dashpay · QuantumExplorer · Jul 6, 2026 · Jun 15, 2026 · Jun 15, 2026 · Jun 15, 2026
diff --git a/docs/dashpay/research/01-dip-spec.md b/docs/dashpay/research/01-dip-spec.md
diff --git a/docs/dashpay/research/02-rust-dashcore-keywallet.md b/docs/dashpay/research/02-rust-dashcore-keywallet.md
diff --git a/docs/dashpay/research/03-rs-platform-wallet.md b/docs/dashpay/research/03-rs-platform-wallet.md
diff --git a/docs/dashpay/research/04-sdk-and-contract.md b/docs/dashpay/research/04-sdk-and-contract.md
diff --git a/docs/dashpay/research/05-swift-app.md b/docs/dashpay/research/05-swift-app.md
diff --git a/docs/dashpay/research/06-interop-desk-check.md b/docs/dashpay/research/06-interop-desk-check.md
@@ -15,3 +15,6 @@ thiserror = "1.0"
 
 [dev-dependencies]
 hex = "0.4"
+# Tests use secp256k1's RNG helpers (`generate_keypair`, `secp256k1::rand`),
+# which are only available when dashcore's `rand` feature is enabled.
+dashcore = { workspace = true, features = ["rand"] }
@@ -10,6 +10,16 @@ use dashcore::secp256k1::{PublicKey, SecretKey};
 type Aes256CbcEnc = cbc::Encryptor<Aes256>;
 type Aes256CbcDec = cbc::Decryptor<Aes256>;
 
+/// Length of the DIP-15 compact extended-public-key plaintext, in bytes.
+///
+/// `parentFingerprint(4) ‖ chainCode(32) ‖ publicKey(33)` = 69 bytes. This is
+/// the plaintext layout DIP-15 specifies for `encryptedPublicKey` and the form
+/// both reference clients (iOS dash-shared-core, Android dashj) emit and
+/// hard-check on receive. Encrypting exactly 69 bytes yields a 96-byte
+/// ciphertext (16-byte IV + 80-byte AES-256-CBC/PKCS7 block), matching the
+/// deployed contract's `minItems/maxItems: 96`.
+pub const COMPACT_XPUB_LEN: usize = 69;
+
 /// Derive a shared secret key using ECDH as specified in DIP-15
 ///
 /// This uses libsecp256k1_ecdh which computes: SHA256((y[31]&0x1|0x2) || x)
@@ -127,6 +137,66 @@ pub fn decrypt_extended_public_key(
     decrypt_aes_256_cbc(shared_key, &iv, ciphertext)
 }
 
+/// Assemble the DIP-15 compact extended-public-key plaintext.
+///
+/// Concatenates `parent_fingerprint ‖ chain_code ‖ pubkey` into the 69-byte
+/// compact form that DIP-15 defines for `encryptedPublicKey` (and that both
+/// reference clients emit). This is the plaintext that should be fed to
+/// [`encrypt_extended_public_key`] — *not* a BIP32/DIP-14 serialization, which
+/// carries extra version/depth/child-number metadata the wire format omits.
+///
+/// # Arguments
+/// * `parent_fingerprint` - 4-byte fingerprint of the parent key.
+/// * `chain_code` - 32-byte chain code of the shared (account) key.
+/// * `pubkey` - 33-byte compressed secp256k1 public key.
+///
+/// # Returns
+/// The 69-byte compact plaintext.
+pub fn compact_xpub_bytes(
+    parent_fingerprint: [u8; 4],
+    chain_code: [u8; 32],
+    pubkey: [u8; 33],
+) -> [u8; COMPACT_XPUB_LEN] {
+    let mut out = [0u8; COMPACT_XPUB_LEN];
+    out[0..4].copy_from_slice(&parent_fingerprint);
+    out[4..36].copy_from_slice(&chain_code);
+    out[36..69].copy_from_slice(&pubkey);
+    out
+}
+
+/// Parse a DIP-15 compact extended-public-key plaintext back into its
+/// three components.
+///
+/// Inverse of [`compact_xpub_bytes`]. Rejects any input whose length is not
+/// exactly [`COMPACT_XPUB_LEN`] (69) bytes — the reference clients hard-check
+/// this on receive, so a non-69-byte payload is not a valid DIP-15 compact
+/// xpub and must be handled separately (e.g. a legacy 78/107-byte BIP32/DIP-14
+/// serialization) by the caller.
+///
+/// # Arguments
+/// * `bytes` - The decrypted plaintext (must be exactly 69 bytes).
+///
+/// # Returns
+/// `(parent_fingerprint, chain_code, pubkey)` on success.
+///
+/// # Errors
+/// [`CryptoError::InvalidCompactXpubLength`] if `bytes.len() != 69`.
+#[allow(clippy::type_complexity)]
+pub fn parse_compact_xpub(bytes: &[u8]) -> Result<([u8; 4], [u8; 32], [u8; 33]), CryptoError> {
+    if bytes.len() != COMPACT_XPUB_LEN {
+        return Err(CryptoError::InvalidCompactXpubLength(bytes.len()));
+    }
+
+    let mut parent_fingerprint = [0u8; 4];
+    let mut chain_code = [0u8; 32];
+    let mut pubkey = [0u8; 33];
+    parent_fingerprint.copy_from_slice(&bytes[0..4]);
+    chain_code.copy_from_slice(&bytes[4..36]);
+    pubkey.copy_from_slice(&bytes[36..69]);
+
+    Ok((parent_fingerprint, chain_code, pubkey))
+}
+
 /// Encrypt an account label for DashPay (DIP-15)
 ///
 /// # Arguments
@@ -181,6 +251,9 @@ pub enum CryptoError {
 
     #[error("Invalid ciphertext length (must be at least 16 bytes for IV)")]
     InvalidCiphertextLength,
+
+    #[error("Invalid compact xpub length (DIP-15 requires exactly 69 bytes, got {0})")]
+    InvalidCompactXpubLength(usize),
 }
 
 #[cfg(test)]
@@ -232,8 +305,9 @@ mod tests {
         let mut iv = [0u8; 16];
         thread_rng().fill_bytes(&mut iv);
 
-        // Mock extended public key data (78 bytes)
-        let xpub_data = vec![0x04; 78];
+        // DIP-15 compact xpub plaintext (69 bytes). 69 → PKCS7 → 80, + 16-byte
+        // IV = exactly 96 bytes, matching the contract's minItems/maxItems: 96.
+        let xpub_data = vec![0x04; COMPACT_XPUB_LEN];
 
         // Encrypt and decrypt
         let encrypted = encrypt_extended_public_key(&shared_key, &iv, &xpub_data);
@@ -246,6 +320,66 @@ mod tests {
         assert_eq!(xpub_data, decrypted);
     }
 
+    #[test]
+    fn test_compact_xpub_round_trip() {
+        // Distinct byte patterns per field so a mis-sliced offset is caught.
+        let parent_fingerprint = [0x11u8, 0x22, 0x33, 0x44];
+        let chain_code = [0xAAu8; 32];
+        let mut pubkey = [0xBBu8; 33];
+        pubkey[0] = 0x02; // compressed-pubkey prefix
+
+        let compact = compact_xpub_bytes(parent_fingerprint, chain_code, pubkey);
+        assert_eq!(compact.len(), COMPACT_XPUB_LEN);
+        assert_eq!(compact.len(), 69);
+
+        // Byte-exact layout: fingerprint ‖ chaincode ‖ pubkey.
+        assert_eq!(&compact[0..4], &parent_fingerprint);
+        assert_eq!(&compact[4..36], &chain_code);
+        assert_eq!(&compact[36..69], &pubkey);
+
+        let (fp, cc, pk) = parse_compact_xpub(&compact).expect("parse 69-byte compact");
+        assert_eq!(fp, parent_fingerprint);
+        assert_eq!(cc, chain_code);
+        assert_eq!(pk, pubkey);
+    }
+
+    #[test]
+    fn test_encrypt_compact_xpub_is_exactly_96_bytes() {
+        // The whole point of the 69-byte compact form: it encrypts to exactly
+        // 96 bytes (16-byte IV + 80-byte AES-256-CBC/PKCS7), which is what the
+        // deployed contract enforces. A 107-byte DIP-14 serialization would
+        // yield 128 bytes and fail the contract's maxItems: 96.
+        let shared_key = [0x07u8; 32];
+        let iv = [0x09u8; 16];
+        let plaintext = [0xCDu8; COMPACT_XPUB_LEN];
+
+        let encrypted = encrypt_extended_public_key(&shared_key, &iv, &plaintext);
+        assert_eq!(
+            encrypted.len(),
+            96,
+            "69-byte compact plaintext must encrypt to exactly 96 bytes"
+        );
+
+        let decrypted = decrypt_extended_public_key(&shared_key, &encrypted).unwrap();
+        assert_eq!(&decrypted[..], &plaintext[..]);
+    }
+
+    #[test]
+    fn test_parse_compact_xpub_rejects_wrong_length() {
+        // Lengths that are NOT 69 must be rejected — including the legacy 78/107
+        // BIP32/DIP-14 serializations and the empty case.
+        for bad_len in [0usize, 36, 68, 70, 78, 107, 128] {
+            let bytes = vec![0u8; bad_len];
+            let err = parse_compact_xpub(&bytes).expect_err("non-69-byte input must be rejected");
+            assert!(
+                matches!(err, CryptoError::InvalidCompactXpubLength(n) if n == bad_len),
+                "expected InvalidCompactXpubLength({}), got {:?}",
+                bad_len,
+                err
+            );
+        }
+    }
+
     #[test]
     fn test_account_label_encryption() {
         let secp = Secp256k1::new();

@@ -216,6 +216,28 @@ pub unsafe extern "C" fn established_contact_is_hidden(
     PlatformWalletFFIResult::ok()
 }
 
+/// Check whether an established contact's DashPay payment channel is
+/// permanently broken (G1c).
+///
+/// `true` means the account-building sweep hit a permanent failure
+/// (decrypt/decode of the counterparty xpub, or a key-index validation
+/// failure) and stopped retrying. The UI should disable "Send Dash" and
+/// surface "Payment channel broken — ask the contact to send a new
+/// request"; the flag clears automatically when a superseding contact
+/// request (re-)establishes the relationship.
+#[no_mangle]
+pub unsafe extern "C" fn established_contact_is_payment_channel_broken(
+    contact_handle: Handle,
+    out_is_broken: *mut bool,
+) -> PlatformWalletFFIResult {
+    check_ptr!(out_is_broken);
+
+    let option = ESTABLISHED_CONTACT_STORAGE
+        .with_item(contact_handle, |contact| contact.payment_channel_broken);
+    *out_is_broken = unwrap_option_or_return!(option);
+    PlatformWalletFFIResult::ok()
+}
+
 /// Hide an established contact from the contact list
 #[no_mangle]
 pub unsafe extern "C" fn established_contact_hide(

@@ -186,11 +186,31 @@ CREATE TABLE contacts (
     note TEXT,
     is_hidden INTEGER,
     accepted_accounts BLOB,
+    payment_channel_broken INTEGER,
     updated_at INTEGER NOT NULL DEFAULT (unixepoch()),
     PRIMARY KEY (wallet_id, owner_id, contact_id),
     FOREIGN KEY (wallet_id) REFERENCES wallet_metadata(wallet_id) ON DELETE CASCADE
 );
 
+-- Rejected-request tombstone (G5 stage 1). Keyed by
+-- `(wallet_id, owner_id, sender_id, account_reference)` — NOT bare
+-- sender id — so a once-rejected sender can still re-request via a
+-- bumped accountReference (the DIP-15 rotation mechanism), while a
+-- replay of the exact same immutable request stays suppressed. The
+-- optional `document_id` records the rejected document's id for audit /
+-- exact-match suppression. The sync ingest path consults this table
+-- before re-ingesting a received contactRequest.
+CREATE TABLE rejected_contact_requests (
+    wallet_id BLOB NOT NULL,
+    owner_id BLOB NOT NULL,
+    sender_id BLOB NOT NULL,
+    account_reference INTEGER NOT NULL,
+    document_id BLOB,
+    rejected_at INTEGER NOT NULL DEFAULT (unixepoch()),
+    PRIMARY KEY (wallet_id, owner_id, sender_id, account_reference),
+    FOREIGN KEY (wallet_id) REFERENCES wallet_metadata(wallet_id) ON DELETE CASCADE
+);
+
 CREATE TABLE platform_addresses (
     wallet_id BLOB NOT NULL,
     account_index INTEGER NOT NULL,

@@ -199,16 +199,17 @@ pub fn apply(
         let mut stmt = tx.prepare_cached(
             "INSERT INTO contacts \
                 (wallet_id, owner_id, contact_id, state, outgoing_request, incoming_request, \
-                 alias, note, is_hidden, accepted_accounts) \
-             VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, ?10) \
+                 alias, note, is_hidden, accepted_accounts, payment_channel_broken) \
+             VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, ?10, ?11) \
              ON CONFLICT(wallet_id, owner_id, contact_id) DO UPDATE SET \
                 state = excluded.state, \
                 outgoing_request = excluded.outgoing_request, \
                 incoming_request = excluded.incoming_request, \
                 alias = excluded.alias, \
                 note = excluded.note, \
                 is_hidden = excluded.is_hidden, \
-                accepted_accounts = excluded.accepted_accounts",
+                accepted_accounts = excluded.accepted_accounts, \
+                payment_channel_broken = excluded.payment_channel_broken",
         )?;
         for (key, established) in &cs.established {
             let outgoing = blob::encode(&established.outgoing_request)?;
@@ -225,6 +226,30 @@ pub fn apply(
                 established.note,
                 established.is_hidden as i64,
                 accepted,
+                established.payment_channel_broken as i64,
+            ])?;
+        }
+    }
+    if !cs.rejected.is_empty() {
+        // Rejected-request tombstone (G5 stage 1). Keyed by the rejected
+        // document id OR `(sender, accountReference)` — NEVER bare sender
+        // id — so a rotation request (bumped accountReference) from a
+        // once-rejected sender is NOT silently blocked. The sync ingest
+        // path consults this table before re-ingesting a received request.
+        let mut stmt = tx.prepare_cached(
+            "INSERT INTO rejected_contact_requests \
+                (wallet_id, owner_id, sender_id, account_reference, document_id) \
+             VALUES (?1, ?2, ?3, ?4, ?5) \
+             ON CONFLICT(wallet_id, owner_id, sender_id, account_reference) DO UPDATE SET \
+                document_id = excluded.document_id",
+        )?;
+        for entry in cs.rejected.values() {
+            stmt.execute(params![
+                wallet_id.as_slice(),
+                entry.owner_id.as_slice(),
+                entry.sender_id.as_slice(),
+                entry.account_reference as i64,
+                entry.document_id.as_ref().map(|d| d.as_slice()),
             ])?;
         }
     }
@@ -245,7 +270,7 @@ pub(crate) fn load_state(
 
     let mut stmt = conn.prepare(
         "SELECT owner_id, contact_id, state, outgoing_request, incoming_request, \
-                alias, note, is_hidden, accepted_accounts \
+                alias, note, is_hidden, accepted_accounts, payment_channel_broken \
          FROM contacts WHERE wallet_id = ?1",
     )?;
     let mut rows = stmt.query(params![wallet_id.as_slice()])?;
@@ -289,6 +314,7 @@ pub(crate) fn load_state(
                     Some(bytes) => blob::decode(&bytes)?,
                     None => Vec::new(),
                 };
+                let payment_channel_broken: bool = row.get::<_, Option<i64>>(9)?.unwrap_or(0) != 0;
                 state.established.insert(
                     SentContactRequestKey {
                         owner_id,
@@ -302,6 +328,7 @@ pub(crate) fn load_state(
                         note,
                         is_hidden,
                         accepted_accounts,
+                        payment_channel_broken,
                     },
                 );
             }

@@ -211,6 +211,7 @@ fn managed_identity_from_entry(
         established_contacts: Default::default(),
         sent_contact_requests: Default::default(),
         incoming_contact_requests: Default::default(),
+        rejected_contact_requests: Default::default(),
         status: entry.status,
         dpns_names: entry.dpns_names.clone(),
         contested_dpns_names: entry.contested_dpns_names.clone(),

@@ -531,7 +531,7 @@ fn contacts_round_trip(
 
 /// A fully-populated [`EstablishedContact`] so the round-trip exercises
 /// every metadata column (`alias`, `note`, `is_hidden`,
-/// `accepted_accounts`) plus both request blobs.
+/// `accepted_accounts`, `payment_channel_broken`) plus both request blobs.
 fn established_contact(owner: u8, contact: u8) -> EstablishedContact {
     EstablishedContact {
         contact_identity_id: Identifier::from([contact; 32]),
@@ -541,6 +541,9 @@ fn established_contact(owner: u8, contact: u8) -> EstablishedContact {
         note: Some("met at conf".to_string()),
         is_hidden: true,
         accepted_accounts: vec![1, 7, 42],
+        // Non-default so the round-trip test pins the new
+        // `payment_channel_broken` column through write + read.
+        payment_channel_broken: true,
     }
 }