Merge branch 'beta' into mergemaster

# Conflicts:
#	src/main.cpp

src/wallet/asyncrpcoperation_mergetoaddress.cpp

@@ -0,0 +1,947 @@
+// Copyright (c) 2017 The Zcash developers
+// Distributed under the MIT software license, see the accompanying
+// file COPYING or http://www.opensource.org/licenses/mit-license.php.
+
+#include "asyncrpcoperation_mergetoaddress.h"
+
+#include "amount.h"
+#include "asyncrpcqueue.h"
+#include "core_io.h"
+#include "init.h"
+#include "main.h"
+#include "miner.h"
+#include "net.h"
+#include "netbase.h"
+#include "rpcprotocol.h"
+#include "rpcserver.h"
+#include "script/interpreter.h"
+#include "sodium.h"
+#include "timedata.h"
+#include "util.h"
+#include "utilmoneystr.h"
+#include "utiltime.h"
+#include "wallet.h"
+#include "walletdb.h"
+#include "zcash/IncrementalMerkleTree.hpp"
+
+#include <chrono>
+#include <iostream>
+#include <string>
+#include <thread>
+
+#include "paymentdisclosuredb.h"
+
+using namespace libzcash;
+
+int mta_find_output(UniValue obj, int n)
+{
+    UniValue outputMapValue = find_value(obj, "outputmap");
+    if (!outputMapValue.isArray()) {
+        throw JSONRPCError(RPC_WALLET_ERROR, "Missing outputmap for JoinSplit operation");
+    }
+
+    UniValue outputMap = outputMapValue.get_array();
+    assert(outputMap.size() == ZC_NUM_JS_OUTPUTS);
+    for (size_t i = 0; i < outputMap.size(); i++) {
+        if (outputMap[i].get_int() == n) {
+            return i;
+        }
+    }
+
+    throw std::logic_error("n is not present in outputmap");
+}
+
+AsyncRPCOperation_mergetoaddress::AsyncRPCOperation_mergetoaddress(
+    CMutableTransaction contextualTx,
+    std::vector<MergeToAddressInputUTXO> utxoInputs,
+    std::vector<MergeToAddressInputNote> noteInputs,
+    MergeToAddressRecipient recipient,
+    CAmount fee,
+    UniValue contextInfo) :
+    tx_(contextualTx), utxoInputs_(utxoInputs), noteInputs_(noteInputs),
+    recipient_(recipient), fee_(fee), contextinfo_(contextInfo)
+{
+    if (fee < 0 || fee > MAX_MONEY) {
+        throw JSONRPCError(RPC_INVALID_PARAMETER, "Fee is out of range");
+    }
+
+    if (utxoInputs.empty() && noteInputs.empty()) {
+        throw JSONRPCError(RPC_INVALID_PARAMETER, "No inputs");
+    }
+
+    if (std::get<0>(recipient).size() == 0) {
+        throw JSONRPCError(RPC_INVALID_PARAMETER, "Recipient parameter missing");
+    }
+
+    toTaddr_ = CBitcoinAddress(std::get<0>(recipient));
+    isToTaddr_ = toTaddr_.IsValid();
+    isToZaddr_ = false;
+
+    if (!isToTaddr_) {
+        CZCPaymentAddress address(std::get<0>(recipient));
+        try {
+            PaymentAddress addr = address.Get();
+
+            isToZaddr_ = true;
+            toPaymentAddress_ = addr;
+        } catch (const std::runtime_error& e) {
+            throw JSONRPCError(RPC_INVALID_ADDRESS_OR_KEY, string("runtime error: ") + e.what());
+        }
+    }
+
+    // Log the context info i.e. the call parameters to z_mergetoaddress
+    if (LogAcceptCategory("zrpcunsafe")) {
+        LogPrint("zrpcunsafe", "%s: z_mergetoaddress initialized (params=%s)\n", getId(), contextInfo.write());
+    } else {
+        LogPrint("zrpc", "%s: z_mergetoaddress initialized\n", getId());
+    }
+
+    // Lock UTXOs
+    lock_utxos();
+    lock_notes();
+
+    // Enable payment disclosure if requested
+    paymentDisclosureMode = fExperimentalMode && GetBoolArg("-paymentdisclosure", false);
+}
+
+AsyncRPCOperation_mergetoaddress::~AsyncRPCOperation_mergetoaddress()
+{
+}
+
+void AsyncRPCOperation_mergetoaddress::main()
+{
+    if (isCancelled()) {
+        unlock_utxos(); // clean up
+        unlock_notes();
+        return;
+    }
+
+    set_state(OperationStatus::EXECUTING);
+    start_execution_clock();
+
+    bool success = false;
+
+#ifdef ENABLE_MINING
+#ifdef ENABLE_WALLET
+    GenerateBitcoins(false, NULL, 0);
+#else
+    GenerateBitcoins(false, 0);
+#endif
+#endif
+
+    try {
+        success = main_impl();
+    } catch (const UniValue& objError) {
+        int code = find_value(objError, "code").get_int();
+        std::string message = find_value(objError, "message").get_str();
+        set_error_code(code);
+        set_error_message(message);
+    } catch (const runtime_error& e) {
+        set_error_code(-1);
+        set_error_message("runtime error: " + string(e.what()));
+    } catch (const logic_error& e) {
+        set_error_code(-1);
+        set_error_message("logic error: " + string(e.what()));
+    } catch (const exception& e) {
+        set_error_code(-1);
+        set_error_message("general exception: " + string(e.what()));
+    } catch (...) {
+        set_error_code(-2);
+        set_error_message("unknown error");
+    }
+
+#ifdef ENABLE_MINING
+#ifdef ENABLE_WALLET
+    GenerateBitcoins(GetBoolArg("-gen", false), pwalletMain, GetArg("-genproclimit", 1));
+#else
+    GenerateBitcoins(GetBoolArg("-gen", false), GetArg("-genproclimit", 1));
+#endif
+#endif
+
+    stop_execution_clock();
+
+    if (success) {
+        set_state(OperationStatus::SUCCESS);
+    } else {
+        set_state(OperationStatus::FAILED);
+    }
+
+    std::string s = strprintf("%s: z_mergetoaddress finished (status=%s", getId(), getStateAsString());
+    if (success) {
+        s += strprintf(", txid=%s)\n", tx_.GetHash().ToString());
+    } else {
+        s += strprintf(", error=%s)\n", getErrorMessage());
+    }
+    LogPrintf("%s", s);
+
+    unlock_utxos(); // clean up
+    unlock_notes(); // clean up
+
+    // !!! Payment disclosure START
+    if (success && paymentDisclosureMode && paymentDisclosureData_.size() > 0) {
+        uint256 txidhash = tx_.GetHash();
+        std::shared_ptr<PaymentDisclosureDB> db = PaymentDisclosureDB::sharedInstance();
+        for (PaymentDisclosureKeyInfo p : paymentDisclosureData_) {
+            p.first.hash = txidhash;
+            if (!db->Put(p.first, p.second)) {
+                LogPrint("paymentdisclosure", "%s: Payment Disclosure: Error writing entry to database for key %s\n", getId(), p.first.ToString());
+            } else {
+                LogPrint("paymentdisclosure", "%s: Payment Disclosure: Successfully added entry to database for key %s\n", getId(), p.first.ToString());
+            }
+        }
+    }
+    // !!! Payment disclosure END
+}
+
+// Notes:
+// 1. #1359 Currently there is no limit set on the number of joinsplits, so size of tx could be invalid.
+// 2. #1277 Spendable notes are not locked, so an operation running in parallel could also try to use them.
+bool AsyncRPCOperation_mergetoaddress::main_impl()
+{
+    assert(isToTaddr_ != isToZaddr_);
+
+    bool isPureTaddrOnlyTx = (noteInputs_.empty() && isToTaddr_);
+    CAmount minersFee = fee_;
+
+    size_t numInputs = utxoInputs_.size();
+
+    // Check mempooltxinputlimit to avoid creating a transaction which the local mempool rejects
+    size_t limit = (size_t)GetArg("-mempooltxinputlimit", 0);
+    if (limit > 0 && numInputs > limit) {
+        throw JSONRPCError(RPC_WALLET_ERROR,
+                           strprintf("Number of transparent inputs %d is greater than mempooltxinputlimit of %d",
+                                     numInputs, limit));
+    }
+
+    CAmount t_inputs_total = 0;
+    for (MergeToAddressInputUTXO& t : utxoInputs_) {
+        t_inputs_total += std::get<1>(t);
+    }
+
+    CAmount z_inputs_total = 0;
+    for (MergeToAddressInputNote& t : noteInputs_) {
+        z_inputs_total += std::get<2>(t);
+    }
+
+    CAmount targetAmount = z_inputs_total + t_inputs_total;
+
+    if (targetAmount <= minersFee) {
+        throw JSONRPCError(RPC_WALLET_INSUFFICIENT_FUNDS,
+                           strprintf("Insufficient funds, have %s and miners fee is %s",
+                                     FormatMoney(targetAmount), FormatMoney(minersFee)));
+    }
+
+    CAmount sendAmount = targetAmount - minersFee;
+
+    // update the transaction with the UTXO inputs and output (if any)
+    CMutableTransaction rawTx(tx_);
+    for (MergeToAddressInputUTXO& t : utxoInputs_) {
+        CTxIn in(std::get<0>(t));
+        rawTx.vin.push_back(in);
+    }
+    if (isToTaddr_) {
+        CScript scriptPubKey = GetScriptForDestination(toTaddr_.Get());
+        CTxOut out(sendAmount, scriptPubKey);
+        rawTx.vout.push_back(out);
+    }
+    tx_ = CTransaction(rawTx);
+
+    LogPrint(isPureTaddrOnlyTx ? "zrpc" : "zrpcunsafe", "%s: spending %s to send %s with fee %s\n",
+             getId(), FormatMoney(targetAmount), FormatMoney(sendAmount), FormatMoney(minersFee));
+    LogPrint("zrpc", "%s: transparent input: %s\n", getId(), FormatMoney(t_inputs_total));
+    LogPrint("zrpcunsafe", "%s: private input: %s\n", getId(), FormatMoney(z_inputs_total));
+    if (isToTaddr_) {
+        LogPrint("zrpc", "%s: transparent output: %s\n", getId(), FormatMoney(sendAmount));
+    } else {
+        LogPrint("zrpcunsafe", "%s: private output: %s\n", getId(), FormatMoney(sendAmount));
+    }
+    LogPrint("zrpc", "%s: fee: %s\n", getId(), FormatMoney(minersFee));
+
+    // Grab the current consensus branch ID
+    {
+        LOCK(cs_main);
+        consensusBranchId_ = CurrentEpochBranchId(chainActive.Height() + 1, Params().GetConsensus());
+    }
+
+    /**
+     * SCENARIO #1
+     *
+     * taddrs -> taddr
+     *
+     * There are no zaddrs or joinsplits involved.
+     */
+    if (isPureTaddrOnlyTx) {
+        UniValue obj(UniValue::VOBJ);
+        obj.push_back(Pair("rawtxn", EncodeHexTx(tx_)));
+        sign_send_raw_transaction(obj);
+        return true;
+    }
+    /**
+     * END SCENARIO #1
+     */
+
+
+    // Prepare raw transaction to handle JoinSplits
+    CMutableTransaction mtx(tx_);
+    crypto_sign_keypair(joinSplitPubKey_.begin(), joinSplitPrivKey_);
+    mtx.joinSplitPubKey = joinSplitPubKey_;
+    tx_ = CTransaction(mtx);
+    std::string hexMemo = std::get<1>(recipient_);
+
+
+    /**
+     * SCENARIO #2
+     *
+     * taddrs -> zaddr
+     *
+     * We only need a single JoinSplit.
+     */
+    if (noteInputs_.empty() && isToZaddr_) {
+        // Create JoinSplit to target z-addr.
+        MergeToAddressJSInfo info;
+        info.vpub_old = sendAmount;
+        info.vpub_new = 0;
+
+        JSOutput jso = JSOutput(toPaymentAddress_, sendAmount);
+        if (hexMemo.size() > 0) {
+            jso.memo = get_memo_from_hex_string(hexMemo);
+        }
+        info.vjsout.push_back(jso);
+
+        UniValue obj(UniValue::VOBJ);
+        obj = perform_joinsplit(info);
+        sign_send_raw_transaction(obj);
+        return true;
+    }
+    /**
+     * END SCENARIO #2
+     */
+
+
+    // Copy zinputs to more flexible containers
+    std::deque<MergeToAddressInputNote> zInputsDeque;
+    for (auto o : noteInputs_) {
+        zInputsDeque.push_back(o);
+    }
+
+    // When spending notes, take a snapshot of note witnesses and anchors as the treestate will
+    // change upon arrival of new blocks which contain joinsplit transactions.  This is likely
+    // to happen as creating a chained joinsplit transaction can take longer than the block interval.
+    {
+        LOCK2(cs_main, pwalletMain->cs_wallet);
+        for (auto t : noteInputs_) {
+            JSOutPoint jso = std::get<0>(t);
+            std::vector<JSOutPoint> vOutPoints = {jso};
+            uint256 inputAnchor;
+            std::vector<boost::optional<ZCIncrementalWitness>> vInputWitnesses;
+            pwalletMain->GetNoteWitnesses(vOutPoints, vInputWitnesses, inputAnchor);
+            jsopWitnessAnchorMap[jso.ToString()] = MergeToAddressWitnessAnchorData{vInputWitnesses[0], inputAnchor};
+        }
+    }
+
+    /**
+     * SCENARIO #3
+     *
+     * zaddrs -> zaddr
+     * taddrs ->
+     *
+     * zaddrs ->
+     * taddrs -> taddr
+     *
+     * Send to zaddr by chaining JoinSplits together and immediately consuming any change
+     * Send to taddr by creating dummy z outputs and accumulating value in a change note
+     * which is used to set vpub_new in the last chained joinsplit.
+     */
+    UniValue obj(UniValue::VOBJ);
+    CAmount jsChange = 0;          // this is updated after each joinsplit
+    int changeOutputIndex = -1;    // this is updated after each joinsplit if jsChange > 0
+    bool vpubOldProcessed = false; // updated when vpub_old for taddr inputs is set in first joinsplit
+    bool vpubNewProcessed = false; // updated when vpub_new for miner fee and taddr outputs is set in last joinsplit
+
+    // At this point, we are guaranteed to have at least one input note.
+    // Use address of first input note as the temporary change address.
+    SpendingKey changeKey = std::get<3>(zInputsDeque.front());
+    PaymentAddress changeAddress = changeKey.address();
+
+    CAmount vpubOldTarget = 0;
+    CAmount vpubNewTarget = 0;
+    if (isToTaddr_) {
+        vpubNewTarget = z_inputs_total;
+    } else {
+        if (utxoInputs_.empty()) {
+            vpubNewTarget = minersFee;
+        } else {
+            vpubOldTarget = t_inputs_total - minersFee;
+        }
+    }
+
+    // Keep track of treestate within this transaction
+    boost::unordered_map<uint256, ZCIncrementalMerkleTree, CCoinsKeyHasher> intermediates;
+    std::vector<uint256> previousCommitments;
+
+    while (!vpubNewProcessed) {
+        MergeToAddressJSInfo info;
+        info.vpub_old = 0;
+        info.vpub_new = 0;
+
+        // Set vpub_old in the first joinsplit
+        if (!vpubOldProcessed) {
+            if (t_inputs_total < vpubOldTarget) {
+                throw JSONRPCError(RPC_WALLET_ERROR,
+                                   strprintf("Insufficient transparent funds for vpub_old %s (miners fee %s, taddr inputs %s)",
+                                             FormatMoney(vpubOldTarget), FormatMoney(minersFee), FormatMoney(t_inputs_total)));
+            }
+            info.vpub_old += vpubOldTarget; // funds flowing from public pool
+            vpubOldProcessed = true;
+        }
+
+        CAmount jsInputValue = 0;
+        uint256 jsAnchor;
+        std::vector<boost::optional<ZCIncrementalWitness>> witnesses;
+
+        JSDescription prevJoinSplit;
+
+        // Keep track of previous JoinSplit and its commitments
+        if (tx_.vjoinsplit.size() > 0) {
+            prevJoinSplit = tx_.vjoinsplit.back();
+        }
+
+        // If there is no change, the chain has terminated so we can reset the tracked treestate.
+        if (jsChange == 0 && tx_.vjoinsplit.size() > 0) {
+            intermediates.clear();
+            previousCommitments.clear();
+        }
+
+        //
+        // Consume change as the first input of the JoinSplit.
+        //
+        if (jsChange > 0) {
+            LOCK2(cs_main, pwalletMain->cs_wallet);
+
+            // Update tree state with previous joinsplit
+            ZCIncrementalMerkleTree tree;
+            auto it = intermediates.find(prevJoinSplit.anchor);
+            if (it != intermediates.end()) {
+                tree = it->second;
+            } else if (!pcoinsTip->GetAnchorAt(prevJoinSplit.anchor, tree)) {
+                throw JSONRPCError(RPC_WALLET_ERROR, "Could not find previous JoinSplit anchor");
+            }
+
+            assert(changeOutputIndex != -1);
+            boost::optional<ZCIncrementalWitness> changeWitness;
+            int n = 0;
+            for (const uint256& commitment : prevJoinSplit.commitments) {
+                tree.append(commitment);
+                previousCommitments.push_back(commitment);
+                if (!changeWitness && changeOutputIndex == n++) {
+                    changeWitness = tree.witness();
+                } else if (changeWitness) {
+                    changeWitness.get().append(commitment);
+                }
+            }
+            if (changeWitness) {
+                witnesses.push_back(changeWitness);
+            }
+            jsAnchor = tree.root();
+            intermediates.insert(std::make_pair(tree.root(), tree)); // chained js are interstitial (found in between block boundaries)
+
+            // Decrypt the change note's ciphertext to retrieve some data we need
+            ZCNoteDecryption decryptor(changeKey.receiving_key());
+            auto hSig = prevJoinSplit.h_sig(*pzcashParams, tx_.joinSplitPubKey);
+            try {
+                NotePlaintext plaintext = NotePlaintext::decrypt(
+                    decryptor,
+                    prevJoinSplit.ciphertexts[changeOutputIndex],
+                    prevJoinSplit.ephemeralKey,
+                    hSig,
+                    (unsigned char)changeOutputIndex);
+
+                Note note = plaintext.note(changeAddress);
+                info.notes.push_back(note);
+                info.zkeys.push_back(changeKey);
+
+                jsInputValue += plaintext.value;
+
+                LogPrint("zrpcunsafe", "%s: spending change (amount=%s)\n",
+                         getId(),
+                         FormatMoney(plaintext.value));
+
+            } catch (const std::exception& e) {
+                throw JSONRPCError(RPC_WALLET_ERROR, strprintf("Error decrypting output note of previous JoinSplit: %s", e.what()));
+            }
+        }
+
+
+        //
+        // Consume spendable non-change notes
+        //
+        std::vector<Note> vInputNotes;
+        std::vector<SpendingKey> vInputZKeys;
+        std::vector<JSOutPoint> vOutPoints;
+        std::vector<boost::optional<ZCIncrementalWitness>> vInputWitnesses;
+        uint256 inputAnchor;
+        int numInputsNeeded = (jsChange > 0) ? 1 : 0;
+        while (numInputsNeeded++ < ZC_NUM_JS_INPUTS && zInputsDeque.size() > 0) {
+            MergeToAddressInputNote t = zInputsDeque.front();
+            JSOutPoint jso = std::get<0>(t);
+            Note note = std::get<1>(t);
+            CAmount noteFunds = std::get<2>(t);
+            SpendingKey zkey = std::get<3>(t);
+            zInputsDeque.pop_front();
+
+            MergeToAddressWitnessAnchorData wad = jsopWitnessAnchorMap[jso.ToString()];
+            vInputWitnesses.push_back(wad.witness);
+            if (inputAnchor.IsNull()) {
+                inputAnchor = wad.anchor;
+            } else if (inputAnchor != wad.anchor) {
+                throw JSONRPCError(RPC_WALLET_ERROR, "Selected input notes do not share the same anchor");
+            }
+
+            vOutPoints.push_back(jso);
+            vInputNotes.push_back(note);
+            vInputZKeys.push_back(zkey);
+
+            jsInputValue += noteFunds;
+
+            int wtxHeight = -1;
+            int wtxDepth = -1;
+            {
+                LOCK2(cs_main, pwalletMain->cs_wallet);
+                const CWalletTx& wtx = pwalletMain->mapWallet[jso.hash];
+                // Zero confirmation notes belong to transactions which have not yet been mined
+                if (mapBlockIndex.find(wtx.hashBlock) == mapBlockIndex.end()) {
+                    throw JSONRPCError(RPC_WALLET_ERROR, strprintf("mapBlockIndex does not contain block hash %s", wtx.hashBlock.ToString()));
+                }
+                wtxHeight = mapBlockIndex[wtx.hashBlock]->nHeight;
+                wtxDepth = wtx.GetDepthInMainChain();
+            }
+            LogPrint("zrpcunsafe", "%s: spending note (txid=%s, vjoinsplit=%d, ciphertext=%d, amount=%s, height=%d, confirmations=%d)\n",
+                     getId(),
+                     jso.hash.ToString().substr(0, 10),
+                     jso.js,
+                     int(jso.n), // uint8_t
+                     FormatMoney(noteFunds),
+                     wtxHeight,
+                     wtxDepth);
+        }
+
+        // Add history of previous commitments to witness
+        if (vInputNotes.size() > 0) {
+            if (vInputWitnesses.size() == 0) {
+                throw JSONRPCError(RPC_WALLET_ERROR, "Could not find witness for note commitment");
+            }
+
+            for (auto& optionalWitness : vInputWitnesses) {
+                if (!optionalWitness) {
+                    throw JSONRPCError(RPC_WALLET_ERROR, "Witness for note commitment is null");
+                }
+                ZCIncrementalWitness w = *optionalWitness; // could use .get();
+                if (jsChange > 0) {
+                    for (const uint256& commitment : previousCommitments) {
+                        w.append(commitment);
+                    }
+                    if (jsAnchor != w.root()) {
+                        throw JSONRPCError(RPC_WALLET_ERROR, "Witness for spendable note does not have same anchor as change input");
+                    }
+                }
+                witnesses.push_back(w);
+            }
+
+            // The jsAnchor is null if this JoinSplit is at the start of a new chain
+            if (jsAnchor.IsNull()) {
+                jsAnchor = inputAnchor;
+            }
+
+            // Add spendable notes as inputs
+            std::copy(vInputNotes.begin(), vInputNotes.end(), std::back_inserter(info.notes));
+            std::copy(vInputZKeys.begin(), vInputZKeys.end(), std::back_inserter(info.zkeys));
+        }
+
+        // Accumulate change
+        jsChange = jsInputValue + info.vpub_old;
+
+        // Set vpub_new in the last joinsplit (when there are no more notes to spend)
+        if (zInputsDeque.empty()) {
+            assert(!vpubNewProcessed);
+            if (jsInputValue < vpubNewTarget) {
+                throw JSONRPCError(RPC_WALLET_ERROR,
+                                   strprintf("Insufficient funds for vpub_new %s (miners fee %s, taddr inputs %s)",
+                                             FormatMoney(vpubNewTarget), FormatMoney(minersFee), FormatMoney(t_inputs_total)));
+            }
+            info.vpub_new += vpubNewTarget; // funds flowing back to public pool
+            vpubNewProcessed = true;
+            jsChange -= vpubNewTarget;
+            // If we are merging to a t-addr, there should be no change
+            if (isToTaddr_) assert(jsChange == 0);
+        }
+
+        // create dummy output
+        info.vjsout.push_back(JSOutput()); // dummy output while we accumulate funds into a change note for vpub_new
+
+        // create output for any change
+        if (jsChange > 0) {
+            std::string outputType = "change";
+            auto jso = JSOutput(changeAddress, jsChange);
+            // If this is the final output, set the target and memo
+            if (isToZaddr_ && vpubNewProcessed) {
+                outputType = "target";
+                jso.addr = toPaymentAddress_;
+                if (!hexMemo.empty()) {
+                    jso.memo = get_memo_from_hex_string(hexMemo);
+                }
+            }
+            info.vjsout.push_back(jso);
+
+            LogPrint("zrpcunsafe", "%s: generating note for %s (amount=%s)\n",
+                     getId(),
+                     outputType,
+                     FormatMoney(jsChange));
+        }
+
+        obj = perform_joinsplit(info, witnesses, jsAnchor);
+
+        if (jsChange > 0) {
+            changeOutputIndex = mta_find_output(obj, 1);
+        }
+    }
+
+    // Sanity check in case changes to code block above exits loop by invoking 'break'
+    assert(zInputsDeque.size() == 0);
+    assert(vpubNewProcessed);
+
+    sign_send_raw_transaction(obj);
+    return true;
+}
+
+
+/**
+ * Sign and send a raw transaction.
+ * Raw transaction as hex string should be in object field "rawtxn"
+ */
+void AsyncRPCOperation_mergetoaddress::sign_send_raw_transaction(UniValue obj)
+{
+    // Sign the raw transaction
+    UniValue rawtxnValue = find_value(obj, "rawtxn");
+    if (rawtxnValue.isNull()) {
+        throw JSONRPCError(RPC_WALLET_ERROR, "Missing hex data for raw transaction");
+    }
+    std::string rawtxn = rawtxnValue.get_str();
+
+    UniValue params = UniValue(UniValue::VARR);
+    params.push_back(rawtxn);
+    UniValue signResultValue = signrawtransaction(params, false);
+    UniValue signResultObject = signResultValue.get_obj();
+    UniValue completeValue = find_value(signResultObject, "complete");
+    bool complete = completeValue.get_bool();
+    if (!complete) {
+        // TODO: #1366 Maybe get "errors" and print array vErrors into a string
+        throw JSONRPCError(RPC_WALLET_ENCRYPTION_FAILED, "Failed to sign transaction");
+    }
+
+    UniValue hexValue = find_value(signResultObject, "hex");
+    if (hexValue.isNull()) {
+        throw JSONRPCError(RPC_WALLET_ERROR, "Missing hex data for signed transaction");
+    }
+    std::string signedtxn = hexValue.get_str();
+
+    // Send the signed transaction
+    if (!testmode) {
+        params.clear();
+        params.setArray();
+        params.push_back(signedtxn);
+        UniValue sendResultValue = sendrawtransaction(params, false);
+        if (sendResultValue.isNull()) {
+            throw JSONRPCError(RPC_WALLET_ERROR, "Send raw transaction did not return an error or a txid.");
+        }
+
+        std::string txid = sendResultValue.get_str();
+
+        UniValue o(UniValue::VOBJ);
+        o.push_back(Pair("txid", txid));
+        set_result(o);
+    } else {
+        // Test mode does not send the transaction to the network.
+
+        CDataStream stream(ParseHex(signedtxn), SER_NETWORK, PROTOCOL_VERSION);
+        CTransaction tx;
+        stream >> tx;
+
+        UniValue o(UniValue::VOBJ);
+        o.push_back(Pair("test", 1));
+        o.push_back(Pair("txid", tx.GetHash().ToString()));
+        o.push_back(Pair("hex", signedtxn));
+        set_result(o);
+    }
+
+    // Keep the signed transaction so we can hash to the same txid
+    CDataStream stream(ParseHex(signedtxn), SER_NETWORK, PROTOCOL_VERSION);
+    CTransaction tx;
+    stream >> tx;
+    tx_ = tx;
+}
+
+
+UniValue AsyncRPCOperation_mergetoaddress::perform_joinsplit(MergeToAddressJSInfo& info)
+{
+    std::vector<boost::optional<ZCIncrementalWitness>> witnesses;
+    uint256 anchor;
+    {
+        LOCK(cs_main);
+        anchor = pcoinsTip->GetBestAnchor(); // As there are no inputs, ask the wallet for the best anchor
+    }
+    return perform_joinsplit(info, witnesses, anchor);
+}
+
+
+UniValue AsyncRPCOperation_mergetoaddress::perform_joinsplit(MergeToAddressJSInfo& info, std::vector<JSOutPoint>& outPoints)
+{
+    std::vector<boost::optional<ZCIncrementalWitness>> witnesses;
+    uint256 anchor;
+    {
+        LOCK(cs_main);
+        pwalletMain->GetNoteWitnesses(outPoints, witnesses, anchor);
+    }
+    return perform_joinsplit(info, witnesses, anchor);
+}
+
+UniValue AsyncRPCOperation_mergetoaddress::perform_joinsplit(
+    MergeToAddressJSInfo& info,
+    std::vector<boost::optional<ZCIncrementalWitness>> witnesses,
+    uint256 anchor)
+{
+    if (anchor.IsNull()) {
+        throw std::runtime_error("anchor is null");
+    }
+
+    if (witnesses.size() != info.notes.size()) {
+        throw runtime_error("number of notes and witnesses do not match");
+    }
+
+    if (info.notes.size() != info.zkeys.size()) {
+        throw runtime_error("number of notes and spending keys do not match");
+    }
+
+    for (size_t i = 0; i < witnesses.size(); i++) {
+        if (!witnesses[i]) {
+            throw runtime_error("joinsplit input could not be found in tree");
+        }
+        info.vjsin.push_back(JSInput(*witnesses[i], info.notes[i], info.zkeys[i]));
+    }
+
+    // Make sure there are two inputs and two outputs
+    while (info.vjsin.size() < ZC_NUM_JS_INPUTS) {
+        info.vjsin.push_back(JSInput());
+    }
+
+    while (info.vjsout.size() < ZC_NUM_JS_OUTPUTS) {
+        info.vjsout.push_back(JSOutput());
+    }
+
+    if (info.vjsout.size() != ZC_NUM_JS_INPUTS || info.vjsin.size() != ZC_NUM_JS_OUTPUTS) {
+        throw runtime_error("unsupported joinsplit input/output counts");
+    }
+
+    CMutableTransaction mtx(tx_);
+
+    LogPrint("zrpcunsafe", "%s: creating joinsplit at index %d (vpub_old=%s, vpub_new=%s, in[0]=%s, in[1]=%s, out[0]=%s, out[1]=%s)\n",
+             getId(),
+             tx_.vjoinsplit.size(),
+             FormatMoney(info.vpub_old), FormatMoney(info.vpub_new),
+             FormatMoney(info.vjsin[0].note.value), FormatMoney(info.vjsin[1].note.value),
+             FormatMoney(info.vjsout[0].value), FormatMoney(info.vjsout[1].value));
+
+    // Generate the proof, this can take over a minute.
+    boost::array<libzcash::JSInput, ZC_NUM_JS_INPUTS> inputs{info.vjsin[0], info.vjsin[1]};
+    boost::array<libzcash::JSOutput, ZC_NUM_JS_OUTPUTS> outputs{info.vjsout[0], info.vjsout[1]};
+    boost::array<size_t, ZC_NUM_JS_INPUTS> inputMap;
+    boost::array<size_t, ZC_NUM_JS_OUTPUTS> outputMap;
+
+    uint256 esk; // payment disclosure - secret
+
+    JSDescription jsdesc = JSDescription::Randomized(
+        *pzcashParams,
+        joinSplitPubKey_,
+        anchor,
+        inputs,
+        outputs,
+        inputMap,
+        outputMap,
+        info.vpub_old,
+        info.vpub_new,
+        !this->testmode,
+        &esk); // parameter expects pointer to esk, so pass in address
+    {
+        auto verifier = libzcash::ProofVerifier::Strict();
+        if (!(jsdesc.Verify(*pzcashParams, verifier, joinSplitPubKey_))) {
+            throw std::runtime_error("error verifying joinsplit");
+        }
+    }
+
+    mtx.vjoinsplit.push_back(jsdesc);
+
+    // Empty output script.
+    CScript scriptCode;
+    CTransaction signTx(mtx);
+    uint256 dataToBeSigned = SignatureHash(scriptCode, signTx, NOT_AN_INPUT, SIGHASH_ALL, 0, consensusBranchId_);
+
+    // Add the signature
+    if (!(crypto_sign_detached(&mtx.joinSplitSig[0], NULL,
+                               dataToBeSigned.begin(), 32,
+                               joinSplitPrivKey_) == 0)) {
+        throw std::runtime_error("crypto_sign_detached failed");
+    }
+
+    // Sanity check
+    if (!(crypto_sign_verify_detached(&mtx.joinSplitSig[0],
+                                      dataToBeSigned.begin(), 32,
+                                      mtx.joinSplitPubKey.begin()) == 0)) {
+        throw std::runtime_error("crypto_sign_verify_detached failed");
+    }
+
+    CTransaction rawTx(mtx);
+    tx_ = rawTx;
+
+    CDataStream ss(SER_NETWORK, PROTOCOL_VERSION);
+    ss << rawTx;
+
+    std::string encryptedNote1;
+    std::string encryptedNote2;
+    {
+        CDataStream ss2(SER_NETWORK, PROTOCOL_VERSION);
+        ss2 << ((unsigned char)0x00);
+        ss2 << jsdesc.ephemeralKey;
+        ss2 << jsdesc.ciphertexts[0];
+        ss2 << jsdesc.h_sig(*pzcashParams, joinSplitPubKey_);
+
+        encryptedNote1 = HexStr(ss2.begin(), ss2.end());
+    }
+    {
+        CDataStream ss2(SER_NETWORK, PROTOCOL_VERSION);
+        ss2 << ((unsigned char)0x01);
+        ss2 << jsdesc.ephemeralKey;
+        ss2 << jsdesc.ciphertexts[1];
+        ss2 << jsdesc.h_sig(*pzcashParams, joinSplitPubKey_);
+
+        encryptedNote2 = HexStr(ss2.begin(), ss2.end());
+    }
+
+    UniValue arrInputMap(UniValue::VARR);
+    UniValue arrOutputMap(UniValue::VARR);
+    for (size_t i = 0; i < ZC_NUM_JS_INPUTS; i++) {
+        arrInputMap.push_back(inputMap[i]);
+    }
+    for (size_t i = 0; i < ZC_NUM_JS_OUTPUTS; i++) {
+        arrOutputMap.push_back(outputMap[i]);
+    }
+
+
+    // !!! Payment disclosure START
+    unsigned char buffer[32] = {0};
+    memcpy(&buffer[0], &joinSplitPrivKey_[0], 32); // private key in first half of 64 byte buffer
+    std::vector<unsigned char> vch(&buffer[0], &buffer[0] + 32);
+    uint256 joinSplitPrivKey = uint256(vch);
+    size_t js_index = tx_.vjoinsplit.size() - 1;
+    uint256 placeholder;
+    for (int i = 0; i < ZC_NUM_JS_OUTPUTS; i++) {
+        uint8_t mapped_index = outputMap[i];
+        // placeholder for txid will be filled in later when tx has been finalized and signed.
+        PaymentDisclosureKey pdKey = {placeholder, js_index, mapped_index};
+        JSOutput output = outputs[mapped_index];
+        libzcash::PaymentAddress zaddr = output.addr; // randomized output
+        PaymentDisclosureInfo pdInfo = {PAYMENT_DISCLOSURE_VERSION_EXPERIMENTAL, esk, joinSplitPrivKey, zaddr};
+        paymentDisclosureData_.push_back(PaymentDisclosureKeyInfo(pdKey, pdInfo));
+
+        CZCPaymentAddress address(zaddr);
+        LogPrint("paymentdisclosure", "%s: Payment Disclosure: js=%d, n=%d, zaddr=%s\n", getId(), js_index, int(mapped_index), address.ToString());
+    }
+    // !!! Payment disclosure END
+
+    UniValue obj(UniValue::VOBJ);
+    obj.push_back(Pair("encryptednote1", encryptedNote1));
+    obj.push_back(Pair("encryptednote2", encryptedNote2));
+    obj.push_back(Pair("rawtxn", HexStr(ss.begin(), ss.end())));
+    obj.push_back(Pair("inputmap", arrInputMap));
+    obj.push_back(Pair("outputmap", arrOutputMap));
+    return obj;
+}
+
+boost::array<unsigned char, ZC_MEMO_SIZE> AsyncRPCOperation_mergetoaddress::get_memo_from_hex_string(std::string s)
+{
+    boost::array<unsigned char, ZC_MEMO_SIZE> memo = {{0x00}};
+
+    std::vector<unsigned char> rawMemo = ParseHex(s.c_str());
+
+    // If ParseHex comes across a non-hex char, it will stop but still return results so far.
+    size_t slen = s.length();
+    if (slen % 2 != 0 || (slen > 0 && rawMemo.size() != slen / 2)) {
+        throw JSONRPCError(RPC_INVALID_PARAMETER, "Memo must be in hexadecimal format");
+    }
+
+    if (rawMemo.size() > ZC_MEMO_SIZE) {
+        throw JSONRPCError(RPC_INVALID_PARAMETER, strprintf("Memo size of %d is too big, maximum allowed is %d", rawMemo.size(), ZC_MEMO_SIZE));
+    }
+
+    // copy vector into boost array
+    int lenMemo = rawMemo.size();
+    for (int i = 0; i < ZC_MEMO_SIZE && i < lenMemo; i++) {
+        memo[i] = rawMemo[i];
+    }
+    return memo;
+}
+
+/**
+ * Override getStatus() to append the operation's input parameters to the default status object.
+ */
+UniValue AsyncRPCOperation_mergetoaddress::getStatus() const
+{
+    UniValue v = AsyncRPCOperation::getStatus();
+    if (contextinfo_.isNull()) {
+        return v;
+    }
+
+    UniValue obj = v.get_obj();
+    obj.push_back(Pair("method", "z_mergetoaddress"));
+    obj.push_back(Pair("params", contextinfo_));
+    return obj;
+}
+
+/**
+ * Lock input utxos
+ */
+ void AsyncRPCOperation_mergetoaddress::lock_utxos() {
+    LOCK2(cs_main, pwalletMain->cs_wallet);
+    for (auto utxo : utxoInputs_) {
+        pwalletMain->LockCoin(std::get<0>(utxo));
+    }
+}
+
+/**
+ * Unlock input utxos
+ */
+void AsyncRPCOperation_mergetoaddress::unlock_utxos() {
+    LOCK2(cs_main, pwalletMain->cs_wallet);
+    for (auto utxo : utxoInputs_) {
+        pwalletMain->UnlockCoin(std::get<0>(utxo));
+    }
+}
+
+
+/**
+ * Lock input notes
+ */
+ void AsyncRPCOperation_mergetoaddress::lock_notes() {
+    LOCK2(cs_main, pwalletMain->cs_wallet);
+    for (auto note : noteInputs_) {
+        pwalletMain->LockNote(std::get<0>(note));
+    }
+}
+
+/**
+ * Unlock input notes
+ */
+void AsyncRPCOperation_mergetoaddress::unlock_notes() {
+    LOCK2(cs_main, pwalletMain->cs_wallet);
+    for (auto note : noteInputs_) {
+        pwalletMain->UnlockNote(std::get<0>(note));
+    }
+}

src/wallet/asyncrpcoperation_mergetoaddress.h

@@ -0,0 +1,193 @@
+// Copyright (c) 2017 The Zcash developers
+// Distributed under the MIT software license, see the accompanying
+// file COPYING or http://www.opensource.org/licenses/mit-license.php.
+
+#ifndef ASYNCRPCOPERATION_MERGETOADDRESS_H
+#define ASYNCRPCOPERATION_MERGETOADDRESS_H
+
+#include "amount.h"
+#include "asyncrpcoperation.h"
+#include "base58.h"
+#include "paymentdisclosure.h"
+#include "primitives/transaction.h"
+#include "wallet.h"
+#include "zcash/Address.hpp"
+#include "zcash/JoinSplit.hpp"
+
+#include <tuple>
+#include <unordered_map>
+
+#include <univalue.h>
+
+// Default transaction fee if caller does not specify one.
+#define MERGE_TO_ADDRESS_OPERATION_DEFAULT_MINERS_FEE 10000
+
+using namespace libzcash;
+
+// Input UTXO is a tuple of txid, vout, amount
+typedef std::tuple<COutPoint, CAmount> MergeToAddressInputUTXO;
+
+// Input JSOP is a tuple of JSOutpoint, note, amount, spending key
+typedef std::tuple<JSOutPoint, Note, CAmount, SpendingKey> MergeToAddressInputNote;
+
+// A recipient is a tuple of address, memo (optional if zaddr)
+typedef std::tuple<std::string, std::string> MergeToAddressRecipient;
+
+// Package of info which is passed to perform_joinsplit methods.
+struct MergeToAddressJSInfo {
+    std::vector<JSInput> vjsin;
+    std::vector<JSOutput> vjsout;
+    std::vector<Note> notes;
+    std::vector<SpendingKey> zkeys;
+    CAmount vpub_old = 0;
+    CAmount vpub_new = 0;
+};
+
+// A struct to help us track the witness and anchor for a given JSOutPoint
+struct MergeToAddressWitnessAnchorData {
+    boost::optional<ZCIncrementalWitness> witness;
+    uint256 anchor;
+};
+
+class AsyncRPCOperation_mergetoaddress : public AsyncRPCOperation
+{
+public:
+    AsyncRPCOperation_mergetoaddress(
+        CMutableTransaction contextualTx,
+        std::vector<MergeToAddressInputUTXO> utxoInputs,
+        std::vector<MergeToAddressInputNote> noteInputs,
+        MergeToAddressRecipient recipient,
+        CAmount fee = MERGE_TO_ADDRESS_OPERATION_DEFAULT_MINERS_FEE,
+        UniValue contextInfo = NullUniValue);
+    virtual ~AsyncRPCOperation_mergetoaddress();
+
+    // We don't want to be copied or moved around
+    AsyncRPCOperation_mergetoaddress(AsyncRPCOperation_mergetoaddress const&) = delete;            // Copy construct
+    AsyncRPCOperation_mergetoaddress(AsyncRPCOperation_mergetoaddress&&) = delete;                 // Move construct
+    AsyncRPCOperation_mergetoaddress& operator=(AsyncRPCOperation_mergetoaddress const&) = delete; // Copy assign
+    AsyncRPCOperation_mergetoaddress& operator=(AsyncRPCOperation_mergetoaddress&&) = delete;      // Move assign
+
+    virtual void main();
+
+    virtual UniValue getStatus() const;
+
+    bool testmode = false; // Set to true to disable sending txs and generating proofs
+
+    bool paymentDisclosureMode = false; // Set to true to save esk for encrypted notes in payment disclosure database.
+
+private:
+    friend class TEST_FRIEND_AsyncRPCOperation_mergetoaddress; // class for unit testing
+
+    UniValue contextinfo_; // optional data to include in return value from getStatus()
+
+    uint32_t consensusBranchId_;
+    CAmount fee_;
+    int mindepth_;
+    MergeToAddressRecipient recipient_;
+    bool isToTaddr_;
+    bool isToZaddr_;
+    CBitcoinAddress toTaddr_;
+    PaymentAddress toPaymentAddress_;
+
+    uint256 joinSplitPubKey_;
+    unsigned char joinSplitPrivKey_[crypto_sign_SECRETKEYBYTES];
+
+    // The key is the result string from calling JSOutPoint::ToString()
+    std::unordered_map<std::string, MergeToAddressWitnessAnchorData> jsopWitnessAnchorMap;
+
+    std::vector<MergeToAddressInputUTXO> utxoInputs_;
+    std::vector<MergeToAddressInputNote> noteInputs_;
+
+    CTransaction tx_;
+
+    boost::array<unsigned char, ZC_MEMO_SIZE> get_memo_from_hex_string(std::string s);
+    bool main_impl();
+
+    // JoinSplit without any input notes to spend
+    UniValue perform_joinsplit(MergeToAddressJSInfo&);
+
+    // JoinSplit with input notes to spend (JSOutPoints))
+    UniValue perform_joinsplit(MergeToAddressJSInfo&, std::vector<JSOutPoint>&);
+
+    // JoinSplit where you have the witnesses and anchor
+    UniValue perform_joinsplit(
+        MergeToAddressJSInfo& info,
+        std::vector<boost::optional<ZCIncrementalWitness>> witnesses,
+        uint256 anchor);
+
+    void sign_send_raw_transaction(UniValue obj); // throws exception if there was an error
+
+    void lock_utxos();
+
+    void unlock_utxos();
+
+    void lock_notes();
+
+    void unlock_notes();
+
+    // payment disclosure!
+    std::vector<PaymentDisclosureKeyInfo> paymentDisclosureData_;
+};
+
+
+// To test private methods, a friend class can act as a proxy
+class TEST_FRIEND_AsyncRPCOperation_mergetoaddress
+{
+public:
+    std::shared_ptr<AsyncRPCOperation_mergetoaddress> delegate;
+
+    TEST_FRIEND_AsyncRPCOperation_mergetoaddress(std::shared_ptr<AsyncRPCOperation_mergetoaddress> ptr) : delegate(ptr) {}
+
+    CTransaction getTx()
+    {
+        return delegate->tx_;
+    }
+
+    void setTx(CTransaction tx)
+    {
+        delegate->tx_ = tx;
+    }
+
+    // Delegated methods
+
+    boost::array<unsigned char, ZC_MEMO_SIZE> get_memo_from_hex_string(std::string s)
+    {
+        return delegate->get_memo_from_hex_string(s);
+    }
+
+    bool main_impl()
+    {
+        return delegate->main_impl();
+    }
+
+    UniValue perform_joinsplit(MergeToAddressJSInfo& info)
+    {
+        return delegate->perform_joinsplit(info);
+    }
+
+    UniValue perform_joinsplit(MergeToAddressJSInfo& info, std::vector<JSOutPoint>& v)
+    {
+        return delegate->perform_joinsplit(info, v);
+    }
+
+    UniValue perform_joinsplit(
+        MergeToAddressJSInfo& info,
+        std::vector<boost::optional<ZCIncrementalWitness>> witnesses,
+        uint256 anchor)
+    {
+        return delegate->perform_joinsplit(info, witnesses, anchor);
+    }
+
+    void sign_send_raw_transaction(UniValue obj)
+    {
+        delegate->sign_send_raw_transaction(obj);
+    }
+
+    void set_state(OperationStatus state)
+    {
+        delegate->state_.store(state);
+    }
+};
+
+
+#endif /* ASYNCRPCOPERATION_MERGETOADDRESS_H */

src/wallet/asyncrpcoperation_sendmany.cpp

@@ -5,6 +5,7 @@
 #include "asyncrpcoperation_sendmany.h"
 #include "asyncrpcqueue.h"
 #include "amount.h"
+#include "consensus/upgrades.h"
 #include "core_io.h"
 #include "init.h"
 #include "main.h"
@@ -30,6 +31,8 @@
 #include <thread>
 #include <string>
 
+#include "paymentdisclosuredb.h"
+
 using namespace libzcash;
 
 int find_output(UniValue obj, int n) {
@@ -50,13 +53,14 @@ int find_output(UniValue obj, int n) {
 }
 
 AsyncRPCOperation_sendmany::AsyncRPCOperation_sendmany(
+        CMutableTransaction contextualTx,
         std::string fromAddress,
         std::vector<SendManyRecipient> tOutputs,
         std::vector<SendManyRecipient> zOutputs,
         int minDepth,
         CAmount fee,
         UniValue contextInfo) :
-        fromaddress_(fromAddress), t_outputs_(tOutputs), z_outputs_(zOutputs), mindepth_(minDepth), fee_(fee), contextinfo_(contextInfo)
+        tx_(contextualTx), fromaddress_(fromAddress), t_outputs_(tOutputs), z_outputs_(zOutputs), mindepth_(minDepth), fee_(fee), contextinfo_(contextInfo)
 {
     assert(fee_ >= 0);
 
@@ -95,12 +99,20 @@ AsyncRPCOperation_sendmany::AsyncRPCOperation_sendmany(
         }
     }
 
+    if (isfromzaddr_ && minDepth==0) {
+        throw JSONRPCError(RPC_INVALID_PARAMETER, "Minconf cannot be zero when sending from zaddr");
+    }
+
     // Log the context info i.e. the call parameters to z_sendmany
     if (LogAcceptCategory("zrpcunsafe")) {
         LogPrint("zrpcunsafe", "%s: z_sendmany initialized (params=%s)\n", getId(), contextInfo.write());
     } else {
         LogPrint("zrpc", "%s: z_sendmany initialized\n", getId());
     }
+
+
+    // Enable payment disclosure if requested
+    paymentDisclosureMode = fExperimentalMode && GetBoolArg("-paymentdisclosure", false);
 }
 
 AsyncRPCOperation_sendmany::~AsyncRPCOperation_sendmany() {
@@ -167,6 +179,21 @@ void AsyncRPCOperation_sendmany::main() {
         s += strprintf(", error=%s)\n", getErrorMessage());
     }
     LogPrintf("%s",s);
+
+    // !!! Payment disclosure START
+    if (success && paymentDisclosureMode && paymentDisclosureData_.size()>0) {
+        uint256 txidhash = tx_.GetHash();
+        std::shared_ptr<PaymentDisclosureDB> db = PaymentDisclosureDB::sharedInstance();
+        for (PaymentDisclosureKeyInfo p : paymentDisclosureData_) {
+            p.first.hash = txidhash;
+            if (!db->Put(p.first, p.second)) {
+                LogPrint("paymentdisclosure", "%s: Payment Disclosure: Error writing entry to database for key %s\n", getId(), p.first.ToString());
+            } else {
+                LogPrint("paymentdisclosure", "%s: Payment Disclosure: Successfully added entry to database for key %s\n", getId(), p.first.ToString());
+            }
+        }
+    }
+    // !!! Payment disclosure END
 }
 
 // Notes:
@@ -283,6 +310,15 @@ bool AsyncRPCOperation_sendmany::main_impl() {
         t_inputs_ = selectedTInputs;
         t_inputs_total = selectedUTXOAmount;
 
+        // Check mempooltxinputlimit to avoid creating a transaction which the local mempool rejects
+        size_t limit = (size_t)GetArg("-mempooltxinputlimit", 0);
+        if (limit > 0) {
+            size_t n = t_inputs_.size();
+            if (n > limit) {
+                throw JSONRPCError(RPC_WALLET_ERROR, strprintf("Too many transparent inputs %zu > limit %zu", n, limit));
+            }
+        }
+
         // update the transaction with these inputs
         CMutableTransaction rawTx(tx_);
         for (SendManyInputUTXO & t : t_inputs_) {
@@ -304,6 +340,12 @@ bool AsyncRPCOperation_sendmany::main_impl() {
     LogPrint("zrpcunsafe", "%s: private output: %s\n", getId(), FormatMoney(z_outputs_total));
     LogPrint("zrpc", "%s: fee: %s\n", getId(), FormatMoney(minersFee));
 
+    // Grab the current consensus branch ID
+    {
+        LOCK(cs_main);
+        consensusBranchId_ = CurrentEpochBranchId(chainActive.Height() + 1, Params().GetConsensus());
+    }
+
     /**
      * SCENARIO #1
      *
@@ -339,16 +381,20 @@ bool AsyncRPCOperation_sendmany::main_impl() {
 
     // Prepare raw transaction to handle JoinSplits
     CMutableTransaction mtx(tx_);
-    mtx.nVersion = 2;
     crypto_sign_keypair(joinSplitPubKey_.begin(), joinSplitPrivKey_);
     mtx.joinSplitPubKey = joinSplitPubKey_;
     mtx.nLockTime = (uint32_t)time(NULL) - 60; // jl777
     tx_ = CTransaction(mtx);
 
     // Copy zinputs and zoutputs to more flexible containers
-    std::deque<SendManyInputJSOP> zInputsDeque;
+    std::deque<SendManyInputJSOP> zInputsDeque; // zInputsDeque stores minimum numbers of notes for target amount
+    CAmount tmp = 0;
     for (auto o : z_inputs_) {
         zInputsDeque.push_back(o);
+        tmp += std::get<2>(o);
+        if (tmp >= targetAmount) {
+            break;
+        }
     }
     std::deque<SendManyRecipient> zOutputsDeque;
     for (auto o : z_outputs_) {
@@ -446,283 +492,220 @@ bool AsyncRPCOperation_sendmany::main_impl() {
      * zaddr -> taddrs
      *       -> zaddrs
      *
-     * Processing order:
-     * Part 1: taddrs and miners fee
-     * Part 2: zaddrs
-     */
-
-    /**
-     * SCENARIO #3
-     * Part 1: Add to the transparent value pool.
+     * Send to zaddrs by chaining JoinSplits together and immediately consuming any change
+     * Send to taddrs by creating dummy z outputs and accumulating value in a change note
+     * which is used to set vpub_new in the last chained joinsplit.
      */
     UniValue obj(UniValue::VOBJ);
     CAmount jsChange = 0;   // this is updated after each joinsplit
     int changeOutputIndex = -1; // this is updated after each joinsplit if jsChange > 0
-    bool minersFeeProcessed = false;
-
+    bool vpubNewProcessed = false;  // updated when vpub_new for miner fee and taddr outputs is set in last joinsplit
+    CAmount vpubNewTarget = minersFee;
     if (t_outputs_total > 0) {
         add_taddr_outputs_to_tx();
-        CAmount taddrTargetAmount = t_outputs_total + minersFee;
-        minersFeeProcessed = true;
-        while (zInputsDeque.size() > 0 && taddrTargetAmount > 0) {
-            AsyncJoinSplitInfo info;
-            info.vpub_old = 0;
-            info.vpub_new = 0;
-            std::vector<JSOutPoint> outPoints;
-            int n = 0;
-            while (n++ < ZC_NUM_JS_INPUTS && taddrTargetAmount > 0) {
-                SendManyInputJSOP o = zInputsDeque.front();
-                JSOutPoint outPoint = std::get<0>(o);
-                Note note = std::get<1>(o);
-                CAmount noteFunds = std::get<2>(o);
-                zInputsDeque.pop_front();
-
-                info.notes.push_back(note);
-                outPoints.push_back(outPoint);
-
-                int wtxHeight = -1;
-                int wtxDepth = -1;
-                {
-                    LOCK2(cs_main, pwalletMain->cs_wallet);
-                    const CWalletTx& wtx = pwalletMain->mapWallet[outPoint.hash];
-                    wtxHeight = mapBlockIndex[wtx.hashBlock]->nHeight;
-                    wtxDepth = wtx.GetDepthInMainChain();
-                }
-                LogPrint("zrpcunsafe", "%s: spending note (txid=%s, vjoinsplit=%d, ciphertext=%d, amount=%s, height=%d, confirmations=%d)\n",
-                        getId(),
-                        outPoint.hash.ToString().substr(0, 10),
-                        outPoint.js,
-                        int(outPoint.n), // uint8_t
-                        FormatMoney(noteFunds),
-                        wtxHeight,
-                        wtxDepth
-                        );
-
-
-                // Put value back into the value pool
-                if (noteFunds >= taddrTargetAmount) {
-                    jsChange = noteFunds - taddrTargetAmount;
-                    info.vpub_new += taddrTargetAmount;
-                } else {
-                    info.vpub_new += noteFunds;
-                }
-
-                taddrTargetAmount -= noteFunds;
-                if (taddrTargetAmount <= 0) {
-                    break;
-                }
-            }
-
-            if (jsChange > 0) {
-                info.vjsout.push_back(JSOutput());
-                info.vjsout.push_back(JSOutput(frompaymentaddress_, jsChange));
-
-                LogPrint("zrpcunsafe", "%s: generating note for change (amount=%s)\n",
-                        getId(),
-                        FormatMoney(jsChange)
-                        );
-            }
-
-            obj = perform_joinsplit(info, outPoints);
-
-            if (jsChange > 0) {
-                changeOutputIndex = find_output(obj, 1);
-            }
-        }
+        vpubNewTarget += t_outputs_total;
     }
 
+    // Keep track of treestate within this transaction
+    boost::unordered_map<uint256, ZCIncrementalMerkleTree, CCoinsKeyHasher> intermediates;
+    std::vector<uint256> previousCommitments;
 
-    /**
-     * SCENARIO #3
-     * Part 2: Send to zaddrs by chaining JoinSplits together and immediately consuming any change
-     */
-    if (z_outputs_total>0) {
+    while (!vpubNewProcessed) {
+        AsyncJoinSplitInfo info;
+        info.vpub_old = 0;
+        info.vpub_new = 0;
 
-        // Keep track of treestate within this transaction
-        boost::unordered_map<uint256, ZCIncrementalMerkleTree, CCoinsKeyHasher> intermediates;
-        std::vector<uint256> previousCommitments;
+        CAmount jsInputValue = 0;
+        uint256 jsAnchor;
+        std::vector<boost::optional<ZCIncrementalWitness>> witnesses;
 
-        while (zOutputsDeque.size() > 0) {
-            AsyncJoinSplitInfo info;
-            info.vpub_old = 0;
-            info.vpub_new = 0;
+        JSDescription prevJoinSplit;
 
-            CAmount jsInputValue = 0;
-            uint256 jsAnchor;
-            std::vector<boost::optional<ZCIncrementalWitness>> witnesses;
+        // Keep track of previous JoinSplit and its commitments
+        if (tx_.vjoinsplit.size() > 0) {
+            prevJoinSplit = tx_.vjoinsplit.back();
+        }
 
-            JSDescription prevJoinSplit;
+        // If there is no change, the chain has terminated so we can reset the tracked treestate.
+        if (jsChange==0 && tx_.vjoinsplit.size() > 0) {
+            intermediates.clear();
+            previousCommitments.clear();
+        }
 
-            // Keep track of previous JoinSplit and its commitments
-            if (tx_.vjoinsplit.size() > 0) {
-                prevJoinSplit = tx_.vjoinsplit.back();
+        //
+        // Consume change as the first input of the JoinSplit.
+        //
+        if (jsChange > 0) {
+            LOCK2(cs_main, pwalletMain->cs_wallet);
+
+            // Update tree state with previous joinsplit
+            ZCIncrementalMerkleTree tree;
+            auto it = intermediates.find(prevJoinSplit.anchor);
+            if (it != intermediates.end()) {
+                tree = it->second;
+            } else if (!pcoinsTip->GetAnchorAt(prevJoinSplit.anchor, tree)) {
+                throw JSONRPCError(RPC_WALLET_ERROR, "Could not find previous JoinSplit anchor");
             }
 
-            // If there is no change, the chain has terminated so we can reset the tracked treestate.
-            if (jsChange==0 && tx_.vjoinsplit.size() > 0) {
-                intermediates.clear();
-                previousCommitments.clear();
+            assert(changeOutputIndex != -1);
+            boost::optional<ZCIncrementalWitness> changeWitness;
+            int n = 0;
+            for (const uint256& commitment : prevJoinSplit.commitments) {
+                tree.append(commitment);
+                previousCommitments.push_back(commitment);
+                if (!changeWitness && changeOutputIndex == n++) {
+                    changeWitness = tree.witness();
+                } else if (changeWitness) {
+                    changeWitness.get().append(commitment);
+                }
+            }
+            if (changeWitness) {
+                    witnesses.push_back(changeWitness);
+            }
+            jsAnchor = tree.root();
+            intermediates.insert(std::make_pair(tree.root(), tree));    // chained js are interstitial (found in between block boundaries)
+
+            // Decrypt the change note's ciphertext to retrieve some data we need
+            ZCNoteDecryption decryptor(spendingkey_.receiving_key());
+            auto hSig = prevJoinSplit.h_sig(*pzcashParams, tx_.joinSplitPubKey);
+            try {
+                NotePlaintext plaintext = NotePlaintext::decrypt(
+                        decryptor,
+                        prevJoinSplit.ciphertexts[changeOutputIndex],
+                        prevJoinSplit.ephemeralKey,
+                        hSig,
+                        (unsigned char) changeOutputIndex);
+
+                Note note = plaintext.note(frompaymentaddress_);
+                info.notes.push_back(note);
+
+                jsInputValue += plaintext.value;
+
+                LogPrint("zrpcunsafe", "%s: spending change (amount=%s)\n",
+                    getId(),
+                    FormatMoney(plaintext.value)
+                    );
+
+            } catch (const std::exception& e) {
+                throw JSONRPCError(RPC_WALLET_ERROR, strprintf("Error decrypting output note of previous JoinSplit: %s", e.what()));
+            }
+        }
+
+
+        //
+        // Consume spendable non-change notes
+        //
+        std::vector<Note> vInputNotes;
+        std::vector<JSOutPoint> vOutPoints;
+        std::vector<boost::optional<ZCIncrementalWitness>> vInputWitnesses;
+        uint256 inputAnchor;
+        int numInputsNeeded = (jsChange>0) ? 1 : 0;
+        while (numInputsNeeded++ < ZC_NUM_JS_INPUTS && zInputsDeque.size() > 0) {
+            SendManyInputJSOP t = zInputsDeque.front();
+            JSOutPoint jso = std::get<0>(t);
+            Note note = std::get<1>(t);
+            CAmount noteFunds = std::get<2>(t);
+            zInputsDeque.pop_front();
+
+            WitnessAnchorData wad = jsopWitnessAnchorMap[ jso.ToString() ];
+            vInputWitnesses.push_back(wad.witness);
+            if (inputAnchor.IsNull()) {
+                inputAnchor = wad.anchor;
+            } else if (inputAnchor != wad.anchor) {
+                throw JSONRPCError(RPC_WALLET_ERROR, "Selected input notes do not share the same anchor");
             }
 
-            //
-            // Consume change as the first input of the JoinSplit.
-            //
-            if (jsChange > 0) {
+            vOutPoints.push_back(jso);
+            vInputNotes.push_back(note);
+            
+            jsInputValue += noteFunds;
+            
+            int wtxHeight = -1;
+            int wtxDepth = -1;
+            {
                 LOCK2(cs_main, pwalletMain->cs_wallet);
-
-                // Update tree state with previous joinsplit
-                ZCIncrementalMerkleTree tree;
-                auto it = intermediates.find(prevJoinSplit.anchor);
-                if (it != intermediates.end()) {
-                    tree = it->second;
-                } else if (!pcoinsTip->GetAnchorAt(prevJoinSplit.anchor, tree)) {
-                    throw JSONRPCError(RPC_WALLET_ERROR, "Could not find previous JoinSplit anchor");
+                const CWalletTx& wtx = pwalletMain->mapWallet[jso.hash];
+                // Zero-confirmation notes belong to transactions which have not yet been mined
+                if (mapBlockIndex.find(wtx.hashBlock) == mapBlockIndex.end()) {
+                    throw JSONRPCError(RPC_WALLET_ERROR, strprintf("mapBlockIndex does not contain block hash %s", wtx.hashBlock.ToString()));
                 }
+                wtxHeight = mapBlockIndex[wtx.hashBlock]->nHeight;
+                wtxDepth = wtx.GetDepthInMainChain();
+            }
+            LogPrint("zrpcunsafe", "%s: spending note (txid=%s, vjoinsplit=%d, ciphertext=%d, amount=%s, height=%d, confirmations=%d)\n",
+                    getId(),
+                    jso.hash.ToString().substr(0, 10),
+                    jso.js,
+                    int(jso.n), // uint8_t
+                    FormatMoney(noteFunds),
+                    wtxHeight,
+                    wtxDepth
+                    );
+        }
+                    
+        // Add history of previous commitments to witness
+        if (vInputNotes.size() > 0) {
 
-                assert(changeOutputIndex != -1);
-                boost::optional<ZCIncrementalWitness> changeWitness;
-                int n = 0;
-                for (const uint256& commitment : prevJoinSplit.commitments) {
-                    tree.append(commitment);
-                    previousCommitments.push_back(commitment);
-                    if (!changeWitness && changeOutputIndex == n++) {
-                        changeWitness = tree.witness();
-                    } else if (changeWitness) {
-                        changeWitness.get().append(commitment);
+            if (vInputWitnesses.size()==0) {
+                throw JSONRPCError(RPC_WALLET_ERROR, "Could not find witness for note commitment");
+            }
+            
+            for (auto & optionalWitness : vInputWitnesses) {
+                if (!optionalWitness) {
+                    throw JSONRPCError(RPC_WALLET_ERROR, "Witness for note commitment is null");
+                }
+                ZCIncrementalWitness w = *optionalWitness; // could use .get();
+                if (jsChange > 0) {
+                    for (const uint256& commitment : previousCommitments) {
+                        w.append(commitment);
+                    }
+                    if (jsAnchor != w.root()) {
+                        throw JSONRPCError(RPC_WALLET_ERROR, "Witness for spendable note does not have same anchor as change input");
                     }
                 }
-                if (changeWitness) {
-                        witnesses.push_back(changeWitness);
-                }
-                jsAnchor = tree.root();
-                intermediates.insert(std::make_pair(tree.root(), tree));    // chained js are interstitial (found in between block boundaries)
-
-                // Decrypt the change note's ciphertext to retrieve some data we need
-                ZCNoteDecryption decryptor(spendingkey_.viewing_key());
-                auto hSig = prevJoinSplit.h_sig(*pzcashParams, tx_.joinSplitPubKey);
-                try {
-                    NotePlaintext plaintext = NotePlaintext::decrypt(
-                            decryptor,
-                            prevJoinSplit.ciphertexts[changeOutputIndex],
-                            prevJoinSplit.ephemeralKey,
-                            hSig,
-                            (unsigned char) changeOutputIndex);
-
-                    Note note = plaintext.note(frompaymentaddress_);
-                    info.notes.push_back(note);
-
-                    jsInputValue += plaintext.value;
-
-                    LogPrint("zrpcunsafe", "%s: spending change (amount=%s)\n",
-                        getId(),
-                        FormatMoney(plaintext.value)
-                        );
-
-                } catch (const std::exception& e) {
-                    throw JSONRPCError(RPC_WALLET_ERROR, strprintf("Error decrypting output note of previous JoinSplit: %s", e.what()));
-                }
+                witnesses.push_back(w);
             }
 
-
-            //
-            // Consume spendable non-change notes
-            //
-            std::vector<Note> vInputNotes;
-            std::vector<JSOutPoint> vOutPoints;
-            std::vector<boost::optional<ZCIncrementalWitness>> vInputWitnesses;
-            uint256 inputAnchor;
-            int numInputsNeeded = (jsChange>0) ? 1 : 0;
-            while (numInputsNeeded++ < ZC_NUM_JS_INPUTS && zInputsDeque.size() > 0) {
-                SendManyInputJSOP t = zInputsDeque.front();
-                JSOutPoint jso = std::get<0>(t);
-                Note note = std::get<1>(t);
-                CAmount noteFunds = std::get<2>(t);
-                zInputsDeque.pop_front();
-
-                WitnessAnchorData wad = jsopWitnessAnchorMap[ jso.ToString() ];
-                vInputWitnesses.push_back(wad.witness);
-                if (inputAnchor.IsNull()) {
-                    inputAnchor = wad.anchor;
-                } else if (inputAnchor != wad.anchor) {
-                    throw JSONRPCError(RPC_WALLET_ERROR, "Selected input notes do not share the same anchor");
-                }
-
-                vOutPoints.push_back(jso);
-                vInputNotes.push_back(note);
-
-                jsInputValue += noteFunds;
-
-                int wtxHeight = -1;
-                int wtxDepth = -1;
-                {
-                    LOCK2(cs_main, pwalletMain->cs_wallet);
-                    const CWalletTx& wtx = pwalletMain->mapWallet[jso.hash];
-                    wtxHeight = mapBlockIndex[wtx.hashBlock]->nHeight;
-                    wtxDepth = wtx.GetDepthInMainChain();
-                }
-                LogPrint("zrpcunsafe", "%s: spending note (txid=%s, vjoinsplit=%d, ciphertext=%d, amount=%s, height=%d, confirmations=%d)\n",
-                        getId(),
-                        jso.hash.ToString().substr(0, 10),
-                        jso.js,
-                        int(jso.n), // uint8_t
-                        FormatMoney(noteFunds),
-                        wtxHeight,
-                        wtxDepth
-                        );
+            // The jsAnchor is null if this JoinSplit is at the start of a new chain
+            if (jsAnchor.IsNull()) {
+                jsAnchor = inputAnchor;
             }
 
-            // Add history of previous commitments to witness
-            if (vInputNotes.size() > 0) {
+            // Add spendable notes as inputs
+            std::copy(vInputNotes.begin(), vInputNotes.end(), std::back_inserter(info.notes));
+        }
 
-                if (vInputWitnesses.size()==0) {
-                    throw JSONRPCError(RPC_WALLET_ERROR, "Could not find witness for note commitment");
-                }
-
-                for (auto & optionalWitness : vInputWitnesses) {
-                    if (!optionalWitness) {
-                        throw JSONRPCError(RPC_WALLET_ERROR, "Witness for note commitment is null");
-                    }
-                    ZCIncrementalWitness w = *optionalWitness; // could use .get();
-                    if (jsChange > 0) {
-                        for (const uint256& commitment : previousCommitments) {
-                            w.append(commitment);
-                        }
-                        if (jsAnchor != w.root()) {
-                            throw JSONRPCError(RPC_WALLET_ERROR, "Witness for spendable note does not have same anchor as change input");
-                        }
-                    }
-                    witnesses.push_back(w);
-                }
-
-                // The jsAnchor is null if this JoinSplit is at the start of a new chain
-                if (jsAnchor.IsNull()) {
-                    jsAnchor = inputAnchor;
-                }
-
-                // Add spendable notes as inputs
-                std::copy(vInputNotes.begin(), vInputNotes.end(), std::back_inserter(info.notes));
-            }
-
-
-            //
-            // Find recipient to transfer funds to
-            //
+        // Find recipient to transfer funds to
+        std::string address, hexMemo;
+        CAmount value = 0;
+        if (zOutputsDeque.size() > 0) {
             SendManyRecipient smr = zOutputsDeque.front();
-            std::string address = std::get<0>(smr);
-            CAmount value = std::get<1>(smr);
-            std::string hexMemo = std::get<2>(smr);
+            address = std::get<0>(smr);
+            value = std::get<1>(smr);
+            hexMemo = std::get<2>(smr);
             zOutputsDeque.pop_front();
+        }
 
-            // Will we have any change?  Has the miners fee been processed yet?
-            jsChange = 0;
-            CAmount outAmount = value;
-            if (!minersFeeProcessed) {
-                if (jsInputValue < minersFee) {
-                    throw JSONRPCError(RPC_WALLET_ERROR, "Not enough funds to pay miners fee");
-                }
-                outAmount += minersFee;
+        // Reset change
+        jsChange = 0;
+        CAmount outAmount = value;
+
+        // Set vpub_new in the last joinsplit (when there are no more notes to spend or zaddr outputs to satisfy)
+        if (zOutputsDeque.size() == 0 && zInputsDeque.size() == 0) {
+            assert(!vpubNewProcessed);
+            if (jsInputValue < vpubNewTarget) {
+                throw JSONRPCError(RPC_WALLET_ERROR,
+                    strprintf("Insufficient funds for vpub_new %s (miners fee %s, taddr outputs %s)",
+                    FormatMoney(vpubNewTarget), FormatMoney(minersFee), FormatMoney(t_outputs_total)));
             }
-
+            outAmount += vpubNewTarget;
+            info.vpub_new += vpubNewTarget; // funds flowing back to public pool
+            vpubNewProcessed = true;
+            jsChange = jsInputValue - outAmount;
+            assert(jsChange >= 0);
+        }
+        else {
+            // This is not the last joinsplit, so compute change and any amount still due to the recipient
             if (jsInputValue > outAmount) {
                 jsChange = jsInputValue - outAmount;
             } else if (outAmount > jsInputValue) {
@@ -733,42 +716,44 @@ bool AsyncRPCOperation_sendmany::main_impl() {
 
                 // reduce the amount being sent right now to the value of all inputs
                 value = jsInputValue;
-                if (!minersFeeProcessed) {
-                    value -= minersFee;
-                }
             }
+        }
 
-            if (!minersFeeProcessed) {
-                minersFeeProcessed = true;
-                info.vpub_new += minersFee; // funds flowing back to public pool
-            }
-
-            // create output for recipient
+        // create output for recipient
+        if (address.empty()) {
+            assert(value==0);
+            info.vjsout.push_back(JSOutput());  // dummy output while we accumulate funds into a change note for vpub_new
+        } else {
             PaymentAddress pa = CZCPaymentAddress(address).Get();
             JSOutput jso = JSOutput(pa, value);
             if (hexMemo.size() > 0) {
                 jso.memo = get_memo_from_hex_string(hexMemo);
             }
             info.vjsout.push_back(jso);
+        }
 
-            // create output for any change
-            if (jsChange>0) {
-                info.vjsout.push_back(JSOutput(frompaymentaddress_, jsChange));
+        // create output for any change
+        if (jsChange>0) {
+            info.vjsout.push_back(JSOutput(frompaymentaddress_, jsChange));
 
-                LogPrint("zrpcunsafe", "%s: generating note for change (amount=%s)\n",
-                        getId(),
-                        FormatMoney(jsChange)
-                        );
-            }
+            LogPrint("zrpcunsafe", "%s: generating note for change (amount=%s)\n",
+                    getId(),
+                    FormatMoney(jsChange)
+                    );
+        }
 
-            obj = perform_joinsplit(info, witnesses, jsAnchor);
+        obj = perform_joinsplit(info, witnesses, jsAnchor);
 
-            if (jsChange > 0) {
-                changeOutputIndex = find_output(obj, 1);
-            }
+        if (jsChange > 0) {
+            changeOutputIndex = find_output(obj, 1);
         }
     }
 
+    // Sanity check in case changes to code block above exits loop by invoking 'break'
+    assert(zInputsDeque.size() == 0);
+    assert(zOutputsDeque.size() == 0);
+    assert(vpubNewProcessed);
+
     sign_send_raw_transaction(obj);
     return true;
 }
@@ -850,6 +835,10 @@ bool AsyncRPCOperation_sendmany::find_utxos(bool fAcceptCoinbase=false) {
     pwalletMain->AvailableCoins(vecOutputs, false, NULL, true, fAcceptCoinbase);
 
     BOOST_FOREACH(const COutput& out, vecOutputs) {
+        if (!out.fSpendable) {
+            continue;
+        }
+
         if (out.nDepth < mindepth_) {
             continue;
         }
@@ -921,7 +910,7 @@ UniValue AsyncRPCOperation_sendmany::perform_joinsplit(AsyncJoinSplitInfo & info
     std::vector<boost::optional < ZCIncrementalWitness>> witnesses;
     uint256 anchor;
     {
-        LOCK2(cs_main, pwalletMain->cs_wallet);
+        LOCK(cs_main);
         anchor = pcoinsTip->GetBestAnchor();    // As there are no inputs, ask the wallet for the best anchor
     }
     return perform_joinsplit(info, witnesses, anchor);
@@ -986,13 +975,15 @@ UniValue AsyncRPCOperation_sendmany::perform_joinsplit(
             {info.vjsin[0], info.vjsin[1]};
     boost::array<libzcash::JSOutput, ZC_NUM_JS_OUTPUTS> outputs
             {info.vjsout[0], info.vjsout[1]};
-    #ifdef __LP64__
+#ifdef __LP64__
     boost::array<uint64_t, ZC_NUM_JS_INPUTS> inputMap;
     boost::array<uint64_t, ZC_NUM_JS_OUTPUTS> outputMap;
-    #else
+#else
     boost::array<size_t, ZC_NUM_JS_INPUTS> inputMap;
     boost::array<size_t, ZC_NUM_JS_OUTPUTS> outputMap;
-    #endif
+#endif
+    uint256 esk; // payment disclosure - secret
+
     JSDescription jsdesc = JSDescription::Randomized(
             *pzcashParams,
             joinSplitPubKey_,
@@ -1003,8 +994,8 @@ UniValue AsyncRPCOperation_sendmany::perform_joinsplit(
             outputMap,
             info.vpub_old,
             info.vpub_new,
-            !this->testmode);
-
+            !this->testmode,
+            &esk); // parameter expects pointer to esk, so pass in address
     {
         auto verifier = libzcash::ProofVerifier::Strict();
         if (!(jsdesc.Verify(*pzcashParams, verifier, joinSplitPubKey_))) {
@@ -1017,7 +1008,7 @@ UniValue AsyncRPCOperation_sendmany::perform_joinsplit(
     // Empty output script.
     CScript scriptCode;
     CTransaction signTx(mtx);
-    uint256 dataToBeSigned = SignatureHash(scriptCode, signTx, NOT_AN_INPUT, SIGHASH_ALL);
+    uint256 dataToBeSigned = SignatureHash(scriptCode, signTx, NOT_AN_INPUT, SIGHASH_ALL, 0, consensusBranchId_);
 
     // Add the signature
     if (!(crypto_sign_detached(&mtx.joinSplitSig[0], NULL,
@@ -1073,6 +1064,28 @@ UniValue AsyncRPCOperation_sendmany::perform_joinsplit(
         arrOutputMap.push_back(outputMap[i]);
     }
 
+
+    // !!! Payment disclosure START
+    unsigned char buffer[32] = {0};
+    memcpy(&buffer[0], &joinSplitPrivKey_[0], 32); // private key in first half of 64 byte buffer
+    std::vector<unsigned char> vch(&buffer[0], &buffer[0] + 32);
+    uint256 joinSplitPrivKey = uint256(vch);
+    size_t js_index = tx_.vjoinsplit.size() - 1;
+    uint256 placeholder;
+    for (int i = 0; i < ZC_NUM_JS_OUTPUTS; i++) {
+        uint8_t mapped_index = outputMap[i];
+        // placeholder for txid will be filled in later when tx has been finalized and signed.
+        PaymentDisclosureKey pdKey = {placeholder, js_index, mapped_index};
+        JSOutput output = outputs[mapped_index];
+        libzcash::PaymentAddress zaddr = output.addr;  // randomized output
+        PaymentDisclosureInfo pdInfo = {PAYMENT_DISCLOSURE_VERSION_EXPERIMENTAL, esk, joinSplitPrivKey, zaddr};
+        paymentDisclosureData_.push_back(PaymentDisclosureKeyInfo(pdKey, pdInfo));
+
+        CZCPaymentAddress address(zaddr);
+        LogPrint("paymentdisclosure", "%s: Payment Disclosure: js=%d, n=%d, zaddr=%s\n", getId(), js_index, int(mapped_index), address.ToString());
+    }
+    // !!! Payment disclosure END
+
     UniValue obj(UniValue::VOBJ);
     obj.push_back(Pair("encryptednote1", encryptedNote1));
     obj.push_back(Pair("encryptednote2", encryptedNote2));

src/wallet/asyncrpcoperation_sendmany.h

@@ -12,6 +12,7 @@
 #include "zcash/JoinSplit.hpp"
 #include "zcash/Address.hpp"
 #include "wallet.h"
+#include "paymentdisclosure.h"
 
 #include <unordered_map>
 #include <tuple>
@@ -50,7 +51,7 @@ struct WitnessAnchorData {
 
 class AsyncRPCOperation_sendmany : public AsyncRPCOperation {
 public:
-    AsyncRPCOperation_sendmany(std::string fromAddress, std::vector<SendManyRecipient> tOutputs, std::vector<SendManyRecipient> zOutputs, int minDepth, CAmount fee = ASYNC_RPC_OPERATION_DEFAULT_MINERS_FEE, UniValue contextInfo = NullUniValue);
+    AsyncRPCOperation_sendmany(CMutableTransaction contextualTx, std::string fromAddress, std::vector<SendManyRecipient> tOutputs, std::vector<SendManyRecipient> zOutputs, int minDepth, CAmount fee = ASYNC_RPC_OPERATION_DEFAULT_MINERS_FEE, UniValue contextInfo = NullUniValue);
     virtual ~AsyncRPCOperation_sendmany();
     
     // We don't want to be copied or moved around
@@ -65,11 +66,14 @@ public:
 
     bool testmode = false;  // Set to true to disable sending txs and generating proofs
 
+    bool paymentDisclosureMode = false; // Set to true to save esk for encrypted notes in payment disclosure database.
+
 private:
     friend class TEST_FRIEND_AsyncRPCOperation_sendmany;    // class for unit testing
 
     UniValue contextinfo_;     // optional data to include in return value from getStatus()
 
+    uint32_t consensusBranchId_;
     CAmount fee_;
     int mindepth_;
     std::string fromaddress_;
@@ -113,6 +117,8 @@ private:
 
     void sign_send_raw_transaction(UniValue obj);     // throws exception if there was an error
 
+    // payment disclosure!
+    std::vector<PaymentDisclosureKeyInfo> paymentDisclosureData_;
 };
 
 

src/wallet/asyncrpcoperation_shieldcoinbase.cpp

@@ -0,0 +1,497 @@
+// Copyright (c) 2017 The Zcash developers
+// Distributed under the MIT software license, see the accompanying
+// file COPYING or http://www.opensource.org/licenses/mit-license.php.
+
+#include "asyncrpcqueue.h"
+#include "amount.h"
+#include "consensus/upgrades.h"
+#include "core_io.h"
+#include "init.h"
+#include "main.h"
+#include "net.h"
+#include "netbase.h"
+#include "rpcserver.h"
+#include "timedata.h"
+#include "util.h"
+#include "utilmoneystr.h"
+#include "wallet.h"
+#include "walletdb.h"
+#include "script/interpreter.h"
+#include "utiltime.h"
+#include "rpcprotocol.h"
+#include "zcash/IncrementalMerkleTree.hpp"
+#include "sodium.h"
+#include "miner.h"
+
+#include <iostream>
+#include <chrono>
+#include <thread>
+#include <string>
+
+#include "asyncrpcoperation_shieldcoinbase.h"
+
+#include "paymentdisclosure.h"
+#include "paymentdisclosuredb.h"
+
+using namespace libzcash;
+
+static int find_output(UniValue obj, int n) {
+    UniValue outputMapValue = find_value(obj, "outputmap");
+    if (!outputMapValue.isArray()) {
+        throw JSONRPCError(RPC_WALLET_ERROR, "Missing outputmap for JoinSplit operation");
+    }
+
+    UniValue outputMap = outputMapValue.get_array();
+    assert(outputMap.size() == ZC_NUM_JS_OUTPUTS);
+    for (size_t i = 0; i < outputMap.size(); i++) {
+        if (outputMap[i].get_int() == n) {
+            return i;
+        }
+    }
+
+    throw std::logic_error("n is not present in outputmap");
+}
+
+AsyncRPCOperation_shieldcoinbase::AsyncRPCOperation_shieldcoinbase(
+        CMutableTransaction contextualTx,
+        std::vector<ShieldCoinbaseUTXO> inputs,
+        std::string toAddress,
+        CAmount fee,
+        UniValue contextInfo) :
+        tx_(contextualTx), inputs_(inputs), fee_(fee), contextinfo_(contextInfo)
+{
+    assert(contextualTx.nVersion >= 2);  // transaction format version must support vjoinsplit
+
+    if (fee < 0 || fee > MAX_MONEY) {
+        throw JSONRPCError(RPC_INVALID_PARAMETER, "Fee is out of range");
+    }
+
+    if (inputs.size() == 0) {
+        throw JSONRPCError(RPC_WALLET_INSUFFICIENT_FUNDS, "Empty inputs");
+    }
+
+    //  Check the destination address is valid for this network i.e. not testnet being used on mainnet
+    CZCPaymentAddress address(toAddress);
+    try {
+        tozaddr_ = address.Get();
+    } catch (const std::runtime_error& e) {
+        throw JSONRPCError(RPC_INVALID_ADDRESS_OR_KEY, string("runtime error: ") + e.what());
+    }
+
+    // Log the context info
+    if (LogAcceptCategory("zrpcunsafe")) {
+        LogPrint("zrpcunsafe", "%s: z_shieldcoinbase initialized (context=%s)\n", getId(), contextInfo.write());
+    } else {
+        LogPrint("zrpc", "%s: z_shieldcoinbase initialized\n", getId());
+    }
+
+    // Lock UTXOs
+    lock_utxos();
+
+    // Enable payment disclosure if requested
+    paymentDisclosureMode = fExperimentalMode && GetBoolArg("-paymentdisclosure", false);
+}
+
+AsyncRPCOperation_shieldcoinbase::~AsyncRPCOperation_shieldcoinbase() {
+}
+
+void AsyncRPCOperation_shieldcoinbase::main() {
+    if (isCancelled()) {
+        unlock_utxos(); // clean up
+        return;
+    }
+
+    set_state(OperationStatus::EXECUTING);
+    start_execution_clock();
+
+    bool success = false;
+
+#ifdef ENABLE_MINING
+  #ifdef ENABLE_WALLET
+    GenerateBitcoins(false, NULL, 0);
+  #else
+    GenerateBitcoins(false, 0);
+  #endif
+#endif
+
+    try {
+        success = main_impl();
+    } catch (const UniValue& objError) {
+        int code = find_value(objError, "code").get_int();
+        std::string message = find_value(objError, "message").get_str();
+        set_error_code(code);
+        set_error_message(message);
+    } catch (const runtime_error& e) {
+        set_error_code(-1);
+        set_error_message("runtime error: " + string(e.what()));
+    } catch (const logic_error& e) {
+        set_error_code(-1);
+        set_error_message("logic error: " + string(e.what()));
+    } catch (const exception& e) {
+        set_error_code(-1);
+        set_error_message("general exception: " + string(e.what()));
+    } catch (...) {
+        set_error_code(-2);
+        set_error_message("unknown error");
+    }
+
+#ifdef ENABLE_MINING
+  #ifdef ENABLE_WALLET
+    GenerateBitcoins(GetBoolArg("-gen",false), pwalletMain, GetArg("-genproclimit", 1));
+  #else
+    GenerateBitcoins(GetBoolArg("-gen",false), GetArg("-genproclimit", 1));
+  #endif
+#endif
+
+    stop_execution_clock();
+
+    if (success) {
+        set_state(OperationStatus::SUCCESS);
+    } else {
+        set_state(OperationStatus::FAILED);
+    }
+
+    std::string s = strprintf("%s: z_shieldcoinbase finished (status=%s", getId(), getStateAsString());
+    if (success) {
+        s += strprintf(", txid=%s)\n", tx_.GetHash().ToString());
+    } else {
+        s += strprintf(", error=%s)\n", getErrorMessage());
+    }
+    LogPrintf("%s",s);
+
+    unlock_utxos(); // clean up
+
+    // !!! Payment disclosure START
+    if (success && paymentDisclosureMode && paymentDisclosureData_.size()>0) {
+        uint256 txidhash = tx_.GetHash();
+        std::shared_ptr<PaymentDisclosureDB> db = PaymentDisclosureDB::sharedInstance();
+        for (PaymentDisclosureKeyInfo p : paymentDisclosureData_) {
+            p.first.hash = txidhash;
+            if (!db->Put(p.first, p.second)) {
+                LogPrint("paymentdisclosure", "%s: Payment Disclosure: Error writing entry to database for key %s\n", getId(), p.first.ToString());
+            } else {
+                LogPrint("paymentdisclosure", "%s: Payment Disclosure: Successfully added entry to database for key %s\n", getId(), p.first.ToString());
+            }
+        }
+    }
+    // !!! Payment disclosure END
+}
+
+
+bool AsyncRPCOperation_shieldcoinbase::main_impl() {
+
+    CAmount minersFee = fee_;
+
+    size_t numInputs = inputs_.size();
+
+    // Check mempooltxinputlimit to avoid creating a transaction which the local mempool rejects
+    size_t limit = (size_t)GetArg("-mempooltxinputlimit", 0);
+    if (limit>0 && numInputs > limit) {
+        throw JSONRPCError(RPC_WALLET_ERROR,
+            strprintf("Number of inputs %d is greater than mempooltxinputlimit of %d",
+            numInputs, limit));
+    }
+
+    CAmount targetAmount = 0;
+    for (ShieldCoinbaseUTXO & utxo : inputs_) {
+        targetAmount += utxo.amount;
+    }
+
+    if (targetAmount <= minersFee) {
+        throw JSONRPCError(RPC_WALLET_INSUFFICIENT_FUNDS,
+            strprintf("Insufficient coinbase funds, have %s and miners fee is %s",
+            FormatMoney(targetAmount), FormatMoney(minersFee)));
+    }
+
+    CAmount sendAmount = targetAmount - minersFee;
+    LogPrint("zrpc", "%s: spending %s to shield %s with fee %s\n",
+            getId(), FormatMoney(targetAmount), FormatMoney(sendAmount), FormatMoney(minersFee));
+
+    // update the transaction with these inputs
+    CMutableTransaction rawTx(tx_);
+    for (ShieldCoinbaseUTXO & t : inputs_) {
+        CTxIn in(COutPoint(t.txid, t.vout));
+        rawTx.vin.push_back(in);
+    }
+    tx_ = CTransaction(rawTx);
+
+    // Prepare raw transaction to handle JoinSplits
+    CMutableTransaction mtx(tx_);
+    crypto_sign_keypair(joinSplitPubKey_.begin(), joinSplitPrivKey_);
+    mtx.joinSplitPubKey = joinSplitPubKey_;
+    tx_ = CTransaction(mtx);
+
+    // Create joinsplit
+    UniValue obj(UniValue::VOBJ);
+    ShieldCoinbaseJSInfo info;
+    info.vpub_old = sendAmount;
+    info.vpub_new = 0;
+    JSOutput jso = JSOutput(tozaddr_, sendAmount);
+    info.vjsout.push_back(jso);
+    obj = perform_joinsplit(info);
+
+    sign_send_raw_transaction(obj);
+    return true;
+}
+
+
+/**
+ * Sign and send a raw transaction.
+ * Raw transaction as hex string should be in object field "rawtxn"
+ */
+void AsyncRPCOperation_shieldcoinbase::sign_send_raw_transaction(UniValue obj)
+{
+    // Sign the raw transaction
+    UniValue rawtxnValue = find_value(obj, "rawtxn");
+    if (rawtxnValue.isNull()) {
+        throw JSONRPCError(RPC_WALLET_ERROR, "Missing hex data for raw transaction");
+    }
+    std::string rawtxn = rawtxnValue.get_str();
+
+    UniValue params = UniValue(UniValue::VARR);
+    params.push_back(rawtxn);
+    UniValue signResultValue = signrawtransaction(params, false);
+    UniValue signResultObject = signResultValue.get_obj();
+    UniValue completeValue = find_value(signResultObject, "complete");
+    bool complete = completeValue.get_bool();
+    if (!complete) {
+        // TODO: #1366 Maybe get "errors" and print array vErrors into a string
+        throw JSONRPCError(RPC_WALLET_ENCRYPTION_FAILED, "Failed to sign transaction");
+    }
+
+    UniValue hexValue = find_value(signResultObject, "hex");
+    if (hexValue.isNull()) {
+        throw JSONRPCError(RPC_WALLET_ERROR, "Missing hex data for signed transaction");
+    }
+    std::string signedtxn = hexValue.get_str();
+
+    // Send the signed transaction
+    if (!testmode) {
+        params.clear();
+        params.setArray();
+        params.push_back(signedtxn);
+        UniValue sendResultValue = sendrawtransaction(params, false);
+        if (sendResultValue.isNull()) {
+            throw JSONRPCError(RPC_WALLET_ERROR, "Send raw transaction did not return an error or a txid.");
+        }
+
+        std::string txid = sendResultValue.get_str();
+
+        UniValue o(UniValue::VOBJ);
+        o.push_back(Pair("txid", txid));
+        set_result(o);
+    } else {
+        // Test mode does not send the transaction to the network.
+
+        CDataStream stream(ParseHex(signedtxn), SER_NETWORK, PROTOCOL_VERSION);
+        CTransaction tx;
+        stream >> tx;
+
+        UniValue o(UniValue::VOBJ);
+        o.push_back(Pair("test", 1));
+        o.push_back(Pair("txid", tx.GetHash().ToString()));
+        o.push_back(Pair("hex", signedtxn));
+        set_result(o);
+    }
+
+    // Keep the signed transaction so we can hash to the same txid
+    CDataStream stream(ParseHex(signedtxn), SER_NETWORK, PROTOCOL_VERSION);
+    CTransaction tx;
+    stream >> tx;
+    tx_ = tx;
+}
+
+
+UniValue AsyncRPCOperation_shieldcoinbase::perform_joinsplit(ShieldCoinbaseJSInfo & info) {
+    uint32_t consensusBranchId;
+    uint256 anchor;
+    {
+        LOCK(cs_main);
+        consensusBranchId = CurrentEpochBranchId(chainActive.Height() + 1, Params().GetConsensus());
+        anchor = pcoinsTip->GetBestAnchor();
+    }
+
+
+    if (anchor.IsNull()) {
+        throw std::runtime_error("anchor is null");
+    }
+
+    // Make sure there are two inputs and two outputs
+    while (info.vjsin.size() < ZC_NUM_JS_INPUTS) {
+        info.vjsin.push_back(JSInput());
+    }
+
+    while (info.vjsout.size() < ZC_NUM_JS_OUTPUTS) {
+        info.vjsout.push_back(JSOutput());
+    }
+
+    if (info.vjsout.size() != ZC_NUM_JS_INPUTS || info.vjsin.size() != ZC_NUM_JS_OUTPUTS) {
+        throw runtime_error("unsupported joinsplit input/output counts");
+    }
+
+    CMutableTransaction mtx(tx_);
+
+    LogPrint("zrpcunsafe", "%s: creating joinsplit at index %d (vpub_old=%s, vpub_new=%s, in[0]=%s, in[1]=%s, out[0]=%s, out[1]=%s)\n",
+            getId(),
+            tx_.vjoinsplit.size(),
+            FormatMoney(info.vpub_old), FormatMoney(info.vpub_new),
+            FormatMoney(info.vjsin[0].note.value), FormatMoney(info.vjsin[1].note.value),
+            FormatMoney(info.vjsout[0].value), FormatMoney(info.vjsout[1].value)
+            );
+
+    // Generate the proof, this can take over a minute.
+    boost::array<libzcash::JSInput, ZC_NUM_JS_INPUTS> inputs
+            {info.vjsin[0], info.vjsin[1]};
+    boost::array<libzcash::JSOutput, ZC_NUM_JS_OUTPUTS> outputs
+            {info.vjsout[0], info.vjsout[1]};
+    boost::array<size_t, ZC_NUM_JS_INPUTS> inputMap;
+    boost::array<size_t, ZC_NUM_JS_OUTPUTS> outputMap;
+
+    uint256 esk; // payment disclosure - secret
+
+    JSDescription jsdesc = JSDescription::Randomized(
+            *pzcashParams,
+            joinSplitPubKey_,
+            anchor,
+            inputs,
+            outputs,
+            inputMap,
+            outputMap,
+            info.vpub_old,
+            info.vpub_new,
+            !this->testmode,
+            &esk); // parameter expects pointer to esk, so pass in address
+    {
+        auto verifier = libzcash::ProofVerifier::Strict();
+        if (!(jsdesc.Verify(*pzcashParams, verifier, joinSplitPubKey_))) {
+            throw std::runtime_error("error verifying joinsplit");
+        }
+    }
+
+    mtx.vjoinsplit.push_back(jsdesc);
+
+    // Empty output script.
+    CScript scriptCode;
+    CTransaction signTx(mtx);
+    uint256 dataToBeSigned = SignatureHash(scriptCode, signTx, NOT_AN_INPUT, SIGHASH_ALL, 0, consensusBranchId);
+
+    // Add the signature
+    if (!(crypto_sign_detached(&mtx.joinSplitSig[0], NULL,
+            dataToBeSigned.begin(), 32,
+            joinSplitPrivKey_
+            ) == 0))
+    {
+        throw std::runtime_error("crypto_sign_detached failed");
+    }
+
+    // Sanity check
+    if (!(crypto_sign_verify_detached(&mtx.joinSplitSig[0],
+            dataToBeSigned.begin(), 32,
+            mtx.joinSplitPubKey.begin()
+            ) == 0))
+    {
+        throw std::runtime_error("crypto_sign_verify_detached failed");
+    }
+
+    CTransaction rawTx(mtx);
+    tx_ = rawTx;
+
+    CDataStream ss(SER_NETWORK, PROTOCOL_VERSION);
+    ss << rawTx;
+
+    std::string encryptedNote1;
+    std::string encryptedNote2;
+    {
+        CDataStream ss2(SER_NETWORK, PROTOCOL_VERSION);
+        ss2 << ((unsigned char) 0x00);
+        ss2 << jsdesc.ephemeralKey;
+        ss2 << jsdesc.ciphertexts[0];
+        ss2 << jsdesc.h_sig(*pzcashParams, joinSplitPubKey_);
+
+        encryptedNote1 = HexStr(ss2.begin(), ss2.end());
+    }
+    {
+        CDataStream ss2(SER_NETWORK, PROTOCOL_VERSION);
+        ss2 << ((unsigned char) 0x01);
+        ss2 << jsdesc.ephemeralKey;
+        ss2 << jsdesc.ciphertexts[1];
+        ss2 << jsdesc.h_sig(*pzcashParams, joinSplitPubKey_);
+
+        encryptedNote2 = HexStr(ss2.begin(), ss2.end());
+    }
+
+    UniValue arrInputMap(UniValue::VARR);
+    UniValue arrOutputMap(UniValue::VARR);
+    for (size_t i = 0; i < ZC_NUM_JS_INPUTS; i++) {
+        arrInputMap.push_back(inputMap[i]);
+    }
+    for (size_t i = 0; i < ZC_NUM_JS_OUTPUTS; i++) {
+        arrOutputMap.push_back(outputMap[i]);
+    }
+
+    // !!! Payment disclosure START
+    unsigned char buffer[32] = {0};
+    memcpy(&buffer[0], &joinSplitPrivKey_[0], 32); // private key in first half of 64 byte buffer
+    std::vector<unsigned char> vch(&buffer[0], &buffer[0] + 32);
+    uint256 joinSplitPrivKey = uint256(vch);
+    size_t js_index = tx_.vjoinsplit.size() - 1;
+    uint256 placeholder;
+    for (int i = 0; i < ZC_NUM_JS_OUTPUTS; i++) {
+        uint8_t mapped_index = outputMap[i];
+        // placeholder for txid will be filled in later when tx has been finalized and signed.
+        PaymentDisclosureKey pdKey = {placeholder, js_index, mapped_index};
+        JSOutput output = outputs[mapped_index];
+        libzcash::PaymentAddress zaddr = output.addr;  // randomized output
+        PaymentDisclosureInfo pdInfo = {PAYMENT_DISCLOSURE_VERSION_EXPERIMENTAL, esk, joinSplitPrivKey, zaddr};
+        paymentDisclosureData_.push_back(PaymentDisclosureKeyInfo(pdKey, pdInfo));
+
+        CZCPaymentAddress address(zaddr);
+        LogPrint("paymentdisclosure", "%s: Payment Disclosure: js=%d, n=%d, zaddr=%s\n", getId(), js_index, int(mapped_index), address.ToString());
+    }
+    // !!! Payment disclosure END
+
+    UniValue obj(UniValue::VOBJ);
+    obj.push_back(Pair("encryptednote1", encryptedNote1));
+    obj.push_back(Pair("encryptednote2", encryptedNote2));
+    obj.push_back(Pair("rawtxn", HexStr(ss.begin(), ss.end())));
+    obj.push_back(Pair("inputmap", arrInputMap));
+    obj.push_back(Pair("outputmap", arrOutputMap));
+    return obj;
+}
+
+/**
+ * Override getStatus() to append the operation's context object to the default status object.
+ */
+UniValue AsyncRPCOperation_shieldcoinbase::getStatus() const {
+    UniValue v = AsyncRPCOperation::getStatus();
+    if (contextinfo_.isNull()) {
+        return v;
+    }
+
+    UniValue obj = v.get_obj();
+    obj.push_back(Pair("method", "z_shieldcoinbase"));
+    obj.push_back(Pair("params", contextinfo_ ));
+    return obj;
+}
+
+/**
+ * Lock input utxos
+ */
+ void AsyncRPCOperation_shieldcoinbase::lock_utxos() {
+    LOCK2(cs_main, pwalletMain->cs_wallet);
+    for (auto utxo : inputs_) {
+        COutPoint outpt(utxo.txid, utxo.vout);
+        pwalletMain->LockCoin(outpt);
+    }
+}
+
+/**
+ * Unlock input utxos
+ */
+void AsyncRPCOperation_shieldcoinbase::unlock_utxos() {
+    LOCK2(cs_main, pwalletMain->cs_wallet);
+    for (auto utxo : inputs_) {
+        COutPoint outpt(utxo.txid, utxo.vout);
+        pwalletMain->UnlockCoin(outpt);
+    }
+}

src/wallet/asyncrpcoperation_shieldcoinbase.h

@@ -0,0 +1,129 @@
+// Copyright (c) 2017 The Zcash developers
+// Distributed under the MIT software license, see the accompanying
+// file COPYING or http://www.opensource.org/licenses/mit-license.php.
+
+#ifndef ASYNCRPCOPERATION_SHIELDCOINBASE_H
+#define ASYNCRPCOPERATION_SHIELDCOINBASE_H
+
+#include "asyncrpcoperation.h"
+#include "amount.h"
+#include "base58.h"
+#include "primitives/transaction.h"
+#include "zcash/JoinSplit.hpp"
+#include "zcash/Address.hpp"
+#include "wallet.h"
+
+#include <unordered_map>
+#include <tuple>
+
+#include <univalue.h>
+
+#include "paymentdisclosure.h"
+
+// Default transaction fee if caller does not specify one.
+#define SHIELD_COINBASE_DEFAULT_MINERS_FEE   10000
+
+using namespace libzcash;
+
+struct ShieldCoinbaseUTXO {
+    uint256 txid;
+    int vout;
+    CAmount amount;
+};
+
+// Package of info which is passed to perform_joinsplit methods.
+struct ShieldCoinbaseJSInfo
+{
+    std::vector<JSInput> vjsin;
+    std::vector<JSOutput> vjsout;
+    CAmount vpub_old = 0;
+    CAmount vpub_new = 0;
+};
+
+class AsyncRPCOperation_shieldcoinbase : public AsyncRPCOperation {
+public:
+    AsyncRPCOperation_shieldcoinbase(CMutableTransaction contextualTx, std::vector<ShieldCoinbaseUTXO> inputs, std::string toAddress, CAmount fee = SHIELD_COINBASE_DEFAULT_MINERS_FEE, UniValue contextInfo = NullUniValue);
+    virtual ~AsyncRPCOperation_shieldcoinbase();
+
+    // We don't want to be copied or moved around
+    AsyncRPCOperation_shieldcoinbase(AsyncRPCOperation_shieldcoinbase const&) = delete;             // Copy construct
+    AsyncRPCOperation_shieldcoinbase(AsyncRPCOperation_shieldcoinbase&&) = delete;                  // Move construct
+    AsyncRPCOperation_shieldcoinbase& operator=(AsyncRPCOperation_shieldcoinbase const&) = delete;  // Copy assign
+    AsyncRPCOperation_shieldcoinbase& operator=(AsyncRPCOperation_shieldcoinbase &&) = delete;      // Move assign
+
+    virtual void main();
+
+    virtual UniValue getStatus() const;
+
+    bool testmode = false;  // Set to true to disable sending txs and generating proofs
+
+    bool paymentDisclosureMode = false; // Set to true to save esk for encrypted notes in payment disclosure database.
+
+private:
+    friend class TEST_FRIEND_AsyncRPCOperation_shieldcoinbase;    // class for unit testing
+
+    UniValue contextinfo_;     // optional data to include in return value from getStatus()
+
+    CAmount fee_;
+    PaymentAddress tozaddr_;
+
+    uint256 joinSplitPubKey_;
+    unsigned char joinSplitPrivKey_[crypto_sign_SECRETKEYBYTES];
+
+    std::vector<ShieldCoinbaseUTXO> inputs_;
+
+    CTransaction tx_;
+
+    bool main_impl();
+
+    // JoinSplit without any input notes to spend
+    UniValue perform_joinsplit(ShieldCoinbaseJSInfo &);
+
+    void sign_send_raw_transaction(UniValue obj);     // throws exception if there was an error
+
+    void lock_utxos();
+
+    void unlock_utxos();
+
+    // payment disclosure!
+    std::vector<PaymentDisclosureKeyInfo> paymentDisclosureData_;
+};
+
+
+// To test private methods, a friend class can act as a proxy
+class TEST_FRIEND_AsyncRPCOperation_shieldcoinbase {
+public:
+    std::shared_ptr<AsyncRPCOperation_shieldcoinbase> delegate;
+
+    TEST_FRIEND_AsyncRPCOperation_shieldcoinbase(std::shared_ptr<AsyncRPCOperation_shieldcoinbase> ptr) : delegate(ptr) {}
+
+    CTransaction getTx() {
+        return delegate->tx_;
+    }
+
+    void setTx(CTransaction tx) {
+        delegate->tx_ = tx;
+    }
+
+    // Delegated methods
+
+    bool main_impl() {
+        return delegate->main_impl();
+    }
+
+    UniValue perform_joinsplit(ShieldCoinbaseJSInfo &info) {
+        return delegate->perform_joinsplit(info);
+    }
+
+    void sign_send_raw_transaction(UniValue obj) {
+        delegate->sign_send_raw_transaction(obj);
+    }
+
+    void set_state(OperationStatus state) {
+        delegate->state_.store(state);
+    }
+};
+
+
+#endif /* ASYNCRPCOPERATION_SHIELDCOINBASE_H */
+

src/wallet/crypter.cpp

@@ -153,7 +153,7 @@ static bool DecryptSpendingKey(const CKeyingMaterial& vMasterKey,
 
 bool CCryptoKeyStore::SetCrypted()
 {
-    LOCK(cs_KeyStore);
+    LOCK2(cs_KeyStore, cs_SpendingKeyStore);
     if (fUseCrypto)
         return true;
     if (!(mapKeys.empty() && mapSpendingKeys.empty()))
@@ -179,7 +179,7 @@ bool CCryptoKeyStore::Lock()
 bool CCryptoKeyStore::Unlock(const CKeyingMaterial& vMasterKeyIn)
 {
     {
-        LOCK(cs_KeyStore);
+        LOCK2(cs_KeyStore, cs_SpendingKeyStore);
         if (!SetCrypted())
             return false;
 
@@ -316,14 +316,14 @@ bool CCryptoKeyStore::AddSpendingKey(const libzcash::SpendingKey &sk)
         if (!EncryptSecret(vMasterKey, vchSecret, address.GetHash(), vchCryptedSecret))
             return false;
 
-        if (!AddCryptedSpendingKey(address, sk.viewing_key(), vchCryptedSecret))
+        if (!AddCryptedSpendingKey(address, sk.receiving_key(), vchCryptedSecret))
             return false;
     }
     return true;
 }
 
 bool CCryptoKeyStore::AddCryptedSpendingKey(const libzcash::PaymentAddress &address,
-                                            const libzcash::ViewingKey &vk,
+                                            const libzcash::ReceivingKey &rk,
                                             const std::vector<unsigned char> &vchCryptedSecret)
 {
     {
@@ -332,7 +332,7 @@ bool CCryptoKeyStore::AddCryptedSpendingKey(const libzcash::PaymentAddress &addr
             return false;
 
         mapCryptedSpendingKeys[address] = vchCryptedSecret;
-        mapNoteDecryptors.insert(std::make_pair(address, ZCNoteDecryption(vk)));
+        mapNoteDecryptors.insert(std::make_pair(address, ZCNoteDecryption(rk)));
     }
     return true;
 }
@@ -384,7 +384,7 @@ bool CCryptoKeyStore::EncryptKeys(CKeyingMaterial& vMasterKeyIn)
             std::vector<unsigned char> vchCryptedSecret;
             if (!EncryptSecret(vMasterKeyIn, vchSecret, address.GetHash(), vchCryptedSecret))
                 return false;
-            if (!AddCryptedSpendingKey(address, sk.viewing_key(), vchCryptedSecret))
+            if (!AddCryptedSpendingKey(address, sk.receiving_key(), vchCryptedSecret))
                 return false;
         }
         mapSpendingKeys.clear();

src/wallet/crypter.h

@@ -201,13 +201,13 @@ public:
         }
     }
     virtual bool AddCryptedSpendingKey(const libzcash::PaymentAddress &address,
-                                       const libzcash::ViewingKey &vk,
+                                       const libzcash::ReceivingKey &rk,
                                        const std::vector<unsigned char> &vchCryptedSecret);
     bool AddSpendingKey(const libzcash::SpendingKey &sk);
     bool HaveSpendingKey(const libzcash::PaymentAddress &address) const
     {
         {
-            LOCK(cs_KeyStore);
+            LOCK(cs_SpendingKeyStore);
             if (!IsCrypted())
                 return CBasicKeyStore::HaveSpendingKey(address);
             return mapCryptedSpendingKeys.count(address) > 0;

src/wallet/gtest/test_wallet.cpp

@@ -281,7 +281,7 @@ TEST(wallet_tests, find_unspent_notes) {
     wallet.GetFilteredNotes(entries, "", 2, false);
     EXPECT_EQ(1, entries.size());
     entries.clear();    
-    // If we also ignore spent notes at thie depth, we won't find any notes.
+    // If we also ignore spent notes at this depth, we won't find any notes.
     wallet.GetFilteredNotes(entries, "", 2, true);
     EXPECT_EQ(0, entries.size());
     entries.clear(); 
@@ -328,7 +328,7 @@ TEST(wallet_tests, GetNoteNullifier) {
 
     auto sk = libzcash::SpendingKey::random();
     auto address = sk.address();
-    auto dec = ZCNoteDecryption(sk.viewing_key());
+    auto dec = ZCNoteDecryption(sk.receiving_key());
 
     auto wtx = GetValidReceive(sk, 10, true);
     auto note = GetNote(sk, wtx, 0, 1);
@@ -1046,3 +1046,36 @@ TEST(wallet_tests, MarkAffectedTransactionsDirty) {
     wallet.MarkAffectedTransactionsDirty(wtx2);
     EXPECT_FALSE(wallet.mapWallet[hash].fDebitCached);
 }
+
+TEST(wallet_tests, NoteLocking) {
+    TestWallet wallet;
+
+    auto sk = libzcash::SpendingKey::random();
+    wallet.AddSpendingKey(sk);
+
+    auto wtx = GetValidReceive(sk, 10, true);
+    auto wtx2 = GetValidReceive(sk, 10, true);
+
+    JSOutPoint jsoutpt {wtx.GetHash(), 0, 0};
+    JSOutPoint jsoutpt2 {wtx2.GetHash(),0, 0};
+
+    // Test selective locking
+    wallet.LockNote(jsoutpt);
+    EXPECT_TRUE(wallet.IsLockedNote(jsoutpt.hash, jsoutpt.js, jsoutpt.n));
+    EXPECT_FALSE(wallet.IsLockedNote(jsoutpt2.hash, jsoutpt2.js, jsoutpt2.n));
+
+    // Test selective unlocking
+    wallet.UnlockNote(jsoutpt);
+    EXPECT_FALSE(wallet.IsLockedNote(jsoutpt.hash, jsoutpt.js, jsoutpt.n));
+
+    // Test multiple locking
+    wallet.LockNote(jsoutpt);
+    wallet.LockNote(jsoutpt2);
+    EXPECT_TRUE(wallet.IsLockedNote(jsoutpt.hash, jsoutpt.js, jsoutpt.n));
+    EXPECT_TRUE(wallet.IsLockedNote(jsoutpt2.hash, jsoutpt2.js, jsoutpt2.n));
+
+    // Test unlock all
+    wallet.UnlockAllNotes();
+    EXPECT_FALSE(wallet.IsLockedNote(jsoutpt.hash, jsoutpt.js, jsoutpt.n));
+    EXPECT_FALSE(wallet.IsLockedNote(jsoutpt2.hash, jsoutpt2.js, jsoutpt2.n));
+}

src/wallet/gtest/test_wallet_zkeys.cpp

@@ -66,6 +66,53 @@ TEST(wallet_zkeys_tests, store_and_load_zkeys) {
     ASSERT_EQ(m.nCreateTime, now);
 }
 
+/**
+ * This test covers methods on CWallet
+ * AddViewingKey()
+ * RemoveViewingKey()
+ * LoadViewingKey()
+ */
+TEST(wallet_zkeys_tests, StoreAndLoadViewingKeys) {
+    SelectParams(CBaseChainParams::MAIN);
+
+    CWallet wallet;
+
+    // wallet should be empty
+    std::set<libzcash::PaymentAddress> addrs;
+    wallet.GetPaymentAddresses(addrs);
+    ASSERT_EQ(0, addrs.size());
+
+    // manually add new viewing key to wallet
+    auto sk = libzcash::SpendingKey::random();
+    auto vk = sk.viewing_key();
+    ASSERT_TRUE(wallet.AddViewingKey(vk));
+
+    // verify wallet did add it
+    auto addr = sk.address();
+    ASSERT_TRUE(wallet.HaveViewingKey(addr));
+    // and that we don't have the corresponding spending key
+    ASSERT_FALSE(wallet.HaveSpendingKey(addr));
+
+    // verify viewing key stored correctly
+    libzcash::ViewingKey vkOut;
+    wallet.GetViewingKey(addr, vkOut);
+    ASSERT_EQ(vk, vkOut);
+
+    // Load a second viewing key into the wallet
+    auto sk2 = libzcash::SpendingKey::random();
+    ASSERT_TRUE(wallet.LoadViewingKey(sk2.viewing_key()));
+
+    // verify wallet did add it
+    auto addr2 = sk2.address();
+    ASSERT_TRUE(wallet.HaveViewingKey(addr2));
+    ASSERT_FALSE(wallet.HaveSpendingKey(addr2));
+
+    // Remove the first viewing key
+    ASSERT_TRUE(wallet.RemoveViewingKey(vk));
+    ASSERT_FALSE(wallet.HaveViewingKey(addr));
+    ASSERT_TRUE(wallet.HaveViewingKey(addr2));
+}
+
 /**
  * This test covers methods on CWalletDB
  * WriteZKey()
@@ -138,6 +185,50 @@ TEST(wallet_zkeys_tests, write_zkey_direct_to_db) {
     ASSERT_EQ(m.nCreateTime, now);
 }
 
+/**
+ * This test covers methods on CWalletDB
+ * WriteViewingKey()
+ */
+TEST(wallet_zkeys_tests, WriteViewingKeyDirectToDB) {
+    SelectParams(CBaseChainParams::TESTNET);
+
+    // Get temporary and unique path for file.
+    // Note: / operator to append paths
+    boost::filesystem::path pathTemp = boost::filesystem::temp_directory_path() / boost::filesystem::unique_path();
+    boost::filesystem::create_directories(pathTemp);
+    mapArgs["-datadir"] = pathTemp.string();
+
+    bool fFirstRun;
+    CWallet wallet("wallet-vkey.dat");
+    ASSERT_EQ(DB_LOAD_OK, wallet.LoadWallet(fFirstRun));
+
+    // No default CPubKey set
+    ASSERT_TRUE(fFirstRun);
+
+    // create random viewing key and add it to database directly, bypassing wallet
+    auto sk = libzcash::SpendingKey::random();
+    auto vk = sk.viewing_key();
+    auto addr = sk.address();
+    int64_t now = GetTime();
+    CKeyMetadata meta(now);
+    CWalletDB db("wallet-vkey.dat");
+    db.WriteViewingKey(vk);
+
+    // wallet should not be aware of viewing key
+    ASSERT_FALSE(wallet.HaveViewingKey(addr));
+
+    // load the wallet again
+    ASSERT_EQ(DB_LOAD_OK, wallet.LoadWallet(fFirstRun));
+
+    // wallet can now see the viewing key
+    ASSERT_TRUE(wallet.HaveViewingKey(addr));
+
+    // check key is the same
+    libzcash::ViewingKey vkOut;
+    wallet.GetViewingKey(addr, vkOut);
+    ASSERT_EQ(vk, vkOut);
+}
+
 
 
 /**
@@ -214,5 +305,7 @@ TEST(wallet_zkeys_tests, write_cryptedzkey_direct_to_db) {
     
     wallet2.GetSpendingKey(paymentAddress2.Get(), keyOut);
     ASSERT_EQ(paymentAddress2.Get(), keyOut.address());
+
+    ECC_Stop();
 }
 

src/wallet/rpcdisclosure.cpp

@@ -0,0 +1,305 @@
+// Copyright (c) 2017 The Zcash developers
+// Distributed under the MIT software license, see the accompanying
+// file COPYING or http://www.opensource.org/licenses/mit-license.php.
+
+#include "base58.h"
+#include "rpcserver.h"
+#include "init.h"
+#include "main.h"
+#include "script/script.h"
+#include "script/standard.h"
+#include "sync.h"
+#include "util.h"
+#include "utiltime.h"
+#include "wallet.h"
+
+#include <fstream>
+#include <stdint.h>
+
+#include <boost/algorithm/string.hpp>
+#include <boost/date_time/posix_time/posix_time.hpp>
+
+#include <univalue.h>
+
+#include "paymentdisclosure.h"
+#include "paymentdisclosuredb.h"
+
+#include "zcash/Note.hpp"
+#include "zcash/NoteEncryption.hpp"
+
+using namespace std;
+using namespace libzcash;
+
+// Function declaration for function implemented in wallet/rpcwallet.cpp
+bool EnsureWalletIsAvailable(bool avoidException);
+
+/**
+ * RPC call to generate a payment disclosure
+ */
+UniValue z_getpaymentdisclosure(const UniValue& params, bool fHelp)
+{
+    if (!EnsureWalletIsAvailable(fHelp))
+        return NullUniValue;
+
+    auto fEnablePaymentDisclosure = fExperimentalMode && GetBoolArg("-paymentdisclosure", false);
+    string strPaymentDisclosureDisabledMsg = "";
+    if (!fEnablePaymentDisclosure) {
+        strPaymentDisclosureDisabledMsg = "\nWARNING: Payment disclosure is currently DISABLED. This call always fails.\n";
+    }
+
+    if (fHelp || params.size() < 3 || params.size() > 4 )
+        throw runtime_error(
+            "z_getpaymentdisclosure \"txid\" \"js_index\" \"output_index\" (\"message\") \n"
+            "\nGenerate a payment disclosure for a given joinsplit output.\n"
+            "\nEXPERIMENTAL FEATURE\n"
+            + strPaymentDisclosureDisabledMsg +
+            "\nArguments:\n"
+            "1. \"txid\"            (string, required) \n"
+            "2. \"js_index\"        (string, required) \n"
+            "3. \"output_index\"    (string, required) \n"
+            "4. \"message\"         (string, optional) \n"
+            "\nResult:\n"
+            "\"paymentdisclosure\"  (string) Hex data string, with \"zpd:\" prefix.\n"
+            "\nExamples:\n"
+            + HelpExampleCli("z_getpaymentdisclosure", "96f12882450429324d5f3b48630e3168220e49ab7b0f066e5c2935a6b88bb0f2 0 0 \"refund\"")
+            + HelpExampleRpc("z_getpaymentdisclosure", "\"96f12882450429324d5f3b48630e3168220e49ab7b0f066e5c2935a6b88bb0f2\", 0, 0, \"refund\"")
+        );
+
+    if (!fEnablePaymentDisclosure) {
+        throw JSONRPCError(RPC_WALLET_ERROR, "Error: payment disclosure is disabled.");
+    }
+
+    LOCK2(cs_main, pwalletMain->cs_wallet);
+
+    EnsureWalletIsUnlocked();
+
+    // Check wallet knows about txid
+    string txid = params[0].get_str();
+    uint256 hash;
+    hash.SetHex(txid);
+
+    CTransaction tx;
+    uint256 hashBlock;
+
+    // Check txid has been seen
+    if (!GetTransaction(hash, tx, hashBlock, true)) {
+        throw JSONRPCError(RPC_INVALID_ADDRESS_OR_KEY, "No information available about transaction");
+    }
+
+    // Check tx has been confirmed
+    if (hashBlock.IsNull()) {
+        throw JSONRPCError(RPC_MISC_ERROR, "Transaction has not been confirmed yet");
+    }
+
+    // Check is mine
+    if (!pwalletMain->mapWallet.count(hash)) {
+        throw JSONRPCError(RPC_MISC_ERROR, "Transaction does not belong to the wallet");
+    }
+    const CWalletTx& wtx = pwalletMain->mapWallet[hash];
+
+    // Check if shielded tx
+    if (wtx.vjoinsplit.empty()) {
+        throw JSONRPCError(RPC_MISC_ERROR, "Transaction is not a shielded transaction");        
+    }
+
+    // Check js_index
+    int js_index = params[1].get_int();
+    if (js_index < 0 || js_index >= wtx.vjoinsplit.size()) {
+        throw JSONRPCError(RPC_INVALID_PARAMETER, "Invalid js_index");
+    }
+
+    // Check output_index
+    int output_index = params[2].get_int();
+    if (output_index < 0 || output_index >= ZC_NUM_JS_OUTPUTS) {
+        throw JSONRPCError(RPC_INVALID_PARAMETER, "Invalid output_index");
+    }
+
+    // Get message if it exists
+    string msg;
+    if (params.size() == 4) {
+        msg = params[3].get_str();
+    }
+
+    // Create PaymentDisclosureKey
+    PaymentDisclosureKey key = {hash, (size_t)js_index, (uint8_t)output_index };
+
+    // TODO: In future, perhaps init the DB in init.cpp
+    shared_ptr<PaymentDisclosureDB> db = PaymentDisclosureDB::sharedInstance();
+    PaymentDisclosureInfo info;
+    if (!db->Get(key, info)) {
+        throw JSONRPCError(RPC_DATABASE_ERROR, "Could not find payment disclosure info for the given joinsplit output");
+    }
+
+    PaymentDisclosure pd( wtx.joinSplitPubKey, key, info, msg );
+    CDataStream ss(SER_NETWORK, PROTOCOL_VERSION);
+    ss << pd;
+    string strHex = HexStr(ss.begin(), ss.end());
+    return PAYMENT_DISCLOSURE_BLOB_STRING_PREFIX + strHex;
+}
+
+
+
+/**
+ * RPC call to validate a payment disclosure data blob.
+ */
+UniValue z_validatepaymentdisclosure(const UniValue& params, bool fHelp)
+{
+    if (!EnsureWalletIsAvailable(fHelp))
+        return NullUniValue;
+
+    auto fEnablePaymentDisclosure = fExperimentalMode && GetBoolArg("-paymentdisclosure", false);
+    string strPaymentDisclosureDisabledMsg = "";
+    if (!fEnablePaymentDisclosure) {
+        strPaymentDisclosureDisabledMsg = "\nWARNING: Payment disclosure is curretly DISABLED. This call always fails.\n";
+    }
+
+    if (fHelp || params.size() != 1)
+        throw runtime_error(
+            "z_validatepaymentdisclosure \"paymentdisclosure\"\n"
+            "\nValidates a payment disclosure.\n"
+            "\nEXPERIMENTAL FEATURE\n"
+            + strPaymentDisclosureDisabledMsg +
+            "\nArguments:\n"
+            "1. \"paymentdisclosure\"     (string, required) Hex data string, with \"zpd:\" prefix.\n"
+            "\nExamples:\n"
+            + HelpExampleCli("z_validatepaymentdisclosure", "\"zpd:706462ff004c561a0447ba2ec51184e6c204...\"")
+            + HelpExampleRpc("z_validatepaymentdisclosure", "\"zpd:706462ff004c561a0447ba2ec51184e6c204...\"")
+        );
+
+    if (!fEnablePaymentDisclosure) {
+        throw JSONRPCError(RPC_WALLET_ERROR, "Error: payment disclosure is disabled.");
+    }
+
+    LOCK2(cs_main, pwalletMain->cs_wallet);
+
+    EnsureWalletIsUnlocked();
+
+    // Verify the payment disclosure input begins with "zpd:" prefix.
+    string strInput = params[0].get_str();
+    size_t pos = strInput.find(PAYMENT_DISCLOSURE_BLOB_STRING_PREFIX);
+    if (pos != 0) {
+        throw JSONRPCError(RPC_INVALID_PARAMETER, "Invalid parameter, payment disclosure prefix not found.");
+    }
+    string hexInput = strInput.substr(strlen(PAYMENT_DISCLOSURE_BLOB_STRING_PREFIX));
+    if (!IsHex(hexInput))
+    {
+        throw JSONRPCError(RPC_INVALID_PARAMETER, "Invalid parameter, expected payment disclosure data in hexadecimal format.");
+    }
+
+    // Unserialize the payment disclosure data into an object
+    PaymentDisclosure pd;
+    CDataStream ss(ParseHex(hexInput), SER_NETWORK, PROTOCOL_VERSION);
+    try {
+        ss >> pd;
+        // too much data is ignored, but if not enough data, exception of type ios_base::failure is thrown,
+        // CBaseDataStream::read(): end of data: iostream error
+    } catch (const std::exception &e) {
+        throw JSONRPCError(RPC_INVALID_PARAMETER, "Invalid parameter, payment disclosure data is malformed.");        
+    }
+
+    if (pd.payload.marker != PAYMENT_DISCLOSURE_PAYLOAD_MAGIC_BYTES) {
+        throw JSONRPCError(RPC_INVALID_PARAMETER, "Invalid parameter, payment disclosure marker not found.");
+    }
+
+    if (pd.payload.version != PAYMENT_DISCLOSURE_VERSION_EXPERIMENTAL) {
+        throw JSONRPCError(RPC_INVALID_PARAMETER, "Payment disclosure version is unsupported.");
+    }
+
+    uint256 hash = pd.payload.txid;
+    CTransaction tx;
+    uint256 hashBlock;
+    // Check if we have seen the transaction
+    if (!GetTransaction(hash, tx, hashBlock, true)) {
+        throw JSONRPCError(RPC_INVALID_ADDRESS_OR_KEY, "No information available about transaction");
+    }
+
+    // Check if the transaction has been confirmed
+    if (hashBlock.IsNull()) {
+        throw JSONRPCError(RPC_MISC_ERROR, "Transaction has not been confirmed yet");
+    }
+
+    // Check if shielded tx
+    if (tx.vjoinsplit.empty()) {
+        throw JSONRPCError(RPC_MISC_ERROR, "Transaction is not a shielded transaction");        
+    }
+
+    UniValue errs(UniValue::VARR);
+    UniValue o(UniValue::VOBJ);
+    o.push_back(Pair("txid", pd.payload.txid.ToString()));
+
+    // Check js_index
+    if (pd.payload.js >= tx.vjoinsplit.size()) {
+        errs.push_back("Payment disclosure refers to an invalid joinsplit index");
+    }
+    o.push_back(Pair("jsIndex", pd.payload.js));
+
+    if (pd.payload.n < 0 || pd.payload.n >= ZC_NUM_JS_OUTPUTS) {
+        errs.push_back("Payment disclosure refers to an invalid output index");
+    }
+    o.push_back(Pair("outputIndex", pd.payload.n));
+    o.push_back(Pair("version", pd.payload.version));
+    o.push_back(Pair("onetimePrivKey", pd.payload.esk.ToString()));
+    o.push_back(Pair("message", pd.payload.message));
+    o.push_back(Pair("joinSplitPubKey", tx.joinSplitPubKey.ToString()));
+
+    // Verify the payment disclosure was signed using the same key as the transaction i.e. the joinSplitPrivKey.
+    uint256 dataToBeSigned = SerializeHash(pd.payload, SER_GETHASH, 0);
+    bool sigVerified = (crypto_sign_verify_detached(pd.payloadSig.data(),
+        dataToBeSigned.begin(), 32,
+        tx.joinSplitPubKey.begin()) == 0);
+    o.push_back(Pair("signatureVerified", sigVerified));
+    if (!sigVerified) {
+        errs.push_back("Payment disclosure signature does not match transaction signature");        
+    }
+   
+    // Check the payment address is valid
+    PaymentAddress zaddr = pd.payload.zaddr;
+    CZCPaymentAddress address;
+    if (!address.Set(zaddr)) {
+        errs.push_back("Payment disclosure refers to an invalid payment address");        
+    } else {
+        o.push_back(Pair("paymentAddress", address.ToString()));
+
+        try {
+            // Decrypt the note to get value and memo field
+            JSDescription jsdesc = tx.vjoinsplit[pd.payload.js];
+            uint256 h_sig = jsdesc.h_sig(*pzcashParams, tx.joinSplitPubKey);
+
+            ZCPaymentDisclosureNoteDecryption decrypter;
+
+            ZCNoteEncryption::Ciphertext ciphertext = jsdesc.ciphertexts[pd.payload.n];
+
+            uint256 pk_enc = zaddr.pk_enc;
+            auto plaintext = decrypter.decryptWithEsk(ciphertext, pk_enc, pd.payload.esk, h_sig, pd.payload.n);
+
+            CDataStream ssPlain(SER_NETWORK, PROTOCOL_VERSION);
+            ssPlain << plaintext;
+            NotePlaintext npt;
+            ssPlain >> npt;
+
+            string memoHexString = HexStr(npt.memo.data(), npt.memo.data() + npt.memo.size());
+            o.push_back(Pair("memo", memoHexString));
+            o.push_back(Pair("value", ValueFromAmount(npt.value)));
+            
+            // Check the blockchain commitment matches decrypted note commitment
+            uint256 cm_blockchain =  jsdesc.commitments[pd.payload.n];
+            Note note = npt.note(zaddr);
+            uint256 cm_decrypted = note.cm();
+            bool cm_match = (cm_decrypted == cm_blockchain);
+            o.push_back(Pair("commitmentMatch", cm_match));
+            if (!cm_match) {
+                errs.push_back("Commitment derived from payment disclosure does not match blockchain commitment");
+            }
+        } catch (const std::exception &e) {
+            errs.push_back(string("Error while decrypting payment disclosure note: ") + string(e.what()) );
+        }
+    }
+
+    bool isValid = errs.empty();
+    o.push_back(Pair("valid", isValid));
+    if (!isValid) {
+        o.push_back(Pair("errors", errs));
+    }
+
+    return o;
+}

src/wallet/rpcdump.cpp

@@ -128,8 +128,9 @@ UniValue importprivkey(const UniValue& params, bool fHelp)
         pwalletMain->SetAddressBook(vchAddress, strLabel, "receive");
 
         // Don't throw error in case a key is already there
-        if (pwalletMain->HaveKey(vchAddress))
-            return NullUniValue;
+        if (pwalletMain->HaveKey(vchAddress)) {
+            return CBitcoinAddress(vchAddress).ToString();
+        }
 
         pwalletMain->mapKeyMetadata[vchAddress].nCreateTime = 1;
 
@@ -144,7 +145,7 @@ UniValue importprivkey(const UniValue& params, bool fHelp)
         }
     }
 
-    return NullUniValue;
+    return CBitcoinAddress(vchAddress).ToString();
 }
 
 UniValue importaddress(const UniValue& params, bool fHelp)
@@ -233,11 +234,11 @@ UniValue z_importwallet(const UniValue& params, bool fHelp)
             "1. \"filename\"    (string, required) The wallet file\n"
             "\nExamples:\n"
             "\nDump the wallet\n"
-            + HelpExampleCli("z_exportwallet", "\"test\"") +
+            + HelpExampleCli("z_exportwallet", "\"nameofbackup\"") +
             "\nImport the wallet\n"
-            + HelpExampleCli("z_importwallet", "\"test\"") +
+            + HelpExampleCli("z_importwallet", "\"path/to/exportdir/nameofbackup\"") +
             "\nImport using the json rpc call\n"
-            + HelpExampleRpc("z_importwallet", "\"test\"")
+            + HelpExampleRpc("z_importwallet", "\"path/to/exportdir/nameofbackup\"")
         );
 
 	return importwallet_impl(params, fHelp, true);
@@ -256,11 +257,11 @@ UniValue importwallet(const UniValue& params, bool fHelp)
             "1. \"filename\"    (string, required) The wallet file\n"
             "\nExamples:\n"
             "\nDump the wallet\n"
-            + HelpExampleCli("dumpwallet", "\"test\"") +
+            + HelpExampleCli("dumpwallet", "\"nameofbackup\"") +
             "\nImport the wallet\n"
-            + HelpExampleCli("importwallet", "\"test\"") +
+            + HelpExampleCli("importwallet", "\"path/to/exportdir/nameofbackup\"") +
             "\nImport using the json rpc call\n"
-            + HelpExampleRpc("importwallet", "\"test\"")
+            + HelpExampleRpc("importwallet", "\"path/to/exportdir/nameofbackup\"")
         );
 
 	return importwallet_impl(params, fHelp, false);
@@ -427,7 +428,7 @@ UniValue z_exportwallet(const UniValue& params, bool fHelp)
     if (fHelp || params.size() != 1)
         throw runtime_error(
             "z_exportwallet \"filename\"\n"
-            "\nExports all wallet keys, for taddr and zaddr, in a human-readable format.\n"
+            "\nExports all wallet keys, for taddr and zaddr, in a human-readable format.  Overwriting an existing file is not permitted.\n"
             "\nArguments:\n"
             "1. \"filename\"    (string, required) The filename, saved in folder set by zcashd -exportdir option\n"
             "\nResult:\n"
@@ -448,7 +449,7 @@ UniValue dumpwallet(const UniValue& params, bool fHelp)
     if (fHelp || params.size() != 1)
         throw runtime_error(
             "dumpwallet \"filename\"\n"
-            "\nDumps taddr wallet keys in a human-readable format.\n"
+            "\nDumps taddr wallet keys in a human-readable format.  Overwriting an existing file is not permitted.\n"
             "\nArguments:\n"
             "1. \"filename\"    (string, required) The filename, saved in folder set by zcashd -exportdir option\n"
             "\nResult:\n"
@@ -483,6 +484,10 @@ UniValue dumpwallet_impl(const UniValue& params, bool fHelp, bool fDumpZKeys)
     }
     boost::filesystem::path exportfilepath = exportdir / clean;
 
+    if (boost::filesystem::exists(exportfilepath)) {
+        throw JSONRPCError(RPC_INVALID_PARAMETER, "Cannot overwrite existing file " + exportfilepath.string());
+    }
+
     ofstream file;
     file.open(exportfilepath.string().c_str());
     if (!file.is_open())
@@ -643,6 +648,94 @@ UniValue z_importkey(const UniValue& params, bool fHelp)
     return NullUniValue;
 }
 
+UniValue z_importviewingkey(const UniValue& params, bool fHelp)
+{
+    if (!EnsureWalletIsAvailable(fHelp))
+        return NullUniValue;
+
+    if (fHelp || params.size() < 1 || params.size() > 3)
+        throw runtime_error(
+            "z_importviewingkey \"vkey\" ( rescan startHeight )\n"
+            "\nAdds a viewing key (as returned by z_exportviewingkey) to your wallet.\n"
+            "\nArguments:\n"
+            "1. \"vkey\"             (string, required) The viewing key (see z_exportviewingkey)\n"
+            "2. rescan             (string, optional, default=\"whenkeyisnew\") Rescan the wallet for transactions - can be \"yes\", \"no\" or \"whenkeyisnew\"\n"
+            "3. startHeight        (numeric, optional, default=0) Block height to start rescan from\n"
+            "\nNote: This call can take minutes to complete if rescan is true.\n"
+            "\nExamples:\n"
+            "\nImport a viewing key\n"
+            + HelpExampleCli("z_importviewingkey", "\"vkey\"") +
+            "\nImport the viewing key without rescan\n"
+            + HelpExampleCli("z_importviewingkey", "\"vkey\", no") +
+            "\nImport the viewing key with partial rescan\n"
+            + HelpExampleCli("z_importviewingkey", "\"vkey\" whenkeyisnew 30000") +
+            "\nRe-import the viewing key with longer partial rescan\n"
+            + HelpExampleCli("z_importviewingkey", "\"vkey\" yes 20000") +
+            "\nAs a JSON-RPC call\n"
+            + HelpExampleRpc("z_importviewingkey", "\"vkey\", \"no\"")
+        );
+
+    LOCK2(cs_main, pwalletMain->cs_wallet);
+
+    EnsureWalletIsUnlocked();
+
+    // Whether to perform rescan after import
+    bool fRescan = true;
+    bool fIgnoreExistingKey = true;
+    if (params.size() > 1) {
+        auto rescan = params[1].get_str();
+        if (rescan.compare("whenkeyisnew") != 0) {
+            fIgnoreExistingKey = false;
+            if (rescan.compare("no") == 0) {
+                fRescan = false;
+            } else if (rescan.compare("yes") != 0) {
+                throw JSONRPCError(
+                    RPC_INVALID_PARAMETER,
+                    "rescan must be \"yes\", \"no\" or \"whenkeyisnew\"");
+            }
+        }
+    }
+
+    // Height to rescan from
+    int nRescanHeight = 0;
+    if (params.size() > 2) {
+        nRescanHeight = params[2].get_int();
+    }
+    if (nRescanHeight < 0 || nRescanHeight > chainActive.Height()) {
+        throw JSONRPCError(RPC_INVALID_PARAMETER, "Block height out of range");
+    }
+
+    string strVKey = params[0].get_str();
+    CZCViewingKey viewingkey(strVKey);
+    auto vkey = viewingkey.Get();
+    auto addr = vkey.address();
+
+    {
+        if (pwalletMain->HaveSpendingKey(addr)) {
+            throw JSONRPCError(RPC_WALLET_ERROR, "The wallet already contains the private key for this viewing key");
+        }
+
+        // Don't throw error in case a viewing key is already there
+        if (pwalletMain->HaveViewingKey(addr)) {
+            if (fIgnoreExistingKey) {
+                return NullUniValue;
+            }
+        } else {
+            pwalletMain->MarkDirty();
+
+            if (!pwalletMain->AddViewingKey(vkey)) {
+                throw JSONRPCError(RPC_WALLET_ERROR, "Error adding viewing key to wallet");
+            }
+        }
+
+        // We want to scan for transactions and notes
+        if (fRescan) {
+            pwalletMain->ScanForWalletTransactions(chainActive[nRescanHeight], true);
+        }
+    }
+
+    return NullUniValue;
+}
 
 UniValue z_exportkey(const UniValue& params, bool fHelp)
 {
@@ -681,3 +774,43 @@ UniValue z_exportkey(const UniValue& params, bool fHelp)
     return spendingkey.ToString();
 }
 
+UniValue z_exportviewingkey(const UniValue& params, bool fHelp)
+{
+    if (!EnsureWalletIsAvailable(fHelp))
+        return NullUniValue;
+
+    if (fHelp || params.size() != 1)
+        throw runtime_error(
+            "z_exportviewingkey \"zaddr\"\n"
+            "\nReveals the viewing key corresponding to 'zaddr'.\n"
+            "Then the z_importviewingkey can be used with this output\n"
+            "\nArguments:\n"
+            "1. \"zaddr\"   (string, required) The zaddr for the viewing key\n"
+            "\nResult:\n"
+            "\"vkey\"                  (string) The viewing key\n"
+            "\nExamples:\n"
+            + HelpExampleCli("z_exportviewingkey", "\"myaddress\"")
+            + HelpExampleRpc("z_exportviewingkey", "\"myaddress\"")
+        );
+
+    LOCK2(cs_main, pwalletMain->cs_wallet);
+
+    EnsureWalletIsUnlocked();
+
+    string strAddress = params[0].get_str();
+
+    CZCPaymentAddress address(strAddress);
+    auto addr = address.Get();
+
+    libzcash::ViewingKey vk;
+    if (!pwalletMain->GetViewingKey(addr, vk)) {
+        libzcash::SpendingKey k;
+        if (!pwalletMain->GetSpendingKey(addr, k)) {
+            throw JSONRPCError(RPC_WALLET_ERROR, "Wallet does not hold private key or viewing key for this zaddr");
+        }
+        vk = k.viewing_key();
+    }
+
+    CZCViewingKey viewingkey(vk);
+    return viewingkey.ToString();
+}

src/wallet/wallet.cpp

@@ -8,7 +8,9 @@
 #include "base58.h"
 #include "checkpoints.h"
 #include "coincontrol.h"
+#include "consensus/upgrades.h"
 #include "consensus/validation.h"
+#include "consensus/consensus.h"
 #include "init.h"
 #include "main.h"
 #include "net.h"
@@ -111,6 +113,10 @@ bool CWallet::AddZKey(const libzcash::SpendingKey &key)
     if (!CCryptoKeyStore::AddSpendingKey(key))
         return false;
 
+    // check if we need to remove from viewing keys
+    if (HaveViewingKey(addr))
+        RemoveViewingKey(key.viewing_key());
+
     if (!fFileBacked)
         return true;
 
@@ -194,10 +200,10 @@ bool CWallet::AddCryptedKey(const CPubKey &vchPubKey,
 
 
 bool CWallet::AddCryptedSpendingKey(const libzcash::PaymentAddress &address,
-                                    const libzcash::ViewingKey &vk,
+                                    const libzcash::ReceivingKey &rk,
                                     const std::vector<unsigned char> &vchCryptedSecret)
 {
-    if (!CCryptoKeyStore::AddCryptedSpendingKey(address, vk, vchCryptedSecret))
+    if (!CCryptoKeyStore::AddCryptedSpendingKey(address, rk, vchCryptedSecret))
         return false;
     if (!fFileBacked)
         return true;
@@ -205,12 +211,12 @@ bool CWallet::AddCryptedSpendingKey(const libzcash::PaymentAddress &address,
         LOCK(cs_wallet);
         if (pwalletdbEncryption) {
             return pwalletdbEncryption->WriteCryptedZKey(address,
-                                                         vk,
+                                                         rk,
                                                          vchCryptedSecret,
                                                          mapZKeyMetadata[address]);
         } else {
             return CWalletDB(strWalletFile).WriteCryptedZKey(address,
-                                                             vk,
+                                                             rk,
                                                              vchCryptedSecret,
                                                              mapZKeyMetadata[address]);
         }
@@ -240,9 +246,9 @@ bool CWallet::LoadCryptedKey(const CPubKey &vchPubKey, const std::vector<unsigne
     return CCryptoKeyStore::AddCryptedKey(vchPubKey, vchCryptedSecret);
 }
 
-bool CWallet::LoadCryptedZKey(const libzcash::PaymentAddress &addr, const libzcash::ViewingKey &vk, const std::vector<unsigned char> &vchCryptedSecret)
+bool CWallet::LoadCryptedZKey(const libzcash::PaymentAddress &addr, const libzcash::ReceivingKey &rk, const std::vector<unsigned char> &vchCryptedSecret)
 {
-    return CCryptoKeyStore::AddCryptedSpendingKey(addr, vk, vchCryptedSecret);
+    return CCryptoKeyStore::AddCryptedSpendingKey(addr, rk, vchCryptedSecret);
 }
 
 bool CWallet::LoadZKey(const libzcash::SpendingKey &key)
@@ -250,6 +256,38 @@ bool CWallet::LoadZKey(const libzcash::SpendingKey &key)
     return CCryptoKeyStore::AddSpendingKey(key);
 }
 
+bool CWallet::AddViewingKey(const libzcash::ViewingKey &vk)
+{
+    if (!CCryptoKeyStore::AddViewingKey(vk)) {
+        return false;
+    }
+    nTimeFirstKey = 1; // No birthday information for viewing keys.
+    if (!fFileBacked) {
+        return true;
+    }
+    return CWalletDB(strWalletFile).WriteViewingKey(vk);
+}
+
+bool CWallet::RemoveViewingKey(const libzcash::ViewingKey &vk)
+{
+    AssertLockHeld(cs_wallet);
+    if (!CCryptoKeyStore::RemoveViewingKey(vk)) {
+        return false;
+    }
+    if (fFileBacked) {
+        if (!CWalletDB(strWalletFile).EraseViewingKey(vk)) {
+            return false;
+        }
+    }
+
+    return true;
+}
+
+bool CWallet::LoadViewingKey(const libzcash::ViewingKey &vk)
+{
+    return CCryptoKeyStore::AddViewingKey(vk);
+}
+
 bool CWallet::AddCScript(const CScript& redeemScript)
 {
     if (!CCryptoKeyStore::AddCScript(redeemScript))
@@ -963,7 +1001,8 @@ void CWallet::MarkDirty()
 }
 
 /**
- * Ensure that every note in the wallet has a cached nullifier.
+ * Ensure that every note in the wallet (for which we possess a spending key)
+ * has a cached nullifier.
  */
 bool CWallet::UpdateNullifierNoteMap()
 {
@@ -977,16 +1016,17 @@ bool CWallet::UpdateNullifierNoteMap()
         for (std::pair<const uint256, CWalletTx>& wtxItem : mapWallet) {
             for (mapNoteData_t::value_type& item : wtxItem.second.mapNoteData) {
                 if (!item.second.nullifier) {
-                    auto i = item.first.js;
-                    GetNoteDecryptor(item.second.address, dec);
-                    auto hSig = wtxItem.second.vjoinsplit[i].h_sig(
-                        *pzcashParams, wtxItem.second.joinSplitPubKey);
-                    item.second.nullifier = GetNoteNullifier(
-                        wtxItem.second.vjoinsplit[i],
-                        item.second.address,
-                        dec,
-                        hSig,
-                        item.first.n);
+                    if (GetNoteDecryptor(item.second.address, dec)) {
+                        auto i = item.first.js;
+                        auto hSig = wtxItem.second.vjoinsplit[i].h_sig(
+                            *pzcashParams, wtxItem.second.joinSplitPubKey);
+                        item.second.nullifier = GetNoteNullifier(
+                            wtxItem.second.vjoinsplit[i],
+                            item.second.address,
+                            dec,
+                            hSig,
+                            item.first.n);
+                    }
                 }
             }
             UpdateNullifierNoteMapWithTx(wtxItem.second);
@@ -1248,7 +1288,9 @@ boost::optional<uint256> CWallet::GetNoteNullifier(const JSDescription& jsdesc,
         hSig,
         (unsigned char) n);
     auto note = note_pt.note(address);
-    // SpendingKeys are only available if the wallet is unlocked
+    // SpendingKeys are only available if:
+    // - We have them (this isn't a viewing key)
+    // - The wallet is unlocked
     libzcash::SpendingKey key;
     if (GetSpendingKey(address, key)) {
         ret = note.nullifier(key);
@@ -2580,6 +2622,7 @@ bool CWallet::FundTransaction(CMutableTransaction& tx, CAmount &nFeeRet, int& nC
 
     CReserveKey reservekey(this);
     CWalletTx wtx;
+    
     if (!CreateTransaction(vecSend, wtx, reservekey, nFeeRet, nChangePosRet, strFailReason, &coinControl, false))
         return false;
 
@@ -2629,36 +2672,23 @@ bool CWallet::CreateTransaction(const vector<CRecipient>& vecSend, CWalletTx& wt
 
     wtxNew.fTimeReceivedIsTxTime = true;
     wtxNew.BindWallet(this);
-    CMutableTransaction txNew;
-
-    if ( 0 )
-    {
-        // Discourage fee sniping.
-        //
-        // However because of a off-by-one-error in previous versions we need to
-        // neuter it by setting nLockTime to at least one less than nBestHeight.
-        // Secondly currently propagation of transactions created for block heights
-        // corresponding to blocks that were just mined may be iffy - transactions
-        // aren't re-accepted into the mempool - we additionally neuter the code by
-        // going ten blocks back. Doesn't yet do anything for sniping, but does act
-        // to shake out wallet bugs like not showing nLockTime'd transactions at
-        // all.
-        txNew.nLockTime = std::max(0, chainActive.Height() - 10);
-        
-        // Secondly occasionally randomly pick a nLockTime even further back, so
-        // that transactions that are delayed after signing for whatever reason,
-        // e.g. high-latency mix networks and some CoinJoin implementations, have
-        // better privacy.
-        if (GetRandInt(10) == 0)
-            txNew.nLockTime = std::max(0, (int)txNew.nLockTime - GetRandInt(100));
-        
-        assert(txNew.nLockTime <= (unsigned int)chainActive.Height());
-        assert(txNew.nLockTime < LOCKTIME_THRESHOLD);
-    }
-    else
-    {
+    int nextBlockHeight = chainActive.Height() + 1;
+    CMutableTransaction txNew = CreateNewContextualCMutableTransaction(
+                                                                       Params().GetConsensus(), nextBlockHeight);
         txNew.nLockTime = (uint32_t)chainActive.Tip()->nTime + 1; // set to a time close to now
+
+    // Activates after Overwinter network upgrade
+    // Set nExpiryHeight to expiryDelta (default 20) blocks past current block height
+    if (NetworkUpgradeActive(nextBlockHeight, Params().GetConsensus(), Consensus::UPGRADE_OVERWINTER))
+    {
+        if (nextBlockHeight + expiryDelta >= TX_EXPIRY_HEIGHT_THRESHOLD){
+            strFailReason = _("nExpiryHeight must be less than TX_EXPIRY_HEIGHT_THRESHOLD.");
+            return false;
+        } else {
+            txNew.nExpiryHeight = nextBlockHeight + expiryDelta;
+        }
     }
+    
     {
         LOCK2(cs_main, cs_wallet);
         {
@@ -2779,8 +2809,6 @@ bool CWallet::CreateTransaction(const vector<CRecipient>& vecSend, CWalletTx& wt
                         extern int32_t USE_EXTERNAL_PUBKEY; extern std::string NOTARY_PUBKEY;
                         if ( USE_EXTERNAL_PUBKEY == 0 )
                         {
-                            //fprintf(stderr,"use notary pubkey\n");
-                            //scriptPubKey = CScript() << ParseHex(NOTARY_PUBKEY) << OP_CHECKSIG;
                             bool ret;
                             ret = reservekey.GetReservedKey(vchPubKey);
                             assert(ret); // should never fail, as we just unlocked
@@ -2788,6 +2816,7 @@ bool CWallet::CreateTransaction(const vector<CRecipient>& vecSend, CWalletTx& wt
                         }
                         else
                         {
+                            //fprintf(stderr,"use notary pubkey\n");
                             scriptChange = CScript() << ParseHex(NOTARY_PUBKEY) << OP_CHECKSIG;
                         }
                     }
@@ -2839,6 +2868,19 @@ bool CWallet::CreateTransaction(const vector<CRecipient>& vecSend, CWalletTx& wt
                     txNew.vin.push_back(CTxIn(coin.first->GetHash(),coin.second,CScript(),
                                               std::numeric_limits<unsigned int>::max()-1));
 
+                // Check mempooltxinputlimit to avoid creating a transaction which the local mempool rejects
+                size_t limit = (size_t)GetArg("-mempooltxinputlimit", 0);
+                if (limit > 0) {
+                    size_t n = txNew.vin.size();
+                    if (n > limit) {
+                        strFailReason = _(strprintf("Too many transparent inputs %zu > limit %zu", n, limit).c_str());
+                        return false;
+                    }
+                }
+
+                // Grab the current consensus branch ID
+                auto consensusBranchId = CurrentEpochBranchId(chainActive.Height() + 1, Params().GetConsensus());
+
                 // Sign
                 int nIn = 0;
                 CTransaction txNewConst(txNew);
@@ -2846,17 +2888,20 @@ bool CWallet::CreateTransaction(const vector<CRecipient>& vecSend, CWalletTx& wt
                 {
                     bool signSuccess;
                     const CScript& scriptPubKey = coin.first->vout[coin.second].scriptPubKey;
-                    CScript& scriptSigRes = txNew.vin[nIn].scriptSig;
+                    SignatureData sigdata;
                     if (sign)
-                        signSuccess = ProduceSignature(TransactionSignatureCreator(this, &txNewConst, nIn, SIGHASH_ALL), scriptPubKey, scriptSigRes);
+                        signSuccess = ProduceSignature(TransactionSignatureCreator(this, &txNewConst, nIn, coin.first->vout[coin.second].nValue, SIGHASH_ALL), scriptPubKey, sigdata, consensusBranchId);
                     else
-                        signSuccess = ProduceSignature(DummySignatureCreator(this), scriptPubKey, scriptSigRes);
+                        signSuccess = ProduceSignature(DummySignatureCreator(this), scriptPubKey, sigdata, consensusBranchId);
 
                     if (!signSuccess)
                     {
                         strFailReason = _("Signing transaction failed");
                         return false;
+                    } else {
+                        UpdateTransaction(txNew, nIn, sigdata);
                     }
+
                     nIn++;
                 }
 
@@ -3490,6 +3535,42 @@ void CWallet::ListLockedCoins(std::vector<COutPoint>& vOutpts)
     }
 }
 
+
+// Note Locking Operations
+
+void CWallet::LockNote(JSOutPoint& output)
+{
+    AssertLockHeld(cs_wallet); // setLockedNotes
+    setLockedNotes.insert(output);
+}
+
+void CWallet::UnlockNote(JSOutPoint& output)
+{
+    AssertLockHeld(cs_wallet); // setLockedNotes
+    setLockedNotes.erase(output);
+}
+
+void CWallet::UnlockAllNotes()
+{
+    AssertLockHeld(cs_wallet); // setLockedNotes
+    setLockedNotes.clear();
+}
+
+bool CWallet::IsLockedNote(uint256 hash, size_t js, uint8_t n) const
+{
+    AssertLockHeld(cs_wallet); // setLockedNotes
+    JSOutPoint outpt(hash, js, n);
+
+    return (setLockedNotes.count(outpt) > 0);
+}
+
+std::vector<JSOutPoint> CWallet::ListLockedNotes()
+{
+    AssertLockHeld(cs_wallet); // setLockedNotes
+    std::vector<JSOutPoint> vOutpts(setLockedNotes.begin(), setLockedNotes.end());
+    return vOutpts;
+}
+
 /** @} */ // end of Actions
 
 class CAffectedKeysVisitor : public boost::static_visitor<void> {
@@ -3725,15 +3806,28 @@ bool CMerkleTx::AcceptToMemoryPool(bool fLimitFree, bool fRejectAbsurdFee)
  * Find notes in the wallet filtered by payment address, min depth and ability to spend.
  * These notes are decrypted and added to the output parameter vector, outEntries.
  */
-void CWallet::GetFilteredNotes(std::vector<CNotePlaintextEntry> & outEntries, std::string address, int minDepth, bool ignoreSpent)
+void CWallet::GetFilteredNotes(std::vector<CNotePlaintextEntry> & outEntries, std::string address, int minDepth, bool ignoreSpent, bool ignoreUnspendable)
 {
-    bool fFilterAddress = false;
-    libzcash::PaymentAddress filterPaymentAddress;
+    std::set<PaymentAddress> filterAddresses;
+
     if (address.length() > 0) {
-        filterPaymentAddress = CZCPaymentAddress(address).Get();
-        fFilterAddress = true;
+        filterAddresses.insert(CZCPaymentAddress(address).Get());
     }
 
+    GetFilteredNotes(outEntries, filterAddresses, minDepth, ignoreSpent, ignoreUnspendable);
+}
+
+/**
+ * Find notes in the wallet filtered by payment addresses, min depth and ability to spend.
+ * These notes are decrypted and added to the output parameter vector, outEntries.
+ */
+void CWallet::GetFilteredNotes(
+    std::vector<CNotePlaintextEntry>& outEntries,
+    std::set<PaymentAddress>& filterAddresses,
+    int minDepth,
+    bool ignoreSpent,
+    bool ignoreUnspendable)
+{
     LOCK2(cs_main, cs_wallet);
 
     for (auto & p : mapWallet) {
@@ -3754,7 +3848,7 @@ void CWallet::GetFilteredNotes(std::vector<CNotePlaintextEntry> & outEntries, st
             PaymentAddress pa = nd.address;
 
             // skip notes which belong to a different payment address in the wallet
-            if (fFilterAddress && !(pa == filterPaymentAddress)) {
+            if (!(filterAddresses.empty() || filterAddresses.count(pa))) {
                 continue;
             }
 
@@ -3763,6 +3857,16 @@ void CWallet::GetFilteredNotes(std::vector<CNotePlaintextEntry> & outEntries, st
                 continue;
             }
 
+            // skip notes which cannot be spent
+            if (ignoreUnspendable && !HaveSpendingKey(pa)) {
+                continue;
+            }
+            
+            // skip locked notes
+            if (IsLockedNote(jsop.hash, jsop.js, jsop.n)) {
+                continue;
+            }
+
             int i = jsop.js; // Index into CTransaction.vjoinsplit
             int j = jsop.n; // Index into JSDescription.ciphertexts
 
@@ -3783,7 +3887,7 @@ void CWallet::GetFilteredNotes(std::vector<CNotePlaintextEntry> & outEntries, st
                         hSig,
                         (unsigned char) j);
 
-                outEntries.push_back(CNotePlaintextEntry{jsop, plaintext});
+                outEntries.push_back(CNotePlaintextEntry{jsop, pa, plaintext});
 
             } catch (const note_decryption_failed &err) {
                 // Couldn't decrypt with this spending key

src/wallet/wallet.h

@@ -8,9 +8,9 @@
 
 #include "amount.h"
 #include "coins.h"
-#include "consensus/consensus.h"
 #include "key.h"
 #include "keystore.h"
+#include "main.h"
 #include "primitives/block.h"
 #include "primitives/transaction.h"
 #include "tinyformat.h"
@@ -61,7 +61,6 @@ static const unsigned int MAX_FREE_TRANSACTION_CREATE_SIZE = 1000;
 #define _COINBASE_MATURITY 100
 static const unsigned int WITNESS_CACHE_SIZE = _COINBASE_MATURITY+10;
 
-class CAccountingEntry;
 class CBlockIndex;
 class CCoinControl;
 class COutput;
@@ -154,7 +153,7 @@ struct COutputEntry
     int vout;
 };
 
-/** An note outpoint */
+/** A note outpoint */
 class JSOutPoint
 {
 public:
@@ -273,6 +272,7 @@ typedef std::map<JSOutPoint, CNoteData> mapNoteData_t;
 struct CNotePlaintextEntry
 {
     JSOutPoint jsop;
+    libzcash::PaymentAddress address;
     libzcash::NotePlaintext plaintext;
 };
 
@@ -575,6 +575,86 @@ public:
     }
 };
 
+/**
+ * Internal transfers.
+ * Database key is acentry<account><counter>.
+ */
+class CAccountingEntry
+{
+public:
+    std::string strAccount;
+    CAmount nCreditDebit;
+    int64_t nTime;
+    std::string strOtherAccount;
+    std::string strComment;
+    mapValue_t mapValue;
+    int64_t nOrderPos;  //! position in ordered transaction list
+    uint64_t nEntryNo;
+
+    CAccountingEntry()
+    {
+        SetNull();
+    }
+
+    void SetNull()
+    {
+        nCreditDebit = 0;
+        nTime = 0;
+        strAccount.clear();
+        strOtherAccount.clear();
+        strComment.clear();
+        nOrderPos = -1;
+        nEntryNo = 0;
+    }
+
+    ADD_SERIALIZE_METHODS;
+
+    template <typename Stream, typename Operation>
+    inline void SerializationOp(Stream& s, Operation ser_action, int nType, int nVersion) {
+        if (!(nType & SER_GETHASH))
+            READWRITE(nVersion);
+        //! Note: strAccount is serialized as part of the key, not here.
+        READWRITE(nCreditDebit);
+        READWRITE(nTime);
+        READWRITE(LIMITED_STRING(strOtherAccount, 65536));
+
+        if (!ser_action.ForRead())
+        {
+            WriteOrderPos(nOrderPos, mapValue);
+
+            if (!(mapValue.empty() && _ssExtra.empty()))
+            {
+                CDataStream ss(nType, nVersion);
+                ss.insert(ss.begin(), '\0');
+                ss << mapValue;
+                ss.insert(ss.end(), _ssExtra.begin(), _ssExtra.end());
+                strComment.append(ss.str());
+            }
+        }
+
+        READWRITE(LIMITED_STRING(strComment, 65536));
+
+        size_t nSepPos = strComment.find("\0", 0, 1);
+        if (ser_action.ForRead())
+        {
+            mapValue.clear();
+            if (std::string::npos != nSepPos)
+            {
+                CDataStream ss(std::vector<char>(strComment.begin() + nSepPos + 1, strComment.end()), nType, nVersion);
+                ss >> mapValue;
+                _ssExtra = std::vector<char>(ss.begin(), ss.end());
+            }
+            ReadOrderPos(nOrderPos, mapValue);
+        }
+        if (std::string::npos != nSepPos)
+            strComment.erase(nSepPos);
+
+        mapValue.erase("n");
+    }
+
+private:
+    std::vector<char> _ssExtra;
+};
 
 
 /**
@@ -802,6 +882,7 @@ public:
     CPubKey vchDefaultKey;
 
     std::set<COutPoint> setLockedCoins;
+    std::set<JSOutPoint> setLockedNotes;
 
     int64_t nTimeFirstKey;
 
@@ -822,6 +903,14 @@ public:
     void UnlockAllCoins();
     void ListLockedCoins(std::vector<COutPoint>& vOutpts);
 
+
+    bool IsLockedNote(uint256 hash, size_t js, uint8_t n) const;
+    void LockNote(JSOutPoint& output);
+    void UnlockNote(JSOutPoint& output);
+    void UnlockAllNotes();
+    std::vector<JSOutPoint> ListLockedNotes();
+
+
     /**
      * keystore implementation
      * Generate a new key
@@ -876,9 +965,15 @@ public:
     //! Load spending key metadata (used by LoadWallet)
     bool LoadZKeyMetadata(const libzcash::PaymentAddress &addr, const CKeyMetadata &meta);
     //! Adds an encrypted spending key to the store, without saving it to disk (used by LoadWallet)
-    bool LoadCryptedZKey(const libzcash::PaymentAddress &addr, const libzcash::ViewingKey &vk, const std::vector<unsigned char> &vchCryptedSecret);
+    bool LoadCryptedZKey(const libzcash::PaymentAddress &addr, const libzcash::ReceivingKey &rk, const std::vector<unsigned char> &vchCryptedSecret);
     //! Adds an encrypted spending key to the store, and saves it to disk (virtual method, declared in crypter.h)
-    bool AddCryptedSpendingKey(const libzcash::PaymentAddress &address, const libzcash::ViewingKey &vk, const std::vector<unsigned char> &vchCryptedSecret);
+    bool AddCryptedSpendingKey(const libzcash::PaymentAddress &address, const libzcash::ReceivingKey &rk, const std::vector<unsigned char> &vchCryptedSecret);
+
+    //! Adds a viewing key to the store, and saves it to disk.
+    bool AddViewingKey(const libzcash::ViewingKey &vk);
+    bool RemoveViewingKey(const libzcash::ViewingKey &vk);
+    //! Adds a viewing key to the store, without saving it to disk (used by LoadWallet)
+    bool LoadViewingKey(const libzcash::ViewingKey &dest);
 
     /**
      * Increment the next transaction order id
@@ -1041,8 +1136,19 @@ public:
     void SetBroadcastTransactions(bool broadcast) { fBroadcastTransactions = broadcast; }
 
     /* Find notes filtered by payment address, min depth, ability to spend */
-    void GetFilteredNotes(std::vector<CNotePlaintextEntry> & outEntries, std::string address, int minDepth=1, bool ignoreSpent=true);
+    void GetFilteredNotes(std::vector<CNotePlaintextEntry> & outEntries,
+                          std::string address,
+                          int minDepth=1,
+                          bool ignoreSpent=true,
+                          bool ignoreUnspendable=true);
 
+    /* Find notes filtered by payment addresses, min depth, ability to spend */
+    void GetFilteredNotes(std::vector<CNotePlaintextEntry>& outEntries,
+                          std::set<libzcash::PaymentAddress>& filterAddresses,
+                          int minDepth=1,
+                          bool ignoreSpent=true,
+                          bool ignoreUnspendable=true);
+    
 };
 
 /** A key allocated from the key pool. */
@@ -1098,88 +1204,4 @@ public:
         READWRITE(vchPubKey);
     }
 };
-
-
-
-/**
- * Internal transfers.
- * Database key is acentry<account><counter>.
- */
-class CAccountingEntry
-{
-public:
-    std::string strAccount;
-    CAmount nCreditDebit;
-    int64_t nTime;
-    std::string strOtherAccount;
-    std::string strComment;
-    mapValue_t mapValue;
-    int64_t nOrderPos;  //! position in ordered transaction list
-    uint64_t nEntryNo;
-
-    CAccountingEntry()
-    {
-        SetNull();
-    }
-
-    void SetNull()
-    {
-        nCreditDebit = 0;
-        nTime = 0;
-        strAccount.clear();
-        strOtherAccount.clear();
-        strComment.clear();
-        nOrderPos = -1;
-        nEntryNo = 0;
-    }
-
-    ADD_SERIALIZE_METHODS;
-
-    template <typename Stream, typename Operation>
-    inline void SerializationOp(Stream& s, Operation ser_action, int nType, int nVersion) {
-        if (!(nType & SER_GETHASH))
-            READWRITE(nVersion);
-        //! Note: strAccount is serialized as part of the key, not here.
-        READWRITE(nCreditDebit);
-        READWRITE(nTime);
-        READWRITE(LIMITED_STRING(strOtherAccount, 65536));
-
-        if (!ser_action.ForRead())
-        {
-            WriteOrderPos(nOrderPos, mapValue);
-
-            if (!(mapValue.empty() && _ssExtra.empty()))
-            {
-                CDataStream ss(nType, nVersion);
-                ss.insert(ss.begin(), '\0');
-                ss << mapValue;
-                ss.insert(ss.end(), _ssExtra.begin(), _ssExtra.end());
-                strComment.append(ss.str());
-            }
-        }
-
-        READWRITE(LIMITED_STRING(strComment, 65536));
-
-        size_t nSepPos = strComment.find("\0", 0, 1);
-        if (ser_action.ForRead())
-        {
-            mapValue.clear();
-            if (std::string::npos != nSepPos)
-            {
-                CDataStream ss(std::vector<char>(strComment.begin() + nSepPos + 1, strComment.end()), nType, nVersion);
-                ss >> mapValue;
-                _ssExtra = std::vector<char>(ss.begin(), ss.end());
-            }
-            ReadOrderPos(nOrderPos, mapValue);
-        }
-        if (std::string::npos != nSepPos)
-            strComment.erase(nSepPos);
-
-        mapValue.erase("n");
-    }
-
-private:
-    std::vector<char> _ssExtra;
-};
-
 #endif // BITCOIN_WALLET_WALLET_H

src/wallet/wallet_ismine.cpp

@@ -71,6 +71,7 @@ isminetype IsMine(const CKeyStore &keystore, const CScript& scriptPubKey)
         }
         break;
     }
+
     case TX_MULTISIG:
     {
         // Only consider transactions "mine" if we own ALL the

src/wallet/walletdb.cpp

@@ -106,7 +106,7 @@ bool CWalletDB::WriteCryptedKey(const CPubKey& vchPubKey,
 }
 
 bool CWalletDB::WriteCryptedZKey(const libzcash::PaymentAddress & addr,
-                                 const libzcash::ViewingKey &vk,
+                                 const libzcash::ReceivingKey &rk,
                                  const std::vector<unsigned char>& vchCryptedSecret,
                                  const CKeyMetadata &keyMeta)
 {
@@ -116,7 +116,7 @@ bool CWalletDB::WriteCryptedZKey(const libzcash::PaymentAddress & addr,
     if (!Write(std::make_pair(std::string("zkeymeta"), addr), keyMeta))
         return false;
 
-    if (!Write(std::make_pair(std::string("czkey"), addr), std::make_pair(vk, vchCryptedSecret), false))
+    if (!Write(std::make_pair(std::string("czkey"), addr), std::make_pair(rk, vchCryptedSecret), false))
         return false;
     if (fEraseUnencryptedKey)
     {
@@ -142,6 +142,18 @@ bool CWalletDB::WriteZKey(const libzcash::PaymentAddress& addr, const libzcash::
     return Write(std::make_pair(std::string("zkey"), addr), key, false);
 }
 
+bool CWalletDB::WriteViewingKey(const libzcash::ViewingKey &vk)
+{
+    nWalletDBUpdated++;
+    return Write(std::make_pair(std::string("vkey"), vk), '1');
+}
+
+bool CWalletDB::EraseViewingKey(const libzcash::ViewingKey &vk)
+{
+    nWalletDBUpdated++;
+    return Erase(std::make_pair(std::string("vkey"), vk));
+}
+
 bool CWalletDB::WriteCScript(const uint160& hash, const CScript& redeemScript)
 {
     nWalletDBUpdated++;
@@ -471,6 +483,19 @@ ReadKeyValue(CWallet* pwallet, CDataStream& ssKey, CDataStream& ssValue,
             // so set the wallet birthday to the beginning of time.
             pwallet->nTimeFirstKey = 1;
         }
+        else if (strType == "vkey")
+        {
+            libzcash::ViewingKey vk;
+            ssKey >> vk;
+            char fYes;
+            ssValue >> fYes;
+            if (fYes == '1')
+                pwallet->LoadViewingKey(vk);
+
+            // Viewing keys have no birthday information for now,
+            // so set the wallet birthday to the beginning of time.
+            pwallet->nTimeFirstKey = 1;
+        }
         else if (strType == "zkey")
         {
             libzcash::PaymentAddress addr;
@@ -585,14 +610,14 @@ ReadKeyValue(CWallet* pwallet, CDataStream& ssKey, CDataStream& ssValue,
             libzcash::PaymentAddress addr;
             ssKey >> addr;
             // Deserialization of a pair is just one item after another
-            uint256 vkValue;
-            ssValue >> vkValue;
-            libzcash::ViewingKey vk(vkValue);
+            uint256 rkValue;
+            ssValue >> rkValue;
+            libzcash::ReceivingKey rk(rkValue);
             vector<unsigned char> vchCryptedSecret;
             ssValue >> vchCryptedSecret;
             wss.nCKeys++;
 
-            if (!pwallet->LoadCryptedZKey(addr, vk, vchCryptedSecret))
+            if (!pwallet->LoadCryptedZKey(addr, rk, vchCryptedSecret))
             {
                 strErr = "Error reading wallet database: LoadCryptedZKey failed";
                 return false;
@@ -694,6 +719,7 @@ static bool IsKeyType(string strType)
 {
     return (strType== "key" || strType == "wkey" ||
             strType == "zkey" || strType == "czkey" ||
+            strType == "vkey" ||
             strType == "mkey" || strType == "ckey");
 }
 
@@ -968,11 +994,7 @@ bool BackupWallet(const CWallet& wallet, const string& strDest)
                     pathDest /= wallet.strWalletFile;
 
                 try {
-#if BOOST_VERSION >= 104000
                     boost::filesystem::copy_file(pathSrc, pathDest, boost::filesystem::copy_option::overwrite_if_exists);
-#else
-                    boost::filesystem::copy_file(pathSrc, pathDest);
-#endif
                     LogPrintf("copied wallet.dat to %s\n", pathDest.string());
                     return true;
                 } catch (const boost::filesystem::filesystem_error& e) {

src/wallet/walletdb.h

@@ -136,10 +136,13 @@ public:
     /// Write spending key to wallet database, where key is payment address and value is spending key.
     bool WriteZKey(const libzcash::PaymentAddress& addr, const libzcash::SpendingKey& key, const CKeyMetadata &keyMeta);
     bool WriteCryptedZKey(const libzcash::PaymentAddress & addr,
-                          const libzcash::ViewingKey & vk,
+                          const libzcash::ReceivingKey & rk,
                           const std::vector<unsigned char>& vchCryptedSecret,
                           const CKeyMetadata &keyMeta);
 
+    bool WriteViewingKey(const libzcash::ViewingKey &vk);
+    bool EraseViewingKey(const libzcash::ViewingKey &vk);
+
 private:
     CWalletDB(const CWalletDB&);
     void operator=(const CWalletDB&);