View tags and scanning cost
How a receiver finds its payments among everyone's, what one byte saves, and what scanning costs today.
Receivers find payments by checking every announcement on the chain. Nobody tells you that you were paid; your client works it out. This page is about what that costs.
The check, per announcement
s′ = p_view · P_e one elliptic-curve multiplication
keccak256(s′)[0] = view tag ? one hash, one byte compared
P_spend + keccak256(s′) · G only on a tag match
addr(…) = stealth ? only on a tag match
The first line is the expensive one and runs for every announcement. The view tag lets the client stop right after it for 255 of every 256 announcements that are not yours, skipping the second multiplication, the point addition and the address hash.
What a view tag reveals
One byte splits all receivers into 256 groups. An observer who sees a tag learns that the receiver is in one group out of 256, among everyone who uses stealth payments. That is a small, deliberate loss, and the reason the tag is one byte and not more.
Measured
| Setup | Result |
|---|---|
| One check: multiplication, hash, byte compare | about 300 announcements per second |
| Library | @noble/curves 1.9, pure JavaScript |
| Machine | one core of a 2.1 GHz cloud server, Node 22 |
| Tag matches in 3,000 random announcements | 8, against 11.7 expected (1 in 256) |
At that rate, 10,000 announcements take about half a minute on one core. That is acceptable for a first scan and fast for the daily catch-up, but it grows with usage. Faster backends (WebAssembly builds of libsecp256k1, several cores) are planned for the client, and we will publish their numbers the same way.
Making it scale
Every client checking every announcement is simple and private, but it does not scale forever. Ways to make it cheaper without handing your viewing key to a server are on the roadmap under The Endgame, as research.
Privacy of scanning itself
Downloading all announcements reveals only that you use stealth payments. Checking balances of the addresses that turned out to be yours does reveal them to your RPC provider. See the trust model.
Key derivation
How the client turns one wallet signature into your spending and viewing keys, why it works that way, and what a leaked signature would allow.
The Announcer and the registry
The two shared contracts every ERC-5564 payment uses, their interfaces, and the byte layout of announcement metadata.