<blockquote>
  <p>Do they need to pre-generate a list of all possible public keys and watch new blocks for those transactions?</p>
</blockquote>

<p>Essentially. </p>

<blockquote>
  <p>Assuming that there is no limit to BIP32 keys, that means the auditor would need an infinite amount of resources to audit a key (pre generation, and then cross referencing each incoming Tx). What are some appropriate ways to constrain this auditing?</p>
</blockquote>

<p>Deterministic keys are used sequentially. Currently a client will scan up until they hit a sequence of unused addresses in a row and assume none past this gap have been used. </p>

CC BY-SA 3.0
2014-02-18T03:18:45.937Z
2014-02-18T03:18:45.937Z
user13413
<p>I have written tools that an auditor should find very helpful for this purpose.</p>

<p>The tool scans both receive and change addresses up to the gap limit, which is 20 by default (matches the standard), but can be adjusted if wished.</p>

<p>The steps can be as simple as:</p>

<ol>
<li>obtain the Master XPub key for the wallet.</li>
<li>Go <a href="https://mybitprices.info/hd-wallet-addrs.html" rel="nofollow">here</a> to find all the addresses that have ever been used.</li>
<li>Click "Generate Price History Report For These Addresses".  This will generate a transaction history report, with historic USD prices.</li>
</ol>

<p>If the website should not be available for any reason in the future, the tools are open source and can be found on github.</p>

<ol>
<li>github.com/dan-da/hd-wallet-addrs</li>
<li>github.com/dan-da/bitprices</li>
</ol>

CC BY-SA 3.0
2016-02-05T23:49:33.940Z
2016-02-05T23:49:33.940Z
danda
<p>Suppose an auditor needs to review all the incoming Tx for a given wallet... or many wallets.  What are the logical steps the Auditor needs to do?</p>

<p>Do they need to pre-generate a list of all possible public keys and watch new blocks for those transactions?</p>

<p>Assuming that there is no limit to BIP32 keys, that means the auditor would need an infinite amount of resources to audit a key (pre generation, and then cross referencing each incoming Tx).  What are some appropriate ways to constrain this auditing?</p>

<performance><bip32-hd-wallets><deterministic-wallets>
How would an Auditor ("m") of BIP32 audit the keys generated by the master?
makerofthings7
# How would an Auditor ("m") of BIP32 audit the keys generated by the master?

(Asked by: username_0 on 2014-02-17)

Suppose an auditor needs to review all the incoming Tx for a given wallet... or many wallets. What are the logical steps the Auditor needs to do?

Do they need to pre-generate a list of all possible public keys and watch new blocks for those transactions?

Assuming that there is no limit to BIP32 keys, that means the auditor would need an infinite amount of resources to audit a key (pre generation, and then cross referencing each incoming Tx). What are some appropriate ways to constrain this auditing?

**Tags:** performance, bip32-hd-wallets, deterministic-wallets


---

## 2 answers

### Answer by username_1 on 2014-02-18. Score: 1

> Do they need to pre-generate a list of all possible public keys and watch new blocks for those transactions?

Essentially.

> Assuming that there is no limit to BIP32 keys, that means the auditor would need an infinite amount of resources to audit a key (pre generation, and then cross referencing each incoming Tx). What are some appropriate ways to constrain this auditing?

Deterministic keys are used sequentially. Currently a client will scan up until they hit a sequence of unused addresses in a row and assume none past this gap have been used.


---

### Answer by username_2 on 2016-02-05. Score: 1

I have written tools that an auditor should find very helpful for this purpose.

The tool scans both receive and change addresses up to the gap limit, which is 20 by default (matches the standard), but can be adjusted if wished.

The steps can be as simple as:

1. obtain the Master XPub key for the wallet.
2. Go [here](https://mybitprices.info/hd-wallet-addrs.html) to find all the addresses that have ever been used.
3. Click "Generate Price History Report For These Addresses". This will generate a transaction history report, with historic USD prices.

If the website should not be available for any reason in the future, the tools are open source and can be found on github.

1. github.com/dan-da/hd-wallet-addrs
2. github.com/dan-da/bitprices


---

