From b940e4c89779d0b324984989ca7adc1fecb8fc5a Mon Sep 17 00:00:00 2001
From: 42Pupusas <technology@illuminodes.com>
Date: Fri, 31 Jul 2026 15:54:17 -0600
Subject: [PATCH 01/12] common: add silent payment boundary types (BIP-352)

Derivation coordinates (SilentPaymentAccount), scan-only material with no path to b_spend (SilentPaymentScanMaterial), and the PSET proprietary-key metadata a wallet attaches for a signer (SilentPaymentInputMeta), behind a new silentpayments feature. Living in lwk_common lets wallet and signer share the boundary without depending on each other.
---
 lwk_common/Cargo.toml            |   6 +
 lwk_common/src/lib.rs            |   3 +
 lwk_common/src/silentpayments.rs | 411 +++++++++++++++++++++++++++++++
 3 files changed, 420 insertions(+)
 create mode 100644 lwk_common/src/silentpayments.rs

diff --git a/lwk_common/Cargo.toml b/lwk_common/Cargo.toml
index 7a696a555..d868f6430 100644
--- a/lwk_common/Cargo.toml
+++ b/lwk_common/Cargo.toml
@@ -24,6 +24,12 @@ serde_json.workspace = true
 default = ["amp0"]
 amp0 = []
 sqlite = ["rusqlite"]
+# Silent Payments (BIP-352) boundary types shared between `lwk_wollet` (the
+# wallet/scan side) and `lwk_signer` (the signing side). Living here rather than in
+# either crate is what lets a wallet depend on the shared types without depending on
+# a signer, and vice versa — see `SilentPaymentScanMaterial`'s docs for why that
+# split matters.
+silentpayments = []
 
 [target.'cfg(not(target_arch = "wasm32"))'.dependencies]
 rusqlite = { version = "0.32", optional = true, features = ["bundled"] }
diff --git a/lwk_common/src/lib.rs b/lwk_common/src/lib.rs
index c0fede67e..40d0a619f 100644
--- a/lwk_common/src/lib.rs
+++ b/lwk_common/src/lib.rs
@@ -25,6 +25,9 @@ mod pset;
 mod qr;
 mod segwit;
 mod signer;
+#[cfg(feature = "silentpayments")]
+#[cfg_attr(docsrs, doc(cfg(feature = "silentpayments")))]
+pub mod silentpayments;
 #[cfg(all(feature = "sqlite", not(target_arch = "wasm32")))]
 pub mod sqlite;
 mod store;
diff --git a/lwk_common/src/silentpayments.rs b/lwk_common/src/silentpayments.rs
new file mode 100644
index 000000000..a7a72a446
--- /dev/null
+++ b/lwk_common/src/silentpayments.rs
@@ -0,0 +1,411 @@
+//! Shared Liquid silent-payment boundary types.
+
+use elements_miniscript::elements::bitcoin::bip32::{ChildNumber, DerivationPath};
+use elements_miniscript::elements::bitcoin::secp256k1::{PublicKey, Scalar, SecretKey};
+use elements_miniscript::elements::pset::raw::ProprietaryKey;
+use elements_miniscript::elements::pset::Input as PsetInput;
+
+use crate::Signer;
+
+const PURPOSE: u32 = 352;
+
+const COIN_TYPE_LIQUID_MAINNET: u32 = 1776;
+
+const COIN_TYPE_LIQUID_TESTNET: u32 = 1;
+
+const HARDENED_THRESHOLD: u32 = 0x8000_0000;
+
+/// Errors for invalid hardened account coordinates.
+#[derive(thiserror::Error, Debug, Clone, Copy, PartialEq, Eq)]
+pub enum SilentPaymentAccountError {
+    /// The coin type has bit 31 set, so `coin_type'` is not a valid BIP-32 index.
+    #[error("silent payment coin type {0} cannot be hardened (must be < 2^31)")]
+    CoinTypeNotHardenable(u32),
+
+    /// The account index has bit 31 set, so `account'` is not a valid BIP-32 index.
+    #[error("silent payment account {0} cannot be hardened (must be < 2^31)")]
+    AccountNotHardenable(u32),
+}
+
+/// Silent-payment key derivation coordinates.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
+pub struct SilentPaymentAccount {
+    coin_type: u32,
+    account: u32,
+}
+
+impl SilentPaymentAccount {
+    /// The account for Liquid mainnet at index `account`.
+    pub fn liquid_mainnet(account: u32) -> Self {
+        SilentPaymentAccount {
+            coin_type: COIN_TYPE_LIQUID_MAINNET,
+            account,
+        }
+    }
+
+    /// The account for Liquid testnet/regtest at index `account`.
+    pub fn liquid_testnet(account: u32) -> Self {
+        SilentPaymentAccount {
+            coin_type: COIN_TYPE_LIQUID_TESTNET,
+            account,
+        }
+    }
+
+    /// Builds an account from a coin type and account index.
+    pub fn from_raw(coin_type: u32, account: u32) -> Result<Self, SilentPaymentAccountError> {
+        if coin_type >= HARDENED_THRESHOLD {
+            return Err(SilentPaymentAccountError::CoinTypeNotHardenable(coin_type));
+        }
+        if account >= HARDENED_THRESHOLD {
+            return Err(SilentPaymentAccountError::AccountNotHardenable(account));
+        }
+        Ok(SilentPaymentAccount { coin_type, account })
+    }
+
+    /// The SLIP-44 coin type this account uses.
+    pub fn coin_type(&self) -> u32 {
+        self.coin_type
+    }
+
+    /// The account index.
+    pub fn account(&self) -> u32 {
+        self.account
+    }
+
+    /// Scan-key path: `m/352'/<coin>'/<account>'/1'/0`.
+    pub fn scan_path(&self) -> DerivationPath {
+        self.path_at(1)
+    }
+
+    /// Spend-key path: `m/352'/<coin>'/<account>'/0'/0`.
+    pub fn spend_path(&self) -> DerivationPath {
+        self.path_at(0)
+    }
+
+    fn path_at(&self, change: u32) -> DerivationPath {
+        DerivationPath::from(vec![
+            ChildNumber::from_hardened_idx(PURPOSE).expect("352 < 2^31"),
+            ChildNumber::from_hardened_idx(self.coin_type).expect("checked < 2^31 at construction"),
+            ChildNumber::from_hardened_idx(self.account).expect("checked < 2^31 at construction"),
+            ChildNumber::from_hardened_idx(change).expect("0 or 1"),
+            ChildNumber::from_normal_idx(0).expect("0 is always a valid normal index"),
+        ])
+    }
+}
+
+/// Scan-only material exported by a signer.
+#[derive(Debug, Clone, Copy)]
+pub struct SilentPaymentScanMaterial {
+    account: SilentPaymentAccount,
+    scan_seckey: SecretKey,
+    spend_pubkey: PublicKey,
+}
+
+impl SilentPaymentScanMaterial {
+    /// Which BIP-352 account this material was derived for.
+    pub fn account(&self) -> SilentPaymentAccount {
+        self.account
+    }
+
+    /// `b_scan` — the scan secret, for the ECDH shared secret and label tweaks.
+    pub fn scan_seckey(&self) -> SecretKey {
+        self.scan_seckey
+    }
+
+    /// `B_spend = b_spend·G` — the public base point outputs are tweaked from.
+    pub fn spend_pubkey(&self) -> PublicKey {
+        self.spend_pubkey
+    }
+
+    /// Scan public key.
+    pub fn scan_pubkey<C: elements_miniscript::elements::bitcoin::secp256k1::Signing>(
+        &self,
+        secp: &elements_miniscript::elements::bitcoin::secp256k1::Secp256k1<C>,
+    ) -> PublicKey {
+        self.scan_seckey.public_key(secp)
+    }
+    /// Assemble scan material for `account`.
+    pub fn new(
+        account: SilentPaymentAccount,
+        scan_seckey: SecretKey,
+        spend_pubkey: PublicKey,
+    ) -> Self {
+        SilentPaymentScanMaterial {
+            account,
+            scan_seckey,
+            spend_pubkey,
+        }
+    }
+
+    /// PSET metadata for an output's spend tweak.
+    pub fn input_meta(&self, spend_tweak: Scalar) -> SilentPaymentInputMeta {
+        SilentPaymentInputMeta {
+            account: self.account,
+            spend_tweak,
+            expected_spend_pubkey: self.spend_pubkey,
+        }
+    }
+}
+
+/// Silent-payment PSET metadata.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct SilentPaymentInputMeta {
+    account: SilentPaymentAccount,
+    spend_tweak: Scalar,
+    expected_spend_pubkey: PublicKey,
+}
+
+/// Silent-payment operations offered by a signer.
+pub trait SilentPaymentSigner: Signer {
+    /// Export scan material for `account`.
+    fn silent_payment_scan_material(
+        &self,
+        account: SilentPaymentAccount,
+    ) -> Result<SilentPaymentScanMaterial, Self::Error>;
+}
+
+/// Errors reading silent-payment PSET metadata.
+#[derive(thiserror::Error, Debug, Clone, Copy, PartialEq, Eq)]
+pub enum SilentPaymentPsetMetaError {
+    /// The proprietary key/value for silent payments was not present on this input.
+    #[error("input carries no silent payment metadata")]
+    Missing,
+
+    /// The value was present but not the expected byte layout.
+    #[error("silent payment metadata is malformed")]
+    Malformed,
+
+    /// The blob parsed, but named account coordinates that cannot be derived.
+    #[error("silent payment metadata names an underivable account: {0}")]
+    Account(#[from] SilentPaymentAccountError),
+}
+
+impl SilentPaymentInputMeta {
+    /// Which account's `b_spend` this input's tweak is relative to.
+    pub fn account(&self) -> SilentPaymentAccount {
+        self.account
+    }
+
+    /// The scalar that turns the account's `b_spend` into this output's spend key.
+    pub fn spend_tweak(&self) -> Scalar {
+        self.spend_tweak
+    }
+
+    /// The `B_spend` the wallet says it derived this tweak from.
+    pub fn expected_spend_pubkey(&self) -> PublicKey {
+        self.expected_spend_pubkey
+    }
+
+    /// Proprietary-key prefix for silent-payment metadata.
+    const PROPRIETARY_PREFIX: &'static [u8] = b"lwk_sp";
+
+    /// Proprietary-key subtype for this input metadata blob.
+    const SUBTYPE: u8 = 0x01;
+
+    /// Encodes `coin_type || account || spend_tweak || expected_spend_pubkey`.
+    fn to_bytes(self) -> Vec<u8> {
+        let mut out = Vec::with_capacity(4 + 4 + 32 + 33);
+        out.extend_from_slice(&self.account.coin_type.to_le_bytes());
+        out.extend_from_slice(&self.account.account.to_le_bytes());
+        out.extend_from_slice(&self.spend_tweak.to_be_bytes());
+        out.extend_from_slice(&self.expected_spend_pubkey.serialize());
+        out
+    }
+
+    fn from_bytes(bytes: &[u8]) -> Result<Self, SilentPaymentPsetMetaError> {
+        if bytes.len() != 4 + 4 + 32 + 33 {
+            return Err(SilentPaymentPsetMetaError::Malformed);
+        }
+        let coin_type = u32::from_le_bytes(bytes[0..4].try_into().expect("checked len"));
+        let account = u32::from_le_bytes(bytes[4..8].try_into().expect("checked len"));
+        let spend_tweak = Scalar::from_be_bytes(bytes[8..40].try_into().expect("checked len"))
+            .map_err(|_| SilentPaymentPsetMetaError::Malformed)?;
+        let expected_spend_pubkey = PublicKey::from_slice(&bytes[40..73])
+            .map_err(|_| SilentPaymentPsetMetaError::Malformed)?;
+        Ok(SilentPaymentInputMeta {
+            account: SilentPaymentAccount::from_raw(coin_type, account)?,
+            spend_tweak,
+            expected_spend_pubkey,
+        })
+    }
+
+    /// Builds the proprietary key without using the reserved `pset` prefix.
+    fn proprietary_key() -> ProprietaryKey {
+        ProprietaryKey {
+            prefix: Self::PROPRIETARY_PREFIX.to_vec(),
+            subtype: Self::SUBTYPE,
+            key: vec![],
+        }
+    }
+
+    /// Attach this metadata to a PSET input.
+    ///
+    /// Overwrites any silent-payment metadata already present on the input.
+    pub fn attach(self, input: &mut PsetInput) {
+        input
+            .proprietary
+            .insert(Self::proprietary_key(), self.to_bytes());
+    }
+
+    /// Read silent-payment metadata back out of a PSET input, if present.
+    pub fn read(input: &PsetInput) -> Result<Self, SilentPaymentPsetMetaError> {
+        let bytes = input
+            .proprietary
+            .get(&Self::proprietary_key())
+            .ok_or(SilentPaymentPsetMetaError::Missing)?;
+        Self::from_bytes(bytes)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use elements_miniscript::elements::pset::PartiallySignedTransaction;
+    use std::str::FromStr;
+
+    fn sk(byte: u8) -> SecretKey {
+        SecretKey::from_slice(&[byte; 32]).unwrap()
+    }
+
+    #[test]
+    fn account_paths_follow_elip_convention() {
+        let account = SilentPaymentAccount::liquid_mainnet(0);
+        assert_eq!(
+            account.scan_path(),
+            DerivationPath::from_str("m/352'/1776'/0'/1'/0").unwrap()
+        );
+        assert_eq!(
+            account.spend_path(),
+            DerivationPath::from_str("m/352'/1776'/0'/0'/0").unwrap()
+        );
+
+        let testnet = SilentPaymentAccount::liquid_testnet(3);
+        assert_eq!(
+            testnet.scan_path(),
+            DerivationPath::from_str("m/352'/1'/3'/1'/0").unwrap()
+        );
+        assert_eq!(
+            testnet.spend_path(),
+            DerivationPath::from_str("m/352'/1'/3'/0'/0").unwrap()
+        );
+    }
+
+    #[test]
+    fn un_hardenable_account_coordinates_are_refused() {
+        for bad in [HARDENED_THRESHOLD, HARDENED_THRESHOLD + 1, u32::MAX] {
+            assert_eq!(
+                SilentPaymentAccount::from_raw(bad, 0),
+                Err(SilentPaymentAccountError::CoinTypeNotHardenable(bad))
+            );
+            assert_eq!(
+                SilentPaymentAccount::from_raw(1, bad),
+                Err(SilentPaymentAccountError::AccountNotHardenable(bad))
+            );
+        }
+
+        let edge = SilentPaymentAccount::from_raw(HARDENED_THRESHOLD - 1, HARDENED_THRESHOLD - 1)
+            .expect("2^31 - 1 is a valid hardened index");
+        let _ = edge.scan_path();
+        let _ = edge.spend_path();
+    }
+
+    #[test]
+    fn a_crafted_pset_naming_an_underivable_account_errors_instead_of_panicking() {
+        let secp = elements_miniscript::elements::secp256k1_zkp::Secp256k1::new();
+        let honest = SilentPaymentInputMeta {
+            account: SilentPaymentAccount::liquid_testnet(0),
+            spend_tweak: Scalar::from_be_bytes(sk(0x11).secret_bytes()).unwrap(),
+            expected_spend_pubkey: sk(0x22).public_key(&secp),
+        };
+        let mut input = PsetInput::default();
+        honest.attach(&mut input);
+
+        let key = SilentPaymentInputMeta::proprietary_key();
+        for (offset, expected) in [
+            (
+                0,
+                SilentPaymentAccountError::CoinTypeNotHardenable(u32::MAX),
+            ),
+            (4, SilentPaymentAccountError::AccountNotHardenable(u32::MAX)),
+        ] {
+            let mut bytes = honest.to_bytes();
+            bytes[offset..offset + 4].copy_from_slice(&u32::MAX.to_le_bytes());
+            input.proprietary.insert(key.clone(), bytes);
+
+            assert_eq!(
+                SilentPaymentInputMeta::read(&input),
+                Err(SilentPaymentPsetMetaError::Account(expected)),
+                "crafted coordinates at offset {offset} must be rejected, not derived"
+            );
+        }
+    }
+
+    #[test]
+    fn input_meta_roundtrips_through_a_pset_input() {
+        let secp = elements_miniscript::elements::secp256k1_zkp::Secp256k1::new();
+        let meta = SilentPaymentInputMeta {
+            account: SilentPaymentAccount::liquid_mainnet(1),
+            spend_tweak: Scalar::from_be_bytes(sk(0x42).secret_bytes()).unwrap(),
+            expected_spend_pubkey: sk(0x24).public_key(&secp),
+        };
+
+        let mut input = PsetInput::default();
+        assert_eq!(
+            SilentPaymentInputMeta::read(&input),
+            Err(SilentPaymentPsetMetaError::Missing)
+        );
+
+        meta.attach(&mut input);
+        assert_eq!(SilentPaymentInputMeta::read(&input), Ok(meta));
+    }
+
+    #[test]
+    fn metadata_survives_a_pset_serialization_roundtrip() {
+        use elements_miniscript::elements::encode::{deserialize, serialize};
+        use elements_miniscript::elements::OutPoint;
+
+        let secp = elements_miniscript::elements::secp256k1_zkp::Secp256k1::new();
+        let meta = SilentPaymentInputMeta {
+            account: SilentPaymentAccount::liquid_testnet(2),
+            spend_tweak: Scalar::from_be_bytes(sk(0x42).secret_bytes()).unwrap(),
+            expected_spend_pubkey: sk(0x24).public_key(&secp),
+        };
+
+        let mut pset = PartiallySignedTransaction::new_v2();
+        let mut input = PsetInput::from_prevout(OutPoint::default());
+        meta.attach(&mut input);
+        pset.add_input(input);
+
+        let bytes = serialize(&pset);
+        let decoded: PartiallySignedTransaction =
+            deserialize(&bytes).expect("a PSET carrying SP metadata must deserialize");
+
+        assert_eq!(
+            SilentPaymentInputMeta::read(&decoded.inputs()[0]),
+            Ok(meta),
+            "metadata must survive the round trip byte-for-byte"
+        );
+    }
+
+    #[test]
+    fn proprietary_key_uses_our_own_namespace() {
+        let key = SilentPaymentInputMeta::proprietary_key();
+        assert_eq!(key.prefix, SilentPaymentInputMeta::PROPRIETARY_PREFIX);
+        assert!(
+            !key.is_pset_key(),
+            "must not claim the reserved `pset` namespace"
+        );
+    }
+
+    #[test]
+    fn malformed_metadata_is_reported_not_panicked() {
+        let mut input = PsetInput::default();
+        input
+            .proprietary
+            .insert(SilentPaymentInputMeta::proprietary_key(), vec![0u8; 3]);
+        assert_eq!(
+            SilentPaymentInputMeta::read(&input),
+            Err(SilentPaymentPsetMetaError::Malformed)
+        );
+    }
+}

From fcc52849106e6f99170d1b7dcf94afd604c93e7a Mon Sep 17 00:00:00 2001
From: 42Pupusas <technology@illuminodes.com>
Date: Fri, 31 Jul 2026 15:55:26 -0600
Subject: [PATCH 02/12] signer: read the genesis hash from the PSET in
 sign_with_seckey

It was hardcoded to all-zeros. Correct by accident today: this function only reaches BIP-143 v0 sighashes, which never commit to the genesis hash. The regression test pins both facts so a future taproot path cannot silently inherit the wrong constant.
---
 lwk_signer/src/software.rs | 80 +++++++++++++++++++++++++++++++++++++-
 1 file changed, 79 insertions(+), 1 deletion(-)

diff --git a/lwk_signer/src/software.rs b/lwk_signer/src/software.rs
index 212ec8b4e..c8e2896d3 100644
--- a/lwk_signer/src/software.rs
+++ b/lwk_signer/src/software.rs
@@ -467,7 +467,8 @@ pub fn sign_with_seckey(
     let tx = pset.extract_tx()?;
     let mut sighash_cache = SighashCache::new(&tx);
     let mut signature_added = 0;
-    let genesis_hash = elements_miniscript::elements::BlockHash::all_zeros();
+    // Read the genesis hash from the PSET for ELIP-101 compatibility.
+    let genesis_hash = get_genesis_hash(pset);
     let mut messages = vec![];
     for i in 0..pset.inputs().len() {
         let msg = pset
@@ -585,6 +586,83 @@ mod tests {
         // bitcoin-cli verifymessage "1BZ9j3F7m4H1RPyeDp5iFwpR31SB6zrs19" "Hwlg40qLYZXEj9AoA3oZpfJMJPxaXzBL0+siHAJRhTIvSFiwSdtCsqxqB7TxgWfhqIr/YnGE4nagWzPchFJElTo=" 'Hello, world!'
     }
 
+    /// ECDSA signing reads the genesis hash from the PSET.
+    #[test]
+    fn sign_with_seckey_uses_the_psets_genesis_hash() {
+        use elements_miniscript::elements::pset::{Input, Output, PsbtSighashType};
+        use elements_miniscript::elements::{
+            confidential::{Asset, Value},
+            AssetId, OutPoint, Script, TxOut, Txid,
+        };
+
+        let secp = Secp256k1::new();
+        let seckey = bitcoin::secp256k1::SecretKey::from_slice(&[0x42; 32]).unwrap();
+        let pk = bitcoin::key::PublicKey::new(seckey.public_key(&secp));
+
+        let build = |network: lwk_common::Network| {
+            let wpkh = elements_miniscript::elements::WPubkeyHash::from_slice(
+                pk.wpubkey_hash().unwrap().as_byte_array(),
+            )
+            .unwrap();
+            let txout = TxOut {
+                asset: Asset::Explicit(AssetId::from_slice(&[0x42; 32]).unwrap()),
+                value: Value::Explicit(100_000),
+                nonce: Default::default(),
+                script_pubkey: Script::new_v0_wpkh(&wpkh),
+                witness: Default::default(),
+            };
+
+            let mut input =
+                Input::from_prevout(OutPoint::new(Txid::from_slice(&[0x99; 32]).unwrap(), 0));
+            input.witness_utxo = Some(txout.clone());
+            input.sighash_type = Some(PsbtSighashType::from_u32(EcdsaSighashType::All as u32));
+            input
+                .bip32_derivation
+                .insert(pk, (Fingerprint::default(), DerivationPath::master()));
+
+            let mut pset = PartiallySignedTransaction::new_v2();
+            lwk_common::set_genesis_hash(&mut pset, &network);
+            pset.add_input(input);
+            pset.add_output(Output::from_txout(TxOut {
+                script_pubkey: Script::new(),
+                ..txout
+            }));
+            pset
+        };
+
+        let mut pset = build(lwk_common::Network::TestnetLiquid);
+        assert_eq!(sign_with_seckey(seckey, &mut pset).unwrap(), 1);
+
+        let genesis_hash = get_genesis_hash(&pset);
+        assert_ne!(
+            genesis_hash,
+            elements_miniscript::elements::BlockHash::all_zeros(),
+            "fixture must carry a real genesis hash, or this proves nothing"
+        );
+        let tx = pset.extract_tx().unwrap();
+        let mut cache = SighashCache::new(&tx);
+        let msg = pset
+            .sighash_msg(0, &mut cache, None, genesis_hash)
+            .unwrap()
+            .to_secp_msg();
+
+        let stored = pset.inputs()[0].partial_sigs.get(&pk).unwrap().clone();
+        let (_, der) = stored.split_last().unwrap();
+        let sig = bitcoin::secp256k1::ecdsa::Signature::from_der(der).unwrap();
+        secp.verify_ecdsa(&msg, &sig, &seckey.public_key(&secp))
+            .expect("signature must verify under the PSET's own genesis hash");
+
+        // BIP-143 does not commit to the genesis hash.
+        let mut mainnet = build(lwk_common::Network::Liquid);
+        assert_eq!(sign_with_seckey(seckey, &mut mainnet).unwrap(), 1);
+        assert_eq!(
+            pset.inputs()[0].partial_sigs.get(&pk).unwrap(),
+            mainnet.inputs()[0].partial_sigs.get(&pk).unwrap(),
+            "BIP-143 v0 sighashes do not commit to the genesis hash; if these now differ, \
+             a taproot signing path was added and needs its own genesis-hash coverage"
+        );
+    }
+
     #[test]
     fn test_bip85_mnemonic_derivation() {
         // Test with a known mnemonic

From a2eb0e32432e4e5003802d8555cf6cd9e127fac3 Mon Sep 17 00:00:00 2001
From: 42Pupusas <technology@illuminodes.com>
Date: Fri, 31 Jul 2026 15:55:49 -0600
Subject: [PATCH 03/12] signer: sign silent payment inputs in SwSigner

A new silentpayments feature adds SilentPaymentSigner (scan-material export that never returns b_spend) and a silent-payment phase inside the ordinary Signer::sign: it reads untrusted SilentPaymentInputMeta off each PSET input, verifies the named account and that the tweaked key reproduces the Taproot output being spent, and only then signs. Hardware signers refuse loudly (no such protocol operation exists yet).
---
 lwk_signer/Cargo.toml            |   2 +
 lwk_signer/src/lib.rs            |  43 +++
 lwk_signer/src/silentpayments.rs | 490 +++++++++++++++++++++++++++++++
 lwk_signer/src/software.rs       |  35 +++
 4 files changed, 570 insertions(+)
 create mode 100644 lwk_signer/src/silentpayments.rs

diff --git a/lwk_signer/Cargo.toml b/lwk_signer/Cargo.toml
index 447712231..e7890fe30 100644
--- a/lwk_signer/Cargo.toml
+++ b/lwk_signer/Cargo.toml
@@ -24,6 +24,8 @@ default = ["jade", "amp0"]
 jade = ["lwk_jade"]
 ledger = ["lwk_ledger"]
 amp0 = []
+# BIP-352 silent-payment signing support and its optional signer errors.
+silentpayments = ["lwk_common/silentpayments"]
 
 [package.metadata.docs.rs]
 all-features = true
diff --git a/lwk_signer/src/lib.rs b/lwk_signer/src/lib.rs
index 76c38a4dd..7bda91478 100644
--- a/lwk_signer/src/lib.rs
+++ b/lwk_signer/src/lib.rs
@@ -8,7 +8,14 @@
 
 mod software;
 pub use crate::software::{sign_with_seckey, NewError, SignError, SwSigner};
+#[cfg(feature = "silentpayments")]
+mod silentpayments;
+
 pub use bip39;
+#[cfg(feature = "silentpayments")]
+use lwk_common::silentpayments::{
+    SilentPaymentAccount, SilentPaymentScanMaterial, SilentPaymentSigner,
+};
 
 use elements_miniscript::bitcoin::bip32::{self, DerivationPath, Fingerprint};
 use elements_miniscript::bitcoin::sign_message::MessageSignature;
@@ -33,6 +40,17 @@ pub enum SignerError {
 
     #[error(transparent)]
     Bip32Error(#[from] bip32::Error),
+
+    /// A hardware signer was asked for a silent-payment operation.
+    ///
+    /// This is a protocol gap, not an oversight: BIP-352 spending needs the device
+    /// to combine its `b_spend` with a host-supplied tweak, and neither the Jade nor
+    /// the Ledger protocol exposes such an operation today. Refusing loudly is the
+    /// only honest answer — the alternative (deriving the key on the host) would
+    /// defeat the entire point of using a hardware signer.
+    #[cfg(feature = "silentpayments")]
+    #[error("This signer does not support silent payments")]
+    UnsupportedSilentPayments,
 }
 
 /// A signer that can be a software signer [`SwSigner`] or a [`lwk_jade::Jade`]
@@ -83,6 +101,31 @@ impl Signer for AnySigner {
     }
 }
 
+/// Dispatches silent-payment scan-material export to the only signer that supports it.
+///
+/// Implemented on `AnySigner` rather than folded into [`Signer`] so signers with no
+/// silent-payment support carry no dead state. Signing itself uses the single
+/// [`Signer::sign`] operation; software signers recognize SP metadata there, while
+/// hardware signers currently leave those unsupported inputs unsigned.
+#[cfg(feature = "silentpayments")]
+#[cfg_attr(docsrs, doc(cfg(feature = "silentpayments")))]
+impl SilentPaymentSigner for AnySigner {
+    fn silent_payment_scan_material(
+        &self,
+        account: SilentPaymentAccount,
+    ) -> Result<SilentPaymentScanMaterial, Self::Error> {
+        match self {
+            AnySigner::Software(s) => Ok(s.silent_payment_scan_material(account)?),
+
+            #[cfg(feature = "jade")]
+            AnySigner::Jade(_, _) => Err(SignerError::UnsupportedSilentPayments),
+
+            #[cfg(feature = "ledger")]
+            AnySigner::Ledger(_, _) => Err(SignerError::UnsupportedSilentPayments),
+        }
+    }
+}
+
 impl Signer for &AnySigner {
     type Error = SignerError;
 
diff --git a/lwk_signer/src/silentpayments.rs b/lwk_signer/src/silentpayments.rs
new file mode 100644
index 000000000..d289ca07c
--- /dev/null
+++ b/lwk_signer/src/silentpayments.rs
@@ -0,0 +1,490 @@
+//! BIP-352 signing support for [`SwSigner`].
+
+use elements_miniscript::elements::pset::PartiallySignedTransaction;
+use elements_miniscript::elements::schnorr::TweakedPublicKey;
+use elements_miniscript::elements::secp256k1_zkp::{
+    Keypair, Message, Secp256k1, SecretKey as ZkpSecretKey,
+};
+use elements_miniscript::elements::sighash::{Prevouts, SighashCache};
+use elements_miniscript::elements::{SchnorrSighashType, Script, TxOut};
+use lwk_common::get_genesis_hash;
+use lwk_common::silentpayments::{
+    SilentPaymentAccount, SilentPaymentInputMeta, SilentPaymentPsetMetaError,
+    SilentPaymentScanMaterial, SilentPaymentSigner,
+};
+
+use crate::software::{SignError, SwSigner};
+
+impl SilentPaymentSigner for SwSigner {
+    fn silent_payment_scan_material(
+        &self,
+        account: SilentPaymentAccount,
+    ) -> Result<SilentPaymentScanMaterial, Self::Error> {
+        let secp = Secp256k1::new();
+
+        let scan_seckey = self.derive_xprv(&account.scan_path())?.private_key;
+
+        let b_spend = self.derive_xprv(&account.spend_path())?.private_key;
+        let spend_pubkey = b_spend.public_key(&secp);
+
+        Ok(SilentPaymentScanMaterial::new(
+            account,
+            scan_seckey,
+            spend_pubkey,
+        ))
+    }
+}
+
+impl SwSigner {
+    /// Sign the silent-payment inputs recognized by the ordinary signer entry point.
+    pub(crate) fn sign_silent_payment_inputs(
+        &self,
+        pset: &mut PartiallySignedTransaction,
+    ) -> Result<u32, SignError> {
+        SilentPaymentPsetSigner::new(self).sign(pset)
+    }
+}
+
+/// Verifies and signs silent-payment inputs in a PSET.
+struct SilentPaymentPsetSigner<'a> {
+    signer: &'a SwSigner,
+    secp: Secp256k1<elements_miniscript::elements::secp256k1_zkp::All>,
+}
+
+impl<'a> SilentPaymentPsetSigner<'a> {
+    fn new(signer: &'a SwSigner) -> Self {
+        SilentPaymentPsetSigner {
+            signer,
+            secp: Secp256k1::new(),
+        }
+    }
+
+    /// Signs verified silent-payment inputs and returns the number signed.
+    fn sign(&self, pset: &mut PartiallySignedTransaction) -> Result<u32, SignError> {
+        if !pset.inputs().iter().any(|i| {
+            !matches!(
+                SilentPaymentInputMeta::read(i),
+                Err(SilentPaymentPsetMetaError::Missing)
+            )
+        }) {
+            return Ok(0);
+        }
+
+        let prevouts = self.prevouts(pset)?;
+        let tx = pset.extract_tx()?;
+        let genesis_hash = get_genesis_hash(pset);
+        let mut sighash_cache = SighashCache::new(&tx);
+
+        let mut signatures: Vec<Option<(Keypair, Message, SchnorrSighashType)>> = Vec::new();
+        for (index, input) in pset.inputs().iter().enumerate() {
+            let meta = match SilentPaymentInputMeta::read(input) {
+                Ok(meta) => meta,
+                Err(SilentPaymentPsetMetaError::Missing) => {
+                    signatures.push(None);
+                    continue;
+                }
+                Err(e) => return Err(e.into()),
+            };
+
+            if input.tap_key_sig.is_some() {
+                signatures.push(None);
+                continue;
+            }
+
+            let keypair = self.verified_keypair(&meta, &prevouts[index])?;
+            let hash_ty = input
+                .sighash_type
+                .and_then(|h| h.schnorr_hash_ty())
+                .unwrap_or(SchnorrSighashType::Default);
+            let sighash = sighash_cache.taproot_key_spend_signature_hash(
+                index,
+                &Prevouts::All(&prevouts),
+                hash_ty,
+                genesis_hash,
+            )?;
+            let msg = Message::from_digest_slice(sighash.as_ref())?;
+            signatures.push(Some((keypair, msg, hash_ty)));
+        }
+
+        let mut added = 0;
+        for (input, signature) in pset.inputs_mut().iter_mut().zip(signatures) {
+            let Some((keypair, msg, hash_ty)) = signature else {
+                continue;
+            };
+            let sig = self.secp.sign_schnorr_no_aux_rand(&msg, &keypair);
+            input.tap_key_sig =
+                Some(elements_miniscript::elements::schnorr::SchnorrSig { sig, hash_ty });
+            added += 1;
+        }
+
+        Ok(added)
+    }
+
+    /// Returns all witness prevouts required for Taproot sighashing.
+    fn prevouts(&self, pset: &PartiallySignedTransaction) -> Result<Vec<TxOut>, SignError> {
+        pset.inputs()
+            .iter()
+            .map(|i| i.witness_utxo.clone().ok_or(SignError::MissingWitnessUtxo))
+            .collect()
+    }
+
+    /// Verifies metadata and derives the temporary signing key.
+    fn verified_keypair(
+        &self,
+        meta: &SilentPaymentInputMeta,
+        prevout: &TxOut,
+    ) -> Result<Keypair, SignError> {
+        let b_spend = self
+            .signer
+            .derive_xprv(&meta.account().spend_path())?
+            .private_key;
+        if b_spend.public_key(&self.secp) != meta.expected_spend_pubkey() {
+            return Err(SignError::SilentPaymentSpendPubkeyMismatch);
+        }
+
+        let d = b_spend
+            .add_tweak(&meta.spend_tweak())
+            .map_err(|_| SignError::InvalidTweak)?;
+        let d_zkp =
+            ZkpSecretKey::from_slice(&d.secret_bytes()).map_err(|_| SignError::InvalidTweak)?;
+        let keypair = Keypair::from_secret_key(&self.secp, &d_zkp);
+
+        let (x_only, _parity) = keypair.x_only_public_key();
+        let expected_script = Script::new_v1_p2tr_tweaked(TweakedPublicKey::new(x_only));
+        if prevout.script_pubkey != expected_script {
+            return Err(SignError::SilentPaymentOutputMismatch);
+        }
+
+        Ok(keypair)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use elements_miniscript::bitcoin;
+    use elements_miniscript::elements::hashes::Hash;
+    use lwk_common::Signer;
+
+    #[test]
+    fn scan_material_derivation() {
+        let signer = SwSigner::new(lwk_test_util::TEST_MNEMONIC, false).unwrap();
+        let secp = Secp256k1::new();
+
+        let account = SilentPaymentAccount::liquid_testnet(0);
+        let material = signer.silent_payment_scan_material(account).unwrap();
+        let b_scan = signer
+            .derive_xprv(&account.scan_path())
+            .unwrap()
+            .private_key;
+        let b_spend = signer
+            .derive_xprv(&account.spend_path())
+            .unwrap()
+            .private_key;
+        assert_eq!(material.scan_seckey(), b_scan);
+        assert_eq!(material.spend_pubkey(), b_spend.public_key(&secp));
+
+        let disjoint = [
+            (
+                "accounts differing by index",
+                SilentPaymentAccount::liquid_testnet(0),
+                SilentPaymentAccount::liquid_testnet(1),
+            ),
+            (
+                "one index across mainnet and testnet",
+                SilentPaymentAccount::liquid_mainnet(0),
+                SilentPaymentAccount::liquid_testnet(0),
+            ),
+        ];
+        for (why, left, right) in disjoint {
+            let a = signer.silent_payment_scan_material(left).unwrap();
+            let b = signer.silent_payment_scan_material(right).unwrap();
+            assert_ne!(
+                a.scan_seckey(),
+                b.scan_seckey(),
+                "{why} must not share a scan key"
+            );
+            assert_ne!(
+                a.spend_pubkey(),
+                b.spend_pubkey(),
+                "{why} must not share a spend key"
+            );
+        }
+    }
+
+    /// Builds PSETs containing silent-payment metadata for signer tests.
+    struct SpPsetFixture {
+        signer: SwSigner,
+        account: SilentPaymentAccount,
+        tweak: bitcoin::secp256k1::Scalar,
+    }
+
+    impl SpPsetFixture {
+        fn new() -> Self {
+            SpPsetFixture {
+                signer: SwSigner::new(lwk_test_util::TEST_MNEMONIC, false).unwrap(),
+                account: SilentPaymentAccount::liquid_testnet(0),
+                tweak: bitcoin::secp256k1::Scalar::from_be_bytes([0x37; 32]).unwrap(),
+            }
+        }
+
+        fn spend_pubkey(&self) -> bitcoin::secp256k1::PublicKey {
+            self.signer
+                .silent_payment_scan_material(self.account)
+                .unwrap()
+                .spend_pubkey()
+        }
+
+        /// The scriptPubKey of the output that `b_spend + tweak` actually controls:
+        /// a bare v1 P2TR of `x_only(B_spend + tweak·G)`, no script tree, no BIP-341
+        /// taptweak — BIP-352's output convention.
+        fn output_script(&self, tweak: &bitcoin::secp256k1::Scalar) -> Script {
+            let secp = Secp256k1::new();
+            let b_spend = self
+                .signer
+                .derive_xprv(&self.account.spend_path())
+                .unwrap()
+                .private_key;
+            let d = b_spend.add_tweak(tweak).unwrap();
+            let d_zkp = ZkpSecretKey::from_slice(&d.secret_bytes()).unwrap();
+            let (x_only, _) = Keypair::from_secret_key(&secp, &d_zkp).x_only_public_key();
+            Script::new_v1_p2tr_tweaked(TweakedPublicKey::new(x_only))
+        }
+
+        fn txout(&self, script_pubkey: Script) -> TxOut {
+            use elements_miniscript::elements::confidential::{Asset, Value};
+            use elements_miniscript::elements::AssetId;
+            TxOut {
+                asset: Asset::Explicit(AssetId::from_slice(&[0x42; 32]).unwrap()),
+                value: Value::Explicit(100_000),
+                nonce: Default::default(),
+                script_pubkey,
+                witness: Default::default(),
+            }
+        }
+
+        /// A PSET with one silent-payment input spending the output the metadata
+        /// describes.
+        fn pset(&self, meta: SilentPaymentInputMeta) -> PartiallySignedTransaction {
+            self.pset_spending(meta, self.output_script(&self.tweak))
+        }
+
+        /// As [`Self::pset`], but the coin actually being spent is `spent_script`.
+        fn pset_spending(
+            &self,
+            meta: SilentPaymentInputMeta,
+            spent_script: Script,
+        ) -> PartiallySignedTransaction {
+            use elements_miniscript::elements::pset::{Input, Output, PsbtSighashType};
+            use elements_miniscript::elements::{OutPoint, Txid};
+
+            let outpoint = OutPoint::new(Txid::from_slice(&[0x99; 32]).unwrap(), 0);
+            let mut input = Input::from_prevout(outpoint);
+            input.witness_utxo = Some(self.txout(spent_script));
+            input.sighash_type = Some(PsbtSighashType::from_u32(0));
+            meta.attach(&mut input);
+
+            let mut pset = PartiallySignedTransaction::new_v2();
+            // A real genesis hash, as `TxBuilder` writes (ELIP-101).
+            lwk_common::set_genesis_hash(&mut pset, &lwk_common::Network::TestnetLiquid);
+            pset.add_input(input);
+            pset.add_output(Output::from_txout(self.txout(Script::new())));
+            pset
+        }
+
+        fn valid_meta(&self) -> SilentPaymentInputMeta {
+            self.meta_with(self.account, self.tweak, self.spend_pubkey())
+        }
+
+        /// Builds metadata from an account, tweak, and public spend key.
+        fn meta_with(
+            &self,
+            account: SilentPaymentAccount,
+            spend_tweak: bitcoin::secp256k1::Scalar,
+            spend_pubkey: bitcoin::secp256k1::PublicKey,
+        ) -> SilentPaymentInputMeta {
+            let dummy_scan = bitcoin::secp256k1::SecretKey::from_slice(&[0x11; 32]).unwrap();
+            SilentPaymentScanMaterial::new(account, dummy_scan, spend_pubkey)
+                .input_meta(spend_tweak)
+        }
+    }
+
+    #[test]
+    fn honest_metadata_is_signed_exactly_once() {
+        let f = SpPsetFixture::new();
+
+        let mut untouched = PartiallySignedTransaction::new_v2();
+        assert_eq!(
+            f.signer.sign(&mut untouched).unwrap(),
+            0,
+            "a PSET without silent payment metadata must be left alone"
+        );
+
+        let mut pset = f.pset(f.valid_meta());
+        assert_eq!(f.signer.sign(&mut pset).unwrap(), 1);
+        let first = pset.inputs()[0].tap_key_sig;
+        assert!(first.is_some());
+
+        assert_eq!(
+            f.signer.sign(&mut pset).unwrap(),
+            0,
+            "an already-signed input must not be re-signed"
+        );
+        assert_eq!(pset.inputs()[0].tap_key_sig, first);
+    }
+
+    /// Elements Taproot sighashes commit to the chain genesis hash (ELIP-101), which
+    /// the signer must read from the PSET rather than assume.
+    #[test]
+    fn signature_commits_to_the_psets_genesis_hash() {
+        use elements_miniscript::elements::sighash::Prevouts;
+
+        let f = SpPsetFixture::new();
+
+        let mut liquid = f.pset(f.valid_meta());
+        lwk_common::set_genesis_hash(&mut liquid, &lwk_common::Network::Liquid);
+        let mut testnet = f.pset(f.valid_meta());
+        lwk_common::set_genesis_hash(&mut testnet, &lwk_common::Network::TestnetLiquid);
+
+        assert_eq!(f.signer.sign(&mut liquid).unwrap(), 1);
+        assert_eq!(f.signer.sign(&mut testnet).unwrap(), 1);
+
+        let liquid_sig = liquid.inputs()[0].tap_key_sig.unwrap().sig;
+        let testnet_sig = testnet.inputs()[0].tap_key_sig.unwrap().sig;
+        assert_ne!(
+            liquid_sig, testnet_sig,
+            "same transaction on two chains must not produce the same signature; \
+             if it does, the genesis hash is not reaching the sighash"
+        );
+
+        let secp = Secp256k1::verification_only();
+        let output_key = {
+            let b_spend = f
+                .signer
+                .derive_xprv(&f.account.spend_path())
+                .unwrap()
+                .private_key;
+            let d = b_spend.add_tweak(&f.tweak).unwrap();
+            let d_zkp = ZkpSecretKey::from_slice(&d.secret_bytes()).unwrap();
+            Keypair::from_secret_key(&Secp256k1::new(), &d_zkp)
+                .x_only_public_key()
+                .0
+        };
+        let tx = liquid.clone().extract_tx().unwrap();
+        let prevouts = [liquid.inputs()[0].witness_utxo.clone().unwrap()];
+        let sighash = SighashCache::new(&tx)
+            .taproot_key_spend_signature_hash(
+                0,
+                &Prevouts::All(&prevouts),
+                SchnorrSighashType::Default,
+                lwk_common::Network::Liquid.genesis_hash(),
+            )
+            .unwrap();
+        let msg = Message::from_digest_slice(sighash.as_ref()).unwrap();
+        assert!(
+            secp.verify_schnorr(&liquid_sig, &msg, &output_key).is_ok(),
+            "signature must verify under the genesis hash the PSET actually carries"
+        );
+    }
+
+    enum Tampering {
+        WrongAccount,
+        WrongSpendPubkey,
+        WrongTweak,
+        ForeignSpentScript,
+        MissingWitnessUtxo,
+        MalformedMeta,
+    }
+
+    impl Tampering {
+        fn apply(&self, f: &SpPsetFixture) -> (PartiallySignedTransaction, SignError) {
+            match self {
+                Tampering::WrongAccount => {
+                    let meta = f.meta_with(
+                        SilentPaymentAccount::liquid_testnet(7),
+                        f.tweak,
+                        f.spend_pubkey(),
+                    );
+                    (f.pset(meta), SignError::SilentPaymentSpendPubkeyMismatch)
+                }
+                Tampering::WrongSpendPubkey => {
+                    let stranger = bitcoin::secp256k1::SecretKey::from_slice(&[0x05; 32])
+                        .unwrap()
+                        .public_key(&Secp256k1::new());
+                    let meta = f.meta_with(f.account, f.tweak, stranger);
+                    (f.pset(meta), SignError::SilentPaymentSpendPubkeyMismatch)
+                }
+                Tampering::WrongTweak => {
+                    let meta = f.meta_with(
+                        f.account,
+                        bitcoin::secp256k1::Scalar::from_be_bytes([0x51; 32]).unwrap(),
+                        f.spend_pubkey(),
+                    );
+                    // The coin spent is still the one the original tweak controls.
+                    (
+                        f.pset_spending(meta, f.output_script(&f.tweak)),
+                        SignError::SilentPaymentOutputMismatch,
+                    )
+                }
+                Tampering::ForeignSpentScript => (
+                    f.pset_spending(f.valid_meta(), Script::from(vec![0x00, 0x14, 0xAB])),
+                    SignError::SilentPaymentOutputMismatch,
+                ),
+                Tampering::MissingWitnessUtxo => {
+                    let mut pset = f.pset(f.valid_meta());
+                    pset.inputs_mut()[0].witness_utxo = None;
+                    (pset, SignError::MissingWitnessUtxo)
+                }
+                Tampering::MalformedMeta => {
+                    let mut pset = f.pset(f.valid_meta());
+                    let key = pset.inputs()[0]
+                        .proprietary
+                        .keys()
+                        .next()
+                        .expect("metadata was attached")
+                        .clone();
+                    pset.inputs_mut()[0].proprietary.insert(key, vec![0xFF; 5]);
+                    (
+                        pset,
+                        SignError::SilentPaymentMeta(
+                            lwk_common::silentpayments::SilentPaymentPsetMetaError::Malformed,
+                        ),
+                    )
+                }
+            }
+        }
+    }
+
+    #[test]
+    fn tampered_metadata_is_refused_and_left_unsigned() {
+        let f = SpPsetFixture::new();
+        let cases = [
+            Tampering::WrongAccount,
+            Tampering::WrongSpendPubkey,
+            Tampering::WrongTweak,
+            Tampering::ForeignSpentScript,
+            Tampering::MissingWitnessUtxo,
+            Tampering::MalformedMeta,
+        ];
+
+        for case in &cases {
+            let (mut pset, expected) = case.apply(&f);
+            let err = f
+                .signer
+                .sign(&mut pset)
+                .expect_err("tampered metadata must not be signed");
+
+            // By variant: SignError is not PartialEq, and the exact payload of the
+            // metadata error is pinned by its own tests in lwk_common.
+            assert_eq!(
+                std::mem::discriminant(&err),
+                std::mem::discriminant(&expected),
+                "expected {expected:?}, got {err:?}"
+            );
+            assert!(
+                pset.inputs()[0].tap_key_sig.is_none(),
+                "a refused input must be left unsigned"
+            );
+        }
+    }
+}
diff --git a/lwk_signer/src/software.rs b/lwk_signer/src/software.rs
index c8e2896d3..c2ac96fc4 100644
--- a/lwk_signer/src/software.rs
+++ b/lwk_signer/src/software.rs
@@ -53,6 +53,36 @@ pub enum SignError {
 
     #[error("BIP85 derivation failed: {0}")]
     Bip85Derivation(String),
+
+    /// Errors specific to silent-payment signing.
+    #[cfg(feature = "silentpayments")]
+    #[error("Invalid tweak: tweaked key is out of range (e.g. sums to zero)")]
+    InvalidTweak,
+
+    #[cfg(feature = "silentpayments")]
+    #[error("Taproot key-spend sighash requires every input's witness_utxo")]
+    MissingWitnessUtxo,
+
+    #[cfg(feature = "silentpayments")]
+    #[error(transparent)]
+    TaprootSighash(#[from] elements_miniscript::elements::sighash::Error),
+
+    #[cfg(feature = "silentpayments")]
+    #[error(transparent)]
+    Secp256k1(#[from] elements_miniscript::bitcoin::secp256k1::Error),
+
+    /// Invalid untrusted silent-payment PSET metadata.
+    #[cfg(feature = "silentpayments")]
+    #[error(transparent)]
+    SilentPaymentMeta(#[from] lwk_common::silentpayments::SilentPaymentPsetMetaError),
+
+    #[cfg(feature = "silentpayments")]
+    #[error("Silent payment input names an account whose B_spend this signer does not derive")]
+    SilentPaymentSpendPubkeyMismatch,
+
+    #[cfg(feature = "silentpayments")]
+    #[error("Silent payment tweak does not produce the Taproot output being spent")]
+    SilentPaymentOutputMismatch,
 }
 
 /// Possible errors when creating a new software signer [`SwSigner`]
@@ -417,6 +447,11 @@ impl Signer for SwSigner {
             }
         }
 
+        #[cfg(feature = "silentpayments")]
+        {
+            signature_added += self.sign_silent_payment_inputs(pset)?;
+        }
+
         Ok(signature_added)
     }
 

From 932c4a34be8ab7b5f5d25a8447687ab83f2d2951 Mon Sep 17 00:00:00 2001
From: 42Pupusas <technology@illuminodes.com>
Date: Fri, 31 Jul 2026 15:56:05 -0600
Subject: [PATCH 04/12] test-util: add deterministic Elements test data

Shared fixtures for building deterministic transactions, outpoints and secret keys, used by the silent payment unit tests in lwk_wollet.
---
 lwk_test_util/src/elements_test_data.rs | 93 +++++++++++++++++++++++++
 lwk_test_util/src/lib.rs                |  2 +
 2 files changed, 95 insertions(+)
 create mode 100644 lwk_test_util/src/elements_test_data.rs

diff --git a/lwk_test_util/src/elements_test_data.rs b/lwk_test_util/src/elements_test_data.rs
new file mode 100644
index 000000000..8ba670c57
--- /dev/null
+++ b/lwk_test_util/src/elements_test_data.rs
@@ -0,0 +1,93 @@
+use elements_miniscript::elements::bitcoin::hashes::{hash160, Hash as _};
+use elements_miniscript::elements::bitcoin::secp256k1::{PublicKey, Secp256k1, SecretKey};
+use elements_miniscript::elements::{
+    OutPoint, Script, Sequence, TxIn, TxInWitness, Txid, WPubkeyHash,
+};
+
+pub struct ElementsTestData;
+
+impl ElementsTestData {
+    pub fn secret_key(byte: u8) -> SecretKey {
+        SecretKey::from_slice(&[byte; 32]).unwrap()
+    }
+
+    pub fn public_key(byte: u8) -> PublicKey {
+        Self::secret_key(byte).public_key(&Secp256k1::new())
+    }
+
+    pub fn txid(byte: u8) -> Txid {
+        Txid::from_byte_array([byte; 32])
+    }
+
+    pub fn outpoint(txid_byte: u8, vout: u32) -> OutPoint {
+        OutPoint::new(Self::txid(txid_byte), vout)
+    }
+
+    pub fn p2wpkh(secret_key: &SecretKey) -> Script {
+        Self::p2wpkh_of(&secret_key.public_key(&Secp256k1::new()))
+    }
+
+    /// Builds a P2WPKH scriptPubKey for `pubkey`.
+    pub fn p2wpkh_of(pubkey: &PublicKey) -> Script {
+        let hash = hash160::Hash::hash(&pubkey.serialize());
+        Script::new_v0_wpkh(&WPubkeyHash::from_byte_array(hash.to_byte_array()))
+    }
+
+    /// Builds a P2WPKH witness containing `pubkey`.
+    pub fn p2wpkh_witness(pubkey: &PublicKey) -> Vec<Vec<u8>> {
+        vec![vec![0x30; 71], pubkey.serialize().to_vec()]
+    }
+
+    /// Builds a transaction input with the supplied witness.
+    pub fn input(previous_output: OutPoint, script_witness: Vec<Vec<u8>>, is_pegin: bool) -> TxIn {
+        TxIn {
+            previous_output,
+            is_pegin,
+            script_sig: Script::new(),
+            sequence: Sequence::MAX,
+            asset_issuance: Default::default(),
+            witness: TxInWitness {
+                script_witness,
+                ..Default::default()
+            },
+        }
+    }
+
+    /// Builds a non-pegin P2WPKH input for `secret_key`.
+    pub fn p2wpkh_input(previous_output: OutPoint, secret_key: &SecretKey) -> TxIn {
+        let pubkey = secret_key.public_key(&Secp256k1::new());
+        Self::input(previous_output, Self::p2wpkh_witness(&pubkey), false)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::ElementsTestData;
+
+    #[test]
+    fn deterministic_elements_values() {
+        assert_eq!(
+            ElementsTestData::outpoint(0x42, 7).txid,
+            ElementsTestData::txid(0x42)
+        );
+        assert_eq!(
+            ElementsTestData::public_key(0x21),
+            ElementsTestData::secret_key(0x21)
+                .public_key(&elements_miniscript::elements::bitcoin::secp256k1::Secp256k1::new())
+        );
+        assert!(ElementsTestData::p2wpkh(&ElementsTestData::secret_key(0x21)).is_v0_p2wpkh());
+
+        let secret = ElementsTestData::secret_key(0x33);
+        assert_eq!(
+            ElementsTestData::p2wpkh(&secret),
+            ElementsTestData::p2wpkh_of(&ElementsTestData::public_key(0x33))
+        );
+
+        let input = ElementsTestData::p2wpkh_input(ElementsTestData::outpoint(0x44, 0), &secret);
+        assert_eq!(
+            input.witness.script_witness[1],
+            ElementsTestData::public_key(0x33).serialize().to_vec()
+        );
+        assert!(!input.is_pegin);
+    }
+}
diff --git a/lwk_test_util/src/lib.rs b/lwk_test_util/src/lib.rs
index c0492ce95..1a47930f8 100644
--- a/lwk_test_util/src/lib.rs
+++ b/lwk_test_util/src/lib.rs
@@ -67,6 +67,7 @@ impl lwk_common::Store for PanicStore {
 
 mod amp2;
 mod auth;
+mod elements_test_data;
 mod registry;
 mod test_env;
 mod waterfalls;
@@ -74,6 +75,7 @@ pub use auth::{
     AuthStack, AUTH_CLIENT_ID, AUTH_CLIENT_SECRET, AUTH_REALM, AUTH_SHORT_CLIENT_ID,
     AUTH_SHORT_CLIENT_SECRET, AUTH_USER_UUID,
 };
+pub use elements_test_data::ElementsTestData;
 pub use test_env::{TestEnv, TestEnvBuilder};
 
 const DEFAULT_FEE_RATE: f32 = 100.0;

From 63fbf82285874daf9b7d69798f5da1b470a8a410 Mon Sep 17 00:00:00 2001
From: 42Pupusas <technology@illuminodes.com>
Date: Fri, 31 Jul 2026 15:58:11 -0600
Subject: [PATCH 05/12] wollet: declare the backend features test and example
 targets need

tests/e2e.rs imports electrum/esplora/amp0 types at file scope and the list_transactions example uses the electrum client, so feature-off builds of --all-targets failed. required-features skips the targets instead; --test e2e -- --list under default features still shows every test.
---
 lwk_wollet/Cargo.toml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/lwk_wollet/Cargo.toml b/lwk_wollet/Cargo.toml
index 83ec8ce02..571db52de 100644
--- a/lwk_wollet/Cargo.toml
+++ b/lwk_wollet/Cargo.toml
@@ -149,12 +149,16 @@ amp0 = [
 prices = ["reqwest"]
 registry = ["reqwest"]
 
+# The e2e target requires the backend features it imports.
 [[test]]
 name = "e2e"
 path = "tests/e2e.rs"
+required-features = ["electrum", "esplora", "amp0"]
 
+# Uses `ElectrumClient` and `full_scan_with_electrum_client`, both gated on `electrum`.
 [[example]]
 name = "list_transactions"
+required-features = ["electrum"]
 
 [package.metadata.docs.rs]
 all-features = true

From 466a3553d4423cefc8a285b15feb8a9ceaf14646 Mon Sep 17 00:00:00 2001
From: 42Pupusas <technology@illuminodes.com>
Date: Fri, 31 Jul 2026 16:01:58 -0600
Subject: [PATCH 06/12] wollet: add the silent payments module (BIP-352 per the
 Liquid ELIP)

The full scan/derive/track stack behind a new silentpayments feature: bech32 lqsp addresses, sender/receiver output derivation with CT unblinding via the shared secret, input aggregation with BIP-352 eligibility, per-tx and per-block scanning (locally computed or tweak-server assisted), the cache entry and utxo views, and recipient resolution for the transaction builder. Pinned against the ELIP known-answer vectors.
---
 Cargo.lock                                    |   1 +
 lwk_wollet/Cargo.toml                         |   6 +
 lwk_wollet/src/error.rs                       |  30 +
 lwk_wollet/src/lib.rs                         |   3 +
 lwk_wollet/src/silentpayments/address.rs      | 156 +++++
 lwk_wollet/src/silentpayments/block_tweaks.rs | 189 ++++++
 lwk_wollet/src/silentpayments/cache_entry.rs  | 150 +++++
 lwk_wollet/src/silentpayments/inputs.rs       | 454 +++++++++++++
 lwk_wollet/src/silentpayments/mod.rs          | 159 +++++
 lwk_wollet/src/silentpayments/output.rs       |  28 +
 lwk_wollet/src/silentpayments/receiver.rs     | 160 +++++
 lwk_wollet/src/silentpayments/recipient.rs    | 136 ++++
 .../src/silentpayments/scan_material.rs       | 113 ++++
 lwk_wollet/src/silentpayments/scanner.rs      | 288 ++++++++
 lwk_wollet/src/silentpayments/sender.rs       |  83 +++
 .../src/silentpayments/shared_secret.rs       | 146 ++++
 lwk_wollet/src/silentpayments/sync.rs         | 157 +++++
 lwk_wollet/src/silentpayments/tags.rs         |  26 +
 lwk_wollet/src/silentpayments/test_fixture.rs | 150 +++++
 lwk_wollet/src/silentpayments/tweak_server.rs |  82 +++
 lwk_wollet/src/silentpayments/tx_inputs.rs    | 629 ++++++++++++++++++
 lwk_wollet/src/silentpayments/tx_scan.rs      | 173 +++++
 lwk_wollet/src/silentpayments/txout.rs        |  76 +++
 lwk_wollet/src/silentpayments/utxo.rs         |  99 +++
 24 files changed, 3494 insertions(+)
 create mode 100644 lwk_wollet/src/silentpayments/address.rs
 create mode 100644 lwk_wollet/src/silentpayments/block_tweaks.rs
 create mode 100644 lwk_wollet/src/silentpayments/cache_entry.rs
 create mode 100644 lwk_wollet/src/silentpayments/inputs.rs
 create mode 100644 lwk_wollet/src/silentpayments/mod.rs
 create mode 100644 lwk_wollet/src/silentpayments/output.rs
 create mode 100644 lwk_wollet/src/silentpayments/receiver.rs
 create mode 100644 lwk_wollet/src/silentpayments/recipient.rs
 create mode 100644 lwk_wollet/src/silentpayments/scan_material.rs
 create mode 100644 lwk_wollet/src/silentpayments/scanner.rs
 create mode 100644 lwk_wollet/src/silentpayments/sender.rs
 create mode 100644 lwk_wollet/src/silentpayments/shared_secret.rs
 create mode 100644 lwk_wollet/src/silentpayments/sync.rs
 create mode 100644 lwk_wollet/src/silentpayments/tags.rs
 create mode 100644 lwk_wollet/src/silentpayments/test_fixture.rs
 create mode 100644 lwk_wollet/src/silentpayments/tweak_server.rs
 create mode 100644 lwk_wollet/src/silentpayments/tx_inputs.rs
 create mode 100644 lwk_wollet/src/silentpayments/tx_scan.rs
 create mode 100644 lwk_wollet/src/silentpayments/txout.rs
 create mode 100644 lwk_wollet/src/silentpayments/utxo.rs

diff --git a/Cargo.lock b/Cargo.lock
index 12539992a..386362352 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -3026,6 +3026,7 @@ dependencies = [
  "aes-gcm-siv",
  "age",
  "base64 0.21.7",
+ "bech32 0.11.0",
  "bip39",
  "bitcoincore-rpc",
  "cbc",
diff --git a/lwk_wollet/Cargo.toml b/lwk_wollet/Cargo.toml
index 571db52de..801d905f2 100644
--- a/lwk_wollet/Cargo.toml
+++ b/lwk_wollet/Cargo.toml
@@ -19,6 +19,7 @@ lwk_signer = { version = "0.18.1", features = [
 ], optional = true }
 
 rand = "0.8"
+bech32 = { version = "0.11", optional = true }
 serde = { workspace = true, features = ["derive"] }
 serde_json.workspace = true
 aes-gcm-siv = "0.11.0"
@@ -118,6 +119,7 @@ default = [
     "amp0",
     "prices",
     "registry",
+    "silentpayments",
 ]
 serial = ["lwk_jade/serial"] # this is a dev-dep feature
 esplora = ["reqwest", "age"]
@@ -148,6 +150,10 @@ amp0 = [
 ]
 prices = ["reqwest"]
 registry = ["reqwest"]
+# Silent Payments (BIP-352 on Liquid, per the Liquid silent payments ELIP).
+# The wallet feature scans, unblinds, and tracks outputs; signing remains in
+# `lwk_signer`'s separate `silentpayments` feature.
+silentpayments = ["bech32", "lwk_common/silentpayments"]
 
 # The e2e target requires the backend features it imports.
 [[test]]
diff --git a/lwk_wollet/src/error.rs b/lwk_wollet/src/error.rs
index 4741cac91..d922ad7a3 100644
--- a/lwk_wollet/src/error.rs
+++ b/lwk_wollet/src/error.rs
@@ -119,6 +119,36 @@ pub enum Error {
         body: Option<String>,
     },
 
+    #[cfg(feature = "silentpayments")]
+    #[error(transparent)]
+    SilentPaymentAddress(#[from] crate::silentpayments::SilentPaymentAddressError),
+
+    #[cfg(feature = "silentpayments")]
+    #[error(transparent)]
+    SilentPaymentInput(#[from] crate::silentpayments::SilentPaymentInputError),
+
+    /// A silent payment recipient was added, but the PSET was finalized without
+    /// supplying the input private keys needed to derive the output.
+    #[cfg(feature = "silentpayments")]
+    #[error("transaction has {0} silent payment recipient(s): finish with `TxBuilder::finish_silent_payment()` (a watch-only wallet cannot derive silent payment outputs, they require the input private keys)")]
+    SilentPaymentRequiresKeys(usize),
+
+    /// A silent payment receive operation was attempted on a wallet built without
+    /// scan material. Detection needs `b_scan`, which a CT descriptor cannot express.
+    #[cfg(feature = "silentpayments")]
+    #[error("wallet has no silent payment scan material: build it with `WolletBuilder::with_silent_payment_material()`")]
+    MissingSilentPaymentKeys,
+
+    /// A silent payment scan was requested from a backend that cannot discover them.
+    ///
+    /// Silent payment outputs match no descriptor-derived script, so a backend whose
+    /// only query is script history cannot find them however many addresses it scans.
+    /// This is reported rather than silently skipped: a scan that quietly finds nothing
+    /// is indistinguishable from having received no payments.
+    #[cfg(feature = "silentpayments")]
+    #[error("this backend cannot discover silent payments (it can only query descriptor-derived script history, which never matches a silent payment output); use a backend with `Capability::SilentPayments`, such as `EsploraClient`")]
+    SilentPaymentsUnsupportedByBackend,
+
     #[error("Address must be explicit")]
     NotExplicitAddress,
 
diff --git a/lwk_wollet/src/lib.rs b/lwk_wollet/src/lib.rs
index f206398d2..422e802be 100644
--- a/lwk_wollet/src/lib.rs
+++ b/lwk_wollet/src/lib.rs
@@ -112,6 +112,9 @@ mod tx_details;
 mod pset_create;
 #[cfg(feature = "registry")]
 pub mod registry;
+#[cfg(feature = "silentpayments")]
+#[cfg_attr(docsrs, doc(cfg(feature = "silentpayments")))]
+pub mod silentpayments;
 mod tx_builder;
 mod update;
 mod util;
diff --git a/lwk_wollet/src/silentpayments/address.rs b/lwk_wollet/src/silentpayments/address.rs
new file mode 100644
index 000000000..243acfdb3
--- /dev/null
+++ b/lwk_wollet/src/silentpayments/address.rs
@@ -0,0 +1,156 @@
+//! Bech32m silent-payment addresses.
+
+use bech32::primitives::decode::CheckedHrpstring;
+use bech32::{Bech32m, Fe32, Hrp};
+
+use crate::secp256k1::PublicKey;
+use crate::Network;
+
+/// Receiver scan and spend public keys.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct SilentPaymentAddress {
+    /// `B_scan` — used by the sender to compute the ECDH shared secret.
+    pub scan: PublicKey,
+    /// `B_spend` — base point the per-output spend key is tweaked from.
+    pub spend: PublicKey,
+}
+
+impl SilentPaymentAddress {
+    /// Version 0 (`q`).
+    const VERSION: Fe32 = Fe32::Q;
+
+    /// The expected payload size: two compressed secp256k1 public keys.
+    const PAYLOAD_LEN: usize = 66;
+
+    /// Network-specific Liquid address HRP.
+    fn hrp(network: Network) -> Hrp {
+        match network {
+            Network::Liquid => Hrp::parse_unchecked("lqsp"),
+            _ => Hrp::parse_unchecked("tlqsp"),
+        }
+    }
+
+    /// Encodes for `network`.
+    pub fn encode(&self, network: Network) -> String {
+        use bech32::primitives::iter::{ByteIterExt, Fe32IterExt};
+
+        let mut payload = Vec::with_capacity(Self::PAYLOAD_LEN);
+        payload.extend_from_slice(&self.scan.serialize());
+        payload.extend_from_slice(&self.spend.serialize());
+
+        std::iter::once(Self::VERSION)
+            .chain(payload.into_iter().bytes_to_fes())
+            .with_checksum::<Bech32m>(&Self::hrp(network))
+            .chars()
+            .collect()
+    }
+
+    /// Parse a bech32m silent payment address, validating the HRP against `network`.
+    pub fn parse(s: &str, network: Network) -> Result<Self, SilentPaymentAddressError> {
+        use bech32::primitives::iter::Fe32IterExt;
+
+        let checked = CheckedHrpstring::new::<Bech32m>(s)
+            .map_err(|_| SilentPaymentAddressError::InvalidBech32m)?;
+
+        if checked.hrp() != Self::hrp(network) {
+            return Err(SilentPaymentAddressError::WrongNetwork);
+        }
+
+        let mut iter = checked.fe32_iter::<std::vec::IntoIter<u8>>();
+        let version = iter.next().ok_or(SilentPaymentAddressError::Truncated)?;
+        if version != Self::VERSION {
+            return Err(SilentPaymentAddressError::UnknownVersion);
+        }
+
+        let bytes: Vec<u8> = iter.fes_to_bytes().collect();
+        if bytes.len() != Self::PAYLOAD_LEN {
+            return Err(SilentPaymentAddressError::WrongPayloadLength(bytes.len()));
+        }
+        let scan = PublicKey::from_slice(&bytes[..33])
+            .map_err(|_| SilentPaymentAddressError::InvalidPublicKey)?;
+        let spend = PublicKey::from_slice(&bytes[33..])
+            .map_err(|_| SilentPaymentAddressError::InvalidPublicKey)?;
+        Ok(SilentPaymentAddress { scan, spend })
+    }
+}
+
+/// Errors parsing a [`SilentPaymentAddress`].
+#[derive(thiserror::Error, Debug, Clone, Copy, PartialEq, Eq)]
+pub enum SilentPaymentAddressError {
+    /// Not a valid bech32m string.
+    #[error("not a valid bech32m string")]
+    InvalidBech32m,
+
+    /// HRP does not match the expected network.
+    #[error("address HRP does not match network")]
+    WrongNetwork,
+
+    /// Payload ended before the version/keys could be read.
+    #[error("address payload truncated")]
+    Truncated,
+
+    /// Address version is not supported.
+    #[error("unsupported silent payment address version")]
+    UnknownVersion,
+
+    /// Payload is not the expected 66 bytes (two compressed pubkeys).
+    #[error("expected 66-byte payload, got {0}")]
+    WrongPayloadLength(usize),
+
+    /// A public key in the payload is not a valid point.
+    #[error("invalid public key in address payload")]
+    InvalidPublicKey,
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::silentpayments::test_fixture::SilentPaymentTestData as Data;
+    use crate::silentpayments::SilentPaymentScan;
+
+    #[test]
+    fn address_encodes_and_round_trips_per_network() {
+        let address = Data::material(0x11, 0x22).address();
+
+        for (network, hrp) in [
+            (Network::Liquid, "lqsp1"),
+            (Network::TestnetLiquid, "tlqsp1"),
+            (Network::default_regtest(), "tlqsp1"),
+        ] {
+            let encoded = address.encode(network);
+            assert!(
+                encoded.starts_with(hrp),
+                "address {encoded} should start with {hrp}"
+            );
+            assert_eq!(
+                SilentPaymentAddress::parse(&encoded, network).unwrap(),
+                address,
+                "address did not round-trip on {network:?}"
+            );
+        }
+
+        assert_eq!(
+            address.encode(Network::TestnetLiquid),
+            address.encode(Network::default_regtest()),
+            "testnet and regtest must share the tlqsp HRP"
+        );
+    }
+
+    #[test]
+    fn address_rejects_wrong_network_and_garbage() {
+        let address = Data::material(0x11, 0x22).address();
+        let mainnet = address.encode(Network::Liquid);
+
+        for network in [Network::TestnetLiquid, Network::default_regtest()] {
+            assert_eq!(
+                SilentPaymentAddress::parse(&mainnet, network),
+                Err(SilentPaymentAddressError::WrongNetwork),
+                "a mainnet address must not parse as {network:?}"
+            );
+        }
+
+        assert!(SilentPaymentAddress::parse("not an address", Network::Liquid).is_err());
+        // Valid bech32m but wrong payload length (no key bytes).
+        assert!(SilentPaymentAddress::parse("lq1qqqqqq", Network::Liquid).is_err());
+    }
+}
diff --git a/lwk_wollet/src/silentpayments/block_tweaks.rs b/lwk_wollet/src/silentpayments/block_tweaks.rs
new file mode 100644
index 000000000..1d69f35cf
--- /dev/null
+++ b/lwk_wollet/src/silentpayments/block_tweaks.rs
@@ -0,0 +1,189 @@
+//! Computes silent-payment tweaks for a block.
+
+use crate::elements::{Block, OutPoint, Script, Transaction, Txid};
+use crate::silentpayments::{PartialTweak, SilentPaymentTxInputs};
+use std::collections::HashMap;
+
+/// Computes silent-payment tweaks for a block view.
+pub struct BlockTweaks<'a> {
+    block: &'a Block,
+}
+
+impl<'a> BlockTweaks<'a> {
+    /// A tweak extractor over `block`.
+    pub fn new(block: &'a Block) -> Self {
+        BlockTweaks { block }
+    }
+
+    /// Returns the external prevouts needed to classify block inputs.
+    pub fn required_prevouts(&self) -> Vec<OutPoint> {
+        let local: HashMap<Txid, &Transaction> =
+            self.block.txdata.iter().map(|tx| (tx.txid(), tx)).collect();
+
+        let mut seen = std::collections::HashSet::new();
+        let mut out = Vec::new();
+        for tx in &self.block.txdata {
+            if tx.is_coinbase() {
+                continue;
+            }
+            for input in &tx.input {
+                if input.is_pegin() {
+                    continue;
+                }
+                let op = input.previous_output;
+                if local.contains_key(&op.txid) {
+                    continue;
+                }
+                if seen.insert(op) {
+                    out.push(op);
+                }
+            }
+        }
+        out
+    }
+
+    /// Computes partial tweaks for transactions with eligible inputs.
+    pub fn compute(&self, prevouts: &HashMap<OutPoint, Script>) -> Vec<(Txid, PartialTweak)> {
+        let local: HashMap<Txid, &Transaction> =
+            self.block.txdata.iter().map(|tx| (tx.txid(), tx)).collect();
+
+        let mut out = Vec::new();
+        for tx in &self.block.txdata {
+            if tx.is_coinbase() {
+                continue;
+            }
+
+            let lookup = |op: &OutPoint| -> Option<&Script> {
+                if let Some(script) = prevouts.get(op) {
+                    return Some(script);
+                }
+                local
+                    .get(&op.txid)
+                    .and_then(|prev| prev.output.get(op.vout as usize))
+                    .map(|txout| &txout.script_pubkey)
+            };
+
+            let inputs = SilentPaymentTxInputs::extract(tx, lookup);
+            if !inputs.is_eligible() {
+                continue;
+            }
+            let Ok(observed) = inputs.observed() else {
+                continue;
+            };
+            out.push((tx.txid(), PartialTweak::from_observed(&observed)));
+        }
+        out
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::elements::{
+        confidential::{Asset, Value},
+        TxOut,
+    };
+    use crate::util::EC;
+    use lwk_test_util::ElementsTestData as Data;
+
+    /// Build a P2WPKH-spending transaction so its input is SP-eligible.
+    fn spending_tx(prev: OutPoint, secret: u8) -> Transaction {
+        let input = Data::p2wpkh_input(prev, &Data::secret_key(secret));
+        Transaction {
+            version: 2,
+            lock_time: crate::elements::LockTime::ZERO,
+            input: vec![input],
+            output: vec![TxOut {
+                asset: Asset::Null,
+                value: Value::Explicit(1000),
+                nonce: crate::elements::confidential::Nonce::Null,
+                script_pubkey: Script::new(),
+                witness: Default::default(),
+            }],
+        }
+    }
+
+    fn block_with(txs: Vec<Transaction>) -> Block {
+        Block {
+            // Reuse the crate's existing test header rather than a bespoke one: the
+            // header is irrelevant here, only txdata is read.
+            header: crate::update::default_blockheader(),
+            txdata: txs,
+        }
+    }
+
+    /// Every prevout this block genuinely needs from the backend, and nothing else:
+    /// same-block outputs are already in hand, peg-in prevouts are Bitcoin txids a
+    /// Liquid backend cannot serve, the coinbase spends nothing, and a prevout wanted
+    /// twice is still one request.
+    #[test]
+    fn required_prevouts_asks_only_for_what_it_cannot_derive() {
+        let external = Data::outpoint(0x11, 0);
+        let funding = spending_tx(Data::outpoint(0x99, 0), 0x41);
+        let spends_local = spending_tx(OutPoint::new(funding.txid(), 0), 0x42);
+        let spends_external = spending_tx(external, 0x43);
+        let also_spends_external = spending_tx(external, 0x44);
+
+        // A peg-in carries a Bitcoin outpoint; the coinbase carries a null one.
+        let bitcoin_op = Data::outpoint(0xbc, 0);
+        let mut pegin = spending_tx(bitcoin_op, 0x45);
+        pegin.input[0].is_pegin = true;
+        let mut coinbase = spending_tx(OutPoint::null(), 0x46);
+        coinbase.input[0].previous_output = OutPoint::null();
+
+        let block = block_with(vec![
+            funding.clone(),
+            spends_local,
+            spends_external,
+            also_spends_external,
+            pegin,
+            coinbase,
+        ]);
+        let required = BlockTweaks::new(&block).required_prevouts();
+
+        assert!(required.contains(&external), "external prevout is needed");
+        assert!(
+            !required.iter().any(|op| op.txid == funding.txid()),
+            "same-block prevout must not be fetched"
+        );
+        assert!(
+            !required.contains(&bitcoin_op),
+            "a peg-in prevout is a Bitcoin txid and must never be fetched from a Liquid backend"
+        );
+        assert!(
+            !required.contains(&OutPoint::null()),
+            "the coinbase spends nothing"
+        );
+        assert_eq!(
+            required.iter().filter(|op| **op == external).count(),
+            1,
+            "a prevout wanted twice is still one request"
+        );
+    }
+
+    /// Block-derived tweaks match direct input derivation.
+    #[test]
+    fn computed_tweak_matches_direct_derivation() {
+        let prev = Data::outpoint(0x11, 0);
+        let tx = spending_tx(prev, 0x41);
+        let block = block_with(vec![tx.clone()]);
+
+        let mut prevouts = HashMap::new();
+        prevouts.insert(prev, Data::p2wpkh(&Data::secret_key(0x41)));
+
+        let tweaks = BlockTweaks::new(&block).compute(&prevouts);
+        assert_eq!(tweaks.len(), 1);
+        assert_eq!(tweaks[0].0, tx.txid());
+
+        let direct = PartialTweak::from_inputs(&[(prev, Data::secret_key(0x41).public_key(&EC))])
+            .expect("direct tweak");
+        assert_eq!(tweaks[0].1, direct, "block tweak must match direct tweak");
+
+        // Without the prevout script there is no eligible input, so the same
+        // transaction must yield no tweak rather than a wrong one.
+        assert!(
+            BlockTweaks::new(&block).compute(&HashMap::new()).is_empty(),
+            "unknown prevout must not produce a tweak"
+        );
+    }
+}
diff --git a/lwk_wollet/src/silentpayments/cache_entry.rs b/lwk_wollet/src/silentpayments/cache_entry.rs
new file mode 100644
index 000000000..813c9230e
--- /dev/null
+++ b/lwk_wollet/src/silentpayments/cache_entry.rs
@@ -0,0 +1,150 @@
+//! Persisted wallet state for a discovered silent-payment output.
+
+use crate::elements::{OutPoint, Script};
+use crate::secp256k1::PublicKey;
+use crate::silentpayments::{SpendTweak, CHANGE_LABEL};
+use crate::Chain;
+
+/// A discovered silent-payment output in wallet cache form.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct SilentPaymentCacheEntry {
+    /// Where the output sits on chain.
+    pub outpoint: OutPoint,
+
+    /// The output's scriptPubKey, `OP_1 <x_only(P_k)>`.
+    pub script_pubkey: Script,
+
+    /// The output counter `k` the scan found this at.
+    pub k: u32,
+
+    /// The BIP-352 label the payment was sent to, if any.
+    pub label: Option<u32>,
+
+    /// `t_k (+ label_tweak_m)` — the scalar that turns a signer's `b_spend` into
+    /// this output's spend key. Not sufficient to spend by itself.
+    pub spend_tweak: SpendTweak,
+
+    /// `BK_k`, the output's blinding pubkey, kept so a confidential address can be
+    /// rendered without re-deriving the shared secret.
+    pub blinding_pubkey: PublicKey,
+}
+
+impl SilentPaymentCacheEntry {
+    /// Classifies change-labeled outputs as internal.
+    pub fn chain(&self) -> Chain {
+        if self.label == Some(CHANGE_LABEL) {
+            Chain::Internal
+        } else {
+            Chain::External
+        }
+    }
+
+    /// Whether this output is the wallet's own silent-payment change.
+    pub fn is_change(&self) -> bool {
+        self.label == Some(CHANGE_LABEL)
+    }
+
+    /// Checks `B_spend + spend_tweak·G == x_only(P_k)`.
+    pub fn verify(&self, spend_base: &PublicKey) -> bool {
+        let Some(expected) = self.spend_tweak.applied_to(spend_base) else {
+            return false;
+        };
+        self.x_only_pubkey() == Some(expected.x_only_public_key().0)
+    }
+
+    /// Extracts `x_only(P_k)` from the stored script.
+    pub fn x_only_pubkey(&self) -> Option<crate::elements::secp256k1_zkp::XOnlyPublicKey> {
+        let bytes = self.script_pubkey.as_bytes();
+        // `OP_1 <32-byte push>`: 0x51 0x20 followed by the key.
+        if bytes.len() != 34 || bytes[0] != 0x51 || bytes[1] != 0x20 {
+            return None;
+        }
+        crate::elements::secp256k1_zkp::XOnlyPublicKey::from_slice(&bytes[2..]).ok()
+    }
+
+    /// Weight of a key-path Taproot satisfaction.
+    pub fn max_weight_to_satisfy(&self) -> usize {
+        crate::silentpayments::SilentPaymentUtxo::MAX_WEIGHT_TO_SATISFY
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::silentpayments::test_fixture::SilentPaymentTestData as Data;
+    use crate::silentpayments::{
+        SilentPaymentReceiver, SilentPaymentScanMaterial, SilentPaymentSender,
+    };
+
+    fn entry_and_material() -> (SilentPaymentCacheEntry, SilentPaymentScanMaterial) {
+        let m = Data::material(0x11, 0x22);
+        let inputs = [
+            (Data::outpoint(1, 0), Data::secret_key(0xA1)),
+            (Data::outpoint(2, 1), Data::secret_key(0xA2)),
+        ];
+        let sender = SilentPaymentSender::from_inputs(&inputs).unwrap();
+        let observed = sender.inputs().observed();
+        let (output, spend_tweak) =
+            SilentPaymentReceiver::new(m).derive_output_from_observed(&observed, 0);
+
+        let entry = SilentPaymentCacheEntry {
+            outpoint: Data::outpoint(9, 0),
+            script_pubkey: output.script_pubkey(),
+            k: 0,
+            label: None,
+            spend_tweak,
+            blinding_pubkey: output.blinding_pubkey,
+        };
+        (entry, m)
+    }
+
+    #[test]
+    fn entry_verifies_only_against_its_own_material() {
+        let (entry, m) = entry_and_material();
+        assert!(
+            entry.verify(&m.spend_pubkey()),
+            "the stored tweak must verify"
+        );
+
+        let stranger = Data::material(0x77, 0x88);
+        assert!(
+            !entry.verify(&stranger.spend_pubkey()),
+            "a different spend base must not verify this entry"
+        );
+
+        let mut corrupted = entry;
+        corrupted.spend_tweak = SpendTweak::from_be_bytes([0x5A; 32]).unwrap();
+        assert!(
+            !corrupted.verify(&m.spend_pubkey()),
+            "a corrupted tweak must fail rather than be trusted"
+        );
+    }
+
+    #[test]
+    fn change_label_maps_to_the_internal_chain() {
+        let (mut entry, _) = entry_and_material();
+        assert_eq!(entry.chain(), Chain::External);
+        assert!(!entry.is_change());
+
+        entry.label = Some(CHANGE_LABEL);
+        assert_eq!(entry.chain(), Chain::Internal);
+        assert!(entry.is_change());
+
+        entry.label = Some(7);
+        assert_eq!(entry.chain(), Chain::External);
+        assert!(!entry.is_change());
+    }
+
+    #[test]
+    fn entry_is_read_as_taproot_or_not_at_all() {
+        let (entry, _) = entry_and_material();
+        assert_eq!(
+            entry.max_weight_to_satisfy(),
+            crate::silentpayments::SilentPaymentUtxo::MAX_WEIGHT_TO_SATISFY
+        );
+
+        let mut not_taproot = entry;
+        not_taproot.script_pubkey = Script::from(vec![0x00, 0x14, 0xAB, 0xCD]);
+        assert!(not_taproot.x_only_pubkey().is_none());
+    }
+}
diff --git a/lwk_wollet/src/silentpayments/inputs.rs b/lwk_wollet/src/silentpayments/inputs.rs
new file mode 100644
index 000000000..ec3cd26a6
--- /dev/null
+++ b/lwk_wollet/src/silentpayments/inputs.rs
@@ -0,0 +1,454 @@
+//! Silent-payment input aggregation.
+
+use crate::elements::OutPoint;
+use crate::hashes::{Hash, HashEngine};
+use crate::secp256k1::{PublicKey, Scalar, SecretKey};
+use crate::silentpayments::tags::InputsHash;
+use crate::util::EC;
+use std::collections::HashMap;
+
+/// Computes BIP-352 input hashes.
+pub(crate) struct InputHasher;
+
+impl InputHasher {
+    /// `input_hash = H_BIP0352/Inputs(outpoint_L || A)`.
+    ///
+    /// `outpoint_l` is the serialization of the lexicographically smallest input
+    /// outpoint; `a_sum_pubkey` is `A = a·G` (the sum of eligible input pubkeys).
+    pub(crate) fn hash(outpoint_l: &[u8], a_sum_pubkey: &PublicKey) -> Scalar {
+        let mut eng = InputsHash::engine();
+        eng.input(outpoint_l);
+        eng.input(&a_sum_pubkey.serialize());
+        let h = InputsHash::from_engine(eng);
+        // BIP-352 treats the hash directly as a scalar.
+        Scalar::from_be_bytes(h.to_byte_array()).expect("input hash within curve order")
+    }
+
+    /// BIP-352's 36-byte form: `txid (32, internal) || vout (4, LE)`.
+    pub(crate) fn serialize_outpoint(outpoint: &crate::elements::OutPoint) -> Vec<u8> {
+        crate::elements::encode::serialize(outpoint)
+    }
+
+    /// Hashes the smallest serialized outpoint.
+    pub(crate) fn hash_over<'a>(
+        outpoints: impl Iterator<Item = &'a crate::elements::OutPoint>,
+        a_sum_pubkey: &PublicKey,
+    ) -> Scalar {
+        let outpoint_l = outpoints
+            .map(Self::serialize_outpoint)
+            .min()
+            .expect("caller checked inputs are non-empty");
+        Self::hash(&outpoint_l, a_sum_pubkey)
+    }
+}
+
+/// Eligible input key and spend type.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum InputKey {
+    /// A key-path Taproot input: normalize to even-Y before summing.
+    Taproot(SecretKey),
+    /// A P2WPKH / P2SH-P2WPKH input: sum as-is.
+    Plain(SecretKey),
+}
+
+impl InputKey {
+    /// Normalized secret key.
+    pub fn normalized(&self) -> SecretKey {
+        match self {
+            InputKey::Taproot(sk) => {
+                if sk.public_key(&EC).x_only_public_key().1
+                    == crate::elements::secp256k1_zkp::Parity::Odd
+                {
+                    sk.negate()
+                } else {
+                    *sk
+                }
+            }
+            InputKey::Plain(sk) => *sk,
+        }
+    }
+
+    /// The public key an observer recovers for this input, i.e. `normalized()·G`.
+    pub fn public_key(&self) -> PublicKey {
+        self.normalized().public_key(&EC)
+    }
+}
+
+/// Errors aggregating silent-payment inputs.
+#[derive(thiserror::Error, Debug, Clone, Copy, PartialEq, Eq)]
+pub enum SilentPaymentInputError {
+    /// No eligible inputs were provided.
+    #[error("no eligible silent payment inputs")]
+    NoInputs,
+
+    /// A selected input should contribute to the sender sum, but its private key
+    /// was not supplied by the signer/provider.
+    #[error("missing private key for an eligible silent payment input")]
+    MissingKey,
+
+    /// The summed private key is zero (the inputs cancel out); the payment is
+    /// undefined per BIP-352 and the transaction must be aborted.
+    #[error("eligible input keys sum to zero")]
+    SumIsZero,
+
+    /// More outputs than BIP-352's `K_max` allows in one recipient group; the
+    /// receiver is forbidden to scan that far and could not spend them.
+    #[error("too many silent payment outputs in one transaction (limit is K_max = 2323)")]
+    TooManyOutputs,
+}
+
+/// Sender-side aggregated input data.
+#[derive(Debug, Clone, Copy)]
+pub struct SilentPaymentInputs {
+    /// `a = Σ a_i` over eligible inputs.
+    pub a_sum: SecretKey,
+    /// `A = a·G`.
+    pub a_pubkey: PublicKey,
+    /// `input_hash = H_BIP0352/Inputs(outpoint_L || A)`.
+    pub input_hash: Scalar,
+}
+
+impl SilentPaymentInputs {
+    /// Aggregate `(outpoint, private_key)` pairs into `a`, `A`, and `input_hash`.
+    pub fn aggregate(
+        inputs: &[(crate::elements::OutPoint, SecretKey)],
+    ) -> Result<Self, SilentPaymentInputError> {
+        let tagged: Vec<_> = inputs
+            .iter()
+            .map(|(o, sk)| (*o, InputKey::Plain(*sk)))
+            .collect();
+        Self::aggregate_keys(&tagged)
+    }
+
+    /// Aggregates typed eligible inputs.
+    pub fn aggregate_keys(
+        inputs: &[(crate::elements::OutPoint, InputKey)],
+    ) -> Result<Self, SilentPaymentInputError> {
+        Self::aggregate_with_extra_outpoints(inputs, &[])
+    }
+
+    /// Aggregates eligible inputs and keyless-input outpoints.
+    pub fn aggregate_with_extra_outpoints(
+        inputs: &[(crate::elements::OutPoint, InputKey)],
+        extra_outpoints: &[crate::elements::OutPoint],
+    ) -> Result<Self, SilentPaymentInputError> {
+        let (first, rest) = inputs
+            .split_first()
+            .ok_or(SilentPaymentInputError::NoInputs)?;
+
+        // `SecretKey` cannot represent an intermediate zero sum.
+        let mut a_sum = Some(first.1.normalized());
+        for (_, key) in rest {
+            let next = key.normalized();
+            a_sum = match a_sum {
+                Some(current) => current
+                    .add_tweak(&Scalar::from_be_bytes(next.secret_bytes()).expect("scalar"))
+                    .ok(),
+                None => Some(next),
+            };
+        }
+        let a_sum = a_sum.ok_or(SilentPaymentInputError::SumIsZero)?;
+        let a_pubkey = a_sum.public_key(&EC);
+
+        let input_hash = InputHasher::hash_over(
+            inputs.iter().map(|(o, _)| o).chain(extra_outpoints.iter()),
+            &a_pubkey,
+        );
+
+        Ok(SilentPaymentInputs {
+            a_sum,
+            a_pubkey,
+            input_hash,
+        })
+    }
+
+    /// The observer's view of these same inputs.
+    pub fn observed(&self) -> ObservedInputs {
+        ObservedInputs {
+            a_pubkey: self.a_pubkey,
+            input_hash: self.input_hash,
+        }
+    }
+}
+
+/// Observer-side aggregated public input data.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct ObservedInputs {
+    /// `A = Σ A_i`.
+    pub a_pubkey: PublicKey,
+    /// `input_hash = H_BIP0352/Inputs(outpoint_L || A)`.
+    pub input_hash: Scalar,
+}
+
+impl ObservedInputs {
+    /// Aggregate `(outpoint, pubkey)` pairs into `A` and `input_hash`.
+    pub fn aggregate(
+        inputs: &[(crate::elements::OutPoint, PublicKey)],
+    ) -> Result<Self, SilentPaymentInputError> {
+        Self::aggregate_with_extra_outpoints(inputs, &[])
+    }
+
+    /// Aggregates observed inputs and keyless-input outpoints.
+    pub fn aggregate_with_extra_outpoints(
+        inputs: &[(crate::elements::OutPoint, PublicKey)],
+        extra_outpoints: &[crate::elements::OutPoint],
+    ) -> Result<Self, SilentPaymentInputError> {
+        let (first, rest) = inputs
+            .split_first()
+            .ok_or(SilentPaymentInputError::NoInputs)?;
+
+        // An intermediate point at infinity is the additive identity.
+        let mut a_pubkey = Some(first.1);
+        for (_, pk) in rest {
+            a_pubkey = match a_pubkey {
+                Some(current) => current.combine(pk).ok(),
+                None => Some(*pk),
+            };
+        }
+        let a_pubkey = a_pubkey.ok_or(SilentPaymentInputError::SumIsZero)?;
+
+        let input_hash = InputHasher::hash_over(
+            inputs.iter().map(|(o, _)| o).chain(extra_outpoints.iter()),
+            &a_pubkey,
+        );
+
+        Ok(ObservedInputs {
+            a_pubkey,
+            input_hash,
+        })
+    }
+}
+
+/// Result of classifying one selected transaction input for silent payments.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum InputKeyResult {
+    /// The input contributes this private key to the sender-side sum.
+    Eligible(InputKey),
+    /// The input belongs to the transaction but contributes no key, such as a peg-in.
+    Ineligible,
+    /// The input is eligible in principle, but its private key was not supplied.
+    Missing,
+}
+
+/// Supplies silent-payment input classification and, where available, key material.
+pub trait SilentPaymentInputProvider {
+    /// Classifies `outpoint` and supplies available key material.
+    fn input_key(&self, outpoint: &OutPoint) -> InputKeyResult;
+}
+
+/// A [`SilentPaymentInputProvider`] backed by an in-memory map.
+#[derive(Debug, Clone, Default)]
+pub struct MapInputProvider {
+    keys: HashMap<OutPoint, InputKey>,
+}
+
+impl MapInputProvider {
+    /// An empty provider.
+    pub fn new() -> Self {
+        Self::default()
+    }
+
+    /// Register the key spending `outpoint`.
+    pub fn insert(mut self, outpoint: OutPoint, key: InputKey) -> Self {
+        self.keys.insert(outpoint, key);
+        self
+    }
+}
+
+impl FromIterator<(OutPoint, InputKey)> for MapInputProvider {
+    fn from_iter<T: IntoIterator<Item = (OutPoint, InputKey)>>(iter: T) -> Self {
+        Self {
+            keys: iter.into_iter().collect(),
+        }
+    }
+}
+
+impl SilentPaymentInputProvider for MapInputProvider {
+    fn input_key(&self, outpoint: &OutPoint) -> InputKeyResult {
+        self.keys
+            .get(outpoint)
+            .copied()
+            .map(InputKeyResult::Eligible)
+            .unwrap_or(InputKeyResult::Missing)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use lwk_test_util::ElementsTestData as Data;
+
+    #[test]
+    fn map_provider_reports_known_and_unknown_inputs() {
+        let known = Data::outpoint(0x10, 0);
+        let unknown = Data::outpoint(0x99, 7);
+
+        let provider =
+            MapInputProvider::new().insert(known, InputKey::Plain(Data::secret_key(0x31)));
+
+        assert_eq!(
+            provider.input_key(&known),
+            InputKeyResult::Eligible(InputKey::Plain(Data::secret_key(0x31)))
+        );
+        assert_eq!(provider.input_key(&unknown), InputKeyResult::Missing);
+
+        // Taproot keys keep their tag so the even-Y normalization is not lost.
+        let provider: MapInputProvider = [(known, InputKey::Taproot(Data::secret_key(0x31)))]
+            .into_iter()
+            .collect();
+        assert_eq!(
+            provider.input_key(&known),
+            InputKeyResult::Eligible(InputKey::Taproot(Data::secret_key(0x31)))
+        );
+    }
+
+    #[test]
+    fn input_aggregation_sender_and_observer_agree() {
+        let inputs_sk = [
+            (Data::outpoint(0x30, 1), Data::secret_key(0x30)),
+            (Data::outpoint(0x10, 0), Data::secret_key(0x31)), // smallest txid → outpoint_L
+            (Data::outpoint(0x20, 7), Data::secret_key(0x32)),
+        ];
+        let agg = SilentPaymentInputs::aggregate(&inputs_sk).unwrap();
+
+        let inputs_pk: Vec<_> = inputs_sk
+            .iter()
+            .map(|(o, s)| (*o, s.public_key(&EC)))
+            .collect();
+        let obs = ObservedInputs::aggregate(&inputs_pk).unwrap();
+
+        assert_eq!(
+            agg.a_pubkey, obs.a_pubkey,
+            "A mismatch between sender and observer"
+        );
+        assert_eq!(
+            agg.input_hash, obs.input_hash,
+            "input_hash mismatch between sender and observer"
+        );
+        assert_eq!(agg.observed(), obs);
+        assert_eq!(agg.a_sum.public_key(&EC), agg.a_pubkey);
+
+        let reversed: Vec<_> = inputs_sk.iter().rev().copied().collect();
+        let shuffled = SilentPaymentInputs::aggregate(&reversed).unwrap();
+        assert_eq!(shuffled.input_hash, agg.input_hash);
+        assert_eq!(shuffled.a_pubkey, agg.a_pubkey);
+    }
+
+    /// `outpoint_L` uses serialized, not `OutPoint`, ordering.
+    #[test]
+    fn outpoint_l_uses_serialized_byte_order_not_outpoint_ord() {
+        let low_vout = Data::outpoint(0x10, 1); // serializes ...01000000
+        let high_vout = Data::outpoint(0x10, 256); // serializes ...00010000
+
+        // The two orderings must genuinely disagree, or the test is vacuous.
+        assert!(low_vout < high_vout, "numerically vout 1 < vout 256");
+        assert!(
+            InputHasher::serialize_outpoint(&high_vout)
+                < InputHasher::serialize_outpoint(&low_vout),
+            "as bytes, vout 256 sorts before vout 1"
+        );
+
+        let a = Data::secret_key(0x31);
+        let agg = SilentPaymentInputs::aggregate(&[(low_vout, a), (high_vout, a)]).unwrap();
+
+        let expected =
+            InputHasher::hash(&InputHasher::serialize_outpoint(&high_vout), &agg.a_pubkey);
+        assert_eq!(
+            agg.input_hash, expected,
+            "input_hash must use the byte-wise smallest outpoint"
+        );
+
+        // Not the hash the `OutPoint: Ord` minimum would produce.
+        let wrong = InputHasher::hash(&InputHasher::serialize_outpoint(&low_vout), &agg.a_pubkey);
+        assert_ne!(agg.input_hash, wrong);
+
+        let obs = ObservedInputs::aggregate(&[
+            (low_vout, a.public_key(&EC)),
+            (high_vout, a.public_key(&EC)),
+        ])
+        .unwrap();
+        assert_eq!(obs.input_hash, agg.input_hash);
+    }
+
+    /// ELIP `test_taproot_even_y_negation`.
+    #[test]
+    fn taproot_input_keys_are_negated_to_even_y() {
+        use crate::elements::secp256k1_zkp::Parity;
+
+        let odd = (1u8..=0xFF)
+            .map(Data::secret_key)
+            .find(|k| k.public_key(&EC).x_only_public_key().1 == Parity::Odd)
+            .expect("an odd-Y key exists");
+        let even = (1u8..=0xFF)
+            .map(Data::secret_key)
+            .find(|k| k.public_key(&EC).x_only_public_key().1 == Parity::Even)
+            .expect("an even-Y key exists");
+
+        assert_eq!(InputKey::Taproot(odd).normalized(), odd.negate());
+        assert_ne!(
+            InputKey::Taproot(odd).normalized(),
+            InputKey::Plain(odd).normalized()
+        );
+        // Negation preserves the x-only key.
+        assert_eq!(
+            InputKey::Taproot(odd).public_key().x_only_public_key().0,
+            odd.public_key(&EC).x_only_public_key().0
+        );
+
+        assert_eq!(InputKey::Taproot(even).normalized(), even);
+        assert_eq!(
+            InputKey::Taproot(even).normalized(),
+            InputKey::Plain(even).normalized()
+        );
+
+        let op = Data::outpoint(0x10, 0);
+        let agg = SilentPaymentInputs::aggregate_keys(&[(op, InputKey::Taproot(odd))]).unwrap();
+        let obs = ObservedInputs::aggregate(&[(op, InputKey::Taproot(odd).public_key())]).unwrap();
+        assert_eq!(agg.a_pubkey, obs.a_pubkey);
+        assert_eq!(agg.input_hash, obs.input_hash);
+    }
+
+    /// ELIP `test_pegin_input_excluded_from_shared_secret`.
+    #[test]
+    fn pegin_outpoint_participates_in_outpoint_l_but_contributes_no_key() {
+        let eligible = [
+            (
+                Data::outpoint(0x61, 0),
+                InputKey::Plain(Data::secret_key(0x51)),
+            ),
+            (
+                Data::outpoint(0x62, 1),
+                InputKey::Plain(Data::secret_key(0x52)),
+            ),
+        ];
+        // Smaller than every eligible outpoint, so it decides outpoint_L.
+        let pegin = Data::outpoint(0x01, 0);
+
+        let without = SilentPaymentInputs::aggregate_keys(&eligible).unwrap();
+        let with =
+            SilentPaymentInputs::aggregate_with_extra_outpoints(&eligible, &[pegin]).unwrap();
+
+        assert_eq!(with.a_sum, without.a_sum);
+        assert_eq!(with.a_pubkey, without.a_pubkey);
+
+        assert_ne!(
+            with.input_hash, without.input_hash,
+            "a peg-in outpoint smaller than every eligible one must change outpoint_L"
+        );
+        let expected = InputHasher::hash(&InputHasher::serialize_outpoint(&pegin), &with.a_pubkey);
+        assert_eq!(with.input_hash, expected);
+
+        let observed: Vec<_> = eligible.iter().map(|(o, k)| (*o, k.public_key())).collect();
+        let obs = ObservedInputs::aggregate_with_extra_outpoints(&observed, &[pegin]).unwrap();
+        assert_eq!(obs.input_hash, with.input_hash);
+        assert_eq!(obs.a_pubkey, with.a_pubkey);
+    }
+
+    #[test]
+    fn input_aggregation_rejects_empty() {
+        assert!(matches!(
+            SilentPaymentInputs::aggregate(&[]),
+            Err(SilentPaymentInputError::NoInputs)
+        ));
+    }
+}
diff --git a/lwk_wollet/src/silentpayments/mod.rs b/lwk_wollet/src/silentpayments/mod.rs
new file mode 100644
index 000000000..7d49adc7f
--- /dev/null
+++ b/lwk_wollet/src/silentpayments/mod.rs
@@ -0,0 +1,159 @@
+//! Silent Payments (BIP-352) on Liquid, per the Liquid silent payments ELIP.
+//!
+//! This crate holds `b_scan`, the public `B_spend`, and per-output [`SpendTweak`]s:
+//! enough to detect, unblind, and track a silent payment, never enough to sign one.
+//! A tweak is verified publicly as `B_spend + spend_tweak·G == spend pubkey`.
+//!
+//! Silent-payment scripts are derived from transaction inputs, not wallet descriptors.
+
+pub mod address;
+pub mod block_tweaks;
+pub mod cache_entry;
+pub mod inputs;
+pub mod output;
+pub mod receiver;
+pub mod recipient;
+pub mod scan_material;
+pub mod scanner;
+pub mod sender;
+pub mod shared_secret;
+pub mod sync;
+mod tags;
+#[cfg(test)]
+pub(crate) mod test_fixture;
+pub mod tweak_server;
+pub mod tx_inputs;
+pub mod tx_scan;
+pub mod txout;
+pub mod utxo;
+
+pub use address::{SilentPaymentAddress, SilentPaymentAddressError};
+pub use block_tweaks::BlockTweaks;
+pub use cache_entry::SilentPaymentCacheEntry;
+pub use inputs::{
+    InputKey, InputKeyResult, MapInputProvider, ObservedInputs, SilentPaymentInputError,
+    SilentPaymentInputProvider, SilentPaymentInputs,
+};
+pub use output::SilentPaymentOutput;
+pub use receiver::{SilentPaymentReceiver, SpendTweak};
+pub use recipient::{ResolvedSilentPayment, SilentPaymentRecipient};
+pub use scan_material::{
+    SilentPaymentAccount, SilentPaymentScan, SilentPaymentScanMaterial, CHANGE_LABEL,
+};
+pub use scanner::{LabeledHit, SilentPaymentScanner};
+pub use sender::SilentPaymentSender;
+pub use shared_secret::SharedSecret;
+pub use sync::SilentPaymentSync;
+pub use tweak_server::{PartialTweak, SilentPaymentTweakClient};
+pub use tx_inputs::{InputPubkeyRecovery, SilentPaymentTxInputs};
+pub use tx_scan::SilentPaymentTxScanner;
+pub use txout::SpTxOutBuilder;
+pub use utxo::SilentPaymentUtxo;
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::silentpayments::test_fixture::SilentPaymentTestData as Data;
+
+    /// Test-only: production wallet code never holds `b_spend`.
+    fn reconstruct_spend_key(
+        b_spend: &crate::secp256k1::SecretKey,
+        tweak: &SpendTweak,
+    ) -> crate::secp256k1::SecretKey {
+        b_spend
+            .add_tweak(tweak.as_scalar())
+            .expect("test vectors are in range")
+    }
+
+    /// The ELIP's known-answer vectors, pinned so an independent implementation can
+    /// confirm cross-implementation agreement.
+    #[test]
+    fn known_answer_vectors() {
+        use crate::elements::hashes::hex::DisplayHex;
+
+        let b_spend = Data::secret_key(0x22);
+        let keys = Data::material(0x11, 0x22);
+        let inputs = [
+            (Data::outpoint(0x10, 0), Data::secret_key(0x31)),
+            (Data::outpoint(0x20, 1), Data::secret_key(0x32)),
+        ];
+        let sender = SilentPaymentSender::from_inputs(&inputs).unwrap();
+        let agg = *sender.inputs();
+        let receiver = SilentPaymentReceiver::new(keys);
+
+        assert_eq!(
+            agg.a_pubkey.serialize().to_lower_hex_string(),
+            "031195a8046dcbb8e17034bca630065e7a0982e4e36f6f7e5a8d4554e4846fcd99",
+            "A = a·G"
+        );
+        assert_eq!(
+            agg.input_hash.to_be_bytes().to_lower_hex_string(),
+            "d392922c00280a7e8d282182f5026f2fddbc74c1e1de18b4822128b2b77ec641",
+            "input_hash"
+        );
+
+        // (k, P_spend, BK, bk, spend_sk, scriptPubKey)
+        let expected: [(u32, &str, &str, &str, &str, &str); 2] = [
+            (
+                0,
+                "02a29d9716417c964ca9e477343e71ffe730a4991a3eaad668eabec84e9feb7931",
+                "0344e1289497e6da66fde710d2f38de053fc07355e405524401d7d609df5a1a8cc",
+                "70ab8897b64bd21b427339ff4d014b883191ef6425862246c53bfc27a59aa3f0",
+                "f03c436d2cd67ae1fecf7d88a38aa3a03c0abea43feaf6da8eb71e2e3a866bda",
+                "5120a29d9716417c964ca9e477343e71ffe730a4991a3eaad668eabec84e9feb7931",
+            ),
+            (
+                1,
+                "0229d77654023af267dbe9cb7ff1956f947c816f203494381308387168fb010c92",
+                "03efdeda770ccdbe8bf466fba48bfd2b2c436ab0c04658fc6d6c277de5078129fa",
+                "945ba73a9804f62089c7d2ffdc079031031f0aebab372cec17ef9c110ebceb10",
+                "9eff3472230fc83ef5ea8f8c80401c4eecd595a048bd2482a107d3a49baa5a58",
+                "512029d77654023af267dbe9cb7ff1956f947c816f203494381308387168fb010c92",
+            ),
+        ];
+
+        for (k, p_spend, bk_pub, bk_sec, spend_sk_hex, script_hex) in expected {
+            let out = sender.derive_output(&keys.address(), k);
+            let (recv_out, spend_tweak) = receiver.derive_output_from_observed(&agg.observed(), k);
+            assert_eq!(out, recv_out);
+
+            assert_eq!(
+                out.spend_pubkey.serialize().to_lower_hex_string(),
+                p_spend,
+                "P_spend k={k}"
+            );
+            assert_eq!(
+                out.blinding_pubkey.serialize().to_lower_hex_string(),
+                bk_pub,
+                "BK k={k}"
+            );
+            assert_eq!(
+                out.blinding_seckey.secret_bytes().to_lower_hex_string(),
+                bk_sec,
+                "bk k={k}"
+            );
+            assert_eq!(
+                reconstruct_spend_key(&b_spend, &spend_tweak)
+                    .secret_bytes()
+                    .to_lower_hex_string(),
+                spend_sk_hex,
+                "b_spend + t_k k={k}"
+            );
+            assert_eq!(
+                spend_tweak.applied_to(&keys.spend_pubkey()).unwrap(),
+                out.spend_pubkey,
+                "B_spend + t_k*G k={k}"
+            );
+            assert_eq!(
+                out.script_pubkey().as_bytes().to_lower_hex_string(),
+                script_hex,
+                "scriptPubKey k={k}"
+            );
+        }
+
+        assert_eq!(
+            keys.address().encode(crate::Network::Liquid),
+            "lqsp1qqd8n2k7uklxq4aegau7vawtptkgxsja4kt99lpv6krctwpq8tpc65qjxd4lu4etruh9sngx3su9mtqp5fqzxz7re59y5nnez9p03ht3lyudcfhfe",
+        );
+    }
+}
diff --git a/lwk_wollet/src/silentpayments/output.rs b/lwk_wollet/src/silentpayments/output.rs
new file mode 100644
index 000000000..c760bab7f
--- /dev/null
+++ b/lwk_wollet/src/silentpayments/output.rs
@@ -0,0 +1,28 @@
+//! Per-output silent payment key material.
+
+use crate::secp256k1::{PublicKey, SecretKey};
+
+/// The per-output key material for output index `k`.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct SilentPaymentOutput {
+    /// `P_spend_k = B_spend + t_k·G`.
+    pub spend_pubkey: PublicKey,
+    /// `BK_k = bk_k·G`.
+    pub blinding_pubkey: PublicKey,
+    /// `bk_k`, recomputed by the receiver to unblind.
+    pub blinding_seckey: SecretKey,
+}
+
+impl SilentPaymentOutput {
+    /// `P_spend_k` as an x-only key.
+    pub fn x_only_pubkey(&self) -> crate::elements::secp256k1_zkp::XOnlyPublicKey {
+        self.spend_pubkey.x_only_public_key().0
+    }
+
+    /// The `OP_1 <x_only(P_k)>` scriptPubKey.
+    pub fn script_pubkey(&self) -> crate::elements::Script {
+        use crate::elements::schnorr::TweakedPublicKey;
+        let tweaked = TweakedPublicKey::new(self.x_only_pubkey());
+        crate::elements::Script::new_v1_p2tr_tweaked(tweaked)
+    }
+}
diff --git a/lwk_wollet/src/silentpayments/receiver.rs b/lwk_wollet/src/silentpayments/receiver.rs
new file mode 100644
index 000000000..8bb5d57bb
--- /dev/null
+++ b/lwk_wollet/src/silentpayments/receiver.rs
@@ -0,0 +1,160 @@
+//! Recomputes silent-payment outputs and spend tweaks.
+
+use crate::secp256k1::{PublicKey, Scalar};
+use crate::silentpayments::inputs::InputHasher;
+use crate::silentpayments::{
+    ObservedInputs, SharedSecret, SilentPaymentOutput, SilentPaymentScan, SilentPaymentScanMaterial,
+};
+
+/// Scalar that tweaks `b_spend` into an output spend key.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct SpendTweak(Scalar);
+
+impl SpendTweak {
+    /// Wrap a raw scalar as a spend tweak.
+    pub fn from_scalar(scalar: Scalar) -> Self {
+        SpendTweak(scalar)
+    }
+
+    /// Underlying scalar.
+    pub fn as_scalar(&self) -> &Scalar {
+        &self.0
+    }
+
+    /// The 32 big-endian bytes, as persisted and as carried in PSET metadata.
+    pub fn to_be_bytes(self) -> [u8; 32] {
+        self.0.to_be_bytes()
+    }
+
+    /// Rebuild from persisted bytes.
+    pub fn from_be_bytes(bytes: [u8; 32]) -> Option<Self> {
+        Scalar::from_be_bytes(bytes).ok().map(SpendTweak)
+    }
+
+    /// Adds a label tweak.
+    pub fn add_label_tweak(self, label_tweak: &Scalar) -> Option<Self> {
+        let combined = crate::secp256k1::SecretKey::from_slice(&self.0.to_be_bytes())
+            .ok()?
+            .add_tweak(label_tweak)
+            .ok()?;
+        Scalar::from_be_bytes(combined.secret_bytes())
+            .ok()
+            .map(SpendTweak)
+    }
+
+    /// Applies this tweak to a spend base.
+    pub fn applied_to(&self, spend_base: &PublicKey) -> Option<PublicKey> {
+        spend_base.add_exp_tweak(&crate::util::EC, &self.0).ok()
+    }
+}
+
+/// Recomputes outputs from scan material.
+#[derive(Debug, Clone, Copy)]
+pub struct SilentPaymentReceiver {
+    material: SilentPaymentScanMaterial,
+}
+
+impl SilentPaymentReceiver {
+    /// Build a receiver from the wallet's scan-only material.
+    pub fn new(material: SilentPaymentScanMaterial) -> Self {
+        SilentPaymentReceiver { material }
+    }
+
+    /// The scan-only material backing this receiver.
+    pub fn material(&self) -> &SilentPaymentScanMaterial {
+        &self.material
+    }
+
+    /// Recomputes output `k` from aggregated inputs.
+    pub fn derive_output(
+        &self,
+        a_sum_pubkey: &PublicKey,
+        input_hash: &Scalar,
+        k: u32,
+    ) -> (SilentPaymentOutput, SpendTweak) {
+        let shared_secret =
+            SharedSecret::for_receiver(&self.material.scan_seckey(), a_sum_pubkey, input_hash);
+        self.derive_from_shared_secret(&shared_secret, k)
+    }
+
+    /// Recompute the output for index `k` from an observer's aggregated inputs.
+    pub fn derive_output_from_observed(
+        &self,
+        observed: &ObservedInputs,
+        k: u32,
+    ) -> (SilentPaymentOutput, SpendTweak) {
+        self.derive_output(&observed.a_pubkey, &observed.input_hash, k)
+    }
+
+    /// Recomputes output `k` from an aggregate pubkey and raw outpoint.
+    pub fn derive_output_from_raw(
+        &self,
+        a_sum_pubkey: &PublicKey,
+        outpoint_l: &[u8],
+        k: u32,
+    ) -> (SilentPaymentOutput, SpendTweak) {
+        let ih = InputHasher::hash(outpoint_l, a_sum_pubkey);
+        self.derive_output(a_sum_pubkey, &ih, k)
+    }
+
+    /// Derives output `k` from a shared secret.
+    pub(crate) fn derive_from_shared_secret(
+        &self,
+        shared_secret: &SharedSecret,
+        k: u32,
+    ) -> (SilentPaymentOutput, SpendTweak) {
+        let out = shared_secret.derive_output(&self.material.spend_pubkey(), k);
+        (out, SpendTweak::from_scalar(shared_secret.spend_tweak(k)))
+    }
+
+    /// The labeled spend base `B_m` for label `m`, computed by public point addition.
+    pub(crate) fn labeled_spend_base(&self, m: u32) -> PublicKey {
+        self.material.labeled_spend_base(m)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::silentpayments::test_fixture::SilentPaymentTestData as Data;
+    use crate::silentpayments::SilentPaymentSender;
+
+    fn material() -> SilentPaymentScanMaterial {
+        Data::material(0x11, 0x22)
+    }
+
+    /// Spend tweaks reproduce output keys from public data.
+    #[test]
+    fn spend_tweak_reproduces_the_output_key_from_public_data() {
+        let m = material();
+        let inputs = [
+            (Data::outpoint(1, 0), Data::secret_key(0xA1)),
+            (Data::outpoint(2, 1), Data::secret_key(0xA2)),
+        ];
+        let sender = SilentPaymentSender::from_inputs(&inputs).unwrap();
+        let receiver = SilentPaymentReceiver::new(m);
+
+        for k in 0..3u32 {
+            let (out, tweak) = receiver.derive_output_from_observed(&sender.inputs().observed(), k);
+            assert_eq!(
+                tweak.applied_to(&m.spend_pubkey()).unwrap(),
+                out.spend_pubkey,
+                "B_spend + t_k*G must equal the output spend key at k={k}"
+            );
+            assert_eq!(
+                SpendTweak::from_be_bytes(tweak.to_be_bytes()),
+                Some(tweak),
+                "a persisted tweak must come back unchanged"
+            );
+        }
+
+        let base_tweak = SpendTweak::from_scalar(Scalar::from_be_bytes([0x09; 32]).unwrap());
+        let label = 7u32;
+        let combined = base_tweak.add_label_tweak(&m.label_tweak(label)).unwrap();
+        assert_eq!(
+            combined.applied_to(&m.spend_pubkey()).unwrap(),
+            base_tweak.applied_to(&m.labeled_spend_base(label)).unwrap(),
+            "folding a label in must equal tweaking the labeled base"
+        );
+    }
+}
diff --git a/lwk_wollet/src/silentpayments/recipient.rs b/lwk_wollet/src/silentpayments/recipient.rs
new file mode 100644
index 000000000..9d85e844a
--- /dev/null
+++ b/lwk_wollet/src/silentpayments/recipient.rs
@@ -0,0 +1,136 @@
+//! Pending silent-payment recipients and input-dependent resolution.
+
+use crate::elements::{AssetId, OutPoint};
+use crate::silentpayments::{InputKey, SilentPaymentAddress, SilentPaymentSender};
+use crate::{Error, Recipient};
+use std::collections::HashMap;
+
+/// A pending silent payment: who to pay, how much, and of which asset.
+///
+/// Created by [`crate::TxBuilder::add_silent_payment_recipient()`].
+#[derive(Debug, Clone)]
+pub struct SilentPaymentRecipient {
+    /// The receiver's reusable silent payment address.
+    pub address: SilentPaymentAddress,
+
+    /// The amount to send, in satoshi.
+    pub satoshi: u64,
+
+    /// The asset to send.
+    pub asset: AssetId,
+}
+
+impl SilentPaymentRecipient {
+    /// Queue a payment of `satoshi` units of `asset` to `address`.
+    pub fn new(address: SilentPaymentAddress, satoshi: u64, asset: AssetId) -> Self {
+        Self {
+            address,
+            satoshi,
+            asset,
+        }
+    }
+
+    /// Resolves recipients using the transaction's eligible input keys.
+    pub fn resolve_all(
+        recipients: &[SilentPaymentRecipient],
+        inputs: &[(OutPoint, InputKey)],
+        extra_outpoints: &[OutPoint],
+    ) -> Result<Vec<ResolvedSilentPayment>, Error> {
+        if recipients.is_empty() {
+            return Ok(vec![]);
+        }
+
+        let sender = SilentPaymentSender::from_input_keys(inputs, extra_outpoints)?;
+
+        let mut next_index_by_scan: HashMap<_, u32> = HashMap::new();
+        recipients
+            .iter()
+            .map(|r| {
+                let k = next_index_by_scan.entry(r.address.scan).or_insert(0);
+                let index = *k;
+                *k = (*k)
+                    .checked_add(1)
+                    .ok_or(Error::SilentPaymentRequiresKeys(0))?;
+                let k = index;
+                let out = sender
+                    .try_derive_output(&r.address, k)
+                    .ok_or(crate::silentpayments::SilentPaymentInputError::TooManyOutputs)?;
+
+                Ok(ResolvedSilentPayment {
+                    recipient: Recipient {
+                        satoshi: r.satoshi,
+                        script_pubkey: out.script_pubkey(),
+                        blinding_pubkey: Some(out.blinding_pubkey),
+                        asset: r.asset,
+                    },
+                    output: out,
+                })
+            })
+            .collect()
+    }
+}
+
+/// A resolved recipient and its derived silent-payment output.
+#[derive(Debug, Clone)]
+pub struct ResolvedSilentPayment {
+    /// The recipient as passed to the transaction builder.
+    pub recipient: Recipient,
+
+    /// The derived output the recipient resolves to.
+    pub output: crate::silentpayments::SilentPaymentOutput,
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::silentpayments::test_fixture::SilentPaymentTestData as Data;
+    use crate::silentpayments::SilentPaymentScan;
+
+    /// Several silent payments in one transaction must land on DISTINCT outputs:
+    /// each recipient takes the next index `k`, per BIP-352.
+    #[test]
+    fn multiple_recipients_get_distinct_indices() {
+        let a = Data::material(0x11, 0x22);
+        let b = Data::material(0x33, 0x44);
+        let asset = AssetId::from_slice(&[0x42u8; 32]).unwrap();
+        let inputs = [(
+            Data::outpoint(0x10, 0),
+            InputKey::Plain(Data::secret_key(0x31)),
+        )];
+
+        // Two payments to DIFFERENT addresses.
+        let pending = [
+            SilentPaymentRecipient::new(a.address(), 1_000, asset),
+            SilentPaymentRecipient::new(b.address(), 2_000, asset),
+        ];
+        let resolved = SilentPaymentRecipient::resolve_all(&pending, &inputs, &[]).unwrap();
+        assert_ne!(
+            resolved[0].recipient.script_pubkey,
+            resolved[1].recipient.script_pubkey
+        );
+
+        // Two payments to the SAME address must also differ — this is the case that
+        // would silently collapse into one output if `k` were not incremented,
+        // burning the second payment.
+        let same = [
+            SilentPaymentRecipient::new(a.address(), 1_000, asset),
+            SilentPaymentRecipient::new(a.address(), 2_000, asset),
+        ];
+        let resolved = SilentPaymentRecipient::resolve_all(&same, &inputs, &[]).unwrap();
+        assert_ne!(
+            resolved[0].recipient.script_pubkey, resolved[1].recipient.script_pubkey,
+            "two payments to one address must not collapse onto the same output"
+        );
+        assert_eq!(resolved[0].recipient.satoshi, 1_000);
+        assert_eq!(resolved[1].recipient.satoshi, 2_000);
+    }
+
+    /// No recipients → no inputs needed, and no error. Resolution must not demand
+    /// input keys from a transaction that has no silent payments in it.
+    #[test]
+    fn resolving_nothing_is_a_no_op() {
+        assert!(SilentPaymentRecipient::resolve_all(&[], &[], &[])
+            .unwrap()
+            .is_empty());
+    }
+}
diff --git a/lwk_wollet/src/silentpayments/scan_material.rs b/lwk_wollet/src/silentpayments/scan_material.rs
new file mode 100644
index 000000000..be398346b
--- /dev/null
+++ b/lwk_wollet/src/silentpayments/scan_material.rs
@@ -0,0 +1,113 @@
+//! Scan-only material and labeled silent-payment addresses.
+
+use crate::hashes::{Hash, HashEngine};
+use crate::secp256k1::Scalar;
+use crate::silentpayments::tags::LabelHash;
+use crate::silentpayments::SilentPaymentAddress;
+use crate::util::EC;
+
+/// Scan-only silent-payment material.
+pub use lwk_common::silentpayments::SilentPaymentScanMaterial;
+
+/// The account coordinates a wallet's silent payments belong to.
+pub use lwk_common::silentpayments::SilentPaymentAccount;
+
+/// BIP-352 change label (`m = 0`).
+pub const CHANGE_LABEL: u32 = 0;
+
+/// Scan-material address derivation.
+pub trait SilentPaymentScan {
+    /// The (unlabeled) public address for this material.
+    fn address(&self) -> SilentPaymentAddress;
+
+    /// Derives BIP-352's label tweak for `m`.
+    fn label_tweak(&self, m: u32) -> Scalar;
+
+    /// Derives the labeled address for `m`.
+    fn labeled_address(&self, m: u32) -> SilentPaymentAddress;
+
+    /// The labeled spend base `B_m = B_spend + label_tweak_m·G`.
+    fn labeled_spend_base(&self, m: u32) -> crate::secp256k1::PublicKey;
+}
+
+impl SilentPaymentScan for SilentPaymentScanMaterial {
+    fn address(&self) -> SilentPaymentAddress {
+        SilentPaymentAddress {
+            scan: self.scan_seckey().public_key(&EC),
+            spend: self.spend_pubkey(),
+        }
+    }
+
+    fn label_tweak(&self, m: u32) -> Scalar {
+        let mut eng = LabelHash::engine();
+        eng.input(&self.scan_seckey().secret_bytes());
+        eng.input(&m.to_be_bytes());
+        let h = LabelHash::from_engine(eng);
+        Scalar::from_be_bytes(h.to_byte_array()).expect("label tweak within curve order")
+    }
+
+    fn labeled_address(&self, m: u32) -> SilentPaymentAddress {
+        SilentPaymentAddress {
+            scan: self.scan_seckey().public_key(&EC),
+            spend: self.labeled_spend_base(m),
+        }
+    }
+
+    fn labeled_spend_base(&self, m: u32) -> crate::secp256k1::PublicKey {
+        self.spend_pubkey()
+            .add_exp_tweak(&EC, &self.label_tweak(m))
+            .expect("labeled spend key")
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::silentpayments::test_fixture::SilentPaymentTestData as Data;
+
+    /// Addresses derive from scan material without a spend secret.
+    #[test]
+    fn addresses_derive_from_public_material_only() {
+        let m = Data::material(0x11, 0x22);
+        let plain = m.address();
+        assert_eq!(plain.scan, m.scan_seckey().public_key(&EC));
+        assert_eq!(plain.spend, m.spend_pubkey());
+
+        for label in [CHANGE_LABEL, 7, 99] {
+            let labeled = m.labeled_address(label);
+            assert_eq!(labeled.scan, plain.scan, "scan key is never tweaked");
+            assert_ne!(labeled.spend, plain.spend, "spend base is tweaked");
+            assert_eq!(
+                labeled.spend,
+                plain
+                    .spend
+                    .add_exp_tweak(&EC, &m.label_tweak(label))
+                    .unwrap(),
+                "labeled base must be B_spend + label_tweak*G"
+            );
+        }
+    }
+
+    /// Labels commit to the scan key.
+    #[test]
+    fn label_tweak_commits_to_the_scan_key() {
+        let a = Data::material(0x11, 0x22);
+        let b = Data::material(0x33, 0x22);
+        assert_eq!(a.spend_pubkey(), b.spend_pubkey(), "same spend base");
+        assert_ne!(
+            a.label_tweak(0).to_be_bytes(),
+            b.label_tweak(0).to_be_bytes(),
+            "different scan keys must give different label tweaks"
+        );
+    }
+
+    /// Scan material exposes no spend secret.
+    #[test]
+    fn scan_material_has_no_spend_secret() {
+        let m = Data::material(0x11, 0x22);
+
+        let _: crate::secp256k1::PublicKey = m.spend_pubkey();
+
+        let _: crate::secp256k1::SecretKey = m.scan_seckey();
+    }
+}
diff --git a/lwk_wollet/src/silentpayments/scanner.rs b/lwk_wollet/src/silentpayments/scanner.rs
new file mode 100644
index 000000000..4c0f0e1af
--- /dev/null
+++ b/lwk_wollet/src/silentpayments/scanner.rs
@@ -0,0 +1,288 @@
+//! Gap-limited silent-payment scanning.
+
+use crate::secp256k1::PublicKey;
+use crate::silentpayments::{
+    PartialTweak, SharedSecret, SilentPaymentOutput, SilentPaymentReceiver, SilentPaymentScan,
+    SilentPaymentScanMaterial, SpendTweak,
+};
+use crate::util::EC;
+
+/// A silent-payment output found by a scan.
+#[derive(Debug, Clone)]
+pub struct LabeledHit {
+    /// Output counter `k`.
+    pub k: u32,
+    /// The label `m` the output was sent to, if any. `Some(0)` is change.
+    pub label: Option<u32>,
+    /// The recomputed SP output (spend pubkey + blinding keys).
+    pub output: SilentPaymentOutput,
+    /// Tweak needed to spend this output.
+    pub spend_tweak: SpendTweak,
+}
+
+/// Scans transactions for silent-payment outputs.
+#[derive(Debug, Clone)]
+pub struct SilentPaymentScanner {
+    receiver: SilentPaymentReceiver,
+    labels: Vec<u32>,
+    gap_limit: u32,
+}
+
+impl SilentPaymentScanner {
+    /// Default consecutive-miss limit.
+    pub const DEFAULT_GAP_LIMIT: u32 = 3;
+
+    /// Exclusive BIP-352 output-count limit.
+    pub const K_MAX: u32 = 2323;
+
+    /// A scanner for `material` that looks only for plain (unlabeled) outputs.
+    pub fn new(material: SilentPaymentScanMaterial) -> Self {
+        SilentPaymentScanner {
+            receiver: SilentPaymentReceiver::new(material),
+            labels: Vec::new(),
+            gap_limit: Self::DEFAULT_GAP_LIMIT,
+        }
+    }
+
+    /// Also detect outputs sent to any of `labels` (e.g.
+    /// [`crate::silentpayments::CHANGE_LABEL`]).
+    pub fn with_labels(mut self, labels: impl IntoIterator<Item = u32>) -> Self {
+        self.labels = labels.into_iter().collect();
+        self
+    }
+
+    /// Stop scanning after `gap_limit` consecutive misses.
+    pub fn with_gap_limit(mut self, gap_limit: u32) -> Self {
+        self.gap_limit = gap_limit;
+        self
+    }
+
+    /// Scans a transaction's partial tweak for owned outputs.
+    pub fn scan(
+        &self,
+        partial_tweak: &PartialTweak,
+        output_scripts: &[crate::elements::Script],
+    ) -> Vec<LabeledHit> {
+        let material = self.receiver.material();
+        let shared_secret =
+            SharedSecret::from_partial_tweak(&material.scan_seckey(), partial_tweak.as_pubkey());
+        let labeled_bases = self.labeled_bases();
+
+        let mut found = Vec::new();
+        let mut k = 0u32;
+        let mut misses = 0u32;
+        while misses < self.gap_limit && k < Self::K_MAX {
+            let t_k = shared_secret.spend_tweak(k);
+            let mut hit = false;
+
+            let (plain, spend_tweak) = self.receiver.derive_from_shared_secret(&shared_secret, k);
+            if output_scripts.iter().any(|s| *s == plain.script_pubkey()) {
+                found.push(LabeledHit {
+                    k,
+                    label: None,
+                    output: plain,
+                    spend_tweak,
+                });
+                hit = true;
+            }
+
+            for (m, base) in &labeled_bases {
+                let spend_pubkey = base.add_exp_tweak(&EC, &t_k).expect("labeled P_k");
+                let output = SilentPaymentOutput {
+                    spend_pubkey,
+                    blinding_pubkey: plain.blinding_pubkey,
+                    blinding_seckey: plain.blinding_seckey,
+                };
+                if output_scripts.iter().any(|s| *s == output.script_pubkey()) {
+                    let Some(spend_tweak) =
+                        SpendTweak::from_scalar(t_k).add_label_tweak(&material.label_tweak(*m))
+                    else {
+                        continue;
+                    };
+                    found.push(LabeledHit {
+                        k,
+                        label: Some(*m),
+                        output,
+                        spend_tweak,
+                    });
+                    hit = true;
+                }
+            }
+
+            if hit {
+                misses = 0;
+            } else {
+                misses += 1;
+            }
+            k += 1;
+        }
+        found
+    }
+
+    /// Derives candidate output scripts for `0..count`.
+    pub fn candidate_scripts(
+        &self,
+        partial_tweak: &PartialTweak,
+        count: u32,
+    ) -> Vec<crate::elements::Script> {
+        let material = self.receiver.material();
+        let shared_secret =
+            SharedSecret::from_partial_tweak(&material.scan_seckey(), partial_tweak.as_pubkey());
+        let labeled_bases = self.labeled_bases();
+
+        let mut scripts = Vec::new();
+        for k in 0..count.min(Self::K_MAX) {
+            let t_k = shared_secret.spend_tweak(k);
+            let (plain, _) = self.receiver.derive_from_shared_secret(&shared_secret, k);
+            scripts.push(plain.script_pubkey());
+
+            for (_, base) in &labeled_bases {
+                let spend_pubkey = base.add_exp_tweak(&EC, &t_k).expect("labeled P_k");
+                let output = SilentPaymentOutput {
+                    spend_pubkey,
+                    blinding_pubkey: plain.blinding_pubkey,
+                    blinding_seckey: plain.blinding_seckey,
+                };
+                scripts.push(output.script_pubkey());
+            }
+        }
+        scripts
+    }
+
+    /// Computes labeled spend bases.
+    fn labeled_bases(&self) -> Vec<(u32, PublicKey)> {
+        self.labels
+            .iter()
+            .map(|&m| (m, self.receiver.labeled_spend_base(m)))
+            .collect()
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::silentpayments::test_fixture::SilentPaymentTestData as Data;
+    use crate::silentpayments::{SilentPaymentSender, SilentPaymentTweakClient, CHANGE_LABEL};
+
+    /// Verifies a scan hit using public spend material.
+    fn assert_hit_verifies(hit: &LabeledHit, m: &SilentPaymentScanMaterial) {
+        assert_eq!(
+            hit.spend_tweak.applied_to(&m.spend_pubkey()).unwrap(),
+            hit.output.spend_pubkey,
+            "tweak must reproduce the output spend key at k={}",
+            hit.k
+        );
+    }
+
+    #[test]
+    fn scan_finds_every_output_it_should_and_no_others() {
+        struct MockServer {
+            tweaks: Vec<PartialTweak>,
+        }
+        impl SilentPaymentTweakClient for MockServer {
+            type Error = ();
+            fn tweaks(&self, _height: u32) -> Result<Vec<PartialTweak>, ()> {
+                Ok(self.tweaks.clone())
+            }
+        }
+
+        let keys = Data::material(0x11, 0x22);
+        let other_label = 7u32;
+
+        let change_addr = keys.labeled_address(CHANGE_LABEL);
+        assert_ne!(change_addr.spend, keys.address().spend);
+        assert_eq!(change_addr.scan, keys.address().scan);
+
+        let inputs = [
+            (Data::outpoint(0x10, 0), Data::secret_key(0x31)),
+            (Data::outpoint(0x20, 1), Data::secret_key(0x32)),
+        ];
+        let sender = SilentPaymentSender::from_inputs(&inputs).unwrap();
+        let agg = sender.inputs();
+
+        let plain0 = sender.derive_output(&keys.address(), 0);
+        let plain1 = sender.derive_output(&keys.address(), 1);
+        let change = sender.derive_output(&change_addr, 0);
+        let labeled = sender.derive_output(&keys.labeled_address(other_label), 0);
+        let noise = sender.derive_output(&Data::material(0xEE, 0xEF).address(), 0);
+
+        let output_scripts = vec![
+            noise.script_pubkey(),
+            plain0.script_pubkey(),
+            plain1.script_pubkey(),
+            change.script_pubkey(),
+            labeled.script_pubkey(),
+            crate::elements::Script::new(), // fee
+        ];
+
+        let server = MockServer {
+            tweaks: vec![PartialTweak::new(&agg.a_pubkey, &agg.input_hash)],
+        };
+        let published = server.tweaks(1).unwrap();
+
+        let plain_scanner = SilentPaymentScanner::new(keys);
+        let mut hits = Vec::new();
+        for t in &published {
+            hits.extend(plain_scanner.scan(t, &output_scripts));
+        }
+        assert_eq!(hits.len(), 2, "should find both plain SP outputs");
+        assert_eq!(hits.iter().map(|h| h.k).collect::<Vec<_>>(), vec![0, 1]);
+        for hit in &hits {
+            assert_hit_verifies(hit, &keys);
+            assert_eq!(hit.label, None, "these are unlabeled outputs");
+        }
+
+        let labeled_hits = SilentPaymentScanner::new(keys)
+            .with_labels([CHANGE_LABEL, other_label])
+            .scan(&published[0], &output_scripts);
+        let found_labels: Vec<_> = labeled_hits.iter().filter_map(|h| h.label).collect();
+        assert_eq!(
+            found_labels.len(),
+            2,
+            "both labeled outputs should be found"
+        );
+        assert!(
+            found_labels.contains(&CHANGE_LABEL),
+            "change label must be recognized"
+        );
+        assert!(found_labels.contains(&other_label));
+        for hit in &labeled_hits {
+            assert_hit_verifies(hit, &keys);
+        }
+
+        assert!(SilentPaymentScanner::new(Data::material(0x77, 0x88))
+            .with_labels([CHANGE_LABEL, other_label])
+            .scan(&published[0], &output_scripts)
+            .is_empty());
+    }
+
+    #[test]
+    fn k_max_is_enforced_for_sender_and_scanner() {
+        let keys = Data::material(0x11, 0x22);
+        let sender =
+            SilentPaymentSender::from_inputs(&[(Data::outpoint(0x10, 0), Data::secret_key(0x31))])
+                .unwrap();
+
+        assert!(sender
+            .try_derive_output(&keys.address(), SilentPaymentScanner::K_MAX - 1)
+            .is_some());
+        assert!(
+            sender
+                .try_derive_output(&keys.address(), SilentPaymentScanner::K_MAX)
+                .is_none(),
+            "sender must refuse to build an output the receiver may not scan for"
+        );
+
+        let beyond = sender
+            .shared_secret(&keys.address())
+            .derive_output(&keys.address().spend, SilentPaymentScanner::K_MAX);
+        let t = PartialTweak::from_observed(&sender.inputs().observed());
+        let hits = SilentPaymentScanner::new(keys)
+            .with_gap_limit(u32::MAX)
+            .scan(&t, &[beyond.script_pubkey()]);
+        assert!(
+            hits.is_empty(),
+            "scanner must not find an output past K_max (and must terminate)"
+        );
+    }
+}
diff --git a/lwk_wollet/src/silentpayments/sender.rs b/lwk_wollet/src/silentpayments/sender.rs
new file mode 100644
index 000000000..4a923781a
--- /dev/null
+++ b/lwk_wollet/src/silentpayments/sender.rs
@@ -0,0 +1,83 @@
+//! The sending side of a silent payment.
+
+use crate::secp256k1::SecretKey;
+use crate::silentpayments::inputs::InputHasher;
+use crate::silentpayments::{
+    SharedSecret, SilentPaymentAddress, SilentPaymentInputs, SilentPaymentOutput,
+    SilentPaymentScanner,
+};
+use crate::util::EC;
+
+/// Derives outputs for a silent-payment address.
+#[derive(Debug, Clone, Copy)]
+pub struct SilentPaymentSender {
+    inputs: SilentPaymentInputs,
+}
+
+impl SilentPaymentSender {
+    /// Build a sender from the wallet's aggregated eligible inputs.
+    pub fn new(inputs: SilentPaymentInputs) -> Self {
+        SilentPaymentSender { inputs }
+    }
+
+    /// Aggregate `(outpoint, private_key)` pairs and build the sender in one step.
+    pub fn from_inputs(
+        inputs: &[(crate::elements::OutPoint, SecretKey)],
+    ) -> Result<Self, crate::silentpayments::SilentPaymentInputError> {
+        Ok(Self::new(SilentPaymentInputs::aggregate(inputs)?))
+    }
+
+    /// Aggregates tagged inputs and keyless-input outpoints.
+    pub fn from_input_keys(
+        inputs: &[(crate::elements::OutPoint, crate::silentpayments::InputKey)],
+        extra_outpoints: &[crate::elements::OutPoint],
+    ) -> Result<Self, crate::silentpayments::SilentPaymentInputError> {
+        Ok(Self::new(
+            SilentPaymentInputs::aggregate_with_extra_outpoints(inputs, extra_outpoints)?,
+        ))
+    }
+
+    /// The aggregated inputs backing this sender.
+    pub fn inputs(&self) -> &SilentPaymentInputs {
+        &self.inputs
+    }
+
+    /// Derives `S = input_hash · a · B_scan`.
+    pub fn shared_secret(&self, address: &SilentPaymentAddress) -> SharedSecret {
+        SharedSecret::for_sender(&address.scan, &self.inputs)
+    }
+
+    /// Derives output `k`; panics when `k >= K_MAX`.
+    pub fn derive_output(&self, address: &SilentPaymentAddress, k: u32) -> SilentPaymentOutput {
+        self.try_derive_output(address, k)
+            .expect("output index within K_max")
+    }
+
+    /// Derives output `k`, or `None` when `k >= K_MAX`.
+    pub fn try_derive_output(
+        &self,
+        address: &SilentPaymentAddress,
+        k: u32,
+    ) -> Option<SilentPaymentOutput> {
+        if k >= SilentPaymentScanner::K_MAX {
+            return None;
+        }
+        Some(self.shared_secret(address).derive_output(&address.spend, k))
+    }
+
+    /// Derives an output from a summed key and serialized outpoint.
+    pub fn derive_output_from_raw(
+        address: &SilentPaymentAddress,
+        a_sum: &SecretKey,
+        outpoint_l: &[u8],
+        k: u32,
+    ) -> SilentPaymentOutput {
+        let a_pubkey = a_sum.public_key(&EC);
+        let inputs = SilentPaymentInputs {
+            a_sum: *a_sum,
+            a_pubkey,
+            input_hash: InputHasher::hash(outpoint_l, &a_pubkey),
+        };
+        Self::new(inputs).derive_output(address, k)
+    }
+}
diff --git a/lwk_wollet/src/silentpayments/shared_secret.rs b/lwk_wollet/src/silentpayments/shared_secret.rs
new file mode 100644
index 000000000..98523da69
--- /dev/null
+++ b/lwk_wollet/src/silentpayments/shared_secret.rs
@@ -0,0 +1,146 @@
+//! Shared-secret and per-output silent-payment derivation.
+
+use crate::hashes::{Hash, HashEngine};
+use crate::secp256k1::{PublicKey, Scalar, SecretKey};
+use crate::silentpayments::tags::{BlindHash, SharedSecretHash};
+use crate::silentpayments::{SilentPaymentInputs, SilentPaymentOutput};
+use crate::util::EC;
+
+/// An ECDH shared secret for one transaction and receiver.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct SharedSecret(PublicKey);
+
+impl SharedSecret {
+    /// Sender's ECDH shared secret `S = input_hash · a · B_scan` from aggregated inputs.
+    pub fn for_sender(scan_pubkey: &PublicKey, inputs: &SilentPaymentInputs) -> Self {
+        let a_ih = inputs
+            .a_sum
+            .mul_tweak(&inputs.input_hash)
+            .expect("scalar mul");
+        SharedSecret(
+            scan_pubkey
+                .mul_tweak(
+                    &EC,
+                    &Scalar::from_be_bytes(a_ih.secret_bytes()).expect("scalar"),
+                )
+                .expect("ecdh point mul"),
+        )
+    }
+
+    /// Receiver's ECDH shared secret `S = input_hash · b_scan · A`.
+    pub fn for_receiver(scan_seckey: &SecretKey, a_sum_pubkey: &PublicKey, ih: &Scalar) -> Self {
+        let bscan_ih = scan_seckey.mul_tweak(ih).expect("scalar mul");
+        SharedSecret(
+            a_sum_pubkey
+                .mul_tweak(
+                    &EC,
+                    &Scalar::from_be_bytes(bscan_ih.secret_bytes()).expect("scalar"),
+                )
+                .expect("ecdh point mul"),
+        )
+    }
+
+    /// Derives `S = b_scan · T` from a server partial tweak.
+    pub fn from_partial_tweak(scan_seckey: &SecretKey, partial_tweak: &PublicKey) -> Self {
+        SharedSecret(
+            partial_tweak
+                .mul_tweak(
+                    &EC,
+                    &Scalar::from_be_bytes(scan_seckey.secret_bytes()).expect("scalar"),
+                )
+                .expect("ecdh point mul"),
+        )
+    }
+
+    /// The underlying point, `serP(S)` being what the tagged hashes commit to.
+    pub fn as_pubkey(&self) -> &PublicKey {
+        &self.0
+    }
+
+    /// `t_k = H_BIP0352/SharedSecret(serP(S) || ser32(k))`, returned as a tweak scalar.
+    pub fn spend_tweak(&self, k: u32) -> Scalar {
+        let mut eng = SharedSecretHash::engine();
+        eng.input(&self.0.serialize());
+        eng.input(&k.to_be_bytes());
+        let h = SharedSecretHash::from_engine(eng);
+        Scalar::from_be_bytes(h.to_byte_array()).expect("shared secret tweak within curve order")
+    }
+
+    /// `bk_k = H_LiquidSilentPayments/Blind(serP(S) || ser32(k))`.
+    pub fn blinding_key(&self, k: u32) -> SecretKey {
+        let mut eng = BlindHash::engine();
+        eng.input(&self.0.serialize());
+        eng.input(&k.to_be_bytes());
+        let h = BlindHash::from_engine(eng);
+        SecretKey::from_slice(&h.to_byte_array()).expect("blinding key within curve order")
+    }
+
+    /// Derives the output spend and blinding keys for `k`.
+    pub fn derive_output(&self, spend_base: &PublicKey, k: u32) -> SilentPaymentOutput {
+        let t_k = self.spend_tweak(k);
+        let spend_pubkey = spend_base.add_exp_tweak(&EC, &t_k).expect("add exp tweak");
+
+        let blinding_seckey = self.blinding_key(k);
+        let blinding_pubkey = blinding_seckey.public_key(&EC);
+
+        SilentPaymentOutput {
+            spend_pubkey,
+            blinding_pubkey,
+            blinding_seckey,
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::silentpayments::test_fixture::SilentPaymentTestData as Data;
+    use crate::silentpayments::SilentPaymentScan;
+
+    /// Q3: the spend tweak `t_k` and the blinding key `bk_k` are derived from the
+    /// SAME shared secret `S` but in DIFFERENT tagged-hash domains, so they are
+    /// independent — knowing one reveals nothing about the other, and the blinding
+    /// key is never accidentally equal to (a function of) the spend tweak.
+    #[test]
+    fn blinding_key_domain_separated_from_spend_tweak() {
+        let keys = Data::material(0x11, 0x22);
+        let a_sum = Data::secret_key(0x33);
+        let inputs = [(Data::outpoint(0xAB, 0), a_sum)];
+        let agg = SilentPaymentInputs::aggregate(&inputs).unwrap();
+        let s = SharedSecret::for_sender(&keys.address().scan, &agg);
+
+        for k in 0..4u32 {
+            let t_k = s.spend_tweak(k);
+            let bk_k = s.blinding_key(k);
+            // Distinct domains → distinct 32-byte values.
+            assert_ne!(
+                t_k.to_be_bytes(),
+                bk_k.secret_bytes(),
+                "spend tweak and blinding key must differ at k={k}"
+            );
+        }
+    }
+
+    /// The three routes to `S` — sender, receiver, and tweak-server partial tweak —
+    /// must all land on the same point, or the scheme simply does not work.
+    #[test]
+    fn all_shared_secret_paths_agree() {
+        let keys = Data::material(0x11, 0x22);
+        let inputs = [
+            (Data::outpoint(0x10, 0), Data::secret_key(0x31)),
+            (Data::outpoint(0x20, 1), Data::secret_key(0x32)),
+        ];
+        let agg = SilentPaymentInputs::aggregate(&inputs).unwrap();
+
+        let sender = SharedSecret::for_sender(&keys.address().scan, &agg);
+        let receiver =
+            SharedSecret::for_receiver(&keys.scan_seckey(), &agg.a_pubkey, &agg.input_hash);
+        let via_server = SharedSecret::from_partial_tweak(
+            &keys.scan_seckey(),
+            crate::silentpayments::PartialTweak::new(&agg.a_pubkey, &agg.input_hash).as_pubkey(),
+        );
+
+        assert_eq!(sender, receiver);
+        assert_eq!(sender, via_server);
+    }
+}
diff --git a/lwk_wollet/src/silentpayments/sync.rs b/lwk_wollet/src/silentpayments/sync.rs
new file mode 100644
index 000000000..a5fde9dab
--- /dev/null
+++ b/lwk_wollet/src/silentpayments/sync.rs
@@ -0,0 +1,157 @@
+//! Scans block ranges for silent-payment outputs.
+
+use crate::elements::{Script, Txid};
+use crate::silentpayments::{PartialTweak, SilentPaymentScanMaterial, SilentPaymentScanner};
+use std::collections::HashMap;
+
+/// Plans a silent-payment scan over transaction tweaks.
+#[derive(Debug, Clone)]
+pub struct SilentPaymentSync {
+    material: SilentPaymentScanMaterial,
+    labels: Vec<u32>,
+    candidates_per_tx: u32,
+}
+
+impl SilentPaymentSync {
+    /// Candidate output indices per transaction.
+    pub const DEFAULT_CANDIDATES_PER_TX: u32 = 3;
+
+    /// Scans transactions for the plain address.
+    pub fn new(material: SilentPaymentScanMaterial) -> Self {
+        SilentPaymentSync {
+            material,
+            labels: Vec::new(),
+            candidates_per_tx: Self::DEFAULT_CANDIDATES_PER_TX,
+        }
+    }
+
+    /// Also watch these BIP-352 labels (e.g. [`crate::silentpayments::CHANGE_LABEL`]).
+    pub fn with_labels(mut self, labels: impl IntoIterator<Item = u32>) -> Self {
+        self.labels = labels.into_iter().collect();
+        self
+    }
+
+    /// Sets the candidate count, capped at [`SilentPaymentScanner::K_MAX`].
+    pub fn with_candidates_per_tx(mut self, n: u32) -> Self {
+        self.candidates_per_tx = n.min(SilentPaymentScanner::K_MAX);
+        self
+    }
+
+    /// Maps candidate scripts to their source transactions.
+    pub fn candidate_scripts(&self, tweaks: &[(Txid, PartialTweak)]) -> HashMap<Script, Txid> {
+        let scanner = self.scanner();
+        let mut out = HashMap::new();
+        for (txid, tweak) in tweaks {
+            for script in scanner.candidate_scripts(tweak, self.candidates_per_tx) {
+                out.entry(script).or_insert(*txid);
+            }
+        }
+        out
+    }
+
+    /// Returns tweaks whose candidate scripts exist on chain.
+    pub fn tweaks_to_scan(
+        &self,
+        tweaks: &[(Txid, PartialTweak)],
+        found_scripts: &[Script],
+    ) -> Vec<(Txid, PartialTweak)> {
+        let by_script = self.candidate_scripts(tweaks);
+        let hit: std::collections::HashSet<Txid> = found_scripts
+            .iter()
+            .filter_map(|s| by_script.get(s).copied())
+            .collect();
+
+        tweaks
+            .iter()
+            .filter(|(txid, _)| hit.contains(txid))
+            .cloned()
+            .collect()
+    }
+
+    /// Returns a scanner configured with this sync's material and labels.
+    pub fn scanner(&self) -> SilentPaymentScanner {
+        SilentPaymentScanner::new(self.material).with_labels(self.labels.iter().copied())
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::silentpayments::test_fixture::SilentPaymentTestData as Data;
+    use crate::silentpayments::{
+        SilentPaymentInputs, SilentPaymentScan, SilentPaymentSender, CHANGE_LABEL,
+    };
+
+    fn keys() -> SilentPaymentScanMaterial {
+        Data::material(0x11, 0x22)
+    }
+
+    fn payer(outpoint: u8, key: u8) -> (PartialTweak, SilentPaymentSender) {
+        let inputs =
+            SilentPaymentInputs::aggregate(&[(Data::outpoint(outpoint, 0), Data::secret_key(key))])
+                .unwrap();
+        let tweak = PartialTweak::from_observed(&inputs.observed());
+        (tweak, SilentPaymentSender::new(inputs))
+    }
+
+    #[test]
+    fn candidate_generation() {
+        let keys = keys();
+        let txid = Data::txid(0x01);
+        let (tweak, sender) = payer(0x10, 0x31);
+
+        let plain = sender.derive_output(&keys.address(), 0).script_pubkey();
+        let labeled = sender
+            .derive_output(&keys.labeled_address(CHANGE_LABEL), 0)
+            .script_pubkey();
+
+        let unlabeled_scan = SilentPaymentSync::new(keys).candidate_scripts(&[(txid, tweak)]);
+        assert_eq!(
+            unlabeled_scan.get(&plain),
+            Some(&txid),
+            "a real payment's script must be a candidate"
+        );
+        assert!(
+            !unlabeled_scan.contains_key(&labeled),
+            "unlabeled scan must not generate labeled candidates"
+        );
+
+        let labeled_scan = SilentPaymentSync::new(keys)
+            .with_labels([CHANGE_LABEL])
+            .candidate_scripts(&[(txid, tweak)]);
+        assert!(
+            labeled_scan.contains_key(&labeled),
+            "configured label must generate its candidate"
+        );
+
+        assert_eq!(
+            SilentPaymentSync::new(keys)
+                .with_candidates_per_tx(u32::MAX)
+                .candidates_per_tx,
+            SilentPaymentScanner::K_MAX,
+            "candidate count must stay bounded by K_MAX"
+        );
+    }
+
+    #[test]
+    fn narrowing_keeps_only_hit_transactions() {
+        let keys = keys();
+        let (our_tweak, our_sender) = payer(0x10, 0x31);
+        let (their_tweak, _) = payer(0x20, 0x32);
+
+        let our_txid = Data::txid(0x01);
+        let tweaks = vec![(our_txid, our_tweak), (Data::txid(0x02), their_tweak)];
+        let our_script = our_sender.derive_output(&keys.address(), 0).script_pubkey();
+
+        let sync = SilentPaymentSync::new(keys);
+
+        let to_scan = sync.tweaks_to_scan(&tweaks, &[our_script]);
+        assert_eq!(to_scan.len(), 1, "only the paying tx should be scanned");
+        assert_eq!(to_scan[0].0, our_txid);
+
+        assert!(
+            sync.tweaks_to_scan(&tweaks, &[]).is_empty(),
+            "no candidate seen on chain means no transaction to fetch"
+        );
+    }
+}
diff --git a/lwk_wollet/src/silentpayments/tags.rs b/lwk_wollet/src/silentpayments/tags.rs
new file mode 100644
index 000000000..8285195e0
--- /dev/null
+++ b/lwk_wollet/src/silentpayments/tags.rs
@@ -0,0 +1,26 @@
+use crate::hashes::sha256t_hash_newtype;
+
+sha256t_hash_newtype! {
+    pub(crate) struct InputsTag = hash_str("BIP0352/Inputs");
+    /// `input_hash = H_BIP0352/Inputs(outpoint_L || A)`.
+    #[hash_newtype(forward)]
+    pub(crate) struct InputsHash(_);
+
+    pub(crate) struct SharedSecretTag = hash_str("BIP0352/SharedSecret");
+    /// `t_k = H_BIP0352/SharedSecret(serP(S) || ser32(k))`.
+    #[hash_newtype(forward)]
+    pub(crate) struct SharedSecretHash(_);
+
+    pub(crate) struct BlindTag = hash_str("LiquidSilentPayments/Blind");
+    /// `bk_k = H_LiquidSilentPayments/Blind(serP(S) || ser32(k))`.
+    ///
+    /// Shares its preimage with [`SharedSecretHash`]; only the tag makes `bk_k` and
+    /// `t_k` independent.
+    #[hash_newtype(forward)]
+    pub(crate) struct BlindHash(_);
+
+    pub(crate) struct LabelTag = hash_str("BIP0352/Label");
+    /// `label_tweak_m = H_BIP0352/Label(ser256(b_scan) || ser32(m))`.
+    #[hash_newtype(forward)]
+    pub(crate) struct LabelHash(_);
+}
diff --git a/lwk_wollet/src/silentpayments/test_fixture.rs b/lwk_wollet/src/silentpayments/test_fixture.rs
new file mode 100644
index 000000000..fd29cf22c
--- /dev/null
+++ b/lwk_wollet/src/silentpayments/test_fixture.rs
@@ -0,0 +1,150 @@
+//! Shared construction of silent-payment test transactions.
+
+use crate::elements::confidential::{Asset, Value};
+use crate::elements::{
+    AssetId, LockTime, OutPoint, Script, Transaction, TxIn, TxOut, TxOutWitness,
+};
+use crate::secp256k1::SecretKey;
+use crate::silentpayments::{
+    SilentPaymentAddress, SilentPaymentScan, SilentPaymentScanMaterial,
+    SilentPaymentSender, SpTxOutBuilder,
+};
+use lwk_test_util::ElementsTestData;
+
+pub(crate) struct SilentPaymentTestData;
+
+impl SilentPaymentTestData {
+    pub(crate) fn secret_key(byte: u8) -> SecretKey {
+        ElementsTestData::secret_key(byte)
+    }
+
+    pub(crate) fn outpoint(txid_byte: u8, vout: u32) -> OutPoint {
+        ElementsTestData::outpoint(txid_byte, vout)
+    }
+
+    pub(crate) fn txid(byte: u8) -> crate::elements::Txid {
+        ElementsTestData::txid(byte)
+    }
+
+    pub(crate) fn asset() -> AssetId {
+        AssetId::from_slice(&[0x42u8; 32]).unwrap()
+    }
+
+    pub(crate) fn material(scan: u8, spend: u8) -> SilentPaymentScanMaterial {
+        SilentPaymentScanMaterial::new(
+            crate::silentpayments::SilentPaymentAccount::liquid_testnet(0),
+            ElementsTestData::secret_key(scan),
+            ElementsTestData::public_key(spend),
+        )
+    }
+}
+
+/// A silent payment built for a test.
+pub(crate) struct SpPayment {
+    pub(crate) tx: Transaction,
+    /// The scriptPubKeys the transaction's inputs spend.
+    pub(crate) prevouts: Vec<(OutPoint, Script)>,
+}
+
+impl SpPayment {
+    /// Resolves prevout scripts, borrowing from the fixture rather than the argument.
+    pub(crate) fn prevout_lookup<'a>(&'a self) -> impl FnMut(&OutPoint) -> Option<&'a Script> {
+        move |o: &OutPoint| self.prevouts.iter().find(|(p, _)| p == o).map(|(_, s)| s)
+    }
+}
+
+/// Builds silent-payment transactions for tests, defaulting to a two-input payment
+/// at index 0.
+pub(crate) struct SpPaymentBuilder {
+    inputs: Vec<(OutPoint, SecretKey)>,
+    k: u32,
+    value: u64,
+    asset: AssetId,
+    /// Whether to append a second, non-silent output.
+    extra_output: bool,
+}
+
+impl Default for SpPaymentBuilder {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
+impl SpPaymentBuilder {
+    pub(crate) fn new() -> Self {
+        SpPaymentBuilder {
+            inputs: vec![
+                (
+                    ElementsTestData::outpoint(0x22, 1),
+                    ElementsTestData::secret_key(0xA1),
+                ),
+                (
+                    ElementsTestData::outpoint(0x11, 0),
+                    ElementsTestData::secret_key(0xA2),
+                ),
+            ],
+            k: 0,
+            value: 50_000,
+            asset: SilentPaymentTestData::asset(),
+            extra_output: true,
+        }
+    }
+
+    pub(crate) fn with_inputs(mut self, inputs: &[(OutPoint, SecretKey)]) -> Self {
+        self.inputs = inputs.to_vec();
+        self
+    }
+
+    pub(crate) fn with_value(mut self, value: u64) -> Self {
+        self.value = value;
+        self
+    }
+
+    /// Build a payment to `address`.
+    pub(crate) fn build(self, address: &SilentPaymentAddress) -> SpPayment {
+        let sender = SilentPaymentSender::from_inputs(&self.inputs)
+            .expect("the fixture's inputs must aggregate");
+        let output = sender.derive_output(address, self.k);
+
+        let (sp_txout, _) =
+            SpTxOutBuilder::build(&output, self.asset, self.value, &mut rand::thread_rng())
+                .expect("building the silent payment output must succeed");
+
+        let mut outputs = vec![sp_txout];
+        if self.extra_output {
+            outputs.push(TxOut {
+                asset: Asset::Explicit(self.asset),
+                value: Value::Explicit(500),
+                nonce: Default::default(),
+                script_pubkey: Script::new(),
+                witness: TxOutWitness::default(),
+            });
+        }
+
+        let tx = Transaction {
+            version: 2,
+            lock_time: LockTime::ZERO,
+            input: self.inputs.iter().map(Self::witness_input).collect(),
+            output: outputs,
+        };
+
+        SpPayment {
+            prevouts: self.inputs.iter().map(Self::prevout).collect(),
+            tx,
+        }
+    }
+
+    /// Build a payment to the address `material` publishes.
+    pub(crate) fn build_for(self, material: &SilentPaymentScanMaterial) -> SpPayment {
+        self.build(&material.address())
+    }
+
+    /// A P2WPKH input whose witness carries the pubkey the key is recovered from.
+    fn witness_input((outpoint, key): &(OutPoint, SecretKey)) -> TxIn {
+        ElementsTestData::p2wpkh_input(*outpoint, key)
+    }
+
+    fn prevout((outpoint, key): &(OutPoint, SecretKey)) -> (OutPoint, Script) {
+        (*outpoint, ElementsTestData::p2wpkh(key))
+    }
+}
diff --git a/lwk_wollet/src/silentpayments/tweak_server.rs b/lwk_wollet/src/silentpayments/tweak_server.rs
new file mode 100644
index 000000000..4d6b7b869
--- /dev/null
+++ b/lwk_wollet/src/silentpayments/tweak_server.rs
@@ -0,0 +1,82 @@
+//! The tweak/index server model (design §4.5, BIP0352-index-server-specification).
+
+use crate::secp256k1::{PublicKey, Scalar};
+use crate::silentpayments::{ObservedInputs, SilentPaymentInputError};
+use crate::util::EC;
+
+/// A server-published partial tweak: `T = input_hash · A`.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct PartialTweak(PublicKey);
+
+impl PartialTweak {
+    /// `T = input_hash · A`.
+    pub fn new(a_pubkey: &PublicKey, input_hash: &Scalar) -> Self {
+        PartialTweak(
+            a_pubkey
+                .mul_tweak(&EC, input_hash)
+                .expect("partial tweak point mul"),
+        )
+    }
+
+    /// Compute a partial tweak directly from an observer's aggregated inputs.
+    pub fn from_observed(observed: &ObservedInputs) -> Self {
+        Self::new(&observed.a_pubkey, &observed.input_hash)
+    }
+
+    /// Computes a partial tweak from observed input keys.
+    pub fn from_inputs(
+        inputs: &[(crate::elements::OutPoint, PublicKey)],
+    ) -> Result<Self, SilentPaymentInputError> {
+        Ok(Self::from_observed(&ObservedInputs::aggregate(inputs)?))
+    }
+
+    /// The underlying point, as published by the server and consumed by clients.
+    pub fn as_pubkey(&self) -> &PublicKey {
+        &self.0
+    }
+}
+
+impl From<PartialTweak> for PublicKey {
+    fn from(t: PartialTweak) -> Self {
+        t.0
+    }
+}
+
+/// A source of per-transaction BIP-352 partial tweaks.
+pub trait SilentPaymentTweakClient {
+    /// The error type returned by the backend.
+    type Error;
+
+    /// Return the partial tweaks `T = input_hash·A` for every SP-eligible
+    /// transaction in the block at `height`.
+    fn tweaks(&self, height: u32) -> Result<Vec<PartialTweak>, Self::Error>;
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::silentpayments::test_fixture::SilentPaymentTestData as Data;
+    use crate::silentpayments::{SharedSecret, SilentPaymentInputs};
+
+    #[test]
+    fn every_route_to_a_partial_tweak_agrees() {
+        let keys = Data::material(0x11, 0x22);
+        let inputs = [
+            (Data::outpoint(0x10, 0), Data::secret_key(0x31)),
+            (Data::outpoint(0x20, 1), Data::secret_key(0x32)),
+        ];
+        let agg = SilentPaymentInputs::aggregate(&inputs).unwrap();
+        let observed: Vec<_> = inputs
+            .iter()
+            .map(|(o, s)| (*o, s.public_key(&EC)))
+            .collect();
+
+        let t = PartialTweak::new(&agg.a_pubkey, &agg.input_hash);
+        assert_eq!(t, PartialTweak::from_observed(&agg.observed()));
+        assert_eq!(t, PartialTweak::from_inputs(&observed).unwrap());
+
+        let client = SharedSecret::from_partial_tweak(&keys.scan_seckey(), t.as_pubkey());
+        let sender = SharedSecret::for_sender(&keys.scan_seckey().public_key(&EC), &agg);
+        assert_eq!(client, sender);
+    }
+}
diff --git a/lwk_wollet/src/silentpayments/tx_inputs.rs b/lwk_wollet/src/silentpayments/tx_inputs.rs
new file mode 100644
index 000000000..f849635f8
--- /dev/null
+++ b/lwk_wollet/src/silentpayments/tx_inputs.rs
@@ -0,0 +1,629 @@
+//! Public silent-payment input-key recovery.
+
+use crate::elements::{OutPoint, Script, Transaction};
+use crate::secp256k1::PublicKey;
+use crate::silentpayments::{ObservedInputs, SilentPaymentInputError};
+
+/// Recovers the single pubkey one input contributes to `A = Σ A_i`.
+pub struct InputPubkeyRecovery<'a> {
+    prevout_script: &'a Script,
+    script_sig: &'a Script,
+    witness: &'a [Vec<u8>],
+}
+
+impl<'a> InputPubkeyRecovery<'a> {
+    const COMPRESSED_LEN: usize = 33;
+    const P2SH_P2WPKH_REDEEM_LEN: usize = 22;
+    const ANNEX_PREFIX: u8 = 0x50;
+
+    /// Build a recovery view over one input.
+    pub fn new(prevout_script: &'a Script, script_sig: &'a Script, witness: &'a [Vec<u8>]) -> Self {
+        InputPubkeyRecovery {
+            prevout_script,
+            script_sig,
+            witness,
+        }
+    }
+
+    /// Recovers this input's eligible pubkey.
+    pub fn recover(&self) -> Option<PublicKey> {
+        if self.prevout_script.is_v1_p2tr() {
+            self.taproot_output_key()
+        } else if self.prevout_script.is_v0_p2wpkh() {
+            self.witness_pubkey()
+        } else if self.prevout_script.is_p2sh() {
+            self.nested_p2wpkh_pubkey()
+        } else if self.prevout_script.is_p2pkh() {
+            self.script_sig_pubkey()
+        } else {
+            None
+        }
+    }
+
+    /// The NUMS point `H` from BIP-341, `lift_x(0x50929b74...803ac)`.
+    const NUMS_H: [u8; 32] = [
+        0x50, 0x92, 0x9b, 0x74, 0xc1, 0xa0, 0x49, 0x54, 0xb7, 0x8b, 0x4b, 0x60, 0x35, 0xe9, 0x7a,
+        0x5e, 0x07, 0x8a, 0x5a, 0x0f, 0x28, 0xec, 0x96, 0xd5, 0x47, 0xbf, 0xee, 0x9a, 0xce, 0x80,
+        0x3a, 0xc0,
+    ];
+
+    /// Recovers an eligible Taproot output key.
+    fn taproot_output_key(&self) -> Option<PublicKey> {
+        if !self.is_eligible_taproot_spend() {
+            return None;
+        }
+
+        let spk = self.prevout_script.as_bytes();
+        let x_only = spk.get(2..34)?;
+        let key = crate::elements::secp256k1_zkp::XOnlyPublicKey::from_slice(x_only).ok()?;
+        Some(PublicKey::from_x_only_public_key(
+            key,
+            crate::elements::secp256k1_zkp::Parity::Even,
+        ))
+    }
+
+    fn is_eligible_taproot_spend(&self) -> bool {
+        let mut stack = self.witness;
+        // A single witness item is always the key-path signature, never an annex.
+        if stack.len() > 1 {
+            if let Some((last, rest)) = stack.split_last() {
+                if last.first() == Some(&Self::ANNEX_PREFIX) {
+                    stack = rest;
+                }
+            }
+        }
+
+        match stack.len() {
+            1 => true,
+            n if n >= 2 => {
+                let control_block = &stack[n - 1];
+                match crate::elements::taproot::ControlBlock::from_slice(control_block) {
+                    Ok(cb) => cb.internal_key.serialize() != Self::NUMS_H,
+                    Err(_) => false,
+                }
+            }
+            _ => false,
+        }
+    }
+
+    /// P2WPKH: witness is `[signature, pubkey]`.
+    fn witness_pubkey(&self) -> Option<PublicKey> {
+        if self.witness.len() != 2 {
+            return None;
+        }
+        Self::parse_pubkey(self.witness.get(1)?)
+    }
+
+    /// Recovers a P2SH-wrapped P2WPKH pubkey.
+    fn nested_p2wpkh_pubkey(&self) -> Option<PublicKey> {
+        let sig = self.script_sig.as_bytes();
+        let redeem = sig.strip_prefix(&[Self::P2SH_P2WPKH_REDEEM_LEN as u8])?;
+        if redeem.len() != Self::P2SH_P2WPKH_REDEEM_LEN || redeem[0] != 0x00 || redeem[1] != 0x14 {
+            return None;
+        }
+        self.witness_pubkey()
+    }
+
+    /// Recovers the committed compressed P2PKH pubkey.
+    fn script_sig_pubkey(&self) -> Option<PublicKey> {
+        let spk_hash = self.prevout_script.as_bytes().get(3..3 + 20)?;
+        let sig = self.script_sig.as_bytes();
+
+        (Self::COMPRESSED_LEN..=sig.len()).rev().find_map(|end| {
+            let candidate = &sig[end - Self::COMPRESSED_LEN..end];
+            use crate::elements::hashes::{hash160, Hash as _};
+            (hash160::Hash::hash(candidate).to_byte_array() == spk_hash)
+                .then(|| Self::parse_pubkey(candidate))
+                .flatten()
+        })
+    }
+
+    /// Parses a compressed pubkey.
+    fn parse_pubkey(bytes: &[u8]) -> Option<PublicKey> {
+        if bytes.len() != Self::COMPRESSED_LEN {
+            return None;
+        }
+        PublicKey::from_slice(bytes).ok()
+    }
+}
+
+/// Transaction inputs classified for silent payments.
+#[derive(Debug, Clone, Default, PartialEq, Eq)]
+pub struct SilentPaymentTxInputs {
+    eligible: Vec<(OutPoint, PublicKey)>,
+    ineligible: Vec<OutPoint>,
+    unknown_segwit_version: bool,
+}
+
+impl SilentPaymentTxInputs {
+    /// Classifies transaction inputs from their prevout scripts.
+    pub fn extract<'a, F>(tx: &Transaction, mut prevout_script: F) -> Self
+    where
+        F: FnMut(&OutPoint) -> Option<&'a Script>,
+    {
+        let mut eligible = Vec::new();
+        let mut ineligible = Vec::new();
+        let mut unknown_segwit_version = false;
+
+        for input in &tx.input {
+            let outpoint = input.previous_output;
+
+            if input.is_pegin() {
+                ineligible.push(outpoint);
+                continue;
+            }
+
+            let spk = prevout_script(&outpoint);
+
+            if spk.is_some_and(Self::is_unknown_segwit_version) {
+                unknown_segwit_version = true;
+            }
+
+            let pubkey = spk.and_then(|spk| {
+                InputPubkeyRecovery::new(spk, &input.script_sig, &input.witness.script_witness)
+                    .recover()
+            });
+
+            match pubkey {
+                Some(pk) => eligible.push((outpoint, pk)),
+                None => ineligible.push(outpoint),
+            }
+        }
+
+        SilentPaymentTxInputs {
+            eligible,
+            ineligible,
+            unknown_segwit_version,
+        }
+    }
+
+    fn is_unknown_segwit_version(spk: &Script) -> bool {
+        if !spk.is_witness_program() {
+            return false;
+        }
+        let version_byte = spk.as_bytes()[0];
+        let version = if version_byte == 0 {
+            0
+        } else {
+            version_byte.wrapping_sub(0x50)
+        };
+        version > 1
+    }
+
+    /// The inputs contributing to `A`, as `(outpoint, pubkey)` pairs.
+    pub fn eligible(&self) -> &[(OutPoint, PublicKey)] {
+        &self.eligible
+    }
+
+    /// The outpoints of inputs contributing no key but still entering `outpoint_L`.
+    pub fn ineligible(&self) -> &[OutPoint] {
+        &self.ineligible
+    }
+
+    /// Whether this transaction could carry a silent payment at all.
+    pub fn is_eligible(&self) -> bool {
+        !self.eligible.is_empty() && !self.unknown_segwit_version
+    }
+
+    /// Whether an input uses an unsupported SegWit version.
+    pub fn must_not_be_scanned(&self) -> bool {
+        self.unknown_segwit_version
+    }
+
+    /// Aggregates the observer-side input data.
+    pub fn observed(&self) -> Result<ObservedInputs, SilentPaymentInputError> {
+        if self.unknown_segwit_version {
+            return Err(SilentPaymentInputError::NoInputs);
+        }
+        ObservedInputs::aggregate_with_extra_outpoints(&self.eligible, &self.ineligible)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::elements::{Transaction, TxIn};
+    use crate::util::EC;
+    use lwk_test_util::ElementsTestData as Data;
+
+    /// Prevout scripts of each shape the recovery has to classify.
+    ///
+    /// Built through elements' own hash types: `elements` and `elements::bitcoin`
+    /// have distinct `WPubkeyHash`/`PubkeyHash` newtypes over the same digest.
+    struct Spk;
+
+    impl Spk {
+        fn p2wpkh(pk: &PublicKey) -> Script {
+            Data::p2wpkh_of(pk)
+        }
+
+        fn p2pkh_of(key_bytes: &[u8]) -> Script {
+            use crate::elements::hashes::{hash160, Hash as _};
+            let hash = hash160::Hash::hash(key_bytes);
+            Script::new_p2pkh(&crate::elements::PubkeyHash::from_byte_array(
+                hash.to_byte_array(),
+            ))
+        }
+
+        fn p2pkh(pk: &PublicKey) -> Script {
+            Self::p2pkh_of(&pk.serialize())
+        }
+
+        fn p2tr(pk: &PublicKey) -> Script {
+            let (x_only, _) = pk.x_only_public_key();
+            Script::new_v1_p2tr_tweaked(crate::elements::schnorr::TweakedPublicKey::new(x_only))
+        }
+
+        fn p2sh(redeem: &Script) -> Script {
+            Script::new_p2sh(&redeem.script_hash())
+        }
+
+        /// OP_2 PUSH32: a well-formed witness program of a version SP does not know.
+        fn unknown_witness_version() -> Script {
+            let mut bytes = vec![0x52u8, 0x20];
+            bytes.extend_from_slice(&[0xAA; 32]);
+            Script::from(bytes)
+        }
+    }
+
+    struct ScriptSig;
+
+    impl ScriptSig {
+        fn push(data: &[u8]) -> Script {
+            let mut bytes = vec![data.len() as u8];
+            bytes.extend_from_slice(data);
+            Script::from(bytes)
+        }
+
+        fn p2pkh(key_bytes: &[u8]) -> Script {
+            let mut bytes = vec![71u8];
+            bytes.extend_from_slice(&[0x30; 71]);
+            bytes.push(key_bytes.len() as u8);
+            bytes.extend_from_slice(key_bytes);
+            Script::from(bytes)
+        }
+
+        fn p2pkh_with_trailing_push(key_bytes: &[u8], junk: &[u8]) -> Script {
+            let mut bytes = Self::p2pkh(key_bytes).as_bytes().to_vec();
+            bytes.push(junk.len() as u8);
+            bytes.extend_from_slice(junk);
+            Script::from(bytes)
+        }
+    }
+
+    struct Witness;
+
+    impl Witness {
+        fn p2wpkh(pk: &PublicKey) -> Vec<Vec<u8>> {
+            Data::p2wpkh_witness(pk)
+        }
+
+        fn keypath() -> Vec<Vec<u8>> {
+            vec![vec![0x30; 64]]
+        }
+
+        /// Signature, one leaf script, then a control block: leaf-version/parity byte
+        /// followed by the x-only internal key, with no merkle branch.
+        fn script_path(internal_key: &crate::secp256k1::XOnlyPublicKey) -> Vec<Vec<u8>> {
+            let mut control = vec![0xc0u8];
+            control.extend_from_slice(&internal_key.serialize());
+            vec![vec![0x30; 64], vec![0xab; 32], control]
+        }
+    }
+
+    /// One prevout/spend shape and the key it must contribute, if any.
+    struct RecoveryCase {
+        why: &'static str,
+        spk: Script,
+        script_sig: Script,
+        witness: Vec<Vec<u8>>,
+        expected: Option<PublicKey>,
+    }
+
+    impl RecoveryCase {
+        fn new(
+            why: &'static str,
+            spk: Script,
+            script_sig: Script,
+            witness: Vec<Vec<u8>>,
+            expected: Option<PublicKey>,
+        ) -> Self {
+            Self {
+                why,
+                spk,
+                script_sig,
+                witness,
+                expected,
+            }
+        }
+
+        fn check(&self) {
+            assert_eq!(
+                InputPubkeyRecovery::new(&self.spk, &self.script_sig, &self.witness).recover(),
+                self.expected,
+                "{}",
+                self.why
+            );
+        }
+    }
+
+    struct TxFixture;
+
+    impl TxFixture {
+        fn input(previous_output: OutPoint, script_witness: Vec<Vec<u8>>, is_pegin: bool) -> TxIn {
+            Data::input(previous_output, script_witness, is_pegin)
+        }
+
+        fn of(input: Vec<TxIn>) -> Transaction {
+            Transaction {
+                version: 2,
+                lock_time: crate::elements::LockTime::ZERO,
+                input,
+                output: vec![],
+            }
+        }
+    }
+
+    /// Taproot keys must come back in even-Y form even when the signer's key is
+    /// odd-Y, because that is all an observer can see in the scriptPubKey. Getting
+    /// this wrong makes half of all taproot inputs derive the wrong `A`.
+    #[test]
+    fn taproot_recovers_even_y_output_key() {
+        // Find a key with odd Y so the negation path is actually exercised.
+        let (secret, pk) = (1u8..40)
+            .map(|b| (Data::secret_key(b), Data::secret_key(b).public_key(&EC)))
+            .find(|(_, pk)| pk.x_only_public_key().1 == crate::elements::secp256k1_zkp::Parity::Odd)
+            .expect("some seed yields an odd-Y key");
+        let spk = Spk::p2tr(&pk);
+        let witness = Witness::keypath();
+
+        let got = InputPubkeyRecovery::new(&spk, &Script::new(), &witness)
+            .recover()
+            .expect("key-path taproot is eligible");
+
+        assert_eq!(got, secret.negate().public_key(&EC));
+        assert_ne!(got, pk, "the odd-Y key must not be summed as-is");
+        assert_eq!(
+            got,
+            crate::silentpayments::InputKey::Taproot(secret).public_key()
+        );
+    }
+
+    /// Every prevout shape the recovery has to classify, plus the malleations that
+    /// must not change its answer. `None` means the input contributes no key —
+    /// either the shape is not SP-eligible, or the key it commits to is not permitted.
+    #[test]
+    fn single_input_key_recovery() {
+        let pubk = |b: u8| Data::secret_key(b).public_key(&EC);
+        let taproot =
+            |b: u8| crate::silentpayments::InputKey::Taproot(Data::secret_key(b)).public_key();
+
+        let nums_h =
+            crate::secp256k1::XOnlyPublicKey::from_slice(&InputPubkeyRecovery::NUMS_H).unwrap();
+        let junk = pubk(0x99);
+        let redeem = Spk::p2wpkh(&pubk(0x23));
+        let not_p2wpkh = Script::from(vec![0x52, 0x53, 0x54]);
+        let uncompressed = pubk(0x26).serialize_uncompressed();
+
+        // A 64-byte BIP-340 signature begins with 0x50 about 1 time in 256, and
+        // BIP-341 recognizes an annex only from 2 witness elements up.
+        let sig_resembling_an_annex = {
+            let mut sig = vec![0x50u8];
+            sig.extend_from_slice(&[0xAB; 63]);
+            vec![sig]
+        };
+
+        let cases = [
+            RecoveryCase::new(
+                "p2wpkh key is summed as-is",
+                Spk::p2wpkh(&pubk(0x21)),
+                Script::new(),
+                Witness::p2wpkh(&pubk(0x21)),
+                Some(pubk(0x21)),
+            ),
+            RecoveryCase::new(
+                "script-path taproot contributes the output key, not the internal key",
+                Spk::p2tr(&pubk(0x22)),
+                Script::new(),
+                Witness::script_path(&junk.x_only_public_key().0),
+                Some(taproot(0x22)),
+            ),
+            RecoveryCase::new(
+                "script-path taproot using NUMS H is not eligible",
+                Spk::p2tr(&pubk(0x23)),
+                Script::new(),
+                Witness::script_path(&nums_h),
+                None,
+            ),
+            RecoveryCase::new(
+                "a one-element witness is a key-path spend, not an annex",
+                Spk::p2tr(&pubk(0x25)),
+                Script::new(),
+                sig_resembling_an_annex,
+                Some(taproot(0x25)),
+            ),
+            RecoveryCase::new(
+                "malformed control block is not eligible",
+                Spk::p2tr(&pubk(0x24)),
+                Script::new(),
+                vec![vec![0x30; 64], vec![0xab; 32], vec![0xc0; 10]],
+                None,
+            ),
+            RecoveryCase::new(
+                "p2sh is eligible when it wraps p2wpkh",
+                Spk::p2sh(&redeem),
+                ScriptSig::push(redeem.as_bytes()),
+                Witness::p2wpkh(&pubk(0x23)),
+                Some(pubk(0x23)),
+            ),
+            RecoveryCase::new(
+                "p2sh wrapping anything else is not",
+                Spk::p2sh(&redeem),
+                ScriptSig::push(not_p2wpkh.as_bytes()),
+                Witness::p2wpkh(&pubk(0x23)),
+                None,
+            ),
+            RecoveryCase::new(
+                "legacy p2pkh key matches the committed hash160",
+                Spk::p2pkh(&pubk(0x24)),
+                ScriptSig::p2pkh(&pubk(0x24).serialize()),
+                vec![],
+                Some(pubk(0x24)),
+            ),
+            RecoveryCase::new(
+                "BIP-352 permits only compressed and x-only keys",
+                Spk::p2pkh_of(&uncompressed),
+                ScriptSig::p2pkh(&uncompressed),
+                vec![],
+                None,
+            ),
+            RecoveryCase::new(
+                "p2pkh key is found by hash160, not by taking the last push",
+                Spk::p2pkh(&pubk(0x27)),
+                ScriptSig::p2pkh_with_trailing_push(&pubk(0x27).serialize(), &junk.serialize()),
+                vec![],
+                Some(pubk(0x27)),
+            ),
+        ];
+
+        for case in &cases {
+            case.check();
+        }
+    }
+
+    #[test]
+    fn extract_over_transaction_agrees_with_direct_aggregation() {
+        let keys = [Data::secret_key(0x31), Data::secret_key(0x32)];
+        let outpoints = [Data::outpoint(0x30, 1), Data::outpoint(0x10, 0)];
+        let spks: Vec<Script> = keys
+            .iter()
+            .map(|k| Spk::p2wpkh(&k.public_key(&EC)))
+            .collect();
+
+        let tx = TxFixture::of(
+            (0..2)
+                .map(|i| {
+                    TxFixture::input(
+                        outpoints[i],
+                        Witness::p2wpkh(&keys[i].public_key(&EC)),
+                        false,
+                    )
+                })
+                .collect(),
+        );
+
+        let lookup: Vec<(OutPoint, Script)> = outpoints.iter().copied().zip(spks).collect();
+        let extracted = SilentPaymentTxInputs::extract(&tx, |o| {
+            lookup.iter().find(|(op, _)| op == o).map(|(_, s)| s)
+        });
+
+        assert!(extracted.is_eligible());
+        assert_eq!(extracted.eligible().len(), 2);
+        assert!(extracted.ineligible().is_empty());
+
+        let direct = crate::silentpayments::SilentPaymentInputs::aggregate(&[
+            (outpoints[0], keys[0]),
+            (outpoints[1], keys[1]),
+        ])
+        .unwrap();
+        assert_eq!(extracted.observed().unwrap(), direct.observed());
+    }
+
+    #[test]
+    fn unknown_prevout_is_ineligible_but_keeps_its_outpoint() {
+        let key = Data::secret_key(0x41);
+        let known = Data::outpoint(0x50, 0);
+        // Smaller serialization than `known`, so it decides outpoint_L if counted.
+        let unknown = Data::outpoint(0x10, 0);
+        let spk = Spk::p2wpkh(&key.public_key(&EC));
+        let witness = Witness::p2wpkh(&key.public_key(&EC));
+
+        let tx = TxFixture::of(vec![
+            TxFixture::input(known, witness.clone(), false),
+            TxFixture::input(unknown, witness, false),
+        ]);
+
+        let extracted =
+            SilentPaymentTxInputs::extract(&tx, |o| if *o == known { Some(&spk) } else { None });
+
+        assert_eq!(extracted.eligible().len(), 1);
+        assert_eq!(extracted.ineligible(), &[unknown]);
+
+        let with = extracted.observed().unwrap();
+        let without = ObservedInputs::aggregate(&[(known, key.public_key(&EC))]).unwrap();
+        assert_eq!(with.a_pubkey, without.a_pubkey, "A only sums eligible keys");
+        assert_ne!(
+            with.input_hash, without.input_hash,
+            "the ineligible outpoint must still affect outpoint_L"
+        );
+    }
+
+    #[test]
+    fn pegin_input_contributes_no_key() {
+        let key = Data::secret_key(0x42);
+        let op = Data::outpoint(0x60, 3);
+        let spk = Spk::p2wpkh(&key.public_key(&EC));
+
+        let tx = TxFixture::of(vec![TxFixture::input(
+            op,
+            Witness::p2wpkh(&key.public_key(&EC)),
+            true,
+        )]);
+
+        let extracted = SilentPaymentTxInputs::extract(&tx, |_| Some(&spk));
+        assert!(
+            !extracted.is_eligible(),
+            "a peg-in alone is not SP-eligible"
+        );
+        assert_eq!(extracted.ineligible(), &[op]);
+        assert_eq!(extracted.observed(), Err(SilentPaymentInputError::NoInputs));
+    }
+
+    #[test]
+    fn unknown_segwit_version_disqualifies_the_whole_transaction() {
+        let key = Data::secret_key(0x51);
+        let known = Data::outpoint(0x70, 0);
+        let unknown_version = Data::outpoint(0x71, 0);
+        let p2wpkh = Spk::p2wpkh(&key.public_key(&EC));
+        let v2_program = Spk::unknown_witness_version();
+
+        let tx = TxFixture::of(vec![
+            TxFixture::input(known, Witness::p2wpkh(&key.public_key(&EC)), false),
+            TxFixture::input(unknown_version, vec![vec![0xAB; 64]], false),
+        ]);
+
+        let lookup = |o: &OutPoint| {
+            if *o == known {
+                Some(&p2wpkh)
+            } else if *o == unknown_version {
+                Some(&v2_program)
+            } else {
+                None
+            }
+        };
+
+        let extracted = SilentPaymentTxInputs::extract(&tx, lookup);
+        assert!(extracted.must_not_be_scanned());
+        assert!(
+            !extracted.is_eligible(),
+            "an unknown SegWit version input must veto the whole transaction, \
+             even with an otherwise-eligible P2WPKH input present"
+        );
+        assert_eq!(
+            extracted.observed(),
+            Err(SilentPaymentInputError::NoInputs),
+            "observed() must also refuse a transaction that must not be scanned"
+        );
+    }
+
+    #[test]
+    fn known_segwit_versions_do_not_trip_the_veto() {
+        let key = Data::secret_key(0x52).public_key(&EC);
+        assert!(!SilentPaymentTxInputs::is_unknown_segwit_version(
+            &Spk::p2wpkh(&key)
+        ));
+        assert!(!SilentPaymentTxInputs::is_unknown_segwit_version(
+            &Spk::p2tr(&key)
+        ));
+    }
+}
diff --git a/lwk_wollet/src/silentpayments/tx_scan.rs b/lwk_wollet/src/silentpayments/tx_scan.rs
new file mode 100644
index 000000000..9de5f6c21
--- /dev/null
+++ b/lwk_wollet/src/silentpayments/tx_scan.rs
@@ -0,0 +1,173 @@
+//! Scans transactions for wallet-owned silent payments.
+
+use crate::elements::{OutPoint, Script, Transaction};
+use crate::silentpayments::{
+    PartialTweak, SilentPaymentScanMaterial, SilentPaymentScanner, SilentPaymentTxInputs,
+    SilentPaymentUtxo,
+};
+use crate::util::EC;
+
+/// Scans complete transactions for wallet-owned silent payments.
+#[derive(Debug, Clone)]
+pub struct SilentPaymentTxScanner {
+    scanner: SilentPaymentScanner,
+}
+
+impl SilentPaymentTxScanner {
+    /// A scanner for `material`, detecting plain (unlabeled) payments only.
+    pub fn new(material: SilentPaymentScanMaterial) -> Self {
+        SilentPaymentTxScanner {
+            scanner: SilentPaymentScanner::new(material),
+        }
+    }
+
+    /// Also detects payments sent to `labels`.
+    pub fn with_labels(mut self, labels: impl IntoIterator<Item = u32>) -> Self {
+        self.scanner = self.scanner.with_labels(labels);
+        self
+    }
+
+    /// Stop scanning a transaction after `gap_limit` consecutive output indices miss.
+    pub fn with_gap_limit(mut self, gap_limit: u32) -> Self {
+        self.scanner = self.scanner.with_gap_limit(gap_limit);
+        self
+    }
+
+    /// Finds wallet-owned outputs using input prevout scripts.
+    pub fn scan_tx<'a, F>(&self, tx: &Transaction, prevout_script: F) -> Vec<SilentPaymentUtxo>
+    where
+        F: FnMut(&OutPoint) -> Option<&'a Script>,
+    {
+        let inputs = SilentPaymentTxInputs::extract(tx, prevout_script);
+
+        if !inputs.is_eligible() {
+            return Vec::new();
+        }
+
+        let Ok(observed) = inputs.observed() else {
+            return Vec::new();
+        };
+
+        let tweak = PartialTweak::from_observed(&observed);
+        self.scan_tx_with_tweak(tx, &tweak)
+    }
+
+    /// Scans `tx` using an externally obtained partial tweak.
+    pub fn scan_tx_with_tweak(
+        &self,
+        tx: &Transaction,
+        tweak: &PartialTweak,
+    ) -> Vec<SilentPaymentUtxo> {
+        let txid = tx.txid();
+        let scripts: Vec<Script> = tx.output.iter().map(|o| o.script_pubkey.clone()).collect();
+
+        let mut found = Vec::new();
+        for hit in self.scanner.scan(tweak, &scripts) {
+            let want = hit.output.script_pubkey();
+
+            let Some(vout) = tx.output.iter().position(|o| o.script_pubkey == want) else {
+                continue;
+            };
+            let txout = &tx.output[vout];
+
+            let Ok(unblinded) = txout.unblind(&EC, hit.output.blinding_seckey) else {
+                continue;
+            };
+
+            found.push(SilentPaymentUtxo::new(
+                OutPoint::new(txid, vout as u32),
+                txout.clone(),
+                unblinded,
+                hit,
+            ));
+        }
+        found
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::silentpayments::test_fixture::SilentPaymentTestData as Data;
+    use crate::silentpayments::test_fixture::SpPaymentBuilder;
+    use crate::silentpayments::{SilentPaymentScan, CHANGE_LABEL};
+
+    fn keys() -> SilentPaymentScanMaterial {
+        Data::material(0x11, 0x22)
+    }
+
+    #[test]
+    fn scan_tx_finds_nothing_it_should_not() {
+        let keys = keys();
+        let inputs = [(Data::outpoint(0x22, 1), Data::secret_key(0xA1))];
+
+        let stranger = Data::material(0x77, 0x88);
+        let to_stranger = SpPaymentBuilder::new()
+            .with_inputs(&inputs)
+            .with_value(1_000)
+            .build_for(&stranger);
+        assert!(
+            SilentPaymentTxScanner::new(keys)
+                .scan_tx(&to_stranger.tx, to_stranger.prevout_lookup())
+                .is_empty(),
+            "must not claim another wallet's payment"
+        );
+
+        let to_us = SpPaymentBuilder::new()
+            .with_inputs(&inputs)
+            .build_for(&keys);
+        assert!(
+            SilentPaymentTxScanner::new(keys)
+                .scan_tx(&to_us.tx, |_| None)
+                .is_empty(),
+            "without prevouts there is no A, so there must be no discovery"
+        );
+    }
+
+    /// Finds labeled change only when the label is configured.
+    #[test]
+    fn change_label_requires_opt_in() {
+        let keys = keys();
+        let payment = SpPaymentBuilder::new()
+            .with_inputs(&[(Data::outpoint(0x33, 0), Data::secret_key(0xB1))])
+            .with_value(7_000)
+            .build(&keys.labeled_address(CHANGE_LABEL));
+
+        assert!(SilentPaymentTxScanner::new(keys)
+            .scan_tx(&payment.tx, payment.prevout_lookup())
+            .is_empty());
+
+        let found = SilentPaymentTxScanner::new(keys)
+            .with_labels([CHANGE_LABEL])
+            .scan_tx(&payment.tx, payment.prevout_lookup());
+        assert_eq!(found.len(), 1);
+        assert_eq!(found[0].label, Some(CHANGE_LABEL));
+        assert!(found[0].is_change());
+        assert_eq!(found[0].unblinded.value, 7_000);
+        assert_eq!(
+            found[0]
+                .spend_tweak
+                .applied_to(&keys.spend_pubkey())
+                .unwrap(),
+            found[0].output.spend_pubkey
+        );
+    }
+
+    #[test]
+    fn tweak_path_agrees_with_prevout_path() {
+        let keys = keys();
+        let payment = SpPaymentBuilder::new().with_value(12_345).build_for(&keys);
+        let scanner = SilentPaymentTxScanner::new(keys);
+
+        let from_prevouts = scanner.scan_tx(&payment.tx, payment.prevout_lookup());
+
+        let extracted = SilentPaymentTxInputs::extract(&payment.tx, payment.prevout_lookup());
+        let tweak = PartialTweak::from_observed(&extracted.observed().unwrap());
+        let from_tweak = scanner.scan_tx_with_tweak(&payment.tx, &tweak);
+
+        assert_eq!(from_prevouts.len(), 1);
+        assert_eq!(from_tweak.len(), 1);
+        assert_eq!(from_prevouts[0].outpoint, from_tweak[0].outpoint);
+        assert_eq!(from_prevouts[0].spend_tweak, from_tweak[0].spend_tweak);
+    }
+}
diff --git a/lwk_wollet/src/silentpayments/txout.rs b/lwk_wollet/src/silentpayments/txout.rs
new file mode 100644
index 000000000..c8127e3e1
--- /dev/null
+++ b/lwk_wollet/src/silentpayments/txout.rs
@@ -0,0 +1,76 @@
+//! Building the confidential `TxOut` that pays a silent payment output.
+
+use crate::silentpayments::SilentPaymentOutput;
+use crate::util::EC;
+use crate::Error;
+
+/// Builds silent-payment confidential outputs without surjection proofs.
+pub struct SpTxOutBuilder;
+
+impl SpTxOutBuilder {
+    /// The rangeproof exponent and minimum-bits, matching `TxBuilder`'s blinding.
+    const RANGEPROOF_EXP: i32 = 0;
+    const RANGEPROOF_MIN_BITS: u8 = 52;
+
+    /// Builds a blinded output and its blinding secrets.
+    pub fn build(
+        out: &SilentPaymentOutput,
+        asset: crate::elements::AssetId,
+        value: u64,
+        rng: &mut (impl rand::RngCore + rand::CryptoRng),
+    ) -> Result<(crate::elements::TxOut, crate::elements::TxOutSecrets), Error> {
+        use crate::elements::confidential::{
+            Asset, AssetBlindingFactor, Nonce, Value, ValueBlindingFactor,
+        };
+        use crate::elements::secp256k1_zkp::{Generator, PedersenCommitment, RangeProof, Tag};
+        use crate::elements::{TxOut, TxOutSecrets, TxOutWitness};
+
+        let script_pubkey = out.script_pubkey();
+        let abf = AssetBlindingFactor::new(&mut *rng);
+        let vbf = ValueBlindingFactor::new(&mut *rng);
+
+        let (nonce, ct_shared_secret) =
+            Nonce::new_confidential(&mut *rng, &EC, &out.blinding_pubkey);
+
+        let asset_tag = Tag::from(asset.into_inner().to_byte_array());
+        let asset_generator = Generator::new_blinded(&EC, asset_tag, abf.into_inner());
+        let value_commitment =
+            PedersenCommitment::new(&EC, value, vbf.into_inner(), asset_generator);
+
+        let mut message = [0u8; 64];
+        message[..32].copy_from_slice(&asset.into_inner().to_byte_array());
+        message[32..].copy_from_slice(abf.into_inner().as_ref());
+
+        let rangeproof = RangeProof::new(
+            &EC,
+            1,
+            value_commitment,
+            value,
+            vbf.into_inner(),
+            &message,
+            script_pubkey.as_bytes(),
+            ct_shared_secret,
+            Self::RANGEPROOF_EXP,
+            Self::RANGEPROOF_MIN_BITS,
+            asset_generator,
+        )?;
+
+        let txout = TxOut {
+            asset: Asset::Confidential(asset_generator),
+            value: Value::Confidential(value_commitment),
+            nonce,
+            script_pubkey,
+            witness: TxOutWitness {
+                surjection_proof: None,
+                rangeproof: Some(Box::new(rangeproof)),
+            },
+        };
+        let secrets = TxOutSecrets {
+            asset,
+            asset_bf: abf,
+            value,
+            value_bf: vbf,
+        };
+        Ok((txout, secrets))
+    }
+}
diff --git a/lwk_wollet/src/silentpayments/utxo.rs b/lwk_wollet/src/silentpayments/utxo.rs
new file mode 100644
index 000000000..00ce4206c
--- /dev/null
+++ b/lwk_wollet/src/silentpayments/utxo.rs
@@ -0,0 +1,99 @@
+//! Silent payment outputs owned by the wallet.
+
+use crate::elements::{OutPoint, TxOut, TxOutSecrets};
+use crate::model::ExternalUtxo;
+use crate::silentpayments::{LabeledHit, SilentPaymentOutput, SpendTweak, CHANGE_LABEL};
+
+/// A scanned, unblinded silent-payment output and its spend tweak.
+#[derive(Debug, Clone)]
+pub struct SilentPaymentUtxo {
+    /// Where the output sits on chain.
+    pub outpoint: OutPoint,
+
+    /// The output as it appears in the transaction, still blinded.
+    pub txout: TxOut,
+
+    /// Asset and value, unblinded with `bk_k`.
+    pub unblinded: TxOutSecrets,
+
+    /// The output counter `k` this output was found at.
+    pub k: u32,
+
+    /// The label the payment was sent to; `Some(CHANGE_LABEL)` is the wallet's change.
+    pub label: Option<u32>,
+
+    /// The recomputed spend and blinding key material.
+    pub output: SilentPaymentOutput,
+
+    /// `t_k (+ label_tweak_m)`, added to `b_spend` when signing.
+    pub spend_tweak: SpendTweak,
+}
+
+impl SilentPaymentUtxo {
+    /// Weight of a default-sighash key-path Taproot satisfaction.
+    pub const MAX_WEIGHT_TO_SATISFY: usize = 66;
+
+    /// Assemble a found output from a scan hit and the located transaction output.
+    pub fn new(outpoint: OutPoint, txout: TxOut, unblinded: TxOutSecrets, hit: LabeledHit) -> Self {
+        SilentPaymentUtxo {
+            outpoint,
+            txout,
+            unblinded,
+            k: hit.k,
+            label: hit.label,
+            output: hit.output,
+            spend_tweak: hit.spend_tweak,
+        }
+    }
+
+    /// The cache's view of this output.
+    pub fn cache_entry(&self) -> crate::silentpayments::SilentPaymentCacheEntry {
+        crate::silentpayments::SilentPaymentCacheEntry {
+            outpoint: self.outpoint,
+            script_pubkey: self.txout.script_pubkey.clone(),
+            k: self.k,
+            label: self.label,
+            spend_tweak: self.spend_tweak,
+            blinding_pubkey: self.output.blinding_pubkey,
+        }
+    }
+
+    /// Whether this output is the wallet's own silent-payment change (label `m = 0`).
+    pub fn is_change(&self) -> bool {
+        self.label == Some(CHANGE_LABEL)
+    }
+
+    /// Returns the descriptor-independent funding view.
+    pub fn external_utxo(&self) -> ExternalUtxo {
+        ExternalUtxo {
+            outpoint: self.outpoint,
+            txout: self.txout.clone(),
+            tx: None,
+            unblinded: self.unblinded,
+            max_weight_to_satisfy: Self::MAX_WEIGHT_TO_SATISFY,
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// A wrong value here under-pays the fee on every transaction spending a silent
+    /// payment, so the constant is pinned against miniscript rather than trusted.
+    #[test]
+    fn sp_taproot_satisfaction_weight_matches_miniscript() {
+        use elements_miniscript::{Descriptor, DescriptorPublicKey};
+        use std::str::FromStr;
+
+        let pk = lwk_test_util::ElementsTestData::public_key(0x42);
+        let desc = Descriptor::<DescriptorPublicKey>::from_str(&format!("eltr({pk})"))
+            .expect("tr descriptor parses");
+
+        assert_eq!(
+            desc.max_weight_to_satisfy().expect("weight is computable"),
+            SilentPaymentUtxo::MAX_WEIGHT_TO_SATISFY,
+            "hard-coded SP taproot satisfaction weight disagrees with miniscript"
+        );
+    }
+}

From 847b5b9f55aa11d18ba85a9fd6c448d7dacee051 Mon Sep 17 00:00:00 2001
From: 42Pupusas <technology@illuminodes.com>
Date: Fri, 31 Jul 2026 16:03:40 -0600
Subject: [PATCH 07/12] wollet: treat silent payments as ordinary wallet money

WolletBuilder accepts scan-only material and a birthday; the cache tracks found outputs by script alongside descriptor-derived ones so utxos/balance/spent bookkeeping need no special cases; Update version 6 carries discovered outputs and scan progress; scan material participates in wallet status so persistence cannot mix wallets. TxBuilder gains silent payment recipients (resolved at finish, when the final inputs are known), standalone SP utxos, correct Taproot key-path weight for fee estimation, and PSET annotation that attaches verified signing metadata for the signer. Empty SP state hashes exactly as before the feature existed, keeping every persisted wallet valid.
---
 lwk_wollet/src/cache.rs                       | 118 ++-
 lwk_wollet/src/clients/asyncr/esplora.rs      |   2 +
 lwk_wollet/src/clients/blocking/mod.rs        |   2 +
 lwk_wollet/src/issuance.rs                    |   4 +-
 lwk_wollet/src/lib.rs                         |   4 +
 lwk_wollet/src/pset_create.rs                 |  29 +-
 lwk_wollet/src/silentpayments/mod.rs          |   2 +
 .../src/silentpayments/pset_annotate.rs       | 111 +++
 lwk_wollet/src/silentpayments/test_fixture.rs |  11 +
 lwk_wollet/src/tx_builder.rs                  | 435 +++++++++-
 lwk_wollet/src/update.rs                      | 370 ++++++++-
 lwk_wollet/src/wollet.rs                      | 749 ++++++++++++++++++
 12 files changed, 1826 insertions(+), 11 deletions(-)
 create mode 100644 lwk_wollet/src/silentpayments/pset_annotate.rs

diff --git a/lwk_wollet/src/cache.rs b/lwk_wollet/src/cache.rs
index 180fb8418..20f8bf656 100644
--- a/lwk_wollet/src/cache.rs
+++ b/lwk_wollet/src/cache.rs
@@ -20,7 +20,8 @@ fn tx_key(txid: &Txid) -> String {
 }
 
 /// `Cache` is a cache of wallet data, like wallet transactions.
-/// It is fully reconstructable from the CT Descriptor and the blockchain.
+///
+/// Silent-payment scan keys also contribute to persistent wallet status.
 pub struct Cache {
     /// Store for all wallet transactions
     txs_store: Arc<dyn DynStore>,
@@ -64,6 +65,14 @@ pub struct Cache {
 
     /// last unused index for internal addresses (changes) for current descriptor
     pub last_unused_internal: AtomicU32,
+
+    /// Discovered silent-payment outputs, keyed by script.
+    #[cfg(feature = "silentpayments")]
+    pub silent_payments: HashMap<Script, crate::silentpayments::SilentPaymentCacheEntry>,
+
+    /// Height through which silent-payment discovery has run.
+    #[cfg(feature = "silentpayments")]
+    pub silent_payments_scanned_to: Option<Height>,
 }
 
 impl Default for Cache {
@@ -82,6 +91,10 @@ impl Default for Cache {
             last_unused_internal: 0.into(),
             last_unused_external: 0.into(),
             timestamps: HashMap::default(),
+            #[cfg(feature = "silentpayments")]
+            silent_payments: HashMap::default(),
+            #[cfg(feature = "silentpayments")]
+            silent_payments_scanned_to: None,
         }
     }
 }
@@ -122,6 +135,20 @@ impl std::hash::Hash for Cache {
         self.last_unused_internal
             .load(Ordering::Relaxed)
             .hash(state);
+
+        // Skip empty state to preserve existing wallet status hashes.
+        #[cfg(feature = "silentpayments")]
+        if !self.silent_payments.is_empty() {
+            let mut vec: Vec<_> = self.silent_payments.keys().collect();
+            vec.sort();
+            vec.hash(state);
+        }
+
+        // Skip absent state to preserve existing wallet status hashes.
+        #[cfg(feature = "silentpayments")]
+        if let Some(height) = self.silent_payments_scanned_to {
+            height.hash(state);
+        }
     }
 }
 
@@ -326,6 +353,18 @@ impl Cache {
         self.sorted_txids = sorted;
     }
 
+    /// Whether the wallet owns `script`.
+    pub(crate) fn owns_script(&self, script: &Script) -> bool {
+        if self.paths.contains_key(script) {
+            return true;
+        }
+        #[cfg(feature = "silentpayments")]
+        if self.silent_payments.contains_key(script) {
+            return true;
+        }
+        false
+    }
+
     fn update_unspent(
         &mut self,
         txid_height_new: &[(Txid, Option<u32>)],
@@ -342,7 +381,7 @@ impl Cache {
                 self.outpoint_script(op, new_txs)
                     .map(|script| (*op, script))
             })
-            .filter(|(_, script)| self.paths.contains_key(script))
+            .filter(|(_, script)| self.owns_script(script))
             .collect();
 
         let inputs_new: HashSet<OutPoint> = txids_new
@@ -362,7 +401,7 @@ impl Cache {
                 self.outpoint_script(&op, new_txs)
                     .map(|script| (op, script))
             })
-            .filter(|(_, script)| self.paths.contains_key(script))
+            .filter(|(_, script)| self.owns_script(script))
             .collect();
 
         // Add outputs of new txs
@@ -539,6 +578,39 @@ impl Cache {
     }
 }
 
+/// Silent payment outputs in the cache.
+#[cfg(feature = "silentpayments")]
+impl Cache {
+    /// Records a discovered silent-payment output.
+    pub(crate) fn insert_silent_payment(
+        &mut self,
+        entry: crate::silentpayments::SilentPaymentCacheEntry,
+        unblinded: TxOutSecrets,
+    ) {
+        let outpoint = entry.outpoint;
+        let script = entry.script_pubkey.clone();
+        self.unblinded.insert(outpoint, unblinded);
+        self.silent_payments.insert(script.clone(), entry);
+        if !self.is_spent(&outpoint) {
+            self.unspent.insert(outpoint, script);
+        }
+    }
+
+    /// Whether a cached transaction spends `outpoint`.
+    fn is_spent(&self, outpoint: &OutPoint) -> bool {
+        self.all_txs()
+            .any(|(_, tx)| tx.input.iter().any(|i| i.previous_output == *outpoint))
+    }
+
+    /// The silent payment entry for `script`, if the wallet owns it.
+    pub(crate) fn silent_payment(
+        &self,
+        script: &Script,
+    ) -> Option<&crate::silentpayments::SilentPaymentCacheEntry> {
+        self.silent_payments.get(script)
+    }
+}
+
 #[cfg(test)]
 mod tests {
     use crate::{cache::Cache, WolletDescriptor};
@@ -603,6 +675,46 @@ mod tests {
         // TODO test other fields change the hash
     }
 
+    /// Empty silent-payment state preserves the legacy status hash.
+    #[cfg(feature = "silentpayments")]
+    #[test]
+    fn silent_payments_hash_only_once_non_empty() {
+        use crate::silentpayments::SilentPaymentCacheEntry;
+
+        let hash_of = |cache: &Cache| {
+            let mut hasher = DefaultHasher::new();
+            cache.hash(&mut hasher);
+            hasher.finish()
+        };
+
+        let mut cache = Cache::default();
+        assert_eq!(
+            hash_of(&cache),
+            11565483422739161174,
+            "an empty silent payment set must hash exactly as before the field existed"
+        );
+
+        let script = elements::Script::from(vec![0x51, 0x20, 0xAB]);
+        cache.silent_payments.insert(
+            script.clone(),
+            SilentPaymentCacheEntry {
+                outpoint: elements::OutPoint::new(<Txid as elements::hashes::Hash>::all_zeros(), 0),
+                script_pubkey: script,
+                k: 0,
+                label: None,
+                spend_tweak: crate::silentpayments::SpendTweak::from_be_bytes([0x11; 32]).unwrap(),
+                blinding_pubkey: crate::secp256k1::SecretKey::from_slice(&[0x22; 32])
+                    .unwrap()
+                    .public_key(&crate::util::EC),
+            },
+        );
+        assert_ne!(
+            hash_of(&cache),
+            11565483422739161174,
+            "a found silent payment is cache content and must change the hash"
+        );
+    }
+
     #[test]
     fn test_v5_restore_keeps_deleted_txids() {
         let tx = Transaction {
diff --git a/lwk_wollet/src/clients/asyncr/esplora.rs b/lwk_wollet/src/clients/asyncr/esplora.rs
index 27dfeb09e..7b116590d 100644
--- a/lwk_wollet/src/clients/asyncr/esplora.rs
+++ b/lwk_wollet/src/clients/asyncr/esplora.rs
@@ -495,6 +495,8 @@ impl EsploraClient {
                 tip,
                 unspent,
                 last_unused,
+                #[cfg(feature = "silentpayments")]
+                silent_payments: None,
             };
             Ok(Some(update))
         } else {
diff --git a/lwk_wollet/src/clients/blocking/mod.rs b/lwk_wollet/src/clients/blocking/mod.rs
index a88b2081b..43ee02846 100644
--- a/lwk_wollet/src/clients/blocking/mod.rs
+++ b/lwk_wollet/src/clients/blocking/mod.rs
@@ -269,6 +269,8 @@ pub trait BlockchainBackend {
                 tip,
                 unspent,
                 last_unused,
+                #[cfg(feature = "silentpayments")]
+                silent_payments: None,
             };
             Ok(Some(update))
         } else {
diff --git a/lwk_wollet/src/issuance.rs b/lwk_wollet/src/issuance.rs
index da9c99034..2a041d98a 100644
--- a/lwk_wollet/src/issuance.rs
+++ b/lwk_wollet/src/issuance.rs
@@ -3,7 +3,7 @@ use crate::elements::{Address, AssetId, OutPoint, Transaction};
 use crate::Error;
 use std::collections::HashSet;
 
-#[derive(Debug)]
+#[derive(Debug, Clone)]
 pub enum Issuances {
     None,
     Sequential(Vec<IssuanceRequest>),
@@ -110,7 +110,7 @@ impl IssuanceRequest {
 }
 
 /// Accumulates the reissuance requests added via [`crate::TxBuilder::add_reissuance()`].
-#[derive(Default)]
+#[derive(Default, Clone)]
 pub struct Reissuances {
     pub(crate) requests: Vec<ReissuanceRequest>,
     /// Cache to check for duplicated assets
diff --git a/lwk_wollet/src/lib.rs b/lwk_wollet/src/lib.rs
index 422e802be..3e6ff33c0 100644
--- a/lwk_wollet/src/lib.rs
+++ b/lwk_wollet/src/lib.rs
@@ -147,6 +147,10 @@ pub use crate::wollet::DirectoryIdHash;
 pub use crate::issuance::{IssuanceRequest, ReissuanceRequest};
 pub use crate::tx_builder::{BuiltTx, TxBuilder, WolletTxBuilder};
 pub use crate::update::{DownloadTxResult, Update};
+// The `Update::silent_payments` field is public, so its type must be nameable from
+// outside the crate — otherwise the field can be neither constructed nor matched.
+#[cfg(feature = "silentpayments")]
+pub use crate::update::SilentPaymentsUpdate;
 pub use crate::util::EC;
 pub use crate::wollet::{Tip, Wollet, WolletBuilder};
 pub use lwk_common::{
diff --git a/lwk_wollet/src/pset_create.rs b/lwk_wollet/src/pset_create.rs
index 620e8b4ff..b90f5b3c5 100644
--- a/lwk_wollet/src/pset_create.rs
+++ b/lwk_wollet/src/pset_create.rs
@@ -62,7 +62,7 @@ impl Wollet {
             Some(self.get_tx(&utxo.outpoint.txid)?)
         };
 
-        add_input_inner(
+        let idx = add_input_inner(
             pset,
             inp_txout_sec,
             inp_weight,
@@ -70,10 +70,31 @@ impl Wollet {
             self.get_txout(&utxo.outpoint)?,
             tx,
             utxo.unblinded,
-            self.max_weight_to_satisfy(),
+            self.satisfaction_weight_for(utxo),
             false, // wallet inputs cannot be explicit
             add_input_rangeproofs,
-        )
+        )?;
+
+        Ok(idx)
+    }
+
+    /// Weight units this input's satisfaction will add.
+    ///
+    /// Normally the wallet-wide value derived from the CT descriptor, since every
+    /// descriptor-derived input is satisfied the same way. A silent payment output is
+    /// the exception: it is always a key-path Taproot spend regardless of what the
+    /// wallet descriptor is, so charging it the descriptor's weight would mis-estimate
+    /// the fee — under-paying on a wpkh wallet, which risks a transaction that will not
+    /// relay.
+    /// With silent payments compiled out every wallet input is descriptor-derived, so
+    /// the utxo carries no information the wallet-wide value does not already have.
+    #[cfg_attr(not(feature = "silentpayments"), allow(unused_variables))]
+    pub(crate) fn satisfaction_weight_for(&self, utxo: &WalletTxOut) -> usize {
+        #[cfg(feature = "silentpayments")]
+        if let Some(entry) = self.cache.silent_payment(&utxo.script_pubkey) {
+            return entry.max_weight_to_satisfy();
+        }
+        self.max_weight_to_satisfy()
     }
 
     pub(crate) fn set_issuance(
@@ -165,7 +186,7 @@ impl Wollet {
         let index = if self.descriptor.has_wildcard() {
             Some(*last_unused)
         } else if self.descriptor.spk_count().is_some() {
-            // For wollets without descriptor, for now we do a safe choice and internally always use the first scriptpubkey
+            // Use the first fixed script when no wildcard is available.
             Some(0)
         } else {
             // Descriptor wollet with no wildcard
diff --git a/lwk_wollet/src/silentpayments/mod.rs b/lwk_wollet/src/silentpayments/mod.rs
index 7d49adc7f..98e0e23d4 100644
--- a/lwk_wollet/src/silentpayments/mod.rs
+++ b/lwk_wollet/src/silentpayments/mod.rs
@@ -11,6 +11,7 @@ pub mod block_tweaks;
 pub mod cache_entry;
 pub mod inputs;
 pub mod output;
+mod pset_annotate;
 pub mod receiver;
 pub mod recipient;
 pub mod scan_material;
@@ -35,6 +36,7 @@ pub use inputs::{
     SilentPaymentInputProvider, SilentPaymentInputs,
 };
 pub use output::SilentPaymentOutput;
+pub(crate) use pset_annotate::SilentPaymentPsetAnnotator;
 pub use receiver::{SilentPaymentReceiver, SpendTweak};
 pub use recipient::{ResolvedSilentPayment, SilentPaymentRecipient};
 pub use scan_material::{
diff --git a/lwk_wollet/src/silentpayments/pset_annotate.rs b/lwk_wollet/src/silentpayments/pset_annotate.rs
new file mode 100644
index 000000000..cd927d6e2
--- /dev/null
+++ b/lwk_wollet/src/silentpayments/pset_annotate.rs
@@ -0,0 +1,111 @@
+//! Attaches silent-payment signing metadata to PSET inputs.
+
+use std::collections::HashMap;
+
+use crate::elements::pset::PartiallySignedTransaction;
+use crate::elements::{OutPoint, Script};
+use crate::error::Error;
+use crate::silentpayments::{SilentPaymentScanMaterial, SilentPaymentUtxo, SpendTweak};
+use crate::wollet::Wollet;
+
+/// Attaches silent-payment metadata to PSET inputs.
+pub(crate) struct SilentPaymentPsetAnnotator<'a> {
+    wollet: &'a Wollet,
+
+    material: &'a SilentPaymentScanMaterial,
+
+    /// Standalone output tweaks by outpoint.
+    standalone: HashMap<OutPoint, SpendTweak>,
+}
+
+impl<'a> SilentPaymentPsetAnnotator<'a> {
+    /// Creates an annotator for the wallet and standalone silent-payment UTXOs.
+    pub(crate) fn for_builder(
+        wollet: &'a Wollet,
+        utxos: &[SilentPaymentUtxo],
+    ) -> Result<Option<Self>, Error> {
+        let material = match wollet.silent_payment_material() {
+            Some(material) => material,
+            None if utxos.is_empty() => return Ok(None),
+            None => return Err(Error::MissingSilentPaymentKeys),
+        };
+
+        Ok(Some(SilentPaymentPsetAnnotator {
+            wollet,
+            material,
+            standalone: utxos.iter().map(|u| (u.outpoint, u.spend_tweak)).collect(),
+        }))
+    }
+
+    /// Annotates silent-payment inputs, leaving ordinary inputs alone.
+    pub(crate) fn annotate(&self, pset: &mut PartiallySignedTransaction) -> Result<(), Error> {
+        for idx in 0..pset.inputs().len() {
+            let input = &pset.inputs()[idx];
+            let outpoint = OutPoint::new(input.previous_txid, input.previous_output_index);
+            let script = input
+                .witness_utxo
+                .as_ref()
+                .map(|txout| txout.script_pubkey.clone());
+
+            let Some(tweak) = self.tweak_for(&outpoint, script.as_ref()) else {
+                continue; // an ordinary descriptor-derived input
+            };
+
+            // Reject metadata that does not match the selected output.
+            self.verify(&outpoint, script.as_ref(), &tweak)?;
+
+            let input = pset
+                .inputs_mut()
+                .get_mut(idx)
+                .ok_or_else(|| Error::MissingVin)?;
+            self.material.input_meta(*tweak.as_scalar()).attach(input);
+        }
+        Ok(())
+    }
+
+    /// Returns the standalone or cached spend tweak.
+    fn tweak_for(&self, outpoint: &OutPoint, script: Option<&Script>) -> Option<SpendTweak> {
+        if let Some(tweak) = self.standalone.get(outpoint) {
+            return Some(*tweak);
+        }
+        self.wollet
+            .cache
+            .silent_payment(script?)
+            .map(|entry| entry.spend_tweak)
+    }
+
+    /// Checks `B_spend + tweak·G == x_only(P_k)` against the witness UTXO.
+    fn verify(
+        &self,
+        outpoint: &OutPoint,
+        script: Option<&Script>,
+        tweak: &SpendTweak,
+    ) -> Result<(), Error> {
+        let Some(script) = script else {
+            return Err(Error::Generic(format!(
+                "silent payment input {outpoint} has no witness utxo to verify its tweak against"
+            )));
+        };
+        let verified = tweak
+            .applied_to(&self.material.spend_pubkey())
+            .map(|expected| Self::output_key(script) == Some(expected.x_only_public_key().0))
+            .unwrap_or(false);
+        if verified {
+            Ok(())
+        } else {
+            Err(Error::Generic(format!(
+                "silent payment {outpoint} does not verify against this wallet's spend key"
+            )))
+        }
+    }
+
+    /// The x-only output key of a v1 Taproot program, or `None` if `script` is not one.
+    fn output_key(script: &Script) -> Option<crate::elements::secp256k1_zkp::XOnlyPublicKey> {
+        let bytes = script.as_bytes();
+        // `OP_1 <32-byte push>`: 0x51 0x20 followed by the key.
+        if bytes.len() != 34 || bytes[0] != 0x51 || bytes[1] != 0x20 {
+            return None;
+        }
+        crate::elements::secp256k1_zkp::XOnlyPublicKey::from_slice(&bytes[2..]).ok()
+    }
+}
diff --git a/lwk_wollet/src/silentpayments/test_fixture.rs b/lwk_wollet/src/silentpayments/test_fixture.rs
index fd29cf22c..fa8d86eab 100644
--- a/lwk_wollet/src/silentpayments/test_fixture.rs
+++ b/lwk_wollet/src/silentpayments/test_fixture.rs
@@ -100,6 +100,17 @@ impl SpPaymentBuilder {
         self
     }
 
+    pub(crate) fn with_asset(mut self, asset: AssetId) -> Self {
+        self.asset = asset;
+        self
+    }
+
+    /// Emit only the silent-payment output.
+    pub(crate) fn without_extra_output(mut self) -> Self {
+        self.extra_output = false;
+        self
+    }
+
     /// Build a payment to `address`.
     pub(crate) fn build(self, address: &SilentPaymentAddress) -> SpPayment {
         let sender = SilentPaymentSender::from_inputs(&self.inputs)
diff --git a/lwk_wollet/src/tx_builder.rs b/lwk_wollet/src/tx_builder.rs
index a57346303..6b04a3377 100644
--- a/lwk_wollet/src/tx_builder.rs
+++ b/lwk_wollet/src/tx_builder.rs
@@ -23,6 +23,9 @@ use elements::{
 use lwk_common::{calculate_fee, set_genesis_hash};
 use rand::thread_rng;
 
+#[cfg(feature = "silentpayments")]
+use crate::silentpayments::{SilentPaymentAddress, SilentPaymentRecipient};
+
 /// Validates the outputs receiving `total` (re)issued satoshi, filling in the default single
 /// output to the wallet generating the (re)issuance if the caller added none
 fn validate_outputs(
@@ -209,7 +212,7 @@ pub(crate) fn add_input_inner(
 ///   of the wallet in the finish methods because this it more friendly for bindings implementation.
 ///   Moreover, we could have an alternative finish which don't use a wallet at all.
 /// * We are consuming and returning self to build the tx with method chaining
-#[derive(Debug)]
+#[derive(Debug, Clone)]
 pub struct TxBuilder {
     network: Network,
     recipients: Vec<Recipient>,
@@ -229,6 +232,22 @@ pub struct TxBuilder {
     // LiquiDEX fields
     is_liquidex_make: bool,
     liquidex_proposals: Vec<LiquidexProposal<Validated>>,
+
+    /// Silent payment recipients, held apart from `recipients` because they cannot
+    /// be resolved until the transaction's inputs are known: the output key is
+    /// derived from a shared secret over the very inputs that fund it.
+    #[cfg(feature = "silentpayments")]
+    silent_payment_recipients: Vec<SilentPaymentRecipient>,
+
+    /// Silent payment outputs being spent *standalone* — found by a scan but not
+    /// applied to the wallet, so the cache cannot recognize them.
+    ///
+    /// Their funding side already travels as an `ExternalUtxo`; what an `ExternalUtxo`
+    /// has nowhere to carry is the spend tweak, and without it the resulting PSET input
+    /// is unsignable. Kept here so the tweak survives to `finish_inner`, where the one
+    /// annotation pass writes it into the PSET.
+    #[cfg(feature = "silentpayments")]
+    silent_payment_utxos: Vec<crate::silentpayments::SilentPaymentUtxo>,
 }
 
 impl TxBuilder {
@@ -249,6 +268,27 @@ impl TxBuilder {
             add_input_rangeproofs: true,
             is_liquidex_make: false,
             liquidex_proposals: vec![],
+            #[cfg(feature = "silentpayments")]
+            silent_payment_recipients: vec![],
+            #[cfg(feature = "silentpayments")]
+            silent_payment_utxos: vec![],
+        }
+    }
+
+    /// Refuse to build if silent payment recipients are still unresolved.
+    ///
+    /// Only exists under the feature: with it off there are no silent payment
+    /// recipients to check, so the call site is gated too rather than calling a
+    /// stub that would read as "checked, and fine" in a build where the concept
+    /// does not exist.
+    #[cfg(feature = "silentpayments")]
+    fn check_no_pending_silent_payments(&self) -> Result<(), Error> {
+        if self.silent_payment_recipients.is_empty() {
+            Ok(())
+        } else {
+            Err(Error::SilentPaymentRequiresKeys(
+                self.silent_payment_recipients.len(),
+            ))
         }
     }
 
@@ -311,6 +351,64 @@ impl TxBuilder {
         self.add_unvalidated_recipient(&rec)
     }
 
+    /// Add a silent payment recipient (BIP-352 on Liquid).
+    ///
+    /// The receiver publishes one reusable `lqsp1...` address; every payment to it
+    /// still lands on a fresh, unlinkable output, and on Liquid the same shared
+    /// secret also blinds the output so the receiver can unblind it unaided.
+    ///
+    /// Unlike every other recipient, the on-chain output cannot be computed here: it
+    /// is derived from a shared secret over the transaction's **own inputs**, which
+    /// are not known until coin selection has run. It is therefore resolved when the
+    /// transaction is finalized — and because that derivation needs the inputs'
+    /// **private** keys, which a watch-only [`Wollet`] does not hold, a transaction
+    /// with silent payment recipients must be finished with
+    /// [`TxBuilder::finish_silent_payment()`] rather than [`TxBuilder::finish()`].
+    ///
+    /// ```rust
+    /// # use lwk_wollet::{TxBuilder, Network};
+    /// # use lwk_wollet::silentpayments::SilentPaymentAddress;
+    /// # fn main() -> Result<(), lwk_wollet::Error> {
+    /// # let network = Network::TestnetLiquid;
+    /// # let sp_address = "tlqsp1qq...";
+    /// # let asset = *network.policy_asset();
+    /// # let _ = |sp_address: &str| -> Result<(), lwk_wollet::Error> {
+    /// let builder = TxBuilder::new(network)
+    ///     .add_silent_payment_recipient(sp_address, 100_000, asset)?;
+    /// # Ok(()) };
+    /// # Ok(())
+    /// # }
+    /// ```
+    #[cfg(feature = "silentpayments")]
+    #[cfg_attr(docsrs, doc(cfg(feature = "silentpayments")))]
+    pub fn add_silent_payment_recipient(
+        self,
+        address: &str,
+        satoshi: u64,
+        asset: AssetId,
+    ) -> Result<Self, Error> {
+        let address = SilentPaymentAddress::parse(address, self.network())?;
+        Ok(
+            self.add_validated_silent_payment_recipient(SilentPaymentRecipient::new(
+                address, satoshi, asset,
+            )),
+        )
+    }
+
+    /// Add an already-parsed silent payment recipient.
+    ///
+    /// See [`TxBuilder::add_silent_payment_recipient()`] for the caveats on how and
+    /// when the output is derived.
+    #[cfg(feature = "silentpayments")]
+    #[cfg_attr(docsrs, doc(cfg(feature = "silentpayments")))]
+    pub fn add_validated_silent_payment_recipient(
+        mut self,
+        recipient: SilentPaymentRecipient,
+    ) -> Self {
+        self.silent_payment_recipients.push(recipient);
+        self
+    }
+
     /// Add an `OP_RETURN` output carrying arbitrary `data`, with zero value.
     pub fn add_op_return(mut self, data: &[u8]) -> Result<Self, Error> {
         self.recipients.push(Recipient {
@@ -553,6 +651,37 @@ impl TxBuilder {
         Ok(self)
     }
 
+    /// Spend silent payment outputs that have **not** been applied to the wallet.
+    ///
+    /// Use this for outputs from [`crate::Wollet::scan_silent_payments()`] that the
+    /// caller is holding itself. Outputs passed to
+    /// [`crate::Wollet::apply_silent_payments()`] need nothing special — they are
+    /// ordinary wallet money by then, and coin selection spends them like any other
+    /// UTXO.
+    ///
+    /// # Why this exists rather than `add_external_utxos`
+    ///
+    /// [`crate::silentpayments::SilentPaymentUtxo::external_utxo()`] describes how to
+    /// *fund* with the output, and that part an [`ExternalUtxo`] carries fine. What it
+    /// has nowhere to put is the spend tweak — the one thing a signer cannot rederive,
+    /// since a silent payment output has no derivation path. Passing such an output
+    /// through `add_external_utxos` alone therefore yields a PSET whose input no signer
+    /// can complete. This method keeps the tweak attached, and the builder writes it
+    /// into the PSET as proprietary metadata for a silent-payment aware signer.
+    ///
+    /// The funding side is registered for you; do not also pass `external_utxo()` for
+    /// the same output, or it would be added twice.
+    #[cfg(feature = "silentpayments")]
+    pub fn add_silent_payment_utxos(
+        mut self,
+        utxos: Vec<crate::silentpayments::SilentPaymentUtxo>,
+    ) -> Result<Self, Error> {
+        self.external_utxos
+            .extend(utxos.iter().map(|u| u.external_utxo()));
+        self.silent_payment_utxos.extend(utxos);
+        Ok(self)
+    }
+
     /// Switch to manual coin selection by giving a list of internal UTXOs to use.
     ///
     /// All passed UTXOs are added to the transaction.
@@ -984,6 +1113,12 @@ impl TxBuilder {
     }
 
     /// Finish building the transaction
+    ///
+    /// Fails if any silent payment recipient was added: deriving those outputs needs
+    /// the funding inputs' private keys, which a watch-only wallet does not have.
+    /// Use [`TxBuilder::finish_silent_payment()`] instead. Failing loudly here is
+    /// deliberate — silently dropping the recipient would produce a transaction that
+    /// looks fine but pays nobody.
     pub fn finish(self, wollet: &Wollet) -> Result<PartiallySignedTransaction, Error> {
         let BuiltTx { pset, .. } = self.finish_inner(wollet)?;
         Ok(pset)
@@ -998,7 +1133,96 @@ impl TxBuilder {
         self.finish_inner(wollet)
     }
 
+    /// Finish building a transaction containing silent-payment recipients.
+    ///
+    /// `keys` supplies private keys for the selected inputs.
+    #[cfg(feature = "silentpayments")]
+    #[cfg_attr(docsrs, doc(cfg(feature = "silentpayments")))]
+    pub fn finish_silent_payment(
+        mut self,
+        wollet: &Wollet,
+        keys: &impl crate::silentpayments::SilentPaymentInputProvider,
+    ) -> Result<PartiallySignedTransaction, Error> {
+        use crate::silentpayments::SilentPaymentRecipient;
+
+        let pending = std::mem::take(&mut self.silent_payment_recipients);
+        if pending.is_empty() {
+            return self.finish(wollet);
+        }
+
+        let mut probe = self.clone_for_probe();
+        for r in &pending {
+            probe = probe.add_validated_recipient(Self::silent_payment_placeholder(r));
+        }
+        let probe_pset = probe.finish(wollet)?;
+
+        let outpoints: Vec<OutPoint> = probe_pset
+            .inputs()
+            .iter()
+            .map(|i| OutPoint::new(i.previous_txid, i.previous_output_index))
+            .collect();
+
+        // Preserve keyless outpoints in `outpoint_L`.
+        let mut eligible = Vec::new();
+        let mut extra = Vec::new();
+        for outpoint in &outpoints {
+            match keys.input_key(outpoint) {
+                crate::silentpayments::InputKeyResult::Eligible(key) => {
+                    eligible.push((*outpoint, key));
+                }
+                crate::silentpayments::InputKeyResult::Ineligible => extra.push(*outpoint),
+                crate::silentpayments::InputKeyResult::Missing => {
+                    return Err(crate::silentpayments::SilentPaymentInputError::MissingKey.into());
+                }
+            }
+        }
+        if eligible.is_empty() {
+            return Err(crate::silentpayments::SilentPaymentInputError::NoInputs.into());
+        }
+
+        let resolved = SilentPaymentRecipient::resolve_all(&pending, &eligible, &extra)?;
+        for r in &resolved {
+            self = self.add_validated_recipient(r.recipient.clone());
+        }
+
+        // Preserve the selected input set while rebuilding the real outputs.
+        let external: HashSet<OutPoint> = self.external_utxos.iter().map(|u| u.outpoint).collect();
+        let wallet_utxos: Vec<OutPoint> = outpoints
+            .into_iter()
+            .filter(|o| !external.contains(o))
+            .collect();
+
+        self.set_wallet_utxos(wallet_utxos).finish(wollet)
+    }
+
+    /// Creates a size-equivalent recipient for input selection.
+    #[cfg(feature = "silentpayments")]
+    fn silent_payment_placeholder(recipient: &SilentPaymentRecipient) -> Recipient {
+        Recipient {
+            satoshi: recipient.satoshi,
+            script_pubkey: Script::new_v1_p2tr_tweaked(elements::schnorr::TweakedPublicKey::new(
+                recipient.address.spend.x_only_public_key().0,
+            )),
+            blinding_pubkey: Some(recipient.address.scan),
+            asset: recipient.asset,
+        }
+    }
+
+    /// Copies the builder for the input-selection probe.
+    #[cfg(feature = "silentpayments")]
+    fn clone_for_probe(&self) -> Self {
+        let mut probe = self.clone();
+        probe.silent_payment_recipients.clear();
+        probe
+    }
+
     fn finish_inner(self, wollet: &Wollet) -> Result<BuiltTx, Error> {
+        // Guard first: an unresolved silent payment recipient must never be silently
+        // dropped from the transaction, which would yield a plausible-looking PSET
+        // that pays nobody.
+        #[cfg(feature = "silentpayments")]
+        self.check_no_pending_silent_payments()?;
+
         if self.is_liquidex_make {
             if self.inputs_order.is_some() {
                 return Err(Error::LiquidexUnsupportedWithInputsOrder);
@@ -1532,6 +1756,24 @@ impl TxBuilder {
         // Add details to the pset from our descriptor, like bip32derivation and keyorigin
         wollet.add_details(&mut built_tx.pset)?;
 
+        // The same step for inputs the descriptor cannot describe. A silent payment
+        // output has no derivation path, so `add_details` above passes over it and a
+        // signer would meet an input it cannot recognize; this attaches the tweak that
+        // stands in for the missing `bip32_derivation`.
+        //
+        // One pass over the finished PSET, after every input has been added by whatever
+        // route — coin selection, pinned ordering, or the reissuance token path — so no
+        // route can be forgotten. Gated at the call site rather than behind a stub: with
+        // the feature off no input can be a silent payment, and a call here would read
+        // as a check that passed rather than a concept that does not exist.
+        #[cfg(feature = "silentpayments")]
+        if let Some(annotator) = crate::silentpayments::SilentPaymentPsetAnnotator::for_builder(
+            wollet,
+            &self.silent_payment_utxos,
+        )? {
+            annotator.annotate(&mut built_tx.pset)?;
+        }
+
         Ok(built_tx)
     }
 }
@@ -1653,6 +1895,10 @@ impl BuiltTx {
             tip: crate::update::default_blockheader(),
             unspent: vec![],
             last_unused: crate::wollet::WolletState::last_unused(wollet),
+            // Persisting a blinder is not a chain scan, so it claims no discovery
+            // progress.
+            #[cfg(feature = "silentpayments")]
+            silent_payments: None,
         };
         Ok(update)
     }
@@ -1694,6 +1940,60 @@ impl<'a> WolletTxBuilder<'a> {
         self.inner.build(self.wollet)
     }
 
+    /// Wrapper of [`TxBuilder::finish_silent_payment()`]
+    ///
+    /// Use this instead of [`WolletTxBuilder::finish()`] whenever a silent payment
+    /// recipient was added: the derivation needs the funding inputs' private keys,
+    /// which `keys` supplies.
+    #[cfg(feature = "silentpayments")]
+    #[cfg_attr(docsrs, doc(cfg(feature = "silentpayments")))]
+    pub fn finish_silent_payment(
+        self,
+        keys: &impl crate::silentpayments::SilentPaymentInputProvider,
+    ) -> Result<PartiallySignedTransaction, Error> {
+        self.inner.finish_silent_payment(self.wollet, keys)
+    }
+
+    /// Wrapper of [`TxBuilder::add_silent_payment_recipient()`]
+    #[cfg(feature = "silentpayments")]
+    #[cfg_attr(docsrs, doc(cfg(feature = "silentpayments")))]
+    pub fn add_silent_payment_recipient(
+        self,
+        address: &str,
+        satoshi: u64,
+        asset: AssetId,
+    ) -> Result<Self, Error> {
+        Ok(Self {
+            wollet: self.wollet,
+            inner: self
+                .inner
+                .add_silent_payment_recipient(address, satoshi, asset)?,
+        })
+    }
+
+    /// Wrapper of [`TxBuilder::add_silent_payment_utxos()`]
+    #[cfg(feature = "silentpayments")]
+    #[cfg_attr(docsrs, doc(cfg(feature = "silentpayments")))]
+    pub fn add_silent_payment_utxos(
+        self,
+        utxos: Vec<crate::silentpayments::SilentPaymentUtxo>,
+    ) -> Result<Self, Error> {
+        Ok(Self {
+            wollet: self.wollet,
+            inner: self.inner.add_silent_payment_utxos(utxos)?,
+        })
+    }
+
+    /// Wrapper of [`TxBuilder::add_validated_silent_payment_recipient()`]
+    #[cfg(feature = "silentpayments")]
+    #[cfg_attr(docsrs, doc(cfg(feature = "silentpayments")))]
+    pub fn add_validated_silent_payment_recipient(self, recipient: SilentPaymentRecipient) -> Self {
+        Self {
+            wollet: self.wollet,
+            inner: self.inner.add_validated_silent_payment_recipient(recipient),
+        }
+    }
+
     /// Wrapper of [`TxBuilder::add_recipient()`]
     pub fn add_recipient(
         self,
@@ -1942,6 +2242,137 @@ mod tests {
         clients::LastUnused, update::default_blockheader, DownloadTxResult, WolletBuilder,
     };
 
+    /// The probe placeholder must have the EXACT on-chain footprint of the real
+    /// silent payment output it stands in for.
+    ///
+    /// This underpins the two-pass build: pass 1 measures weight and picks coins
+    /// using placeholders, pass 2 swaps in the derived outputs. If the two differed
+    /// in size, the final transaction could come out underfunded or overpay fees,
+    /// and the pinned coin selection could no longer cover it.
+    #[cfg(feature = "silentpayments")]
+    #[test]
+    fn silent_payment_placeholder_matches_real_output_size() {
+        use crate::silentpayments::{
+            InputKey, SilentPaymentRecipient, SilentPaymentScan, SilentPaymentScanMaterial,
+            SilentPaymentSender,
+        };
+        use elements::secp256k1_zkp::SecretKey;
+
+        let sk = |b: u8| SecretKey::from_slice(&[b; 32]).unwrap();
+        let keys = SilentPaymentScanMaterial::new(
+            crate::silentpayments::SilentPaymentAccount::liquid_testnet(0),
+            sk(0x11),
+            sk(0x22).public_key(&crate::util::EC),
+        );
+        let asset = AssetId::from_slice(&[0x42u8; 32]).unwrap();
+        let recipient = SilentPaymentRecipient::new(keys.address(), 50_000, asset);
+
+        let placeholder = TxBuilder::silent_payment_placeholder(&recipient);
+
+        // The real output, derived from concrete inputs.
+        let outpoint = OutPoint::new(elements::Txid::from_byte_array([0x10; 32]), 0);
+        let sender =
+            SilentPaymentSender::from_input_keys(&[(outpoint, InputKey::Plain(sk(0x31)))], &[])
+                .unwrap();
+        let real = sender.derive_output(&keys.address(), 0);
+
+        assert_eq!(
+            placeholder.script_pubkey.len(),
+            real.script_pubkey().len(),
+            "placeholder scriptPubKey must be the same size as the real one"
+        );
+        assert!(
+            placeholder.script_pubkey.is_v1_p2tr(),
+            "placeholder must be a v1 taproot program, like the real output"
+        );
+        // Both confidential: a placeholder without a blinding key would make pass 1
+        // measure an explicit output and underestimate the weight.
+        assert!(placeholder.blinding_pubkey.is_some());
+        assert_eq!(placeholder.satoshi, 50_000);
+        assert_eq!(placeholder.asset, asset);
+
+        // It must NOT be mistaken for the real output: the placeholder is a stand-in
+        // and must always be replaced before the PSET is returned.
+        assert_ne!(placeholder.script_pubkey, real.script_pubkey());
+    }
+
+    /// `clone_for_probe` must carry every builder setting across, or pass 1 would
+    /// measure a different transaction than pass 2 builds — while dropping the
+    /// silent payment recipients, which the probe replaces with placeholders.
+    #[cfg(feature = "silentpayments")]
+    #[test]
+    fn probe_preserves_settings_but_drops_silent_payments() {
+        use crate::silentpayments::{
+            SilentPaymentRecipient, SilentPaymentScan, SilentPaymentScanMaterial,
+        };
+        use elements::secp256k1_zkp::SecretKey;
+
+        let keys = SilentPaymentScanMaterial::new(
+            crate::silentpayments::SilentPaymentAccount::liquid_testnet(0),
+            SecretKey::from_slice(&[0x11; 32]).unwrap(),
+            SecretKey::from_slice(&[0x22; 32])
+                .unwrap()
+                .public_key(&crate::util::EC),
+        );
+        let asset = AssetId::from_slice(&[0x42u8; 32]).unwrap();
+
+        let builder = TxBuilder::new(Network::default_regtest())
+            .fee_rate(Some(250.0))
+            .add_validated_silent_payment_recipient(SilentPaymentRecipient::new(
+                keys.address(),
+                1_000,
+                asset,
+            ));
+
+        let probe = builder.clone_for_probe();
+
+        assert!(
+            probe.silent_payment_recipients.is_empty(),
+            "probe must not carry unresolved silent payments"
+        );
+        // Settings that affect weight/fee must survive.
+        assert_eq!(probe.fee_rate, builder.fee_rate);
+        assert_eq!(probe.ct_discount, builder.ct_discount);
+        assert_eq!(probe.network, builder.network);
+    }
+
+    /// Finishing normally with a pending silent payment must FAIL, not silently drop
+    /// it. A dropped recipient would yield a perfectly valid transaction that simply
+    /// never pays the intended party.
+    #[cfg(feature = "silentpayments")]
+    #[test]
+    fn plain_finish_refuses_pending_silent_payments() {
+        use crate::silentpayments::{
+            SilentPaymentRecipient, SilentPaymentScan, SilentPaymentScanMaterial,
+        };
+        use elements::secp256k1_zkp::SecretKey;
+
+        let keys = SilentPaymentScanMaterial::new(
+            crate::silentpayments::SilentPaymentAccount::liquid_testnet(0),
+            SecretKey::from_slice(&[0x11; 32]).unwrap(),
+            SecretKey::from_slice(&[0x22; 32])
+                .unwrap()
+                .public_key(&crate::util::EC),
+        );
+        let asset = AssetId::from_slice(&[0x42u8; 32]).unwrap();
+
+        let builder = TxBuilder::new(Network::default_regtest());
+        assert!(
+            builder.check_no_pending_silent_payments().is_ok(),
+            "a builder with no silent payments must be unaffected"
+        );
+
+        let builder = builder.add_validated_silent_payment_recipient(SilentPaymentRecipient::new(
+            keys.address(),
+            1_000,
+            asset,
+        ));
+        assert!(matches!(
+            builder.check_no_pending_silent_payments(),
+            Err(Error::SilentPaymentRequiresKeys(1))
+        ));
+    }
+
     #[test]
     fn test_extract_issuances() {
         let tx_bytes = include_bytes!(
@@ -2012,6 +2443,8 @@ mod tests {
                     external: 7,
                     internal: 11,
                 },
+                #[cfg(feature = "silentpayments")]
+                silent_payments: None,
             })
             .unwrap();
 
diff --git a/lwk_wollet/src/update.rs b/lwk_wollet/src/update.rs
index 5bf864e83..1ac4a639b 100644
--- a/lwk_wollet/src/update.rs
+++ b/lwk_wollet/src/update.rs
@@ -220,6 +220,24 @@ pub struct Update {
     /// This lets wallet restore advance address indexes without reloading transactions from the
     /// tx store just to recompute them.
     pub last_unused: LastUnused,
+
+    /// Silent-payment discoveries and discovery progress from this scan.
+    ///
+    /// `None` means discovery did not run; an empty `found` list records a completed
+    /// scan with no matching outputs.
+    #[cfg(feature = "silentpayments")]
+    pub silent_payments: Option<SilentPaymentsUpdate>,
+}
+
+/// What a silent payment scan contributes to an [`Update`].
+#[cfg(feature = "silentpayments")]
+#[derive(Clone, PartialEq, Eq, Debug, Default)]
+pub struct SilentPaymentsUpdate {
+    /// Discovered outputs with their unblinded secrets and spend tweaks.
+    pub found: Vec<(crate::silentpayments::SilentPaymentCacheEntry, TxOutSecrets)>,
+
+    /// Height through which discovery ran, including scans with no matches.
+    pub scanned_to: Height,
 }
 
 impl Update {
@@ -360,6 +378,28 @@ impl Update {
         // Update unspent to latest
         self.unspent = following.unspent;
 
+        // Silent payment discovery accumulates: the outputs found by each update are
+        // disjoint findings, and the scanned-to height only ever moves forward. Taking
+        // `following` wholesale (as `unspent` does) would discard everything the earlier
+        // update discovered, and a merged update is what a restore replays — so the loss
+        // would be permanent, not just in memory.
+        #[cfg(feature = "silentpayments")]
+        {
+            self.silent_payments = match (self.silent_payments.take(), following.silent_payments) {
+                (Some(mut a), Some(b)) => {
+                    a.found.extend(b.found);
+                    a.scanned_to = a.scanned_to.max(b.scanned_to);
+                    Some(a)
+                }
+                (a, b) => a.or(b),
+            };
+            // A merged update that carries discovery must be readable as one, even if
+            // `following` was an older-version update that did not.
+            if self.silent_payments.is_some() {
+                self.version = self.version.max(6);
+            }
+        }
+
         self.last_unused.external = self
             .last_unused
             .external
@@ -470,6 +510,10 @@ impl Wollet {
             tip: default_blockheader(),
             unspent,
             last_unused: self.last_unused(),
+            // Applying a single transaction locally is not a chain scan, so it makes no
+            // claim about silent payment discovery progress.
+            #[cfg(feature = "silentpayments")]
+            silent_payments: None,
         };
 
         self.apply_update_inner(update.clone())?;
@@ -531,6 +575,8 @@ impl Wollet {
             tip,
             unspent,
             last_unused,
+            #[cfg(feature = "silentpayments")]
+            silent_payments,
         } = update;
 
         let scripts_with_blinding_pubkey =
@@ -624,6 +670,23 @@ impl Wollet {
             }
         }
 
+        // Applied after `cache.update()` above, which inserts the scan's transactions:
+        // a silent payment output needs its containing transaction present to have a
+        // confirmation height and spent/unspent bookkeeping to hang off.
+        #[cfg(feature = "silentpayments")]
+        if let Some(sp) = silent_payments {
+            for (entry, unblinded) in sp.found {
+                cache.insert_silent_payment(entry, unblinded);
+            }
+            // `fetch_max` in spirit: updates can be applied out of order (and merged
+            // updates replay old ones), so discovery progress must never move backwards.
+            let scanned_to = match cache.silent_payments_scanned_to {
+                Some(current) => current.max(sp.scanned_to),
+                None => sp.scanned_to,
+            };
+            cache.silent_payments_scanned_to = Some(scanned_to);
+        }
+
         Ok(())
     }
 
@@ -894,10 +957,113 @@ impl Encodable for Update {
             bytes_written += self.last_unused.internal.consensus_encode(&mut w)?;
         }
 
+        // A leading flag byte rather than a bare list, so "discovery never ran" stays
+        // distinguishable from "discovery ran and found nothing" — an empty list would
+        // conflate them and lose the scanned-to height.
+        #[cfg(feature = "silentpayments")]
+        if self.version >= 6 {
+            match self.silent_payments.as_ref() {
+                None => bytes_written += 0u8.consensus_encode(&mut w)?,
+                Some(sp) => {
+                    bytes_written += 1u8.consensus_encode(&mut w)?;
+                    bytes_written += sp.scanned_to.consensus_encode(&mut w)?;
+                    bytes_written +=
+                        elements::encode::VarInt(sp.found.len() as u64).consensus_encode(&mut w)?;
+                    for (entry, unblinded) in sp.found.iter() {
+                        bytes_written += entry.outpoint.consensus_encode(&mut w)?;
+                        bytes_written += entry.script_pubkey.consensus_encode(&mut w)?;
+                        bytes_written += entry.k.consensus_encode(&mut w)?;
+                        // u32::MAX is not a valid BIP-352 label (labels are small
+                        // counters), so it can stand in for "no label" without a
+                        // second byte.
+                        bytes_written +=
+                            entry.label.unwrap_or(u32::MAX).consensus_encode(&mut w)?;
+                        bytes_written +=
+                            entry.spend_tweak.to_be_bytes().consensus_encode(&mut w)?;
+                        bytes_written +=
+                            entry.blinding_pubkey.serialize().consensus_encode(&mut w)?;
+                        bytes_written += unblinded.asset.consensus_encode(&mut w)?;
+                        bytes_written += unblinded.value.consensus_encode(&mut w)?;
+                        bytes_written +=
+                            unblinded.asset_bf.into_inner().consensus_encode(&mut w)?;
+                        bytes_written +=
+                            unblinded.value_bf.into_inner().consensus_encode(&mut w)?;
+                    }
+                }
+            }
+        }
+
         Ok(bytes_written)
     }
 }
 
+impl Update {
+    /// Decode the v6 silent payments section written by [`Update::consensus_encode()`].
+    ///
+    /// Kept apart from the main decoder so the version-gated block there stays one line;
+    /// the field-by-field reads below are only meaningful as the exact mirror of the
+    /// encoder, and interleaving them with the rest of the format obscures both.
+    #[cfg(feature = "silentpayments")]
+    fn decode_silent_payments<D: std::io::Read>(
+        mut d: D,
+    ) -> Result<Option<SilentPaymentsUpdate>, elements::encode::Error> {
+        use crate::elements::confidential::{AssetBlindingFactor, ValueBlindingFactor};
+        use crate::elements::{AssetId, OutPoint, Script, TxOutSecrets};
+        use crate::secp256k1::PublicKey;
+        use crate::silentpayments::SpendTweak;
+
+        let present = u8::consensus_decode(&mut d)?;
+        if present == 0 {
+            return Ok(None);
+        }
+
+        let scanned_to = Height::consensus_decode(&mut d)?;
+        let len = elements::encode::VarInt::consensus_decode(&mut d)?.0;
+        let mut found = Vec::with_capacity(len as usize);
+        for _ in 0..len {
+            let outpoint = OutPoint::consensus_decode(&mut d)?;
+            let script_pubkey = Script::consensus_decode(&mut d)?;
+            let k = u32::consensus_decode(&mut d)?;
+            let label = match u32::consensus_decode(&mut d)? {
+                u32::MAX => None,
+                l => Some(l),
+            };
+
+            let tweak_bytes: [u8; 32] = Decodable::consensus_decode(&mut d)?;
+            let spend_tweak = SpendTweak::from_be_bytes(tweak_bytes).ok_or(
+                elements::encode::Error::ParseFailed("invalid SP spend tweak"),
+            )?;
+
+            let blinding_bytes: [u8; 33] = Decodable::consensus_decode(&mut d)?;
+            let blinding_pubkey = PublicKey::from_slice(&blinding_bytes)
+                .map_err(|_| elements::encode::Error::ParseFailed("invalid SP blinding pubkey"))?;
+
+            let asset = AssetId::consensus_decode(&mut d)?;
+            let value = u64::consensus_decode(&mut d)?;
+            let asset_bf_bytes: [u8; 32] = Decodable::consensus_decode(&mut d)?;
+            let value_bf_bytes: [u8; 32] = Decodable::consensus_decode(&mut d)?;
+            let asset_bf = AssetBlindingFactor::from_slice(&asset_bf_bytes)
+                .map_err(|_| elements::encode::Error::ParseFailed("invalid SP asset bf"))?;
+            let value_bf = ValueBlindingFactor::from_slice(&value_bf_bytes)
+                .map_err(|_| elements::encode::Error::ParseFailed("invalid SP value bf"))?;
+
+            found.push((
+                crate::silentpayments::SilentPaymentCacheEntry {
+                    outpoint,
+                    script_pubkey,
+                    k,
+                    label,
+                    spend_tweak,
+                    blinding_pubkey,
+                },
+                TxOutSecrets::new(asset, asset_bf, value, value_bf),
+            ));
+        }
+
+        Ok(Some(SilentPaymentsUpdate { found, scanned_to }))
+    }
+}
+
 impl Decodable for Update {
     fn consensus_decode<D: std::io::Read>(mut d: D) -> Result<Self, elements::encode::Error> {
         let magic_bytes: [u8; 4] = Decodable::consensus_decode(&mut d)?;
@@ -906,7 +1072,7 @@ impl Decodable for Update {
         }
 
         let version = u8::consensus_decode(&mut d)?;
-        if version > 5 {
+        if version > 6 {
             return Err(elements::encode::Error::ParseFailed("Unsupported version"));
         }
         let wollet_status = if version >= 1 {
@@ -1005,6 +1171,13 @@ impl Decodable for Update {
             LastUnused::default()
         };
 
+        #[cfg(feature = "silentpayments")]
+        let silent_payments = if version >= 6 {
+            Self::decode_silent_payments(&mut d)?
+        } else {
+            None
+        };
+
         Ok(Self {
             version,
             wollet_status,
@@ -1016,6 +1189,8 @@ impl Decodable for Update {
             tip,
             unspent,
             last_unused,
+            #[cfg(feature = "silentpayments")]
+            silent_payments,
         })
     }
 }
@@ -1064,6 +1239,8 @@ mod test {
             wollet_status: 1,
             unspent: Default::default(),
             last_unused: Default::default(),
+            #[cfg(feature = "silentpayments")]
+            silent_payments: None,
         };
         assert!(update.only_tip());
         update
@@ -1120,6 +1297,8 @@ mod test {
             wollet_status: 1,
             unspent: vec![],
             last_unused: Default::default(),
+            #[cfg(feature = "silentpayments")]
+            silent_payments: None,
         };
 
         let mut vec = vec![];
@@ -1158,6 +1337,8 @@ mod test {
                 external: 7,
                 internal: 11,
             },
+            #[cfg(feature = "silentpayments")]
+            silent_payments: None,
         };
 
         let mut vec = vec![];
@@ -1188,6 +1369,181 @@ mod test {
         assert_eq!(upd_from_v0, upd_from_v1);
     }
 
+    /// A v6 update must survive the wire intact — including the tweak, which is the one
+    /// field that cannot be recovered from anywhere else if it is lost or corrupted.
+    #[cfg(feature = "silentpayments")]
+    #[test]
+    fn silent_payments_survive_a_serialization_roundtrip() {
+        use super::SilentPaymentsUpdate;
+        use crate::elements::secp256k1_zkp::{PublicKey, SecretKey};
+        use crate::elements::OutPoint;
+        use crate::silentpayments::{SilentPaymentCacheEntry, SpendTweak};
+
+        let tweak = SpendTweak::from_be_bytes([0x42; 32]).unwrap();
+        let entry = SilentPaymentCacheEntry {
+            outpoint: OutPoint::new(lwk_test_util::txid_test_vector(), 3),
+            script_pubkey: Script::from(vec![0x51, 0x20, 0xab]),
+            k: 2,
+            label: Some(7),
+            spend_tweak: tweak,
+            blinding_pubkey: PublicKey::from_secret_key_global(
+                &SecretKey::from_slice(&[0x24; 32]).unwrap(),
+            ),
+        };
+        let secrets = lwk_test_util::tx_out_secrets_test_vector();
+
+        let tip = lwk_test_util::liquid_block_1().header;
+        let update = Update {
+            version: 6,
+            wollet_status: 1,
+            new_txs: DownloadTxResult::default(),
+            txid_height_new: vec![],
+            txid_height_delete: vec![],
+            timestamps: vec![],
+            scripts_with_blinding_pubkey: vec![],
+            tip,
+            unspent: vec![],
+            last_unused: Default::default(),
+            silent_payments: Some(SilentPaymentsUpdate {
+                found: vec![(entry.clone(), secrets)],
+                scanned_to: 900_123,
+            }),
+        };
+
+        let back = Update::deserialize(&update.serialize().unwrap()).unwrap();
+        assert_eq!(update, back);
+
+        let sp = back.silent_payments.unwrap();
+        assert_eq!(sp.scanned_to, 900_123);
+        assert_eq!(sp.found[0].0, entry);
+        // The tweak is what lets a signer spend the output; a silent corruption here
+        // would surface only when the user tried to spend.
+        assert_eq!(sp.found[0].0.spend_tweak, tweak);
+    }
+
+    /// "Discovery ran and found nothing" must not decay into "discovery never ran" — the
+    /// former carries a scanned-to height, and losing it would make every scan restart
+    /// from genesis.
+    #[cfg(feature = "silentpayments")]
+    #[test]
+    fn an_empty_scan_still_records_its_progress() {
+        use super::SilentPaymentsUpdate;
+        let tip = lwk_test_util::liquid_block_1().header;
+        let update = Update {
+            version: 6,
+            wollet_status: 1,
+            new_txs: DownloadTxResult::default(),
+            txid_height_new: vec![],
+            txid_height_delete: vec![],
+            timestamps: vec![],
+            scripts_with_blinding_pubkey: vec![],
+            tip,
+            unspent: vec![],
+            last_unused: Default::default(),
+            silent_payments: Some(SilentPaymentsUpdate {
+                found: vec![],
+                scanned_to: 555,
+            }),
+        };
+
+        let back = Update::deserialize(&update.serialize().unwrap()).unwrap();
+        let sp = back
+            .silent_payments
+            .expect("an empty scan is still a scan, and must not decode as `None`");
+        assert!(sp.found.is_empty());
+        assert_eq!(sp.scanned_to, 555);
+    }
+
+    /// Merging must accumulate discoveries. A merged update is what a restore replays, so
+    /// dropping the earlier update's findings would lose them permanently.
+    #[cfg(feature = "silentpayments")]
+    #[test]
+    fn merge_accumulates_silent_payments_and_advances_progress() {
+        use super::SilentPaymentsUpdate;
+        let tip = lwk_test_util::liquid_block_1().header;
+        let base = |scanned_to| Update {
+            version: 6,
+            wollet_status: 1,
+            new_txs: DownloadTxResult::default(),
+            txid_height_new: vec![],
+            txid_height_delete: vec![],
+            timestamps: vec![],
+            scripts_with_blinding_pubkey: vec![],
+            tip: tip.clone(),
+            unspent: vec![],
+            last_unused: Default::default(),
+            silent_payments: Some(SilentPaymentsUpdate {
+                found: vec![],
+                scanned_to,
+            }),
+        };
+
+        let mut first = base(100);
+        first.merge(base(200));
+        let sp = first.silent_payments.unwrap();
+        assert_eq!(sp.scanned_to, 200, "progress must move forward");
+
+        // Out-of-order merge: progress must never go backwards.
+        let mut later = base(200);
+        later.merge(base(100));
+        assert_eq!(later.silent_payments.unwrap().scanned_to, 200);
+    }
+
+    /// A v4 update merged into a v6 one must not erase the v6 discovery, and the result
+    /// must still identify as v6 so the trailing section is read back.
+    #[cfg(feature = "silentpayments")]
+    #[test]
+    fn merging_an_older_update_preserves_discovery() {
+        use super::SilentPaymentsUpdate;
+        let tip = lwk_test_util::liquid_block_1().header;
+        let mut with_sp = Update {
+            version: 6,
+            wollet_status: 1,
+            new_txs: DownloadTxResult::default(),
+            txid_height_new: vec![],
+            txid_height_delete: vec![],
+            timestamps: vec![],
+            scripts_with_blinding_pubkey: vec![],
+            tip: tip.clone(),
+            unspent: vec![],
+            last_unused: Default::default(),
+            silent_payments: Some(SilentPaymentsUpdate {
+                found: vec![],
+                scanned_to: 42,
+            }),
+        };
+
+        let plain_v4 = Update {
+            version: 4,
+            wollet_status: 1,
+            new_txs: DownloadTxResult::default(),
+            txid_height_new: vec![],
+            txid_height_delete: vec![],
+            timestamps: vec![],
+            scripts_with_blinding_pubkey: vec![],
+            tip,
+            unspent: vec![],
+            last_unused: Default::default(),
+            silent_payments: None,
+        };
+
+        with_sp.merge(plain_v4);
+
+        assert_eq!(
+            with_sp.silent_payments.as_ref().unwrap().scanned_to,
+            42,
+            "a later update without discovery must not erase earlier discovery"
+        );
+        assert_eq!(
+            with_sp.version, 6,
+            "the merged update still carries a silent payments section"
+        );
+
+        // And it must survive the wire, which is the situation that actually loses data.
+        let back = Update::deserialize(&with_sp.serialize().unwrap()).unwrap();
+        assert_eq!(back.silent_payments.unwrap().scanned_to, 42);
+    }
+
     #[test]
     fn test_merge_keeps_max_last_unused() {
         let tip = lwk_test_util::liquid_block_1().header;
@@ -1205,6 +1561,8 @@ mod test {
                 external: 2,
                 internal: 8,
             },
+            #[cfg(feature = "silentpayments")]
+            silent_payments: None,
         };
 
         let following_tip = lwk_test_util::liquid_block_header_2_963_520();
@@ -1222,6 +1580,8 @@ mod test {
                 external: 7,
                 internal: 3,
             },
+            #[cfg(feature = "silentpayments")]
+            silent_payments: None,
         };
 
         update.merge(following);
@@ -1249,6 +1609,8 @@ mod test {
             tip: super::default_blockheader(),
             unspent: vec![],
             last_unused: LastUnused::default(),
+            #[cfg(feature = "silentpayments")]
+            silent_payments: None,
         };
 
         let following = Update {
@@ -1265,6 +1627,8 @@ mod test {
                 external: 7,
                 internal: 11,
             },
+            #[cfg(feature = "silentpayments")]
+            silent_payments: None,
         };
 
         update.merge(following);
@@ -1298,6 +1662,8 @@ mod test {
                     external: 7,
                     internal: 11,
                 },
+                #[cfg(feature = "silentpayments")]
+                silent_payments: None,
             })
             .unwrap();
 
@@ -1318,6 +1684,8 @@ mod test {
                     external: 3,
                     internal: 5,
                 },
+                #[cfg(feature = "silentpayments")]
+                silent_payments: None,
             })
             .unwrap();
 
diff --git a/lwk_wollet/src/wollet.rs b/lwk_wollet/src/wollet.rs
index 8ba8610aa..9cb88b3eb 100644
--- a/lwk_wollet/src/wollet.rs
+++ b/lwk_wollet/src/wollet.rs
@@ -53,6 +53,19 @@ pub struct Wollet {
     /// cached value
     max_weight_to_satisfy: usize,
     utxo_only: bool,
+
+    /// Silent-payment scan-only material.
+    #[cfg(feature = "silentpayments")]
+    pub(crate) silent_payment_material: Option<crate::silentpayments::SilentPaymentScanMaterial>,
+
+    /// Where discovery starts when it has never run. See
+    /// [`WolletBuilder::with_silent_payment_birthday()`].
+    ///
+    /// Not persisted: it describes how to *begin* scanning, and once a scan has run the
+    /// recorded progress supersedes it. Persisting it would create two sources of truth
+    /// for the resume point.
+    #[cfg(feature = "silentpayments")]
+    pub(crate) silent_payment_birthday: Option<Height>,
 }
 
 /// A builder for constructing [`Wollet`] instances
@@ -68,6 +81,10 @@ pub struct WolletBuilder {
     txs_store: Arc<dyn DynStore>,
     encrypt_txs_store: Option<bool>,
     utxo_only: bool,
+    #[cfg(feature = "silentpayments")]
+    silent_payment_material: Option<crate::silentpayments::SilentPaymentScanMaterial>,
+    #[cfg(feature = "silentpayments")]
+    silent_payment_birthday: Option<Height>,
 }
 
 impl WolletBuilder {
@@ -83,9 +100,30 @@ impl WolletBuilder {
             encrypt_txs_store: None,
             merge_threshold: None,
             utxo_only: false,
+            #[cfg(feature = "silentpayments")]
+            silent_payment_material: None,
+            #[cfg(feature = "silentpayments")]
+            silent_payment_birthday: None,
         }
     }
 
+    /// Sets scan-only material for receiving silent payments.
+    #[cfg(feature = "silentpayments")]
+    pub fn with_silent_payment_material(
+        mut self,
+        material: crate::silentpayments::SilentPaymentScanMaterial,
+    ) -> Self {
+        self.silent_payment_material = Some(material);
+        self
+    }
+
+    /// Sets the first block used for silent-payment discovery.
+    #[cfg(feature = "silentpayments")]
+    pub fn with_silent_payment_birthday(mut self, height: Height) -> Self {
+        self.silent_payment_birthday = Some(height);
+        self
+    }
+
     /// Set all key-value stores for peristence
     ///
     /// **Experimental**: this API might change without notice.
@@ -245,6 +283,10 @@ impl WolletBuilder {
             updates_persister,
             max_weight_to_satisfy,
             utxo_only: self.utxo_only,
+            #[cfg(feature = "silentpayments")]
+            silent_payment_material: self.silent_payment_material,
+            #[cfg(feature = "silentpayments")]
+            silent_payment_birthday: self.silent_payment_birthday,
         };
 
         wollet.restore_updates()?;
@@ -282,6 +324,52 @@ pub trait WolletState {
     fn descriptor(&self) -> WolletDescriptor;
     fn wollet_status(&self) -> u64;
     fn utxo_only(&self) -> bool;
+
+    /// The silent payment scan-only material, if this wallet has any.
+    ///
+    /// A scan needs this to discover silent payments, and it cannot be recovered
+    /// from the descriptor — detection requires `b_scan`, which a CT descriptor cannot
+    /// express. `None` means the wallet can send silent payments but not receive them,
+    /// and a scan skips discovery entirely.
+    #[cfg(feature = "silentpayments")]
+    fn silent_payment_material(&self) -> Option<&crate::silentpayments::SilentPaymentScanMaterial> {
+        None
+    }
+
+    /// The height through which silent payments have already been discovered.
+    ///
+    /// Discovery cannot resume from the descriptor-scan tip: the two advance
+    /// independently, and a silent payment scan that restarted from the wallet tip after
+    /// every restart would re-download every block in between.
+    #[cfg(feature = "silentpayments")]
+    fn silent_payments_scanned_to(&self) -> Option<Height> {
+        None
+    }
+
+    /// The height at which discovery should begin when it has never run.
+    ///
+    /// See [`WolletBuilder::with_silent_payment_birthday()`]. `None` means genesis,
+    /// which is correct but only affordable on a short chain.
+    #[cfg(feature = "silentpayments")]
+    fn silent_payment_birthday(&self) -> Option<Height> {
+        None
+    }
+
+    /// The first height a scan must examine: one past whatever discovery already
+    /// covered, or the birthday if it has never run.
+    ///
+    /// Provided by the trait so every backend resolves this the same way. Getting it
+    /// wrong in either direction is costly — too low re-downloads the chain, too high
+    /// silently skips payments — so it is defined once rather than at each call site.
+    #[cfg(feature = "silentpayments")]
+    fn silent_payments_scan_from(&self) -> Height {
+        match self.silent_payments_scanned_to() {
+            // Recorded progress always wins: it is a fact about what was scanned,
+            // whereas the birthday is only a hint about where to start.
+            Some(scanned_to) => scanned_to.saturating_add(1),
+            None => self.silent_payment_birthday().unwrap_or(0),
+        }
+    }
 }
 
 impl WolletState for WolletConciseState {
@@ -430,6 +518,21 @@ impl WolletState for Wollet {
     fn utxo_only(&self) -> bool {
         self.utxo_only
     }
+
+    #[cfg(feature = "silentpayments")]
+    fn silent_payment_material(&self) -> Option<&crate::silentpayments::SilentPaymentScanMaterial> {
+        self.silent_payment_material.as_ref()
+    }
+
+    #[cfg(feature = "silentpayments")]
+    fn silent_payments_scanned_to(&self) -> Option<Height> {
+        self.cache.silent_payments_scanned_to
+    }
+
+    #[cfg(feature = "silentpayments")]
+    fn silent_payment_birthday(&self) -> Option<Height> {
+        self.silent_payment_birthday
+    }
 }
 
 impl std::hash::Hash for Wollet {
@@ -437,6 +540,49 @@ impl std::hash::Hash for Wollet {
         self.network.hash(state);
         self.cache.hash(state);
         self.descriptor.hash(state);
+        #[cfg(feature = "silentpayments")]
+        self.hash_silent_payment_identity(state);
+    }
+}
+
+/// The silent-payment half of a wallet's persistence identity.
+///
+/// Only compiled with the feature: without it a wallet has no scan material, so
+/// there is nothing to contribute and no call site to gate.
+#[cfg(feature = "silentpayments")]
+impl Wollet {
+    /// Domain tag for the silent-payment section of [`Wollet::status()`].
+    ///
+    /// Version for the silent-payment identity hash.
+    const STATUS_DOMAIN: &'static [u8] = b"lwk/silentpayments/status/v1";
+
+    /// Mix this wallet's silent-payment identity into its `status()` hash.
+    ///
+    /// Hashes the presence and identity of scan material.
+    ///
+    /// The layout is `domain tag ‖ present flag ‖ coin_type ‖ account ‖ B_scan ‖ B_spend`.
+    ///
+    /// The section is omitted when no material exists, preserving the legacy hash.
+    /// Account coordinates and both public points identify the material; the secret
+    /// scan key is never hashed.
+    fn hash_silent_payment_identity<H: std::hash::Hasher>(&self, state: &mut H) {
+        use std::hash::Hash;
+
+        match self.silent_payment_material.as_ref() {
+            None => {}
+            Some(material) => {
+                Self::STATUS_DOMAIN.hash(state);
+                true.hash(state);
+                let account = material.account();
+                account.coin_type().hash(state);
+                account.account().hash(state);
+                material
+                    .scan_pubkey(&crate::util::EC)
+                    .serialize()
+                    .hash(state);
+                material.spend_pubkey().serialize().hash(state);
+            }
+        }
     }
 }
 
@@ -643,6 +789,15 @@ impl Wollet {
                 continue;
             }
             let height = self.cache.tx_height(&outpoint.txid).unwrap_or(&None);
+
+            // A silent payment output has no derivation path, so it cannot go through
+            // `index()`; it is described by its cache entry instead.
+            #[cfg(feature = "silentpayments")]
+            if let Some(entry) = self.cache.silent_payment(script_pubkey) {
+                utxos.push(self.silent_payment_wallet_txout(entry, unblinded, *height)?);
+                continue;
+            }
+
             let index = self
                 .index(script_pubkey)
                 .ok()
@@ -696,6 +851,21 @@ impl Wollet {
                 })
                 .filter_map(|(outpoint, output, is_spent)| {
                     let unblinded = *self.cache.get_unblinded(&outpoint)?;
+
+                    // Silent payment outputs are described by their cache entry, not by a
+                    // derivation path. They must appear here too, not just in `utxos()`:
+                    // `txos_inner` is what transaction history and per-transaction
+                    // balances are computed from, so skipping them would show a receiving
+                    // transaction with no incoming amount.
+                    #[cfg(feature = "silentpayments")]
+                    if let Some(entry) = self.cache.silent_payment(&output.script_pubkey) {
+                        let mut txo = self
+                            .silent_payment_wallet_txout(entry, unblinded, *height)
+                            .ok()?;
+                        txo.is_spent = is_spent;
+                        return Some(txo);
+                    }
+
                     let index = self.index(&output.script_pubkey).ok()?;
                     let blinding_pubkey = (!is_explicit(&unblinded))
                         .then(|| {
@@ -727,6 +897,45 @@ impl Wollet {
         Ok(txos)
     }
 
+    /// Render a found silent payment output as an ordinary [`WalletTxOut`].
+    ///
+    /// Two fields cannot mean what they usually do, because this output has no
+    /// derivation path:
+    ///
+    /// - `wildcard_index` carries the silent payment output counter `k`. It is not a
+    ///   BIP-32 child index, and deriving the wallet descriptor at `k` yields an
+    ///   unrelated script.
+    /// - `ext_int` is a classification from the BIP-352 label rather than a chain in the
+    ///   descriptor: change-labeled outputs report [`Chain::Internal`].
+    ///
+    /// The address is confidential, built from the output's own blinding pubkey — the
+    /// blinding key comes from the shared secret, so the wallet's SLIP-77 key has
+    /// nothing to do with it.
+    #[cfg(feature = "silentpayments")]
+    fn silent_payment_wallet_txout(
+        &self,
+        entry: &crate::silentpayments::SilentPaymentCacheEntry,
+        unblinded: TxOutSecrets,
+        height: Option<Height>,
+    ) -> Result<WalletTxOut, Error> {
+        let address = Address::from_script(
+            &entry.script_pubkey,
+            Some(entry.blinding_pubkey),
+            self.network().address_params(),
+        )
+        .ok_or_else(|| Error::Generic("invalid silent payment scriptpubkey".into()))?;
+        Ok(WalletTxOut {
+            outpoint: entry.outpoint,
+            script_pubkey: entry.script_pubkey.clone(),
+            height,
+            unblinded,
+            wildcard_index: entry.k,
+            ext_int: entry.chain(),
+            is_spent: false,
+            address,
+        })
+    }
+
     /// Get the wallet UTXOs
     pub fn utxos(&self) -> Result<Vec<WalletTxOut>, Error> {
         let mut utxos = self.utxos_inner()?;
@@ -1246,6 +1455,132 @@ impl Wollet {
     }
 }
 
+/// Silent-payment wallet operations using scan-only material.
+#[cfg(feature = "silentpayments")]
+impl Wollet {
+    /// Returns the wallet's scan-only silent-payment material, if configured.
+    pub fn silent_payment_material(
+        &self,
+    ) -> Option<&crate::silentpayments::SilentPaymentScanMaterial> {
+        self.silent_payment_material.as_ref()
+    }
+
+    /// Returns the height through which silent-payment discovery has scanned.
+    pub fn silent_payments_scanned_to(&self) -> Option<Height> {
+        self.cache.silent_payments_scanned_to
+    }
+
+    /// Returns the wallet's reusable silent-payment address.
+    pub fn silent_payment_address(&self) -> Result<String, Error> {
+        use crate::silentpayments::SilentPaymentScan as _;
+        Ok(self
+            .require_silent_payment_material()?
+            .address()
+            .encode(self.network))
+    }
+
+    /// A labeled silent-payment address (BIP-352 labels), e.g.
+    /// [`crate::silentpayments::CHANGE_LABEL`] for change.
+    pub fn labeled_silent_payment_address(&self, label: u32) -> Result<String, Error> {
+        use crate::silentpayments::SilentPaymentScan as _;
+        Ok(self
+            .require_silent_payment_material()?
+            .labeled_address(label)
+            .encode(self.network))
+    }
+
+    /// The scan material, or an error explaining that the wallet has none.
+    pub(crate) fn require_silent_payment_material(
+        &self,
+    ) -> Result<&crate::silentpayments::SilentPaymentScanMaterial, Error> {
+        self.silent_payment_material
+            .as_ref()
+            .ok_or(Error::MissingSilentPaymentKeys)
+    }
+
+    /// Find the silent payments to this wallet among `txs`, returning them unblinded and
+    /// ready to spend.
+    ///
+    /// This is the low-level entry point, for callers holding transactions from a source
+    /// of their own. A normal sync reaches it via
+    /// [`crate::clients::blocking::BlockchainBackend::full_scan()`], after which the
+    /// results are in [`Wollet::utxos()`] and [`Wollet::balance()`] and need no special
+    /// handling to spend; use this directly only to scan transactions the wallet's
+    /// backend cannot supply.
+    ///
+    /// Transactions must be passed in because a silent-payment scriptPubKey is derived
+    /// from a shared secret and so matches none of the wallet's descriptor-derived
+    /// scripts: no script-history query can surface it, and the transactions have to come
+    /// from a source that does not filter by descriptor (a full node, a tweak/index
+    /// server, or a block feed).
+    ///
+    /// `prevout_script` resolves the scriptPubKey each input spends, which is what the
+    /// input pubkeys are recovered from; returning `None` makes that input contribute
+    /// no key. When a tweak server already publishes `T = input_hash·A`, prefer
+    /// [`crate::silentpayments::SilentPaymentTxScanner::scan_tx_with_tweak()`] and skip
+    /// the prevout lookups entirely.
+    ///
+    /// `labels` are the BIP-352 labels to watch in addition to the plain address.
+    ///
+    /// Results are returned, **not** applied to the wallet: this method takes `&self`.
+    /// Feed them to [`Wollet::apply_silent_payments()`] to have them show up in the
+    /// balance, or spend them standalone via
+    /// [`crate::TxBuilder::add_silent_payment_utxos()`] — which carries the spend tweak
+    /// through to the PSET, as `external_utxo()` alone cannot.
+    pub fn scan_silent_payments<'a, F>(
+        &self,
+        txs: &[Transaction],
+        labels: impl IntoIterator<Item = u32>,
+        mut prevout_script: F,
+    ) -> Result<Vec<crate::silentpayments::SilentPaymentUtxo>, Error>
+    where
+        F: FnMut(&OutPoint) -> Option<&'a Script>,
+    {
+        let material = *self.require_silent_payment_material()?;
+        let scanner =
+            crate::silentpayments::SilentPaymentTxScanner::new(material).with_labels(labels);
+        Ok(txs
+            .iter()
+            .flat_map(|tx| scanner.scan_tx(tx, &mut prevout_script))
+            .collect())
+    }
+
+    /// Record found silent payments as wallet outputs.
+    ///
+    /// After this they are ordinary wallet outputs: they appear in [`Wollet::utxos()`],
+    /// [`Wollet::balance()`] and [`Wollet::txos()`], coin selection will spend them, and
+    /// the fee estimate uses their Taproot satisfaction weight rather than the
+    /// descriptor's.
+    ///
+    /// The transaction containing each output must already be in the wallet (a scan
+    /// applies the transactions it fetched before applying what it found), otherwise the
+    /// output has no confirmation height and no spend/unspend bookkeeping to hang off;
+    /// such entries are reported as [`Error::MissingTransaction`] rather than stored in a
+    /// state where the balance would count an output the wallet cannot locate.
+    ///
+    /// Only the spend **tweak** is stored, never the spend key — see
+    /// [`crate::silentpayments::SilentPaymentCacheEntry`]. Signing re-derives the key
+    /// from the wallet's scan keys.
+    pub fn apply_silent_payments(
+        &mut self,
+        found: &[crate::silentpayments::SilentPaymentUtxo],
+    ) -> Result<(), Error> {
+        // Check every output first: applying half of them would leave the balance
+        // counting outputs whose transaction the wallet cannot locate.
+        for utxo in found {
+            if self.cache.tx(&utxo.outpoint.txid).is_none() {
+                return Err(Error::MissingTransaction);
+            }
+        }
+
+        for utxo in found {
+            self.cache
+                .insert_silent_payment(utxo.cache_entry(), utxo.unblinded);
+        }
+        Ok(())
+    }
+}
+
 fn is_explicit(txoutsecrets: &TxOutSecrets) -> bool {
     txoutsecrets.asset_bf == AssetBlindingFactor::zero()
         && txoutsecrets.value_bf == ValueBlindingFactor::zero()
@@ -1492,10 +1827,422 @@ mod tests {
             .unwrap()
     }
 
+    /// Scan material for testnet `account`, derived from a fixed master key.
+    ///
+    /// This duplicates what `lwk_signer::SwSigner` does, deliberately: `lwk_wollet`
+    /// must not depend on `lwk_signer` (the whole point of the boundary), so a test
+    /// that needs realistic material has to derive it here. Note what it produces is
+    /// still only `b_scan` + `B_spend` — `b_spend` is derived, reduced to a point,
+    /// and dropped, exactly as the signer does.
+    #[cfg(feature = "silentpayments")]
+    fn test_scan_material(account: u32) -> crate::silentpayments::SilentPaymentScanMaterial {
+        use crate::silentpayments::{SilentPaymentAccount, SilentPaymentScanMaterial};
+
+        let master = Xpriv::new_master(BitcoinNetwork::Testnet, &[0x42; 32]).unwrap();
+        let acct = SilentPaymentAccount::liquid_testnet(account);
+        let derive = |path| master.derive_priv(&EC, &path).unwrap().private_key;
+
+        SilentPaymentScanMaterial::new(
+            acct,
+            derive(acct.scan_path()),
+            derive(acct.spend_path()).public_key(&EC),
+        )
+    }
+
     fn fast_tempdir() -> tempfile::TempDir {
         tempfile::tempdir_in("/dev/shm").unwrap_or_else(|_| tempfile::tempdir().unwrap())
     }
 
+    #[cfg(feature = "silentpayments")]
+    #[test]
+    fn silent_payment_material_changes_wallet_identity() {
+        use crate::silentpayments::CHANGE_LABEL;
+
+        let view_key = "1111111111111111111111111111111111111111111111111111111111111111";
+        let xpub = "tpubDD7tXK8KeQ3YY83yWq755fHY2JW8Ha8Q765tknUM5rSvjPcGWfUppDFMpQ1ScziKfW3ZNtZvAD7M3u7bSs7HofjTD3KP3YxPK7X6hwV8Rk2";
+        let desc = format!("ct({view_key},elwpkh({xpub}/*))");
+
+        // The receiver's scan material, obtained the way a real wallet obtains it:
+        // from a signer, which derives both BIP-352 branches and exports only the
+        // scan-only half.
+        let network = Network::TestnetLiquid;
+        let keys = test_scan_material(0);
+
+        // A wallet without scan material refuses to hand out an address it could never
+        // scan for, rather than returning one that would silently swallow funds.
+        let keyless = new_wollet(&desc);
+        assert!(matches!(
+            keyless.silent_payment_address(),
+            Err(Error::MissingSilentPaymentKeys)
+        ));
+
+        let wollet = WolletBuilder::new(network, desc.parse().unwrap())
+            .with_silent_payment_material(keys)
+            .build()
+            .unwrap();
+
+        // Scan material participates in the wallet identity, so a cache built without it
+        // is not mistaken for one built with it.
+        assert_ne!(
+            wollet.status(),
+            keyless.status(),
+            "scan material must change `status()`, else toggling it reuses a stale cache"
+        );
+
+        // ...and so does *which* material it is. Two accounts of the same signer
+        // discover different outputs, so their caches are not interchangeable either.
+        let other_account = WolletBuilder::new(network, desc.parse().unwrap())
+            .with_silent_payment_material(test_scan_material(1))
+            .build()
+            .unwrap();
+        assert_ne!(
+            wollet.status(),
+            other_account.status(),
+            "a different silent payment account must change `status()`"
+        );
+
+        // The account coordinates are hashed in their own right, not merely implied
+        // by the keys. Today distinct accounts always derive distinct points, so the
+        // assertion above would hold even if the coordinates were ignored; this one
+        // isolates them by holding the keys fixed and changing only the account.
+        //
+        // That combination cannot arise from a signer, which is the point: it is what
+        // a future derivation change could produce, and identity should already be
+        // correct when it does rather than needing to be fixed afterwards.
+        let same_keys_other_account = WolletBuilder::new(network, desc.parse().unwrap())
+            .with_silent_payment_material(crate::silentpayments::SilentPaymentScanMaterial::new(
+                lwk_common::silentpayments::SilentPaymentAccount::liquid_testnet(9),
+                keys.scan_seckey(),
+                keys.spend_pubkey(),
+            ))
+            .build()
+            .unwrap();
+        assert_ne!(
+            wollet.status(),
+            same_keys_other_account.status(),
+            "account coordinates must contribute to `status()` on their own"
+        );
+
+        // The published address is reusable and network-tagged.
+        let address = wollet.silent_payment_address().unwrap();
+        assert!(address.starts_with("tlqsp1"), "unexpected hrp: {address}");
+        assert_eq!(
+            address,
+            wollet.silent_payment_address().unwrap(),
+            "an SP address is reusable, not index-consuming"
+        );
+        // Labeled addresses differ from the plain one but share the scan key.
+        let change_address = wollet.labeled_silent_payment_address(CHANGE_LABEL).unwrap();
+        assert_ne!(change_address, address);
+    }
+
+    #[cfg(feature = "silentpayments")]
+    #[test]
+    fn applying_a_silent_payment_requires_its_transaction() {
+        use crate::silentpayments::test_fixture::SilentPaymentTestData as Data;
+        use crate::silentpayments::test_fixture::SpPaymentBuilder;
+
+        let view_key = "1111111111111111111111111111111111111111111111111111111111111111";
+        let xpub = "tpubDD7tXK8KeQ3YY83yWq755fHY2JW8Ha8Q765tknUM5rSvjPcGWfUppDFMpQ1ScziKfW3ZNtZvAD7M3u7bSs7HofjTD3KP3YxPK7X6hwV8Rk2";
+        let desc = format!("ct({view_key},elwpkh({xpub}/*))");
+        let network = Network::TestnetLiquid;
+        let keys = test_scan_material(0);
+
+        let mut wollet = WolletBuilder::new(network, desc.parse().unwrap())
+            .with_silent_payment_material(keys)
+            .build()
+            .unwrap();
+
+        // A stranger pays the wallet's SP address.
+        let asset = *network.policy_asset();
+        let value = 123_456u64;
+        let payment = SpPaymentBuilder::new()
+            .with_inputs(&[(Data::outpoint(0x31, 0), Data::secret_key(0xB1))])
+            .with_value(value)
+            .with_asset(asset)
+            .without_extra_output()
+            .build_for(&keys);
+        let tx = payment.tx.clone();
+
+        let found = wollet
+            .scan_silent_payments(std::slice::from_ref(&tx), [], payment.prevout_lookup())
+            .unwrap();
+        assert_eq!(found.len(), 1);
+
+        // Applying before the transaction is known must fail rather than record an
+        // output whose transaction the wallet cannot locate.
+        assert!(matches!(
+            wollet.apply_silent_payments(&found),
+            Err(Error::MissingTransaction)
+        ));
+        assert!(wollet.balance().unwrap().values().all(|v| *v == 0));
+    }
+
+    /// A silent payment spent *standalone* — never applied to the wallet — must reach a
+    /// signer just as well annotated as one the wallet is tracking.
+    ///
+    /// This is the path `scan_silent_payments()` documents for callers holding their own
+    /// transactions. Funding it was always possible through `external_utxo()`, but an
+    /// `ExternalUtxo` has nowhere to carry the spend tweak, so the resulting input had
+    /// no `bip32_derivation` (it cannot) *and* no metadata (it should have) — an input
+    /// no signer could complete, from an API that looked like it worked.
+    #[cfg(feature = "silentpayments")]
+    #[test]
+    fn a_standalone_silent_payment_reaches_the_signer_annotated() {
+        use crate::silentpayments::test_fixture::SilentPaymentTestData as Data;
+        use crate::silentpayments::test_fixture::SpPaymentBuilder;
+        use lwk_common::silentpayments::SilentPaymentInputMeta;
+
+        let view_key = "1111111111111111111111111111111111111111111111111111111111111111";
+        let xpub = "tpubDD7tXK8KeQ3YY83yWq755fHY2JW8Ha8Q765tknUM5rSvjPcGWfUppDFMpQ1ScziKfW3ZNtZvAD7M3u7bSs7HofjTD3KP3YxPK7X6hwV8Rk2";
+        let desc = format!("ct({view_key},elwpkh({xpub}/*))");
+        let network = Network::TestnetLiquid;
+        let keys = test_scan_material(0);
+        let asset = *network.policy_asset();
+
+        let mut wollet = WolletBuilder::new(network, desc.parse().unwrap())
+            .with_silent_payment_material(keys)
+            .build()
+            .unwrap();
+
+        // A stranger pays the wallet's SP address, and separately the wallet holds
+        // ordinary money so the transaction has a descriptor-derived input to contrast
+        // against.
+        let sp_value = 200_000u64;
+        let payment = SpPaymentBuilder::new()
+            .with_inputs(&[(Data::outpoint(0x41, 0), Data::secret_key(0xB4))])
+            .with_value(sp_value)
+            .with_asset(asset)
+            .without_extra_output()
+            .build_for(&keys);
+        let tx = payment.tx.clone();
+
+        let found = wollet
+            .scan_silent_payments(std::slice::from_ref(&tx), [], payment.prevout_lookup())
+            .unwrap();
+        assert_eq!(found.len(), 1);
+
+        // The transaction is known to the wallet (it has to be, to spend from it) but
+        // the payment is deliberately NOT applied: this is the standalone path, so the
+        // cache must not be what makes the annotation work.
+        wollet
+            .cache
+            .update(
+                &[(tx.txid(), Some(100u32))],
+                &[],
+                &[(tx.txid(), tx.clone())],
+                false,
+                vec![],
+                false,
+            )
+            .unwrap();
+        assert!(
+            wollet.utxos().unwrap().is_empty(),
+            "the payment must not be wallet money in this test"
+        );
+
+        // Spend it standalone. Every satoshi has to come from the silent payment,
+        // since the wallet has nothing else.
+        let recipient_addr = wollet.address(Some(0)).unwrap().address().clone();
+        let pset = wollet
+            .tx_builder()
+            .add_silent_payment_utxos(found.clone())
+            .unwrap()
+            .add_recipient(&recipient_addr, 1_000, asset)
+            .unwrap()
+            .finish()
+            .unwrap();
+
+        let sp_index = pset
+            .inputs()
+            .iter()
+            .position(|i| {
+                i.previous_txid == found[0].outpoint.txid
+                    && i.previous_output_index == found[0].outpoint.vout
+            })
+            .expect("the standalone silent payment must fund the transaction");
+
+        let sp_input = &pset.inputs()[sp_index];
+        assert!(
+            sp_input.bip32_derivation.is_empty(),
+            "an SP input has no derivation path; the metadata is what stands in for it"
+        );
+
+        let meta = SilentPaymentInputMeta::read(sp_input)
+            .expect("a standalone silent payment input must carry signing metadata");
+        assert_eq!(meta.account(), keys.account());
+        assert_eq!(meta.expected_spend_pubkey(), keys.spend_pubkey());
+        assert_eq!(&meta.spend_tweak(), found[0].spend_tweak.as_scalar());
+
+        // The metadata must survive serialization: a PSET exists to be handed to
+        // another process, and metadata that only round-trips in memory is useless.
+        let reparsed: PartiallySignedTransaction = pset.to_string().parse().unwrap();
+        assert_eq!(
+            SilentPaymentInputMeta::read(&reparsed.inputs()[sp_index]).unwrap(),
+            meta
+        );
+    }
+
+    /// A silent payment UTXO handed to a wallet that holds no scan material must be
+    /// refused, not quietly funded into an unsignable PSET.
+    ///
+    /// Such a wallet could not have found the output, so it cannot vouch for the tweak
+    /// or name the account a signer should use. Skipping the annotation would produce
+    /// exactly the failure this whole change exists to remove.
+    #[cfg(feature = "silentpayments")]
+    #[test]
+    fn spending_a_silent_payment_without_scan_material_is_refused() {
+        use crate::silentpayments::{SilentPaymentOutput, SilentPaymentUtxo, SpendTweak};
+
+        let view_key = "1111111111111111111111111111111111111111111111111111111111111111";
+        let xpub = "tpubDD7tXK8KeQ3YY83yWq755fHY2JW8Ha8Q765tknUM5rSvjPcGWfUppDFMpQ1ScziKfW3ZNtZvAD7M3u7bSs7HofjTD3KP3YxPK7X6hwV8Rk2";
+        let desc = format!("ct({view_key},elwpkh({xpub}/*))");
+        let network = Network::TestnetLiquid;
+
+        // Built WITHOUT `with_silent_payment_material`.
+        let wollet = WolletBuilder::new(network, desc.parse().unwrap())
+            .build()
+            .unwrap();
+
+        let stranger = crate::secp256k1::SecretKey::from_slice(&[0xE1; 32]).unwrap();
+        let pk = stranger.public_key(&EC);
+        let utxo = SilentPaymentUtxo {
+            outpoint: OutPoint::new(
+                <Txid as crate::hashes::Hash>::from_byte_array([0xF2; 32]),
+                0,
+            ),
+            txout: crate::elements::TxOut {
+                asset: crate::elements::confidential::Asset::Explicit(*network.policy_asset()),
+                value: crate::elements::confidential::Value::Explicit(50_000),
+                nonce: Default::default(),
+                script_pubkey: Script::new_v1_p2tr_tweaked(
+                    crate::elements::schnorr::TweakedPublicKey::new(pk.x_only_public_key().0),
+                ),
+                witness: Default::default(),
+            },
+            unblinded: TxOutSecrets::new(
+                *network.policy_asset(),
+                AssetBlindingFactor::zero(),
+                50_000,
+                ValueBlindingFactor::zero(),
+            ),
+            k: 0,
+            label: None,
+            output: SilentPaymentOutput {
+                spend_pubkey: pk,
+                blinding_pubkey: pk,
+                blinding_seckey: stranger,
+            },
+            spend_tweak: SpendTweak::from_be_bytes([0x3C; 32]).unwrap(),
+        };
+
+        let recipient_addr = wollet.address(Some(0)).unwrap().address().clone();
+        let err = wollet
+            .tx_builder()
+            .add_silent_payment_utxos(vec![utxo])
+            .unwrap()
+            .add_recipient(&recipient_addr, 1_000, *network.policy_asset())
+            .unwrap()
+            .finish()
+            .expect_err("a wallet with no scan material cannot vouch for a silent payment");
+        assert!(
+            matches!(err, Error::MissingSilentPaymentKeys),
+            "unexpected error: {err}"
+        );
+    }
+
+    /// A cache entry whose tweak does not describe its own script must be refused at
+    /// build time, not annotated and shipped to a signer.
+    ///
+    /// The signer would catch it — that check is the real gate. But a PSET that is
+    /// guaranteed to fail signing is not a useful thing to hand back to a caller, and
+    /// the failure would surface far from its cause, looking like a signer bug rather
+    /// than a corrupt or foreign cache entry.
+    #[cfg(feature = "silentpayments")]
+    #[test]
+    fn a_corrupt_cache_entry_is_refused_before_it_reaches_a_signer() {
+        use crate::silentpayments::{SilentPaymentCacheEntry, SpendTweak};
+
+        let view_key = "1111111111111111111111111111111111111111111111111111111111111111";
+        let xpub = "tpubDD7tXK8KeQ3YY83yWq755fHY2JW8Ha8Q765tknUM5rSvjPcGWfUppDFMpQ1ScziKfW3ZNtZvAD7M3u7bSs7HofjTD3KP3YxPK7X6hwV8Rk2";
+        let desc = format!("ct({view_key},elwpkh({xpub}/*))");
+        let keys = test_scan_material(0);
+
+        let mut wollet = WolletBuilder::new(Network::TestnetLiquid, desc.parse().unwrap())
+            .with_silent_payment_material(keys)
+            .build()
+            .unwrap();
+
+        // A well-formed Taproot script paired with a tweak that has nothing to do with
+        // it — the shape a corrupted or cross-wallet cache entry would have.
+        let stranger = crate::secp256k1::SecretKey::from_slice(&[0xC7; 32])
+            .unwrap()
+            .public_key(&EC);
+        let entry = SilentPaymentCacheEntry {
+            outpoint: OutPoint::new(
+                <Txid as crate::hashes::Hash>::from_byte_array([0xD1; 32]),
+                0,
+            ),
+            script_pubkey: Script::new_v1_p2tr_tweaked(
+                crate::elements::schnorr::TweakedPublicKey::new(stranger.x_only_public_key().0),
+            ),
+            k: 0,
+            label: None,
+            spend_tweak: SpendTweak::from_be_bytes([0x5A; 32]).unwrap(),
+            blinding_pubkey: stranger,
+        };
+
+        assert!(
+            !entry.verify(&keys.spend_pubkey()),
+            "fixture must be a genuinely inconsistent entry"
+        );
+
+        // It has to be *in the cache*: the annotation path keys off the cache to decide
+        // whether an input is a silent payment at all.
+        let script = entry.script_pubkey.clone();
+        let outpoint = entry.outpoint;
+        wollet.cache.insert_silent_payment(
+            entry,
+            TxOutSecrets::new(
+                *Network::TestnetLiquid.policy_asset(),
+                AssetBlindingFactor::zero(),
+                1_000,
+                ValueBlindingFactor::zero(),
+            ),
+        );
+
+        // The witness utxo is what verification reads the script from — the annotator
+        // checks the tweak against the output the PSET actually spends, not against
+        // whatever the cache claims the script is.
+        let mut pset = PartiallySignedTransaction::new_v2();
+        let mut input = crate::elements::pset::Input::from_prevout(outpoint);
+        input.witness_utxo = Some(crate::elements::TxOut {
+            asset: crate::elements::confidential::Asset::Explicit(
+                *Network::TestnetLiquid.policy_asset(),
+            ),
+            value: crate::elements::confidential::Value::Explicit(1_000),
+            nonce: Default::default(),
+            script_pubkey: script,
+            witness: Default::default(),
+        });
+        pset.add_input(input);
+
+        let err = crate::silentpayments::SilentPaymentPsetAnnotator::for_builder(&wollet, &[])
+            .expect("the wallet has scan material")
+            .expect("a wallet with material always gets an annotator")
+            .annotate(&mut pset)
+            .expect_err("an inconsistent cache entry must not be annotated");
+        assert!(
+            format!("{err}").contains("does not verify"),
+            "unexpected error: {err}"
+        );
+
+        // And nothing was written: a refused input must not carry half-formed metadata.
+        assert!(
+            lwk_common::silentpayments::SilentPaymentInputMeta::read(&pset.inputs()[0]).is_err()
+        );
+    }
+
     #[test]
     fn test_signers() {
         let view_key = "1111111111111111111111111111111111111111111111111111111111111111";
@@ -1551,6 +2298,8 @@ mod tests {
             tip,
             unspent: Vec::new(),
             last_unused: Default::default(),
+            #[cfg(feature = "silentpayments")]
+            silent_payments: None,
         };
 
         wollet.apply_update(update.clone()).unwrap();

From 09495a5e71897e3f15dd51caabfd94568ba53f41 Mon Sep 17 00:00:00 2001
From: 42Pupusas <technology@illuminodes.com>
Date: Fri, 31 Jul 2026 16:04:45 -0600
Subject: [PATCH 08/12] wollet: discover silent payments during full_scan

A new Capability::SilentPayments gates discovery: script-history backends can never surface SP outputs, so backends without it honestly refuse rather than silently missing money. The Esplora client earns it by computing per-block partial tweaks locally, reading every prevout script from the paged /block/{hash}/txs listing (one page per 25 txs instead of one request per prevout, which public instances 429). Discovery progress is tracked separately from the tip so a wallet that scanned before configuring keys does not skip history, and resumes from the birthday when set. Waterfalls descriptor filtering cannot serve SP scripts, so its client only advertises the capability through the underlying Esplora path.
---
 .../src/clients/asyncr/block_prevouts.rs      | 184 +++++++
 lwk_wollet/src/clients/asyncr/esplora.rs      | 202 +++++++-
 .../src/clients/asyncr/esplora/waterfalls.rs  |  14 +
 lwk_wollet/src/clients/asyncr/mod.rs          |   5 +
 lwk_wollet/src/clients/blocking/esplora.rs    |  17 +
 lwk_wollet/src/clients/blocking/mod.rs        | 467 +++++++++++++++++-
 lwk_wollet/src/clients/blocking/waterfalls.rs |  16 +
 lwk_wollet/src/clients/mod.rs                 |  14 +
 lwk_wollet/src/silentpayments/test_fixture.rs |   6 +-
 9 files changed, 917 insertions(+), 8 deletions(-)
 create mode 100644 lwk_wollet/src/clients/asyncr/block_prevouts.rs

diff --git a/lwk_wollet/src/clients/asyncr/block_prevouts.rs b/lwk_wollet/src/clients/asyncr/block_prevouts.rs
new file mode 100644
index 000000000..fc4ce171d
--- /dev/null
+++ b/lwk_wollet/src/clients/asyncr/block_prevouts.rs
@@ -0,0 +1,184 @@
+//! Reads block-input prevout scripts from Esplora transaction listings.
+
+use std::collections::HashMap;
+
+use crate::elements::{OutPoint, Script, Txid};
+
+/// A `/block/{hash}/txs` page.
+#[derive(serde::Deserialize)]
+pub(crate) struct BlockTxsPage(Vec<BlockTx>);
+
+#[derive(serde::Deserialize)]
+struct BlockTx {
+    vin: Vec<BlockTxIn>,
+}
+
+#[derive(serde::Deserialize)]
+struct BlockTxIn {
+    txid: Txid,
+    vout: u32,
+    /// Absent for coinbase and peg-in inputs.
+    prevout: Option<BlockPrevout>,
+    #[serde(default)]
+    is_coinbase: bool,
+    #[serde(default)]
+    is_pegin: bool,
+}
+
+#[derive(serde::Deserialize)]
+struct BlockPrevout {
+    /// Hex-encoded scriptPubKey of the output being spent.
+    scriptpubkey: String,
+}
+
+impl BlockTxsPage {
+    /// Number of transactions in this page.
+    pub(crate) fn len(&self) -> usize {
+        self.0.len()
+    }
+
+    /// Adds decodable non-coinbase, non-peg-in prevout scripts to `out`.
+    pub(crate) fn collect_into(&self, out: &mut HashMap<OutPoint, Script>) {
+        for tx in &self.0 {
+            for input in &tx.vin {
+                if input.is_coinbase || input.is_pegin {
+                    continue;
+                }
+                let Some(prevout) = &input.prevout else {
+                    continue;
+                };
+                let Ok(script) = prevout.scriptpubkey.parse::<Script>() else {
+                    continue;
+                };
+                out.insert(
+                    OutPoint {
+                        txid: input.txid,
+                        vout: input.vout,
+                    },
+                    script,
+                );
+            }
+        }
+    }
+}
+
+/// Esplora returns block transactions in pages of this size.
+pub(crate) const BLOCK_TXS_PAGE_SIZE: usize = 25;
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// Trimmed from a real `/block/{hash}/txs` response on Liquid testnet: a coinbase
+    /// (null prevout) and an ordinary p2wpkh spend carrying its prevout script.
+    const PAGE: &str = r#"[
+      {
+        "txid": "0226949ff2a9f9b6c7f0a93aef2db6c1bbd0ef95ce4881077013d8d2fb631cda",
+        "vin": [{
+          "txid": "0000000000000000000000000000000000000000000000000000000000000000",
+          "vout": 4294967295,
+          "prevout": null,
+          "is_coinbase": true,
+          "is_pegin": false
+        }]
+      },
+      {
+        "txid": "3e8dc4ae3c6d58c8af69137d5d93354ee1995580f80274f2f9d9fed90539dcc5",
+        "vin": [{
+          "txid": "2ff1893242d1bfcd999ef5d531768e5f8a26f36f04d0c06c7e24b6dae548f4a4",
+          "vout": 0,
+          "prevout": {
+            "scriptpubkey": "00142d0f8ce38a5d3e8d97f415b4f28906b9cc8fdec7",
+            "scriptpubkey_type": "v0_p2wpkh"
+          },
+          "is_coinbase": false,
+          "is_pegin": false
+        }]
+      }
+    ]"#;
+
+    /// The whole point of this module: the spent script arrives inline, so it must be
+    /// recovered without any further request.
+    #[test]
+    fn prevout_scripts_are_read_from_the_listing() {
+        let page: BlockTxsPage = serde_json::from_str(PAGE).unwrap();
+        assert_eq!(
+            page.len(),
+            2,
+            "both transactions must be counted for paging"
+        );
+
+        let mut prevouts = HashMap::new();
+        page.collect_into(&mut prevouts);
+
+        let op = OutPoint {
+            txid: "2ff1893242d1bfcd999ef5d531768e5f8a26f36f04d0c06c7e24b6dae548f4a4"
+                .parse()
+                .unwrap(),
+            vout: 0,
+        };
+        let script = prevouts.get(&op).expect("the spent script must be present");
+        assert_eq!(
+            crate::elements::hex::ToHex::to_hex(script.as_bytes()),
+            "00142d0f8ce38a5d3e8d97f415b4f28906b9cc8fdec7",
+            "the script must round-trip byte-for-byte, or tweaks are computed over the wrong key"
+        );
+
+        // Keyed by the spent outpoint, never by the spending transaction.
+        assert_eq!(prevouts.len(), 1, "the coinbase must contribute nothing");
+    }
+
+    /// A peg-in's `previous_output` names a Bitcoin transaction, and Esplora sends its
+    /// prevout as null. It contributes no key to the tweak, so it must be skipped rather
+    /// than recorded as a missing script.
+    #[test]
+    fn pegin_inputs_are_skipped() {
+        let json = r#"[{
+          "txid": "3e8dc4ae3c6d58c8af69137d5d93354ee1995580f80274f2f9d9fed90539dcc5",
+          "vin": [{
+            "txid": "0c52d2526a5c9f00e9fb74afd15dd3caaf17c823159a514f929ae25193a43a52",
+            "vout": 0,
+            "prevout": null,
+            "is_coinbase": false,
+            "is_pegin": true
+          }]
+        }]"#;
+
+        let page: BlockTxsPage = serde_json::from_str(json).unwrap();
+        let mut prevouts = HashMap::new();
+        page.collect_into(&mut prevouts);
+        assert!(prevouts.is_empty());
+    }
+
+    /// Esplora sends many more fields than these structs name; binding to all of them
+    /// would break the client whenever upstream adds one.
+    #[test]
+    fn unknown_fields_are_tolerated() {
+        let json = r#"[{
+          "txid": "3e8dc4ae3c6d58c8af69137d5d93354ee1995580f80274f2f9d9fed90539dcc5",
+          "version": 2,
+          "locktime": 1224565,
+          "size": 21967,
+          "status": {"confirmed": true, "block_height": 1224566},
+          "vin": [{
+            "txid": "2ff1893242d1bfcd999ef5d531768e5f8a26f36f04d0c06c7e24b6dae548f4a4",
+            "vout": 0,
+            "scriptsig": "",
+            "witness": ["aabb"],
+            "sequence": 4294967293,
+            "prevout": {
+              "scriptpubkey": "00142d0f8ce38a5d3e8d97f415b4f28906b9cc8fdec7",
+              "valuecommitment": "097bc0ac90c7c0e86a7b0f27c11da235c823e9814419fa5b014a4040a5e3c2b3c8"
+            },
+            "is_coinbase": false,
+            "is_pegin": false
+          }],
+          "vout": [{"scriptpubkey": "6a", "value": 0}]
+        }]"#;
+
+        let page: BlockTxsPage = serde_json::from_str(json).unwrap();
+        let mut prevouts = HashMap::new();
+        page.collect_into(&mut prevouts);
+        assert_eq!(prevouts.len(), 1);
+    }
+}
diff --git a/lwk_wollet/src/clients/asyncr/esplora.rs b/lwk_wollet/src/clients/asyncr/esplora.rs
index 7b116590d..de7061543 100644
--- a/lwk_wollet/src/clients/asyncr/esplora.rs
+++ b/lwk_wollet/src/clients/asyncr/esplora.rs
@@ -213,6 +213,181 @@ impl EsploraClient {
         }
     }
 
+    /// Fetch the full block at `height`.
+    #[cfg(feature = "silentpayments")]
+    async fn get_block_at(&self, height: Height) -> Result<elements::Block, Error> {
+        let block_height = format!("{}/block-height/{}", self.base_url, height);
+        let response = self.get_with_retry(&block_height).await?;
+        let block_hash = BlockHash::from_str(&response.text().await?)?;
+
+        let block_url = format!("{}/block/{}/raw", self.base_url, block_hash);
+        let response = self.get_with_retry(&block_url).await?;
+        Ok(elements::Block::consensus_decode(
+            &response.bytes().await?[..],
+        )?)
+    }
+
+    /// Computes block tweaks from Esplora block and transaction-listing data.
+    #[cfg(feature = "silentpayments")]
+    pub async fn silent_payment_tweaks(
+        &self,
+        height: Height,
+    ) -> Result<Vec<(Txid, crate::silentpayments::PartialTweak)>, Error> {
+        use crate::silentpayments::BlockTweaks;
+
+        let block = self.get_block_at(height).await?;
+        let tweaks = BlockTweaks::new(&block);
+
+        if tweaks.required_prevouts().is_empty() {
+            return Ok(tweaks.compute(&HashMap::new()));
+        }
+
+        let prevouts = self.block_prevout_scripts(&block).await?;
+        Ok(tweaks.compute(&prevouts))
+    }
+
+    /// Reads spent scripts from Esplora's paged transaction listing.
+    #[cfg(feature = "silentpayments")]
+    async fn block_prevout_scripts(
+        &self,
+        block: &elements::Block,
+    ) -> Result<HashMap<elements::OutPoint, Script>, Error> {
+        use super::block_prevouts::{BlockTxsPage, BLOCK_TXS_PAGE_SIZE};
+
+        let block_hash = block.block_hash();
+        let mut prevouts = HashMap::new();
+
+        let mut start = 0usize;
+        while start < block.txdata.len() {
+            let url = format!("{}/block/{}/txs/{}", self.base_url, block_hash, start);
+            let response = self.get_with_retry(&url).await?;
+            let page: BlockTxsPage = serde_json::from_str(&response.text().await?)
+                .map_err(|e| Error::Generic(format!("cannot parse block txs page: {e}")))?;
+
+            let seen = page.len();
+            page.collect_into(&mut prevouts);
+
+            // An empty page means the listing is exhausted; without this a server that
+            // disagrees with our page size would loop forever. Advance by what was
+            // actually returned rather than by the nominal page size, so a short page
+            // cannot cause transactions to be skipped.
+            if seen == 0 {
+                break;
+            }
+            start += seen;
+            if seen < BLOCK_TXS_PAGE_SIZE {
+                break;
+            }
+        }
+
+        Ok(prevouts)
+    }
+
+    /// Async twin of `BlockchainBackend::scan_silent_payments_for()`, run as part of
+    /// [`Self::full_scan_to_index()`].
+    ///
+    /// Returns `None` when discovery did not run — the wallet has no scan keys, or the
+    /// range is already covered — which must stay distinct from running and finding
+    /// nothing, since only the latter advances the scanned-to height.
+    #[cfg(feature = "silentpayments")]
+    async fn scan_silent_payments_for(
+        &self,
+        wollet: &Wollet,
+        tip: &elements::BlockHeader,
+        new_txs: &mut crate::update::DownloadTxResult,
+    ) -> Result<Option<crate::update::SilentPaymentsUpdate>, Error> {
+        use crate::silentpayments::{SilentPaymentSync, SilentPaymentTxScanner, CHANGE_LABEL};
+
+        let Some(material) = wollet.silent_payment_material().copied() else {
+            return Ok(None);
+        };
+
+        // Resume from where discovery reached, never from the wallet tip: the two
+        // advance for different reasons and starting from the tip would skip the blocks
+        // in between. On a wallet that has never scanned this is the configured
+        // birthday.
+        let from = {
+            use crate::wollet::WolletState;
+            wollet.silent_payments_scan_from()
+        };
+        if from > tip.height {
+            return Ok(None);
+        }
+
+        let sync = SilentPaymentSync::new(material).with_labels([CHANGE_LABEL]);
+
+        let mut tweaks = Vec::new();
+        for height in from..=tip.height {
+            tweaks.extend(self.silent_payment_tweaks(height).await?);
+        }
+        if tweaks.is_empty() {
+            return Ok(Some(crate::update::SilentPaymentsUpdate {
+                found: Vec::new(),
+                scanned_to: tip.height,
+            }));
+        }
+
+        // Narrow to the transactions that might pay us before downloading any of them.
+        let candidates = sync.candidate_scripts(&tweaks);
+        let scripts: Vec<Script> = candidates.keys().cloned().collect();
+        let script_refs: Vec<&Script> = scripts.iter().collect();
+        let histories = self.get_scripts_history(&script_refs).await?;
+        let seen: Vec<Script> = histories
+            .iter()
+            .zip(scripts.iter())
+            .filter(|(history, _)| !history.is_empty())
+            .map(|(_, script)| script.clone())
+            .collect();
+
+        let hits = sync.tweaks_to_scan(&tweaks, &seen);
+        if hits.is_empty() {
+            return Ok(Some(crate::update::SilentPaymentsUpdate {
+                found: Vec::new(),
+                scanned_to: tip.height,
+            }));
+        }
+
+        let txids: Vec<Txid> = hits.iter().map(|(txid, _)| *txid).collect();
+        let txs = self.get_transactions(&txids).await?;
+        // Pair by txid rather than by position: `get_transactions` promises no ordering,
+        // and scanning a transaction with another's tweak would find nothing at all.
+        let by_txid: HashMap<Txid, crate::silentpayments::PartialTweak> =
+            hits.into_iter().collect();
+
+        // Scan with the tweak discovery already computed — re-deriving it would need the
+        // prevout scripts, which this client does not have.
+        let scanner = SilentPaymentTxScanner::new(material).with_labels([CHANGE_LABEL]);
+        let mut found = Vec::new();
+        let mut matched = Vec::new();
+        for tx in txs {
+            let Some(tweak) = by_txid.get(&tx.txid()) else {
+                continue;
+            };
+            for utxo in scanner.scan_tx_with_tweak(&tx, tweak) {
+                found.push((utxo.cache_entry(), utxo.unblinded));
+            }
+            matched.push(tx);
+        }
+
+        // These transactions are not in the descriptor-derived history, so nothing else
+        // in this scan would add them, and without them the outputs have no confirmation
+        // height to hang off.
+        if !found.is_empty() {
+            let known: HashSet<Txid> = new_txs.txs.iter().map(|(txid, _)| *txid).collect();
+            for tx in matched {
+                let txid = tx.txid();
+                if !known.contains(&txid) {
+                    new_txs.txs.push((txid, tx));
+                }
+            }
+        }
+
+        Ok(Some(crate::update::SilentPaymentsUpdate {
+            found,
+            scanned_to: tip.height,
+        }))
+    }
+
     async fn get_scripts_history_esplora(
         &self,
         addresses: &[Address],
@@ -428,10 +603,19 @@ impl EsploraClient {
         };
 
         let history_txs_id: HashSet<Txid> = txid_height.keys().cloned().collect();
-        let new_txs = self
+        #[cfg_attr(not(feature = "silentpayments"), allow(unused_mut))]
+        let mut new_txs = self
             .download_txs(&history_txs_id, &scripts, cache, &descriptor)
             .await?;
 
+        // Discovered here for the same reason as in the blocking client: a silent
+        // payment is spendable wallet money, so a scan that skipped it would under-report
+        // the balance.
+        #[cfg(feature = "silentpayments")]
+        let silent_payments = self
+            .scan_silent_payments_for(wollet, &tip, &mut new_txs)
+            .await?;
+
         let history_txs_heights_plus_tip: HashSet<Height> = txid_height
             .values()
             .filter_map(|e| *e)
@@ -485,6 +669,9 @@ impl EsploraClient {
                 .collect();
 
             let update = Update {
+                #[cfg(feature = "silentpayments")]
+                version: if silent_payments.is_some() { 6 } else { 4 },
+                #[cfg(not(feature = "silentpayments"))]
                 version: 4,
                 wollet_status,
                 new_txs,
@@ -496,7 +683,7 @@ impl EsploraClient {
                 unspent,
                 last_unused,
                 #[cfg(feature = "silentpayments")]
-                silent_payments: None,
+                silent_payments,
             };
             Ok(Some(update))
         } else {
@@ -938,11 +1125,16 @@ impl EsploraClient {
 
     #[allow(unused)]
     pub(crate) fn capabilities(&self) -> HashSet<Capability> {
+        let mut caps = HashSet::new();
         if self.waterfalls {
-            vec![Capability::Waterfalls].into_iter().collect()
-        } else {
-            HashSet::new()
+            caps.insert(Capability::Waterfalls);
         }
+        // Esplora exposes whole blocks and arbitrary transactions, which is everything
+        // needed to compute tweaks client-side. Unlike Electrum — whose protocol has no
+        // block-enumeration method — this needs no server extension.
+        #[cfg(feature = "silentpayments")]
+        caps.insert(Capability::SilentPayments);
+        caps
     }
 
     /// Return the number of network requests made by this client.
diff --git a/lwk_wollet/src/clients/asyncr/esplora/waterfalls.rs b/lwk_wollet/src/clients/asyncr/esplora/waterfalls.rs
index 6a5887b94..4792a58c5 100644
--- a/lwk_wollet/src/clients/asyncr/esplora/waterfalls.rs
+++ b/lwk_wollet/src/clients/asyncr/esplora/waterfalls.rs
@@ -306,6 +306,20 @@ impl WaterfallsClient {
         self.inner.capabilities()
     }
 
+    /// Async version of [`crate::blocking::BlockchainBackend::silent_payment_tweaks()`],
+    /// delegating to the wrapped Esplora client.
+    ///
+    /// Waterfalls has no tweak endpoint of its own yet, so discovery costs the same
+    /// block downloads as plain Esplora here — the descriptor-side speedup does not
+    /// extend to silent payments, because no descriptor generates their scripts.
+    #[cfg(feature = "silentpayments")]
+    pub async fn silent_payment_tweaks(
+        &self,
+        height: Height,
+    ) -> Result<Vec<(Txid, crate::silentpayments::PartialTweak)>, Error> {
+        self.inner.silent_payment_tweaks(height).await
+    }
+
     /// Returns true if the wallet has any tx using the first gap limit addresses.
     pub async fn has_txs(
         &self,
diff --git a/lwk_wollet/src/clients/asyncr/mod.rs b/lwk_wollet/src/clients/asyncr/mod.rs
index 7d11d8135..7e5713fe6 100644
--- a/lwk_wollet/src/clients/asyncr/mod.rs
+++ b/lwk_wollet/src/clients/asyncr/mod.rs
@@ -3,6 +3,11 @@
 #[cfg(feature = "esplora")]
 mod esplora;
 
+// Parsing of Esplora's JSON block listing, used to get a block's prevout scripts in a
+// handful of requests instead of one per input.
+#[cfg(all(feature = "esplora", feature = "silentpayments"))]
+mod block_prevouts;
+
 #[cfg(feature = "esplora")]
 pub use crate::clients::{EsploraClientBuilder, WaterfallsClientBuilder};
 
diff --git a/lwk_wollet/src/clients/blocking/esplora.rs b/lwk_wollet/src/clients/blocking/esplora.rs
index fd949fbe7..12650edb0 100644
--- a/lwk_wollet/src/clients/blocking/esplora.rs
+++ b/lwk_wollet/src/clients/blocking/esplora.rs
@@ -39,6 +39,15 @@ impl EsploraClient {
             client: asyncr::EsploraClient::new(network, url),
         })
     }
+
+    /// The number of network requests this client has made.
+    ///
+    /// Useful for asserting that an operation's cost scales the way it is meant to —
+    /// against a rate-limited public endpoint, request count is a correctness concern
+    /// and not just a performance one.
+    pub fn requests(&self) -> usize {
+        self.client.requests()
+    }
 }
 
 /// "Waterfalls" methods
@@ -137,6 +146,14 @@ impl BlockchainBackend for EsploraClient {
         self.client.capabilities()
     }
 
+    #[cfg(feature = "silentpayments")]
+    fn silent_payment_tweaks(
+        &self,
+        height: Height,
+    ) -> Result<Vec<(Txid, crate::silentpayments::PartialTweak)>, Error> {
+        self.rt.block_on(self.client.silent_payment_tweaks(height))
+    }
+
     fn get_history_waterfalls<S: WolletState>(
         &mut self,
         descriptor: &WolletDescriptor,
diff --git a/lwk_wollet/src/clients/blocking/mod.rs b/lwk_wollet/src/clients/blocking/mod.rs
index 43ee02846..b334069ea 100644
--- a/lwk_wollet/src/clients/blocking/mod.rs
+++ b/lwk_wollet/src/clients/blocking/mod.rs
@@ -62,6 +62,20 @@ pub trait BlockchainBackend {
         HashSet::new()
     }
 
+    /// The silent payment tweak `T = input_hash·A` of every eligible transaction in
+    /// the block at `height`, paired with its txid.
+    ///
+    /// Returns each eligible transaction's `T = input_hash·A` tweak in a block.
+    ///
+    /// Defaults to [`Error::SilentPaymentsUnsupportedByBackend`].
+    #[cfg(feature = "silentpayments")]
+    fn silent_payment_tweaks(
+        &self,
+        _height: Height,
+    ) -> Result<Vec<(Txid, crate::silentpayments::PartialTweak)>, Error> {
+        Err(Error::SilentPaymentsUnsupportedByBackend)
+    }
+
     /// Whether the client is configured to only fetch transactions with unspent outputs (false by default)
     fn utxo_only(&self) -> bool {
         false
@@ -210,7 +224,14 @@ pub trait BlockchainBackend {
         let tip = self.tip()?;
 
         let history_txs_id: HashSet<Txid> = txid_height.keys().cloned().collect();
-        let new_txs = self.download_txs(&history_txs_id, &scripts, state, &descriptor)?;
+        #[cfg_attr(not(feature = "silentpayments"), allow(unused_mut))]
+        let mut new_txs = self.download_txs(&history_txs_id, &scripts, state, &descriptor)?;
+
+        // Silent payments are discovered here rather than left to the caller because
+        // they are wallet money like any other: a `full_scan` that skipped them would
+        // report a balance that is missing funds the wallet can actually spend.
+        #[cfg(feature = "silentpayments")]
+        let silent_payments = self.scan_silent_payments_for(state, &tip, &mut new_txs)?;
 
         let history_txs_heights_plus_tip: HashSet<Height> = txid_height
             .values()
@@ -259,6 +280,9 @@ pub trait BlockchainBackend {
                 .collect();
 
             let update = Update {
+                #[cfg(feature = "silentpayments")]
+                version: if silent_payments.is_some() { 6 } else { 4 },
+                #[cfg(not(feature = "silentpayments"))]
                 version: 4,
                 wollet_status,
                 new_txs,
@@ -270,7 +294,7 @@ pub trait BlockchainBackend {
                 unspent,
                 last_unused,
                 #[cfg(feature = "silentpayments")]
-                silent_payments: None,
+                silent_payments,
             };
             Ok(Some(update))
         } else {
@@ -278,6 +302,174 @@ pub trait BlockchainBackend {
         }
     }
 
+    /// Run silent payment discovery as part of a full scan, appending any transactions
+    /// it found to `new_txs` so the outputs have a transaction to hang off.
+    ///
+    /// Returns `None` when discovery did not run.
+    #[cfg(feature = "silentpayments")]
+    fn scan_silent_payments_for<S: WolletState>(
+        &self,
+        state: &S,
+        tip: &BlockHeader,
+        new_txs: &mut DownloadTxResult,
+    ) -> Result<Option<crate::update::SilentPaymentsUpdate>, Error> {
+        let Some(material) = state.silent_payment_material() else {
+            return Ok(None);
+        };
+        if !self.capabilities().contains(&Capability::SilentPayments) {
+            return Ok(None);
+        }
+
+        // Resume where discovery last reached, not from the wallet tip: the two advance
+        // independently, and starting from the tip would skip every block between. On a
+        // wallet that has never scanned this is the configured birthday.
+        let from = state.silent_payments_scan_from();
+        if from > tip.height {
+            return Ok(None);
+        }
+
+        let sync = crate::silentpayments::SilentPaymentSync::new(*material)
+            .with_labels([crate::silentpayments::CHANGE_LABEL]);
+        let hits = self.scan_silent_payments_with_tweaks(&sync, from, tip.height)?;
+
+        // Scan with the tweak discovery already computed. Deriving it again here would
+        // need the prevout scriptPubKeys, which a light client does not have — passing
+        // an empty prevout lookup would make every input ineligible and find nothing.
+        let scanner = crate::silentpayments::SilentPaymentTxScanner::new(*material)
+            .with_labels([crate::silentpayments::CHANGE_LABEL]);
+        let mut found = Vec::new();
+        for (tx, tweak) in &hits {
+            for utxo in scanner.scan_tx_with_tweak(tx, tweak) {
+                found.push((utxo.cache_entry(), utxo.unblinded));
+            }
+        }
+        let txs: Vec<Transaction> = hits.into_iter().map(|(tx, _)| tx).collect();
+
+        // The transactions discovery fetched are not in the descriptor-derived history,
+        // so nothing else in this scan would add them. Without them the outputs would
+        // have no confirmation height and `apply_silent_payments`-style bookkeeping
+        // would have nothing to attach to.
+        if !found.is_empty() {
+            let known: HashSet<Txid> = new_txs.txs.iter().map(|(txid, _)| *txid).collect();
+            for tx in txs {
+                let txid = tx.txid();
+                if !known.contains(&txid) {
+                    new_txs.txs.push((txid, tx));
+                }
+            }
+        }
+
+        Ok(Some(crate::update::SilentPaymentsUpdate {
+            found,
+            scanned_to: tip.height,
+        }))
+    }
+
+    /// Find the silent payments to `state`'s scan keys in the blocks `from_height..=to_height`.
+    ///
+    /// Returns the transactions that pay this wallet, for the caller to scan and apply.
+    ///
+    /// Requires [`Capability::SilentPayments`].
+    #[cfg(feature = "silentpayments")]
+    fn scan_silent_payments(
+        &self,
+        sync: &crate::silentpayments::SilentPaymentSync,
+        from_height: Height,
+        to_height: Height,
+    ) -> Result<Vec<Transaction>, Error> {
+        if !self.capabilities().contains(&Capability::SilentPayments) {
+            return Err(Error::SilentPaymentsUnsupportedByBackend);
+        }
+
+        let mut tweaks = Vec::new();
+        for height in from_height..=to_height {
+            tweaks.extend(self.silent_payment_tweaks(height)?);
+        }
+        if tweaks.is_empty() {
+            return Ok(Vec::new());
+        }
+
+        let candidates = sync.candidate_scripts(&tweaks);
+        let scripts: Vec<Script> = candidates.keys().cloned().collect();
+        let script_refs: Vec<&Script> = scripts.iter().collect();
+        let histories = self.get_scripts_history(&script_refs)?;
+
+        let seen: Vec<Script> = histories
+            .iter()
+            .zip(scripts.iter())
+            .filter(|(history, _)| !history.is_empty())
+            .map(|(_, script)| script.clone())
+            .collect();
+
+        let to_fetch: Vec<Txid> = sync
+            .tweaks_to_scan(&tweaks, &seen)
+            .into_iter()
+            .map(|(txid, _)| txid)
+            .collect();
+        if to_fetch.is_empty() {
+            return Ok(Vec::new());
+        }
+
+        self.get_transactions(&to_fetch)
+    }
+
+    /// As [`Self::scan_silent_payments()`], but keeps each transaction paired with the
+    /// tweak that found it.
+    ///
+    /// Scanning a transaction needs `T = input_hash·A`, which is normally recovered from
+    /// the scriptPubKeys its inputs spend — prevouts a light client does not have. But
+    /// discovery already computed that tweak in order to derive the candidate scripts,
+    /// so returning it turns an impossible lookup into a value we are holding anyway.
+    #[cfg(feature = "silentpayments")]
+    fn scan_silent_payments_with_tweaks(
+        &self,
+        sync: &crate::silentpayments::SilentPaymentSync,
+        from_height: Height,
+        to_height: Height,
+    ) -> Result<Vec<(Transaction, crate::silentpayments::PartialTweak)>, Error> {
+        if !self.capabilities().contains(&Capability::SilentPayments) {
+            return Err(Error::SilentPaymentsUnsupportedByBackend);
+        }
+
+        let mut tweaks = Vec::new();
+        for height in from_height..=to_height {
+            tweaks.extend(self.silent_payment_tweaks(height)?);
+        }
+        if tweaks.is_empty() {
+            return Ok(Vec::new());
+        }
+
+        let candidates = sync.candidate_scripts(&tweaks);
+        let scripts: Vec<Script> = candidates.keys().cloned().collect();
+        let script_refs: Vec<&Script> = scripts.iter().collect();
+        let histories = self.get_scripts_history(&script_refs)?;
+
+        let seen: Vec<Script> = histories
+            .iter()
+            .zip(scripts.iter())
+            .filter(|(history, _)| !history.is_empty())
+            .map(|(_, script)| script.clone())
+            .collect();
+
+        let hits = sync.tweaks_to_scan(&tweaks, &seen);
+        if hits.is_empty() {
+            return Ok(Vec::new());
+        }
+
+        let txids: Vec<Txid> = hits.iter().map(|(txid, _)| *txid).collect();
+        let txs = self.get_transactions(&txids)?;
+
+        // Re-pair by txid rather than trusting order: `get_transactions` gives no
+        // ordering guarantee, and mismatching a transaction with another's tweak would
+        // silently scan with the wrong shared secret and find nothing.
+        let by_txid: HashMap<Txid, crate::silentpayments::PartialTweak> =
+            hits.into_iter().collect();
+        Ok(txs
+            .into_iter()
+            .filter_map(|tx| by_txid.get(&tx.txid()).map(|tweak| (tx, *tweak)))
+            .collect())
+    }
+
     /// Download and unblind the transactions
     fn download_txs<S: WolletState>(
         &self,
@@ -375,3 +567,274 @@ pub trait BlockchainBackend {
         Ok(has_any_tx)
     }
 }
+
+#[cfg(all(test, feature = "silentpayments"))]
+mod silentpayments_tests {
+    use super::*;
+    use crate::silentpayments::test_fixture::SilentPaymentTestData as Data;
+    use crate::silentpayments::test_fixture::SpPaymentBuilder;
+    use crate::silentpayments::{PartialTweak, SilentPaymentScanMaterial, SilentPaymentSync};
+
+    /// A backend serving canned tweaks and script histories, standing in for a server
+    /// with [`Capability::SilentPayments`].
+    struct MockBackend {
+        tweaks: Vec<(Txid, PartialTweak)>,
+        /// Scripts that exist on chain.
+        on_chain: HashSet<Script>,
+        txs: HashMap<Txid, Transaction>,
+        supports_sp: bool,
+        /// Records what was actually downloaded, to prove the narrowing works.
+        fetched: std::cell::RefCell<Vec<Txid>>,
+    }
+
+    impl MockBackend {
+        /// A header at `height`, enough for the scan machinery (which only reads the
+        /// height and time).
+        fn header_at(height: Height) -> BlockHeader {
+            let mut h = crate::update::default_blockheader();
+            h.height = height;
+            h.time = 1_600_000_000 + height;
+            h
+        }
+    }
+
+    impl BlockchainBackend for MockBackend {
+        fn tip(&mut self) -> Result<BlockHeader, Error> {
+            Ok(Self::header_at(1))
+        }
+        fn broadcast(&self, _tx: &Transaction) -> Result<Txid, Error> {
+            unimplemented!("not exercised")
+        }
+        fn get_transactions(&self, txids: &[Txid]) -> Result<Vec<Transaction>, Error> {
+            self.fetched.borrow_mut().extend_from_slice(txids);
+            Ok(txids
+                .iter()
+                .filter_map(|t| self.txs.get(t).cloned())
+                .collect())
+        }
+        fn get_headers(
+            &self,
+            heights: &[Height],
+            _height_blockhash: &HashMap<Height, BlockHash>,
+        ) -> Result<Vec<BlockHeader>, Error> {
+            Ok(heights.iter().copied().map(Self::header_at).collect())
+        }
+        fn get_scripts_history(&self, scripts: &[&Script]) -> Result<Vec<Vec<History>>, Error> {
+            Ok(scripts
+                .iter()
+                .map(|s| {
+                    if self.on_chain.contains(*s) {
+                        vec![History {
+                            txid: Txid::from_raw_hash(
+                                <elements::hashes::sha256d::Hash as elements::hashes::Hash>::all_zeros(),
+                            ),
+                            height: 1,
+                            block_hash: None,
+                            block_timestamp: None,
+                            v: 0,
+                        }]
+                    } else {
+                        vec![]
+                    }
+                })
+                .collect())
+        }
+        fn capabilities(&self) -> HashSet<Capability> {
+            let mut caps = HashSet::new();
+            if self.supports_sp {
+                caps.insert(Capability::SilentPayments);
+            }
+            caps
+        }
+        fn silent_payment_tweaks(
+            &self,
+            _height: Height,
+        ) -> Result<Vec<(Txid, PartialTweak)>, Error> {
+            Ok(self.tweaks.clone())
+        }
+    }
+
+    /// A transaction paying `keys` a silent payment, plus its tweak.
+    fn paying_tx(keys: &SilentPaymentScanMaterial) -> (Transaction, PartialTweak) {
+        let payment = SpPaymentBuilder::new()
+            .with_inputs(&[(Data::outpoint(0x10, 0), Data::secret_key(0x31))])
+            .with_value(1000)
+            .without_extra_output()
+            .build_for(keys);
+        (payment.tx, payment.tweak)
+    }
+
+    fn keys() -> SilentPaymentScanMaterial {
+        SilentPaymentScanMaterial::new(
+            crate::silentpayments::SilentPaymentAccount::liquid_testnet(0),
+            Data::secret_key(0x11),
+            Data::secret_key(0x22).public_key(&crate::util::EC),
+        )
+    }
+
+    /// A tweak whose candidates are not on chain must cost no transaction download.
+    /// This is the property that makes scanning a block range affordable; without it
+    /// the wallet would fetch every tweaked transaction in every block.
+    #[test]
+    fn unrelated_transactions_are_never_downloaded() {
+        let keys = keys();
+        let (tx, tweak) = paying_tx(&keys);
+
+        // The tweak is published, but none of our candidate scripts exist on chain
+        // (i.e. the payment was to somebody else).
+        let backend = MockBackend {
+            tweaks: vec![(tx.txid(), tweak)],
+            on_chain: HashSet::new(),
+            txs: [(tx.txid(), tx.clone())].into_iter().collect(),
+            supports_sp: true,
+            fetched: Default::default(),
+        };
+
+        let found = backend
+            .scan_silent_payments(&SilentPaymentSync::new(keys), 1, 1)
+            .unwrap();
+
+        assert!(found.is_empty());
+        assert!(
+            backend.fetched.borrow().is_empty(),
+            "no transaction should be downloaded when no candidate is on chain"
+        );
+    }
+
+    /// A backend that cannot discover silent payments must say so. Reporting an empty
+    /// result would be indistinguishable from "you received nothing", which is exactly
+    /// how funds appear to go missing.
+    #[test]
+    fn backend_without_capability_errors() {
+        let backend = MockBackend {
+            tweaks: vec![],
+            on_chain: HashSet::new(),
+            txs: HashMap::new(),
+            supports_sp: false,
+            fetched: Default::default(),
+        };
+
+        let err = backend
+            .scan_silent_payments(&SilentPaymentSync::new(keys()), 1, 1)
+            .unwrap_err();
+        assert!(matches!(err, Error::SilentPaymentsUnsupportedByBackend));
+    }
+
+    /// Capability and tweak support must be provided together.
+    #[test]
+    fn advertising_the_capability_without_implementing_tweaks_is_a_contradiction() {
+        struct LyingBackend;
+
+        impl BlockchainBackend for LyingBackend {
+            fn tip(&mut self) -> Result<BlockHeader, Error> {
+                unimplemented!("not exercised")
+            }
+            fn broadcast(&self, _tx: &Transaction) -> Result<Txid, Error> {
+                unimplemented!("not exercised")
+            }
+            fn get_transactions(&self, _txids: &[Txid]) -> Result<Vec<Transaction>, Error> {
+                unimplemented!("not exercised")
+            }
+            fn get_headers(
+                &self,
+                _heights: &[Height],
+                _height_blockhash: &HashMap<Height, BlockHash>,
+            ) -> Result<Vec<BlockHeader>, Error> {
+                unimplemented!("not exercised")
+            }
+            fn get_scripts_history(
+                &self,
+                _scripts: &[&Script],
+            ) -> Result<Vec<Vec<History>>, Error> {
+                unimplemented!("not exercised")
+            }
+            fn capabilities(&self) -> HashSet<Capability> {
+                [Capability::SilentPayments].into_iter().collect()
+            }
+        }
+
+        let err = LyingBackend
+            .scan_silent_payments(&SilentPaymentSync::new(keys()), 1, 1)
+            .unwrap_err();
+        assert!(matches!(err, Error::SilentPaymentsUnsupportedByBackend));
+    }
+
+    #[test]
+    fn discovery_resumes_after_progress_and_otherwise_at_the_birthday() {
+        use crate::wollet::WolletState;
+        use crate::{Network, WolletBuilder};
+
+        let build = |birthday: Option<u32>| {
+            let desc: crate::WolletDescriptor =
+                lwk_test_util::wollet_descriptor_string().parse().unwrap();
+            let mut builder = WolletBuilder::new(Network::default_regtest(), desc)
+                .with_silent_payment_material(keys());
+            if let Some(birthday) = birthday {
+                builder = builder.with_silent_payment_birthday(birthday);
+            }
+            builder.build().unwrap()
+        };
+
+        assert_eq!(
+            build(Some(800_000)).silent_payments_scan_from(),
+            800_000,
+            "a wallet that never scanned must start at its birthday"
+        );
+        assert_eq!(
+            build(None).silent_payments_scan_from(),
+            0,
+            "without a birthday the first scan starts at genesis"
+        );
+
+        for (scanned_to, expected, why) in [
+            (
+                900_000,
+                900_001,
+                "a scan must resume after what it already covered, not redo it",
+            ),
+            (
+                700_000,
+                700_001,
+                "a later birthday must not open a gap the scan skips",
+            ),
+        ] {
+            let mut wollet = build(Some(800_000));
+            wollet.cache.silent_payments_scanned_to = Some(scanned_to);
+            assert_eq!(wollet.silent_payments_scan_from(), expected, "{why}");
+        }
+    }
+
+    /// A wallet without scan keys does not run silent-payment discovery.
+    #[test]
+    fn full_scan_without_scan_keys_does_no_discovery() {
+        use crate::{Network, WolletBuilder};
+
+        let desc: crate::WolletDescriptor =
+            lwk_test_util::wollet_descriptor_string().parse().unwrap();
+        let wollet = WolletBuilder::new(Network::default_regtest(), desc)
+            .build()
+            .unwrap();
+
+        let (tx, tweak) = paying_tx(&keys());
+        let mut backend = MockBackend {
+            tweaks: vec![(tx.txid(), tweak)],
+            on_chain: [tx.output[0].script_pubkey.clone()].into_iter().collect(),
+            txs: [(tx.txid(), tx.clone())].into_iter().collect(),
+            supports_sp: true,
+            fetched: Default::default(),
+        };
+
+        let update = backend.full_scan(&wollet).unwrap();
+
+        assert!(
+            backend.fetched.borrow().is_empty(),
+            "a wallet without scan keys must not download silent payment candidates"
+        );
+        if let Some(update) = update {
+            assert!(
+                update.silent_payments.is_none(),
+                "no scan keys means no discovery claim, so a later scan starts from scratch"
+            );
+        }
+    }
+}
diff --git a/lwk_wollet/src/clients/blocking/waterfalls.rs b/lwk_wollet/src/clients/blocking/waterfalls.rs
index 40ba42d5f..780ec4b24 100644
--- a/lwk_wollet/src/clients/blocking/waterfalls.rs
+++ b/lwk_wollet/src/clients/blocking/waterfalls.rs
@@ -317,6 +317,22 @@ impl BlockchainBackend for WaterfallsClient {
         self.client.capabilities()
     }
 
+    /// Waterfalls wraps an Esplora client, so tweaks are computed from blocks exactly as
+    /// there. Forwarding is not optional: [`Self::capabilities()`] inherits
+    /// [`Capability::SilentPayments`] from the inner client, so without this the backend
+    /// would advertise discovery and then fail on the trait default.
+    ///
+    /// This is the client-side fallback, not the endgame — a Waterfalls *server* already
+    /// indexes every block and could serve tweaks directly, which is what would make
+    /// discovery cheap for browser wallets.
+    #[cfg(feature = "silentpayments")]
+    fn silent_payment_tweaks(
+        &self,
+        height: Height,
+    ) -> Result<Vec<(Txid, crate::silentpayments::PartialTweak)>, Error> {
+        self.rt.block_on(self.client.silent_payment_tweaks(height))
+    }
+
     fn get_history_waterfalls<S: WolletState>(
         &mut self,
         descriptor: &WolletDescriptor,
diff --git a/lwk_wollet/src/clients/mod.rs b/lwk_wollet/src/clients/mod.rs
index cd376f505..42d8304b2 100644
--- a/lwk_wollet/src/clients/mod.rs
+++ b/lwk_wollet/src/clients/mod.rs
@@ -289,6 +289,20 @@ pub struct Data {
 pub enum Capability {
     /// Can interfact with a Waterfalls data source
     Waterfalls,
+
+    /// Can supply per-block silent payment tweaks (`T = input_hash·A`).
+    ///
+    /// Silent payment outputs match no descriptor-derived script, so script-history
+    /// queries can never surface them however deep they scan. Discovery instead needs
+    /// the tweak of every eligible transaction, from which a wallet derives the
+    /// candidate outputs its scan key would own.
+    ///
+    /// A backend earns this either by serving tweaks from an index (the BIP-352
+    /// index-server model) or by computing them locally from downloaded blocks; both
+    /// answer [`blocking::BlockchainBackend::silent_payment_tweaks()`] identically, so
+    /// the wallet-side scan does not care which.
+    #[cfg(feature = "silentpayments")]
+    SilentPayments,
 }
 
 #[derive(Debug, Clone, Deserialize)]
diff --git a/lwk_wollet/src/silentpayments/test_fixture.rs b/lwk_wollet/src/silentpayments/test_fixture.rs
index fa8d86eab..d57753d67 100644
--- a/lwk_wollet/src/silentpayments/test_fixture.rs
+++ b/lwk_wollet/src/silentpayments/test_fixture.rs
@@ -6,7 +6,7 @@ use crate::elements::{
 };
 use crate::secp256k1::SecretKey;
 use crate::silentpayments::{
-    SilentPaymentAddress, SilentPaymentScan, SilentPaymentScanMaterial,
+    PartialTweak, SilentPaymentAddress, SilentPaymentScan, SilentPaymentScanMaterial,
     SilentPaymentSender, SpTxOutBuilder,
 };
 use lwk_test_util::ElementsTestData;
@@ -44,6 +44,8 @@ pub(crate) struct SpPayment {
     pub(crate) tx: Transaction,
     /// The scriptPubKeys the transaction's inputs spend.
     pub(crate) prevouts: Vec<(OutPoint, Script)>,
+    /// `T = input_hash·A`, as a tweak server would publish it.
+    pub(crate) tweak: PartialTweak,
 }
 
 impl SpPayment {
@@ -116,6 +118,7 @@ impl SpPaymentBuilder {
         let sender = SilentPaymentSender::from_inputs(&self.inputs)
             .expect("the fixture's inputs must aggregate");
         let output = sender.derive_output(address, self.k);
+        let tweak = PartialTweak::from_observed(&sender.inputs().observed());
 
         let (sp_txout, _) =
             SpTxOutBuilder::build(&output, self.asset, self.value, &mut rand::thread_rng())
@@ -142,6 +145,7 @@ impl SpPaymentBuilder {
         SpPayment {
             prevouts: self.inputs.iter().map(Self::prevout).collect(),
             tx,
+            tweak,
         }
     }
 

From 54d8848849bfff86f434b221a388b34bbc89e248 Mon Sep 17 00:00:00 2001
From: 42Pupusas <technology@illuminodes.com>
Date: Fri, 31 Jul 2026 16:05:16 -0600
Subject: [PATCH 09/12] wollet: prove silent payments end to end on regtest

The e2e suite runs the full lifecycle against a real elementsd + esplora: send to an lqsp address, discover through full_scan, and spend the discovered output back through the ordinary signer flow. Negative coverage pins that a stranger discovers nothing and that a wallet without scan material claims no discovery. The stray electrum_oidc TODO is dropped: silent payments now exercise the feature-gating CI story it was standing in for.
---
 Cargo.lock                             |  24 +-
 lwk_wollet/CHANGELOG.md                |  13 +
 lwk_wollet/Cargo.toml                  |   7 +-
 lwk_wollet/tests/silentpayments_e2e.rs | 358 +++++++++++++++++++++++++
 4 files changed, 389 insertions(+), 13 deletions(-)
 create mode 100644 lwk_wollet/tests/silentpayments_e2e.rs

diff --git a/Cargo.lock b/Cargo.lock
index 386362352..32bf8a08f 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -588,9 +588,9 @@ checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
 
 [[package]]
 name = "bitflags"
-version = "2.9.4"
+version = "2.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2261d10cca569e4643e526d8dc2e62e433cc8aba21ab764233731f8d369bf394"
+checksum = "b588b76d00fde79687d7646a9b5bdf3cc0f655e0bbd080335a95d7e96f3587da"
 
 [[package]]
 name = "block-buffer"
@@ -1769,7 +1769,7 @@ version = "0.9.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0bf760ebf69878d9fd8f110c89703d90ce35095324d1f1edcb595c63945ee757"
 dependencies = [
- "bitflags 2.9.4",
+ "bitflags 2.13.1",
  "ignore",
  "walkdir",
 ]
@@ -3226,7 +3226,7 @@ version = "0.30.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "74523f3a35e05aba87a1d978330aef40f67b0304ac79c1c00b294c9830543db6"
 dependencies = [
- "bitflags 2.9.4",
+ "bitflags 2.13.1",
  "cfg-if",
  "cfg_aliases",
  "libc",
@@ -3552,7 +3552,7 @@ version = "0.9.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "57206b407293d2bcd3af849ce869d52068623f19e1b5ff8e8778e3309439682b"
 dependencies = [
- "bitflags 2.9.4",
+ "bitflags 2.13.1",
  "getopts",
  "memchr",
  "unicase",
@@ -3722,7 +3722,7 @@ version = "0.5.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ed2bf2547551a7053d6fdfafda3f938979645c44812fbfcda098faae3f1a362d"
 dependencies = [
- "bitflags 2.9.4",
+ "bitflags 2.13.1",
 ]
 
 [[package]]
@@ -3876,7 +3876,7 @@ version = "0.32.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7753b721174eb8ff87a9a0e799e2d7bc3749323e773db92e0984debb00019d6e"
 dependencies = [
- "bitflags 2.9.4",
+ "bitflags 2.13.1",
  "fallible-iterator",
  "fallible-streaming-iterator",
  "hashlink",
@@ -3945,7 +3945,7 @@ version = "0.38.44"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fdb5bc1ae2baa591800df16c9ca78619bf65c0488b41b96ccec5d11220d8c154"
 dependencies = [
- "bitflags 2.9.4",
+ "bitflags 2.13.1",
  "errno",
  "libc",
  "linux-raw-sys 0.4.15",
@@ -3958,7 +3958,7 @@ version = "1.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "146c9e247ccc180c1f61615433868c99f3de3ae256a30a43b49f67c2d9171f34"
 dependencies = [
- "bitflags 2.9.4",
+ "bitflags 2.13.1",
  "errno",
  "libc",
  "linux-raw-sys 0.11.0",
@@ -4344,7 +4344,7 @@ version = "4.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a4d91116f97173694f1642263b2ff837f80d933aa837e2314969f6728f661df3"
 dependencies = [
- "bitflags 2.9.4",
+ "bitflags 2.13.1",
  "cfg-if",
  "core-foundation 0.10.0",
  "core-foundation-sys",
@@ -4701,7 +4701,7 @@ version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3c879d448e9d986b661742763247d3693ed13609438cf3d006f51f5368a5ba6b"
 dependencies = [
- "bitflags 2.9.4",
+ "bitflags 2.13.1",
  "core-foundation 0.9.4",
  "system-configuration-sys",
 ]
@@ -5050,7 +5050,7 @@ version = "0.6.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "adc82fd73de2a9722ac5da747f12383d2bfdb93591ee6c58486e0097890f05f2"
 dependencies = [
- "bitflags 2.9.4",
+ "bitflags 2.13.1",
  "bytes",
  "futures-util",
  "http",
diff --git a/lwk_wollet/CHANGELOG.md b/lwk_wollet/CHANGELOG.md
index d839df988..99740c823 100644
--- a/lwk_wollet/CHANGELOG.md
+++ b/lwk_wollet/CHANGELOG.md
@@ -2,6 +2,19 @@
 
 ## Unreleased
 
+* Add Silent Payments (BIP-352 on Liquid, per the Liquid silent payments ELIP) behind the new default-on `silentpayments` feature, in module `lwk_wollet::silentpayments`:
+  * Send: `TxBuilder::add_silent_payment_recipient()` plus `TxBuilder::finish_silent_payment()`, which needs the funding inputs' private keys (via `SilentPaymentInputProvider`) because the output is derived from the transaction's own inputs. Calling plain `TxBuilder::finish()` with a pending silent payment recipient fails with `Error::SilentPaymentRequiresKeys` rather than dropping the recipient.
+  * Receive: **scan-only** material (`SilentPaymentScanMaterial`, i.e. `b_scan` plus the *public* `B_spend`) is configured once with `WolletBuilder::with_silent_payment_material()`, then `Wollet::silent_payment_address()` and `Wollet::labeled_silent_payment_address()` produce reusable addresses. Obtain it from a signer via `lwk_common::silentpayments::SilentPaymentSigner::silent_payment_scan_material()`, implemented by `lwk_signer::SwSigner`, which derives both ELIP branches (`m/352'/{1776'|1'}/account'/{1'|0'}/0`) and exports only the scan half.
+  * Trust boundary: a `Wollet` can detect, unblind, track and select silent payments, but holds no `b_spend` and so **cannot sign** for them. Scan results carry a `SpendTweak` (the scalar `t_k`, or `t_k + label_tweak_m`), never a completed key; correctness is checked publicly as `B_spend + spend_tweak*G == output spend pubkey`. Spending requires `lwk_signer::SwSigner::sign()`, which re-derives `b_spend` internally, verifies the wallet's tweak against the output being spent, and only then signs. Hardware signers are explicitly unsupported (`SignerError::UnsupportedSilentPayments`) until their protocols expose the necessary operation.
+  * Discovery: `BlockchainBackend::scan_silent_payments()` finds them through a light client. Backends advertise `Capability::SilentPayments` and answer `BlockchainBackend::silent_payment_tweaks()` with each block's `T = input_hash·A`; the wallet derives the candidate scripts those tweaks would produce for its keys and confirms them with the ordinary script-history query, so only transactions that actually pay it are downloaded. Implemented for `EsploraClient`, which computes tweaks from blocks with no server change. A backend without the capability returns `Error::SilentPaymentsUnsupportedByBackend` rather than an empty result.
+  * **Fixed**: silent-payment signatures now commit to the PSET's genesis hash (ELIP-101).
+  * **Fixed**: a crafted PSET naming a silent-payment account with bit 31 set (e.g. `u32::MAX`) panicked the signer instead of erroring, since those values have no hardened BIP-32 form. `SilentPaymentAccount::from_raw` is now checked and returns `SilentPaymentAccountError`; the new `SilentPaymentPsetMetaError::Account` surfaces it at the decode boundary.
+  * Silent-payment discovery and spending are covered end to end on regtest, including network acceptance of the finalized spend.
+  * Spend, standalone: outputs from `scan_silent_payments()` that were never applied to the wallet go through `TxBuilder::add_silent_payment_utxos()`, which registers the funding view *and* keeps the spend tweak. `SilentPaymentUtxo::external_utxo()` alone funds the input but cannot carry the tweak, so it produces an input no signer can complete — its docs now say so and point here.
+  * Spend: coin selection picks silent payment outputs like any other, and `TxBuilder` annotates each such PSET input with `lwk_common::silentpayments::SilentPaymentInputMeta` (account + spend tweak + expected `B_spend`; never a key). This is what stands in for the `bip32_derivation` an SP input cannot have. `lwk_signer::SwSigner::sign()` verifies that metadata against the prevout and signs; a cache entry whose tweak does not verify against the wallet's own `B_spend` is refused at build time rather than shipped as a PSET that could only fail later.
+  * Found outputs are ordinary wallet money: after `Wollet::apply_silent_payments()` they appear in `Wollet::balance()`, `Wollet::utxos()` and `Wollet::txos()`, and coin selection spends them with no silent-payment-specific handling. Only the spend *tweak* is cached, never a spending key. They can still be spent standalone via `SilentPaymentUtxo::external_utxo()`.
+  * Discovery runs as part of `full_scan()`: a wallet built with `WolletBuilder::with_silent_payment_material()` finds silent payments during an ordinary scan, and after `apply_update()` they are in `balance()`, `utxos()` and `txos()` with no silent-payment-specific call. Findings travel in the `Update` (wire version 6) so they are persisted and replayed on restore like everything else a scan finds; older update versions decode unchanged. How far discovery has run is tracked separately from the wallet tip, since a wallet that scanned before its scan material was configured must not treat that history as already searched. `Wollet::status()` incorporates both `B_scan` and `B_spend` (never a secret), so changing signer or account invalidates an incompatible persisted cache.
+  * `Wollet::scan_silent_payments()` remains available for callers holding transactions from a source of their own.
 * Add Waterfalls descriptor subscriptions, returning `tip`, `mempool`, `block`, and `reorg` events that callers can use as wallet rescan hints.
 * Add the `electrum_oidc` feature: `TokenProvider::Blockstream` support for `ElectrumClient` (automatic OAuth2 token fetch, plus invalidate and retry once when the server denies a call with an authentication error). Not available on wasm.
 * `Wollet::assets_owned()` returns all assets ever owned instead of only unspent ones.
diff --git a/lwk_wollet/Cargo.toml b/lwk_wollet/Cargo.toml
index 801d905f2..c881d0bcb 100644
--- a/lwk_wollet/Cargo.toml
+++ b/lwk_wollet/Cargo.toml
@@ -99,7 +99,7 @@ js-sys = { version = "0.3.68" }
 [dev-dependencies]
 lwk_jade = { version = "0.18.1", features = ["test_emulator"] }
 lwk_ledger = { version = "0.18.1", features = ["test_emulator"] }
-lwk_signer = { version = "0.18.1", features = ["jade", "ledger"] }
+lwk_signer = { version = "0.18.1", features = ["jade", "ledger", "silentpayments"] }
 lwk_containers = { version = "0.18.1" }
 lwk_test_util = { version = "0.18.0" }
 lwk_common = { version = "0.18.1", features = ["sqlite"]}
@@ -161,6 +161,11 @@ name = "e2e"
 path = "tests/e2e.rs"
 required-features = ["electrum", "esplora", "amp0"]
 
+[[test]]
+name = "silentpayments_e2e"
+path = "tests/silentpayments_e2e.rs"
+required-features = ["silentpayments", "esplora"]
+
 # Uses `ElectrumClient` and `full_scan_with_electrum_client`, both gated on `electrum`.
 [[example]]
 name = "list_transactions"
diff --git a/lwk_wollet/tests/silentpayments_e2e.rs b/lwk_wollet/tests/silentpayments_e2e.rs
new file mode 100644
index 000000000..2626264af
--- /dev/null
+++ b/lwk_wollet/tests/silentpayments_e2e.rs
@@ -0,0 +1,358 @@
+#![cfg(feature = "silentpayments")]
+
+use lwk_common::silentpayments::{SilentPaymentAccount, SilentPaymentSigner};
+use lwk_common::{singlesig_desc, DescriptorBlindingKey, Signer, Singlesig};
+use lwk_signer::SwSigner;
+use lwk_test_util::{TestEnv, TestEnvBuilder, DEFAULT_SPECULOS_MNEMONIC, TEST_MNEMONIC};
+use lwk_wollet::clients::blocking::{BlockchainBackend, EsploraClient};
+use lwk_wollet::elements::bitcoin::bip32::{ChildNumber, DerivationPath, Xpriv};
+use lwk_wollet::elements::{AssetId, Txid};
+use lwk_wollet::silentpayments::{InputKey, MapInputProvider, SilentPaymentScanMaterial};
+use lwk_wollet::{Capability, Network, Wollet, WolletBuilder, EC};
+
+const FUNDED: u64 = 1_000_000;
+const SENT: u64 = 100_000;
+
+const STRANGER_MNEMONIC: &str = DEFAULT_SPECULOS_MNEMONIC;
+
+/// A regtest environment with a funded sender wallet.
+struct SpEnv {
+    env: TestEnv,
+    client: EsploraClient,
+    signer: SwSigner,
+    sender: Wollet,
+}
+
+impl SpEnv {
+    fn new() -> Self {
+        let env = TestEnvBuilder::from_env().with_esplora().build();
+
+        // Each regtest node mines its own genesis block, and the Elements taproot
+        // sighash commits to that hash. Using the default regtest parameters here
+        // would make the signer commit to a genesis the chain never had, so the
+        // network must come from the running node.
+        let network = env.elementsd_network();
+        let client = EsploraClient::new(&env.esplora_url(), network)
+            .expect("the regtest esplora endpoint must be reachable");
+
+        let signer = SwSigner::new(TEST_MNEMONIC, false).expect("the test mnemonic must be valid");
+        let sender = Self::wallet_for(network, &signer, None);
+
+        let mut this = SpEnv {
+            env,
+            client,
+            signer,
+            sender,
+        };
+        this.fund_sender();
+        this
+    }
+
+    fn wallet_for(
+        network: Network,
+        signer: &SwSigner,
+        material: Option<SilentPaymentScanMaterial>,
+    ) -> Wollet {
+        let desc: lwk_wollet::WolletDescriptor =
+            singlesig_desc(signer, Singlesig::Wpkh, DescriptorBlindingKey::Slip77)
+                .expect("descriptor derivation must succeed")
+                .parse()
+                .expect("the derived descriptor must parse");
+
+        let mut builder = WolletBuilder::new(network, desc);
+        if let Some(material) = material {
+            builder = builder.with_silent_payment_material(material);
+        }
+        builder.build().expect("building the wallet must succeed")
+    }
+
+    fn scan_material(mnemonic: &str) -> SilentPaymentScanMaterial {
+        SwSigner::new(mnemonic, false)
+            .expect("the mnemonic must be valid")
+            .silent_payment_scan_material(SilentPaymentAccount::liquid_testnet(0))
+            .expect("a software signer must export scan material")
+    }
+
+    fn policy_asset(&self) -> AssetId {
+        self.sender.policy_asset()
+    }
+
+    /// Syncs the sender, tolerating a dropped connection.
+    ///
+    /// Callers poll this in a loop, and several regtest nodes running at once
+    /// occasionally drop an HTTP response. A transient failure is retried by the
+    /// next iteration; a real one still fails the surrounding wait.
+    fn sync(&mut self) {
+        if let Ok(Some(update)) = self.client.full_scan(&self.sender) {
+            self.sender
+                .apply_update(update)
+                .expect("applying the sender update must succeed");
+        }
+    }
+
+    fn fund_sender(&mut self) {
+        let address = self
+            .sender
+            .address(None)
+            .expect("deriving an address must succeed")
+            .address()
+            .clone();
+        let txid = self.env.elementsd_sendtoaddress(&address, FUNDED, None);
+        self.env.elementsd_generate(2);
+        self.wait_for_sender_tx(&txid);
+    }
+
+    /// Waits until the sender sees `txid` in a block, returning its height.
+    ///
+    /// Esplora indexes a transaction as soon as it reaches the mempool, so
+    /// waiting for mere presence would race the confirmation we assert on.
+    fn wait_for_sender_tx(&mut self, txid: &Txid) -> u32 {
+        for _ in 0..120 {
+            self.sync();
+            if let Some(height) = self
+                .sender
+                .transaction(txid)
+                .expect("looking up a transaction must succeed")
+                .and_then(|tx| tx.height)
+            {
+                return height;
+            }
+            std::thread::sleep(std::time::Duration::from_millis(500));
+        }
+        panic!("the sender never saw {txid} confirmed");
+    }
+
+    /// Provides keys for the sender's current UTXOs.
+    fn input_provider_for_utxos(&self) -> MapInputProvider {
+        let master = Xpriv::new_master(
+            lwk_wollet::elements::bitcoin::Network::Regtest,
+            &lwk_signer::bip39::Mnemonic::parse(TEST_MNEMONIC)
+                .expect("the test mnemonic must parse")
+                .to_seed(""),
+        )
+        .expect("deriving a master key must succeed");
+
+        let account: DerivationPath = "m/84'/1'/0'"
+            .parse()
+            .expect("the account path must be valid");
+
+        self.sender
+            .utxos()
+            .expect("listing the sender's UTXOs must succeed")
+            .into_iter()
+            .map(|utxo| {
+                let path = account
+                    .child(
+                        ChildNumber::from_normal_idx(utxo.ext_int as u32)
+                            .expect("the chain index is normal"),
+                    )
+                    .child(
+                        ChildNumber::from_normal_idx(utxo.wildcard_index)
+                            .expect("the address index is normal"),
+                    );
+                let key = master
+                    .derive_priv(&EC, &path)
+                    .expect("deriving a wallet key must succeed")
+                    .private_key;
+                (utxo.outpoint, InputKey::Plain(key))
+            })
+            .collect()
+    }
+
+    /// Sends to `sp_address`, confirms, and returns the txid and height.
+    fn send_silent_payment(&mut self, sp_address: &str, satoshi: u64) -> (Txid, u32) {
+        let asset = self.policy_asset();
+        let mut pset = self
+            .sender
+            .tx_builder()
+            .add_silent_payment_recipient(sp_address, satoshi, asset)
+            .expect("adding a silent payment recipient must succeed")
+            .finish_silent_payment(&self.input_provider_for_utxos())
+            .expect("building the silent payment must succeed");
+
+        self.signer.sign(&mut pset).expect("signing must succeed");
+        let tx = self
+            .sender
+            .finalize(&mut pset)
+            .expect("the signed transaction must finalize");
+
+        let txid = self
+            .client
+            .broadcast(&tx)
+            .expect("broadcasting must succeed");
+        self.env.elementsd_generate(2);
+        let height = self.wait_for_sender_tx(&txid);
+
+        (txid, height)
+    }
+
+    /// Builds a recipient wallet with unrelated descriptor data.
+    fn recipient(&self, material: SilentPaymentScanMaterial, birthday: u32) -> Wollet {
+        let signer = SwSigner::new(STRANGER_MNEMONIC, false).expect("the mnemonic must be valid");
+        let desc: lwk_wollet::WolletDescriptor =
+            singlesig_desc(&signer, Singlesig::Wpkh, DescriptorBlindingKey::Slip77)
+                .expect("descriptor derivation must succeed")
+                .parse()
+                .expect("the derived descriptor must parse");
+
+        WolletBuilder::new(self.env.elementsd_network(), desc)
+            .with_silent_payment_material(material)
+            .with_silent_payment_birthday(birthday)
+            .build()
+            .expect("building the recipient must succeed")
+    }
+
+    fn scan(&mut self, wollet: &mut Wollet) {
+        if let Some(update) = self
+            .client
+            .full_scan(wollet)
+            .expect("scanning must succeed")
+        {
+            wollet
+                .apply_update(update)
+                .expect("applying the update must succeed");
+        }
+    }
+
+    fn balance(wollet: &Wollet, asset: &AssetId) -> u64 {
+        wollet
+            .balance()
+            .expect("computing the balance must succeed")
+            .get(asset)
+            .copied()
+            .unwrap_or(0)
+    }
+}
+
+#[test]
+fn regtest_esplora_advertises_silent_payments() {
+    let env = TestEnvBuilder::from_env().with_esplora().build();
+    let client = EsploraClient::new(&env.esplora_url(), env.elementsd_network()).unwrap();
+
+    assert!(
+        client.capabilities().contains(&Capability::SilentPayments),
+        "esplora computes tweaks client-side, so it must advertise discovery"
+    );
+}
+
+#[test]
+fn a_silent_payment_is_sent_discovered_and_spent() {
+    let mut env = SpEnv::new();
+    let asset = env.policy_asset();
+    let material = SpEnv::scan_material(TEST_MNEMONIC);
+
+    let birthday = env.sender.tip().height();
+    let sp_address = env
+        .recipient(material, birthday)
+        .silent_payment_address()
+        .expect("a wallet with scan material must state where to pay it");
+
+    let (txid, height) = env.send_silent_payment(&sp_address, SENT);
+
+    let mut recipient = env.recipient(material, birthday);
+    env.scan(&mut recipient);
+
+    assert_eq!(
+        SpEnv::balance(&recipient, &asset),
+        SENT,
+        "discovery must find the payment and count it in the balance"
+    );
+
+    let utxo = recipient
+        .utxos()
+        .expect("listing the recipient's UTXOs must succeed")
+        .into_iter()
+        .find(|u| u.outpoint.txid == txid)
+        .expect("the discovered UTXO must come from the broadcast transaction");
+    assert_eq!(utxo.unblinded.value, SENT);
+
+    assert_eq!(
+        recipient.silent_payments_scanned_to(),
+        Some(env.sender.tip().height()),
+        "a completed scan must record how far discovery reached"
+    );
+    assert!(height >= birthday);
+
+    let change = env
+        .sender
+        .address(None)
+        .expect("deriving an address must succeed")
+        .address()
+        .clone();
+    let mut pset = recipient
+        .tx_builder()
+        .add_recipient(&change, SENT / 2, asset)
+        .expect("adding a recipient must succeed")
+        .finish()
+        .expect("coin selection must fund the spend from the discovered payment");
+
+    let signer = SwSigner::new(TEST_MNEMONIC, false).unwrap();
+    let signed = signer
+        .sign(&mut pset)
+        .expect("the signer must sign the silent payment input");
+    assert_eq!(signed, 1, "exactly the silent payment input is signed");
+
+    let tx = recipient
+        .finalize(&mut pset)
+        .expect("the signed spend must finalize");
+    let spend_txid = env
+        .client
+        .broadcast(&tx)
+        .expect("the network must accept the spend of a silent payment output");
+    env.env.elementsd_generate(2);
+
+    env.scan(&mut recipient);
+    assert!(
+        SpEnv::balance(&recipient, &asset) < SENT,
+        "spending the discovered payment must reduce the balance"
+    );
+    assert!(
+        recipient
+            .transaction(&spend_txid)
+            .expect("looking up the spend must succeed")
+            .is_some(),
+        "the wallet must see its own spend confirmed"
+    );
+}
+
+#[test]
+fn a_stranger_does_not_discover_the_payment() {
+    let mut env = SpEnv::new();
+    let asset = env.policy_asset();
+    let material = SpEnv::scan_material(TEST_MNEMONIC);
+
+    let birthday = env.sender.tip().height();
+    let sp_address = env
+        .recipient(material, birthday)
+        .silent_payment_address()
+        .expect("a wallet with scan material must state where to pay it");
+
+    env.send_silent_payment(&sp_address, SENT);
+
+    let stranger_material = SpEnv::scan_material(STRANGER_MNEMONIC);
+    let mut stranger = env.recipient(stranger_material, birthday);
+    env.scan(&mut stranger);
+
+    assert_eq!(
+        SpEnv::balance(&stranger, &asset),
+        0,
+        "different scan material must not discover this payment"
+    );
+}
+
+#[test]
+fn full_scan_without_scan_material_claims_no_discovery() {
+    let mut env = SpEnv::new();
+
+    let update = env
+        .client
+        .full_scan(&env.sender)
+        .expect("a full scan must succeed");
+
+    if let Some(update) = update {
+        assert!(
+            update.silent_payments.is_none(),
+            "no scan material means no discovery claim, so adding it later rescans history"
+        );
+    }
+}

From bda7701950e30398c8b5cd07ef711f0681bb9ae4 Mon Sep 17 00:00:00 2001
From: 42Pupusas <technology@illuminodes.com>
Date: Mon, 3 Aug 2026 08:30:30 -0600
Subject: [PATCH 10/12] wollet: make silentpayments opt-in

The feature shipped default-on, which quietly enrolls every downstream consumer of lwk_wollet in a new protocol before it has settled. Opt-in matches lwk_common and lwk_signer, where it always was.

CI only builds default features, so the code would otherwise compile nowhere: add an explicit feature-on test run covering the three crates.
---
 .github/workflows/cont_integration.yml | 2 ++
 lwk_wollet/CHANGELOG.md                | 2 +-
 lwk_wollet/Cargo.toml                  | 3 +--
 3 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/cont_integration.yml b/.github/workflows/cont_integration.yml
index 11574da46..dba3c2ec2 100644
--- a/.github/workflows/cont_integration.yml
+++ b/.github/workflows/cont_integration.yml
@@ -24,6 +24,8 @@ jobs:
       - run: cargo build
       - run: cargo build --features serial
       - run: cargo test --lib  # integration tests requires binaries for the test env...
+      # `silentpayments` is opt-in, so the default build above never compiles it.
+      - run: cargo test --lib -p lwk_common -p lwk_signer -p lwk_wollet --features lwk_common/silentpayments,lwk_signer/silentpayments,lwk_wollet/silentpayments
 
   nix:
     runs-on: ubuntu-22.04
diff --git a/lwk_wollet/CHANGELOG.md b/lwk_wollet/CHANGELOG.md
index 99740c823..02a8f3add 100644
--- a/lwk_wollet/CHANGELOG.md
+++ b/lwk_wollet/CHANGELOG.md
@@ -2,7 +2,7 @@
 
 ## Unreleased
 
-* Add Silent Payments (BIP-352 on Liquid, per the Liquid silent payments ELIP) behind the new default-on `silentpayments` feature, in module `lwk_wollet::silentpayments`:
+* Add Silent Payments (BIP-352 on Liquid, per the Liquid silent payments ELIP) behind the new opt-in `silentpayments` feature, in module `lwk_wollet::silentpayments`:
   * Send: `TxBuilder::add_silent_payment_recipient()` plus `TxBuilder::finish_silent_payment()`, which needs the funding inputs' private keys (via `SilentPaymentInputProvider`) because the output is derived from the transaction's own inputs. Calling plain `TxBuilder::finish()` with a pending silent payment recipient fails with `Error::SilentPaymentRequiresKeys` rather than dropping the recipient.
   * Receive: **scan-only** material (`SilentPaymentScanMaterial`, i.e. `b_scan` plus the *public* `B_spend`) is configured once with `WolletBuilder::with_silent_payment_material()`, then `Wollet::silent_payment_address()` and `Wollet::labeled_silent_payment_address()` produce reusable addresses. Obtain it from a signer via `lwk_common::silentpayments::SilentPaymentSigner::silent_payment_scan_material()`, implemented by `lwk_signer::SwSigner`, which derives both ELIP branches (`m/352'/{1776'|1'}/account'/{1'|0'}/0`) and exports only the scan half.
   * Trust boundary: a `Wollet` can detect, unblind, track and select silent payments, but holds no `b_spend` and so **cannot sign** for them. Scan results carry a `SpendTweak` (the scalar `t_k`, or `t_k + label_tweak_m`), never a completed key; correctness is checked publicly as `B_spend + spend_tweak*G == output spend pubkey`. Spending requires `lwk_signer::SwSigner::sign()`, which re-derives `b_spend` internally, verifies the wallet's tweak against the output being spent, and only then signs. Hardware signers are explicitly unsupported (`SignerError::UnsupportedSilentPayments`) until their protocols expose the necessary operation.
diff --git a/lwk_wollet/Cargo.toml b/lwk_wollet/Cargo.toml
index c881d0bcb..8db224c73 100644
--- a/lwk_wollet/Cargo.toml
+++ b/lwk_wollet/Cargo.toml
@@ -119,7 +119,6 @@ default = [
     "amp0",
     "prices",
     "registry",
-    "silentpayments",
 ]
 serial = ["lwk_jade/serial"] # this is a dev-dep feature
 esplora = ["reqwest", "age"]
@@ -152,7 +151,7 @@ prices = ["reqwest"]
 registry = ["reqwest"]
 # Silent Payments (BIP-352 on Liquid, per the Liquid silent payments ELIP).
 # The wallet feature scans, unblinds, and tracks outputs; signing remains in
-# `lwk_signer`'s separate `silentpayments` feature.
+# `lwk_signer`'s separate `silentpayments` feature. Opt-in while it settles.
 silentpayments = ["bech32", "lwk_common/silentpayments"]
 
 # The e2e target requires the backend features it imports.

From e421b00fe88d422a874da1824092d7783b0864ea Mon Sep 17 00:00:00 2001
From: 42Pupusas <technology@illuminodes.com>
Date: Mon, 3 Aug 2026 08:35:17 -0600
Subject: [PATCH 11/12] wollet: say why a silent payment input has no
 bip32_derivation

The ELIP does specify a derivation path, so 'has no derivation path' read as if it contradicted the spec. The path reaches b_spend; the key that signs is b_spend + t_k, tweaked by the paying transaction and so off any BIP-32 path. Comments and changelog now say that.
---
 lwk_wollet/CHANGELOG.md      | 2 +-
 lwk_wollet/src/tx_builder.rs | 6 +++---
 lwk_wollet/src/wollet.rs     | 4 ++--
 3 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/lwk_wollet/CHANGELOG.md b/lwk_wollet/CHANGELOG.md
index 02a8f3add..a8ee00129 100644
--- a/lwk_wollet/CHANGELOG.md
+++ b/lwk_wollet/CHANGELOG.md
@@ -11,7 +11,7 @@
   * **Fixed**: a crafted PSET naming a silent-payment account with bit 31 set (e.g. `u32::MAX`) panicked the signer instead of erroring, since those values have no hardened BIP-32 form. `SilentPaymentAccount::from_raw` is now checked and returns `SilentPaymentAccountError`; the new `SilentPaymentPsetMetaError::Account` surfaces it at the decode boundary.
   * Silent-payment discovery and spending are covered end to end on regtest, including network acceptance of the finalized spend.
   * Spend, standalone: outputs from `scan_silent_payments()` that were never applied to the wallet go through `TxBuilder::add_silent_payment_utxos()`, which registers the funding view *and* keeps the spend tweak. `SilentPaymentUtxo::external_utxo()` alone funds the input but cannot carry the tweak, so it produces an input no signer can complete — its docs now say so and point here.
-  * Spend: coin selection picks silent payment outputs like any other, and `TxBuilder` annotates each such PSET input with `lwk_common::silentpayments::SilentPaymentInputMeta` (account + spend tweak + expected `B_spend`; never a key). This is what stands in for the `bip32_derivation` an SP input cannot have. `lwk_signer::SwSigner::sign()` verifies that metadata against the prevout and signs; a cache entry whose tweak does not verify against the wallet's own `B_spend` is refused at build time rather than shipped as a PSET that could only fail later.
+  * Spend: coin selection picks silent payment outputs like any other, and `TxBuilder` annotates each such PSET input with `lwk_common::silentpayments::SilentPaymentInputMeta` (account + spend tweak + expected `B_spend`; never a key). This is what stands in for the `bip32_derivation` an SP input cannot have: the ELIP path `m/352'/1776'/account'/0'/0` reaches `b_spend`, but the key that signs is `b_spend + t_k`, tweaked by the paying transaction and so off any BIP-32 path. `lwk_signer::SwSigner::sign()` verifies that metadata against the prevout and signs; a cache entry whose tweak does not verify against the wallet's own `B_spend` is refused at build time rather than shipped as a PSET that could only fail later.
   * Found outputs are ordinary wallet money: after `Wollet::apply_silent_payments()` they appear in `Wollet::balance()`, `Wollet::utxos()` and `Wollet::txos()`, and coin selection spends them with no silent-payment-specific handling. Only the spend *tweak* is cached, never a spending key. They can still be spent standalone via `SilentPaymentUtxo::external_utxo()`.
   * Discovery runs as part of `full_scan()`: a wallet built with `WolletBuilder::with_silent_payment_material()` finds silent payments during an ordinary scan, and after `apply_update()` they are in `balance()`, `utxos()` and `txos()` with no silent-payment-specific call. Findings travel in the `Update` (wire version 6) so they are persisted and replayed on restore like everything else a scan finds; older update versions decode unchanged. How far discovery has run is tracked separately from the wallet tip, since a wallet that scanned before its scan material was configured must not treat that history as already searched. `Wollet::status()` incorporates both `B_scan` and `B_spend` (never a secret), so changing signer or account invalidates an incompatible persisted cache.
   * `Wollet::scan_silent_payments()` remains available for callers holding transactions from a source of their own.
diff --git a/lwk_wollet/src/tx_builder.rs b/lwk_wollet/src/tx_builder.rs
index 6b04a3377..0cf645999 100644
--- a/lwk_wollet/src/tx_builder.rs
+++ b/lwk_wollet/src/tx_builder.rs
@@ -664,7 +664,7 @@ impl TxBuilder {
     /// [`crate::silentpayments::SilentPaymentUtxo::external_utxo()`] describes how to
     /// *fund* with the output, and that part an [`ExternalUtxo`] carries fine. What it
     /// has nowhere to put is the spend tweak — the one thing a signer cannot rederive,
-    /// since a silent payment output has no derivation path. Passing such an output
+    /// since it comes from the paying transaction rather than a BIP-32 path. Passing such an output
     /// through `add_external_utxos` alone therefore yields a PSET whose input no signer
     /// can complete. This method keeps the tweak attached, and the builder writes it
     /// into the PSET as proprietary metadata for a silent-payment aware signer.
@@ -1756,8 +1756,8 @@ impl TxBuilder {
         // Add details to the pset from our descriptor, like bip32derivation and keyorigin
         wollet.add_details(&mut built_tx.pset)?;
 
-        // The same step for inputs the descriptor cannot describe. A silent payment
-        // output has no derivation path, so `add_details` above passes over it and a
+        // The same step for inputs the descriptor cannot describe. A silent payment key is
+        // `b_spend + t_k`, off any BIP-32 path, so `add_details` above passes over it and a
         // signer would meet an input it cannot recognize; this attaches the tweak that
         // stands in for the missing `bip32_derivation`.
         //
diff --git a/lwk_wollet/src/wollet.rs b/lwk_wollet/src/wollet.rs
index 9cb88b3eb..1623f3a20 100644
--- a/lwk_wollet/src/wollet.rs
+++ b/lwk_wollet/src/wollet.rs
@@ -790,8 +790,8 @@ impl Wollet {
             }
             let height = self.cache.tx_height(&outpoint.txid).unwrap_or(&None);
 
-            // A silent payment output has no derivation path, so it cannot go through
-            // `index()`; it is described by its cache entry instead.
+            // A silent payment script is not derived from the descriptor, so it cannot go
+            // through `index()`; it is described by its cache entry instead.
             #[cfg(feature = "silentpayments")]
             if let Some(entry) = self.cache.silent_payment(script_pubkey) {
                 utxos.push(self.silent_payment_wallet_txout(entry, unblinded, *height)?);

From 066bd8e20e8e9e59966f7eabd730ff60c654ea45 Mon Sep 17 00:00:00 2001
From: 42Pupusas <technology@illuminodes.com>
Date: Mon, 3 Aug 2026 09:49:17 -0600
Subject: [PATCH 12/12] wollet: pin that an unblindable match does not stop the
 scan

The k loop and the gap counter live in the scanner, which matches on
scriptPubKey alone and never sees a TxOut; unblinding happens afterwards in
the tx scanner, so a failed unblind drops the utxo without rewinding k. That
is the ELIP rule, but nothing pinned it: folding the unblind into the scan
loop would let a sender hide every later output of a transaction behind one
matching but unblindable output at k = 0.

The test fails if the unblind failure is turned into a break.
---
 lwk_wollet/src/silentpayments/tx_scan.rs | 57 +++++++++++++++++++++++-
 1 file changed, 56 insertions(+), 1 deletion(-)

diff --git a/lwk_wollet/src/silentpayments/tx_scan.rs b/lwk_wollet/src/silentpayments/tx_scan.rs
index 9de5f6c21..3acecf95f 100644
--- a/lwk_wollet/src/silentpayments/tx_scan.rs
+++ b/lwk_wollet/src/silentpayments/tx_scan.rs
@@ -90,7 +90,9 @@ mod tests {
     use super::*;
     use crate::silentpayments::test_fixture::SilentPaymentTestData as Data;
     use crate::silentpayments::test_fixture::SpPaymentBuilder;
-    use crate::silentpayments::{SilentPaymentScan, CHANGE_LABEL};
+    use crate::silentpayments::{
+        SilentPaymentScan, SilentPaymentSender, SpTxOutBuilder, CHANGE_LABEL,
+    };
 
     fn keys() -> SilentPaymentScanMaterial {
         Data::material(0x11, 0x22)
@@ -153,6 +155,59 @@ mod tests {
         );
     }
 
+    /// A match at `k` advances `k` even when the output does not unblind, otherwise a sender
+    /// could hide later outputs by exhausting the gap limit with unblindable ones.
+    #[test]
+    fn unblindable_match_does_not_stop_the_scan() {
+        let keys = keys();
+        let inputs = [(Data::outpoint(0x44, 0), Data::secret_key(0xC1))];
+        let sender = SilentPaymentSender::from_inputs(&inputs).unwrap();
+        let gap_limit = SilentPaymentScanner::DEFAULT_GAP_LIMIT;
+
+        let mut outputs = Vec::new();
+        for k in 0..gap_limit {
+            let mut output = sender.derive_output(&keys.address(), k);
+            output.blinding_pubkey = Data::material(0xDE, 0xAD).spend_pubkey();
+            let (txout, _) =
+                SpTxOutBuilder::build(&output, Data::asset(), 1_000, &mut rand::thread_rng())
+                    .unwrap();
+            outputs.push(txout);
+        }
+
+        let payable = sender.derive_output(&keys.address(), gap_limit);
+        let (txout, _) =
+            SpTxOutBuilder::build(&payable, Data::asset(), 9_000, &mut rand::thread_rng()).unwrap();
+        outputs.push(txout);
+
+        let tx = Transaction {
+            version: 2,
+            lock_time: crate::elements::LockTime::ZERO,
+            input: inputs
+                .iter()
+                .map(|(o, k)| lwk_test_util::ElementsTestData::p2wpkh_input(*o, k))
+                .collect(),
+            output: outputs,
+        };
+        let prevouts: Vec<_> = inputs
+            .iter()
+            .map(|(o, k)| (*o, lwk_test_util::ElementsTestData::p2wpkh(k)))
+            .collect();
+        let lookup = |o: &OutPoint| prevouts.iter().find(|(p, _)| p == o).map(|(_, s)| s);
+
+        let found = SilentPaymentTxScanner::new(keys).scan_tx(&tx, lookup);
+
+        assert_eq!(
+            found.len(),
+            1,
+            "the unblindable outputs must be dropped, the payable one kept"
+        );
+        assert_eq!(
+            found[0].k, gap_limit,
+            "a match must advance k even when it does not unblind"
+        );
+        assert_eq!(found[0].unblinded.value, 9_000);
+    }
+
     #[test]
     fn tweak_path_agrees_with_prevout_path() {
         let keys = keys();