update changelogs

location and version needed in gateway settings updates

.github/workflows/build-and-upload-binaries-ci.yml

@@ -80,7 +80,7 @@ jobs:
           components: rustfmt, clippy
 
       - name: Install wasm-opt
-        run: cargo install --version 0.110.0 wasm-opt
+        run: cargo install --version 0.112.0 wasm-opt
 
       - name: Build release contracts
         run: make wasm

.github/workflows/contracts-build.yml

@@ -20,7 +20,7 @@ jobs:
           components: rustfmt, clippy
 
       - name: Install wasm-opt
-        run: cargo install --version 0.110.0 wasm-opt
+        run: cargo install --version 0.112.0 wasm-opt
 
       - name: Build release contracts
         run: make wasm

CHANGELOG.md

@@ -4,6 +4,20 @@ Post 1.0.0 release, the changelog format is based on [Keep a Changelog](https://
 
 ## [Unreleased]
 
+## [v1.1.14] (2023-04-04)
+
+- Investigate cause of qwerty validator being in invalid rewarding state ([#3224])
+- Fix NR config due to changes in #3199 ([#3223])
+- [Issue] Mixnodes and gateway do not close connections properly  ([#3187])
+- disable sign-ext when using wasm-opt + update wasm-opt ([#3203])
+- chore: tidy up client `Debug` config section ([#3199])
+
+[#3224]: https://github.com/nymtech/nym/issues/3224
+[#3223]: https://github.com/nymtech/nym/issues/3223
+[#3187]: https://github.com/nymtech/nym/issues/3187
+[#3203]: https://github.com/nymtech/nym/pull/3203
+[#3199]: https://github.com/nymtech/nym/pull/3199
+
 ## [v1.1.13] (2023-03-15)
 
 - NE - instead of throwing a "Mixnode/Gateway not found" error for blacklisted nodes due to bad performance, show their history but tag them as "Having poor performance" ([#2979])

Cargo.toml

@@ -22,7 +22,6 @@ members = [
     "clients/native",
     "clients/native/websocket-requests",
     "clients/socks5",
-    "common/bandwidth-claim-contract",
     "common/bin-common",
     "common/client-libs/gateway-client",
     "common/client-libs/mixnet-client",
@@ -106,6 +105,7 @@ license = "Apache-2.0"
 
 [workspace.dependencies]
 async-trait = "0.1.64"
+bip39 = { version = "2.0.0", features = ["zeroize"] }
 cfg-if = "1.0.0"
 cosmwasm-derive = "=1.0.0"
 cosmwasm-schema = "=1.0.0"

Makefile

@@ -1,143 +1,90 @@
+# Default target
+all: test
+
 test: clippy-all cargo-test wasm fmt
-test-no-mobile: clippy-all-no-mobile cargo-test-no-mobile wasm fmt-no-mobile
+
 test-all: test cargo-test-expensive
-test-all-no-mobile: test-no-mobile cargo-test-expensive
+
 no-clippy: build cargo-test wasm fmt
-no-clippy-no-mobile: build-no-mobile cargo-test-no-mobile wasm fmt-no-mobile
+
 happy: fmt clippy-happy test
-happy-no-mobile: fmt-no-mobile clippy-happy-no-mobile test-no-mobile
-clippy-all: clippy-all-no-mobile clippy-all-connect-mobile
-clippy-all-no-mobile: clippy-main clippy-main-examples clippy-all-contracts clippy-all-wallet clippy-all-connect clippy-all-wasm-client
-clippy-happy: clippy-happy-no-mobile clippy-happy-connect-mobile
-clippy-happy-no-mobile: clippy-happy-main clippy-happy-contracts clippy-happy-wallet clippy-happy-connect
-cargo-test: cargo-test-no-mobile test-connect-mobile
-cargo-test-no-mobile: test-main test-contracts test-wallet test-connect 
-cargo-test-expensive: test-main-expensive test-contracts-expensive test-wallet-expensive test-connect-expensive
-build: build-no-mobile build-connect-mobile 
-build-no-mobile: build-contracts build-wallet build-main build-main-examples build-connect build-wasm-client 
-fmt: fmt-no-mobile fmt-connect-mobile
-fmt-no-mobile: fmt-main fmt-contracts fmt-wallet fmt-connect fmt-wasm-client
 
-clippy-happy-main:
-	cargo clippy
+# -----------------------------------------------------------------------------
+# Define targets for a given workspace
+#  $(1): name
+#  $(2): path to workspace
+#  $(3): extra arguments to cargo
+# -----------------------------------------------------------------------------
+define add_cargo_workspace
 
-clippy-happy-contracts:
-	cargo clippy --manifest-path contracts/Cargo.toml --target wasm32-unknown-unknown
+clippy-happy-$(1):
+	cargo clippy --manifest-path $(2)/Cargo.toml $(3)
 
-clippy-happy-wallet:
-	cargo clippy --manifest-path nym-wallet/Cargo.toml
+clippy-$(1):
+	cargo clippy --manifest-path $(2)/Cargo.toml --workspace $(3) -- -D warnings
 
-clippy-happy-connect:
-	cargo clippy --manifest-path nym-connect/desktop/Cargo.toml
+clippy-$(1)-examples:
+	cargo clippy --manifest-path $(2)/Cargo.toml --workspace --examples -- -D warnings
 
-clippy-happy-connect-mobile:
-	cargo clippy --manifest-path nym-connect/mobile/src-tauri/Cargo.toml
+test-$(1):
+	cargo test --manifest-path $(2)/Cargo.toml --workspace
 
-clippy-main:
-	cargo clippy --workspace -- -D warnings
+test-$(1)-expensive:
+	cargo test --manifest-path $(2)/Cargo.toml --workspace -- --ignored
 
-clippy-main-examples:
-	cargo clippy --workspace --examples -- -D warnings
+build-$(1):
+	cargo build --manifest-path $(2)/Cargo.toml --workspace $(3)
 
-clippy-wasm:
-	cargo clippy --manifest-path clients/webassembly/Cargo.toml --target wasm32-unknown-unknown --workspace -- -D warnings
+build-$(1)-examples:
+	cargo build --manifest-path $(2)/Cargo.toml --workspace --examples
 
+fmt-$(1):
+	cargo fmt --manifest-path $(2)/Cargo.toml --all
 
-clippy-all-contracts:
-	cargo clippy --workspace --manifest-path contracts/Cargo.toml --all-features --target wasm32-unknown-unknown -- -D warnings
+clippy-happy: clippy-happy-$(1)
+clippy-all: clippy-$(1) clippy-$(1)-examples
+cargo-test: test-$(1)
+cargo-test-expensive: test-$(1)-expensive
+build: build-$(1) build-$(1)-examples
+fmt: fmt-$(1)
 
-clippy-all-wallet:
-	cargo clippy --workspace --manifest-path nym-wallet/Cargo.toml --all-features -- -D warnings
+endef
 
-clippy-all-connect:
-	cargo clippy --workspace --manifest-path nym-connect/desktop/Cargo.toml --all-features -- -D warnings
+# -----------------------------------------------------------------------------
+# Rust workspaces
+# -----------------------------------------------------------------------------
 
-clippy-all-connect-mobile:
-	cargo clippy --workspace --manifest-path nym-connect/mobile/src-tauri/Cargo.toml --all-features -- -D warnings
+# Generate targets for the various cargo workspaces
 
-clippy-all-wasm-client:
-	cargo clippy --workspace --manifest-path clients/webassembly/Cargo.toml --all-features --target wasm32-unknown-unknown -- -D warnings
+$(eval $(call add_cargo_workspace,main,.))
+$(eval $(call add_cargo_workspace,contracts,contracts,--target wasm32-unknown-unknown))
+$(eval $(call add_cargo_workspace,wasm-client,clients/webassembly,--target wasm32-unknown-unknown))
+$(eval $(call add_cargo_workspace,wallet,nym-wallet,))
+$(eval $(call add_cargo_workspace,connect,nym-connect/desktop))
+ifndef NYM_NO_MOBILE
+$(eval $(call add_cargo_workspace,connect-mobile,nym-connect/mobile/src-tauri))
+endif
 
-test-main:
-	cargo test --workspace
-
-test-main-expensive:
-	cargo test --workspace -- --ignored
-
-test-contracts:
-	cargo test --manifest-path contracts/Cargo.toml --all-features
-
-test-contracts-expensive:
-	cargo test --manifest-path contracts/Cargo.toml --all-features -- --ignored
-
-test-wallet:
-	cargo test --manifest-path nym-wallet/Cargo.toml --all-features
-
-test-wallet-expensive:
-	cargo test --manifest-path nym-wallet/Cargo.toml --all-features -- --ignored
-
-test-connect:
-	cargo test --manifest-path nym-connect/desktop/Cargo.toml --all-features
-
-test-connect-expensive:
-	cargo test --manifest-path nym-connect/desktop/Cargo.toml --all-features -- --ignored
-
-test-connect-mobile:
-	cargo test --manifest-path nym-connect/mobile/src-tauri/Cargo.toml --all-features
-
-test-connect-mobile-expensive:
-	cargo test --manifest-path nym-connect/mobile/src-tauri/Cargo.toml --all-features -- --ignored
-
-build-main:
-	cargo build --workspace
-
-build-main-examples:
-	cargo build --workspace --examples
-
-build-contracts:
-	cargo build --manifest-path contracts/Cargo.toml --workspace
-
-build-wallet:
-	cargo build --manifest-path nym-wallet/Cargo.toml --workspace
-
-build-connect:
-	cargo build --manifest-path nym-connect/desktop/Cargo.toml --workspace
-
-build-connect-mobile:
-	cargo build --manifest-path nym-connect/mobile/src-tauri/Cargo.toml --workspace
+# -----------------------------------------------------------------------------
+# Convenience targets for crates that are already part of the main workspace
+# -----------------------------------------------------------------------------
 
 build-explorer-api:
-	cargo build --manifest-path explorer-api/Cargo.toml --workspace
-
-build-wasm-client:
-	cargo build --manifest-path clients/webassembly/Cargo.toml --workspace --target wasm32-unknown-unknown
+	cargo build -p explorer-api
 
 build-nym-cli:
-	cargo build --release --manifest-path tools/nym-cli/Cargo.toml
+	cargo build -p nym-cli --release
 
-fmt-main:
-	cargo fmt --all
-
-fmt-contracts:
-	cargo fmt --manifest-path contracts/Cargo.toml --all
-
-fmt-wallet:
-	cargo fmt --manifest-path nym-wallet/Cargo.toml --all
-
-fmt-connect:
-	cargo fmt --manifest-path nym-connect/desktop/Cargo.toml --all
-
-fmt-connect-mobile:
-	cargo fmt --manifest-path nym-connect/mobile/src-tauri/Cargo.toml --all
-
-fmt-wasm-client:
-	cargo fmt --manifest-path clients/webassembly/Cargo.toml --all
+# -----------------------------------------------------------------------------
+# Misc
+# -----------------------------------------------------------------------------
 
 wasm:
 	RUSTFLAGS='-C link-arg=-s' cargo build --manifest-path contracts/Cargo.toml --release --target wasm32-unknown-unknown
-	wasm-opt -Os contracts/target/wasm32-unknown-unknown/release/vesting_contract.wasm -o contracts/target/wasm32-unknown-unknown/release/vesting_contract.wasm
-	wasm-opt -Os contracts/target/wasm32-unknown-unknown/release/mixnet_contract.wasm -o contracts/target/wasm32-unknown-unknown/release/mixnet_contract.wasm
+	wasm-opt --disable-sign-ext -Os contracts/target/wasm32-unknown-unknown/release/vesting_contract.wasm -o contracts/target/wasm32-unknown-unknown/release/vesting_contract.wasm
+	wasm-opt --disable-sign-ext -Os contracts/target/wasm32-unknown-unknown/release/mixnet_contract.wasm -o contracts/target/wasm32-unknown-unknown/release/mixnet_contract.wasm
 
+# NOTE: this seems deprecated an not needed anymore?
 mixnet-opt: wasm
 	cd contracts/mixnet && make opt
 

clients/client-core/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "client-core"
-version = "1.1.13"
+version = "1.1.14"
 authors = ["Dave Hrycyszyn <futurechimp@users.noreply.github.com>"]
 edition = "2021"
 rust-version = "1.66"

clients/client-core/src/client/base_client/helpers.rs

@@ -5,7 +5,11 @@ use crate::{client::replies::reply_storage, config::DebugConfig};
 
 pub fn setup_empty_reply_surb_backend(debug_config: &DebugConfig) -> reply_storage::Empty {
     reply_storage::Empty {
-        min_surb_threshold: debug_config.minimum_reply_surb_storage_threshold,
-        max_surb_threshold: debug_config.maximum_reply_surb_storage_threshold,
+        min_surb_threshold: debug_config
+            .reply_surbs
+            .minimum_reply_surb_storage_threshold,
+        max_surb_threshold: debug_config
+            .reply_surbs
+            .maximum_reply_surb_storage_threshold,
     }
 }

clients/client-core/src/client/base_client/mod.rs

@@ -35,7 +35,7 @@ use nym_crypto::asymmetric::{encryption, identity};
 use nym_sphinx::acknowledgements::AckKey;
 use nym_sphinx::addressing::clients::Recipient;
 use nym_sphinx::addressing::nodes::NodeIdentity;
-use nym_sphinx::receiver::ReconstructedMessage;
+use nym_sphinx::receiver::{ReconstructedMessage, SphinxMessageReceiver};
 use nym_task::connections::{ConnectionCommandReceiver, ConnectionCommandSender, LaneQueueLengths};
 use nym_task::{TaskClient, TaskManager};
 use nym_topology::provider_trait::TopologyProvider;
@@ -236,15 +236,15 @@ where
 
         let mut stream = LoopCoverTrafficStream::new(
             ack_key,
-            debug_config.average_ack_delay,
-            debug_config.average_packet_delay,
-            debug_config.loop_cover_traffic_average_delay,
+            debug_config.acknowledgements.average_ack_delay,
+            debug_config.traffic.average_packet_delay,
+            debug_config.cover_traffic.loop_cover_traffic_average_delay,
             mix_tx,
             self_address,
             topology_accessor,
         );
 
-        if let Some(size) = debug_config.use_extended_packet_size {
+        if let Some(size) = debug_config.traffic.use_extended_packet_size {
             log::debug!("Setting extended packet size: {:?}", size);
             stream.set_custom_packet_size(size.into());
         }
@@ -294,14 +294,15 @@ where
         shutdown: TaskClient,
     ) {
         info!("Starting received messages buffer controller...");
-        ReceivedMessagesBufferController::new(
-            local_encryption_keypair,
-            query_receiver,
-            mixnet_receiver,
-            reply_key_storage,
-            reply_controller_sender,
-        )
-        .start_with_shutdown(shutdown)
+        let controller: ReceivedMessagesBufferController<SphinxMessageReceiver> =
+            ReceivedMessagesBufferController::new(
+                local_encryption_keypair,
+                query_receiver,
+                mixnet_receiver,
+                reply_key_storage,
+                reply_controller_sender,
+            );
+        controller.start_with_shutdown(shutdown)
     }
 
     async fn start_gateway_client(
@@ -337,7 +338,9 @@ where
             shared_key,
             mixnet_message_sender,
             ack_sender,
-            self.debug_config.gateway_response_timeout,
+            self.debug_config
+                .gateway_connection
+                .gateway_response_timeout,
             self.bandwidth_controller.take(),
             shutdown,
         );
@@ -499,7 +502,7 @@ where
         );
         Self::start_topology_refresher(
             topology_provider,
-            self.debug_config.topology_refresh_rate,
+            self.debug_config.topology.topology_refresh_rate,
             shared_topology_accessor.clone(),
             task_manager.subscribe(),
         )
@@ -535,7 +538,7 @@ where
             self_address,
         );
 
-        if let Some(size) = self.debug_config.use_extended_packet_size {
+        if let Some(size) = self.debug_config.traffic.use_extended_packet_size {
             log::debug!("Setting extended packet size: {:?}", size);
             controller_config.set_custom_packet_size(size.into());
         }
@@ -554,7 +557,11 @@ where
             task_manager.subscribe(),
         );
 
-        if !self.debug_config.disable_loop_cover_traffic_stream {
+        if !self
+            .debug_config
+            .cover_traffic
+            .disable_loop_cover_traffic_stream
+        {
             Self::start_cover_traffic_stream(
                 self.debug_config,
                 self.key_manager.ack_key(),

clients/client-core/src/client/base_client/non_wasm_helpers.rs

@@ -30,8 +30,12 @@ async fn setup_fresh_backend<P: AsRef<Path>>(
     // it will only be happening on the very first run and in practice won't incur huge
     // costs since the storage is going to be empty
     let mem_store = CombinedReplyStorage::new(
-        debug_config.minimum_reply_surb_storage_threshold,
-        debug_config.maximum_reply_surb_storage_threshold,
+        debug_config
+            .reply_surbs
+            .minimum_reply_surb_storage_threshold,
+        debug_config
+            .reply_surbs
+            .maximum_reply_surb_storage_threshold,
     );
     storage_backend
         .init_fresh(&mem_store)
@@ -46,8 +50,12 @@ async fn setup_fresh_backend<P: AsRef<Path>>(
 fn setup_inactive_backend(debug_config: &DebugConfig) -> fs_backend::Backend {
     info!("creating inactive surb database");
     fs_backend::Backend::new_inactive(
-        debug_config.minimum_reply_surb_storage_threshold,
-        debug_config.maximum_reply_surb_storage_threshold,
+        debug_config
+            .reply_surbs
+            .minimum_reply_surb_storage_threshold,
+        debug_config
+            .reply_surbs
+            .maximum_reply_surb_storage_threshold,
     )
 }
 

clients/client-core/src/client/real_messages_control/mod.rs

@@ -153,25 +153,35 @@ impl Config {
             ack_key,
             self_recipient,
             packet_size: Default::default(),
-            ack_wait_addition: base_client_debug_config.ack_wait_addition,
-            ack_wait_multiplier: base_client_debug_config.ack_wait_multiplier,
-            average_message_sending_delay: base_client_debug_config.message_sending_average_delay,
-            average_packet_delay_duration: base_client_debug_config.average_packet_delay,
-            average_ack_delay_duration: base_client_debug_config.average_ack_delay,
+            ack_wait_addition: base_client_debug_config.acknowledgements.ack_wait_addition,
+            ack_wait_multiplier: base_client_debug_config
+                .acknowledgements
+                .ack_wait_multiplier,
+            average_message_sending_delay: base_client_debug_config
+                .traffic
+                .message_sending_average_delay,
+            average_packet_delay_duration: base_client_debug_config.traffic.average_packet_delay,
+            average_ack_delay_duration: base_client_debug_config.acknowledgements.average_ack_delay,
             disable_main_poisson_packet_distribution: base_client_debug_config
+                .traffic
                 .disable_main_poisson_packet_distribution,
             minimum_reply_surb_request_size: base_client_debug_config
+                .reply_surbs
                 .minimum_reply_surb_request_size,
             maximum_reply_surb_request_size: base_client_debug_config
+                .reply_surbs
                 .maximum_reply_surb_request_size,
             maximum_allowed_reply_surb_request_size: base_client_debug_config
+                .reply_surbs
                 .maximum_allowed_reply_surb_request_size,
             maximum_reply_surb_rerequest_waiting_period: base_client_debug_config
+                .reply_surbs
                 .maximum_reply_surb_rerequest_waiting_period,
             maximum_reply_surb_drop_waiting_period: base_client_debug_config
+                .reply_surbs
                 .maximum_reply_surb_drop_waiting_period,
-            maximum_reply_surb_age: base_client_debug_config.maximum_reply_surb_age,
-            maximum_reply_key_age: base_client_debug_config.maximum_reply_key_age,
+            maximum_reply_surb_age: base_client_debug_config.reply_surbs.maximum_reply_surb_age,
+            maximum_reply_key_age: base_client_debug_config.reply_surbs.maximum_reply_key_age,
         }
     }
 

clients/client-core/src/client/received_buffer.rs

@@ -30,13 +30,13 @@ pub type ReceivedBufferRequestReceiver = mpsc::UnboundedReceiver<ReceivedBufferM
 pub type ReconstructedMessagesSender = mpsc::UnboundedSender<Vec<ReconstructedMessage>>;
 pub type ReconstructedMessagesReceiver = mpsc::UnboundedReceiver<Vec<ReconstructedMessage>>;
 
-struct ReceivedMessagesBufferInner {
+struct ReceivedMessagesBufferInner<R: MessageReceiver> {
     messages: Vec<ReconstructedMessage>,
     local_encryption_keypair: Arc<encryption::KeyPair>,
 
     // TODO: looking how it 'looks' here, perhaps `MessageReceiver` should be renamed to something
     // else instead.
-    message_receiver: MessageReceiver,
+    message_receiver: R,
     message_sender: Option<ReconstructedMessagesSender>,
 
     // TODO: this will get cleared upon re-running the client
@@ -45,7 +45,7 @@ struct ReceivedMessagesBufferInner {
     recently_reconstructed: HashSet<i32>,
 }
 
-impl ReceivedMessagesBufferInner {
+impl<R: MessageReceiver> ReceivedMessagesBufferInner<R> {
     fn recover_from_fragment(&mut self, fragment_data: &[u8]) -> Option<NymMessage> {
         if nym_sphinx::cover::is_cover(fragment_data) {
             trace!("The message was a loop cover message! Skipping it");
@@ -102,13 +102,13 @@ impl ReceivedMessagesBufferInner {
         &mut self,
         reply_ciphertext: &mut [u8],
         reply_key: SurbEncryptionKey,
-    ) -> Option<NymMessage> {
+    ) -> Result<Option<NymMessage>, MessageRecoveryError> {
         // note: this performs decryption IN PLACE without extra allocation
         self.message_receiver
-            .recover_plaintext_from_reply(reply_ciphertext, reply_key);
+            .recover_plaintext_from_reply(reply_ciphertext, reply_key)?;
         let fragment_data = reply_ciphertext;
 
-        self.recover_from_fragment(fragment_data)
+        Ok(self.recover_from_fragment(fragment_data))
     }
 
     fn process_received_regular_packet(&mut self, mut raw_fragment: Vec<u8>) -> Option<NymMessage> {
@@ -130,13 +130,13 @@ impl ReceivedMessagesBufferInner {
 #[derive(Debug, Clone)]
 // Note: you should NEVER create more than a single instance of this using 'new()'.
 // You should always use .clone() to create additional instances
-struct ReceivedMessagesBuffer {
-    inner: Arc<Mutex<ReceivedMessagesBufferInner>>,
+struct ReceivedMessagesBuffer<R: MessageReceiver> {
+    inner: Arc<Mutex<ReceivedMessagesBufferInner<R>>>,
     reply_key_storage: SentReplyKeys,
     reply_controller_sender: ReplyControllerSender,
 }
 
-impl ReceivedMessagesBuffer {
+impl<R: MessageReceiver> ReceivedMessagesBuffer<R> {
     fn new(
         local_encryption_keypair: Arc<encryption::KeyPair>,
         reply_key_storage: SentReplyKeys,
@@ -146,7 +146,7 @@ impl ReceivedMessagesBuffer {
             inner: Arc::new(Mutex::new(ReceivedMessagesBufferInner {
                 messages: Vec::new(),
                 local_encryption_keypair,
-                message_receiver: MessageReceiver::new(),
+                message_receiver: R::new(),
                 message_sender: None,
                 recently_reconstructed: HashSet::new(),
             })),
@@ -328,7 +328,10 @@ impl ReceivedMessagesBuffer {
             })
     }
 
-    async fn handle_new_received(&mut self, msgs: Vec<Vec<u8>>) {
+    async fn handle_new_received(
+        &mut self,
+        msgs: Vec<Vec<u8>>,
+    ) -> Result<(), MessageRecoveryError> {
         trace!(
             "Processing {:?} new message that might get added to the buffer!",
             msgs.len()
@@ -344,7 +347,7 @@ impl ReceivedMessagesBuffer {
             // if yes - this is a reply message
             let completed_message =
                 if let Some((reply_key, reply_message)) = self.get_reply_key(&mut msg) {
-                    inner_guard.process_received_reply(reply_message, reply_key)
+                    inner_guard.process_received_reply(reply_message, reply_key)?
                 } else {
                     inner_guard.process_received_regular_packet(msg)
                 };
@@ -360,6 +363,7 @@ impl ReceivedMessagesBuffer {
         if !completed_messages.is_empty() {
             self.handle_reconstructed_messages(completed_messages).await
         }
+        Ok(())
     }
 }
 
@@ -372,14 +376,14 @@ pub enum ReceivedBufferMessage {
     ReceiverDisconnect,
 }
 
-struct RequestReceiver {
-    received_buffer: ReceivedMessagesBuffer,
+struct RequestReceiver<R: MessageReceiver> {
+    received_buffer: ReceivedMessagesBuffer<R>,
     query_receiver: ReceivedBufferRequestReceiver,
 }
 
-impl RequestReceiver {
+impl<R: MessageReceiver> RequestReceiver<R> {
     fn new(
-        received_buffer: ReceivedMessagesBuffer,
+        received_buffer: ReceivedMessagesBuffer<R>,
         query_receiver: ReceivedBufferRequestReceiver,
     ) -> Self {
         RequestReceiver {
@@ -422,14 +426,14 @@ impl RequestReceiver {
     }
 }
 
-struct FragmentedMessageReceiver {
-    received_buffer: ReceivedMessagesBuffer,
+struct FragmentedMessageReceiver<R: MessageReceiver> {
+    received_buffer: ReceivedMessagesBuffer<R>,
     mixnet_packet_receiver: MixnetMessageReceiver,
 }
 
-impl FragmentedMessageReceiver {
+impl<R: MessageReceiver> FragmentedMessageReceiver<R> {
     fn new(
-        received_buffer: ReceivedMessagesBuffer,
+        received_buffer: ReceivedMessagesBuffer<R>,
         mixnet_packet_receiver: MixnetMessageReceiver,
     ) -> Self {
         FragmentedMessageReceiver {
@@ -438,13 +442,16 @@ impl FragmentedMessageReceiver {
         }
     }
 
-    async fn run_with_shutdown(&mut self, mut shutdown: nym_task::TaskClient) {
+    async fn run_with_shutdown(
+        &mut self,
+        mut shutdown: nym_task::TaskClient,
+    ) -> Result<(), MessageRecoveryError> {
         debug!("Started FragmentedMessageReceiver with graceful shutdown support");
         while !shutdown.is_shutdown() {
             tokio::select! {
                 new_messages = self.mixnet_packet_receiver.next() => {
                     if let Some(new_messages) = new_messages {
-                        self.received_buffer.handle_new_received(new_messages).await;
+                        self.received_buffer.handle_new_received(new_messages).await?;
                     } else {
                         log::trace!("FragmentedMessageReceiver: Stopping since channel closed");
                         break;
@@ -457,15 +464,16 @@ impl FragmentedMessageReceiver {
         }
         shutdown.recv_timeout().await;
         log::debug!("FragmentedMessageReceiver: Exiting");
+        Ok(())
     }
 }
 
-pub(crate) struct ReceivedMessagesBufferController {
-    fragmented_message_receiver: FragmentedMessageReceiver,
-    request_receiver: RequestReceiver,
+pub(crate) struct ReceivedMessagesBufferController<R: MessageReceiver> {
+    fragmented_message_receiver: FragmentedMessageReceiver<R>,
+    request_receiver: RequestReceiver<R>,
 }
 
-impl ReceivedMessagesBufferController {
+impl<R: MessageReceiver + Clone + Send + 'static> ReceivedMessagesBufferController<R> {
     pub(crate) fn new(
         local_encryption_keypair: Arc<encryption::KeyPair>,
         query_receiver: ReceivedBufferRequestReceiver,
@@ -494,9 +502,13 @@ impl ReceivedMessagesBufferController {
 
         let shutdown_handle = shutdown.clone();
         spawn_future(async move {
-            fragmented_message_receiver
+            match fragmented_message_receiver
                 .run_with_shutdown(shutdown_handle)
-                .await;
+                .await
+            {
+                Ok(_) => {}
+                Err(e) => error!("{e}"),
+            }
         });
         spawn_future(async move {
             request_receiver.run_with_shutdown(shutdown).await;

clients/client-core/src/client/replies/reply_storage/backend/browser_backend.rs

@@ -35,8 +35,12 @@ impl ReplyStorageBackend for Backend {
     ) -> Result<Self, Self::StorageError> {
         Ok(Backend {
             empty: Empty {
-                min_surb_threshold: debug_config.minimum_reply_surb_storage_threshold,
-                max_surb_threshold: debug_config.maximum_reply_surb_storage_threshold,
+                min_surb_threshold: debug_config
+                    .reply_surbs
+                    .minimum_reply_surb_storage_threshold,
+                max_surb_threshold: debug_config
+                    .reply_surbs
+                    .maximum_reply_surb_storage_threshold,
             },
         })
     }

clients/client-core/src/client/replies/reply_storage/backend/mod.rs

@@ -35,8 +35,12 @@ impl ReplyStorageBackend for Empty {
         _db_path: Option<PathBuf>,
     ) -> Result<Self, Self::StorageError> {
         Ok(Self {
-            min_surb_threshold: debug_config.minimum_reply_surb_storage_threshold,
-            max_surb_threshold: debug_config.maximum_reply_surb_storage_threshold,
+            min_surb_threshold: debug_config
+                .reply_surbs
+                .minimum_reply_surb_storage_threshold,
+            max_surb_threshold: debug_config
+                .reply_surbs
+                .maximum_reply_surb_storage_threshold,
         })
     }
 

clients/client-core/src/config/mod.rs

@@ -13,6 +13,7 @@ use url::Url;
 #[cfg(target_arch = "wasm32")]
 use wasm_bindgen::prelude::*;
 
+pub mod old_config_v1_1_13;
 pub mod persistence;
 
 pub const MISSING_VALUE: &str = "MISSING VALUE";
@@ -210,11 +211,12 @@ impl<T> Config<T> {
     }
 
     pub fn set_high_default_traffic_volume(&mut self) {
-        self.debug.average_packet_delay = Duration::from_millis(10);
+        self.debug.traffic.average_packet_delay = Duration::from_millis(10);
         // basically don't really send cover messages
-        self.debug.loop_cover_traffic_average_delay = Duration::from_millis(2_000_000);
+        self.debug.cover_traffic.loop_cover_traffic_average_delay =
+            Duration::from_millis(2_000_000);
         // 250 "real" messages / s
-        self.debug.message_sending_average_delay = Duration::from_millis(4);
+        self.debug.traffic.message_sending_average_delay = Duration::from_millis(4);
     }
 
     pub fn with_disabled_cover_traffic(mut self, disabled: bool) -> Self {
@@ -225,8 +227,8 @@ impl<T> Config<T> {
     }
 
     pub fn set_no_cover_traffic(&mut self) {
-        self.debug.disable_loop_cover_traffic_stream = true;
-        self.debug.disable_main_poisson_packet_distribution = true;
+        self.debug.cover_traffic.disable_loop_cover_traffic_stream = true;
+        self.debug.traffic.disable_main_poisson_packet_distribution = true;
     }
 
     pub fn set_custom_version(&mut self, version: &str) {
@@ -311,87 +313,93 @@ impl<T> Config<T> {
     }
 
     pub fn get_average_packet_delay(&self) -> Duration {
-        self.debug.average_packet_delay
+        self.debug.traffic.average_packet_delay
     }
 
     pub fn get_average_ack_delay(&self) -> Duration {
-        self.debug.average_ack_delay
+        self.debug.acknowledgements.average_ack_delay
     }
 
     pub fn get_ack_wait_multiplier(&self) -> f64 {
-        self.debug.ack_wait_multiplier
+        self.debug.acknowledgements.ack_wait_multiplier
     }
 
     pub fn get_ack_wait_addition(&self) -> Duration {
-        self.debug.ack_wait_addition
+        self.debug.acknowledgements.ack_wait_addition
     }
 
     pub fn get_loop_cover_traffic_average_delay(&self) -> Duration {
-        self.debug.loop_cover_traffic_average_delay
+        self.debug.cover_traffic.loop_cover_traffic_average_delay
     }
 
     pub fn get_message_sending_average_delay(&self) -> Duration {
-        self.debug.message_sending_average_delay
+        self.debug.traffic.message_sending_average_delay
     }
 
     pub fn get_gateway_response_timeout(&self) -> Duration {
-        self.debug.gateway_response_timeout
+        self.debug.gateway_connection.gateway_response_timeout
     }
 
     pub fn get_topology_refresh_rate(&self) -> Duration {
-        self.debug.topology_refresh_rate
+        self.debug.topology.topology_refresh_rate
     }
 
     pub fn get_topology_resolution_timeout(&self) -> Duration {
-        self.debug.topology_resolution_timeout
+        self.debug.topology.topology_resolution_timeout
     }
 
     pub fn get_disabled_loop_cover_traffic_stream(&self) -> bool {
-        self.debug.disable_loop_cover_traffic_stream
+        self.debug.cover_traffic.disable_loop_cover_traffic_stream
     }
 
     pub fn get_disabled_main_poisson_packet_distribution(&self) -> bool {
-        self.debug.disable_main_poisson_packet_distribution
+        self.debug.traffic.disable_main_poisson_packet_distribution
     }
 
     pub fn get_use_extended_packet_size(&self) -> Option<ExtendedPacketSize> {
-        self.debug.use_extended_packet_size
+        self.debug.traffic.use_extended_packet_size
     }
 
     pub fn get_minimum_reply_surb_storage_threshold(&self) -> usize {
-        self.debug.minimum_reply_surb_storage_threshold
+        self.debug.reply_surbs.minimum_reply_surb_storage_threshold
     }
 
     pub fn get_maximum_reply_surb_storage_threshold(&self) -> usize {
-        self.debug.maximum_reply_surb_storage_threshold
+        self.debug.reply_surbs.maximum_reply_surb_storage_threshold
     }
 
     pub fn get_minimum_reply_surb_request_size(&self) -> u32 {
-        self.debug.minimum_reply_surb_request_size
+        self.debug.reply_surbs.minimum_reply_surb_request_size
     }
 
     pub fn get_maximum_reply_surb_request_size(&self) -> u32 {
-        self.debug.maximum_reply_surb_request_size
+        self.debug.reply_surbs.maximum_reply_surb_request_size
     }
 
     pub fn get_maximum_allowed_reply_surb_request_size(&self) -> u32 {
-        self.debug.maximum_allowed_reply_surb_request_size
+        self.debug
+            .reply_surbs
+            .maximum_allowed_reply_surb_request_size
     }
 
     pub fn get_maximum_reply_surb_rerequest_waiting_period(&self) -> Duration {
-        self.debug.maximum_reply_surb_rerequest_waiting_period
+        self.debug
+            .reply_surbs
+            .maximum_reply_surb_rerequest_waiting_period
     }
 
     pub fn get_maximum_reply_surb_drop_waiting_period(&self) -> Duration {
-        self.debug.maximum_reply_surb_drop_waiting_period
+        self.debug
+            .reply_surbs
+            .maximum_reply_surb_drop_waiting_period
     }
 
     pub fn get_maximum_reply_surb_age(&self) -> Duration {
-        self.debug.maximum_reply_surb_age
+        self.debug.reply_surbs.maximum_reply_surb_age
     }
 
     pub fn get_maximum_reply_key_age(&self) -> Duration {
-        self.debug.maximum_reply_key_age
+        self.debug.reply_surbs.maximum_reply_key_age
     }
 }
 
@@ -450,63 +458,63 @@ impl From<nym_topology::gateway::Node> for GatewayEndpointConfig {
 pub struct Client<T> {
     /// Version of the client for which this configuration was created.
     #[serde(default = "missing_string_value")]
-    version: String,
+    pub version: String,
 
     /// ID specifies the human readable ID of this particular client.
-    id: String,
+    pub id: String,
 
     /// Indicates whether this client is running in a disabled credentials mode, thus attempting
     /// to claim bandwidth without presenting bandwidth credentials.
     #[serde(default)]
-    disabled_credentials_mode: bool,
+    pub disabled_credentials_mode: bool,
 
     /// Addresses to nyxd validators via which the client can communicate with the chain.
     #[serde(alias = "validator_urls")]
-    nyxd_urls: Vec<Url>,
+    pub nyxd_urls: Vec<Url>,
 
     /// Addresses to APIs running on validator from which the client gets the view of the network.
     #[serde(alias = "validator_api_urls")]
-    nym_api_urls: Vec<Url>,
+    pub nym_api_urls: Vec<Url>,
 
     /// Path to file containing private identity key.
-    private_identity_key_file: PathBuf,
+    pub private_identity_key_file: PathBuf,
 
     /// Path to file containing public identity key.
-    public_identity_key_file: PathBuf,
+    pub public_identity_key_file: PathBuf,
 
     /// Path to file containing private encryption key.
-    private_encryption_key_file: PathBuf,
+    pub private_encryption_key_file: PathBuf,
 
     /// Path to file containing public encryption key.
-    public_encryption_key_file: PathBuf,
+    pub public_encryption_key_file: PathBuf,
 
     /// Path to file containing shared key derived with the specified gateway that is used
     /// for all communication with it.
-    gateway_shared_key_file: PathBuf,
+    pub gateway_shared_key_file: PathBuf,
 
     /// Path to file containing key used for encrypting and decrypting the content of an
     /// acknowledgement so that nobody besides the client knows which packet it refers to.
-    ack_key_file: PathBuf,
+    pub ack_key_file: PathBuf,
 
     /// Information regarding how the client should send data to gateway.
-    gateway_endpoint: GatewayEndpointConfig,
+    pub gateway_endpoint: GatewayEndpointConfig,
 
     /// Path to the database containing bandwidth credentials of this client.
-    database_path: PathBuf,
+    pub database_path: PathBuf,
 
     /// Path to the persistent store for received reply surbs, unused encryption keys and used sender tags.
     // this was set to use #[serde(default)] for the purposes of compatibility for multi-surbs introduced in 1.1.4.
     // if you're reading this message and we have already introduced some breaking changes, feel free
     // to remove that attribute since at this point the client configs should have gotten regenerated
     #[serde(default)]
-    reply_surb_database_path: PathBuf,
+    pub reply_surb_database_path: PathBuf,
 
     /// nym_home_directory specifies absolute path to the home nym Clients directory.
     /// It is expected to use default value and hence .toml file should not redefine this field.
-    nym_root_directory: PathBuf,
+    pub nym_root_directory: PathBuf,
 
     #[serde(skip)]
-    super_struct: PhantomData<T>,
+    pub super_struct: PhantomData<T>,
 }
 
 impl<T: NymConfig> Default for Client<T> {
@@ -587,9 +595,9 @@ impl<T: NymConfig> Client<T> {
 #[serde(deny_unknown_fields)]
 pub struct Logging {}
 
-#[derive(Debug, Clone, Deserialize, PartialEq, Serialize)]
+#[derive(Debug, Clone, Copy, Deserialize, PartialEq, Serialize)]
 #[serde(default, deny_unknown_fields)]
-pub struct DebugConfig {
+pub struct Traffic {
     /// The parameter of Poisson distribution determining how long, on average,
     /// sent packet is going to be delayed at any given mix node.
     /// So for a packet going through three mix nodes, on average, it will take three times this value
@@ -597,6 +605,74 @@ pub struct DebugConfig {
     #[serde(with = "humantime_serde")]
     pub average_packet_delay: Duration,
 
+    /// The parameter of Poisson distribution determining how long, on average,
+    /// it is going to take another 'real traffic stream' message to be sent.
+    /// If no real packets are available and cover traffic is enabled,
+    /// a loop cover message is sent instead in order to preserve the rate.
+    #[serde(with = "humantime_serde")]
+    pub message_sending_average_delay: Duration,
+
+    /// Controls whether the main packet stream constantly produces packets according to the predefined
+    /// poisson distribution.
+    pub disable_main_poisson_packet_distribution: bool,
+
+    /// Controls whether the sent sphinx packet use a NON-DEFAULT bigger size.
+    pub use_extended_packet_size: Option<ExtendedPacketSize>,
+}
+
+impl Default for Traffic {
+    fn default() -> Self {
+        Traffic {
+            average_packet_delay: DEFAULT_AVERAGE_PACKET_DELAY,
+            message_sending_average_delay: DEFAULT_MESSAGE_STREAM_AVERAGE_DELAY,
+            disable_main_poisson_packet_distribution: false,
+            use_extended_packet_size: None,
+        }
+    }
+}
+
+#[derive(Debug, Clone, Copy, Deserialize, PartialEq, Serialize)]
+#[serde(default, deny_unknown_fields)]
+pub struct CoverTraffic {
+    /// The parameter of Poisson distribution determining how long, on average,
+    /// it is going to take for another loop cover traffic message to be sent.
+    #[serde(with = "humantime_serde")]
+    pub loop_cover_traffic_average_delay: Duration,
+
+    /// Controls whether the dedicated loop cover traffic stream should be enabled.
+    /// (and sending packets, on average, every [Self::loop_cover_traffic_average_delay])
+    pub disable_loop_cover_traffic_stream: bool,
+}
+
+impl Default for CoverTraffic {
+    fn default() -> Self {
+        CoverTraffic {
+            loop_cover_traffic_average_delay: DEFAULT_LOOP_COVER_STREAM_AVERAGE_DELAY,
+            disable_loop_cover_traffic_stream: false,
+        }
+    }
+}
+
+#[derive(Debug, Clone, Copy, Deserialize, PartialEq, Serialize)]
+#[serde(default, deny_unknown_fields)]
+pub struct GatewayConnection {
+    /// How long we're willing to wait for a response to a message sent to the gateway,
+    /// before giving up on it.
+    #[serde(with = "humantime_serde")]
+    pub gateway_response_timeout: Duration,
+}
+
+impl Default for GatewayConnection {
+    fn default() -> Self {
+        GatewayConnection {
+            gateway_response_timeout: DEFAULT_GATEWAY_RESPONSE_TIMEOUT,
+        }
+    }
+}
+
+#[derive(Debug, Clone, Copy, Deserialize, PartialEq, Serialize)]
+#[serde(default, deny_unknown_fields)]
+pub struct Acknowledgements {
     /// The parameter of Poisson distribution determining how long, on average,
     /// sent acknowledgement is going to be delayed at any given mix node.
     /// So for an ack going through three mix nodes, on average, it will take three times this value
@@ -614,24 +690,21 @@ pub struct DebugConfig {
     /// In an ideal network with 0 latency, this value would have been 0.
     #[serde(with = "humantime_serde")]
     pub ack_wait_addition: Duration,
+}
 
-    /// The parameter of Poisson distribution determining how long, on average,
-    /// it is going to take for another loop cover traffic message to be sent.
-    #[serde(with = "humantime_serde")]
-    pub loop_cover_traffic_average_delay: Duration,
-
-    /// The parameter of Poisson distribution determining how long, on average,
-    /// it is going to take another 'real traffic stream' message to be sent.
-    /// If no real packets are available and cover traffic is enabled,
-    /// a loop cover message is sent instead in order to preserve the rate.
-    #[serde(with = "humantime_serde")]
-    pub message_sending_average_delay: Duration,
-
-    /// How long we're willing to wait for a response to a message sent to the gateway,
-    /// before giving up on it.
-    #[serde(with = "humantime_serde")]
-    pub gateway_response_timeout: Duration,
+impl Default for Acknowledgements {
+    fn default() -> Self {
+        Acknowledgements {
+            average_ack_delay: DEFAULT_AVERAGE_PACKET_DELAY,
+            ack_wait_multiplier: DEFAULT_ACK_WAIT_MULTIPLIER,
+            ack_wait_addition: DEFAULT_ACK_WAIT_ADDITION,
+        }
+    }
+}
 
+#[derive(Debug, Clone, Copy, Deserialize, PartialEq, Serialize)]
+#[serde(default, deny_unknown_fields)]
+pub struct Topology {
     /// The uniform delay every which clients are querying the directory server
     /// to try to obtain a compatible network topology to send sphinx packets through.
     #[serde(with = "humantime_serde")]
@@ -642,18 +715,20 @@ pub struct DebugConfig {
     /// did not reach its destination.
     #[serde(with = "humantime_serde")]
     pub topology_resolution_timeout: Duration,
+}
 
-    /// Controls whether the dedicated loop cover traffic stream should be enabled.
-    /// (and sending packets, on average, every [Self::loop_cover_traffic_average_delay])
-    pub disable_loop_cover_traffic_stream: bool,
-
-    /// Controls whether the main packet stream constantly produces packets according to the predefined
-    /// poisson distribution.
-    pub disable_main_poisson_packet_distribution: bool,
-
-    /// Controls whether the sent sphinx packet use a NON-DEFAULT bigger size.
-    pub use_extended_packet_size: Option<ExtendedPacketSize>,
+impl Default for Topology {
+    fn default() -> Self {
+        Topology {
+            topology_refresh_rate: DEFAULT_TOPOLOGY_REFRESH_RATE,
+            topology_resolution_timeout: DEFAULT_TOPOLOGY_RESOLUTION_TIMEOUT,
+        }
+    }
+}
 
+#[derive(Debug, Clone, Copy, Deserialize, PartialEq, Serialize)]
+#[serde(default, deny_unknown_fields)]
+pub struct ReplySurbs {
     /// Defines the minimum number of reply surbs the client wants to keep in its storage at all times.
     /// It can only allow to go below that value if its to request additional reply surbs.
     pub minimum_reply_surb_storage_threshold: usize,
@@ -691,29 +766,9 @@ pub struct DebugConfig {
     pub maximum_reply_key_age: Duration,
 }
 
-#[derive(Clone, Copy, Debug, Serialize, Deserialize, PartialEq, Eq)]
-#[serde(rename_all = "lowercase")]
-pub enum ExtendedPacketSize {
-    Extended8,
-    Extended16,
-    Extended32,
-}
-
-impl Default for DebugConfig {
+impl Default for ReplySurbs {
     fn default() -> Self {
-        DebugConfig {
-            average_packet_delay: DEFAULT_AVERAGE_PACKET_DELAY,
-            average_ack_delay: DEFAULT_AVERAGE_PACKET_DELAY,
-            ack_wait_multiplier: DEFAULT_ACK_WAIT_MULTIPLIER,
-            ack_wait_addition: DEFAULT_ACK_WAIT_ADDITION,
-            loop_cover_traffic_average_delay: DEFAULT_LOOP_COVER_STREAM_AVERAGE_DELAY,
-            message_sending_average_delay: DEFAULT_MESSAGE_STREAM_AVERAGE_DELAY,
-            gateway_response_timeout: DEFAULT_GATEWAY_RESPONSE_TIMEOUT,
-            topology_refresh_rate: DEFAULT_TOPOLOGY_REFRESH_RATE,
-            topology_resolution_timeout: DEFAULT_TOPOLOGY_RESOLUTION_TIMEOUT,
-            disable_loop_cover_traffic_stream: false,
-            disable_main_poisson_packet_distribution: false,
-            use_extended_packet_size: None,
+        ReplySurbs {
             minimum_reply_surb_storage_threshold: DEFAULT_MINIMUM_REPLY_SURB_STORAGE_THRESHOLD,
             maximum_reply_surb_storage_threshold: DEFAULT_MAXIMUM_REPLY_SURB_STORAGE_THRESHOLD,
             minimum_reply_surb_request_size: DEFAULT_MINIMUM_REPLY_SURB_REQUEST_SIZE,
@@ -728,6 +783,52 @@ impl Default for DebugConfig {
     }
 }
 
+#[derive(Debug, Clone, Copy, Deserialize, PartialEq, Serialize)]
+#[serde(default, deny_unknown_fields)]
+pub struct DebugConfig {
+    /// Defines all configuration options related to traffic streams.
+    pub traffic: Traffic,
+
+    /// Defines all configuration options related to cover traffic stream(s).
+    pub cover_traffic: CoverTraffic,
+
+    /// Defines all configuration options related to the gateway connection.
+    pub gateway_connection: GatewayConnection,
+
+    /// Defines all configuration options related to acknowledgements, such as delays or wait timeouts.
+    pub acknowledgements: Acknowledgements,
+
+    /// Defines all configuration options related topology, such as refresh rates or timeouts.
+    pub topology: Topology,
+
+    /// Defines all configuration options related to reply SURBs.
+    pub reply_surbs: ReplySurbs,
+}
+
+#[derive(Clone, Copy, Debug, Serialize, Deserialize, PartialEq, Eq)]
+#[serde(rename_all = "lowercase")]
+pub enum ExtendedPacketSize {
+    Extended8,
+    Extended16,
+    Extended32,
+}
+
+// it could be derived, sure, but I'd rather have an explicit implementation in case we had to change
+// something manually at some point
+#[allow(clippy::derivable_impls)]
+impl Default for DebugConfig {
+    fn default() -> Self {
+        DebugConfig {
+            traffic: Default::default(),
+            cover_traffic: Default::default(),
+            gateway_connection: Default::default(),
+            acknowledgements: Default::default(),
+            topology: Default::default(),
+            reply_surbs: Default::default(),
+        }
+    }
+}
+
 impl From<ExtendedPacketSize> for PacketSize {
     fn from(size: ExtendedPacketSize) -> PacketSize {
         match size {

clients/client-core/src/config/old_config_v1_1_13.rs

@@ -0,0 +1,198 @@
+// Copyright 2023 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::config::{
+    Acknowledgements, Client, Config, CoverTraffic, DebugConfig, ExtendedPacketSize,
+    GatewayConnection, Logging, ReplySurbs, Topology, Traffic, DEFAULT_ACK_WAIT_ADDITION,
+    DEFAULT_ACK_WAIT_MULTIPLIER, DEFAULT_AVERAGE_PACKET_DELAY, DEFAULT_GATEWAY_RESPONSE_TIMEOUT,
+    DEFAULT_LOOP_COVER_STREAM_AVERAGE_DELAY, DEFAULT_MAXIMUM_ALLOWED_SURB_REQUEST_SIZE,
+    DEFAULT_MAXIMUM_REPLY_KEY_AGE, DEFAULT_MAXIMUM_REPLY_SURB_AGE,
+    DEFAULT_MAXIMUM_REPLY_SURB_DROP_WAITING_PERIOD, DEFAULT_MAXIMUM_REPLY_SURB_REQUEST_SIZE,
+    DEFAULT_MAXIMUM_REPLY_SURB_REREQUEST_WAITING_PERIOD,
+    DEFAULT_MAXIMUM_REPLY_SURB_STORAGE_THRESHOLD, DEFAULT_MESSAGE_STREAM_AVERAGE_DELAY,
+    DEFAULT_MINIMUM_REPLY_SURB_REQUEST_SIZE, DEFAULT_MINIMUM_REPLY_SURB_STORAGE_THRESHOLD,
+    DEFAULT_TOPOLOGY_REFRESH_RATE, DEFAULT_TOPOLOGY_RESOLUTION_TIMEOUT,
+};
+use nym_config::NymConfig;
+use serde::{Deserialize, Serialize};
+use std::marker::PhantomData;
+use std::time::Duration;
+
+#[derive(Debug, Clone, Deserialize, PartialEq, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct OldConfigV1_1_13<T> {
+    pub client: Client<T>,
+
+    #[serde(default)]
+    logging: Logging,
+    #[serde(default)]
+    debug: OldDebugConfigV1_1_13,
+}
+
+impl<T: NymConfig> Default for OldConfigV1_1_13<T> {
+    fn default() -> Self {
+        OldConfigV1_1_13 {
+            client: Client::<T>::default(),
+            logging: Default::default(),
+            debug: Default::default(),
+        }
+    }
+}
+
+#[derive(Debug, Clone, Deserialize, PartialEq, Serialize)]
+#[serde(default, deny_unknown_fields)]
+pub struct OldDebugConfigV1_1_13 {
+    #[serde(with = "humantime_serde")]
+    pub average_packet_delay: Duration,
+
+    #[serde(with = "humantime_serde")]
+    pub average_ack_delay: Duration,
+
+    pub ack_wait_multiplier: f64,
+    #[serde(with = "humantime_serde")]
+    pub ack_wait_addition: Duration,
+
+    #[serde(with = "humantime_serde")]
+    pub loop_cover_traffic_average_delay: Duration,
+
+    #[serde(with = "humantime_serde")]
+    pub message_sending_average_delay: Duration,
+
+    #[serde(with = "humantime_serde")]
+    pub gateway_response_timeout: Duration,
+
+    #[serde(with = "humantime_serde")]
+    pub topology_refresh_rate: Duration,
+
+    #[serde(with = "humantime_serde")]
+    pub topology_resolution_timeout: Duration,
+
+    pub disable_loop_cover_traffic_stream: bool,
+
+    pub disable_main_poisson_packet_distribution: bool,
+
+    pub use_extended_packet_size: Option<ExtendedPacketSize>,
+
+    pub minimum_reply_surb_storage_threshold: usize,
+
+    pub maximum_reply_surb_storage_threshold: usize,
+
+    pub minimum_reply_surb_request_size: u32,
+
+    pub maximum_reply_surb_request_size: u32,
+
+    pub maximum_allowed_reply_surb_request_size: u32,
+
+    #[serde(with = "humantime_serde")]
+    pub maximum_reply_surb_rerequest_waiting_period: Duration,
+
+    #[serde(with = "humantime_serde")]
+    pub maximum_reply_surb_drop_waiting_period: Duration,
+
+    #[serde(with = "humantime_serde")]
+    pub maximum_reply_surb_age: Duration,
+
+    #[serde(with = "humantime_serde")]
+    pub maximum_reply_key_age: Duration,
+}
+
+impl From<OldDebugConfigV1_1_13> for DebugConfig {
+    fn from(value: OldDebugConfigV1_1_13) -> Self {
+        DebugConfig {
+            traffic: Traffic {
+                average_packet_delay: value.average_packet_delay,
+                message_sending_average_delay: value.message_sending_average_delay,
+                disable_main_poisson_packet_distribution: value
+                    .disable_main_poisson_packet_distribution,
+                use_extended_packet_size: value.use_extended_packet_size,
+            },
+            cover_traffic: CoverTraffic {
+                loop_cover_traffic_average_delay: value.loop_cover_traffic_average_delay,
+                disable_loop_cover_traffic_stream: value.disable_loop_cover_traffic_stream,
+            },
+            gateway_connection: GatewayConnection {
+                gateway_response_timeout: value.gateway_response_timeout,
+            },
+            acknowledgements: Acknowledgements {
+                average_ack_delay: value.average_ack_delay,
+                ack_wait_multiplier: value.ack_wait_multiplier,
+                ack_wait_addition: value.ack_wait_addition,
+            },
+            topology: Topology {
+                topology_refresh_rate: value.topology_refresh_rate,
+                topology_resolution_timeout: value.topology_resolution_timeout,
+            },
+            reply_surbs: ReplySurbs {
+                minimum_reply_surb_storage_threshold: value.minimum_reply_surb_storage_threshold,
+                maximum_reply_surb_storage_threshold: value.maximum_reply_surb_storage_threshold,
+                minimum_reply_surb_request_size: value.minimum_reply_surb_request_size,
+                maximum_reply_surb_request_size: value.maximum_reply_surb_request_size,
+                maximum_allowed_reply_surb_request_size: value
+                    .maximum_allowed_reply_surb_request_size,
+                maximum_reply_surb_rerequest_waiting_period: value
+                    .maximum_reply_surb_rerequest_waiting_period,
+                maximum_reply_surb_drop_waiting_period: value
+                    .maximum_reply_surb_drop_waiting_period,
+                maximum_reply_surb_age: value.maximum_reply_surb_age,
+                maximum_reply_key_age: value.maximum_reply_key_age,
+            },
+        }
+    }
+}
+
+impl Default for OldDebugConfigV1_1_13 {
+    fn default() -> Self {
+        OldDebugConfigV1_1_13 {
+            average_packet_delay: DEFAULT_AVERAGE_PACKET_DELAY,
+            average_ack_delay: DEFAULT_AVERAGE_PACKET_DELAY,
+            ack_wait_multiplier: DEFAULT_ACK_WAIT_MULTIPLIER,
+            ack_wait_addition: DEFAULT_ACK_WAIT_ADDITION,
+            loop_cover_traffic_average_delay: DEFAULT_LOOP_COVER_STREAM_AVERAGE_DELAY,
+            message_sending_average_delay: DEFAULT_MESSAGE_STREAM_AVERAGE_DELAY,
+            gateway_response_timeout: DEFAULT_GATEWAY_RESPONSE_TIMEOUT,
+            topology_refresh_rate: DEFAULT_TOPOLOGY_REFRESH_RATE,
+            topology_resolution_timeout: DEFAULT_TOPOLOGY_RESOLUTION_TIMEOUT,
+            disable_loop_cover_traffic_stream: false,
+            disable_main_poisson_packet_distribution: false,
+            use_extended_packet_size: None,
+            minimum_reply_surb_storage_threshold: DEFAULT_MINIMUM_REPLY_SURB_STORAGE_THRESHOLD,
+            maximum_reply_surb_storage_threshold: DEFAULT_MAXIMUM_REPLY_SURB_STORAGE_THRESHOLD,
+            minimum_reply_surb_request_size: DEFAULT_MINIMUM_REPLY_SURB_REQUEST_SIZE,
+            maximum_reply_surb_request_size: DEFAULT_MAXIMUM_REPLY_SURB_REQUEST_SIZE,
+            maximum_allowed_reply_surb_request_size: DEFAULT_MAXIMUM_ALLOWED_SURB_REQUEST_SIZE,
+            maximum_reply_surb_rerequest_waiting_period:
+                DEFAULT_MAXIMUM_REPLY_SURB_REREQUEST_WAITING_PERIOD,
+            maximum_reply_surb_drop_waiting_period: DEFAULT_MAXIMUM_REPLY_SURB_DROP_WAITING_PERIOD,
+            maximum_reply_surb_age: DEFAULT_MAXIMUM_REPLY_SURB_AGE,
+            maximum_reply_key_age: DEFAULT_MAXIMUM_REPLY_KEY_AGE,
+        }
+    }
+}
+
+impl<T, U> From<OldConfigV1_1_13<T>> for Config<U> {
+    fn from(value: OldConfigV1_1_13<T>) -> Self {
+        Config {
+            client: Client {
+                version: value.client.version,
+                id: value.client.id,
+                disabled_credentials_mode: value.client.disabled_credentials_mode,
+                nyxd_urls: value.client.nyxd_urls,
+                nym_api_urls: value.client.nym_api_urls,
+                private_identity_key_file: value.client.private_identity_key_file,
+                public_identity_key_file: value.client.public_identity_key_file,
+                private_encryption_key_file: value.client.private_encryption_key_file,
+                public_encryption_key_file: value.client.public_encryption_key_file,
+                gateway_shared_key_file: value.client.gateway_shared_key_file,
+                ack_key_file: value.client.ack_key_file,
+                gateway_endpoint: value.client.gateway_endpoint,
+                database_path: value.client.database_path,
+                reply_surb_database_path: value.client.reply_surb_database_path,
+                nym_root_directory: value.client.nym_root_directory,
+
+                super_struct: PhantomData,
+            },
+            logging: value.logging,
+            debug: value.debug.into(),
+        }
+    }
+}

clients/client-core/src/init/mod.rs

@@ -112,14 +112,14 @@ where
 {
     let id = config.get_id();
 
-    // If we are not going to register gateway, and an explicitly chosed gateway is not passed in,
+    // If we are not going to register gateway, and an explicitly chosen gateway is not passed in,
     // load the existing configuration file
     if !register_gateway && user_chosen_gateway_id.is_none() {
         println!("Not registering gateway, will reuse existing config and keys");
         return load_existing_gateway_config::<C>(&id);
     }
 
-    // Else, we preceed by querying the nym-api
+    // Else, we proceed by querying the nym-api
     let gateway = helpers::query_gateway_details(
         config.get_nym_api_endpoints(),
         user_chosen_gateway_id,

clients/credential/Cargo.toml

@@ -6,7 +6,7 @@ edition = "2021"
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
 
 [dependencies]
-bip39 = "1.0.1"
+bip39 = { workspace = true }
 clap = { version = "4.0", features = ["cargo", "derive"] }
 log = "0.4"
 rand = "0.7.3"

clients/native/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "nym-client"
-version = "1.1.13"
+version = "1.1.14"
 authors = ["Dave Hrycyszyn <futurechimp@users.noreply.github.com>", "Jędrzej Stuczyński <andrew@nymtech.net>"]
 description = "Implementation of the Nym Client"
 edition = "2021"

clients/native/src/client/config/mod.rs

@@ -15,6 +15,7 @@ pub use client_core::config::Config as BaseConfig;
 pub use client_core::config::MISSING_VALUE;
 pub use client_core::config::{DebugConfig, GatewayEndpointConfig};
 
+pub mod old_config_v1_1_13;
 mod template;
 
 #[derive(Debug, Deserialize, PartialEq, Eq, Serialize, Clone, Copy)]

clients/native/src/client/config/old_config_v1_1_13.rs

@@ -0,0 +1,60 @@
+// Copyright 2023 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::client::config::{Config, Socket};
+use client_core::config::old_config_v1_1_13::OldConfigV1_1_13 as OldBaseConfigV1_1_13;
+use nym_config::NymConfig;
+use serde::{Deserialize, Serialize};
+use std::path::PathBuf;
+
+#[derive(Debug, Default, Deserialize, PartialEq, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct OldConfigV1_1_13 {
+    #[serde(flatten)]
+    base: OldBaseConfigV1_1_13<OldConfigV1_1_13>,
+
+    socket: Socket,
+}
+
+impl NymConfig for OldConfigV1_1_13 {
+    fn template() -> &'static str {
+        // not intended to be used
+        unimplemented!()
+    }
+
+    fn default_root_directory() -> PathBuf {
+        dirs::home_dir()
+            .expect("Failed to evaluate $HOME value")
+            .join(".nym")
+            .join("clients")
+    }
+
+    fn try_default_root_directory() -> Option<PathBuf> {
+        dirs::home_dir().map(|path| path.join(".nym").join("clients"))
+    }
+
+    fn root_directory(&self) -> PathBuf {
+        self.base.client.nym_root_directory.clone()
+    }
+
+    fn config_directory(&self) -> PathBuf {
+        self.root_directory()
+            .join(&self.base.client.id)
+            .join("config")
+    }
+
+    fn data_directory(&self) -> PathBuf {
+        self.root_directory()
+            .join(&self.base.client.id)
+            .join("data")
+    }
+}
+
+impl From<OldConfigV1_1_13> for Config {
+    fn from(value: OldConfigV1_1_13) -> Self {
+        Config {
+            base: value.base.into(),
+            socket: value.socket,
+        }
+    }
+}

clients/native/src/client/config/template.rs

@@ -110,10 +110,15 @@ host = '{{ socket.host }}'
 
 [debug]
 
-average_packet_delay = '{{ debug.average_packet_delay }}'
-average_ack_delay = '{{ debug.average_ack_delay }}'
-loop_cover_traffic_average_delay = '{{ debug.loop_cover_traffic_average_delay }}'
-message_sending_average_delay = '{{ debug.message_sending_average_delay }}'
+[debug.traffic]
+average_packet_delay = '{{ debug.traffic.average_packet_delay }}'
+message_sending_average_delay = '{{ debug.traffic.message_sending_average_delay }}'
+
+[debug.acknowledgements]
+average_ack_delay = '{{ debug.acknowledgements.average_ack_delay }}'
+
+[debug.cover_traffic]
+loop_cover_traffic_average_delay = '{{ debug.cover_traffic.loop_cover_traffic_average_delay }}'
 
 "#
 }

clients/native/src/commands/init.rs

@@ -1,6 +1,7 @@
 // Copyright 2021 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0
 
+use crate::commands::try_upgrade_v1_1_13_config;
 use crate::{
     client::config::Config,
     commands::{override_config, OverrideConfig},
@@ -121,6 +122,9 @@ pub(crate) async fn execute(args: &Init) -> Result<(), ClientError> {
 
     let already_init = Config::default_config_file_path(id).exists();
     if already_init {
+        // in case we're using old config, try to upgrade it
+        // (if we're using the current version, it's a no-op)
+        try_upgrade_v1_1_13_config(id)?;
         println!("Client \"{id}\" was already initialised before");
     }
 

clients/native/src/commands/mod.rs

@@ -1,13 +1,15 @@
 // Copyright 2021-2023 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0
 
+use crate::client::config::old_config_v1_1_13::OldConfigV1_1_13;
 use crate::client::config::{BaseConfig, Config};
 use clap::CommandFactory;
 use clap::{Parser, Subcommand};
 use lazy_static::lazy_static;
+use log::info;
 use nym_bin_common::build_information::BinaryBuildInformation;
 use nym_bin_common::completions::{fig_generate, ArgShell};
-use nym_config::OptionalSet;
+use nym_config::{NymConfig, OptionalSet};
 use std::error::Error;
 use std::net::IpAddr;
 
@@ -102,6 +104,20 @@ pub(crate) fn override_config(config: Config, args: OverrideConfig) -> Config {
         )
 }
 
+fn try_upgrade_v1_1_13_config(id: &str) -> std::io::Result<()> {
+    // explicitly load it as v1.1.13 (which is incompatible with the current, i.e. 1.1.14+)
+    let Ok(old_config) = OldConfigV1_1_13::load_from_file(id) else {
+        // if we failed to load it, there might have been nothing to upgrade
+        // or maybe it was an even older file. in either way. just ignore it and carry on with our day
+        return Ok(());
+    };
+    info!("It seems the client is using <= v1.1.13 config template.");
+    info!("It is going to get updated to the current specification.");
+
+    let updated: Config = old_config.into();
+    updated.save_to_file(None)
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;

clients/native/src/commands/run.rs

@@ -4,12 +4,12 @@
 use std::error::Error;
 use std::net::IpAddr;
 
+use crate::commands::try_upgrade_v1_1_13_config;
 use crate::{
     client::{config::Config, SocketClient},
     commands::{override_config, OverrideConfig},
     error::ClientError,
 };
-
 use clap::Args;
 use log::*;
 use nym_bin_common::version_checker::is_minor_version_compatible;
@@ -100,6 +100,10 @@ fn version_check(cfg: &Config) -> bool {
 pub(crate) async fn execute(args: &Run) -> Result<(), Box<dyn Error + Send + Sync>> {
     let id = &args.id;
 
+    // in case we're using old config, try to upgrade it
+    // (if we're using the current version, it's a no-op)
+    try_upgrade_v1_1_13_config(id)?;
+
     let mut config = match Config::load_from_file(id) {
         Ok(cfg) => cfg,
         Err(err) => {

clients/socks5/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "nym-socks5-client"
-version = "1.1.13"
+version = "1.1.14"
 authors = ["Dave Hrycyszyn <futurechimp@users.noreply.github.com>"]
 description = "A SOCKS5 localhost proxy that converts incoming messages to Sphinx and sends them to a Nym address"
 edition = "2021"

clients/socks5/src/client/config/mod.rs

@@ -15,6 +15,7 @@ use std::fmt::Debug;
 use std::path::PathBuf;
 use std::str::FromStr;
 
+pub mod old_config_v1_1_13;
 mod template;
 
 const DEFAULT_CONNECTION_START_SURBS: u32 = 20;

clients/socks5/src/client/config/old_config_v1_1_13.rs

@@ -0,0 +1,66 @@
+// Copyright 2023 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::client::config::{Config, Socks5, Socks5Debug};
+use client_core::config::old_config_v1_1_13::OldConfigV1_1_13 as OldBaseConfigV1_1_13;
+use nym_config::NymConfig;
+use serde::{Deserialize, Serialize};
+use std::path::PathBuf;
+
+#[derive(Clone, Debug, Default, Deserialize, PartialEq, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct OldConfigV1_1_13 {
+    #[serde(flatten)]
+    base: OldBaseConfigV1_1_13<OldConfigV1_1_13>,
+
+    socks5: Socks5,
+
+    #[serde(default)]
+    socks5_debug: Socks5Debug,
+}
+
+impl NymConfig for OldConfigV1_1_13 {
+    fn template() -> &'static str {
+        // not intended to be used
+        unimplemented!()
+    }
+
+    fn default_root_directory() -> PathBuf {
+        #[cfg(not(feature = "mobile"))]
+        let base_dir = dirs::home_dir().expect("Failed to evaluate $HOME value");
+        #[cfg(feature = "mobile")]
+        let base_dir = PathBuf::from("/tmp");
+
+        base_dir.join(".nym").join("socks5-clients")
+    }
+
+    fn try_default_root_directory() -> Option<PathBuf> {
+        dirs::home_dir().map(|path| path.join(".nym").join("socks5-clients"))
+    }
+
+    fn root_directory(&self) -> PathBuf {
+        self.base.client.nym_root_directory.clone()
+    }
+
+    fn config_directory(&self) -> PathBuf {
+        self.root_directory()
+            .join(&self.base.client.id)
+            .join("config")
+    }
+
+    fn data_directory(&self) -> PathBuf {
+        self.root_directory()
+            .join(&self.base.client.id)
+            .join("data")
+    }
+}
+
+impl From<OldConfigV1_1_13> for Config {
+    fn from(value: OldConfigV1_1_13) -> Self {
+        Config {
+            base: value.base.into(),
+            socks5: value.socks5,
+            socks5_debug: value.socks5_debug,
+        }
+    }
+}

clients/socks5/src/client/config/template.rs

@@ -114,10 +114,15 @@ send_anonymously = {{ socks5.send_anonymously }}
 
 [debug]
 
-average_packet_delay = '{{ debug.average_packet_delay }}'
-average_ack_delay = '{{ debug.average_ack_delay }}'
-loop_cover_traffic_average_delay = '{{ debug.loop_cover_traffic_average_delay }}'
-message_sending_average_delay = '{{ debug.message_sending_average_delay }}'
+[debug.traffic]
+average_packet_delay = '{{ debug.traffic.average_packet_delay }}'
+message_sending_average_delay = '{{ debug.traffic.message_sending_average_delay }}'
+
+[debug.acknowledgements]
+average_ack_delay = '{{ debug.acknowledgements.average_ack_delay }}'
+
+[debug.cover_traffic]
+loop_cover_traffic_average_delay = '{{ debug.cover_traffic.loop_cover_traffic_average_delay }}'
 
 "#
 }

clients/socks5/src/commands/init.rs

@@ -1,6 +1,7 @@
 // Copyright 2021 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0
 
+use crate::commands::try_upgrade_v1_1_13_config;
 use crate::{
     client::config::Config,
     commands::{override_config, OverrideConfig},
@@ -124,6 +125,9 @@ pub(crate) async fn execute(args: &Init) -> Result<(), Socks5ClientError> {
 
     let already_init = Config::default_config_file_path(id).exists();
     if already_init {
+        // in case we're using old config, try to upgrade it
+        // (if we're using the current version, it's a no-op)
+        try_upgrade_v1_1_13_config(id)?;
         println!("SOCKS5 client \"{id}\" was already initialised before");
     }
 

clients/socks5/src/commands/mod.rs

@@ -1,13 +1,15 @@
 // Copyright 2021-2023 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0
 
+use crate::client::config::old_config_v1_1_13::OldConfigV1_1_13;
 use crate::client::config::{BaseConfig, Config};
 use clap::CommandFactory;
 use clap::{Parser, Subcommand};
 use lazy_static::lazy_static;
+use log::info;
 use nym_bin_common::build_information::BinaryBuildInformation;
 use nym_bin_common::completions::{fig_generate, ArgShell};
-use nym_config::OptionalSet;
+use nym_config::{NymConfig, OptionalSet};
 use std::error::Error;
 
 pub mod init;
@@ -101,6 +103,20 @@ pub(crate) fn override_config(config: Config, args: OverrideConfig) -> Config {
         )
 }
 
+fn try_upgrade_v1_1_13_config(id: &str) -> std::io::Result<()> {
+    // explicitly load it as v1.1.13 (which is incompatible with the current, i.e. 1.1.14+)
+    let Ok(old_config) = OldConfigV1_1_13::load_from_file(id) else {
+        // if we failed to load it, there might have been nothing to upgrade
+        // or maybe it was an even older file. in either way. just ignore it and carry on with our day
+        return Ok(());
+    };
+    info!("It seems the client is using <= v1.1.13 config template.");
+    info!("It is going to get updated to the current specification.");
+
+    let updated: Config = old_config.into();
+    updated.save_to_file(None)
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;

clients/socks5/src/commands/run.rs

@@ -1,12 +1,12 @@
 // Copyright 2021 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0
 
+use crate::commands::try_upgrade_v1_1_13_config;
 use crate::{
     client::{config::Config, NymClient},
     commands::{override_config, OverrideConfig},
     error::Socks5ClientError,
 };
-
 use clap::Args;
 use log::*;
 use nym_bin_common::version_checker::is_minor_version_compatible;
@@ -108,6 +108,10 @@ fn version_check(cfg: &Config) -> bool {
 pub(crate) async fn execute(args: &Run) -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
     let id = &args.id;
 
+    // in case we're using old config, try to upgrade it
+    // (if we're using the current version, it's a no-op)
+    try_upgrade_v1_1_13_config(id)?;
+
     let mut config = match Config::load_from_file(id) {
         Ok(cfg) => cfg,
         Err(err) => {

clients/webassembly/src/client/config.rs

@@ -3,8 +3,15 @@
 
 // due to expansion of #[wasm_bindgen] macro on `Debug` Config struct
 #![allow(clippy::drop_non_drop)]
+// another issue due to #[wasm_bindgen] and `Copy` trait
+#![allow(clippy::drop_copy)]
 
-use client_core::config::{DebugConfig as ConfigDebug, ExtendedPacketSize, GatewayEndpointConfig};
+use client_core::config::{
+    Acknowledgements as ConfigAcknowledgements, CoverTraffic as ConfigCoverTraffic,
+    DebugConfig as ConfigDebug, ExtendedPacketSize, GatewayConnection as ConfigGatewayConnection,
+    GatewayEndpointConfig, ReplySurbs as ConfigReplySurbs, Topology as ConfigTopology,
+    Traffic as ConfigTraffic,
+};
 use serde::{Deserialize, Serialize};
 use std::time::Duration;
 use url::Url;
@@ -48,15 +55,124 @@ impl Config {
     }
 }
 
-// just a helper structure to more easily pass through the JS boundary
 #[wasm_bindgen]
-pub struct Debug {
+#[derive(Debug, Copy, Clone)]
+pub struct Traffic {
     /// The parameter of Poisson distribution determining how long, on average,
     /// sent packet is going to be delayed at any given mix node.
     /// So for a packet going through three mix nodes, on average, it will take three times this value
     /// until the packet reaches its destination.
     pub average_packet_delay_ms: u64,
 
+    /// The parameter of Poisson distribution determining how long, on average,
+    /// it is going to take another 'real traffic stream' message to be sent.
+    /// If no real packets are available and cover traffic is enabled,
+    /// a loop cover message is sent instead in order to preserve the rate.
+    pub message_sending_average_delay_ms: u64,
+
+    /// Controls whether the main packet stream constantly produces packets according to the predefined
+    /// poisson distribution.
+    pub disable_main_poisson_packet_distribution: bool,
+
+    /// Controls whether the sent sphinx packet use the NON-DEFAULT bigger size.
+    pub use_extended_packet_size: bool,
+}
+
+impl From<Traffic> for ConfigTraffic {
+    fn from(traffic: Traffic) -> Self {
+        let use_extended_packet_size = traffic
+            .use_extended_packet_size
+            .then(|| ExtendedPacketSize::Extended32);
+
+        ConfigTraffic {
+            average_packet_delay: Duration::from_millis(traffic.average_packet_delay_ms),
+            message_sending_average_delay: Duration::from_millis(
+                traffic.message_sending_average_delay_ms,
+            ),
+            disable_main_poisson_packet_distribution: traffic
+                .disable_main_poisson_packet_distribution,
+            use_extended_packet_size,
+        }
+    }
+}
+
+impl From<ConfigTraffic> for Traffic {
+    fn from(traffic: ConfigTraffic) -> Self {
+        Traffic {
+            average_packet_delay_ms: traffic.average_packet_delay.as_millis() as u64,
+            message_sending_average_delay_ms: traffic.message_sending_average_delay.as_millis()
+                as u64,
+            disable_main_poisson_packet_distribution: traffic
+                .disable_main_poisson_packet_distribution,
+            use_extended_packet_size: traffic.use_extended_packet_size.is_some(),
+        }
+    }
+}
+
+#[wasm_bindgen]
+#[derive(Debug, Copy, Clone)]
+pub struct CoverTraffic {
+    /// The parameter of Poisson distribution determining how long, on average,
+    /// it is going to take for another loop cover traffic message to be sent.
+    pub loop_cover_traffic_average_delay_ms: u64,
+
+    /// Controls whether the dedicated loop cover traffic stream should be enabled.
+    /// (and sending packets, on average, every [Self::loop_cover_traffic_average_delay])
+    pub disable_loop_cover_traffic_stream: bool,
+}
+
+impl From<CoverTraffic> for ConfigCoverTraffic {
+    fn from(cover_traffic: CoverTraffic) -> Self {
+        ConfigCoverTraffic {
+            loop_cover_traffic_average_delay: Duration::from_millis(
+                cover_traffic.loop_cover_traffic_average_delay_ms,
+            ),
+            disable_loop_cover_traffic_stream: cover_traffic.disable_loop_cover_traffic_stream,
+        }
+    }
+}
+
+impl From<ConfigCoverTraffic> for CoverTraffic {
+    fn from(cover_traffic: ConfigCoverTraffic) -> Self {
+        CoverTraffic {
+            loop_cover_traffic_average_delay_ms: cover_traffic
+                .loop_cover_traffic_average_delay
+                .as_millis() as u64,
+            disable_loop_cover_traffic_stream: cover_traffic.disable_loop_cover_traffic_stream,
+        }
+    }
+}
+
+#[wasm_bindgen]
+#[derive(Debug, Copy, Clone)]
+pub struct GatewayConnection {
+    /// How long we're willing to wait for a response to a message sent to the gateway,
+    /// before giving up on it.
+    pub gateway_response_timeout_ms: u64,
+}
+
+impl From<GatewayConnection> for ConfigGatewayConnection {
+    fn from(gateway_connection: GatewayConnection) -> Self {
+        ConfigGatewayConnection {
+            gateway_response_timeout: Duration::from_millis(
+                gateway_connection.gateway_response_timeout_ms,
+            ),
+        }
+    }
+}
+
+impl From<ConfigGatewayConnection> for GatewayConnection {
+    fn from(gateway_connection: ConfigGatewayConnection) -> Self {
+        GatewayConnection {
+            gateway_response_timeout_ms: gateway_connection.gateway_response_timeout.as_millis()
+                as u64,
+        }
+    }
+}
+
+#[wasm_bindgen]
+#[derive(Debug, Copy, Clone)]
+pub struct Acknowledgements {
     /// The parameter of Poisson distribution determining how long, on average,
     /// sent acknowledgement is going to be delayed at any given mix node.
     /// So for an ack going through three mix nodes, on average, it will take three times this value
@@ -72,21 +188,31 @@ pub struct Debug {
     /// it is assumed it was lost and retransmission of the data packet happens.
     /// In an ideal network with 0 latency, this value would have been 0.
     pub ack_wait_addition_ms: u64,
+}
 
-    /// The parameter of Poisson distribution determining how long, on average,
-    /// it is going to take for another loop cover traffic message to be sent.
-    pub loop_cover_traffic_average_delay_ms: u64,
+impl From<Acknowledgements> for ConfigAcknowledgements {
+    fn from(acknowledgements: Acknowledgements) -> Self {
+        ConfigAcknowledgements {
+            average_ack_delay: Duration::from_millis(acknowledgements.average_ack_delay_ms),
+            ack_wait_multiplier: acknowledgements.ack_wait_multiplier,
+            ack_wait_addition: Duration::from_millis(acknowledgements.ack_wait_addition_ms),
+        }
+    }
+}
 
-    /// The parameter of Poisson distribution determining how long, on average,
-    /// it is going to take another 'real traffic stream' message to be sent.
-    /// If no real packets are available and cover traffic is enabled,
-    /// a loop cover message is sent instead in order to preserve the rate.
-    pub message_sending_average_delay_ms: u64,
-
-    /// How long we're willing to wait for a response to a message sent to the gateway,
-    /// before giving up on it.
-    pub gateway_response_timeout_ms: u64,
+impl From<ConfigAcknowledgements> for Acknowledgements {
+    fn from(acknowledgements: ConfigAcknowledgements) -> Self {
+        Acknowledgements {
+            average_ack_delay_ms: acknowledgements.average_ack_delay.as_millis() as u64,
+            ack_wait_multiplier: acknowledgements.ack_wait_multiplier,
+            ack_wait_addition_ms: acknowledgements.ack_wait_addition.as_millis() as u64,
+        }
+    }
+}
 
+#[wasm_bindgen]
+#[derive(Debug, Copy, Clone)]
+pub struct Topology {
     /// The uniform delay every which clients are querying the directory server
     /// to try to obtain a compatible network topology to send sphinx packets through.
     pub topology_refresh_rate_ms: u64,
@@ -95,18 +221,31 @@ pub struct Debug {
     /// path. This timeout determines waiting period until it is decided that the packet
     /// did not reach its destination.
     pub topology_resolution_timeout_ms: u64,
+}
 
-    /// Controls whether the dedicated loop cover traffic stream should be enabled.
-    /// (and sending packets, on average, every [Self::loop_cover_traffic_average_delay_ms])
-    pub disable_loop_cover_traffic_stream: bool,
+impl From<Topology> for ConfigTopology {
+    fn from(topology: Topology) -> Self {
+        ConfigTopology {
+            topology_refresh_rate: Duration::from_millis(topology.topology_refresh_rate_ms),
+            topology_resolution_timeout: Duration::from_millis(
+                topology.topology_resolution_timeout_ms,
+            ),
+        }
+    }
+}
 
-    /// Controls whether the main packet stream constantly produces packets according to the predefined
-    /// poisson distribution.
-    pub disable_main_poisson_packet_distribution: bool,
-
-    /// Controls whether the sent sphinx packet use the NON-DEFAULT bigger size.
-    pub use_extended_packet_size: bool,
+impl From<ConfigTopology> for Topology {
+    fn from(topology: ConfigTopology) -> Self {
+        Topology {
+            topology_refresh_rate_ms: topology.topology_refresh_rate.as_millis() as u64,
+            topology_resolution_timeout_ms: topology.topology_resolution_timeout.as_millis() as u64,
+        }
+    }
+}
 
+#[wasm_bindgen]
+#[derive(Debug, Copy, Clone)]
+pub struct ReplySurbs {
     /// Defines the minimum number of reply surbs the client wants to keep in its storage at all times.
     /// It can only allow to go below that value if its to request additional reply surbs.
     pub minimum_reply_surb_storage_threshold: usize,
@@ -140,46 +279,80 @@ pub struct Debug {
     pub maximum_reply_key_age_ms: u64,
 }
 
-impl From<Debug> for ConfigDebug {
-    fn from(debug: Debug) -> Self {
-        // For now we just always use the (older) 32kb extended size
-        let use_extended_packet_size = debug
-            .use_extended_packet_size
-            .then(|| ExtendedPacketSize::Extended32);
-
-        ConfigDebug {
-            average_packet_delay: Duration::from_millis(debug.average_packet_delay_ms),
-            average_ack_delay: Duration::from_millis(debug.average_ack_delay_ms),
-            ack_wait_multiplier: debug.ack_wait_multiplier,
-            ack_wait_addition: Duration::from_millis(debug.ack_wait_addition_ms),
-            loop_cover_traffic_average_delay: Duration::from_millis(
-                debug.loop_cover_traffic_average_delay_ms,
-            ),
-            message_sending_average_delay: Duration::from_millis(
-                debug.message_sending_average_delay_ms,
-            ),
-            gateway_response_timeout: Duration::from_millis(debug.gateway_response_timeout_ms),
-            topology_refresh_rate: Duration::from_millis(debug.topology_refresh_rate_ms),
-            topology_resolution_timeout: Duration::from_millis(
-                debug.topology_resolution_timeout_ms,
-            ),
-            disable_loop_cover_traffic_stream: debug.disable_loop_cover_traffic_stream,
-            disable_main_poisson_packet_distribution: debug
-                .disable_main_poisson_packet_distribution,
-            use_extended_packet_size,
-            minimum_reply_surb_storage_threshold: debug.minimum_reply_surb_storage_threshold,
-            maximum_reply_surb_storage_threshold: debug.maximum_reply_surb_storage_threshold,
-            minimum_reply_surb_request_size: debug.minimum_reply_surb_request_size,
-            maximum_reply_surb_request_size: debug.maximum_reply_surb_request_size,
-            maximum_allowed_reply_surb_request_size: debug.maximum_allowed_reply_surb_request_size,
+impl From<ReplySurbs> for ConfigReplySurbs {
+    fn from(reply_surbs: ReplySurbs) -> Self {
+        ConfigReplySurbs {
+            minimum_reply_surb_storage_threshold: reply_surbs.minimum_reply_surb_storage_threshold,
+            maximum_reply_surb_storage_threshold: reply_surbs.maximum_reply_surb_storage_threshold,
+            minimum_reply_surb_request_size: reply_surbs.minimum_reply_surb_request_size,
+            maximum_reply_surb_request_size: reply_surbs.maximum_reply_surb_request_size,
+            maximum_allowed_reply_surb_request_size: reply_surbs
+                .maximum_allowed_reply_surb_request_size,
             maximum_reply_surb_rerequest_waiting_period: Duration::from_millis(
-                debug.maximum_reply_surb_rerequest_waiting_period_ms,
+                reply_surbs.maximum_reply_surb_rerequest_waiting_period_ms,
             ),
             maximum_reply_surb_drop_waiting_period: Duration::from_millis(
-                debug.maximum_reply_surb_drop_waiting_period_ms,
+                reply_surbs.maximum_reply_surb_drop_waiting_period_ms,
             ),
-            maximum_reply_surb_age: Duration::from_millis(debug.maximum_reply_surb_age_ms),
-            maximum_reply_key_age: Duration::from_millis(debug.maximum_reply_key_age_ms),
+            maximum_reply_surb_age: Duration::from_millis(reply_surbs.maximum_reply_surb_age_ms),
+            maximum_reply_key_age: Duration::from_millis(reply_surbs.maximum_reply_key_age_ms),
+        }
+    }
+}
+
+impl From<ConfigReplySurbs> for ReplySurbs {
+    fn from(reply_surbs: ConfigReplySurbs) -> Self {
+        ReplySurbs {
+            minimum_reply_surb_storage_threshold: reply_surbs.minimum_reply_surb_storage_threshold,
+            maximum_reply_surb_storage_threshold: reply_surbs.maximum_reply_surb_storage_threshold,
+            minimum_reply_surb_request_size: reply_surbs.minimum_reply_surb_request_size,
+            maximum_reply_surb_request_size: reply_surbs.maximum_reply_surb_request_size,
+            maximum_allowed_reply_surb_request_size: reply_surbs
+                .maximum_allowed_reply_surb_request_size,
+            maximum_reply_surb_rerequest_waiting_period_ms: reply_surbs
+                .maximum_reply_surb_rerequest_waiting_period
+                .as_millis() as u64,
+            maximum_reply_surb_drop_waiting_period_ms: reply_surbs
+                .maximum_reply_surb_drop_waiting_period
+                .as_millis() as u64,
+            maximum_reply_surb_age_ms: reply_surbs.maximum_reply_surb_age.as_millis() as u64,
+            maximum_reply_key_age_ms: reply_surbs.maximum_reply_key_age.as_millis() as u64,
+        }
+    }
+}
+
+// just a helper structure to more easily pass through the JS boundary
+#[wasm_bindgen]
+#[derive(Debug, Copy, Clone)]
+pub struct Debug {
+    /// Defines all configuration options related to traffic streams.
+    pub traffic: Traffic,
+
+    /// Defines all configuration options related to cover traffic stream(s).
+    pub cover_traffic: CoverTraffic,
+
+    /// Defines all configuration options related to the gateway connection.
+    pub gateway_connection: GatewayConnection,
+
+    /// Defines all configuration options related to acknowledgements, such as delays or wait timeouts.
+    pub acknowledgements: Acknowledgements,
+
+    /// Defines all configuration options related topology, such as refresh rates or timeouts.
+    pub topology: Topology,
+
+    /// Defines all configuration options related to reply SURBs.
+    pub reply_surbs: ReplySurbs,
+}
+
+impl From<Debug> for ConfigDebug {
+    fn from(debug: Debug) -> Self {
+        ConfigDebug {
+            traffic: debug.traffic.into(),
+            cover_traffic: debug.cover_traffic.into(),
+            gateway_connection: debug.gateway_connection.into(),
+            acknowledgements: debug.acknowledgements.into(),
+            topology: debug.topology.into(),
+            reply_surbs: debug.reply_surbs.into(),
         }
     }
 }
@@ -187,34 +360,12 @@ impl From<Debug> for ConfigDebug {
 impl From<ConfigDebug> for Debug {
     fn from(debug: ConfigDebug) -> Self {
         Debug {
-            average_packet_delay_ms: debug.average_packet_delay.as_millis() as u64,
-            average_ack_delay_ms: debug.average_ack_delay.as_millis() as u64,
-            ack_wait_multiplier: debug.ack_wait_multiplier,
-            ack_wait_addition_ms: debug.ack_wait_addition.as_millis() as u64,
-            loop_cover_traffic_average_delay_ms: debug.loop_cover_traffic_average_delay.as_millis()
-                as u64,
-            message_sending_average_delay_ms: debug.message_sending_average_delay.as_millis()
-                as u64,
-            gateway_response_timeout_ms: debug.gateway_response_timeout.as_millis() as u64,
-            topology_refresh_rate_ms: debug.topology_refresh_rate.as_millis() as u64,
-            topology_resolution_timeout_ms: debug.topology_resolution_timeout.as_millis() as u64,
-            disable_loop_cover_traffic_stream: debug.disable_loop_cover_traffic_stream,
-            disable_main_poisson_packet_distribution: debug
-                .disable_main_poisson_packet_distribution,
-            use_extended_packet_size: debug.use_extended_packet_size.is_some(),
-            minimum_reply_surb_storage_threshold: debug.minimum_reply_surb_storage_threshold,
-            maximum_reply_surb_storage_threshold: debug.maximum_reply_surb_storage_threshold,
-            minimum_reply_surb_request_size: debug.minimum_reply_surb_request_size,
-            maximum_reply_surb_request_size: debug.maximum_reply_surb_request_size,
-            maximum_allowed_reply_surb_request_size: debug.maximum_allowed_reply_surb_request_size,
-            maximum_reply_surb_rerequest_waiting_period_ms: debug
-                .maximum_reply_surb_rerequest_waiting_period
-                .as_millis() as u64,
-            maximum_reply_surb_drop_waiting_period_ms: debug
-                .maximum_reply_surb_drop_waiting_period
-                .as_millis() as u64,
-            maximum_reply_surb_age_ms: debug.maximum_reply_surb_age.as_millis() as u64,
-            maximum_reply_key_age_ms: debug.maximum_reply_key_age.as_millis() as u64,
+            traffic: debug.traffic.into(),
+            cover_traffic: debug.cover_traffic.into(),
+            gateway_connection: debug.gateway_connection.into(),
+            acknowledgements: debug.acknowledgements.into(),
+            topology: debug.topology.into(),
+            reply_surbs: debug.reply_surbs.into(),
         }
     }
 }

clients/webassembly/src/client/mod.rs

@@ -82,8 +82,14 @@ impl NymClientBuilder {
     // with no persistence
     fn setup_reply_surb_storage_backend(config: &Config) -> browser_backend::Backend {
         browser_backend::Backend::new(
-            config.debug.minimum_reply_surb_storage_threshold,
-            config.debug.maximum_reply_surb_storage_threshold,
+            config
+                .debug
+                .reply_surbs
+                .minimum_reply_surb_storage_threshold,
+            config
+                .debug
+                .reply_surbs
+                .maximum_reply_surb_storage_threshold,
         )
     }
 

common/bandwidth-claim-contract/Cargo.toml

@@ -1,10 +0,0 @@
-[package]
-name = "nym-bandwidth-claim-contract"
-version = "0.1.0"
-edition = "2021"
-
-# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
-
-[dependencies]
-schemars = "0.8"
-serde = { version = "1.0.103", default-features = false, features = ["derive"] }

common/bandwidth-claim-contract/src/keys.rs

@@ -1,45 +0,0 @@
-// Copyright 2021 - Nym Technologies SA <contact@nymtech.net>
-// SPDX-License-Identifier: Apache-2.0
-
-use schemars::JsonSchema;
-use serde::{Deserialize, Serialize};
-
-// Serializable structures for what we find in common/crypto
-#[derive(Serialize, Deserialize, Copy, Clone, Debug, PartialEq, Eq, JsonSchema)]
-pub struct PublicKey([u8; 32]);
-
-impl PublicKey {
-    pub fn new(bytes: [u8; 32]) -> Self {
-        PublicKey(bytes)
-    }
-    pub fn to_bytes(&self) -> [u8; 32] {
-        self.0
-    }
-}
-
-impl AsRef<[u8]> for PublicKey {
-    #[inline]
-    fn as_ref(&self) -> &[u8] {
-        &self.0
-    }
-}
-
-#[derive(Serialize, Deserialize, Clone, Debug, PartialEq, Eq, JsonSchema)]
-pub struct Signature([u8; 32], [u8; 32]);
-
-impl Signature {
-    pub fn new(bytes: [u8; 64]) -> Self {
-        let mut sig1 = [0u8; 32];
-        let mut sig2 = [0u8; 32];
-        sig1.copy_from_slice(&bytes[..32]);
-        sig2.copy_from_slice(&bytes[32..]);
-
-        Signature(sig1, sig2)
-    }
-    pub fn to_bytes(&self) -> [u8; 64] {
-        let mut res = [0u8; 64];
-        res[..32].copy_from_slice(&self.0);
-        res[32..].copy_from_slice(&self.1);
-        res
-    }
-}

common/bandwidth-claim-contract/src/lib.rs

@@ -1,3 +0,0 @@
-pub mod keys;
-pub mod msg;
-pub mod payment;

common/bandwidth-claim-contract/src/msg.rs

@@ -1,30 +0,0 @@
-// Copyright 2021 - Nym Technologies SA <contact@nymtech.net>
-// SPDX-License-Identifier: Apache-2.0
-
-use schemars::JsonSchema;
-use serde::{Deserialize, Serialize};
-
-use crate::keys::PublicKey;
-use crate::payment::LinkPaymentData;
-
-#[derive(Serialize, Deserialize, Clone, Debug, PartialEq, Eq, JsonSchema)]
-pub struct InstantiateMsg {}
-
-#[derive(Serialize, Deserialize, Clone, Debug, PartialEq, Eq, JsonSchema)]
-#[serde(rename_all = "snake_case")]
-pub enum ExecuteMsg {
-    LinkPayment { data: LinkPaymentData },
-}
-
-#[derive(Serialize, Deserialize, Clone, Debug, PartialEq, Eq, JsonSchema)]
-#[serde(rename_all = "snake_case")]
-pub enum QueryMsg {
-    GetPayments {
-        limit: Option<u32>,
-        start_after: Option<PublicKey>,
-    },
-}
-
-#[derive(Serialize, Deserialize, Clone, Debug, PartialEq, Eq, JsonSchema)]
-#[serde(rename_all = "snake_case")]
-pub struct MigrateMsg {}

common/bandwidth-claim-contract/src/payment.rs

@@ -1,73 +0,0 @@
-// Copyright 2021 - Nym Technologies SA <contact@nymtech.net>
-// SPDX-License-Identifier: Apache-2.0
-
-use schemars::JsonSchema;
-use serde::{Deserialize, Serialize};
-
-use crate::keys::{PublicKey, Signature};
-
-#[derive(Clone, Debug, Deserialize, PartialEq, Eq, Serialize, JsonSchema)]
-pub struct Payment {
-    verification_key: PublicKey,
-    gateway_identity: PublicKey,
-    bandwidth: u64,
-}
-
-impl Payment {
-    pub fn new(verification_key: PublicKey, gateway_identity: PublicKey, bandwidth: u64) -> Self {
-        Payment {
-            verification_key,
-            gateway_identity,
-            bandwidth,
-        }
-    }
-
-    pub fn verification_key(&self) -> PublicKey {
-        self.verification_key
-    }
-}
-
-#[derive(Serialize, Deserialize, Clone, Debug, PartialEq, Eq, JsonSchema)]
-pub struct LinkPaymentData {
-    pub verification_key: PublicKey,
-    pub gateway_identity: PublicKey,
-    pub bandwidth: u64,
-    pub signature: Signature,
-}
-
-impl LinkPaymentData {
-    pub fn new(
-        verification_key: [u8; 32],
-        gateway_identity: [u8; 32],
-        bandwidth: u64,
-        signature: [u8; 64],
-    ) -> Self {
-        LinkPaymentData {
-            verification_key: PublicKey::new(verification_key),
-            gateway_identity: PublicKey::new(gateway_identity),
-            bandwidth,
-            signature: Signature::new(signature),
-        }
-    }
-}
-
-#[derive(Clone, Debug, Deserialize, PartialEq, Eq, Serialize, JsonSchema)]
-pub struct PagedPaymentResponse {
-    pub payments: Vec<Payment>,
-    pub per_page: usize,
-    pub start_next_after: Option<PublicKey>,
-}
-
-impl PagedPaymentResponse {
-    pub fn new(
-        payments: Vec<Payment>,
-        per_page: usize,
-        start_next_after: Option<PublicKey>,
-    ) -> Self {
-        PagedPaymentResponse {
-            payments,
-            per_page,
-            start_next_after,
-        }
-    }
-}

common/bin-common/.gitignore

@@ -1,3 +0,0 @@
-/target
-**/*.rs.bk
-Cargo.lock

common/bin-common/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "nym-bin-common"
-version = "0.3.0"
+version = "0.4.0"
 description = "Common code for nym binaries"
 edition = { workspace = true }
 authors = { workspace = true }

common/client-libs/validator-client/Cargo.toml

@@ -37,7 +37,7 @@ nym-execute = { path = "../../execute" }
 # at some point it might be possible to make it wasm-compatible
 # perhaps after https://github.com/cosmos/cosmos-rust/pull/97 is resolved (and tendermint-rs is updated)
 async-trait = { workspace = true, optional = true }
-bip39 = { version = "1", features = ["rand"], optional = true }
+bip39 = { workspace = true, features = ["rand"], optional = true }
 nym-config = { path = "../../config", optional = true }
 cosmrs = { git = "https://github.com/neacsu/cosmos-rust", branch = "neacsu/feegrant_support", features = ["rpc", "bip32", "cosmwasm"], optional = true}
 cw3 = { workspace = true, optional = true }
@@ -46,8 +46,8 @@ prost = { version = "0.10", default-features = false, optional = true }
 flate2 = { version = "1.0.20", optional = true }
 sha2 = { version = "0.9.5", optional = true }
 itertools = { version = "0.10", optional = true }
+zeroize = { version = "1.5.7", optional = true, features = ["zeroize_derive"] }
 cosmwasm-std = { workspace = true, optional = true }
-zeroize = { version = "1.5.7", optional = true }
 
 [dev-dependencies]
 ts-rs = "6.1.2"

common/client-libs/validator-client/src/nyxd/mod.rs

@@ -43,6 +43,7 @@ pub use cosmrs::tendermint::Time as TendermintTime;
 pub use cosmrs::tx::{self, Gas};
 pub use cosmrs::Coin as CosmosCoin;
 pub use cosmrs::{bip32, AccountId, Decimal, Denom};
+use cosmwasm_std::Addr;
 pub use cosmwasm_std::Coin as CosmWasmCoin;
 pub use fee::{gas_price::GasPrice, GasAdjustable, GasAdjustment};
 pub use signing_client::Client as SigningNyxdClient;
@@ -369,6 +370,15 @@ where
         &self.client_address.as_ref().unwrap()[0]
     }
 
+    pub fn cw_address(&self) -> Addr
+    where
+        C: SigningCosmWasmClient,
+    {
+        // the call to unchecked is fine here as we're converting directly from `AccountId`
+        // which must have been a valid bech32 address
+        Addr::unchecked(self.address().as_ref())
+    }
+
     pub fn signer(&self) -> &DirectSecp256k1HdWallet
     where
         C: SigningCosmWasmClient,

common/client-libs/validator-client/src/nyxd/traits/mixnet_query_client.rs

@@ -6,6 +6,7 @@ use crate::nyxd::error::NyxdError;
 use crate::nyxd::NyxdClient;
 use async_trait::async_trait;
 use cosmrs::AccountId;
+use nym_contracts_common::signing::Nonce;
 use nym_mixnet_contract_common::delegation::{MixNodeDelegationResponse, OwnerProxySubKey};
 use nym_mixnet_contract_common::families::Family;
 use nym_mixnet_contract_common::mixnode::{
@@ -390,6 +391,13 @@ pub trait MixnetQueryClient {
             .await
     }
 
+    async fn get_signing_nonce(&self, address: &AccountId) -> Result<Nonce, NyxdError> {
+        self.query_mixnet_contract(MixnetQueryMsg::GetSigningNonce {
+            address: address.to_string(),
+        })
+        .await
+    }
+
     async fn get_node_family_by_label(&self, label: &str) -> Result<Option<Family>, NyxdError> {
         self.query_mixnet_contract(MixnetQueryMsg::GetFamilyByLabel {
             label: label.to_string(),

common/client-libs/validator-client/src/nyxd/traits/mixnet_signing_client.rs

@@ -1,4 +1,4 @@
-// Copyright 2022 - Nym Technologies SA <contact@nymtech.net>
+// Copyright 2022-2023 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0
 
 use crate::nyxd::coin::Coin;
@@ -8,6 +8,9 @@ use crate::nyxd::error::NyxdError;
 use crate::nyxd::{Fee, NyxdClient, SigningCosmWasmClient};
 use async_trait::async_trait;
 use cosmrs::AccountId;
+use nym_contracts_common::signing::MessageSignature;
+use nym_mixnet_contract_common::families::FamilyHead;
+use nym_mixnet_contract_common::gateway::GatewayConfigUpdate;
 use nym_mixnet_contract_common::mixnode::{MixNodeConfigUpdate, MixNodeCostParams};
 use nym_mixnet_contract_common::reward_params::{IntervalRewardingParamsUpdate, Performance};
 use nym_mixnet_contract_common::{
@@ -144,25 +147,16 @@ pub trait MixnetSigningClient {
     // family related
     async fn create_family(
         &self,
-        owner_signature: String,
         label: String,
         fee: Option<Fee>,
     ) -> Result<ExecuteResult, NyxdError> {
-        self.execute_mixnet_contract(
-            fee,
-            MixnetExecuteMsg::CreateFamily {
-                owner_signature,
-                label,
-            },
-            vec![],
-        )
-        .await
+        self.execute_mixnet_contract(fee, MixnetExecuteMsg::CreateFamily { label }, vec![])
+            .await
     }
 
     async fn create_family_on_behalf(
         &self,
         owner_address: String,
-        owner_signature: String,
         label: String,
         fee: Option<Fee>,
     ) -> Result<ExecuteResult, NyxdError> {
@@ -170,7 +164,6 @@ pub trait MixnetSigningClient {
             fee,
             MixnetExecuteMsg::CreateFamilyOnBehalf {
                 owner_address,
-                owner_signature,
                 label,
             },
             vec![],
@@ -180,14 +173,14 @@ pub trait MixnetSigningClient {
 
     async fn join_family(
         &self,
-        signature: String,
-        family_head: String,
+        join_permit: MessageSignature,
+        family_head: FamilyHead,
         fee: Option<Fee>,
     ) -> Result<ExecuteResult, NyxdError> {
         self.execute_mixnet_contract(
             fee,
             MixnetExecuteMsg::JoinFamily {
-                signature,
+                join_permit,
                 family_head,
             },
             vec![],
@@ -198,17 +191,15 @@ pub trait MixnetSigningClient {
     async fn join_family_on_behalf(
         &self,
         member_address: String,
-        node_identity_signature: String,
-        family_signature: String,
-        family_head: String,
+        join_permit: MessageSignature,
+        family_head: FamilyHead,
         fee: Option<Fee>,
     ) -> Result<ExecuteResult, NyxdError> {
         self.execute_mixnet_contract(
             fee,
             MixnetExecuteMsg::JoinFamilyOnBehalf {
                 member_address,
-                node_identity_signature,
-                family_signature,
+                join_permit,
                 family_head,
             },
             vec![],
@@ -218,33 +209,23 @@ pub trait MixnetSigningClient {
 
     async fn leave_family(
         &self,
-        signature: String,
-        family_head: String,
+        family_head: FamilyHead,
         fee: Option<Fee>,
     ) -> Result<ExecuteResult, NyxdError> {
-        self.execute_mixnet_contract(
-            fee,
-            MixnetExecuteMsg::LeaveFamily {
-                signature,
-                family_head,
-            },
-            vec![],
-        )
-        .await
+        self.execute_mixnet_contract(fee, MixnetExecuteMsg::LeaveFamily { family_head }, vec![])
+            .await
     }
 
     async fn leave_family_on_behalf(
         &self,
         member_address: String,
-        node_identity_signature: String,
-        family_head: String,
+        family_head: FamilyHead,
         fee: Option<Fee>,
     ) -> Result<ExecuteResult, NyxdError> {
         self.execute_mixnet_contract(
             fee,
             MixnetExecuteMsg::LeaveFamilyOnBehalf {
                 member_address,
-                node_identity_signature,
                 family_head,
             },
             vec![],
@@ -254,22 +235,16 @@ pub trait MixnetSigningClient {
 
     async fn kick_family_member(
         &self,
-        signature: String,
         member: String,
         fee: Option<Fee>,
     ) -> Result<ExecuteResult, NyxdError> {
-        self.execute_mixnet_contract(
-            fee,
-            MixnetExecuteMsg::KickFamilyMember { signature, member },
-            vec![],
-        )
-        .await
+        self.execute_mixnet_contract(fee, MixnetExecuteMsg::KickFamilyMember { member }, vec![])
+            .await
     }
 
     async fn kick_family_member_on_behalf(
         &self,
         head_address: String,
-        signature: String,
         member: String,
         fee: Option<Fee>,
     ) -> Result<ExecuteResult, NyxdError> {
@@ -277,7 +252,6 @@ pub trait MixnetSigningClient {
             fee,
             MixnetExecuteMsg::KickFamilyMemberOnBehalf {
                 head_address,
-                signature,
                 member,
             },
             vec![],
@@ -290,7 +264,7 @@ pub trait MixnetSigningClient {
         &self,
         mix_node: MixNode,
         cost_params: MixNodeCostParams,
-        owner_signature: String,
+        owner_signature: MessageSignature,
         pledge: Coin,
         fee: Option<Fee>,
     ) -> Result<ExecuteResult, NyxdError> {
@@ -311,7 +285,7 @@ pub trait MixnetSigningClient {
         owner: AccountId,
         mix_node: MixNode,
         cost_params: MixNodeCostParams,
-        owner_signature: String,
+        owner_signature: MessageSignature,
         pledge: Coin,
         fee: Option<Fee>,
     ) -> Result<ExecuteResult, NyxdError> {
@@ -442,7 +416,7 @@ pub trait MixnetSigningClient {
     async fn bond_gateway(
         &self,
         gateway: Gateway,
-        owner_signature: String,
+        owner_signature: MessageSignature,
         pledge: Coin,
         fee: Option<Fee>,
     ) -> Result<ExecuteResult, NyxdError> {
@@ -461,7 +435,7 @@ pub trait MixnetSigningClient {
         &self,
         owner: AccountId,
         gateway: Gateway,
-        owner_signature: String,
+        owner_signature: MessageSignature,
         pledge: Coin,
         fee: Option<Fee>,
     ) -> Result<ExecuteResult, NyxdError> {
@@ -497,6 +471,36 @@ pub trait MixnetSigningClient {
         .await
     }
 
+    async fn update_gateway_config(
+        &self,
+        new_config: GatewayConfigUpdate,
+        fee: Option<Fee>,
+    ) -> Result<ExecuteResult, NyxdError> {
+        self.execute_mixnet_contract(
+            fee,
+            MixnetExecuteMsg::UpdateGatewayConfig { new_config },
+            vec![],
+        )
+        .await
+    }
+
+    async fn update_gateway_config_on_behalf(
+        &self,
+        owner: AccountId,
+        new_config: GatewayConfigUpdate,
+        fee: Option<Fee>,
+    ) -> Result<ExecuteResult, NyxdError> {
+        self.execute_mixnet_contract(
+            fee,
+            MixnetExecuteMsg::UpdateGatewayConfigOnBehalf {
+                new_config,
+                owner: owner.to_string(),
+            },
+            vec![],
+        )
+        .await
+    }
+
     // delegation-related:
 
     async fn delegate_to_mixnode(

common/client-libs/validator-client/src/nyxd/traits/vesting_signing_client.rs

@@ -6,6 +6,9 @@ use crate::nyxd::cosmwasm_client::types::ExecuteResult;
 use crate::nyxd::error::NyxdError;
 use crate::nyxd::{Coin, Fee, NyxdClient};
 use async_trait::async_trait;
+use nym_contracts_common::signing::MessageSignature;
+use nym_mixnet_contract_common::families::FamilyHead;
+use nym_mixnet_contract_common::gateway::GatewayConfigUpdate;
 use nym_mixnet_contract_common::mixnode::{MixNodeConfigUpdate, MixNodeCostParams};
 use nym_mixnet_contract_common::{Gateway, MixId, MixNode};
 use nym_vesting_contract_common::messages::{
@@ -34,6 +37,12 @@ pub trait VestingSigningClient {
         fee: Option<Fee>,
     ) -> Result<ExecuteResult, NyxdError>;
 
+    async fn vesting_update_gateway_config(
+        &self,
+        new_config: GatewayConfigUpdate,
+        fee: Option<Fee>,
+    ) -> Result<ExecuteResult, NyxdError>;
+
     async fn update_mixnet_address(
         &self,
         address: &str,
@@ -43,7 +52,7 @@ pub trait VestingSigningClient {
     async fn vesting_bond_gateway(
         &self,
         gateway: Gateway,
-        owner_signature: &str,
+        owner_signature: MessageSignature,
         pledge: Coin,
         fee: Option<Fee>,
     ) -> Result<ExecuteResult, NyxdError>;
@@ -61,7 +70,7 @@ pub trait VestingSigningClient {
         &self,
         mix_node: MixNode,
         cost_params: MixNodeCostParams,
-        owner_signature: &str,
+        owner_signature: MessageSignature,
         pledge: Coin,
         fee: Option<Fee>,
     ) -> Result<ExecuteResult, NyxdError>;
@@ -128,6 +137,50 @@ pub trait VestingSigningClient {
         cap: Option<PledgeCap>,
         fee: Option<Fee>,
     ) -> Result<ExecuteResult, NyxdError>;
+
+    async fn vesting_create_family(
+        &self,
+        label: String,
+        fee: Option<Fee>,
+    ) -> Result<ExecuteResult, NyxdError> {
+        self.execute_vesting_contract(fee, VestingExecuteMsg::CreateFamily { label }, vec![])
+            .await
+    }
+
+    async fn vesting_join_family(
+        &self,
+        join_permit: MessageSignature,
+        family_head: FamilyHead,
+        fee: Option<Fee>,
+    ) -> Result<ExecuteResult, NyxdError> {
+        self.execute_vesting_contract(
+            fee,
+            VestingExecuteMsg::JoinFamily {
+                join_permit,
+                family_head,
+            },
+            vec![],
+        )
+        .await
+    }
+
+    async fn vesting_leave_family(
+        &self,
+        family_head: FamilyHead,
+        fee: Option<Fee>,
+    ) -> Result<ExecuteResult, NyxdError> {
+        self.execute_vesting_contract(fee, VestingExecuteMsg::LeaveFamily { family_head }, vec![])
+            .await
+    }
+
+    async fn vesting_kick_family_member(
+        &self,
+        member: String,
+        fee: Option<Fee>,
+    ) -> Result<ExecuteResult, NyxdError> {
+        self.execute_vesting_contract(fee, VestingExecuteMsg::KickFamilyMember { member }, vec![])
+            .await
+    }
 }
 
 #[async_trait]
@@ -184,6 +237,19 @@ impl<C: SigningCosmWasmClient + Sync + Send + Clone> VestingSigningClient for Ny
             .await
     }
 
+    async fn vesting_update_gateway_config(
+        &self,
+        new_config: GatewayConfigUpdate,
+        fee: Option<Fee>,
+    ) -> Result<ExecuteResult, NyxdError> {
+        self.execute_vesting_contract(
+            fee,
+            VestingExecuteMsg::UpdateGatewayConfig { new_config },
+            vec![],
+        )
+        .await
+    }
+
     async fn update_mixnet_address(
         &self,
         address: &str,
@@ -208,14 +274,14 @@ impl<C: SigningCosmWasmClient + Sync + Send + Clone> VestingSigningClient for Ny
     async fn vesting_bond_gateway(
         &self,
         gateway: Gateway,
-        owner_signature: &str,
+        owner_signature: MessageSignature,
         pledge: Coin,
         fee: Option<Fee>,
     ) -> Result<ExecuteResult, NyxdError> {
         let fee = fee.unwrap_or(Fee::Auto(Some(self.simulated_gas_multiplier)));
         let req = VestingExecuteMsg::BondGateway {
             gateway,
-            owner_signature: owner_signature.to_string(),
+            owner_signature,
             amount: pledge.into(),
         };
         self.client
@@ -272,7 +338,7 @@ impl<C: SigningCosmWasmClient + Sync + Send + Clone> VestingSigningClient for Ny
         &self,
         mix_node: MixNode,
         cost_params: MixNodeCostParams,
-        owner_signature: &str,
+        owner_signature: MessageSignature,
         pledge: Coin,
         fee: Option<Fee>,
     ) -> Result<ExecuteResult, NyxdError> {
@@ -281,7 +347,7 @@ impl<C: SigningCosmWasmClient + Sync + Send + Clone> VestingSigningClient for Ny
             VestingExecuteMsg::BondMixnode {
                 mix_node,
                 cost_params,
-                owner_signature: owner_signature.to_string(),
+                owner_signature,
                 amount: pledge.into(),
             },
             vec![],

common/client-libs/validator-client/src/nyxd/wallet/mod.rs

@@ -8,7 +8,7 @@ use cosmrs::crypto::PublicKey;
 use cosmrs::tx::SignDoc;
 use cosmrs::{tx, AccountId};
 use nym_config::defaults;
-use zeroize::Zeroize;
+use zeroize::{Zeroize, ZeroizeOnDrop};
 
 /// Derivation information required to derive a keypair and an address from a mnemonic.
 #[derive(Debug, Clone)]
@@ -41,7 +41,7 @@ impl AccountData {
 
 type Secp256k1Keypair = (SigningKey, PublicKey);
 
-#[derive(Debug, Clone)]
+#[derive(Debug, Clone, Zeroize, ZeroizeOnDrop)]
 pub struct DirectSecp256k1HdWallet {
     /// Base secret
     secret: bip39::Mnemonic,
@@ -54,30 +54,10 @@ pub struct DirectSecp256k1HdWallet {
     // that would include the secret key which is a dyn EcdsaSigner and hence not Sync making the wallet
     // not Sync and if used on the signing client in an async trait, it wouldn't be Send
     /// Derivation instructions
+    #[zeroize(skip)]
     accounts: Vec<Secp256k1Derivation>,
 }
 
-impl Zeroize for DirectSecp256k1HdWallet {
-    fn zeroize(&mut self) {
-        // in ideal world, Mnemonic would have had zeroize defined on it (there's an almost year old PR that introduces it)
-        // and the memory would have been filled with zeroes.
-        //
-        // we really don't want to keep our real mnemonic in memory, so let's do the semi-nasty thing
-        // of overwriting it with a fresh mnemonic that was never used before
-        //
-        // note: this function can only fail on an invalid word count, which clearly is not the case here
-        self.secret = bip39::Mnemonic::generate(self.secret.word_count()).unwrap();
-        self.seed.zeroize();
-        // there's nothing secret about derivation paths
-    }
-}
-
-impl Drop for DirectSecp256k1HdWallet {
-    fn drop(&mut self) {
-        self.zeroize()
-    }
-}
-
 impl DirectSecp256k1HdWallet {
     pub fn builder(prefix: &str) -> DirectSecp256k1HdWalletBuilder {
         DirectSecp256k1HdWalletBuilder::new(prefix)

common/commands/Cargo.toml

@@ -6,7 +6,7 @@ edition = "2021"
 
 [dependencies]
 base64 = "0.13.0"
-bip39 = "1.0.1"
+bip39 = { workspace = true }
 bs58 = "0.4"
 comfy-table = "6.0.0"
 cfg-if = "1.0.0"
@@ -29,7 +29,9 @@ cosmrs = { git = "https://github.com/neacsu/cosmos-rust", branch = "neacsu/feegr
 cosmwasm-std = { workspace = true }
 
 validator-client = { path = "../client-libs/validator-client", features = ["nyxd-client"] }
+nym-crypto = { path = "../../common/crypto", features = ["asymmetric"] }
 nym-network-defaults = { path = "../network-defaults" }
+nym-contracts-common = { path = "../cosmwasm-smart-contracts/contracts-common" }
 nym-mixnet-contract-common = { path = "../cosmwasm-smart-contracts/mixnet-contract" }
 nym-vesting-contract-common = { path = "../cosmwasm-smart-contracts/vesting-contract" }
 nym-coconut-bandwidth-contract-common = { path = "../cosmwasm-smart-contracts/coconut-bandwidth-contract" }

common/commands/src/utils.rs

@@ -1,13 +1,20 @@
 // Copyright 2022 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0
 
+use cosmrs::AccountId;
+use cosmwasm_std::{Addr, Coin as CosmWasmCoin, Decimal};
+use log::error;
 use std::error::Error;
 use std::fmt::Display;
-
-use cosmwasm_std::{Coin as CosmWasmCoin, Decimal};
-use log::error;
 use validator_client::nyxd::Coin;
 
+// TODO: perhaps it should be moved to some global common crate?
+pub fn account_id_to_cw_addr(account_id: &AccountId) -> Addr {
+    // the call to unchecked is fine here as we're converting directly from `AccountId`
+    // which must have been a valid bech32 address
+    Addr::unchecked(account_id.as_ref())
+}
+
 pub fn pretty_coin(coin: &Coin) -> String {
     let amount = Decimal::from_ratio(coin.amount, 1_000_000u128);
     let denom = if coin.denom.starts_with('u') {

common/commands/src/validator/mixnet/delegators/mod.rs

@@ -6,9 +6,11 @@ use clap::{Args, Subcommand};
 pub mod rewards;
 
 pub mod delegate_to_mixnode;
+pub mod pledge_more;
 pub mod query_for_delegations;
 pub mod undelegate_from_mixnode;
 pub mod vesting_delegate_to_mixnode;
+pub mod vesting_pledge_more;
 pub mod vesting_undelegate_from_mixnode;
 
 #[derive(Debug, Args)]
@@ -32,4 +34,8 @@ pub enum MixnetDelegatorsCommands {
     DelegateVesting(vesting_delegate_to_mixnode::Args),
     /// Undelegate from a mixnode (when originally using locked tokens)
     UndelegateVesting(vesting_undelegate_from_mixnode::Args),
+    /// Pledge more
+    PledgeMore(pledge_more::Args),
+    /// Pledge more with locked tokens
+    PledgeMoreVesting(vesting_pledge_more::Args),
 }

common/commands/src/validator/mixnet/delegators/pledge_more.rs

@@ -0,0 +1,29 @@
+// Copyright 2021 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::context::SigningClient;
+use clap::Parser;
+use log::info;
+use nym_mixnet_contract_common::Coin;
+use validator_client::nyxd::traits::MixnetSigningClient;
+
+#[derive(Debug, Parser)]
+pub struct Args {
+    #[clap(long)]
+    pub amount: u128,
+}
+
+pub async fn pledge_more(args: Args, client: SigningClient) {
+    let denom = client.current_chain_details().mix_denom.base.as_str();
+
+    info!("Starting to pledge more");
+
+    let coin = Coin::new(args.amount, denom);
+
+    let res = client
+        .pledge_more(coin.into(), None)
+        .await
+        .expect("failed to pledge more!");
+
+    info!("pledging more: {:?}", res);
+}

common/commands/src/validator/mixnet/delegators/vesting_pledge_more.rs

@@ -0,0 +1,30 @@
+// Copyright 2021 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use clap::Parser;
+use log::info;
+use nym_mixnet_contract_common::Coin;
+use validator_client::nyxd::VestingSigningClient;
+
+use crate::context::SigningClient;
+
+#[derive(Debug, Parser)]
+pub struct Args {
+    #[clap(long)]
+    pub amount: u128,
+}
+
+pub async fn vesting_pledge_more(args: Args, client: SigningClient) {
+    let denom = client.current_chain_details().mix_denom.base.as_str();
+
+    info!("Starting vesting pledge more");
+
+    let coin = Coin::new(args.amount, denom);
+
+    let res = client
+        .vesting_pledge_more(coin.into(), None)
+        .await
+        .expect("failed to pledge more!");
+
+    info!("vesting pledge more: {:?}", res);
+}

common/commands/src/validator/mixnet/operators/gateway/bond_gateway.rs

@@ -4,6 +4,7 @@
 use crate::context::SigningClient;
 use clap::Parser;
 use log::{info, warn};
+use nym_contracts_common::signing::MessageSignature;
 use nym_mixnet_contract_common::Coin;
 use nym_network_defaults::{DEFAULT_CLIENT_LISTENING_PORT, DEFAULT_MIX_LISTENING_PORT};
 use validator_client::nyxd::traits::MixnetSigningClient;
@@ -14,7 +15,7 @@ pub struct Args {
     pub host: String,
 
     #[clap(long)]
-    pub signature: String,
+    pub signature: MessageSignature,
 
     #[clap(long)]
     pub mix_port: Option<u16>,
@@ -23,7 +24,7 @@ pub struct Args {
     pub clients_port: Option<u16>,
 
     #[clap(long)]
-    pub location: Option<String>,
+    pub location: String,
 
     #[clap(long)]
     pub sphinx_key: String,
@@ -59,9 +60,7 @@ pub async fn bond_gateway(args: Args, client: SigningClient) {
         host: args.host,
         mix_port: args.mix_port.unwrap_or(DEFAULT_MIX_LISTENING_PORT),
         clients_port: args.clients_port.unwrap_or(DEFAULT_CLIENT_LISTENING_PORT),
-        location: args
-            .location
-            .unwrap_or_else(|| "secret gateway location".to_owned()),
+        location: args.location,
         sphinx_key: args.sphinx_key,
         identity_key: args.identity_key,
         version: args.version,

common/commands/src/validator/mixnet/operators/gateway/gateway_bonding_sign_payload.rs

@@ -0,0 +1,81 @@
+// Copyright 2023 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::context::SigningClient;
+use crate::utils::account_id_to_cw_addr;
+use clap::Parser;
+use cosmwasm_std::Coin;
+use nym_mixnet_contract_common::construct_gateway_bonding_sign_payload;
+use nym_network_defaults::{DEFAULT_CLIENT_LISTENING_PORT, DEFAULT_MIX_LISTENING_PORT};
+use validator_client::nyxd::traits::MixnetQueryClient;
+
+#[derive(Debug, Parser)]
+pub struct Args {
+    #[clap(long)]
+    pub host: String,
+
+    #[clap(long)]
+    pub mix_port: Option<u16>,
+
+    #[clap(long)]
+    pub clients_port: Option<u16>,
+
+    #[clap(long)]
+    pub location: String,
+
+    #[clap(long)]
+    pub sphinx_key: String,
+
+    #[clap(long)]
+    pub identity_key: String,
+
+    #[clap(long)]
+    pub version: String,
+
+    #[clap(
+        long,
+        help = "bonding amount in current DENOMINATION (so it would be 'unym', rather than 'nym')"
+    )]
+    pub amount: u128,
+
+    /// Indicates whether the gateway is going to get bonded via a vesting account
+    #[arg(long)]
+    pub with_vesting_account: bool,
+}
+
+pub async fn create_payload(args: Args, client: SigningClient) {
+    let denom = client.current_chain_details().mix_denom.base.as_str();
+
+    let gateway = nym_mixnet_contract_common::Gateway {
+        host: args.host,
+        mix_port: args.mix_port.unwrap_or(DEFAULT_MIX_LISTENING_PORT),
+        clients_port: args.clients_port.unwrap_or(DEFAULT_CLIENT_LISTENING_PORT),
+        location: args.location,
+        sphinx_key: args.sphinx_key,
+        identity_key: args.identity_key,
+        version: args.version,
+    };
+
+    let coin = Coin::new(args.amount, denom);
+
+    let nonce = match client.get_signing_nonce(client.address()).await {
+        Ok(nonce) => nonce,
+        Err(err) => {
+            eprint!(
+                "failed to query for the signing nonce of {}: {err}",
+                client.address()
+            );
+            return;
+        }
+    };
+
+    let address = account_id_to_cw_addr(client.address());
+    let proxy = if args.with_vesting_account {
+        Some(account_id_to_cw_addr(client.vesting_contract_address()))
+    } else {
+        None
+    };
+
+    let payload = construct_gateway_bonding_sign_payload(nonce, address, proxy, coin, gateway);
+    println!("{}", payload.to_base58_string().unwrap())
+}

common/commands/src/validator/mixnet/operators/gateway/mod.rs

@@ -4,6 +4,8 @@
 use clap::{Args, Subcommand};
 
 pub mod bond_gateway;
+pub mod gateway_bonding_sign_payload;
+pub mod settings;
 pub mod unbond_gateway;
 pub mod vesting_bond_gateway;
 pub mod vesting_unbond_gateway;
@@ -17,12 +19,16 @@ pub struct MixnetOperatorsGateway {
 
 #[derive(Debug, Subcommand)]
 pub enum MixnetOperatorsGatewayCommands {
+    /// Manage your gateway settings stored in the directory
+    Settings(settings::MixnetOperatorsGatewaySettings),
     /// Bond to a gateway
     Bond(bond_gateway::Args),
-    /// Unbound from a gateway
-    Unbound(unbond_gateway::Args),
+    /// Unbond from a gateway
+    Unbond(unbond_gateway::Args),
     /// Bond to a gateway with locked tokens
     VestingBond(vesting_bond_gateway::Args),
-    /// Unbound from a gateway (when originally using locked tokens)
-    VestingUnbound(vesting_unbond_gateway::Args),
+    /// Unbond from a gateway (when originally using locked tokens)
+    VestingUnbond(vesting_unbond_gateway::Args),
+    /// Create base58-encoded payload required for producing valid bonding signature.
+    CreateGatewayBondingSignPayload(gateway_bonding_sign_payload::Args),
 }

common/commands/src/validator/mixnet/operators/gateway/settings/mod.rs

@@ -0,0 +1,22 @@
+// Copyright 2023 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use clap::{Args, Subcommand};
+
+pub mod update_config;
+pub mod vesting_update_config;
+
+#[derive(Debug, Args)]
+#[clap(args_conflicts_with_subcommands = true, subcommand_required = true)]
+pub struct MixnetOperatorsGatewaySettings {
+    #[clap(subcommand)]
+    pub command: MixnetOperatorsGatewaySettingsCommands,
+}
+
+#[derive(Debug, Subcommand)]
+pub enum MixnetOperatorsGatewaySettingsCommands {
+    /// Update gateway configuration
+    UpdateConfig(update_config::Args),
+    /// Update gateway configuration for a gateway bonded with locked tokens
+    VestingUpdateConfig(vesting_update_config::Args),
+}

common/commands/src/validator/mixnet/operators/gateway/settings/update_config.rs

@@ -0,0 +1,60 @@
+// Copyright 2023 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::context::SigningClient;
+use clap::Parser;
+use log::info;
+use nym_mixnet_contract_common::GatewayConfigUpdate;
+use validator_client::nyxd::traits::{MixnetQueryClient, MixnetSigningClient};
+
+#[derive(Debug, Parser)]
+pub struct Args {
+    #[clap(long)]
+    pub host: Option<String>,
+
+    #[clap(long)]
+    pub mix_port: Option<u16>,
+
+    #[clap(long)]
+    pub clients_port: Option<u16>,
+
+    #[clap(long)]
+    pub location: Option<String>,
+
+    #[clap(long)]
+    pub version: Option<String>,
+}
+
+pub async fn update_config(args: Args, client: SigningClient) {
+    info!("Update gateway config!");
+
+    let current_details = match client
+        .get_owned_gateway(client.address())
+        .await
+        .expect("failed to query the chain for gateway details")
+        .gateway
+    {
+        Some(details) => details,
+        None => {
+            log::warn!("this operator does not own a gateway to update");
+            return;
+        }
+    };
+
+    let update = GatewayConfigUpdate {
+        host: args.host.unwrap_or(current_details.gateway.host),
+        mix_port: args.mix_port.unwrap_or(current_details.gateway.mix_port),
+        clients_port: args
+            .clients_port
+            .unwrap_or(current_details.gateway.clients_port),
+        location: args.location.unwrap_or(current_details.gateway.location),
+        version: args.version.unwrap_or(current_details.gateway.version),
+    };
+
+    let res = client
+        .update_gateway_config(update, None)
+        .await
+        .expect("updating gateway config");
+
+    info!("gateway config updated: {:?}", res)
+}

common/commands/src/validator/mixnet/operators/gateway/settings/vesting_update_config.rs

@@ -0,0 +1,61 @@
+// Copyright 2023 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::context::SigningClient;
+use clap::Parser;
+use log::info;
+use nym_mixnet_contract_common::GatewayConfigUpdate;
+use validator_client::nyxd::traits::MixnetQueryClient;
+use validator_client::nyxd::VestingSigningClient;
+
+#[derive(Debug, Parser)]
+pub struct Args {
+    #[clap(long)]
+    pub host: Option<String>,
+
+    #[clap(long)]
+    pub mix_port: Option<u16>,
+
+    #[clap(long)]
+    pub clients_port: Option<u16>,
+
+    #[clap(long)]
+    pub location: Option<String>,
+
+    #[clap(long)]
+    pub version: Option<String>,
+}
+
+pub async fn vesting_update_config(client: SigningClient, args: Args) {
+    info!("Update vesting gateway config!");
+
+    let current_details = match client
+        .get_owned_gateway(client.address())
+        .await
+        .expect("failed to query the chain for gateway details")
+        .gateway
+    {
+        Some(details) => details,
+        None => {
+            log::warn!("this operator does not own a gateway to update");
+            return;
+        }
+    };
+
+    let update = GatewayConfigUpdate {
+        host: args.host.unwrap_or(current_details.gateway.host),
+        mix_port: args.mix_port.unwrap_or(current_details.gateway.mix_port),
+        clients_port: args
+            .clients_port
+            .unwrap_or(current_details.gateway.clients_port),
+        location: args.location.unwrap_or(current_details.gateway.location),
+        version: args.version.unwrap_or(current_details.gateway.version),
+    };
+
+    let res = client
+        .vesting_update_gateway_config(update, None)
+        .await
+        .expect("updating vesting gateway config");
+
+    info!("gateway config updated: {:?}", res)
+}

common/commands/src/validator/mixnet/operators/gateway/vesting_bond_gateway.rs

@@ -4,6 +4,7 @@
 use crate::context::SigningClient;
 use clap::Parser;
 use log::{info, warn};
+use nym_contracts_common::signing::MessageSignature;
 use nym_mixnet_contract_common::{Coin, Gateway};
 use nym_network_defaults::{DEFAULT_CLIENT_LISTENING_PORT, DEFAULT_MIX_LISTENING_PORT};
 use validator_client::nyxd::VestingSigningClient;
@@ -14,7 +15,7 @@ pub struct Args {
     pub host: String,
 
     #[clap(long)]
-    pub signature: String,
+    pub signature: MessageSignature,
 
     #[clap(long)]
     pub mix_port: Option<u16>,
@@ -23,7 +24,7 @@ pub struct Args {
     pub clients_port: Option<u16>,
 
     #[clap(long)]
-    pub location: Option<String>,
+    pub location: String,
 
     #[clap(long)]
     pub sphinx_key: String,
@@ -57,9 +58,7 @@ pub async fn vesting_bond_gateway(client: SigningClient, args: Args, denom: &str
         host: args.host,
         mix_port: args.mix_port.unwrap_or(DEFAULT_MIX_LISTENING_PORT),
         clients_port: args.clients_port.unwrap_or(DEFAULT_CLIENT_LISTENING_PORT),
-        location: args
-            .location
-            .unwrap_or_else(|| "secret gateway location".to_owned()),
+        location: args.location,
         sphinx_key: args.sphinx_key,
         identity_key: args.identity_key,
         version: args.version,
@@ -68,7 +67,7 @@ pub async fn vesting_bond_gateway(client: SigningClient, args: Args, denom: &str
     let coin = Coin::new(args.amount, denom);
 
     let res = client
-        .vesting_bond_gateway(gateway, &args.signature, coin.into(), None)
+        .vesting_bond_gateway(gateway, args.signature, coin.into(), None)
         .await
         .expect("failed to bond gateway!");
 

common/commands/src/validator/mixnet/operators/mixnode/bond_mixnode.rs

@@ -5,6 +5,7 @@ use clap::Parser;
 use cosmwasm_std::Uint128;
 use log::{info, warn};
 
+use nym_contracts_common::signing::MessageSignature;
 use nym_mixnet_contract_common::{Coin, MixNodeCostParams, Percent};
 use nym_network_defaults::{
     DEFAULT_HTTP_API_LISTENING_PORT, DEFAULT_MIX_LISTENING_PORT, DEFAULT_VERLOC_LISTENING_PORT,
@@ -20,7 +21,7 @@ pub struct Args {
     pub host: String,
 
     #[clap(long)]
-    pub signature: String,
+    pub signature: MessageSignature,
 
     #[clap(long)]
     pub mix_port: Option<u16>,

common/commands/src/validator/mixnet/operators/mixnode/families/create_family.rs

@@ -0,0 +1,37 @@
+// Copyright 2023 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::context::SigningClient;
+use clap::Parser;
+use log::info;
+use validator_client::nyxd::traits::MixnetSigningClient;
+use validator_client::nyxd::VestingSigningClient;
+
+#[derive(Debug, Parser)]
+pub struct Args {
+    /// Label that is going to be used for creating the family
+    #[arg(long)]
+    pub family_label: String,
+
+    /// Indicates whether the family is going to get created via a vesting account
+    #[arg(long)]
+    pub with_vesting_account: bool,
+}
+
+pub async fn create_family(args: Args, client: SigningClient) {
+    info!("Create family");
+
+    let res = if args.with_vesting_account {
+        client
+            .vesting_create_family(args.family_label, None)
+            .await
+            .expect("failed to create family with vesting account")
+    } else {
+        client
+            .create_family(args.family_label, None)
+            .await
+            .expect("failed to create family")
+    };
+
+    info!("Family creation result: {:?}", res);
+}

common/commands/src/validator/mixnet/operators/mixnode/families/create_family_join_permit_sign_payload.rs

@@ -0,0 +1,72 @@
+// Copyright 2021 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::context::QueryClient;
+use crate::utils::account_id_to_cw_addr;
+use clap::Parser;
+use cosmrs::AccountId;
+use log::info;
+use nym_crypto::asymmetric::identity;
+use nym_mixnet_contract_common::construct_family_join_permit;
+use nym_mixnet_contract_common::families::FamilyHead;
+use validator_client::nyxd::traits::MixnetQueryClient;
+
+#[derive(Debug, Parser)]
+pub struct Args {
+    /// Account address (i.e. owner of the family head) which will be used for issuing the permit
+    #[arg(long)]
+    pub address: AccountId,
+
+    /// Indicates whether the member joining the family is going to use the vesting account for joining.
+    #[arg(long)]
+    pub with_vesting_account: bool,
+
+    // might as well validate the value when parsing the arguments
+    /// Identity of the member for whom we're issuing the permit
+    #[arg(long)]
+    pub member: identity::PublicKey,
+}
+
+pub async fn create_family_join_permit_sign_payload(args: Args, client: QueryClient) {
+    info!("Create family join permit sign payload");
+
+    // get the address of our mixnode to recover the family head information
+    let Some(mixnode) = client.get_owned_mixnode(&args.address).await.unwrap().mixnode_details else {
+        eprintln!("{} does not seem to even own a mixnode!", args.address);
+        return
+    };
+
+    // make sure this mixnode is actually a family head
+    if client
+        .get_node_family_by_head(mixnode.bond_information.identity())
+        .await
+        .unwrap()
+        .is_none()
+    {
+        eprintln!("{} does not even seem to own a family!", args.address);
+        return;
+    }
+
+    let nonce = match client.get_signing_nonce(&args.address).await {
+        Ok(nonce) => nonce,
+        Err(err) => {
+            eprint!(
+                "failed to query for the signing nonce of {}: {err}",
+                args.address
+            );
+            return;
+        }
+    };
+
+    // let address = account_id_to_cw_addr(&args.address);
+    let proxy = if args.with_vesting_account {
+        Some(account_id_to_cw_addr(client.vesting_contract_address()))
+    } else {
+        None
+    };
+
+    let head = FamilyHead::new(mixnode.bond_information.identity());
+
+    let payload = construct_family_join_permit(nonce, head, proxy, args.member.to_base58_string());
+    println!("{}", payload.to_base58_string().unwrap())
+}

common/commands/src/validator/mixnet/operators/mixnode/families/join_family.rs

@@ -0,0 +1,46 @@
+// Copyright 2023 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::context::SigningClient;
+use clap::Parser;
+use log::info;
+use nym_contracts_common::signing::MessageSignature;
+use nym_crypto::asymmetric::identity;
+use nym_mixnet_contract_common::families::FamilyHead;
+use validator_client::nyxd::traits::MixnetSigningClient;
+use validator_client::nyxd::VestingSigningClient;
+
+#[derive(Debug, Parser)]
+pub struct Args {
+    /// The head of the family that we intend to join
+    #[arg(long)]
+    pub family_head: identity::PublicKey,
+
+    /// Indicates whether the member joining the family is going to do so via the vesting contract
+    #[arg(long)]
+    pub with_vesting_account: bool,
+
+    /// Permission, as provided by the family head, for joining the family
+    #[arg(long)]
+    pub join_permit: MessageSignature,
+}
+
+pub async fn join_family(args: Args, client: SigningClient) {
+    info!("Join family");
+
+    let family_head = FamilyHead::new(&args.family_head.to_base58_string());
+
+    let res = if args.with_vesting_account {
+        client
+            .vesting_join_family(args.join_permit, family_head, None)
+            .await
+            .expect("failed to join family with vesting account")
+    } else {
+        client
+            .join_family(args.join_permit, family_head, None)
+            .await
+            .expect("failed to join family")
+    };
+
+    info!("Family join result: {:?}", res);
+}

common/commands/src/validator/mixnet/operators/mixnode/families/kick_family_member.rs

@@ -0,0 +1,40 @@
+// Copyright 2023 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::context::SigningClient;
+use clap::Parser;
+use log::info;
+use nym_crypto::asymmetric::identity;
+use validator_client::nyxd::traits::MixnetSigningClient;
+use validator_client::nyxd::VestingSigningClient;
+
+#[derive(Debug, Parser)]
+pub struct Args {
+    /// The member of the family that we intend to kick
+    #[arg(long)]
+    pub member: identity::PublicKey,
+
+    /// Indicates whether the family was created (and managed) via the vesting contract
+    #[arg(long)]
+    pub with_vesting_account: bool,
+}
+
+pub async fn kick_family_member(args: Args, client: SigningClient) {
+    info!("Leave family");
+
+    let member = args.member.to_base58_string();
+
+    let res = if args.with_vesting_account {
+        client
+            .vesting_kick_family_member(member, None)
+            .await
+            .expect("failed to kick family member with vesting account")
+    } else {
+        client
+            .kick_family_member(member, None)
+            .await
+            .expect("failed to kick family member")
+    };
+
+    info!("Family leave result: {:?}", res);
+}

common/commands/src/validator/mixnet/operators/mixnode/families/leave_family.rs

@@ -0,0 +1,41 @@
+// Copyright 2023 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::context::SigningClient;
+use clap::Parser;
+use log::info;
+use nym_crypto::asymmetric::identity;
+use nym_mixnet_contract_common::families::FamilyHead;
+use validator_client::nyxd::traits::MixnetSigningClient;
+use validator_client::nyxd::VestingSigningClient;
+
+#[derive(Debug, Parser)]
+pub struct Args {
+    /// The head of the family that we intend to leave
+    #[arg(long)]
+    pub family_head: identity::PublicKey,
+
+    /// Indicates whether we joined the family via the vesting contract
+    #[arg(long)]
+    pub with_vesting_account: bool,
+}
+
+pub async fn leave_family(args: Args, client: SigningClient) {
+    info!("Leave family");
+
+    let family_head = FamilyHead::new(&args.family_head.to_base58_string());
+
+    let res = if args.with_vesting_account {
+        client
+            .vesting_leave_family(family_head, None)
+            .await
+            .expect("failed to leave family with vesting account")
+    } else {
+        client
+            .leave_family(family_head, None)
+            .await
+            .expect("failed to leave family")
+    };
+
+    info!("Family leave result: {:?}", res);
+}

common/commands/src/validator/mixnet/operators/mixnode/families/mod.rs

@@ -0,0 +1,35 @@
+// Copyright 2023 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use clap::{Args, Subcommand};
+
+pub mod create_family;
+pub mod create_family_join_permit_sign_payload;
+pub mod join_family;
+pub mod kick_family_member;
+pub mod leave_family;
+
+#[derive(Debug, Args)]
+#[clap(args_conflicts_with_subcommands = true, subcommand_required = true)]
+pub struct MixnetOperatorsMixnodeFamilies {
+    #[clap(subcommand)]
+    pub command: MixnetOperatorsMixnodeFamiliesCommands,
+}
+
+#[derive(Debug, Subcommand)]
+pub enum MixnetOperatorsMixnodeFamiliesCommands {
+    /// Create family
+    CreateFamily(create_family::Args),
+
+    /// Join family
+    JoinFamily(join_family::Args),
+
+    /// Leave family,
+    LeaveFamily(leave_family::Args),
+
+    /// Kick family member
+    KickFamilyMember(kick_family_member::Args),
+
+    /// Create a message payload that is required to get signed in order to obtain a permit for joining family
+    CreateFamilyJoinPermitSignPayload(create_family_join_permit_sign_payload::Args),
+}

common/commands/src/validator/mixnet/operators/mixnode/mixnode_bonding_sign_payload.rs

@@ -0,0 +1,108 @@
+// Copyright 2023 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::context::SigningClient;
+use crate::utils::account_id_to_cw_addr;
+use clap::Parser;
+use cosmwasm_std::{Coin, Uint128};
+use nym_contracts_common::Percent;
+use nym_mixnet_contract_common::{construct_mixnode_bonding_sign_payload, MixNodeCostParams};
+use nym_network_defaults::{
+    DEFAULT_HTTP_API_LISTENING_PORT, DEFAULT_MIX_LISTENING_PORT, DEFAULT_VERLOC_LISTENING_PORT,
+};
+use validator_client::nyxd::traits::MixnetQueryClient;
+use validator_client::nyxd::CosmWasmCoin;
+
+#[derive(Debug, Parser)]
+pub struct Args {
+    #[clap(long)]
+    pub host: String,
+
+    #[clap(long)]
+    pub mix_port: Option<u16>,
+
+    #[clap(long)]
+    pub verloc_port: Option<u16>,
+
+    #[clap(long)]
+    pub http_api_port: Option<u16>,
+
+    #[clap(long)]
+    pub sphinx_key: String,
+
+    #[clap(long)]
+    pub identity_key: String,
+
+    #[clap(long)]
+    pub version: String,
+
+    #[clap(long)]
+    pub profit_margin_percent: Option<u8>,
+
+    #[clap(
+        long,
+        help = "operating cost in current DENOMINATION (so it would be 'unym', rather than 'nym')"
+    )]
+    pub interval_operating_cost: Option<u128>,
+
+    #[clap(
+        long,
+        help = "bonding amount in current DENOMINATION (so it would be 'unym', rather than 'nym')"
+    )]
+    pub amount: u128,
+
+    /// Indicates whether the mixnode is going to get bonded via a vesting account
+    #[arg(long)]
+    pub with_vesting_account: bool,
+}
+
+pub async fn create_payload(args: Args, client: SigningClient) {
+    let denom = client.current_chain_details().mix_denom.base.as_str();
+
+    let mixnode = nym_mixnet_contract_common::MixNode {
+        host: args.host,
+        mix_port: args.mix_port.unwrap_or(DEFAULT_MIX_LISTENING_PORT),
+        verloc_port: args.verloc_port.unwrap_or(DEFAULT_VERLOC_LISTENING_PORT),
+        http_api_port: args
+            .http_api_port
+            .unwrap_or(DEFAULT_HTTP_API_LISTENING_PORT),
+        sphinx_key: args.sphinx_key,
+        identity_key: args.identity_key,
+        version: args.version,
+    };
+
+    let coin = Coin::new(args.amount, denom);
+
+    let cost_params = MixNodeCostParams {
+        profit_margin_percent: Percent::from_percentage_value(
+            args.profit_margin_percent.unwrap_or(10) as u64,
+        )
+        .unwrap(),
+        interval_operating_cost: CosmWasmCoin {
+            denom: denom.into(),
+            amount: Uint128::new(args.interval_operating_cost.unwrap_or(40_000_000)),
+        },
+    };
+
+    let nonce = match client.get_signing_nonce(client.address()).await {
+        Ok(nonce) => nonce,
+        Err(err) => {
+            eprint!(
+                "failed to query for the signing nonce of {}: {err}",
+                client.address()
+            );
+            return;
+        }
+    };
+
+    let address = account_id_to_cw_addr(client.address());
+    let proxy = if args.with_vesting_account {
+        Some(account_id_to_cw_addr(client.vesting_contract_address()))
+    } else {
+        None
+    };
+
+    let payload =
+        construct_mixnode_bonding_sign_payload(nonce, address, proxy, coin, mixnode, cost_params);
+    println!("{}", payload.to_base58_string().unwrap())
+}

common/commands/src/validator/mixnet/operators/mixnode/mod.rs

@@ -4,7 +4,9 @@
 use clap::{Args, Subcommand};
 
 pub mod bond_mixnode;
+pub mod families;
 pub mod keys;
+pub mod mixnode_bonding_sign_payload;
 pub mod rewards;
 pub mod settings;
 pub mod unbond_mixnode;
@@ -26,12 +28,16 @@ pub enum MixnetOperatorsMixnodeCommands {
     Rewards(rewards::MixnetOperatorsMixnodeRewards),
     /// Manage your mixnode settings stored in the directory
     Settings(settings::MixnetOperatorsMixnodeSettings),
+    /// Operations for mixnode families
+    Families(families::MixnetOperatorsMixnodeFamilies),
     /// Bond to a mixnode
     Bond(bond_mixnode::Args),
-    /// Unbound from a mixnode
-    Unbound(unbond_mixnode::Args),
+    /// Unbond from a mixnode
+    Unbond(unbond_mixnode::Args),
     /// Bond to a mixnode with locked tokens
     BondVesting(vesting_bond_mixnode::Args),
-    /// Unbound from a mixnode (when originally using locked tokens)
-    UnboundVesting(vesting_unbond_mixnode::Args),
+    /// Unbond from a mixnode (when originally using locked tokens)
+    UnbondVesting(vesting_unbond_mixnode::Args),
+    /// Create base58-encoded payload required for producing valid bonding signature.
+    CreateMixnodeBondingSignPayload(mixnode_bonding_sign_payload::Args),
 }

common/commands/src/validator/mixnet/operators/mixnode/vesting_bond_mixnode.rs

@@ -1,10 +1,11 @@
-// Copyright 2021 - Nym Technologies SA <contact@nymtech.net>
+// Copyright 2021-2023 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0
 
 use crate::context::SigningClient;
 use clap::Parser;
 use cosmwasm_std::Uint128;
 use log::{info, warn};
+use nym_contracts_common::signing::MessageSignature;
 use nym_mixnet_contract_common::{Coin, MixNodeCostParams};
 use nym_mixnet_contract_common::{MixNode, Percent};
 use nym_network_defaults::{
@@ -18,7 +19,7 @@ pub struct Args {
     pub host: String,
 
     #[clap(long)]
-    pub signature: String,
+    pub signature: MessageSignature,
 
     #[clap(long)]
     pub mix_port: Option<u16>,
@@ -95,7 +96,7 @@ pub async fn vesting_bond_mixnode(client: SigningClient, args: Args, denom: &str
     };
 
     let res = client
-        .vesting_bond_mixnode(mixnode, cost_params, &args.signature, coin.into(), None)
+        .vesting_bond_mixnode(mixnode, cost_params, args.signature, coin.into(), None)
         .await
         .expect("failed to bond vesting mixnode!");
 

common/cosmwasm-smart-contracts/coconut-dkg/src/types.rs

@@ -21,7 +21,7 @@ pub const TOTAL_DEALINGS: usize = 2 + 2 + 1;
 #[derive(Serialize, Deserialize, Default, Clone, Debug, PartialEq, Eq, Ord, PartialOrd)]
 pub struct InitialReplacementData {
     pub initial_dealers: Vec<Addr>,
-    pub initial_height: Option<u64>,
+    pub initial_height: u64,
 }
 
 #[derive(

common/cosmwasm-smart-contracts/contracts-common/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "nym-contracts-common"
-version = "0.3.0"
+version = "0.4.0"
 description = "Common library for Nym cosmwasm contracts"
 edition = { workspace = true }
 authors = { workspace = true }

common/cosmwasm-smart-contracts/contracts-common/src/lib.rs

@@ -6,6 +6,7 @@
 
 pub mod dealings;
 pub mod events;
+pub mod signing;
 pub mod types;
 
 pub use types::*;

common/cosmwasm-smart-contracts/contracts-common/src/signing/mod.rs

@@ -0,0 +1,259 @@
+// Copyright 2023 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use cosmwasm_std::{from_slice, to_vec, Addr, Coin, MessageInfo, StdResult};
+use schemars::JsonSchema;
+use serde::de::DeserializeOwned;
+use serde::{de, Deserialize, Deserializer, Serialize, Serializer};
+use std::fmt::{Display, Formatter};
+use std::str::FromStr;
+pub use verifier::Verifier;
+
+pub mod verifier;
+
+pub type Nonce = u32;
+
+// define this type explicitly for [hopefully] better usability
+// (so you wouldn't need to worry about whether you should use bytes, bs58, etc.)
+#[derive(Clone, Debug, PartialEq, JsonSchema)]
+pub struct MessageSignature(Vec<u8>);
+
+impl MessageSignature {
+    pub fn as_bs58_string(&self) -> String {
+        bs58::encode(&self.0).into_string()
+    }
+}
+
+impl<'a> From<&'a [u8]> for MessageSignature {
+    fn from(value: &'a [u8]) -> Self {
+        MessageSignature(value.to_vec())
+    }
+}
+
+impl From<Vec<u8>> for MessageSignature {
+    fn from(value: Vec<u8>) -> Self {
+        MessageSignature(value)
+    }
+}
+
+impl<'a> TryFrom<&'a str> for MessageSignature {
+    type Error = bs58::decode::Error;
+
+    fn try_from(value: &'a str) -> Result<Self, Self::Error> {
+        Ok(MessageSignature(bs58::decode(value).into_vec()?))
+    }
+}
+
+impl TryFrom<String> for MessageSignature {
+    type Error = bs58::decode::Error;
+
+    fn try_from(value: String) -> Result<Self, Self::Error> {
+        Self::try_from(value.as_str())
+    }
+}
+
+impl AsRef<[u8]> for MessageSignature {
+    #[inline]
+    fn as_ref(&self) -> &[u8] {
+        &self.0
+    }
+}
+
+impl<'de> Deserialize<'de> for MessageSignature {
+    fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
+    where
+        D: Deserializer<'de>,
+    {
+        let inner = String::deserialize(deserializer)?;
+        let bytes = bs58::decode(inner).into_vec().map_err(de::Error::custom)?;
+        Ok(MessageSignature(bytes))
+    }
+}
+
+impl Serialize for MessageSignature {
+    fn serialize<S>(&self, serializer: S) -> Result<S::Ok, S::Error>
+    where
+        S: Serializer,
+    {
+        let bs58_encoded = self.as_bs58_string();
+        bs58_encoded.serialize(serializer)
+    }
+}
+
+impl Display for MessageSignature {
+    fn fmt(&self, f: &mut Formatter<'_>) -> std::fmt::Result {
+        write!(f, "{}", self.as_bs58_string())
+    }
+}
+
+impl FromStr for MessageSignature {
+    type Err = bs58::decode::Error;
+
+    fn from_str(s: &str) -> Result<Self, Self::Err> {
+        Self::try_from(s)
+    }
+}
+
+pub trait SigningPurpose {
+    fn message_type() -> MessageType;
+}
+
+#[derive(Serialize, Deserialize)]
+#[serde(transparent)]
+pub struct MessageType(String);
+
+impl MessageType {
+    pub fn new<S: Into<String>>(typ: S) -> Self {
+        MessageType(typ.into())
+    }
+}
+
+impl<T> From<T> for MessageType
+where
+    T: ToString,
+{
+    fn from(value: T) -> Self {
+        MessageType(value.to_string())
+    }
+}
+
+#[derive(Default, Debug, Serialize, Deserialize, Copy, Clone)]
+#[serde(rename_all = "lowercase")]
+pub enum SigningAlgorithm {
+    #[default]
+    Ed25519,
+    Secp256k1,
+}
+
+impl SigningAlgorithm {
+    pub fn is_ed25519(&self) -> bool {
+        matches!(self, SigningAlgorithm::Ed25519)
+    }
+}
+
+// TODO: maybe move this one to repo-wide common?
+// TODO: should it perhaps also include the public key itself?
+#[derive(Serialize, Deserialize)]
+pub struct SignableMessage<T> {
+    pub nonce: u32,
+    pub algorithm: SigningAlgorithm,
+    pub message_type: MessageType,
+
+    pub content: T,
+}
+
+impl<T> SignableMessage<T>
+where
+    T: SigningPurpose,
+{
+    pub fn new(nonce: u32, content: T) -> Self {
+        SignableMessage {
+            nonce,
+            algorithm: SigningAlgorithm::Ed25519,
+            message_type: T::message_type(),
+            content,
+        }
+    }
+
+    pub fn with_signing_algorithm(mut self, algorithm: SigningAlgorithm) -> Self {
+        self.algorithm = algorithm;
+        self
+    }
+
+    pub fn to_plaintext(&self) -> StdResult<Vec<u8>>
+    where
+        T: Serialize,
+    {
+        to_vec(self)
+    }
+
+    pub fn to_sha256_plaintext_digest(&self) -> StdResult<Vec<u8>>
+    where
+        T: Serialize,
+    {
+        unimplemented!()
+    }
+
+    pub fn to_json_string(&self) -> StdResult<String>
+    where
+        T: Serialize,
+    {
+        // if you look into implementation of `serde_json_wasm::to_string` this [i.e. the String conversion]
+        // CAN'T fail, but let's avoid this unnecessary unwrap either way
+        self.to_plaintext()
+            .map(|s| String::from_utf8(s).unwrap_or(String::from("SERIALIZATION FAILURE")))
+    }
+
+    pub fn to_base58_string(&self) -> StdResult<String>
+    where
+        T: Serialize,
+    {
+        self.to_plaintext().map(|s| bs58::encode(s).into_string())
+    }
+
+    pub fn try_from_bytes(bytes: &[u8]) -> StdResult<SignableMessage<T>>
+    where
+        T: DeserializeOwned,
+    {
+        from_slice(bytes)
+    }
+
+    pub fn try_from_string(raw: &str) -> StdResult<SignableMessage<T>>
+    where
+        T: DeserializeOwned,
+    {
+        Self::try_from_bytes(raw.as_bytes())
+    }
+
+    pub fn try_from_base58_string(raw: &str) -> bs58::decode::Result<StdResult<SignableMessage<T>>>
+    where
+        T: DeserializeOwned,
+    {
+        bs58::decode(raw)
+            .into_vec()
+            .map(|d| Self::try_from_bytes(&d))
+    }
+}
+
+#[derive(Serialize)]
+pub struct ContractMessageContent<T> {
+    pub sender: Addr,
+    pub proxy: Option<Addr>,
+    pub funds: Vec<Coin>,
+    pub data: T,
+}
+
+impl<T> SigningPurpose for ContractMessageContent<T>
+where
+    T: SigningPurpose,
+{
+    fn message_type() -> MessageType {
+        T::message_type()
+    }
+}
+
+impl<T> ContractMessageContent<T> {
+    pub fn new(sender: Addr, proxy: Option<Addr>, funds: Vec<Coin>, data: T) -> Self {
+        ContractMessageContent {
+            sender,
+            proxy,
+            funds,
+            data,
+        }
+    }
+
+    pub fn new_with_info(info: MessageInfo, signer: Addr, data: T) -> Self {
+        let proxy = if info.sender == signer {
+            None
+        } else {
+            Some(info.sender)
+        };
+
+        ContractMessageContent {
+            sender: signer,
+            proxy,
+            funds: info.funds,
+            data,
+        }
+    }
+}

common/cosmwasm-smart-contracts/contracts-common/src/signing/verifier.rs

@@ -0,0 +1,81 @@
+// Copyright 2023 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::signing::{MessageSignature, SignableMessage, SigningAlgorithm, SigningPurpose};
+use cosmwasm_std::{Api, StdError, VerificationError};
+use serde::Serialize;
+use thiserror::Error;
+
+pub trait Verifier {
+    type Error: From<StdError>;
+
+    fn verify_message<T: Serialize + SigningPurpose>(
+        &self,
+        message: SignableMessage<T>,
+        signature: MessageSignature,
+        public_key: &[u8],
+    ) -> Result<bool, Self::Error> {
+        match message.algorithm {
+            SigningAlgorithm::Ed25519 => {
+                let plaintext = message.to_plaintext()?;
+                self.verify_ed25519(&plaintext, signature.as_ref(), public_key)
+            }
+            SigningAlgorithm::Secp256k1 => {
+                let plaintext = message.to_sha256_plaintext_digest()?;
+                self.verify_secp256k1(&plaintext, signature.as_ref(), public_key)
+            }
+        }
+    }
+
+    fn verify_ed25519(
+        &self,
+        _message: &[u8],
+        _signature: &[u8],
+        _public_key: &[u8],
+    ) -> Result<bool, Self::Error> {
+        unimplemented!()
+    }
+
+    fn verify_secp256k1(
+        &self,
+        _message_hash: &[u8],
+        _signature: &[u8],
+        _public_key: &[u8],
+    ) -> Result<bool, Self::Error> {
+        unimplemented!()
+    }
+}
+
+#[derive(Debug, Error, PartialEq)]
+pub enum ApiVerifierError {
+    #[error(transparent)]
+    Verification(#[from] VerificationError),
+
+    #[error(transparent)]
+    Std(#[from] StdError),
+}
+
+impl<T> Verifier for T
+where
+    T: Api + ?Sized,
+{
+    type Error = ApiVerifierError;
+
+    fn verify_ed25519(
+        &self,
+        message: &[u8],
+        signature: &[u8],
+        public_key: &[u8],
+    ) -> Result<bool, Self::Error> {
+        Ok(self.ed25519_verify(message, signature, public_key)?)
+    }
+
+    fn verify_secp256k1(
+        &self,
+        message_hash: &[u8],
+        signature: &[u8],
+        public_key: &[u8],
+    ) -> Result<bool, Self::Error> {
+        Ok(self.secp256k1_verify(message_hash, signature, public_key)?)
+    }
+}

common/cosmwasm-smart-contracts/mixnet-contract/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "nym-mixnet-contract-common"
-version = "0.3.0"
+version = "0.4.0"
 description = "Common library for the Nym mixnet contract"
 rust-version = "1.62"
 edition = { workspace = true }
@@ -15,8 +15,10 @@ serde = { version = "1.0", features = ["derive"] }
 serde_repr = "0.1"
 schemars = "0.8"
 thiserror = "1.0"
-contracts-common = { path = "../contracts-common", package = "nym-contracts-common", version = "0.3.0" }
-serde_json = "1.0.0"
+contracts-common = { path = "../contracts-common", package = "nym-contracts-common", version = "0.4.0" }
+# use 0.4.1 as that's the version used by cosmwasm-std 1.0.0
+# (and ideally we don't want to pull the same dependency twice)
+serde-json-wasm = "=0.4.1"
 humantime-serde = "1.1.1"
 
 # TO CHECK WHETHER STILL NEEDED:

common/cosmwasm-smart-contracts/mixnet-contract/src/error.rs

@@ -2,6 +2,7 @@
 // SPDX-License-Identifier: Apache-2.0
 
 use crate::{EpochState, IdentityKey, MixId};
+use contracts_common::signing::verifier::ApiVerifierError;
 use cosmwasm_std::{Addr, Coin, Decimal};
 use thiserror::Error;
 
@@ -218,4 +219,10 @@ pub enum MixnetContractError {
         value: String,
         error_message: String,
     },
+
+    #[error("failed to verify message signature: {source}")]
+    SignatureVerificationFailure {
+        #[from]
+        source: ApiVerifierError,
+    },
 }

common/cosmwasm-smart-contracts/mixnet-contract/src/events.rs

@@ -1,6 +1,7 @@
 // Copyright 2022 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0
 
+use crate::gateway::GatewayConfigUpdate;
 use crate::mixnode::{MixNodeConfigUpdate, MixNodeCostParams};
 use crate::reward_params::{IntervalRewardParams, IntervalRewardingParamsUpdate};
 use crate::rewarding::RewardDistribution;
@@ -42,6 +43,7 @@ pub enum MixnetEventType {
     ReconcilePendingEvents,
     PendingIntervalConfigUpdate,
     IntervalConfigUpdate,
+    GatewayConfigUpdate,
 }
 
 impl From<MixnetEventType> for String {
@@ -86,6 +88,7 @@ impl ToString for MixnetEventType {
             MixnetEventType::PendingIntervalConfigUpdate => "pending_interval_config_update",
             MixnetEventType::IntervalConfigUpdate => "interval_config_update",
             MixnetEventType::DelegationOnUnbonding => "delegation_on_unbonding_node",
+            MixnetEventType::GatewayConfigUpdate => "gateway_config_update",
         };
 
         format!("{EVENT_VERSION_PREFIX}{event_name}")
@@ -122,6 +125,7 @@ pub const OLD_REWARDING_VALIDATOR_ADDRESS_KEY: &str = "old_rewarding_validator_a
 pub const NEW_REWARDING_VALIDATOR_ADDRESS_KEY: &str = "new_rewarding_validator_address";
 
 pub const UPDATED_MIXNODE_CONFIG_KEY: &str = "updated_mixnode_config";
+pub const UPDATED_GATEWAY_CONFIG_KEY: &str = "updated_gateway_config";
 pub const UPDATED_MIXNODE_COST_PARAMS_KEY: &str = "updated_mixnode_cost_params";
 
 // rewarding
@@ -382,6 +386,17 @@ pub fn new_mixnode_config_update_event(
         .add_attribute(UPDATED_MIXNODE_CONFIG_KEY, update.to_inline_json())
 }
 
+pub fn new_gateway_config_update_event(
+    owner: &Addr,
+    proxy: &Option<Addr>,
+    update: &GatewayConfigUpdate,
+) -> Event {
+    Event::new(MixnetEventType::GatewayConfigUpdate)
+        .add_attribute(OWNER_KEY, owner)
+        .add_optional_attribute(PROXY_KEY, proxy.as_ref())
+        .add_attribute(UPDATED_GATEWAY_CONFIG_KEY, update.to_inline_json())
+}
+
 pub fn new_mixnode_pending_cost_params_update_event(
     mix_id: MixId,
     owner: &Addr,

common/cosmwasm-smart-contracts/mixnet-contract/src/families.rs

@@ -1,7 +1,9 @@
 use crate::{IdentityKey, IdentityKeyRef};
 use cosmwasm_std::Addr;
 use schemars::JsonSchema;
-use serde::{Deserialize, Serialize};
+use serde::{Deserialize, Deserializer, Serialize, Serializer};
+use std::fmt::{Display, Formatter};
+use std::str::FromStr;
 
 #[cfg_attr(feature = "generate-ts", derive(ts_rs::TS))]
 #[cfg_attr(
@@ -20,9 +22,45 @@ pub struct Family {
     feature = "generate-ts",
     ts(export_to = "ts-packages/types/src/types/rust/NodeFamilyHead.ts")
 )]
-#[derive(Serialize, Deserialize, Debug, Clone, Eq, PartialEq, JsonSchema)]
+#[derive(Debug, Clone, Eq, PartialEq, JsonSchema)]
 pub struct FamilyHead(IdentityKey);
 
+impl Serialize for FamilyHead {
+    fn serialize<S>(&self, serializer: S) -> Result<S::Ok, S::Error>
+    where
+        S: Serializer,
+    {
+        self.0.serialize(serializer)
+    }
+}
+
+impl<'de> Deserialize<'de> for FamilyHead {
+    fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
+    where
+        D: Deserializer<'de>,
+    {
+        let inner = IdentityKey::deserialize(deserializer)?;
+        Ok(FamilyHead(inner))
+    }
+}
+
+impl FromStr for FamilyHead {
+    type Err = <IdentityKey as FromStr>::Err;
+
+    fn from_str(s: &str) -> Result<Self, Self::Err> {
+        // theoretically we should be verifying whether it's a valid base58 value
+        // (or even better, whether it's a valid ed25519 public key), but definition of
+        // `FamilyHead` might change later
+        Ok(FamilyHead(IdentityKey::from_str(s)?))
+    }
+}
+
+impl Display for FamilyHead {
+    fn fmt(&self, f: &mut Formatter<'_>) -> std::fmt::Result {
+        self.0.fmt(f)
+    }
+}
+
 impl FamilyHead {
     pub fn new(identity: IdentityKeyRef<'_>) -> Self {
         FamilyHead(identity.to_string())
@@ -34,11 +72,11 @@ impl FamilyHead {
 }
 
 impl Family {
-    pub fn new(head: FamilyHead, proxy: Option<Addr>, label: &str) -> Self {
+    pub fn new(head: FamilyHead, proxy: Option<Addr>, label: String) -> Self {
         Family {
             head,
             proxy: proxy.map(|p| p.to_string()),
-            label: label.to_string(),
+            label,
         }
     }
 
@@ -60,3 +98,21 @@ impl Family {
         &self.label
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn family_head_serde() {
+        let dummy = FamilyHead::new("foomp");
+
+        let ser_str = serde_json_wasm::to_string(&dummy).unwrap();
+        let de_str: FamilyHead = serde_json_wasm::from_str(&ser_str).unwrap();
+        assert_eq!(dummy, de_str);
+
+        let ser_bytes = serde_json_wasm::to_vec(&dummy).unwrap();
+        let de_bytes: FamilyHead = serde_json_wasm::from_slice(&ser_bytes).unwrap();
+        assert_eq!(dummy, de_bytes);
+    }
+}

common/cosmwasm-smart-contracts/mixnet-contract/src/gateway.rs

@@ -112,6 +112,26 @@ impl Display for GatewayBond {
     }
 }
 
+#[cfg_attr(feature = "generate-ts", derive(ts_rs::TS))]
+#[cfg_attr(
+    feature = "generate-ts",
+    ts(export_to = "ts-packages/types/src/types/rust/GatewayConfigUpdate.ts")
+)]
+#[derive(Clone, Debug, Deserialize, PartialEq, Eq, Serialize, JsonSchema)]
+pub struct GatewayConfigUpdate {
+    pub host: String,
+    pub mix_port: u16,
+    pub clients_port: u16,
+    pub location: String,
+    pub version: String,
+}
+
+impl GatewayConfigUpdate {
+    pub fn to_inline_json(&self) -> String {
+        serde_json_wasm::to_string(self).unwrap_or_else(|_| "serialisation failure".into())
+    }
+}
+
 #[derive(Clone, Debug, Deserialize, PartialEq, Serialize, JsonSchema)]
 pub struct PagedGatewayResponse {
     pub nodes: Vec<GatewayBond>,

common/cosmwasm-smart-contracts/mixnet-contract/src/lib.rs

@@ -17,6 +17,7 @@ mod msg;
 pub mod pending_events;
 pub mod reward_params;
 pub mod rewarding;
+pub mod signing_types;
 mod types;
 
 pub use contracts_common::types::*;
@@ -26,7 +27,8 @@ pub use delegation::{
     PagedMixNodeDelegationsResponse,
 };
 pub use gateway::{
-    Gateway, GatewayBond, GatewayBondResponse, GatewayOwnershipResponse, PagedGatewayResponse,
+    Gateway, GatewayBond, GatewayBondResponse, GatewayConfigUpdate, GatewayOwnershipResponse,
+    PagedGatewayResponse,
 };
 pub use interval::{
     CurrentIntervalResponse, EpochState, EpochStatus, Interval, NumberOfPendingEventsResponse,
@@ -43,4 +45,5 @@ pub use pending_events::{
     PendingIntervalEventData, PendingIntervalEventKind,
 };
 pub use reward_params::{IntervalRewardParams, IntervalRewardingParamsUpdate, RewardingParams};
+pub use signing_types::*;
 pub use types::*;

common/cosmwasm-smart-contracts/mixnet-contract/src/mixnode.rs

@@ -542,7 +542,7 @@ pub struct MixNodeCostParams {
 
 impl MixNodeCostParams {
     pub fn to_inline_json(&self) -> String {
-        serde_json::to_string(self).unwrap_or_else(|_| "serialisation failure".into())
+        serde_json_wasm::to_string(self).unwrap_or_else(|_| "serialisation failure".into())
     }
 }
 
@@ -636,7 +636,7 @@ pub struct MixNodeConfigUpdate {
 
 impl MixNodeConfigUpdate {
     pub fn to_inline_json(&self) -> String {
-        serde_json::to_string(self).unwrap_or_else(|_| "serialisation failure".into())
+        serde_json_wasm::to_string(self).unwrap_or_else(|_| "serialisation failure".into())
     }
 }
 

common/cosmwasm-smart-contracts/mixnet-contract/src/msg.rs

@@ -3,6 +3,8 @@
 
 use crate::delegation::OwnerProxySubKey;
 use crate::error::MixnetContractError;
+use crate::families::FamilyHead;
+use crate::gateway::GatewayConfigUpdate;
 use crate::helpers::IntoBaseDecimal;
 use crate::mixnode::{MixNodeConfigUpdate, MixNodeCostParams};
 use crate::reward_params::{
@@ -10,6 +12,7 @@ use crate::reward_params::{
 };
 use crate::{delegation, ContractStateParams, Layer, LayerAssignment, MixId, Percent};
 use crate::{Gateway, IdentityKey, MixNode};
+use contracts_common::signing::MessageSignature;
 use cosmwasm_std::Decimal;
 use schemars::JsonSchema;
 use serde::{Deserialize, Serialize};
@@ -80,42 +83,35 @@ pub enum ExecuteMsg {
     // Families
     /// Only owner of the node can crate the family with node as head
     CreateFamily {
-        owner_signature: String,
         label: String,
     },
     /// Family head needs to sign the joining node IdentityKey
     JoinFamily {
-        signature: String,
-        family_head: IdentityKey,
+        join_permit: MessageSignature,
+        family_head: FamilyHead,
     },
     LeaveFamily {
-        signature: String,
-        family_head: IdentityKey,
+        family_head: FamilyHead,
     },
     KickFamilyMember {
-        signature: String,
         member: IdentityKey,
     },
     CreateFamilyOnBehalf {
         owner_address: String,
-        owner_signature: String,
         label: String,
     },
     /// Family head needs to sign the joining node IdentityKey, MixNode needs to provide its signature proving that it wants to join the family
     JoinFamilyOnBehalf {
         member_address: String,
-        node_identity_signature: String,
-        family_signature: String,
-        family_head: IdentityKey,
+        join_permit: MessageSignature,
+        family_head: FamilyHead,
     },
     LeaveFamilyOnBehalf {
         member_address: String,
-        node_identity_signature: String,
-        family_head: IdentityKey,
+        family_head: FamilyHead,
     },
     KickFamilyMemberOnBehalf {
         head_address: String,
-        signature: String,
         member: IdentityKey,
     },
 
@@ -153,12 +149,12 @@ pub enum ExecuteMsg {
     BondMixnode {
         mix_node: MixNode,
         cost_params: MixNodeCostParams,
-        owner_signature: String,
+        owner_signature: MessageSignature,
     },
     BondMixnodeOnBehalf {
         mix_node: MixNode,
         cost_params: MixNodeCostParams,
-        owner_signature: String,
+        owner_signature: MessageSignature,
         owner: String,
     },
     PledgeMore {},
@@ -187,17 +183,24 @@ pub enum ExecuteMsg {
     // gateway-related:
     BondGateway {
         gateway: Gateway,
-        owner_signature: String,
+        owner_signature: MessageSignature,
     },
     BondGatewayOnBehalf {
         gateway: Gateway,
         owner: String,
-        owner_signature: String,
+        owner_signature: MessageSignature,
     },
     UnbondGateway {},
     UnbondGatewayOnBehalf {
         owner: String,
     },
+    UpdateGatewayConfig {
+        new_config: GatewayConfigUpdate,
+    },
+    UpdateGatewayConfigOnBehalf {
+        new_config: GatewayConfigUpdate,
+        owner: String,
+    },
 
     // delegation-related:
     DelegateToMixnode {
@@ -312,6 +315,10 @@ impl ExecuteMsg {
             }
             ExecuteMsg::UnbondGateway { .. } => "unbonding gateway".into(),
             ExecuteMsg::UnbondGatewayOnBehalf { .. } => "unbonding gateway on behalf".into(),
+            ExecuteMsg::UpdateGatewayConfig { .. } => "updating gateway configuration".into(),
+            ExecuteMsg::UpdateGatewayConfigOnBehalf { .. } => {
+                "updating gateway configuration on behalf".into()
+            }
             ExecuteMsg::DelegateToMixnode { mix_id } => format!("delegating to mixnode {mix_id}"),
             ExecuteMsg::DelegateToMixnodeOnBehalf { mix_id, .. } => {
                 format!("delegating to mixnode {mix_id} on behalf")
@@ -500,6 +507,11 @@ pub enum QueryMsg {
         start_after: Option<u32>,
     },
     GetNumberOfPendingEvents {},
+
+    // signing-related
+    GetSigningNonce {
+        address: String,
+    },
 }
 
 #[derive(Serialize, Deserialize, Clone, Debug, PartialEq, Eq, JsonSchema)]

common/cosmwasm-smart-contracts/mixnet-contract/src/reward_params.rs

@@ -70,7 +70,7 @@ pub struct IntervalRewardParams {
 
 impl IntervalRewardParams {
     pub fn to_inline_json(&self) -> String {
-        serde_json::to_string(self).unwrap_or_else(|_| "serialisation failure".into())
+        serde_json_wasm::to_string(self).unwrap_or_else(|_| "serialisation failure".into())
     }
 }
 
@@ -282,6 +282,6 @@ impl IntervalRewardingParamsUpdate {
     }
 
     pub fn to_inline_json(&self) -> String {
-        serde_json::to_string(self).unwrap_or_else(|_| "serialisation failure".into())
+        serde_json_wasm::to_string(self).unwrap_or_else(|_| "serialisation failure".into())
     }
 }

common/cosmwasm-smart-contracts/mixnet-contract/src/signing_types.rs

@@ -0,0 +1,121 @@
+// Copyright 2023 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::families::FamilyHead;
+use crate::{Gateway, IdentityKey, MixNode, MixNodeCostParams};
+use contracts_common::signing::{
+    ContractMessageContent, MessageType, Nonce, SignableMessage, SigningPurpose,
+};
+use cosmwasm_std::{Addr, Coin};
+use serde::Serialize;
+
+pub type SignableMixNodeBondingMsg = SignableMessage<ContractMessageContent<MixnodeBondingPayload>>;
+pub type SignableGatewayBondingMsg = SignableMessage<ContractMessageContent<GatewayBondingPayload>>;
+pub type SignableFamilyJoinPermitMsg = SignableMessage<FamilyJoinPermit>;
+
+#[derive(Serialize)]
+pub struct MixnodeBondingPayload {
+    mix_node: MixNode,
+    cost_params: MixNodeCostParams,
+}
+
+impl MixnodeBondingPayload {
+    pub fn new(mix_node: MixNode, cost_params: MixNodeCostParams) -> Self {
+        Self {
+            mix_node,
+            cost_params,
+        }
+    }
+}
+
+impl SigningPurpose for MixnodeBondingPayload {
+    fn message_type() -> MessageType {
+        MessageType::new("mixnode-bonding")
+    }
+}
+
+pub fn construct_mixnode_bonding_sign_payload(
+    nonce: Nonce,
+    sender: Addr,
+    proxy: Option<Addr>,
+    pledge: Coin,
+    mix_node: MixNode,
+    cost_params: MixNodeCostParams,
+) -> SignableMixNodeBondingMsg {
+    let payload = MixnodeBondingPayload::new(mix_node, cost_params);
+    let content = ContractMessageContent::new(sender, proxy, vec![pledge], payload);
+
+    SignableMessage::new(nonce, content)
+}
+
+#[derive(Serialize)]
+pub struct GatewayBondingPayload {
+    gateway: Gateway,
+}
+
+impl GatewayBondingPayload {
+    pub fn new(gateway: Gateway) -> Self {
+        Self { gateway }
+    }
+}
+
+impl SigningPurpose for GatewayBondingPayload {
+    fn message_type() -> MessageType {
+        MessageType::new("gateway-bonding")
+    }
+}
+
+pub fn construct_gateway_bonding_sign_payload(
+    nonce: Nonce,
+    sender: Addr,
+    proxy: Option<Addr>,
+    pledge: Coin,
+    gateway: Gateway,
+) -> SignableGatewayBondingMsg {
+    let payload = GatewayBondingPayload::new(gateway);
+    let content = ContractMessageContent::new(sender, proxy, vec![pledge], payload);
+
+    SignableMessage::new(nonce, content)
+}
+
+#[derive(Serialize)]
+pub struct FamilyJoinPermit {
+    // the granter of this permit
+    family_head: FamilyHead,
+    // whether the **member** will want to join via the proxy (i.e. vesting contract)
+    proxy: Option<Addr>,
+    // the actual member we want to permit to join
+    member_node: IdentityKey,
+}
+
+impl FamilyJoinPermit {
+    pub fn new(family_head: FamilyHead, proxy: Option<Addr>, member_node: IdentityKey) -> Self {
+        Self {
+            family_head,
+            proxy,
+            member_node,
+        }
+    }
+}
+
+impl SigningPurpose for FamilyJoinPermit {
+    fn message_type() -> MessageType {
+        MessageType::new("family-join-permit")
+    }
+}
+
+pub fn construct_family_join_permit(
+    nonce: Nonce,
+    family_head: FamilyHead,
+    proxy: Option<Addr>,
+    member_node: IdentityKey,
+) -> SignableFamilyJoinPermitMsg {
+    let payload = FamilyJoinPermit::new(family_head, proxy, member_node);
+
+    // note: we're NOT wrapping it in `ContractMessageContent` because the family head is not going to be the one
+    // sending the message to the contract
+    SignableMessage::new(nonce, payload)
+}
+
+// TODO: depending on our threat model, we should perhaps extend it to include all _on_behalf methods
+// (update: but we trust our vesting contract since its compromise would be even more devastating so there's no need)

common/cosmwasm-smart-contracts/vesting-contract/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "nym-vesting-contract-common"
-version = "0.3.0"
+version = "0.4.0"
 description = "Common library for the Nym vesting contract"
 edition = { workspace = true }
 authors = { workspace = true }
@@ -9,8 +9,8 @@ repository = { workspace = true }
 
 [dependencies]
 cosmwasm-std = { workspace = true }
-mixnet-contract-common = { path = "../mixnet-contract", package = "nym-mixnet-contract-common", version = "0.3.0" }
-contracts-common = { path = "../contracts-common", package = "nym-contracts-common", version = "0.3.0" }
+mixnet-contract-common = { path = "../mixnet-contract", package = "nym-mixnet-contract-common", version = "0.4.0" }
+contracts-common = { path = "../contracts-common", package = "nym-contracts-common", version = "0.4.0" }
 serde = { version = "1.0", features = ["derive"] }
 schemars = "0.8"
 ts-rs = {version = "6.1.2", optional = true}

common/cosmwasm-smart-contracts/vesting-contract/src/events.rs

@@ -17,6 +17,7 @@ pub const VESTING_MIXNODE_BONDING_EVENT_TYPE: &str = "vesting_mixnode_bonding";
 pub const VESTING_PLEDGE_MORE_EVENT_TYPE: &str = "vesting_pledge_more";
 pub const VESTING_MIXNODE_UNBONDING_EVENT_TYPE: &str = "vesting_mixnode_unbonding";
 pub const VESTING_UPDATE_MIXNODE_CONFIG_EVENT_TYPE: &str = "vesting_update_mixnode_config";
+pub const VESTING_UPDATE_GATEWAY_CONFIG_EVENT_TYPE: &str = "vesting_update_gateway_config";
 pub const VESTING_UPDATE_MIXNODE_COST_PARAMS_EVENT_TYPE: &str =
     "vesting_update_mixnode_cost_params";
 
@@ -121,6 +122,10 @@ pub fn new_vesting_update_mixnode_config_event() -> Event {
     Event::new(VESTING_UPDATE_MIXNODE_CONFIG_EVENT_TYPE)
 }
 
+pub fn new_vesting_update_gateway_config_event() -> Event {
+    Event::new(VESTING_UPDATE_GATEWAY_CONFIG_EVENT_TYPE)
+}
+
 pub fn new_vesting_update_mixnode_cost_params_event() -> Event {
     Event::new(VESTING_UPDATE_MIXNODE_COST_PARAMS_EVENT_TYPE)
 }

common/cosmwasm-smart-contracts/vesting-contract/src/messages.rs

@@ -1,5 +1,8 @@
+use contracts_common::signing::MessageSignature;
 use cosmwasm_std::{Coin, Timestamp};
+use mixnet_contract_common::families::FamilyHead;
 use mixnet_contract_common::{
+    gateway::GatewayConfigUpdate,
     mixnode::{MixNodeConfigUpdate, MixNodeCostParams},
     Gateway, IdentityKey, MixId, MixNode,
 };
@@ -58,21 +61,17 @@ pub enum ExecuteMsg {
     // Families
     /// Only owner of the node can crate the family with node as head
     CreateFamily {
-        owner_signature: String,
         label: String,
     },
     /// Family head needs to sign the joining node IdentityKey, the Node provides its signature signaling consent to join the family
     JoinFamily {
-        node_identity_signature: String,
-        family_signature: String,
-        family_head: IdentityKey,
+        join_permit: MessageSignature,
+        family_head: FamilyHead,
     },
     LeaveFamily {
-        node_identity_signature: String,
-        family_head: IdentityKey,
+        family_head: FamilyHead,
     },
     KickFamilyMember {
-        signature: String,
         member: IdentityKey,
     },
     TrackReward {
@@ -118,7 +117,7 @@ pub enum ExecuteMsg {
     BondMixnode {
         mix_node: MixNode,
         cost_params: MixNodeCostParams,
-        owner_signature: String,
+        owner_signature: MessageSignature,
         amount: Coin,
     },
     PledgeMore {
@@ -131,7 +130,7 @@ pub enum ExecuteMsg {
     },
     BondGateway {
         gateway: Gateway,
-        owner_signature: String,
+        owner_signature: MessageSignature,
         amount: Coin,
     },
     UnbondGateway {},
@@ -139,6 +138,9 @@ pub enum ExecuteMsg {
         owner: String,
         amount: Coin,
     },
+    UpdateGatewayConfig {
+        new_config: GatewayConfigUpdate,
+    },
     TransferOwnership {
         to_address: String,
     },
@@ -178,6 +180,7 @@ impl ExecuteMsg {
             ExecuteMsg::BondGateway { .. } => "VestingExecuteMsg::BondGateway",
             ExecuteMsg::UnbondGateway { .. } => "VestingExecuteMsg::UnbondGateway",
             ExecuteMsg::TrackUnbondGateway { .. } => "VestingExecuteMsg::TrackUnbondGateway",
+            ExecuteMsg::UpdateGatewayConfig { .. } => "VestingExecuteMsg::UpdateGatewayConfig",
             ExecuteMsg::TransferOwnership { .. } => "VestingExecuteMsg::TransferOwnership",
             ExecuteMsg::UpdateStakingAddress { .. } => "VestingExecuteMsg::UpdateStakingAddress",
             ExecuteMsg::UpdateLockedPledgeCap { .. } => "VestingExecuteMsg::UpdateLockedPledgeCap",

common/mixnode-common/src/verloc/listener.rs

@@ -99,17 +99,24 @@ impl ConnectionHandler {
         let mut framed_conn = Framed::new(conn, EchoPacketCodec);
         while !shutdown_listener.is_shutdown() {
             tokio::select! {
-                Some(echo_packet) = framed_conn.next() => {
+                biased;
+               _ = shutdown_listener.recv() => {
+                    trace!("ConnectionHandler: Shutdown received");
+                }
+                maybe_echo_packet = framed_conn.next() => {
                     // handle echo packet
-                    let reply_packet = match echo_packet {
-                        Ok(echo_packet) => self.handle_echo_packet(echo_packet),
-                        Err(err) => {
-                            error!(
-                                "The socket connection got corrupted with error: {}. Closing the socket",
-                                err
+                    let reply_packet = match maybe_echo_packet {
+                        Some(Ok(echo_packet)) => self.handle_echo_packet(echo_packet),
+                        Some(Err(err)) => {
+                             error!(
+                                "The socket connection got corrupted with error: {err}. Closing the socket",
                             );
                             return;
                         }
+                        None => {
+                            error!("The socket connection got terminated by the remote!");
+                            return;
+                        }
                     };
 
                     // write back the reply (note the lack of framing)
@@ -125,9 +132,6 @@ impl ConnectionHandler {
                         return;
                     }
                 },
-                _ = shutdown_listener.recv() => {
-                    trace!("ConnectionHandler: Shutdown received");
-                }
             }
         }
     }

common/nymsphinx/Cargo.toml

@@ -26,6 +26,9 @@ nym-sphinx-types = { path = "types" }
 nym-crypto = { path = "../crypto", version = "0.2.0" }
 nym-topology = { path = "../topology" }
 
+# outfox
+nym-outfox = { path = "../../nym-outfox" }
+
 [dev-dependencies]
 nym-mixnet-contract-common = { path = "../cosmwasm-smart-contracts/mixnet-contract" }
 

common/nymsphinx/src/receiver.rs

@@ -7,6 +7,8 @@ use nym_crypto::asymmetric::encryption;
 use nym_crypto::shared_key::recompute_shared_key;
 use nym_crypto::symmetric::stream_cipher;
 use nym_crypto::symmetric::stream_cipher::CipherKey;
+use nym_outfox::error::OutfoxError;
+use nym_outfox::lion::lion_transform_decrypt;
 use nym_sphinx_anonymous_replies::requests::AnonymousSenderTag;
 use nym_sphinx_anonymous_replies::SurbEncryptionKey;
 use nym_sphinx_chunking::fragment::Fragment;
@@ -74,54 +76,76 @@ pub enum MessageRecoveryError {
 
     #[error("Failed to recover message fragment - {0}")]
     FragmentRecoveryError(#[from] ChunkingError),
+
+    #[error("Outfox: {source}")]
+    OutfoxRecoveryError {
+        #[from]
+        source: OutfoxError,
+    },
 }
 
-pub struct MessageReceiver {
-    /// High level public structure used to buffer all received data [`Fragment`]s and eventually
-    /// returning original messages that they encapsulate.
+#[derive(Default)]
+pub struct OutfoxMessageReceiver {
     reconstructor: MessageReconstructor,
-
-    /// Number of mix hops each packet ('real' message, ack, reply) is expected to take.
-    /// Note that it does not include gateway hops.
-    num_mix_hops: u8,
 }
 
-impl MessageReceiver {
+impl OutfoxMessageReceiver {
     pub fn new() -> Self {
         Default::default()
     }
+}
 
-    /// Allows setting non-default number of expected mix hops in the network.
-    #[must_use]
-    pub fn with_mix_hops(mut self, hops: u8) -> Self {
-        self.num_mix_hops = hops;
-        self
+impl MessageReceiver for OutfoxMessageReceiver {
+    fn new() -> Self {
+        Self::default()
     }
 
-    fn decrypt_raw_message<C>(&self, message: &mut [u8], key: &CipherKey<C>)
+    fn reconstructor(&mut self) -> &mut MessageReconstructor {
+        &mut self.reconstructor
+    }
+
+    fn num_mix_hops(&self) -> u8 {
+        DEFAULT_NUM_MIX_HOPS
+    }
+
+    fn decrypt_raw_message<C>(
+        &self,
+        message: &mut [u8],
+        key: &CipherKey<C>,
+    ) -> Result<(), MessageRecoveryError>
     where
         C: StreamCipher + KeyIvInit,
     {
-        let zero_iv = stream_cipher::zero_iv::<C>();
-        stream_cipher::decrypt_in_place::<C>(key, &zero_iv, message)
+        lion_transform_decrypt(message, key)?;
+        Ok(())
     }
+}
 
-    /// Given raw fragment data, **WITH KEY DIGEST PREFIX ALREADY REMOVED!!**, uses looked up
-    /// key to decrypt fragment data
-    pub fn recover_plaintext_from_reply(
+pub trait MessageReceiver {
+    fn new() -> Self;
+    fn reconstructor(&mut self) -> &mut MessageReconstructor;
+    fn num_mix_hops(&self) -> u8;
+
+    fn decrypt_raw_message<C>(
+        &self,
+        message: &mut [u8],
+        key: &CipherKey<C>,
+    ) -> Result<(), MessageRecoveryError>
+    where
+        C: StreamCipher + KeyIvInit;
+
+    fn recover_plaintext_from_reply(
         &self,
         reply_ciphertext: &mut [u8],
         reply_key: SurbEncryptionKey,
-    ) {
+    ) -> Result<(), MessageRecoveryError> {
         self.decrypt_raw_message::<ReplySurbEncryptionAlgorithm>(
             reply_ciphertext,
             reply_key.inner(),
         )
     }
 
-    /// Given raw fragment data, recovers the remote ephemeral key, recomputes shared secret,
-    /// uses it to decrypt fragment data
-    pub fn recover_plaintext_from_regular_packet<'a>(
+    fn recover_plaintext_from_regular_packet<'a>(
         &self,
         local_key: &encryption::PrivateKey,
         raw_enc_frag: &'a mut [u8],
@@ -146,30 +170,25 @@ impl MessageReceiver {
         // 3. decrypt fragment data
         let fragment_ciphertext = &mut raw_enc_frag[encryption::PUBLIC_KEY_SIZE..];
 
-        self.decrypt_raw_message::<PacketEncryptionAlgorithm>(fragment_ciphertext, &encryption_key);
+        self.decrypt_raw_message::<PacketEncryptionAlgorithm>(
+            fragment_ciphertext,
+            &encryption_key,
+        )?;
         let fragment_data = fragment_ciphertext;
 
         Ok(fragment_data)
     }
 
-    /// Given fragment data recovers [`Fragment`] itself.
-    pub fn recover_fragment(&self, frag_data: &[u8]) -> Result<Fragment, MessageRecoveryError> {
+    fn recover_fragment(&self, frag_data: &[u8]) -> Result<Fragment, MessageRecoveryError> {
         Ok(Fragment::try_from_bytes(frag_data)?)
     }
 
-    /// Inserts given [`Fragment`] into the reconstructor.
-    /// If it was last remaining [`Fragment`] for the original message, the message is reconstructed
-    /// and returned alongside all (if applicable) set ids used in the message.
-    ///
-    /// # Returns:
-    /// - The reconstructed message alongside optional reply SURB,
-    /// - List of ids of all the [`Set`]s used during reconstruction to detect stale retransmissions.
-    pub fn insert_new_fragment(
+    fn insert_new_fragment(
         &mut self,
         fragment: Fragment,
     ) -> Result<Option<(NymMessage, Vec<i32>)>, MessageRecoveryError> {
-        if let Some((message, used_sets)) = self.reconstructor.insert_new_fragment(fragment) {
-            match PaddedMessage::new_reconstructed(message).remove_padding(self.num_mix_hops) {
+        if let Some((message, used_sets)) = self.reconstructor().insert_new_fragment(fragment) {
+            match PaddedMessage::new_reconstructed(message).remove_padding(self.num_mix_hops()) {
                 Ok(message) => Ok(Some((message, used_sets))),
                 Err(err) => Err(MessageRecoveryError::MalformedReconstructedMessage {
                     source: err,
@@ -182,9 +201,56 @@ impl MessageReceiver {
     }
 }
 
-impl Default for MessageReceiver {
+#[derive(Clone)]
+pub struct SphinxMessageReceiver {
+    /// High level public structure used to buffer all received data [`Fragment`]s and eventually
+    /// returning original messages that they encapsulate.
+    reconstructor: MessageReconstructor,
+
+    /// Number of mix hops each packet ('real' message, ack, reply) is expected to take.
+    /// Note that it does not include gateway hops.
+    num_mix_hops: u8,
+}
+
+impl SphinxMessageReceiver {
+    /// Allows setting non-default number of expected mix hops in the network.
+    #[must_use]
+    pub fn with_mix_hops(mut self, hops: u8) -> Self {
+        self.num_mix_hops = hops;
+        self
+    }
+}
+
+impl MessageReceiver for SphinxMessageReceiver {
+    fn new() -> Self {
+        Default::default()
+    }
+
+    fn decrypt_raw_message<C>(
+        &self,
+        message: &mut [u8],
+        key: &CipherKey<C>,
+    ) -> Result<(), MessageRecoveryError>
+    where
+        C: StreamCipher + KeyIvInit,
+    {
+        let zero_iv = stream_cipher::zero_iv::<C>();
+        stream_cipher::decrypt_in_place::<C>(key, &zero_iv, message);
+        Ok(())
+    }
+
+    fn reconstructor(&mut self) -> &mut MessageReconstructor {
+        &mut self.reconstructor
+    }
+
+    fn num_mix_hops(&self) -> u8 {
+        self.num_mix_hops
+    }
+}
+
+impl Default for SphinxMessageReceiver {
     fn default() -> Self {
-        MessageReceiver {
+        SphinxMessageReceiver {
             reconstructor: Default::default(),
             num_mix_hops: DEFAULT_NUM_MIX_HOPS,
         }

common/types/src/gateway.rs

@@ -81,7 +81,6 @@ impl GatewayBond {
 pub struct GatewayNodeDetailsResponse {
     pub identity_key: String,
     pub sphinx_key: String,
-    pub owner_signature: String,
     pub announce_address: String,
     pub bind_address: String,
     pub version: String,
@@ -94,7 +93,6 @@ impl fmt::Display for GatewayNodeDetailsResponse {
     fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
         writeln!(f, "Identity Key: {}", self.identity_key)?;
         writeln!(f, "Sphinx Key: {}", self.sphinx_key)?;
-        writeln!(f, "Owner Signature: {}", self.owner_signature)?;
         writeln!(
             f,
             "Host: {} (bind address: {})",

common/types/src/mixnode.rs

@@ -167,7 +167,6 @@ impl MixNodeCostParams {
 pub struct MixnodeNodeDetailsResponse {
     pub identity_key: String,
     pub sphinx_key: String,
-    pub owner_signature: String,
     pub announce_address: String,
     pub bind_address: String,
     pub version: String,
@@ -182,7 +181,6 @@ impl fmt::Display for MixnodeNodeDetailsResponse {
         let wallet_address = self.wallet_address.clone().unwrap_or_default();
         writeln!(f, "Identity Key: {}", self.identity_key)?;
         writeln!(f, "Sphinx Key: {}", self.sphinx_key)?;
-        writeln!(f, "Owner Signature: {}", self.owner_signature)?;
         writeln!(
             f,
             "Host: {} (bind address: {})",

contracts/CHANGELOG.md

@@ -2,6 +2,15 @@
 
 ## Unreleased
 
+## [v1.1.5] (2023-04-04)
+- change in-contract signatures to include nonces and to sign entire payloads for family-related operations ([#3125])
+- change in-contract signatures to include nonces and to sign entire payloads for node bonding (will require wallet changes) ([#3067])
+- removed migration code from mixnet and vesting contracts ([#3207])
+
+[#3125]: https://github.com/nymtech/nym/issues/3125
+[#3067]: https://github.com/nymtech/nym/issues/3067
+[#3207]: https://github.com/nymtech/nym/pull/3207
+
 ## [v1.1.4] (2023-02-21)
 
 - Problem 142 (rust-side) ([#3024])

contracts/Cargo.lock

@@ -173,7 +173,6 @@ dependencies = [
  "cw3-flex-multisig",
  "cw4",
  "cw4-group",
- "nym-bandwidth-claim-contract",
  "nym-coconut-bandwidth",
  "nym-coconut-bandwidth-contract-common",
  "nym-coconut-dkg",
@@ -960,14 +959,6 @@ dependencies = [
  "libm",
 ]
 
-[[package]]
-name = "nym-bandwidth-claim-contract"
-version = "0.1.0"
-dependencies = [
- "schemars",
- "serde",
-]
-
 [[package]]
 name = "nym-coconut-bandwidth"
 version = "0.1.0"
@@ -976,7 +967,6 @@ dependencies = [
  "cosmwasm-storage",
  "cw-controllers",
  "cw-storage-plus",
- "nym-bandwidth-claim-contract",
  "nym-coconut-bandwidth-contract-common",
  "nym-multisig-contract-common",
  "schemars",
@@ -1028,7 +1018,7 @@ dependencies = [
 
 [[package]]
 name = "nym-contracts-common"
-version = "0.3.0"
+version = "0.4.0"
 dependencies = [
  "bs58",
  "cosmwasm-std",
@@ -1062,7 +1052,7 @@ dependencies = [
 
 [[package]]
 name = "nym-mixnet-contract"
-version = "1.2.0"
+version = "1.3.0"
 dependencies = [
  "bs58",
  "cosmwasm-derive",
@@ -1071,6 +1061,7 @@ dependencies = [
  "cosmwasm-storage",
  "cw-storage-plus",
  "cw2",
+ "nym-contracts-common",
  "nym-crypto",
  "nym-mixnet-contract-common",
  "nym-vesting-contract-common",
@@ -1085,7 +1076,7 @@ dependencies = [
 
 [[package]]
 name = "nym-mixnet-contract-common"
-version = "0.3.0"
+version = "0.4.0"
 dependencies = [
  "bs58",
  "cosmwasm-std",
@@ -1094,7 +1085,7 @@ dependencies = [
  "nym-contracts-common",
  "schemars",
  "serde",
- "serde_json",
+ "serde-json-wasm",
  "serde_repr",
  "thiserror",
  "time",
@@ -1130,7 +1121,7 @@ dependencies = [
 
 [[package]]
 name = "nym-vesting-contract"
-version = "1.2.0"
+version = "1.3.0"
 dependencies = [
  "base64 0.21.0",
  "cosmwasm-crypto",
@@ -1153,7 +1144,7 @@ dependencies = [
 
 [[package]]
 name = "nym-vesting-contract-common"
-version = "0.3.0"
+version = "0.4.0"
 dependencies = [
  "cosmwasm-std",
  "nym-contracts-common",

contracts/coconut-bandwidth/Cargo.toml

@@ -9,7 +9,6 @@ edition = "2021"
 crate-type = ["cdylib", "rlib"]
 
 [dependencies]
-nym-bandwidth-claim-contract = { path = "../../common/bandwidth-claim-contract" }
 nym-coconut-bandwidth-contract-common = { path = "../../common/cosmwasm-smart-contracts/coconut-bandwidth-contract" }
 nym-multisig-contract-common = { path = "../../common/cosmwasm-smart-contracts/multisig-contract" }
 

contracts/coconut-dkg/src/dealers/transactions.rs

@@ -22,7 +22,7 @@ fn verify_dealer(deps: DepsMut<'_>, dealer: &Addr, resharing: bool) -> Result<()
     let state = STATE.load(deps.storage)?;
 
     let height = if resharing {
-        INITIAL_REPLACEMENT_DATA.load(deps.storage)?.initial_height
+        Some(INITIAL_REPLACEMENT_DATA.load(deps.storage)?.initial_height)
     } else {
         None
     };
@@ -105,7 +105,7 @@ pub(crate) mod tests {
                     deps.as_mut().storage,
                     &InitialReplacementData {
                         initial_dealers: vec![details1.address, details2.address, details3.address],
-                        initial_height: Some(1),
+                        initial_height: 1,
                     },
                 )
                 .unwrap();
@@ -126,7 +126,7 @@ pub(crate) mod tests {
 
             INITIAL_REPLACEMENT_DATA
                 .update::<_, ContractError>(deps.as_mut().storage, |mut data| {
-                    data.initial_height = Some(2);
+                    data.initial_height = 2;
                     Ok(data)
                 })
                 .unwrap();

contracts/coconut-dkg/src/dealings/transactions.rs

@@ -110,7 +110,7 @@ pub(crate) mod tests {
                 deps.as_mut().storage,
                 &InitialReplacementData {
                     initial_dealers: vec![],
-                    initial_height: None,
+                    initial_height: 1,
                 },
             )
             .unwrap();

contracts/coconut-dkg/src/epoch_state/transactions.rs

@@ -7,6 +7,7 @@ use crate::epoch_state::storage::{CURRENT_EPOCH, INITIAL_REPLACEMENT_DATA, THRES
 use crate::epoch_state::utils::check_epoch_state;
 use crate::error::ContractError;
 use crate::state::STATE;
+use crate::verification_key_shares::storage::verified_dealers;
 use cosmwasm_std::{Addr, Deps, DepsMut, Env, Order, Response, Storage};
 use nym_coconut_dkg_common::types::{Epoch, EpochState, InitialReplacementData};
 
@@ -19,7 +20,13 @@ fn reset_epoch_state(storage: &mut dyn Storage) -> Result<(), ContractError> {
     for dealer_addr in dealers {
         let details = current_dealers().load(storage, &dealer_addr)?;
         for dealings in DEALINGS_BYTES {
-            dealings.remove(storage, &details.address);
+            let dealing_keys: Vec<_> = dealings
+                .keys(storage, None, None, Order::Ascending)
+                .flatten()
+                .collect();
+            for key in dealing_keys {
+                dealings.remove(storage, &key);
+            }
         }
         current_dealers().remove(storage, &dealer_addr)?;
         past_dealers().save(storage, &dealer_addr, &details)?;
@@ -46,15 +53,9 @@ fn dealers_still_active(
 }
 
 fn dealers_eq_members(deps: &DepsMut<'_>) -> Result<bool, ContractError> {
-    let dealers_still_active = dealers_still_active(
-        &deps.as_ref(),
-        current_dealers()
-            .keys(deps.storage, None, None, Order::Ascending)
-            .flatten(),
-    )?;
-    let all_dealers = current_dealers()
-        .keys(deps.storage, None, None, Order::Ascending)
-        .count();
+    let verified_dealers = verified_dealers(deps.storage)?;
+    let all_dealers = verified_dealers.len();
+    let dealers_still_active = dealers_still_active(&deps.as_ref(), verified_dealers.into_iter())?;
     let group_members = STATE
         .load(deps.storage)?
         .group_addr
@@ -66,7 +67,11 @@ fn dealers_eq_members(deps: &DepsMut<'_>) -> Result<bool, ContractError> {
 
 fn replacement_threshold_surpassed(deps: &DepsMut<'_>) -> Result<bool, ContractError> {
     let threshold = THRESHOLD.load(deps.storage)? as usize;
-    let initial_dealers = INITIAL_REPLACEMENT_DATA.load(deps.storage)?.initial_dealers;
+    let initial_dealers = verified_dealers(deps.storage)?;
+    if initial_dealers.is_empty() {
+        // possibly failed DKG, just reset and start again
+        return Ok(true);
+    }
     let initial_dealer_count = initial_dealers.len();
     let replacement_threshold = threshold - (initial_dealers.len() + 2 - 1) / 2 + 1;
     let removed_dealer_count =
@@ -90,24 +95,23 @@ pub(crate) fn advance_epoch_state(deps: DepsMut<'_>, env: Env) -> Result<Respons
     let next_epoch = if let Some(state) = current_epoch.state.next() {
         // We are during DKG process
         let mut new_state = state;
-        if let EpochState::DealingExchange { resharing } = state {
+        if let EpochState::DealingExchange { .. } = state {
             let current_dealers = current_dealers()
                 .keys(deps.storage, None, None, Order::Ascending)
                 .collect::<Result<Vec<Addr>, _>>()?;
-            if current_dealers.is_empty() {
-                // If no dealer registered yet, we just stay in the same state until there's at least one
+            let group_members =
+                STATE
+                    .load(deps.storage)?
+                    .group_addr
+                    .list_members(&deps.querier, None, None)?;
+            if current_dealers.len() < group_members.len() {
+                // If not all group members registered yet, we just stay in the same state until
+                // they either register or they get kicked out of the group
                 new_state = current_epoch.state;
             } else {
                 // note: ceiling in integer division can be achieved via q = (x + y - 1) / y;
                 let threshold = (2 * current_dealers.len() as u64 + 3 - 1) / 3;
                 THRESHOLD.save(deps.storage, &threshold)?;
-                if !resharing {
-                    let replacement_data = InitialReplacementData {
-                        initial_dealers: current_dealers,
-                        initial_height: None,
-                    };
-                    INITIAL_REPLACEMENT_DATA.save(deps.storage, &replacement_data)?;
-                }
             }
         };
         Epoch::new(
@@ -129,13 +133,23 @@ pub(crate) fn advance_epoch_state(deps: DepsMut<'_>, env: Env) -> Result<Respons
         // Dealer set changed, we need to redo DKG...
         let state = if replacement_threshold_surpassed(&deps)? {
             // ... in reset mode
+            INITIAL_REPLACEMENT_DATA.remove(deps.storage);
             EpochState::default()
         } else {
             // ... in reshare mode
-            INITIAL_REPLACEMENT_DATA.update::<_, ContractError>(deps.storage, |mut data| {
-                data.initial_height = Some(env.block.height);
-                Ok(data)
-            })?;
+            if INITIAL_REPLACEMENT_DATA.may_load(deps.storage)?.is_some() {
+                INITIAL_REPLACEMENT_DATA.update::<_, ContractError>(deps.storage, |mut data| {
+                    data.initial_height = env.block.height;
+                    Ok(data)
+                })?;
+            } else {
+                let replacement_data = InitialReplacementData {
+                    initial_dealers: verified_dealers(deps.storage)?,
+                    initial_height: env.block.height,
+                };
+                INITIAL_REPLACEMENT_DATA.save(deps.storage, &replacement_data)?;
+            }
+
             EpochState::PublicKeySubmission { resharing: true }
         };
         reset_epoch_state(deps.storage)?;
@@ -158,10 +172,8 @@ pub(crate) fn try_surpassed_threshold(
     check_epoch_state(deps.storage, EpochState::InProgress)?;
 
     let threshold = THRESHOLD.load(deps.storage)?;
-    let dealers = current_dealers()
-        .keys(deps.storage, None, None, Order::Ascending)
-        .flatten();
-    if dealers_still_active(&deps.as_ref(), dealers)? < threshold as usize {
+    let dealers = verified_dealers(deps.storage)?;
+    if dealers_still_active(&deps.as_ref(), dealers.into_iter())? < threshold as usize {
         reset_epoch_state(deps.storage)?;
         CURRENT_EPOCH.update::<_, ContractError>(deps.storage, |epoch| {
             Ok(Epoch::new(
@@ -180,8 +192,9 @@ pub(crate) fn try_surpassed_threshold(
 pub(crate) mod tests {
     use super::*;
     use crate::error::ContractError::EarlyEpochStateAdvancement;
-    use crate::support::tests::fixtures::dealer_details_fixture;
+    use crate::support::tests::fixtures::{dealer_details_fixture, vk_share_fixture};
     use crate::support::tests::helpers::{init_contract, GROUP_MEMBERS};
+    use crate::verification_key_shares::storage::vk_shares;
     use cosmwasm_std::testing::mock_env;
     use cosmwasm_std::Addr;
     use cw4::Member;
@@ -204,11 +217,15 @@ pub(crate) mod tests {
 
             for n in [10, 25, 50, 100] {
                 let dealers: Vec<_> = (0..n).map(dealer_details_fixture).collect();
+                let shares: Vec<_> = (0..n).map(|idx| vk_share_fixture(&format!("owner{}", idx), 0)).collect();
                 let initial_dealers = dealers.iter().map(|d| d.address.clone()).collect();
                 let data = InitialReplacementData {
                     initial_dealers,
-                    initial_height: None,
+                    initial_height: 1,
                 };
+                for share in shares {
+                    vk_shares().save(deps.as_mut().storage, (&share.owner, 0), &share).unwrap();
+                }
                 for f in [two_thirds, three_fourths, ninty_pc] {
                     let threshold = f(n);
                     THRESHOLD.save(deps.as_mut().storage, &threshold).unwrap();
@@ -247,39 +264,39 @@ pub(crate) mod tests {
 
             assert!(dealers_eq_members(&deps.as_mut()).unwrap());
 
-            let details = dealer_details_fixture(1);
-            let different_details = dealer_details_fixture(2);
-            current_dealers()
-                .save(deps.as_mut().storage, &details.address, &details)
+            let share = vk_share_fixture("owner2", 0);
+            let different_share = vk_share_fixture("owner4", 0);
+            vk_shares()
+                .save(deps.as_mut().storage, (&share.owner, 0), &share)
                 .unwrap();
             assert!(!dealers_eq_members(&deps.as_mut()).unwrap());
 
-            current_dealers()
-                .remove(deps.as_mut().storage, &details.address)
+            vk_shares()
+                .remove(deps.as_mut().storage, (&share.owner, 0))
                 .unwrap();
             GROUP_MEMBERS.lock().unwrap().push((
                 Member {
-                    addr: "owner1".to_string(),
+                    addr: "owner2".to_string(),
                     weight: 10,
                 },
                 1,
             ));
             assert!(!dealers_eq_members(&deps.as_mut()).unwrap());
 
-            current_dealers()
+            vk_shares()
                 .save(
                     deps.as_mut().storage,
-                    &different_details.address,
-                    &different_details,
+                    (&different_share.owner, 0),
+                    &different_share,
                 )
                 .unwrap();
             assert!(!dealers_eq_members(&deps.as_mut()).unwrap());
 
-            current_dealers()
-                .remove(deps.as_mut().storage, &different_details.address)
+            vk_shares()
+                .remove(deps.as_mut().storage, (&different_share.owner, 0))
                 .unwrap();
-            current_dealers()
-                .save(deps.as_mut().storage, &details.address, &details)
+            vk_shares()
+                .save(deps.as_mut().storage, (&share.owner, 0), &share)
                 .unwrap();
             assert!(dealers_eq_members(&deps.as_mut()).unwrap());
         }
@@ -407,6 +424,12 @@ pub(crate) mod tests {
             );
 
             // setup dealer details
+            let all_shares: [_; 4] = std::array::from_fn(|i| vk_share_fixture(&format!("owner{}", i + 1), 0));
+            for share in all_shares.iter() {
+                vk_shares()
+                    .save(deps.as_mut().storage, (&share.owner, 0), share)
+                    .unwrap();
+            }
             let all_details: [_; 4] = std::array::from_fn(|i| dealer_details_fixture(i as u64 + 1));
             for details in all_details.iter() {
                 current_dealers()
@@ -431,12 +454,6 @@ pub(crate) mod tests {
                     .time
                     .plus_seconds(epoch.time_configuration.dealing_exchange_time_secs)
             );
-            let replacement_data = INITIAL_REPLACEMENT_DATA.load(&deps.storage).unwrap();
-            let expected_replacement_data = InitialReplacementData {
-                initial_dealers: all_details.iter().map(|d| d.address.clone()).collect(),
-                initial_height: None,
-            };
-            assert_eq!(replacement_data, expected_replacement_data);
 
             env.block.time = env
                 .block
@@ -588,8 +605,14 @@ pub(crate) mod tests {
             );
             assert_eq!(curr_epoch, expected_epoch);
             assert!(THRESHOLD.may_load(&deps.storage).unwrap().is_none());
+            let replacement_data = INITIAL_REPLACEMENT_DATA.load(&deps.storage).unwrap();
+            let expected_replacement_data = InitialReplacementData {
+                initial_dealers: all_details.iter().map(|d| d.address.clone()).collect(),
+                initial_height: 12345,
+            };
+            assert_eq!(replacement_data, expected_replacement_data);
 
-            let all_details: [_; 2] = std::array::from_fn(|i| dealer_details_fixture(i as u64 + 2));
+            let all_details: [_; 4] = std::array::from_fn(|i| dealer_details_fixture(i as u64 + 2));
             for details in all_details.iter() {
                 past_dealers().remove(deps.as_mut().storage, &details.address).unwrap();
                 current_dealers()
@@ -607,6 +630,17 @@ pub(crate) mod tests {
                 advance_epoch_state(deps.as_mut(), env.clone()).unwrap();
             }
 
+            let all_shares: [_; 4] = std::array::from_fn(|i| {
+                let mut share = vk_share_fixture(&format!("owner{}", i + 1), 1);
+                share.verified = i % 2 == 0;
+                share
+                });
+            for share in all_shares.iter() {
+                vk_shares()
+                    .save(deps.as_mut().storage, (&share.owner, 0), share)
+                    .unwrap();
+            }
+
             // Group changed even more, surpassing threshold, so re-run dkg in reset mode
             *GROUP_MEMBERS.lock().unwrap().last_mut().unwrap() = (
                 Member {
@@ -623,7 +657,7 @@ pub(crate) mod tests {
             advance_epoch_state(deps.as_mut(), env.clone()).unwrap();
             let curr_epoch = CURRENT_EPOCH.load(deps.as_mut().storage).unwrap();
             let expected_epoch = Epoch::new(
-                EpochState::PublicKeySubmission { resharing: false },
+                EpochState::PublicKeySubmission { resharing: true },
                 prev_epoch.epoch_id + 1,
                 prev_epoch.time_configuration,
                 env.block.time,
@@ -672,12 +706,25 @@ pub(crate) mod tests {
                 }
             );
 
+
+            let all_shares: [_; 3] = std::array::from_fn(|i| vk_share_fixture(&format!("owner{}", i + 1), 0));
+            for share in all_shares.iter() {
+                vk_shares()
+                    .save(deps.as_mut().storage, (&share.owner, 0), share)
+                    .unwrap();
+            }
             let all_details: [_; 3] = std::array::from_fn(|i| dealer_details_fixture(i as u64 + 1));
             for details in all_details.iter() {
                 current_dealers()
                     .save(deps.as_mut().storage, &details.address, details)
                     .unwrap();
             }
+            let all_shares: [_; 3] = std::array::from_fn(|i| vk_share_fixture(&format!("owner{}", i + 1), 0));
+            for share in all_shares.iter() {
+                vk_shares()
+                    .save(deps.as_mut().storage, (&share.owner, share.epoch_id), share)
+                    .unwrap();
+            }
 
             for times in [
                 time_configuration.public_key_submission_time_secs,

contracts/coconut-dkg/src/verification_key_shares/storage.rs

@@ -4,7 +4,9 @@
 // SPDX-License-Identifier: Apache-2.0
 
 use crate::constants::{VK_SHARES_EPOCH_ID_IDX_NAMESPACE, VK_SHARES_PK_NAMESPACE};
-use cosmwasm_std::Addr;
+use crate::epoch_state::storage::CURRENT_EPOCH;
+use crate::error::ContractError;
+use cosmwasm_std::{Addr, Order, Storage};
 use cw_storage_plus::{Index, IndexList, IndexedMap, MultiIndex};
 use nym_coconut_dkg_common::types::EpochId;
 use nym_coconut_dkg_common::verification_key::ContractVKShare;
@@ -35,3 +37,21 @@ pub(crate) fn vk_shares<'a>() -> IndexedMap<'a, VKShareKey<'a>, ContractVKShare,
     };
     IndexedMap::new(VK_SHARES_PK_NAMESPACE, indexes)
 }
+
+pub(crate) fn verified_dealers(storage: &dyn Storage) -> Result<Vec<Addr>, ContractError> {
+    let epoch_id = CURRENT_EPOCH.load(storage)?.epoch_id;
+    Ok(vk_shares()
+        .idx
+        .epoch_id
+        .prefix(epoch_id)
+        .range(storage, None, None, Order::Ascending)
+        .flatten()
+        .filter_map(|(_, share)| {
+            if share.verified {
+                Some(share.owner)
+            } else {
+                None
+            }
+        })
+        .collect())
+}