chore: use updated sphinx packets (client-side)

Display error messages if IPv4 or IPv6 address not found on nymtun0

.github/workflows/ci-contracts.yml

@@ -9,6 +9,8 @@ on:
     paths:
       - 'contracts/**'
       - 'common/**'
+      - 'Cargo.lock'
+      - 'Cargo.toml'
       - '.github/workflows/ci-contracts.yml'
 
 jobs:

CHANGELOG.md

@@ -4,6 +4,42 @@ Post 1.0.0 release, the changelog format is based on [Keep a Changelog](https://
 
 ## [Unreleased]
 
+## [2025.3-ruta] (2025-02-10)
+
+- Push down forget me to client configs ([#5431])
+- Fix statistics shutdown ([#5426])
+- Make wait_for_graceful_shutdown to be pub ([#5424])
+- Upgrade to thiserror 2.0 ([#5414])
+- build(deps): bump the patch-updates group across 1 directory with 9 updates ([#5406])
+- Relocate a validator api function ([#5401])
+- Send shutdown instead of panic when reaching max fail ([#5398])
+- Change Explorer URL to new smooshed nodes ([#5396])
+- reduce log severity for checking topology validity ([#5395])
+- MixnetClient can send ClientRequests ([#5381])
+- Fix missing path triggers for CI ([#5380])
+- Uncouple storage reference for bandwidth client ([#5372])
+- build(deps): bump tokio from 1.40.0 to 1.43.0 ([#5370])
+- DNS resolver configuration for internal HTTP client lookups ([#5355])
+- Update README.md ([#5328])
+- Update README.md ([#5327])
+
+[#5431]: https://github.com/nymtech/nym/pull/5431
+[#5426]: https://github.com/nymtech/nym/pull/5426
+[#5424]: https://github.com/nymtech/nym/pull/5424
+[#5414]: https://github.com/nymtech/nym/pull/5414
+[#5406]: https://github.com/nymtech/nym/pull/5406
+[#5401]: https://github.com/nymtech/nym/pull/5401
+[#5398]: https://github.com/nymtech/nym/pull/5398
+[#5396]: https://github.com/nymtech/nym/pull/5396
+[#5395]: https://github.com/nymtech/nym/pull/5395
+[#5381]: https://github.com/nymtech/nym/pull/5381
+[#5380]: https://github.com/nymtech/nym/pull/5380
+[#5372]: https://github.com/nymtech/nym/pull/5372
+[#5370]: https://github.com/nymtech/nym/pull/5370
+[#5355]: https://github.com/nymtech/nym/pull/5355
+[#5328]: https://github.com/nymtech/nym/pull/5328
+[#5327]: https://github.com/nymtech/nym/pull/5327
+
 ## [2025.2-hu] (2025-02-04)
 
 - Feature/remove double spending bloomfilter ([#5417])

Cargo.toml

@@ -187,18 +187,21 @@ readme = "README.md"
 
 [workspace.dependencies]
 addr = "0.15.6"
+aead = "0.5.2"
 aes = "0.8.1"
 aes-gcm = "0.10.1"
 aes-gcm-siv = "0.11.1"
-aead = "0.5.2"
+ammonia = "4"
 anyhow = "1.0.95"
 arc-swap = "1.7.1"
 argon2 = "0.5.0"
 async-trait = "0.1.86"
-axum-client-ip = "0.6.1"
 axum = "0.7.5"
+axum-client-ip = "0.6.1"
 axum-extra = "0.9.4"
+axum-test = "16.2.0"
 base64 = "0.22.1"
+base85rs = "0.1.3"
 bincode = "1.3.3"
 bip39 = { version = "2.0.0", features = ["zeroize"] }
 bit-vec = "0.7.0"                                     # can we unify those?
@@ -209,16 +212,16 @@ bs58 = "0.5.1"
 bytecodec = "0.4.15"
 bytes = "1.7.2"
 cargo_metadata = "0.18.1"
-celes = "2.4.0"
+celes = "2.5.0"
 cfg-if = "1.0.0"
 chacha20 = "0.9.0"
 chacha20poly1305 = "0.10.1"
 chrono = "0.4.39"
 cipher = "0.4.3"
-clap = "4.5.28"
+clap = "4.5.30"
 clap_complete = "4.5"
 clap_complete_fig = "4.5"
-colored = "2.0"
+colored = "2.2"
 comfy-table = "7.1.4"
 console = "0.15.10"
 console-subscriber = "0.1.1"
@@ -239,8 +242,9 @@ doc-comment = "0.3"
 dotenvy = "0.15.6"
 ecdsa = "0.16"
 ed25519-dalek = "2.1"
-etherparse = "0.13.0"
+env_logger = "0.11.6"
 envy = "0.4"
+etherparse = "0.13.0"
 eyre = "0.6.9"
 fastrand = "2.1.1"
 flate2 = "1.0.35"
@@ -259,9 +263,9 @@ hmac = "0.12.1"
 http = "1"
 http-body-util = "0.1"
 httpcodec = "0.2.3"
+human-repr = "1.1.0"
 humantime = "2.1.0"
 humantime-serde = "1.1.1"
-human-repr = "1.1.0"
 hyper = "1.6.0"
 hyper-util = "0.1"
 indicatif = "0.17.11"
@@ -276,7 +280,6 @@ ledger-transport = "0.10.0"
 ledger-transport-hid = "0.10.0"
 log = "0.4"
 maxminddb = "0.23.0"
-rs_merkle = "1.4.2"
 mime = "0.3.17"
 moka = { version = "0.12", features = ["future"] }
 nix = "0.27.1"
@@ -305,6 +308,7 @@ reqwest = { version = "0.12.4", default-features = false }
 rocket = "0.5.0"
 rocket_cors = "0.6.0"
 rocket_okapi = "0.8.0"
+rs_merkle = "1.4.2"
 safer-ffi = "0.1.13"
 schemars = "0.8.21"
 semver = "1.0.25"
@@ -318,7 +322,7 @@ serde_with = "3.9.0"
 serde_yaml = "0.9.25"
 sha2 = "0.10.8"
 si-scale = "0.2.3"
-sphinx-packet = "0.1.1"
+sphinx-packet = "=0.3.1" # make sure to use version below 0.4.0 that supports processing legacy and updated packets
 sqlx = "0.7.4"
 strum = "0.26"
 strum_macros = "0.26"
@@ -326,11 +330,12 @@ subtle-encoding = "0.5"
 syn = "1"
 sysinfo = "0.33.0"
 tap = "1.0.1"
-tar = "0.4.43"
+tar = "0.4.44"
 tempfile = "3.15"
 thiserror = "2.0"
 time = "0.3.37"
 tokio = "1.43"
+tokio-postgres = "0.7"
 tokio-stream = "0.1.17"
 tokio-test = "0.4.4"
 tokio-tun = "0.11.5"
@@ -340,15 +345,17 @@ toml = "0.8.20"
 tower = "0.5.2"
 tower-http = "0.5.2"
 tracing = "0.1.41"
+tracing-log = "0.2"
 tracing-opentelemetry = "0.19.0"
 tracing-subscriber = "0.3.19"
 tracing-tree = "0.2.2"
-tracing-log = "0.2"
 ts-rs = "10.1.0"
 tungstenite = { version = "0.20.1", default-features = false }
+uniffi = "0.29.0"
+uniffi_build = "0.29.0"
 url = "2.5"
 utoipa = "5.2"
-utoipa-swagger-ui = "8.0"
+utoipa-swagger-ui = "8.1"
 utoipauto = "0.2"
 uuid = "*"
 vergen = { version = "=8.3.1", default-features = false }

clients/native/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "nym-client"
-version = "1.1.47"
+version = "1.1.48"
 authors = ["Dave Hrycyszyn <futurechimp@users.noreply.github.com>", "Jędrzej Stuczyński <andrew@nymtech.net>"]
 description = "Implementation of the Nym Client"
 edition = "2021"

clients/native/src/client/mod.rs

@@ -49,7 +49,7 @@ impl SocketClient {
         client_output: ClientOutput,
         client_state: ClientState,
         self_address: &Recipient,
-        shutdown: nym_task::TaskClient,
+        task_client: nym_task::TaskClient,
         packet_type: PacketType,
     ) {
         info!("Starting websocket listener...");
@@ -77,10 +77,15 @@ impl SocketClient {
             shared_lane_queue_lengths,
             reply_controller_sender,
             Some(packet_type),
+            task_client.fork("websocket_handler"),
         );
 
-        websocket::Listener::new(config.socket.host, config.socket.listening_port)
-            .start(websocket_handler, shutdown);
+        websocket::Listener::new(
+            config.socket.host,
+            config.socket.listening_port,
+            task_client.with_suffix("websocket_listener"),
+        )
+        .start(websocket_handler);
     }
 
     /// blocking version of `start_socket` method. Will run forever (or until SIGINT is sent)

clients/native/src/websocket/handler.rs

@@ -19,6 +19,7 @@ use nym_sphinx::receiver::ReconstructedMessage;
 use nym_task::connections::{
     ConnectionCommand, ConnectionCommandSender, ConnectionId, LaneQueueLengths, TransmissionLane,
 };
+use nym_task::TaskClient;
 use std::time::Duration;
 use tokio::net::TcpStream;
 use tokio::time::Instant;
@@ -43,9 +44,11 @@ pub(crate) struct HandlerBuilder {
     lane_queue_lengths: LaneQueueLengths,
     reply_controller_sender: ReplyControllerSender,
     packet_type: Option<PacketType>,
+    task_client: TaskClient,
 }
 
 impl HandlerBuilder {
+    #[allow(clippy::too_many_arguments)]
     pub(crate) fn new(
         msg_input: InputMessageSender,
         client_connection_tx: ConnectionCommandSender,
@@ -54,6 +57,7 @@ impl HandlerBuilder {
         lane_queue_lengths: LaneQueueLengths,
         reply_controller_sender: ReplyControllerSender,
         packet_type: Option<PacketType>,
+        task_client: TaskClient,
     ) -> Self {
         Self {
             msg_input,
@@ -63,11 +67,14 @@ impl HandlerBuilder {
             lane_queue_lengths,
             reply_controller_sender,
             packet_type,
+            task_client,
         }
     }
 
     // TODO: make sure we only ever have one active handler
     pub fn create_active_handler(&self) -> Handler {
+        let mut task_client = self.task_client.fork("active_handler");
+        task_client.disarm();
         Handler {
             msg_input: self.msg_input.clone(),
             client_connection_tx: self.client_connection_tx.clone(),
@@ -78,6 +85,7 @@ impl HandlerBuilder {
             lane_queue_lengths: self.lane_queue_lengths.clone(),
             reply_controller_sender: self.reply_controller_sender.clone(),
             packet_type: self.packet_type,
+            task_client,
         }
     }
 }
@@ -92,16 +100,18 @@ pub(crate) struct Handler {
     lane_queue_lengths: LaneQueueLengths,
     reply_controller_sender: ReplyControllerSender,
     packet_type: Option<PacketType>,
+    task_client: TaskClient,
 }
 
 impl Drop for Handler {
     fn drop(&mut self) {
-        if self
+        if let Err(err) = self
             .buffer_requester
             .unbounded_send(ReceivedBufferMessage::ReceiverDisconnect)
-            .is_err()
         {
-            error!("we failed to disconnect the receiver from the buffer! presumably the shutdown procedure has been initiated!")
+            if !self.task_client.is_shutdown_poll() {
+                error!("failed to disconnect the receiver from the buffer: {err}");
+            }
         }
     }
 }
@@ -125,10 +135,23 @@ impl Handler {
         };
 
         // get the number of pending replies waiting for reply surbs
-        let reply_queue_length = self
+        let reply_queue_length = match self
             .reply_controller_sender
             .get_lane_queue_length(connection_id)
-            .await;
+            .await
+        {
+            Ok(length) => length,
+            Err(err) => {
+                if !self.task_client.is_shutdown_poll() {
+                    error!(
+                        "Failed to get reply queue length for connection {connection_id}: {err}"
+                    );
+                }
+                // We're just going to assume that the queue is empty, and I think that's okay
+                // during shutdown.
+                0
+            }
+        };
 
         let queue_length = base_length + reply_queue_length;
 
@@ -168,10 +191,11 @@ impl Handler {
 
         // the ack control is now responsible for chunking, etc.
         let input_msg = InputMessage::new_regular(recipient, message, lane, self.packet_type);
-        self.msg_input
-            .send(input_msg)
-            .await
-            .expect("InputMessageReceiver has stopped receiving!");
+        if let Err(err) = self.msg_input.send(input_msg).await {
+            if !self.task_client.is_shutdown_poll() {
+                error!("Failed to send message to the input buffer: {err}");
+            }
+        }
 
         // Only reply back with a `LaneQueueLength` if the sender providided a connection id
         let TransmissionLane::ConnectionId(connection_id) = lane else {
@@ -200,10 +224,11 @@ impl Handler {
 
         let input_msg =
             InputMessage::new_anonymous(recipient, message, reply_surbs, lane, self.packet_type);
-        self.msg_input
-            .send(input_msg)
-            .await
-            .expect("InputMessageReceiver has stopped receiving!");
+        if let Err(err) = self.msg_input.send(input_msg).await {
+            if !self.task_client.is_shutdown_poll() {
+                error!("Failed to send anonymous message to the input buffer: {err}");
+            }
+        }
 
         // Only reply back with a `LaneQueueLength` if the sender providided a connection id
         let TransmissionLane::ConnectionId(connection_id) = lane else {
@@ -227,10 +252,11 @@ impl Handler {
         });
 
         let input_msg = InputMessage::new_reply(recipient_tag, message, lane, self.packet_type);
-        self.msg_input
-            .send(input_msg)
-            .await
-            .expect("InputMessageReceiver has stopped receiving!");
+        if let Err(err) = self.msg_input.send(input_msg).await {
+            if !self.task_client.is_shutdown_poll() {
+                error!("Failed to send reply message to the input buffer: {err}");
+            }
+        }
 
         // Only reply back with a `LaneQueueLength` if the sender providided a connection id
         let TransmissionLane::ConnectionId(connection_id) = lane else {
@@ -245,9 +271,14 @@ impl Handler {
     }
 
     fn handle_closed_connection(&self, connection_id: u64) -> Option<ServerResponse> {
-        self.client_connection_tx
+        if let Err(err) = self
+            .client_connection_tx
             .unbounded_send(ConnectionCommand::Close(connection_id))
-            .unwrap();
+        {
+            if !self.task_client.is_shutdown_poll() {
+                error!("Failed to send close connection command: {err}");
+            }
+        }
         None
     }
 
@@ -362,11 +393,10 @@ impl Handler {
         }
     }
 
-    async fn listen_for_requests(
-        &mut self,
-        mut msg_receiver: ReconstructedMessagesReceiver,
-        mut task_client: nym_task::TaskClient,
-    ) {
+    async fn listen_for_requests(&mut self, mut msg_receiver: ReconstructedMessagesReceiver) {
+        let mut task_client = self.task_client.fork("select");
+        task_client.disarm();
+
         while !task_client.is_shutdown() {
             tokio::select! {
                 // we can either get a client request from the websocket
@@ -415,15 +445,7 @@ impl Handler {
     }
 
     // consume self to make sure `drop` is called after this is done
-    pub(crate) async fn handle_connection(
-        mut self,
-        socket: TcpStream,
-        mut task_client: nym_task::TaskClient,
-    ) {
-        // We don't want a crash in the connection handler to trigger a shutdown of the whole
-        // process.
-        task_client.disarm();
-
+    pub(crate) async fn handle_connection(mut self, socket: TcpStream) {
         let ws_stream = match accept_async(socket).await {
             Ok(ws_stream) => ws_stream,
             Err(err) => {
@@ -436,14 +458,18 @@ impl Handler {
         let (reconstructed_sender, reconstructed_receiver) = mpsc::unbounded();
 
         // tell the buffer to start sending stuff to us
-        self.buffer_requester
-            .unbounded_send(ReceivedBufferMessage::ReceiverAnnounce(
-                reconstructed_sender,
-            ))
-            .expect("the buffer request failed!");
+        if let Err(err) =
+            self.buffer_requester
+                .unbounded_send(ReceivedBufferMessage::ReceiverAnnounce(
+                    reconstructed_sender,
+                ))
+        {
+            if !self.task_client.is_shutdown_poll() {
+                error!("failed to announce the receiver to the buffer: {err}");
+            }
+        }
 
-        self.listen_for_requests(reconstructed_receiver, task_client)
-            .await;
+        self.listen_for_requests(reconstructed_receiver).await;
     }
 }
 

clients/native/src/websocket/listener.rs

@@ -3,6 +3,7 @@
 
 use super::handler::HandlerBuilder;
 use log::*;
+use nym_task::TaskClient;
 use std::net::IpAddr;
 use std::{net::SocketAddr, process, sync::Arc};
 use tokio::io::AsyncWriteExt;
@@ -22,21 +23,19 @@ impl State {
 pub(crate) struct Listener {
     address: SocketAddr,
     state: State,
+    task_client: TaskClient,
 }
 
 impl Listener {
-    pub(crate) fn new(host: IpAddr, port: u16) -> Self {
+    pub(crate) fn new(host: IpAddr, port: u16, task_client: TaskClient) -> Self {
         Listener {
             address: SocketAddr::new(host, port),
             state: State::AwaitingConnection,
+            task_client,
         }
     }
 
-    pub(crate) async fn run(
-        &mut self,
-        handler: HandlerBuilder,
-        mut task_client: nym_task::TaskClient,
-    ) {
+    pub(crate) async fn run(&mut self, handler: HandlerBuilder) {
         let tcp_listener = match tokio::net::TcpListener::bind(self.address).await {
             Ok(listener) => listener,
             Err(err) => {
@@ -47,11 +46,11 @@ impl Listener {
 
         let notify = Arc::new(Notify::new());
 
-        loop {
+        while !self.task_client.is_shutdown() {
             tokio::select! {
                 // When the handler finishes we check if shutdown is signalled
                 _ = notify.notified() => {
-                    if task_client.is_shutdown() {
+                    if self.task_client.is_shutdown() {
                         log::trace!("Websocket listener: detected shutdown after connection closed");
                         break;
                     }
@@ -60,7 +59,7 @@ impl Listener {
                 }
                 // ... but when there is no connected client at the time of shutdown being
                 // signalled, we handle it here.
-                _ = task_client.recv() => {
+                _ = self.task_client.recv() => {
                     if !self.state.is_connected() {
                         log::trace!("Not connected: shutting down");
                         break;
@@ -88,9 +87,8 @@ impl Listener {
                                 // hanging because the executor doesn't come back here
                                 let notify_clone = Arc::clone(&notify);
                                 let fresh_handler = handler.create_active_handler();
-                                let task_client_handler = task_client.clone();
                                 tokio::spawn(async move {
-                                    fresh_handler.handle_connection(socket, task_client_handler).await;
+                                    fresh_handler.handle_connection(socket).await;
                                     notify_clone.notify_one();
                                 });
                                 self.state = State::Connected;
@@ -104,13 +102,9 @@ impl Listener {
         log::debug!("Websocket listener: Exiting");
     }
 
-    pub(crate) fn start(
-        mut self,
-        handler: HandlerBuilder,
-        shutdown: nym_task::TaskClient,
-    ) -> JoinHandle<()> {
+    pub(crate) fn start(mut self, handler: HandlerBuilder) -> JoinHandle<()> {
         info!("Running websocket on {:?}", self.address.to_string());
 
-        tokio::spawn(async move { self.run(handler, shutdown).await })
+        tokio::spawn(async move { self.run(handler).await })
     }
 }

clients/socks5/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "nym-socks5-client"
-version = "1.1.47"
+version = "1.1.48"
 authors = ["Dave Hrycyszyn <futurechimp@users.noreply.github.com>"]
 description = "A SOCKS5 localhost proxy that converts incoming messages to Sphinx and sends them to a Nym address"
 edition = "2021"

common/authenticator-requests/src/v4/registration.rs

@@ -60,7 +60,7 @@ impl From<IpAddr> for IpPair {
             std::net::IpAddr::V4(ipv4_addr) => (ipv4_addr.octets()[2], ipv4_addr.octets()[3]),
             std::net::IpAddr::V6(ipv6_addr) => (ipv6_addr.octets()[14], ipv6_addr.octets()[15]),
         };
-        let last_bytes = (before_last_byte as u16) << 8 | last_byte as u16;
+        let last_bytes = ((before_last_byte as u16) << 8) | last_byte as u16;
         let ipv4 = Ipv4Addr::new(
             WG_TUN_DEVICE_IP_ADDRESS_V4.octets()[0],
             WG_TUN_DEVICE_IP_ADDRESS_V4.octets()[1],

common/client-core/src/client/base_client/mod.rs

@@ -40,6 +40,7 @@ use nym_client_core_config_types::ForgetMe;
 use nym_client_core_gateways_storage::{GatewayDetails, GatewaysDetailsStore};
 use nym_credential_storage::storage::Storage as CredentialStorage;
 use nym_crypto::asymmetric::{encryption, identity};
+use nym_crypto::hkdf::DerivationMaterial;
 use nym_gateway_client::client::config::GatewayClientConfig;
 use nym_gateway_client::{
     AcknowledgementReceiver, GatewayClient, GatewayConfig, MixnetMessageReceiver, PacketRouter,
@@ -192,6 +193,8 @@ pub struct BaseClientBuilder<C, S: MixnetClientStorage> {
 
     #[cfg(unix)]
     connection_fd_callback: Option<Arc<dyn Fn(RawFd) + Send + Sync>>,
+
+    derivation_material: Option<DerivationMaterial>,
 }
 
 impl<C, S> BaseClientBuilder<C, S>
@@ -216,9 +219,19 @@ where
             setup_method: GatewaySetup::MustLoad { gateway_id: None },
             #[cfg(unix)]
             connection_fd_callback: None,
+            derivation_material: None,
         }
     }
 
+    #[must_use]
+    pub fn with_derivation_material(
+        mut self,
+        derivation_material: Option<DerivationMaterial>,
+    ) -> Self {
+        self.derivation_material = derivation_material;
+        self
+    }
+
     #[must_use]
     pub fn with_forget_me(mut self, forget_me: &ForgetMe) -> Self {
         self.config.debug.forget_me = *forget_me;
@@ -297,7 +310,7 @@ where
         topology_accessor: TopologyAccessor,
         mix_tx: BatchMixMessageSender,
         stats_tx: ClientStatsSender,
-        shutdown: TaskClient,
+        task_client: TaskClient,
     ) {
         info!("Starting loop cover traffic stream...");
 
@@ -310,9 +323,10 @@ where
             debug_config.traffic,
             debug_config.cover_traffic,
             stats_tx,
+            task_client,
         );
 
-        stream.start_with_shutdown(shutdown);
+        stream.start();
     }
 
     #[allow(clippy::too_many_arguments)]
@@ -327,7 +341,7 @@ where
         reply_controller_receiver: ReplyControllerReceiver,
         lane_queue_lengths: LaneQueueLengths,
         client_connection_rx: ConnectionCommandReceiver,
-        shutdown: TaskClient,
+        task_client: TaskClient,
         packet_type: PacketType,
         stats_tx: ClientStatsSender,
     ) {
@@ -345,8 +359,9 @@ where
             lane_queue_lengths,
             client_connection_rx,
             stats_tx,
+            task_client,
         )
-        .start_with_shutdown(shutdown, packet_type);
+        .start(packet_type);
     }
 
     // buffer controlling all messages fetched from provider
@@ -369,8 +384,9 @@ where
                 reply_key_storage,
                 reply_controller_sender,
                 metrics_reporter,
+                shutdown,
             );
-        controller.start_with_shutdown(shutdown)
+        controller.start()
     }
 
     #[allow(clippy::too_many_arguments)]
@@ -559,15 +575,22 @@ where
         topology_accessor: TopologyAccessor,
         local_gateway: NodeIdentity,
         wait_for_gateway: bool,
-        mut shutdown: TaskClient,
+        mut task_client: TaskClient,
     ) -> Result<(), ClientCoreError> {
         let topology_refresher_config =
             TopologyRefresherConfig::new(topology_config.topology_refresh_rate);
 
+        if topology_config.disable_refreshing {
+            // if we're not spawning the refresher, don't cause shutdown immediately
+            info!("The background topology refesher is not going to be started");
+            task_client.disarm();
+        }
+
         let mut topology_refresher = TopologyRefresher::new(
             topology_refresher_config,
             topology_accessor,
             topology_provider,
+            task_client,
         );
         // before returning, block entire runtime to refresh the current network view so that any
         // components depending on topology would see a non-empty view
@@ -608,15 +631,11 @@ where
             }
         }
 
-        if topology_config.disable_refreshing {
-            // if we're not spawning the refresher, don't cause shutdown immediately
-            info!("The topology refesher is not going to be started");
-            shutdown.disarm();
-        } else {
+        if !topology_config.disable_refreshing {
             // don't spawn the refresher if we don't want to be refreshing the topology.
             // only use the initial values obtained
             info!("Starting topology refresher...");
-            topology_refresher.start_with_shutdown(shutdown);
+            topology_refresher.start();
         }
 
         Ok(())
@@ -627,17 +646,17 @@ where
         user_agent: Option<UserAgent>,
         client_stats_id: String,
         input_sender: Sender<InputMessage>,
-        shutdown: TaskClient,
+        task_client: TaskClient,
     ) -> ClientStatsSender {
         info!("Starting statistics control...");
-        StatisticsControl::create_and_start_with_shutdown(
+        StatisticsControl::create_and_start(
             config.debug.stats_reporting,
             user_agent
                 .map(|u| u.application)
                 .unwrap_or("unknown".to_string()),
             client_stats_id,
             input_sender.clone(),
-            shutdown.with_suffix("controller"),
+            task_client,
         )
     }
 
@@ -647,8 +666,8 @@ where
     ) -> (BatchMixMessageSender, ClientRequestSender) {
         info!("Starting mix traffic controller...");
         let (mix_traffic_controller, mix_tx, client_tx) =
-            MixTrafficController::new(gateway_transceiver);
-        mix_traffic_controller.start_with_shutdown(shutdown);
+            MixTrafficController::new(gateway_transceiver, shutdown);
+        mix_traffic_controller.start();
         (mix_tx, client_tx)
     }
 
@@ -684,6 +703,7 @@ where
         setup_method: GatewaySetup,
         key_store: &S::KeyStore,
         details_store: &S::GatewaysDetailsStore,
+        derivation_material: Option<DerivationMaterial>,
     ) -> Result<InitialisationResult, ClientCoreError>
     where
         <S::KeyStore as KeyStore>::StorageError: Sync + Send,
@@ -693,7 +713,12 @@ where
         if key_store.load_keys().await.is_err() {
             info!("could not find valid client keys - a new set will be generated");
             let mut rng = OsRng;
-            let keys = ClientKeys::generate_new(&mut rng);
+            let keys = if let Some(derivation_material) = derivation_material {
+                ClientKeys::from_master_key(&mut rng, &derivation_material)
+                    .map_err(|_| ClientCoreError::HkdfDerivationError {})?
+            } else {
+                ClientKeys::generate_new(&mut rng)
+            };
             store_client_keys(keys, key_store).await?;
         }
 
@@ -715,6 +740,7 @@ where
             self.setup_method,
             self.client_store.key_store(),
             self.client_store.gateway_details_store(),
+            self.derivation_material,
         )
         .await?;
 

common/client-core/src/client/cover_traffic_stream.rs

@@ -13,6 +13,7 @@ use nym_sphinx::cover::generate_loop_cover_packet;
 use nym_sphinx::params::{PacketSize, PacketType};
 use nym_sphinx::utils::sample_poisson_duration;
 use nym_statistics_common::clients::{packet_statistics::PacketStatisticsEvent, ClientStatsSender};
+use nym_task::TaskClient;
 use rand::{rngs::OsRng, CryptoRng, Rng};
 use std::pin::Pin;
 use std::sync::Arc;
@@ -64,6 +65,8 @@ where
     packet_type: PacketType,
 
     stats_tx: ClientStatsSender,
+
+    task_client: TaskClient,
 }
 
 impl<R> Stream for LoopCoverTrafficStream<R>
@@ -110,6 +113,7 @@ impl LoopCoverTrafficStream<OsRng> {
         traffic_config: config::Traffic,
         cover_config: config::CoverTraffic,
         stats_tx: ClientStatsSender,
+        task_client: TaskClient,
     ) -> Self {
         let rng = OsRng;
 
@@ -128,6 +132,7 @@ impl LoopCoverTrafficStream<OsRng> {
             secondary_packet_size: traffic_config.secondary_packet_size,
             packet_type: traffic_config.packet_type,
             stats_tx,
+            task_client,
         }
     }
 
@@ -175,7 +180,7 @@ impl LoopCoverTrafficStream<OsRng> {
             }
         };
 
-        let cover_message = generate_loop_cover_packet(
+        let cover_message = match generate_loop_cover_packet(
             &mut self.rng,
             topology_ref,
             &self.ack_key,
@@ -184,8 +189,15 @@ impl LoopCoverTrafficStream<OsRng> {
             self.cover_traffic.loop_cover_traffic_average_delay,
             cover_traffic_packet_size,
             self.packet_type,
-        )
-        .expect("Somehow failed to generate a loop cover message with a valid topology");
+        ) {
+            Ok(cover_message) => cover_message,
+            Err(err) => {
+                warn!(
+                    "Somehow failed to generate a loop cover message with a valid topology: {err}"
+                );
+                return;
+            }
+        };
 
         if let Err(err) = self.mix_tx.try_send(vec![cover_message]) {
             match err {
@@ -217,7 +229,7 @@ impl LoopCoverTrafficStream<OsRng> {
         tokio::task::yield_now().await;
     }
 
-    pub fn start_with_shutdown(mut self, mut shutdown: nym_task::TaskClient) {
+    pub fn start(mut self) {
         if self.cover_traffic.disable_loop_cover_traffic_stream {
             // we should have never got here in the first place - the task should have never been created to begin with
             // so panic and review the code that lead to this branch
@@ -231,6 +243,8 @@ impl LoopCoverTrafficStream<OsRng> {
         );
         self.set_next_delay(sampled);
 
+        let mut shutdown = self.task_client.fork("select");
+
         spawn_future(async move {
             debug!("Started LoopCoverTrafficStream with graceful shutdown support");
 

common/client-core/src/client/key_manager/mod.rs

@@ -2,7 +2,10 @@
 // SPDX-License-Identifier: Apache-2.0
 
 use crate::client::key_manager::persistence::KeyStore;
-use nym_crypto::asymmetric::{encryption, identity};
+use nym_crypto::{
+    asymmetric::{encryption, identity},
+    hkdf::{DerivationMaterial, InvalidLength},
+};
 use nym_gateway_requests::shared_key::{LegacySharedKeys, SharedGatewayKey, SharedSymmetricKey};
 use nym_sphinx::acknowledgements::AckKey;
 use rand::{CryptoRng, RngCore};
@@ -10,6 +13,7 @@ use std::sync::Arc;
 use zeroize::ZeroizeOnDrop;
 
 pub mod persistence;
+mod test;
 
 // Note: to support key rotation in the future, all keys will require adding an extra smart pointer,
 // most likely an AtomicCell, or if it doesn't work as I think it does, a Mutex. Although I think
@@ -43,6 +47,24 @@ impl ClientKeys {
         }
     }
 
+    pub fn from_master_key<R>(
+        rng: &mut R,
+        derivation_material: &DerivationMaterial,
+    ) -> Result<Self, InvalidLength>
+    where
+        R: RngCore + CryptoRng,
+    {
+        let secret = derivation_material.derive_secret()?;
+        Ok(ClientKeys {
+            identity_keypair: Arc::new(identity::KeyPair::from_secret(
+                secret,
+                derivation_material.index(),
+            )),
+            encryption_keypair: Arc::new(encryption::KeyPair::new(rng)),
+            ack_key: Arc::new(AckKey::new(rng)),
+        })
+    }
+
     pub fn from_keys(
         id_keypair: identity::KeyPair,
         enc_keypair: encryption::KeyPair,

common/client-core/src/client/key_manager/test.rs

@@ -0,0 +1,89 @@
+#[cfg(test)]
+mod tests {
+    use crate::client::key_manager::ClientKeys;
+    use nym_crypto::hkdf::DerivationMaterial;
+    use rand::SeedableRng;
+    use rand_chacha::ChaCha20Rng;
+
+    #[test]
+    fn test_from_master_key_success() {
+        // Set up a deterministic RNG.
+        let seed = [33u8; 32];
+        let mut rng = ChaCha20Rng::from_seed(seed);
+
+        // Set up the derivation material.
+        let master_key = b"this is a secret master key";
+        let salt = b"unique-salt";
+        let derivation_material = DerivationMaterial::new(master_key, 0, salt);
+
+        // Generate ClientKeys from the master key.
+        let client_keys = ClientKeys::from_master_key(&mut rng, &derivation_material)
+            .expect("Failed to create client keys");
+
+        assert_eq!(
+            client_keys.identity_keypair().public_key().to_string(),
+            String::from("FX4Undr5LPPBA7zThWWpAKXKQTXSbW1C28PnxbCqUkU4")
+        );
+
+        assert_eq!(
+            client_keys.identity_keypair().private_key().to_string(),
+            String::from("6S3uMi2rU5SwyUUYCiMrF5qqdcYnEDMYLggBSvavVzEt")
+        );
+    }
+
+    #[test]
+    fn test_from_master_key_deterministic_identity() {
+        // Using identical derivation material should result in the exactly same identity keypair.
+        let seed = [1u8; 32];
+        let mut rng1 = ChaCha20Rng::from_seed(seed);
+        let mut rng2 = ChaCha20Rng::from_seed(seed);
+
+        let master_key = b"another secret master key";
+        let salt = b"deterministic-salt";
+        let index = 7u32;
+        let derivation_material = DerivationMaterial::new(master_key, index, salt);
+
+        let client_keys1 = ClientKeys::from_master_key(&mut rng1, &derivation_material)
+            .expect("Failed to create client keys (first instance)");
+        let client_keys2 = ClientKeys::from_master_key(&mut rng2, &derivation_material)
+            .expect("Failed to create client keys (second instance)");
+
+        assert_eq!(
+            client_keys1.identity_keypair().public_key().to_string(),
+            client_keys2.identity_keypair().public_key().to_string()
+        );
+
+        assert_eq!(
+            client_keys1.identity_keypair().private_key().to_string(),
+            client_keys2.identity_keypair().private_key().to_string()
+        );
+    }
+
+    #[test]
+    fn test_from_master_key_different_indices() {
+        // Changing the index should yield a different identity key.
+        let seed = [5u8; 32];
+        let mut rng = ChaCha20Rng::from_seed(seed);
+
+        let master_key = b"same secret key";
+        let salt = b"same-salt";
+
+        let derivation_material1 = DerivationMaterial::new(master_key, 1, salt);
+        let derivation_material2 = DerivationMaterial::new(master_key, 2, salt);
+
+        let client_keys1 = ClientKeys::from_master_key(&mut rng, &derivation_material1)
+            .expect("Failed to create client keys for index 1");
+        let client_keys2 = ClientKeys::from_master_key(&mut rng, &derivation_material2)
+            .expect("Failed to create client keys for index 2");
+
+        assert_ne!(
+            client_keys1.identity_keypair().public_key().to_string(),
+            client_keys2.identity_keypair().public_key().to_string()
+        );
+
+        assert_ne!(
+            client_keys1.identity_keypair().private_key().to_string(),
+            client_keys2.identity_keypair().private_key().to_string()
+        );
+    }
+}

common/client-core/src/client/mix_traffic/mod.rs

@@ -7,6 +7,7 @@ use crate::spawn_future;
 use log::*;
 use nym_gateway_requests::ClientRequest;
 use nym_sphinx::forwarding::packet::MixPacket;
+use nym_task::TaskClient;
 use transceiver::ErasedGatewayError;
 
 pub type BatchMixMessageSender = tokio::sync::mpsc::Sender<Vec<MixPacket>>;
@@ -32,11 +33,14 @@ pub struct MixTrafficController {
     // TODO: this is temporary work-around.
     // in long run `gateway_client` will be moved away from `MixTrafficController` anyway.
     consecutive_gateway_failure_count: usize,
+
+    task_client: TaskClient,
 }
 
 impl MixTrafficController {
     pub fn new<T>(
         gateway_transceiver: T,
+        task_client: TaskClient,
     ) -> (
         MixTrafficController,
         BatchMixMessageSender,
@@ -56,6 +60,7 @@ impl MixTrafficController {
                 mix_rx: message_receiver,
                 client_rx: client_receiver,
                 consecutive_gateway_failure_count: 0,
+                task_client,
             },
             message_sender,
             client_sender,
@@ -64,6 +69,7 @@ impl MixTrafficController {
 
     pub fn new_dynamic(
         gateway_transceiver: Box<dyn GatewayTransceiver + Send>,
+        task_client: TaskClient,
     ) -> (
         MixTrafficController,
         BatchMixMessageSender,
@@ -78,6 +84,7 @@ impl MixTrafficController {
                 mix_rx: message_receiver,
                 client_rx: client_receiver,
                 consecutive_gateway_failure_count: 0,
+                task_client,
             },
             message_sender,
             client_sender,
@@ -109,11 +116,11 @@ impl MixTrafficController {
         result
     }
 
-    pub fn start_with_shutdown(mut self, mut shutdown: nym_task::TaskClient) {
+    pub fn start(mut self) {
         spawn_future(async move {
             debug!("Started MixTrafficController with graceful shutdown support");
 
-            loop {
+            while !self.task_client.is_shutdown() {
                 tokio::select! {
                     mix_packets = self.mix_rx.recv() => match mix_packets {
                         Some(mix_packets) => {
@@ -125,7 +132,7 @@ impl MixTrafficController {
                                     error!("Failed to send sphinx packet to the gateway {MAX_FAILURE_COUNT} times in a row - assuming the gateway is dead");
                                     // Do we need to handle the embedded mixnet client case
                                     // separately?
-                                    shutdown.send_we_stopped(Box::new(ClientCoreError::GatewayFailedToForwardMessages));
+                                    self.task_client.send_we_stopped(Box::new(ClientCoreError::GatewayFailedToForwardMessages));
                                     break;
                                 }
                             }
@@ -146,13 +153,13 @@ impl MixTrafficController {
                             log::trace!("MixTrafficController, client request channel closed");
                         }
                     },
-                    _ = shutdown.recv_with_delay() => {
+                    _ = self.task_client.recv() => {
                         log::trace!("MixTrafficController: Received shutdown");
                         break;
                     }
                 }
             }
-            shutdown.recv_timeout().await;
+            self.task_client.recv_timeout().await;
 
             log::debug!("MixTrafficController: Exiting");
         });

common/client-core/src/client/real_messages_control/acknowledgement_control/acknowledgement_listener.rs

@@ -11,6 +11,7 @@ use nym_sphinx::{
     acknowledgements::{identifier::recover_identifier, AckKey},
     chunking::fragment::{FragmentIdentifier, COVER_FRAG_ID},
 };
+use nym_task::TaskClient;
 use std::sync::Arc;
 
 /// Module responsible for listening for any data resembling acknowledgements from the network
@@ -20,6 +21,7 @@ pub(super) struct AcknowledgementListener {
     ack_receiver: AcknowledgementReceiver,
     action_sender: AckActionSender,
     stats_tx: ClientStatsSender,
+    task_client: TaskClient,
 }
 
 impl AcknowledgementListener {
@@ -28,12 +30,14 @@ impl AcknowledgementListener {
         ack_receiver: AcknowledgementReceiver,
         action_sender: AckActionSender,
         stats_tx: ClientStatsSender,
+        task_client: TaskClient,
     ) -> Self {
         AcknowledgementListener {
             ack_key,
             ack_receiver,
             action_sender,
             stats_tx,
+            task_client,
         }
     }
 
@@ -64,9 +68,14 @@ impl AcknowledgementListener {
         trace!("Received {} from the mix network", frag_id);
         self.stats_tx
             .report(PacketStatisticsEvent::RealAckReceived(ack_content.len()).into());
-        self.action_sender
+        if let Err(err) = self
+            .action_sender
             .unbounded_send(Action::new_remove(frag_id))
-            .unwrap();
+        {
+            if !self.task_client.is_shutdown_poll() {
+                error!("Failed to send remove action to action controller: {err}");
+            }
+        }
     }
 
     async fn handle_ack_receiver_item(&mut self, item: Vec<Vec<u8>>) {
@@ -76,10 +85,10 @@ impl AcknowledgementListener {
         }
     }
 
-    pub(super) async fn run_with_shutdown(&mut self, mut shutdown: nym_task::TaskClient) {
+    pub(super) async fn run(&mut self) {
         debug!("Started AcknowledgementListener with graceful shutdown support");
 
-        while !shutdown.is_shutdown() {
+        while !self.task_client.is_shutdown() {
             tokio::select! {
                 acks = self.ack_receiver.next() => match acks {
                     Some(acks) => self.handle_ack_receiver_item(acks).await,
@@ -88,12 +97,12 @@ impl AcknowledgementListener {
                         break;
                     }
                 },
-                _ = shutdown.recv_with_delay() => {
+                _ = self.task_client.recv() => {
                     log::trace!("AcknowledgementListener: Received shutdown");
                 }
             }
         }
-        shutdown.recv_timeout().await;
+        self.task_client.recv_timeout().await;
         log::debug!("AcknowledgementListener: Exiting");
     }
 }

common/client-core/src/client/real_messages_control/acknowledgement_control/action_controller.rs

@@ -9,6 +9,7 @@ use log::*;
 use nym_nonexhaustive_delayqueue::{Expired, NonExhaustiveDelayQueue, QueueKey};
 use nym_sphinx::chunking::fragment::FragmentIdentifier;
 use nym_sphinx::Delay as SphinxDelay;
+use nym_task::TaskClient;
 use std::collections::HashMap;
 use std::sync::Arc;
 use std::time::Duration;
@@ -101,6 +102,8 @@ pub(super) struct ActionController {
 
     /// Channel for notifying `RetransmissionRequestListener` about expired acknowledgements.
     retransmission_sender: RetransmissionRequestSender,
+
+    task_client: TaskClient,
 }
 
 impl ActionController {
@@ -108,6 +111,7 @@ impl ActionController {
         config: Config,
         retransmission_sender: RetransmissionRequestSender,
         incoming_actions: AckActionReceiver,
+        task_client: TaskClient,
     ) -> Self {
         ActionController {
             config,
@@ -115,6 +119,7 @@ impl ActionController {
             pending_acks_timers: NonExhaustiveDelayQueue::new(),
             incoming_actions,
             retransmission_sender,
+            task_client,
         }
     }
 
@@ -216,11 +221,7 @@ impl ActionController {
     }
 
     // note: when the entry expires it's automatically removed from pending_acks_timers
-    fn handle_expired_ack_timer(
-        &mut self,
-        expired_ack: Expired<FragmentIdentifier>,
-        task_client: &mut nym_task::TaskClient,
-    ) {
+    fn handle_expired_ack_timer(&mut self, expired_ack: Expired<FragmentIdentifier>) {
         // I'm honestly not sure how to handle it, because getting it means other things in our
         // system are already misbehaving. If we ever see this panic, then I guess we should worry
         // about it. Perhaps just reschedule it at later point?
@@ -238,15 +239,13 @@ impl ActionController {
             // downgrading an arc and then upgrading vs cloning is difference of 30ns vs 15ns
             // so it's literally a NO difference while it might prevent us from unnecessarily
             // resending data (in maybe 1 in 1 million cases, but it's something)
-            if self
+            if let Err(err) = self
                 .retransmission_sender
                 .unbounded_send(Arc::downgrade(pending_ack_data))
-                .is_err()
             {
-                assert!(
-                    task_client.is_shutdown_poll(),
-                    "Failed to send pending ack for retransmission"
-                );
+                if !self.task_client.is_shutdown_poll() {
+                    log::error!("Failed to send pending ack for retransmission: {err}");
+                }
             }
         } else {
             // this shouldn't cause any issues but shouldn't have happened to begin with!
@@ -265,10 +264,10 @@ impl ActionController {
         }
     }
 
-    pub(super) async fn run_with_shutdown(&mut self, mut shutdown: nym_task::TaskClient) {
+    pub(super) async fn run(&mut self) {
         debug!("Started ActionController with graceful shutdown support");
 
-        loop {
+        while !self.task_client.is_shutdown() {
             tokio::select! {
                 action = self.incoming_actions.next() => match action {
                     Some(action) => self.process_action(action),
@@ -280,19 +279,19 @@ impl ActionController {
                     }
                 },
                 expired_ack = self.pending_acks_timers.next() => match expired_ack {
-                    Some(expired_ack) => self.handle_expired_ack_timer(expired_ack, &mut shutdown),
+                    Some(expired_ack) => self.handle_expired_ack_timer(expired_ack),
                     None => {
                         log::trace!("ActionController: Stopping since ack channel closed");
                         break;
                     }
                 },
-                _ = shutdown.recv_with_delay() => {
+                _ = self.task_client.recv() => {
                     log::trace!("ActionController: Received shutdown");
                     break;
                 }
             }
         }
-        shutdown.recv_timeout().await;
+        self.task_client.recv_timeout().await;
         log::debug!("ActionController: Exiting");
     }
 }

common/client-core/src/client/real_messages_control/acknowledgement_control/input_message_listener.rs

@@ -11,6 +11,7 @@ use nym_sphinx::anonymous_replies::requests::AnonymousSenderTag;
 use nym_sphinx::forwarding::packet::MixPacket;
 use nym_sphinx::params::PacketType;
 use nym_task::connections::TransmissionLane;
+use nym_task::TaskClient;
 use rand::{CryptoRng, Rng};
 
 /// Module responsible for dealing with the received messages: splitting them, creating acknowledgements,
@@ -23,6 +24,7 @@ where
     input_receiver: InputMessageReceiver,
     message_handler: MessageHandler<R>,
     reply_controller_sender: ReplyControllerSender,
+    task_client: TaskClient,
 }
 
 impl<R> InputMessageListener<R>
@@ -36,11 +38,13 @@ where
         input_receiver: InputMessageReceiver,
         message_handler: MessageHandler<R>,
         reply_controller_sender: ReplyControllerSender,
+        task_client: TaskClient,
     ) -> Self {
         InputMessageListener {
             input_receiver,
             message_handler,
             reply_controller_sender,
+            task_client,
         }
     }
 
@@ -63,8 +67,14 @@ where
         lane: TransmissionLane,
     ) {
         // offload reply handling to the dedicated task
-        self.reply_controller_sender
+        if let Err(err) = self
+            .reply_controller_sender
             .send_reply(recipient_tag, data, lane)
+        {
+            if !self.task_client.is_shutdown_poll() {
+                error!("failed to send a reply - {err}");
+            }
+        }
     }
 
     async fn handle_plain_message(
@@ -164,10 +174,10 @@ where
         };
     }
 
-    pub(super) async fn run_with_shutdown(&mut self, mut shutdown: nym_task::TaskClient) {
+    pub(super) async fn run(&mut self) {
         debug!("Started InputMessageListener with graceful shutdown support");
 
-        while !shutdown.is_shutdown() {
+        while !self.task_client.is_shutdown() {
             tokio::select! {
                 input_msg = self.input_receiver.recv() => match input_msg {
                     Some(input_msg) => {
@@ -178,12 +188,12 @@ where
                         break;
                     }
                 },
-                _ = shutdown.recv_with_delay() => {
+                _ = self.task_client.recv() => {
                     log::trace!("InputMessageListener: Received shutdown");
                 }
             }
         }
-        shutdown.recv_timeout().await;
+        self.task_client.recv_timeout().await;
         log::debug!("InputMessageListener: Exiting");
     }
 }

common/client-core/src/client/real_messages_control/acknowledgement_control/mod.rs

@@ -24,6 +24,7 @@ use nym_sphinx::{
     Delay as SphinxDelay,
 };
 use nym_statistics_common::clients::ClientStatsSender;
+use nym_task::TaskClient;
 use rand::{CryptoRng, Rng};
 use std::{
     sync::{Arc, Weak},
@@ -66,7 +67,7 @@ pub(crate) enum PacketDestination {
 
 /// Structure representing a data `Fragment` that is on-route to the specified `Recipient`
 #[derive(Debug)]
-pub(crate) struct PendingAcknowledgement {
+pub struct PendingAcknowledgement {
     message_chunk: Fragment,
     delay: SphinxDelay,
     destination: PacketDestination,
@@ -216,6 +217,7 @@ where
         message_handler: MessageHandler<R>,
         reply_controller_sender: ReplyControllerSender,
         stats_tx: ClientStatsSender,
+        task_client: TaskClient,
     ) -> Self {
         let (retransmission_tx, retransmission_rx) = mpsc::unbounded();
 
@@ -225,6 +227,7 @@ where
             action_config,
             retransmission_tx,
             connectors.ack_action_receiver,
+            task_client.fork("action_controller"),
         );
 
         // will listen for any acks coming from the network
@@ -233,6 +236,7 @@ where
             connectors.ack_receiver,
             connectors.ack_action_sender.clone(),
             stats_tx,
+            task_client.fork("acknowledgement_listener"),
         );
 
         // will listen for any new messages from the client
@@ -240,6 +244,7 @@ where
             connectors.input_receiver,
             message_handler.clone(),
             reply_controller_sender.clone(),
+            task_client.fork("input_message_listener"),
         );
 
         // will listen for any ack timeouts and trigger retransmission
@@ -249,12 +254,16 @@ where
             message_handler,
             retransmission_rx,
             reply_controller_sender,
+            task_client.fork("retransmission_request_listener"),
         );
 
         // will listen for events indicating the packet was sent through the network so that
         // the retransmission timer should be started.
-        let sent_notification_listener =
-            SentNotificationListener::new(connectors.sent_notifier, connectors.ack_action_sender);
+        let sent_notification_listener = SentNotificationListener::new(
+            connectors.sent_notifier,
+            connectors.ack_action_sender,
+            task_client.with_suffix("sent_notification_listener"),
+        );
 
         AcknowledgementController {
             acknowledgement_listener,
@@ -265,53 +274,35 @@ where
         }
     }
 
-    pub(super) fn start_with_shutdown(
-        self,
-        shutdown: nym_task::TaskClient,
-        packet_type: PacketType,
-    ) {
+    pub(super) fn start(self, packet_type: PacketType) {
         let mut acknowledgement_listener = self.acknowledgement_listener;
         let mut input_message_listener = self.input_message_listener;
         let mut retransmission_request_listener = self.retransmission_request_listener;
         let mut sent_notification_listener = self.sent_notification_listener;
         let mut action_controller = self.action_controller;
 
-        let shutdown_handle = shutdown.fork("acknowledgement_listener");
         spawn_future(async move {
-            acknowledgement_listener
-                .run_with_shutdown(shutdown_handle)
-                .await;
+            acknowledgement_listener.run().await;
             debug!("The acknowledgement listener has finished execution!");
         });
 
-        let shutdown_handle = shutdown.fork("input_message_listener");
         spawn_future(async move {
-            input_message_listener
-                .run_with_shutdown(shutdown_handle)
-                .await;
+            input_message_listener.run().await;
             debug!("The input listener has finished execution!");
         });
 
-        let shutdown_handle = shutdown.fork("retransmission_request_listener");
         spawn_future(async move {
-            retransmission_request_listener
-                .run_with_shutdown(shutdown_handle, packet_type)
-                .await;
+            retransmission_request_listener.run(packet_type).await;
             debug!("The retransmission request listener has finished execution!");
         });
 
-        let shutdown_handle = shutdown.fork("sent_notification_listener");
         spawn_future(async move {
-            sent_notification_listener
-                .run_with_shutdown(shutdown_handle)
-                .await;
+            sent_notification_listener.run().await;
             debug!("The sent notification listener has finished execution!");
         });
 
         spawn_future(async move {
-            action_controller
-                .run_with_shutdown(shutdown.with_suffix("action_controller"))
-                .await;
+            action_controller.run().await;
             debug!("The controller has finished execution!");
         });
     }

common/client-core/src/client/real_messages_control/acknowledgement_control/retransmission_request_listener.rs

@@ -14,7 +14,7 @@ use log::*;
 use nym_sphinx::chunking::fragment::Fragment;
 use nym_sphinx::preparer::PreparedFragment;
 use nym_sphinx::{addressing::clients::Recipient, params::PacketType};
-use nym_task::connections::TransmissionLane;
+use nym_task::{connections::TransmissionLane, TaskClient};
 use rand::{CryptoRng, Rng};
 use std::sync::{Arc, Weak};
 
@@ -25,6 +25,7 @@ pub(super) struct RetransmissionRequestListener<R> {
     message_handler: MessageHandler<R>,
     request_receiver: RetransmissionRequestReceiver,
     reply_controller_sender: ReplyControllerSender,
+    task_client: TaskClient,
 }
 
 impl<R> RetransmissionRequestListener<R>
@@ -37,6 +38,7 @@ where
         message_handler: MessageHandler<R>,
         request_receiver: RetransmissionRequestReceiver,
         reply_controller_sender: ReplyControllerSender,
+        task_client: TaskClient,
     ) -> Self {
         RetransmissionRequestListener {
             maximum_retransmissions,
@@ -44,6 +46,7 @@ where
             message_handler,
             request_receiver,
             reply_controller_sender,
+            task_client,
         }
     }
 
@@ -79,9 +82,12 @@ where
         if let Some(limit) = self.maximum_retransmissions {
             if timed_out_ack.retransmissions >= limit {
                 warn!("reached maximum number of allowed retransmissions for the packet");
-                self.action_sender
+                if let Err(err) = self
+                    .action_sender
                     .unbounded_send(Action::new_remove(frag_id))
-                    .unwrap();
+                {
+                    error!("Failed to send remove action to the controller: {err}");
+                }
                 return;
             }
         }
@@ -93,11 +99,16 @@ where
             } => {
                 // if this is retransmission for reply, offload it to the dedicated task
                 // that deals with all the surbs
-                return self.reply_controller_sender.send_retransmission_data(
+                if let Err(err) = self.reply_controller_sender.send_retransmission_data(
                     *recipient_tag,
                     weak_timed_out_ack,
                     *extra_surb_request,
-                );
+                ) {
+                    if !self.task_client.is_shutdown_poll() {
+                        error!("Failed to send retransmission data to the reply controller: {err}");
+                    }
+                }
+                return;
             }
             PacketDestination::KnownRecipient(recipient) => {
                 self.prepare_normal_retransmission_chunk(
@@ -114,9 +125,12 @@ where
             Err(err) => {
                 warn!("Could not retransmit the packet - {err}");
                 // we NEED to start timer here otherwise we will have this guy permanently stuck in memory
-                self.action_sender
+                if let Err(err) = self
+                    .action_sender
                     .unbounded_send(Action::new_start_timer(frag_id))
-                    .unwrap();
+                {
+                    error!("Failed to send start timer action to the controller: {err}");
+                }
                 return;
             }
         };
@@ -141,9 +155,14 @@ where
         // is sent to the `OutQueueControl` and has gone through its internal queue
         // with the additional poisson delay.
         // And since Actions are executed in order `UpdateTimer` will HAVE TO be executed before `StartTimer`
-        self.action_sender
+        if let Err(err) = self
+            .action_sender
             .unbounded_send(Action::new_update_pending_ack(frag_id, new_delay))
-            .unwrap();
+        {
+            if !self.task_client.is_shutdown_poll() {
+                error!("Failed to send update pending ack action to the controller: {err}");
+            }
+        }
 
         // send to `OutQueueControl` to eventually send to the mix network
         self.message_handler
@@ -157,14 +176,10 @@ where
             .await
     }
 
-    pub(super) async fn run_with_shutdown(
-        &mut self,
-        mut shutdown: nym_task::TaskClient,
-        packet_type: PacketType,
-    ) {
+    pub(super) async fn run(&mut self, packet_type: PacketType) {
         debug!("Started RetransmissionRequestListener with graceful shutdown support");
 
-        while !shutdown.is_shutdown() {
+        while !self.task_client.is_shutdown() {
             tokio::select! {
                 timed_out_ack = self.request_receiver.next() => match timed_out_ack {
                     Some(timed_out_ack) => self.on_retransmission_request(timed_out_ack, packet_type).await,
@@ -173,12 +188,12 @@ where
                         break;
                     }
                 },
-                _ = shutdown.recv() => {
+                _ = self.task_client.recv() => {
                     log::trace!("RetransmissionRequestListener: Received shutdown");
                 }
             }
         }
-        shutdown.recv_timeout().await;
+        self.task_client.recv_timeout().await;
         log::debug!("RetransmissionRequestListener: Exiting");
     }
 }

common/client-core/src/client/real_messages_control/acknowledgement_control/sent_notification_listener.rs

@@ -6,6 +6,7 @@ use super::SentPacketNotificationReceiver;
 use futures::StreamExt;
 use log::*;
 use nym_sphinx::chunking::fragment::{FragmentIdentifier, COVER_FRAG_ID};
+use nym_task::TaskClient;
 
 /// Module responsible for starting up retransmission timers.
 /// It is required because when we send our packet to the `real traffic stream` controlled
@@ -14,16 +15,19 @@ use nym_sphinx::chunking::fragment::{FragmentIdentifier, COVER_FRAG_ID};
 pub(super) struct SentNotificationListener {
     sent_notifier: SentPacketNotificationReceiver,
     action_sender: AckActionSender,
+    task_client: TaskClient,
 }
 
 impl SentNotificationListener {
     pub(super) fn new(
         sent_notifier: SentPacketNotificationReceiver,
         action_sender: AckActionSender,
+        task_client: TaskClient,
     ) -> Self {
         SentNotificationListener {
             sent_notifier,
             action_sender,
+            task_client,
         }
     }
 
@@ -32,15 +36,20 @@ impl SentNotificationListener {
             trace!("sent off a cover message - no need to start retransmission timer!");
             return;
         }
-        self.action_sender
+        if let Err(err) = self
+            .action_sender
             .unbounded_send(Action::new_start_timer(frag_id))
-            .unwrap();
+        {
+            if !self.task_client.is_shutdown_poll() {
+                error!("Failed to send start timer action to action controller: {err}");
+            }
+        }
     }
 
-    pub(super) async fn run_with_shutdown(&mut self, mut shutdown: nym_task::TaskClient) {
+    pub(super) async fn run(&mut self) {
         debug!("Started SentNotificationListener with graceful shutdown support");
 
-        loop {
+        while !self.task_client.is_shutdown() {
             tokio::select! {
                 frag_id = self.sent_notifier.next() => match frag_id {
                     Some(frag_id) => {
@@ -51,13 +60,13 @@ impl SentNotificationListener {
                         break;
                     }
                 },
-                _ = shutdown.recv_with_delay() => {
+                _ = self.task_client.recv() => {
                     log::trace!("SentNotificationListener: Received shutdown");
                     break;
                 }
             }
         }
-        assert!(shutdown.is_shutdown_poll());
+        assert!(self.task_client.is_shutdown_poll());
         log::debug!("SentNotificationListener: Exiting");
     }
 }

common/client-core/src/client/real_messages_control/message_handler.rs

@@ -19,6 +19,7 @@ use nym_sphinx::params::{PacketSize, PacketType};
 use nym_sphinx::preparer::{MessagePreparer, PreparedFragment};
 use nym_sphinx::Delay;
 use nym_task::connections::TransmissionLane;
+use nym_task::TaskClient;
 use nym_topology::{NymRouteProvider, NymTopologyError};
 use rand::{CryptoRng, Rng};
 use std::collections::HashMap;
@@ -149,12 +150,14 @@ pub(crate) struct MessageHandler<R> {
     topology_access: TopologyAccessor,
     reply_key_storage: SentReplyKeys,
     tag_storage: UsedSenderTags,
+    task_client: TaskClient,
 }
 
 impl<R> MessageHandler<R>
 where
     R: CryptoRng + Rng,
 {
+    #[allow(clippy::too_many_arguments)]
     pub(crate) fn new(
         config: Config,
         rng: R,
@@ -163,6 +166,7 @@ where
         topology_access: TopologyAccessor,
         reply_key_storage: SentReplyKeys,
         tag_storage: UsedSenderTags,
+        task_client: TaskClient,
     ) -> Self
     where
         R: Copy,
@@ -183,6 +187,7 @@ where
             topology_access,
             reply_key_storage,
             tag_storage,
+            task_client,
         }
     }
 
@@ -609,15 +614,25 @@ where
     }
 
     pub(crate) fn update_ack_delay(&self, id: FragmentIdentifier, new_delay: Delay) {
-        self.action_sender
+        if let Err(err) = self
+            .action_sender
             .unbounded_send(Action::UpdatePendingAck(id, new_delay))
-            .expect("action control task has died")
+        {
+            if !self.task_client.is_shutdown_poll() {
+                error!("Failed to send update action to the controller: {err}");
+            }
+        }
     }
 
     pub(crate) fn insert_pending_acks(&self, pending_acks: Vec<PendingAcknowledgement>) {
-        self.action_sender
+        if let Err(err) = self
+            .action_sender
             .unbounded_send(Action::new_insert(pending_acks))
-            .expect("action control task has died")
+        {
+            if !self.task_client.is_shutdown_poll() {
+                error!("Failed to send insert action to the controller: {err}");
+            }
+        }
     }
 
     // tells real message sender (with the poisson timer) to send this to the mix network
@@ -631,9 +646,9 @@ where
             .send((messages, transmission_lane))
             .await
         {
-            error!(
-                "Failed to forward messages to the real message sender (OutQueueControl): {err}"
-            );
+            if !self.task_client.is_shutdown_poll() {
+                error!("Failed to forward messages to the real message sender: {err}");
+            }
         }
     }
 }

common/client-core/src/client/real_messages_control/mod.rs

@@ -31,6 +31,7 @@ use nym_sphinx::addressing::clients::Recipient;
 use nym_sphinx::params::PacketType;
 use nym_statistics_common::clients::ClientStatsSender;
 use nym_task::connections::{ConnectionCommandReceiver, LaneQueueLengths};
+use nym_task::TaskClient;
 use rand::{rngs::OsRng, CryptoRng, Rng};
 use std::sync::Arc;
 
@@ -147,6 +148,7 @@ impl RealMessagesController<OsRng> {
         lane_queue_lengths: LaneQueueLengths,
         client_connection_rx: ConnectionCommandReceiver,
         stats_tx: ClientStatsSender,
+        task_client: TaskClient,
     ) -> Self {
         let rng = OsRng;
 
@@ -177,6 +179,7 @@ impl RealMessagesController<OsRng> {
             topology_access.clone(),
             reply_storage.key_storage(),
             reply_storage.tags_storage(),
+            task_client.fork("message_handler"),
         );
 
         let ack_control = AcknowledgementController::new(
@@ -186,6 +189,7 @@ impl RealMessagesController<OsRng> {
             message_handler.clone(),
             reply_controller_sender,
             stats_tx.clone(),
+            task_client.fork("ack_control"),
         );
 
         let reply_control = ReplyController::new(
@@ -193,6 +197,7 @@ impl RealMessagesController<OsRng> {
             message_handler,
             reply_storage,
             reply_controller_receiver,
+            task_client.fork("reply_controller"),
         );
 
         let out_queue_control = OutQueueControl::new(
@@ -205,6 +210,7 @@ impl RealMessagesController<OsRng> {
             lane_queue_lengths,
             client_connection_rx,
             stats_tx,
+            task_client.with_suffix("out_queue_control"),
         );
 
         RealMessagesController {
@@ -214,22 +220,20 @@ impl RealMessagesController<OsRng> {
         }
     }
 
-    pub fn start_with_shutdown(self, shutdown: nym_task::TaskClient, packet_type: PacketType) {
+    pub fn start(self, packet_type: PacketType) {
         let mut out_queue_control = self.out_queue_control;
         let ack_control = self.ack_control;
         let mut reply_control = self.reply_control;
 
-        let shutdown_handle = shutdown.fork("out_queue_control");
         spawn_future(async move {
-            out_queue_control.run_with_shutdown(shutdown_handle).await;
+            out_queue_control.run().await;
             debug!("The out queue controller has finished execution!");
         });
-        let shutdown_handle = shutdown.fork("reply_control");
         spawn_future(async move {
-            reply_control.run_with_shutdown(shutdown_handle).await;
+            reply_control.run().await;
             debug!("The reply controller has finished execution!");
         });
 
-        ack_control.start_with_shutdown(shutdown.with_suffix("ack_control"), packet_type);
+        ack_control.start(packet_type);
     }
 }

common/client-core/src/client/real_messages_control/real_traffic_stream.rs

@@ -22,6 +22,7 @@ use nym_statistics_common::clients::{packet_statistics::PacketStatisticsEvent, C
 use nym_task::connections::{
     ConnectionCommand, ConnectionCommandReceiver, ConnectionId, LaneQueueLengths, TransmissionLane,
 };
+use nym_task::TaskClient;
 use rand::{CryptoRng, Rng};
 use std::pin::Pin;
 use std::sync::Arc;
@@ -117,6 +118,8 @@ where
 
     /// Channel used for sending metrics events (specifically `PacketStatistics` events) to the metrics tracker.
     stats_tx: ClientStatsSender,
+
+    task_client: TaskClient,
 }
 
 #[derive(Debug)]
@@ -176,6 +179,7 @@ where
         lane_queue_lengths: LaneQueueLengths,
         client_connection_rx: ConnectionCommandReceiver,
         stats_tx: ClientStatsSender,
+        task_client: TaskClient,
     ) -> Self {
         OutQueueControl {
             config,
@@ -190,6 +194,7 @@ where
             client_connection_rx,
             lane_queue_lengths,
             stats_tx,
+            task_client,
         }
     }
 
@@ -198,7 +203,9 @@ where
         // queues and client load rather than the required delay. So realistically we can treat
         // whatever is about to happen as negligible additional delay.
         trace!("{} is about to get sent to the mixnet", frag_id);
-        self.sent_notifier.unbounded_send(frag_id).unwrap();
+        if let Err(err) = self.sent_notifier.unbounded_send(frag_id) {
+            error!("Failed to notify about sent message: {err}");
+        }
     }
 
     fn loop_cover_message_size(&mut self) -> PacketSize {
@@ -271,7 +278,9 @@ where
         };
 
         if let Err(err) = self.mix_tx.send(vec![next_message]).await {
-            log::error!("Failed to send: {err}");
+            if !self.task_client.is_shutdown_poll() {
+                log::error!("Failed to send: {err}");
+            }
         } else {
             let event = if fragment_id.is_some() {
                 PacketStatisticsEvent::RealPacketSent(packet_size)
@@ -504,7 +513,7 @@ where
     }
 
     #[cfg(not(target_arch = "wasm32"))]
-    fn log_status(&self, shutdown: &mut nym_task::TaskClient) {
+    fn log_status(&self, shutdown: &mut TaskClient) {
         use crate::error::ClientCoreStatusMessage;
 
         let packets = self.transmission_buffer.total_size();
@@ -535,14 +544,16 @@ where
         }
     }
 
-    pub(super) async fn run_with_shutdown(&mut self, mut shutdown: nym_task::TaskClient) {
+    pub(super) async fn run(&mut self) {
         debug!("Started OutQueueControl with graceful shutdown support");
 
+        let mut shutdown = self.task_client.fork("select");
+
         #[cfg(not(target_arch = "wasm32"))]
         {
             let mut status_timer = tokio::time::interval(Duration::from_secs(5));
 
-            loop {
+            while !shutdown.is_shutdown() {
                 tokio::select! {
                     biased;
                     _ = shutdown.recv() => {

common/client-core/src/client/received_buffer.rs

@@ -20,6 +20,7 @@ use nym_sphinx::message::{NymMessage, PlainMessage};
 use nym_sphinx::params::ReplySurbKeyDigestAlgorithm;
 use nym_sphinx::receiver::{MessageReceiver, MessageRecoveryError, ReconstructedMessage};
 use nym_statistics_common::clients::{packet_statistics::PacketStatisticsEvent, ClientStatsSender};
+use nym_task::TaskClient;
 use std::collections::HashSet;
 use std::sync::Arc;
 
@@ -152,6 +153,7 @@ struct ReceivedMessagesBuffer<R: MessageReceiver> {
     inner: Arc<Mutex<ReceivedMessagesBufferInner<R>>>,
     reply_key_storage: SentReplyKeys,
     reply_controller_sender: ReplyControllerSender,
+    task_client: TaskClient,
 }
 
 impl<R: MessageReceiver> ReceivedMessagesBuffer<R> {
@@ -160,6 +162,7 @@ impl<R: MessageReceiver> ReceivedMessagesBuffer<R> {
         reply_key_storage: SentReplyKeys,
         reply_controller_sender: ReplyControllerSender,
         stats_tx: ClientStatsSender,
+        task_client: TaskClient,
     ) -> Self {
         ReceivedMessagesBuffer {
             inner: Arc::new(Mutex::new(ReceivedMessagesBufferInner {
@@ -172,6 +175,7 @@ impl<R: MessageReceiver> ReceivedMessagesBuffer<R> {
             })),
             reply_key_storage,
             reply_controller_sender,
+            task_client,
         }
     }
 
@@ -257,11 +261,15 @@ impl<R: MessageReceiver> ReceivedMessagesBuffer<R> {
                 }
             };
 
-            self.reply_controller_sender.send_additional_surbs(
+            if let Err(err) = self.reply_controller_sender.send_additional_surbs(
                 msg.sender_tag,
                 reply_surbs,
                 from_surb_request,
-            )
+            ) {
+                if !self.task_client.is_shutdown_poll() {
+                    error!("{err}");
+                }
+            }
         }
         reconstructed
     }
@@ -276,8 +284,14 @@ impl<R: MessageReceiver> ReceivedMessagesBuffer<R> {
                 ReplyMessageContent::Data { message } => reconstructed.push(message.into()),
                 ReplyMessageContent::SurbRequest { recipient, amount } => {
                     debug!("received request for {amount} additional reply SURBs from {recipient}");
-                    self.reply_controller_sender
-                        .send_additional_surbs_request(*recipient, amount);
+                    if let Err(err) = self
+                        .reply_controller_sender
+                        .send_additional_surbs_request(*recipient, amount)
+                    {
+                        if !self.task_client.is_shutdown_poll() {
+                            error!("{err}");
+                        }
+                    }
                 }
             }
         }
@@ -399,16 +413,19 @@ pub enum ReceivedBufferMessage {
 struct RequestReceiver<R: MessageReceiver> {
     received_buffer: ReceivedMessagesBuffer<R>,
     query_receiver: ReceivedBufferRequestReceiver,
+    task_client: TaskClient,
 }
 
 impl<R: MessageReceiver> RequestReceiver<R> {
     fn new(
         received_buffer: ReceivedMessagesBuffer<R>,
         query_receiver: ReceivedBufferRequestReceiver,
+        task_client: TaskClient,
     ) -> Self {
         RequestReceiver {
             received_buffer,
             query_receiver,
+            task_client,
         }
     }
 
@@ -423,12 +440,12 @@ impl<R: MessageReceiver> RequestReceiver<R> {
         }
     }
 
-    async fn run_with_shutdown(&mut self, mut shutdown: nym_task::TaskClient) {
+    async fn run(&mut self) {
         debug!("Started RequestReceiver with graceful shutdown support");
-        while !shutdown.is_shutdown() {
+        while !self.task_client.is_shutdown() {
             tokio::select! {
                 biased;
-                _ = shutdown.recv_with_delay() => {
+                _ = self.task_client.recv() => {
                     log::trace!("RequestReceiver: Received shutdown");
                 }
                 request = self.query_receiver.next() => {
@@ -441,7 +458,7 @@ impl<R: MessageReceiver> RequestReceiver<R> {
                 },
             }
         }
-        shutdown.recv_timeout().await;
+        self.task_client.recv().await;
         log::debug!("RequestReceiver: Exiting");
     }
 }
@@ -449,25 +466,25 @@ impl<R: MessageReceiver> RequestReceiver<R> {
 struct FragmentedMessageReceiver<R: MessageReceiver> {
     received_buffer: ReceivedMessagesBuffer<R>,
     mixnet_packet_receiver: MixnetMessageReceiver,
+    task_client: TaskClient,
 }
 
 impl<R: MessageReceiver> FragmentedMessageReceiver<R> {
     fn new(
         received_buffer: ReceivedMessagesBuffer<R>,
         mixnet_packet_receiver: MixnetMessageReceiver,
+        task_client: TaskClient,
     ) -> Self {
         FragmentedMessageReceiver {
             received_buffer,
             mixnet_packet_receiver,
+            task_client,
         }
     }
 
-    async fn run_with_shutdown(
-        &mut self,
-        mut shutdown: nym_task::TaskClient,
-    ) -> Result<(), MessageRecoveryError> {
+    async fn run(&mut self) -> Result<(), MessageRecoveryError> {
         debug!("Started FragmentedMessageReceiver with graceful shutdown support");
-        while !shutdown.is_shutdown() {
+        while !self.task_client.is_shutdown() {
             tokio::select! {
                 new_messages = self.mixnet_packet_receiver.next() => {
                     if let Some(new_messages) = new_messages {
@@ -477,12 +494,12 @@ impl<R: MessageReceiver> FragmentedMessageReceiver<R> {
                         break;
                     }
                 },
-                _ = shutdown.recv_with_delay() => {
+                _ = self.task_client.recv_with_delay() => {
                     log::trace!("FragmentedMessageReceiver: Received shutdown");
                 }
             }
         }
-        shutdown.recv_timeout().await;
+        self.task_client.recv_timeout().await;
         log::debug!("FragmentedMessageReceiver: Exiting");
         Ok(())
     }
@@ -501,41 +518,42 @@ impl<R: MessageReceiver + Clone + Send + 'static> ReceivedMessagesBufferControll
         reply_key_storage: SentReplyKeys,
         reply_controller_sender: ReplyControllerSender,
         metrics_reporter: ClientStatsSender,
+        task_client: TaskClient,
     ) -> Self {
         let received_buffer = ReceivedMessagesBuffer::new(
             local_encryption_keypair,
             reply_key_storage,
             reply_controller_sender,
             metrics_reporter,
+            task_client.fork("received_messages_buffer"),
         );
 
         ReceivedMessagesBufferController {
             fragmented_message_receiver: FragmentedMessageReceiver::new(
                 received_buffer.clone(),
                 mixnet_packet_receiver,
+                task_client.fork("fragmented_message_receiver"),
+            ),
+            request_receiver: RequestReceiver::new(
+                received_buffer,
+                query_receiver,
+                task_client.with_suffix("request_receiver"),
             ),
-            request_receiver: RequestReceiver::new(received_buffer, query_receiver),
         }
     }
 
-    pub fn start_with_shutdown(self, shutdown: nym_task::TaskClient) {
+    pub fn start(self) {
         let mut fragmented_message_receiver = self.fragmented_message_receiver;
         let mut request_receiver = self.request_receiver;
 
-        let shutdown_handle = shutdown.fork("fragmented_message_receiver");
         spawn_future(async move {
-            match fragmented_message_receiver
-                .run_with_shutdown(shutdown_handle)
-                .await
-            {
+            match fragmented_message_receiver.run().await {
                 Ok(_) => {}
                 Err(e) => error!("{e}"),
             }
         });
         spawn_future(async move {
-            request_receiver
-                .run_with_shutdown(shutdown.with_suffix("request_receiver"))
-                .await;
+            request_receiver.run().await;
         });
     }
 }

common/client-core/src/client/replies/reply_controller/mod.rs

@@ -12,6 +12,7 @@ use nym_sphinx::anonymous_replies::requests::AnonymousSenderTag;
 use nym_sphinx::anonymous_replies::ReplySurb;
 use nym_sphinx::chunking::fragment::{Fragment, FragmentIdentifier};
 use nym_task::connections::{ConnectionId, TransmissionLane};
+use nym_task::TaskClient;
 use rand::{CryptoRng, Rng};
 use std::cmp::{max, min};
 use std::collections::btree_map::Entry;
@@ -68,6 +69,9 @@ pub struct ReplyController<R> {
 
     message_handler: MessageHandler<R>,
     full_reply_storage: CombinedReplyStorage,
+
+    // Listen for shutdown signals
+    task_client: TaskClient,
 }
 
 impl<R> ReplyController<R>
@@ -79,6 +83,7 @@ where
         message_handler: MessageHandler<R>,
         full_reply_storage: CombinedReplyStorage,
         request_receiver: ReplyControllerReceiver,
+        task_client: TaskClient,
     ) -> Self {
         ReplyController {
             config,
@@ -87,6 +92,7 @@ where
             pending_retransmissions: HashMap::new(),
             message_handler,
             full_reply_storage,
+            task_client,
         }
     }
 
@@ -846,9 +852,11 @@ where
     //     todo!()
     // }
 
-    pub(crate) async fn run_with_shutdown(&mut self, mut shutdown: nym_task::TaskClient) {
+    pub(crate) async fn run(&mut self) {
         debug!("Started ReplyController with graceful shutdown support");
 
+        let mut shutdown = self.task_client.fork("select");
+
         let polling_rate = Duration::from_secs(5);
         let mut stale_inspection = new_interval_stream(polling_rate);
 
@@ -860,7 +868,7 @@ where
         while !shutdown.is_shutdown() {
             tokio::select! {
                 biased;
-                _ = shutdown.recv_with_delay() => {
+                _ = shutdown.recv() => {
                     log::trace!("ReplyController: Received shutdown");
                 },
                 req = self.request_receiver.next() => match req {

common/client-core/src/client/replies/reply_controller/requests.rs

@@ -15,6 +15,27 @@ pub(crate) fn new_control_channels() -> (ReplyControllerSender, ReplyControllerR
     (tx.into(), rx)
 }
 
+#[derive(Debug, thiserror::Error)]
+pub enum ReplyControllerSenderError {
+    #[error("failed to send retransmission data to reply controller")]
+    SendRetransmissionData(#[source] mpsc::TrySendError<ReplyControllerMessage>),
+
+    #[error("failed to send reply to reply controller")]
+    SendReply(#[source] mpsc::TrySendError<ReplyControllerMessage>),
+
+    #[error("failed to send additional surbs to reply controller")]
+    AdditionalSurbs(#[source] mpsc::TrySendError<ReplyControllerMessage>),
+
+    #[error("failed to send additional surbs request to reply controller")]
+    AdditionalSurbsRequest(#[source] mpsc::TrySendError<ReplyControllerMessage>),
+
+    #[error("failed to request lane queue length from reply controller")]
+    LaneQueueLength(#[source] mpsc::TrySendError<ReplyControllerMessage>),
+
+    #[error("response channel was dropped before we could receive the response")]
+    ResponseChannelDropped(#[source] oneshot::Canceled),
+}
+
 #[derive(Debug, Clone)]
 pub struct ReplyControllerSender(mpsc::UnboundedSender<ReplyControllerMessage>);
 
@@ -30,14 +51,14 @@ impl ReplyControllerSender {
         recipient: AnonymousSenderTag,
         timed_out_ack: Weak<PendingAcknowledgement>,
         extra_surb_request: bool,
-    ) {
+    ) -> Result<(), ReplyControllerSenderError> {
         self.0
             .unbounded_send(ReplyControllerMessage::RetransmitReply {
                 recipient,
                 timed_out_ack,
                 extra_surb_request,
             })
-            .expect("ReplyControllerReceiver has died!")
+            .map_err(ReplyControllerSenderError::SendRetransmissionData)
     }
 
     pub(crate) fn send_reply(
@@ -45,14 +66,14 @@ impl ReplyControllerSender {
         recipient: AnonymousSenderTag,
         message: Vec<u8>,
         lane: TransmissionLane,
-    ) {
+    ) -> Result<(), ReplyControllerSenderError> {
         self.0
             .unbounded_send(ReplyControllerMessage::SendReply {
                 recipient,
                 message,
                 lane,
             })
-            .expect("ReplyControllerReceiver has died!")
+            .map_err(ReplyControllerSenderError::SendReply)
     }
 
     pub(crate) fn send_additional_surbs(
@@ -60,42 +81,47 @@ impl ReplyControllerSender {
         sender_tag: AnonymousSenderTag,
         reply_surbs: Vec<ReplySurb>,
         from_surb_request: bool,
-    ) {
+    ) -> Result<(), ReplyControllerSenderError> {
         self.0
             .unbounded_send(ReplyControllerMessage::AdditionalSurbs {
                 sender_tag,
                 reply_surbs,
                 from_surb_request,
             })
-            .expect("ReplyControllerReceiver has died!")
+            .map_err(ReplyControllerSenderError::AdditionalSurbs)
     }
 
-    pub(crate) fn send_additional_surbs_request(&self, recipient: Recipient, amount: u32) {
+    pub(crate) fn send_additional_surbs_request(
+        &self,
+        recipient: Recipient,
+        amount: u32,
+    ) -> Result<(), ReplyControllerSenderError> {
         self.0
             .unbounded_send(ReplyControllerMessage::AdditionalSurbsRequest {
                 recipient: Box::new(recipient),
                 amount,
             })
-            .expect("ReplyControllerReceiver has died!")
+            .map_err(ReplyControllerSenderError::AdditionalSurbsRequest)
     }
 
-    pub async fn get_lane_queue_length(&self, connection_id: ConnectionId) -> usize {
+    pub async fn get_lane_queue_length(
+        &self,
+        connection_id: ConnectionId,
+    ) -> Result<usize, ReplyControllerSenderError> {
         let (response_tx, response_rx) = oneshot::channel();
-        self.0
+        if let Err(err) = self
+            .0
             .unbounded_send(ReplyControllerMessage::LaneQueueLength {
                 connection_id,
                 response_channel: response_tx,
             })
-            .expect("ReplyControllerReceiver has died!");
-
-        match response_rx.await {
-            Ok(length) => length,
-            Err(_) => {
-                error!("The reply controller has dropped our response channel!");
-                // TODO: should we panic here instead? this message implies something weird and unrecoverable has happened
-                0
-            }
+        {
+            return Err(ReplyControllerSenderError::LaneQueueLength(err));
         }
+
+        response_rx
+            .await
+            .map_err(ReplyControllerSenderError::ResponseChannelDropped)
     }
 }
 
@@ -110,7 +136,10 @@ impl ReplyQueueLengths {
         }
     }
 
-    pub async fn get_lane_queue_length(&self, connection_id: ConnectionId) -> usize {
+    pub async fn get_lane_queue_length(
+        &self,
+        connection_id: ConnectionId,
+    ) -> Result<usize, ReplyControllerSenderError> {
         self.reply_controller_sender
             .get_lane_queue_length(connection_id)
             .await
@@ -120,7 +149,7 @@ impl ReplyQueueLengths {
 pub(crate) type ReplyControllerReceiver = mpsc::UnboundedReceiver<ReplyControllerMessage>;
 
 #[derive(Debug)]
-pub(crate) enum ReplyControllerMessage {
+pub enum ReplyControllerMessage {
     RetransmitReply {
         recipient: AnonymousSenderTag,
         timed_out_ack: Weak<PendingAcknowledgement>,

common/client-core/src/client/statistics_control.rs

@@ -22,7 +22,7 @@ use nym_sphinx::addressing::Recipient;
 use nym_statistics_common::clients::{
     ClientStatsController, ClientStatsReceiver, ClientStatsSender,
 };
-use nym_task::connections::TransmissionLane;
+use nym_task::{connections::TransmissionLane, TaskClient};
 use std::time::Duration;
 
 use crate::{
@@ -51,6 +51,9 @@ pub(crate) struct StatisticsControl {
 
     /// Config for stats reporting (enabled, address, interval)
     reporting_config: StatsReporting,
+
+    /// Task client for listening for shutdown
+    task_client: TaskClient,
 }
 
 impl StatisticsControl {
@@ -59,19 +62,24 @@ impl StatisticsControl {
         client_type: String,
         client_stats_id: String,
         report_tx: InputMessageSender,
+        task_client: TaskClient,
     ) -> (Self, ClientStatsSender) {
         let (stats_tx, stats_rx) = tokio::sync::mpsc::unbounded_channel();
 
         let stats = ClientStatsController::new(client_stats_id, client_type);
 
+        let mut task_client_stats_sender = task_client.fork("stats_sender");
+        task_client_stats_sender.disarm();
+
         (
             StatisticsControl {
                 stats,
                 stats_rx,
                 report_tx,
                 reporting_config,
+                task_client,
             },
-            ClientStatsSender::new(Some(stats_tx)),
+            ClientStatsSender::new(Some(stats_tx), task_client_stats_sender),
         )
     }
 
@@ -91,7 +99,7 @@ impl StatisticsControl {
         }
     }
 
-    async fn run_with_shutdown(&mut self, mut task_client: nym_task::TaskClient) {
+    async fn run(&mut self) {
         log::debug!("Started StatisticsControl with graceful shutdown support");
 
         #[cfg(not(target_arch = "wasm32"))]
@@ -121,10 +129,10 @@ impl StatisticsControl {
         let mut snapshot_interval =
             gloo_timers::future::IntervalStream::new(SNAPSHOT_INTERVAL.as_millis() as u32);
 
-        loop {
+        while !self.task_client.is_shutdown() {
             tokio::select! {
                 biased;
-                _ = task_client.recv() => {
+                _ = self.task_client.recv() => {
                     log::trace!("StatisticsControl: Received shutdown");
                     break;
                 },
@@ -149,29 +157,34 @@ impl StatisticsControl {
                 }
 
                 _ = local_report_interval.next() => {
-                    self.stats.local_report(&mut task_client);
+                    self.stats.local_report(&mut self.task_client);
                 }
             }
         }
         log::debug!("StatisticsControl: Exiting");
     }
 
-    pub(crate) fn start_with_shutdown(mut self, task_client: nym_task::TaskClient) {
+    pub(crate) fn start(mut self) {
         spawn_future(async move {
-            self.run_with_shutdown(task_client).await;
+            self.run().await;
         })
     }
 
-    pub(crate) fn create_and_start_with_shutdown(
+    pub(crate) fn create_and_start(
         reporting_config: StatsReporting,
         client_type: String,
         client_stats_id: String,
         report_tx: InputMessageSender,
-        task_client: nym_task::TaskClient,
+        task_client: TaskClient,
     ) -> ClientStatsSender {
-        let (controller, sender) =
-            Self::create(reporting_config, client_type, client_stats_id, report_tx);
-        controller.start_with_shutdown(task_client);
+        let (controller, sender) = Self::create(
+            reporting_config,
+            client_type,
+            client_stats_id,
+            report_tx,
+            task_client,
+        );
+        controller.start();
         sender
     }
 }

common/client-core/src/client/topology_control/mod.rs

@@ -6,6 +6,7 @@ pub(crate) use accessor::{TopologyAccessor, TopologyReadPermit};
 use futures::StreamExt;
 use log::*;
 use nym_sphinx::addressing::nodes::NodeIdentity;
+use nym_task::TaskClient;
 use nym_topology::NymTopologyError;
 use std::time::Duration;
 
@@ -43,6 +44,8 @@ pub struct TopologyRefresher {
 
     refresh_rate: Duration,
     consecutive_failure_count: usize,
+
+    task_client: TaskClient,
 }
 
 impl TopologyRefresher {
@@ -50,12 +53,14 @@ impl TopologyRefresher {
         cfg: TopologyRefresherConfig,
         topology_accessor: TopologyAccessor,
         topology_provider: Box<dyn TopologyProvider + Send + Sync>,
+        task_client: TaskClient,
     ) -> Self {
         TopologyRefresher {
             topology_provider,
             topology_accessor,
             refresh_rate: cfg.refresh_rate,
             consecutive_failure_count: 0,
+            task_client,
         }
     }
 
@@ -142,7 +147,7 @@ impl TopologyRefresher {
         }
     }
 
-    pub fn start_with_shutdown(mut self, mut shutdown: nym_task::TaskClient) {
+    pub fn start(mut self) {
         spawn_future(async move {
             debug!("Started TopologyRefresher with graceful shutdown support");
 
@@ -155,17 +160,17 @@ impl TopologyRefresher {
             let mut interval =
                 gloo_timers::future::IntervalStream::new(self.refresh_rate.as_millis() as u32);
 
-            while !shutdown.is_shutdown() {
+            while !self.task_client.is_shutdown() {
                 tokio::select! {
                     _ = interval.next() => {
                         self.try_refresh().await;
                     },
-                    _ = shutdown.recv() => {
+                    _ = self.task_client.recv() => {
                         log::trace!("TopologyRefresher: Received shutdown");
                     },
                 }
             }
-            shutdown.recv_timeout().await;
+            self.task_client.recv_timeout().await;
             log::debug!("TopologyRefresher: Exiting");
         })
     }

common/client-core/src/error.rs

@@ -222,6 +222,9 @@ pub enum ClientCoreError {
         "fresh registration with gateway {gateway_id} somehow requires an additional key upgrade!"
     )]
     UnexpectedKeyUpgrade { gateway_id: String },
+
+    #[error("failed to derive keys from master key")]
+    HkdfDerivationError {},
 }
 
 /// Set of messages that the client can send to listeners via the task manager

common/client-libs/gateway-client/src/client/mod.rs

@@ -204,15 +204,15 @@ impl<C, St> GatewayClient<C, St> {
             "Attemting to establish connection to gateway at: {}",
             self.gateway_address
         );
-        let (ws_stream, _) = connect_async(&self.gateway_address).await?;
+        let (ws_stream, _) = connect_async(
+            &self.gateway_address,
+            #[cfg(unix)]
+            self.connection_fd_callback.clone(),
+        )
+        .await?;
 
         self.connection = SocketState::Available(Box::new(ws_stream));
 
-        #[cfg(unix)]
-        if let (Some(callback), Some(fd)) = (self.connection_fd_callback.as_ref(), self.ws_fd()) {
-            callback.as_ref()(fd);
-        }
-
         Ok(())
     }
 
@@ -1053,7 +1053,7 @@ impl GatewayClient<InitOnly, EphemeralCredentialStorage> {
             connection: SocketState::NotConnected,
             packet_router,
             bandwidth_controller: None,
-            stats_reporter: ClientStatsSender::new(None),
+            stats_reporter: ClientStatsSender::new(None, task_client.clone()),
             negotiated_protocol: None,
             #[cfg(unix)]
             connection_fd_callback: None,

common/client-libs/gateway-client/src/client/websockets.rs

@@ -1,6 +1,11 @@
 use crate::error::GatewayClientError;
 
 use nym_http_api_client::HickoryDnsResolver;
+#[cfg(unix)]
+use std::{
+    os::fd::{AsRawFd, RawFd},
+    sync::Arc,
+};
 use tokio::net::TcpStream;
 use tokio_tungstenite::{MaybeTlsStream, WebSocketStream};
 use tungstenite::handshake::client::Response;
@@ -11,7 +16,10 @@ use std::net::SocketAddr;
 #[cfg(not(target_arch = "wasm32"))]
 pub(crate) async fn connect_async(
     endpoint: &str,
+    #[cfg(unix)] connection_fd_callback: Option<Arc<dyn Fn(RawFd) + Send + Sync>>,
 ) -> Result<(WebSocketStream<MaybeTlsStream<TcpStream>>, Response), GatewayClientError> {
+    use tokio::net::TcpSocket;
+
     let resolver = HickoryDnsResolver::default();
     let uri =
         Url::parse(endpoint).map_err(|_| GatewayClientError::InvalidUrl(endpoint.to_owned()))?;
@@ -37,14 +45,41 @@ pub(crate) async fn connect_async(
         }
     };
 
-    let stream = TcpStream::connect(&sock_addrs[..]).await.map_err(|error| {
-        GatewayClientError::NetworkConnectionFailed {
-            address: endpoint.to_owned(),
-            source: error.into(),
+    let mut stream = Err(GatewayClientError::NoEndpointForConnection {
+        address: endpoint.to_owned(),
+    });
+    for sock_addr in sock_addrs {
+        let socket = if sock_addr.is_ipv4() {
+            TcpSocket::new_v4()
+        } else {
+            TcpSocket::new_v6()
         }
-    })?;
+        .map_err(|err| GatewayClientError::NetworkConnectionFailed {
+            address: endpoint.to_owned(),
+            source: err.into(),
+        })?;
 
-    tokio_tungstenite::client_async_tls(endpoint, stream)
+        #[cfg(unix)]
+        if let Some(callback) = connection_fd_callback.as_ref() {
+            callback.as_ref()(socket.as_raw_fd());
+        }
+
+        match socket.connect(sock_addr).await {
+            Ok(s) => {
+                stream = Ok(s);
+                break;
+            }
+            Err(err) => {
+                stream = Err(GatewayClientError::NetworkConnectionFailed {
+                    address: endpoint.to_owned(),
+                    source: err.into(),
+                });
+                continue;
+            }
+        }
+    }
+
+    tokio_tungstenite::client_async_tls(endpoint, stream?)
         .await
         .map_err(|error| GatewayClientError::NetworkConnectionFailed {
             address: endpoint.to_owned(),

common/client-libs/gateway-client/src/error.rs

@@ -43,6 +43,9 @@ pub enum GatewayClientError {
     #[error("connection failed: {address}: {source}")]
     NetworkConnectionFailed { address: String, source: WsError },
 
+    #[error("no socket address for endpoint: {address}")]
+    NoEndpointForConnection { address: String },
+
     #[error("Invalid URL: {0}")]
     InvalidUrl(String),
 

common/crypto/Cargo.toml

@@ -24,6 +24,7 @@ ed25519-dalek = { workspace = true, features = ["rand_core"], optional = true }
 rand = { workspace = true, optional = true }
 serde_bytes = { workspace = true, optional = true }
 serde = { workspace = true, features = ["derive"], optional = true }
+sha2 = { workspace = true, optional = true }
 subtle-encoding = { workspace = true, features = ["bech32-preview"] }
 thiserror = { workspace = true }
 zeroize = { workspace = true, optional = true, features = ["zeroize_derive"] }
@@ -36,11 +37,10 @@ nym-pemstore = { path = "../../common/pemstore", version = "0.3.0" }
 rand_chacha = { workspace = true }
 
 [features]
-default = ["sphinx"]
+default = []
 aead = ["dep:aead", "aead/std", "aes-gcm-siv", "generic-array"]
 serde = ["dep:serde", "serde_bytes", "ed25519-dalek/serde", "x25519-dalek/serde"]
 asymmetric = ["x25519-dalek", "ed25519-dalek", "zeroize"]
-hashing = ["blake3", "digest", "hkdf", "hmac", "generic-array"]
+hashing = ["blake3", "digest", "hkdf", "hmac", "generic-array", "sha2"]
 stream_cipher = ["aes", "ctr", "cipher", "generic-array"]
-sphinx = ["nym-sphinx-types/sphinx"]
-outfox = ["nym-sphinx-types/outfox"]
+sphinx = ["nym-sphinx-types/sphinx"]

common/crypto/src/asymmetric/encryption/mod.rs

@@ -202,6 +202,18 @@ impl PemStorableKey for PublicKey {
     }
 }
 
+impl From<x25519_dalek::PublicKey> for PublicKey {
+    fn from(public_key: x25519_dalek::PublicKey) -> Self {
+        PublicKey(public_key)
+    }
+}
+
+impl From<PublicKey> for x25519_dalek::PublicKey {
+    fn from(public_key: PublicKey) -> Self {
+        public_key.0
+    }
+}
+
 #[derive(Zeroize, ZeroizeOnDrop)]
 pub struct PrivateKey(x25519_dalek::StaticSecret);
 
@@ -308,109 +320,15 @@ impl PemStorableKey for PrivateKey {
     }
 }
 
-// compatibility with sphinx keys:
-#[cfg(feature = "sphinx")]
-impl From<PublicKey> for nym_sphinx_types::PublicKey {
-    fn from(key: PublicKey) -> Self {
-        nym_sphinx_types::PublicKey::from(key.to_bytes())
+impl From<x25519_dalek::StaticSecret> for PrivateKey {
+    fn from(secret: x25519_dalek::StaticSecret) -> Self {
+        PrivateKey(secret)
     }
 }
 
-#[cfg(feature = "sphinx")]
-impl<'a> From<&'a PublicKey> for nym_sphinx_types::PublicKey {
-    fn from(key: &'a PublicKey) -> Self {
-        nym_sphinx_types::PublicKey::from((*key).to_bytes())
-    }
-}
-
-#[cfg(feature = "sphinx")]
-impl From<nym_sphinx_types::PublicKey> for PublicKey {
-    fn from(pub_key: nym_sphinx_types::PublicKey) -> Self {
-        Self(x25519_dalek::PublicKey::from(*pub_key.as_bytes()))
-    }
-}
-
-#[cfg(feature = "sphinx")]
-impl From<PrivateKey> for nym_sphinx_types::PrivateKey {
-    fn from(key: PrivateKey) -> Self {
-        nym_sphinx_types::PrivateKey::from(key.to_bytes())
-    }
-}
-
-#[cfg(feature = "sphinx")]
-impl<'a> From<&'a PrivateKey> for nym_sphinx_types::PrivateKey {
-    fn from(key: &'a PrivateKey) -> Self {
-        nym_sphinx_types::PrivateKey::from(key.to_bytes())
-    }
-}
-
-#[cfg(feature = "sphinx")]
-impl From<nym_sphinx_types::PrivateKey> for PrivateKey {
-    fn from(private_key: nym_sphinx_types::PrivateKey) -> Self {
-        let private_key_bytes = private_key.to_bytes();
-        assert_eq!(private_key_bytes.len(), PRIVATE_KEY_SIZE);
-        Self::from_bytes(&private_key_bytes).unwrap()
-    }
-}
-
-#[cfg(test)]
-mod sphinx_key_conversion {
-    use super::*;
-    use rand_chacha::rand_core::SeedableRng;
-    use rand_chacha::ChaCha20Rng;
-
-    pub(super) fn test_rng() -> ChaCha20Rng {
-        let dummy_seed = [42u8; 32];
-        ChaCha20Rng::from_seed(dummy_seed)
-    }
-
-    const NUM_ITERATIONS: usize = 100;
-
-    #[test]
-    fn works_for_forward_conversion() {
-        let mut rng = test_rng();
-
-        for _ in 0..NUM_ITERATIONS {
-            let keys = KeyPair::new(&mut rng);
-            let private = &keys.private_key;
-            let public = &keys.public_key;
-
-            let dummy_remote = KeyPair::new(&mut rng);
-            let dh1 = private.diffie_hellman(&dummy_remote.public_key);
-
-            let public_bytes = public.to_bytes();
-
-            let sphinx_private: nym_sphinx_types::PrivateKey = private.into();
-            let recovered_private = PrivateKey::from(sphinx_private);
-
-            let dh2 = recovered_private.diffie_hellman(&dummy_remote.public_key);
-
-            let sphinx_public: nym_sphinx_types::PublicKey = public.into();
-            let recovered_public = PublicKey::from(sphinx_public);
-            assert_eq!(public_bytes, recovered_public.to_bytes());
-
-            // even though the byte representation of the private key changed, the resultant DH is the same
-            // which is what matters
-            assert_eq!(dh1, dh2);
-        }
-    }
-
-    #[test]
-    fn works_for_backward_conversion() {
-        for _ in 0..NUM_ITERATIONS {
-            let (sphinx_private, sphinx_public) = nym_sphinx_types::crypto::keygen();
-
-            let private_bytes = sphinx_private.to_bytes();
-            let public_bytes = sphinx_public.as_bytes();
-
-            let private: PrivateKey = sphinx_private.into();
-            let recovered_sphinx_private: nym_sphinx_types::PrivateKey = private.into();
-
-            let public: PublicKey = sphinx_public.into();
-            let recovered_sphinx_public: nym_sphinx_types::PublicKey = public.into();
-            assert_eq!(private_bytes, recovered_sphinx_private.to_bytes());
-            assert_eq!(public_bytes, recovered_sphinx_public.as_bytes());
-        }
+impl AsRef<x25519_dalek::StaticSecret> for PrivateKey {
+    fn as_ref(&self) -> &x25519_dalek::StaticSecret {
+        &self.0
     }
 }
 

common/crypto/src/asymmetric/identity/mod.rs

@@ -2,7 +2,7 @@
 // SPDX-License-Identifier: Apache-2.0
 
 pub use ed25519_dalek::SignatureError;
-use ed25519_dalek::{Signer, SigningKey};
+use ed25519_dalek::{SecretKey, Signer, SigningKey};
 pub use ed25519_dalek::{Verifier, PUBLIC_KEY_LENGTH, SECRET_KEY_LENGTH, SIGNATURE_LENGTH};
 use nym_pemstore::traits::{PemStorableKey, PemStorableKeyPair};
 use std::fmt::{self, Debug, Display, Formatter};
@@ -18,7 +18,7 @@ pub mod serde_helpers;
 use nym_sphinx_types::{DestinationAddressBytes, DESTINATION_ADDRESS_LENGTH};
 
 #[cfg(feature = "rand")]
-use rand::{CryptoRng, RngCore};
+use rand::{CryptoRng, Rng, RngCore};
 #[cfg(feature = "serde")]
 use serde::de::Error as SerdeError;
 #[cfg(feature = "serde")]
@@ -62,16 +62,33 @@ pub struct KeyPair {
     // nothing secret about public key
     #[zeroize(skip)]
     public_key: PublicKey,
+
+    #[zeroize(skip)]
+    index: u32,
 }
 
+/// All keys will always have an index field populated this is to prevent anyone from figuring out if
+/// the keys are derived or random, and alter their behaviour based on that.
 impl KeyPair {
     #[cfg(feature = "rand")]
     pub fn new<R: RngCore + CryptoRng>(rng: &mut R) -> Self {
+        let index = rng.gen();
         let ed25519_signing_key = ed25519_dalek::SigningKey::generate(rng);
 
         KeyPair {
             private_key: PrivateKey(ed25519_signing_key.to_bytes()),
             public_key: PublicKey(ed25519_signing_key.verifying_key()),
+            index,
+        }
+    }
+
+    pub fn from_secret(secret: SecretKey, index: u32) -> Self {
+        let ed25519_signing_key = SigningKey::from(secret);
+
+        KeyPair {
+            private_key: PrivateKey(ed25519_signing_key.to_bytes()),
+            public_key: PublicKey(ed25519_signing_key.verifying_key()),
+            index,
         }
     }
 
@@ -87,15 +104,31 @@ impl KeyPair {
         Ok(KeyPair {
             private_key: PrivateKey::from_bytes(priv_bytes)?,
             public_key: PublicKey::from_bytes(pub_bytes)?,
+            index: fake_index(pub_bytes),
         })
     }
 }
 
+/// Reduces a byte slice into a u32 value by XOR-ing all its bytes into a 4-byte accumulator.
+/// The process iterates over every byte in the input slice, XOR-ing each one into a slot based on its index modulo 4.
+/// If the input slice contains fewer than 4 bytes, the remaining positions in the accumulator remain zero.
+/// Finally, the accumulator is interpreted in big-endian order to produce the resulting u32.
+/// Index is used to verify deterministic identity key, master key and salt are also requried for verification.
+fn fake_index(input: &[u8]) -> u32 {
+    let mut accumulator = [0u8; 4];
+    for (i, &byte) in input.iter().enumerate() {
+        accumulator[i % 4] ^= byte;
+    }
+    u32::from_be_bytes(accumulator)
+}
+
 impl From<PrivateKey> for KeyPair {
     fn from(private_key: PrivateKey) -> Self {
+        let public_key = (&private_key).into();
         KeyPair {
-            public_key: (&private_key).into(),
+            public_key,
             private_key,
+            index: fake_index(public_key.to_bytes().as_ref()),
         }
     }
 }
@@ -115,6 +148,7 @@ impl PemStorableKeyPair for KeyPair {
         KeyPair {
             private_key,
             public_key,
+            index: fake_index(public_key.to_bytes().as_ref()),
         }
     }
 }

common/crypto/src/hkdf.rs

@@ -8,6 +8,10 @@ use hkdf::{
     },
     Hkdf,
 };
+use sha2::{Sha256, Sha512};
+
+pub use hkdf::InvalidLength;
+use zeroize::ZeroizeOnDrop;
 
 /// Perform HKDF `extract` then `expand` as a single step.
 pub fn extract_then_expand<D>(
@@ -28,3 +32,80 @@ where
 
     Ok(okm)
 }
+
+/// `DerivationMaterial` encapsulates parameters for deterministic key derivation using
+/// HKDF (SHA-512).
+///
+/// It consists of:
+///   - A master key (`master_key`): the base secret.
+///   - An index (`index`): ensures unique derivations.
+///   - A salt (`salt`): adds additional uniqueness, should be application specific.
+///
+/// Use the `derive_secret()` method to generate a 32-byte secret. To prepare for a new derivation,
+/// call the `next()` method, which increments the index. **It is the caller's responsibility to
+/// track and persist the derivation index if keys need to be rederived.**
+///
+/// # Example
+///
+/// ```rust
+/// use nym_crypto::hkdf::DerivationMaterial;
+///
+/// let master_key = [0u8; 32]; // your secret master key
+/// let salt = b"unique-salt-value";
+/// let material = DerivationMaterial::new(master_key, 0, salt);
+///
+/// // Derive a secret
+/// let secret = material.derive_secret().expect("Failed to derive secret");
+///
+/// // Prepare for the next derivation
+/// let next_material = material.next();
+/// ```
+#[derive(ZeroizeOnDrop)]
+pub struct DerivationMaterial {
+    master_key: [u8; 32],
+    index: u32,
+    salt: Vec<u8>,
+}
+
+impl DerivationMaterial {
+    pub fn index(&self) -> u32 {
+        self.index
+    }
+
+    pub fn salt(&self) -> &[u8] {
+        &self.salt
+    }
+
+    /// Derives a 32-byte seed from a master seed and an index using HKDF (with SHA-512).
+    ///
+    /// The `salt` and the use of the index (as info) bind this derivation to an application/client.
+    pub fn derive_secret(&self) -> Result<[u8; 32], hkdf::InvalidLength> {
+        let salt = &self.salt;
+        let info = self.index.to_be_bytes(); // Use the index as info
+        let hk = Hkdf::<Sha512>::new(Some(salt), &self.master_key);
+        let mut okm = [0u8; 32];
+        hk.expand(&info, &mut okm)?;
+        Ok(okm)
+    }
+
+    pub fn new<T: AsRef<[u8]>>(master_key: T, index: u32, salt: &[u8]) -> Self {
+        // Coerce master_key to [u8; 32]
+        let mut hasher = Sha256::new();
+        hasher.update(master_key.as_ref());
+        let master_key = hasher.finalize().into();
+
+        Self {
+            master_key,
+            index,
+            salt: salt.to_vec(),
+        }
+    }
+
+    pub fn next(&self) -> Self {
+        Self {
+            master_key: self.master_key,
+            index: self.index + 1,
+            salt: self.salt.clone(),
+        }
+    }
+}

common/http-api-client/Cargo.toml

@@ -12,7 +12,7 @@ license.workspace = true
 
 [dependencies]
 async-trait = { workspace = true }
-reqwest = { workspace = true, features = ["json"] }
+reqwest = { workspace = true, features = ["json", "gzip"] }
 http.workspace = true
 url = { workspace = true }
 once_cell = { workspace = true }

common/http-api-client/src/user_agent.rs

@@ -7,11 +7,16 @@ use http::HeaderValue;
 use nym_bin_common::build_information::{BinaryBuildInformation, BinaryBuildInformationOwned};
 use serde::{Deserialize, Serialize};
 
+/// Characteristic elements sent to the API providing basic context information of the requesting client.
 #[derive(Clone, Debug, Serialize, Deserialize, PartialEq, Eq)]
 pub struct UserAgent {
+    /// The internal crate / application / subsystem making use of API client
     pub application: String,
+    /// version of the calling crate / application / subsystem
     pub version: String,
+    /// client platform
     pub platform: String,
+    /// source commit version for the calling calling crate / subsystem
     pub git_commit: String,
 }
 

common/http-api-common/Cargo.toml

@@ -20,6 +20,7 @@ mime = { workspace = true }
 serde = { workspace = true, features = ["derive"] }
 serde_json.workspace = true
 serde_yaml = { workspace = true }
+subtle.workspace = true
 tower = { workspace = true }
 tracing.workspace = true
 utoipa = { workspace = true, optional = true }

common/http-api-common/src/middleware/bearer_auth.rs

@@ -7,6 +7,7 @@ use axum::{extract::Request, response::Response};
 use futures::future::BoxFuture;
 use std::sync::Arc;
 use std::task::{Context, Poll};
+use subtle::ConstantTimeEq;
 use tower::{Layer, Service};
 use tracing::{debug, instrument, trace};
 use zeroize::Zeroizing;
@@ -76,7 +77,7 @@ impl<S> RequireAuth<S> {
             return Err("`Authorization` header must contain non-empty `Bearer` token");
         }
 
-        if self.bearer_token.as_str() != bearer_token {
+        if bool::from(self.bearer_token.as_bytes().ct_ne(bearer_token.as_bytes())) {
             return Err("`Authorization` header does not contain the correct `Bearer` token");
         }
 

common/network-defaults/Cargo.toml

@@ -26,4 +26,4 @@ utoipa = [ "dep:utoipa" ]
 
 [build-dependencies]
 regex = { workspace = true }
-cargo_metadata = { version = "0.18" }
+cargo_metadata = { workspace = true }

common/nym_offline_compact_ecash/Cargo.toml

@@ -31,7 +31,7 @@ nym-pemstore = { path = "../pemstore" }
 nym-network-defaults = { path = "../network-defaults", default-features = false }
 
 [dev-dependencies]
-criterion = { version = "0.5.1", features = ["html_reports"] }
+criterion = { workspace = true, features = ["html_reports"] }
 
 
 [[bench]]

common/nymsphinx/Cargo.toml

@@ -48,12 +48,10 @@ features = ["sync"]
 [features]
 default = ["sphinx"]
 sphinx = [
-    "nym-crypto/sphinx",
     "nym-sphinx-params/sphinx",
     "nym-sphinx-types/sphinx",
 ]
 outfox = [
-    "nym-crypto/outfox",
     "nym-sphinx-params/outfox",
     "nym-sphinx-types/outfox",
 ]

common/nymsphinx/addressing/Cargo.toml

@@ -8,7 +8,7 @@ license = { workspace = true }
 repository = { workspace = true }
 
 [dependencies]
-nym-crypto = { path = "../../crypto", features = ["asymmetric"] } # all addresses are expressed in terms on their crypto keys
+nym-crypto = { path = "../../crypto", features = ["asymmetric", "sphinx"] } # all addresses are expressed in terms on their crypto keys
 nym-sphinx-types = { path = "../types", features = ["sphinx"] } # we need to be able to refer to some types defined inside sphinx crate
 serde = { workspace = true } # implementing serialization/deserialization for some types, like `Recipient`
 thiserror = { workspace = true }

common/nymsphinx/anonymous-replies/src/requests.rs

@@ -559,7 +559,7 @@ mod tests {
             let mut address_bytes = [0; NODE_ADDRESS_LENGTH];
             rng.fill_bytes(&mut address_bytes);
 
-            let dummy_private = PrivateKey::new_with_rng(rng);
+            let dummy_private = PrivateKey::random_from_rng(rng);
             let pub_key = (&dummy_private).into();
             Node {
                 address: NodeAddressBytes::from_bytes(address_bytes),

common/nymsphinx/framing/src/codec.rs

@@ -130,28 +130,33 @@ impl Decoder for NymCodec {
 mod packet_encoding {
     use super::*;
     use nym_sphinx_types::{
-        crypto, Delay as SphinxDelay, Destination, DestinationAddressBytes, Node, NodeAddressBytes,
-        DESTINATION_ADDRESS_LENGTH, IDENTIFIER_LENGTH, NODE_ADDRESS_LENGTH,
+        Delay as SphinxDelay, Destination, DestinationAddressBytes, Node, NodeAddressBytes,
+        PrivateKey, DESTINATION_ADDRESS_LENGTH, IDENTIFIER_LENGTH, NODE_ADDRESS_LENGTH,
     };
 
+    fn random_pubkey() -> nym_sphinx_types::PublicKey {
+        let private_key = PrivateKey::random();
+        (&private_key).into()
+    }
+
     fn make_valid_outfox_packet(size: PacketSize) -> NymPacket {
-        let (_, node1_pk) = crypto::keygen();
+        let node1_pk = random_pubkey();
         let node1 = Node::new(
             NodeAddressBytes::from_bytes([5u8; NODE_ADDRESS_LENGTH]),
             node1_pk,
         );
-        let (_, node2_pk) = crypto::keygen();
+        let node2_pk = random_pubkey();
         let node2 = Node::new(
             NodeAddressBytes::from_bytes([4u8; NODE_ADDRESS_LENGTH]),
             node2_pk,
         );
-        let (_, node3_pk) = crypto::keygen();
+        let node3_pk = random_pubkey();
         let node3 = Node::new(
             NodeAddressBytes::from_bytes([2u8; NODE_ADDRESS_LENGTH]),
             node3_pk,
         );
 
-        let (_, node4_pk) = crypto::keygen();
+        let node4_pk = random_pubkey();
         let node4 = Node::new(
             NodeAddressBytes::from_bytes([2u8; NODE_ADDRESS_LENGTH]),
             node4_pk,
@@ -170,17 +175,17 @@ mod packet_encoding {
     }
 
     fn make_valid_sphinx_packet(size: PacketSize) -> NymPacket {
-        let (_, node1_pk) = crypto::keygen();
+        let node1_pk = random_pubkey();
         let node1 = Node::new(
             NodeAddressBytes::from_bytes([5u8; NODE_ADDRESS_LENGTH]),
             node1_pk,
         );
-        let (_, node2_pk) = crypto::keygen();
+        let node2_pk = random_pubkey();
         let node2 = Node::new(
             NodeAddressBytes::from_bytes([4u8; NODE_ADDRESS_LENGTH]),
             node2_pk,
         );
-        let (_, node3_pk) = crypto::keygen();
+        let node3_pk = random_pubkey();
         let node3 = Node::new(
             NodeAddressBytes::from_bytes([2u8; NODE_ADDRESS_LENGTH]),
             node3_pk,

common/nymsphinx/framing/src/processing.rs

@@ -4,8 +4,10 @@ use nym_sphinx_addressing::nodes::{NymNodeRoutingAddress, NymNodeRoutingAddressE
 use nym_sphinx_params::{PacketSize, PacketType};
 use nym_sphinx_types::{
     Delay as SphinxDelay, DestinationAddressBytes, NodeAddressBytes, NymPacket, NymPacketError,
-    NymProcessedPacket, OutfoxError, PrivateKey, ProcessedPacket, SphinxError,
+    NymProcessedPacket, OutfoxError, PrivateKey, ProcessedPacketData, SphinxError,
+    Version as SphinxPacketVersion,
 };
+use std::fmt::Display;
 use thiserror::Error;
 
 use crate::packet::FramedNymPacket;
@@ -13,12 +15,38 @@ use nym_metrics::nanos;
 use nym_sphinx_forwarding::packet::MixPacket;
 
 #[derive(Debug)]
-pub enum MixProcessingResult {
+pub enum MixProcessingResultData {
     /// Contains unwrapped data that should first get delayed before being sent to next hop.
-    ForwardHop(MixPacket, Option<SphinxDelay>),
+    ForwardHop {
+        packet: MixPacket,
+        delay: Option<SphinxDelay>,
+    },
 
     /// Contains all data extracted out of the final hop packet that could be forwarded to the destination.
-    FinalHop(ProcessedFinalHop),
+    FinalHop { final_hop_data: ProcessedFinalHop },
+}
+
+#[derive(Debug, Copy, Clone)]
+pub enum MixPacketVersion {
+    Outfox,
+    Sphinx(SphinxPacketVersion),
+}
+
+impl Display for MixPacketVersion {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> Result<(), std::fmt::Error> {
+        match self {
+            MixPacketVersion::Outfox => "outfox".fmt(f),
+            MixPacketVersion::Sphinx(sphinx_version) => {
+                write!(f, "sphinx-{}", sphinx_version.value())
+            }
+        }
+    }
+}
+
+#[derive(Debug)]
+pub struct MixProcessingResult {
+    pub packet_version: MixPacketVersion,
+    pub processing_data: MixProcessingResultData,
 }
 
 type ForwardAck = MixPacket;
@@ -107,37 +135,63 @@ fn perform_final_processing(
 ) -> Result<MixProcessingResult, PacketProcessingError> {
     match packet {
         NymProcessedPacket::Sphinx(packet) => {
-            match packet {
-                ProcessedPacket::ForwardHop(packet, address, delay) => {
-                    process_forward_hop(NymPacket::Sphinx(*packet), address, delay, packet_type)
-                }
+            let processing_data = match packet.data {
+                ProcessedPacketData::ForwardHop {
+                    next_hop_packet,
+                    next_hop_address,
+                    delay,
+                } => process_forward_hop(
+                    NymPacket::Sphinx(next_hop_packet),
+                    next_hop_address,
+                    delay,
+                    packet_type,
+                ),
                 // right now there's no use for the surb_id included in the header - probably it should get removed from the
                 // sphinx all together?
-                ProcessedPacket::FinalHop(destination, _, payload) => process_final_hop(
+                ProcessedPacketData::FinalHop {
+                    destination,
+                    identifier: _,
+                    payload,
+                } => process_final_hop(
                     destination,
                     payload.recover_plaintext()?,
                     packet_size,
                     packet_type,
                 ),
-            }
+            }?;
+
+            Ok(MixProcessingResult {
+                packet_version: MixPacketVersion::Sphinx(packet.version),
+                processing_data,
+            })
         }
         NymProcessedPacket::Outfox(packet) => {
             let next_address = *packet.next_address();
             let packet = packet.into_packet();
             if packet.is_final_hop() {
-                process_final_hop(
+                let processing_data = process_final_hop(
                     DestinationAddressBytes::from_bytes(next_address),
                     packet.recover_plaintext()?.to_vec(),
                     packet_size,
                     packet_type,
-                )
+                )?;
+                Ok(MixProcessingResult {
+                    packet_version: MixPacketVersion::Outfox,
+                    processing_data,
+                })
             } else {
-                let mix_packet = MixPacket::new(
+                let packet = MixPacket::new(
                     NymNodeRoutingAddress::try_from_bytes(&next_address)?,
                     NymPacket::Outfox(packet),
                     PacketType::Outfox,
                 );
-                Ok(MixProcessingResult::ForwardHop(mix_packet, None))
+                Ok(MixProcessingResult {
+                    packet_version: MixPacketVersion::Outfox,
+                    processing_data: MixProcessingResultData::ForwardHop {
+                        packet,
+                        delay: None,
+                    },
+                })
             }
         }
     }
@@ -148,14 +202,16 @@ fn process_final_hop(
     payload: Vec<u8>,
     packet_size: PacketSize,
     packet_type: PacketType,
-) -> Result<MixProcessingResult, PacketProcessingError> {
+) -> Result<MixProcessingResultData, PacketProcessingError> {
     let (forward_ack, message) = split_into_ack_and_message(payload, packet_size, packet_type)?;
 
-    Ok(MixProcessingResult::FinalHop(ProcessedFinalHop {
-        destination,
-        forward_ack,
-        message,
-    }))
+    Ok(MixProcessingResultData::FinalHop {
+        final_hop_data: ProcessedFinalHop {
+            destination,
+            forward_ack,
+            message,
+        },
+    })
 }
 
 fn split_into_ack_and_message(
@@ -211,11 +267,14 @@ fn process_forward_hop(
     forward_address: NodeAddressBytes,
     delay: SphinxDelay,
     packet_type: PacketType,
-) -> Result<MixProcessingResult, PacketProcessingError> {
+) -> Result<MixProcessingResultData, PacketProcessingError> {
     let next_hop_address = NymNodeRoutingAddress::try_from(forward_address)?;
 
-    let mix_packet = MixPacket::new(next_hop_address, packet, packet_type);
-    Ok(MixProcessingResult::ForwardHop(mix_packet, Some(delay)))
+    let packet = MixPacket::new(next_hop_address, packet, packet_type);
+    Ok(MixProcessingResultData::ForwardHop {
+        packet,
+        delay: Some(delay),
+    })
 }
 
 // TODO: what more could we realistically test here?

common/nymsphinx/params/Cargo.toml

@@ -16,5 +16,5 @@ nym-sphinx-types = { path = "../types" }
 
 [features]
 default = ["sphinx"]
-sphinx = ["nym-crypto/sphinx", "nym-sphinx-types/outfox"]
-outfox = ["nym-crypto/outfox", "nym-sphinx-types/outfox"]
+sphinx = ["nym-sphinx-types/outfox"]
+outfox = ["nym-sphinx-types/outfox"]

common/nymsphinx/types/src/lib.rs

@@ -1,14 +1,22 @@
 // Copyright 2021 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0
 
+use std::{array::TryFromSliceError, fmt};
+use thiserror::Error;
+
+#[cfg(feature = "outfox")]
+use nym_outfox::packet::{OutfoxPacket, OutfoxProcessedPacket};
+
+#[cfg(feature = "sphinx")]
+use sphinx_packet::{SphinxPacket, SphinxPacketBuilder};
+
 #[cfg(feature = "outfox")]
 pub use nym_outfox::{
     constants::MIN_PACKET_SIZE, constants::MIX_PARAMS_LEN, constants::OUTFOX_PACKET_OVERHEAD,
     error::OutfoxError,
 };
 // re-exporting types and constants available in sphinx
-#[cfg(feature = "outfox")]
-use nym_outfox::packet::{OutfoxPacket, OutfoxProcessedPacket};
+
 #[cfg(feature = "sphinx")]
 pub use sphinx_packet::{
     constants::{
@@ -21,12 +29,9 @@ pub use sphinx_packet::{
     payload::{Payload, PAYLOAD_OVERHEAD_SIZE},
     route::{Destination, DestinationAddressBytes, Node, NodeAddressBytes, SURBIdentifier},
     surb::{SURBMaterial, SURB},
-    Error as SphinxError, ProcessedPacket,
+    version::Version,
+    Error as SphinxError, ProcessedPacket, ProcessedPacketData,
 };
-#[cfg(feature = "sphinx")]
-use sphinx_packet::{SphinxPacket, SphinxPacketBuilder};
-use std::{array::TryFromSliceError, fmt};
-use thiserror::Error;
 
 #[derive(Error, Debug)]
 pub enum NymPacketError {

common/statistics/src/clients/mod.rs

@@ -25,19 +25,28 @@ pub type ClientStatsReceiver = tokio::sync::mpsc::UnboundedReceiver<ClientStatsE
 #[derive(Clone)]
 pub struct ClientStatsSender {
     stats_tx: Option<UnboundedSender<ClientStatsEvents>>,
+    task_client: TaskClient,
 }
 
 impl ClientStatsSender {
     /// Create a new statistics Sender
-    pub fn new(stats_tx: Option<UnboundedSender<ClientStatsEvents>>) -> Self {
-        ClientStatsSender { stats_tx }
+    pub fn new(
+        stats_tx: Option<UnboundedSender<ClientStatsEvents>>,
+        task_client: TaskClient,
+    ) -> Self {
+        ClientStatsSender {
+            stats_tx,
+            task_client,
+        }
     }
 
     /// Report a statistics event using the sender.
     pub fn report(&self, event: ClientStatsEvents) {
         if let Some(tx) = &self.stats_tx {
             if let Err(err) = tx.send(event) {
-                log::error!("Failed to send stats event: {:?}", err);
+                if !self.task_client.is_shutdown_poll() {
+                    log::error!("Failed to send stats event: {err}");
+                }
             }
         }
     }

common/task/src/manager.rs

@@ -299,6 +299,8 @@ impl Clone for TaskClient {
             None
         };
 
+        log::debug!("Cloned task client: {name:?}");
+
         TaskClient {
             name,
             shutdown: AtomicBool::new(self.shutdown.load(Ordering::Relaxed)),
@@ -344,6 +346,7 @@ impl TaskClient {
             format!("unknown-{suffix}")
         };
 
+        log::debug!("Forked task client: {child_name}");
         child.name = Some(child_name);
         child
     }
@@ -377,6 +380,7 @@ impl TaskClient {
         } else {
             format!("unknown-{suffix}")
         };
+        log::debug!("Renamed task client: {name}");
         self.named(name)
     }
 

common/topology/Cargo.toml

@@ -27,7 +27,7 @@ wasm-bindgen = { workspace = true, optional = true }
 
 ## internal
 nym-config = { path = "../config" }
-nym-crypto = { path = "../crypto", features = ["sphinx", "outfox"] }
+nym-crypto = { path = "../crypto" }
 nym-mixnet-contract-common = { path = "../cosmwasm-smart-contracts/mixnet-contract" }
 nym-sphinx-addressing = { path = "../nymsphinx/addressing" }
 nym-sphinx-types = { path = "../nymsphinx/types", features = [

common/topology/src/node.rs

@@ -105,7 +105,7 @@ impl<'a> From<&'a RoutingNode> for SphinxNode {
             .try_into()
             .unwrap();
 
-        SphinxNode::new(node_address_bytes, (&node.sphinx_key).into())
+        SphinxNode::new(node_address_bytes, node.sphinx_key.into())
     }
 }
 

common/wireguard/src/peer_handle.rs

@@ -43,7 +43,7 @@ impl PeerHandle {
         let timeout_check_interval = tokio_stream::wrappers::IntervalStream::new(
             tokio::time::interval(DEFAULT_PEER_TIMEOUT_CHECK),
         );
-        let mut task_client = task_client.fork(format!("peer-{public_key}"));
+        let mut task_client = task_client.fork(format!("peer_{public_key}"));
         task_client.disarm();
         PeerHandle {
             public_key,

contracts/mixnet/src/support/tests/mod.rs

@@ -198,8 +198,8 @@ pub mod test_helpers {
 
             let choices = [true, false];
 
-            // every epoch there's a 2% chance of somebody bonding a node
-            let bonding_weights = [2, 98];
+            // every epoch there's a 3% chance of somebody bonding a node
+            let bonding_weights = [3, 97];
 
             // and 15% of making a delegation
             let delegation_weights = [15, 85];
@@ -246,28 +246,28 @@ pub mod test_helpers {
 
                 // make sure we cover our edge case of somebody having both liquid and vested delegation towards the same node
                 if epoch_id == 123 {
-                    test.add_immediate_delegation(problematic_delegator, stake, 4);
-                    test.add_immediate_delegation(problematic_delegator_twin, stake, 4);
+                    test.add_immediate_delegation(problematic_delegator, stake, 3);
+                    test.add_immediate_delegation(problematic_delegator_twin, stake, 3);
                 }
 
                 if epoch_id == 666 {
-                    test.add_immediate_delegation_with_legal_proxy(problematic_delegator, stake, 4);
+                    test.add_immediate_delegation_with_legal_proxy(problematic_delegator, stake, 3);
                     test.add_immediate_delegation_with_legal_proxy(
                         problematic_delegator_twin,
                         stake,
-                        4,
+                        3,
                     );
                 }
 
                 if epoch_id == 234 {
-                    test.add_immediate_delegation(problematic_delegator_alt_twin, stake, 4);
+                    test.add_immediate_delegation(problematic_delegator_alt_twin, stake, 3);
                 }
 
                 if epoch_id == 420 {
                     test.add_immediate_delegation_with_legal_proxy(
                         problematic_delegator_alt_twin,
                         stake,
-                        4,
+                        3,
                     );
                 }
 

contracts/mixnet/src/vesting_migration.rs

@@ -400,7 +400,7 @@ mod tests {
 
             let problematic_delegator = "n1foomp";
             let problematic_delegator_twin = "n1bar";
-            let mix_id = 4;
+            let mix_id = 3;
 
             let liquid_storage_key = Delegation::generate_storage_key(
                 mix_id,

docker/typescript_client/upload_contract/package-lock.json

@@ -535,9 +535,10 @@
       }
     },
     "node_modules/elliptic": {
-      "version": "6.5.4",
-      "resolved": "https://registry.npmjs.org/elliptic/-/elliptic-6.5.4.tgz",
-      "integrity": "sha512-iLhC6ULemrljPZb+QutR5TQGB+pdW6KGD5RSegS+8sorOZT+rdQFbsQFJgvN3eRqNALqJer4oQ16YvJHlU8hzQ==",
+      "version": "6.6.1",
+      "resolved": "https://registry.npmjs.org/elliptic/-/elliptic-6.6.1.tgz",
+      "integrity": "sha512-RaddvvMatK2LJHqFJ+YA4WysVN5Ita9E35botqIYspQ4TkRAlCicdzKOjlyv/1Za5RyTNn7di//eEV0uTAfe3g==",
+      "license": "MIT",
       "dependencies": {
         "bn.js": "^4.11.9",
         "brorand": "^1.1.0",
@@ -1635,9 +1636,9 @@
       "integrity": "sha512-58lmxKSA4BNyLz+HHMUzlOEpg09FV+ev6ZMe3vJihgdxzgcwZ8VoEEPmALCZG9LmqfVoNMMKpttIYTVG6uDY7A=="
     },
     "elliptic": {
-      "version": "6.5.4",
-      "resolved": "https://registry.npmjs.org/elliptic/-/elliptic-6.5.4.tgz",
-      "integrity": "sha512-iLhC6ULemrljPZb+QutR5TQGB+pdW6KGD5RSegS+8sorOZT+rdQFbsQFJgvN3eRqNALqJer4oQ16YvJHlU8hzQ==",
+      "version": "6.6.1",
+      "resolved": "https://registry.npmjs.org/elliptic/-/elliptic-6.6.1.tgz",
+      "integrity": "sha512-RaddvvMatK2LJHqFJ+YA4WysVN5Ita9E35botqIYspQ4TkRAlCicdzKOjlyv/1Za5RyTNn7di//eEV0uTAfe3g==",
       "requires": {
         "bn.js": "^4.11.9",
         "brorand": "^1.1.0",

documentation/autodoc/Cargo.toml

@@ -9,5 +9,5 @@ edition.workspace = true
 license.workspace = true
 
 [dependencies]
-env_logger = "0.11.6"
+env_logger = { workspace = true }
 log.workspace = true

documentation/docs/pages/operators/changelog.mdx

@@ -47,6 +47,128 @@ This page displays a full list of all the changes during our release cycle from
 
 <VarInfo />
 
+## `v2025.3-ruta`
+
+- [Release Binaries](https://github.com/nymtech/nym/releases/tag/nym-binaries-v2025.3-ruta)
+- [`nym-node`](nodes/nym-node.mdx) version `1.5.0`
+
+```
+nym-node
+Binary Name:        nym-node
+Build Timestamp:    2025-02-13T11:49:34.670488195Z
+Build Version:      1.5.0
+Commit SHA:         a3e19b4563843055b305ea9a397eb1ad84b5c378
+Commit Date:        2025-02-10T18:14:47.000000000+01:00
+Commit Branch:      HEAD
+rustc Version:      1.84.1
+rustc Channel:      stable
+cargo Profile:      release
+```
+
+### Operators Updates & Tools
+
+- **Operators who use Debian based distributions must run their `nym-node` on Debian bookworm (Debian 12)/ Ubuntu 22.04 (and newer).** In case of running older operation system make sure to upgrade your server.
+
+#### Service Grant Program v2 (SGPv2)
+
+As we announced in [`hu` release notes](#service-grant-program-v2), we are opened a second iteration Service Grant Program to bootstrap node operations in key target geographies for Nym and ensures the network can provide a good quality of service.
+
+##### Conditions to join of SGPv2
+
+<Callout type="warning">
+**If you are interested to become a part of SGPv2, read the point below. Do *not* buy new machines and do *not* migrate nodes just yet!**
+</Callout>
+
+- [Read specs & rules first](#service-grant-program-v2)
+- The program will start from March 1st.
+- Accepted participants are expected to run their nodes in assigned location and with [new specs](#service-grant-program-v2) by February 28th the latest.
+- Squads orchestrating multiple nodes will be prioritized in locations with more slots.
+- There is no final budget, neither a size per node as we expect that the next round of Service Grants program will be individual grants of varying sizes, depending on how many nodes, location, specs etc.
+- Every participant of SGPv1 can submit for SGPv2 as many nodes as they currently have grant for, more slots may be offered later on.
+- New submissions can only do one node per operator unless people come in squads (or DAOs) and can orchestrate multiple nodes on larger dedicated servers.
+- Actual locations and approximate slots are listed below. If you want to have a node in a location which is not listed but it's near by some of the listed ones, it's not a problem, be honest in the form so we know where you planning to run nodes.
+- February is the last month we proceed with grants under SGPv1.
+
+##### How to Join
+
+1. Have a look at the remaining [locations](#locations), specs and providers. You can contact them directly and make a calculation how much running a node on their service would cost and what size of a grant you expect to receive.
+2. To apply for a service grant, the first step is to fill in [this form](https://nymtech2.typeform.com/to/LyPJer49) per each node.
+3. Be responsive on Element for follow up communication.
+
+##### Locations
+
+These locations and slots are approximate and constantly change based on new operators submissions. Please keep in mind that we are going to chose people with respect to empty slots in the given location at the time of their submission. In case of competing submissions in the same location we will take the one with better specs vs price ratio. 
+
+| LOCATION       | SLOTS |
+| :--            | --:   |
+| India          | 3     |
+| Austria        | 1     |
+| Poland         | 1     |
+| Russia         | 2     |
+| Canada         | 1     |
+| South Africa   | 2     |
+| Sweden         | 2     |
+| Latvia         | 2     |
+| Lithuania      | 1     |
+| Bahrain        | 1     |
+| Czech Republic | 1     |
+| Denmark        | 1     |
+| Norway         | 1     |
+| South Korea    | 1     |
+| Ukraine        | 1     |
+| Vietnam        | 1     |
+| Argentina      | 1     |
+| Belarus        | 1     |
+| Croatia        | 1     |
+| Cyprus         | 1     |
+| Ecuador        | 1     |
+| Hungary        | 1     |
+| Malta          | 1     |
+| New Zealand    | 1     |
+
+##### ISPs
+
+- Have a look into our [ISP list](community-counsel/isp-list) page
+- Further you can check out Tor community [Good Bad ISPs](https://community.torproject.org/relay/community-resources/good-bad-isps/) page
+- With any findings or feedback, please add it to this [csv](https://github.com/nymtech/nym/blob/develop/documentation/docs/data/csv/isp-sheet.csv), issue a [Pull Request](community-counsel/add-content) and ping me for review.
+- We will add much more providers in the coming days
+
+### Features
+
+- [DNS resolver configuration for internal HTTP client lookups](https://github.com/nymtech/nym/pull/5355): The resolver itself is the set combination of the google, cloudflare, and quad9 endpoints supporting DoH, DoT, and for google DoH3 as well. This resolver implements a fallback mechanism where, should the DNS-over-X resolution fail, a followup resolution will be done using the hosts configured default (e.g. `/etc/resolve.conf` on linux).
+
+- [Bump tokio from `1.40.0` to `1.43.0`](https://github.com/nymtech/nym/pull/5370)
+
+- [Uncouple storage reference for bandwidth client](https://github.com/nymtech/nym/pull/5372): Because of the `Storage` reference in the bandwidth client, the client can't be separated and used in a different place, as it will be linked to the `DisconnectedClient`. Cloning it ensures we uncouple this unnecessary dependence.
+
+- [`MixnetClient` can send `ClientRequests`](https://github.com/nymtech/nym/pull/5381): Adding a channel to the `MixnetClient`, so that it can signal to the `MixTrafficController` that can send a `ClientRequest` via its `GatewayTransciver`. Additionaly adds a sleep to the `disconnect` call as the socket would close before the channel message got processed.
+
+- [Use secure DNS for websocket connection establishment](https://github.com/nymtech/nym/pull/5386): Adjust the websocket connection establishment (using `tokio_tungstenite`) to use a custom DNS resolver that tries DoH and DoT. Instead of relying on the `tokio_tungstenite` to open the `tokio::net::TcpStream` ([which it does here](https://github.com/snapview/tokio-tungstenite/blob/aafb2f9e036162f7bffa002cfea502376a690724/src/connect.rs#L91)) which would kick in the default network resolver we do the resolution and open the `TcpStream` ourselves before handing off to the websocket libary.
+
+- [Reduce log severity for checking topology validity](https://github.com/nymtech/nym/pull/5395)
+
+- [Change Explorer URL to new smooshed nodes](https://github.com/nymtech/nym/pull/5396)
+
+- [Send shutdown instead of panic when reaching max fail](https://github.com/nymtech/nym/pull/5398): Remove a panic and an unwrap inside `client-core` that is hit occasionally in the vpn client. This is a change that can have wide ranging impact since it changes the task handling and it's inside `client-core`, which is used in many components and services, so preventing regressions is important.
+
+- [Relocate a validator api function](https://github.com/nymtech/nym/pull/5401): Adds a function to the `nym-validator-client` crate that hits the network details endpoint and returns an object parsed from `json`. This was floating loose in the `nym-vpn-client` repo. 
+
+- [Bump the patch-updates group across 1 directory with 9 updates](https://github.com/nymtech/nym/pull/5406)
+
+- [Upgrade to `thiserror` 2.0](https://github.com/nymtech/nym/pull/5414)
+
+- [Make `wait_for_graceful_shutdown` to be pub](https://github.com/nymtech/nym/pull/5424)
+
+- [Fix statistics shutdown](https://github.com/nymtech/nym/pull/5426)
+
+- [Push down forget me to client configs](https://github.com/nymtech/nym/pull/5431)
+
+### Bugfix
+
+- [Fix missing path triggers for CI](https://github.com/nymtech/nym/pull/5380): Fix missing path triggers for CI and sort crate list alphabetically to make it easier to maintain.
+
+
+
 ## `v2025.2-hu`
 
 - [Release Binaries](https://github.com/nymtech/nym/releases/tag/nym-binaries-v2025.2-hu)

documentation/docs/pages/operators/nodes/nym-node/setup.mdx

@@ -20,10 +20,10 @@ This documentation page provides a guide on how to set up and run a [NYM NODE](.
 ```sh
 nym-node
 Binary Name:        nym-node
-Build Timestamp:    2025-02-04T09:35:42.399220545Z
-Build Version:      1.4.0
-Commit SHA:         4c2bf3642e8eec0d55c7753e14429d73ac2d0e99
-Commit Date:        2025-02-04T10:29:48.000000000+01:00
+Build Timestamp:    2025-02-13T11:49:34.670488195Z
+Build Version:      1.5.0
+Commit SHA:         a3e19b4563843055b305ea9a397eb1ad84b5c378
+Commit Date:        2025-02-10T18:14:47.000000000+01:00
 Commit Branch:      HEAD
 rustc Version:      1.84.1
 rustc Channel:      stable
@@ -62,7 +62,7 @@ Exit Gateway is the only mode routing data directly to the open internet. Theref
 
 ***dVPN routing (2-hop) is the Fast option of NymVPN. It runs a wireguard tunnel inside another wireguard tunnel. dVPN uses 2 Gateway layers (entry and exit) and no Mixnode layers. If an operator announces and [correctly configure](configuration#connectivity-test-and-configuration) their node to route wireguard, the node can be chosen as entry or exit by any client at any time.***
 
-To activate wireguard routing, operators need to add `--wireguard-enabled true` alongside `nym-node` command `run`. 
+To activate wireguard routing, operators need to add `--wireguard-enabled true` alongside `nym-node` command `run`.
 
 <Callout type="warning">
 Wireguard nodes route data directly to the open internet. Therefore it exposes IP of operators server (VPS) to abuse complains. Before you decide to run a node with active wireguard routing, please read our [Community Counsel pages](../../community-counsel/exit-gateway) containing more information and some legal content.

documentation/docs/vercel.json

@@ -0,0 +1,7 @@
+{
+  "git": {
+    "deploymentEnabled": {
+      "master": false
+    }
+  }
+}

explorer-api/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "explorer-api"
-version = "1.1.45"
+version = "1.1.46"
 edition = "2021"
 license.workspace = true
 

gateway/src/node/client_handling/websocket/connection_handler/mod.rs

@@ -95,7 +95,7 @@ where
     S: AsyncRead + AsyncWrite + Unpin + Send,
 {
     // don't accept any new requests if we have already received shutdown
-    if handle.shutdown.is_shutdown() {
+    if handle.shutdown.is_shutdown_poll() {
         debug!("stopping the handle as we have received a shutdown");
         return;
     }

gateway/src/node/client_handling/websocket/listener.rs

@@ -50,7 +50,7 @@ impl Listener {
                 connection = tcp_listener.accept() => {
                     match connection {
                         Ok((socket, remote_addr)) => {
-                            let shutdown = self.shutdown.fork(format!("websocket-handler-{remote_addr}"));
+                            let shutdown = self.shutdown.fork(format!("websocket_handler_{remote_addr}"));
                             trace!("received a socket connection from {remote_addr}");
                             // TODO: I think we *REALLY* need a mechanism for having a maximum number of connected
                             // clients or spawned tokio tasks -> perhaps a worker system?

gateway/src/node/mod.rs

@@ -225,7 +225,7 @@ impl GatewayTasksBuilder {
                 handler_config,
                 nyxd_client,
                 self.identity_keypair.public_key().to_bytes(),
-                self.shutdown.fork("ecash-manager"),
+                self.shutdown.fork("ecash_manager"),
                 self.storage.clone(),
             )
             .await?,
@@ -279,13 +279,13 @@ impl GatewayTasksBuilder {
         let mut message_router_builder = SpMessageRouterBuilder::new(
             *self.identity_keypair.public_key(),
             self.mix_packet_sender.clone(),
-            self.shutdown.fork("network-requester-message-router"),
+            self.shutdown.fork("network_requester_message_router"),
         );
         let transceiver = message_router_builder.gateway_transceiver();
 
         let (on_start_tx, on_start_rx) = oneshot::channel();
         let mut nr_builder = NRServiceProviderBuilder::new(nr_opts.config.clone())
-            .with_shutdown(self.shutdown.fork("network-requester-sp"))
+            .with_shutdown(self.shutdown.fork("network_requester_sp"))
             .with_custom_gateway_transceiver(transceiver)
             .with_wait_for_gateway(true)
             .with_minimum_gateway_performance(0)
@@ -314,13 +314,13 @@ impl GatewayTasksBuilder {
         let mut message_router_builder = SpMessageRouterBuilder::new(
             *self.identity_keypair.public_key(),
             self.mix_packet_sender.clone(),
-            self.shutdown.fork("ipr-message-router"),
+            self.shutdown.fork("ipr_message_router"),
         );
         let transceiver = message_router_builder.gateway_transceiver();
 
         let (on_start_tx, on_start_rx) = oneshot::channel();
         let mut ip_packet_router = IpPacketRouter::new(ip_opts.config.clone())
-            .with_shutdown(self.shutdown.fork("ipr-sp"))
+            .with_shutdown(self.shutdown.fork("ipr_sp"))
             .with_custom_gateway_transceiver(Box::new(transceiver))
             .with_wait_for_gateway(true)
             .with_minimum_gateway_performance(0)
@@ -418,7 +418,7 @@ impl GatewayTasksBuilder {
         let mut message_router_builder = SpMessageRouterBuilder::new(
             *self.identity_keypair.public_key(),
             self.mix_packet_sender.clone(),
-            self.shutdown.fork("authenticator-message-router"),
+            self.shutdown.fork("authenticator_message_router"),
         );
         let transceiver = message_router_builder.gateway_transceiver();
 
@@ -431,7 +431,7 @@ impl GatewayTasksBuilder {
         )
         .with_ecash_verifier(ecash_manager)
         .with_custom_gateway_transceiver(transceiver)
-        .with_shutdown(self.shutdown.fork("authenticator-sp"))
+        .with_shutdown(self.shutdown.fork("authenticator_sp"))
         .with_wait_for_gateway(true)
         .with_minimum_gateway_performance(0)
         .with_custom_topology_provider(topology_provider)
@@ -451,7 +451,7 @@ impl GatewayTasksBuilder {
     pub fn build_stale_messages_cleaner(&self) -> StaleMessagesCleaner {
         StaleMessagesCleaner::new(
             &self.storage,
-            self.shutdown.fork("stale-messages-cleaner"),
+            self.shutdown.fork("stale_messages_cleaner"),
             self.config.debug.stale_messages_max_age,
             self.config.debug.stale_messages_cleaner_run_interval,
         )

nym-api/Cargo.toml

@@ -4,7 +4,7 @@
 [package]
 name = "nym-api"
 license = "GPL-3.0"
-version = "1.1.49"
+version = "1.1.50"
 authors.workspace = true
 edition = "2021"
 rust-version.workspace = true
@@ -65,7 +65,7 @@ zeroize = { workspace = true }
 # for axum server
 axum = { workspace = true, features = ["tokio"] }
 axum-extra = { workspace = true, features = ["typed-header"] }
-tower-http = { workspace = true, features = ["cors", "trace"] }
+tower-http = { workspace = true, features = ["cors", "trace", "compression-br", "compression-deflate", "compression-gzip", "compression-zstd"] }
 utoipa = { workspace = true, features = ["axum_extras", "time"] }
 utoipauto = { workspace = true }
 utoipa-swagger-ui = { workspace = true, features = ["axum"] }
@@ -136,7 +136,7 @@ sqlx = { workspace = true, features = [
 ] }
 
 [dev-dependencies]
-axum-test = "16.2.0"
+axum-test = { workspace = true }
 tempfile = { workspace = true }
 cw3 = { workspace = true }
 cw-utils = { workspace = true }

nym-api/nym-api-requests/src/nym_nodes.rs

@@ -8,12 +8,19 @@ use nym_crypto::asymmetric::x25519::serde_helpers::bs58_x25519_pubkey;
 use nym_crypto::asymmetric::{ed25519, x25519};
 use nym_mixnet_contract_common::nym_node::Role;
 use nym_mixnet_contract_common::reward_params::Performance;
-use nym_mixnet_contract_common::NodeId;
+use nym_mixnet_contract_common::{Interval, NodeId};
 use serde::{Deserialize, Serialize};
 use std::net::IpAddr;
 use time::OffsetDateTime;
 use utoipa::ToSchema;
 
+#[derive(Clone, Copy, Debug, Serialize, Deserialize, schemars::JsonSchema, utoipa::ToSchema)]
+#[serde(rename_all = "kebab-case")]
+pub enum TopologyRequestStatus {
+    NoUpdates,
+    Fresh(Interval),
+}
+
 #[derive(Clone, Debug, Serialize, Deserialize, schemars::JsonSchema, ToSchema)]
 pub struct CachedNodesResponse<T: ToSchema> {
     pub refreshed_at: OffsetDateTimeJsonSchemaWrapper,
@@ -37,6 +44,7 @@ impl<T: ToSchema> CachedNodesResponse<T> {
 
 #[derive(Clone, Debug, Serialize, Deserialize, schemars::JsonSchema)]
 pub struct PaginatedCachedNodesResponse<T> {
+    pub status: Option<TopologyRequestStatus>,
     pub refreshed_at: OffsetDateTimeJsonSchemaWrapper,
     pub nodes: PaginatedResponse<T>,
 }
@@ -56,6 +64,28 @@ impl<T> PaginatedCachedNodesResponse<T> {
                 },
                 data: nodes,
             },
+            status: None,
+        }
+    }
+
+    pub fn fresh(mut self, interval: Option<Interval>) -> Self {
+        let iv = interval.map(TopologyRequestStatus::Fresh);
+        self.status = iv;
+        self
+    }
+
+    pub fn no_updates() -> Self {
+        PaginatedCachedNodesResponse {
+            refreshed_at: OffsetDateTime::now_utc().into(),
+            nodes: PaginatedResponse {
+                pagination: Pagination {
+                    total: 0,
+                    page: 0,
+                    size: 0,
+                },
+                data: Vec::new(),
+            },
+            status: Some(TopologyRequestStatus::NoUpdates),
         }
     }
 }

nym-api/src/network/handlers.rs

@@ -6,6 +6,7 @@ use crate::support::http::state::AppState;
 use axum::{extract, Router};
 use nym_contracts_common::ContractBuildInformation;
 use std::collections::HashMap;
+use tower_http::compression::CompressionLayer;
 use utoipa::ToSchema;
 
 pub(crate) fn nym_network_routes() -> Router<AppState> {
@@ -16,6 +17,7 @@ pub(crate) fn nym_network_routes() -> Router<AppState> {
             "/nym-contracts-detailed",
             axum::routing::get(nym_contracts_detailed),
         )
+        .layer(CompressionLayer::new())
 }
 
 #[utoipa::path(

nym-api/src/network_monitor/monitor/sender.rs

@@ -167,7 +167,7 @@ impl PacketSender {
         let gateway_packet_router = PacketRouter::new(
             ack_sender,
             message_sender,
-            task_client.fork("packet-router"),
+            task_client.fork("packet_router"),
         );
 
         let shared_keys = fresh_gateway_client_data
@@ -184,7 +184,10 @@ impl PacketSender {
             shared_keys,
             gateway_packet_router,
             Some(fresh_gateway_client_data.bandwidth_controller.clone()),
-            nym_statistics_common::clients::ClientStatsSender::new(None),
+            nym_statistics_common::clients::ClientStatsSender::new(
+                None,
+                task_client.fork("client_stats_sender"),
+            ),
             #[cfg(unix)]
             None,
             task_client,

nym-api/src/nym_nodes/handlers/legacy.rs

@@ -7,6 +7,7 @@ use axum::extract::State;
 use axum::{Json, Router};
 use nym_api_requests::legacy::LegacyMixNodeBondWithLayer;
 use nym_api_requests::models::{LegacyDescribedGateway, LegacyDescribedMixNode};
+use tower_http::compression::CompressionLayer;
 
 // we want to mark the routes as deprecated in swagger, but still expose them
 #[allow(deprecated)]
@@ -20,6 +21,7 @@ pub(crate) fn legacy_nym_node_routes() -> Router<AppState> {
             "/mixnodes/described",
             axum::routing::get(get_mixnodes_described),
         )
+        .layer(CompressionLayer::new())
 }
 
 #[utoipa::path(

nym-api/src/nym_nodes/handlers/mod.rs

@@ -21,6 +21,7 @@ use schemars::JsonSchema;
 use serde::{Deserialize, Serialize};
 use std::time::Duration;
 use time::{Date, OffsetDateTime};
+use tower_http::compression::CompressionLayer;
 use utoipa::{IntoParams, ToSchema};
 
 pub(crate) mod legacy;
@@ -45,6 +46,7 @@ pub(crate) fn nym_node_routes() -> Router<AppState> {
         // to make it compatible with all the explorers that were used to using 0-100 values
         .route("/uptime-history/:node_id", get(get_node_uptime_history))
         .route("/rewarded-set", get(rewarded_set))
+        .layer(CompressionLayer::new())
 }
 
 #[utoipa::path(

nym-api/src/nym_nodes/handlers/unstable/mod.rs

@@ -33,6 +33,7 @@ use axum::routing::get;
 use axum::Router;
 use nym_api_requests::nym_nodes::NodeRoleQueryParam;
 use serde::Deserialize;
+use tower_http::compression::CompressionLayer;
 
 pub(crate) mod full_fat;
 mod helpers;
@@ -73,6 +74,7 @@ pub(crate) fn nym_node_routes_unstable() -> Router<AppState> {
         .nest("/full-fat", Router::new().route("/", get(nodes_detailed)))
         .route("/gateways/skimmed", get(skimmed::deprecated_gateways_basic))
         .route("/mixnodes/skimmed", get(skimmed::deprecated_mixnodes_basic))
+        .layer(CompressionLayer::new())
 }
 
 #[derive(Debug, Deserialize, utoipa::IntoParams)]
@@ -85,6 +87,11 @@ struct NodesParamsWithRole {
     no_legacy: Option<bool>,
     page: Option<u32>,
     per_page: Option<u32>,
+
+    // Identifier for the current epoch of the topology state. When sent by a client we can check if
+    // the client already knows about the latest topology state, allowing a `no-updates` response
+    // instead of wasting bandwidth serving an unchanged topology.
+    epoch_id: Option<u32>,
 }
 
 #[derive(Debug, Deserialize, utoipa::IntoParams)]
@@ -95,6 +102,11 @@ struct NodesParams {
     no_legacy: Option<bool>,
     page: Option<u32>,
     per_page: Option<u32>,
+
+    // Identifier for the current epoch of the topology state. When sent by a client we can check if
+    // the client already knows about the latest topology state, allowing a `no-updates` response
+    // instead of wasting bandwidth serving an unchanged topology.
+    epoch_id: Option<u32>,
 }
 
 impl From<NodesParamsWithRole> for NodesParams {
@@ -104,6 +116,7 @@ impl From<NodesParamsWithRole> for NodesParams {
             no_legacy: params.no_legacy,
             page: params.page,
             per_page: params.per_page,
+            epoch_id: params.epoch_id,
         }
     }
 }

nym-api/src/nym_nodes/handlers/unstable/skimmed.rs

@@ -124,6 +124,21 @@ where
     // (ideally it'd be tied directly to the NI iterator, but I couldn't defeat the compiler)
     let describe_cache = state.describe_nodes_cache_data().await?;
 
+    let maybe_interval = state
+        .nym_contract_cache()
+        .current_interval()
+        .await
+        .to_owned();
+
+    // 4.0 If the client indicates that they already know about the current topology send empty response
+    if let Some(client_known_epoch) = query_params.epoch_id {
+        if let Some(ref interval) = maybe_interval {
+            if client_known_epoch == interval.current_epoch_id() {
+                return Ok(Json(PaginatedCachedNodesResponse::no_updates()));
+            }
+        }
+    }
+
     // 4. start building the response
     let mut nodes =
         build_nym_nodes_response(&rewarded_set, nym_nodes_subset, &annotations, active_only);
@@ -137,10 +152,9 @@ where
             describe_cache.timestamp(),
         ]);
 
-        return Ok(Json(PaginatedCachedNodesResponse::new_full(
-            refreshed_at,
-            nodes,
-        )));
+        return Ok(Json(
+            PaginatedCachedNodesResponse::new_full(refreshed_at, nodes).fresh(maybe_interval),
+        ));
     }
 
     // 6. grab relevant legacy nodes
@@ -162,10 +176,9 @@ where
         annotated_legacy_nodes.timestamp(),
     ]);
 
-    Ok(Json(PaginatedCachedNodesResponse::new_full(
-        refreshed_at,
-        nodes,
-    )))
+    Ok(Json(
+        PaginatedCachedNodesResponse::new_full(refreshed_at, nodes).fresh(maybe_interval),
+    ))
 }
 
 /// Deprecated query that gets ALL gateways

nym-credential-proxy/nym-credential-proxy-requests/src/client.rs

@@ -6,7 +6,9 @@ use crate::api::v1::ticketbook::models::{
     TicketbookWalletSharesResponse,
 };
 use async_trait::async_trait;
-use nym_http_api_client::{parse_response, HttpClientError, Params, PathSegments, NO_PARAMS};
+use nym_http_api_client::{
+    parse_response, ApiClient, HttpClientError, Params, PathSegments, NO_PARAMS,
+};
 use reqwest::IntoUrl;
 use serde::de::DeserializeOwned;
 use serde::{Deserialize, Serialize};

nym-credential-proxy/vpn-api-lib-wasm/Cargo.toml

@@ -20,11 +20,11 @@ thiserror.workspace = true
 zeroize = { workspace = true }
 
 # wasm-specific deps
-getrandom = { version = "0.2", features = ["js"] }
+getrandom = { workspace = true, features = ["js"] }
 wasm-bindgen = { workspace = true }
-js-sys = "0.3.76"
+js-sys = { workspace = true }
 tsify = { workspace = true, features = ["js"] }
-serde-wasm-bindgen = "0.6.5"
+serde-wasm-bindgen = { workspace = true }
 
 # NYM:
 nym-bin-common = { path = "../../common/bin-common" }

nym-network-monitor/Cargo.toml

@@ -27,7 +27,7 @@ tokio = { workspace = true, features = ["macros", "time"] }
 tokio-util = { workspace = true }
 utoipa = { workspace = true, features = ["axum_extras"] }
 utoipa-swagger-ui = { workspace = true, features = ["axum"] }
-tokio-postgres = "0.7"
+tokio-postgres = { workspace = true }
 
 # internal
 nym-bin-common = { path = "../common/bin-common" }

nym-node-status-api/nym-node-status-agent/Cargo.toml

@@ -3,7 +3,7 @@
 
 [package]
 name = "nym-node-status-agent"
-version = "1.0.0-rc.1"
+version = "1.0.0-rc.2"
 authors.workspace = true
 repository.workspace = true
 homepage.workspace = true

nym-node-status-api/nym-node-status-agent/run.sh

@@ -1,9 +1,9 @@
 #!/bin/bash
 
 set -eu
-export ENVIRONMENT=${ENVIRONMENT:-"sandbox"}
+export ENVIRONMENT=${ENVIRONMENT:-"mainnet"}
 
-probe_git_ref="nym-vpn-core-v1.1.0"
+probe_git_ref="nym-vpn-core-v1.3.2"
 
 crate_root=$(dirname $(realpath "$0"))
 monorepo_root=$(realpath "${crate_root}/../..")
@@ -21,6 +21,7 @@ export NODE_STATUS_AGENT_SERVER_ADDRESS="http://127.0.0.1"
 export NODE_STATUS_AGENT_SERVER_PORT="8000"
 export NODE_STATUS_AGENT_PROBE_PATH="$crate_root/nym-gateway-probe"
 export NODE_STATUS_AGENT_AUTH_KEY="BjyC9SsHAZUzPRkQR4sPTvVrp4GgaquTh5YfSJksvvWT"
+export NODE_STATUS_AGENT_PROBE_EXTRA_ARGS="netstack-download-timeout-sec=30,netstack-num-ping=2,netstack-send-timeout-sec=1,netstack-recv-timeout-sec=1"
 
 workers=${1:-1}
 echo "Running $workers workers in parallel"
@@ -54,7 +55,7 @@ function swarm() {
     echo "All agents completed"
 }
 
-# copy_gw_probe
+copy_gw_probe
 build_agent
 
 swarm $workers

nym-node-status-api/nym-node-status-agent/src/cli/mod.rs

@@ -35,6 +35,13 @@ pub(crate) enum Command {
         /// path of binary to run
         #[arg(long, env = "NODE_STATUS_AGENT_PROBE_PATH")]
         probe_path: String,
+
+        #[arg(
+            long,
+            env = "NODE_STATUS_AGENT_PROBE_EXTRA_ARGS",
+            value_delimiter = ','
+        )]
+        probe_extra_args: Vec<String>,
     },
 
     GenerateKeypair {
@@ -51,11 +58,13 @@ impl Args {
                 server_port,
                 ns_api_auth_key,
                 probe_path,
+                probe_extra_args,
             } => run_probe::run_probe(
                 server_address,
                 server_port.to_owned(),
                 ns_api_auth_key,
                 probe_path,
+                probe_extra_args,
             )
             .await
             .inspect_err(|err| {

nym-node-status-api/nym-node-status-agent/src/cli/run_probe.rs

@@ -7,6 +7,7 @@ pub(crate) async fn run_probe(
     server_port: u16,
     ns_api_auth_key: &str,
     probe_path: &str,
+    probe_extra_args: &Vec<String>,
 ) -> anyhow::Result<()> {
     let auth_key = PrivateKey::from_base58_string(ns_api_auth_key)
         .context("Couldn't parse auth key, exiting")?;
@@ -19,7 +20,7 @@ pub(crate) async fn run_probe(
     tracing::info!("Probe version:\n{}", version);
 
     if let Some(testrun) = ns_api_client.request_testrun().await? {
-        let log = probe.run_and_get_log(&Some(testrun.gateway_identity_key));
+        let log = probe.run_and_get_log(&Some(testrun.gateway_identity_key), probe_extra_args);
 
         ns_api_client
             .submit_results(testrun.testrun_id, log, testrun.assigned_at_utc)

nym-node-status-api/nym-node-status-agent/src/probe.rs

@@ -29,7 +29,11 @@ impl GwProbe {
         }
     }
 
-    pub(crate) fn run_and_get_log(&self, gateway_key: &Option<String>) -> String {
+    pub(crate) fn run_and_get_log(
+        &self,
+        gateway_key: &Option<String>,
+        probe_extra_args: &Vec<String>,
+    ) -> String {
         let mut command = std::process::Command::new(&self.path);
         command.stdout(std::process::Stdio::piped());
 
@@ -37,6 +41,16 @@ impl GwProbe {
             command.arg("--gateway").arg(gateway_id);
         }
 
+        tracing::info!("Extra args for the probe:");
+        for arg in probe_extra_args {
+            let mut split = arg.splitn(2, '=');
+            let name = split.next().unwrap_or_default();
+            let value = split.next().unwrap_or_default();
+            tracing::info!("{} {}", name, value);
+
+            command.arg(format!("--{name}")).arg(value);
+        }
+
         match command.spawn() {
             Ok(child) => {
                 if let Ok(output) = child.wait_with_output() {

nym-node-status-api/nym-node-status-api/Cargo.toml

@@ -3,7 +3,7 @@
 
 [package]
 name = "nym-node-status-api"
-version = "1.0.0-rc.8"
+version = "1.0.2"
 authors.workspace = true
 repository.workspace = true
 homepage.workspace = true
@@ -13,14 +13,16 @@ license.workspace = true
 rust-version.workspace = true
 
 [dependencies]
-ammonia = "4"
+ammonia = { workspace = true }
 anyhow = { workspace = true }
 axum = { workspace = true, features = ["tokio", "macros"] }
+bip39 = { workspace = true }
 chrono = { workspace = true }
 clap = { workspace = true, features = ["cargo", "derive", "env", "string"] }
 cosmwasm-std = { workspace = true }
 envy = { workspace = true }
 futures-util = { workspace = true }
+itertools = { workspace = true }
 moka = { workspace = true, features = ["future"] }
 nym-contracts-common = { path = "../../common/cosmwasm-smart-contracts/contracts-common" }
 nym-bin-common = { path = "../../common/bin-common", features = ["models"] }
@@ -33,6 +35,8 @@ nym-statistics-common = { path = "../../common/statistics" }
 nym-validator-client = { path = "../../common/client-libs/validator-client" }
 nym-task = { path = "../../common/task" }
 nym-node-requests = { path = "../../nym-node/nym-node-requests", features = ["openapi"] }
+rand = { workspace = true }
+rand_chacha = { workspace = true }
 regex = { workspace = true }
 reqwest = { workspace = true }
 serde = { workspace = true, features = ["derive"] }

nym-node-status-api/nym-node-status-api/launch_node_status_api.sh

@@ -3,7 +3,7 @@
 set -e
 
 user_rust_log_preference=$RUST_LOG
-export ENVIRONMENT=${ENVIRONMENT:-"sandbox"}
+export ENVIRONMENT=${ENVIRONMENT:-"mainnet"}
 export NYM_API_CLIENT_TIMEOUT=60
 export EXPLORER_CLIENT_TIMEOUT=60
 export NODE_STATUS_API_TESTRUN_REFRESH_INTERVAL=120

nym-node-status-api/nym-node-status-api/src/cli/mod.rs

@@ -83,9 +83,6 @@ pub(crate) struct Cli {
         env = "NYM_NODE_STATUS_API_MAX_AGENT_COUNT"
     )]
     pub(crate) max_agent_count: i64,
-
-    #[clap(long, default_value = "", env = "NYM_NODE_STATUS_API_HM_URL")]
-    pub(crate) hm_url: String,
 }
 
 fn parse_duration(arg: &str) -> Result<std::time::Duration, std::num::ParseIntError> {

nym-node-status-api/nym-node-status-api/src/db/models.rs

@@ -2,7 +2,7 @@ use std::str::FromStr;
 
 use crate::{
     http::{self, models::SummaryHistory},
-    monitor::NumericalCheckedCast,
+    utils::NumericalCheckedCast,
 };
 use anyhow::Context;
 use nym_contracts_common::Percent;
@@ -16,7 +16,7 @@ use strum_macros::{EnumString, FromRepr};
 use time::{Date, OffsetDateTime};
 use utoipa::ToSchema;
 
-pub(crate) struct GatewayRecord {
+pub(crate) struct GatewayInsertRecord {
     pub(crate) identity_key: String,
     pub(crate) bonded: bool,
     pub(crate) self_described: String,
@@ -360,14 +360,24 @@ impl TryFrom<GatewaySessionsRecord> for http::models::SessionStats {
     }
 }
 
-pub(crate) enum MixingNodeKind {
-    LegacyMixnode,
-    NymNode,
+pub(crate) enum ScrapeNodeKind {
+    LegacyMixnode { mix_id: i64 },
+    MixingNymNode { node_id: i64 },
+    EntryExitNymNode { node_id: i64, identity_key: String },
+}
+
+impl ScrapeNodeKind {
+    pub(crate) fn node_id(&self) -> &i64 {
+        match self {
+            ScrapeNodeKind::LegacyMixnode { mix_id } => mix_id,
+            ScrapeNodeKind::MixingNymNode { node_id } => node_id,
+            ScrapeNodeKind::EntryExitNymNode { node_id, .. } => node_id,
+        }
+    }
 }
 
 pub(crate) struct ScraperNodeInfo {
-    pub node_id: i64,
-    pub node_kind: MixingNodeKind,
+    pub node_kind: ScrapeNodeKind,
     pub hosts: Vec<String>,
     pub http_api_port: i64,
 }
@@ -390,6 +400,10 @@ impl ScraperNodeInfo {
 
         urls
     }
+
+    pub(crate) fn node_id(&self) -> &i64 {
+        self.node_kind.node_id()
+    }
 }
 
 #[derive(sqlx::Decode, Debug)]

nym-node-status-api/nym-node-status-api/src/db/queries/gateways.rs

@@ -1,6 +1,8 @@
+use std::collections::HashSet;
+
 use crate::{
     db::{
-        models::{GatewayDto, GatewayRecord},
+        models::{GatewayDto, GatewayInsertRecord},
         DbPool,
     },
     http::models::Gateway,
@@ -30,7 +32,7 @@ pub(crate) async fn select_gateway_identity(
 
 pub(crate) async fn insert_gateways(
     pool: &DbPool,
-    gateways: Vec<GatewayRecord>,
+    gateways: Vec<GatewayInsertRecord>,
 ) -> anyhow::Result<()> {
     let mut db = pool.acquire().await?;
     for record in gateways {
@@ -98,3 +100,21 @@ pub(crate) async fn get_all_gateways(pool: &DbPool) -> anyhow::Result<Vec<Gatewa
     tracing::trace!("Fetched {} gateways from DB", items.len());
     Ok(items)
 }
+
+pub(crate) async fn get_all_gateway_id_keys(pool: &DbPool) -> anyhow::Result<HashSet<String>> {
+    let mut conn = pool.acquire().await?;
+    let items = sqlx::query!(
+        r#"
+            SELECT gateway_identity_key
+            FROM gateways
+            WHERE bonded = true
+        "#
+    )
+    .fetch_all(&mut *conn)
+    .await?
+    .into_iter()
+    .map(|record| record.gateway_identity_key)
+    .collect::<HashSet<_>>();
+
+    Ok(items)
+}

nym-node-status-api/nym-node-status-api/src/db/queries/mixnodes.rs

@@ -1,3 +1,5 @@
+use std::collections::HashSet;
+
 use futures_util::TryStreamExt;
 use tracing::error;
 
@@ -83,8 +85,7 @@ pub(crate) async fn get_all_mixnodes(pool: &DbPool) -> anyhow::Result<Vec<Mixnod
     Ok(items)
 }
 
-/// `offset` = slides our fixed-day period further into the past by N days
-pub(crate) async fn get_daily_stats(pool: &DbPool, offset: i64) -> anyhow::Result<Vec<DailyStats>> {
+pub(crate) async fn get_daily_stats(pool: &DbPool) -> anyhow::Result<Vec<DailyStats>> {
     let mut conn = pool.acquire().await?;
     let items = sqlx::query_as!(
         DailyStats,
@@ -115,11 +116,8 @@ pub(crate) async fn get_daily_stats(pool: &DbPool, offset: i64) -> anyhow::Resul
             WHERE nym_node_daily_mixing_stats.node_id IS NULL
         )
         GROUP BY date_utc
-        ORDER BY date_utc DESC
-        LIMIT 30
-        OFFSET ?
+        ORDER BY date_utc ASC
         "#,
-        offset
     )
     .fetch(&mut *conn)
     .try_collect::<Vec<DailyStats>>()
@@ -127,3 +125,21 @@ pub(crate) async fn get_daily_stats(pool: &DbPool, offset: i64) -> anyhow::Resul
 
     Ok(items)
 }
+
+pub(crate) async fn get_all_mix_ids(pool: &DbPool) -> anyhow::Result<HashSet<i64>> {
+    let mut conn = pool.acquire().await?;
+    let items = sqlx::query!(
+        r#"
+            SELECT mix_id
+            FROM mixnodes
+            WHERE bonded = true
+        "#
+    )
+    .fetch_all(&mut *conn)
+    .await?
+    .into_iter()
+    .map(|record| record.mix_id)
+    .collect::<HashSet<_>>();
+
+    Ok(items)
+}

nym-node-status-api/nym-node-status-api/src/db/queries/mod.rs

@@ -8,13 +8,15 @@ pub(crate) mod scraper;
 mod summary;
 pub(crate) mod testruns;
 
-pub(crate) use gateways::{get_all_gateways, insert_gateways, select_gateway_identity};
+pub(crate) use gateways::{
+    get_all_gateway_id_keys, get_all_gateways, insert_gateways, select_gateway_identity,
+};
 pub(crate) use gateways_stats::{delete_old_records, get_sessions_stats, insert_session_records};
 pub(crate) use misc::insert_summaries;
-pub(crate) use mixnodes::{get_all_mixnodes, get_daily_stats, insert_mixnodes};
+pub(crate) use mixnodes::{get_all_mix_ids, get_all_mixnodes, get_daily_stats, insert_mixnodes};
 pub(crate) use nym_nodes::{get_nym_nodes, insert_nym_nodes};
 pub(crate) use packet_stats::{
     get_raw_node_stats, insert_daily_node_stats, insert_node_packet_stats,
 };
-pub(crate) use scraper::{get_mixing_nodes_for_scraping, insert_scraped_node_description};
+pub(crate) use scraper::{get_nodes_for_scraping, insert_scraped_node_description};
 pub(crate) use summary::{get_summary, get_summary_history};

nym-node-status-api/nym-node-status-api/src/db/queries/nym_nodes.rs

@@ -1,5 +1,6 @@
 use std::collections::HashMap;
 
+use anyhow::Context;
 use futures_util::TryStreamExt;
 use nym_validator_client::{client::NymNodeDetails, nym_api::SkimmedNode};
 use tracing::instrument;
@@ -9,7 +10,7 @@ use crate::{
         models::{NymNodeDto, NymNodeInsertRecord},
         DbPool,
     },
-    monitor::decimal_to_i64,
+    utils::decimal_to_i64,
 };
 
 pub(crate) async fn get_nym_nodes(pool: &DbPool) -> anyhow::Result<Vec<SkimmedNode>> {
@@ -100,7 +101,8 @@ pub(crate) async fn insert_nym_nodes(
             record.last_updated_utc,
         )
         .execute(&mut *conn)
-        .await?;
+        .await
+        .with_context(|| format!("node_id={}", record.node_id))?;
     }
 
     Ok(())

nym-node-status-api/nym-node-status-api/src/db/queries/packet_stats.rs

@@ -1,27 +1,26 @@
 use crate::db::{
-    models::{MixingNodeKind, NodeStats, ScraperNodeInfo},
+    models::{NodeStats, ScrapeNodeKind, ScraperNodeInfo},
     DbPool,
 };
 use anyhow::Result;
 
 pub(crate) async fn insert_node_packet_stats(
     pool: &DbPool,
-    node_id: i64,
-    node_kind: &MixingNodeKind,
+    node_kind: &ScrapeNodeKind,
     stats: &NodeStats,
     timestamp_utc: i64,
 ) -> Result<()> {
     let mut conn = pool.acquire().await?;
 
     match node_kind {
-        MixingNodeKind::LegacyMixnode => {
+        ScrapeNodeKind::LegacyMixnode { mix_id } => {
             sqlx::query!(
                 r#"
                 INSERT INTO mixnode_packet_stats_raw (
                     mix_id, timestamp_utc, packets_received, packets_sent, packets_dropped
                 ) VALUES (?, ?, ?, ?, ?)
                 "#,
-                node_id,
+                mix_id,
                 timestamp_utc,
                 stats.packets_received,
                 stats.packets_sent,
@@ -30,7 +29,8 @@ pub(crate) async fn insert_node_packet_stats(
             .execute(&mut *conn)
             .await?;
         }
-        MixingNodeKind::NymNode => {
+        ScrapeNodeKind::MixingNymNode { node_id }
+        | ScrapeNodeKind::EntryExitNymNode { node_id, .. } => {
             sqlx::query!(
                 r#"
                 INSERT INTO nym_nodes_packet_stats_raw (
@@ -60,7 +60,7 @@ pub(crate) async fn get_raw_node_stats(
     let packets = match node.node_kind {
         // if no packets are found, it's fine to assume 0 because that's also
         // SQL default value if none provided
-        MixingNodeKind::LegacyMixnode => {
+        ScrapeNodeKind::LegacyMixnode { mix_id } => {
             sqlx::query_as!(
                 NodeStats,
                 r#"
@@ -73,12 +73,13 @@ pub(crate) async fn get_raw_node_stats(
                 ORDER BY timestamp_utc DESC
                 LIMIT 1 OFFSET 1
                 "#,
-                node.node_id
+                mix_id
             )
             .fetch_optional(&mut *conn)
             .await?
         }
-        MixingNodeKind::NymNode => {
+        ScrapeNodeKind::MixingNymNode { node_id }
+        | ScrapeNodeKind::EntryExitNymNode { node_id, .. } => {
             sqlx::query_as!(
                 NodeStats,
                 r#"
@@ -91,7 +92,7 @@ pub(crate) async fn get_raw_node_stats(
                 ORDER BY timestamp_utc DESC
                 LIMIT 1 OFFSET 1
                 "#,
-                node.node_id
+                node_id
             )
             .fetch_optional(&mut *conn)
             .await?
@@ -110,7 +111,7 @@ pub(crate) async fn insert_daily_node_stats(
     let mut conn = pool.acquire().await?;
 
     match node.node_kind {
-        MixingNodeKind::LegacyMixnode => {
+        ScrapeNodeKind::LegacyMixnode { mix_id } => {
             let total_stake = sqlx::query_scalar!(
                 r#"
                     SELECT
@@ -118,7 +119,7 @@ pub(crate) async fn insert_daily_node_stats(
                     FROM mixnodes
                     WHERE mix_id = ?
                    "#,
-                node.node_id
+                mix_id
             )
             .fetch_one(&mut *conn)
             .await?;
@@ -136,7 +137,7 @@ pub(crate) async fn insert_daily_node_stats(
                     packets_sent = mixnode_daily_stats.packets_sent + excluded.packets_sent,
                     packets_dropped = mixnode_daily_stats.packets_dropped + excluded.packets_dropped
                 "#,
-                node.node_id,
+                mix_id,
                 date_utc,
                 total_stake,
                 packets.packets_received,
@@ -146,7 +147,8 @@ pub(crate) async fn insert_daily_node_stats(
             .execute(&mut *conn)
             .await?;
         }
-        MixingNodeKind::NymNode => {
+        ScrapeNodeKind::MixingNymNode { node_id }
+        | ScrapeNodeKind::EntryExitNymNode { node_id, .. } => {
             let total_stake = sqlx::query_scalar!(
                 r#"
                 SELECT
@@ -154,7 +156,7 @@ pub(crate) async fn insert_daily_node_stats(
                 FROM nym_nodes
                 WHERE node_id = ?
                 "#,
-                node.node_id
+                node_id
             )
             .fetch_one(&mut *conn)
             .await?;
@@ -167,12 +169,12 @@ pub(crate) async fn insert_daily_node_stats(
                     packets_sent, packets_dropped
                 ) VALUES (?, ?, ?, ?, ?, ?)
                 ON CONFLICT(node_id, date_utc) DO UPDATE SET
-                    total_stake = nym_node_daily_mixing_stats.total_stake + excluded.total_stake,
+                    total_stake = excluded.total_stake,
                     packets_received = nym_node_daily_mixing_stats.packets_received + excluded.packets_received,
                     packets_sent = nym_node_daily_mixing_stats.packets_sent + excluded.packets_sent,
                     packets_dropped = nym_node_daily_mixing_stats.packets_dropped + excluded.packets_dropped
                 "#,
-                node.node_id,
+                node_id,
                 date_utc,
                 total_stake,
                 packets.packets_received,

nym-node-status-api/nym-node-status-api/src/db/queries/scraper.rs

@@ -1,6 +1,6 @@
 use crate::{
     db::{
-        models::{MixingNodeKind, ScraperNodeInfo},
+        models::{ScrapeNodeKind, ScraperNodeInfo},
         queries, DbPool,
     },
     mixnet_scraper::helpers::NodeDescriptionResponse,
@@ -8,16 +8,36 @@ use crate::{
 use anyhow::Result;
 use chrono::Utc;
 
-pub(crate) async fn get_mixing_nodes_for_scraping(pool: &DbPool) -> Result<Vec<ScraperNodeInfo>> {
+pub(crate) async fn get_nodes_for_scraping(pool: &DbPool) -> Result<Vec<ScraperNodeInfo>> {
     let mut nodes_to_scrape = Vec::new();
 
+    let mixnode_ids = queries::get_all_mix_ids(pool).await?;
+    let gateway_keys = queries::get_all_gateway_id_keys(pool).await?;
+
+    let mut entry_exit_nodes = 0;
     queries::get_nym_nodes(pool)
         .await?
         .into_iter()
         .for_each(|node| {
+            // due to polyfilling, Nym nodes table might contain legacy mixnodes
+            // as well. Mark them as such here.
+            let node_kind = if mixnode_ids.contains(&node.node_id.into()) {
+                ScrapeNodeKind::LegacyMixnode {
+                    mix_id: node.node_id.into(),
+                }
+            } else if gateway_keys.contains(&node.ed25519_identity_pubkey.to_base58_string()) {
+                entry_exit_nodes += 1;
+                ScrapeNodeKind::EntryExitNymNode {
+                    node_id: node.node_id.into(),
+                    identity_key: node.ed25519_identity_pubkey.to_base58_string(),
+                }
+            } else {
+                ScrapeNodeKind::MixingNymNode {
+                    node_id: node.node_id.into(),
+                }
+            };
             nodes_to_scrape.push(ScraperNodeInfo {
-                node_id: node.node_id.into(),
-                node_kind: MixingNodeKind::NymNode,
+                node_kind,
                 hosts: node
                     .ip_addresses
                     .into_iter()
@@ -27,7 +47,8 @@ pub(crate) async fn get_mixing_nodes_for_scraping(pool: &DbPool) -> Result<Vec<S
             })
         });
 
-    tracing::debug!("Fetched {} 🌟 nym nodes", nodes_to_scrape.len());
+    tracing::debug!("Fetched {} 🌟 total nym nodes", nodes_to_scrape.len());
+    tracing::debug!("Fetched {} 🚪 entry/exit nodes", entry_exit_nodes);
 
     let mut conn = pool.acquire().await?;
     let mixnodes = sqlx::query!(
@@ -41,7 +62,7 @@ pub(crate) async fn get_mixing_nodes_for_scraping(pool: &DbPool) -> Result<Vec<S
     .await?;
     drop(conn);
 
-    tracing::debug!("Fetched {} 🦖 mixnodes", nodes_to_scrape.len());
+    tracing::debug!("Fetched {} 🦖 mixnodes", mixnodes.len());
 
     let mut duplicates = 0;
     let mut legacy_not_in_nym_node_list = 0;
@@ -49,26 +70,22 @@ pub(crate) async fn get_mixing_nodes_for_scraping(pool: &DbPool) -> Result<Vec<S
     for mixnode in mixnodes {
         if nodes_to_scrape
             .iter()
-            .all(|node| node.node_id != mixnode.node_id)
+            .all(|node| node.node_id() != &mixnode.node_id)
         {
+            // in case polyfilling on Nym API gets removed, this part ensures
+            // mixnodes are added to the final list of nodes to scrape
+            nodes_to_scrape.push(ScraperNodeInfo {
+                node_kind: ScrapeNodeKind::LegacyMixnode {
+                    mix_id: mixnode.node_id,
+                },
+                hosts: vec![mixnode.host],
+                http_api_port: mixnode.http_api_port,
+            });
+
             legacy_not_in_nym_node_list += 1;
         } else {
             duplicates += 1;
         }
-
-        // technically, mixnodes shouldn't be in nym_nodes table, but it's
-        // possible due to polyfilling on Nym API
-        if nodes_to_scrape
-            .iter()
-            .all(|node| node.node_id != mixnode.node_id)
-        {
-            nodes_to_scrape.push(ScraperNodeInfo {
-                node_id: mixnode.node_id,
-                node_kind: MixingNodeKind::LegacyMixnode,
-                hosts: vec![mixnode.host],
-                http_api_port: mixnode.http_api_port,
-            })
-        }
     }
     tracing::debug!(
         "{}/{} legacy mixnodes already included in nym_node list",
@@ -85,19 +102,16 @@ pub(crate) async fn get_mixing_nodes_for_scraping(pool: &DbPool) -> Result<Vec<S
     Ok(nodes_to_scrape)
 }
 
-// TODO: add stuff for gateways
-
 pub(crate) async fn insert_scraped_node_description(
     pool: &DbPool,
-    node_kind: &MixingNodeKind,
-    node_id: i64,
+    node_kind: &ScrapeNodeKind,
     description: &NodeDescriptionResponse,
 ) -> Result<()> {
     let timestamp = Utc::now().timestamp();
     let mut conn = pool.acquire().await?;
 
     match node_kind {
-        MixingNodeKind::LegacyMixnode => {
+        ScrapeNodeKind::LegacyMixnode { mix_id } => {
             sqlx::query!(
                 r#"
                 INSERT INTO mixnode_description (
@@ -110,7 +124,7 @@ pub(crate) async fn insert_scraped_node_description(
                     details = excluded.details,
                     last_updated_utc = excluded.last_updated_utc
                 "#,
-                node_id,
+                mix_id,
                 description.moniker,
                 description.website,
                 description.security_contact,
@@ -120,7 +134,7 @@ pub(crate) async fn insert_scraped_node_description(
             .execute(&mut *conn)
             .await?;
         }
-        MixingNodeKind::NymNode => {
+        ScrapeNodeKind::MixingNymNode { node_id } => {
             sqlx::query!(
                 r#"
                 INSERT INTO nym_node_descriptions (
@@ -143,6 +157,34 @@ pub(crate) async fn insert_scraped_node_description(
             .execute(&mut *conn)
             .await?;
         }
+        ScrapeNodeKind::EntryExitNymNode { identity_key, .. } => {
+            sqlx::query!(
+                r#"
+            INSERT INTO gateway_description (
+                gateway_identity_key,
+                moniker,
+                website,
+                security_contact,
+                details,
+                last_updated_utc
+            ) VALUES (?, ?, ?, ?, ?, ?)
+            ON CONFLICT (gateway_identity_key) DO UPDATE SET
+                moniker = excluded.moniker,
+                website = excluded.website,
+                security_contact = excluded.security_contact,
+                details = excluded.details,
+                last_updated_utc = excluded.last_updated_utc
+            "#,
+                identity_key,
+                description.moniker,
+                description.website,
+                description.security_contact,
+                description.details,
+                timestamp,
+            )
+            .execute(&mut *conn)
+            .await?;
+        }
     }
 
     Ok(())

nym-node-status-api/nym-node-status-api/src/http/api/mixnodes.rs

@@ -99,7 +99,10 @@ async fn get_stats(
     Query(MixStatsQueryParams { offset }): Query<MixStatsQueryParams>,
     State(state): State<AppState>,
 ) -> HttpResult<Json<Vec<DailyStats>>> {
-    let offset = offset.unwrap_or(0);
+    let offset: usize = offset
+        .unwrap_or(0)
+        .try_into()
+        .map_err(|_| HttpError::invalid_input("Offset must be non-negative"))?;
     let last_30_days = state
         .cache()
         .get_mixnode_stats(state.db_pool(), offset)

nym-node-status-api/nym-node-status-api/src/http/server.rs

@@ -17,18 +17,10 @@ pub(crate) async fn start_http_api(
     nym_http_cache_ttl: u64,
     agent_key_list: Vec<PublicKey>,
     agent_max_count: i64,
-    hm_url: String,
 ) -> anyhow::Result<ShutdownHandles> {
     let router_builder = RouterBuilder::with_default_routes();
 
-    let state = AppState::new(
-        db_pool,
-        nym_http_cache_ttl,
-        agent_key_list,
-        agent_max_count,
-        hm_url,
-    )
-    .await;
+    let state = AppState::new(db_pool, nym_http_cache_ttl, agent_key_list, agent_max_count).await;
     let router = router_builder.with_state(state);
 
     let bind_addr = format!("0.0.0.0:{}", http_port);

nym-node-status-api/nym-node-status-api/src/http/state.rs

@@ -25,11 +25,10 @@ impl AppState {
         cache_ttl: u64,
         agent_key_list: Vec<PublicKey>,
         agent_max_count: i64,
-        hm_url: String,
     ) -> Self {
         Self {
             db_pool,
-            cache: HttpCache::new(cache_ttl, hm_url).await,
+            cache: HttpCache::new(cache_ttl).await,
             agent_key_list,
             agent_max_count,
         }
@@ -52,96 +51,14 @@ impl AppState {
     }
 }
 
-#[derive(Debug, Clone)]
-struct HistoricMixingStats {
-    historic_stats: Vec<DailyStats>,
-}
-
-impl HistoricMixingStats {
-    /// Collect historic stats only on initialization. From this point onwards,
-    /// service will collect its own stats
-    async fn init(hm_url: String) -> Self {
-        tracing::info!("Fetching historic mixnode stats from {}", hm_url);
-
-        let target_url = format!("{}/v2/mixnodes/stats", hm_url);
-        if let Ok(response) = reqwest::get(&target_url)
-            .await
-            .and_then(|res| res.error_for_status())
-            .inspect_err(|err| tracing::error!("Failed to fetch cache from HM: {}", err))
-        {
-            if let Ok(mut daily_stats) = response.json::<Vec<DailyStats>>().await {
-                // sorting required for seamless comparison later (descending, newest first)
-                daily_stats.sort_by(|left, right| right.date_utc.cmp(&left.date_utc));
-
-                tracing::info!(
-                    "Successfully fetched {} historic entries from {}",
-                    daily_stats.len(),
-                    hm_url
-                );
-                return Self {
-                    historic_stats: daily_stats,
-                };
-            }
-        };
-
-        tracing::warn!("Failed to get historic daily stats from {}", hm_url);
-        Self {
-            historic_stats: Vec::new(),
-        }
-    }
-
-    /// polyfill with historical data obtained from Harbour Master
-    fn merge_with_historic_stats(&self, mut new_stats: Vec<DailyStats>) -> Vec<DailyStats> {
-        // newest first
-        new_stats.sort_by(|left, right| right.date_utc.cmp(&left.date_utc));
-
-        // historic stats are only used for dates when we don't have new data
-        let oldest_date_in_new_stats = new_stats
-            .last()
-            .map(|day| day.date_utc.to_owned())
-            .unwrap_or(String::from("1900-01-01"));
-
-        // given 2 arrays
-        // index    historic_stats      new_stats
-        //   0        30-01               31-01
-        //   1        29-01               30-01
-        //   2        28-01
-        //            ...
-        //   N        01-01
-        // cutoff point would be at historic_stats[1]
-        // (first date smaller than oldest we've already got)
-        if let Some(cutoff) = self
-            .historic_stats
-            .iter()
-            .position(|elem| elem.date_utc < oldest_date_in_new_stats)
-        {
-            // missing data = (all historic data) - (however many days we already have)
-            let missing_data = self.historic_stats.iter().skip(cutoff).cloned();
-
-            // extend new data with missing days
-            tracing::debug!(
-                "Polyfilled with {} historic records from {:?} to {:?}",
-                missing_data.len(),
-                self.historic_stats.last(),
-                self.historic_stats.get(cutoff)
-            );
-            new_stats.extend(missing_data);
-
-            // oldest first
-            new_stats.into_iter().rev().collect::<Vec<_>>()
-        } else {
-            // if all historic data is older than what we've got, don't use it
-            new_stats
-        }
-    }
-}
-
 static GATEWAYS_LIST_KEY: &str = "gateways";
 static MIXNODES_LIST_KEY: &str = "mixnodes";
 static MIXSTATS_LIST_KEY: &str = "mixstats";
 static SUMMARY_HISTORY_LIST_KEY: &str = "summary-history";
 static SESSION_STATS_LIST_KEY: &str = "session-stats";
 
+const MIXNODE_STATS_HISTORY_DAYS: usize = 30;
+
 #[derive(Debug, Clone)]
 pub(crate) struct HttpCache {
     gateways: Cache<String, Arc<RwLock<Vec<Gateway>>>>,
@@ -149,11 +66,10 @@ pub(crate) struct HttpCache {
     mixstats: Cache<String, Arc<RwLock<Vec<DailyStats>>>>,
     history: Cache<String, Arc<RwLock<Vec<SummaryHistory>>>>,
     session_stats: Cache<String, Arc<RwLock<Vec<SessionStats>>>>,
-    mixnode_historic_daily_stats: HistoricMixingStats,
 }
 
 impl HttpCache {
-    pub async fn new(ttl_seconds: u64, hm_url: String) -> Self {
+    pub async fn new(ttl_seconds: u64) -> Self {
         HttpCache {
             gateways: Cache::builder()
                 .max_capacity(2)
@@ -175,7 +91,6 @@ impl HttpCache {
                 .max_capacity(2)
                 .time_to_live(Duration::from_secs(ttl_seconds))
                 .build(),
-            mixnode_historic_daily_stats: HistoricMixingStats::init(hm_url).await,
         }
     }
 
@@ -285,26 +200,27 @@ impl HttpCache {
             .await
     }
 
-    pub async fn get_mixnode_stats(&self, db: &DbPool, offset: i64) -> Vec<DailyStats> {
-        match self.mixstats.get(MIXSTATS_LIST_KEY).await {
+    pub async fn get_mixnode_stats(&self, db: &DbPool, offset: usize) -> Vec<DailyStats> {
+        let mut stats = match self.mixstats.get(MIXSTATS_LIST_KEY).await {
             Some(guard) => {
                 let read_lock = guard.read().await;
                 read_lock.to_vec()
             }
             None => {
-                let new_node_stats = crate::db::queries::get_daily_stats(db, offset)
+                let new_node_stats = crate::db::queries::get_daily_stats(db)
                     .await
-                    .unwrap_or_default();
-                // for every day that's missing, fill it with cached historic data
-                let mut mixnode_stats = self
-                    .mixnode_historic_daily_stats
-                    .merge_with_historic_stats(new_node_stats);
-                mixnode_stats.truncate(30);
-
-                self.upsert_mixnode_stats(mixnode_stats.clone()).await;
-                mixnode_stats
+                    .unwrap_or_default()
+                    .into_iter()
+                    .rev()
+                    .collect::<Vec<_>>();
+                // cache result without offset
+                self.upsert_mixnode_stats(new_node_stats.clone()).await;
+                new_node_stats
             }
-        }
+        };
+
+        stats.truncate(MIXNODE_STATS_HISTORY_DAYS + offset);
+        stats.into_iter().skip(offset).rev().collect()
     }
 
     pub async fn get_summary_history(&self, db: &DbPool) -> Vec<SummaryHistory> {

nym-node-status-api/nym-node-status-api/src/logging.rs

@@ -34,6 +34,8 @@ pub(crate) fn setup_tracing_logger() -> anyhow::Result<()> {
         "tower_http",
         "axum",
         "html5ever",
+        "hickory_proto",
+        "hickory_resolver",
     ];
     for crate_name in warn_crates {
         filter = filter.add_directive(directive_checked(format!("{}=warn", crate_name))?);

nym-node-status-api/nym-node-status-api/src/main.rs

@@ -10,6 +10,7 @@ mod mixnet_scraper;
 mod monitor;
 mod node_scraper;
 mod testruns;
+mod utils;
 
 #[tokio::main]
 async fn main() -> anyhow::Result<()> {
@@ -66,7 +67,6 @@ async fn main() -> anyhow::Result<()> {
         args.nym_http_cache_ttl,
         agent_key_list.to_owned(),
         args.max_agent_count,
-        args.hm_url,
     )
     .await
     .expect("Failed to start server");

nym-node-status-api/nym-node-status-api/src/mixnet_scraper/helpers.rs

@@ -1,12 +1,15 @@
-use crate::db::{
-    models::{NodeStats, ScraperNodeInfo},
-    queries::{
-        get_raw_node_stats, insert_daily_node_stats, insert_node_packet_stats,
-        insert_scraped_node_description,
+use crate::{
+    db::{
+        models::{NodeStats, ScraperNodeInfo},
+        queries::{
+            get_raw_node_stats, insert_daily_node_stats, insert_node_packet_stats,
+            insert_scraped_node_description,
+        },
     },
+    utils::generate_node_name,
 };
 use ammonia::Builder;
-use anyhow::Result;
+use anyhow::{anyhow, Result};
 use chrono::{DateTime, Datelike, Utc};
 use reqwest;
 use serde::{Deserialize, Serialize};
@@ -80,22 +83,33 @@ pub fn build_client() -> Result<reqwest::Client> {
         .map_err(|e| anyhow::anyhow!("Failed to build HTTP client: {}", e))
 }
 
-pub fn sanitize_description(description: NodeDescriptionResponse) -> NodeDescriptionResponse {
+pub fn sanitize_description(
+    description: NodeDescriptionResponse,
+    node_id: i64,
+) -> NodeDescriptionResponse {
     let mut sanitizer = Builder::new();
     sanitizer
         .tags(std::collections::HashSet::new())
         .generic_attributes(std::collections::HashSet::new())
         .url_schemes(std::collections::HashSet::new());
 
+    const UNKNOWN: &str = "N/A";
     let sanitize_field = |opt: Option<String>| -> Option<String> {
         Some(
             opt.filter(|s| !s.trim().is_empty())
-                .map_or_else(|| "N/A".to_string(), |s| sanitizer.clean(&s).to_string()),
+                .map_or_else(|| UNKNOWN.to_string(), |s| sanitizer.clean(&s).to_string()),
         )
     };
 
+    let mut moniker = sanitize_field(description.moniker);
+    if let Some(sanitized) = &moniker {
+        if sanitized == UNKNOWN {
+            moniker = Some(generate_node_name(node_id));
+        }
+    };
+
     NodeDescriptionResponse {
-        moniker: sanitize_field(description.moniker),
+        moniker,
         website: sanitize_field(description.website),
         security_contact: sanitize_field(description.security_contact),
         details: sanitize_field(description.details),
@@ -108,18 +122,26 @@ pub async fn scrape_and_store_description(pool: &SqlitePool, node: &ScraperNodeI
 
     let mut description = None;
     let mut error = None;
+    let mut tried_url_list = Vec::new();
 
     for mut url in urls {
         url = format!("{}{}", url.trim_end_matches('/'), DESCRIPTION_URL);
+        tried_url_list.push(url.clone());
 
-        match client.get(&url).send().await {
+        match client
+            .get(&url)
+            .send()
+            .await
+            // convert 404 and similar to error
+            .and_then(|res| res.error_for_status())
+        {
             Ok(response) => {
                 if let Ok(desc) = response.json::<NodeDescriptionResponse>().await {
                     description = Some(desc);
                     break;
                 }
             }
-            Err(e) => error = Some(e),
+            Err(e) => error = Some(anyhow!("{:?} ({})", tried_url_list, e)),
         }
     }
 
@@ -128,9 +150,8 @@ pub async fn scrape_and_store_description(pool: &SqlitePool, node: &ScraperNodeI
         anyhow::anyhow!("Failed to fetch description from any URL: {}", err_msg)
     })?;
 
-    let sanitized_description = sanitize_description(description);
-    insert_scraped_node_description(pool, &node.node_kind, node.node_id, &sanitized_description)
-        .await?;
+    let sanitized_description = sanitize_description(description, *node.node_id());
+    insert_scraped_node_description(pool, &node.node_kind, &sanitized_description).await?;
 
     Ok(())
 }
@@ -144,9 +165,11 @@ pub async fn scrape_and_store_packet_stats(
 
     let mut stats = None;
     let mut error = None;
+    let mut tried_url_list = Vec::new();
 
     for mut url in urls {
         url = format!("{}{}", url.trim_end_matches('/'), PACKET_STATS_URL);
+        tried_url_list.push(url.clone());
 
         match client.get(&url).send().await {
             Ok(response) => {
@@ -155,18 +178,18 @@ pub async fn scrape_and_store_packet_stats(
                     break;
                 }
             }
-            Err(e) => error = Some(e),
+            Err(e) => error = Some(anyhow!("{:?} ({})", tried_url_list, e)),
         }
     }
 
     let stats = stats.ok_or_else(|| {
         let err_msg = error.map_or_else(|| "Unknown error".to_string(), |e| e.to_string());
-        anyhow::anyhow!("Failed to fetch stats from any URL: {}", err_msg)
+        anyhow::anyhow!("Failed to fetch description from any URL: {}", err_msg)
     })?;
 
     let timestamp = Utc::now();
     let timestamp_utc = timestamp.timestamp();
-    insert_node_packet_stats(pool, node.node_id, &node.node_kind, &stats, timestamp_utc).await?;
+    insert_node_packet_stats(pool, &node.node_kind, &stats, timestamp_utc).await?;
 
     // Update daily stats
     update_daily_stats(pool, node, timestamp, &stats).await?;