Monero's privacy model separates the ability to view incoming transactions from the ability to spend funds, a cryptographic property that has no direct equivalent in transparent ledgers like Bitcoin or Ethereum. The secret view key (a) enables a wallet to scan the blockchain and identify all outputs destined for its corresponding public address by reconstructing the ECDH shared secret used in the stealth addressing scheme. This allows an exchange, auditor, or compliance team to run a view-only wallet that can prove incoming transaction amounts and confirm deposit completeness without ever holding the secret spend key (b) required to authorize transfers.
Protocols
View-Only Wallet and Audit Key Patterns
How to implement view-only wallets using the secret view key for compliance, accounting, and cold-storage monitoring. Covers proving incoming transaction amounts to auditors without exposing spend authority, and the critical limitation of detecting outgoing transactions via key image imports.
introduction
VIEW-KEY ARCHITECTURE FOR MONERO
Introduction
How to implement view-only wallets using the secret view key for compliance, accounting, and cold-storage monitoring without exposing spend authority.
The operational pattern is straightforward but has a critical limitation: a view-only wallet cannot detect outgoing transactions by default. Because Monero's ring signatures hide the true signer among a set of decoys, the wallet cannot determine if a specific output has been spent simply by scanning the blockchain. To close this gap, operators must import key images—cryptographic proofs of spend authority generated by the hot or cold wallet that holds the spend key. Each imported key image marks a specific output as spent, allowing the view-only wallet to calculate an accurate balance. Without this step, a compliance dashboard will silently show an inflated balance, missing unauthorized or unexpected withdrawals.
For exchange treasury teams and institutional custody operators, this architecture demands a deliberate key image synchronization pipeline. The cold-signing environment must periodically export key images for all consumed outputs and deliver them to the view-only monitoring instance. This process is the sole mechanism for detecting theft, insider threats, or operational errors in a spend-capable wallet. Chainscore Labs can assess the completeness of this pipeline, review the security boundary between view-key and spend-key environments, and verify that monitoring coverage correctly reflects all on-chain activity.
VIEW-ONLY WALLET AND AUDIT KEY PATTERNS
Quick Facts
Operational and cryptographic facts for implementing view-only wallets for compliance, accounting, and cold-storage monitoring without exposing spend authority.
| Area | What changes | Who is affected | Action |
|---|---|---|---|
Key Material | View-only wallets use the secret view key, not the secret spend key. | Exchange compliance teams, auditors, treasury operators | Verify that key generation and storage procedures never expose the secret spend key to the view-only instance. |
Incoming Transaction Detection | All incoming transactions are visible and their amounts can be proven cryptographically. | Accounting departments, compliance officers | Implement automated scanning of incoming transactions and use |
Outgoing Transaction Detection | Outgoing transactions are invisible to a pure view-only wallet. | Security engineers, treasury operators | Recognize this critical monitoring gap. A view-only wallet alone cannot detect unauthorized withdrawals. |
Key Image Import | Importing signed key images enables detection of spent outputs. | Custody infrastructure teams, exchange security engineers | Establish a secure, air-gapped process to export key images from the cold spend wallet and import them into the hot view-only wallet for complete balance tracking. |
Balance Calculation | A displayed balance will be incorrect if key images for spent outputs are not imported. | Accounting departments, financial controllers | Do not rely on the balance shown by a view-only wallet for financial reporting unless a key image synchronization process is confirmed to be complete and up-to-date. |
Audit Scope | A view-only wallet with key images provides a complete, cryptographically verifiable audit trail of all funds. | External auditors, regulatory compliance officers | Use this setup to prove total liabilities and transaction history without granting auditors the ability to spend funds. |
Operational Risk | Failure to import key images leads to an overstatement of funds and missed theft detection. | Exchange operators, protocol treasury managers | Chainscore can assess the completeness and failure-recovery logic of your key image import pipeline to prevent monitoring blind spots. |
technical-context
VIEW-KEY ARCHITECTURE
Technical Mechanism
How Monero's dual-key system separates spend authority from audit capability, enabling view-only wallets that prove incoming transaction amounts without exposing funds to theft.
Monero's account model is built on a pair of elliptic curve keys: a private spend key and a private view key. The spend key authorizes outgoing transactions by generating key images and signing ring signatures. The view key derives a one-time public key for each incoming transaction and can decode the corresponding tx_extra field to reveal the amount and the one-time stealth address that received the funds. This cryptographic separation is the foundation of the view-only wallet pattern, where an auditor or compliance team holds the view key but never the spend key.
A view-only wallet can reconstruct every inbound transaction and prove the exact amount received to a third party. This is critical for exchange treasury reconciliation, cold-storage monitoring, and regulatory audits. However, the view key alone cannot detect outgoing transactions. To monitor for unauthorized withdrawals, the operator must periodically import signed key images from a cold signing device. Each key image proves that a specific output was spent without revealing which ring member consumed it. This import step is the single most important operational control in a view-only custody setup—without it, a compromised hot wallet could drain funds invisibly to the auditor.
The monero-wallet-cli and monero-wallet-rpc both support generating a view-only wallet from keys or from a hardware device export. The export_key_images and import_key_images commands form the bridge between the offline signing environment and the online watchtower. Teams that skip this synchronization step operate with a dangerous monitoring gap. Chainscore can assess whether a view-only wallet deployment correctly covers the full threat model, including key image import frequency, RPC segmentation, and reconciliation logic against on-chain data.
WHO MUST ACT ON VIEW-ONLY WALLET PATTERNS
Affected Actors
Compliance and Audit Teams
View-only wallets are the primary tool for independent audit and regulatory reporting without custody risk. Teams must understand that a wallet loaded with only the secret view key can prove all incoming transaction amounts and destinations cryptographically.
Critical limitation: Outgoing transactions are invisible unless key images are imported. A compliance setup that omits key image imports will miss unauthorized withdrawals entirely.
Action items:
- Verify that audit wallets receive regular key image exports from the spend-capable wallet.
- Use
get_tx_proofto generate non-repudiable payment confirmations for regulators. - Do not treat a view-only wallet without key images as a complete monitoring solution.
Chainscore can assess whether your audit wallet configuration provides the coverage your compliance program assumes.
implementation-impact
VIEW-ONLY WALLET AND AUDIT KEY PATTERNS
Implementation Impact
Implementing view-only wallets for Monero requires careful handling of the secret view key to enable compliance and monitoring without exposing spend authority. The following impact areas highlight critical controls, limitations, and operational steps for exchange compliance teams, auditors, and treasury operators.
01
Secret View Key Exposure Risk
The secret view key can decrypt all incoming transaction amounts and destinations for a wallet. A leak of this key to an unauthorized party provides a complete, permanent log of all future incoming funds. Implement strict access controls, hardware security module (HSM) policies, and key-generation ceremonies that treat the view key with the same sensitivity as a full spend key for confidentiality. Chainscore can review your key-management architecture to ensure the view key is not inadvertently exposed through logging, backups, or API responses.
02
Outgoing Transaction Blind Spot
A view-only wallet cannot detect outgoing transactions by default. This creates a critical monitoring gap where funds can be spent without the auditor's knowledge. The only mitigation is to import signed key images from a cold wallet. This process must be performed regularly and securely to provide a complete picture of wallet activity. Teams should build an operational pipeline for generating, exporting, and importing key images after every spend to maintain audit integrity.
03
Key Image Import Pipeline Integrity
The security of outgoing transaction detection depends entirely on the integrity of the key image import process. If an attacker can inject false key images or prevent the import of legitimate ones, they can hide unauthorized spends. The pipeline from the offline signing device to the view-only wallet must be authenticated and tamper-proof. Chainscore can assess your key image synchronization architecture for man-in-the-middle vulnerabilities and replay-attack resistance.
04
Auditor Trust Assumptions
When providing a secret view key to an auditor, you are trusting them to keep it confidential and not to collude with a third party who might obtain the corresponding key images. A malicious actor with both the view key and a set of key images can reconstruct the entire transaction graph for that wallet. Formalize data-handling agreements and consider using a dedicated audit sub-address for third-party reviews to limit exposure to the entire wallet history.
05
Cold Storage Monitoring Setup
For treasury operations, a view-only wallet is the standard method for monitoring cold storage without exposing the spend key to a networked environment. The setup requires a hot node with the wallet's view key and a regular import of key images from the offline signing device. Ensure your operational playbook defines the frequency of key image imports and includes reconciliation procedures to verify that the view-only wallet's balance matches the expected cold storage holdings.
06
Completeness of Monitoring Coverage
A view-only wallet setup is only as complete as its key image set. If a key image import is missed, the corresponding spent output will still appear as an unspent balance, leading to an overstatement of funds. Implement automated alerts that trigger when the time since the last key image import exceeds a defined threshold. Chainscore can review your monitoring dashboards and alerting logic to ensure they accurately reflect the known limitations of the current key image state.
VIEW-ONLY WALLET AND AUDIT KEY PATTERNS
Risk Matrix
Operational and security risks introduced by view-only wallet deployments for compliance, accounting, and cold-storage monitoring.
| Area | Failure Mode | Severity | Affected Actors | Mitigation |
|---|---|---|---|---|
Outgoing Transaction Detection | View-only wallets cannot detect spent outputs without importing key images. Unauthorized spends remain invisible. | Critical | Exchange compliance teams, treasury operators, auditors | Implement a key image import pipeline from the signing wallet to the view-only instance after every sweep. |
Key Image Sync Gap | A delay between transaction signing and key image import creates a monitoring blind spot where funds can be spent and not observed. | High | Custody providers, security engineers | Automate key image export and import as a synchronous step in the transaction signing workflow. |
Audit Key Exposure | Sharing the secret view key with an auditor reveals all historical and future incoming transactions, breaking financial privacy. | High | Treasury operators, accountants | Use a dedicated audit wallet with a subset of funds rather than exposing the primary wallet's view key. |
Incomplete Balance Calculation | A view-only wallet calculates balance as (sum of incoming) - (sum of imported key images). Missing a single key image overstates the balance. | Medium | Accounting teams, financial controllers | Reconcile view-only balances against the signing wallet's actual balance at regular intervals. |
Cold Storage Monitoring Lag | View-only wallets connected to a full node may not reflect the latest chain state if the node is desynchronized or rate-limited. | Medium | Infrastructure operators, node operators | Monitor the connected daemon's block height and implement alerts if it falls behind the network tip. |
Restore Height Misconfiguration | Restoring a view-only wallet with a restore height higher than the first transaction's block height permanently hides those incoming funds. | Medium | Wallet developers, exchange infrastructure teams | Always set the restore height to a point well before the wallet's creation date or first known transaction. |
Subaddress Label Leakage | View-only wallets can see all subaddresses and their labels. Sharing the view key with a third party exposes internal accounting metadata. | Low | Compliance officers, payment processors | Strip subaddress labels before sharing view-only wallet files with external auditors. |
Trusted Daemon Privacy Risk | Connecting a view-only wallet to a remote node leaks the set of outputs being scanned to the node operator. | Low | Privacy-conscious integrators, wallet developers | Always run a local full node for view-only wallets that monitor sensitive treasury or exchange funds. |
VIEW-ONLY WALLET DEPLOYMENT
Operator Checklist
A practical checklist for exchange operators, treasury teams, and auditors deploying a view-only wallet for compliance monitoring. Each item identifies a critical verification step to ensure complete monitoring coverage without exposing spend authority.
Confirm that only the secret view key—not the secret spend key—has been imported into the view-only wallet instance. The wallet must be initialized with generate-from-view-key or restored using the view key alone.
Why it matters: Importing the spend key into a hot or semi-hot environment defeats the purpose of a view-only setup and creates a direct theft vector.
Readiness signal: The wallet status command returns Watch-only and the balance reflects incoming transactions without the ability to initiate transfers.
resource-links
OFFICIAL MONERO REFERENCES
Source Resources
Use these canonical Monero resources to design and validate view-only monitoring, audit access, and key-image synchronization. Confirm behavior against the deployed wallet release before relying on any RPC method or operational workflow.
Chains We Build On
Looking to build on a specific blockchain?
We build smart contracts, DeFi applications, wallets, tokenization platforms, and blockchain infrastructure across the major ecosystems teams choose today. That includes Ethereum, Arbitrum, Optimism, Polygon, Avalanche, Solana, Sui, Aptos, Hedera, Stellar, and NEAR, with support for additional EVM and non-EVM networks based on your product requirements.
EVM ecosystems
- Ethereum
- Arbitrum
- Optimism
- Polygon
- Avalanche
- Cronos
Non-EVM ecosystems
- Solana
- Sui
- Aptos
- Hedera
- Stellar
- NEAR
Additional ecosystems
- Polkadot
- Cosmos
- TON
- Cardano
- Algorand
- Tempo
Also available for Base, appchains, custom EVM networks, and cross-chain product architecture.
VIEW-ONLY WALLET AND AUDIT KEY PATTERNS
Frequently Asked Questions
Common operational and security questions for teams implementing view-only wallets for compliance, accounting, and cold-storage monitoring.
A view-only wallet created with the secret view key can detect all incoming transactions and their amounts but cannot detect outgoing transactions on its own. This is because the secret view key allows scanning for outputs addressed to the wallet, but it does not provide the ability to compute key images, which are the unique identifiers of spent outputs. Without importing key images, a view-only wallet will show an incorrect (inflated) balance, as spent outputs still appear as unspent. The wallet will only show a zero balance if all received funds have been spent and the corresponding key images have been imported.
Trusted by Industry Leaders
Delivering blockchain solutions for 5+ years.
We have partnered with 50+ leading DeFi protocols, NFT ecosystems, and fintech innovators to build secure, scalable, and capital-efficient blockchain products.
Selected Partners & Clients
“I've been working with Chainscore Labs for last 3+ years, they've consistently delivered with strong ownership across multiple projects. The team is reliable and detail-oriented.”
L
Lee Erswell
CEO, Telos Foundation
how to get started
How to get started?
If you're looking for blockchain integration, ChainScore Labs has 5+ years of experience helping teams build and integrate exchanges, wallets, smart contracts, tokenization solutions, and protocol-connected products, we can help you choose the right path, integrate securely, and get to production faster. Our team consists of experienced blockchain developers and architects who can help you with your blockchain integration needs.
01
Exploration & Strategy
Define your product goals and choose the right blockchain architecture for your use case.
02
Architecture & Design
Design the smart contracts, tokenomics, and security parameters of your system.
03
Development & Integration
Build and integrate with wallets, oracles, and front-end dApps for a seamless experience.
04
Security & Launch
Comprehensive audits followed by a risk-managed mainnet deployment to protect your users.
Explore More Solutions
Discover our
blockchain development services.
We build production-grade blockchain solutions for top-tier projects across DeFi and Web3.
Book a Call
Start a build
Need a blockchain engineering team?
Send the project context and we will respond with next steps, scope questions, and a practical path to delivery.