/3b0dd79cacaf4e97489746ace5c1c8d6fe8db38d (implement-bip352-sending-01 -> implement-bip352-01-rebase, compare)

Fixed silent merge conflict with CKey now returning std::byte*

DrahtBot removed the label CI failed on Jan 19, 2024

willcl-ark added the label Wallet on Jan 24, 2024

willcl-ark added the label Privacy on Jan 24, 2024

DrahtBot added the label Needs rebase on Jan 26, 2024

josibake force-pushed on Jan 26, 2024

DrahtBot removed the label Needs rebase on Jan 26, 2024

DrahtBot added the label CI failed on Feb 2, 2024

DrahtBot removed the label CI failed on Feb 7, 2024

DrahtBot added the label Needs rebase on Feb 20, 2024

josibake force-pushed on Apr 22, 2024

DrahtBot removed the label Needs rebase on Apr 22, 2024

DrahtBot added the label CI failed on Apr 22, 2024

DrahtBot commented at 9:52 pm on April 22, 2024: contributor

🚧 At least one of the CI tasks failed. Make sure to run all tests locally, according to the documentation.

Possibly this is due to a silent merge conflict (the changes in this pull request being incompatible with the current code in the target branch). If so, make sure to rebase on the latest commit of the target branch.

Leave a comment here, if you need help tracking down a confusing failure.

Debug: https://github.com/bitcoin/bitcoin/runs/24114299414

josibake force-pushed on Apr 27, 2024

josibake force-pushed on May 5, 2024

DrahtBot removed the label CI failed on May 5, 2024

DrahtBot added the label Needs rebase on May 20, 2024

achow101 referenced this in commit f0745d028e on Jun 27, 2024

josibake force-pushed on Jul 15, 2024

DrahtBot removed the label Needs rebase on Jul 15, 2024

josibake force-pushed on Jul 23, 2024

DrahtBot added the label CI failed on Jul 23, 2024

DrahtBot commented at 10:45 am on July 23, 2024: contributor

🚧 At least one of the CI tasks failed. Debug: https://github.com/bitcoin/bitcoin/runs/27794809832

Make sure to run all tests locally, according to the documentation.

The failure may happen due to a number of reasons, for example:

Possibly due to a silent merge conflict (the changes in this pull request being incompatible with the current code in the target branch). If so, make sure to rebase on the latest commit of the target branch.
A sanitizer issue, which can only be found by compiling with the sanitizer and running the affected test.
An intermittent issue.

Leave a comment here, if you need help tracking down a confusing failure.

DrahtBot added the label Needs rebase on Aug 2, 2024

ryanofsky referenced this in commit b38fb19b7e on Aug 7, 2024

josibake force-pushed on Apr 4, 2025

DrahtBot removed the label Needs rebase on Apr 4, 2025

josibake force-pushed on Apr 4, 2025

DrahtBot removed the label CI failed on Apr 4, 2025

josibake force-pushed on Apr 7, 2025

DrahtBot added the label CI failed on Apr 27, 2025

josibake force-pushed on May 13, 2025

DrahtBot added the label Needs rebase on May 13, 2025

josibake force-pushed on May 14, 2025

DrahtBot removed the label Needs rebase on May 14, 2025

DrahtBot removed the label CI failed on May 14, 2025

DrahtBot added the label Needs rebase on May 16, 2025

josibake force-pushed on Jul 10, 2025

josibake force-pushed on Jul 11, 2025

DrahtBot removed the label Needs rebase on Jul 11, 2025

josibake force-pushed on Jul 16, 2025

DrahtBot added the label CI failed on Jul 16, 2025

DrahtBot commented at 9:18 am on July 16, 2025: contributor

🚧 At least one of the CI tasks failed. Task lint: https://github.com/bitcoin/bitcoin/runs/46079826609 LLM reason (✨ experimental): The CI failure is due to a lint error related to subtree merging issues.

Try to run the tests locally, according to the documentation. However, a CI failure may still happen due to a number of reasons, for example:

Possibly due to a silent merge conflict (the changes in this pull request being incompatible with the current code in the target branch). If so, make sure to rebase on the latest commit of the target branch.
A sanitizer issue, which can only be found by compiling with the sanitizer and running the affected test.
An intermittent issue.

Leave a comment here, if you need help tracking down a confusing failure.

josibake force-pushed on Jul 16, 2025

josibake commented at 9:51 am on July 16, 2025: member

CI failure is from the test each commit job not handling a subtree pull; ignoring for now and will look into a CI fix later.

DrahtBot removed the label CI failed on Jul 16, 2025

josibake force-pushed on Jul 17, 2025

DrahtBot added the label Needs rebase on Jul 23, 2025

in src/wallet/spend.cpp:472 in e0404435ff outdated

465@@ -450,6 +466,18 @@ CoinsResult AvailableCoins(const CWallet& wallet,
466             type = Solver(script, script_solutions);
467             is_from_p2sh = true;
468         }
469+        // Very unlikely we'd be spending a witness unknown output, but if we are trying to pay a
470+        // silent payments v0 address, this can't be included
471+        if (silent_payment && type == TxoutType::WITNESS_UNKNOWN) continue;

Eunovo commented at 4:48 pm on July 23, 2025:

https://github.com/bitcoin/bitcoin/pull/28201/commits/e0404435ff4d64b32b58774b6c909c66f1692a9f: TxoutType::PUBKEY which represents Pay2Pubkey outputs, is also not eligible to pay to silent payments outputs.

josibake commented at 12:56 pm on July 24, 2025:

This is fine, actually. What we are doing here is making sure to never include a taproot with script path spend or a witness unknown spend. We can include Pay2Pubkey inputs, so long as there is at least one silent payments eligible input.

In the CreateSilentPaymentsOutputs function, we check for at least one eligible input here: https://github.com/bitcoin/bitcoin/blob/4225ebc65595b5ef0f661b4f41e3e21266b93575/src/wallet/spend.cpp#L1116, by calling the IsInputForSharedSecretDerivation function on each input.

Eunovo commented at 2:52 am on July 25, 2025:

Makes sense

josibake force-pushed on Jul 24, 2025

DrahtBot removed the label Needs rebase on Jul 24, 2025

DrahtBot added the label CI failed on Jul 24, 2025

DrahtBot commented at 7:13 pm on July 24, 2025: contributor

🚧 At least one of the CI tasks failed. Task MSan, depends: https://github.com/bitcoin/bitcoin/runs/46646862923 LLM reason (✨ experimental): MemorySanitizer detected use of uninitialized memory in secp256k1 tests, causing the CI failure.

Try to run the tests locally, according to the documentation. However, a CI failure may still happen due to a number of reasons, for example:

Possibly due to a silent merge conflict (the changes in this pull request being incompatible with the current code in the target branch). If so, make sure to rebase on the latest commit of the target branch.
A sanitizer issue, which can only be found by compiling with the sanitizer and running the affected test.
An intermittent issue.

Leave a comment here, if you need help tracking down a confusing failure.

josibake force-pushed on Jul 25, 2025

DrahtBot removed the label CI failed on Jul 25, 2025

DrahtBot added the label Needs rebase on Jul 31, 2025

josibake force-pushed on Aug 4, 2025

DrahtBot removed the label Needs rebase on Aug 4, 2025

Squashed 'src/secp256k1/' changes from b9313c6e1a..2b57d2ad89

2b57d2ad89 docs: update README
5d2d4adabd ci: enable silentpayments module
d6788a888c tests: add constant time tests
4c32ba9613 tests: add BIP-352 test vectors
183e5414f7 silentpayments: add benchmarks for scanning
288390446a silentpayments: add examples/silentpayments.c
250beff5d2 silentpayments: receiving
f90d7a76b0 silentpayments: recipient label support
1a5f53f2cf silentpayments: sending
ca2538a878 build: add skeleton for new silentpayments (BIP352) module

git-subtree-dir: src/secp256k1
git-subtree-split: 2b57d2ad8964e536508fae0b6ab1331396fe0308

520acba4ef

josibake force-pushed on Aug 13, 2025

DrahtBot added the label Needs rebase on Aug 13, 2025

Merge commit '520acba4efec147fa97d040a62fbbf8163b6dc8b' into refresh-secp256k1 9ad09bfe87

crypto: add read-only method to KeyPair

Add a method for passing a KeyPair object to secp256k1 functions expecting a secp256k1_keypair.
This allows for passing a KeyPair directly to a secp256k1 function without needing to create a
temporary secp256k1_keypair object.

87b2440d84

Add "sp" HRP c08547838f

Add V0SilentPaymentDestination address type a4c47957d4

josibake force-pushed on Aug 14, 2025

DrahtBot removed the label Needs rebase on Aug 14, 2025

common: add bip352.{h,cpp} secp256k1 module

Wrap the silentpayments module from libsecp256k1. This is placed in
common as it is intended to be used by:

  * RPCs: for parsing addresses
  * Wallet: for sending, receiving, spending silent payment outputs
  * Node: for creating silent payment indexes for light clients

e25066e4c9

wallet: disable sending to silent payment address

Have `IsValidDestination` return false for silent payment destinations
and set an error string when decoding a silent payment address.

This prevents anyone from sending to a silent payment address before
sending is implemented in the wallet, but also allows the functions to
be used in the unit testing famework.

d3b3c381e3

tests: add BIP352 test vectors as unit tests

Use the test vectors to test sending and receiving. A few cases are not
covered here, namely anything that requires testing specific to the
wallet. For example:

* Taproot script path spending is not tested, as that is better tested in
  a wallets coin selection / signing logic
* Re-computing outputs during RBF is not tested, as that is better
  tested in a wallets RBF logic

The unit tests are written in such a way that adding new test cases is
as easy as updating the JSON file

832d767b78

wallet: get serialized size for `V0SilentPayments`

BIP352 v0 specifies that a silent payment output is a taproot output.
Taproot scriptPubKeys are a fixed size, so when calculating the
serialized size for a CRecipient with a V0SilentPayments destination,
use WitnessV1Taproot for the serialized txout size.

54ab0d7ff5

wallet: add method for retreiving a private key

Add a method for retreiving a private key for a given scriptPubKey.
If the scriptPubKey is a taproot output, tweak the private key with the
merkle root or hash of the public key, if applicable.

63798bf52f

wallet: make coin selection silent payment aware

Add a flag to the `CoinControl` object if silent payment destinations
are provided. Before adding the flag, call a function which checks if:

* The wallet has private keys
* The wallet is unlocked

Without both of the above being true, we cannot send to a silent payment
address.

During coin selection, if this flag is set, skip taproot inputs when
script spend data is available. This is based on the assumption that if
a user provides script spend data, they don't have access to the key
path spend. As future improvement, we could instead check to see if we
have access to the key path spend, and only exclude the output when we
don't regardless of whether or not the user provides script spend data.

Also skip UTXOs of type `WITNESS_UNKNOWN`, although it is very unlikely
our wallet would ever try to spend a witness unknown output.

5b89291e6b

wallet: add `IsInputForSharedSecretDerivation` function b6dc5bdfb0

wallet: add `CreateSilentPaymentOutputs` function

`CreateSilentPaymentsOutputs` gets the correct private keys, adds them
together, groups the silent payment destinations and then generates the
taproot script pubkeys. These are then passed back to
CreateTransactionInternal, which uses these scriptPubKeys to update
vecSend before adding them to the transaction outputs.

7c1093b08c

wallet: update TransactionChangeType

If sending to a silent payment destination, the change type should be taproot

46d619176d

wallet: enable sending to silent payment address

Treat silent payment addresses as valid destination. Also disable using
silent payment addresses with the `addr()` descriptor, as this
descriptor expects an encoding of a scriptPubKey, whereas a silent
payment address consists of instructions on how to generate a
scriptPubKey for the recipient.

Co-authored-by: Oghenovo Usiwoma <37949128+eunovo@users.noreply.github.com>

87c5b52f3b

tests: add sending functional tests 6986e507da

josibake force-pushed on Aug 15, 2025

Silent Payments: sending #28201

Sending

Silent Payments logic

Final steps

Code Coverage & Benchmarks

Reviews

Conflicts