From 671a104d2c7d9d1e1be316d6169d0f3f215be58c Mon Sep 17 00:00:00 2001
From: pasta <pasta@dashboost.org>
Date: Wed, 12 Aug 2026 23:21:00 -0500
Subject: [PATCH 01/14] feat(wallet): derive masternode operator keys from seed

---
 src/Makefile.am                               |   2 +
 src/Makefile.test.include                     |   1 +
 src/interfaces/masternode_operator.h          |  40 ++
 src/interfaces/node.h                         |   4 +
 src/interfaces/wallet.h                       |  20 +
 src/node/interfaces.cpp                       |   9 +
 src/wallet/interfaces.cpp                     |  76 +++-
 src/wallet/masternode_operator.h              |  25 ++
 src/wallet/scriptpubkeyman.cpp                |  75 +++-
 src/wallet/scriptpubkeyman.h                  |  19 +
 src/wallet/test/masternode_operator_tests.cpp | 396 ++++++++++++++++++
 src/wallet/wallet.cpp                         | 329 +++++++++++++++
 src/wallet/wallet.h                           |  47 ++-
 src/wallet/walletdb.cpp                       |  26 +-
 src/wallet/walletdb.h                         |   5 +
 15 files changed, 1061 insertions(+), 13 deletions(-)
 create mode 100644 src/interfaces/masternode_operator.h
 create mode 100644 src/wallet/masternode_operator.h
 create mode 100644 src/wallet/test/masternode_operator_tests.cpp

diff --git a/src/Makefile.am b/src/Makefile.am
index fb1ffde2529a..c909c2db5aee 100644
--- a/src/Makefile.am
+++ b/src/Makefile.am
@@ -280,6 +280,7 @@ BITCOIN_CORE_H = \
   interfaces/handler.h \
   interfaces/init.h \
   interfaces/ipc.h \
+  interfaces/masternode_operator.h \
   interfaces/node.h \
   interfaces/wallet.h \
   kernel/blockmanager_opts.h \
@@ -476,6 +477,7 @@ BITCOIN_CORE_H = \
   wallet/hdchain.h \
   wallet/ismine.h \
   wallet/load.h \
+  wallet/masternode_operator.h \
   wallet/receive.h \
   wallet/rpc/util.h \
   wallet/rpc/wallet.h \
diff --git a/src/Makefile.test.include b/src/Makefile.test.include
index 427909b8e12f..f3ef0cee4e4d 100644
--- a/src/Makefile.test.include
+++ b/src/Makefile.test.include
@@ -224,6 +224,7 @@ if ENABLE_WALLET
 BITCOIN_TESTS += \
   wallet/test/bip39_tests.cpp \
   wallet/test/coinjoin_tests.cpp \
+  wallet/test/masternode_operator_tests.cpp \
   wallet/test/psbt_wallet_tests.cpp \
   wallet/test/spend_tests.cpp \
   wallet/test/wallet_tests.cpp \
diff --git a/src/interfaces/masternode_operator.h b/src/interfaces/masternode_operator.h
new file mode 100644
index 000000000000..235a7e6a4377
--- /dev/null
+++ b/src/interfaces/masternode_operator.h
@@ -0,0 +1,40 @@
+// Copyright (c) 2026 The Dash Core developers
+// Distributed under the MIT software license, see the accompanying
+// file COPYING or http://www.opensource.org/licenses/mit-license.php.
+
+#ifndef BITCOIN_INTERFACES_MASTERNODE_OPERATOR_H
+#define BITCOIN_INTERFACES_MASTERNODE_OPERATOR_H
+
+#include <support/allocators/secure.h>
+
+#include <cstdint>
+#include <string>
+#include <vector>
+
+namespace interfaces {
+
+/** Result of a deterministic masternode operator-key operation. */
+enum class MasternodeOperatorKeyStatus : uint8_t {
+    SUCCESS,
+    NOT_SUPPORTED,
+    WALLET_LOCKED,
+    EXHAUSTED,
+    INVALID_KEY,
+    NOT_FOUND,
+    CONFLICT,
+    DATABASE_ERROR,
+    DERIVATION_ERROR,
+};
+
+/** A deterministic masternode operator key reserved by the wallet. */
+struct MasternodeOperatorKey {
+    SecureVector secret_key;
+    std::vector<unsigned char> public_key;
+    std::string path;
+    uint32_t index{0};
+    uint64_t reservation_id{0};
+};
+
+} // namespace interfaces
+
+#endif // BITCOIN_INTERFACES_MASTERNODE_OPERATOR_H
diff --git a/src/interfaces/node.h b/src/interfaces/node.h
index ba85809416be..32b93f88d041 100644
--- a/src/interfaces/node.h
+++ b/src/interfaces/node.h
@@ -86,6 +86,10 @@ class MnEntry
     virtual const int32_t& getPoSePenalty() const = 0;
     virtual const int32_t& getRegisteredHeight() const = 0;
     virtual const uint16_t& getOperatorReward() const = 0;
+    //! Registered operator public key normalized to 48-byte basic-scheme serialization.
+    //! This is stable regardless of the transaction's original wire-scheme version;
+    //! an entry whose operator was revoked returns an empty vector.
+    virtual std::vector<unsigned char> getOperatorPubKeyBytes() const = 0;
     virtual const uint256& getProTxHash() const = 0;
 };
 
diff --git a/src/interfaces/wallet.h b/src/interfaces/wallet.h
index 7300f4286e99..3c3ff1273f1e 100644
--- a/src/interfaces/wallet.h
+++ b/src/interfaces/wallet.h
@@ -8,6 +8,7 @@
 #include <consensus/amount.h>          // For CAmount
 #include <governance/common.h>
 #include <interfaces/chain.h>          // For ChainClient
+#include <interfaces/masternode_operator.h>
 #include <pubkey.h>                    // For CKeyID and CScriptID (definitions needed in CTxDestination instantiation)
 #include <script/standard.h>           // For CTxDestination
 #include <support/allocators/secure.h> // For SecureString
@@ -130,6 +131,25 @@ class Wallet
     //! Sign special transaction payload
     virtual bool signSpecialTxPayload(const uint256& hash, const CKeyID& keyid, std::vector<unsigned char>& vchSig) = 0;
 
+    //! Whether this wallet has exactly one BIP39 seed from which operator keys can be derived.
+    virtual bool canDeriveMasternodeOperatorKey() = 0;
+    //! Reserve the next unused operator key in memory without writing to disk. `in_use`
+    //! contains basic-scheme public keys already registered on chain. The caller must
+    //! release the token on cancellation or commit it after registration succeeds.
+    virtual MasternodeOperatorKeyStatus reserveMasternodeOperatorKey(const std::vector<std::vector<unsigned char>>& in_use,
+                                                                     MasternodeOperatorKey& key) = 0;
+    //! Release a reservation when registration is cancelled or fails.
+    virtual void releaseMasternodeOperatorKey(uint64_t reservation_id) = 0;
+    //! Record a successfully registered reserved key. The wallet re-derives and verifies
+    //! the token, public key and index before writing, then removes the reservation.
+    virtual MasternodeOperatorKeyStatus commitMasternodeOperatorKey(uint64_t reservation_id,
+                                                                    const std::vector<unsigned char>& public_key,
+                                                                    uint32_t index) = 0;
+    //! Recover an operator key by its basic-scheme public key. This is an exact bounded
+    //! lookup and does not record an index merely because it was derived.
+    virtual MasternodeOperatorKeyStatus getMasternodeOperatorKey(const std::vector<unsigned char>& public_key,
+                                                                 MasternodeOperatorKey& key) = 0;
+
     //! Return whether wallet has private key.
     virtual bool isSpendable(const CScript& script) = 0;
     virtual bool isSpendable(const CTxDestination& dest) = 0;
diff --git a/src/node/interfaces.cpp b/src/node/interfaces.cpp
index 80dd1e018d46..4599f4db0c9c 100644
--- a/src/node/interfaces.cpp
+++ b/src/node/interfaces.cpp
@@ -146,6 +146,15 @@ class MnEntryImpl : public MnEntry
     const int32_t& getPoSePenalty() const override { return m_dmn->pdmnState->nPoSePenalty; }
     const int32_t& getRegisteredHeight() const override { return m_dmn->pdmnState->nRegisteredHeight; }
     const uint16_t& getOperatorReward() const override { return m_dmn->nOperatorReward; }
+    std::vector<unsigned char> getOperatorPubKeyBytes() const override
+    {
+        // Get() returns the mathematical public key decoded with the state record's
+        // scheme. Re-serializing it as basic yields the wallet API's canonical bytes,
+        // including for masternodes originally registered with legacy wire encoding.
+        const CBLSPublicKey& public_key{m_dmn->pdmnState->pubKeyOperator.Get()};
+        if (!public_key.IsValid()) return {};
+        return public_key.ToByteVector(/*specificLegacyScheme=*/false);
+    }
     const uint256& getProTxHash() const override { return m_dmn->proTxHash; }
 };
 
diff --git a/src/wallet/interfaces.cpp b/src/wallet/interfaces.cpp
index 099437d099a3..7863d87a2dac 100644
--- a/src/wallet/interfaces.cpp
+++ b/src/wallet/interfaces.cpp
@@ -4,18 +4,24 @@
 
 #include <interfaces/wallet.h>
 
+#include <bls/bls.h>
 #include <chain.h>
 #include <coinjoin/client.h>
 #include <consensus/amount.h>
+#include <evo/deterministicmns.h>
 #include <interfaces/chain.h>
 #include <interfaces/coinjoin.h>
 #include <interfaces/handler.h>
+#include <masternode/sync.h>
+#include <node/context.h>
 #include <policy/fees.h>
 #include <primitives/transaction.h>
 #include <rpc/server.h>
 #include <script/standard.h>
 #include <support/allocators/secure.h>
+#include <support/cleanse.h>
 #include <sync.h>
+#include <txdb.h>
 #include <uint256.h>
 #include <util/check.h>
 #include <util/system.h>
@@ -25,18 +31,14 @@
 #include <wallet/coinjoin.h>
 #include <wallet/context.h>
 #include <wallet/fees.h>
+#include <wallet/hdchain.h>
 #include <wallet/ismine.h>
 #include <wallet/load.h>
 #include <wallet/receive.h>
 #include <wallet/rpc/wallet.h>
+#include <wallet/scriptpubkeyman.h>
 #include <wallet/spend.h>
 #include <wallet/wallet.h>
-#include <wallet/hdchain.h>
-#include <wallet/scriptpubkeyman.h>
-#include <evo/deterministicmns.h>
-#include <masternode/sync.h>
-#include <txdb.h>
-#include <node/context.h>
 
 #include <algorithm>
 #include <memory>
@@ -48,6 +50,8 @@ using interfaces::Chain;
 using interfaces::FoundBlock;
 using interfaces::Handler;
 using interfaces::MakeHandler;
+using interfaces::MasternodeOperatorKey;
+using interfaces::MasternodeOperatorKeyStatus;
 using interfaces::Wallet;
 using interfaces::WalletAddress;
 using interfaces::WalletBalances;
@@ -237,6 +241,66 @@ class WalletImpl : public Wallet
     {
         return m_wallet->SignSpecialTxPayload(hash, keyid, vchSig);
     }
+    bool canDeriveMasternodeOperatorKey() override { return m_wallet->CanDeriveMasternodeOperatorKey(); }
+    MasternodeOperatorKeyStatus reserveMasternodeOperatorKey(const std::vector<std::vector<unsigned char>>& in_use,
+                                                             MasternodeOperatorKey& key) override
+    {
+        key = MasternodeOperatorKey{};
+        CBLSSecretKey secret;
+        uint32_t index{0};
+        uint64_t reservation_id{0};
+        const MasternodeOperatorKeyStatus status{
+            m_wallet->ReserveMasternodeOperatorKey(in_use, secret, index, reservation_id)};
+        if (status != MasternodeOperatorKeyStatus::SUCCESS) return status;
+
+        auto secret_bytes{secret.ToBytes(/*specificLegacyScheme=*/false)};
+        key.secret_key.assign(secret_bytes.begin(), secret_bytes.end());
+        memory_cleanse(secret_bytes.data(), secret_bytes.size());
+        key.public_key = secret.GetPublicKey().ToByteVector(/*specificLegacyScheme=*/false);
+        key.path = m_wallet->GetMasternodeOperatorKeyPath(index);
+        key.index = index;
+        key.reservation_id = reservation_id;
+        return status;
+    }
+    void releaseMasternodeOperatorKey(uint64_t reservation_id) override
+    {
+        m_wallet->ReleaseMasternodeOperatorKey(reservation_id);
+    }
+    MasternodeOperatorKeyStatus commitMasternodeOperatorKey(uint64_t reservation_id,
+                                                            const std::vector<unsigned char>& public_key,
+                                                            uint32_t index) override
+    {
+        CBLSPublicKey parsed;
+        parsed.SetBytes(public_key, /*specificLegacyScheme=*/false);
+        if (!parsed.IsValid() || parsed.ToByteVector(/*specificLegacyScheme=*/false) != public_key) {
+            return MasternodeOperatorKeyStatus::INVALID_KEY;
+        }
+        return m_wallet->CommitMasternodeOperatorKey(reservation_id, parsed, index);
+    }
+    MasternodeOperatorKeyStatus getMasternodeOperatorKey(const std::vector<unsigned char>& public_key,
+                                                         MasternodeOperatorKey& key) override
+    {
+        key = MasternodeOperatorKey{};
+        CBLSPublicKey parsed;
+        parsed.SetBytes(public_key, /*specificLegacyScheme=*/false);
+        if (!parsed.IsValid() || parsed.ToByteVector(/*specificLegacyScheme=*/false) != public_key) {
+            return MasternodeOperatorKeyStatus::INVALID_KEY;
+        }
+
+        CBLSSecretKey secret;
+        uint32_t index{0};
+        const MasternodeOperatorKeyStatus status{m_wallet->GetMasternodeOperatorKey(parsed, secret, index)};
+        if (status != MasternodeOperatorKeyStatus::SUCCESS) return status;
+
+        auto secret_bytes{secret.ToBytes(/*specificLegacyScheme=*/false)};
+        key.secret_key.assign(secret_bytes.begin(), secret_bytes.end());
+        memory_cleanse(secret_bytes.data(), secret_bytes.size());
+        key.public_key = public_key;
+        key.path = m_wallet->GetMasternodeOperatorKeyPath(index);
+        key.index = index;
+        key.reservation_id = 0;
+        return status;
+    }
     bool isSpendable(const CScript& script) override
     {
         LOCK(m_wallet->cs_wallet);
diff --git a/src/wallet/masternode_operator.h b/src/wallet/masternode_operator.h
new file mode 100644
index 000000000000..57e415151319
--- /dev/null
+++ b/src/wallet/masternode_operator.h
@@ -0,0 +1,25 @@
+// Copyright (c) 2026 The Dash Core developers
+// Distributed under the MIT software license, see the accompanying
+// file COPYING or http://www.opensource.org/licenses/mit-license.php.
+
+#ifndef BITCOIN_WALLET_MASTERNODE_OPERATOR_H
+#define BITCOIN_WALLET_MASTERNODE_OPERATOR_H
+
+#include <interfaces/masternode_operator.h>
+
+#include <cstdint>
+
+namespace wallet {
+
+/**
+ * Operator keys are recovered by walking this many leaves of the deterministic
+ * derivation path. New keys are selected from the same range, so every key the
+ * wallet creates remains recoverable by the bounded walk.
+ */
+inline constexpr uint32_t MASTERNODE_OPERATOR_KEY_LIMIT{500};
+
+using MasternodeOperatorKeyStatus = interfaces::MasternodeOperatorKeyStatus;
+
+} // namespace wallet
+
+#endif // BITCOIN_WALLET_MASTERNODE_OPERATOR_H
diff --git a/src/wallet/scriptpubkeyman.cpp b/src/wallet/scriptpubkeyman.cpp
index fcd9bbd5c6aa..56eabd6b534a 100644
--- a/src/wallet/scriptpubkeyman.cpp
+++ b/src/wallet/scriptpubkeyman.cpp
@@ -2,13 +2,14 @@
 // Distributed under the MIT software license, see the accompanying
 // file COPYING or http://www.opensource.org/licenses/mit-license.php.
 
-#include <key_io.h>
 #include <chainparams.h>
+#include <key_io.h>
 #include <logging.h>
 #include <messagesigner.h>
 #include <script/descriptor.h>
 #include <script/sign.h>
 #include <shutdown.h>
+#include <support/cleanse.h>
 #include <util/bip32.h>
 #include <util/strencodings.h>
 #include <util/system.h>
@@ -768,6 +769,45 @@ bool LegacyScriptPubKeyMan::SignSpecialTxPayload(const uint256& hash, const CKey
     return CHashSigner::SignHash(hash, key, vchSig);
 }
 
+BIP39SeedStatus LegacyScriptPubKeyMan::GetBIP39SeedIdentifier(std::vector<unsigned char>& identifier) const
+{
+    CHDChain chain;
+    SecureVector mnemonic;
+    SecureVector passphrase;
+    if (!GetHDChain(chain) || !chain.GetMnemonic(mnemonic, passphrase) || mnemonic.empty()) {
+        return BIP39SeedStatus::NONE;
+    }
+
+    // The chain id is the hash of the unencrypted seed and remains available while locked.
+    // Prefix it so identifiers from different ScriptPubKeyMan implementations compare
+    // conservatively instead of accidentally claiming to be the same source.
+    const uint256 chain_id{chain.GetID()};
+    identifier.assign(1, 0);
+    identifier.insert(identifier.end(), chain_id.begin(), chain_id.end());
+    return BIP39SeedStatus::AVAILABLE;
+}
+
+bool LegacyScriptPubKeyMan::GetBIP39Seed(SecureVector& seed) const
+{
+    memory_cleanse(seed.data(), seed.size());
+    seed.clear();
+    CHDChain chain;
+    if (!GetDecryptedHDChain(chain)) return false;
+
+    SecureString mnemonic;
+    SecureString passphrase;
+    if (!chain.GetMnemonic(mnemonic, passphrase) || mnemonic.empty() || !CMnemonic::Check(mnemonic)) {
+        return false;
+    }
+
+    SecureVector bip39_seed;
+    CMnemonic::ToSeed(mnemonic, passphrase, bip39_seed);
+    if (bip39_seed.empty() || bip39_seed != chain.GetSeed()) return false;
+
+    seed = std::move(bip39_seed);
+    return true;
+}
+
 TransactionError LegacyScriptPubKeyMan::FillPSBT(PartiallySignedTransaction& psbtx, const PrecomputedTransactionData& txdata, int sighash_type, bool sign, bool bip32derivs, int* n_signed, bool finalize) const
 {
     if (n_signed) {
@@ -2716,6 +2756,39 @@ bool DescriptorScriptPubKeyMan::SignSpecialTxPayload(const uint256& hash, const
     return CHashSigner::SignHash(hash, key, vchSig);
 }
 
+BIP39SeedStatus DescriptorScriptPubKeyMan::GetBIP39SeedIdentifier(std::vector<unsigned char>& identifier) const
+{
+    LOCK(cs_desc_man);
+
+    std::vector<CKeyID> seed_ids;
+    for (const auto& [id, mnemonic] : m_mnemonics) {
+        if (!mnemonic.first.empty()) seed_ids.push_back(id);
+    }
+    for (const auto& [id, mnemonic] : m_crypted_mnemonics) {
+        if (!mnemonic.first.empty()) seed_ids.push_back(id);
+    }
+    if (seed_ids.empty()) return BIP39SeedStatus::NONE;
+    if (seed_ids.size() != 1) return BIP39SeedStatus::AMBIGUOUS;
+
+    identifier.assign(1, 1);
+    identifier.insert(identifier.end(), seed_ids.front().begin(), seed_ids.front().end());
+    return BIP39SeedStatus::AVAILABLE;
+}
+
+bool DescriptorScriptPubKeyMan::GetBIP39Seed(SecureVector& seed) const
+{
+    memory_cleanse(seed.data(), seed.size());
+    seed.clear();
+    SecureString mnemonic;
+    SecureString passphrase;
+    if (!GetMnemonicString(mnemonic, passphrase) || mnemonic.empty() || !CMnemonic::Check(mnemonic)) {
+        return false;
+    }
+
+    CMnemonic::ToSeed(mnemonic, passphrase, seed);
+    return !seed.empty();
+}
+
 TransactionError DescriptorScriptPubKeyMan::FillPSBT(PartiallySignedTransaction& psbtx, const PrecomputedTransactionData& txdata, int sighash_type, bool sign, bool bip32derivs, int* n_signed, bool finalize) const
 {
     if (n_signed) {
diff --git a/src/wallet/scriptpubkeyman.h b/src/wallet/scriptpubkeyman.h
index 2cf6805ff52d..3ed032b2ca3e 100644
--- a/src/wallet/scriptpubkeyman.h
+++ b/src/wallet/scriptpubkeyman.h
@@ -26,6 +26,12 @@
 #include <optional>
 
 namespace wallet {
+enum class BIP39SeedStatus {
+    NONE,
+    AVAILABLE,
+    AMBIGUOUS,
+};
+
 // Wallet storage things that ScriptPubKeyMans need in order to be able to store things to the wallet database.
 // It provides access to things that are part of the entire wallet and not specific to a ScriptPubKeyMan such as
 // wallet flags, wallet version, encryption keys, encryption status, and the database itself. This allows a
@@ -234,6 +240,15 @@ class ScriptPubKeyMan
     /** Sign a message with the given script */
     virtual SigningResult SignMessage(const std::string& message, const PKHash& pkhash, std::string& str_sig) const { return SigningResult::SIGNING_FAILED; };
     virtual bool SignSpecialTxPayload(const uint256& hash, const CKeyID& keyid, std::vector<unsigned char>& vchSig) const { return false; }
+    /** Return an unlock-free identifier for this manager's BIP39 seed source. Managers
+     *  backed by the same source return the same identifier. A manager backed only by a
+     *  raw HD seed or imported keys returns BIP39SeedStatus::NONE. */
+    virtual BIP39SeedStatus GetBIP39SeedIdentifier(std::vector<unsigned char>& identifier) const
+    {
+        return BIP39SeedStatus::NONE;
+    }
+    /** Return the 64-byte BIP39 seed. Requires an unlocked wallet. */
+    virtual bool GetBIP39Seed(SecureVector& seed) const { return false; }
     /** Adds script and derivation path information to a PSBT, and optionally signs it. */
     virtual TransactionError FillPSBT(PartiallySignedTransaction& psbt, const PrecomputedTransactionData& txdata, int sighash_type = 1 /* SIGHASH_ALL */, bool sign = true, bool bip32derivs = false, int* n_signed = nullptr, bool finalize = true) const { return TransactionError::INVALID_PSBT; }
 
@@ -384,6 +399,8 @@ class LegacyScriptPubKeyMan : public ScriptPubKeyMan, public FillableSigningProv
     bool SignTransaction(CMutableTransaction& tx, const std::map<COutPoint, Coin>& coins, int sighash, std::map<int, bilingual_str>& input_errors) const override;
     SigningResult SignMessage(const std::string& message, const PKHash& pkhash, std::string& str_sig) const override;
     bool SignSpecialTxPayload(const uint256& hash, const CKeyID& keyid, std::vector<unsigned char>& vchSig) const override;
+    BIP39SeedStatus GetBIP39SeedIdentifier(std::vector<unsigned char>& identifier) const override;
+    bool GetBIP39Seed(SecureVector& seed) const override;
     TransactionError FillPSBT(PartiallySignedTransaction& psbt, const PrecomputedTransactionData& txdata, int sighash_type = 1 /* SIGHASH_ALL */, bool sign = true, bool bip32derivs = false, int* n_signed = nullptr, bool finalize = true) const override;
 
     uint256 GetID() const override;
@@ -643,6 +660,8 @@ class DescriptorScriptPubKeyMan : public ScriptPubKeyMan
     bool SignTransaction(CMutableTransaction& tx, const std::map<COutPoint, Coin>& coins, int sighash, std::map<int, bilingual_str>& input_errors) const override;
     SigningResult SignMessage(const std::string& message, const PKHash& pkhash, std::string& str_sig) const override;
     bool SignSpecialTxPayload(const uint256& hash, const CKeyID& keyid, std::vector<unsigned char>& vchSig) const override;
+    BIP39SeedStatus GetBIP39SeedIdentifier(std::vector<unsigned char>& identifier) const override;
+    bool GetBIP39Seed(SecureVector& seed) const override;
     TransactionError FillPSBT(PartiallySignedTransaction& psbt, const PrecomputedTransactionData& txdata, int sighash_type = 1 /* SIGHASH_ALL */, bool sign = true, bool bip32derivs = false, int* n_signed = nullptr, bool finalize = true) const override;
 
     uint256 GetID() const override;
diff --git a/src/wallet/test/masternode_operator_tests.cpp b/src/wallet/test/masternode_operator_tests.cpp
new file mode 100644
index 000000000000..4b6c4786c1d6
--- /dev/null
+++ b/src/wallet/test/masternode_operator_tests.cpp
@@ -0,0 +1,396 @@
+// Copyright (c) 2026 The Dash Core developers
+// Distributed under the MIT software license, see the accompanying
+// file COPYING or http://www.opensource.org/licenses/mit-license.php.
+
+#include <bls/bls.h>
+#include <clientversion.h>
+#include <streams.h>
+#include <util/strencodings.h>
+#include <wallet/hdchain.h>
+#include <wallet/scriptpubkeyman.h>
+#include <wallet/test/wallet_test_fixture.h>
+#include <wallet/wallet.h>
+#include <wallet/walletdb.h>
+
+#include <boost/test/unit_test.hpp>
+
+#include <map>
+#include <memory>
+#include <string>
+#include <vector>
+
+namespace wallet {
+namespace {
+
+const SecureString DASHSYNC_MNEMONIC{
+    "enemy check owner stumble unaware debris suffer peanut good fabric bleak outside"};
+const SecureString SECOND_MNEMONIC{
+    "abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon about"};
+const std::string DASHSYNC_OPERATOR_SECRET{"344e7bf67fddf1c2d2f629f2392ce2b4af99393cd8a4c70d4bbaef7aaf4c364b"};
+const std::string DASHSYNC_OPERATOR_PUBLIC_KEY_LEGACY{
+    "157b10706659e25eb362b5d902d809f9160b1688e201ee6e94b40f9b5062d7074683ef05a2d5efb7793c47059c878dfa"};
+
+void SetupLegacyMnemonic(CWallet& wallet, const SecureString& mnemonic = DASHSYNC_MNEMONIC)
+{
+    CHDChain chain;
+    BOOST_REQUIRE(chain.SetMnemonic(mnemonic, /*ssMnemonicPassphrase=*/"", /*fUpdateID=*/true));
+    chain.AddAccount();
+
+    LOCK(wallet.cs_wallet);
+    LegacyScriptPubKeyMan* spk_man{wallet.GetOrCreateLegacyScriptPubKeyMan()};
+    BOOST_REQUIRE(spk_man != nullptr);
+    BOOST_REQUIRE(spk_man->LoadHDChain(chain));
+}
+
+void SetupRawLegacySeed(CWallet& wallet, const SecureString& mnemonic = DASHSYNC_MNEMONIC)
+{
+    CHDChain mnemonic_chain;
+    BOOST_REQUIRE(mnemonic_chain.SetMnemonic(mnemonic, /*ssMnemonicPassphrase=*/"", /*fUpdateID=*/true));
+
+    CHDChain raw_chain;
+    BOOST_REQUIRE(raw_chain.SetSeed(mnemonic_chain.GetSeed(), /*fUpdateID=*/true));
+    raw_chain.AddAccount();
+
+    LOCK(wallet.cs_wallet);
+    LegacyScriptPubKeyMan* spk_man{wallet.GetOrCreateLegacyScriptPubKeyMan()};
+    BOOST_REQUIRE(spk_man != nullptr);
+    BOOST_REQUIRE(spk_man->LoadHDChain(raw_chain));
+}
+
+std::vector<unsigned char> PublicKeyBytes(const CBLSSecretKey& secret)
+{
+    return secret.GetPublicKey().ToByteVector(/*specificLegacyScheme=*/false);
+}
+
+size_t CountOperatorIndexRecords(CWallet& wallet)
+{
+    std::unique_ptr<DatabaseBatch> batch{wallet.GetDatabase().MakeBatch()};
+    BOOST_REQUIRE(batch);
+    BOOST_REQUIRE(batch->StartCursor());
+    size_t count{0};
+    while (true) {
+        CDataStream key(SER_DISK, CLIENT_VERSION);
+        CDataStream value(SER_DISK, CLIENT_VERSION);
+        bool complete{false};
+        BOOST_REQUIRE(batch->ReadAtCursor(key, value, complete));
+        if (complete) break;
+        std::string type;
+        key >> type;
+        if (type == DBKeys::MASTERNODE_OPERATOR_INDEX) ++count;
+    }
+    batch->CloseCursor();
+    return count;
+}
+
+std::map<std::vector<unsigned char>, uint32_t> ReadOperatorIndexRecords(CWallet& wallet)
+{
+    std::unique_ptr<DatabaseBatch> batch{wallet.GetDatabase().MakeBatch()};
+    BOOST_REQUIRE(batch);
+    BOOST_REQUIRE(batch->StartCursor());
+    std::map<std::vector<unsigned char>, uint32_t> records;
+    while (true) {
+        CDataStream key(SER_DISK, CLIENT_VERSION);
+        CDataStream value(SER_DISK, CLIENT_VERSION);
+        bool complete{false};
+        BOOST_REQUIRE(batch->ReadAtCursor(key, value, complete));
+        if (complete) break;
+        std::string type;
+        key >> type;
+        if (type != DBKeys::MASTERNODE_OPERATOR_INDEX) continue;
+        std::vector<unsigned char> public_key;
+        uint32_t index{0};
+        key >> public_key;
+        value >> index;
+        records.emplace(std::move(public_key), index);
+    }
+    batch->CloseCursor();
+    return records;
+}
+
+struct MasternodeOperatorTestingSetup : public WalletTestingSetup {
+    MasternodeOperatorTestingSetup() :
+        WalletTestingSetup(CBaseChainParams::REGTEST)
+    {
+        gArgs.ForceSetArg("-keypool", "1");
+    }
+
+    std::unique_ptr<CWallet> MakeWallet()
+    {
+        auto wallet{std::make_unique<CWallet>(m_node.chain.get(), m_coinjoin_loader.get(), "", m_args,
+                                              CreateMockWalletDatabase())};
+        BOOST_REQUIRE(wallet->LoadWallet() == DBErrors::LOAD_OK);
+        return wallet;
+    }
+};
+
+} // namespace
+
+BOOST_FIXTURE_TEST_SUITE(masternode_operator_tests, MasternodeOperatorTestingSetup)
+
+BOOST_AUTO_TEST_CASE(dashsync_known_answer_and_scheme_normalization)
+{
+    SetupLegacyMnemonic(m_wallet);
+    BOOST_CHECK(m_wallet.CanDeriveMasternodeOperatorKey());
+    BOOST_CHECK_EQUAL(m_wallet.GetMasternodeOperatorKeyPath(0), "m/9'/1'/3'/3'/0");
+
+    CBLSSecretKey secret;
+    BOOST_REQUIRE(m_wallet.DeriveMasternodeOperatorKey(0, secret) == MasternodeOperatorKeyStatus::SUCCESS);
+    BOOST_CHECK_EQUAL(HexStr(secret.ToByteVector(/*specificLegacyScheme=*/false)), DASHSYNC_OPERATOR_SECRET);
+    BOOST_CHECK_EQUAL(HexStr(secret.GetPublicKey().ToByteVector(/*specificLegacyScheme=*/true)),
+                      DASHSYNC_OPERATOR_PUBLIC_KEY_LEGACY);
+
+    CBLSSecretKey second;
+    CBLSSecretKey third;
+    BOOST_REQUIRE(m_wallet.DeriveMasternodeOperatorKey(1, second) == MasternodeOperatorKeyStatus::SUCCESS);
+    BOOST_REQUIRE(m_wallet.DeriveMasternodeOperatorKey(2, third) == MasternodeOperatorKeyStatus::SUCCESS);
+    BOOST_CHECK(second != secret);
+    BOOST_CHECK(third != secret);
+    BOOST_CHECK(third != second);
+    BOOST_CHECK_EQUAL(m_wallet.GetMasternodeOperatorKeyPath(1), "m/9'/1'/3'/3'/1");
+    BOOST_CHECK_EQUAL(m_wallet.GetMasternodeOperatorKeyPath(2), "m/9'/1'/3'/3'/2");
+
+    CBLSPublicKey registered_legacy;
+    registered_legacy.SetHexStr(DASHSYNC_OPERATOR_PUBLIC_KEY_LEGACY, /*specificLegacyScheme=*/true);
+    BOOST_REQUIRE(registered_legacy.IsValid());
+    const auto normalized{registered_legacy.ToByteVector(/*specificLegacyScheme=*/false)};
+    BOOST_CHECK(normalized == PublicKeyBytes(secret));
+
+    CBLSSecretKey recovered;
+    uint32_t index{MASTERNODE_OPERATOR_KEY_LIMIT};
+    BOOST_CHECK(m_wallet.GetMasternodeOperatorKey(registered_legacy, recovered, index) ==
+                MasternodeOperatorKeyStatus::SUCCESS);
+    BOOST_CHECK(recovered == secret);
+    BOOST_CHECK_EQUAL(index, 0U);
+    BOOST_CHECK_EQUAL(CountOperatorIndexRecords(m_wallet), 0U);
+}
+
+BOOST_AUTO_TEST_CASE(reservation_release_and_commit)
+{
+    SetupLegacyMnemonic(m_wallet);
+    const std::vector<std::vector<unsigned char>> none_in_use;
+
+    CBLSSecretKey first;
+    uint32_t first_index{MASTERNODE_OPERATOR_KEY_LIMIT};
+    uint64_t first_reservation{0};
+    BOOST_REQUIRE(m_wallet.ReserveMasternodeOperatorKey(none_in_use, first, first_index, first_reservation) ==
+                  MasternodeOperatorKeyStatus::SUCCESS);
+    BOOST_CHECK_EQUAL(first_index, 0U);
+    BOOST_CHECK_NE(first_reservation, 0U);
+    BOOST_CHECK_EQUAL(CountOperatorIndexRecords(m_wallet), 0U);
+
+    CBLSSecretKey concurrent;
+    uint32_t concurrent_index{MASTERNODE_OPERATOR_KEY_LIMIT};
+    uint64_t concurrent_reservation{0};
+    BOOST_REQUIRE(m_wallet.ReserveMasternodeOperatorKey(none_in_use, concurrent, concurrent_index,
+                                                        concurrent_reservation) == MasternodeOperatorKeyStatus::SUCCESS);
+    BOOST_CHECK_EQUAL(concurrent_index, 1U);
+    BOOST_CHECK(concurrent != first);
+
+    m_wallet.ReleaseMasternodeOperatorKey(first_reservation);
+    CBLSSecretKey reused;
+    uint32_t reused_index{MASTERNODE_OPERATOR_KEY_LIMIT};
+    uint64_t reused_reservation{0};
+    BOOST_REQUIRE(m_wallet.ReserveMasternodeOperatorKey(none_in_use, reused, reused_index, reused_reservation) ==
+                  MasternodeOperatorKeyStatus::SUCCESS);
+    BOOST_CHECK_EQUAL(reused_index, 0U);
+    BOOST_CHECK(reused == first);
+
+    CBLSSecretKey unrelated;
+    unrelated.MakeNewKey();
+    BOOST_CHECK(m_wallet.CommitMasternodeOperatorKey(reused_reservation, reused.GetPublicKey(), /*index=*/1) ==
+                MasternodeOperatorKeyStatus::CONFLICT);
+    BOOST_CHECK(m_wallet.CommitMasternodeOperatorKey(reused_reservation, unrelated.GetPublicKey(), reused_index) ==
+                MasternodeOperatorKeyStatus::INVALID_KEY);
+    BOOST_CHECK(m_wallet.CommitMasternodeOperatorKey(reused_reservation, reused.GetPublicKey(), reused_index) ==
+                MasternodeOperatorKeyStatus::SUCCESS);
+    BOOST_CHECK_EQUAL(CountOperatorIndexRecords(m_wallet), 1U);
+    BOOST_CHECK(m_wallet.CommitMasternodeOperatorKey(reused_reservation, reused.GetPublicKey(), reused_index) ==
+                MasternodeOperatorKeyStatus::CONFLICT);
+
+    m_wallet.ReleaseMasternodeOperatorKey(concurrent_reservation);
+}
+
+BOOST_AUTO_TEST_CASE(recovery_is_exact_and_does_not_persist)
+{
+    SetupLegacyMnemonic(m_wallet);
+    CBLSSecretKey expected;
+    BOOST_REQUIRE(m_wallet.DeriveMasternodeOperatorKey(2, expected) == MasternodeOperatorKeyStatus::SUCCESS);
+
+    CBLSSecretKey recovered;
+    uint32_t recovered_index{MASTERNODE_OPERATOR_KEY_LIMIT};
+    BOOST_CHECK(m_wallet.GetMasternodeOperatorKey(expected.GetPublicKey(), recovered, recovered_index) ==
+                MasternodeOperatorKeyStatus::SUCCESS);
+    BOOST_CHECK(recovered == expected);
+    BOOST_CHECK_EQUAL(recovered_index, 2U);
+    BOOST_CHECK_EQUAL(CountOperatorIndexRecords(m_wallet), 0U);
+
+    CBLSSecretKey foreign;
+    foreign.MakeNewKey();
+    BOOST_CHECK(m_wallet.GetMasternodeOperatorKey(foreign.GetPublicKey(), recovered, recovered_index) ==
+                MasternodeOperatorKeyStatus::NOT_FOUND);
+    BOOST_CHECK_EQUAL(CountOperatorIndexRecords(m_wallet), 0U);
+}
+
+BOOST_AUTO_TEST_CASE(restored_wallet_skips_registered_keys)
+{
+    SetupLegacyMnemonic(m_wallet);
+    CBLSSecretKey registered;
+    BOOST_REQUIRE(m_wallet.DeriveMasternodeOperatorKey(0, registered) == MasternodeOperatorKeyStatus::SUCCESS);
+
+    auto restored{MakeWallet()};
+    SetupLegacyMnemonic(*restored);
+    const std::vector<std::vector<unsigned char>> in_use{PublicKeyBytes(registered)};
+    CBLSSecretKey next;
+    uint32_t next_index{MASTERNODE_OPERATOR_KEY_LIMIT};
+    uint64_t reservation{0};
+    BOOST_REQUIRE(restored->ReserveMasternodeOperatorKey(in_use, next, next_index, reservation) ==
+                  MasternodeOperatorKeyStatus::SUCCESS);
+    BOOST_CHECK_EQUAL(next_index, 1U);
+    BOOST_CHECK(next != registered);
+    restored->ReleaseMasternodeOperatorKey(reservation);
+}
+
+BOOST_AUTO_TEST_CASE(explicit_exhaustion_and_invalid_input)
+{
+    SetupLegacyMnemonic(m_wallet);
+    std::vector<std::vector<unsigned char>> in_use;
+    in_use.reserve(MASTERNODE_OPERATOR_KEY_LIMIT);
+    for (uint32_t index{0}; index < MASTERNODE_OPERATOR_KEY_LIMIT; ++index) {
+        CBLSSecretKey secret;
+        BOOST_REQUIRE(m_wallet.DeriveMasternodeOperatorKey(index, secret) == MasternodeOperatorKeyStatus::SUCCESS);
+        in_use.push_back(PublicKeyBytes(secret));
+    }
+
+    CBLSSecretKey exhausted;
+    uint32_t index{0};
+    uint64_t reservation{0};
+    BOOST_CHECK(m_wallet.ReserveMasternodeOperatorKey(in_use, exhausted, index, reservation) ==
+                MasternodeOperatorKeyStatus::EXHAUSTED);
+
+    in_use.front().pop_back();
+    BOOST_CHECK(m_wallet.ReserveMasternodeOperatorKey(in_use, exhausted, index, reservation) ==
+                MasternodeOperatorKeyStatus::INVALID_KEY);
+}
+
+BOOST_AUTO_TEST_CASE(locked_no_seed_and_raw_seed_wallets)
+{
+    SetupLegacyMnemonic(m_wallet);
+    BOOST_REQUIRE(m_wallet.EncryptWallet("passphrase"));
+    BOOST_REQUIRE(m_wallet.IsLocked());
+    BOOST_CHECK(m_wallet.CanDeriveMasternodeOperatorKey());
+
+    CBLSSecretKey secret;
+    uint32_t index{0};
+    uint64_t reservation{0};
+    BOOST_CHECK(m_wallet.ReserveMasternodeOperatorKey({}, secret, index, reservation) ==
+                MasternodeOperatorKeyStatus::WALLET_LOCKED);
+    BOOST_REQUIRE(m_wallet.Unlock("passphrase"));
+    BOOST_CHECK(m_wallet.ReserveMasternodeOperatorKey({}, secret, index, reservation) ==
+                MasternodeOperatorKeyStatus::SUCCESS);
+    m_wallet.ReleaseMasternodeOperatorKey(reservation);
+
+    auto no_seed{MakeWallet()};
+    BOOST_CHECK(!no_seed->CanDeriveMasternodeOperatorKey());
+    BOOST_CHECK(no_seed->ReserveMasternodeOperatorKey({}, secret, index, reservation) ==
+                MasternodeOperatorKeyStatus::NOT_SUPPORTED);
+
+    auto raw_seed{MakeWallet()};
+    SetupRawLegacySeed(*raw_seed);
+    BOOST_CHECK(!raw_seed->CanDeriveMasternodeOperatorKey());
+    BOOST_CHECK(raw_seed->ReserveMasternodeOperatorKey({}, secret, index, reservation) ==
+                MasternodeOperatorKeyStatus::NOT_SUPPORTED);
+
+    auto watch_only{MakeWallet()};
+    SetupLegacyMnemonic(*watch_only);
+    watch_only->SetWalletFlag(WALLET_FLAG_DISABLE_PRIVATE_KEYS);
+    BOOST_CHECK(!watch_only->CanDeriveMasternodeOperatorKey());
+
+    auto external_signer{MakeWallet()};
+    SetupLegacyMnemonic(*external_signer);
+    external_signer->SetWalletFlag(WALLET_FLAG_EXTERNAL_SIGNER);
+    BOOST_CHECK(!external_signer->CanDeriveMasternodeOperatorKey());
+}
+
+BOOST_AUTO_TEST_CASE(descriptor_mnemonic_wallet)
+{
+    auto descriptor{MakeWallet()};
+    {
+        LOCK(descriptor->cs_wallet);
+        descriptor->SetWalletFlag(WALLET_FLAG_DESCRIPTORS);
+        descriptor->SetupDescriptorScriptPubKeyMans(DASHSYNC_MNEMONIC, /*mnemonic_passphrase=*/"");
+    }
+    BOOST_CHECK(descriptor->CanDeriveMasternodeOperatorKey());
+
+    CBLSSecretKey secret;
+    BOOST_REQUIRE(descriptor->DeriveMasternodeOperatorKey(0, secret) == MasternodeOperatorKeyStatus::SUCCESS);
+    BOOST_CHECK_EQUAL(HexStr(secret.ToByteVector(/*specificLegacyScheme=*/false)), DASHSYNC_OPERATOR_SECRET);
+
+    BOOST_REQUIRE(descriptor->EncryptWallet("passphrase"));
+    BOOST_REQUIRE(descriptor->IsLocked());
+    BOOST_CHECK(descriptor->CanDeriveMasternodeOperatorKey());
+    BOOST_CHECK(descriptor->DeriveMasternodeOperatorKey(0, secret) == MasternodeOperatorKeyStatus::WALLET_LOCKED);
+    BOOST_REQUIRE(descriptor->Unlock("passphrase"));
+    BOOST_REQUIRE(descriptor->DeriveMasternodeOperatorKey(0, secret) == MasternodeOperatorKeyStatus::SUCCESS);
+    BOOST_CHECK_EQUAL(HexStr(secret.ToByteVector(/*specificLegacyScheme=*/false)), DASHSYNC_OPERATOR_SECRET);
+}
+
+BOOST_AUTO_TEST_CASE(multiple_mnemonics_are_ambiguous)
+{
+    auto descriptor{MakeWallet()};
+    {
+        LOCK(descriptor->cs_wallet);
+        descriptor->SetWalletFlag(WALLET_FLAG_DESCRIPTORS);
+        descriptor->SetupDescriptorScriptPubKeyMans(DASHSYNC_MNEMONIC, /*mnemonic_passphrase=*/"");
+        descriptor->SetupDescriptorScriptPubKeyMans(SECOND_MNEMONIC, /*mnemonic_passphrase=*/"");
+    }
+    BOOST_CHECK(!descriptor->CanDeriveMasternodeOperatorKey());
+}
+
+BOOST_FIXTURE_TEST_CASE(mainnet_derivation_path, WalletTestingSetup)
+{
+    SetupLegacyMnemonic(m_wallet);
+    BOOST_CHECK_EQUAL(m_wallet.GetMasternodeOperatorKeyPath(0), "m/9'/5'/3'/3'/0");
+    CBLSSecretKey secret;
+    BOOST_REQUIRE(m_wallet.DeriveMasternodeOperatorKey(0, secret) == MasternodeOperatorKeyStatus::SUCCESS);
+    BOOST_CHECK_NE(HexStr(secret.ToByteVector(/*specificLegacyScheme=*/false)), DASHSYNC_OPERATOR_SECRET);
+}
+
+BOOST_AUTO_TEST_CASE(committed_record_reloads_and_recovers_from_corruption)
+{
+    SetupLegacyMnemonic(m_wallet);
+    CBLSSecretKey secret;
+    uint32_t index{MASTERNODE_OPERATOR_KEY_LIMIT};
+    uint64_t reservation{0};
+    BOOST_REQUIRE(m_wallet.ReserveMasternodeOperatorKey({}, secret, index, reservation) ==
+                  MasternodeOperatorKeyStatus::SUCCESS);
+    BOOST_REQUIRE(m_wallet.CommitMasternodeOperatorKey(reservation, secret.GetPublicKey(), index) ==
+                  MasternodeOperatorKeyStatus::SUCCESS);
+
+    const auto records{ReadOperatorIndexRecords(m_wallet)};
+    BOOST_REQUIRE_EQUAL(records.size(), 1U);
+    auto reloaded{MakeWallet()};
+    SetupLegacyMnemonic(*reloaded);
+    {
+        LOCK(reloaded->cs_wallet);
+        BOOST_REQUIRE(reloaded->LoadMasternodeOperatorIndex(records.begin()->first, records.begin()->second));
+    }
+    CBLSSecretKey recovered;
+    uint32_t recovered_index{MASTERNODE_OPERATOR_KEY_LIMIT};
+    BOOST_CHECK(reloaded->GetMasternodeOperatorKey(secret.GetPublicKey(), recovered, recovered_index) ==
+                MasternodeOperatorKeyStatus::SUCCESS);
+    BOOST_CHECK(recovered == secret);
+
+    auto corrupt{MakeWallet()};
+    SetupLegacyMnemonic(*corrupt);
+    {
+        LOCK(corrupt->cs_wallet);
+        BOOST_REQUIRE(corrupt->LoadMasternodeOperatorIndex(records.begin()->first, /*index=*/1));
+    }
+    BOOST_CHECK(corrupt->GetMasternodeOperatorKey(secret.GetPublicKey(), recovered, recovered_index) ==
+                MasternodeOperatorKeyStatus::SUCCESS);
+    BOOST_CHECK(recovered == secret);
+    BOOST_CHECK_EQUAL(recovered_index, 0U);
+}
+
+BOOST_AUTO_TEST_SUITE_END()
+} // namespace wallet
diff --git a/src/wallet/wallet.cpp b/src/wallet/wallet.cpp
index e02442a653ec..ccac2be29755 100644
--- a/src/wallet/wallet.cpp
+++ b/src/wallet/wallet.cpp
@@ -7,6 +7,7 @@
 #include <wallet/wallet.h>
 
 #include <blockfilter.h>
+#include <bls/bls.h>
 #include <chain.h>
 #include <chainparams.h>
 #include <consensus/amount.h>
@@ -3811,6 +3812,334 @@ std::vector<const Governance::Object*> CWallet::GetGovernanceObjects()
     return vecObjects;
 }
 
+//! Basic-scheme serialization is stable across BLS scheme activation and matches
+//! the operator public keys exposed by the deterministic masternode list.
+static std::vector<unsigned char> MasternodeOperatorPublicKeyBytes(const CBLSPublicKey& public_key)
+{
+    return public_key.ToByteVector(/*specificLegacyScheme=*/false);
+}
+
+//! DashSync-compatible path: m/9'/coin'/3'/3'/index. Only the leaf is unhardened.
+constexpr uint32_t BIP32_HARDENED{0x80000000};
+constexpr uint32_t MASTERNODE_PROVIDER_FEATURE{3};
+constexpr uint32_t MASTERNODE_OPERATOR_SUBFEATURE{3};
+
+static uint32_t MasternodeOperatorCoinType()
+{
+    // DashSync uses testnet's coin type for every non-mainnet network.
+    return Params().NetworkIDString() == CBaseChainParams::MAIN ? 5 : 1;
+}
+
+static bls::ExtendedPrivateKey DeriveMasternodeOperatorAccount(const SecureVector& seed, uint32_t coin_type)
+{
+    // DashSync always uses the legacy BLS child derivation algorithm for this path,
+    // independently of the network's currently active BLS signature scheme.
+    return bls::ExtendedPrivateKey::FromSeed(bls::Bytes{seed.data(), seed.size()})
+        .PrivateChild(BIP32_HARDENED | BIP32_PURPOSE_FEATURE, /*fLegacy=*/true)
+        .PrivateChild(BIP32_HARDENED | coin_type, /*fLegacy=*/true)
+        .PrivateChild(BIP32_HARDENED | MASTERNODE_PROVIDER_FEATURE, /*fLegacy=*/true)
+        .PrivateChild(BIP32_HARDENED | MASTERNODE_OPERATOR_SUBFEATURE, /*fLegacy=*/true);
+}
+
+static CBLSSecretKey DeriveMasternodeOperatorLeaf(const bls::ExtendedPrivateKey& account, uint32_t index)
+{
+    auto secret_bytes{account.PrivateChild(index, /*fLegacy=*/true).GetPrivateKey().SerializeToArray()};
+    CBLSSecretKey secret{Span<const unsigned char>{secret_bytes.data(), secret_bytes.size()}};
+    memory_cleanse(secret_bytes.data(), secret_bytes.size());
+    return secret;
+}
+
+static bool DeriveMasternodeOperatorSecret(const SecureVector& seed, uint32_t coin_type, uint32_t index,
+                                           CBLSSecretKey& secret)
+{
+    if (seed.empty() || index >= MASTERNODE_OPERATOR_KEY_LIMIT) return false;
+
+    try {
+        secret = DeriveMasternodeOperatorLeaf(DeriveMasternodeOperatorAccount(seed, coin_type), index);
+        return secret.IsValid();
+    } catch (const std::exception& e) {
+        LogPrintf("%s: BLS derivation failed: %s\n", __func__, e.what());
+        return false;
+    }
+}
+
+//! Walk the complete recoverable range once, deriving the account only once. `visit`
+//! returns false when the caller has found what it needs.
+static bool WalkMasternodeOperatorSecrets(const SecureVector& seed, uint32_t coin_type,
+                                          const std::function<bool(uint32_t, const CBLSSecretKey&)>& visit)
+{
+    if (seed.empty()) return false;
+
+    try {
+        const bls::ExtendedPrivateKey account{DeriveMasternodeOperatorAccount(seed, coin_type)};
+        for (uint32_t index{0}; index < MASTERNODE_OPERATOR_KEY_LIMIT; ++index) {
+            const CBLSSecretKey secret{DeriveMasternodeOperatorLeaf(account, index)};
+            if (!secret.IsValid()) return false;
+            if (!visit(index, secret)) break;
+        }
+        return true;
+    } catch (const std::exception& e) {
+        LogPrintf("%s: BLS derivation failed: %s\n", __func__, e.what());
+        return false;
+    }
+}
+
+bool CWallet::LoadMasternodeOperatorIndex(const std::vector<unsigned char>& public_key, uint32_t index)
+{
+    AssertLockHeld(cs_wallet);
+    CBLSPublicKey parsed;
+    parsed.SetBytes(public_key, /*specificLegacyScheme=*/false);
+    if (!parsed.IsValid() || MasternodeOperatorPublicKeyBytes(parsed) != public_key ||
+        index >= MASTERNODE_OPERATOR_KEY_LIMIT) {
+        return false;
+    }
+    for (const auto& [recorded_public_key, recorded_index] : m_mn_operator_indexes) {
+        if (recorded_public_key != public_key && recorded_index == index) return false;
+    }
+    m_mn_operator_indexes[public_key] = index;
+    return true;
+}
+
+bool CWallet::GetBIP39Seed(SecureVector& seed) const
+{
+    memory_cleanse(seed.data(), seed.size());
+    seed.clear();
+    if (!HasSingleBIP39Seed()) return false;
+
+    LOCK(cs_wallet);
+    SecureVector found;
+    for (const auto& [id, spk_man] : m_spk_managers) {
+        SecureVector candidate;
+        if (!spk_man->GetBIP39Seed(candidate)) continue;
+        if (found.empty()) {
+            found = std::move(candidate);
+        } else if (found != candidate) {
+            WalletLogPrintf("%s: wallet has more than one BIP39 seed\n", __func__);
+            return false;
+        }
+    }
+    if (found.empty()) return false;
+
+    seed = std::move(found);
+    return true;
+}
+
+bool CWallet::HasSingleBIP39Seed() const
+{
+    LOCK(cs_wallet);
+    std::optional<std::vector<unsigned char>> source;
+    for (const auto& [id, spk_man] : m_spk_managers) {
+        std::vector<unsigned char> candidate;
+        const BIP39SeedStatus status{spk_man->GetBIP39SeedIdentifier(candidate)};
+        if (status == BIP39SeedStatus::AMBIGUOUS) return false;
+        if (status == BIP39SeedStatus::NONE) continue;
+        if (!source) {
+            source = std::move(candidate);
+        } else if (*source != candidate) {
+            return false;
+        }
+    }
+    return source.has_value();
+}
+
+bool CWallet::CanDeriveMasternodeOperatorKey() const
+{
+    if (IsWalletFlagSet(WALLET_FLAG_DISABLE_PRIVATE_KEYS) || IsWalletFlagSet(WALLET_FLAG_EXTERNAL_SIGNER)) {
+        return false;
+    }
+    return HasSingleBIP39Seed();
+}
+
+MasternodeOperatorKeyStatus CWallet::DeriveMasternodeOperatorKey(uint32_t index, CBLSSecretKey& secret) const
+{
+    secret.Reset();
+    if (!CanDeriveMasternodeOperatorKey()) return MasternodeOperatorKeyStatus::NOT_SUPPORTED;
+    if (index >= MASTERNODE_OPERATOR_KEY_LIMIT) return MasternodeOperatorKeyStatus::INVALID_KEY;
+    if (IsLocked()) return MasternodeOperatorKeyStatus::WALLET_LOCKED;
+
+    SecureVector seed;
+    if (!GetBIP39Seed(seed)) return MasternodeOperatorKeyStatus::DERIVATION_ERROR;
+    const bool derived{DeriveMasternodeOperatorSecret(seed, MasternodeOperatorCoinType(), index, secret)};
+    memory_cleanse(seed.data(), seed.size());
+    return derived ? MasternodeOperatorKeyStatus::SUCCESS : MasternodeOperatorKeyStatus::DERIVATION_ERROR;
+}
+
+MasternodeOperatorKeyStatus CWallet::ReserveMasternodeOperatorKey(const std::vector<std::vector<unsigned char>>& in_use,
+                                                                  CBLSSecretKey& secret, uint32_t& index,
+                                                                  uint64_t& reservation_id)
+{
+    secret.Reset();
+    index = MASTERNODE_OPERATOR_KEY_LIMIT;
+    reservation_id = 0;
+    if (!CanDeriveMasternodeOperatorKey()) return MasternodeOperatorKeyStatus::NOT_SUPPORTED;
+    if (IsLocked()) return MasternodeOperatorKeyStatus::WALLET_LOCKED;
+
+    std::set<std::vector<unsigned char>> taken_public_keys;
+    for (const auto& public_key : in_use) {
+        CBLSPublicKey parsed;
+        parsed.SetBytes(public_key, /*specificLegacyScheme=*/false);
+        if (!parsed.IsValid() || MasternodeOperatorPublicKeyBytes(parsed) != public_key) {
+            return MasternodeOperatorKeyStatus::INVALID_KEY;
+        }
+        taken_public_keys.insert(public_key);
+    }
+
+    SecureVector seed;
+    if (!GetBIP39Seed(seed)) return MasternodeOperatorKeyStatus::DERIVATION_ERROR;
+
+    CBLSSecretKey found;
+    uint32_t found_index{0};
+    const bool walked{WalkMasternodeOperatorSecrets(
+        seed, MasternodeOperatorCoinType(), [&](uint32_t candidate_index, const CBLSSecretKey& candidate) {
+            const std::vector<unsigned char> candidate_public_key{
+                MasternodeOperatorPublicKeyBytes(candidate.GetPublicKey())};
+            if (taken_public_keys.count(candidate_public_key) > 0) return true;
+
+            // Selection and insertion must be atomic, but BLS derivation need not hold
+            // the wallet lock. This prevents concurrent flows from reserving one index
+            // without blocking wallet activity for the entire bounded walk.
+            LOCK(cs_wallet);
+            if (m_mn_operator_indexes.count(candidate_public_key) > 0) return true;
+            if (std::any_of(m_mn_operator_indexes.begin(), m_mn_operator_indexes.end(),
+                            [candidate_index](const auto& entry) { return entry.second == candidate_index; }) ||
+                std::any_of(m_mn_operator_reservations.begin(), m_mn_operator_reservations.end(),
+                            [candidate_index](const auto& entry) { return entry.second == candidate_index; })) {
+                return true;
+            }
+
+            do {
+                ++m_next_mn_operator_reservation;
+            } while (m_next_mn_operator_reservation == 0 ||
+                     m_mn_operator_reservations.count(m_next_mn_operator_reservation) > 0);
+            reservation_id = m_next_mn_operator_reservation;
+            m_mn_operator_reservations.emplace(reservation_id, candidate_index);
+            found = candidate;
+            found_index = candidate_index;
+            return false;
+        })};
+    memory_cleanse(seed.data(), seed.size());
+    if (!walked) return MasternodeOperatorKeyStatus::DERIVATION_ERROR;
+    if (!found.IsValid()) return MasternodeOperatorKeyStatus::EXHAUSTED;
+
+    // The visitor held the index only in memory. Cancellation releases it; only
+    // CommitMasternodeOperatorKey persists it.
+    secret = found;
+    index = found_index;
+    return MasternodeOperatorKeyStatus::SUCCESS;
+}
+
+void CWallet::ReleaseMasternodeOperatorKey(uint64_t reservation_id)
+{
+    LOCK(cs_wallet);
+    m_mn_operator_reservations.erase(reservation_id);
+}
+
+MasternodeOperatorKeyStatus CWallet::CommitMasternodeOperatorKey(uint64_t reservation_id,
+                                                                 const CBLSPublicKey& public_key, uint32_t index)
+{
+    if (reservation_id == 0 || !public_key.IsValid() || index >= MASTERNODE_OPERATOR_KEY_LIMIT) {
+        return MasternodeOperatorKeyStatus::INVALID_KEY;
+    }
+
+    {
+        LOCK(cs_wallet);
+        const auto reservation{m_mn_operator_reservations.find(reservation_id)};
+        if (reservation == m_mn_operator_reservations.end() || reservation->second != index) {
+            return MasternodeOperatorKeyStatus::CONFLICT;
+        }
+    }
+
+    CBLSSecretKey derived;
+    const MasternodeOperatorKeyStatus status{DeriveMasternodeOperatorKey(index, derived)};
+    if (status != MasternodeOperatorKeyStatus::SUCCESS) return status;
+
+    const std::vector<unsigned char> public_key_bytes{MasternodeOperatorPublicKeyBytes(public_key)};
+    if (MasternodeOperatorPublicKeyBytes(derived.GetPublicKey()) != public_key_bytes) {
+        return MasternodeOperatorKeyStatus::INVALID_KEY;
+    }
+
+    LOCK(cs_wallet);
+    const auto reservation{m_mn_operator_reservations.find(reservation_id)};
+    if (reservation == m_mn_operator_reservations.end() || reservation->second != index) {
+        return MasternodeOperatorKeyStatus::CONFLICT;
+    }
+    if (const auto it{m_mn_operator_indexes.find(public_key_bytes)}; it != m_mn_operator_indexes.end()) {
+        if (it->second != index) return MasternodeOperatorKeyStatus::CONFLICT;
+        m_mn_operator_reservations.erase(reservation);
+        return MasternodeOperatorKeyStatus::SUCCESS;
+    }
+    for (const auto& [recorded_public_key, recorded_index] : m_mn_operator_indexes) {
+        if (recorded_index == index) return MasternodeOperatorKeyStatus::CONFLICT;
+    }
+
+    WalletBatch batch(GetDatabase());
+    if (!batch.WriteMasternodeOperatorIndex(public_key_bytes, index)) {
+        return MasternodeOperatorKeyStatus::DATABASE_ERROR;
+    }
+    m_mn_operator_indexes.emplace(public_key_bytes, index);
+    m_mn_operator_reservations.erase(reservation);
+    return MasternodeOperatorKeyStatus::SUCCESS;
+}
+
+MasternodeOperatorKeyStatus CWallet::GetMasternodeOperatorKey(const CBLSPublicKey& public_key, CBLSSecretKey& secret,
+                                                              uint32_t& index) const
+{
+    secret.Reset();
+    index = MASTERNODE_OPERATOR_KEY_LIMIT;
+    if (!public_key.IsValid()) return MasternodeOperatorKeyStatus::INVALID_KEY;
+    if (!CanDeriveMasternodeOperatorKey()) return MasternodeOperatorKeyStatus::NOT_SUPPORTED;
+    if (IsLocked()) return MasternodeOperatorKeyStatus::WALLET_LOCKED;
+
+    const std::vector<unsigned char> public_key_bytes{MasternodeOperatorPublicKeyBytes(public_key)};
+    std::optional<uint32_t> recorded_index;
+    {
+        LOCK(cs_wallet);
+        if (const auto it{m_mn_operator_indexes.find(public_key_bytes)}; it != m_mn_operator_indexes.end()) {
+            recorded_index = it->second;
+        }
+    }
+
+    if (recorded_index) {
+        CBLSSecretKey derived;
+        const MasternodeOperatorKeyStatus status{DeriveMasternodeOperatorKey(*recorded_index, derived)};
+        if (status != MasternodeOperatorKeyStatus::SUCCESS) return status;
+        if (MasternodeOperatorPublicKeyBytes(derived.GetPublicKey()) == public_key_bytes) {
+            secret = derived;
+            index = *recorded_index;
+            return MasternodeOperatorKeyStatus::SUCCESS;
+        }
+        WalletLogPrintf("%s: ignoring mismatched masternode operator index record\n", __func__);
+    }
+
+    SecureVector seed;
+    if (!GetBIP39Seed(seed)) return MasternodeOperatorKeyStatus::DERIVATION_ERROR;
+
+    CBLSSecretKey found;
+    uint32_t found_index{0};
+    const bool walked{WalkMasternodeOperatorSecrets(seed, MasternodeOperatorCoinType(),
+                                                    [&](uint32_t candidate_index, const CBLSSecretKey& candidate) {
+                                                        if (MasternodeOperatorPublicKeyBytes(candidate.GetPublicKey()) !=
+                                                            public_key_bytes)
+                                                            return true;
+                                                        found = candidate;
+                                                        found_index = candidate_index;
+                                                        return false;
+                                                    })};
+    memory_cleanse(seed.data(), seed.size());
+    if (!walked) return MasternodeOperatorKeyStatus::DERIVATION_ERROR;
+    if (!found.IsValid()) return MasternodeOperatorKeyStatus::NOT_FOUND;
+
+    secret = found;
+    index = found_index;
+    return MasternodeOperatorKeyStatus::SUCCESS;
+}
+
+std::string CWallet::GetMasternodeOperatorKeyPath(uint32_t index) const
+{
+    return strprintf("m/%d'/%d'/%d'/%d'/%d", static_cast<uint32_t>(BIP32_PURPOSE_FEATURE), MasternodeOperatorCoinType(),
+                     MASTERNODE_PROVIDER_FEATURE, MASTERNODE_OPERATOR_SUBFEATURE, index);
+}
+
 CKeyPool::CKeyPool()
 {
     nTime = GetTime();
diff --git a/src/wallet/wallet.h b/src/wallet/wallet.h
index fd5eb5b11e1c..0bd03ea2dd38 100644
--- a/src/wallet/wallet.h
+++ b/src/wallet/wallet.h
@@ -8,6 +8,7 @@
 #define BITCOIN_WALLET_WALLET_H
 
 #include <consensus/amount.h>
+#include <external_signer.h>
 #include <governance/common.h>
 #include <interfaces/chain.h>
 #include <interfaces/coinjoin.h>
@@ -20,14 +21,14 @@
 #include <util/hasher.h>
 #include <util/message.h>
 #include <util/result.h>
+#include <util/strencodings.h>
 #include <util/string.h>
 #include <util/system.h>
-#include <util/strencodings.h>
 #include <util/ui_change_type.h>
 #include <validationinterface.h>
-#include <wallet/crypter.h>
 #include <wallet/coinselection.h>
-#include <external_signer.h>
+#include <wallet/crypter.h>
+#include <wallet/masternode_operator.h>
 #include <wallet/scriptpubkeyman.h>
 #include <wallet/transaction.h>
 #include <wallet/walletdb.h>
@@ -49,6 +50,8 @@
 
 #include <boost/signals2/signal.hpp>
 
+class CBLSPublicKey;
+class CBLSSecretKey;
 class CKey;
 class CScript;
 class CTxDSIn;
@@ -426,6 +429,15 @@ class CWallet final : public WalletStorage, public interfaces::Chain::Notificati
     //! Whether the CoinJoin client is mixing with this wallet
     std::atomic<bool> m_mixing{false};
 
+    /** Deterministic masternode operator keys that completed registration, mapping
+     *  basic-scheme public-key bytes to their recoverable derivation index. */
+    std::map<std::vector<unsigned char>, uint32_t> m_mn_operator_indexes GUARDED_BY(cs_wallet);
+    /** Provisional operator-key indexes held by active registration flows. These are
+     *  intentionally memory-only: cancellation/restart releases them, while `in_use`
+     *  supplies successful registrations after the wallet restarts. */
+    std::map<uint64_t, uint32_t> m_mn_operator_reservations GUARDED_BY(cs_wallet);
+    uint64_t m_next_mn_operator_reservation GUARDED_BY(cs_wallet){0};
+
     /** Height of last block processed is used by wallet to know depth of transactions
      * without relying on Chain interface beyond asynchronous updates. For safety, we
      * initialize it to -1. Height is a pointer on node's tip and doesn't imply
@@ -998,6 +1010,35 @@ class CWallet final : public WalletStorage, public interfaces::Chain::Notificati
     /** Returns a vector containing pointers to the governance objects in m_gobjects */
     std::vector<const Governance::Object*> GetGovernanceObjects() EXCLUSIVE_LOCKS_REQUIRED(cs_wallet);
 
+    /** Load a committed operator-key index record. Public-key/index consistency is
+     *  checked later when the unlocked wallet can re-derive the secret. */
+    bool LoadMasternodeOperatorIndex(const std::vector<unsigned char>& public_key, uint32_t index)
+        EXCLUSIVE_LOCKS_REQUIRED(cs_wallet);
+
+    /** Return the one BIP39 seed shared by this wallet's ScriptPubKeyMans. */
+    bool GetBIP39Seed(SecureVector& seed) const;
+    /** Whether the wallet has exactly one identifiable BIP39 seed source. */
+    bool HasSingleBIP39Seed() const;
+    /** Whether deterministic operator-key operations are supported. */
+    bool CanDeriveMasternodeOperatorKey() const;
+    /** Derive one key directly. Indexes outside the bounded recovery range are rejected. */
+    MasternodeOperatorKeyStatus DeriveMasternodeOperatorKey(uint32_t index, CBLSSecretKey& secret) const;
+    /** Reserve the next unused key in memory without persisting it. */
+    MasternodeOperatorKeyStatus ReserveMasternodeOperatorKey(const std::vector<std::vector<unsigned char>>& in_use,
+                                                             CBLSSecretKey& secret, uint32_t& index,
+                                                             uint64_t& reservation_id);
+    /** Release an incomplete registration's in-memory reservation. */
+    void ReleaseMasternodeOperatorKey(uint64_t reservation_id);
+    /** Verify and persist a reserved index only after its registration succeeded. */
+    MasternodeOperatorKeyStatus CommitMasternodeOperatorKey(uint64_t reservation_id, const CBLSPublicKey& public_key,
+                                                            uint32_t index);
+    /** Recover a key exactly by public key, using a bounded walk when no record exists.
+     *  Recovery itself does not create an index record. */
+    MasternodeOperatorKeyStatus GetMasternodeOperatorKey(const CBLSPublicKey& public_key, CBLSSecretKey& secret,
+                                                         uint32_t& index) const;
+    /** Human-readable DashSync-compatible derivation path. */
+    std::string GetMasternodeOperatorKeyPath(uint32_t index) const;
+
     /**
      * Blocks until the wallet state is up-to-date to /at least/ the current
      * chain at the time this function is entered
diff --git a/src/wallet/walletdb.cpp b/src/wallet/walletdb.cpp
index 6a1f62c3ff09..49bae52e1aef 100644
--- a/src/wallet/walletdb.cpp
+++ b/src/wallet/walletdb.cpp
@@ -51,6 +51,7 @@ const std::string KEYMETA{"keymeta"};
 const std::string KEY{"key"};
 const std::string LOCKED_UTXO{"lockedutxo"};
 const std::string MASTER_KEY{"mkey"};
+const std::string MASTERNODE_OPERATOR_INDEX{"mnopidx"};
 const std::string MINVERSION{"minversion"};
 const std::string NAME{"name"};
 const std::string OLD_KEY{"wkey"};
@@ -242,6 +243,11 @@ bool WalletBatch::WriteCoinJoinPendingObs(const std::map<COutPoint, int64_t>& pe
     return WriteIC(DBKeys::COINJOIN_PENDING_OBS, pending_obs);
 }
 
+bool WalletBatch::WriteMasternodeOperatorIndex(const std::vector<unsigned char>& public_key, uint32_t index)
+{
+    return WriteIC(std::make_pair(DBKeys::MASTERNODE_OPERATOR_INDEX, public_key), index);
+}
+
 bool WalletBatch::WriteGovernanceObject(const Governance::Object& obj)
 {
     return WriteIC(std::make_pair(DBKeys::G_OBJECT, obj.GetHash()), obj, false);
@@ -355,6 +361,7 @@ class CWalletScanState {
     std::map<std::pair<uint256, CKeyID>, std::pair<CPubKey, std::vector<unsigned char>>> m_descriptor_crypt_keys;
     std::map<std::pair<uint256, CKeyID>, std::pair<SecureString, SecureString>> mnemonics;
     std::map<std::pair<uint256, CKeyID>, std::pair<std::vector<unsigned char>, std::vector<unsigned char>>> crypted_mnemonics;
+    std::map<std::vector<unsigned char>, uint32_t> m_mn_operator_indexes;
     bool tx_corrupt{false};
 
     CWalletScanState() = default;
@@ -787,6 +794,12 @@ ReadKeyValue(CWallet* pwallet, CDataStream& ssKey, CDataStream& ssValue,
                 wss.crypted_mnemonics.insert(std::make_pair(std::make_pair(desc_id, pubkey.GetID()), std::make_pair(mnemonic, mnemonic_passphrase)));
             }
 
+        } else if (strType == DBKeys::MASTERNODE_OPERATOR_INDEX) {
+            std::vector<unsigned char> public_key;
+            uint32_t index;
+            ssKey >> public_key;
+            ssValue >> index;
+            wss.m_mn_operator_indexes[public_key] = index;
         } else if (strType == DBKeys::LOCKED_UTXO) {
             uint256 hash;
             uint32_t n;
@@ -794,9 +807,8 @@ ReadKeyValue(CWallet* pwallet, CDataStream& ssKey, CDataStream& ssValue,
             ssKey >> n;
             pwallet->LockCoin(COutPoint(hash, n));
         } else if (strType != DBKeys::BESTBLOCK && strType != DBKeys::BESTBLOCK_NOMERKLE &&
-                   strType != DBKeys::MINVERSION && strType != DBKeys::ACENTRY &&
-                   strType != DBKeys::VERSION && strType != DBKeys::SETTINGS &&
-                   strType != DBKeys::PRIVATESEND_SALT && strType != DBKeys::COINJOIN_SALT &&
+                   strType != DBKeys::MINVERSION && strType != DBKeys::ACENTRY && strType != DBKeys::VERSION &&
+                   strType != DBKeys::SETTINGS && strType != DBKeys::PRIVATESEND_SALT && strType != DBKeys::COINJOIN_SALT &&
                    strType != DBKeys::COINJOIN_PENDING_OBS && strType != DBKeys::FLAGS) {
             wss.m_unknown_records++;
         }
@@ -970,6 +982,14 @@ DBErrors WalletBatch::LoadWallet(CWallet* pwallet)
         }
     }
 
+    // Invalid cache records do not prevent the wallet from loading. They hold no secret
+    // and can at worst require the operator key to be recovered from its public key again.
+    for (const auto& [public_key, index] : wss.m_mn_operator_indexes) {
+        if (!pwallet->LoadMasternodeOperatorIndex(public_key, index)) {
+            pwallet->WalletLogPrintf("Ignoring unusable masternode operator index record\n");
+        }
+    }
+
     if (rescan_required && result == DBErrors::LOAD_OK) {
         result = DBErrors::NEED_RESCAN;
     } else if (fNoncriticalErrors && result == DBErrors::LOAD_OK) {
diff --git a/src/wallet/walletdb.h b/src/wallet/walletdb.h
index fac9f7453e02..fd0efb97efdf 100644
--- a/src/wallet/walletdb.h
+++ b/src/wallet/walletdb.h
@@ -82,6 +82,7 @@ extern const std::string KEY;
 extern const std::string KEYMETA;
 extern const std::string LOCKED_UTXO;
 extern const std::string MASTER_KEY;
+extern const std::string MASTERNODE_OPERATOR_INDEX;
 extern const std::string MINVERSION;
 extern const std::string NAME;
 extern const std::string OLD_KEY;
@@ -226,6 +227,10 @@ class WalletBatch
     bool ReadCoinJoinPendingObs(std::map<COutPoint, int64_t>& pending_obs);
     bool WriteCoinJoinPendingObs(const std::map<COutPoint, int64_t>& pending_obs);
 
+    /** Committed deterministic operator-key index, keyed by basic-scheme public key.
+     *  The secret is never stored because the BIP39 seed reproduces it. */
+    bool WriteMasternodeOperatorIndex(const std::vector<unsigned char>& public_key, uint32_t index);
+
     /** Write a CGovernanceObject to the database */
     bool WriteGovernanceObject(const Governance::Object& obj);
 

From 819e95ca0f4ee030582d4b1180a79d2cae354e45 Mon Sep 17 00:00:00 2001
From: pasta <pasta@dashboost.org>
Date: Wed, 12 Aug 2026 23:22:16 -0500
Subject: [PATCH 02/14] docs: add release notes for wallet-derived operator
 keys

---
 doc/release-notes-7594.md | 8 ++++++++
 1 file changed, 8 insertions(+)
 create mode 100644 doc/release-notes-7594.md

diff --git a/doc/release-notes-7594.md b/doc/release-notes-7594.md
new file mode 100644
index 000000000000..af1fd81b9e1c
--- /dev/null
+++ b/doc/release-notes-7594.md
@@ -0,0 +1,8 @@
+Wallet
+------
+
+* Mnemonic-backed wallets can now derive and recover masternode operator BLS
+  keys using the DashSync-compatible `m/9'/coin'/3'/3'/index` path. A successful
+  registration can record the public key's derivation index without storing the
+  operator secret separately; the recovery phrase remains the backup. Existing
+  operator keys and wallets without a BIP39 recovery phrase are unchanged.

From eb0ba49ee35e1d5839c3528a9a496940f60bf9c4 Mon Sep 17 00:00:00 2001
From: pasta <pasta@dashboost.org>
Date: Thu, 13 Aug 2026 00:09:36 -0500
Subject: [PATCH 03/14] fix(wallet): avoid cleansing null seed buffers

---
 src/wallet/scriptpubkeyman.cpp | 4 ++--
 src/wallet/wallet.cpp          | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/src/wallet/scriptpubkeyman.cpp b/src/wallet/scriptpubkeyman.cpp
index 56eabd6b534a..4d3a99351e92 100644
--- a/src/wallet/scriptpubkeyman.cpp
+++ b/src/wallet/scriptpubkeyman.cpp
@@ -789,7 +789,7 @@ BIP39SeedStatus LegacyScriptPubKeyMan::GetBIP39SeedIdentifier(std::vector<unsign
 
 bool LegacyScriptPubKeyMan::GetBIP39Seed(SecureVector& seed) const
 {
-    memory_cleanse(seed.data(), seed.size());
+    if (!seed.empty()) memory_cleanse(seed.data(), seed.size());
     seed.clear();
     CHDChain chain;
     if (!GetDecryptedHDChain(chain)) return false;
@@ -2777,7 +2777,7 @@ BIP39SeedStatus DescriptorScriptPubKeyMan::GetBIP39SeedIdentifier(std::vector<un
 
 bool DescriptorScriptPubKeyMan::GetBIP39Seed(SecureVector& seed) const
 {
-    memory_cleanse(seed.data(), seed.size());
+    if (!seed.empty()) memory_cleanse(seed.data(), seed.size());
     seed.clear();
     SecureString mnemonic;
     SecureString passphrase;
diff --git a/src/wallet/wallet.cpp b/src/wallet/wallet.cpp
index ccac2be29755..0f5a1b46aec7 100644
--- a/src/wallet/wallet.cpp
+++ b/src/wallet/wallet.cpp
@@ -3902,7 +3902,7 @@ bool CWallet::LoadMasternodeOperatorIndex(const std::vector<unsigned char>& publ
 
 bool CWallet::GetBIP39Seed(SecureVector& seed) const
 {
-    memory_cleanse(seed.data(), seed.size());
+    if (!seed.empty()) memory_cleanse(seed.data(), seed.size());
     seed.clear();
     if (!HasSingleBIP39Seed()) return false;
 

From c39dc912bd23d61e2724581aea24d648e8b1bea6 Mon Sep 17 00:00:00 2001
From: pasta <pasta@dashboost.org>
Date: Thu, 13 Aug 2026 00:20:08 -0500
Subject: [PATCH 04/14] fix(wallet): serialize operator key derivation

---
 src/wallet/test/masternode_operator_tests.cpp | 50 +++++++++++++++++++
 src/wallet/wallet.cpp                         | 33 ++++++------
 src/wallet/wallet.h                           |  2 +-
 3 files changed, 67 insertions(+), 18 deletions(-)

diff --git a/src/wallet/test/masternode_operator_tests.cpp b/src/wallet/test/masternode_operator_tests.cpp
index 4b6c4786c1d6..43e0c75d7615 100644
--- a/src/wallet/test/masternode_operator_tests.cpp
+++ b/src/wallet/test/masternode_operator_tests.cpp
@@ -14,9 +14,11 @@
 
 #include <boost/test/unit_test.hpp>
 
+#include <atomic>
 #include <map>
 #include <memory>
 #include <string>
+#include <thread>
 #include <vector>
 
 namespace wallet {
@@ -231,6 +233,54 @@ BOOST_AUTO_TEST_CASE(recovery_is_exact_and_does_not_persist)
     BOOST_CHECK_EQUAL(CountOperatorIndexRecords(m_wallet), 0U);
 }
 
+BOOST_AUTO_TEST_CASE(wallet_lock_serializes_secret_recovery)
+{
+    SetupLegacyMnemonic(m_wallet);
+    CBLSSecretKey expected;
+    BOOST_REQUIRE(m_wallet.DeriveMasternodeOperatorKey(MASTERNODE_OPERATOR_KEY_LIMIT - 1, expected) ==
+                  MasternodeOperatorKeyStatus::SUCCESS);
+    BOOST_REQUIRE(m_wallet.EncryptWallet("passphrase"));
+    BOOST_REQUIRE(m_wallet.Unlock("passphrase"));
+
+    CBLSSecretKey recovered;
+    uint32_t recovered_index{MASTERNODE_OPERATOR_KEY_LIMIT};
+    MasternodeOperatorKeyStatus status{MasternodeOperatorKeyStatus::DERIVATION_ERROR};
+    std::atomic<bool> finished{false};
+    std::thread recovery_thread{[&] {
+        status = m_wallet.GetMasternodeOperatorKey(expected.GetPublicKey(), recovered, recovered_index);
+        finished.store(true, std::memory_order_release);
+    }};
+
+    bool recovery_holds_wallet_lock{false};
+    while (!finished.load(std::memory_order_acquire)) {
+        TRY_LOCK(m_wallet.cs_wallet, wallet_lock);
+        if (!wallet_lock) {
+            recovery_holds_wallet_lock = true;
+            break;
+        }
+        std::this_thread::yield();
+    }
+
+    const bool lock_result{m_wallet.Lock()};
+    // Lock() acquiring cs_wallet synchronizes with publication of these outputs,
+    // even if the recovery thread has not yet stored its completion flag.
+    const bool secret_published_before_lock{recovered.IsValid()};
+    const uint32_t index_published_before_lock{recovered_index};
+    recovery_thread.join();
+
+    BOOST_REQUIRE(recovery_holds_wallet_lock);
+    BOOST_REQUIRE(lock_result);
+    BOOST_CHECK(secret_published_before_lock);
+    BOOST_CHECK_EQUAL(index_published_before_lock, MASTERNODE_OPERATOR_KEY_LIMIT - 1);
+    BOOST_CHECK(status == MasternodeOperatorKeyStatus::SUCCESS);
+    BOOST_CHECK(m_wallet.IsLocked());
+
+    BOOST_CHECK(m_wallet.GetMasternodeOperatorKey(expected.GetPublicKey(), recovered, recovered_index) ==
+                MasternodeOperatorKeyStatus::WALLET_LOCKED);
+    BOOST_CHECK(!recovered.IsValid());
+    BOOST_CHECK_EQUAL(recovered_index, MASTERNODE_OPERATOR_KEY_LIMIT);
+}
+
 BOOST_AUTO_TEST_CASE(restored_wallet_skips_registered_keys)
 {
     SetupLegacyMnemonic(m_wallet);
diff --git a/src/wallet/wallet.cpp b/src/wallet/wallet.cpp
index 0f5a1b46aec7..b291349afbdc 100644
--- a/src/wallet/wallet.cpp
+++ b/src/wallet/wallet.cpp
@@ -3902,11 +3902,11 @@ bool CWallet::LoadMasternodeOperatorIndex(const std::vector<unsigned char>& publ
 
 bool CWallet::GetBIP39Seed(SecureVector& seed) const
 {
+    AssertLockHeld(cs_wallet);
     if (!seed.empty()) memory_cleanse(seed.data(), seed.size());
     seed.clear();
     if (!HasSingleBIP39Seed()) return false;
 
-    LOCK(cs_wallet);
     SecureVector found;
     for (const auto& [id, spk_man] : m_spk_managers) {
         SecureVector candidate;
@@ -3953,6 +3953,9 @@ bool CWallet::CanDeriveMasternodeOperatorKey() const
 MasternodeOperatorKeyStatus CWallet::DeriveMasternodeOperatorKey(uint32_t index, CBLSSecretKey& secret) const
 {
     secret.Reset();
+    // Keep walletlock from clearing the master key while an operation is still
+    // deriving or publishing a secret copied from it.
+    LOCK(cs_wallet);
     if (!CanDeriveMasternodeOperatorKey()) return MasternodeOperatorKeyStatus::NOT_SUPPORTED;
     if (index >= MASTERNODE_OPERATOR_KEY_LIMIT) return MasternodeOperatorKeyStatus::INVALID_KEY;
     if (IsLocked()) return MasternodeOperatorKeyStatus::WALLET_LOCKED;
@@ -3971,6 +3974,9 @@ MasternodeOperatorKeyStatus CWallet::ReserveMasternodeOperatorKey(const std::vec
     secret.Reset();
     index = MASTERNODE_OPERATOR_KEY_LIMIT;
     reservation_id = 0;
+    // Reservation publication and secret derivation form one operation with
+    // respect to walletlock.
+    LOCK(cs_wallet);
     if (!CanDeriveMasternodeOperatorKey()) return MasternodeOperatorKeyStatus::NOT_SUPPORTED;
     if (IsLocked()) return MasternodeOperatorKeyStatus::WALLET_LOCKED;
 
@@ -3995,10 +4001,6 @@ MasternodeOperatorKeyStatus CWallet::ReserveMasternodeOperatorKey(const std::vec
                 MasternodeOperatorPublicKeyBytes(candidate.GetPublicKey())};
             if (taken_public_keys.count(candidate_public_key) > 0) return true;
 
-            // Selection and insertion must be atomic, but BLS derivation need not hold
-            // the wallet lock. This prevents concurrent flows from reserving one index
-            // without blocking wallet activity for the entire bounded walk.
-            LOCK(cs_wallet);
             if (m_mn_operator_indexes.count(candidate_public_key) > 0) return true;
             if (std::any_of(m_mn_operator_indexes.begin(), m_mn_operator_indexes.end(),
                             [candidate_index](const auto& entry) { return entry.second == candidate_index; }) ||
@@ -4041,12 +4043,10 @@ MasternodeOperatorKeyStatus CWallet::CommitMasternodeOperatorKey(uint64_t reserv
         return MasternodeOperatorKeyStatus::INVALID_KEY;
     }
 
-    {
-        LOCK(cs_wallet);
-        const auto reservation{m_mn_operator_reservations.find(reservation_id)};
-        if (reservation == m_mn_operator_reservations.end() || reservation->second != index) {
-            return MasternodeOperatorKeyStatus::CONFLICT;
-        }
+    LOCK(cs_wallet);
+    const auto initial_reservation{m_mn_operator_reservations.find(reservation_id)};
+    if (initial_reservation == m_mn_operator_reservations.end() || initial_reservation->second != index) {
+        return MasternodeOperatorKeyStatus::CONFLICT;
     }
 
     CBLSSecretKey derived;
@@ -4058,7 +4058,6 @@ MasternodeOperatorKeyStatus CWallet::CommitMasternodeOperatorKey(uint64_t reserv
         return MasternodeOperatorKeyStatus::INVALID_KEY;
     }
 
-    LOCK(cs_wallet);
     const auto reservation{m_mn_operator_reservations.find(reservation_id)};
     if (reservation == m_mn_operator_reservations.end() || reservation->second != index) {
         return MasternodeOperatorKeyStatus::CONFLICT;
@@ -4087,16 +4086,16 @@ MasternodeOperatorKeyStatus CWallet::GetMasternodeOperatorKey(const CBLSPublicKe
     secret.Reset();
     index = MASTERNODE_OPERATOR_KEY_LIMIT;
     if (!public_key.IsValid()) return MasternodeOperatorKeyStatus::INVALID_KEY;
+    // Exact recovery can walk the complete bounded range. Serialize the whole
+    // secret-producing operation with walletlock, not only the initial seed copy.
+    LOCK(cs_wallet);
     if (!CanDeriveMasternodeOperatorKey()) return MasternodeOperatorKeyStatus::NOT_SUPPORTED;
     if (IsLocked()) return MasternodeOperatorKeyStatus::WALLET_LOCKED;
 
     const std::vector<unsigned char> public_key_bytes{MasternodeOperatorPublicKeyBytes(public_key)};
     std::optional<uint32_t> recorded_index;
-    {
-        LOCK(cs_wallet);
-        if (const auto it{m_mn_operator_indexes.find(public_key_bytes)}; it != m_mn_operator_indexes.end()) {
-            recorded_index = it->second;
-        }
+    if (const auto it{m_mn_operator_indexes.find(public_key_bytes)}; it != m_mn_operator_indexes.end()) {
+        recorded_index = it->second;
     }
 
     if (recorded_index) {
diff --git a/src/wallet/wallet.h b/src/wallet/wallet.h
index 0bd03ea2dd38..23373f8eee2e 100644
--- a/src/wallet/wallet.h
+++ b/src/wallet/wallet.h
@@ -1016,7 +1016,7 @@ class CWallet final : public WalletStorage, public interfaces::Chain::Notificati
         EXCLUSIVE_LOCKS_REQUIRED(cs_wallet);
 
     /** Return the one BIP39 seed shared by this wallet's ScriptPubKeyMans. */
-    bool GetBIP39Seed(SecureVector& seed) const;
+    bool GetBIP39Seed(SecureVector& seed) const EXCLUSIVE_LOCKS_REQUIRED(cs_wallet);
     /** Whether the wallet has exactly one identifiable BIP39 seed source. */
     bool HasSingleBIP39Seed() const;
     /** Whether deterministic operator-key operations are supported. */

From e5088e7b1be5b5e4b3f637667568a1a4881b2778 Mon Sep 17 00:00:00 2001
From: pasta <pasta@dashboost.org>
Date: Thu, 13 Aug 2026 00:22:15 -0500
Subject: [PATCH 05/14] test(wallet): restore operator fixture arguments

---
 src/wallet/test/masternode_operator_tests.cpp | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/src/wallet/test/masternode_operator_tests.cpp b/src/wallet/test/masternode_operator_tests.cpp
index 43e0c75d7615..73224679d10b 100644
--- a/src/wallet/test/masternode_operator_tests.cpp
+++ b/src/wallet/test/masternode_operator_tests.cpp
@@ -116,6 +116,8 @@ struct MasternodeOperatorTestingSetup : public WalletTestingSetup {
         gArgs.ForceSetArg("-keypool", "1");
     }
 
+    ~MasternodeOperatorTestingSetup() { gArgs.ForceRemoveArg("keypool"); }
+
     std::unique_ptr<CWallet> MakeWallet()
     {
         auto wallet{std::make_unique<CWallet>(m_node.chain.get(), m_coinjoin_loader.get(), "", m_args,

From 2c54e31ef2da592b698fa744a64adf18667c660c Mon Sep 17 00:00:00 2001
From: pasta <pasta@dashboost.org>
Date: Thu, 13 Aug 2026 00:23:48 -0500
Subject: [PATCH 06/14] fix(wallet): assert operator reservation lock

---
 src/wallet/wallet.cpp | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/wallet/wallet.cpp b/src/wallet/wallet.cpp
index b291349afbdc..96456d729645 100644
--- a/src/wallet/wallet.cpp
+++ b/src/wallet/wallet.cpp
@@ -3997,6 +3997,7 @@ MasternodeOperatorKeyStatus CWallet::ReserveMasternodeOperatorKey(const std::vec
     uint32_t found_index{0};
     const bool walked{WalkMasternodeOperatorSecrets(
         seed, MasternodeOperatorCoinType(), [&](uint32_t candidate_index, const CBLSSecretKey& candidate) {
+            AssertLockHeld(cs_wallet);
             const std::vector<unsigned char> candidate_public_key{
                 MasternodeOperatorPublicKeyBytes(candidate.GetPublicKey())};
             if (taken_public_keys.count(candidate_public_key) > 0) return true;

From 4f9f131242253240368b23624f57c309ac2790d0 Mon Sep 17 00:00:00 2001
From: pasta <pasta@dashboost.org>
Date: Thu, 13 Aug 2026 00:24:28 -0500
Subject: [PATCH 07/14] fix(wallet): annotate operator reservation lock

---
 src/wallet/wallet.cpp | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/wallet/wallet.cpp b/src/wallet/wallet.cpp
index 96456d729645..b222b901e0ca 100644
--- a/src/wallet/wallet.cpp
+++ b/src/wallet/wallet.cpp
@@ -3996,8 +3996,8 @@ MasternodeOperatorKeyStatus CWallet::ReserveMasternodeOperatorKey(const std::vec
     CBLSSecretKey found;
     uint32_t found_index{0};
     const bool walked{WalkMasternodeOperatorSecrets(
-        seed, MasternodeOperatorCoinType(), [&](uint32_t candidate_index, const CBLSSecretKey& candidate) {
-            AssertLockHeld(cs_wallet);
+        seed, MasternodeOperatorCoinType(), [&](uint32_t candidate_index, const CBLSSecretKey& candidate)
+                                                 EXCLUSIVE_LOCKS_REQUIRED(cs_wallet) {
             const std::vector<unsigned char> candidate_public_key{
                 MasternodeOperatorPublicKeyBytes(candidate.GetPublicKey())};
             if (taken_public_keys.count(candidate_public_key) > 0) return true;

From 0aebf08a6844b65b813c8b6fe8a8c61578f572ce Mon Sep 17 00:00:00 2001
From: pasta <pasta@dashboost.org>
Date: Thu, 13 Aug 2026 00:40:47 -0500
Subject: [PATCH 08/14] fix(wallet): serialize operator secret publication

---
 src/wallet/interfaces.cpp                     |  2 +
 src/wallet/test/masternode_operator_tests.cpp | 54 +++++++++++++++++++
 2 files changed, 56 insertions(+)

diff --git a/src/wallet/interfaces.cpp b/src/wallet/interfaces.cpp
index 7863d87a2dac..26d4f3a379b3 100644
--- a/src/wallet/interfaces.cpp
+++ b/src/wallet/interfaces.cpp
@@ -246,6 +246,7 @@ class WalletImpl : public Wallet
                                                              MasternodeOperatorKey& key) override
     {
         key = MasternodeOperatorKey{};
+        LOCK(m_wallet->cs_wallet);
         CBLSSecretKey secret;
         uint32_t index{0};
         uint64_t reservation_id{0};
@@ -287,6 +288,7 @@ class WalletImpl : public Wallet
             return MasternodeOperatorKeyStatus::INVALID_KEY;
         }
 
+        LOCK(m_wallet->cs_wallet);
         CBLSSecretKey secret;
         uint32_t index{0};
         const MasternodeOperatorKeyStatus status{m_wallet->GetMasternodeOperatorKey(parsed, secret, index)};
diff --git a/src/wallet/test/masternode_operator_tests.cpp b/src/wallet/test/masternode_operator_tests.cpp
index 73224679d10b..298d5190cfb3 100644
--- a/src/wallet/test/masternode_operator_tests.cpp
+++ b/src/wallet/test/masternode_operator_tests.cpp
@@ -125,6 +125,12 @@ struct MasternodeOperatorTestingSetup : public WalletTestingSetup {
         BOOST_REQUIRE(wallet->LoadWallet() == DBErrors::LOAD_OK);
         return wallet;
     }
+
+    std::unique_ptr<interfaces::Wallet> MakeWalletInterface()
+    {
+        std::shared_ptr<CWallet> wallet{&m_wallet, [](CWallet*) {}};
+        return interfaces::MakeWallet(*Assert(m_wallet_loader->context()), wallet);
+    }
 };
 
 } // namespace
@@ -283,6 +289,54 @@ BOOST_AUTO_TEST_CASE(wallet_lock_serializes_secret_recovery)
     BOOST_CHECK_EQUAL(recovered_index, MASTERNODE_OPERATOR_KEY_LIMIT);
 }
 
+BOOST_AUTO_TEST_CASE(wallet_interface_lock_serializes_secret_publication)
+{
+    SetupLegacyMnemonic(m_wallet);
+    CBLSSecretKey expected;
+    BOOST_REQUIRE(m_wallet.DeriveMasternodeOperatorKey(MASTERNODE_OPERATOR_KEY_LIMIT - 1, expected) ==
+                  MasternodeOperatorKeyStatus::SUCCESS);
+    BOOST_REQUIRE(m_wallet.EncryptWallet("passphrase"));
+    BOOST_REQUIRE(m_wallet.Unlock("passphrase"));
+    auto wallet_interface{MakeWalletInterface()};
+
+    interfaces::MasternodeOperatorKey recovered;
+    MasternodeOperatorKeyStatus status{MasternodeOperatorKeyStatus::DERIVATION_ERROR};
+    std::atomic<bool> finished{false};
+    std::thread recovery_thread{[&] {
+        status = wallet_interface->getMasternodeOperatorKey(PublicKeyBytes(expected), recovered);
+        finished.store(true, std::memory_order_release);
+    }};
+
+    bool recovery_holds_wallet_lock{false};
+    while (!finished.load(std::memory_order_acquire)) {
+        TRY_LOCK(m_wallet.cs_wallet, wallet_lock);
+        if (!wallet_lock) {
+            recovery_holds_wallet_lock = true;
+            break;
+        }
+        std::this_thread::yield();
+    }
+
+    const bool lock_result{m_wallet.Lock()};
+    // The interface keeps cs_wallet held until these outputs are populated, so
+    // Lock() returning synchronizes with their publication.
+    const bool secret_published_before_lock{!recovered.secret_key.empty()};
+    const uint32_t index_published_before_lock{recovered.index};
+    recovery_thread.join();
+
+    BOOST_REQUIRE(recovery_holds_wallet_lock);
+    BOOST_REQUIRE(lock_result);
+    BOOST_CHECK(secret_published_before_lock);
+    BOOST_CHECK_EQUAL(index_published_before_lock, MASTERNODE_OPERATOR_KEY_LIMIT - 1);
+    BOOST_CHECK(status == MasternodeOperatorKeyStatus::SUCCESS);
+    const auto expected_secret{expected.ToByteVector(/*specificLegacyScheme=*/false)};
+    BOOST_CHECK_EQUAL_COLLECTIONS(recovered.secret_key.begin(), recovered.secret_key.end(), expected_secret.begin(),
+                                  expected_secret.end());
+    BOOST_CHECK(recovered.public_key == PublicKeyBytes(expected));
+    BOOST_CHECK_EQUAL(recovered.path, "m/9'/1'/3'/3'/499");
+    BOOST_CHECK(m_wallet.IsLocked());
+}
+
 BOOST_AUTO_TEST_CASE(restored_wallet_skips_registered_keys)
 {
     SetupLegacyMnemonic(m_wallet);

From 24119c7c0363f59dcf295752125bd8b88b2da86d Mon Sep 17 00:00:00 2001
From: pasta <pasta@dashboost.org>
Date: Thu, 13 Aug 2026 00:51:47 -0500
Subject: [PATCH 09/14] fix(wallet): serialize mixing-only lock transitions

---
 src/wallet/test/masternode_operator_tests.cpp | 73 ++++++++++---------
 src/wallet/wallet.cpp                         | 15 ++--
 src/wallet/wallet.h                           |  2 +-
 3 files changed, 47 insertions(+), 43 deletions(-)

diff --git a/src/wallet/test/masternode_operator_tests.cpp b/src/wallet/test/masternode_operator_tests.cpp
index 298d5190cfb3..fd9afffb4496 100644
--- a/src/wallet/test/masternode_operator_tests.cpp
+++ b/src/wallet/test/masternode_operator_tests.cpp
@@ -296,45 +296,48 @@ BOOST_AUTO_TEST_CASE(wallet_interface_lock_serializes_secret_publication)
     BOOST_REQUIRE(m_wallet.DeriveMasternodeOperatorKey(MASTERNODE_OPERATOR_KEY_LIMIT - 1, expected) ==
                   MasternodeOperatorKeyStatus::SUCCESS);
     BOOST_REQUIRE(m_wallet.EncryptWallet("passphrase"));
-    BOOST_REQUIRE(m_wallet.Unlock("passphrase"));
     auto wallet_interface{MakeWalletInterface()};
 
-    interfaces::MasternodeOperatorKey recovered;
-    MasternodeOperatorKeyStatus status{MasternodeOperatorKeyStatus::DERIVATION_ERROR};
-    std::atomic<bool> finished{false};
-    std::thread recovery_thread{[&] {
-        status = wallet_interface->getMasternodeOperatorKey(PublicKeyBytes(expected), recovered);
-        finished.store(true, std::memory_order_release);
-    }};
-
-    bool recovery_holds_wallet_lock{false};
-    while (!finished.load(std::memory_order_acquire)) {
-        TRY_LOCK(m_wallet.cs_wallet, wallet_lock);
-        if (!wallet_lock) {
-            recovery_holds_wallet_lock = true;
-            break;
+    for (const bool allow_mixing : {false, true}) {
+        BOOST_REQUIRE(m_wallet.Unlock("passphrase"));
+        interfaces::MasternodeOperatorKey recovered;
+        MasternodeOperatorKeyStatus status{MasternodeOperatorKeyStatus::DERIVATION_ERROR};
+        std::atomic<bool> finished{false};
+        std::thread recovery_thread{[&] {
+            status = wallet_interface->getMasternodeOperatorKey(PublicKeyBytes(expected), recovered);
+            finished.store(true, std::memory_order_release);
+        }};
+
+        bool recovery_holds_wallet_lock{false};
+        while (!finished.load(std::memory_order_acquire)) {
+            TRY_LOCK(m_wallet.cs_wallet, wallet_lock);
+            if (!wallet_lock) {
+                recovery_holds_wallet_lock = true;
+                break;
+            }
+            std::this_thread::yield();
         }
-        std::this_thread::yield();
-    }
-
-    const bool lock_result{m_wallet.Lock()};
-    // The interface keeps cs_wallet held until these outputs are populated, so
-    // Lock() returning synchronizes with their publication.
-    const bool secret_published_before_lock{!recovered.secret_key.empty()};
-    const uint32_t index_published_before_lock{recovered.index};
-    recovery_thread.join();
 
-    BOOST_REQUIRE(recovery_holds_wallet_lock);
-    BOOST_REQUIRE(lock_result);
-    BOOST_CHECK(secret_published_before_lock);
-    BOOST_CHECK_EQUAL(index_published_before_lock, MASTERNODE_OPERATOR_KEY_LIMIT - 1);
-    BOOST_CHECK(status == MasternodeOperatorKeyStatus::SUCCESS);
-    const auto expected_secret{expected.ToByteVector(/*specificLegacyScheme=*/false)};
-    BOOST_CHECK_EQUAL_COLLECTIONS(recovered.secret_key.begin(), recovered.secret_key.end(), expected_secret.begin(),
-                                  expected_secret.end());
-    BOOST_CHECK(recovered.public_key == PublicKeyBytes(expected));
-    BOOST_CHECK_EQUAL(recovered.path, "m/9'/1'/3'/3'/499");
-    BOOST_CHECK(m_wallet.IsLocked());
+        const bool lock_result{m_wallet.Lock(allow_mixing)};
+        // Both full lock and mixing-only lock acquire cs_wallet, so returning
+        // synchronizes with interface publication of all secret outputs.
+        const bool secret_published_before_lock{!recovered.secret_key.empty()};
+        const uint32_t index_published_before_lock{recovered.index};
+        recovery_thread.join();
+
+        BOOST_REQUIRE(recovery_holds_wallet_lock);
+        BOOST_REQUIRE(lock_result);
+        BOOST_CHECK(secret_published_before_lock);
+        BOOST_CHECK_EQUAL(index_published_before_lock, MASTERNODE_OPERATOR_KEY_LIMIT - 1);
+        BOOST_CHECK(status == MasternodeOperatorKeyStatus::SUCCESS);
+        const auto expected_secret{expected.ToByteVector(/*specificLegacyScheme=*/false)};
+        BOOST_CHECK_EQUAL_COLLECTIONS(recovered.secret_key.begin(), recovered.secret_key.end(), expected_secret.begin(),
+                                      expected_secret.end());
+        BOOST_CHECK(recovered.public_key == PublicKeyBytes(expected));
+        BOOST_CHECK_EQUAL(recovered.path, "m/9'/1'/3'/3'/499");
+        BOOST_CHECK(m_wallet.IsLocked());
+        BOOST_CHECK_EQUAL(m_wallet.IsLocked(/*fForMixing=*/true), !allow_mixing);
+    }
 }
 
 BOOST_AUTO_TEST_CASE(restored_wallet_skips_registered_keys)
diff --git a/src/wallet/wallet.cpp b/src/wallet/wallet.cpp
index b222b901e0ca..96811b8bfbb9 100644
--- a/src/wallet/wallet.cpp
+++ b/src/wallet/wallet.cpp
@@ -4228,9 +4228,8 @@ bool CWallet::IsLocked(bool fForMixing) const
     if (!IsCrypted())
         return false;
 
-    if(!fForMixing && fOnlyMixingAllowed) return true;
-
     LOCK(cs_wallet);
+    if (!fForMixing && fOnlyMixingAllowed) return true;
     return vMasterKey.empty();
 }
 
@@ -4239,15 +4238,17 @@ bool CWallet::Lock(bool fAllowMixing)
     if (!IsCrypted())
         return false;
 
-    if(!fAllowMixing) {
+    {
         LOCK(cs_wallet);
-        if (!vMasterKey.empty()) {
-            memory_cleanse(vMasterKey.data(), vMasterKey.size() * sizeof(decltype(vMasterKey)::value_type));
-            vMasterKey.clear();
+        if (!fAllowMixing) {
+            if (!vMasterKey.empty()) {
+                memory_cleanse(vMasterKey.data(), vMasterKey.size() * sizeof(decltype(vMasterKey)::value_type));
+                vMasterKey.clear();
+            }
         }
+        fOnlyMixingAllowed = fAllowMixing;
     }
 
-    fOnlyMixingAllowed = fAllowMixing;
     NotifyStatusChanged(this);
     return true;
 }
diff --git a/src/wallet/wallet.h b/src/wallet/wallet.h
index 23373f8eee2e..1795022045f8 100644
--- a/src/wallet/wallet.h
+++ b/src/wallet/wallet.h
@@ -293,7 +293,7 @@ class CWallet final : public WalletStorage, public interfaces::Chain::Notificati
     CKeyingMaterial vMasterKey GUARDED_BY(cs_wallet);
 
     //! if fOnlyMixingAllowed is true, only mixing should be allowed in unlocked wallet
-    bool fOnlyMixingAllowed{false};
+    bool fOnlyMixingAllowed GUARDED_BY(cs_wallet){false};
 
     bool Unlock(const CKeyingMaterial& vMasterKeyIn, bool fForMixingOnly = false);
 

From 8150bf878c3177350c499e46a09f88c29448fea3 Mon Sep 17 00:00:00 2001
From: pasta <pasta@dashboost.org>
Date: Thu, 13 Aug 2026 01:09:53 -0500
Subject: [PATCH 10/14] fix(bls): cleanse generated secret candidate

---
 src/bls/bls.cpp | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/src/bls/bls.cpp b/src/bls/bls.cpp
index 49981ee9190f..8d5b1b83703c 100644
--- a/src/bls/bls.cpp
+++ b/src/bls/bls.cpp
@@ -8,6 +8,7 @@
 
 #ifndef BUILD_BITCOIN_INTERNAL
 #include <support/allocators/mt_pooled_secure.h>
+#include <support/cleanse.h>
 #endif
 
 #include <cassert>
@@ -73,6 +74,7 @@ void CBLSSecretKey::MakeNewKey()
         } catch (...) {
         }
     }
+    memory_cleanse(buf, sizeof(buf));
     fValid = true;
     cachedHash.SetNull();
 }

From 312c8b4e24b085e2c39b7c0b9537cc8a428d1a55 Mon Sep 17 00:00:00 2001
From: pasta <pasta@dashboost.org>
Date: Thu, 13 Aug 2026 01:30:21 -0500
Subject: [PATCH 11/14] fix(wallet): validate cached operator key indexes

---
 src/wallet/test/masternode_operator_tests.cpp | 76 +++++++++++++++++--
 src/wallet/wallet.cpp                         | 45 ++++++++---
 src/wallet/walletdb.cpp                       |  5 ++
 src/wallet/walletdb.h                         |  1 +
 4 files changed, 111 insertions(+), 16 deletions(-)

diff --git a/src/wallet/test/masternode_operator_tests.cpp b/src/wallet/test/masternode_operator_tests.cpp
index fd9afffb4496..b38abf19193a 100644
--- a/src/wallet/test/masternode_operator_tests.cpp
+++ b/src/wallet/test/masternode_operator_tests.cpp
@@ -109,6 +109,14 @@ std::map<std::vector<unsigned char>, uint32_t> ReadOperatorIndexRecords(CWallet&
     return records;
 }
 
+void WriteAndLoadOperatorIndexRecord(CWallet& wallet, const std::vector<unsigned char>& public_key, uint32_t index)
+{
+    WalletBatch batch{wallet.GetDatabase()};
+    BOOST_REQUIRE(batch.WriteMasternodeOperatorIndex(public_key, index));
+    LOCK(wallet.cs_wallet);
+    BOOST_REQUIRE(wallet.LoadMasternodeOperatorIndex(public_key, index));
+}
+
 struct MasternodeOperatorTestingSetup : public WalletTestingSetup {
     MasternodeOperatorTestingSetup() :
         WalletTestingSetup(CBaseChainParams::REGTEST)
@@ -268,6 +276,9 @@ BOOST_AUTO_TEST_CASE(wallet_lock_serializes_secret_recovery)
         }
         std::this_thread::yield();
     }
+    // A fast worker can complete before the first mutex probe; the acquire load
+    // then provides the same publication synchronization as taking cs_wallet.
+    const bool recovery_completed_before_observation{finished.load(std::memory_order_acquire)};
 
     const bool lock_result{m_wallet.Lock()};
     // Lock() acquiring cs_wallet synchronizes with publication of these outputs,
@@ -276,7 +287,7 @@ BOOST_AUTO_TEST_CASE(wallet_lock_serializes_secret_recovery)
     const uint32_t index_published_before_lock{recovered_index};
     recovery_thread.join();
 
-    BOOST_REQUIRE(recovery_holds_wallet_lock);
+    BOOST_REQUIRE(recovery_holds_wallet_lock || recovery_completed_before_observation);
     BOOST_REQUIRE(lock_result);
     BOOST_CHECK(secret_published_before_lock);
     BOOST_CHECK_EQUAL(index_published_before_lock, MASTERNODE_OPERATOR_KEY_LIMIT - 1);
@@ -317,6 +328,9 @@ BOOST_AUTO_TEST_CASE(wallet_interface_lock_serializes_secret_publication)
             }
             std::this_thread::yield();
         }
+        // Completion before observation is a valid scheduling outcome and the
+        // acquire load already synchronizes the published interface outputs.
+        const bool recovery_completed_before_observation{finished.load(std::memory_order_acquire)};
 
         const bool lock_result{m_wallet.Lock(allow_mixing)};
         // Both full lock and mixing-only lock acquire cs_wallet, so returning
@@ -325,7 +339,7 @@ BOOST_AUTO_TEST_CASE(wallet_interface_lock_serializes_secret_publication)
         const uint32_t index_published_before_lock{recovered.index};
         recovery_thread.join();
 
-        BOOST_REQUIRE(recovery_holds_wallet_lock);
+        BOOST_REQUIRE(recovery_holds_wallet_lock || recovery_completed_before_observation);
         BOOST_REQUIRE(lock_result);
         BOOST_CHECK(secret_published_before_lock);
         BOOST_CHECK_EQUAL(index_published_before_lock, MASTERNODE_OPERATOR_KEY_LIMIT - 1);
@@ -491,14 +505,64 @@ BOOST_AUTO_TEST_CASE(committed_record_reloads_and_recovers_from_corruption)
 
     auto corrupt{MakeWallet()};
     SetupLegacyMnemonic(*corrupt);
-    {
-        LOCK(corrupt->cs_wallet);
-        BOOST_REQUIRE(corrupt->LoadMasternodeOperatorIndex(records.begin()->first, /*index=*/1));
-    }
+    CBLSSecretKey second;
+    BOOST_REQUIRE(corrupt->DeriveMasternodeOperatorKey(1, second) == MasternodeOperatorKeyStatus::SUCCESS);
+    WriteAndLoadOperatorIndexRecord(*corrupt, PublicKeyBytes(secret), /*index=*/1);
+    WriteAndLoadOperatorIndexRecord(*corrupt, PublicKeyBytes(second), /*index=*/0);
     BOOST_CHECK(corrupt->GetMasternodeOperatorKey(secret.GetPublicKey(), recovered, recovered_index) ==
                 MasternodeOperatorKeyStatus::SUCCESS);
     BOOST_CHECK(recovered == secret);
     BOOST_CHECK_EQUAL(recovered_index, 0U);
+
+    CBLSSecretKey reserved;
+    uint32_t reserved_index{MASTERNODE_OPERATOR_KEY_LIMIT};
+    reservation = 0;
+    BOOST_REQUIRE(corrupt->ReserveMasternodeOperatorKey({}, reserved, reserved_index, reservation) ==
+                  MasternodeOperatorKeyStatus::SUCCESS);
+    BOOST_CHECK(reserved == secret);
+    BOOST_CHECK_EQUAL(reserved_index, 0U);
+    BOOST_REQUIRE(corrupt->CommitMasternodeOperatorKey(reservation, reserved.GetPublicKey(), reserved_index) ==
+                  MasternodeOperatorKeyStatus::SUCCESS);
+
+    auto repaired_records{ReadOperatorIndexRecords(*corrupt)};
+    BOOST_REQUIRE_EQUAL(repaired_records.size(), 1U);
+    BOOST_CHECK_EQUAL(repaired_records.at(PublicKeyBytes(secret)), 0U);
+
+    BOOST_REQUIRE(corrupt->ReserveMasternodeOperatorKey({}, reserved, reserved_index, reservation) ==
+                  MasternodeOperatorKeyStatus::SUCCESS);
+    BOOST_CHECK(reserved == second);
+    BOOST_CHECK_EQUAL(reserved_index, 1U);
+    BOOST_REQUIRE(corrupt->CommitMasternodeOperatorKey(reservation, reserved.GetPublicKey(), reserved_index) ==
+                  MasternodeOperatorKeyStatus::SUCCESS);
+
+    repaired_records = ReadOperatorIndexRecords(*corrupt);
+    BOOST_REQUIRE_EQUAL(repaired_records.size(), 2U);
+    BOOST_CHECK_EQUAL(repaired_records.at(PublicKeyBytes(secret)), 0U);
+    BOOST_CHECK_EQUAL(repaired_records.at(PublicKeyBytes(second)), 1U);
+}
+
+BOOST_AUTO_TEST_CASE(corrupt_index_records_do_not_exhaust_reservations)
+{
+    SetupLegacyMnemonic(m_wallet);
+    std::vector<std::vector<unsigned char>> public_keys;
+    public_keys.reserve(MASTERNODE_OPERATOR_KEY_LIMIT);
+    for (uint32_t index{0}; index < MASTERNODE_OPERATOR_KEY_LIMIT; ++index) {
+        CBLSSecretKey secret;
+        BOOST_REQUIRE(m_wallet.DeriveMasternodeOperatorKey(index, secret) == MasternodeOperatorKeyStatus::SUCCESS);
+        public_keys.push_back(PublicKeyBytes(secret));
+    }
+    for (uint32_t index{0}; index < MASTERNODE_OPERATOR_KEY_LIMIT; ++index) {
+        WriteAndLoadOperatorIndexRecord(m_wallet, public_keys[index], (index + 1) % MASTERNODE_OPERATOR_KEY_LIMIT);
+    }
+
+    CBLSSecretKey reserved;
+    uint32_t reserved_index{MASTERNODE_OPERATOR_KEY_LIMIT};
+    uint64_t reservation{0};
+    BOOST_REQUIRE(m_wallet.ReserveMasternodeOperatorKey({}, reserved, reserved_index, reservation) ==
+                  MasternodeOperatorKeyStatus::SUCCESS);
+    BOOST_CHECK_EQUAL(reserved_index, 0U);
+    BOOST_CHECK(PublicKeyBytes(reserved) == public_keys.front());
+    m_wallet.ReleaseMasternodeOperatorKey(reservation);
 }
 
 BOOST_AUTO_TEST_SUITE_END()
diff --git a/src/wallet/wallet.cpp b/src/wallet/wallet.cpp
index 96811b8bfbb9..8c5795ac00ba 100644
--- a/src/wallet/wallet.cpp
+++ b/src/wallet/wallet.cpp
@@ -4002,10 +4002,12 @@ MasternodeOperatorKeyStatus CWallet::ReserveMasternodeOperatorKey(const std::vec
                 MasternodeOperatorPublicKeyBytes(candidate.GetPublicKey())};
             if (taken_public_keys.count(candidate_public_key) > 0) return true;
 
-            if (m_mn_operator_indexes.count(candidate_public_key) > 0) return true;
-            if (std::any_of(m_mn_operator_indexes.begin(), m_mn_operator_indexes.end(),
-                            [candidate_index](const auto& entry) { return entry.second == candidate_index; }) ||
-                std::any_of(m_mn_operator_reservations.begin(), m_mn_operator_reservations.end(),
+            // Cache rows are advisory until their public key and derived index agree.
+            if (const auto it{m_mn_operator_indexes.find(candidate_public_key)};
+                it != m_mn_operator_indexes.end() && it->second == candidate_index) {
+                return true;
+            }
+            if (std::any_of(m_mn_operator_reservations.begin(), m_mn_operator_reservations.end(),
                             [candidate_index](const auto& entry) { return entry.second == candidate_index; })) {
                 return true;
             }
@@ -4063,20 +4065,43 @@ MasternodeOperatorKeyStatus CWallet::CommitMasternodeOperatorKey(uint64_t reserv
     if (reservation == m_mn_operator_reservations.end() || reservation->second != index) {
         return MasternodeOperatorKeyStatus::CONFLICT;
     }
-    if (const auto it{m_mn_operator_indexes.find(public_key_bytes)}; it != m_mn_operator_indexes.end()) {
-        if (it->second != index) return MasternodeOperatorKeyStatus::CONFLICT;
+    if (const auto it{m_mn_operator_indexes.find(public_key_bytes)};
+        it != m_mn_operator_indexes.end() && it->second == index) {
         m_mn_operator_reservations.erase(reservation);
         return MasternodeOperatorKeyStatus::SUCCESS;
     }
+
+    std::vector<std::vector<unsigned char>> mismatched_public_keys;
     for (const auto& [recorded_public_key, recorded_index] : m_mn_operator_indexes) {
-        if (recorded_index == index) return MasternodeOperatorKeyStatus::CONFLICT;
+        if (recorded_public_key != public_key_bytes && recorded_index == index) {
+            mismatched_public_keys.push_back(recorded_public_key);
+        }
     }
 
     WalletBatch batch(GetDatabase());
-    if (!batch.WriteMasternodeOperatorIndex(public_key_bytes, index)) {
-        return MasternodeOperatorKeyStatus::DATABASE_ERROR;
+    if (mismatched_public_keys.empty()) {
+        if (!batch.WriteMasternodeOperatorIndex(public_key_bytes, index)) {
+            return MasternodeOperatorKeyStatus::DATABASE_ERROR;
+        }
+    } else {
+        // The derived key is authoritative, so atomically replace stale cache rows
+        // that claim its index before recording the verified public key.
+        if (!batch.TxnBegin()) return MasternodeOperatorKeyStatus::DATABASE_ERROR;
+        for (const auto& mismatched_public_key : mismatched_public_keys) {
+            if (!batch.EraseMasternodeOperatorIndex(mismatched_public_key)) {
+                batch.TxnAbort();
+                return MasternodeOperatorKeyStatus::DATABASE_ERROR;
+            }
+        }
+        if (!batch.WriteMasternodeOperatorIndex(public_key_bytes, index) || !batch.TxnCommit()) {
+            batch.TxnAbort();
+            return MasternodeOperatorKeyStatus::DATABASE_ERROR;
+        }
+    }
+    for (const auto& mismatched_public_key : mismatched_public_keys) {
+        m_mn_operator_indexes.erase(mismatched_public_key);
     }
-    m_mn_operator_indexes.emplace(public_key_bytes, index);
+    m_mn_operator_indexes[public_key_bytes] = index;
     m_mn_operator_reservations.erase(reservation);
     return MasternodeOperatorKeyStatus::SUCCESS;
 }
diff --git a/src/wallet/walletdb.cpp b/src/wallet/walletdb.cpp
index 49bae52e1aef..59adb28cac7f 100644
--- a/src/wallet/walletdb.cpp
+++ b/src/wallet/walletdb.cpp
@@ -248,6 +248,11 @@ bool WalletBatch::WriteMasternodeOperatorIndex(const std::vector<unsigned char>&
     return WriteIC(std::make_pair(DBKeys::MASTERNODE_OPERATOR_INDEX, public_key), index);
 }
 
+bool WalletBatch::EraseMasternodeOperatorIndex(const std::vector<unsigned char>& public_key)
+{
+    return EraseIC(std::make_pair(DBKeys::MASTERNODE_OPERATOR_INDEX, public_key));
+}
+
 bool WalletBatch::WriteGovernanceObject(const Governance::Object& obj)
 {
     return WriteIC(std::make_pair(DBKeys::G_OBJECT, obj.GetHash()), obj, false);
diff --git a/src/wallet/walletdb.h b/src/wallet/walletdb.h
index fd0efb97efdf..3707ca957741 100644
--- a/src/wallet/walletdb.h
+++ b/src/wallet/walletdb.h
@@ -230,6 +230,7 @@ class WalletBatch
     /** Committed deterministic operator-key index, keyed by basic-scheme public key.
      *  The secret is never stored because the BIP39 seed reproduces it. */
     bool WriteMasternodeOperatorIndex(const std::vector<unsigned char>& public_key, uint32_t index);
+    bool EraseMasternodeOperatorIndex(const std::vector<unsigned char>& public_key);
 
     /** Write a CGovernanceObject to the database */
     bool WriteGovernanceObject(const Governance::Object& obj);

From 348958f6d080a3216ea489e4a9b31b5a79e1aebd Mon Sep 17 00:00:00 2001
From: pasta <pasta@dashboost.org>
Date: Thu, 13 Aug 2026 00:22:48 -0500
Subject: [PATCH 12/14] refactor(evo): expose typed provider transaction
 operations

---
 src/Makefile.am                     |   3 +
 src/evo/providertx.cpp              |  97 ++-
 src/evo/providertx.h                |   6 +
 src/evo/providertx_service.cpp      | 818 ++++++++++++++++++++++++
 src/evo/providertx_service.h        |  49 ++
 src/evo/specialtxman.cpp            |  89 +--
 src/interfaces/node.h               |  22 +
 src/interfaces/providertx.h         | 142 +++++
 src/interfaces/wallet.h             |  23 +
 src/node/interfaces.cpp             |  50 +-
 src/rpc/evo.cpp                     | 941 ++++++++++------------------
 src/rpc/evo_util.cpp                | 133 ----
 src/rpc/evo_util.h                  |   8 -
 src/test/evo_netinfo_tests.cpp      |  43 ++
 src/test/interfaces_tests.cpp       |  97 +++
 src/wallet/interfaces.cpp           |  80 +++
 src/wallet/test/wallet_tests.cpp    |  14 +
 test/functional/wallet_dash_rpcs.py |  53 +-
 18 files changed, 1809 insertions(+), 859 deletions(-)
 create mode 100644 src/evo/providertx_service.cpp
 create mode 100644 src/evo/providertx_service.h
 create mode 100644 src/interfaces/providertx.h

diff --git a/src/Makefile.am b/src/Makefile.am
index c909c2db5aee..132e6c7e34b5 100644
--- a/src/Makefile.am
+++ b/src/Makefile.am
@@ -232,6 +232,7 @@ BITCOIN_CORE_H = \
   evo/mnhftx.h \
   evo/netinfo.h \
   evo/providertx.h \
+  evo/providertx_service.h \
   evo/simplifiedmns.h \
   evo/smldiff.h \
   evo/specialtx.h \
@@ -282,6 +283,7 @@ BITCOIN_CORE_H = \
   interfaces/ipc.h \
   interfaces/masternode_operator.h \
   interfaces/node.h \
+  interfaces/providertx.h \
   interfaces/wallet.h \
   kernel/blockmanager_opts.h \
   kernel/chain.h \
@@ -541,6 +543,7 @@ libbitcoin_node_a_SOURCES = \
   evo/mnauth.cpp \
   evo/mnhftx.cpp \
   evo/providertx.cpp \
+  evo/providertx_service.cpp \
   evo/simplifiedmns.cpp \
   evo/smldiff.cpp \
   evo/specialtx.cpp \
diff --git a/src/evo/providertx.cpp b/src/evo/providertx.cpp
index 9ccf89abfc61..ef133a9a5cb5 100644
--- a/src/evo/providertx.cpp
+++ b/src/evo/providertx.cpp
@@ -79,30 +79,105 @@ bool IsPayoutListKeySafe(const MasternodePayoutShares& payouts, const CTxDestina
     return true;
 }
 
-template <typename ProTx>
-bool IsNetInfoTriviallyValid(const ProTx& proTx, TxValidationState& state)
+static bool IsNetInfoTriviallyValid(const std::shared_ptr<NetInfoInterface>& net_info, MnType type, TxValidationState& state)
 {
-    if (!proTx.netInfo->HasEntries(NetInfoPurpose::CORE_P2P)) {
+    if (!net_info->HasEntries(NetInfoPurpose::CORE_P2P)) {
         // Mandatory for all nodes
         return state.Invalid(TxValidationResult::TX_BAD_SPECIAL, "bad-protx-netinfo-empty");
     }
-    if (proTx.nType == MnType::Regular) {
+    if (type == MnType::Regular) {
         // Regular nodes shouldn't populate Platform-specific fields
-        if (proTx.netInfo->HasEntries(NetInfoPurpose::PLATFORM_HTTPS) ||
-            proTx.netInfo->HasEntries(NetInfoPurpose::PLATFORM_P2P)) {
+        if (net_info->HasEntries(NetInfoPurpose::PLATFORM_HTTPS) || net_info->HasEntries(NetInfoPurpose::PLATFORM_P2P)) {
             return state.Invalid(TxValidationResult::TX_BAD_SPECIAL, "bad-protx-netinfo-bad");
         }
     }
-    if (proTx.netInfo->CanStorePlatform() && proTx.nType == MnType::Evo) {
+    if (net_info->CanStorePlatform() && type == MnType::Evo) {
         // Platform fields are mandatory for EvoNodes
-        if (!proTx.netInfo->HasEntries(NetInfoPurpose::PLATFORM_HTTPS) ||
-            !proTx.netInfo->HasEntries(NetInfoPurpose::PLATFORM_P2P)) {
+        if (!net_info->HasEntries(NetInfoPurpose::PLATFORM_HTTPS) || !net_info->HasEntries(NetInfoPurpose::PLATFORM_P2P)) {
             return state.Invalid(TxValidationResult::TX_BAD_SPECIAL, "bad-protx-netinfo-empty");
         }
     }
     return true;
 }
 
+static bool CheckNetInfo(const NetInfoInterface& net_info, TxValidationState& state)
+{
+    switch (net_info.Validate()) {
+    case NetInfoStatus::BadAddress:
+        return state.Invalid(TxValidationResult::TX_BAD_SPECIAL, "bad-protx-netinfo-addr");
+    case NetInfoStatus::BadPort:
+        return state.Invalid(TxValidationResult::TX_BAD_SPECIAL, "bad-protx-netinfo-port");
+    case NetInfoStatus::BadType:
+        return state.Invalid(TxValidationResult::TX_BAD_SPECIAL, "bad-protx-netinfo-addr-type");
+    case NetInfoStatus::NotRoutable:
+        return state.Invalid(TxValidationResult::TX_BAD_SPECIAL, "bad-protx-netinfo-addr-unroutable");
+    case NetInfoStatus::Malformed:
+        return state.Invalid(TxValidationResult::TX_BAD_SPECIAL, "bad-protx-netinfo-bad");
+    case NetInfoStatus::Success:
+        return true;
+    case NetInfoStatus::BadInput:
+        return state.Invalid(TxValidationResult::TX_BAD_SPECIAL, "bad-protx-netinfo-entry");
+    case NetInfoStatus::Duplicate:
+        return state.Invalid(TxValidationResult::TX_BAD_SPECIAL, "bad-protx-dup-netinfo-entry");
+    case NetInfoStatus::MaxLimit:
+        return state.Invalid(TxValidationResult::TX_BAD_SPECIAL, "bad-protx-netinfo-maxlimit");
+    }
+    assert(false);
+}
+
+bool CheckProviderNetworkFields(const std::shared_ptr<NetInfoInterface>& net_info, MnType type, uint16_t version,
+                                const uint160* platform_node_id, uint16_t platform_p2p_port,
+                                uint16_t platform_http_port, bool allow_empty, TxValidationState& state)
+{
+    if (!net_info || net_info->CanStorePlatform() != (version >= ProTxVersion::ExtAddr)) {
+        return state.Invalid(TxValidationResult::TX_CONSENSUS, "bad-protx-netinfo-version");
+    }
+    if (net_info->IsEmpty()) {
+        if (!allow_empty) {
+            return state.Invalid(TxValidationResult::TX_BAD_SPECIAL, "bad-protx-netinfo-empty");
+        }
+    } else {
+        if (!IsNetInfoTriviallyValid(net_info, type, state) || !CheckNetInfo(*net_info, state)) {
+            return false;
+        }
+    }
+
+    if (type != MnType::Evo) return true;
+    if (platform_node_id && platform_node_id->IsNull()) {
+        return state.Invalid(TxValidationResult::TX_BAD_SPECIAL, "bad-protx-platform-nodeid");
+    }
+    if (version >= ProTxVersion::ExtAddr) {
+        if (platform_p2p_port != 0) {
+            return state.Invalid(TxValidationResult::TX_BAD_SPECIAL, "bad-protx-platform-p2p-port");
+        }
+        if (platform_http_port != 0) {
+            return state.Invalid(TxValidationResult::TX_BAD_SPECIAL, "bad-protx-platform-http-port");
+        }
+        return true;
+    }
+
+    if (::IsNodeOnMainnet()) {
+        if (platform_p2p_port != ::MainParams().GetDefaultPlatformP2PPort()) {
+            return state.Invalid(TxValidationResult::TX_BAD_SPECIAL, "bad-protx-platform-p2p-port");
+        }
+        if (platform_http_port != ::MainParams().GetDefaultPlatformHTTPPort()) {
+            return state.Invalid(TxValidationResult::TX_BAD_SPECIAL, "bad-protx-platform-http-port");
+        }
+    }
+    if (platform_p2p_port == ::MainParams().GetDefaultPort()) {
+        return state.Invalid(TxValidationResult::TX_BAD_SPECIAL, "bad-protx-platform-p2p-port");
+    }
+    if (platform_http_port == ::MainParams().GetDefaultPort()) {
+        return state.Invalid(TxValidationResult::TX_BAD_SPECIAL, "bad-protx-platform-http-port");
+    }
+
+    const uint16_t core_port{net_info->GetPrimary().GetPort()};
+    if (platform_p2p_port == platform_http_port || platform_p2p_port == core_port || platform_http_port == core_port) {
+        return state.Invalid(TxValidationResult::TX_BAD_SPECIAL, "bad-protx-platform-dup-ports");
+    }
+    return true;
+}
+
 bool CProRegTx::IsTriviallyValid(TxValidationState& state) const
 {
     if (nVersion == 0 || nVersion > ProTxVersion::ExtAddr) {
@@ -129,7 +204,7 @@ bool CProRegTx::IsTriviallyValid(TxValidationState& state) const
     if (netInfo->CanStorePlatform() != (nVersion >= ProTxVersion::ExtAddr)) {
         return state.Invalid(TxValidationResult::TX_CONSENSUS, "bad-protx-netinfo-version");
     }
-    if (!netInfo->IsEmpty() && !IsNetInfoTriviallyValid(*this, state)) {
+    if (!netInfo->IsEmpty() && !IsNetInfoTriviallyValid(netInfo, nType, state)) {
         // pass the state returned by the function above
         return false;
     }
@@ -199,7 +274,7 @@ bool CProUpServTx::IsTriviallyValid(TxValidationState& state) const
     if (netInfo->IsEmpty()) {
         return state.Invalid(TxValidationResult::TX_BAD_SPECIAL, "bad-protx-netinfo-empty");
     }
-    if (!IsNetInfoTriviallyValid(*this, state)) {
+    if (!IsNetInfoTriviallyValid(netInfo, nType, state)) {
         // pass the state returned by the function above
         return false;
     }
diff --git a/src/evo/providertx.h b/src/evo/providertx.h
index d27713e74ca7..f38c3bacc059 100644
--- a/src/evo/providertx.h
+++ b/src/evo/providertx.h
@@ -58,6 +58,12 @@ template<class T>
 [[nodiscard]] std::string PayoutListToString(const MasternodePayoutShares& payouts);
 [[nodiscard]] UniValue PayoutListToJson(const MasternodePayoutShares& payouts);
 
+/** Validate all provider network fields using the same rules as special transaction validation.
+ *  Pass nullptr for platform_node_id when validating endpoint input separately from the rest of a payload. */
+[[nodiscard]] bool CheckProviderNetworkFields(const std::shared_ptr<NetInfoInterface>& net_info, MnType type,
+                                              uint16_t version, const uint160* platform_node_id, uint16_t platform_p2p_port,
+                                              uint16_t platform_http_port, bool allow_empty, TxValidationState& state);
+
 class CProRegTx
 {
 public:
diff --git a/src/evo/providertx_service.cpp b/src/evo/providertx_service.cpp
new file mode 100644
index 000000000000..aea8ddd921bf
--- /dev/null
+++ b/src/evo/providertx_service.cpp
@@ -0,0 +1,818 @@
+// Copyright (c) 2026 The Dash Core developers
+// Distributed under the MIT software license, see the accompanying
+// file COPYING or http://www.opensource.org/licenses/mit-license.php.
+
+#include <evo/providertx_service.h>
+
+#include <consensus/validation.h>
+#include <deploymentstatus.h>
+#include <evo/chainhelper.h>
+#include <evo/deterministicmns.h>
+#include <evo/netinfo.h>
+#include <evo/providertx.h>
+#include <evo/specialtx.h>
+#include <evo/specialtxman.h>
+#include <interfaces/wallet.h>
+#include <key_io.h>
+#include <node/context.h>
+#include <node/transaction.h>
+#include <policy/policy.h>
+#include <script/standard.h>
+#include <sync.h>
+#include <util/check.h>
+#include <util/message.h>
+#include <util/result.h>
+#include <util/strencodings.h>
+#include <util/translation.h>
+#include <validation.h>
+
+#include <algorithm>
+#include <optional>
+#include <string>
+#include <string_view>
+#include <utility>
+#include <variant>
+#include <vector>
+
+namespace evo::provider {
+namespace {
+
+using interfaces::CoinLockResult;
+using interfaces::ExistingProviderCollateral;
+using interfaces::FundProviderCollateral;
+using interfaces::PreparedProviderRegistration;
+using interfaces::ProviderNetInfo;
+using interfaces::ProviderPayout;
+using interfaces::ProviderPlatformEndpoints;
+using interfaces::ProviderRegistrationRequest;
+using interfaces::ProviderRevokeRequest;
+using interfaces::ProviderTxError;
+using interfaces::ProviderTxErrorCode;
+using interfaces::ProviderTxResult;
+using interfaces::ProviderTxSubmission;
+using interfaces::ProviderUpdateRegistrarRequest;
+using interfaces::ProviderUpdateServiceRequest;
+using interfaces::Wallet;
+
+ProviderTxError Error(ProviderTxErrorCode code, std::string message, std::string reject_reason = {},
+                      std::optional<TransactionError> transaction_error = std::nullopt)
+{
+    return ProviderTxError{code, Untranslated(std::move(message)), std::move(reject_reason), transaction_error};
+}
+
+std::optional<ProviderTxError> CheckDestination(const std::optional<CTxDestination>& destination, std::string_view field_name)
+{
+    if (destination && !IsValidDestination(*destination)) {
+        return Error(ProviderTxErrorCode::INVALID_ADDRESS_OR_KEY, strprintf("invalid %s address", field_name));
+    }
+    return std::nullopt;
+}
+
+std::optional<ProviderTxError> CheckWallet(Wallet& wallet)
+{
+    AssertLockNotHeld(::cs_main);
+    if (wallet.isLocked()) {
+        return Error(ProviderTxErrorCode::WALLET_UNLOCK_NEEDED,
+                     "Please enter the wallet passphrase with walletpassphrase first.");
+    }
+    return std::nullopt;
+}
+
+uint16_t CurrentProviderTxVersion(node::NodeContext& node, std::optional<bool> basic_override = std::nullopt)
+{
+    AssertLockNotHeld(::cs_main);
+    auto& chainman{*Assert(node.chainman)};
+    LOCK(::cs_main);
+    return DeploymentToProtxVersion(chainman.ActiveChain().Tip(), chainman, basic_override);
+}
+
+struct ChainSnapshot {
+    uint16_t provider_tx_version{0};
+    CDeterministicMNCPtr dmn;
+    std::optional<Coin> collateral_coin;
+};
+
+ChainSnapshot SnapshotChain(node::NodeContext& node, std::optional<uint256> pro_tx_hash,
+                            std::optional<COutPoint> collateral_outpoint, std::optional<bool> basic_override = std::nullopt)
+{
+    AssertLockNotHeld(::cs_main);
+    auto& chainman{*Assert(node.chainman)};
+    LOCK(::cs_main);
+
+    ChainSnapshot snapshot;
+    snapshot.provider_tx_version = DeploymentToProtxVersion(chainman.ActiveChain().Tip(), chainman, basic_override);
+    if (pro_tx_hash) snapshot.dmn = Assert(node.dmnman)->GetListAtChainTip().GetMN(*pro_tx_hash);
+    if (collateral_outpoint) {
+        Coin coin;
+        if (chainman.ActiveChainstate().CoinsTip().GetCoin(*collateral_outpoint, coin) && !coin.IsSpent()) {
+            snapshot.collateral_coin = std::move(coin);
+        }
+    }
+    return snapshot;
+}
+
+template <typename ProTx>
+std::optional<ProviderTxError> ApplyCoreNetInfo(ProTx& payload, const std::vector<std::string>& entries, bool optional)
+{
+    CHECK_NONFATAL(payload.netInfo);
+    if (!optional && entries.empty()) {
+        return Error(ProviderTxErrorCode::INVALID_PARAMETER, "Invalid param for coreP2PAddrs, cannot be empty");
+    }
+    for (size_t index{0}; index < entries.size(); ++index) {
+        if (entries[index].empty()) {
+            return Error(ProviderTxErrorCode::INVALID_PARAMETER,
+                         strprintf("Invalid param for coreP2PAddrs[%zu], cannot be empty", index));
+        }
+        if (const auto status{payload.netInfo->AddEntry(NetInfoPurpose::CORE_P2P, entries[index])};
+            status != NetInfoStatus::Success) {
+            return Error(ProviderTxErrorCode::INVALID_PARAMETER,
+                         strprintf("Error setting coreP2PAddrs[%zu] to '%s' (%s)", index, entries[index],
+                                   NISToString(status)));
+        }
+    }
+    return std::nullopt;
+}
+
+bool IsNumeric(std::string_view input)
+{
+    return !input.empty() && input.find_first_not_of("0123456789") == std::string_view::npos;
+}
+
+bool HasPlatformEndpoints(const ProviderPlatformEndpoints& input)
+{
+    if (std::holds_alternative<uint16_t>(input)) return true;
+    const auto* entries{std::get_if<std::vector<std::string>>(&input)};
+    return entries && !entries->empty();
+}
+
+template <typename ProTx>
+std::optional<ProviderTxError> ApplyPlatformField(ProTx& payload, const ProviderPlatformEndpoints& input,
+                                                  NetInfoPurpose purpose, std::string_view field_name,
+                                                  uint16_t& legacy_port, bool optional)
+{
+    CHECK_NONFATAL(payload.netInfo);
+
+    const auto add_entry = [&](const std::string& entry, size_t index) -> std::optional<ProviderTxError> {
+        if (entry.empty()) {
+            return Error(ProviderTxErrorCode::INVALID_PARAMETER,
+                         strprintf("Invalid param for %s[%zu], cannot be empty", field_name, index));
+        }
+        if (const auto status{payload.netInfo->AddEntry(purpose, entry)}; status != NetInfoStatus::Success) {
+            return Error(ProviderTxErrorCode::INVALID_PARAMETER,
+                         strprintf("Error setting %s[%zu] to '%s' (%s)", field_name, index, entry, NISToString(status)));
+        }
+        return std::nullopt;
+    };
+
+    if (const auto* port{std::get_if<uint16_t>(&input)}) {
+        if (*port == 0) {
+            return Error(ProviderTxErrorCode::INVALID_PARAMETER,
+                         strprintf("Invalid param for %s, must be a valid port [1-65535]", field_name));
+        }
+        if (!payload.netInfo->CanStorePlatform()) {
+            legacy_port = *port;
+            return std::nullopt;
+        }
+        if (!payload.netInfo->HasEntries(NetInfoPurpose::CORE_P2P)) {
+            return Error(ProviderTxErrorCode::INVALID_PARAMETER,
+                         strprintf("Cannot set param for %s, must specify coreP2PAddrs first", field_name));
+        }
+        const CService service{CNetAddr{payload.netInfo->GetPrimary()}, *port};
+        return add_entry(service.ToStringAddrPort(), 0);
+    }
+
+    const auto* entries{std::get_if<std::vector<std::string>>(&input)};
+    const bool empty{!entries || entries->empty()};
+    if (empty) {
+        if (!optional) {
+            return Error(ProviderTxErrorCode::INVALID_PARAMETER,
+                         strprintf("Invalid param for %s, cannot be empty", field_name));
+        }
+        if (!payload.netInfo->IsEmpty()) {
+            return Error(ProviderTxErrorCode::INVALID_PARAMETER,
+                         strprintf("Invalid param for %s, cannot be empty if other fields populated", field_name));
+        }
+    }
+
+    if (!payload.netInfo->CanStorePlatform()) {
+        return Error(ProviderTxErrorCode::INVALID_PARAMETER,
+                     strprintf("Invalid param for %s, this ProTx version only accepts a bare port number; the "
+                               "\"ADDR:PORT\" / address-array form requires upgrading to a version 3 ProTx",
+                               field_name));
+    }
+    if (!entries) return std::nullopt;
+    for (size_t index{0}; index < entries->size(); ++index) {
+        if (IsNumeric((*entries)[index])) {
+            return Error(ProviderTxErrorCode::INVALID_PARAMETER,
+                         strprintf("Invalid param for %s[%zu], must be string", field_name, index));
+        }
+        if (auto error{add_entry((*entries)[index], index)}) return error;
+    }
+    return std::nullopt;
+}
+
+template <typename ProTx>
+std::optional<ProviderTxError> ApplyNetInfo(ProTx& payload, const ProviderNetInfo& net_info, bool platform, bool optional)
+{
+    if (auto error{ApplyCoreNetInfo(payload, net_info.core_p2p, optional)}) return error;
+    if (!platform) {
+        if (HasPlatformEndpoints(net_info.platform_p2p) || HasPlatformEndpoints(net_info.platform_https)) {
+            return Error(ProviderTxErrorCode::INVALID_PARAMETER, "Platform endpoints are only valid for an EvoNode");
+        }
+        return std::nullopt;
+    }
+    if (auto error{ApplyPlatformField(payload, net_info.platform_p2p, NetInfoPurpose::PLATFORM_P2P, "platformP2PAddrs",
+                                      payload.platformP2PPort, optional)}) {
+        return error;
+    }
+    return ApplyPlatformField(payload, net_info.platform_https, NetInfoPurpose::PLATFORM_HTTPS, "platformHTTPSAddrs",
+                              payload.platformHTTPPort, optional);
+}
+
+template <typename ProTx>
+std::optional<ProviderTxError> ValidateNetworkFields(const ProTx& payload, bool allow_empty, bool check_platform_node_id)
+{
+    TxValidationState state;
+    const uint160* platform_node_id{check_platform_node_id && payload.nType == MnType::Evo ? &payload.platformNodeID
+                                                                                           : nullptr};
+    if (!CheckProviderNetworkFields(payload.netInfo, payload.nType, payload.nVersion, platform_node_id,
+                                    payload.platformP2PPort, payload.platformHTTPPort, allow_empty, state)) {
+        return Error(ProviderTxErrorCode::CONSENSUS_REJECTED, state.ToString(), state.GetRejectReason());
+    }
+    return std::nullopt;
+}
+
+using PayoutResult = std::variant<MasternodePayoutShares, ProviderTxError>;
+
+PayoutResult BuildPayouts(const std::vector<ProviderPayout>& payouts)
+{
+    if (payouts.empty()) {
+        return Error(ProviderTxErrorCode::INVALID_PARAMETER, "payouts must contain at least one entry");
+    }
+    if (payouts.size() > 8) {
+        return Error(ProviderTxErrorCode::INVALID_PARAMETER, "payouts must not contain more than 8 entries");
+    }
+
+    MasternodePayoutShares result;
+    result.reserve(payouts.size());
+    for (const auto& payout : payouts) {
+        if (!IsValidDestination(payout.destination)) {
+            return Error(ProviderTxErrorCode::INVALID_ADDRESS_OR_KEY,
+                         strprintf("invalid payout address: %s", EncodeDestination(payout.destination)));
+        }
+        result.emplace_back(GetScriptForDestination(payout.destination), payout.reward);
+    }
+    return result;
+}
+
+template <typename Payload>
+void UpdateInputsHash(const CMutableTransaction& tx, Payload& payload)
+{
+    payload.inputsHash = CalcTxInputsHash(CTransaction(tx));
+}
+
+template <typename Payload>
+std::optional<ProviderTxError> SignPayload(const CMutableTransaction& tx, Payload& payload, const CKeyID& key_id,
+                                           Wallet& wallet)
+{
+    UpdateInputsHash(tx, payload);
+    payload.vchSig.clear();
+    if (!wallet.signSpecialTxPayload(::SerializeHash(payload), key_id, payload.vchSig)) {
+        return Error(ProviderTxErrorCode::INTERNAL_ERROR, "failed to sign special tx");
+    }
+    return std::nullopt;
+}
+
+template <typename Payload>
+void SignPayload(const CMutableTransaction& tx, Payload& payload, const CBLSSecretKey& key, bool legacy)
+{
+    UpdateInputsHash(tx, payload);
+    payload.sig = key.Sign(::SerializeHash(payload), legacy);
+}
+
+using MutableTxResult = std::variant<CMutableTransaction, ProviderTxError>;
+
+template <typename Payload>
+MutableTxResult Fund(Wallet& wallet, CMutableTransaction tx, const Payload& payload, const CTxDestination& fund_destination)
+{
+    AssertLockNotHeld(::cs_main);
+    if (!IsValidDestination(fund_destination)) {
+        return Error(ProviderTxErrorCode::FUNDING_ERROR, "No source of funds specified");
+    }
+    SetTxPayload(tx, payload);
+    auto funded{wallet.fundTransaction(tx, fund_destination)};
+    if (!funded) {
+        return Error(ProviderTxErrorCode::FUNDING_ERROR, util::ErrorString(funded).original);
+    }
+    return CMutableTransaction{**funded};
+}
+
+std::optional<ProviderTxError> Preflight(node::NodeContext& node, const CTransaction& tx)
+{
+    AssertLockNotHeld(::cs_main);
+    auto& chainman{*Assert(node.chainman)};
+    auto& chain_helper{*Assert(node.chain_helper)};
+    LOCK(::cs_main);
+
+    const CBlockIndex* tip{chainman.ActiveChain().Tip()};
+    const auto& consensus{chainman.GetConsensus()};
+    if (!DeploymentActiveAfter(tip, consensus, Consensus::DEPLOYMENT_DIP0003)) {
+        const int current_height{tip ? tip->nHeight : -1};
+        const int next_block_height{current_height + 1};
+        const int activation_height{consensus.DIP0003Height};
+        const int blocks_to_mine{activation_height > next_block_height ? activation_height - next_block_height : 0};
+        return Error(ProviderTxErrorCode::VERIFY_ERROR,
+                     strprintf("DIP0003 is not active yet; ProTx transactions are valid starting at block height %d "
+                               "(current chain height %d, next block height %d). Mine %d more block%s or restart "
+                               "this regtest/devnet chain with DIP3 activation parameters that are already active.",
+                               activation_height, current_height, next_block_height, blocks_to_mine,
+                               blocks_to_mine == 1 ? "" : "s"));
+    }
+
+    TxValidationState state;
+    if (!chain_helper.special_tx->CheckSpecialTx(tx, tip, chainman.ActiveChainstate().CoinsTip(), true, state)) {
+        return Error(ProviderTxErrorCode::CONSENSUS_REJECTED, state.ToString(), state.GetRejectReason());
+    }
+    return std::nullopt;
+}
+
+ProviderTxResult<ProviderTxSubmission> Finish(node::NodeContext& node, Wallet& wallet, const CMutableTransaction& tx,
+                                              bool submit)
+{
+    AssertLockNotHeld(::cs_main);
+    if (auto error{Preflight(node, CTransaction{tx})}) return *error;
+
+    auto signed_result{wallet.signTransaction(tx)};
+    if (!signed_result) {
+        return Error(wallet.isLocked() ? ProviderTxErrorCode::WALLET_UNLOCK_NEEDED : ProviderTxErrorCode::WALLET_ERROR,
+                     util::ErrorString(signed_result).original);
+    }
+    if (!signed_result->complete) {
+        std::string errors;
+        for (const auto& error : signed_result->errors) {
+            if (!errors.empty()) errors += ", ";
+            errors += error.original;
+        }
+        return Error(ProviderTxErrorCode::WALLET_ERROR,
+                     strprintf("transaction inputs could not be fully signed by this wallet; run this command on "
+                               "the wallet that funded the transaction, or finish signing there with "
+                               "signrawtransactionwithwallet (%s)",
+                               errors));
+    }
+    if (!submit) return ProviderTxSubmission{signed_result->tx, false};
+
+    const CAmount max_fee{node::DEFAULT_MAX_RAW_TX_FEE_RATE.GetFee(GetVirtualTransactionSize(*signed_result->tx))};
+    bilingual_str message;
+    const TransactionError transaction_error{
+        node::BroadcastTransaction(node, signed_result->tx, message, max_fee, /*relay=*/true, /*wait_callback=*/true)};
+    if (transaction_error != TransactionError::OK) {
+        return Error(ProviderTxErrorCode::BROADCAST_ERROR, message.original, {}, transaction_error);
+    }
+    return ProviderTxSubmission{signed_result->tx, true};
+}
+
+class CollateralLockGuard
+{
+public:
+    CollateralLockGuard(Wallet& wallet, const COutPoint& outpoint) :
+        m_wallet(wallet),
+        m_outpoint(outpoint)
+    {
+        m_result = m_wallet.acquireCoinLock(m_outpoint, /*write_to_db=*/false);
+    }
+
+    ~CollateralLockGuard()
+    {
+        if (m_result == CoinLockResult::ACQUIRED && !m_keep) m_wallet.unlockCoin(m_outpoint);
+    }
+
+    bool Succeeded() const { return m_result != CoinLockResult::FAILED; }
+    bool Acquired() const { return m_result == CoinLockResult::ACQUIRED; }
+    void Keep() { m_keep = true; }
+
+private:
+    Wallet& m_wallet;
+    COutPoint m_outpoint;
+    CoinLockResult m_result{CoinLockResult::FAILED};
+    bool m_keep{false};
+};
+
+using RegistrationOutcome = std::variant<ProviderTxSubmission, PreparedProviderRegistration>;
+using RegistrationResult = ProviderTxResult<RegistrationOutcome>;
+
+RegistrationResult BuildRegistration(node::NodeContext& node, Wallet& wallet,
+                                     const ProviderRegistrationRequest& request, bool prepare)
+{
+    if (!IsValidMnType(request.type)) {
+        return Error(ProviderTxErrorCode::INVALID_PARAMETER, "invalid masternode type");
+    }
+    if (prepare && !std::holds_alternative<ExistingProviderCollateral>(request.collateral)) {
+        return Error(ProviderTxErrorCode::INVALID_PARAMETER,
+                     "prepared registration requires an existing collateral outpoint");
+    }
+    if (!request.operator_key.IsValid()) {
+        return Error(ProviderTxErrorCode::INVALID_PARAMETER, "operator BLS address must be a valid BLS public key");
+    }
+    if (request.operator_reward > 10000) {
+        return Error(ProviderTxErrorCode::INVALID_PARAMETER, "operatorReward must be between 0 and 10000");
+    }
+    if (auto error{CheckDestination(request.fee_source, "fee source")}) return *error;
+
+    const auto* existing_collateral{std::get_if<ExistingProviderCollateral>(&request.collateral)};
+    const ChainSnapshot chain_snapshot{
+        SnapshotChain(node, std::nullopt, existing_collateral ? std::optional{existing_collateral->outpoint} : std::nullopt,
+                      /*basic_override=*/!request.use_legacy_bls_scheme)};
+    if (auto error{CheckWallet(wallet)}) return *error;
+
+    CMutableTransaction tx;
+    tx.nVersion = 3;
+    tx.nType = TRANSACTION_PROVIDER_REGISTER;
+
+    CProRegTx payload;
+    payload.nType = request.type;
+    payload.nVersion = chain_snapshot.provider_tx_version;
+    payload.netInfo = NetInfoInterface::MakeNetInfo(payload.nVersion);
+
+    if (const auto* collateral{std::get_if<FundProviderCollateral>(&request.collateral)}) {
+        if (!IsValidDestination(collateral->destination)) {
+            return Error(ProviderTxErrorCode::INVALID_ADDRESS_OR_KEY,
+                         strprintf("invalid collaterall address: %s", EncodeDestination(collateral->destination)));
+        }
+        tx.vout.emplace_back(GetMnType(request.type).collat_amount, GetScriptForDestination(collateral->destination));
+    } else {
+        payload.collateralOutpoint = std::get<ExistingProviderCollateral>(request.collateral).outpoint;
+        if (payload.collateralOutpoint.hash.IsNull()) {
+            return Error(ProviderTxErrorCode::INVALID_ADDRESS_OR_KEY,
+                         strprintf("invalid hash or index: %s-%d", payload.collateralOutpoint.hash.ToString(),
+                                   payload.collateralOutpoint.n));
+        }
+    }
+
+    if (auto error{ApplyNetInfo(payload, request.net_info, request.type == MnType::Evo, /*optional=*/true)}) {
+        return *error;
+    }
+    payload.keyIDOwner = request.owner_key;
+    payload.keyIDVoting = request.voting_key.IsNull() ? request.owner_key : request.voting_key;
+    payload.pubKeyOperator.Set(request.operator_key, request.use_legacy_bls_scheme);
+    if (payload.pubKeyOperator.IsLegacy() != (payload.nVersion == ProTxVersion::LegacyBLS)) {
+        return Error(ProviderTxErrorCode::INVALID_PARAMETER, "operator key encoding does not match ProTx version");
+    }
+    payload.nOperatorReward = request.operator_reward;
+
+    auto payouts_result{BuildPayouts(request.payouts)};
+    if (const auto* error{std::get_if<ProviderTxError>(&payouts_result)}) return *error;
+    payload.payouts = std::get<MasternodePayoutShares>(std::move(payouts_result));
+    payload.scriptPayout = payload.payouts.front().scriptPayout;
+    if (payload.nVersion < ProTxVersion::ExtAddr && (request.uses_extended_payouts || payload.payouts.size() > 1)) {
+        return Error(ProviderTxErrorCode::INVALID_PARAMETER, "payouts array requires provider transaction version 3");
+    }
+
+    if (request.type == MnType::Evo) {
+        if (!request.platform_node_id) {
+            return Error(ProviderTxErrorCode::INVALID_PARAMETER, "platformNodeID must be specified for an EvoNode");
+        }
+        payload.platformNodeID = *request.platform_node_id;
+    }
+    if (auto error{ValidateNetworkFields(payload, /*allow_empty=*/true,
+                                         /*check_platform_node_id=*/true)}) {
+        return *error;
+    }
+
+    const CTxDestination fund_destination{request.fee_source.value_or(request.payouts.front().destination)};
+    if (std::holds_alternative<FundProviderCollateral>(request.collateral)) {
+        auto funded_result{Fund(wallet, std::move(tx), payload, fund_destination)};
+        if (const auto* error{std::get_if<ProviderTxError>(&funded_result)}) return *error;
+        tx = std::get<CMutableTransaction>(std::move(funded_result));
+        UpdateInputsHash(tx, payload);
+
+        const CAmount collateral_amount{GetMnType(request.type).collat_amount};
+        const auto it{std::find_if(tx.vout.begin(), tx.vout.end(), [collateral_amount](const CTxOut& output) {
+            return output.nValue == collateral_amount;
+        })};
+        if (it == tx.vout.end()) {
+            return Error(ProviderTxErrorCode::INTERNAL_ERROR, "funded transaction lost its collateral output");
+        }
+        payload.collateralOutpoint.n = static_cast<uint32_t>(std::distance(tx.vout.begin(), it));
+        SetTxPayload(tx, payload);
+        auto result{Finish(node, wallet, tx, request.submit)};
+        if (const auto* error{std::get_if<ProviderTxError>(&result)}) return *error;
+        return RegistrationOutcome{std::get<ProviderTxSubmission>(std::move(result))};
+    }
+
+    CollateralLockGuard collateral_lock{wallet, payload.collateralOutpoint};
+    if (!collateral_lock.Succeeded()) {
+        return Error(ProviderTxErrorCode::WALLET_ERROR,
+                     strprintf("failed to lock collateral: %s", payload.collateralOutpoint.ToStringShort()));
+    }
+
+    payload.vchSig.resize(CPubKey::COMPACT_SIGNATURE_SIZE);
+    auto funded_result{Fund(wallet, std::move(tx), payload, fund_destination)};
+    if (const auto* error{std::get_if<ProviderTxError>(&funded_result)}) return *error;
+    tx = std::get<CMutableTransaction>(std::move(funded_result));
+    UpdateInputsHash(tx, payload);
+
+    if (!chain_snapshot.collateral_coin) {
+        return Error(ProviderTxErrorCode::INVALID_ADDRESS_OR_KEY,
+                     strprintf("collateral not found: %s", payload.collateralOutpoint.ToStringShort()));
+    }
+    CTxDestination collateral_destination;
+    ExtractDestination(chain_snapshot.collateral_coin->out.scriptPubKey, collateral_destination);
+    const auto* collateral_key{std::get_if<PKHash>(&collateral_destination)};
+    if (!collateral_key) {
+        return Error(ProviderTxErrorCode::INVALID_ADDRESS_OR_KEY,
+                     strprintf("collateral type not supported: %s", payload.collateralOutpoint.ToStringShort()));
+    }
+
+    if (prepare) {
+        payload.vchSig.clear();
+        SetTxPayload(tx, payload);
+        collateral_lock.Keep();
+        return RegistrationOutcome{PreparedProviderRegistration{MakeTransactionRef(std::move(tx)), collateral_destination,
+                                                                payload.MakeSignString(), collateral_lock.Acquired()}};
+    }
+
+    std::string signature;
+    const SigningResult signing_result{wallet.signMessage(payload.MakeSignString(), *collateral_key, signature)};
+    if (signing_result != SigningResult::OK) {
+        return Error(signing_result == SigningResult::SIGNING_FAILED ? ProviderTxErrorCode::INVALID_ADDRESS_OR_KEY
+                                                                     : ProviderTxErrorCode::WALLET_ERROR,
+                     SigningResultString(signing_result));
+    }
+    auto decoded_signature{DecodeBase64(signature)};
+    if (!decoded_signature) {
+        return Error(ProviderTxErrorCode::INTERNAL_ERROR, "failed to decode base64 ready signature for protx");
+    }
+    payload.vchSig = std::move(*decoded_signature);
+    SetTxPayload(tx, payload);
+    auto result{Finish(node, wallet, tx, request.submit)};
+    if (const auto* error{std::get_if<ProviderTxError>(&result)}) return *error;
+    collateral_lock.Keep();
+    return RegistrationOutcome{std::get<ProviderTxSubmission>(std::move(result))};
+}
+
+} // namespace
+
+interfaces::ProviderTxCapabilities GetCapabilities(node::NodeContext& node, std::optional<bool> basic_override)
+{
+    const uint16_t version{CurrentProviderTxVersion(node, basic_override)};
+    return interfaces::ProviderTxCapabilities{version, version >= ProTxVersion::ExtAddr};
+}
+
+std::optional<ProviderTxError> ValidateNetInfo(const ProviderNetInfo& net_info, MnType type, uint16_t version, bool optional)
+{
+    if (!IsValidMnType(type)) {
+        return Error(ProviderTxErrorCode::INVALID_PARAMETER, "invalid masternode type");
+    }
+    if (version < ProTxVersion::LegacyBLS || version > ProTxVersion::ExtAddr) {
+        return Error(ProviderTxErrorCode::INVALID_PARAMETER, "invalid provider transaction version");
+    }
+
+    CProRegTx payload;
+    payload.nType = type;
+    payload.nVersion = version;
+    payload.netInfo = NetInfoInterface::MakeNetInfo(version);
+    if (auto error{ApplyNetInfo(payload, net_info, type == MnType::Evo, optional)}) return error;
+    return ValidateNetworkFields(payload, optional, /*check_platform_node_id=*/false);
+}
+
+ProviderTxResult<ProviderTxSubmission> Register(node::NodeContext& node, Wallet& wallet,
+                                                const ProviderRegistrationRequest& request)
+{
+    auto result{BuildRegistration(node, wallet, request, /*prepare=*/false)};
+    if (const auto* error{std::get_if<ProviderTxError>(&result)}) return *error;
+    auto& outcome{std::get<RegistrationOutcome>(result)};
+    if (auto* submission{std::get_if<ProviderTxSubmission>(&outcome)}) return std::move(*submission);
+    return Error(ProviderTxErrorCode::INTERNAL_ERROR, "registration returned an unexpected prepared transaction");
+}
+
+ProviderTxResult<PreparedProviderRegistration> PrepareRegistration(node::NodeContext& node, Wallet& wallet,
+                                                                   const ProviderRegistrationRequest& request)
+{
+    auto result{BuildRegistration(node, wallet, request, /*prepare=*/true)};
+    if (const auto* error{std::get_if<ProviderTxError>(&result)}) return *error;
+    auto& outcome{std::get<RegistrationOutcome>(result)};
+    if (auto* prepared{std::get_if<PreparedProviderRegistration>(&outcome)}) return std::move(*prepared);
+    return Error(ProviderTxErrorCode::INTERNAL_ERROR, "registration returned an unexpected submitted transaction");
+}
+
+ProviderTxResult<ProviderTxSubmission> SubmitRegistration(node::NodeContext& node, Wallet& wallet,
+                                                          const CTransactionRef& transaction,
+                                                          const std::vector<unsigned char>& collateral_signature)
+{
+    if (auto error{CheckWallet(wallet)}) return *error;
+    if (!transaction) {
+        return Error(ProviderTxErrorCode::INVALID_PARAMETER, "transaction not deserializable");
+    }
+
+    CMutableTransaction tx{*transaction};
+    if (tx.nType != TRANSACTION_PROVIDER_REGISTER) {
+        return Error(ProviderTxErrorCode::INVALID_PARAMETER, "transaction not a ProRegTx");
+    }
+    auto payload{GetTxPayload<CProRegTx>(tx)};
+    if (!payload) {
+        return Error(ProviderTxErrorCode::INVALID_PARAMETER, "transaction payload not deserializable");
+    }
+    if (!payload->vchSig.empty()) {
+        return Error(ProviderTxErrorCode::INVALID_PARAMETER, "payload signature not empty");
+    }
+    payload->vchSig = collateral_signature;
+    SetTxPayload(tx, *payload);
+    return Finish(node, wallet, tx, /*submit=*/true);
+}
+
+ProviderTxResult<ProviderTxSubmission> UpdateService(node::NodeContext& node, Wallet& wallet,
+                                                     const ProviderUpdateServiceRequest& request)
+{
+    if (!IsValidMnType(request.type)) {
+        return Error(ProviderTxErrorCode::INVALID_PARAMETER, "invalid masternode type");
+    }
+    if (!request.operator_key.IsValid()) {
+        return Error(ProviderTxErrorCode::INVALID_PARAMETER, "operatorKey must be a valid BLS secret key");
+    }
+    if (auto error{CheckDestination(request.operator_payout, "operator payout")}) return *error;
+    if (auto error{CheckDestination(request.fee_source, "fee source")}) return *error;
+
+    const ChainSnapshot chain_snapshot{SnapshotChain(node, request.pro_tx_hash, std::nullopt)};
+    if (auto error{CheckWallet(wallet)}) return *error;
+    const auto& dmn{chain_snapshot.dmn};
+    if (!dmn) {
+        return Error(ProviderTxErrorCode::CONSENSUS_REJECTED,
+                     strprintf("masternode with proTxHash %s not found", request.pro_tx_hash.ToString()));
+    }
+    if (dmn->nType != request.type) {
+        return Error(ProviderTxErrorCode::CONSENSUS_REJECTED,
+                     strprintf("masternode with proTxHash %s is not a %s", request.pro_tx_hash.ToString(),
+                               GetMnType(request.type).description));
+    }
+    if (request.operator_key.GetPublicKey() != dmn->pdmnState->pubKeyOperator.Get()) {
+        return Error(ProviderTxErrorCode::INVALID_PARAMETER,
+                     "the operator key does not belong to the registered public key");
+    }
+
+    CProUpServTx payload;
+    payload.proTxHash = request.pro_tx_hash;
+    payload.nType = request.type;
+    payload.nVersion = chain_snapshot.provider_tx_version;
+    payload.netInfo = NetInfoInterface::MakeNetInfo(payload.nVersion);
+    if (auto error{ApplyNetInfo(payload, request.net_info, request.type == MnType::Evo, /*optional=*/false)}) {
+        return *error;
+    }
+    if (request.type == MnType::Evo) {
+        if (!request.platform_node_id) {
+            return Error(ProviderTxErrorCode::INVALID_PARAMETER, "platformNodeID must be specified for an EvoNode");
+        }
+        payload.platformNodeID = *request.platform_node_id;
+    }
+    if (auto error{ValidateNetworkFields(payload, /*allow_empty=*/false,
+                                         /*check_platform_node_id=*/true)}) {
+        return *error;
+    }
+    payload.scriptOperatorPayout = request.operator_payout ? GetScriptForDestination(*request.operator_payout)
+                                                           : dmn->pdmnState->scriptOperatorPayout;
+
+    CTxDestination fund_destination;
+    if (request.fee_source) {
+        fund_destination = *request.fee_source;
+    } else if (!payload.scriptOperatorPayout.empty()) {
+        ExtractDestination(payload.scriptOperatorPayout, fund_destination);
+    } else {
+        const auto owner_payouts{GetOwnerPayouts(*dmn->pdmnState)};
+        if (owner_payouts.empty() || !ExtractDestination(owner_payouts.front().scriptPayout, fund_destination)) {
+            return Error(ProviderTxErrorCode::INVALID_PARAMETER,
+                         "masternode has no default fee source; specify feeSourceAddress");
+        }
+    }
+
+    CMutableTransaction tx;
+    tx.nVersion = 3;
+    tx.nType = TRANSACTION_PROVIDER_UPDATE_SERVICE;
+    auto funded_result{Fund(wallet, std::move(tx), payload, fund_destination)};
+    if (const auto* error{std::get_if<ProviderTxError>(&funded_result)}) return *error;
+    tx = std::get<CMutableTransaction>(std::move(funded_result));
+    SignPayload(tx, payload, request.operator_key, payload.nVersion == ProTxVersion::LegacyBLS);
+    SetTxPayload(tx, payload);
+    return Finish(node, wallet, tx, request.submit);
+}
+
+ProviderTxResult<ProviderTxSubmission> UpdateRegistrar(node::NodeContext& node, Wallet& wallet,
+                                                       const ProviderUpdateRegistrarRequest& request)
+{
+    if (auto error{CheckDestination(request.fee_source, "fee source")}) return *error;
+    const ChainSnapshot chain_snapshot{
+        SnapshotChain(node, request.pro_tx_hash, std::nullopt, /*basic_override=*/!request.use_legacy_bls_scheme)};
+    if (auto error{CheckWallet(wallet)}) return *error;
+    const auto& dmn{chain_snapshot.dmn};
+    if (!dmn) {
+        return Error(ProviderTxErrorCode::INVALID_PARAMETER,
+                     strprintf("masternode %s not found", request.pro_tx_hash.ToString()));
+    }
+
+    CProUpRegTx payload;
+    payload.nVersion = chain_snapshot.provider_tx_version;
+    payload.proTxHash = request.pro_tx_hash;
+    payload.keyIDVoting = request.voting_key.value_or(dmn->pdmnState->keyIDVoting);
+
+    if (request.operator_key) {
+        if (!request.operator_key->IsValid()) {
+            return Error(ProviderTxErrorCode::INVALID_PARAMETER, "operator BLS address must be a valid BLS public key");
+        }
+        payload.pubKeyOperator.Set(*request.operator_key, request.use_legacy_bls_scheme);
+    } else {
+        payload.pubKeyOperator = dmn->pdmnState->pubKeyOperator;
+        if (!request.use_legacy_bls_scheme && payload.pubKeyOperator != CBLSLazyPublicKey() &&
+            payload.pubKeyOperator.IsLegacy()) {
+            payload.pubKeyOperator.Set(payload.pubKeyOperator.Get(), /*specificLegacyScheme=*/false);
+        }
+    }
+    if (payload.pubKeyOperator.IsLegacy() != (payload.nVersion == ProTxVersion::LegacyBLS)) {
+        return Error(ProviderTxErrorCode::INVALID_PARAMETER, "operator key encoding does not match ProTx version");
+    }
+
+    CTxDestination payout_destination;
+    if (request.payouts) {
+        auto payouts_result{BuildPayouts(*request.payouts)};
+        if (const auto* error{std::get_if<ProviderTxError>(&payouts_result)}) return *error;
+        payload.payouts = std::get<MasternodePayoutShares>(std::move(payouts_result));
+        if (payload.nVersion < ProTxVersion::ExtAddr && (request.uses_extended_payouts || payload.payouts.size() > 1)) {
+            return Error(ProviderTxErrorCode::INVALID_PARAMETER,
+                         "payouts array requires provider transaction version 3");
+        }
+    } else {
+        payload.payouts = GetOwnerPayouts(*dmn->pdmnState);
+    }
+    if (payload.payouts.empty() || !ExtractDestination(payload.payouts.front().scriptPayout, payout_destination)) {
+        return Error(ProviderTxErrorCode::INVALID_PARAMETER, "masternode has no payout address");
+    }
+    payload.scriptPayout = payload.payouts.front().scriptPayout;
+
+    if (!wallet.isSpendable(GetScriptForDestination(PKHash{dmn->pdmnState->keyIDOwner}))) {
+        return Error(ProviderTxErrorCode::CONSENSUS_REJECTED,
+                     strprintf("Private key for owner address %s not found in your wallet",
+                               EncodeDestination(PKHash{dmn->pdmnState->keyIDOwner})));
+    }
+
+    CMutableTransaction tx;
+    tx.nVersion = 3;
+    tx.nType = TRANSACTION_PROVIDER_UPDATE_REGISTRAR;
+    payload.vchSig.resize(CPubKey::COMPACT_SIGNATURE_SIZE);
+    auto funded_result{Fund(wallet, std::move(tx), payload, request.fee_source.value_or(payout_destination))};
+    if (const auto* error{std::get_if<ProviderTxError>(&funded_result)}) return *error;
+    tx = std::get<CMutableTransaction>(std::move(funded_result));
+    if (auto error{SignPayload(tx, payload, dmn->pdmnState->keyIDOwner, wallet)}) return *error;
+    SetTxPayload(tx, payload);
+    return Finish(node, wallet, tx, request.submit);
+}
+
+ProviderTxResult<ProviderTxSubmission> Revoke(node::NodeContext& node, Wallet& wallet, const ProviderRevokeRequest& request)
+{
+    if (!request.operator_key.IsValid()) {
+        return Error(ProviderTxErrorCode::INVALID_PARAMETER, "operatorKey must be a valid BLS secret key");
+    }
+    if (request.reason > CProUpRevTx::REASON_LAST) {
+        return Error(ProviderTxErrorCode::INVALID_PARAMETER,
+                     strprintf("invalid reason %d, must be between 0 and %d", request.reason, CProUpRevTx::REASON_LAST));
+    }
+    if (auto error{CheckDestination(request.fee_source, "fee source")}) return *error;
+
+    const ChainSnapshot chain_snapshot{SnapshotChain(node, request.pro_tx_hash, std::nullopt)};
+    if (auto error{CheckWallet(wallet)}) return *error;
+    const auto& dmn{chain_snapshot.dmn};
+    if (!dmn) {
+        return Error(ProviderTxErrorCode::INVALID_PARAMETER,
+                     strprintf("masternode %s not found", request.pro_tx_hash.ToString()));
+    }
+    if (request.operator_key.GetPublicKey() != dmn->pdmnState->pubKeyOperator.Get()) {
+        return Error(ProviderTxErrorCode::INVALID_PARAMETER,
+                     "the operator key does not belong to the registered public key");
+    }
+
+    CProUpRevTx payload;
+    payload.proTxHash = request.pro_tx_hash;
+    payload.nVersion = chain_snapshot.provider_tx_version;
+    payload.nReason = request.reason;
+
+    CTxDestination fund_destination;
+    if (request.fee_source) {
+        fund_destination = *request.fee_source;
+    } else if (!dmn->pdmnState->scriptOperatorPayout.empty()) {
+        ExtractDestination(dmn->pdmnState->scriptOperatorPayout, fund_destination);
+    } else {
+        const auto owner_payouts{GetOwnerPayouts(*dmn->pdmnState)};
+        if (owner_payouts.empty() || !ExtractDestination(owner_payouts.front().scriptPayout, fund_destination)) {
+            return Error(ProviderTxErrorCode::INVALID_PARAMETER,
+                         "No payout or fee source addresses found, can't revoke");
+        }
+    }
+
+    CMutableTransaction tx;
+    tx.nVersion = 3;
+    tx.nType = TRANSACTION_PROVIDER_UPDATE_REVOKE;
+    auto funded_result{Fund(wallet, std::move(tx), payload, fund_destination)};
+    if (const auto* error{std::get_if<ProviderTxError>(&funded_result)}) return *error;
+    tx = std::get<CMutableTransaction>(std::move(funded_result));
+    SignPayload(tx, payload, request.operator_key, payload.nVersion == ProTxVersion::LegacyBLS);
+    SetTxPayload(tx, payload);
+    return Finish(node, wallet, tx, request.submit);
+}
+
+} // namespace evo::provider
diff --git a/src/evo/providertx_service.h b/src/evo/providertx_service.h
new file mode 100644
index 000000000000..53d1f4999af8
--- /dev/null
+++ b/src/evo/providertx_service.h
@@ -0,0 +1,49 @@
+// Copyright (c) 2026 The Dash Core developers
+// Distributed under the MIT software license, see the accompanying
+// file COPYING or http://www.opensource.org/licenses/mit-license.php.
+
+#ifndef BITCOIN_EVO_PROVIDERTX_SERVICE_H
+#define BITCOIN_EVO_PROVIDERTX_SERVICE_H
+
+#include <interfaces/providertx.h>
+
+#include <optional>
+
+namespace interfaces {
+class Wallet;
+} // namespace interfaces
+
+namespace node {
+struct NodeContext;
+} // namespace node
+
+namespace evo::provider {
+
+interfaces::ProviderTxCapabilities GetCapabilities(node::NodeContext& node,
+                                                   std::optional<bool> basic_override = std::nullopt);
+
+std::optional<interfaces::ProviderTxError> ValidateNetInfo(const interfaces::ProviderNetInfo& net_info, MnType type,
+                                                           uint16_t version, bool optional);
+
+interfaces::ProviderTxResult<interfaces::ProviderTxSubmission> Register(
+    node::NodeContext& node, interfaces::Wallet& wallet, const interfaces::ProviderRegistrationRequest& request);
+
+interfaces::ProviderTxResult<interfaces::PreparedProviderRegistration> PrepareRegistration(
+    node::NodeContext& node, interfaces::Wallet& wallet, const interfaces::ProviderRegistrationRequest& request);
+
+interfaces::ProviderTxResult<interfaces::ProviderTxSubmission> SubmitRegistration(
+    node::NodeContext& node, interfaces::Wallet& wallet, const CTransactionRef& tx,
+    const std::vector<unsigned char>& collateral_signature);
+
+interfaces::ProviderTxResult<interfaces::ProviderTxSubmission> UpdateService(
+    node::NodeContext& node, interfaces::Wallet& wallet, const interfaces::ProviderUpdateServiceRequest& request);
+
+interfaces::ProviderTxResult<interfaces::ProviderTxSubmission> UpdateRegistrar(
+    node::NodeContext& node, interfaces::Wallet& wallet, const interfaces::ProviderUpdateRegistrarRequest& request);
+
+interfaces::ProviderTxResult<interfaces::ProviderTxSubmission> Revoke(node::NodeContext& node, interfaces::Wallet& wallet,
+                                                                      const interfaces::ProviderRevokeRequest& request);
+
+} // namespace evo::provider
+
+#endif // BITCOIN_EVO_PROVIDERTX_SERVICE_H
diff --git a/src/evo/specialtxman.cpp b/src/evo/specialtxman.cpp
index 73c08df28492..bf3f11ba5df3 100644
--- a/src/evo/specialtxman.cpp
+++ b/src/evo/specialtxman.cpp
@@ -961,75 +961,6 @@ bool CSpecialTxProcessor::CheckCreditPoolDiffForBlock(const CBlock& block, const
     return true;
 }
 
-template <typename ProTx>
-static bool CheckService(const ProTx& proTx, TxValidationState& state)
-{
-    switch (proTx.netInfo->Validate()) {
-    case NetInfoStatus::BadAddress:
-        return state.Invalid(TxValidationResult::TX_BAD_SPECIAL, "bad-protx-netinfo-addr");
-    case NetInfoStatus::BadPort:
-        return state.Invalid(TxValidationResult::TX_BAD_SPECIAL, "bad-protx-netinfo-port");
-    case NetInfoStatus::BadType:
-        return state.Invalid(TxValidationResult::TX_BAD_SPECIAL, "bad-protx-netinfo-addr-type");
-    case NetInfoStatus::NotRoutable:
-        return state.Invalid(TxValidationResult::TX_BAD_SPECIAL, "bad-protx-netinfo-addr-unroutable");
-    case NetInfoStatus::Malformed:
-        return state.Invalid(TxValidationResult::TX_BAD_SPECIAL, "bad-protx-netinfo-bad");
-    case NetInfoStatus::Success:
-        return true;
-    // Reachable through a serialized netInfo that bypasses the in-memory builder's checks
-    case NetInfoStatus::BadInput:
-        return state.Invalid(TxValidationResult::TX_BAD_SPECIAL, "bad-protx-netinfo-entry");
-    case NetInfoStatus::Duplicate:
-        return state.Invalid(TxValidationResult::TX_BAD_SPECIAL, "bad-protx-dup-netinfo-entry");
-    case NetInfoStatus::MaxLimit:
-        return state.Invalid(TxValidationResult::TX_BAD_SPECIAL, "bad-protx-netinfo-maxlimit");
-    } // no default case, so the compiler can warn about missing cases
-    assert(false);
-}
-
-template <typename ProTx>
-static bool CheckPlatformFields(const ProTx& proTx, bool is_extended_addr, TxValidationState& state)
-{
-    if (proTx.platformNodeID.IsNull()) {
-        return state.Invalid(TxValidationResult::TX_BAD_SPECIAL, "bad-protx-platform-nodeid");
-    }
-
-    if (is_extended_addr) {
-        // platformHTTPPort and platformP2PPort have been subsumed by netInfo. They should always be zero.
-        if (proTx.platformP2PPort != 0) {
-            return state.Invalid(TxValidationResult::TX_BAD_SPECIAL, "bad-protx-platform-p2p-port");
-        }
-        if (proTx.platformHTTPPort != 0) {
-            return state.Invalid(TxValidationResult::TX_BAD_SPECIAL, "bad-protx-platform-http-port");
-        }
-        return true;
-    }
-
-    if (::IsNodeOnMainnet()) {
-        if (proTx.platformP2PPort != ::MainParams().GetDefaultPlatformP2PPort()) {
-            return state.Invalid(TxValidationResult::TX_BAD_SPECIAL, "bad-protx-platform-p2p-port");
-        }
-        if (proTx.platformHTTPPort != ::MainParams().GetDefaultPlatformHTTPPort()) {
-            return state.Invalid(TxValidationResult::TX_BAD_SPECIAL, "bad-protx-platform-http-port");
-        }
-    }
-    if (proTx.platformP2PPort == ::MainParams().GetDefaultPort()) {
-        return state.Invalid(TxValidationResult::TX_BAD_SPECIAL, "bad-protx-platform-p2p-port");
-    }
-    if (proTx.platformHTTPPort == ::MainParams().GetDefaultPort()) {
-        return state.Invalid(TxValidationResult::TX_BAD_SPECIAL, "bad-protx-platform-http-port");
-    }
-
-    const uint16_t core_port{proTx.netInfo->GetPrimary().GetPort()};
-    if (proTx.platformP2PPort == proTx.platformHTTPPort || proTx.platformP2PPort == core_port ||
-        proTx.platformHTTPPort == core_port) {
-        return state.Invalid(TxValidationResult::TX_BAD_SPECIAL, "bad-protx-platform-dup-ports");
-    }
-
-    return true;
-}
-
 template <typename ProTx>
 static bool CheckHashSig(const ProTx& proTx, const PKHash& pkhash, TxValidationState& state)
 {
@@ -1126,17 +1057,11 @@ bool CheckProRegTx(const CTransaction& tx, gsl::not_null<const CBlockIndex*> pin
 
     // It's allowed to set addr to 0, which will put the MN into PoSe-banned state and require a ProUpServTx to be
     // issues later. If any of both is set, it must be valid however
-    if (!opt_ptx->netInfo->IsEmpty() && !CheckService(*opt_ptx, state)) {
-        // pass the state returned by the function above
+    if (!CheckProviderNetworkFields(opt_ptx->netInfo, opt_ptx->nType, opt_ptx->nVersion, &opt_ptx->platformNodeID,
+                                    opt_ptx->platformP2PPort, opt_ptx->platformHTTPPort, /*allow_empty=*/true, state)) {
         return false;
     }
 
-    if (opt_ptx->nType == MnType::Evo) {
-        if (!CheckPlatformFields(*opt_ptx, opt_ptx->nVersion >= ProTxVersion::ExtAddr, state)) {
-            return false;
-        }
-    }
-
     CTxDestination collateralTxDest;
     const PKHash* keyForPayloadSig = nullptr;
     COutPoint collateralOutpoint;
@@ -1260,17 +1185,11 @@ bool CheckProUpServTx(const CTransaction& tx, gsl::not_null<const CBlockIndex*>
         return false;
     }
 
-    if (!CheckService(*opt_ptx, state)) {
-        // pass the state returned by the function above
+    if (!CheckProviderNetworkFields(opt_ptx->netInfo, opt_ptx->nType, opt_ptx->nVersion, &opt_ptx->platformNodeID,
+                                    opt_ptx->platformP2PPort, opt_ptx->platformHTTPPort, /*allow_empty=*/false, state)) {
         return false;
     }
 
-    if (opt_ptx->nType == MnType::Evo) {
-        if (!CheckPlatformFields(*opt_ptx, opt_ptx->nVersion >= ProTxVersion::ExtAddr, state)) {
-            return false;
-        }
-    }
-
     auto mnList = dmnman.GetListForBlock(pindexPrev);
     auto dmn = mnList.GetMN(opt_ptx->proTxHash);
     if (!dmn) {
diff --git a/src/interfaces/node.h b/src/interfaces/node.h
index 32b93f88d041..ba2e5b682aa0 100644
--- a/src/interfaces/node.h
+++ b/src/interfaces/node.h
@@ -17,6 +17,7 @@
 #include <util/translation.h>
 
 #include <evo/types.h>
+#include <interfaces/providertx.h>
 
 #include <functional>
 #include <memory>
@@ -133,6 +134,27 @@ class EVO
 public:
     virtual ~EVO() {}
     virtual std::pair<MnListPtr, const CBlockIndex*> getListAtChainTip() = 0;
+    virtual ProviderTxCapabilities getProviderTxCapabilities() = 0;
+    //! Validate provider endpoints against a capability snapshot without changing node or wallet state.
+    //! Transaction creation validates them again against the then-active rules.
+    virtual std::optional<ProviderTxError> validateProviderNetInfo(const ProviderNetInfo& net_info, MnType type,
+                                                                   uint16_t version, bool optional) = 0;
+    //! Successful registration with an existing collateral leaves that coin locked,
+    //! including when the signed transaction is returned without submission.
+    virtual ProviderTxResult<ProviderTxSubmission> registerMasternode(Wallet& wallet,
+                                                                      const ProviderRegistrationRequest& request) = 0;
+    //! Successful preparation leaves existing collateral locked. The result identifies
+    //! whether this call acquired the lock so a discarded flow cannot unlock an older lock.
+    virtual ProviderTxResult<PreparedProviderRegistration> prepareMasternodeRegistration(
+        Wallet& wallet, const ProviderRegistrationRequest& request) = 0;
+    virtual ProviderTxResult<ProviderTxSubmission> submitMasternodeRegistration(
+        Wallet& wallet, const CTransactionRef& tx, const std::vector<unsigned char>& collateral_signature) = 0;
+    virtual ProviderTxResult<ProviderTxSubmission> updateMasternodeService(Wallet& wallet,
+                                                                           const ProviderUpdateServiceRequest& request) = 0;
+    virtual ProviderTxResult<ProviderTxSubmission> updateMasternodeRegistrar(
+        Wallet& wallet, const ProviderUpdateRegistrarRequest& request) = 0;
+    virtual ProviderTxResult<ProviderTxSubmission> revokeMasternode(Wallet& wallet,
+                                                                    const ProviderRevokeRequest& request) = 0;
     virtual void setContext(node::NodeContext* context) {}
 };
 
diff --git a/src/interfaces/providertx.h b/src/interfaces/providertx.h
new file mode 100644
index 000000000000..c9f048efe31d
--- /dev/null
+++ b/src/interfaces/providertx.h
@@ -0,0 +1,142 @@
+// Copyright (c) 2026 The Dash Core developers
+// Distributed under the MIT software license, see the accompanying
+// file COPYING or http://www.opensource.org/licenses/mit-license.php.
+
+#ifndef BITCOIN_INTERFACES_PROVIDERTX_H
+#define BITCOIN_INTERFACES_PROVIDERTX_H
+
+#include <bls/bls.h>
+#include <evo/dmn_types.h>
+#include <primitives/transaction.h>
+#include <pubkey.h>
+#include <script/standard.h>
+#include <uint256.h>
+#include <util/translation.h>
+
+#include <cstdint>
+#include <optional>
+#include <string>
+#include <variant>
+#include <vector>
+
+enum class TransactionError;
+
+namespace interfaces {
+
+enum class ProviderTxErrorCode {
+    INVALID_PARAMETER,
+    INVALID_ADDRESS_OR_KEY,
+    FUNDING_ERROR,
+    WALLET_ERROR,
+    WALLET_UNLOCK_NEEDED,
+    INTERNAL_ERROR,
+    VERIFY_ERROR,
+    CONSENSUS_REJECTED,
+    BROADCAST_ERROR,
+};
+
+struct ProviderTxError {
+    ProviderTxErrorCode code{ProviderTxErrorCode::INTERNAL_ERROR};
+    bilingual_str message;
+    std::string reject_reason;
+    std::optional<TransactionError> transaction_error;
+};
+
+template <typename T>
+using ProviderTxResult = std::variant<T, ProviderTxError>;
+
+struct ProviderTxSubmission {
+    CTransactionRef tx;
+    bool submitted{false};
+};
+
+struct PreparedProviderRegistration {
+    CTransactionRef tx;
+    CTxDestination collateral_address;
+    std::string sign_message;
+    //! True only if this prepare call newly locked the collateral. A successful prepare
+    //! leaves the lock held; the caller may release this one lock if the flow is discarded.
+    bool collateral_lock_acquired{false};
+};
+
+//! A point-in-time view of the provider transaction rules. Transaction creation and
+//! submission always re-evaluate the active rules and can reject a stale request.
+struct ProviderTxCapabilities {
+    uint16_t version{0};
+    bool extended_addresses{false};
+};
+
+using ProviderPlatformEndpoints = std::variant<std::monostate, uint16_t, std::vector<std::string>>;
+
+struct ProviderNetInfo {
+    std::vector<std::string> core_p2p;
+    ProviderPlatformEndpoints platform_p2p;
+    ProviderPlatformEndpoints platform_https;
+};
+
+struct ProviderPayout {
+    CTxDestination destination;
+    uint16_t reward{0};
+};
+
+struct FundProviderCollateral {
+    CTxDestination destination;
+};
+
+struct ExistingProviderCollateral {
+    COutPoint outpoint;
+};
+
+using ProviderCollateral = std::variant<FundProviderCollateral, ExistingProviderCollateral>;
+
+struct ProviderRegistrationRequest {
+    MnType type{MnType::Regular};
+    ProviderCollateral collateral;
+    ProviderNetInfo net_info;
+    CKeyID owner_key;
+    CBLSPublicKey operator_key;
+    CKeyID voting_key;
+    uint16_t operator_reward{0};
+    std::vector<ProviderPayout> payouts;
+    //! Whether payouts use the version-3 extended representation, even if there is only one.
+    bool uses_extended_payouts{false};
+    std::optional<uint160> platform_node_id;
+    std::optional<CTxDestination> fee_source;
+    bool use_legacy_bls_scheme{false};
+    bool submit{true};
+};
+
+struct ProviderUpdateServiceRequest {
+    MnType type{MnType::Regular};
+    uint256 pro_tx_hash;
+    ProviderNetInfo net_info;
+    CBLSSecretKey operator_key;
+    std::optional<uint160> platform_node_id;
+    std::optional<CTxDestination> operator_payout;
+    std::optional<CTxDestination> fee_source;
+    bool submit{true};
+};
+
+struct ProviderUpdateRegistrarRequest {
+    uint256 pro_tx_hash;
+    std::optional<CBLSPublicKey> operator_key;
+    std::optional<CKeyID> voting_key;
+    std::optional<std::vector<ProviderPayout>> payouts;
+    //! Whether payouts use the version-3 extended representation, even if there is only one.
+    bool uses_extended_payouts{false};
+    std::optional<CTxDestination> fee_source;
+    bool use_legacy_bls_scheme{false};
+    bool submit{true};
+};
+
+struct ProviderRevokeRequest {
+    uint256 pro_tx_hash;
+    CBLSSecretKey operator_key;
+    uint16_t reason{0};
+    std::optional<CTxDestination> fee_source;
+    bool submit{true};
+};
+
+} // namespace interfaces
+
+#endif // BITCOIN_INTERFACES_PROVIDERTX_H
diff --git a/src/interfaces/wallet.h b/src/interfaces/wallet.h
index 3c3ff1273f1e..283ff85eb956 100644
--- a/src/interfaces/wallet.h
+++ b/src/interfaces/wallet.h
@@ -70,6 +70,18 @@ class Loader;
 using WalletOrderForm = std::vector<std::pair<std::string, std::string>>;
 using WalletValueMap = std::map<std::string, std::string>;
 
+struct WalletTxSignResult {
+    CTransactionRef tx;
+    bool complete{false};
+    std::vector<bilingual_str> errors;
+};
+
+enum class CoinLockResult {
+    ACQUIRED,
+    ALREADY_LOCKED,
+    FAILED,
+};
+
 //! Interface for accessing a wallet.
 class Wallet
 {
@@ -184,6 +196,9 @@ class Wallet
     //! Lock coin.
     virtual bool lockCoin(const COutPoint& output, const bool write_to_db) = 0;
 
+    //! Atomically lock a coin only when it is not already locked.
+    virtual CoinLockResult acquireCoinLock(const COutPoint& output, bool write_to_db) = 0;
+
     //! Unlock coin.
     virtual bool unlockCoin(const COutPoint& output) = 0;
 
@@ -215,6 +230,14 @@ class Wallet
         int& change_pos,
         CAmount& fee) = 0;
 
+    //! Fund a transaction template using coins received at one wallet destination.
+    //! The template's version, type, payload, and required outputs are preserved.
+    virtual util::Result<CTransactionRef> fundTransaction(const CMutableTransaction& tx_template,
+                                                          const CTxDestination& fund_destination) = 0;
+
+    //! Sign every wallet-owned input of a transaction and report whether signing is complete.
+    virtual util::Result<WalletTxSignResult> signTransaction(const CMutableTransaction& tx) = 0;
+
     //! Commit transaction.
     virtual void commitTransaction(CTransactionRef tx,
         WalletValueMap value_map,
diff --git a/src/node/interfaces.cpp b/src/node/interfaces.cpp
index 4599f4db0c9c..8277dbce4b34 100644
--- a/src/node/interfaces.cpp
+++ b/src/node/interfaces.cpp
@@ -15,6 +15,7 @@
 #include <evo/chainhelper.h>
 #include <evo/creditpool.h>
 #include <evo/deterministicmns.h>
+#include <evo/providertx_service.h>
 #include <evo/specialtxman.h>
 #include <external_signer.h>
 #include <governance/governance.h>
@@ -23,11 +24,12 @@
 #include <governance/vote.h>
 #include <index/blockfilterindex.h>
 #include <init.h>
+#include <instantsend/instantsend.h>
 #include <interfaces/chain.h>
 #include <interfaces/coinjoin.h>
 #include <interfaces/handler.h>
 #include <interfaces/wallet.h>
-#include <instantsend/instantsend.h>
+#include <kernel/chain.h>
 #include <llmq/commitment.h>
 #include <llmq/context.h>
 #include <llmq/options.h>
@@ -40,7 +42,6 @@
 #include <netaddress.h>
 #include <netbase.h>
 #include <node/blockstorage.h>
-#include <kernel/chain.h>
 #include <node/coin.h>
 #include <node/context.h>
 #include <node/interface_ui.h>
@@ -99,6 +100,17 @@ using interfaces::MnEntryCPtr;
 using interfaces::MnList;
 using interfaces::MnListPtr;
 using interfaces::Node;
+using interfaces::PreparedProviderRegistration;
+using interfaces::ProviderNetInfo;
+using interfaces::ProviderRegistrationRequest;
+using interfaces::ProviderRevokeRequest;
+using interfaces::ProviderTxCapabilities;
+using interfaces::ProviderTxError;
+using interfaces::ProviderTxResult;
+using interfaces::ProviderTxSubmission;
+using interfaces::ProviderUpdateRegistrarRequest;
+using interfaces::ProviderUpdateServiceRequest;
+using interfaces::Wallet;
 using interfaces::WalletLoader;
 
 namespace node {
@@ -233,6 +245,40 @@ class EVOImpl : public EVO
         }
         return {nullptr, nullptr};
     }
+    ProviderTxCapabilities getProviderTxCapabilities() override { return evo::provider::GetCapabilities(context()); }
+    std::optional<ProviderTxError> validateProviderNetInfo(const ProviderNetInfo& net_info, MnType type,
+                                                           uint16_t version, bool optional) override
+    {
+        return evo::provider::ValidateNetInfo(net_info, type, version, optional);
+    }
+    ProviderTxResult<ProviderTxSubmission> registerMasternode(Wallet& wallet, const ProviderRegistrationRequest& request) override
+    {
+        return evo::provider::Register(context(), wallet, request);
+    }
+    ProviderTxResult<PreparedProviderRegistration> prepareMasternodeRegistration(
+        Wallet& wallet, const ProviderRegistrationRequest& request) override
+    {
+        return evo::provider::PrepareRegistration(context(), wallet, request);
+    }
+    ProviderTxResult<ProviderTxSubmission> submitMasternodeRegistration(
+        Wallet& wallet, const CTransactionRef& tx, const std::vector<unsigned char>& collateral_signature) override
+    {
+        return evo::provider::SubmitRegistration(context(), wallet, tx, collateral_signature);
+    }
+    ProviderTxResult<ProviderTxSubmission> updateMasternodeService(Wallet& wallet,
+                                                                   const ProviderUpdateServiceRequest& request) override
+    {
+        return evo::provider::UpdateService(context(), wallet, request);
+    }
+    ProviderTxResult<ProviderTxSubmission> updateMasternodeRegistrar(Wallet& wallet,
+                                                                     const ProviderUpdateRegistrarRequest& request) override
+    {
+        return evo::provider::UpdateRegistrar(context(), wallet, request);
+    }
+    ProviderTxResult<ProviderTxSubmission> revokeMasternode(Wallet& wallet, const ProviderRevokeRequest& request) override
+    {
+        return evo::provider::Revoke(context(), wallet, request);
+    }
     void setContext(NodeContext* context) override
     {
         m_context = context;
diff --git a/src/rpc/evo.cpp b/src/rpc/evo.cpp
index 6e61e43b8929..63a3cbb16850 100644
--- a/src/rpc/evo.cpp
+++ b/src/rpc/evo.cpp
@@ -11,14 +11,16 @@
 #include <evo/deterministicmns.h>
 #include <evo/dmn_types.h>
 #include <evo/providertx.h>
+#include <evo/providertx_service.h>
 #include <evo/smldiff.h>
 #include <evo/specialtx.h>
 #include <evo/specialtxman.h>
 #include <index/txindex.h>
+#include <interfaces/wallet.h>
 #include <llmq/context.h>
 #include <masternode/meta.h>
 #include <node/context.h>
-#include <rpc/evo_util.h>
+#include <node/transaction.h>
 #include <rpc/server.h>
 #include <rpc/server_util.h>
 #include <rpc/util.h>
@@ -31,17 +33,10 @@
 #include <limits>
 
 #ifdef ENABLE_WALLET
-#include <wallet/coincontrol.h>
-#include <wallet/spend.h>
 #include <wallet/wallet.h>
 #endif // ENABLE_WALLET
 
-#ifdef ENABLE_WALLET
-extern RPCHelpMan sendrawtransaction();
-namespace wallet {
-extern RPCHelpMan signrawtransactionwithwallet();
-} // namespace wallet
-#else
+#ifndef ENABLE_WALLET
 namespace wallet {
 class CWallet;
 } // namespace wallet
@@ -51,13 +46,10 @@ using node::GetTransaction;
 using node::NodeContext;
 using wallet::CWallet;
 #ifdef ENABLE_WALLET
-using wallet::CCoinControl;
-using wallet::CRecipient;
 using wallet::DEFAULT_DISABLE_WALLET;
 using wallet::GetWalletForJSONRPCRequest;
 using wallet::HELP_REQUIRING_PASSPHRASE;
 using wallet::isminetype;
-using wallet::RANDOM_CHANGE_POSITION;
 #endif // ENABLE_WALLET
 
 static RPCArg GetRpcArg(const std::string& strParamName)
@@ -292,9 +284,9 @@ static CBLSPublicKey ParseBLSPubKey(const std::string& hexKey, const std::string
     return pubKey;
 }
 
-static MasternodePayoutShares ParsePayouts(const UniValue& value, const std::string& paramName, CTxDestination& first_dest)
+static std::vector<interfaces::ProviderPayout> ParsePayouts(const UniValue& value, const std::string& paramName)
 {
-    MasternodePayoutShares payouts;
+    std::vector<interfaces::ProviderPayout> payouts;
     if (value.isArray()) {
         const auto& arr = value.get_array();
         if (arr.empty()) {
@@ -317,164 +309,128 @@ static MasternodePayoutShares ParsePayouts(const UniValue& value, const std::str
             if (!IsValidDestination(dest)) {
                 throw JSONRPCError(RPC_INVALID_ADDRESS_OR_KEY, strprintf("invalid payout address: %s", address_value.get_str()));
             }
-            if (payouts.empty()) {
-                first_dest = dest;
-            }
             const int64_t reward = reward_value.getInt<int64_t>();
             if (reward < 0 || reward > std::numeric_limits<uint16_t>::max()) {
                 throw JSONRPCError(RPC_INVALID_PARAMETER, "payout reward out of range");
             }
-            payouts.emplace_back(GetScriptForDestination(dest), static_cast<uint16_t>(reward));
+            payouts.push_back({dest, static_cast<uint16_t>(reward)});
         }
     } else {
-        first_dest = DecodeDestination(value.get_str());
-        if (!IsValidDestination(first_dest)) {
+        CTxDestination destination{DecodeDestination(value.get_str())};
+        if (!IsValidDestination(destination)) {
             throw JSONRPCError(RPC_INVALID_ADDRESS_OR_KEY, strprintf("invalid payout address: %s", value.get_str()));
         }
-        payouts.emplace_back(GetScriptForDestination(first_dest), MasternodePayoutShare::MAX_REWARD);
+        payouts.push_back({destination, MasternodePayoutShare::MAX_REWARD});
     }
     return payouts;
 }
 
-template <typename SpecialTxPayload>
-static void FundSpecialTx(CWallet& wallet, CMutableTransaction& tx, const SpecialTxPayload& payload,
-                          const CTxDestination& fundDest) EXCLUSIVE_LOCKS_REQUIRED(!wallet.cs_wallet)
+static std::unique_ptr<interfaces::Wallet> MakeWalletInterface(const NodeContext& node,
+                                                               const std::shared_ptr<CWallet>& wallet)
 {
-    // Make sure the results are valid at least up to the most recent block
-    // the user could have gotten from another RPC command prior to now
-    wallet.BlockUntilSyncedToCurrentChain();
-
-    LOCK(wallet.cs_wallet);
-
-    CTxDestination nodest = CNoDestination();
-    if (fundDest == nodest) {
-        throw JSONRPCError(RPC_INTERNAL_ERROR, "No source of funds specified");
-    }
-
-    CDataStream ds(SER_NETWORK, PROTOCOL_VERSION);
-    ds << payload;
-    tx.vExtraPayload.assign(UCharCast(ds.data()), UCharCast(ds.data() + ds.size()));
-
-    static const CTxOut dummyTxOut(0, CScript() << OP_RETURN);
-    std::vector<CRecipient> vecSend;
-    bool dummyTxOutAdded = false;
-
-    if (tx.vout.empty()) {
-        // add dummy txout as CreateTransaction requires at least one recipient
-        tx.vout.emplace_back(dummyTxOut);
-        dummyTxOutAdded = true;
-    }
-
-    for (const auto& txOut : tx.vout) {
-        CRecipient recipient = {txOut.scriptPubKey, txOut.nValue, false};
-        vecSend.push_back(recipient);
-    }
-
-    CCoinControl coinControl;
-    coinControl.destChange = fundDest;
-    coinControl.fRequireAllInputs = false;
-
-    for (const auto& out : AvailableCoinsListUnspent(wallet).all()) {
-        CTxDestination txDest;
-        if (ExtractDestination(out.txout.scriptPubKey, txDest) && txDest == fundDest) {
-            coinControl.Select(out.outpoint);
-        }
-    }
-
-    if (!coinControl.HasSelected()) {
-        throw JSONRPCError(RPC_INTERNAL_ERROR, strprintf("No funds at specified address %s", EncodeDestination(fundDest)));
-    }
-
-    auto res = CreateTransaction(wallet, vecSend, RANDOM_CHANGE_POSITION, coinControl, /*sign=*/true, tx.vExtraPayload.size());
-    if (!res) {
-        throw JSONRPCError(RPC_INTERNAL_ERROR, util::ErrorString(res).original);
-    }
-
-    const CTransactionRef& newTx = res->tx;
-    tx.vin = newTx->vin;
-    tx.vout = newTx->vout;
-
-    if (dummyTxOutAdded && tx.vout.size() > 1) {
-        // CreateTransaction added a change output, so we don't need the dummy txout anymore.
-        // Removing it results in slight overpayment of fees, but we ignore this for now (as it's a very low amount).
-        auto it = std::find(tx.vout.begin(), tx.vout.end(), dummyTxOut);
-        CHECK_NONFATAL(it != tx.vout.end());
-        tx.vout.erase(it);
-    }
+    auto* wallet_loader{CHECK_NONFATAL(node.wallet_loader)};
+    return interfaces::MakeWallet(*CHECK_NONFATAL(wallet_loader->context()), wallet);
 }
 
-template<typename SpecialTxPayload>
-static void UpdateSpecialTxInputsHash(const CMutableTransaction& tx, SpecialTxPayload& payload)
-{
-    payload.inputsHash = CalcTxInputsHash(CTransaction(tx));
-}
-
-template<typename SpecialTxPayload>
-static void SignSpecialTxPayloadByHash(const CMutableTransaction& tx, SpecialTxPayload& payload, const CKeyID& keyID, const CWallet& wallet)
-{
-    UpdateSpecialTxInputsHash(tx, payload);
-    payload.vchSig.clear();
-
-    const uint256 hash = ::SerializeHash(payload);
-    if (!wallet.SignSpecialTxPayload(hash, keyID, payload.vchSig)) {
-        throw JSONRPCError(RPC_INTERNAL_ERROR, "failed to sign special tx");
-    }
+[[noreturn]] static void ThrowProviderTxError(const interfaces::ProviderTxError& provider_error)
+{
+    using interfaces::ProviderTxErrorCode;
+    switch (provider_error.code) {
+    case ProviderTxErrorCode::INVALID_PARAMETER:
+        throw JSONRPCError(RPC_INVALID_PARAMETER, provider_error.message.original);
+    case ProviderTxErrorCode::INVALID_ADDRESS_OR_KEY:
+        throw JSONRPCError(RPC_INVALID_ADDRESS_OR_KEY, provider_error.message.original);
+    case ProviderTxErrorCode::FUNDING_ERROR:
+        // Preserve the historical protx RPC error code while exposing a useful typed category.
+        throw JSONRPCError(RPC_INTERNAL_ERROR, provider_error.message.original);
+    case ProviderTxErrorCode::WALLET_ERROR:
+        throw JSONRPCError(RPC_WALLET_ERROR, provider_error.message.original);
+    case ProviderTxErrorCode::WALLET_UNLOCK_NEEDED:
+        throw JSONRPCError(RPC_WALLET_UNLOCK_NEEDED, provider_error.message.original);
+    case ProviderTxErrorCode::INTERNAL_ERROR:
+        throw JSONRPCError(RPC_INTERNAL_ERROR, provider_error.message.original);
+    case ProviderTxErrorCode::VERIFY_ERROR:
+        throw JSONRPCError(RPC_VERIFY_ERROR, provider_error.message.original);
+    case ProviderTxErrorCode::CONSENSUS_REJECTED:
+        throw std::runtime_error(provider_error.message.original);
+    case ProviderTxErrorCode::BROADCAST_ERROR:
+        throw JSONRPCTransactionError(*CHECK_NONFATAL(provider_error.transaction_error), provider_error.message.original);
+    }
+    assert(false);
 }
 
-template <typename SpecialTxPayload>
-static void SignSpecialTxPayloadByHash(const CMutableTransaction& tx, SpecialTxPayload& payload,
-                                       const CBLSSecretKey& key, bool use_legacy)
+static std::string SubmissionToString(const interfaces::ProviderTxSubmission& submission)
 {
-    UpdateSpecialTxInputsHash(tx, payload);
-
-    uint256 hash = ::SerializeHash(payload);
-    payload.sig = key.Sign(hash, use_legacy);
+    return submission.submitted ? submission.tx->GetHash().GetHex() : EncodeHexTx(*submission.tx);
 }
 
-static std::string SignAndSendSpecialTx(const JSONRPCRequest& request, CChainstateHelper& chain_helper, const ChainstateManager& chainman, const CMutableTransaction& tx, bool fSubmit)
+static std::vector<std::string> ParseCoreNetInfo(const UniValue& input, bool optional)
 {
-    {
-    LOCK(::cs_main);
-
-    const CBlockIndex* tip{chainman.ActiveChain().Tip()};
-    const Consensus::Params& consensus_params{chainman.GetConsensus()};
-    if (!DeploymentActiveAfter(tip, consensus_params, Consensus::DEPLOYMENT_DIP0003)) {
-        const int current_height{tip ? tip->nHeight : -1};
-        const int next_block_height{current_height + 1};
-        const int activation_height{consensus_params.DIP0003Height};
-        const int blocks_to_mine{
-            activation_height > next_block_height ? activation_height - next_block_height : 0
-        };
-        throw JSONRPCError(RPC_VERIFY_ERROR, strprintf(
-            "DIP0003 is not active yet; ProTx transactions are valid starting at block height %d "
-            "(current chain height %d, next block height %d). Mine %d more block%s or restart "
-            "this regtest/devnet chain with DIP3 activation parameters that are already active.",
-            activation_height, current_height, next_block_height, blocks_to_mine,
-            blocks_to_mine == 1 ? "" : "s"));
+    if (input.isStr()) {
+        if (input.get_str().empty()) {
+            if (!optional) {
+                throw JSONRPCError(RPC_INVALID_PARAMETER, "Invalid param for coreP2PAddrs[0], cannot be empty");
+            }
+            return {};
+        }
+        return {input.get_str()};
     }
-
-    TxValidationState state;
-    if (!chain_helper.special_tx->CheckSpecialTx(CTransaction(tx), tip, chainman.ActiveChainstate().CoinsTip(), true, state)) {
-        throw std::runtime_error(state.ToString());
+    if (!input.isArray()) {
+        throw JSONRPCError(RPC_INVALID_PARAMETER, "Invalid param for coreP2PAddrs, must be string or array");
     }
-    } // cs_main
-
-    CDataStream ds(SER_NETWORK, PROTOCOL_VERSION);
-    ds << tx;
-
-    JSONRPCRequest signRequest(request);
-    signRequest.params.setArray();
-    signRequest.params.push_back(HexStr(ds));
-    UniValue signResult = wallet::signrawtransactionwithwallet().HandleRequest(signRequest);
-
-    if (!fSubmit) {
-        return signResult["hex"].get_str();
+    const auto& entries{input.get_array()};
+    if (!optional && entries.empty()) {
+        throw JSONRPCError(RPC_INVALID_PARAMETER, "Invalid param for coreP2PAddrs, cannot be empty");
     }
+    std::vector<std::string> result;
+    result.reserve(entries.size());
+    for (size_t index{0}; index < entries.size(); ++index) {
+        if (!entries[index].isStr()) {
+            throw JSONRPCError(RPC_INVALID_PARAMETER,
+                               strprintf("Invalid param for coreP2PAddrs[%zu], must be string", index));
+        }
+        result.push_back(entries[index].get_str());
+    }
+    return result;
+}
 
-    JSONRPCRequest sendRequest(request);
-    sendRequest.params.setArray();
-    sendRequest.params.push_back(signResult["hex"].get_str());
-    return ::sendrawtransaction().HandleRequest(sendRequest).get_str();
+static interfaces::ProviderPlatformEndpoints ParsePlatformNetInfo(const UniValue& input, std::string_view field_name,
+                                                                  bool extended_addresses)
+{
+    if (!input.isArray() && !input.isNum() && !input.isStr()) {
+        throw JSONRPCError(RPC_INVALID_PARAMETER,
+                           strprintf("Invalid param for %s, must be array, number or string", field_name));
+    }
+    if (input.isArray()) {
+        std::vector<std::string> result;
+        const auto& entries{input.get_array()};
+        if (!entries.empty() && !extended_addresses) {
+            throw JSONRPCError(RPC_INVALID_PARAMETER,
+                               strprintf("Invalid param for %s, this ProTx version only accepts a bare port number; "
+                                         "the "
+                                         "\"ADDR:PORT\" / address-array form requires upgrading to a version 3 ProTx",
+                                         field_name));
+        }
+        result.reserve(entries.size());
+        for (size_t index{0}; index < entries.size(); ++index) {
+            if (!entries[index].isStr() || entries[index].get_str().find_first_not_of("0123456789") == std::string::npos) {
+                throw JSONRPCError(RPC_INVALID_PARAMETER,
+                                   strprintf("Invalid param for %s[%zu], must be string", field_name, index));
+            }
+            result.push_back(entries[index].get_str());
+        }
+        return result;
+    }
+    const std::string value{input.getValStr()};
+    if (value.empty()) return std::monostate{};
+    int32_t port{0};
+    if (ParseInt32(value, &port) && port >= 1 && port <= std::numeric_limits<uint16_t>::max()) {
+        return static_cast<uint16_t>(port);
+    }
+    if (input.isStr() && value.find_first_not_of("0123456789") != std::string::npos)
+        return std::vector<std::string>{value};
+    throw JSONRPCError(RPC_INVALID_PARAMETER,
+                       strprintf("Invalid param for %s, must be a valid port [1-65535]", field_name));
 }
 
 // forward declaration
@@ -772,65 +728,42 @@ static UniValue protx_register_common_wrapper(const JSONRPCRequest& request,
                                               const ProTxRegisterAction action,
                                               const MnType mnType)
 {
-    const NodeContext& node = EnsureAnyNodeContext(request.context);
-    const ChainstateManager& chainman = EnsureChainman(node);
-
-    CChainstateHelper& chain_helper = *CHECK_NONFATAL(node.chain_helper);
-
-    const bool isEvoRequested = mnType == MnType::Evo;
-
-    std::shared_ptr<CWallet> const pwallet = GetWalletForJSONRPCRequest(request);
+    NodeContext& node{EnsureAnyNodeContext(request.context)};
+    std::shared_ptr<CWallet> const pwallet{GetWalletForJSONRPCRequest(request)};
     if (!pwallet) return UniValue::VNULL;
-
     EnsureWalletIsUnlocked(*pwallet);
 
-    size_t paramIdx = 0;
-
-    CMutableTransaction tx;
-    tx.nVersion = 3;
-    tx.nType = TRANSACTION_PROVIDER_REGISTER;
-
-    const bool use_legacy = specific_legacy_bls_scheme;
-
-    CProRegTx ptx;
-    ptx.nType = mnType;
-    ptx.nVersion = DeploymentToProtxVersion(WITH_LOCK(::cs_main, return chainman.ActiveChain().Tip()), chainman,
-                                            /*is_basic_override=*/!use_legacy);
-    ptx.netInfo = NetInfoInterface::MakeNetInfo(ptx.nVersion);
-
+    interfaces::ProviderRegistrationRequest typed_request;
+    typed_request.type = mnType;
+    typed_request.use_legacy_bls_scheme = specific_legacy_bls_scheme;
+    size_t paramIdx{0};
     if (action == ProTxRegisterAction::Fund) {
-        CTxDestination collateralDest = DecodeDestination(request.params[paramIdx].get_str());
-        if (!IsValidDestination(collateralDest)) {
-            throw JSONRPCError(RPC_INVALID_ADDRESS_OR_KEY, strprintf("invalid collaterall address: %s", request.params[paramIdx].get_str()));
+        CTxDestination collateral_destination{DecodeDestination(request.params[paramIdx].get_str())};
+        if (!IsValidDestination(collateral_destination)) {
+            throw JSONRPCError(RPC_INVALID_ADDRESS_OR_KEY,
+                               strprintf("invalid collaterall address: %s", request.params[paramIdx].get_str()));
         }
-        CScript collateralScript = GetScriptForDestination(collateralDest);
-
-        CAmount fundCollateral = GetMnType(mnType).collat_amount;
-        CTxOut collateralTxOut(fundCollateral, collateralScript);
-        tx.vout.emplace_back(collateralTxOut);
-
+        typed_request.collateral = interfaces::FundProviderCollateral{collateral_destination};
         paramIdx++;
     } else {
-        uint256 collateralHash(ParseHashV(request.params[paramIdx], "collateralHash"));
-        int32_t collateralIndex = request.params[paramIdx + 1].getInt<int>();
-        if (collateralHash.IsNull() || collateralIndex < 0) {
-            throw JSONRPCError(RPC_INVALID_ADDRESS_OR_KEY, strprintf("invalid hash or index: %s-%d", collateralHash.ToString(), collateralIndex));
+        const uint256 collateral_hash{ParseHashV(request.params[paramIdx], "collateralHash")};
+        const int32_t collateral_index{request.params[paramIdx + 1].getInt<int>()};
+        if (collateral_hash.IsNull() || collateral_index < 0) {
+            throw JSONRPCError(RPC_INVALID_ADDRESS_OR_KEY,
+                               strprintf("invalid hash or index: %s-%d", collateral_hash.ToString(), collateral_index));
         }
-
-        ptx.collateralOutpoint = COutPoint(collateralHash, (uint32_t)collateralIndex);
+        typed_request.collateral = interfaces::ExistingProviderCollateral{
+            COutPoint{collateral_hash, static_cast<uint32_t>(collateral_index)}};
         paramIdx += 2;
     }
 
-    ProcessNetInfoCore(ptx, request.params[paramIdx], /*optional=*/true);
-
-    ptx.keyIDOwner = ParsePubKeyIDFromAddress(request.params[paramIdx + 1].get_str(), "owner address");
-    ptx.pubKeyOperator.Set(ParseBLSPubKey(request.params[paramIdx + 2].get_str(), "operator BLS address", use_legacy), use_legacy);
-    CHECK_NONFATAL(ptx.pubKeyOperator.IsLegacy() == (ptx.nVersion == ProTxVersion::LegacyBLS));
-
-    CKeyID keyIDVoting = ptx.keyIDOwner;
-
+    typed_request.net_info.core_p2p = ParseCoreNetInfo(request.params[paramIdx], /*optional=*/true);
+    typed_request.owner_key = ParsePubKeyIDFromAddress(request.params[paramIdx + 1].get_str(), "owner address");
+    typed_request.operator_key = ParseBLSPubKey(request.params[paramIdx + 2].get_str(), "operator BLS address",
+                                                specific_legacy_bls_scheme);
+    typed_request.voting_key = typed_request.owner_key;
     if (!request.params[paramIdx + 3].get_str().empty()) {
-        keyIDVoting = ParsePubKeyIDFromAddress(request.params[paramIdx + 3].get_str(), "voting address");
+        typed_request.voting_key = ParsePubKeyIDFromAddress(request.params[paramIdx + 3].get_str(), "voting address");
     }
 
     int64_t operatorReward;
@@ -840,179 +773,93 @@ static UniValue protx_register_common_wrapper(const JSONRPCRequest& request,
     if (operatorReward < 0 || operatorReward > 10000) {
         throw JSONRPCError(RPC_INVALID_PARAMETER, "operatorReward must be between 0 and 10000");
     }
-    ptx.nOperatorReward = operatorReward;
-
-    CTxDestination payoutDest;
-    if (request.params[paramIdx + 5].isArray() && ptx.nVersion < ProTxVersion::ExtAddr) {
+    typed_request.operator_reward = static_cast<uint16_t>(operatorReward);
+    const auto capabilities{evo::provider::GetCapabilities(node, /*basic_override=*/!specific_legacy_bls_scheme)};
+    typed_request.uses_extended_payouts = request.params[paramIdx + 5].isArray();
+    if (typed_request.uses_extended_payouts && !capabilities.extended_addresses) {
         throw JSONRPCError(RPC_INVALID_PARAMETER, "payouts array requires provider transaction version 3");
     }
-    ptx.payouts = ParsePayouts(request.params[paramIdx + 5], "payouts", payoutDest);
+    typed_request.payouts = ParsePayouts(request.params[paramIdx + 5], "payouts");
 
-    if (isEvoRequested) {
+    if (mnType == MnType::Evo) {
         if (!IsHex(request.params[paramIdx + 6].get_str())) {
             throw JSONRPCError(RPC_INVALID_PARAMETER, "platformNodeID must be hexadecimal string");
         }
-        ptx.platformNodeID.SetHex(request.params[paramIdx + 6].get_str());
-
-        ProcessNetInfoPlatform(ptx, request.params[paramIdx + 7], request.params[paramIdx + 8], /*optional=*/true);
-
+        uint160 platform_node_id;
+        platform_node_id.SetHex(request.params[paramIdx + 6].get_str());
+        typed_request.platform_node_id = platform_node_id;
+        typed_request.net_info.platform_p2p = ParsePlatformNetInfo(request.params[paramIdx + 7], "platformP2PAddrs",
+                                                                   capabilities.extended_addresses);
+        typed_request.net_info.platform_https = ParsePlatformNetInfo(request.params[paramIdx + 8], "platformHTTPSAddrs",
+                                                                     capabilities.extended_addresses);
         paramIdx += 3;
     }
 
-    ptx.keyIDVoting = keyIDVoting;
-    ptx.scriptPayout = ptx.payouts.front().scriptPayout;
-
-    if (action != ProTxRegisterAction::Fund) {
-        // make sure fee calculation works
-        ptx.vchSig.resize(65);
-    }
-
-    CTxDestination fundDest = payoutDest;
     if (!request.params[paramIdx + 6].isNull()) {
-        fundDest = DecodeDestination(request.params[paramIdx + 6].get_str());
-        if (!IsValidDestination(fundDest))
-            throw JSONRPCError(RPC_INVALID_ADDRESS_OR_KEY, std::string("Invalid Dash address: ") + request.params[paramIdx + 6].get_str());
-    }
-
-    bool fSubmit{true};
-    if ((action == ProTxRegisterAction::External || action == ProTxRegisterAction::Fund) && !request.params[paramIdx + 7].isNull()) {
-        fSubmit = ParseBoolV(request.params[paramIdx + 7], "submit");
-    }
-
-    if (action == ProTxRegisterAction::Fund) {
-        FundSpecialTx(*pwallet, tx, ptx, fundDest);
-        UpdateSpecialTxInputsHash(tx, ptx);
-        CAmount fundCollateral = GetMnType(mnType).collat_amount;
-        uint32_t collateralIndex = (uint32_t) -1;
-        for (uint32_t i = 0; i < tx.vout.size(); i++) {
-            if (tx.vout[i].nValue == fundCollateral) {
-                collateralIndex = i;
-                break;
-            }
-        }
-        CHECK_NONFATAL(collateralIndex != (uint32_t) -1);
-        ptx.collateralOutpoint.n = collateralIndex;
-
-        SetTxPayload(tx, ptx);
-        return SignAndSendSpecialTx(request, chain_helper, chainman, tx, fSubmit);
-    } else {
-        // referencing external collateral
-
-        const bool unlockOnError = [&]() {
-            if (LOCK(pwallet->cs_wallet); !pwallet->IsLockedCoin(ptx.collateralOutpoint)) {
-                pwallet->LockCoin(ptx.collateralOutpoint);
-                return true;
-            }
-            return false;
-        }();
-        try {
-            FundSpecialTx(*pwallet, tx, ptx, fundDest);
-            UpdateSpecialTxInputsHash(tx, ptx);
-            Coin coin;
-            if (!GetUTXOCoin(chainman.ActiveChainstate(), ptx.collateralOutpoint, coin)) {
-                throw JSONRPCError(RPC_INVALID_ADDRESS_OR_KEY, strprintf("collateral not found: %s", ptx.collateralOutpoint.ToStringShort()));
-            }
-            CTxDestination txDest;
-            ExtractDestination(coin.out.scriptPubKey, txDest);
-            const PKHash* pkhash = std::get_if<PKHash>(&txDest);
-            if (!pkhash) {
-                throw JSONRPCError(RPC_INVALID_ADDRESS_OR_KEY, strprintf("collateral type not supported: %s", ptx.collateralOutpoint.ToStringShort()));
-            }
-
-            if (action == ProTxRegisterAction::Prepare) {
-                // external signing with collateral key
-                ptx.vchSig.clear();
-                SetTxPayload(tx, ptx);
-
-                UniValue ret(UniValue::VOBJ);
-                ret.pushKV("tx", EncodeHexTx(CTransaction(tx)));
-                ret.pushKV("collateralAddress", EncodeDestination(txDest));
-                ret.pushKV("signMessage", ptx.MakeSignString());
-                return ret;
-            } else {
-                {
-                    LOCK(pwallet->cs_wallet);
-                    // lets prove we own the collateral
-                    CScript scriptPubKey = GetScriptForDestination(txDest);
-
-                    std::string signed_payload;
-                    SigningResult err = pwallet->SignMessage(ptx.MakeSignString(), *pkhash, signed_payload);
-                    if (err == SigningResult::SIGNING_FAILED) {
-                        throw JSONRPCError(RPC_INVALID_ADDRESS_OR_KEY, SigningResultString(err));
-                    } else if (err != SigningResult::OK){
-                        throw JSONRPCError(RPC_WALLET_ERROR, SigningResultString(err));
-                    }
-                    auto opt_vchSig = DecodeBase64(signed_payload);
-                    if (!opt_vchSig.has_value()) throw JSONRPCError(RPC_INTERNAL_ERROR, "failed to decode base64 ready signature for protx");
-                    ptx.vchSig = opt_vchSig.value();
-                } // cs_wallet
-                SetTxPayload(tx, ptx);
-                return SignAndSendSpecialTx(request, chain_helper, chainman, tx, fSubmit);
-            }
-        } catch (...) {
-            if (unlockOnError) {
-                WITH_LOCK(pwallet->cs_wallet, pwallet->UnlockCoin(ptx.collateralOutpoint));
-            }
-            throw;
+        CTxDestination fund_destination{DecodeDestination(request.params[paramIdx + 6].get_str())};
+        if (!IsValidDestination(fund_destination)) {
+            throw JSONRPCError(RPC_INVALID_ADDRESS_OR_KEY,
+                               std::string("Invalid Dash address: ") + request.params[paramIdx + 6].get_str());
         }
-    }
+        typed_request.fee_source = fund_destination;
+    }
+    if ((action == ProTxRegisterAction::External || action == ProTxRegisterAction::Fund) &&
+        !request.params[paramIdx + 7].isNull()) {
+        typed_request.submit = ParseBoolV(request.params[paramIdx + 7], "submit");
+    }
+
+    auto wallet_interface{MakeWalletInterface(node, pwallet)};
+    if (action == ProTxRegisterAction::Prepare) {
+        auto result{evo::provider::PrepareRegistration(node, *wallet_interface, typed_request)};
+        if (const auto* error{std::get_if<interfaces::ProviderTxError>(&result)}) ThrowProviderTxError(*error);
+        const auto& prepared{std::get<interfaces::PreparedProviderRegistration>(result)};
+        UniValue response{UniValue::VOBJ};
+        response.pushKV("tx", EncodeHexTx(*prepared.tx));
+        response.pushKV("collateralAddress", EncodeDestination(prepared.collateral_address));
+        response.pushKV("signMessage", prepared.sign_message);
+        return response;
+    }
+    auto result{evo::provider::Register(node, *wallet_interface, typed_request)};
+    if (const auto* error{std::get_if<interfaces::ProviderTxError>(&result)}) ThrowProviderTxError(*error);
+    return SubmissionToString(std::get<interfaces::ProviderTxSubmission>(result));
 }
 
 static RPCHelpMan protx_register_submit()
 {
-    return RPCHelpMan{"protx register_submit",
+    return RPCHelpMan{
+        "protx register_submit",
         "\nCombines the unsigned ProTx and a signature of the signMessage, signs all inputs\n"
         "which were added to cover fees and submits the resulting transaction to the network.\n"
-        "Note: See \"help protx register_prepare\" for more info about creating a ProTx and a message to sign.\n"
-        + HELP_REQUIRING_PASSPHRASE,
+        "Note: See \"help protx register_prepare\" for more info about creating a ProTx and a message to sign.\n" +
+            HELP_REQUIRING_PASSPHRASE,
         {
             {"tx", RPCArg::Type::STR_HEX, RPCArg::Optional::NO, "The serialized unsigned ProTx in hex format."},
-            {"sig", RPCArg::Type::STR, RPCArg::Optional::NO, "The signature signed with the collateral key. Must be in base64 format."},
-        },
-        RPCResult{
-            RPCResult::Type::STR_HEX, "txid", "The transaction id"
-        },
-        RPCExamples{
-            HelpExampleCli("protx", "register_submit \"tx\" \"sig\"")
+            {"sig", RPCArg::Type::STR, RPCArg::Optional::NO,
+             "The signature signed with the collateral key. Must be in base64 format."},
         },
-        [&](const RPCHelpMan& self, const JSONRPCRequest& request) -> UniValue
-{
-    const NodeContext& node = EnsureAnyNodeContext(request.context);
-    const ChainstateManager& chainman = EnsureChainman(node);
-
-    CChainstateHelper& chain_helper = *CHECK_NONFATAL(node.chain_helper);
-
-    const std::shared_ptr<const CWallet> wallet = GetWalletForJSONRPCRequest(request);
-    if (!wallet) return UniValue::VNULL;
-
-    EnsureWalletIsUnlocked(*wallet);
-
-    CMutableTransaction tx;
-    if (!DecodeHexTx(tx, request.params[0].get_str())) {
-        throw JSONRPCError(RPC_INVALID_PARAMETER, "transaction not deserializable");
-    }
-    if (tx.nType != TRANSACTION_PROVIDER_REGISTER) {
-        throw JSONRPCError(RPC_INVALID_PARAMETER, "transaction not a ProRegTx");
-    }
-    auto ptx = [&tx]() {
-        if (const auto opt_ptx = GetTxPayload<CProRegTx>(tx); opt_ptx.has_value()) {
-            return *opt_ptx;
-        }
-        throw JSONRPCError(RPC_INVALID_PARAMETER, "transaction payload not deserializable");
-    }();
-    if (!ptx.vchSig.empty()) {
-        throw JSONRPCError(RPC_INVALID_PARAMETER, "payload signature not empty");
-    }
-
-    auto opt_vchSig= DecodeBase64(request.params[1].get_str());
-    if (!opt_vchSig.has_value()) {
-        throw JSONRPCError(RPC_INVALID_PARAMETER, "malformed base64 encoding");
-    }
-    ptx.vchSig = opt_vchSig.value();
+        RPCResult{RPCResult::Type::STR_HEX, "txid", "The transaction id"},
+        RPCExamples{HelpExampleCli("protx", "register_submit \"tx\" \"sig\"")},
+        [&](const RPCHelpMan& self, const JSONRPCRequest& request) -> UniValue {
+            NodeContext& node{EnsureAnyNodeContext(request.context)};
+            const std::shared_ptr<CWallet> wallet{GetWalletForJSONRPCRequest(request)};
+            if (!wallet) return UniValue::VNULL;
+            EnsureWalletIsUnlocked(*wallet);
+
+            CMutableTransaction tx;
+            if (!DecodeHexTx(tx, request.params[0].get_str())) {
+                throw JSONRPCError(RPC_INVALID_PARAMETER, "transaction not deserializable");
+            }
+            auto opt_vchSig{DecodeBase64(request.params[1].get_str())};
+            if (!opt_vchSig.has_value()) {
+                throw JSONRPCError(RPC_INVALID_PARAMETER, "malformed base64 encoding");
+            }
 
-    SetTxPayload(tx, ptx);
-    return SignAndSendSpecialTx(request, chain_helper, chainman, tx, /*fSubmit=*/true);
-},
+            auto wallet_interface{MakeWalletInterface(node, wallet)};
+            auto result{evo::provider::SubmitRegistration(node, *wallet_interface, MakeTransactionRef(std::move(tx)),
+                                                          *opt_vchSig)};
+            if (const auto* error{std::get_if<interfaces::ProviderTxError>(&result)}) ThrowProviderTxError(*error);
+            return SubmissionToString(std::get<interfaces::ProviderTxSubmission>(result));
+        },
     };
 }
 
@@ -1084,102 +931,57 @@ static RPCHelpMan protx_update_service_evo()
 
 static UniValue protx_update_service_common_wrapper(const JSONRPCRequest& request, const MnType mnType)
 {
-    const NodeContext& node = EnsureAnyNodeContext(request.context);
-    const ChainstateManager& chainman = EnsureChainman(node);
-
-    CDeterministicMNManager& dmnman = *CHECK_NONFATAL(node.dmnman);
-    CChainstateHelper& chain_helper = *CHECK_NONFATAL(node.chain_helper);
-
-    const bool isEvoRequested = mnType == MnType::Evo;
-    std::shared_ptr<CWallet> const wallet = GetWalletForJSONRPCRequest(request);
+    NodeContext& node{EnsureAnyNodeContext(request.context)};
+    std::shared_ptr<CWallet> const wallet{GetWalletForJSONRPCRequest(request)};
     if (!wallet) return UniValue::VNULL;
-
     EnsureWalletIsUnlocked(*wallet);
 
-    CProUpServTx ptx;
-    ptx.proTxHash = ParseHashV(request.params[0], "proTxHash");
-    auto dmn = dmnman.GetListAtChainTip().GetMN(ptx.proTxHash);
-    if (!dmn) {
-        throw std::runtime_error(strprintf("masternode with proTxHash %s not found", ptx.proTxHash.ToString()));
-    }
-
-    ptx.nType = mnType;
-    if (dmn->nType != mnType) {
-        throw std::runtime_error(strprintf("masternode with proTxHash %s is not a %s", ptx.proTxHash.ToString(), GetMnType(mnType).description));
-    }
-
-    ptx.nVersion = DeploymentToProtxVersion(WITH_LOCK(::cs_main, return chainman.ActiveChain().Tip()), chainman);
-
-    ptx.netInfo = NetInfoInterface::MakeNetInfo(ptx.nVersion);
-
-    ProcessNetInfoCore(ptx, request.params[1], /*optional=*/false);
-
-    CBLSSecretKey keyOperator = ParseBLSSecretKey(request.params[2].get_str(), "operatorKey");
+    interfaces::ProviderUpdateServiceRequest typed_request;
+    typed_request.type = mnType;
+    typed_request.pro_tx_hash = ParseHashV(request.params[0], "proTxHash");
+    typed_request.net_info.core_p2p = ParseCoreNetInfo(request.params[1], /*optional=*/false);
+    typed_request.operator_key = ParseBLSSecretKey(request.params[2].get_str(), "operatorKey");
 
-    size_t paramIdx = 3;
-    if (isEvoRequested) {
+    size_t paramIdx{3};
+    if (mnType == MnType::Evo) {
+        const auto capabilities{evo::provider::GetCapabilities(node)};
         if (!IsHex(request.params[paramIdx].get_str())) {
             throw JSONRPCError(RPC_INVALID_PARAMETER, "platformNodeID must be hexadecimal string");
         }
-        ptx.platformNodeID.SetHex(request.params[paramIdx].get_str());
-
-        ProcessNetInfoPlatform(ptx, request.params[paramIdx + 1], request.params[paramIdx + 2], /*optional=*/false);
-
+        uint160 platform_node_id;
+        platform_node_id.SetHex(request.params[paramIdx].get_str());
+        typed_request.platform_node_id = platform_node_id;
+        typed_request.net_info.platform_p2p = ParsePlatformNetInfo(request.params[paramIdx + 1], "platformP2PAddrs",
+                                                                   capabilities.extended_addresses);
+        typed_request.net_info.platform_https = ParsePlatformNetInfo(request.params[paramIdx + 2], "platformHTTPSAddrs",
+                                                                     capabilities.extended_addresses);
         paramIdx += 3;
     }
 
-    if (keyOperator.GetPublicKey() != dmn->pdmnState->pubKeyOperator.Get()) {
-        throw JSONRPCError(RPC_INVALID_PARAMETER, strprintf("the operator key does not belong to the registered public key"));
-    }
-
-    CMutableTransaction tx;
-    tx.nVersion = 3;
-    tx.nType = TRANSACTION_PROVIDER_UPDATE_SERVICE;
-
-    // param operatorPayoutAddress
-    if (!request.params[paramIdx].isNull()) {
-        if (request.params[paramIdx].get_str().empty()) {
-            ptx.scriptOperatorPayout = dmn->pdmnState->scriptOperatorPayout;
-        } else {
-            CTxDestination payoutDest = DecodeDestination(request.params[paramIdx].get_str());
-            if (!IsValidDestination(payoutDest)) {
-                throw JSONRPCError(RPC_INVALID_ADDRESS_OR_KEY, strprintf("invalid operator payout address: %s", request.params[paramIdx].get_str()));
-            }
-            ptx.scriptOperatorPayout = GetScriptForDestination(payoutDest);
+    if (!request.params[paramIdx].isNull() && !request.params[paramIdx].get_str().empty()) {
+        CTxDestination payout_destination{DecodeDestination(request.params[paramIdx].get_str())};
+        if (!IsValidDestination(payout_destination)) {
+            throw JSONRPCError(RPC_INVALID_ADDRESS_OR_KEY,
+                               strprintf("invalid operator payout address: %s", request.params[paramIdx].get_str()));
         }
-    } else {
-        ptx.scriptOperatorPayout = dmn->pdmnState->scriptOperatorPayout;
+        typed_request.operator_payout = payout_destination;
     }
-
-    CTxDestination feeSource;
-
-    // param feeSourceAddress
     if (!request.params[paramIdx + 1].isNull()) {
-        feeSource = DecodeDestination(request.params[paramIdx + 1].get_str());
-        if (!IsValidDestination(feeSource))
-            throw JSONRPCError(RPC_INVALID_ADDRESS_OR_KEY, std::string("Invalid Dash address: ") + request.params[paramIdx + 1].get_str());
-    } else {
-        if (ptx.scriptOperatorPayout != CScript()) {
-            // use operator reward address as default source for fees
-            ExtractDestination(ptx.scriptOperatorPayout, feeSource);
-        } else {
-            // use payout address as default source for fees
-            const auto owner_payouts = GetOwnerPayouts(*dmn->pdmnState);
-            ExtractDestination(owner_payouts.front().scriptPayout, feeSource);
+        CTxDestination fee_source{DecodeDestination(request.params[paramIdx + 1].get_str())};
+        if (!IsValidDestination(fee_source)) {
+            throw JSONRPCError(RPC_INVALID_ADDRESS_OR_KEY,
+                               std::string("Invalid Dash address: ") + request.params[paramIdx + 1].get_str());
         }
+        typed_request.fee_source = fee_source;
     }
-
-    bool fSubmit{true};
     if (!request.params[paramIdx + 2].isNull()) {
-        fSubmit = ParseBoolV(request.params[paramIdx + 2], "submit");
+        typed_request.submit = ParseBoolV(request.params[paramIdx + 2], "submit");
     }
 
-    FundSpecialTx(*wallet, tx, ptx, feeSource);
-
-    SignSpecialTxPayloadByHash(tx, ptx, keyOperator, /*use_legacy=*/ptx.nVersion == ProTxVersion::LegacyBLS);
-    SetTxPayload(tx, ptx);
-
-    return SignAndSendSpecialTx(request, chain_helper, chainman, tx, fSubmit);
+    auto wallet_interface{MakeWalletInterface(node, wallet)};
+    auto result{evo::provider::UpdateService(node, *wallet_interface, typed_request)};
+    if (const auto* error{std::get_if<interfaces::ProviderTxError>(&result)}) ThrowProviderTxError(*error);
+    return SubmissionToString(std::get<interfaces::ProviderTxSubmission>(result));
 }
 
 static RPCHelpMan protx_update_registrar_wrapper(const bool specific_legacy_bls_scheme)
@@ -1188,12 +990,15 @@ static RPCHelpMan protx_update_registrar_wrapper(const bool specific_legacy_bls_
     std::string rpc_full_name = std::string("protx ").append(rpc_name);
     std::string pubkey_operator = specific_legacy_bls_scheme ? "\"0532646990082f4fd639f90387b1551f2c7c39d37392cb9055a06a7e85c1d23692db8f87f827886310bccc1e29db9aee\"" : "\"8532646990082f4fd639f90387b1551f2c7c39d37392cb9055a06a7e85c1d23692db8f87f827886310bccc1e29db9aee\"";
     std::string rpc_example = rpc_name.append(" \"0123456701234567012345670123456701234567012345670123456701234567\" ").append(pubkey_operator).append(" \"" + EXAMPLE_ADDRESS[1] + "\"");
-    return RPCHelpMan{rpc_full_name,
+    return RPCHelpMan{
+        rpc_full_name,
         "\nCreates and sends a ProUpRegTx to the network. This will update the operator key, voting key and payout\n"
         "address of the masternode specified by \"proTxHash\".\n"
-        "The owner key of the masternode must be known to your wallet.\n"
-        + std::string(specific_legacy_bls_scheme ? "\nDEPRECATED: May be removed in a future version, pass config option -deprecatedrpc=legacy_mn to use RPC\n" : "")
-        + HELP_REQUIRING_PASSPHRASE,
+        "The owner key of the masternode must be known to your wallet.\n" +
+            std::string(specific_legacy_bls_scheme ? "\nDEPRECATED: May be removed in a future version, pass config "
+                                                     "option -deprecatedrpc=legacy_mn to use RPC\n"
+                                                   : "") +
+            HELP_REQUIRING_PASSPHRASE,
         {
             GetRpcArg("proTxHash"),
             specific_legacy_bls_scheme ? GetRpcArg("operatorPubKey_update_legacy") : GetRpcArg("operatorPubKey_update"),
@@ -1203,118 +1008,57 @@ static RPCHelpMan protx_update_registrar_wrapper(const bool specific_legacy_bls_
             GetRpcArg("submit"),
         },
         {
-            RPCResult{"if \"submit\" is not set or set to true",
-                RPCResult::Type::STR_HEX, "txid", "The transaction id"},
-            RPCResult{"if \"submit\" is set to false",
-                RPCResult::Type::STR_HEX, "hex", "The serialized signed ProTx in hex format"},
-        },
-        RPCExamples{
-            HelpExampleCli("protx", rpc_example)
+            RPCResult{"if \"submit\" is not set or set to true", RPCResult::Type::STR_HEX, "txid", "The transaction id"},
+            RPCResult{"if \"submit\" is set to false", RPCResult::Type::STR_HEX, "hex",
+                      "The serialized signed ProTx in hex format"},
         },
-        [&](const RPCHelpMan& self, const JSONRPCRequest& request) -> UniValue
-{
-    const bool use_legacy{self.m_name == "protx update_registrar_legacy"};
-    if (use_legacy && !IsDeprecatedRPCEnabled("legacy_mn")) {
-        throw std::runtime_error("DEPRECATED: Pass config option -deprecatedrpc=legacy_mn to enable this RPC");
-    }
-
-    const NodeContext& node = EnsureAnyNodeContext(request.context);
-    const ChainstateManager& chainman = EnsureChainman(node);
-
-    CDeterministicMNManager& dmnman = *CHECK_NONFATAL(node.dmnman);
-    CChainstateHelper& chain_helper = *CHECK_NONFATAL(node.chain_helper);
-
-    std::shared_ptr<CWallet> const wallet = GetWalletForJSONRPCRequest(request);
-    if (!wallet) return UniValue::VNULL;
-
-    EnsureWalletIsUnlocked(*wallet);
-
-    CProUpRegTx ptx;
-    ptx.nVersion = DeploymentToProtxVersion(WITH_LOCK(::cs_main, return chainman.ActiveChain().Tip()), chainman,
-                                            /*is_basic_override=*/!use_legacy);
-
-    ptx.proTxHash = ParseHashV(request.params[0], "proTxHash");
-    auto dmn = dmnman.GetListAtChainTip().GetMN(ptx.proTxHash);
-    if (!dmn) {
-        throw JSONRPCError(RPC_INVALID_PARAMETER, strprintf("masternode %s not found", ptx.proTxHash.ToString()));
-    }
-
-    ptx.keyIDVoting = dmn->pdmnState->keyIDVoting;
-    ptx.scriptPayout = dmn->pdmnState->scriptPayout;
-    ptx.payouts = GetOwnerPayouts(*dmn->pdmnState);
-
-    if (!request.params[1].get_str().empty()) {
-        // new pubkey
-        ptx.pubKeyOperator.Set(ParseBLSPubKey(request.params[1].get_str(), "operator BLS address", use_legacy), use_legacy);
-    } else {
-        // same pubkey, reuse as is
-        ptx.pubKeyOperator = dmn->pdmnState->pubKeyOperator;
-    }
-
-    // A legacy masternode migrates to the basic scheme via a (non-legacy) registrar update, keeping
-    // its operator key (migration) or supplying a new one (rotation). ptx.nVersion is already set from
-    // the deployment state above -- LegacyBLS for the legacy-BLS RPC variant, basic otherwise -- so
-    // only the key encoding needs fixing up here: a reused key is stored in the legacy encoding, so
-    // re-encode it to the basic scheme to keep the stored key consistent with its version (and the
-    // assertion below holding). A freshly parsed key already matches the requested scheme, and basic
-    // masternodes are untouched.
-    if (!use_legacy && ptx.pubKeyOperator != CBLSLazyPublicKey() && ptx.pubKeyOperator.IsLegacy()) {
-        const CBLSPublicKey& pubkey{ptx.pubKeyOperator.Get()};
-        ptx.pubKeyOperator.Set(pubkey, /*specificLegacyScheme=*/false);
-    }
-
-    CHECK_NONFATAL(ptx.pubKeyOperator.IsLegacy() == (ptx.nVersion == ProTxVersion::LegacyBLS));
-
-    if (!request.params[2].get_str().empty()) {
-        ptx.keyIDVoting = ParsePubKeyIDFromAddress(request.params[2].get_str(), "voting address");
-    }
-
-    CTxDestination payoutDest;
-    ExtractDestination(ptx.payouts.front().scriptPayout, payoutDest);
-    if (request.params[3].isArray()) {
-        if (ptx.nVersion < ProTxVersion::ExtAddr) {
-            throw JSONRPCError(RPC_INVALID_PARAMETER, "payouts array requires provider transaction version 3");
-        }
-        ptx.payouts = ParsePayouts(request.params[3], "payouts", payoutDest);
-        ptx.scriptPayout = ptx.payouts.front().scriptPayout;
-    } else if (!request.params[3].get_str().empty()) {
-        ptx.payouts = ParsePayouts(request.params[3], "payouts", payoutDest);
-        ptx.scriptPayout = ptx.payouts.front().scriptPayout;
-    }
-
-    {
-        const auto pkhash{PKHash(dmn->pdmnState->keyIDOwner)};
-        LOCK(wallet->cs_wallet);
-        if (wallet->IsMine(GetScriptForDestination(pkhash)) != isminetype::ISMINE_SPENDABLE) {
-            throw std::runtime_error(strprintf("Private key for owner address %s not found in your wallet", EncodeDestination(pkhash)));
-        }
-    }
-
-    CMutableTransaction tx;
-    tx.nVersion = 3;
-    tx.nType = TRANSACTION_PROVIDER_UPDATE_REGISTRAR;
-
-    // make sure we get anough fees added
-    ptx.vchSig.resize(65);
-
-    CTxDestination feeSourceDest = payoutDest;
-    if (!request.params[4].isNull()) {
-        feeSourceDest = DecodeDestination(request.params[4].get_str());
-        if (!IsValidDestination(feeSourceDest))
-            throw JSONRPCError(RPC_INVALID_ADDRESS_OR_KEY, std::string("Invalid Dash address: ") + request.params[4].get_str());
-    }
-
-    bool fSubmit{true};
-    if (!request.params[5].isNull()) {
-        fSubmit = ParseBoolV(request.params[5], "submit");
-    }
+        RPCExamples{HelpExampleCli("protx", rpc_example)},
+        [&](const RPCHelpMan& self, const JSONRPCRequest& request) -> UniValue {
+            const bool use_legacy{self.m_name == "protx update_registrar_legacy"};
+            if (use_legacy && !IsDeprecatedRPCEnabled("legacy_mn")) {
+                throw std::runtime_error("DEPRECATED: Pass config option -deprecatedrpc=legacy_mn to enable this RPC");
+            }
 
-    FundSpecialTx(*wallet, tx, ptx, feeSourceDest);
-    SignSpecialTxPayloadByHash(tx, ptx, dmn->pdmnState->keyIDOwner, *wallet);
-    SetTxPayload(tx, ptx);
+            NodeContext& node{EnsureAnyNodeContext(request.context)};
+            std::shared_ptr<CWallet> const wallet{GetWalletForJSONRPCRequest(request)};
+            if (!wallet) return UniValue::VNULL;
+            EnsureWalletIsUnlocked(*wallet);
+
+            interfaces::ProviderUpdateRegistrarRequest typed_request;
+            typed_request.pro_tx_hash = ParseHashV(request.params[0], "proTxHash");
+            typed_request.use_legacy_bls_scheme = use_legacy;
+            if (!request.params[1].get_str().empty()) {
+                typed_request.operator_key = ParseBLSPubKey(request.params[1].get_str(), "operator BLS address",
+                                                            use_legacy);
+            }
+            if (!request.params[2].get_str().empty()) {
+                typed_request.voting_key = ParsePubKeyIDFromAddress(request.params[2].get_str(), "voting address");
+            }
+            if (request.params[3].isArray() || !request.params[3].get_str().empty()) {
+                typed_request.uses_extended_payouts = request.params[3].isArray();
+                if (typed_request.uses_extended_payouts &&
+                    !evo::provider::GetCapabilities(node, /*basic_override=*/!use_legacy).extended_addresses) {
+                    throw JSONRPCError(RPC_INVALID_PARAMETER, "payouts array requires provider transaction version 3");
+                }
+                typed_request.payouts = ParsePayouts(request.params[3], "payouts");
+            }
+            if (!request.params[4].isNull()) {
+                CTxDestination fee_source{DecodeDestination(request.params[4].get_str())};
+                if (!IsValidDestination(fee_source)) {
+                    throw JSONRPCError(RPC_INVALID_ADDRESS_OR_KEY,
+                                       std::string("Invalid Dash address: ") + request.params[4].get_str());
+                }
+                typed_request.fee_source = fee_source;
+            }
+            if (!request.params[5].isNull()) {
+                typed_request.submit = ParseBoolV(request.params[5], "submit");
+            }
 
-    return SignAndSendSpecialTx(request, chain_helper, chainman, tx, fSubmit);
-},
+            auto wallet_interface{MakeWalletInterface(node, wallet)};
+            auto result{evo::provider::UpdateRegistrar(node, *wallet_interface, typed_request)};
+            if (const auto* error{std::get_if<interfaces::ProviderTxError>(&result)}) ThrowProviderTxError(*error);
+            return SubmissionToString(std::get<interfaces::ProviderTxSubmission>(result));
+        },
     };
 }
 
@@ -1330,12 +1074,13 @@ static RPCHelpMan protx_update_registrar_legacy()
 
 static RPCHelpMan protx_revoke()
 {
-    return RPCHelpMan{"protx revoke",
+    return RPCHelpMan{
+        "protx revoke",
         "\nCreates and sends a ProUpRevTx to the network. This will revoke the operator key of the masternode and\n"
         "put it into the PoSe-banned state. It will also set the service field of the masternode\n"
         "to zero. Use this in case your operator key got compromised or you want to stop providing your service\n"
-        "to the masternode owner.\n"
-        + HELP_REQUIRING_PASSPHRASE,
+        "to the masternode owner.\n" +
+            HELP_REQUIRING_PASSPHRASE,
         {
             GetRpcArg("proTxHash"),
             GetRpcArg("operatorKey"),
@@ -1344,85 +1089,47 @@ static RPCHelpMan protx_revoke()
             GetRpcArg("submit"),
         },
         {
-            RPCResult{"if \"submit\" is not set or set to true",
-                RPCResult::Type::STR_HEX, "txid", "The transaction id"},
-            RPCResult{"if \"submit\" is set to false",
-                RPCResult::Type::STR_HEX, "hex", "The serialized signed ProTx in hex format"},
+            RPCResult{"if \"submit\" is not set or set to true", RPCResult::Type::STR_HEX, "txid", "The transaction id"},
+            RPCResult{"if \"submit\" is set to false", RPCResult::Type::STR_HEX, "hex",
+                      "The serialized signed ProTx in hex format"},
         },
-        RPCExamples{
-            HelpExampleCli("protx", "revoke \"0123456701234567012345670123456701234567012345670123456701234567\" \"072f36a77261cdd5d64c32d97bac417540eddca1d5612f416feb07ff75a8e240\"")
-        },
-        [&](const RPCHelpMan& self, const JSONRPCRequest& request) -> UniValue
-{
-    const NodeContext& node = EnsureAnyNodeContext(request.context);
-    const ChainstateManager& chainman = EnsureChainman(node);
-
-    CDeterministicMNManager& dmnman = *CHECK_NONFATAL(node.dmnman);
-    CChainstateHelper& chain_helper = *CHECK_NONFATAL(node.chain_helper);
-
-    std::shared_ptr<CWallet> const pwallet = GetWalletForJSONRPCRequest(request);
-    if (!pwallet) return UniValue::VNULL;
-
-    EnsureWalletIsUnlocked(*pwallet);
-
-    CProUpRevTx ptx;
-    ptx.proTxHash = ParseHashV(request.params[0], "proTxHash");
-
-    auto dmn = dmnman.GetListAtChainTip().GetMN(ptx.proTxHash);
-    if (!dmn) {
-        throw JSONRPCError(RPC_INVALID_PARAMETER, strprintf("masternode %s not found", ptx.proTxHash.ToString()));
-    }
-
-    ptx.nVersion = DeploymentToProtxVersion(WITH_LOCK(::cs_main, return chainman.ActiveChain().Tip()), chainman);
-
-    CBLSSecretKey keyOperator = ParseBLSSecretKey(request.params[1].get_str(), "operatorKey");
-
-    if (!request.params[2].isNull()) {
-        int32_t nReason = request.params[2].getInt<int>();
-        if (nReason < 0 || nReason > CProUpRevTx::REASON_LAST) {
-            throw JSONRPCError(RPC_INVALID_PARAMETER, strprintf("invalid reason %d, must be between 0 and %d", nReason, CProUpRevTx::REASON_LAST));
-        }
-        ptx.nReason = (uint16_t)nReason;
-    }
-
-    if (keyOperator.GetPublicKey() != dmn->pdmnState->pubKeyOperator.Get()) {
-        throw JSONRPCError(RPC_INVALID_PARAMETER, strprintf("the operator key does not belong to the registered public key"));
-    }
-
-    CMutableTransaction tx;
-    tx.nVersion = 3;
-    tx.nType = TRANSACTION_PROVIDER_UPDATE_REVOKE;
-
-    if (!request.params[3].isNull()) {
-        CTxDestination feeSourceDest = DecodeDestination(request.params[3].get_str());
-        if (!IsValidDestination(feeSourceDest))
-            throw JSONRPCError(RPC_INVALID_ADDRESS_OR_KEY, std::string("Invalid Dash address: ") + request.params[3].get_str());
-        FundSpecialTx(*pwallet, tx, ptx, feeSourceDest);
-    } else if (dmn->pdmnState->scriptOperatorPayout != CScript()) {
-        // Using funds from previousely specified operator payout address
-        CTxDestination txDest;
-        ExtractDestination(dmn->pdmnState->scriptOperatorPayout, txDest);
-        FundSpecialTx(*pwallet, tx, ptx, txDest);
-    } else {
-        // Using funds from previousely specified masternode payout address
-        CTxDestination txDest;
-        const auto owner_payouts = GetOwnerPayouts(*dmn->pdmnState);
-        if (owner_payouts.empty() || !ExtractDestination(owner_payouts.front().scriptPayout, txDest)) {
-            throw JSONRPCError(RPC_INVALID_PARAMETER, "No payout or fee source addresses found, can't revoke");
-        }
-        FundSpecialTx(*pwallet, tx, ptx, txDest);
-    }
-
-    bool fSubmit{true};
-    if (!request.params[4].isNull()) {
-        fSubmit = ParseBoolV(request.params[4], "submit");
-    }
-
-    SignSpecialTxPayloadByHash(tx, ptx, keyOperator, /*use_legacy=*/ptx.nVersion == ProTxVersion::LegacyBLS);
-    SetTxPayload(tx, ptx);
+        RPCExamples{HelpExampleCli("protx",
+                                   "revoke \"0123456701234567012345670123456701234567012345670123456701234567\" "
+                                   "\"072f36a77261cdd5d64c32d97bac417540eddca1d5612f416feb07ff75a8e240\"")},
+        [&](const RPCHelpMan& self, const JSONRPCRequest& request) -> UniValue {
+            NodeContext& node{EnsureAnyNodeContext(request.context)};
+            std::shared_ptr<CWallet> const pwallet{GetWalletForJSONRPCRequest(request)};
+            if (!pwallet) return UniValue::VNULL;
+            EnsureWalletIsUnlocked(*pwallet);
+
+            interfaces::ProviderRevokeRequest typed_request;
+            typed_request.pro_tx_hash = ParseHashV(request.params[0], "proTxHash");
+            typed_request.operator_key = ParseBLSSecretKey(request.params[1].get_str(), "operatorKey");
+            if (!request.params[2].isNull()) {
+                const int32_t nReason{request.params[2].getInt<int>()};
+                if (nReason < 0 || nReason > CProUpRevTx::REASON_LAST) {
+                    throw JSONRPCError(RPC_INVALID_PARAMETER, strprintf("invalid reason %d, must be between 0 and %d",
+                                                                        nReason, CProUpRevTx::REASON_LAST));
+                }
+                typed_request.reason = static_cast<uint16_t>(nReason);
+            }
+            if (!request.params[3].isNull()) {
+                CTxDestination fee_source{DecodeDestination(request.params[3].get_str())};
+                if (!IsValidDestination(fee_source)) {
+                    throw JSONRPCError(RPC_INVALID_ADDRESS_OR_KEY,
+                                       std::string("Invalid Dash address: ") + request.params[3].get_str());
+                }
+                typed_request.fee_source = fee_source;
+            }
+            if (!request.params[4].isNull()) {
+                typed_request.submit = ParseBoolV(request.params[4], "submit");
+            }
 
-    return SignAndSendSpecialTx(request, chain_helper, chainman, tx, fSubmit);
-},
+            auto wallet_interface{MakeWalletInterface(node, pwallet)};
+            auto result{evo::provider::Revoke(node, *wallet_interface, typed_request)};
+            if (const auto* error{std::get_if<interfaces::ProviderTxError>(&result)}) ThrowProviderTxError(*error);
+            return SubmissionToString(std::get<interfaces::ProviderTxSubmission>(result));
+        },
     };
 }
 
diff --git a/src/rpc/evo_util.cpp b/src/rpc/evo_util.cpp
index e73bb5cc61b6..29a06993b735 100644
--- a/src/rpc/evo_util.cpp
+++ b/src/rpc/evo_util.cpp
@@ -5,143 +5,10 @@
 #include <rpc/evo_util.h>
 
 #include <evo/deterministicmns.h>
-#include <evo/providertx.h>
 #include <index/txindex.h>
-#include <rpc/protocol.h>
-#include <rpc/request.h>
 
 #include <univalue.h>
 
-namespace {
-bool IsNumeric(std::string_view input) { return input.find_first_not_of("0123456789") == std::string::npos; }
-
-template <typename ProTx>
-void ParseInput(ProTx& ptx, std::string_view field_name, const std::string& input_str, NetInfoPurpose purpose,
-                size_t idx, bool optional)
-{
-    if (input_str.empty()) {
-        if (!optional) {
-            throw JSONRPCError(RPC_INVALID_PARAMETER,
-                               strprintf("Invalid param for %s[%zu], cannot be empty", field_name, idx));
-        }
-        return; // Nothing to do
-    }
-    if (auto ret = ptx.netInfo->AddEntry(purpose, input_str); ret != NetInfoStatus::Success) {
-        throw JSONRPCError(RPC_INVALID_PARAMETER,
-                           strprintf("Error setting %s[%zu] to '%s' (%s)", field_name, idx, input_str, NISToString(ret)));
-    }
-}
-} // anonymous namespace
-
-template <typename ProTx>
-void ProcessNetInfoCore(ProTx& ptx, const UniValue& input, const bool optional)
-{
-    CHECK_NONFATAL(ptx.netInfo);
-
-    if (input.isStr()) {
-        ParseInput(ptx, /*field_name=*/"coreP2PAddrs", input.get_str(), NetInfoPurpose::CORE_P2P, /*idx=*/0, optional);
-    } else if (input.isArray()) {
-        const UniValue& entries = input.get_array();
-        if (!optional && entries.empty()) {
-            throw JSONRPCError(RPC_INVALID_PARAMETER, "Invalid param for coreP2PAddrs, cannot be empty");
-        }
-        for (size_t idx{0}; idx < entries.size(); idx++) {
-            const UniValue& entry_uv{entries[idx]};
-            if (!entry_uv.isStr()) {
-                throw JSONRPCError(RPC_INVALID_PARAMETER,
-                                   strprintf("Invalid param for coreP2PAddrs[%zu], must be string", idx));
-            }
-            ParseInput(ptx, /*field_name=*/"coreP2PAddrs", entry_uv.get_str(), NetInfoPurpose::CORE_P2P, idx,
-                       /*optional=*/false);
-        }
-    } else {
-        throw JSONRPCError(RPC_INVALID_PARAMETER, "Invalid param for coreP2PAddrs, must be string or array");
-    }
-}
-template void ProcessNetInfoCore(CProRegTx& ptx, const UniValue& input, const bool optional);
-template void ProcessNetInfoCore(CProUpServTx& ptx, const UniValue& input, const bool optional);
-
-template <typename ProTx>
-void ProcessNetInfoPlatform(ProTx& ptx, const UniValue& input_p2p, const UniValue& input_http, const bool optional)
-{
-    CHECK_NONFATAL(ptx.netInfo);
-
-    auto process_field = [&](uint16_t& maybe_target, const UniValue& input, const NetInfoPurpose purpose,
-                             std::string_view field_name) {
-        if (!input.isArray() && !input.isNum() && !input.isStr()) {
-            throw JSONRPCError(RPC_INVALID_PARAMETER,
-                               strprintf("Invalid param for %s, must be array, number or string", field_name));
-        }
-
-        bool is_empty{input.isArray() ? input.get_array().empty() : input.getValStr().empty()};
-        bool is_nonnumeric_str{input.isStr() && !IsNumeric(input.getValStr())};
-        if (is_empty || is_nonnumeric_str || input.isArray()) {
-            if (is_empty) {
-                if (!optional) {
-                    // Mandatory field, cannot specify blank value
-                    throw JSONRPCError(RPC_INVALID_PARAMETER,
-                                       strprintf("Invalid param for %s, cannot be empty", field_name));
-                }
-                if (!ptx.netInfo->IsEmpty()) {
-                    // Blank values are tolerable so long as no other field has been populated.
-                    throw JSONRPCError(RPC_INVALID_PARAMETER,
-                                       strprintf("Invalid param for %s, cannot be empty if other fields populated",
-                                                 field_name));
-                }
-            }
-            if (!ptx.netInfo->CanStorePlatform()) {
-                //      Arrays: Expected to be address strings, if relying on platform{HTTP,P2P}Port, bail out.
-                // Empty Input: We can tolerate blank values if netInfo can store platform fields, if it cannot, we are relying
-                //              on platform{HTTP,P2P}Port, where it is mandatory even if their netInfo counterpart is optional.
-                //      String: If not parsable as port and relying on platform{HTTP,P2P}Port, bail out.
-                throw JSONRPCError(
-                    RPC_INVALID_PARAMETER,
-                    strprintf("Invalid param for %s, this ProTx version only accepts a bare port number; the "
-                              "\"ADDR:PORT\" / address-array form requires upgrading to a version 3 ProTx",
-                              field_name));
-            }
-            if (input.isArray()) {
-                const UniValue& entries = input.get_array();
-                for (size_t idx{0}; idx < entries.size(); idx++) {
-                    const UniValue& entry{entries[idx]};
-                    if (!entry.isStr() || IsNumeric(entry.get_str())) {
-                        throw JSONRPCError(RPC_INVALID_PARAMETER,
-                                           strprintf("Invalid param for %s[%zu], must be string", field_name, idx));
-                    }
-                    ParseInput(ptx, field_name, entry.get_str(), purpose, idx, /*optional=*/false);
-                }
-            } else {
-                CHECK_NONFATAL(is_empty || is_nonnumeric_str);
-                ParseInput(ptx, field_name, input.get_str(), purpose, /*idx=*/0, /*optional=*/true);
-            }
-        } else {
-            if (int32_t port{0};
-                ParseInt32(input.getValStr(), &port) && port >= 1 && port <= std::numeric_limits<uint16_t>::max()) {
-                // Valid port
-                if (!ptx.netInfo->CanStorePlatform()) {
-                    maybe_target = static_cast<uint16_t>(port);
-                    return; // Parsing complete
-                }
-                // We cannot store *only* a port number in netInfo so we need to associate it with the primary service of CORE_P2P manually
-                if (!ptx.netInfo->HasEntries(NetInfoPurpose::CORE_P2P)) {
-                    throw JSONRPCError(RPC_INVALID_PARAMETER,
-                                       strprintf("Cannot set param for %s, must specify coreP2PAddrs first", field_name));
-                }
-                const CService service{CNetAddr{ptx.netInfo->GetPrimary()}, static_cast<uint16_t>(port)};
-                CHECK_NONFATAL(service.IsValid());
-                ParseInput(ptx, field_name, service.ToStringAddrPort(), purpose, /*idx=*/0, /*optional=*/false);
-            } else {
-                throw JSONRPCError(RPC_INVALID_PARAMETER,
-                                   strprintf("Invalid param for %s, must be a valid port [1-65535]", field_name));
-            }
-        }
-    };
-    process_field(ptx.platformP2PPort, input_p2p, NetInfoPurpose::PLATFORM_P2P, "platformP2PAddrs");
-    process_field(ptx.platformHTTPPort, input_http, NetInfoPurpose::PLATFORM_HTTPS, "platformHTTPSAddrs");
-}
-template void ProcessNetInfoPlatform(CProRegTx& ptx, const UniValue& input_p2p, const UniValue& input_http, const bool optional);
-template void ProcessNetInfoPlatform(CProUpServTx& ptx, const UniValue& input_p2p, const UniValue& input_http, const bool optional);
-
 
 UniValue CDeterministicMN::ToJson() const
 {
diff --git a/src/rpc/evo_util.h b/src/rpc/evo_util.h
index 6734558e43bb..0a5e08c98225 100644
--- a/src/rpc/evo_util.h
+++ b/src/rpc/evo_util.h
@@ -18,14 +18,6 @@
 
 class CSimplifiedMNListEntry;
 
-/** Process setting (legacy) Core network information field based on ProTx version */
-template <typename ProTx>
-void ProcessNetInfoCore(ProTx& ptx, const UniValue& input, const bool optional);
-
-/** Process setting (legacy) Platform network information fields based on ProTx version */
-template <typename ProTx>
-void ProcessNetInfoPlatform(ProTx& ptx, const UniValue& input_p2p, const UniValue& input_http, const bool optional);
-
 /** Reads network info reporting and appends data from legacy fields if applicable */
 template <typename Obj>
 UniValue GetNetInfoWithLegacyFields(const Obj& obj, const MnType& type)
diff --git a/src/test/evo_netinfo_tests.cpp b/src/test/evo_netinfo_tests.cpp
index b9f30eb1081a..2211720c6aaf 100644
--- a/src/test/evo_netinfo_tests.cpp
+++ b/src/test/evo_netinfo_tests.cpp
@@ -5,6 +5,8 @@
 #include <test/util/setup_common.h>
 
 #include <evo/netinfo.h>
+#include <evo/types.h>
+#include <interfaces/node.h>
 #include <util/helpers.h>
 
 #include <chainparams.h>
@@ -134,6 +136,47 @@ BOOST_AUTO_TEST_CASE(mnnetinfo_rules_main)
 
 BOOST_AUTO_TEST_CASE(extnetinfo_rules_main) { TestExtNetInfo(addr_vals_main); }
 
+BOOST_AUTO_TEST_CASE(provider_network_fields_main)
+{
+    auto node{interfaces::MakeNode(m_node)};
+    interfaces::ProviderNetInfo net_info{
+        .core_p2p = {strprintf("1.1.1.1:%d", MainParams().GetDefaultPort())},
+        .platform_p2p = MainParams().GetDefaultPlatformP2PPort(),
+        .platform_https = MainParams().GetDefaultPlatformHTTPPort(),
+    };
+    BOOST_CHECK(!node->evo().validateProviderNetInfo(net_info, MnType::Evo, ProTxVersion::BasicBLS, /*optional=*/false));
+
+    net_info.platform_p2p = static_cast<uint16_t>(MainParams().GetDefaultPlatformP2PPort() + 1);
+    auto validation_error{
+        node->evo().validateProviderNetInfo(net_info, MnType::Evo, ProTxVersion::BasicBLS, /*optional=*/false)};
+    BOOST_REQUIRE(validation_error);
+    BOOST_CHECK_EQUAL(validation_error->reject_reason, "bad-protx-platform-p2p-port");
+
+    net_info.platform_p2p = MainParams().GetDefaultPlatformP2PPort();
+    net_info.platform_https = static_cast<uint16_t>(MainParams().GetDefaultPlatformHTTPPort() + 1);
+    validation_error = node->evo().validateProviderNetInfo(net_info, MnType::Evo, ProTxVersion::BasicBLS,
+                                                           /*optional=*/false);
+    BOOST_REQUIRE(validation_error);
+    BOOST_CHECK_EQUAL(validation_error->reject_reason, "bad-protx-platform-http-port");
+
+    net_info.platform_p2p = MainParams().GetDefaultPort();
+    net_info.platform_https = MainParams().GetDefaultPlatformHTTPPort();
+    validation_error = node->evo().validateProviderNetInfo(net_info, MnType::Evo, ProTxVersion::BasicBLS,
+                                                           /*optional=*/false);
+    BOOST_REQUIRE(validation_error);
+    BOOST_CHECK_EQUAL(validation_error->reject_reason, "bad-protx-platform-p2p-port");
+
+    net_info = {
+        .core_p2p = {"127.0.0.1:9999"},
+        .platform_p2p = std::vector<std::string>{"1.1.1.2:22200"},
+        .platform_https = std::vector<std::string>{"server.example.com:443"},
+    };
+    validation_error = node->evo().validateProviderNetInfo(net_info, MnType::Evo, ProTxVersion::ExtAddr,
+                                                           /*optional=*/false);
+    BOOST_REQUIRE(validation_error);
+    BOOST_CHECK(validation_error->message.original.find("unroutable address") != std::string::npos);
+}
+
 static const std::vector<TestEntry> addr_vals_reg{
     // - MnNetInfo doesn't mind using port 0
     // - ExtNetInfo requires non-zero ports
diff --git a/src/test/interfaces_tests.cpp b/src/test/interfaces_tests.cpp
index 11c10a4f6432..63c241ff6575 100644
--- a/src/test/interfaces_tests.cpp
+++ b/src/test/interfaces_tests.cpp
@@ -4,7 +4,9 @@
 
 #include <chainparams.h>
 #include <consensus/validation.h>
+#include <evo/providertx.h>
 #include <interfaces/chain.h>
+#include <interfaces/node.h>
 #include <script/standard.h>
 #include <test/util/setup_common.h>
 #include <validation.h>
@@ -60,6 +62,101 @@ BOOST_AUTO_TEST_CASE(findBlock)
     BOOST_CHECK(!chain->findBlock({}, FoundBlock()));
 }
 
+BOOST_AUTO_TEST_CASE(providerTxCapabilities)
+{
+    auto node{interfaces::MakeNode(m_node)};
+    const auto capabilities{node->evo().getProviderTxCapabilities()};
+    const uint16_t expected_version{
+        WITH_LOCK(::cs_main, return DeploymentToProtxVersion(Assert(m_node.chainman)->ActiveChain().Tip(),
+                                                             *Assert(m_node.chainman)))};
+    BOOST_CHECK_EQUAL(capabilities.version, expected_version);
+    BOOST_CHECK_EQUAL(capabilities.extended_addresses, expected_version >= ProTxVersion::ExtAddr);
+}
+
+BOOST_AUTO_TEST_CASE(providerNetInfoValidation)
+{
+    auto node{interfaces::MakeNode(m_node)};
+    interfaces::ProviderNetInfo net_info{
+        .core_p2p = {"1.1.1.1:9998"},
+        .platform_p2p = std::vector<std::string>{"1.1.1.2:22200"},
+        .platform_https = std::vector<std::string>{"server.example.com:443"},
+    };
+
+    BOOST_CHECK(!node->evo().validateProviderNetInfo(net_info, MnType::Evo, ProTxVersion::ExtAddr, /*optional=*/false));
+
+    net_info.platform_p2p = std::vector<std::string>{"server.example.com:22200"};
+    auto error{node->evo().validateProviderNetInfo(net_info, MnType::Evo, ProTxVersion::ExtAddr, /*optional=*/false)};
+    BOOST_REQUIRE(error);
+    BOOST_CHECK_EQUAL(error->code, interfaces::ProviderTxErrorCode::INVALID_PARAMETER);
+    BOOST_CHECK_EQUAL(error->message.original,
+                      "Error setting platformP2PAddrs[0] to 'server.example.com:22200' (invalid input)");
+
+    net_info.platform_p2p = std::vector<std::string>{"1.1.1.1:9998"};
+    error = node->evo().validateProviderNetInfo(net_info, MnType::Evo, ProTxVersion::ExtAddr, /*optional=*/false);
+    BOOST_REQUIRE(error);
+    BOOST_CHECK_EQUAL(error->message.original, "Error setting platformP2PAddrs[0] to '1.1.1.1:9998' (duplicate)");
+
+    net_info.platform_p2p = std::vector<std::string>{"1.1.1.2:22200", "1.1.1.3:22200", "1.1.1.4:22200", "1.1.1.5:22200",
+                                                     "1.1.1.6:22200"};
+    error = node->evo().validateProviderNetInfo(net_info, MnType::Evo, ProTxVersion::ExtAddr, /*optional=*/false);
+    BOOST_REQUIRE(error);
+    BOOST_CHECK_EQUAL(error->message.original,
+                      "Error setting platformP2PAddrs[4] to '1.1.1.6:22200' (too many entries)");
+
+    net_info.platform_p2p = uint16_t{22200};
+    net_info.platform_https = uint16_t{22201};
+    BOOST_CHECK(!node->evo().validateProviderNetInfo(net_info, MnType::Evo, ProTxVersion::BasicBLS, /*optional=*/false));
+
+    net_info.platform_p2p = std::vector<std::string>{"1.1.1.2:22200"};
+    error = node->evo().validateProviderNetInfo(net_info, MnType::Evo, ProTxVersion::BasicBLS, /*optional=*/false);
+    BOOST_REQUIRE(error);
+    BOOST_CHECK(error->message.original.find("only accepts a bare port number") != std::string::npos);
+
+    net_info = {
+        .platform_p2p = std::vector<std::string>{"1.1.1.2:22200"},
+        .platform_https = std::vector<std::string>{"server.example.com:443"},
+    };
+    error = node->evo().validateProviderNetInfo(net_info, MnType::Evo, ProTxVersion::ExtAddr, /*optional=*/true);
+    BOOST_REQUIRE(error);
+    BOOST_CHECK_EQUAL(error->reject_reason, "bad-protx-netinfo-empty");
+
+    net_info = {.core_p2p = {"1.1.1.1:9998"}};
+    error = node->evo().validateProviderNetInfo(net_info, MnType::Evo, ProTxVersion::ExtAddr, /*optional=*/true);
+    BOOST_REQUIRE(error);
+    BOOST_CHECK(error->message.original.find("platformP2PAddrs, cannot be empty if other fields populated") !=
+                std::string::npos);
+    BOOST_CHECK(!node->evo().validateProviderNetInfo(net_info, MnType::Regular, ProTxVersion::ExtAddr, /*optional=*/true));
+
+    net_info.platform_p2p = std::vector<std::string>{"1.1.1.2:22200"};
+    error = node->evo().validateProviderNetInfo(net_info, MnType::Regular, ProTxVersion::ExtAddr, /*optional=*/true);
+    BOOST_REQUIRE(error);
+    BOOST_CHECK_EQUAL(error->message.original, "Platform endpoints are only valid for an EvoNode");
+
+    net_info = {
+        .core_p2p = {"1.1.1.1:9998"},
+        .platform_p2p = std::vector<std::string>{"1.1.1.2:22200"},
+    };
+    error = node->evo().validateProviderNetInfo(net_info, MnType::Evo, ProTxVersion::ExtAddr, /*optional=*/true);
+    BOOST_REQUIRE(error);
+    BOOST_CHECK(error->message.original.find("platformHTTPSAddrs, cannot be empty if other fields populated") !=
+                std::string::npos);
+
+    net_info = {
+        .core_p2p = {"1.1.1.1:9998"},
+        .platform_p2p = uint16_t{22200},
+        .platform_https = uint16_t{22200},
+    };
+    error = node->evo().validateProviderNetInfo(net_info, MnType::Evo, ProTxVersion::BasicBLS, /*optional=*/false);
+    BOOST_REQUIRE(error);
+    BOOST_CHECK_EQUAL(error->reject_reason, "bad-protx-platform-dup-ports");
+
+    net_info.platform_p2p = uint16_t{MainParams().GetDefaultPort()};
+    net_info.platform_https = uint16_t{22201};
+    error = node->evo().validateProviderNetInfo(net_info, MnType::Evo, ProTxVersion::BasicBLS, /*optional=*/false);
+    BOOST_REQUIRE(error);
+    BOOST_CHECK_EQUAL(error->reject_reason, "bad-protx-platform-p2p-port");
+}
+
 BOOST_AUTO_TEST_CASE(findFirstBlockWithTimeAndHeight)
 {
     LOCK(Assert(m_node.chainman)->GetMutex());
diff --git a/src/wallet/interfaces.cpp b/src/wallet/interfaces.cpp
index 26d4f3a379b3..812af00edefd 100644
--- a/src/wallet/interfaces.cpp
+++ b/src/wallet/interfaces.cpp
@@ -47,6 +47,7 @@
 #include <vector>
 
 using interfaces::Chain;
+using interfaces::CoinLockResult;
 using interfaces::FoundBlock;
 using interfaces::Handler;
 using interfaces::MakeHandler;
@@ -59,6 +60,7 @@ using interfaces::WalletLoader;
 using interfaces::WalletOrderForm;
 using interfaces::WalletTx;
 using interfaces::WalletTxOut;
+using interfaces::WalletTxSignResult;
 using interfaces::WalletTxStatus;
 using interfaces::WalletValueMap;
 using node::NodeContext;
@@ -391,6 +393,13 @@ class WalletImpl : public Wallet
         std::unique_ptr<WalletBatch> batch = write_to_db ? std::make_unique<WalletBatch>(m_wallet->GetDatabase()) : nullptr;
         return m_wallet->LockCoin(output, batch.get());
     }
+    CoinLockResult acquireCoinLock(const COutPoint& output, bool write_to_db) override
+    {
+        LOCK(m_wallet->cs_wallet);
+        if (m_wallet->IsLockedCoin(output)) return CoinLockResult::ALREADY_LOCKED;
+        std::unique_ptr<WalletBatch> batch = write_to_db ? std::make_unique<WalletBatch>(m_wallet->GetDatabase()) : nullptr;
+        return m_wallet->LockCoin(output, batch.get()) ? CoinLockResult::ACQUIRED : CoinLockResult::FAILED;
+    }
     bool unlockCoin(const COutPoint& output) override
     {
         LOCK(m_wallet->cs_wallet);
@@ -455,6 +464,77 @@ class WalletImpl : public Wallet
 
         return txr.tx;
     }
+    util::Result<CTransactionRef> fundTransaction(const CMutableTransaction& tx_template,
+                                                  const CTxDestination& fund_destination) override
+    {
+        AssertLockNotHeld(::cs_main);
+        m_wallet->BlockUntilSyncedToCurrentChain();
+
+        LOCK(m_wallet->cs_wallet);
+        if (std::holds_alternative<CNoDestination>(fund_destination)) {
+            return util::Error{Untranslated("No source of funds specified")};
+        }
+
+        CMutableTransaction tx{tx_template};
+        static const CTxOut dummy_output{0, CScript() << OP_RETURN};
+        const bool add_dummy_output{tx.vout.empty()};
+        if (add_dummy_output) tx.vout.emplace_back(dummy_output);
+
+        std::vector<CRecipient> recipients;
+        recipients.reserve(tx.vout.size());
+        for (const auto& output : tx.vout) {
+            recipients.push_back({output.scriptPubKey, output.nValue, /*fSubtractFeeFromAmount=*/false});
+        }
+
+        CCoinControl coin_control;
+        coin_control.destChange = fund_destination;
+        coin_control.fRequireAllInputs = false;
+        for (const auto& output : AvailableCoinsListUnspent(*m_wallet).all()) {
+            CTxDestination destination;
+            if (ExtractDestination(output.txout.scriptPubKey, destination) && destination == fund_destination) {
+                coin_control.Select(output.outpoint);
+            }
+        }
+        if (!coin_control.HasSelected()) {
+            return util::Error{
+                strprintf(Untranslated("No funds at specified address %s"), EncodeDestination(fund_destination))};
+        }
+
+        auto result{CreateTransaction(*m_wallet, recipients, RANDOM_CHANGE_POSITION, coin_control,
+                                      /*sign=*/true, tx.vExtraPayload.size())};
+        if (!result) return util::Error{util::ErrorString(result)};
+
+        tx.vin = result->tx->vin;
+        tx.vout = result->tx->vout;
+        if (add_dummy_output && tx.vout.size() > 1) {
+            const auto it{std::find(tx.vout.begin(), tx.vout.end(), dummy_output)};
+            CHECK_NONFATAL(it != tx.vout.end());
+            tx.vout.erase(it);
+        }
+        return MakeTransactionRef(std::move(tx));
+    }
+    util::Result<WalletTxSignResult> signTransaction(const CMutableTransaction& tx) override
+    {
+        AssertLockNotHeld(::cs_main);
+        std::map<COutPoint, Coin> coins;
+        for (const auto& input : tx.vin)
+            coins.try_emplace(input.prevout);
+        m_wallet->chain().findCoins(coins);
+
+        LOCK(m_wallet->cs_wallet);
+        if (m_wallet->IsLocked()) {
+            return util::Error{_("Please enter the wallet passphrase with walletpassphrase first.")};
+        }
+
+        CMutableTransaction signed_tx{tx};
+        std::map<int, bilingual_str> input_errors;
+        const bool complete{m_wallet->SignTransaction(signed_tx, coins, SIGHASH_ALL, input_errors)};
+        std::vector<bilingual_str> errors;
+        errors.reserve(input_errors.size());
+        for (auto& [index, error] : input_errors)
+            errors.push_back(std::move(error));
+        return WalletTxSignResult{MakeTransactionRef(std::move(signed_tx)), complete, std::move(errors)};
+    }
     void commitTransaction(CTransactionRef tx,
         WalletValueMap value_map,
         WalletOrderForm order_form) override
diff --git a/src/wallet/test/wallet_tests.cpp b/src/wallet/test/wallet_tests.cpp
index ba7fc6640ec6..b8716cbbcfcc 100644
--- a/src/wallet/test/wallet_tests.cpp
+++ b/src/wallet/test/wallet_tests.cpp
@@ -51,6 +51,20 @@ static_assert(DEFAULT_TRANSACTION_MINFEE >= DEFAULT_MIN_RELAY_TX_FEE, "wallet mi
 
 BOOST_FIXTURE_TEST_SUITE(wallet_tests, WalletTestingSetup)
 
+BOOST_AUTO_TEST_CASE(interface_coin_lock_ownership)
+{
+    const auto wallet_ref{std::shared_ptr<CWallet>(&m_wallet, [](CWallet*) {})};
+    auto wallet_interface{interfaces::MakeWallet(*m_wallet_loader->context(), wallet_ref)};
+    const COutPoint outpoint{uint256::ONE, 0};
+
+    BOOST_CHECK(wallet_interface->acquireCoinLock(outpoint, /*write_to_db=*/false) == interfaces::CoinLockResult::ACQUIRED);
+    BOOST_CHECK(wallet_interface->acquireCoinLock(outpoint, /*write_to_db=*/false) ==
+                interfaces::CoinLockResult::ALREADY_LOCKED);
+    BOOST_CHECK(wallet_interface->unlockCoin(outpoint));
+    BOOST_CHECK(wallet_interface->acquireCoinLock(outpoint, /*write_to_db=*/false) == interfaces::CoinLockResult::ACQUIRED);
+    BOOST_CHECK(wallet_interface->unlockCoin(outpoint));
+}
+
 static std::shared_ptr<CWallet> TestLoadWallet(WalletContext& context)
 {
     DatabaseOptions options;
diff --git a/test/functional/wallet_dash_rpcs.py b/test/functional/wallet_dash_rpcs.py
index ecf72572985a..0b37c3e731d2 100755
--- a/test/functional/wallet_dash_rpcs.py
+++ b/test/functional/wallet_dash_rpcs.py
@@ -27,7 +27,7 @@
     DashTestFramework,
     MasternodeInfo,
 )
-from test_framework.util import assert_equal, p2p_port, softfork_active
+from test_framework.util import assert_equal, assert_raises_rpc_error, p2p_port, softfork_active
 
 
 class WalletDashRPCsTest(DashTestFramework):
@@ -58,6 +58,7 @@ def run_test(self):
 
         self.test_gobject_wallet_paths()
         funded_mn = self.test_protx_register_fund()
+        self.test_protx_collateral_lock_errors()
         self.test_protx_register_own_collateral()
         self.test_protx_register_external()
         self.test_protx_update_service(funded_mn)
@@ -130,14 +131,49 @@ def test_protx_register_own_collateral(self):
         mn.set_params(collateral_txid=collateral_txid, collateral_vout=collateral_vout)
         # Unlike register_prepare, this proves ownership of the collateral by signing the
         # payload with the wallet itself (CWallet::SignMessage -> SPKM dispatch)
-        protx_hash = mn.register(node, submit=True)
-        assert protx_hash is not None
+        raw_tx = mn.register(node, submit=False)
+        assert raw_tx is not None
+        collateral_outpoint = {"txid": collateral_txid, "vout": collateral_vout}
+        assert collateral_outpoint in node.listlockunspent()
+        protx_hash = node.sendrawtransaction(raw_tx)
         mn.set_params(proTxHash=protx_hash)
         self.confirm_tx(protx_hash)
         assert protx_hash in node.protx("list", "registered")
         assert_equal(node.protx("info", protx_hash)["collateralHash"], collateral_txid)
         assert "%s-%d" % (collateral_txid, collateral_vout) in node.masternode("list")
 
+    def test_protx_collateral_lock_errors(self):
+        node = self.nodes[0]
+        self.log.info("Test protx collateral lock ownership on errors")
+        mn = self.prepare_unstarted_mn(len(self.nodes) + 4)
+        collateral_txid = node.sendtoaddress(mn.collateral_address, mn.get_collateral_value())
+        self.bump_mocktime(1)
+        self.generate(node, 1)
+        collateral_vout = mn.get_collateral_vout(node, collateral_txid)
+        mn.set_params(collateral_txid=collateral_txid, collateral_vout=collateral_vout)
+        collateral_outpoint = {"txid": collateral_txid, "vout": collateral_vout}
+        unfunded_address = node.getnewaddress()
+
+        # A failing call releases only a lock that it acquired itself.
+        mn.register(node, submit=False, fundsAddr=unfunded_address,
+                    expected_assert_code=-32603, expected_assert_msg="No funds at specified address")
+        assert collateral_outpoint not in node.listlockunspent()
+
+        command = "register_prepare_legacy" if mn.legacy else "register_prepare"
+        prepare_args = [collateral_txid, collateral_vout, f'127.0.0.1:{mn.nodePort}',
+                        mn.ownerAddr, mn.pubKeyOperator, mn.votingAddr, 0,
+                        mn.rewards_address, unfunded_address]
+        assert_raises_rpc_error(-32603, "No funds at specified address", node.protx, command, *prepare_args)
+        assert collateral_outpoint not in node.listlockunspent()
+
+        node.lockunspent(False, [collateral_outpoint])
+        mn.register(node, submit=False, fundsAddr=unfunded_address,
+                    expected_assert_code=-32603, expected_assert_msg="No funds at specified address")
+        assert collateral_outpoint in node.listlockunspent()
+        assert_raises_rpc_error(-32603, "No funds at specified address", node.protx, command, *prepare_args)
+        assert collateral_outpoint in node.listlockunspent()
+        node.lockunspent(True, [collateral_outpoint])
+
     def test_protx_register_external(self):
         node = self.nodes[0]
         self.log.info("Test protx register_prepare + signmessage + register_submit (external collateral)")
@@ -153,8 +189,19 @@ def test_protx_register_external(self):
         prepared = node.protx(command, collateral_txid, collateral_vout, f'127.0.0.1:{mn.nodePort}',
                               mn.ownerAddr, mn.pubKeyOperator, mn.votingAddr, 0, mn.rewards_address, mn.fundsAddr)
         assert_equal(prepared["collateralAddress"], mn.collateral_address)
+        collateral_outpoint = {"txid": collateral_txid, "vout": collateral_vout}
+        assert collateral_outpoint in node.listlockunspent()
         signature = node.signmessage(prepared["collateralAddress"], prepared["signMessage"])
+
+        assert_raises_rpc_error(-1, "bad-protx-sig", node.protx, "register_submit", prepared["tx"], "AA==")
+        assert collateral_outpoint in node.listlockunspent()
+        node.createwallet("empty_signing_wallet")
+        empty_wallet = node.get_wallet_rpc("empty_signing_wallet")
+        assert_raises_rpc_error(-4, "transaction inputs could not be fully signed", empty_wallet.protx,
+                                "register_submit", prepared["tx"], signature)
+        node.unloadwallet("empty_signing_wallet")
         protx_hash = node.protx("register_submit", prepared["tx"], signature)
+        assert collateral_outpoint in node.listlockunspent()
         mn.set_params(proTxHash=protx_hash)
         self.confirm_tx(protx_hash)
         assert protx_hash in node.protx("list", "registered")

From 9742a27bfffa621872d37e469e40ecfd32eced4f Mon Sep 17 00:00:00 2001
From: pasta <pasta@dashboost.org>
Date: Thu, 13 Aug 2026 00:26:32 -0500
Subject: [PATCH 13/14] docs: add release notes for typed provider transactions

---
 doc/release-notes-7600.md | 8 ++++++++
 1 file changed, 8 insertions(+)
 create mode 100644 doc/release-notes-7600.md

diff --git a/doc/release-notes-7600.md b/doc/release-notes-7600.md
new file mode 100644
index 000000000000..be0ec57ada90
--- /dev/null
+++ b/doc/release-notes-7600.md
@@ -0,0 +1,8 @@
+RPC changes
+-----------
+
+- Normal and Evo `protx` registration and maintenance commands now share a
+  typed provider-transaction implementation with other wallet frontends. RPC
+  names and successful result formats are unchanged. Transactions whose wallet
+  inputs cannot be signed completely now fail with a wallet error instead of
+  returning or attempting to broadcast a partially signed transaction. (#7600)

From 66349a4393f27edba32f75ecbd0762dea41941f9 Mon Sep 17 00:00:00 2001
From: pasta <pasta@dashboost.org>
Date: Thu, 13 Aug 2026 10:30:17 -0500
Subject: [PATCH 14/14] fix(interfaces): satisfy provider transaction CI checks

---
 src/rpc/evo.cpp                   | 2 +-
 src/test/interfaces_tests.cpp     | 8 +++++++-
 test/util/data/non-backported.txt | 1 +
 3 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/src/rpc/evo.cpp b/src/rpc/evo.cpp
index 63a3cbb16850..3d5f7702beed 100644
--- a/src/rpc/evo.cpp
+++ b/src/rpc/evo.cpp
@@ -356,7 +356,7 @@ static std::unique_ptr<interfaces::Wallet> MakeWalletInterface(const NodeContext
     case ProviderTxErrorCode::BROADCAST_ERROR:
         throw JSONRPCTransactionError(*CHECK_NONFATAL(provider_error.transaction_error), provider_error.message.original);
     }
-    assert(false);
+    NONFATAL_UNREACHABLE();
 }
 
 static std::string SubmissionToString(const interfaces::ProviderTxSubmission& submission)
diff --git a/src/test/interfaces_tests.cpp b/src/test/interfaces_tests.cpp
index 63c241ff6575..6dfd816b0721 100644
--- a/src/test/interfaces_tests.cpp
+++ b/src/test/interfaces_tests.cpp
@@ -113,6 +113,7 @@ BOOST_AUTO_TEST_CASE(providerNetInfoValidation)
     BOOST_CHECK(error->message.original.find("only accepts a bare port number") != std::string::npos);
 
     net_info = {
+        .core_p2p = {},
         .platform_p2p = std::vector<std::string>{"1.1.1.2:22200"},
         .platform_https = std::vector<std::string>{"server.example.com:443"},
     };
@@ -120,7 +121,11 @@ BOOST_AUTO_TEST_CASE(providerNetInfoValidation)
     BOOST_REQUIRE(error);
     BOOST_CHECK_EQUAL(error->reject_reason, "bad-protx-netinfo-empty");
 
-    net_info = {.core_p2p = {"1.1.1.1:9998"}};
+    net_info = {
+        .core_p2p = {"1.1.1.1:9998"},
+        .platform_p2p = std::monostate{},
+        .platform_https = std::monostate{},
+    };
     error = node->evo().validateProviderNetInfo(net_info, MnType::Evo, ProTxVersion::ExtAddr, /*optional=*/true);
     BOOST_REQUIRE(error);
     BOOST_CHECK(error->message.original.find("platformP2PAddrs, cannot be empty if other fields populated") !=
@@ -135,6 +140,7 @@ BOOST_AUTO_TEST_CASE(providerNetInfoValidation)
     net_info = {
         .core_p2p = {"1.1.1.1:9998"},
         .platform_p2p = std::vector<std::string>{"1.1.1.2:22200"},
+        .platform_https = std::monostate{},
     };
     error = node->evo().validateProviderNetInfo(net_info, MnType::Evo, ProTxVersion::ExtAddr, /*optional=*/true);
     BOOST_REQUIRE(error);
diff --git a/test/util/data/non-backported.txt b/test/util/data/non-backported.txt
index f759bb01a1e1..099a411e88e1 100644
--- a/test/util/data/non-backported.txt
+++ b/test/util/data/non-backported.txt
@@ -25,6 +25,7 @@ src/index/spent*.cpp
 src/index/spent*.h
 src/index/timestamp*.cpp
 src/index/timestamp*.h
+src/interfaces/providertx.h
 src/instantsend/*.cpp
 src/instantsend/*.h
 src/llmq/*.cpp