From 8d0b7ed8c297b6aa0aa458e1c415d79f087efa01 Mon Sep 17 00:00:00 2001
From: Daira Hopwood
The key words "MUST", "MUST NOT", and "MAY" in this document are to be interpreted as described in RFC 2119. 1
-"Jubjub" refers to the elliptic curve defined in 15.
+The key words "MUST", "MUST NOT", "SHOULD", "SHOULD NOT", and "MAY" in this document are to be interpreted as described in RFC 2119. 1
+"Jubjub" refers to the elliptic curve defined in 16.
A "chain code" is a cryptovalue that is needed, in addition to a spending key, in order to derive descendant keys and addresses of that key.
The terms "Testnet" and "Mainnet" are to be interpreted as described in section 3.12 of the Zcash Protocol Specification 10.
The following algorithm standardized in 22 is used:
+The following algorithm standardized in 23 is used:
Let \(\mathcal{G}^\mathsf{Sapling}\) - be as defined in 14 and let + be as defined in 15 and let \(\mathcal{H}^\mathsf{Sapling}\) be as defined in 11.
@@ -809,12 +809,63 @@ \(2^{88}\) payment addresses (unlike Sapling, all Orchard diversifiers are valid).
A wallet that imports a master seed from an external source SHOULD attempt to discover accounts in the following manner.
+Let + \(M\) + be the subset of + \(\{ m_\mathsf{Sapling}, m_\mathsf{Orchard} \}\) + corresponding to master keys for address types that this wallet supports.
+If no transactions are found for either Sapling or Orchard at a given account index, break from the loop over + \(account\) + .
+If no transactions are found for a range of (Legacy address gap limit) consecutive addresses, break from the loop over + \(address\_index\) + .
+(The loop over + \(address\_index\) + finds legacy Sapling addresses generated by zcashd.)
+This algorithm is successful because wallets SHOULD disallow creation of new accounts if the previous one has no transaction history, as described in Key path levels above.
+Please note that the algorithm works with the transaction history, not account balances, so you can have an account with zero balance and the algorithm will still continue with discovery.
+The RECOMMENDED address gap limit for legacy Sapling addresses is 20. If a wallet hits this number of unused addresses in a row, it expects there to be no used addresses beyond this point and SHOULD stop searching the legacy Sapling address chain. We scan just the external chains, because internal chains receive only coins that come from the associated external chains.
+Wallet software should warn when the user is trying to exceed the gap limit on an external chain by generating a new address.
+