The wallet process that selects other blockchain outputs to accompany the real output in a transaction input ring. The selection distribution matters because observers can compare the characteristics of ring members.
Also called: decoy sampling.
Selecting candidates before signing
A spending wallet first identifies the output it controls and obtains other eligible outputs for the ring. The current standard ring has 16 members, so one real output appears with 15 decoys.
Decoy selection needs no action from the owners of those outputs. Their spending authority remains unchanged when the wallet references their outputs in its ring. The wallet then builds the required signature for its actual input.
References: Monero source: wallet/wallet2.cpp · Monero source: cryptonote_core/blockchain.cpp
Sampling output ages
Uniformly choosing from all old outputs would not necessarily resemble how users spend real outputs. An observer could compare ages and favor a candidate whose age looks more plausible for an actual spend.
The reviewed wallet implementation uses a gamma-based age sampler and accounts for the minimum spendable age. It maps sampled ages into output positions using chain output-distribution data. The selection method and its handling of eligible outputs affect the resulting age distribution.
References: Monero source: wallet/wallet2.cpp
A ring containing an older output
Suppose a wallet spends an output it received some time ago. Its decoys need not all have exactly the same age, and a visible old member is not proof that it is the real one. The observer sees a set of candidates rather than the wallet's selection label.
A malicious or unreliable remote node can affect the data supplied to the wallet. Wallet checks and current software matter, but a ring signature does not certify the accuracy of every response from the node.
References: Monero source: wallet/wallet2.cpp · Remote node documentation
Ring size and effective privacy
A ring with 16 members does not establish equal probability for all members. Outside records or statistical evidence can change an observer's assessment even when the signature verifies correctly.
Decoy selection concerns which outputs appear in the ring. CLSAG concerns the proof over that ring. Key images address repeat spending. Keeping those jobs separate helps explain why changing one component is not a complete privacy solution.
References: Monero source: cryptonote_core/blockchain.cpp · Monero source: wallet/wallet2.cpp · Monero source: ringct/rctSigs.cpp
Related glossary terms
Practical guides
Technical baseline: v0.18.5.4. Reviewed 2026-11-08 UTC.