Run fmt

Move functions around
Add type attribute
2024-07-24 22:58:26 +01:00 · 2024-07-24 22:42:44 +01:00 · 2024-07-24 22:41:36 +01:00 · 2024-07-24 09:31:59 +01:00 · 2024-07-24 09:26:58 +01:00 · 2024-07-24 09:12:51 +01:00
625 changed files with 37101 additions and 16333 deletions
@@ -42,7 +42,7 @@ jobs:
    strategy:
      fail-fast: false
      matrix:
-        platform: [ubuntu-20.04]
+        platform: [ ubuntu-20.04 ]

    runs-on: ${{ matrix.platform }}
    env:
@@ -104,8 +104,6 @@ jobs:
          name: nym-binaries-artifacts
          path: |
            target/release/nym-client
-            target/release/nym-gateway
-            target/release/nym-mixnode
            target/release/nym-socks5-client
            target/release/nym-api
            target/release/nym-network-requester
@@ -123,8 +121,6 @@ jobs:
          OUTPUT_DIR: ci-builds/${{ github.ref_name }}
        run: |
          cp target/release/nym-client $OUTPUT_DIR
-          cp target/release/nym-gateway $OUTPUT_DIR
-          cp target/release/nym-mixnode $OUTPUT_DIR
          cp target/release/nym-socks5-client $OUTPUT_DIR
          cp target/release/nym-api $OUTPUT_DIR
          cp target/release/nym-network-requester $OUTPUT_DIR
@@ -15,7 +15,7 @@ jobs:
    strategy:
      fail-fast: false
      matrix:
-        platform: [ubuntu-20.04]
+        platform: [ ubuntu-20.04 ]

    runs-on: ${{ matrix.platform }}
    env:
@@ -58,6 +58,7 @@ jobs:
          cp contracts/target/wasm32-unknown-unknown/release/nym_coconut_dkg.wasm $OUTPUT_DIR
          cp contracts/target/wasm32-unknown-unknown/release/cw3_flex_multisig.wasm $OUTPUT_DIR
          cp contracts/target/wasm32-unknown-unknown/release/cw4_group.wasm $OUTPUT_DIR
+          cp contracts/target/wasm32-unknown-unknown/release/nym_ecash.wasm $OUTPUT_DIR

      - name: Deploy branch to CI www
        continue-on-error: true
@@ -4,6 +4,38 @@ Post 1.0.0 release, the changelog format is based on [Keep a Changelog](https://

 ## [Unreleased]

+## [2024.7-doubledecker] (2024-07-04)
+
+- Add an early return in `parse_raw_str_logs` for empty raw log strings. ([#4686])
+- Bump braces from 3.0.2 to 3.0.3 in /wasm/mix-fetch/internal-dev ([#4672])
+- add expiry returned on import ([#4670])
+- [bugfix] missing rustls feature ([#4666])
+- Bump ws from 8.13.0 to 8.17.1 in /wasm/client/internal-dev-node ([#4665])
+- Bump braces from 3.0.2 to 3.0.3 in /clients/native/examples/js-examples/websocket ([#4663])
+- Bump ws from 8.14.2 to 8.17.1 in /sdk/typescript/packages/nodejs-client ([#4662])
+- Update setup.md ([#4661])
+- New clippy lints ([#4660])
+- Bump braces from 3.0.2 to 3.0.3 in /nym-api/tests ([#4659])
+- Bump braces from 3.0.2 to 3.0.3 in /docker/typescript_client/upload_contract ([#4658])
+- Update vps-setup.md ([#4656])
+- Update configuration.md ([#4655])
+- Remove old PR template ([#4639])
+
+[#4686]: https://github.com/nymtech/nym/pull/4686
+[#4672]: https://github.com/nymtech/nym/pull/4672
+[#4670]: https://github.com/nymtech/nym/pull/4670
+[#4666]: https://github.com/nymtech/nym/pull/4666
+[#4665]: https://github.com/nymtech/nym/pull/4665
+[#4663]: https://github.com/nymtech/nym/pull/4663
+[#4662]: https://github.com/nymtech/nym/pull/4662
+[#4661]: https://github.com/nymtech/nym/pull/4661
+[#4660]: https://github.com/nymtech/nym/pull/4660
+[#4659]: https://github.com/nymtech/nym/pull/4659
+[#4658]: https://github.com/nymtech/nym/pull/4658
+[#4656]: https://github.com/nymtech/nym/pull/4656
+[#4655]: https://github.com/nymtech/nym/pull/4655
+[#4639]: https://github.com/nymtech/nym/pull/4639
+
 ## [2024.6-chomp] (2024-06-25)

 - Remove additional code as part of Ephemera Purge and SP and contracts ([#4650])
@@ -20,6 +20,7 @@ members = [
    "clients/native",
    "clients/native/websocket-requests",
    "clients/socks5",
+    "common/authenticator-requests",
    "common/async-file-watcher",
    "common/bandwidth-controller",
    "common/bin-common",
@@ -33,6 +34,7 @@ members = [
    "common/commands",
    "common/config",
    "common/cosmwasm-smart-contracts/coconut-bandwidth-contract",
+    "common/cosmwasm-smart-contracts/ecash-contract",
    "common/cosmwasm-smart-contracts/coconut-dkg",
    "common/cosmwasm-smart-contracts/contracts-common",
    "common/cosmwasm-smart-contracts/group-contract",
@@ -46,6 +48,8 @@ members = [
    "common/credentials-interface",
    "common/crypto",
    "common/dkg",
+    "common/ecash-double-spending",
+    "common/ecash-time",
    "common/execute",
    "common/exit-policy",
    "common/http-api-client",
@@ -58,6 +62,7 @@ members = [
    "common/node-tester-utils",
    "common/nonexhaustive-delayqueue",
    "common/nymcoconut",
+    "common/nym_offline_compact_ecash",
    "common/nym-id",
    "common/nym-metrics",
    "common/nymsphinx",
@@ -73,6 +78,7 @@ members = [
    "common/nymsphinx/types",
    "common/nyxd-scraper",
    "common/pemstore",
+    "common/serde-helpers",
    "common/socks5-client-core",
    "common/socks5/proxy-helpers",
    "common/socks5/requests",
@@ -95,6 +101,7 @@ members = [
    "mixnode",
    "sdk/lib/socks5-listener",
    "sdk/rust/nym-sdk",
+    "service-providers/authenticator",
    "service-providers/common",
    "service-providers/ip-packet-router",
    "service-providers/network-requester",
@@ -118,6 +125,8 @@ members = [
    "wasm/mix-fetch",
    "wasm/node-tester",
    "wasm/zknym-lib",
+    "tools/internal/testnet-manager",
+    "tools/internal/testnet-manager/dkg-bypass-contract",
 ]

 default-members = [
@@ -137,6 +146,7 @@ exclude = [
    "explorer",
    "contracts",
    "nym-wallet",
+    "nym-vpn/ui/src-tauri",
    "cpu-cycles",
    "sdk/ffi/cpp",
 ]
@@ -161,8 +171,13 @@ axum-extra = "0.9.3"
 base64 = "0.21.4"
 bincode = "1.3.3"
 bip39 = { version = "2.0.0", features = ["zeroize"] }
+
+# can we unify those?
+bit-vec = "0.7.0"
 bitvec = "1.0.0"
+
 blake3 = "1.3.1"
+bloomfilter = "1.0.14"
 bs58 = "0.5.1"
 bytecodec = "0.4.15"
 bytes = "1.5.0"
@@ -214,11 +229,11 @@ httpcodec = "0.2.3"
 humantime = "2.1.0"
 humantime-serde = "1.1.1"
 hyper = "1.3.1"
-indexed_db_futures = "0.3.0"
 inquire = "0.6.2"
 ip_network = "0.4.1"
 ipnetwork = "0.16"
 isocountry = "0.3.2"
+itertools = "0.13.0"
 k256 = "0.13"
 lazy_static = "1.4.0"
 ledger-transport = "0.10.0"
@@ -303,7 +318,8 @@ prometheus = { version = "0.13.0" }
 # coconut/DKG related
 # unfortunately until https://github.com/zkcrypto/bls12_381/issues/10 is resolved, we have to rely on the fork
 # as we need to be able to serialize Gt so that we could create the lookup table for baby-step-giant-step algorithm
-bls12_381 = { git = "https://github.com/jstuczyn/bls12_381", default-features = false,  branch = "feature/gt-serialization-0.8.0" }
+# plus to make our live easier we need serde support from https://github.com/zkcrypto/bls12_381/pull/125
+bls12_381 = { git = "https://github.com/jstuczyn/bls12_381", default-features = false, branch = "temp/experimental-serdect" }
 group = { version = "0.13.0", default-features = false }
 ff = { version = "0.13.0", default-features = false }

@@ -326,16 +342,22 @@ cw-controllers = { version = "=1.1.0" }
 # cosmrs-related
 bip32 = { version = "0.5.1", default-features = false }

-# temporarily using a fork again (yay.) because we need staking and slashing support
-cosmrs = { git = "https://github.com/jstuczyn/cosmos-rust", branch = "nym-temp/all-validator-features" }
-#cosmrs = {  git = "https://github.com/jstuczyn/cosmos-rust", branch = "nym-temp/all-validator-features" } # unfortuntely we need a fork by yours truly to get the staking support
-tendermint = "0.34"     # same version as used by cosmrs
-tendermint-rpc = "0.34" # same version as used by cosmrs
+# temporarily using a fork again (yay.) because we need staking and slashing support (which are already on main but not released)
+# plus response message parsing (which is, as of the time of writing this message, waiting to get merged)
+#cosmrs = { path = "../cosmos-rust-fork/cosmos-rust/cosmrs" }
+cosmrs = { git = "https://github.com/cosmos/cosmos-rust", rev = "4b1332e6d8258ac845cef71589c8d362a669675a" } # unfortuntely we need a fork by yours truly to get the staking support
+tendermint = "0.37.0"     # same version as used by cosmrs
+tendermint-rpc = "0.37.0" # same version as used by cosmrs
 prost = { version = "0.12", default-features = false }

 # wasm-related dependencies
 gloo-utils = "0.2.0"
 gloo-net = "0.5.0"
+
+# use a separate branch due to feature unification failures
+# this is blocked until the upstream removes outdates `wasm_bindgen` feature usage
+# indexed_db_futures = "0.4.1"
+indexed_db_futures = { git = "https://github.com/TiemenSch/rust-indexed-db", branch = "update-uuid" }
 js-sys = "0.3.69"
 serde-wasm-bindgen = "0.6.5"
 tsify = "0.4.5"
@@ -343,7 +365,6 @@ wasm-bindgen = "0.2.92"
 wasm-bindgen-futures = "0.4.39"
 wasmtimer = "0.2.0"
 web-sys = "0.3.69"
-itertools = "0.12.0"


 # Profile settings for individual crates
@@ -133,7 +133,7 @@ clippy: sdk-wasm-lint
 # Build contracts ready for deploy
 # -----------------------------------------------------------------------------

-CONTRACTS=vesting_contract mixnet_contract
+CONTRACTS=vesting_contract mixnet_contract nym_ecash
 CONTRACTS_WASM=$(addsuffix .wasm, $(CONTRACTS))
 CONTRACTS_OUT_DIR=contracts/target/wasm32-unknown-unknown/release

@@ -52,7 +52,7 @@ References for developers:

 You can chat to us in two places:
 * The #dev channel on [Matrix](https://matrix.to/#/#dev:nymtech.chat)
-* The various developer channels on [Discord](discord.gg/nymproject)
+* The various developer channels on [Discord](https://nymtech.net/go/discord)

 ### Tokenomics & Rewards

@@ -1,6 +1,6 @@
 [package]
 name = "nym-client"
-version = "1.1.36"
+version = "1.1.37"
 authors = ["Dave Hrycyszyn <futurechimp@users.noreply.github.com>", "Jędrzej Stuczyński <andrew@nymtech.net>"]
 description = "Implementation of the Nym Client"
 edition = "2021"
@@ -26,6 +26,7 @@ pub(crate) mod import_credential;
 pub(crate) mod init;
 mod list_gateways;
 pub(crate) mod run;
+mod show_ticketbooks;
 mod switch_gateway;

 pub(crate) struct CliNativeClient;
@@ -84,6 +85,9 @@ pub(crate) enum Commands {
    /// Change the currently active gateway. Note that you must have already registered with the new gateway!
    SwitchGateway(switch_gateway::Args),

+    /// Display information associated with the imported ticketbooks,
+    ShowTicketbooks(show_ticketbooks::Args),
+
    /// Show build information of this binary
    BuildInfo(build_info::BuildInfo),

@@ -116,6 +120,7 @@ pub(crate) async fn execute(args: Cli) -> Result<(), Box<dyn Error + Send + Sync
        Commands::ListGateways(args) => list_gateways::execute(args).await?,
        Commands::AddGateway(args) => add_gateway::execute(args).await?,
        Commands::SwitchGateway(args) => switch_gateway::execute(args).await?,
+        Commands::ShowTicketbooks(args) => show_ticketbooks::execute(args).await?,
        Commands::BuildInfo(m) => build_info::execute(m),
        Commands::Completions(s) => s.generate(&mut Cli::command(), bin_name),
        Commands::GenerateFigSpec => fig_generate(&mut Cli::command(), bin_name),
@@ -0,0 +1,32 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::commands::CliNativeClient;
+use crate::error::ClientError;
+use nym_bin_common::output_format::OutputFormat;
+use nym_client_core::cli_helpers::client_show_ticketbooks::{
+    show_ticketbooks, CommonShowTicketbooksArgs,
+};
+
+#[derive(clap::Args)]
+pub(crate) struct Args {
+    #[command(flatten)]
+    common_args: CommonShowTicketbooksArgs,
+
+    #[arg(short, long, default_value_t = OutputFormat::default())]
+    output: OutputFormat,
+}
+
+impl AsRef<CommonShowTicketbooksArgs> for Args {
+    fn as_ref(&self) -> &CommonShowTicketbooksArgs {
+        &self.common_args
+    }
+}
+
+pub(crate) async fn execute(args: Args) -> Result<(), ClientError> {
+    let output = args.output;
+    let res = show_ticketbooks::<CliNativeClient, _>(args).await?;
+
+    println!("{}", output.format(&res));
+    Ok(())
+}
@@ -1,6 +1,6 @@
 [package]
 name = "nym-socks5-client"
-version = "1.1.36"
+version = "1.1.37"
 authors = ["Dave Hrycyszyn <futurechimp@users.noreply.github.com>"]
 description = "A SOCKS5 localhost proxy that converts incoming messages to Sphinx and sends them to a Nym address"
 edition = "2021"
@@ -30,6 +30,7 @@ mod import_credential;
 pub mod init;
 mod list_gateways;
 pub(crate) mod run;
+mod show_ticketbooks;
 mod switch_gateway;

 pub(crate) struct CliSocks5Client;
@@ -88,6 +89,9 @@ pub(crate) enum Commands {
    /// Change the currently active gateway. Note that you must have already registered with the new gateway!
    SwitchGateway(switch_gateway::Args),

+    /// Display information associated with the imported ticketbooks,
+    ShowTicketbooks(show_ticketbooks::Args),
+
    /// Show build information of this binary
    BuildInfo(build_info::BuildInfo),

@@ -123,6 +127,7 @@ pub(crate) async fn execute(args: Cli) -> Result<(), Box<dyn Error + Send + Sync
        Commands::ListGateways(args) => list_gateways::execute(args).await?,
        Commands::AddGateway(args) => add_gateway::execute(args).await?,
        Commands::SwitchGateway(args) => switch_gateway::execute(args).await?,
+        Commands::ShowTicketbooks(args) => show_ticketbooks::execute(args).await?,
        Commands::BuildInfo(m) => build_info::execute(m),
        Commands::Completions(s) => s.generate(&mut Cli::command(), bin_name),
        Commands::GenerateFigSpec => fig_generate(&mut Cli::command(), bin_name),
@@ -0,0 +1,32 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::commands::CliSocks5Client;
+use crate::error::Socks5ClientError;
+use nym_bin_common::output_format::OutputFormat;
+use nym_client_core::cli_helpers::client_show_ticketbooks::{
+    show_ticketbooks, CommonShowTicketbooksArgs,
+};
+
+#[derive(clap::Args)]
+pub(crate) struct Args {
+    #[command(flatten)]
+    common_args: CommonShowTicketbooksArgs,
+
+    #[arg(short, long, default_value_t = OutputFormat::default())]
+    output: OutputFormat,
+}
+
+impl AsRef<CommonShowTicketbooksArgs> for Args {
+    fn as_ref(&self) -> &CommonShowTicketbooksArgs {
+        &self.common_args
+    }
+}
+
+pub(crate) async fn execute(args: Args) -> Result<(), Socks5ClientError> {
+    let output = args.output;
+    let res = show_ticketbooks::<CliSocks5Client, _>(args).await?;
+
+    println!("{}", output.format(&res));
+    Ok(())
+}
@@ -0,0 +1,17 @@
+[package]
+name = "nym-authenticator-requests"
+version = "0.1.0"
+authors.workspace = true
+repository.workspace = true
+homepage.workspace = true
+documentation.workspace = true
+edition.workspace = true
+license.workspace = true
+
+[dependencies]
+bincode = { workspace = true }
+rand = { workspace = true }
+serde = { workspace = true, features = ["derive"] }
+
+nym-sphinx = { path = "../nymsphinx" }
+nym-wireguard-types = { path = "../wireguard-types" }
@@ -0,0 +1,13 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+pub mod v1;
+
+pub const CURRENT_VERSION: u8 = 1;
+
+fn make_bincode_serializer() -> impl bincode::Options {
+    use bincode::Options;
+    bincode::DefaultOptions::new()
+        .with_big_endian()
+        .with_varint_encoding()
+}
@@ -0,0 +1,7 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+pub mod request;
+pub mod response;
+
+const VERSION: u8 = 1;
@@ -0,0 +1,84 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use nym_sphinx::addressing::Recipient;
+use nym_wireguard_types::{GatewayClient, InitMessage, PeerPublicKey};
+use serde::{Deserialize, Serialize};
+
+use crate::make_bincode_serializer;
+
+use super::VERSION;
+
+fn generate_random() -> u64 {
+    use rand::RngCore;
+    let mut rng = rand::rngs::OsRng;
+    rng.next_u64()
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub struct AuthenticatorRequest {
+    pub version: u8,
+    pub data: AuthenticatorRequestData,
+    pub reply_to: Recipient,
+    pub request_id: u64,
+}
+
+impl AuthenticatorRequest {
+    pub fn from_reconstructed_message(
+        message: &nym_sphinx::receiver::ReconstructedMessage,
+    ) -> Result<Self, bincode::Error> {
+        use bincode::Options;
+        make_bincode_serializer().deserialize(&message.message)
+    }
+
+    pub fn new_initial_request(init_message: InitMessage, reply_to: Recipient) -> (Self, u64) {
+        let request_id = generate_random();
+        (
+            Self {
+                version: VERSION,
+                data: AuthenticatorRequestData::Initial(init_message),
+                reply_to,
+                request_id,
+            },
+            request_id,
+        )
+    }
+
+    pub fn new_final_request(gateway_client: GatewayClient, reply_to: Recipient) -> (Self, u64) {
+        let request_id = generate_random();
+        (
+            Self {
+                version: VERSION,
+                data: AuthenticatorRequestData::Final(gateway_client),
+                reply_to,
+                request_id,
+            },
+            request_id,
+        )
+    }
+
+    pub fn new_query_request(peer_public_key: PeerPublicKey, reply_to: Recipient) -> (Self, u64) {
+        let request_id = generate_random();
+        (
+            Self {
+                version: VERSION,
+                data: AuthenticatorRequestData::QueryBandwidth(peer_public_key),
+                reply_to,
+                request_id,
+            },
+            request_id,
+        )
+    }
+
+    pub fn to_bytes(&self) -> Result<Vec<u8>, bincode::Error> {
+        use bincode::Options;
+        make_bincode_serializer().serialize(self)
+    }
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub enum AuthenticatorRequestData {
+    Initial(InitMessage),
+    Final(GatewayClient),
+    QueryBandwidth(PeerPublicKey),
+}
@@ -0,0 +1,119 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use nym_sphinx::addressing::Recipient;
+use nym_wireguard_types::registration::{RegistrationData, RegistredData, RemainingBandwidthData};
+use serde::{Deserialize, Serialize};
+
+use crate::make_bincode_serializer;
+
+use super::VERSION;
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub struct AuthenticatorResponse {
+    pub version: u8,
+    pub data: AuthenticatorResponseData,
+    pub reply_to: Recipient,
+}
+
+impl AuthenticatorResponse {
+    pub fn new_pending_registration_success(
+        registration_data: RegistrationData,
+        request_id: u64,
+        reply_to: Recipient,
+    ) -> Self {
+        Self {
+            version: VERSION,
+            data: AuthenticatorResponseData::PendingRegistration(PendingRegistrationResponse {
+                reply: registration_data,
+                reply_to,
+                request_id,
+            }),
+            reply_to,
+        }
+    }
+
+    pub fn new_registered(
+        registred_data: RegistredData,
+        reply_to: Recipient,
+        request_id: u64,
+    ) -> Self {
+        Self {
+            version: VERSION,
+            data: AuthenticatorResponseData::Registered(RegisteredResponse {
+                reply: registred_data,
+                reply_to,
+                request_id,
+            }),
+            reply_to,
+        }
+    }
+
+    pub fn new_remaining_bandwidth(
+        remaining_bandwidth_data: Option<RemainingBandwidthData>,
+        reply_to: Recipient,
+        request_id: u64,
+    ) -> Self {
+        Self {
+            version: VERSION,
+            data: AuthenticatorResponseData::RemainingBandwidth(RemainingBandwidthResponse {
+                reply: remaining_bandwidth_data,
+                reply_to,
+                request_id,
+            }),
+            reply_to,
+        }
+    }
+
+    pub fn recipient(&self) -> Recipient {
+        self.reply_to
+    }
+
+    pub fn to_bytes(&self) -> Result<Vec<u8>, bincode::Error> {
+        use bincode::Options;
+        make_bincode_serializer().serialize(self)
+    }
+
+    pub fn from_reconstructed_message(
+        message: &nym_sphinx::receiver::ReconstructedMessage,
+    ) -> Result<Self, bincode::Error> {
+        use bincode::Options;
+        make_bincode_serializer().deserialize(&message.message)
+    }
+
+    pub fn id(&self) -> Option<u64> {
+        match &self.data {
+            AuthenticatorResponseData::PendingRegistration(response) => Some(response.request_id),
+            AuthenticatorResponseData::Registered(response) => Some(response.request_id),
+            AuthenticatorResponseData::RemainingBandwidth(response) => Some(response.request_id),
+        }
+    }
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub enum AuthenticatorResponseData {
+    PendingRegistration(PendingRegistrationResponse),
+    Registered(RegisteredResponse),
+    RemainingBandwidth(RemainingBandwidthResponse),
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub struct PendingRegistrationResponse {
+    pub request_id: u64,
+    pub reply_to: Recipient,
+    pub reply: RegistrationData,
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub struct RegisteredResponse {
+    pub request_id: u64,
+    pub reply_to: Recipient,
+    pub reply: RegistredData,
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub struct RemainingBandwidthResponse {
+    pub request_id: u64,
+    pub reply_to: Recipient,
+    pub reply: Option<RemainingBandwidthData>,
+}
@@ -14,13 +14,14 @@ thiserror = { workspace = true }
 url = { workspace = true }
 zeroize = { workspace = true }

-nym-coconut = { path = "../nymcoconut" }
+nym-ecash-time = { path = "../ecash-time" }
 nym-credential-storage = { path = "../credential-storage" }
 nym-credentials = { path = "../credentials" }
 nym-credentials-interface = { path = "../credentials-interface" }
 nym-crypto = { path = "../crypto", features = ["rand", "asymmetric", "symmetric", "aes", "hashing"] }
 nym-network-defaults = { path = "../network-defaults" }
 nym-validator-client = { path = "../client-libs/validator-client", default-features = false }
+nym-ecash-contract-common = { path = "../cosmwasm-smart-contracts/ecash-contract" }

 [target."cfg(not(target_arch = \"wasm32\"))".dependencies.nym-validator-client]
 path = "../client-libs/validator-client"
@@ -1,87 +1,123 @@
-// Copyright 2023 - Nym Technologies SA <contact@nymtech.net>
+// Copyright 2023-2024 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0

 use crate::error::BandwidthControllerError;
-use nym_credential_storage::models::StorableIssuedCredential;
+use crate::utils::{get_coin_index_signatures, get_expiration_date_signatures};
+use log::info;
 use nym_credential_storage::storage::Storage;
-use nym_credentials::coconut::bandwidth::{CredentialType, IssuanceBandwidthCredential};
-use nym_credentials::coconut::utils::obtain_aggregate_signature;
-use nym_crypto::asymmetric::{encryption, identity};
-use nym_validator_client::coconut::all_coconut_api_clients;
-use nym_validator_client::nyxd::contract_traits::CoconutBandwidthSigningClient;
-use nym_validator_client::nyxd::contract_traits::DkgQueryClient;
-use nym_validator_client::nyxd::Coin;
+use nym_credentials::ecash::bandwidth::IssuanceTicketBook;
+use nym_credentials::ecash::utils::obtain_aggregate_wallet;
+use nym_credentials::IssuedTicketBook;
+use nym_crypto::asymmetric::identity;
+use nym_ecash_time::{ecash_default_expiration_date, Date};
+use nym_validator_client::coconut::all_ecash_api_clients;
+use nym_validator_client::nym_api::EpochId;
+use nym_validator_client::nyxd::contract_traits::EcashSigningClient;
+use nym_validator_client::nyxd::contract_traits::{DkgQueryClient, EcashQueryClient};
+use nym_validator_client::nyxd::cosmwasm_client::ToSingletonContractData;
+use nym_validator_client::EcashApiClient;
 use rand::rngs::OsRng;
-use state::State;
-use zeroize::Zeroizing;

-pub mod state;
-
-pub async fn deposit<C>(client: &C, amount: Coin) -> Result<State, BandwidthControllerError>
+pub async fn make_deposit<C>(
+    client: &C,
+    client_id: &[u8],
+    expiration: Option<Date>,
+) -> Result<IssuanceTicketBook, BandwidthControllerError>
 where
-    C: CoconutBandwidthSigningClient + Sync,
+    C: EcashSigningClient + EcashQueryClient + Sync,
 {
    let mut rng = OsRng;
    let signing_key = identity::PrivateKey::new(&mut rng);
-    let encryption_key = encryption::PrivateKey::new(&mut rng);
+    let expiration = expiration.unwrap_or_else(ecash_default_expiration_date);

-    let tx_hash = client
-        .deposit(
-            amount.clone(),
-            CredentialType::Voucher.to_string(),
+    let deposit_amount = client.get_required_deposit_amount().await?;
+    info!("we'll need to deposit {deposit_amount} to obtain the ticketbook");
+    let result = client
+        .make_ticketbook_deposit(
            signing_key.public_key().to_base58_string(),
-            encryption_key.public_key().to_base58_string(),
+            deposit_amount.into(),
            None,
        )
-        .await?
-        .transaction_hash;
+        .await?;

-    let voucher =
-        IssuanceBandwidthCredential::new_voucher(amount, tx_hash, signing_key, encryption_key);
+    let deposit_id = result.parse_singleton_u32_contract_data()?;

-    let state = State { voucher };
+    info!("our ticketbook deposit has been stored under id {deposit_id}");

-    Ok(state)
+    Ok(IssuanceTicketBook::new_with_expiration(
+        deposit_id,
+        client_id,
+        signing_key,
+        expiration,
+    ))
 }

-pub async fn get_bandwidth_voucher<C, St>(
-    state: &State,
+pub async fn query_and_persist_required_global_signatures<S>(
+    storage: &S,
+    epoch_id: EpochId,
+    expiration_date: Date,
+    apis: Vec<EcashApiClient>,
+) -> Result<(), BandwidthControllerError>
+where
+    S: Storage,
+    <S as Storage>::StorageError: Send + Sync + 'static,
+{
+    log::info!("Getting expiration date signatures");
+    // this will also persist the signatures in the storage if they were not there already
+    get_expiration_date_signatures(storage, epoch_id, expiration_date, apis.clone()).await?;
+
+    log::info!("Getting coin indices signatures");
+    // this will also persist the signatures in the storage if they were not there already
+    get_coin_index_signatures(storage, epoch_id, apis).await?;
+    Ok(())
+}
+
+pub async fn get_ticket_book<C, St>(
+    issuance_data: &IssuanceTicketBook,
    client: &C,
    storage: &St,
-) -> Result<(), BandwidthControllerError>
+    apis: Option<Vec<EcashApiClient>>,
+) -> Result<IssuedTicketBook, BandwidthControllerError>
 where
    C: DkgQueryClient + Send + Sync,
    St: Storage,
    <St as Storage>::StorageError: Send + Sync + 'static,
 {
-    // temporary
-    assert!(state.voucher.typ().is_voucher());
-
    let epoch_id = client.get_current_epoch().await?.epoch_id;
    let threshold = client
        .get_current_epoch_threshold()
        .await?
        .ok_or(BandwidthControllerError::NoThreshold)?;

-    let coconut_api_clients = all_coconut_api_clients(client, epoch_id).await?;
-
-    let signature =
-        obtain_aggregate_signature(&state.voucher, &coconut_api_clients, threshold).await?;
-    let issued = state.voucher.to_issued_credential(signature, epoch_id);
-
-    // make sure the data gets zeroized after persisting it
-    let credential_data = Zeroizing::new(issued.pack_v1());
-    let storable = StorableIssuedCredential {
-        serialization_revision: issued.current_serialization_revision(),
-        credential_data: credential_data.as_ref(),
-        credential_type: issued.typ().to_string(),
-        epoch_id: epoch_id
-            .try_into()
-            .expect("our epoch is has run over u32::MAX!"),
+    let apis = match apis {
+        Some(apis) => apis,
+        None => all_ecash_api_clients(client, epoch_id).await?,
    };

+    log::info!("Querying wallet signatures");
+    let wallet = obtain_aggregate_wallet(issuance_data, &apis, threshold).await?;
+    info!("managed to obtain sufficient number of partial signatures!");
+
+    log::info!("Getting expiration date signatures");
+    // this will also persist the signatures in the storage if they were not there already
+    get_expiration_date_signatures(
+        storage,
+        epoch_id,
+        issuance_data.expiration_date(),
+        apis.clone(),
+    )
+    .await?;
+
+    log::info!("Getting coin indices signatures");
+    // this will also persist the signatures in the storage if they were not there already
+    get_coin_index_signatures(storage, epoch_id, apis).await?;
+
+    let issued = issuance_data.to_issued_ticketbook(wallet, epoch_id);
+
+    info!("persisting the ticketbook into the storage...");
    storage
-        .insert_issued_credential(storable)
+        .insert_issued_ticketbook(&issued)
        .await
-        .map_err(|err| BandwidthControllerError::CredentialStorageError(Box::new(err)))
+        .map_err(|err| BandwidthControllerError::CredentialStorageError(Box::new(err)))?;
+    Ok(issued)
 }
@@ -1,14 +0,0 @@
-// Copyright 2022-2024 - Nym Technologies SA <contact@nymtech.net>
-// SPDX-License-Identifier: Apache-2.0
-
-use nym_credentials::coconut::bandwidth::IssuanceBandwidthCredential;
-
-pub struct State {
-    pub voucher: IssuanceBandwidthCredential,
-}
-
-impl State {
-    pub fn new(voucher: IssuanceBandwidthCredential) -> Self {
-        State { voucher }
-    }
-}
@@ -1,12 +1,12 @@
 // Copyright 2023 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0

-use nym_coconut::CoconutError;
 use nym_credential_storage::error::StorageError;
 use nym_credentials::error::Error as CredentialsError;
+use nym_credentials_interface::CompactEcashError;
 use nym_crypto::asymmetric::encryption::KeyRecoveryError;
 use nym_crypto::asymmetric::identity::Ed25519RecoveryError;
-use nym_validator_client::coconut::CoconutApiError;
+use nym_validator_client::coconut::EcashApiError;
 use nym_validator_client::error::ValidatorClientError;
 use thiserror::Error;

@@ -16,7 +16,7 @@ pub enum BandwidthControllerError {
    Nyxd(#[from] nym_validator_client::nyxd::error::NyxdError),

    #[error("coconut api query failure: {0}")]
-    CoconutApiError(#[from] CoconutApiError),
+    CoconutApiError(#[from] EcashApiError),

    #[error("There was a credential storage error - {0}")]
    CredentialStorageError(Box<dyn std::error::Error + Send + Sync>),
@@ -28,8 +28,8 @@ pub enum BandwidthControllerError {
    #[error(transparent)]
    StorageError(#[from] StorageError),

-    #[error("Coconut error - {0}")]
-    CoconutError(#[from] CoconutError),
+    #[error("Ecash error - {0}")]
+    EcashError(#[from] CompactEcashError),

    #[error("Validator client error - {0}")]
    ValidatorError(#[from] ValidatorClientError),
@@ -51,4 +51,15 @@ pub enum BandwidthControllerError {

    #[error("can't handle recovering storage with revision {stored}. {expected} was expected")]
    UnsupportedCredentialStorageRevision { stored: u8, expected: u8 },
+
+    #[error("did not receive a valid response for aggregated data ({typ}) from ANY nym-api")]
+    ExhaustedApiQueries { typ: String },
+}
+
+impl BandwidthControllerError {
+    pub fn credential_storage_error(
+        source: impl std::error::Error + Send + Sync + 'static,
+    ) -> Self {
+        BandwidthControllerError::CredentialStorageError(Box::new(source))
+    }
 }
@@ -0,0 +1,13 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+// See other comments for other TaskStatus message enumds about abusing the Error trait when we
+// should have a new trait for TaskStatus messages
+#[derive(Debug, thiserror::Error)]
+pub enum BandwidthStatusMessage {
+    #[error("remaining bandwidth: {0}")]
+    RemainingBandwidth(i64),
+
+    #[error("no bandwidth left")]
+    NoBandwidth,
+}
@@ -1,21 +1,32 @@
 // Copyright 2021-2024 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0

+#![warn(clippy::expect_used)]
+#![warn(clippy::unwrap_used)]
+#![warn(clippy::todo)]
+#![warn(clippy::dbg_macro)]
+
 use crate::error::BandwidthControllerError;
-use crate::utils::stored_credential_to_issued_bandwidth;
-use log::{debug, error, warn};
+use crate::utils::{
+    get_aggregate_verification_key, get_coin_index_signatures, get_expiration_date_signatures,
+    ApiClientsWrapper,
+};
+use log::error;
+use nym_credential_storage::models::RetrievedTicketbook;
 use nym_credential_storage::storage::Storage;
-use nym_credentials::coconut::bandwidth::issued::BandwidthCredentialIssuedDataVariant;
-use nym_credentials::coconut::bandwidth::CredentialSpendingData;
-use nym_credentials::coconut::utils::obtain_aggregate_verification_key;
-use nym_credentials::IssuedBandwidthCredential;
-use nym_credentials_interface::VerificationKey;
-use nym_validator_client::coconut::all_coconut_api_clients;
+use nym_credentials::ecash::bandwidth::CredentialSpendingData;
+use nym_credentials_interface::{
+    AnnotatedCoinIndexSignature, AnnotatedExpirationDateSignature, NymPayInfo, VerificationKeyAuth,
+};
+use nym_ecash_time::Date;
 use nym_validator_client::nym_api::EpochId;
 use nym_validator_client::nyxd::contract_traits::DkgQueryClient;

+pub use event::BandwidthStatusMessage;
+
 pub mod acquire;
 pub mod error;
+mod event;
 mod utils;

 #[derive(Debug)]
@@ -32,13 +43,20 @@ pub struct PreparedCredential {
    /// could use correct verification key for validation.
    pub epoch_id: EpochId,

-    /// The database id of the stored credential.
-    pub credential_id: i64,
+    /// Auxiliary metadata associated with the withdrawn credential
+    pub metadata: PreparedCredentialMetadata,
 }

-pub struct RetrievedCredential {
-    pub credential: IssuedBandwidthCredential,
-    pub credential_id: i64,
+#[derive(Copy, Clone)]
+pub struct PreparedCredentialMetadata {
+    /// The database id of the stored credential.
+    pub ticketbook_id: i64,
+
+    /// The number of tickets withdrawn in this credential
+    pub tickets_withdrawn: u32,
+
+    /// The amount of tickets used INCLUDING those tickets that JUST got withdrawn
+    pub used_tickets: u32,
 }

 impl<C, St: Storage> BandwidthController<C, St> {
@@ -47,111 +65,155 @@ impl<C, St: Storage> BandwidthController<C, St> {
    }

    /// Tries to retrieve one of the stored, unused credentials that hasn't yet expired.
-    /// It marks any retrieved intermediate credentials as expired.
-    pub async fn get_next_usable_credential(
+    pub async fn get_next_usable_ticketbook(
        &self,
-        gateway_id: &str,
-    ) -> Result<RetrievedCredential, BandwidthControllerError>
+        tickets: u32,
+    ) -> Result<RetrievedTicketbook, BandwidthControllerError>
    where
        <St as Storage>::StorageError: Send + Sync + 'static,
    {
-        loop {
-            let Some(maybe_next) = self
-                .storage
-                .get_next_unspent_credential(gateway_id)
-                .await
-                .map_err(|err| BandwidthControllerError::CredentialStorageError(Box::new(err)))?
-            else {
-                return Err(BandwidthControllerError::NoCredentialsAvailable);
-            };
-            let id = maybe_next.id;
+        let Some(ticketbook) = self
+            .storage
+            .get_next_unspent_usable_ticketbook(tickets)
+            .await
+            .map_err(BandwidthControllerError::credential_storage_error)?
+        else {
+            return Err(BandwidthControllerError::NoCredentialsAvailable);
+        };

-            // try to deserialize it
-            let valid_credential = match stored_credential_to_issued_bandwidth(maybe_next) {
-                // check if it has already expired
-                Ok(credential) => match credential.variant_data() {
-                    BandwidthCredentialIssuedDataVariant::Voucher(_) => {
-                        debug!("credential {id} is a bandwidth voucher");
-                        credential
-                    }
-                    BandwidthCredentialIssuedDataVariant::FreePass(freepass_info) => {
-                        debug!("credential {id} is a free pass");
-                        if freepass_info.expired() {
-                            warn!("the free pass (id: {id}) has already expired! The expiration was set to {}", freepass_info.expiry_date());
-                            self.storage.mark_expired(id).await.map_err(|err| {
-                                BandwidthControllerError::CredentialStorageError(Box::new(err))
-                            })?;
-                            continue;
-                        }
-                        credential
-                    }
-                },
-                Err(err) => {
-                    error!("failed to deserialize credential with id {id}: {err}. it may need to be manually removed from the storage");
-                    return Err(err);
-                }
-            };
-            return Ok(RetrievedCredential {
-                credential: valid_credential,
-                credential_id: id,
-            });
-        }
+        Ok(ticketbook)
    }

-    pub fn storage(&self) -> &St {
-        &self.storage
+    pub async fn attempt_revert_ticket_usage(
+        &self,
+        info: PreparedCredentialMetadata,
+    ) -> Result<bool, BandwidthControllerError>
+    where
+        <St as Storage>::StorageError: Send + Sync + 'static,
+    {
+        self.storage
+            .attempt_revert_ticketbook_withdrawal(
+                info.ticketbook_id,
+                info.used_tickets,
+                info.tickets_withdrawn,
+            )
+            .await
+            .map_err(BandwidthControllerError::credential_storage_error)
    }

    async fn get_aggregate_verification_key(
        &self,
        epoch_id: EpochId,
-    ) -> Result<VerificationKey, BandwidthControllerError>
+        apis: &mut ApiClientsWrapper,
+    ) -> Result<VerificationKeyAuth, BandwidthControllerError>
    where
        C: DkgQueryClient + Sync + Send,
        <St as Storage>::StorageError: Send + Sync + 'static,
    {
-        let coconut_api_clients = all_coconut_api_clients(&self.client, epoch_id).await?;
-        Ok(obtain_aggregate_verification_key(&coconut_api_clients)?)
+        let ecash_apis = apis.get_or_init(epoch_id, &self.client).await?;
+        get_aggregate_verification_key(&self.storage, epoch_id, ecash_apis).await
    }

-    pub async fn prepare_bandwidth_credential(
+    async fn get_coin_index_signatures(
        &self,
-        gateway_id: &str,
+        epoch_id: EpochId,
+        apis: &mut ApiClientsWrapper,
+    ) -> Result<Vec<AnnotatedCoinIndexSignature>, BandwidthControllerError>
+    where
+        C: DkgQueryClient + Sync + Send,
+        <St as Storage>::StorageError: Send + Sync + 'static,
+    {
+        let ecash_apis = apis.get_or_init(epoch_id, &self.client).await?;
+        get_coin_index_signatures(&self.storage, epoch_id, ecash_apis).await
+    }
+
+    async fn get_expiration_date_signatures(
+        &self,
+        epoch_id: EpochId,
+        expiration_date: Date,
+        apis: &mut ApiClientsWrapper,
+    ) -> Result<Vec<AnnotatedExpirationDateSignature>, BandwidthControllerError>
+    where
+        C: DkgQueryClient + Sync + Send,
+        <St as Storage>::StorageError: Send + Sync + 'static,
+    {
+        let ecash_apis = apis.get_or_init(epoch_id, &self.client).await?;
+        get_expiration_date_signatures(&self.storage, epoch_id, expiration_date, ecash_apis).await
+    }
+
+    async fn prepare_ecash_ticket_inner(
+        &self,
+        provider_pk: [u8; 32],
+        tickets_to_spend: u32,
+        mut retrieved_ticketbook: RetrievedTicketbook,
+    ) -> Result<CredentialSpendingData, BandwidthControllerError>
+    where
+        C: DkgQueryClient + Sync + Send,
+        <St as Storage>::StorageError: Send + Sync + 'static,
+    {
+        let epoch_id = retrieved_ticketbook.ticketbook.epoch_id();
+        let expiration_date = retrieved_ticketbook.ticketbook.expiration_date();
+        let mut api_clients = Default::default();
+
+        let verification_key = self
+            .get_aggregate_verification_key(epoch_id, &mut api_clients)
+            .await?;
+        let expiration_signatures = self
+            .get_expiration_date_signatures(epoch_id, expiration_date, &mut api_clients)
+            .await?;
+        let coin_indices_signatures = self
+            .get_coin_index_signatures(epoch_id, &mut api_clients)
+            .await?;
+
+        let pay_info = NymPayInfo::generate(provider_pk);
+
+        let spend_request = retrieved_ticketbook.ticketbook.prepare_for_spending(
+            &verification_key,
+            pay_info.into(),
+            &coin_indices_signatures,
+            &expiration_signatures,
+            tickets_to_spend as u64,
+        )?;
+        Ok(spend_request)
+    }
+
+    pub async fn prepare_ecash_ticket(
+        &self,
+        provider_pk: [u8; 32],
+        tickets_to_spend: u32,
    ) -> Result<PreparedCredential, BandwidthControllerError>
    where
        C: DkgQueryClient + Sync + Send,
        <St as Storage>::StorageError: Send + Sync + 'static,
    {
-        let retrieved_credential = self.get_next_usable_credential(gateway_id).await?;
+        let retrieved_ticketbook = self.get_next_usable_ticketbook(tickets_to_spend).await?;

-        let epoch_id = retrieved_credential.credential.epoch_id();
-        let credential_id = retrieved_credential.credential_id;
+        let ticketbook_id = retrieved_ticketbook.ticketbook_id;
+        let epoch_id = retrieved_ticketbook.ticketbook.epoch_id();

-        let verification_key = self.get_aggregate_verification_key(epoch_id).await?;
+        let used_tickets =
+            retrieved_ticketbook.ticketbook.spent_tickets() as u32 + tickets_to_spend;
+        let metadata = PreparedCredentialMetadata {
+            ticketbook_id,
+            tickets_withdrawn: tickets_to_spend,
+            used_tickets,
+        };

-        let spend_request = retrieved_credential
-            .credential
-            .prepare_for_spending(&verification_key)?;
-
-        Ok(PreparedCredential {
-            data: spend_request,
-            epoch_id,
-            credential_id,
-        })
-    }
-
-    pub async fn consume_credential(
-        &self,
-        id: i64,
-        gateway_id: &str,
-    ) -> Result<(), BandwidthControllerError>
-    where
-        <St as Storage>::StorageError: Send + Sync + 'static,
-    {
-        self.storage
-            .consume_coconut_credential(id, gateway_id)
+        match self
+            .prepare_ecash_ticket_inner(provider_pk, tickets_to_spend, retrieved_ticketbook)
            .await
-            .map_err(|err| BandwidthControllerError::CredentialStorageError(Box::new(err)))
+        {
+            Ok(data) => Ok(PreparedCredential {
+                data,
+                epoch_id,
+                metadata,
+            }),
+            Err(err) => {
+                error!("failed to prepare credential spending request. attempting to revert withdrawal...");
+                self.attempt_revert_ticket_usage(metadata).await?;
+                Err(err)
+            }
+        }
    }
 }

@@ -2,21 +2,180 @@
 // SPDX-License-Identifier: Apache-2.0

 use crate::error::BandwidthControllerError;
-use nym_credential_storage::models::StoredIssuedCredential;
-use nym_credentials::coconut::bandwidth::issued::CURRENT_SERIALIZATION_REVISION;
-use nym_credentials::coconut::bandwidth::IssuedBandwidthCredential;
+use log::warn;
+use nym_credential_storage::storage::Storage;
+use nym_credentials_interface::{
+    AnnotatedCoinIndexSignature, AnnotatedExpirationDateSignature, VerificationKeyAuth,
+};
+use nym_ecash_time::Date;
+use nym_validator_client::coconut::all_ecash_api_clients;
+use nym_validator_client::nym_api::EpochId;
+use nym_validator_client::nyxd::contract_traits::DkgQueryClient;
+use nym_validator_client::EcashApiClient;
+use rand::prelude::SliceRandom;
+use rand::thread_rng;
+use std::fmt::Display;
+use std::future::Future;

-pub fn stored_credential_to_issued_bandwidth(
-    cred: StoredIssuedCredential,
-) -> Result<IssuedBandwidthCredential, BandwidthControllerError> {
-    if cred.serialization_revision != CURRENT_SERIALIZATION_REVISION {
-        return Err(
-            BandwidthControllerError::UnsupportedCredentialStorageRevision {
-                stored: cred.serialization_revision,
-                expected: CURRENT_SERIALIZATION_REVISION,
-            },
-        );
+// it really doesn't need the RwLock because it's never moved across tasks,
+// but we need all the Send/Sync action
+#[derive(Default)]
+pub(crate) struct ApiClientsWrapper(Option<Vec<EcashApiClient>>);
+
+impl ApiClientsWrapper {
+    pub(crate) async fn get_or_init<C>(
+        &mut self,
+        epoch_id: EpochId,
+        dkg_client: &C,
+    ) -> Result<Vec<EcashApiClient>, BandwidthControllerError>
+    where
+        C: DkgQueryClient + Sync + Send,
+    {
+        if let Some(cached) = &self.0 {
+            return Ok(cached.clone());
+        }
+
+        let clients = all_ecash_api_clients(dkg_client, epoch_id).await?;
+
+        // technically we don't have to be cloning all the clients here, but it's way simpler than
+        // dealing with locking and whatnot given the performance penalty is negligible
+        self.0 = Some(clients.clone());
+        Ok(clients)
    }
-
-    Ok(IssuedBandwidthCredential::unpack_v1(&cred.credential_data)?)
+}
+
+pub(crate) async fn query_random_apis_until_success<F, T, U, E>(
+    mut apis: Vec<EcashApiClient>,
+    f: F,
+    typ: impl Into<String>,
+) -> Result<T, BandwidthControllerError>
+where
+    F: Fn(EcashApiClient) -> U,
+    U: Future<Output = Result<T, E>>,
+    E: Display,
+{
+    // try apis in pseudorandom way to remove any bias towards the first registered dealer
+    apis.shuffle(&mut thread_rng());
+
+    for api in apis {
+        let disp = api.to_string();
+        match f(api).await {
+            Ok(res) => return Ok(res),
+            Err(err) => {
+                warn!("failed to obtain valid response from API {disp}: {err}")
+            }
+        }
+    }
+    Err(BandwidthControllerError::ExhaustedApiQueries { typ: typ.into() })
+}
+
+pub(crate) async fn get_aggregate_verification_key<St>(
+    storage: &St,
+    epoch_id: EpochId,
+    ecash_apis: Vec<EcashApiClient>,
+) -> Result<VerificationKeyAuth, BandwidthControllerError>
+where
+    St: Storage,
+    <St as Storage>::StorageError: Send + Sync + 'static,
+{
+    if let Some(stored) = storage
+        .get_master_verification_key(epoch_id)
+        .await
+        .map_err(BandwidthControllerError::credential_storage_error)?
+    {
+        return Ok(stored);
+    };
+
+    let master_vk = query_random_apis_until_success(
+        ecash_apis,
+        |api| async move { api.api_client.master_verification_key(Some(epoch_id)).await },
+        format!("aggregated verification key for epoch {epoch_id}"),
+    )
+    .await?
+    .key;
+
+    // store the retrieved key
+    storage
+        .insert_master_verification_key(epoch_id, &master_vk)
+        .await
+        .map_err(BandwidthControllerError::credential_storage_error)?;
+
+    Ok(master_vk)
+}
+
+pub(crate) async fn get_coin_index_signatures<St>(
+    storage: &St,
+    epoch_id: EpochId,
+    ecash_apis: Vec<EcashApiClient>,
+) -> Result<Vec<AnnotatedCoinIndexSignature>, BandwidthControllerError>
+where
+    St: Storage,
+    <St as Storage>::StorageError: Send + Sync + 'static,
+{
+    if let Some(stored) = storage
+        .get_coin_index_signatures(epoch_id)
+        .await
+        .map_err(BandwidthControllerError::credential_storage_error)?
+    {
+        return Ok(stored);
+    };
+
+    let index_sigs = query_random_apis_until_success(
+        ecash_apis,
+        |api| async move {
+            api.api_client
+                .global_coin_indices_signatures(Some(epoch_id))
+                .await
+        },
+        format!("aggregated coin index signatures for epoch {epoch_id}"),
+    )
+    .await?
+    .signatures;
+
+    // store the retrieved key
+    storage
+        .insert_coin_index_signatures(epoch_id, &index_sigs)
+        .await
+        .map_err(BandwidthControllerError::credential_storage_error)?;
+
+    Ok(index_sigs)
+}
+
+pub(crate) async fn get_expiration_date_signatures<St>(
+    storage: &St,
+    epoch_id: EpochId,
+    expiration_date: Date,
+    ecash_apis: Vec<EcashApiClient>,
+) -> Result<Vec<AnnotatedExpirationDateSignature>, BandwidthControllerError>
+where
+    St: Storage,
+    <St as Storage>::StorageError: Send + Sync + 'static,
+{
+    if let Some(stored) = storage
+        .get_expiration_date_signatures(expiration_date)
+        .await
+        .map_err(BandwidthControllerError::credential_storage_error)?
+    {
+        return Ok(stored);
+    };
+
+    let expiration_sigs = query_random_apis_until_success(
+        ecash_apis,
+        |api| async move {
+            api.api_client
+                .global_expiration_date_signatures(Some(expiration_date))
+                .await
+        },
+        format!("aggregated coin index signatures for date {expiration_date}"),
+    )
+    .await?
+    .signatures;
+
+    // store the retrieved key
+    storage
+        .insert_expiration_date_signatures(epoch_id, expiration_date, &expiration_sigs)
+        .await
+        .map_err(BandwidthControllerError::credential_storage_error)?;
+
+    Ok(expiration_sigs)
 }
@@ -14,6 +14,7 @@ base64 = { workspace = true }
 bs58 = { workspace = true }
 cfg-if = { workspace = true }
 clap = { workspace = true, optional = true }
+comfy-table = { version = "7.1.1", optional = true }
 futures = { workspace = true }
 humantime-serde = { workspace = true }
 log = { workspace = true }
@@ -50,6 +51,7 @@ nym-network-defaults = { path = "../network-defaults" }
 nym-client-core-config-types = { path = "./config-types", features = ["disk-persistence"] }
 nym-client-core-surb-storage = { path = "./surb-storage" }
 nym-client-core-gateways-storage = { path = "./gateways-storage" }
+nym-ecash-time = { path = "../ecash-time" }

 ### For serving prometheus metrics
 [target."cfg(not(target_arch = \"wasm32\"))".dependencies.hyper]
@@ -112,7 +114,7 @@ tempfile = { workspace = true }

 [features]
 default = []
-cli = ["clap"]
+cli = ["clap", "comfy-table"]
 fs-surb-storage = ["nym-client-core-surb-storage/fs-surb-storage"]
 fs-gateways-storage = ["nym-client-core-gateways-storage/fs-gateways-storage"]
 wasm = ["nym-gateway-client/wasm"]
@@ -0,0 +1,129 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::cli_helpers::{CliClient, CliClientConfig};
+use crate::error::ClientCoreError;
+use nym_credential_storage::models::BasicTicketbookInformation;
+use nym_credential_storage::storage::Storage;
+use nym_ecash_time::ecash_today;
+use nym_network_defaults::TicketbookType::MixnetEntry;
+use serde::{Deserialize, Serialize};
+use time::Date;
+
+#[derive(Serialize, Deserialize)]
+pub struct AvailableTicketbook {
+    pub id: i64,
+    pub expiration: Date,
+    pub issued_tickets: u32,
+    pub claimed_tickets: u32,
+    pub ticket_size: u64,
+}
+
+impl AvailableTicketbook {
+    #[cfg(feature = "cli")]
+    fn table_row(&self) -> comfy_table::Row {
+        let ecash_today = ecash_today().date();
+
+        let issued = self.issued_tickets;
+        let si_issued = si_scale::helpers::bibytes2((issued as u64 * self.ticket_size) as f64);
+
+        let claimed = self.claimed_tickets;
+        let si_claimed = si_scale::helpers::bibytes2((claimed as u64 * self.ticket_size) as f64);
+
+        let remaining = issued - claimed;
+        let si_remaining =
+            si_scale::helpers::bibytes2((remaining as u64 * self.ticket_size) as f64);
+        let si_size = si_scale::helpers::bibytes2(self.ticket_size as f64);
+
+        let expiration = if self.expiration <= ecash_today {
+            comfy_table::Cell::new(format!("EXPIRED ON {}", self.expiration))
+                .fg(comfy_table::Color::Red)
+                .add_attribute(comfy_table::Attribute::Bold)
+        } else {
+            comfy_table::Cell::new(self.expiration.to_string())
+        };
+
+        vec![
+            comfy_table::Cell::new(self.id.to_string()),
+            expiration,
+            comfy_table::Cell::new(format!("{issued} ({si_issued})")),
+            comfy_table::Cell::new(format!("{claimed} ({si_claimed})")),
+            comfy_table::Cell::new(format!("{remaining} ({si_remaining})")),
+            comfy_table::Cell::new(si_size),
+        ]
+        .into()
+    }
+}
+
+impl From<BasicTicketbookInformation> for AvailableTicketbook {
+    fn from(value: BasicTicketbookInformation) -> Self {
+        AvailableTicketbook {
+            id: value.id,
+            expiration: value.expiration_date,
+            issued_tickets: value.total_tickets,
+            claimed_tickets: value.used_tickets,
+
+            // TODO: this will change when 'type' field is introduced; for now doesn't matter what we put there
+            ticket_size: MixnetEntry.bandwidth_value(),
+        }
+    }
+}
+
+#[derive(Serialize, Deserialize)]
+#[serde(transparent)]
+pub struct AvailableTicketbooks(Vec<AvailableTicketbook>);
+
+#[cfg(feature = "cli")]
+impl std::fmt::Display for AvailableTicketbooks {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        let mut table = comfy_table::Table::new();
+        table.set_header(vec![
+            "id",
+            "expiration",
+            "issued tickets (bandwidth)",
+            "claimed tickets (bandwidth)",
+            "remaining tickets (bandwidth)",
+            "ticket size",
+        ]);
+
+        for ticketbook in &self.0 {
+            table.add_row(ticketbook.table_row());
+        }
+
+        writeln!(f, "{table}")?;
+        Ok(())
+    }
+}
+
+#[cfg_attr(feature = "cli", derive(clap::Args))]
+#[derive(Debug, Clone)]
+pub struct CommonShowTicketbooksArgs {
+    /// Id of client that is going to display the ticketbook information
+    #[cfg_attr(feature = "cli", clap(long))]
+    pub id: String,
+}
+
+pub async fn show_ticketbooks<C, A>(args: A) -> Result<AvailableTicketbooks, C::Error>
+where
+    A: AsRef<CommonShowTicketbooksArgs>,
+    C: CliClient,
+{
+    let common_args = args.as_ref();
+    let id = &common_args.id;
+
+    let config = C::try_load_current_config(id).await?;
+    let paths = config.common_paths();
+
+    let credentials_store =
+        nym_credential_storage::initialise_persistent_storage(&paths.credentials_database).await;
+    let ticketbooks = credentials_store
+        .get_ticketbooks_info()
+        .await
+        .map_err(|err| ClientCoreError::CredentialStoreError {
+            source: Box::new(err),
+        })?;
+
+    Ok(AvailableTicketbooks(
+        ticketbooks.into_iter().map(Into::into).collect(),
+    ))
+}
@@ -6,6 +6,7 @@ pub mod client_import_credential;
 pub mod client_init;
 pub mod client_list_gateways;
 pub mod client_run;
+pub mod client_show_ticketbooks;
 pub mod client_switch_gateway;
 pub mod traits;
 mod types;
@@ -40,6 +40,7 @@ use nym_bandwidth_controller::BandwidthController;
 use nym_client_core_gateways_storage::{GatewayDetails, GatewaysDetailsStore};
 use nym_credential_storage::storage::Storage as CredentialStorage;
 use nym_crypto::asymmetric::{encryption, identity};
+use nym_gateway_client::client::config::GatewayClientConfig;
 use nym_gateway_client::{
    AcknowledgementReceiver, GatewayClient, GatewayConfig, MixnetMessageReceiver, PacketRouter,
 };
@@ -403,6 +404,11 @@ where
                gateway_listener,
            );
            GatewayClient::new(
+                GatewayClientConfig::new_default()
+                    .with_disabled_credentials_mode(config.client.disabled_credentials_mode)
+                    .with_response_timeout(
+                        config.debug.gateway_connection.gateway_response_timeout,
+                    ),
                cfg,
                managed_keys.identity_keypair(),
                Some(details.derived_aes128_ctr_blake3_hmac_keys),
@@ -410,8 +416,6 @@ where
                bandwidth_controller,
                shutdown,
            )
-            .with_disabled_credentials_mode(config.client.disabled_credentials_mode)
-            .with_response_timeout(config.debug.gateway_connection.gateway_response_timeout)
        };

        gateway_client
@@ -3,10 +3,12 @@

 use async_trait::async_trait;
 use log::{debug, error};
+use nym_credential_storage::storage::Storage as CredentialStorage;
 use nym_crypto::asymmetric::identity;
 use nym_gateway_client::GatewayClient;
 pub use nym_gateway_client::{GatewayPacketRouter, PacketRouter};
 use nym_sphinx::forwarding::packet::MixPacket;
+use nym_validator_client::nyxd::contract_traits::DkgQueryClient;
 use std::fmt::Debug;
 use std::os::raw::c_int as RawFd;
 use thiserror::Error;
@@ -111,8 +113,9 @@ impl<C, St> RemoteGateway<C, St> {

 impl<C, St> GatewayTransceiver for RemoteGateway<C, St>
 where
-    C: Send,
-    St: Send,
+    C: DkgQueryClient + Send + Sync,
+    St: CredentialStorage,
+    <St as CredentialStorage>::StorageError: Send + Sync + 'static,
 {
    fn gateway_identity(&self) -> identity::PublicKey {
        self.gateway_client.gateway_identity()
@@ -126,8 +129,9 @@ where
 #[cfg_attr(not(target_arch = "wasm32"), async_trait)]
 impl<C, St> GatewaySender for RemoteGateway<C, St>
 where
-    C: Send,
-    St: Send,
+    C: DkgQueryClient + Send + Sync,
+    St: CredentialStorage,
+    <St as CredentialStorage>::StorageError: Send + Sync + 'static,
 {
    async fn send_mix_packet(&mut self, packet: MixPacket) -> Result<(), ErasedGatewayError> {
        self.gateway_client
@@ -63,6 +63,11 @@ pub enum ClientCoreError {
        source: Box<dyn Error + Send + Sync>,
    },

+    #[error("experienced a failure with our credentials storage: {source}")]
+    CredentialStoreError {
+        source: Box<dyn Error + Send + Sync>,
+    },
+
    #[error("the gateway id is invalid - {0}")]
    UnableToCreatePublicKeyFromGatewayId(Ed25519RecoveryError),

@@ -0,0 +1,89 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use si_scale::helpers::bibytes2;
+use std::sync::atomic::{AtomicI64, Ordering};
+use std::sync::Arc;
+use std::time::Duration;
+use time::OffsetDateTime;
+
+#[derive(Clone, Default)]
+pub struct ClientBandwidth {
+    inner: Arc<ClientBandwidthInner>,
+}
+
+#[derive(Default)]
+struct ClientBandwidthInner {
+    /// the actual bandwidth amount (in bytes) available
+    available: AtomicI64,
+
+    /// defines the timestamp when the bandwidth information has been logged to the logs stream
+    last_logged_ts: AtomicI64,
+
+    /// defines the timestamp when the bandwidth value was last updated
+    last_updated_ts: AtomicI64,
+}
+
+impl ClientBandwidth {
+    pub(crate) fn new_empty() -> Self {
+        ClientBandwidth {
+            inner: Arc::new(ClientBandwidthInner {
+                available: AtomicI64::new(0),
+                last_logged_ts: AtomicI64::new(0),
+                last_updated_ts: AtomicI64::new(0),
+            }),
+        }
+    }
+    pub(crate) fn remaining(&self) -> i64 {
+        self.inner.available.load(Ordering::Acquire)
+    }
+
+    pub(crate) fn maybe_log_bandwidth(&self, now: Option<OffsetDateTime>) {
+        let last = self.last_logged();
+        let now = now.unwrap_or_else(OffsetDateTime::now_utc);
+        if last + Duration::from_secs(10) < now {
+            self.log_bandwidth(Some(now))
+        }
+    }
+
+    pub(crate) fn log_bandwidth(&self, now: Option<OffsetDateTime>) {
+        let now = now.unwrap_or_else(OffsetDateTime::now_utc);
+
+        let remaining = self.remaining();
+        let remaining_bi2 = bibytes2(remaining as f64);
+
+        if remaining < 0 {
+            log::warn!("OUT OF BANDWIDTH. remaining: {remaining_bi2}");
+        } else {
+            log::info!("remaining bandwidth: {remaining_bi2}");
+        }
+
+        self.inner
+            .last_logged_ts
+            .store(now.unix_timestamp(), Ordering::Relaxed)
+    }
+
+    pub(crate) fn update_and_maybe_log(&self, remaining: i64) {
+        let now = OffsetDateTime::now_utc();
+        self.inner.available.store(remaining, Ordering::Release);
+        self.inner
+            .last_updated_ts
+            .store(now.unix_timestamp(), Ordering::Relaxed);
+        self.maybe_log_bandwidth(Some(now))
+    }
+
+    pub(crate) fn update_and_log(&self, remaining: i64) {
+        let now = OffsetDateTime::now_utc();
+        self.inner.available.store(remaining, Ordering::Release);
+        self.inner
+            .last_updated_ts
+            .store(now.unix_timestamp(), Ordering::Relaxed);
+        self.log_bandwidth(Some(now))
+    }
+
+    fn last_logged(&self) -> OffsetDateTime {
+        // SAFETY: this value is always populated with valid timestamps
+        OffsetDateTime::from_unix_timestamp(self.inner.last_logged_ts.load(Ordering::Relaxed))
+            .unwrap()
+    }
+}
@@ -0,0 +1,135 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::error::GatewayClientError;
+use nym_network_defaults::TicketbookType::MixnetEntry;
+use si_scale::helpers::bibytes2;
+use std::time::Duration;
+
+#[derive(Debug, Default, Clone, Copy)]
+pub struct GatewayClientConfig {
+    pub connection: Connection,
+    pub bandwidth: BandwidthTickets,
+}
+
+impl GatewayClientConfig {
+    pub fn new_default() -> Self {
+        Default::default()
+    }
+
+    #[must_use]
+    pub fn with_disabled_credentials_mode(mut self, disabled_credentials_mode: bool) -> Self {
+        self.bandwidth.require_tickets = !disabled_credentials_mode;
+        self
+    }
+
+    #[must_use]
+    pub fn with_reconnection_on_failure(mut self, should_reconnect_on_failure: bool) -> Self {
+        self.connection.should_reconnect_on_failure = should_reconnect_on_failure;
+        self
+    }
+
+    #[must_use]
+    pub fn with_response_timeout(mut self, response_timeout_duration: Duration) -> Self {
+        self.connection.response_timeout_duration = response_timeout_duration;
+        self
+    }
+
+    #[must_use]
+    pub fn with_reconnection_attempts(mut self, reconnection_attempts: usize) -> Self {
+        self.connection.reconnection_attempts = reconnection_attempts;
+        self
+    }
+
+    #[must_use]
+    pub fn with_reconnection_backoff(mut self, backoff: Duration) -> Self {
+        self.connection.reconnection_backoff = backoff;
+        self
+    }
+}
+
+#[derive(Debug, Clone, Copy)]
+pub struct Connection {
+    /// Specifies the timeout for gateway responses
+    pub response_timeout_duration: Duration,
+
+    /// Specifies whether client should try to reconnect to gateway on connection failure.
+    pub should_reconnect_on_failure: bool,
+
+    /// Specifies maximum number of attempts client will try to reconnect to gateway on failure
+    /// before giving up.
+    pub reconnection_attempts: usize,
+
+    /// Delay between each subsequent reconnection attempt.
+    pub reconnection_backoff: Duration,
+}
+
+impl Connection {
+    // Set this to a high value for now, so that we don't risk sporadic timeouts that might cause
+    // bought bandwidth tokens to not have time to be spent; Once we remove the gateway from the
+    // bandwidth bridging protocol, we can come back to a smaller timeout value
+    pub const DEFAULT_RESPONSE_TIMEOUT: Duration = Duration::from_secs(5 * 60);
+    pub const DEFAULT_RECONNECTION_ATTEMPTS: usize = 10;
+    pub const DEFAULT_RECONNECTION_BACKOFF: Duration = Duration::from_secs(5);
+}
+
+impl Default for Connection {
+    fn default() -> Self {
+        Connection {
+            response_timeout_duration: Self::DEFAULT_RESPONSE_TIMEOUT,
+            should_reconnect_on_failure: true,
+            reconnection_attempts: Self::DEFAULT_RECONNECTION_ATTEMPTS,
+            reconnection_backoff: Self::DEFAULT_RECONNECTION_BACKOFF,
+        }
+    }
+}
+
+#[derive(Debug, Clone, Copy)]
+pub struct BandwidthTickets {
+    /// specifies whether this client will be sending bandwidth tickets or will attempt to use 'free' testnet bandwidth instead
+    pub require_tickets: bool,
+
+    /// specifies threshold (in bytes) under which the client should send another ticket to the gateway
+    pub remaining_bandwidth_threshold: i64,
+
+    /// specifies threshold (in bytes) under which the client will NOT send any tickets because it got accused of double spending and got its bandwidth revoked
+    /// if not specified, the client will always send tickets
+    pub cutoff_remaining_bandwidth_threshold: Option<i64>,
+}
+
+impl BandwidthTickets {
+    // TO BE CHANGED \/
+    pub const DEFAULT_REQUIRES_TICKETS: bool = false;
+
+    // 20% of entry ticket value
+    pub const DEFAULT_REMAINING_BANDWIDTH_THRESHOLD: i64 =
+        (MixnetEntry.bandwidth_value() / 5) as i64;
+
+    pub const DEFAULT_CUTOFF_REMAINING_BANDWIDTH_THRESHOLD: Option<i64> = None;
+
+    pub fn ensure_above_cutoff(&self, available: i64) -> Result<(), GatewayClientError> {
+        if let Some(cutoff) = self.cutoff_remaining_bandwidth_threshold {
+            if available < cutoff {
+                let available_bi2 = bibytes2(available as f64);
+                let cutoff_bi2 = bibytes2(cutoff as f64);
+                return Err(GatewayClientError::BandwidthBelowCutoffValue {
+                    available_bi2,
+                    cutoff_bi2,
+                });
+            }
+        }
+
+        Ok(())
+    }
+}
+
+impl Default for BandwidthTickets {
+    fn default() -> Self {
+        BandwidthTickets {
+            require_tickets: Self::DEFAULT_REQUIRES_TICKETS,
+            remaining_bandwidth_threshold: Self::DEFAULT_REMAINING_BANDWIDTH_THRESHOLD,
+            cutoff_remaining_bandwidth_threshold:
+                Self::DEFAULT_CUTOFF_REMAINING_BANDWIDTH_THRESHOLD,
+        }
+    }
+}
@@ -1,17 +1,18 @@
 // Copyright 2021-2024 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0
-
+use crate::bandwidth::ClientBandwidth;
+use crate::client::config::GatewayClientConfig;
 use crate::error::GatewayClientError;
 use crate::packet_router::PacketRouter;
 pub use crate::packet_router::{
    AcknowledgementReceiver, AcknowledgementSender, MixnetMessageReceiver, MixnetMessageSender,
 };
-use crate::socket_state::{ws_fd, PartiallyDelegated, SocketState};
+use crate::socket_state::{ws_fd, PartiallyDelegatedHandle, SocketState};
 use crate::traits::GatewayPacketRouter;
 use crate::{cleanup_socket_message, try_decrypt_binary_message};
 use futures::{SinkExt, StreamExt};
 use log::*;
-use nym_bandwidth_controller::BandwidthController;
+use nym_bandwidth_controller::{BandwidthController, BandwidthStatusMessage};
 use nym_credential_storage::ephemeral_storage::EphemeralStorage as EphemeralCredentialStorage;
 use nym_credential_storage::storage::Storage as CredentialStorage;
 use nym_credentials::CredentialSpendingData;
@@ -23,14 +24,11 @@ use nym_gateway_requests::{
    BinaryRequest, ClientControlRequest, ServerResponse, CREDENTIAL_UPDATE_V2_PROTOCOL_VERSION,
    CURRENT_PROTOCOL_VERSION,
 };
-use nym_network_defaults::{REMAINING_BANDWIDTH_THRESHOLD, TOKENS_TO_BURN};
 use nym_sphinx::forwarding::packet::MixPacket;
 use nym_task::TaskClient;
 use nym_validator_client::nyxd::contract_traits::DkgQueryClient;
 use rand::rngs::OsRng;
-
 use std::sync::Arc;
-use std::time::Duration;
 use tungstenite::protocol::Message;
 use url::Url;

@@ -48,12 +46,7 @@ use wasm_utils::websocket::JSWebsocket;
 #[cfg(target_arch = "wasm32")]
 use wasmtimer::tokio::sleep;

-// Set this to a high value for now, so that we don't risk sporadic timeouts that might cause
-// bought bandwidth tokens to not have time to be spent; Once we remove the gateway from the
-// bandwidth bridging protocol, we can come back to a smaller timeout value
-const DEFAULT_GATEWAY_RESPONSE_TIMEOUT: Duration = Duration::from_secs(5 * 60);
-const DEFAULT_RECONNECTION_ATTEMPTS: usize = 10;
-const DEFAULT_RECONNECTION_BACKOFF: Duration = Duration::from_secs(5);
+pub mod config;

 pub struct GatewayConfig {
    pub gateway_identity: identity::PublicKey,
@@ -79,96 +72,53 @@ impl GatewayConfig {
 }

 // TODO: this should be refactored into a state machine that keeps track of its authentication state
-#[derive(Debug)]
 pub struct GatewayClient<C, St = EphemeralCredentialStorage> {
+    pub cfg: GatewayClientConfig,
+
    authenticated: bool,
-    disabled_credentials_mode: bool,
-    bandwidth_remaining: i64,
+    bandwidth: ClientBandwidth,
    gateway_address: String,
    gateway_identity: identity::PublicKey,
    local_identity: Arc<identity::KeyPair>,
    shared_key: Option<Arc<SharedKeys>>,
    connection: SocketState,
    packet_router: PacketRouter,
-    response_timeout_duration: Duration,
    bandwidth_controller: Option<BandwidthController<C, St>>,

-    // reconnection related variables
-    /// Specifies whether client should try to reconnect to gateway on connection failure.
-    should_reconnect_on_failure: bool,
-    /// Specifies maximum number of attempts client will try to reconnect to gateway on failure
-    /// before giving up.
-    reconnection_attempts: usize,
-    /// Delay between each subsequent reconnection attempt.
-    reconnection_backoff: Duration,
-
    // currently unused (but populated)
    negotiated_protocol: Option<u8>,

-    /// Listen to shutdown messages.
-    shutdown: TaskClient,
+    /// Listen to shutdown messages and send notifications back to the task manager
+    task_client: TaskClient,
 }

 impl<C, St> GatewayClient<C, St> {
    pub fn new(
-        config: GatewayConfig,
+        cfg: GatewayClientConfig,
+        gateway_config: GatewayConfig,
        local_identity: Arc<identity::KeyPair>,
        // TODO: make it mandatory. if you don't want to pass it, use `new_init`
        shared_key: Option<Arc<SharedKeys>>,
        packet_router: PacketRouter,
        bandwidth_controller: Option<BandwidthController<C, St>>,
-        shutdown: TaskClient,
+        task_client: TaskClient,
    ) -> Self {
        GatewayClient {
+            cfg,
            authenticated: false,
-            disabled_credentials_mode: true,
-            bandwidth_remaining: 0,
-            gateway_address: config.gateway_listener,
-            gateway_identity: config.gateway_identity,
+            bandwidth: ClientBandwidth::new_empty(),
+            gateway_address: gateway_config.gateway_listener,
+            gateway_identity: gateway_config.gateway_identity,
            local_identity,
            shared_key,
            connection: SocketState::NotConnected,
            packet_router,
-            response_timeout_duration: DEFAULT_GATEWAY_RESPONSE_TIMEOUT,
            bandwidth_controller,
-            should_reconnect_on_failure: true,
-            reconnection_attempts: DEFAULT_RECONNECTION_ATTEMPTS,
-            reconnection_backoff: DEFAULT_RECONNECTION_BACKOFF,
            negotiated_protocol: None,
-            shutdown,
+            task_client,
        }
    }

-    #[must_use]
-    pub fn with_disabled_credentials_mode(mut self, disabled_credentials_mode: bool) -> Self {
-        self.disabled_credentials_mode = disabled_credentials_mode;
-        self
-    }
-
-    #[must_use]
-    pub fn with_reconnection_on_failure(mut self, should_reconnect_on_failure: bool) -> Self {
-        self.should_reconnect_on_failure = should_reconnect_on_failure;
-        self
-    }
-
-    #[must_use]
-    pub fn with_response_timeout(mut self, response_timeout_duration: Duration) -> Self {
-        self.response_timeout_duration = response_timeout_duration;
-        self
-    }
-
-    #[must_use]
-    pub fn with_reconnection_attempts(mut self, reconnection_attempts: usize) -> Self {
-        self.reconnection_attempts = reconnection_attempts;
-        self
-    }
-
-    #[must_use]
-    pub fn with_reconnection_backoff(mut self, backoff: Duration) -> Self {
-        self.reconnection_backoff = backoff;
-        self
-    }
-
    pub fn gateway_identity(&self) -> identity::PublicKey {
        self.gateway_identity
    }
@@ -182,7 +132,7 @@ impl<C, St> GatewayClient<C, St> {
    }

    pub fn remaining_bandwidth(&self) -> i64 {
-        self.bandwidth_remaining
+        self.bandwidth.remaining()
    }

    #[cfg(not(target_arch = "wasm32"))]
@@ -258,18 +208,21 @@ impl<C, St> GatewayClient<C, St> {
        info!("Attempting gateway reconnection...");
        self.authenticated = false;

-        for i in 1..self.reconnection_attempts {
-            info!("attempt {}...", i);
+        for i in 1..self.cfg.connection.reconnection_attempts {
+            info!("reconnection attempt {}...", i);
            if self.try_reconnect().await.is_ok() {
                info!("managed to reconnect!");
                return Ok(());
            }

-            sleep(self.reconnection_backoff).await;
+            sleep(self.cfg.connection.reconnection_backoff).await;
        }

        // final attempt (done separately to be able to return a proper error)
-        info!("attempt {}", self.reconnection_attempts);
+        info!(
+            "reconnection attempt {}",
+            self.cfg.connection.reconnection_attempts
+        );
        match self.try_reconnect().await {
            Ok(_) => {
                info!("managed to reconnect!");
@@ -278,7 +231,7 @@ impl<C, St> GatewayClient<C, St> {
            Err(err) => {
                error!(
                    "failed to reconnect after {} attempts",
-                    self.reconnection_attempts
+                    self.cfg.connection.reconnection_attempts
                );
                Err(err)
            }
@@ -294,12 +247,12 @@ impl<C, St> GatewayClient<C, St> {
            _ => return Err(GatewayClientError::ConnectionInInvalidState),
        };

-        let timeout = sleep(self.response_timeout_duration);
+        let timeout = sleep(self.cfg.connection.response_timeout_duration);
        tokio::pin!(timeout);

        loop {
            tokio::select! {
-                _ = self.shutdown.recv() => {
+                _ = self.task_client.recv() => {
                    log::trace!("GatewayClient control response: Received shutdown");
                    log::debug!("GatewayClient control response: Exiting");
                    break Err(GatewayClientError::ConnectionClosedGatewayShutdown);
@@ -463,7 +416,7 @@ impl<C, St> GatewayClient<C, St> {
                ws_stream,
                self.local_identity.as_ref(),
                self.gateway_identity,
-                !self.disabled_credentials_mode,
+                self.cfg.bandwidth.require_tickets,
            )
            .await
            .map_err(GatewayClientError::RegistrationFailure),
@@ -525,7 +478,7 @@ impl<C, St> GatewayClient<C, St> {
            self_address,
            encrypted_address,
            iv,
-            !self.disabled_credentials_mode,
+            self.cfg.bandwidth.require_tickets,
        )
        .into();

@@ -537,9 +490,13 @@ impl<C, St> GatewayClient<C, St> {
            } => {
                self.check_gateway_protocol(protocol_version)?;
                self.authenticated = status;
-                self.bandwidth_remaining = bandwidth_remaining;
+                self.bandwidth.update_and_maybe_log(bandwidth_remaining);
+
                self.negotiated_protocol = protocol_version;
                log::debug!("authenticated: {status}, bandwidth remaining: {bandwidth_remaining}");
+                self.task_client.send_status_msg(Box::new(
+                    BandwidthStatusMessage::RemainingBandwidth(bandwidth_remaining),
+                ));
                Ok(())
            }
            ServerResponse::Error { message } => Err(GatewayClientError::GatewayError(message)),
@@ -573,56 +530,74 @@ impl<C, St> GatewayClient<C, St> {
        }
    }

-    async fn claim_coconut_bandwidth(
+    async fn claim_ecash_bandwidth(
        &mut self,
        credential: CredentialSpendingData,
    ) -> Result<(), GatewayClientError> {
        let mut rng = OsRng;
        let iv = IV::new_random(&mut rng);

-        let msg = ClientControlRequest::new_enc_coconut_bandwidth_credential_v2(
+        let msg = ClientControlRequest::new_enc_ecash_credential(
            credential,
            self.shared_key.as_ref().unwrap(),
            iv,
        )
        .into();
-        self.bandwidth_remaining = match self.send_websocket_message(msg).await? {
+        let bandwidth_remaining = match self.send_websocket_message(msg).await? {
            ServerResponse::Bandwidth { available_total } => Ok(available_total),
            ServerResponse::Error { message } => Err(GatewayClientError::GatewayError(message)),
+            ServerResponse::TypedError { error } => {
+                Err(GatewayClientError::TypedGatewayError(error))
+            }
            _ => Err(GatewayClientError::UnexpectedResponse),
        }?;
+
+        // TODO: create tracing span
+        info!("managed to claim ecash bandwidth");
+        self.bandwidth.update_and_log(bandwidth_remaining);
+
        Ok(())
    }

    async fn try_claim_testnet_bandwidth(&mut self) -> Result<(), GatewayClientError> {
        let msg = ClientControlRequest::ClaimFreeTestnetBandwidth.into();
-        self.bandwidth_remaining = match self.send_websocket_message(msg).await? {
+        let bandwidth_remaining = match self.send_websocket_message(msg).await? {
            ServerResponse::Bandwidth { available_total } => Ok(available_total),
            ServerResponse::Error { message } => Err(GatewayClientError::GatewayError(message)),
            _ => Err(GatewayClientError::UnexpectedResponse),
        }?;

+        info!("managed to claim testnet bandwidth");
+        self.bandwidth.update_and_log(bandwidth_remaining);
+
        Ok(())
    }

+    fn unchecked_bandwidth_controller(&self) -> &BandwidthController<C, St> {
+        self.bandwidth_controller.as_ref().unwrap()
+    }
+
    pub async fn claim_bandwidth(&mut self) -> Result<(), GatewayClientError>
    where
        C: DkgQueryClient + Send + Sync,
        St: CredentialStorage,
        <St as CredentialStorage>::StorageError: Send + Sync + 'static,
    {
+        // TODO: make it configurable
+        const TICKETS_TO_SPEND: u32 = 1;
+
        if !self.authenticated {
            return Err(GatewayClientError::NotAuthenticated);
        }
        if self.shared_key.is_none() {
            return Err(GatewayClientError::NoSharedKeyAvailable);
        }
-        if self.bandwidth_controller.is_none() && !self.disabled_credentials_mode {
+        if self.bandwidth_controller.is_none() && self.cfg.bandwidth.require_tickets {
            return Err(GatewayClientError::NoBandwidthControllerAvailable);
        }

        warn!("Not enough bandwidth. Trying to get more bandwidth, this might take a while");
-        if self.disabled_credentials_mode {
+        if !self.cfg.bandwidth.require_tickets {
            info!("The client is running in disabled credentials mode - attempting to claim bandwidth without a credential");
            return self.try_claim_testnet_bandwidth().await;
        }
@@ -638,49 +613,52 @@ impl<C, St> GatewayClient<C, St> {
                negotiated_protocol: Some(gateway_protocol),
            });
        }
-
-        let gateway_id = self.gateway_identity().to_base58_string();
-
        let prepared_credential = self
-            .bandwidth_controller
-            .as_ref()
-            .unwrap()
-            .prepare_bandwidth_credential(&gateway_id)
+            .unchecked_bandwidth_controller()
+            .prepare_ecash_ticket(self.gateway_identity.to_bytes(), TICKETS_TO_SPEND)
            .await?;

-        self.claim_coconut_bandwidth(prepared_credential.data)
-            .await?;
-        self.bandwidth_controller
-            .as_ref()
-            .unwrap()
-            .consume_credential(prepared_credential.credential_id, &gateway_id)
-            .await?;
+        match self.claim_ecash_bandwidth(prepared_credential.data).await {
+            Ok(_) => Ok(()),
+            Err(err) => {
+                error!("failed to claim ecash bandwidth with the gateway...: {err}");
+                if err.is_ticket_replay() {
+                    warn!("this was due to our ticket being replayed! have you messed with the database file?")
+                } else {
+                    // TODO: tracing span
+                    info!("attempting to revert ticket withdrawal...");
+                    self.unchecked_bandwidth_controller()
+                        .attempt_revert_ticket_usage(prepared_credential.metadata)
+                        .await?;
+                }

-        Ok(())
-    }
-
-    fn estimate_required_bandwidth(&self, packets: &[MixPacket]) -> i64 {
-        packets
-            .iter()
-            .map(|packet| packet.packet().len())
-            .sum::<usize>() as i64
+                Err(err)
+            }
+        }
    }

    pub async fn batch_send_mix_packets(
        &mut self,
        packets: Vec<MixPacket>,
-    ) -> Result<(), GatewayClientError> {
+    ) -> Result<(), GatewayClientError>
+    where
+        C: DkgQueryClient + Send + Sync,
+        St: CredentialStorage,
+        <St as CredentialStorage>::StorageError: Send + Sync + 'static,
+    {
        debug!("Sending {} mix packets", packets.len());

        if !self.authenticated {
            return Err(GatewayClientError::NotAuthenticated);
        }
-        if self.estimate_required_bandwidth(&packets) > self.bandwidth_remaining {
-            return Err(GatewayClientError::NotEnoughBandwidth(
-                self.estimate_required_bandwidth(&packets),
-                self.bandwidth_remaining,
-            ));
+        let bandwidth_remaining = self.bandwidth.remaining();
+        if bandwidth_remaining < self.cfg.bandwidth.remaining_bandwidth_threshold {
+            self.cfg
+                .bandwidth
+                .ensure_above_cutoff(bandwidth_remaining)?;
+            self.claim_bandwidth().await?;
        }
+
        if !self.connection.is_established() {
            return Err(GatewayClientError::ConnectionNotEstablished);
        }
@@ -700,7 +678,7 @@ impl<C, St> GatewayClient<C, St> {
            .batch_send_websocket_messages_without_response(messages)
            .await
        {
-            if err.is_closed_connection() && self.should_reconnect_on_failure {
+            if err.is_closed_connection() && self.cfg.connection.should_reconnect_on_failure {
                self.attempt_reconnection().await
            } else {
                Err(err)
@@ -715,7 +693,7 @@ impl<C, St> GatewayClient<C, St> {
        msg: Message,
    ) -> Result<(), GatewayClientError> {
        if let Err(err) = self.send_websocket_message_without_response(msg).await {
-            if err.is_closed_connection() && self.should_reconnect_on_failure {
+            if err.is_closed_connection() && self.cfg.connection.should_reconnect_on_failure {
                debug!("Going to attempt a reconnection");
                self.attempt_reconnection().await
            } else {
@@ -739,19 +717,23 @@ impl<C, St> GatewayClient<C, St> {
    }

    // TODO: possibly make responses optional
-    pub async fn send_mix_packet(
-        &mut self,
-        mix_packet: MixPacket,
-    ) -> Result<(), GatewayClientError> {
+    pub async fn send_mix_packet(&mut self, mix_packet: MixPacket) -> Result<(), GatewayClientError>
+    where
+        C: DkgQueryClient + Send + Sync,
+        St: CredentialStorage,
+        <St as CredentialStorage>::StorageError: Send + Sync + 'static,
+    {
        if !self.authenticated {
            return Err(GatewayClientError::NotAuthenticated);
        }
-        if (mix_packet.packet().len() as i64) > self.bandwidth_remaining {
-            return Err(GatewayClientError::NotEnoughBandwidth(
-                mix_packet.packet().len() as i64,
-                self.bandwidth_remaining,
-            ));
+        let bandwidth_remaining = self.bandwidth.remaining();
+        if bandwidth_remaining < self.cfg.bandwidth.remaining_bandwidth_threshold {
+            self.cfg
+                .bandwidth
+                .ensure_above_cutoff(bandwidth_remaining)?;
+            self.claim_bandwidth().await?;
        }
+
        if !self.connection.is_established() {
            return Err(GatewayClientError::ConnectionNotEstablished);
        }
@@ -797,7 +779,7 @@ impl<C, St> GatewayClient<C, St> {
        let partially_delegated =
            match std::mem::replace(&mut self.connection, SocketState::Invalid) {
                SocketState::Available(conn) => {
-                    PartiallyDelegated::split_and_listen_for_mixnet_messages(
+                    PartiallyDelegatedHandle::split_and_listen_for_mixnet_messages(
                        *conn,
                        self.packet_router.clone(),
                        Arc::clone(
@@ -805,7 +787,8 @@ impl<C, St> GatewayClient<C, St> {
                                .as_ref()
                                .expect("no shared key present even though we're authenticated!"),
                        ),
-                        self.shutdown.clone(),
+                        self.bandwidth.clone(),
+                        self.task_client.clone(),
                    )
                }
                _ => unreachable!(),
@@ -845,10 +828,12 @@ impl<C, St> GatewayClient<C, St> {
            self.establish_connection().await?;
        }
        let shared_key = self.perform_initial_authentication().await?;
-
-        if self.bandwidth_remaining < REMAINING_BANDWIDTH_THRESHOLD {
-            info!("Claiming more bandwidth for your tokens. This will use {} token(s) from your wallet. \
-            Stop the process now if you don't want that to happen.", TOKENS_TO_BURN);
+        let bandwidth_remaining = self.bandwidth.remaining();
+        if bandwidth_remaining < self.cfg.bandwidth.remaining_bandwidth_threshold {
+            self.cfg
+                .bandwidth
+                .ensure_above_cutoff(bandwidth_remaining)?;
+            info!("Claiming more bandwidth with existing credentials. Stop the process now if you don't want that to happen.");
            self.claim_bandwidth().await?;
        }

@@ -879,26 +864,22 @@ impl GatewayClient<InitOnly, EphemeralCredentialStorage> {
        // perfectly fine here, because it's not meant to be used
        let (ack_tx, _) = mpsc::unbounded();
        let (mix_tx, _) = mpsc::unbounded();
-        let shutdown = TaskClient::dummy();
-        let packet_router = PacketRouter::new(ack_tx, mix_tx, shutdown.clone());
+        let task_client = TaskClient::dummy();
+        let packet_router = PacketRouter::new(ack_tx, mix_tx, task_client.clone());

        GatewayClient {
+            cfg: GatewayClientConfig::default().with_disabled_credentials_mode(true),
            authenticated: false,
-            disabled_credentials_mode: true,
-            bandwidth_remaining: 0,
+            bandwidth: ClientBandwidth::new_empty(),
            gateway_address: gateway_listener.to_string(),
            gateway_identity,
            local_identity,
            shared_key: None,
            connection: SocketState::NotConnected,
            packet_router,
-            response_timeout_duration: DEFAULT_GATEWAY_RESPONSE_TIMEOUT,
            bandwidth_controller: None,
-            should_reconnect_on_failure: false,
-            reconnection_attempts: DEFAULT_RECONNECTION_ATTEMPTS,
-            reconnection_backoff: DEFAULT_RECONNECTION_BACKOFF,
            negotiated_protocol: None,
-            shutdown,
+            task_client,
        }
    }

@@ -906,7 +887,7 @@ impl GatewayClient<InitOnly, EphemeralCredentialStorage> {
        self,
        packet_router: PacketRouter,
        bandwidth_controller: Option<BandwidthController<C, St>>,
-        shutdown: TaskClient,
+        task_client: TaskClient,
    ) -> GatewayClient<C, St> {
        // invariants that can't be broken
        // (unless somebody decided to expose some field that wasn't meant to be exposed)
@@ -915,22 +896,18 @@ impl GatewayClient<InitOnly, EphemeralCredentialStorage> {
        assert!(self.shared_key.is_some());

        GatewayClient {
+            cfg: self.cfg,
            authenticated: self.authenticated,
-            disabled_credentials_mode: self.disabled_credentials_mode,
-            bandwidth_remaining: self.bandwidth_remaining,
+            bandwidth: self.bandwidth,
            gateway_address: self.gateway_address,
            gateway_identity: self.gateway_identity,
            local_identity: self.local_identity,
            shared_key: self.shared_key,
            connection: self.connection,
            packet_router,
-            response_timeout_duration: self.response_timeout_duration,
            bandwidth_controller,
-            should_reconnect_on_failure: self.should_reconnect_on_failure,
-            reconnection_attempts: self.reconnection_attempts,
-            reconnection_backoff: self.reconnection_backoff,
            negotiated_protocol: self.negotiated_protocol,
-            shutdown,
+            task_client,
        }
    }
 }
@@ -1,21 +1,26 @@
 // Copyright 2021 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0

-#[cfg(target_arch = "wasm32")]
-use gloo_utils::errors::JsError;
 use nym_gateway_requests::registration::handshake::error::HandshakeError;
+use nym_gateway_requests::SimpleGatewayRequestsError;
 use std::io;
 use thiserror::Error;
 use tungstenite::Error as WsError;

+#[cfg(target_arch = "wasm32")]
+use gloo_utils::errors::JsError;
+
 #[derive(Debug, Error)]
 pub enum GatewayClientError {
    #[error("Connection to the gateway is not established")]
    ConnectionNotEstablished,

-    #[error("Gateway returned an error response: {0}")]
+    #[error("gateway returned an error response: {0}")]
    GatewayError(String),

+    #[error("gateway returned an error response: {0}")]
+    TypedGatewayError(SimpleGatewayRequestsError),
+
    #[error("There was a network error: {0}")]
    NetworkError(#[from] WsError),

@@ -62,6 +67,12 @@ pub enum GatewayClientError {
    #[error("There are no more bandwidth credentials acquired. Please buy some more if you want to use the mixnet")]
    NoMoreBandwidthCredentials,

+    #[error("the current available bandwidth ({available_bi2}) is below the minimum cutoff threshold off {cutoff_bi2}")]
+    BandwidthBelowCutoffValue {
+        available_bi2: String,
+        cutoff_bi2: String,
+    },
+
    #[error("Received an unexpected response")]
    UnexpectedResponse,

@@ -113,4 +124,11 @@ impl GatewayClientError {
            _ => false,
        }
    }
+
+    pub fn is_ticket_replay(&self) -> bool {
+        match self {
+            GatewayClientError::TypedGatewayError(err) => err.is_ticket_replay(),
+            _ => false,
+        }
+    }
 }
@@ -6,7 +6,7 @@ use log::warn;
 use nym_gateway_requests::BinaryResponse;
 use tungstenite::{protocol::Message, Error as WsError};

-pub use client::{GatewayClient, GatewayConfig};
+pub use client::{config::GatewayClientConfig, GatewayClient, GatewayConfig};
 pub use nym_gateway_requests::registration::handshake::SharedKeys;
 pub use packet_router::{
    AcknowledgementReceiver, AcknowledgementSender, MixnetMessageReceiver, MixnetMessageSender,
@@ -14,6 +14,7 @@ pub use packet_router::{
 };
 pub use traits::GatewayPacketRouter;

+mod bandwidth;
 pub mod client;
 pub mod error;
 pub mod packet_router;
@@ -51,10 +52,7 @@ pub(crate) fn try_decrypt_binary_message(
            BinaryResponse::PushedMixMessage(plaintext) => Some(plaintext),
        },
        Err(err) => {
-            warn!(
-                "message received from the gateway was malformed! - {:?}",
-                err
-            );
+            warn!("message received from the gateway was malformed! - {err}",);
            None
        }
    }
@@ -1,6 +1,7 @@
 // Copyright 2021-2023 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0

+use crate::bandwidth::ClientBandwidth;
 use crate::error::GatewayClientError;
 use crate::packet_router::PacketRouter;
 use crate::traits::GatewayPacketRouter;
@@ -10,16 +11,13 @@ use futures::stream::{SplitSink, SplitStream};
 use futures::{SinkExt, StreamExt};
 use log::*;
 use nym_gateway_requests::registration::handshake::SharedKeys;
-use nym_gateway_requests::ServerResponse;
+use nym_gateway_requests::{ServerResponse, SimpleGatewayRequestsError};
 use nym_task::TaskClient;
-use si_scale::helpers::bibytes2;
 use std::os::raw::c_int as RawFd;
-use std::sync::atomic::{AtomicI64, Ordering};
 use std::sync::Arc;
-use std::time::Duration;
-use time::OffsetDateTime;
-use tungstenite::Message;
+use tungstenite::{protocol::Message, Error as WsError};

+use si_scale::helpers::bibytes2;
 #[cfg(unix)]
 use std::os::fd::AsRawFd;
 #[cfg(not(target_arch = "wasm32"))]
@@ -42,6 +40,7 @@ type WsConn = JSWebsocket;
 // by some other task, however, we can notify it to get the stream back.

 type SplitStreamReceiver = oneshot::Receiver<Result<SplitStream<WsConn>, GatewayClientError>>;
+type SplitStreamSender = oneshot::Sender<Result<SplitStream<WsConn>, GatewayClientError>>;

 pub(crate) fn ws_fd(_conn: &WsConn) -> Option<RawFd> {
    #[cfg(unix)]
@@ -53,92 +52,204 @@ pub(crate) fn ws_fd(_conn: &WsConn) -> Option<RawFd> {
    None
 }

-// disgusting? absolutely, but does the trick for now
-static LAST_LOGGED_BANDWIDTH_TS: AtomicI64 = AtomicI64::new(0);
-
-fn maybe_log_bandwidth(remaining: i64) {
-    // SAFETY: this value is always populated with valid timestamps
-    let last =
-        OffsetDateTime::from_unix_timestamp(LAST_LOGGED_BANDWIDTH_TS.load(Ordering::Relaxed))
-            .unwrap();
-    let now = OffsetDateTime::now_utc();
-    if last + Duration::from_secs(10) < now {
-        log::info!("remaining bandwidth: {}", bibytes2(remaining as f64));
-        LAST_LOGGED_BANDWIDTH_TS.store(now.unix_timestamp(), Ordering::Relaxed)
-    }
-}
-
 #[derive(Debug)]
-pub(crate) struct PartiallyDelegated {
+pub(crate) struct PartiallyDelegatedHandle {
    sink_half: SplitSink<WsConn, Message>,
+    // this could have been simplified by a notify as opposed to oneshot, but let's not change what ain't broke
    delegated_stream: (SplitStreamReceiver, oneshot::Sender<()>),
    ws_fd: Option<RawFd>,
 }

-impl PartiallyDelegated {
-    fn recover_received_plaintexts(
-        ws_msgs: Vec<Message>,
-        shared_key: &SharedKeys,
-    ) -> Result<Vec<Vec<u8>>, GatewayClientError> {
-        let mut plaintexts = Vec::with_capacity(ws_msgs.len());
-        for ws_msg in ws_msgs {
-            match ws_msg {
-                Message::Binary(bin_msg) => {
-                    // this function decrypts the request and checks the MAC
-                    if let Some(plaintext) = try_decrypt_binary_message(bin_msg, shared_key) {
-                        plaintexts.push(plaintext)
+struct PartiallyDelegatedRouter {
+    packet_router: PacketRouter,
+    shared_key: Arc<SharedKeys>,
+    client_bandwidth: ClientBandwidth,
+
+    stream_return: SplitStreamSender,
+    stream_return_requester: oneshot::Receiver<()>,
+}
+
+impl PartiallyDelegatedRouter {
+    fn new(
+        packet_router: PacketRouter,
+        shared_key: Arc<SharedKeys>,
+        client_bandwidth: ClientBandwidth,
+        stream_return: SplitStreamSender,
+        stream_return_requester: oneshot::Receiver<()>,
+    ) -> PartiallyDelegatedRouter {
+        PartiallyDelegatedRouter {
+            packet_router,
+            shared_key,
+            client_bandwidth,
+            stream_return,
+            stream_return_requester,
+        }
+    }
+
+    async fn run(mut self, mut split_stream: SplitStream<WsConn>, mut task_client: TaskClient) {
+        let mut chunked_stream = (&mut split_stream).ready_chunks(8);
+        let ret: Result<_, GatewayClientError> = loop {
+            tokio::select! {
+                biased;
+                // received system-wide shutdown
+                _ = task_client.recv() => {
+                    log::trace!("GatewayClient listener: Received shutdown");
+                    log::debug!("GatewayClient listener: Exiting");
+                    return;
+                }
+                // received request to stop the task and return the stream
+                _ = &mut self.stream_return_requester => {
+                    log::debug!("received request to return the split ws stream");
+                    break Ok(())
+                }
+                socket_msgs = chunked_stream.next() => {
+                    if let Err(err) = self.handle_socket_messages(socket_msgs) {
+                        break Err(err)
                    }
                }
-                // I think that in the future we should perhaps have some sequence number system, i.e.
-                // so each request/response pair can be easily identified, so that if messages are
-                // not ordered (for some peculiar reason) we wouldn't lose anything.
-                // This would also require NOT discarding any text responses here.
+            }
+        };

-                // TODO: those can return the "send confirmations" - perhaps it should be somehow worked around?
-                Message::Text(text) => {
-                    trace!(
+        let return_res = match ret {
+            Err(err) => self.stream_return.send(Err(err)),
+            Ok(_) => {
+                self.packet_router.mark_as_success();
+                task_client.mark_as_success();
+                self.stream_return.send(Ok(split_stream))
+            }
+        };
+
+        if return_res.is_err() {
+            warn!("failed to return the split stream back on the oneshot channel")
+        }
+    }
+
+    fn handle_socket_messages(
+        &self,
+        msgs: Option<Vec<Result<Message, WsError>>>,
+    ) -> Result<(), GatewayClientError> {
+        let ws_msgs = cleanup_socket_messages(msgs)?;
+        let plaintexts = self.recover_received_plaintexts(ws_msgs)?;
+        if !plaintexts.is_empty() {
+            self.packet_router.route_received(plaintexts)?
+        }
+
+        Ok(())
+    }
+
+    fn handle_binary_message(&self, binary_msg: Vec<u8>) -> Result<Vec<u8>, GatewayClientError> {
+        // this function decrypts the request and checks the MAC
+        match try_decrypt_binary_message(binary_msg, &self.shared_key) {
+            Some(plaintext) => Ok(plaintext),
+            None => {
+                error!("failed to decrypt and verify received message!");
+                Err(GatewayClientError::MalformedResponse)
+            }
+        }
+    }
+
+    // only returns an error on **critical** failures
+    fn handle_text_message(&self, text: String) -> Result<(), GatewayClientError> {
+        // if we fail to deserialise the response, return a hard error. we can't handle garbage
+        match ServerResponse::try_from(text).map_err(|_| GatewayClientError::MalformedResponse)? {
+            ServerResponse::Send {
+                remaining_bandwidth,
+            } => {
+                self.client_bandwidth
+                    .update_and_maybe_log(remaining_bandwidth);
+                Ok(())
+            }
+            ServerResponse::Error { message } => {
+                error!("[1] gateway failure: {message}");
+                Err(GatewayClientError::GatewayError(message))
+            }
+            ServerResponse::TypedError { error } => {
+                match error {
+                    SimpleGatewayRequestsError::OutOfBandwidth {
+                        required,
+                        available,
+                    } => {
+                        let available_bi2 = bibytes2(available as f64);
+                        let required_bi2 = bibytes2(required as f64);
+                        warn!("run out of bandwidth when attempting to send the message! we got {available_bi2} available, but needed at least {required_bi2} to send the previous message");
+                        self.client_bandwidth.update_and_log(available);
+                        // UNIMPLEMENTED: we should stop sending messages until we recover bandwidth
+                        Ok(())
+                    }
+                    _ => {
+                        error!("[2] gateway failure: {error}");
+                        Err(GatewayClientError::TypedGatewayError(error))
+                    }
+                }
+            }
+            other => {
+                let name = other.name();
+                warn!("received illegal message of type '{name}' in an authenticated client");
+                Ok(())
+            }
+        }
+    }
+
+    fn recover_received_plaintext(
+        &self,
+        message: Message,
+    ) -> Result<Option<Vec<u8>>, GatewayClientError> {
+        match message {
+            Message::Binary(bin_msg) => {
+                let plaintext = self.handle_binary_message(bin_msg)?;
+                Ok(Some(plaintext))
+            }
+            // I think that in the future we should perhaps have some sequence number system, i.e.
+            // so each request/response pair can be easily identified, so that if messages are
+            // not ordered (for some peculiar reason) we wouldn't lose anything.
+            // This would also require NOT discarding any text responses here.
+
+            // TODO: those can return the "send confirmations" - perhaps it should be somehow worked around?
+            Message::Text(text) => {
+                trace!(
                    "received a text message - probably a response to some previous query! - {text}",
                );
-                    match ServerResponse::try_from(text)
-                        .map_err(|_| GatewayClientError::MalformedResponse)?
-                    {
-                        ServerResponse::Send {
-                            remaining_bandwidth,
-                        } => maybe_log_bandwidth(remaining_bandwidth),
-                        ServerResponse::Error { message } => {
-                            error!("gateway failure: {message}");
-                            return Err(GatewayClientError::GatewayError(message));
-                        }
-                        other => {
-                            warn!(
-                                "received illegal message of type {} in an authenticated client",
-                                other.name()
-                            )
-                        }
-                    }
+                self.handle_text_message(text)?;
+                Ok(None)
+            }
+            _ => {
+                debug!("received websocket message that's neither 'Binary' nor 'Text'. it's going to get ignored");
+                Ok(None)
+            }
+        }
+    }

-                    continue;
-                }
-                _ => continue,
+    fn recover_received_plaintexts(
+        &self,
+        messages: Vec<Message>,
+    ) -> Result<Vec<Vec<u8>>, GatewayClientError> {
+        let mut plaintexts = Vec::new();
+        for ws_msg in messages {
+            if let Some(plaintext) = self.recover_received_plaintext(ws_msg)? {
+                plaintexts.push(plaintext)
            }
        }
        Ok(plaintexts)
    }

-    fn route_socket_messages(
-        ws_msgs: Vec<Message>,
-        packet_router: &PacketRouter,
-        shared_key: &SharedKeys,
-    ) -> Result<(), GatewayClientError> {
-        let plaintexts = Self::recover_received_plaintexts(ws_msgs, shared_key)?;
-        packet_router.route_received(plaintexts)
-    }
+    fn spawn(self, split_stream: SplitStream<WsConn>, task_client: TaskClient) {
+        let fut = async move { self.run(split_stream, task_client).await };

+        #[cfg(target_arch = "wasm32")]
+        wasm_bindgen_futures::spawn_local(fut);
+
+        #[cfg(not(target_arch = "wasm32"))]
+        tokio::spawn(fut);
+    }
+}
+
+impl PartiallyDelegatedHandle {
    pub(crate) fn split_and_listen_for_mixnet_messages(
        conn: WsConn,
-        mut packet_router: PacketRouter,
+        packet_router: PacketRouter,
        shared_key: Arc<SharedKeys>,
-        mut shutdown: TaskClient,
+        client_bandwidth: ClientBandwidth,
+        shutdown: TaskClient,
    ) -> Self {
        // when called for, it NEEDS TO yield back the stream so that we could merge it and
        // read control request responses.
@@ -146,58 +257,18 @@ impl PartiallyDelegated {
        let (stream_sender, stream_receiver) = oneshot::channel();

        let ws_fd = ws_fd(&conn);
+        let (sink, stream) = conn.split();

-        let (sink, mut stream) = conn.split();
+        PartiallyDelegatedRouter::new(
+            packet_router,
+            shared_key,
+            client_bandwidth,
+            stream_sender,
+            notify_receiver,
+        )
+        .spawn(stream, shutdown);

-        let mixnet_receiver_future = async move {
-            let mut notify_receiver = notify_receiver;
-            let mut chunk_stream = (&mut stream).ready_chunks(8);
-
-            let ret_err = loop {
-                tokio::select! {
-                    _ = shutdown.recv() => {
-                        log::trace!("GatewayClient listener: Received shutdown");
-                        log::debug!("GatewayClient listener: Exiting");
-                        return;
-                    }
-                    _ = &mut notify_receiver => {
-                        break Ok(());
-                    }
-                    msgs = chunk_stream.next() => {
-                        let ws_msgs = match cleanup_socket_messages(msgs) {
-                            Err(err) => break Err(err),
-                            Ok(msgs) => msgs
-                        };
-
-                        if let Err(err) = Self::route_socket_messages(ws_msgs, &packet_router, shared_key.as_ref()) {
-                            log::error!("Route socket messages failed: {err}");
-                            break Err(err)
-                        }
-                    }
-                };
-            };
-
-            if match ret_err {
-                Err(err) => stream_sender.send(Err(err)),
-                Ok(_) => {
-                    packet_router.mark_as_success();
-                    shutdown.mark_as_success();
-                    stream_sender.send(Ok(stream))
-                }
-            }
-            .is_err()
-            {
-                warn!("failed to send back `mixnet_receiver_future` result on the oneshot channel")
-            }
-        };
-
-        #[cfg(target_arch = "wasm32")]
-        wasm_bindgen_futures::spawn_local(mixnet_receiver_future);
-
-        #[cfg(not(target_arch = "wasm32"))]
-        tokio::spawn(mixnet_receiver_future);
-
-        PartiallyDelegated {
+        PartiallyDelegatedHandle {
            ws_fd,
            sink_half: sink,
            delegated_stream: (stream_receiver, notify_sender),
@@ -266,7 +337,7 @@ impl PartiallyDelegated {
 #[derive(Debug)]
 pub(crate) enum SocketState {
    Available(Box<WsConn>),
-    PartiallyDelegated(PartiallyDelegated),
+    PartiallyDelegated(PartiallyDelegatedHandle),
    NotConnected,
    Invalid,
 }
@@ -17,6 +17,7 @@ nym-contracts-common = { path = "../../cosmwasm-smart-contracts/contracts-common
 nym-mixnet-contract-common = { path = "../../cosmwasm-smart-contracts/mixnet-contract" }
 nym-vesting-contract-common = { path = "../../cosmwasm-smart-contracts/vesting-contract" }
 nym-coconut-bandwidth-contract-common = { path = "../../cosmwasm-smart-contracts/coconut-bandwidth-contract" }
+nym-ecash-contract-common = { path = "../../cosmwasm-smart-contracts/ecash-contract" }
 nym-multisig-contract-common = { path = "../../cosmwasm-smart-contracts/multisig-contract" }
 nym-group-contract-common = { path = "../../cosmwasm-smart-contracts/group-contract" }
 serde = { workspace = true, features = ["derive"] }
@@ -26,9 +27,10 @@ thiserror = { workspace = true }
 log = { workspace = true }
 url = { workspace = true, features = ["serde"] }
 tokio = { workspace = true, features = ["sync", "time"] }
+time = { workspace = true, features = ["formatting"] }
 futures = { workspace = true }

-nym-coconut = { path = "../../nymcoconut" }
+nym-compact-ecash = { path = "../../nym_offline_compact_ecash" }
 nym-network-defaults = { path = "../../network-defaults" }
 nym-api-requests = { path = "../../../nym-api/nym-api-requests" }

@@ -8,10 +8,14 @@ use crate::{
    nym_api, DirectSigningReqwestRpcValidatorClient, QueryReqwestRpcValidatorClient,
    ReqwestRpcClient, ValidatorClientError,
 };
-use nym_api_requests::coconut::models::FreePassNonceResponse;
-use nym_api_requests::coconut::{
-    BlindSignRequestBody, BlindedSignatureResponse, FreePassRequest, VerifyCredentialBody,
-    VerifyCredentialResponse,
+use nym_api_requests::ecash::models::{
+    AggregatedCoinIndicesSignatureResponse, AggregatedExpirationDateSignatureResponse,
+    BatchRedeemTicketsBody, EcashBatchTicketRedemptionResponse, EcashTicketVerificationResponse,
+    SpentCredentialsResponse, VerifyEcashTicketBody,
+};
+use nym_api_requests::ecash::{
+    BlindSignRequestBody, BlindedSignatureResponse, PartialCoinIndicesSignatureResponse,
+    PartialExpirationDateSignatureResponse, VerificationKeyResponse,
 };
 use nym_api_requests::models::{DescribedGateway, MixNodeBondAnnotated};
 use nym_api_requests::models::{
@@ -19,8 +23,10 @@ use nym_api_requests::models::{
    RewardEstimationResponse, StakeSaturationResponse,
 };
 use nym_api_requests::nym_nodes::SkimmedNode;
+use nym_coconut_dkg_common::types::EpochId;
 use nym_http_api_client::UserAgent;
 use nym_network_defaults::NymNetworkDetails;
+use time::Date;
 use url::Url;

 pub use crate::nym_api::NymApiClientExt;
@@ -29,7 +35,7 @@ pub use nym_mixnet_contract_common::{
 };

 // re-export the type to not break existing imports
-pub use crate::coconut::CoconutApiClient;
+pub use crate::coconut::EcashApiClient;

 #[cfg(feature = "http-client")]
 use crate::rpc::http_client;
@@ -375,24 +381,73 @@ impl NymApiClient {
        Ok(self.nym_api.blind_sign(request_body).await?)
    }

-    pub async fn verify_bandwidth_credential(
+    pub async fn verify_ecash_ticket(
        &self,
-        request_body: &VerifyCredentialBody,
-    ) -> Result<VerifyCredentialResponse, ValidatorClientError> {
+        request_body: &VerifyEcashTicketBody,
+    ) -> Result<EcashTicketVerificationResponse, ValidatorClientError> {
+        Ok(self.nym_api.verify_ecash_ticket(request_body).await?)
+    }
+
+    pub async fn batch_redeem_ecash_tickets(
+        &self,
+        request_body: &BatchRedeemTicketsBody,
+    ) -> Result<EcashBatchTicketRedemptionResponse, ValidatorClientError> {
        Ok(self
            .nym_api
-            .verify_bandwidth_credential(request_body)
+            .batch_redeem_ecash_tickets(request_body)
            .await?)
    }

-    pub async fn free_pass_nonce(&self) -> Result<FreePassNonceResponse, ValidatorClientError> {
-        Ok(self.nym_api.free_pass_nonce().await?)
+    pub async fn spent_credentials_filter(
+        &self,
+    ) -> Result<SpentCredentialsResponse, ValidatorClientError> {
+        Ok(self.nym_api.double_spending_filter_v1().await?)
    }

-    pub async fn issue_free_pass_credential(
+    pub async fn partial_expiration_date_signatures(
        &self,
-        request: &FreePassRequest,
-    ) -> Result<BlindedSignatureResponse, ValidatorClientError> {
-        Ok(self.nym_api.free_pass(request).await?)
+        expiration_date: Option<Date>,
+    ) -> Result<PartialExpirationDateSignatureResponse, ValidatorClientError> {
+        Ok(self
+            .nym_api
+            .partial_expiration_date_signatures(expiration_date)
+            .await?)
+    }
+
+    pub async fn partial_coin_indices_signatures(
+        &self,
+        epoch_id: Option<EpochId>,
+    ) -> Result<PartialCoinIndicesSignatureResponse, ValidatorClientError> {
+        Ok(self
+            .nym_api
+            .partial_coin_indices_signatures(epoch_id)
+            .await?)
+    }
+
+    pub async fn global_expiration_date_signatures(
+        &self,
+        expiration_date: Option<Date>,
+    ) -> Result<AggregatedExpirationDateSignatureResponse, ValidatorClientError> {
+        Ok(self
+            .nym_api
+            .global_expiration_date_signatures(expiration_date)
+            .await?)
+    }
+
+    pub async fn global_coin_indices_signatures(
+        &self,
+        epoch_id: Option<EpochId>,
+    ) -> Result<AggregatedCoinIndicesSignatureResponse, ValidatorClientError> {
+        Ok(self
+            .nym_api
+            .global_coin_indices_signatures(epoch_id)
+            .await?)
+    }
+
+    pub async fn master_verification_key(
+        &self,
+        epoch_id: Option<EpochId>,
+    ) -> Result<VerificationKeyResponse, ValidatorClientError> {
+        Ok(self.nym_api.master_verification_key(epoch_id).await?)
    }
 }
@@ -4,26 +4,40 @@
 use crate::nyxd::contract_traits::{DkgQueryClient, PagedDkgQueryClient};
 use crate::nyxd::error::NyxdError;
 use crate::NymApiClient;
-use nym_coconut::{Base58, CoconutError, VerificationKey};
 use nym_coconut_dkg_common::types::{EpochId, NodeIndex};
 use nym_coconut_dkg_common::verification_key::ContractVKShare;
+use nym_compact_ecash::error::CompactEcashError;
+use nym_compact_ecash::{Base58, VerificationKeyAuth};
+use std::fmt::{Display, Formatter};
 use thiserror::Error;
 use url::Url;

 // TODO: it really doesn't feel like this should live in this crate.
 #[derive(Clone)]
-pub struct CoconutApiClient {
+pub struct EcashApiClient {
    pub api_client: NymApiClient,
-    pub verification_key: VerificationKey,
+    pub verification_key: VerificationKeyAuth,
    pub node_id: NodeIndex,
    pub cosmos_address: cosmrs::AccountId,
 }

+impl Display for EcashApiClient {
+    fn fmt(&self, f: &mut Formatter<'_>) -> std::fmt::Result {
+        write!(
+            f,
+            "[id: {}] {} @ {}",
+            self.node_id,
+            self.cosmos_address,
+            self.api_client.api_url()
+        )
+    }
+}
+
 // TODO: this should be using the coconut error
 // (which is in different crate; perhaps this client should be moved there?)

 #[derive(Debug, Error)]
-pub enum CoconutApiError {
+pub enum EcashApiError {
    // TODO: ask @BN whether this is a correct error message
    #[error("the provided key share hasn't been verified")]
    UnverifiedShare,
@@ -43,7 +57,7 @@ pub enum CoconutApiError {
    #[error("the provided verification key is malformed: {source}")]
    MalformedVerificationKey {
        #[from]
-        source: CoconutError,
+        source: CompactEcashError,
    },

    #[error("the provided account address is malformed: {source}")]
@@ -53,29 +67,29 @@ pub enum CoconutApiError {
    },
 }

-impl TryFrom<ContractVKShare> for CoconutApiClient {
-    type Error = CoconutApiError;
+impl TryFrom<ContractVKShare> for EcashApiClient {
+    type Error = EcashApiError;

    fn try_from(share: ContractVKShare) -> Result<Self, Self::Error> {
        if !share.verified {
-            return Err(CoconutApiError::UnverifiedShare);
+            return Err(EcashApiError::UnverifiedShare);
        }

        let url_address = Url::parse(&share.announce_address)?;

-        Ok(CoconutApiClient {
+        Ok(EcashApiClient {
            api_client: NymApiClient::new(url_address),
-            verification_key: VerificationKey::try_from_bs58(&share.share)?,
+            verification_key: VerificationKeyAuth::try_from_bs58(&share.share)?,
            node_id: share.node_index,
            cosmos_address: share.owner.as_str().parse()?,
        })
    }
 }

-pub async fn all_coconut_api_clients<C>(
+pub async fn all_ecash_api_clients<C>(
    client: &C,
    epoch_id: EpochId,
-) -> Result<Vec<CoconutApiClient>, CoconutApiError>
+) -> Result<Vec<EcashApiClient>, EcashApiError>
 where
    C: DkgQueryClient + Sync + Send,
 {
@@ -7,7 +7,7 @@ use thiserror::Error;

 #[derive(Error, Debug)]
 pub enum ValidatorClientError {
-    #[error("nym api request failed - {source}")]
+    #[error("nym api request failed: {source}")]
    NymAPIError {
        #[from]
        source: nym_api::error::NymAPIError,
@@ -19,7 +19,7 @@ pub enum ValidatorClientError {
    #[error("One of the provided URLs was malformed - {0}")]
    MalformedUrlProvided(#[from] url::ParseError),

-    #[error("nyxd request failed - {0}")]
+    #[error("nyxd request failed: {0}")]
    NyxdError(#[from] crate::nyxd::error::NyxdError),

    #[error("No validator API url has been provided")]
@@ -15,7 +15,7 @@ pub use crate::error::ValidatorClientError;
 pub use crate::rpc::reqwest::ReqwestRpcClient;
 pub use crate::signing::direct_wallet::DirectSecp256k1HdWallet;
 pub use client::NymApiClient;
-pub use client::{Client, CoconutApiClient, Config};
+pub use client::{Client, Config, EcashApiClient};
 pub use nym_api_requests::*;
 pub use nym_http_api_client::UserAgent;

@@ -2,16 +2,33 @@
 // SPDX-License-Identifier: Apache-2.0

 use crate::nym_api::error::NymAPIError;
-use crate::nym_api::routes::{CORE_STATUS_COUNT, SINCE_ARG};
+use crate::nym_api::routes::{ecash, CORE_STATUS_COUNT, SINCE_ARG};
 use async_trait::async_trait;
+use nym_api_requests::ecash::models::{
+    AggregatedCoinIndicesSignatureResponse, AggregatedExpirationDateSignatureResponse,
+    BatchRedeemTicketsBody, EcashBatchTicketRedemptionResponse, EcashTicketVerificationResponse,
+    VerifyEcashTicketBody,
+};
+use nym_api_requests::nym_nodes::{CachedNodesResponse, SkimmedNode};
+use nym_http_api_client::{ApiClient, NO_PARAMS};
+use nym_mixnet_contract_common::mixnode::MixNodeDetails;
+use nym_mixnet_contract_common::{GatewayBond, IdentityKeyRef, MixId};
+use time::format_description::BorrowedFormatItem;
+use time::Date;
+
+pub mod error;
+pub mod routes;
+
+use nym_api_requests::ecash::VerificationKeyResponse;
 pub use nym_api_requests::{
-    coconut::{
+    ecash::{
        models::{
            EpochCredentialsResponse, IssuedCredential, IssuedCredentialBody,
-            IssuedCredentialResponse, IssuedCredentialsResponse,
+            IssuedCredentialResponse, IssuedCredentialsResponse, SpentCredentialsResponse,
        },
        BlindSignRequestBody, BlindedSignatureResponse, CredentialsRequestBody,
-        VerifyCredentialBody, VerifyCredentialResponse,
+        PartialCoinIndicesSignatureResponse, PartialExpirationDateSignatureResponse,
+        VerifyEcashCredentialBody,
    },
    models::{
        ComputeRewardEstParam, DescribedGateway, GatewayBondAnnotated, GatewayCoreStatusResponse,
@@ -22,18 +39,12 @@ pub use nym_api_requests::{
    },
 };
 pub use nym_coconut_dkg_common::types::EpochId;
-use nym_http_api_client::{ApiClient, NO_PARAMS};
-use nym_mixnet_contract_common::mixnode::MixNodeDetails;
-use nym_mixnet_contract_common::{GatewayBond, IdentityKeyRef, MixId};
-
-pub mod error;
-pub mod routes;
-
-use nym_api_requests::coconut::models::FreePassNonceResponse;
-use nym_api_requests::coconut::FreePassRequest;
-use nym_api_requests::nym_nodes::{CachedNodesResponse, SkimmedNode};
 pub use nym_http_api_client::Client;

+pub fn rfc_3339_date() -> Vec<BorrowedFormatItem<'static>> {
+    time::format_description::parse("[year]-[month]-[day]").unwrap()
+}
+
 #[cfg_attr(target_arch = "wasm32", async_trait(?Send))]
 #[cfg_attr(not(target_arch = "wasm32"), async_trait)]
 pub trait NymApiClientExt: ApiClient {
@@ -420,36 +431,6 @@ pub trait NymApiClientExt: ApiClient {
        .await
    }

-    async fn free_pass_nonce(&self) -> Result<FreePassNonceResponse, NymAPIError> {
-        self.get_json(
-            &[
-                routes::API_VERSION,
-                routes::COCONUT_ROUTES,
-                routes::BANDWIDTH,
-                routes::COCONUT_FREE_PASS_NONCE,
-            ],
-            NO_PARAMS,
-        )
-        .await
-    }
-
-    async fn free_pass(
-        &self,
-        request: &FreePassRequest,
-    ) -> Result<BlindedSignatureResponse, NymAPIError> {
-        self.post_json(
-            &[
-                routes::API_VERSION,
-                routes::COCONUT_ROUTES,
-                routes::BANDWIDTH,
-                routes::COCONUT_FREE_PASS,
-            ],
-            NO_PARAMS,
-            request,
-        )
-        .await
-    }
-
    async fn blind_sign(
        &self,
        request_body: &BlindSignRequestBody,
@@ -457,9 +438,8 @@ pub trait NymApiClientExt: ApiClient {
        self.post_json(
            &[
                routes::API_VERSION,
-                routes::COCONUT_ROUTES,
-                routes::BANDWIDTH,
-                routes::COCONUT_BLIND_SIGN,
+                routes::ECASH_ROUTES,
+                routes::ECASH_BLIND_SIGN,
            ],
            NO_PARAMS,
            request_body,
@@ -467,16 +447,15 @@ pub trait NymApiClientExt: ApiClient {
        .await
    }

-    async fn verify_bandwidth_credential(
+    async fn verify_ecash_ticket(
        &self,
-        request_body: &VerifyCredentialBody,
-    ) -> Result<VerifyCredentialResponse, NymAPIError> {
+        request_body: &VerifyEcashTicketBody,
+    ) -> Result<EcashTicketVerificationResponse, NymAPIError> {
        self.post_json(
            &[
                routes::API_VERSION,
-                routes::COCONUT_ROUTES,
-                routes::BANDWIDTH,
-                routes::COCONUT_VERIFY_BANDWIDTH_CREDENTIAL,
+                routes::ECASH_ROUTES,
+                routes::VERIFY_ECASH_TICKET,
            ],
            NO_PARAMS,
            request_body,
@@ -484,6 +463,139 @@ pub trait NymApiClientExt: ApiClient {
        .await
    }

+    async fn batch_redeem_ecash_tickets(
+        &self,
+        request_body: &BatchRedeemTicketsBody,
+    ) -> Result<EcashBatchTicketRedemptionResponse, NymAPIError> {
+        self.post_json(
+            &[
+                routes::API_VERSION,
+                routes::ECASH_ROUTES,
+                routes::BATCH_REDEEM_ECASH_TICKETS,
+            ],
+            NO_PARAMS,
+            request_body,
+        )
+        .await
+    }
+
+    async fn double_spending_filter_v1(&self) -> Result<SpentCredentialsResponse, NymAPIError> {
+        self.get_json(
+            &[
+                routes::API_VERSION,
+                routes::ECASH_ROUTES,
+                routes::DOUBLE_SPENDING_FILTER_V1,
+            ],
+            NO_PARAMS,
+        )
+        .await
+    }
+
+    async fn partial_expiration_date_signatures(
+        &self,
+        expiration_date: Option<Date>,
+    ) -> Result<PartialExpirationDateSignatureResponse, NymAPIError> {
+        let params = match expiration_date {
+            None => Vec::new(),
+            Some(exp) => vec![(
+                ecash::EXPIRATION_DATE_PARAM,
+                exp.format(&rfc_3339_date()).unwrap(),
+            )],
+        };
+
+        self.get_json(
+            &[
+                routes::API_VERSION,
+                routes::ECASH_ROUTES,
+                routes::PARTIAL_EXPIRATION_DATE_SIGNATURES,
+            ],
+            &params,
+        )
+        .await
+    }
+
+    async fn partial_coin_indices_signatures(
+        &self,
+        epoch_id: Option<EpochId>,
+    ) -> Result<PartialCoinIndicesSignatureResponse, NymAPIError> {
+        let params = match epoch_id {
+            None => Vec::new(),
+            Some(epoch_id) => vec![(ecash::EPOCH_ID_PARAM, epoch_id.to_string())],
+        };
+
+        self.get_json(
+            &[
+                routes::API_VERSION,
+                routes::ECASH_ROUTES,
+                routes::PARTIAL_COIN_INDICES_SIGNATURES,
+            ],
+            &params,
+        )
+        .await
+    }
+
+    async fn global_expiration_date_signatures(
+        &self,
+        expiration_date: Option<Date>,
+    ) -> Result<AggregatedExpirationDateSignatureResponse, NymAPIError> {
+        let params = match expiration_date {
+            None => Vec::new(),
+            Some(exp) => vec![(
+                ecash::EXPIRATION_DATE_PARAM,
+                exp.format(&rfc_3339_date()).unwrap(),
+            )],
+        };
+
+        self.get_json(
+            &[
+                routes::API_VERSION,
+                routes::ECASH_ROUTES,
+                routes::GLOBAL_EXPIRATION_DATE_SIGNATURES,
+            ],
+            &params,
+        )
+        .await
+    }
+
+    async fn global_coin_indices_signatures(
+        &self,
+        epoch_id: Option<EpochId>,
+    ) -> Result<AggregatedCoinIndicesSignatureResponse, NymAPIError> {
+        let params = match epoch_id {
+            None => Vec::new(),
+            Some(epoch_id) => vec![(ecash::EPOCH_ID_PARAM, epoch_id.to_string())],
+        };
+
+        self.get_json(
+            &[
+                routes::API_VERSION,
+                routes::ECASH_ROUTES,
+                routes::GLOBAL_COIN_INDICES_SIGNATURES,
+            ],
+            &params,
+        )
+        .await
+    }
+
+    async fn master_verification_key(
+        &self,
+        epoch_id: Option<EpochId>,
+    ) -> Result<VerificationKeyResponse, NymAPIError> {
+        let params = match epoch_id {
+            None => Vec::new(),
+            Some(epoch_id) => vec![(ecash::EPOCH_ID_PARAM, epoch_id.to_string())],
+        };
+        self.get_json(
+            &[
+                routes::API_VERSION,
+                routes::ECASH_ROUTES,
+                routes::ecash::MASTER_VERIFICATION_KEY,
+            ],
+            &params,
+        )
+        .await
+    }
+
    async fn epoch_credentials(
        &self,
        dkg_epoch: EpochId,
@@ -491,9 +603,8 @@ pub trait NymApiClientExt: ApiClient {
        self.get_json(
            &[
                routes::API_VERSION,
-                routes::COCONUT_ROUTES,
-                routes::BANDWIDTH,
-                routes::COCONUT_EPOCH_CREDENTIALS,
+                routes::ECASH_ROUTES,
+                routes::ECASH_EPOCH_CREDENTIALS,
                &dkg_epoch.to_string(),
            ],
            NO_PARAMS,
@@ -508,9 +619,8 @@ pub trait NymApiClientExt: ApiClient {
        self.get_json(
            &[
                routes::API_VERSION,
-                routes::COCONUT_ROUTES,
-                routes::BANDWIDTH,
-                routes::COCONUT_ISSUED_CREDENTIAL,
+                routes::ECASH_ROUTES,
+                routes::ECASH_ISSUED_CREDENTIAL,
                &credential_id.to_string(),
            ],
            NO_PARAMS,
@@ -525,9 +635,8 @@ pub trait NymApiClientExt: ApiClient {
        self.post_json(
            &[
                routes::API_VERSION,
-                routes::COCONUT_ROUTES,
-                routes::BANDWIDTH,
-                routes::COCONUT_ISSUED_CREDENTIALS,
+                routes::ECASH_ROUTES,
+                routes::ECASH_ISSUED_CREDENTIALS,
            ],
            NO_PARAMS,
            &CredentialsRequestBody {
@@ -12,16 +12,27 @@ pub const DETAILED: &str = "detailed";
 pub const DETAILED_UNFILTERED: &str = "detailed-unfiltered";
 pub const ACTIVE: &str = "active";
 pub const REWARDED: &str = "rewarded";
-pub const COCONUT_ROUTES: &str = "coconut";
-pub const BANDWIDTH: &str = "bandwidth";
+pub const DOUBLE_SPENDING_FILTER_V1: &str = "double-spending-filter-v1";

-pub const COCONUT_FREE_PASS: &str = "free-pass";
-pub const COCONUT_FREE_PASS_NONCE: &str = "free-pass-nonce";
-pub const COCONUT_BLIND_SIGN: &str = "blind-sign";
-pub const COCONUT_VERIFY_BANDWIDTH_CREDENTIAL: &str = "verify-bandwidth-credential";
-pub const COCONUT_EPOCH_CREDENTIALS: &str = "epoch-credentials";
-pub const COCONUT_ISSUED_CREDENTIAL: &str = "issued-credential";
-pub const COCONUT_ISSUED_CREDENTIALS: &str = "issued-credentials";
+pub const ECASH_ROUTES: &str = "ecash";
+
+pub use ecash::*;
+pub mod ecash {
+    pub const ECASH_BLIND_SIGN: &str = "blind-sign";
+    pub const VERIFY_ECASH_TICKET: &str = "verify-ecash-ticket";
+    pub const BATCH_REDEEM_ECASH_TICKETS: &str = "batch-redeem-ecash-tickets";
+    pub const PARTIAL_EXPIRATION_DATE_SIGNATURES: &str = "partial-expiration-date-signatures";
+    pub const GLOBAL_EXPIRATION_DATE_SIGNATURES: &str = "aggregated-expiration-date-signatures";
+    pub const PARTIAL_COIN_INDICES_SIGNATURES: &str = "partial-coin-indices-signatures";
+    pub const GLOBAL_COIN_INDICES_SIGNATURES: &str = "aggregated-coin-indices-signatures";
+    pub const MASTER_VERIFICATION_KEY: &str = "master-verification-key";
+    pub const ECASH_EPOCH_CREDENTIALS: &str = "epoch-credentials";
+    pub const ECASH_ISSUED_CREDENTIAL: &str = "issued-credential";
+    pub const ECASH_ISSUED_CREDENTIALS: &str = "issued-credentials";
+
+    pub const EXPIRATION_DATE_PARAM: &str = "expiration_date";
+    pub const EPOCH_ID_PARAM: &str = "epoch_id";
+}

 pub const STATUS_ROUTES: &str = "status";
 pub const MIXNODE: &str = "mixnode";
@@ -1,100 +0,0 @@
-// Copyright 2022-2023 - Nym Technologies SA <contact@nymtech.net>
-// SPDX-License-Identifier: Apache-2.0
-
-use crate::collect_paged;
-use crate::nyxd::contract_traits::NymContractsProvider;
-use crate::nyxd::error::NyxdError;
-use crate::nyxd::CosmWasmClient;
-use async_trait::async_trait;
-use nym_coconut_bandwidth_contract_common::msg::QueryMsg as CoconutBandwidthQueryMsg;
-use nym_coconut_bandwidth_contract_common::spend_credential::{
-    PagedSpendCredentialResponse, SpendCredential, SpendCredentialResponse,
-};
-use serde::Deserialize;
-
-#[cfg_attr(target_arch = "wasm32", async_trait(?Send))]
-#[cfg_attr(not(target_arch = "wasm32"), async_trait)]
-pub trait CoconutBandwidthQueryClient {
-    async fn query_coconut_bandwidth_contract<T>(
-        &self,
-        query: CoconutBandwidthQueryMsg,
-    ) -> Result<T, NyxdError>
-    where
-        for<'a> T: Deserialize<'a>;
-
-    async fn get_spent_credential(
-        &self,
-        blinded_serial_number: String,
-    ) -> Result<SpendCredentialResponse, NyxdError> {
-        self.query_coconut_bandwidth_contract(CoconutBandwidthQueryMsg::GetSpentCredential {
-            blinded_serial_number,
-        })
-        .await
-    }
-
-    async fn get_all_spent_credential_paged(
-        &self,
-        start_after: Option<String>,
-        limit: Option<u32>,
-    ) -> Result<PagedSpendCredentialResponse, NyxdError> {
-        self.query_coconut_bandwidth_contract(CoconutBandwidthQueryMsg::GetAllSpentCredentials {
-            limit,
-            start_after,
-        })
-        .await
-    }
-}
-
-#[cfg_attr(target_arch = "wasm32", async_trait(?Send))]
-#[cfg_attr(not(target_arch = "wasm32"), async_trait)]
-pub trait PagedCoconutBandwidthQueryClient: CoconutBandwidthQueryClient {
-    async fn get_all_spent_credentials(&self) -> Result<Vec<SpendCredential>, NyxdError> {
-        collect_paged!(self, get_all_spent_credential_paged, spend_credentials)
-    }
-}
-
-#[async_trait]
-impl<T> PagedCoconutBandwidthQueryClient for T where T: CoconutBandwidthQueryClient {}
-
-#[cfg_attr(target_arch = "wasm32", async_trait(?Send))]
-#[cfg_attr(not(target_arch = "wasm32"), async_trait)]
-impl<C> CoconutBandwidthQueryClient for C
-where
-    C: CosmWasmClient + NymContractsProvider + Send + Sync,
-{
-    async fn query_coconut_bandwidth_contract<T>(
-        &self,
-        query: CoconutBandwidthQueryMsg,
-    ) -> Result<T, NyxdError>
-    where
-        for<'a> T: Deserialize<'a>,
-    {
-        let coconut_bandwidth_contract_address = self
-            .coconut_bandwidth_contract_address()
-            .ok_or_else(|| NyxdError::unavailable_contract_address("coconut bandwidth contract"))?;
-        self.query_contract_smart(coconut_bandwidth_contract_address, &query)
-            .await
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use crate::nyxd::contract_traits::tests::IgnoreValue;
-
-    // it's enough that this compiles and clippy is happy about it
-    #[allow(dead_code)]
-    fn all_query_variants_are_covered<C: CoconutBandwidthQueryClient + Send + Sync>(
-        client: C,
-        msg: CoconutBandwidthQueryMsg,
-    ) {
-        match msg {
-            CoconutBandwidthQueryMsg::GetSpentCredential {
-                blinded_serial_number,
-            } => client.get_spent_credential(blinded_serial_number).ignore(),
-            CoconutBandwidthQueryMsg::GetAllSpentCredentials { limit, start_after } => client
-                .get_all_spent_credential_paged(start_after, limit)
-                .ignore(),
-        };
-    }
-}
@@ -1,153 +0,0 @@
-// Copyright 2022 - Nym Technologies SA <contact@nymtech.net>
-// SPDX-License-Identifier: Apache-2.0
-
-use crate::nyxd::contract_traits::NymContractsProvider;
-use crate::nyxd::cosmwasm_client::types::ExecuteResult;
-use crate::nyxd::error::NyxdError;
-use crate::nyxd::{Coin, Fee, SigningCosmWasmClient};
-use crate::signing::signer::OfflineSigner;
-use async_trait::async_trait;
-use nym_coconut_bandwidth_contract_common::spend_credential::SpendCredentialData;
-use nym_coconut_bandwidth_contract_common::{
-    deposit::DepositData, msg::ExecuteMsg as CoconutBandwidthExecuteMsg,
-};
-
-#[cfg_attr(target_arch = "wasm32", async_trait(?Send))]
-#[cfg_attr(not(target_arch = "wasm32"), async_trait)]
-pub trait CoconutBandwidthSigningClient {
-    async fn execute_coconut_bandwidth_contract(
-        &self,
-        fee: Option<Fee>,
-        msg: CoconutBandwidthExecuteMsg,
-        memo: String,
-        funds: Vec<Coin>,
-    ) -> Result<ExecuteResult, NyxdError>;
-
-    async fn deposit(
-        &self,
-        amount: Coin,
-        info: String,
-        verification_key: String,
-        encryption_key: String,
-        fee: Option<Fee>,
-    ) -> Result<ExecuteResult, NyxdError> {
-        let req = CoconutBandwidthExecuteMsg::DepositFunds {
-            data: DepositData::new(info, verification_key, encryption_key),
-        };
-        self.execute_coconut_bandwidth_contract(
-            fee,
-            req,
-            "CoconutBandwidth::Deposit".to_string(),
-            vec![amount],
-        )
-        .await
-    }
-
-    async fn spend_credential(
-        &self,
-        funds: Coin,
-        blinded_serial_number: String,
-        gateway_cosmos_address: String,
-        fee: Option<Fee>,
-    ) -> Result<ExecuteResult, NyxdError> {
-        let req = CoconutBandwidthExecuteMsg::SpendCredential {
-            data: SpendCredentialData::new(
-                funds.into(),
-                blinded_serial_number,
-                gateway_cosmos_address,
-            ),
-        };
-        self.execute_coconut_bandwidth_contract(
-            fee,
-            req,
-            "CoconutBandwidth::SpendCredential".to_string(),
-            vec![],
-        )
-        .await
-    }
-
-    async fn release_funds(
-        &self,
-        amount: Coin,
-        fee: Option<Fee>,
-    ) -> Result<ExecuteResult, NyxdError> {
-        self.execute_coconut_bandwidth_contract(
-            fee,
-            CoconutBandwidthExecuteMsg::ReleaseFunds {
-                funds: amount.into(),
-            },
-            "CoconutBandwidth::ReleaseFunds".to_string(),
-            vec![],
-        )
-        .await
-    }
-}
-
-#[cfg_attr(target_arch = "wasm32", async_trait(?Send))]
-#[cfg_attr(not(target_arch = "wasm32"), async_trait)]
-impl<C> CoconutBandwidthSigningClient for C
-where
-    C: SigningCosmWasmClient + NymContractsProvider + Sync,
-    NyxdError: From<<Self as OfflineSigner>::Error>,
-{
-    async fn execute_coconut_bandwidth_contract(
-        &self,
-        fee: Option<Fee>,
-        msg: CoconutBandwidthExecuteMsg,
-        memo: String,
-        funds: Vec<Coin>,
-    ) -> Result<ExecuteResult, NyxdError> {
-        let coconut_bandwidth_contract_address = self
-            .coconut_bandwidth_contract_address()
-            .ok_or_else(|| NyxdError::unavailable_contract_address("coconut bandwidth contract"))?;
-
-        let fee = fee.unwrap_or(Fee::Auto(Some(self.simulated_gas_multiplier())));
-        let signer_address = &self.signer_addresses()?[0];
-
-        self.execute(
-            signer_address,
-            coconut_bandwidth_contract_address,
-            &msg,
-            fee,
-            memo,
-            funds,
-        )
-        .await
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use crate::nyxd::contract_traits::tests::{mock_coin, IgnoreValue};
-
-    // it's enough that this compiles and clippy is happy about it
-    #[allow(dead_code)]
-    fn all_execute_variants_are_covered<C: CoconutBandwidthSigningClient + Send + Sync>(
-        client: C,
-        msg: CoconutBandwidthExecuteMsg,
-    ) {
-        match msg {
-            CoconutBandwidthExecuteMsg::DepositFunds { data } => client
-                .deposit(
-                    mock_coin(),
-                    data.deposit_info().to_string(),
-                    data.identity_key().to_string(),
-                    data.encryption_key().to_string(),
-                    None,
-                )
-                .ignore(),
-            CoconutBandwidthExecuteMsg::SpendCredential { data } => client
-                .spend_credential(
-                    mock_coin(),
-                    data.blinded_serial_number().to_string(),
-                    data.gateway_cosmos_address().to_string(),
-                    None,
-                )
-                .ignore(),
-            CoconutBandwidthExecuteMsg::ReleaseFunds { funds } => {
-                client.release_funds(funds.into(), None).ignore()
-            }
-        };
-    }
-}
@@ -51,6 +51,11 @@ pub trait DkgQueryClient {
        self.query_dkg_contract(request).await
    }

+    async fn get_epoch_threshold(&self, epoch_id: EpochId) -> Result<Option<u64>, NyxdError> {
+        let request = DkgQueryMsg::GetEpochThreshold { epoch_id };
+        self.query_dkg_contract(request).await
+    }
+
    async fn get_registered_dealer_details(
        &self,
        address: &AccountId,
@@ -256,6 +261,9 @@ mod tests {
            DkgQueryMsg::GetCurrentEpochThreshold {} => {
                client.get_current_epoch_threshold().ignore()
            }
+            DkgQueryMsg::GetEpochThreshold { epoch_id } => {
+                client.get_epoch_threshold(epoch_id).ignore()
+            }
            DkgQueryMsg::GetRegisteredDealer {
                dealer_address,
                epoch_id,
@@ -0,0 +1,123 @@
+// Copyright 2022-2023 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::collect_paged;
+use crate::nyxd::contract_traits::NymContractsProvider;
+use crate::nyxd::error::NyxdError;
+use crate::nyxd::CosmWasmClient;
+use async_trait::async_trait;
+use cosmwasm_std::Coin;
+use nym_ecash_contract_common::msg::QueryMsg as EcashQueryMsg;
+use serde::Deserialize;
+
+pub use nym_ecash_contract_common::blacklist::{
+    BlacklistedAccount, BlacklistedAccountResponse, PagedBlacklistedAccountResponse,
+};
+pub use nym_ecash_contract_common::deposit::{
+    Deposit, DepositData, DepositId, DepositResponse, PagedDepositsResponse,
+};
+
+#[cfg_attr(target_arch = "wasm32", async_trait(?Send))]
+#[cfg_attr(not(target_arch = "wasm32"), async_trait)]
+pub trait EcashQueryClient {
+    async fn query_ecash_contract<T>(&self, query: EcashQueryMsg) -> Result<T, NyxdError>
+    where
+        for<'a> T: Deserialize<'a>;
+
+    async fn get_blacklisted_account(
+        &self,
+        public_key: String,
+    ) -> Result<BlacklistedAccountResponse, NyxdError> {
+        self.query_ecash_contract(EcashQueryMsg::GetBlacklistedAccount { public_key })
+            .await
+    }
+
+    async fn get_blacklist_paged(
+        &self,
+        start_after: Option<String>,
+        limit: Option<u32>,
+    ) -> Result<PagedBlacklistedAccountResponse, NyxdError> {
+        self.query_ecash_contract(EcashQueryMsg::GetBlacklistPaged { start_after, limit })
+            .await
+    }
+
+    async fn get_required_deposit_amount(&self) -> Result<Coin, NyxdError> {
+        self.query_ecash_contract(EcashQueryMsg::GetRequiredDepositAmount {})
+            .await
+    }
+
+    async fn get_deposit(&self, deposit_id: u32) -> Result<DepositResponse, NyxdError> {
+        self.query_ecash_contract(EcashQueryMsg::GetDeposit { deposit_id })
+            .await
+    }
+
+    async fn get_deposits_paged(
+        &self,
+        start_after: Option<u32>,
+        limit: Option<u32>,
+    ) -> Result<PagedDepositsResponse, NyxdError> {
+        self.query_ecash_contract(EcashQueryMsg::GetDepositsPaged { start_after, limit })
+            .await
+    }
+}
+
+#[cfg_attr(target_arch = "wasm32", async_trait(?Send))]
+#[cfg_attr(not(target_arch = "wasm32"), async_trait)]
+pub trait PagedEcashQueryClient: EcashQueryClient {
+    async fn get_all_blacklisted_accounts(&self) -> Result<Vec<BlacklistedAccount>, NyxdError> {
+        collect_paged!(self, get_blacklist_paged, accounts)
+    }
+
+    async fn get_all_deposits(&self) -> Result<Vec<DepositData>, NyxdError> {
+        collect_paged!(self, get_deposits_paged, deposits)
+    }
+}
+
+#[async_trait]
+impl<T> PagedEcashQueryClient for T where T: EcashQueryClient {}
+
+#[cfg_attr(target_arch = "wasm32", async_trait(?Send))]
+#[cfg_attr(not(target_arch = "wasm32"), async_trait)]
+impl<C> EcashQueryClient for C
+where
+    C: CosmWasmClient + NymContractsProvider + Send + Sync,
+{
+    async fn query_ecash_contract<T>(&self, query: EcashQueryMsg) -> Result<T, NyxdError>
+    where
+        for<'a> T: Deserialize<'a>,
+    {
+        let ecash_contract_address = self
+            .ecash_contract_address()
+            .ok_or_else(|| NyxdError::unavailable_contract_address("coconut bandwidth contract"))?;
+        self.query_contract_smart(ecash_contract_address, &query)
+            .await
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::nyxd::contract_traits::tests::IgnoreValue;
+    use nym_ecash_contract_common::msg::QueryMsg;
+
+    // it's enough that this compiles and clippy is happy about it
+    #[allow(dead_code)]
+    fn all_query_variants_are_covered<C: EcashQueryClient + Send + Sync>(
+        client: C,
+        msg: EcashQueryMsg,
+    ) {
+        match msg {
+            EcashQueryMsg::GetBlacklistedAccount { public_key } => {
+                client.get_blacklisted_account(public_key).ignore()
+            }
+            QueryMsg::GetBlacklistPaged { limit, start_after } => {
+                client.get_blacklist_paged(start_after, limit).ignore()
+            }
+            QueryMsg::GetDeposit { deposit_id } => client.get_deposit(deposit_id).ignore(),
+            QueryMsg::GetDepositsPaged { limit, start_after } => {
+                client.get_deposits_paged(start_after, limit).ignore()
+            }
+            QueryMsg::GetRequiredDepositAmount {} => client.get_required_deposit_amount().ignore(),
+        };
+    }
+}
@@ -0,0 +1,149 @@
+// Copyright 2022 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::nyxd::contract_traits::NymContractsProvider;
+use crate::nyxd::cosmwasm_client::types::ExecuteResult;
+use crate::nyxd::error::NyxdError;
+use crate::nyxd::{Coin, Fee, SigningCosmWasmClient};
+use crate::signing::signer::OfflineSigner;
+use async_trait::async_trait;
+use nym_ecash_contract_common::msg::ExecuteMsg as EcashExecuteMsg;
+
+#[cfg_attr(target_arch = "wasm32", async_trait(?Send))]
+#[cfg_attr(not(target_arch = "wasm32"), async_trait)]
+pub trait EcashSigningClient {
+    async fn execute_ecash_contract(
+        &self,
+        fee: Option<Fee>,
+        msg: EcashExecuteMsg,
+        memo: String,
+        funds: Vec<Coin>,
+    ) -> Result<ExecuteResult, NyxdError>;
+
+    async fn make_ticketbook_deposit(
+        &self,
+        public_key: String,
+        deposit_amount: Coin,
+        fee: Option<Fee>,
+    ) -> Result<ExecuteResult, NyxdError> {
+        let req = EcashExecuteMsg::DepositTicketBookFunds {
+            identity_key: public_key,
+        };
+        self.execute_ecash_contract(fee, req, "Ecash::Deposit".to_string(), vec![deposit_amount])
+            .await
+    }
+
+    async fn request_ticket_redemption(
+        &self,
+        commitment_bs58: String,
+        number_of_tickets: u16,
+        fee: Option<Fee>,
+    ) -> Result<ExecuteResult, NyxdError> {
+        let req = EcashExecuteMsg::RequestRedemption {
+            commitment_bs58,
+            number_of_tickets,
+        };
+        self.execute_ecash_contract(fee, req, Default::default(), vec![])
+            .await
+    }
+
+    async fn update_admin(
+        &self,
+        admin: String,
+        fee: Option<Fee>,
+    ) -> Result<ExecuteResult, NyxdError> {
+        let req = EcashExecuteMsg::UpdateAdmin { admin };
+        self.execute_ecash_contract(fee, req, "Ecash::UpdateAdmin".to_string(), vec![])
+            .await
+    }
+
+    async fn update_deposit_value(
+        &self,
+        new_deposit: Coin,
+        fee: Option<Fee>,
+    ) -> Result<ExecuteResult, NyxdError> {
+        let req = EcashExecuteMsg::UpdateDepositValue {
+            new_deposit: new_deposit.into(),
+        };
+        self.execute_ecash_contract(fee, req, "Ecash::UpdateDepositValue".to_string(), vec![])
+            .await
+    }
+
+    async fn propose_for_blacklist(
+        &self,
+        public_key: String,
+        fee: Option<Fee>,
+    ) -> Result<ExecuteResult, NyxdError> {
+        let req = EcashExecuteMsg::ProposeToBlacklist { public_key };
+        self.execute_ecash_contract(fee, req, "Ecash::ProposeToBlacklist".to_string(), vec![])
+            .await
+    }
+}
+
+#[cfg_attr(target_arch = "wasm32", async_trait(?Send))]
+#[cfg_attr(not(target_arch = "wasm32"), async_trait)]
+impl<C> EcashSigningClient for C
+where
+    C: SigningCosmWasmClient + NymContractsProvider + Sync,
+    NyxdError: From<<Self as OfflineSigner>::Error>,
+{
+    async fn execute_ecash_contract(
+        &self,
+        fee: Option<Fee>,
+        msg: EcashExecuteMsg,
+        memo: String,
+        funds: Vec<Coin>,
+    ) -> Result<ExecuteResult, NyxdError> {
+        let ecash_contract_address = self
+            .ecash_contract_address()
+            .ok_or_else(|| NyxdError::unavailable_contract_address("coconut bandwidth contract"))?;
+
+        let fee = fee.unwrap_or(Fee::Auto(Some(self.simulated_gas_multiplier())));
+        let signer_address = &self.signer_addresses()?[0];
+
+        self.execute(
+            signer_address,
+            ecash_contract_address,
+            &msg,
+            fee,
+            memo,
+            funds,
+        )
+        .await
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::nyxd::contract_traits::tests::{mock_coin, IgnoreValue};
+    use nym_ecash_contract_common::msg::ExecuteMsg;
+
+    // it's enough that this compiles and clippy is happy about it
+    #[allow(dead_code)]
+    fn all_execute_variants_are_covered<C: EcashSigningClient + Send + Sync>(
+        client: C,
+        msg: EcashExecuteMsg,
+    ) {
+        match msg {
+            EcashExecuteMsg::DepositTicketBookFunds { identity_key } => client
+                .make_ticketbook_deposit(identity_key.to_string(), mock_coin(), None)
+                .ignore(),
+            EcashExecuteMsg::AddToBlacklist { public_key: _ } => unimplemented!(), //no add to blacklist method on client
+            EcashExecuteMsg::ProposeToBlacklist { public_key } => {
+                client.propose_for_blacklist(public_key, None).ignore()
+            }
+            ExecuteMsg::RequestRedemption {
+                commitment_bs58,
+                number_of_tickets,
+            } => client
+                .request_ticket_redemption(commitment_bs58, number_of_tickets, None)
+                .ignore(),
+            ExecuteMsg::RedeemTickets { .. } => unimplemented!(), // no redeem tickets method for the client
+            ExecuteMsg::UpdateAdmin { admin } => client.update_admin(admin, None).ignore(),
+            ExecuteMsg::UpdateDepositValue { new_deposit } => client
+                .update_deposit_value(new_deposit.into(), None)
+                .ignore(),
+        };
+    }
+}
@@ -8,34 +8,32 @@ use std::str::FromStr;
 // TODO: all of those could/should be derived via a macro

 // query clients
-pub mod coconut_bandwidth_query_client;
 pub mod dkg_query_client;
+pub mod ecash_query_client;
 pub mod group_query_client;
 pub mod mixnet_query_client;
 pub mod multisig_query_client;
 pub mod vesting_query_client;

 // signing clients
-pub mod coconut_bandwidth_signing_client;
 pub mod dkg_signing_client;
+pub mod ecash_signing_client;
 pub mod group_signing_client;
 pub mod mixnet_signing_client;
 pub mod multisig_signing_client;
 pub mod vesting_signing_client;

 // re-export query traits
-pub use coconut_bandwidth_query_client::{
-    CoconutBandwidthQueryClient, PagedCoconutBandwidthQueryClient,
-};
 pub use dkg_query_client::{DkgQueryClient, PagedDkgQueryClient};
+pub use ecash_query_client::{EcashQueryClient, PagedEcashQueryClient};
 pub use group_query_client::{GroupQueryClient, PagedGroupQueryClient};
 pub use mixnet_query_client::{MixnetQueryClient, PagedMixnetQueryClient};
 pub use multisig_query_client::{MultisigQueryClient, PagedMultisigQueryClient};
 pub use vesting_query_client::{PagedVestingQueryClient, VestingQueryClient};

 // re-export signing traits
-pub use coconut_bandwidth_signing_client::CoconutBandwidthSigningClient;
 pub use dkg_signing_client::DkgSigningClient;
+pub use ecash_signing_client::EcashSigningClient;
 pub use group_signing_client::GroupSigningClient;
 pub use mixnet_signing_client::MixnetSigningClient;
 pub use multisig_signing_client::MultisigSigningClient;
@@ -48,7 +46,7 @@ pub trait NymContractsProvider {
    fn vesting_contract_address(&self) -> Option<&AccountId>;

    // coconut-related
-    fn coconut_bandwidth_contract_address(&self) -> Option<&AccountId>;
+    fn ecash_contract_address(&self) -> Option<&AccountId>;
    fn dkg_contract_address(&self) -> Option<&AccountId>;
    fn group_contract_address(&self) -> Option<&AccountId>;
    fn multisig_contract_address(&self) -> Option<&AccountId>;
@@ -59,7 +57,7 @@ pub struct TypedNymContracts {
    pub mixnet_contract_address: Option<AccountId>,
    pub vesting_contract_address: Option<AccountId>,

-    pub coconut_bandwidth_contract_address: Option<AccountId>,
+    pub ecash_contract_address: Option<AccountId>,
    pub group_contract_address: Option<AccountId>,
    pub multisig_contract_address: Option<AccountId>,
    pub coconut_dkg_contract_address: Option<AccountId>,
@@ -78,8 +76,8 @@ impl TryFrom<NymContracts> for TypedNymContracts {
                .vesting_contract_address
                .map(|addr| addr.parse())
                .transpose()?,
-            coconut_bandwidth_contract_address: value
-                .coconut_bandwidth_contract_address
+            ecash_contract_address: value
+                .ecash_contract_address
                .map(|addr| addr.parse())
                .transpose()?,
            group_contract_address: value
@@ -6,7 +6,7 @@ use crate::nyxd::error::NyxdError;
 use crate::nyxd::CosmWasmClient;
 use async_trait::async_trait;
 use cw3::{
-    ProposalListResponse, ProposalResponse, VoteListResponse, VoteResponse, VoterDetail,
+    ProposalListResponse, ProposalResponse, VoteInfo, VoteListResponse, VoteResponse, VoterDetail,
    VoterListResponse, VoterResponse,
 };
 use cw_utils::ThresholdResponse;
@@ -134,6 +134,28 @@ pub trait PagedMultisigQueryClient: MultisigQueryClient {

        Ok(voters)
    }
+
+    async fn get_all_votes(&self, proposal_id: u64) -> Result<Vec<VoteInfo>, NyxdError> {
+        let mut votes = Vec::new();
+        let mut start_after = None;
+
+        loop {
+            let mut paged_response = self
+                .list_votes(proposal_id, start_after.take(), None)
+                .await?;
+
+            let last_voter = paged_response.votes.last().map(|vote| vote.voter.clone());
+            votes.append(&mut paged_response.votes);
+
+            if let Some(start_after_res) = last_voter {
+                start_after = Some(start_after_res)
+            } else {
+                break;
+            }
+        }
+
+        Ok(votes)
+    }
 }

 #[async_trait]
@@ -31,15 +31,15 @@ pub trait MultisigSigningClient: NymContractsProvider {
        voucher_value: Coin,
        fee: Option<Fee>,
    ) -> Result<ExecuteResult, NyxdError> {
-        let coconut_bandwidth_contract_address = self
-            .coconut_bandwidth_contract_address()
+        let ecash_contract_address = self
+            .ecash_contract_address()
            .ok_or_else(|| NyxdError::unavailable_contract_address("coconut bandwidth contract"))?;

        let release_funds_req = CoconutBandwidthExecuteMsg::ReleaseFunds {
            funds: voucher_value.into(),
        };
        let release_funds_msg = CosmosMsg::Wasm(WasmMsg::Execute {
-            contract_addr: coconut_bandwidth_contract_address.to_string(),
+            contract_addr: ecash_contract_address.to_string(),
            msg: to_binary(&release_funds_req)?,
            funds: vec![],
        });
@@ -2,17 +2,21 @@
 // SPDX-License-Identifier: Apache-2.0

 use crate::nyxd::cosmwasm_client::client_traits::CosmWasmClient;
-use crate::nyxd::cosmwasm_client::helpers::{compress_wasm_code, CheckResponse};
-use crate::nyxd::cosmwasm_client::logs::{self, parse_raw_logs};
+use crate::nyxd::cosmwasm_client::helpers::{
+    compress_wasm_code, parse_msg_responses, CheckResponse,
+};
+use crate::nyxd::cosmwasm_client::logs::parse_raw_logs;
 use crate::nyxd::cosmwasm_client::types::*;
 use crate::nyxd::error::NyxdError;
 use crate::nyxd::fee::{Fee, DEFAULT_SIMULATED_GAS_MULTIPLIER};
+use crate::nyxd::helpers::find_tx_attribute;
 use crate::nyxd::{Coin, GasAdjustable, GasPrice, TxResponse};
 use crate::signing::signer::OfflineSigner;
 use crate::signing::tx_signer::TxSigner;
 use crate::signing::SignerData;
 use async_trait::async_trait;
 use cosmrs::bank::MsgSend;
+use cosmrs::cosmwasm::{MsgClearAdmin, MsgUpdateAdmin};
 use cosmrs::distribution::MsgWithdrawDelegatorReward;
 use cosmrs::feegrant::{
    AllowedMsgAllowance, BasicAllowance, MsgGrantAllowance, MsgRevokeAllowance,
@@ -25,7 +29,6 @@ use log::debug;
 use serde::Serialize;
 use sha2::Digest;
 use sha2::Sha256;
-
 use std::time::SystemTime;
 use tendermint_rpc::endpoint::broadcast;

@@ -117,7 +120,7 @@ where
            .await?
            .check_response()?;

-        let logs = parse_raw_logs(tx_res.tx_result.log)?;
+        let logs = parse_raw_logs(&tx_res.tx_result.log)?;
        let gas_info = GasInfo {
            gas_wanted: tx_res.tx_result.gas_wanted.try_into().unwrap_or_default(),
            gas_used: tx_res.tx_result.gas_used.try_into().unwrap_or_default(),
@@ -127,9 +130,8 @@ where
        // the reason I think unwrap here is fine is that if the transaction succeeded and those
        // fields do not exist or code_id is not a number, there's no way we can recover, we're probably connected
        // to wrong validator or something
-        let code_id = logs::find_attribute(&logs, "store_code", "code_id")
+        let code_id = find_tx_attribute(&tx_res, "store_code", "code_id")
            .unwrap()
-            .value
            .parse()
            .unwrap();

@@ -140,6 +142,7 @@ where
            compressed_checksum,
            code_id,
            logs,
+            events: tx_res.tx_result.events,
            transaction_hash: tx_res.hash,
            gas_info,
        })
@@ -181,7 +184,7 @@ where
            .await?
            .check_response()?;

-        let logs = parse_raw_logs(tx_res.tx_result.log)?;
+        let logs = parse_raw_logs(&tx_res.tx_result.log)?;
        let gas_info = GasInfo {
            gas_wanted: tx_res.tx_result.gas_wanted.try_into().unwrap_or_default(),
            gas_used: tx_res.tx_result.gas_used.try_into().unwrap_or_default(),
@@ -190,15 +193,15 @@ where
        // the reason I think unwrap here is fine is that if the transaction succeeded and those
        // fields do not exist or address is malformed, there's no way we can recover, we're probably connected
        // to wrong validator or something
-        let contract_address = logs::find_attribute(&logs, "instantiate", "_contract_address")
+        let contract_address = find_tx_attribute(&tx_res, "instantiate", "_contract_address")
            .unwrap()
-            .value
            .parse()
            .unwrap();

        Ok(InstantiateResult {
            contract_address,
            logs,
+            events: tx_res.tx_result.events,
            transaction_hash: tx_res.hash,
            gas_info,
        })
@@ -212,7 +215,7 @@ where
        fee: Fee,
        memo: impl Into<String> + Send + 'static,
    ) -> Result<ChangeAdminResult, NyxdError> {
-        let change_admin_msg = sealed::cosmwasm::MsgUpdateAdmin {
+        let change_admin_msg = MsgUpdateAdmin {
            sender: sender_address.clone(),
            new_admin: new_admin.clone(),
            contract: contract_address.clone(),
@@ -231,6 +234,7 @@ where
        };
        Ok(ChangeAdminResult {
            logs: parse_raw_logs(tx_res.tx_result.log)?,
+            events: tx_res.tx_result.events,
            transaction_hash: tx_res.hash,
            gas_info,
        })
@@ -243,7 +247,7 @@ where
        fee: Fee,
        memo: impl Into<String> + Send + 'static,
    ) -> Result<ChangeAdminResult, NyxdError> {
-        let change_admin_msg = sealed::cosmwasm::MsgClearAdmin {
+        let change_admin_msg = MsgClearAdmin {
            sender: sender_address.clone(),
            contract: contract_address.clone(),
        }
@@ -261,6 +265,7 @@ where
        };
        Ok(ChangeAdminResult {
            logs: parse_raw_logs(tx_res.tx_result.log)?,
+            events: tx_res.tx_result.events,
            transaction_hash: tx_res.hash,
            gas_info,
        })
@@ -298,6 +303,7 @@ where
        };
        Ok(MigrateResult {
            logs: parse_raw_logs(tx_res.tx_result.log)?,
+            events: tx_res.tx_result.events,
            transaction_hash: tx_res.hash,
            gas_info,
        })
@@ -333,9 +339,11 @@ where
            gas_wanted: tx_res.tx_result.gas_wanted.try_into().unwrap_or_default(),
            gas_used: tx_res.tx_result.gas_used.try_into().unwrap_or_default(),
        };
+
        Ok(ExecuteResult {
            logs: parse_raw_logs(tx_res.tx_result.log)?,
-            data: tx_res.tx_result.data.into(),
+            msg_responses: parse_msg_responses(tx_res.tx_result.data),
+            events: tx_res.tx_result.events,
            transaction_hash: tx_res.hash,
            gas_info,
        })
@@ -378,7 +386,8 @@ where
        };
        Ok(ExecuteResult {
            logs: parse_raw_logs(tx_res.tx_result.log)?,
-            data: tx_res.tx_result.data.into(),
+            msg_responses: parse_msg_responses(tx_res.tx_result.data),
+            events: tx_res.tx_result.events,
            transaction_hash: tx_res.hash,
            gas_info,
        })
@@ -707,167 +716,3 @@ where
        )?)
    }
 }
-
-// a temporary bypass until https://github.com/cosmos/cosmos-rust/pull/419 is merged
-mod sealed {
-    pub mod cosmwasm {
-        use cosmrs::{proto, tx::Msg, AccountId, ErrorReport, Result};
-
-        /// MsgUpdateAdmin sets a new admin for a smart contract
-        #[derive(Clone, Debug, Eq, PartialEq, PartialOrd, Ord)]
-        pub struct MsgUpdateAdmin {
-            /// Sender is the that actor that signed the messages
-            pub sender: AccountId,
-
-            /// NewAdmin address to be set
-            pub new_admin: AccountId,
-
-            /// Contract is the address of the smart contract
-            pub contract: AccountId,
-        }
-
-        impl Msg for MsgUpdateAdmin {
-            type Proto = proto::cosmwasm::wasm::v1::MsgUpdateAdmin;
-        }
-
-        impl TryFrom<proto::cosmwasm::wasm::v1::MsgUpdateAdmin> for MsgUpdateAdmin {
-            type Error = ErrorReport;
-
-            fn try_from(
-                proto: proto::cosmwasm::wasm::v1::MsgUpdateAdmin,
-            ) -> Result<MsgUpdateAdmin> {
-                MsgUpdateAdmin::try_from(&proto)
-            }
-        }
-
-        impl TryFrom<&proto::cosmwasm::wasm::v1::MsgUpdateAdmin> for MsgUpdateAdmin {
-            type Error = ErrorReport;
-
-            fn try_from(
-                proto: &proto::cosmwasm::wasm::v1::MsgUpdateAdmin,
-            ) -> Result<MsgUpdateAdmin> {
-                Ok(MsgUpdateAdmin {
-                    sender: proto.sender.parse()?,
-                    new_admin: proto.new_admin.parse()?,
-                    contract: proto.contract.parse()?,
-                })
-            }
-        }
-
-        impl From<MsgUpdateAdmin> for proto::cosmwasm::wasm::v1::MsgUpdateAdmin {
-            fn from(msg: MsgUpdateAdmin) -> proto::cosmwasm::wasm::v1::MsgUpdateAdmin {
-                proto::cosmwasm::wasm::v1::MsgUpdateAdmin::from(&msg)
-            }
-        }
-
-        impl From<&MsgUpdateAdmin> for proto::cosmwasm::wasm::v1::MsgUpdateAdmin {
-            fn from(msg: &MsgUpdateAdmin) -> proto::cosmwasm::wasm::v1::MsgUpdateAdmin {
-                proto::cosmwasm::wasm::v1::MsgUpdateAdmin {
-                    sender: msg.sender.to_string(),
-                    new_admin: msg.new_admin.to_string(),
-                    contract: msg.contract.to_string(),
-                }
-            }
-        }
-
-        /// MsgUpdateAdminResponse returns empty data
-        #[derive(Clone, Copy, Debug, Eq, PartialEq, PartialOrd, Ord)]
-        pub struct MsgUpdateAdminResponse {}
-
-        impl Msg for MsgUpdateAdminResponse {
-            type Proto = proto::cosmwasm::wasm::v1::MsgUpdateAdminResponse;
-        }
-
-        impl TryFrom<proto::cosmwasm::wasm::v1::MsgUpdateAdminResponse> for MsgUpdateAdminResponse {
-            type Error = ErrorReport;
-
-            fn try_from(
-                _proto: proto::cosmwasm::wasm::v1::MsgUpdateAdminResponse,
-            ) -> Result<MsgUpdateAdminResponse> {
-                Ok(MsgUpdateAdminResponse {})
-            }
-        }
-
-        impl From<MsgUpdateAdminResponse> for proto::cosmwasm::wasm::v1::MsgUpdateAdminResponse {
-            fn from(
-                _msg: MsgUpdateAdminResponse,
-            ) -> proto::cosmwasm::wasm::v1::MsgUpdateAdminResponse {
-                proto::cosmwasm::wasm::v1::MsgUpdateAdminResponse {}
-            }
-        }
-
-        /// MsgClearAdmin removes any admin stored for a smart contract
-        #[derive(Clone, Debug, Eq, PartialEq, PartialOrd, Ord)]
-        pub struct MsgClearAdmin {
-            /// Sender is the that actor that signed the messages
-            pub sender: AccountId,
-
-            /// Contract is the address of the smart contract
-            pub contract: AccountId,
-        }
-
-        impl Msg for MsgClearAdmin {
-            type Proto = proto::cosmwasm::wasm::v1::MsgClearAdmin;
-        }
-
-        impl TryFrom<proto::cosmwasm::wasm::v1::MsgClearAdmin> for MsgClearAdmin {
-            type Error = ErrorReport;
-
-            fn try_from(proto: proto::cosmwasm::wasm::v1::MsgClearAdmin) -> Result<MsgClearAdmin> {
-                MsgClearAdmin::try_from(&proto)
-            }
-        }
-
-        impl TryFrom<&proto::cosmwasm::wasm::v1::MsgClearAdmin> for MsgClearAdmin {
-            type Error = ErrorReport;
-
-            fn try_from(proto: &proto::cosmwasm::wasm::v1::MsgClearAdmin) -> Result<MsgClearAdmin> {
-                Ok(MsgClearAdmin {
-                    sender: proto.sender.parse()?,
-                    contract: proto.contract.parse()?,
-                })
-            }
-        }
-
-        impl From<MsgClearAdmin> for proto::cosmwasm::wasm::v1::MsgClearAdmin {
-            fn from(msg: MsgClearAdmin) -> proto::cosmwasm::wasm::v1::MsgClearAdmin {
-                proto::cosmwasm::wasm::v1::MsgClearAdmin::from(&msg)
-            }
-        }
-
-        impl From<&MsgClearAdmin> for proto::cosmwasm::wasm::v1::MsgClearAdmin {
-            fn from(msg: &MsgClearAdmin) -> proto::cosmwasm::wasm::v1::MsgClearAdmin {
-                proto::cosmwasm::wasm::v1::MsgClearAdmin {
-                    sender: msg.sender.to_string(),
-                    contract: msg.contract.to_string(),
-                }
-            }
-        }
-
-        /// MsgClearAdminResponse returns empty data
-        #[derive(Clone, Copy, Debug, Eq, PartialEq, PartialOrd, Ord)]
-        pub struct MsgClearAdminResponse {}
-
-        impl Msg for MsgClearAdminResponse {
-            type Proto = proto::cosmwasm::wasm::v1::MsgClearAdminResponse;
-        }
-
-        impl TryFrom<proto::cosmwasm::wasm::v1::MsgClearAdminResponse> for MsgClearAdminResponse {
-            type Error = ErrorReport;
-
-            fn try_from(
-                _proto: proto::cosmwasm::wasm::v1::MsgClearAdminResponse,
-            ) -> Result<MsgClearAdminResponse> {
-                Ok(MsgClearAdminResponse {})
-            }
-        }
-
-        impl From<MsgClearAdminResponse> for proto::cosmwasm::wasm::v1::MsgClearAdminResponse {
-            fn from(
-                _msg: MsgClearAdminResponse,
-            ) -> proto::cosmwasm::wasm::v1::MsgClearAdminResponse {
-                proto::cosmwasm::wasm::v1::MsgClearAdminResponse {}
-            }
-        }
-    }
-}
@@ -2,9 +2,87 @@
 // SPDX-License-Identifier: Apache-2.0

 use crate::nyxd::error::NyxdError;
+use cosmrs::abci::TxMsgData;
+use cosmrs::cosmwasm::MsgExecuteContractResponse;
 use cosmrs::proto::cosmos::base::query::v1beta1::{PageRequest, PageResponse};
+use log::error;
+use prost::bytes::Bytes;
 use tendermint_rpc::endpoint::broadcast;

+use crate::nyxd::cosmwasm_client::types::ExecuteResult;
+pub use cosmrs::abci::MsgResponse;
+
+pub fn parse_msg_responses(data: Bytes) -> Vec<MsgResponse> {
+    // it seems that currently, on wasmd 0.43 + tendermint-rs 0.37 + cosmrs 0.17.0-pre
+    // the data is left in undecoded base64 form, but I'd imagine this might change so if the decoding fails,
+    // use the bytes directly instead
+    let data = if let Ok(decoded) = base64::decode(&data) {
+        decoded
+    } else {
+        error!("failed to base64-decode the 'data' field of the TxResponse - has the chain been upgraded and introduced some breaking changes?");
+        data.into()
+    };
+
+    match TxMsgData::try_from(data) {
+        Ok(tx_msg_data) => tx_msg_data.msg_responses,
+        Err(err) => {
+            error!("failed to parse tx responses - has the chain been upgraded and introduced some breaking changes? the error was {err}");
+            Vec::new()
+        }
+    }
+}
+
+// requires there's a single response message
+pub trait ToSingletonContractData: Sized {
+    fn parse_singleton_u32_contract_data(&self) -> Result<u32, NyxdError> {
+        let b = self.to_singleton_contract_data()?;
+        if b.len() != 4 {
+            return Err(NyxdError::MalformedResponseData {
+                got: b.len(),
+                expected: 4,
+            });
+        }
+        Ok(u32::from_be_bytes([b[0], b[1], b[2], b[3]]))
+    }
+
+    fn parse_singleton_u64_contract_data(&self) -> Result<u64, NyxdError> {
+        let b = self.to_singleton_contract_data()?;
+        if b.len() != 8 {
+            return Err(NyxdError::MalformedResponseData {
+                got: b.len(),
+                expected: 8,
+            });
+        }
+        Ok(u64::from_be_bytes([
+            b[0], b[1], b[2], b[3], b[4], b[5], b[6], b[7],
+        ]))
+    }
+
+    fn to_singleton_contract_data(&self) -> Result<Vec<u8>, NyxdError>;
+}
+
+impl ToSingletonContractData for ExecuteResult {
+    fn to_singleton_contract_data(&self) -> Result<Vec<u8>, NyxdError> {
+        if self.msg_responses.len() != 1 {
+            return Err(NyxdError::UnexpectedNumberOfMsgResponses {
+                got: self.msg_responses.len(),
+            });
+        }
+
+        self.msg_responses[0].to_contract_response_data()
+    }
+}
+
+pub trait ToContractResponseData: Sized {
+    fn to_contract_response_data(&self) -> Result<Vec<u8>, NyxdError>;
+}
+
+impl ToContractResponseData for MsgResponse {
+    fn to_contract_response_data(&self) -> Result<Vec<u8>, NyxdError> {
+        Ok(self.try_decode_as::<MsgExecuteContractResponse>()?.data)
+    }
+}
+
 pub(crate) trait CheckResponse: Sized {
    fn check_response(self) -> Result<Self, NyxdError>;
 }
@@ -3,22 +3,19 @@

 use crate::nyxd::error::NyxdError;
 use itertools::Itertools;
+use nym_ecash_contract_common::events::PROPOSAL_ID_ATTRIBUTE_NAME;
 use serde::{Deserialize, Serialize};

-pub use nym_coconut_bandwidth_contract_common::event_attributes::*;
 pub use nym_coconut_dkg_common::event_attributes::*;
+pub use nym_ecash_contract_common::event_attributes::*;

 // it seems that currently validators just emit stringified events (which are also returned as part of deliverTx response)
-// as theirs logs
+// as their logs
 #[derive(Debug, Serialize, Deserialize)]
 pub struct Log {
    #[serde(default)]
    // weird thing is that the first msg_index seems to always be undefined on the raw logs
    pub msg_index: usize,
-    // unless I'm missing something obvious, the "log" type in cosmjs is always an empty string
-    // and launchpad cosmos validator was setting it to what essentially is just the raw version of what
-    // we received (and we don't care about launchpad, we, as the time of writing this, work on the stargate)
-    // log: String,
    pub events: Vec<cosmwasm_std::Event>,
 }

@@ -37,8 +34,32 @@ pub fn find_attribute<'a>(
        .find(|attr| attr.key == attribute_key)
 }

-// those two functions were separated so that the internal logic could actually be tested
+/// Search for the proposal id in the given log. It'll be in the LAST wasm event, with attribute key "proposal_id"
+pub fn find_proposal_id(logs: &[Log]) -> Result<u64, NyxdError> {
+    let maybe_attributes = logs
+        .iter()
+        .rev()
+        .flat_map(|log| log.events.iter())
+        .find(|event| event.ty == "wasm")
+        .ok_or(NyxdError::ComswasmEventNotFound)?
+        .attributes
+        .iter()
+        .find(|attr| attr.key == PROPOSAL_ID_ATTRIBUTE_NAME);
+    let attribute = maybe_attributes.ok_or(NyxdError::ComswasmAttributeNotFound)?;
+
+    attribute
+        .value
+        .parse::<u64>()
+        .map_err(|_| NyxdError::DeserializationError("proposal_id".into()))
+}
+
+// these two functions were separated so that the internal logic could actually be tested
 fn parse_raw_str_logs(raw: &str) -> Result<Vec<Log>, NyxdError> {
+    // From Cosmos SDK > 0.50 onwards, log field is not populated
+    if raw.is_empty() {
+        return Ok(Vec::new());
+    }
+
    let logs: Vec<Log> = serde_json::from_str(raw).map_err(|_| NyxdError::MalformedLogString)?;
    if logs.len() != logs.iter().unique_by(|log| log.msg_index).count() {
        // this check is only here because I don't yet fully understand raw log string generation and
@@ -48,7 +69,7 @@ fn parse_raw_str_logs(raw: &str) -> Result<Vec<Log>, NyxdError> {
    Ok(logs)
 }

-pub fn parse_raw_logs(raw: String) -> Result<Vec<Log>, NyxdError> {
+pub fn parse_raw_logs<S: AsRef<str>>(raw: S) -> Result<Vec<Log>, NyxdError> {
    parse_raw_str_logs(raw.as_ref())
 }

@@ -18,6 +18,8 @@ use tendermint_rpc::endpoint::*;
 use tendermint_rpc::query::Query;
 use tendermint_rpc::{Error as TendermintRpcError, Order, Paging, SimpleRequest};

+pub use helpers::{ToContractResponseData, ToSingletonContractData};
+
 #[cfg(feature = "http-client")]
 use crate::http_client;
 #[cfg(feature = "http-client")]
@@ -30,6 +30,7 @@ use prost::Message;
 use serde::Serialize;

 pub use cosmrs::abci::GasInfo;
+pub use cosmrs::abci::MsgResponse;

 pub type ContractCodeId = u64;

@@ -232,13 +233,15 @@ pub struct UploadResult {

    pub logs: Vec<Log>,

+    pub events: Vec<abci::Event>,
+
    /// Transaction hash (might be used as transaction ID)
    pub transaction_hash: Hash,

    pub gas_info: GasInfo,
 }

-#[derive(Debug)]
+#[derive(Debug, Default)]
 pub struct InstantiateOptions {
    /// The funds that are transferred from the sender to the newly created contract.
    /// The funds are transferred as part of the message execution after the contract address is
@@ -260,6 +263,11 @@ impl InstantiateOptions {
            admin,
        }
    }
+
+    pub fn with_admin(mut self, admin: AccountId) -> Self {
+        self.admin = Some(admin);
+        self
+    }
 }

 #[derive(Debug, Serialize)]
@@ -269,6 +277,8 @@ pub struct InstantiateResult {

    pub logs: Vec<Log>,

+    pub events: Vec<abci::Event>,
+
    /// Transaction hash (might be used as transaction ID)
    pub transaction_hash: Hash,

@@ -279,6 +289,8 @@ pub struct InstantiateResult {
 pub struct ChangeAdminResult {
    pub logs: Vec<Log>,

+    pub events: Vec<abci::Event>,
+
    /// Transaction hash (might be used as transaction ID)
    pub transaction_hash: Hash,

@@ -289,6 +301,8 @@ pub struct ChangeAdminResult {
 pub struct MigrateResult {
    pub logs: Vec<Log>,

+    pub events: Vec<abci::Event>,
+
    /// Transaction hash (might be used as transaction ID)
    pub transaction_hash: Hash,

@@ -299,7 +313,9 @@ pub struct MigrateResult {
 pub struct ExecuteResult {
    pub logs: Vec<Log>,

-    pub data: Vec<u8>,
+    pub msg_responses: Vec<MsgResponse>,
+
+    pub events: Vec<abci::Event>,

    /// Transaction hash (might be used as transaction ID)
    pub transaction_hash: Hash,
@@ -32,6 +32,12 @@ pub enum NyxdError {
    #[error("There was an issue on the cosmrs side: {0}")]
    CosmrsErrorReport(#[from] cosmrs::ErrorReport),

+    #[error("cosmwasm event not found")]
+    ComswasmEventNotFound,
+
+    #[error("cosmwasm attribute not found")]
+    ComswasmAttributeNotFound,
+
    #[error("Failed to derive account address")]
    AccountDerivationError,

@@ -142,6 +148,12 @@ pub enum NyxdError {

    #[error("Account had an unexpected bech32 prefix. Expected: {expected}, got: {got}")]
    UnexpectedBech32Prefix { got: String, expected: String },
+
+    #[error("the transaction returned unexpected, {got}, number of MsgResponse. Expected to receive a single one")]
+    UnexpectedNumberOfMsgResponses { got: usize },
+
+    #[error("the response data has invalid size. got {got} bytes, but expected {expected} bytes instead")]
+    MalformedResponseData { got: usize, expected: usize },
 }

 // The purpose of parsing the abci query result is that we want to generate the `pretty_log` if
@@ -3,11 +3,16 @@

 use crate::nyxd::TxResponse;

+// Searches in events for an event of the given event type which contains an
+// attribute for with the given key.
 pub fn find_tx_attribute(tx: &TxResponse, event_type: &str, attribute_key: &str) -> Option<String> {
    let event = tx.tx_result.events.iter().find(|e| e.kind == event_type)?;
-    let attribute = event
-        .attributes
-        .iter()
-        .find(|attr| attr.key == attribute_key)?;
-    Some(attribute.value.clone())
+    let attribute = event.attributes.iter().find(|&attr| {
+        if let Ok(key_str) = attr.key_str() {
+            key_str == attribute_key
+        } else {
+            false
+        }
+    })?;
+    Some(attribute.value_str().ok().map(|str| str.to_string())).flatten()
 }
@@ -240,8 +240,8 @@ impl<C, S> NyxdClient<C, S> {
        self.config.contracts.vesting_contract_address = Some(address);
    }

-    pub fn set_coconut_bandwidth_contract_address(&mut self, address: AccountId) {
-        self.config.contracts.coconut_bandwidth_contract_address = Some(address);
+    pub fn set_ecash_contract_address(&mut self, address: AccountId) {
+        self.config.contracts.ecash_contract_address = Some(address);
    }

    pub fn set_multisig_contract_address(&mut self, address: AccountId) {
@@ -262,11 +262,8 @@ impl<C, S> NymContractsProvider for NyxdClient<C, S> {
        self.config.contracts.vesting_contract_address.as_ref()
    }

-    fn coconut_bandwidth_contract_address(&self) -> Option<&AccountId> {
-        self.config
-            .contracts
-            .coconut_bandwidth_contract_address
-            .as_ref()
+    fn ecash_contract_address(&self) -> Option<&AccountId> {
+        self.config.contracts.ecash_contract_address.as_ref()
    }

    fn dkg_contract_address(&self) -> Option<&AccountId> {
@@ -379,6 +376,14 @@ where
        }
    }

+    pub fn mix_coin(&self, amount: u128) -> Coin {
+        Coin::new(amount, &self.config.chain_details.mix_denom.base)
+    }
+
+    pub fn mix_coins(&self, amount: u128) -> Vec<Coin> {
+        vec![self.mix_coin(amount)]
+    }
+
    pub fn cw_address(&self) -> Addr {
        // the call to unchecked is fine here as we're converting directly from `AccountId`
        // which must have been a valid bech32 address
@@ -43,9 +43,9 @@ nym-contracts-common = { path = "../cosmwasm-smart-contracts/contracts-common" }
 nym-bandwidth-controller = { path = "../../common/bandwidth-controller" }
 nym-mixnet-contract-common = { path = "../cosmwasm-smart-contracts/mixnet-contract" }
 nym-vesting-contract-common = { path = "../cosmwasm-smart-contracts/vesting-contract" }
-nym-coconut-bandwidth-contract-common = { path = "../cosmwasm-smart-contracts/coconut-bandwidth-contract" }
 nym-coconut-dkg-common = { path = "../cosmwasm-smart-contracts/coconut-dkg" }
 nym-multisig-contract-common = { path = "../cosmwasm-smart-contracts/multisig-contract" }
+nym-ecash-contract-common = { path = "../cosmwasm-smart-contracts/ecash-contract" }
 nym-sphinx = { path = "../../common/nymsphinx" }
 nym-client-core = { path = "../../common/client-core" }
 nym-config = { path = "../../common/config" }
@@ -1,194 +0,0 @@
-// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
-// SPDX-License-Identifier: Apache-2.0
-
-use crate::context::SigningClient;
-use anyhow::{anyhow, bail};
-use clap::ArgGroup;
-use clap::Parser;
-use futures::StreamExt;
-use log::{error, info};
-use nym_coconut_dkg_common::types::EpochId;
-use nym_credential_utils::utils::block_until_coconut_is_available;
-use nym_credentials::coconut::bandwidth::freepass::MAX_FREE_PASS_VALIDITY;
-use nym_credentials::{
-    obtain_aggregate_verification_key, IssuanceBandwidthCredential, IssuedBandwidthCredential,
-};
-use nym_credentials_interface::VerificationKey;
-use nym_validator_client::coconut::all_coconut_api_clients;
-use nym_validator_client::nyxd::contract_traits::{DkgQueryClient, NymContractsProvider};
-use nym_validator_client::nyxd::CosmWasmClient;
-use nym_validator_client::signing::AccountData;
-use nym_validator_client::CoconutApiClient;
-use std::fs::File;
-use std::io::Write;
-use std::path::PathBuf;
-use std::sync::Arc;
-use time::format_description::well_known::Rfc3339;
-use time::OffsetDateTime;
-use zeroize::Zeroizing;
-
-fn parse_rfc3339_expiration_date(raw: &str) -> Result<OffsetDateTime, time::error::Parse> {
-    OffsetDateTime::parse(raw, &Rfc3339)
-}
-
-#[derive(Debug, Parser)]
-#[clap(group(ArgGroup::new("expiration").required(true)))]
-pub struct Args {
-    /// Specifies the expiration date of the free pass(es)
-    /// Can't be set to more than a week into the future.
-    #[clap(long, group = "expiration", value_parser = parse_rfc3339_expiration_date)]
-    pub(crate) expiration_date: Option<OffsetDateTime>,
-
-    /// The expiration of the free pass(es) expresses as unix timestamp.
-    /// Can't be set to more than a week into the future.
-    #[clap(long, group = "expiration")]
-    pub(crate) expiration_timestamp: Option<i64>,
-
-    /// The number of free passes to issue
-    #[clap(long, default_value = "1")]
-    pub(crate) amount: u64,
-
-    /// Path to the output directory for generated free passes.
-    #[clap(long)]
-    pub(crate) output_dir: PathBuf,
-}
-
-async fn get_freepass(
-    api_clients: Vec<CoconutApiClient>,
-    aggregate_vk: &VerificationKey,
-    threshold: u64,
-    epoch_id: EpochId,
-    signing_account: &AccountData,
-    expiration_date: OffsetDateTime,
-) -> anyhow::Result<IssuedBandwidthCredential> {
-    let issuance_pass = IssuanceBandwidthCredential::new_freepass(Some(expiration_date));
-    let signing_data = issuance_pass.prepare_for_signing();
-
-    let credential_shares = Arc::new(tokio::sync::Mutex::new(Vec::new()));
-
-    futures::stream::iter(api_clients)
-        .for_each_concurrent(None, |client| async {
-            // move the client into the block
-            let client = client;
-            let api_url = client.api_client.api_url();
-
-            info!("contacting {api_url} for blinded free pass");
-
-            match issuance_pass
-                .obtain_partial_freepass_credential(
-                    &client.api_client,
-                    signing_account,
-                    &client.verification_key,
-                    signing_data.clone(),
-                )
-                .await
-            {
-                Ok(partial_credential) => {
-                    credential_shares
-                        .lock()
-                        .await
-                        .push((partial_credential, client.node_id).into());
-                }
-                Err(err) => {
-                    error!("failed to obtain partial free pass from {api_url}: {err}")
-                }
-            }
-        })
-        .await;
-
-    // SAFETY: the futures have completed, so we MUST have the only arc reference
-    #[allow(clippy::unwrap_used)]
-    let credential_shares = Arc::into_inner(credential_shares).unwrap().into_inner();
-
-    if credential_shares.len() < threshold as usize {
-        bail!("we managed to obtain only {} partial credentials while the minimum threshold is {threshold}", credential_shares.len());
-    }
-
-    let signature = issuance_pass.aggregate_signature_shares(aggregate_vk, &credential_shares)?;
-    Ok(issuance_pass.into_issued_credential(signature, epoch_id))
-}
-
-pub async fn execute(args: Args, client: SigningClient) -> anyhow::Result<()> {
-    let address = client.address();
-
-    if !args.output_dir.is_dir() {
-        bail!("the provided output directory is not a directory!");
-    }
-
-    if args.output_dir.read_dir()?.next().is_some() {
-        bail!("the provided output directory is not empty!");
-    }
-
-    let Some(bandwidth_contract) = client.coconut_bandwidth_contract_address() else {
-        bail!("the bandwidth contract address is not set")
-    };
-
-    let Some(bandwidth_admin) = client
-        .get_contract(bandwidth_contract)
-        .await
-        .map(|c| c.contract_info.admin)?
-    else {
-        bail!("the bandwidth contract doesn't have any admin set")
-    };
-
-    // sanity checks since nym-apis will reject invalid requests anyway
-    if address != bandwidth_admin {
-        bail!("the provided mnemonic does not correspond to the current admin of the bandwidth contract")
-    }
-
-    let expiration_date = match args.expiration_date {
-        Some(date) => date,
-        // SAFETY: one of those arguments must have been set
-        None => OffsetDateTime::from_unix_timestamp(args.expiration_timestamp.unwrap())?,
-    };
-
-    let now = OffsetDateTime::now_utc();
-
-    if expiration_date > now + MAX_FREE_PASS_VALIDITY {
-        bail!("the provided free pass request has too long expiry (expiry is set to on {expiration_date})")
-    }
-
-    if expiration_date < now {
-        bail!("the provided free pass expiry is set in the past!")
-    }
-
-    // issuance start
-    block_until_coconut_is_available(&client).await?;
-
-    let signing_account = client.signing_account()?;
-
-    let epoch_id = client.get_current_epoch().await?.epoch_id;
-    let threshold = client
-        .get_current_epoch_threshold()
-        .await?
-        .ok_or(anyhow!("no threshold available"))?;
-    let api_clients = all_coconut_api_clients(&client, epoch_id).await?;
-
-    if api_clients.len() < threshold as usize {
-        bail!(
-            "we have only {} api clients available while the minimum threshold is {threshold}",
-            api_clients.len()
-        )
-    }
-    let aggregate_vk = obtain_aggregate_verification_key(&api_clients)?;
-
-    for i in 0..args.amount {
-        let human_index = i + 1;
-        info!("trying to obtain free pass {human_index}/{}", args.amount);
-        let free_pass = get_freepass(
-            api_clients.clone(),
-            &aggregate_vk,
-            threshold,
-            epoch_id,
-            &signing_account,
-            expiration_date,
-        )
-        .await?;
-        let credential_data = Zeroizing::new(free_pass.pack_v1());
-        let output = args.output_dir.join(format!("freepass_{i}.nym"));
-        info!("saving the freepass to '{}'", output.display());
-        File::create(output)?.write_all(&credential_data)?;
-    }
-
-    Ok(())
-}
@@ -7,7 +7,7 @@ use anyhow::bail;
 use clap::Parser;
 use nym_credential_storage::initialise_persistent_storage;
 use nym_credential_utils::utils;
-use nym_validator_client::nyxd::Coin;
+use nym_crypto::asymmetric::identity;
 use std::path::PathBuf;

 #[derive(Debug, Parser)]
@@ -15,21 +15,9 @@ pub struct Args {
    /// Config file of the client that is supposed to use the credential.
    #[clap(long)]
    pub(crate) client_config: PathBuf,
-
-    /// The amount of utokens the credential will hold.
-    #[clap(long, default_value = "0")]
-    pub(crate) amount: u64,
-
-    /// Path to a directory used to store recovery files for unconsumed deposits
-    #[clap(long)]
-    pub(crate) recovery_dir: PathBuf,
 }

 pub async fn execute(args: Args, client: SigningClient) -> anyhow::Result<()> {
-    if args.amount == 0 {
-        bail!("did not specify credential amount")
-    }
-
    let loaded = CommonConfigsWrapper::try_load(args.client_config)?;

    if let Ok(id) = loaded.try_get_id() {
@@ -40,16 +28,18 @@ pub async fn execute(args: Args, client: SigningClient) -> anyhow::Result<()> {
        bail!("the loaded config does not have a credentials store information")
    };

+    let Ok(private_id_key) = loaded.try_get_private_id_key() else {
+        bail!("the loaded config does not have a public id key information")
+    };
+
    println!(
        "using credentials store at '{}'",
        credentials_store.display()
    );

-    let denom = &client.current_chain_details().mix_denom.base;
-    let coin = Coin::new(args.amount as u128, denom);
-
    let persistent_storage = initialise_persistent_storage(credentials_store).await;
-    utils::issue_credential(&client, coin, &persistent_storage, args.recovery_dir).await?;
+    let private_id_key: identity::PrivateKey = nym_pemstore::load_key(private_id_key)?;
+    utils::issue_credential(&client, &persistent_storage, &private_id_key.to_bytes()).await?;

    Ok(())
 }
@@ -3,22 +3,20 @@

 use clap::{Args, Subcommand};

-pub mod generate_freepass;
-pub mod import_credential;
-pub mod issue_credentials;
-pub mod recover_credentials;
+pub mod import_ticket_book;
+pub mod issue_ticket_book;
+pub mod recover_ticket_book;

 #[derive(Debug, Args)]
 #[clap(args_conflicts_with_subcommands = true, subcommand_required = true)]
-pub struct Coconut {
+pub struct Ecash {
    #[clap(subcommand)]
-    pub command: CoconutCommands,
+    pub command: EcashCommands,
 }

 #[derive(Debug, Subcommand)]
-pub enum CoconutCommands {
-    GenerateFreepass(generate_freepass::Args),
-    IssueCredentials(issue_credentials::Args),
-    RecoverCredentials(recover_credentials::Args),
-    ImportCredential(import_credential::Args),
+pub enum EcashCommands {
+    IssueTicketBook(issue_ticket_book::Args),
+    RecoverTicketBook(recover_ticket_book::Args),
+    ImportTicketBook(import_ticket_book::Args),
 }
@@ -6,7 +6,7 @@ use crate::utils::CommonConfigsWrapper;
 use anyhow::bail;
 use clap::Parser;
 use nym_credential_storage::initialise_persistent_storage;
-use nym_credential_utils::{recovery_storage, utils};
+use nym_credential_utils::utils;
 use std::path::PathBuf;

 #[derive(Debug, Parser)]
@@ -14,10 +14,6 @@ pub struct Args {
    /// Config file of the client that is supposed to use the credential.
    #[clap(long)]
    pub(crate) client_config: PathBuf,
-
-    /// Path to a directory used to store recovery files for unconsumed deposits
-    #[clap(long)]
-    pub(crate) recovery_dir: PathBuf,
 }

 pub async fn execute(args: Args, client: QueryClient) -> anyhow::Result<()> {
@@ -37,12 +33,9 @@ pub async fn execute(args: Args, client: QueryClient) -> anyhow::Result<()> {
    );

    let persistent_storage = initialise_persistent_storage(credentials_store).await;
-    let recovery_storage = recovery_storage::RecoveryStorage::new(args.recovery_dir)?;

-    let recovered =
-        utils::recover_credentials(&client, &recovery_storage, &persistent_storage).await?;
+    let recovered = utils::recover_deposits(&client, &persistent_storage).await?;

-    // TODO: denom?
-    println!("recovered {recovered} worth of credentials");
+    println!("recovered {recovered} ticketbooks");
    Ok(())
 }
@@ -123,6 +123,21 @@ impl CommonConfigsWrapper {
        }
    }

+    pub(crate) fn try_get_private_id_key(&self) -> anyhow::Result<PathBuf> {
+        match self {
+            CommonConfigsWrapper::NymClients(cfg) => Ok(cfg
+                .storage_paths
+                .inner
+                .keys
+                .private_identity_key_file
+                .clone()),
+            CommonConfigsWrapper::NymApi(_cfg) => {
+                todo!() //SW this will depend on the new network monitor structure. Ping @Drazen
+            }
+            CommonConfigsWrapper::Unknown(cfg) => cfg.try_get_private_id_key(),
+        }
+    }
+
    pub(crate) fn try_get_credentials_store(&self) -> anyhow::Result<PathBuf> {
        match self {
            CommonConfigsWrapper::NymClients(cfg) => {
@@ -225,4 +240,17 @@ impl UnknownConfigWrapper {
            bail!("no 'credentials_database_path' field present in the config")
        }
    }
+
+    pub(crate) fn try_get_private_id_key(&self) -> anyhow::Result<PathBuf> {
+        let id_val = self
+            .find_value("keys.private_identity_key_file")
+            .ok_or_else(|| {
+                anyhow!("no 'keys.private_identity_key_file' field present in the config")
+            })?;
+        if let toml::Value::String(pub_id_key) = id_val {
+            Ok(pub_id_key.parse()?)
+        } else {
+            bail!("no 'keys.private_identity_key_file' field present in the config")
+        }
+    }
 }
@@ -4,21 +4,25 @@
 use std::str::FromStr;

 use clap::Parser;
+use cosmwasm_std::Coin;
 use log::{debug, info};

-use nym_coconut_bandwidth_contract_common::msg::InstantiateMsg;
+use nym_ecash_contract_common::msg::InstantiateMsg;
 use nym_validator_client::nyxd::AccountId;

 #[derive(Debug, Parser)]
 pub struct Args {
    #[clap(long)]
-    pub pool_addr: String,
+    pub group_addr: Option<AccountId>,

    #[clap(long)]
    pub multisig_addr: Option<AccountId>,

    #[clap(long)]
-    pub mix_denom: Option<String>,
+    pub holding_account: AccountId,
+
+    #[clap(long, default_value = "75000000unym")]
+    pub deposit_amount: Coin,
 }

 pub async fn generate(args: Args) {
@@ -26,21 +30,25 @@ pub async fn generate(args: Args) {

    debug!("Received arguments: {:?}", args);

-    let multisig_addr = args.multisig_addr.unwrap_or_else(|| {
-        let address = std::env::var(nym_network_defaults::var_names::REWARDING_VALIDATOR_ADDRESS)
+    let group_addr = args.group_addr.unwrap_or_else(|| {
+        let address = std::env::var(nym_network_defaults::var_names::GROUP_CONTRACT_ADDRESS)
            .expect("Multisig address has to be set");
        AccountId::from_str(address.as_str())
            .expect("Failed converting multisig address to AccountId")
    });

-    let mix_denom = args.mix_denom.unwrap_or_else(|| {
-        std::env::var(nym_network_defaults::var_names::MIX_DENOM).expect("Mix denom has to be set")
+    let multisig_addr = args.multisig_addr.unwrap_or_else(|| {
+        let address = std::env::var(nym_network_defaults::var_names::MULTISIG_CONTRACT_ADDRESS)
+            .expect("Multisig address has to be set");
+        AccountId::from_str(address.as_str())
+            .expect("Failed converting multisig address to AccountId")
    });

    let instantiate_msg = InstantiateMsg {
-        pool_addr: args.pool_addr,
+        holding_account: args.holding_account.to_string(),
+        group_addr: group_addr.to_string(),
        multisig_addr: multisig_addr.to_string(),
-        mix_denom,
+        deposit_amount: args.deposit_amount,
    };

    debug!("instantiate_msg: {:?}", instantiate_msg);
@@ -3,8 +3,8 @@

 use clap::{Args, Subcommand};

-pub mod coconut_bandwidth;
 pub mod coconut_dkg;
+pub mod ecash_bandwidth;
 pub mod mixnet;
 pub mod multisig;
 pub mod vesting;
@@ -18,7 +18,7 @@ pub struct GenerateMessage {

 #[derive(Debug, Subcommand)]
 pub enum GenerateMessageCommands {
-    CoconutBandwidth(coconut_bandwidth::Args),
+    EcashBandwidth(ecash_bandwidth::Args),
    CoconutDKG(coconut_dkg::Args),
    Mixnet(mixnet::Args),
    Multisig(multisig::Args),
@@ -22,7 +22,7 @@ pub struct Args {
    pub max_voting_period: u64,

    #[clap(long)]
-    pub coconut_bandwidth_contract_address: Option<AccountId>,
+    pub ecash_contract_address: Option<AccountId>,

    #[clap(long)]
    pub coconut_dkg_contract_address: Option<AccountId>,
@@ -33,14 +33,12 @@ pub async fn generate(args: Args) {

    debug!("Received arguments: {:?}", args);

-    let coconut_bandwidth_contract_address =
-        args.coconut_bandwidth_contract_address.unwrap_or_else(|| {
-            let address =
-                std::env::var(nym_network_defaults::var_names::COCONUT_BANDWIDTH_CONTRACT_ADDRESS)
-                    .expect("Coconut bandwidth contract address has to be set");
-            AccountId::from_str(address.as_str())
-                .expect("Failed converting bandwidth contract address to AccountId")
-        });
+    let ecash_contract_address = args.ecash_contract_address.unwrap_or_else(|| {
+        let address = std::env::var(nym_network_defaults::var_names::ECASH_CONTRACT_ADDRESS)
+            .expect("Coconut bandwidth contract address has to be set");
+        AccountId::from_str(address.as_str())
+            .expect("Failed converting bandwidth contract address to AccountId")
+    });

    let coconut_dkg_contract_address = args.coconut_dkg_contract_address.unwrap_or_else(|| {
        let address = std::env::var(nym_network_defaults::var_names::COCONUT_DKG_CONTRACT_ADDRESS)
@@ -58,7 +56,7 @@ pub async fn generate(args: Args) {
        max_voting_period: Duration::Time(args.max_voting_period),
        executor: None,
        proposal_deposit: None,
-        coconut_bandwidth_contract_address: coconut_bandwidth_contract_address.to_string(),
+        coconut_bandwidth_contract_address: ecash_contract_address.to_string(),
        coconut_dkg_contract_address: coconut_dkg_contract_address.to_string(),
    };

@@ -4,9 +4,6 @@
 // event types
 pub const DEPOSITED_FUNDS_EVENT_TYPE: &str = "deposited-funds";

-// a 'wasm-' prefix is added to all cosmwasm events
-pub const COSMWASM_DEPOSITED_FUNDS_EVENT_TYPE: &str = "wasm-deposited-funds";
-
 // attributes that are used in multiple places
 pub const DEPOSIT_VALUE: &str = "deposit-value";
 pub const DEPOSIT_INFO: &str = "deposit-info";
@@ -87,6 +87,9 @@ pub enum QueryMsg {
    #[cfg_attr(feature = "schema", returns(u64))]
    GetCurrentEpochThreshold {},

+    #[cfg_attr(feature = "schema", returns(u64))]
+    GetEpochThreshold { epoch_id: EpochId },
+
    #[cfg_attr(feature = "schema", returns(StateAdvanceResponse))]
    CanAdvanceState {},

@@ -2,6 +2,7 @@
 // SPDX-License-Identifier: Apache-2.0

 use cosmwasm_std::Event;
+use std::str::FromStr;

 /// Looks up value of particular attribute in the provided event. If it fails to find it,
 /// the function panics.
@@ -31,6 +32,23 @@ pub fn may_find_attribute(event: &Event, key: &str) -> Option<String> {
    None
 }

+pub fn try_find_attribute<T, E>(
+    events: &[Event],
+    event_name: &str,
+    key: &str,
+) -> Option<Result<T, E>>
+where
+    T: FromStr<Err = E>,
+{
+    for event in events {
+        if event.ty == event_name {
+            let value = may_find_attribute(event, key)?;
+            return Some(value.parse());
+        }
+    }
+    None
+}
+
 pub trait OptionallyAddAttribute {
    fn add_optional_attribute(
        self,
@@ -0,0 +1,21 @@
+[package]
+name = "nym-ecash-contract-common"
+version = "0.1.0"
+edition = "2021"
+license.workspace = true
+
+# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
+
+[dependencies]
+bs58.workspace = true
+cosmwasm-std = { workspace = true }
+cosmwasm-schema = { workspace = true }
+cw2 = { workspace = true, optional = true }
+nym-multisig-contract-common = { path = "../multisig-contract" }
+thiserror.workspace = true
+cw-utils = { workspace = true }
+cw-controllers = { workspace = true }
+
+
+[features]
+schema = ["cw2"]
@@ -0,0 +1,71 @@
+// Copyright 2022 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use cosmwasm_schema::cw_serde;
+
+#[cw_serde]
+pub struct BlacklistedAccount {
+    pub public_key: String,
+    pub info: Blacklisting,
+}
+
+impl From<(String, Blacklisting)> for BlacklistedAccount {
+    fn from((public_key, info): (String, Blacklisting)) -> Self {
+        BlacklistedAccount { public_key, info }
+    }
+}
+
+#[cw_serde]
+pub struct Blacklisting {
+    pub proposal_id: u64,
+    pub finalized_at_height: Option<u64>,
+}
+
+impl Blacklisting {
+    pub fn new(proposal_id: u64) -> Self {
+        Blacklisting {
+            proposal_id,
+            finalized_at_height: None,
+        }
+    }
+}
+
+impl BlacklistedAccount {
+    pub fn public_key(&self) -> &str {
+        &self.public_key
+    }
+}
+
+#[cw_serde]
+pub struct PagedBlacklistedAccountResponse {
+    pub accounts: Vec<BlacklistedAccount>,
+    pub per_page: usize,
+
+    /// Field indicating paging information for the following queries if the caller wishes to get further entries.
+    pub start_next_after: Option<String>,
+}
+
+impl PagedBlacklistedAccountResponse {
+    pub fn new(
+        accounts: Vec<BlacklistedAccount>,
+        per_page: usize,
+        start_next_after: Option<String>,
+    ) -> Self {
+        PagedBlacklistedAccountResponse {
+            accounts,
+            per_page,
+            start_next_after,
+        }
+    }
+}
+
+#[cw_serde]
+pub struct BlacklistedAccountResponse {
+    pub account: Option<Blacklisting>,
+}
+
+impl BlacklistedAccountResponse {
+    pub fn new(account: Option<Blacklisting>) -> Self {
+        BlacklistedAccountResponse { account }
+    }
+}
@@ -0,0 +1,12 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use cosmwasm_schema::cw_serde;
+use cosmwasm_std::Coin;
+
+#[cw_serde]
+pub struct PoolCounters {
+    pub total_deposited: Coin,
+    pub total_redeemed_gateways: Coin,
+    pub total_redeemed_holding: Coin,
+}
@@ -0,0 +1,76 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::error::EcashContractError;
+use cosmwasm_schema::cw_serde;
+use cosmwasm_std::{StdError, StdResult};
+
+pub type DepositId = u32;
+
+#[cw_serde]
+pub struct Deposit {
+    pub bs58_encoded_ed25519_pubkey: String,
+}
+
+impl Deposit {
+    pub fn new(bs58_encoded_ed25519_pubkey: String) -> Self {
+        Deposit {
+            bs58_encoded_ed25519_pubkey,
+        }
+    }
+
+    pub fn get_ed25519_pubkey_bytes(raw: &str) -> Result<[u8; 32], EcashContractError> {
+        let mut ed25519_pubkey_bytes = [0u8; 32];
+        bs58::decode(raw)
+            .onto(&mut ed25519_pubkey_bytes)
+            .map_err(|_| EcashContractError::MalformedEd25519Identity)?;
+
+        Ok(ed25519_pubkey_bytes)
+    }
+
+    pub fn encode_pubkey_bytes(raw: &[u8]) -> String {
+        bs58::encode(raw).into_string()
+    }
+
+    pub fn to_bytes(&self) -> Result<[u8; 32], EcashContractError> {
+        Self::get_ed25519_pubkey_bytes(&self.bs58_encoded_ed25519_pubkey)
+    }
+
+    pub fn try_from_bytes(bytes: &[u8]) -> StdResult<Self> {
+        if bytes.len() != 32 {
+            return Err(StdError::generic_err("malformed deposit data"));
+        }
+
+        Ok(Deposit {
+            bs58_encoded_ed25519_pubkey: Self::encode_pubkey_bytes(bytes),
+        })
+    }
+}
+
+#[cw_serde]
+pub struct DepositResponse {
+    pub id: DepositId,
+
+    pub deposit: Option<Deposit>,
+}
+
+#[cw_serde]
+pub struct DepositData {
+    pub id: DepositId,
+
+    pub deposit: Deposit,
+}
+
+impl From<(DepositId, Deposit)> for DepositData {
+    fn from((id, deposit): (DepositId, Deposit)) -> Self {
+        DepositData { id, deposit }
+    }
+}
+
+#[cw_serde]
+pub struct PagedDepositsResponse {
+    pub deposits: Vec<DepositData>,
+
+    /// Field indicating paging information for the following queries if the caller wishes to get further entries.
+    pub start_next_after: Option<DepositId>,
+}
@@ -0,0 +1,68 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use cosmwasm_std::{Coin, StdError};
+use cw_controllers::AdminError;
+use cw_utils::PaymentError;
+use thiserror::Error;
+
+#[derive(Error, Debug, PartialEq)]
+pub enum EcashContractError {
+    #[error(transparent)]
+    Std(#[from] StdError),
+
+    #[error("Invalid deposit")]
+    InvalidDeposit(#[from] PaymentError),
+
+    #[error("received wrong amount for deposit. got: {received}. required: {amount}")]
+    WrongAmount { received: Coin, amount: Coin },
+
+    #[error("There aren't enough funds in the contract")]
+    NotEnoughFunds,
+
+    #[error(transparent)]
+    Admin(#[from] AdminError),
+
+    #[error("could not find proposal id inside the multisig reply SubMsg")]
+    MissingProposalId,
+
+    // realistically this should NEVER be thrown
+    #[error("the proposal id returned by the multisig contract could not be parsed into an u64")]
+    MalformedProposalId,
+
+    #[error("Group contract invalid address '{addr}'")]
+    InvalidGroup { addr: String },
+
+    #[error("Unauthorized")]
+    Unauthorized,
+
+    #[error("Failed to parse {value} into a valid SemVer version: {error_message}")]
+    SemVerFailure {
+        value: String,
+        error_message: String,
+    },
+
+    #[error("received an invalid reply id: {id}. it does not correspond to any sent SubMsg")]
+    InvalidReplyId { id: u64 },
+
+    #[error("reached the maximum of 255 different deposit types")]
+    MaximumDepositTypesReached,
+
+    #[error("compressed deposit info {typ} does not corresponds to any known type")]
+    UnknownCompressedDepositInfoType { typ: u8 },
+
+    #[error("deposit info {typ} does not corresponds to any previously seen type")]
+    UnknownDepositInfoType { typ: String },
+
+    #[error("the provided ed25519 identity was malformed")]
+    MalformedEd25519Identity,
+
+    #[error("the ticket book size has changed since the contract was created! This was not expected! It used to be {at_init} but it's {current} now! Please let the developers know ASAP!")]
+    TicketBookSizeChanged { at_init: u64, current: u64 },
+
+    #[error("the provided tickets redemption commitment is malformed")]
+    MalformedRedemptionCommitment,
+
+    #[error("the account blacklisting hasn't been fully implemented yet")]
+    UnimplementedBlacklisting,
+}
@@ -0,0 +1,4 @@
+// Copyright 2022 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+pub const BANDWIDTH_PROPOSAL_ID: &str = "proposal_id";
@@ -0,0 +1,9 @@
+// Copyright 2021 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+// event types
+pub const DEPOSITED_FUNDS_EVENT_TYPE: &str = "deposited-funds";
+
+pub const DEPOSIT_ID: &str = "deposit-id";
+pub const WASM_EVENT_NAME: &str = "wasm";
+pub const PROPOSAL_ID_ATTRIBUTE_NAME: &str = "proposal_id";
@@ -0,0 +1,13 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+pub mod blacklist;
+pub mod counters;
+pub mod deposit;
+pub mod error;
+pub mod event_attributes;
+pub mod events;
+pub mod msg;
+pub mod redeem_credential;
+
+pub use error::EcashContractError;
@@ -0,0 +1,84 @@
+// Copyright 2021 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use cosmwasm_schema::cw_serde;
+use cosmwasm_std::Coin;
+
+#[cfg(feature = "schema")]
+use crate::blacklist::{BlacklistedAccountResponse, PagedBlacklistedAccountResponse};
+#[cfg(feature = "schema")]
+use crate::deposit::{DepositResponse, PagedDepositsResponse};
+#[cfg(feature = "schema")]
+use cosmwasm_schema::QueryResponses;
+
+#[cw_serde]
+pub struct InstantiateMsg {
+    pub holding_account: String,
+    pub multisig_addr: String,
+    pub group_addr: String,
+    pub deposit_amount: Coin,
+}
+
+#[cw_serde]
+pub enum ExecuteMsg {
+    /// Used by clients to request ticket books from the signers
+    DepositTicketBookFunds {
+        identity_key: String,
+    },
+
+    /// Used by gateways to batch redeem tokens from the spent tickets
+    RequestRedemption {
+        commitment_bs58: String,
+        number_of_tickets: u16,
+    },
+
+    /// The actual message that gets executed, after multisig votes, that transfers the ticket tokens into gateway's (and the holding) account
+    RedeemTickets {
+        n: u16,
+        gw: String,
+    },
+
+    UpdateAdmin {
+        admin: String,
+    },
+
+    UpdateDepositValue {
+        new_deposit: Coin,
+    },
+
+    // TODO: properly implement
+    ProposeToBlacklist {
+        public_key: String,
+    },
+    AddToBlacklist {
+        public_key: String,
+    },
+}
+
+#[cw_serde]
+#[cfg_attr(feature = "schema", derive(QueryResponses))]
+pub enum QueryMsg {
+    #[cfg_attr(feature = "schema", returns(BlacklistedAccountResponse))]
+    GetBlacklistedAccount { public_key: String },
+
+    #[cfg_attr(feature = "schema", returns(PagedBlacklistedAccountResponse))]
+    GetBlacklistPaged {
+        limit: Option<u32>,
+        start_after: Option<String>,
+    },
+
+    #[cfg_attr(feature = "schema", returns(Coin))]
+    GetRequiredDepositAmount {},
+
+    #[cfg_attr(feature = "schema", returns(DepositResponse))]
+    GetDeposit { deposit_id: u32 },
+
+    #[cfg_attr(feature = "schema", returns(PagedDepositsResponse))]
+    GetDepositsPaged {
+        limit: Option<u32>,
+        start_after: Option<u32>,
+    },
+}
+
+#[cw_serde]
+pub struct MigrateMsg {}
@@ -0,0 +1,5 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+// TODO: to be moved to multisig
+pub const BATCH_REDEMPTION_PROPOSAL_TITLE: &str = "ecash-redemption";
@@ -47,4 +47,10 @@ pub enum ContractError {

    #[error("{0}")]
    Deposit(#[from] DepositError),
+
+    #[error("the provided redemption digest does not have valid base58 encoding or is not 32 bytes long")]
+    MalformedRedemptionDigest,
+
+    #[error("the provided redemption proposal data is malformed and can't be decoded")]
+    MalformedRedemptionProposalData,
 }
@@ -8,22 +8,31 @@ license.workspace = true

 [dependencies]
 async-trait = { workspace = true }
+bincode = { workspace = true, optional = true }

 log = { workspace = true }
 thiserror = { workspace = true }
-tokio = { workspace = true, features = ["sync"]}
+serde = { workspace = true, features = ["derive"], optional = true }
+tokio = { workspace = true, features = ["sync"] }
 zeroize = { workspace = true, features = ["zeroize_derive"] }

+nym-credentials = { path = "../credentials" }
+nym-compact-ecash = { path = "../nym_offline_compact_ecash" }
+nym-ecash-time = { path = "../ecash-time" }
+

 [target."cfg(not(target_arch = \"wasm32\"))".dependencies.sqlx]
 workspace = true
-features = ["runtime-tokio-rustls", "sqlite", "macros", "migrate"]
+features = ["runtime-tokio-rustls", "sqlite", "macros", "migrate", "time"]

 [target."cfg(not(target_arch = \"wasm32\"))".dependencies.tokio]
 workspace = true
-features = [ "rt-multi-thread", "net", "signal", "fs" ]
+features = ["rt-multi-thread", "net", "signal", "fs"]


 [build-dependencies]
 sqlx = { workspace = true, features = ["runtime-tokio-rustls", "sqlite", "macros", "migrate"] }
 tokio = { workspace = true, features = ["rt-multi-thread", "macros"] }
+
+[features]
+persistent-storage = ["bincode", "serde"]
@@ -0,0 +1,66 @@
+/*
+ * Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+ * SPDX-License-Identifier: Apache-2.0
+ */
+ 
+DROP TABLE coconut_credentials;
+
+CREATE TABLE master_verification_key (
+    epoch_id INTEGER PRIMARY KEY NOT NULL,
+    
+    serialised_key BLOB NOT NULL
+);
+
+CREATE TABLE coin_indices_signatures
+(
+    epoch_id INTEGER PRIMARY KEY NOT NULL,
+    
+    serialised_signatures BLOB NOT NULL
+);
+
+CREATE TABLE expiration_date_signatures (
+    expiration_date DATE NOT NULL UNIQUE PRIMARY KEY,
+    
+    epoch_id INTEGER NOT NULL,
+    
+    -- combined signatures for all tuples issued for given day
+    serialised_signatures BLOB NOT NULL
+);
+
+
+CREATE TABLE ecash_ticketbook
+(
+    id INTEGER NOT NULL PRIMARY KEY AUTOINCREMENT,
+    
+    -- introduce a way for us to introduce breaking changes in serialization of data
+    serialization_revision INTEGER NOT NULL,
+    
+    -- the actual crypto data of the ticketbook (wallet, keys, etc.)
+    ticketbook_data BLOB NOT NULL UNIQUE,
+    
+    -- for each ticketbook we MUST have corresponding expiration date signatures
+    expiration_date DATE NOT NULL REFERENCES expiration_date_signatures(expiration_date),
+    
+    -- for each ticketbook we MUST have corresponding coin index signatures
+    epoch_id INTEGER NOT NULL REFERENCES coin_indices_signatures(epoch_id),
+    
+    -- the initial number of tickets the wallet has been created for
+    total_tickets INTEGER NOT NULL,
+    
+    -- how many tickets have been used so far (the `l` value of the wallet)
+    used_tickets INTEGER NOT NULL
+);
+
+-- data for ticketbooks that have an associated deposit, but failed to get issued
+CREATE TABLE pending_issuance 
+(
+    deposit_id INTEGER NOT NULL PRIMARY KEY,
+    
+    -- introduce a way for us to introduce breaking changes in serialization of data
+    serialization_revision INTEGER NOT NULL,
+    
+    pending_ticketbook_data BLOB NOT NULL UNIQUE,
+    
+    -- for each ticketbook we MUST have corresponding expiration date signatures
+    expiration_date DATE NOT NULL REFERENCES expiration_date_signatures(expiration_date)
+);
@@ -1,23 +1,34 @@
 // Copyright 2023-2024 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0

-use crate::models::{CredentialUsage, StoredIssuedCredential};
+use crate::models::{BasicTicketbookInformation, RetrievedPendingTicketbook, RetrievedTicketbook};
+use nym_compact_ecash::scheme::coin_indices_signatures::AnnotatedCoinIndexSignature;
+use nym_compact_ecash::scheme::expiration_date_signatures::AnnotatedExpirationDateSignature;
+use nym_compact_ecash::VerificationKeyAuth;
+use nym_credentials::ecash::bandwidth::serialiser::VersionedSerialise;
+use nym_credentials::{IssuanceTicketBook, IssuedTicketBook};
+use nym_ecash_time::Date;
+use std::collections::HashMap;
 use std::sync::Arc;
 use tokio::sync::RwLock;
+use zeroize::Zeroizing;

 #[derive(Clone)]
-pub struct CoconutCredentialManager {
-    inner: Arc<RwLock<CoconutCredentialManagerInner>>,
+pub struct MemoryEcachTicketbookManager {
+    inner: Arc<RwLock<EcashCredentialManagerInner>>,
 }

 #[derive(Default)]
-struct CoconutCredentialManagerInner {
-    credentials: Vec<StoredIssuedCredential>,
-    credential_usage: Vec<CredentialUsage>,
+struct EcashCredentialManagerInner {
+    ticketbooks: HashMap<i64, RetrievedTicketbook>,
+    pending: HashMap<i64, RetrievedPendingTicketbook>,
+    master_vk: HashMap<u64, VerificationKeyAuth>,
+    coin_indices_sigs: HashMap<u64, Vec<AnnotatedCoinIndexSignature>>,
+    expiration_date_sigs: HashMap<Date, Vec<AnnotatedExpirationDateSignature>>,
    _next_id: i64,
 }

-impl CoconutCredentialManagerInner {
+impl EcashCredentialManagerInner {
    fn next_id(&mut self) -> i64 {
        let next = self._next_id;
        self._next_id += 1;
@@ -25,108 +36,209 @@ impl CoconutCredentialManagerInner {
    }
 }

-impl CoconutCredentialManager {
+// hehe, that's hacky AF, but it works as a **TEMPORARY** workaround
+fn hack_clone_ticketbook(book: &IssuedTicketBook) -> IssuedTicketBook {
+    let ser = book.pack();
+    let data = Zeroizing::new(ser.data);
+    IssuedTicketBook::try_unpack(&data, None).unwrap()
+}
+
+impl MemoryEcachTicketbookManager {
    /// Creates new empty instance of the `CoconutCredentialManager`.
    pub fn new() -> Self {
-        CoconutCredentialManager {
+        MemoryEcachTicketbookManager {
            inner: Default::default(),
        }
    }

-    pub async fn insert_issued_credential(
-        &self,
-        credential_type: String,
-        serialization_revision: u8,
-        credential_data: &[u8],
-        epoch_id: u32,
-    ) {
-        let mut inner = self.inner.write().await;
-        let id = inner.next_id();
-        inner.credentials.push(StoredIssuedCredential {
-            id,
-            serialization_revision,
-            credential_data: credential_data.to_vec(),
-            credential_type,
-            epoch_id,
-            expired: false,
-        })
-    }
-
-    async fn bandwidth_voucher_spent(&self, id: i64) -> bool {
-        self.inner
-            .read()
-            .await
-            .credential_usage
-            .iter()
-            .any(|c| c.credential_id == id)
-    }
-
-    async fn freepass_spent(&self, id: i64, gateway_id: &str) -> bool {
-        self.inner
-            .read()
-            .await
-            .credential_usage
-            .iter()
-            .any(|c| c.credential_id == id && c.gateway_id_bs58 == gateway_id)
-    }
-
-    /// Tries to retrieve one of the stored, unused credentials.
-    pub async fn get_next_unspect_bandwidth_voucher(&self) -> Option<StoredIssuedCredential> {
-        let guard = self.inner.read().await;
-        for credential in guard
-            .credentials
-            .iter()
-            .filter(|c| c.credential_type == "BandwidthVoucher")
-        {
-            if !self.bandwidth_voucher_spent(credential.id).await {
-                return Some(credential.clone());
-            }
-        }
-        None
-    }
-
-    pub async fn get_next_unspect_freepass(
-        &self,
-        gateway_id: &str,
-    ) -> Option<StoredIssuedCredential> {
-        let guard = self.inner.read().await;
-        for credential in guard
-            .credentials
-            .iter()
-            .filter(|c| c.credential_type == "FreeBandwidthPass")
-        {
-            if credential.expired {
-                continue;
-            }
-            if !self.freepass_spent(credential.id, gateway_id).await {
-                return Some(credential.clone());
-            }
-        }
-        None
-    }
-
-    /// Consumes in the database the specified credential.
-    ///
-    /// # Arguments
-    ///
-    /// * `id`: Database id.
-    pub async fn consume_coconut_credential(&self, id: i64, gateway_id: &str) {
+    pub(crate) async fn cleanup_expired(&self) {
        let mut guard = self.inner.write().await;
-        guard.credential_usage.push(CredentialUsage {
-            credential_id: id,
-            gateway_id_bs58: gateway_id.to_string(),
-        });
+
+        let mut to_remove = Vec::new();
+
+        for t in guard.ticketbooks.values() {
+            if t.ticketbook.expired() {
+                to_remove.push(t.ticketbook_id);
+            }
+        }
+
+        for id in to_remove {
+            guard.ticketbooks.remove(&id);
+        }
    }

-    /// Marks the specified credential as expired
-    ///
-    /// # Arguments
-    ///
-    /// * `id`: Id of the credential to mark as expired.
-    pub async fn mark_expired(&self, id: i64) {
-        let mut creds = self.inner.write().await;
-        if let Some(cred) = creds.credentials.get_mut(id as usize) {
-            cred.expired = true;
+    pub async fn get_next_unspent_ticketbook_and_update(
+        &self,
+        tickets: u32,
+    ) -> Option<RetrievedTicketbook> {
+        let mut guard = self.inner.write().await;
+
+        for t in guard.ticketbooks.values_mut() {
+            if !t.ticketbook.expired()
+                && t.ticketbook.spent_tickets() + tickets as u64
+                    <= t.ticketbook.params_total_tickets()
+            {
+                t.ticketbook
+                    .update_spent_tickets(t.ticketbook.spent_tickets() + tickets as u64);
+                return Some(RetrievedTicketbook {
+                    ticketbook_id: t.ticketbook_id,
+                    ticketbook: hack_clone_ticketbook(&t.ticketbook),
+                });
+            }
        }
+
+        None
+    }
+
+    pub(crate) async fn revert_ticketbook_withdrawal(
+        &self,
+        ticketbook_id: i64,
+        withdrawn: u32,
+        expected_current_total_spent: u32,
+    ) -> bool {
+        let mut guard = self.inner.write().await;
+
+        let Some(book) = guard.ticketbooks.get_mut(&ticketbook_id) else {
+            return false;
+        };
+
+        if book.ticketbook.spent_tickets() == expected_current_total_spent as u64 {
+            book.ticketbook
+                .update_spent_tickets(book.ticketbook.spent_tickets() - withdrawn as u64);
+            true
+        } else {
+            false
+        }
+    }
+
+    pub(crate) async fn insert_pending_ticketbook(&self, ticketbook: &IssuanceTicketBook) {
+        let mut guard = self.inner.write().await;
+
+        let ser = ticketbook.pack();
+        let data = Zeroizing::new(ser.data);
+        let id = ticketbook.deposit_id() as i64;
+        guard.pending.insert(
+            id,
+            RetrievedPendingTicketbook {
+                pending_id: ticketbook.deposit_id() as i64,
+                pending_ticketbook: IssuanceTicketBook::try_unpack(&data, None).unwrap(),
+            },
+        );
+    }
+
+    pub(crate) async fn get_pending_ticketbooks(&self) -> Vec<RetrievedPendingTicketbook> {
+        let guard = self.inner.read().await;
+
+        let mut pending = Vec::new();
+
+        for p in guard.pending.values() {
+            // 🫠
+            let ser = p.pending_ticketbook.pack();
+            let data = Zeroizing::new(ser.data);
+            pending.push(RetrievedPendingTicketbook {
+                pending_id: p.pending_id,
+                pending_ticketbook: IssuanceTicketBook::try_unpack(&data, None).unwrap(),
+            })
+        }
+
+        pending
+    }
+
+    pub(crate) async fn remove_pending_ticketbook(&self, pending_id: i64) {
+        let mut guard = self.inner.write().await;
+
+        guard.pending.remove(&pending_id);
+    }
+
+    pub(crate) async fn insert_new_ticketbook(&self, ticketbook: &IssuedTicketBook) {
+        let mut guard = self.inner.write().await;
+        let id = guard.next_id();
+
+        // hehe, that's hacky AF, but it works as a **TEMPORARY** workaround
+        let ser = ticketbook.pack();
+        let data = Zeroizing::new(ser.data);
+        guard.ticketbooks.insert(
+            id,
+            RetrievedTicketbook {
+                ticketbook_id: id,
+                ticketbook: IssuedTicketBook::try_unpack(&data, None).unwrap(),
+            },
+        );
+    }
+
+    pub(crate) async fn get_ticketbooks_info(&self) -> Vec<BasicTicketbookInformation> {
+        let guard = self.inner.read().await;
+
+        guard
+            .ticketbooks
+            .values()
+            .map(|t| BasicTicketbookInformation {
+                id: t.ticketbook_id,
+                expiration_date: t.ticketbook.expiration_date(),
+                epoch_id: t.ticketbook.epoch_id() as u32,
+                total_tickets: t.ticketbook.spent_tickets() as u32,
+                used_tickets: t.ticketbook.params_total_tickets() as u32,
+            })
+            .collect()
+    }
+
+    pub(crate) async fn get_master_verification_key(
+        &self,
+        epoch_id: u64,
+    ) -> Option<VerificationKeyAuth> {
+        let guard = self.inner.read().await;
+
+        guard.master_vk.get(&epoch_id).cloned()
+    }
+
+    pub(crate) async fn insert_master_verification_key(
+        &self,
+        epoch_id: u64,
+        key: &VerificationKeyAuth,
+    ) {
+        let mut guard = self.inner.write().await;
+
+        guard.master_vk.insert(epoch_id, key.clone());
+    }
+
+    pub(crate) async fn get_coin_index_signatures(
+        &self,
+        epoch_id: u64,
+    ) -> Option<Vec<AnnotatedCoinIndexSignature>> {
+        let guard = self.inner.read().await;
+
+        guard.coin_indices_sigs.get(&epoch_id).cloned()
+    }
+
+    pub(crate) async fn insert_coin_index_signatures(
+        &self,
+        epoch_id: u64,
+        sigs: &[AnnotatedCoinIndexSignature],
+    ) {
+        let mut guard = self.inner.write().await;
+
+        guard.coin_indices_sigs.insert(epoch_id, sigs.to_vec());
+    }
+
+    pub(crate) async fn get_expiration_date_signatures(
+        &self,
+        expiration_date: Date,
+    ) -> Option<Vec<AnnotatedExpirationDateSignature>> {
+        let guard = self.inner.read().await;
+
+        guard.expiration_date_sigs.get(&expiration_date).cloned()
+    }
+
+    pub(crate) async fn insert_expiration_date_signatures(
+        &self,
+        _epoch_id: u64,
+        expiration_date: Date,
+        sigs: &[AnnotatedExpirationDateSignature],
+    ) {
+        let mut guard = self.inner.write().await;
+
+        guard
+            .expiration_date_sigs
+            .insert(expiration_date, sigs.to_vec());
    }
 }
@@ -2,5 +2,5 @@
 // SPDX-License-Identifier: Apache-2.0

 pub mod memory;
-#[cfg(not(target_arch = "wasm32"))]
+#[cfg(all(not(target_arch = "wasm32"), feature = "persistent-storage"))]
 pub mod sqlite;
@@ -1,116 +1,279 @@
 // Copyright 2022-2024 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0

-use crate::models::StoredIssuedCredential;
+use crate::models::{
+    BasicTicketbookInformation, RawExpirationDateSignatures, StoredIssuedTicketbook,
+    StoredPendingTicketbook,
+};
+use nym_ecash_time::Date;
+use sqlx::{Executor, Sqlite, Transaction};

 #[derive(Clone)]
-pub struct CoconutCredentialManager {
+pub struct SqliteEcashTicketbookManager {
    connection_pool: sqlx::SqlitePool,
 }

-impl CoconutCredentialManager {
-    /// Creates new instance of the `CoconutCredentialManager` with the provided sqlite connection pool.
+impl SqliteEcashTicketbookManager {
+    /// Creates new instance of the `EcashTicketbookManager` with the provided sqlite connection pool.
    ///
    /// # Arguments
    ///
    /// * `connection_pool`: database connection pool to use.
    pub fn new(connection_pool: sqlx::SqlitePool) -> Self {
-        CoconutCredentialManager { connection_pool }
+        SqliteEcashTicketbookManager { connection_pool }
    }

-    pub async fn insert_issued_credential(
+    pub(crate) async fn cleanup_expired(&self, deadline: Date) -> Result<(), sqlx::Error> {
+        sqlx::query!(
+            "DELETE FROM ecash_ticketbook WHERE expiration_date <= ?",
+            deadline
+        )
+        .execute(&self.connection_pool)
+        .await?;
+        Ok(())
+    }
+
+    pub(crate) async fn begin_storage_tx(&self) -> Result<Transaction<Sqlite>, sqlx::Error> {
+        self.connection_pool.begin().await
+    }
+
+    pub(crate) async fn insert_pending_ticketbook(
        &self,
-        credential_type: String,
-        serialization_revision: u8,
-        credential_data: &[u8],
+        serialisation_revision: u8,
+        deposit_id: u32,
+        data: &[u8],
+        expiration_date: Date,
+    ) -> Result<(), sqlx::Error> {
+        sqlx::query!(
+            r#"
+                INSERT INTO pending_issuance
+                (deposit_id, serialization_revision, pending_ticketbook_data, expiration_date)
+                VALUES (?, ?, ?, ?)
+            "#,
+            deposit_id,
+            serialisation_revision,
+            data,
+            expiration_date,
+        )
+        .execute(&self.connection_pool)
+        .await?;
+
+        Ok(())
+    }
+
+    pub(crate) async fn insert_new_ticketbook(
+        &self,
+        serialisation_revision: u8,
+        data: &[u8],
+        expiration_date: Date,
        epoch_id: u32,
+        total_tickets: u32,
+        used_tickets: u32,
    ) -> Result<(), sqlx::Error> {
        sqlx::query!(
            r#"
-                INSERT INTO coconut_credentials(serialization_revision, credential_type, credential_data, epoch_id, expired)
-                VALUES (?, ?, ?, ?, false)
+                INSERT INTO ecash_ticketbook
+                (serialization_revision, ticketbook_data, expiration_date, epoch_id, total_tickets, used_tickets)
+                VALUES (?, ?, ?, ?, ?, ?)
            "#,
-            serialization_revision, credential_type, credential_data, epoch_id
+            serialisation_revision,
+            data,
+            expiration_date,
+            epoch_id,
+            total_tickets,
+            used_tickets,
        ).execute(&self.connection_pool).await?;
+
        Ok(())
    }

-    pub async fn get_next_unspect_freepass(
+    pub(crate) async fn get_ticketbooks_info(
        &self,
-        gateway_id: &str,
-    ) -> Result<Option<StoredIssuedCredential>, sqlx::Error> {
-        // get a credential of freepass type that doesn't appear in `credential_usage` for the provided gateway_id
+    ) -> Result<Vec<BasicTicketbookInformation>, sqlx::Error> {
        sqlx::query_as(
            r#"
-                SELECT * 
-                FROM coconut_credentials
-                WHERE coconut_credentials.credential_type == "FreeBandwidthPass" AND coconut_credentials.expired = false
-                      AND NOT EXISTS (SELECT 1
-                                      FROM   credential_usage
-                                      WHERE  credential_usage.credential_id = coconut_credentials.id
-                                             AND credential_usage.gateway_id_bs58 == ?)
-                ORDER BY coconut_credentials.id
-                LIMIT 1
-            "#,
+                    SELECT id, expiration_date, epoch_id, total_tickets, used_tickets
+                    FROM ecash_ticketbook
+                "#,
        )
-        .bind(gateway_id)
-        .fetch_optional(&self.connection_pool)
+        .fetch_all(&self.connection_pool)
        .await
    }

-    pub async fn get_next_unspect_bandwidth_voucher(
+    pub(crate) async fn decrease_used_ticketbook_tickets(
        &self,
-    ) -> Result<Option<StoredIssuedCredential>, sqlx::Error> {
-        // get a credential of bandwidth voucher type that doesn't appear in `credential_usage` for any gateway_id
-        sqlx::query_as(
+        ticketbook_id: i64,
+        reverted_spent: u32,
+        expected_current_total_spent: u32,
+    ) -> Result<bool, sqlx::Error> {
+        // the 'AND' clause will ensure this will only be executed if nobody else interacted with the row
+        let affected = sqlx::query!(
            r#"
-                SELECT * 
-                FROM coconut_credentials
-                WHERE coconut_credentials.credential_type == "BandwidthVoucher"
-                      AND NOT EXISTS (SELECT 1
-                                      FROM   credential_usage
-                                      WHERE  credential_usage.credential_id = coconut_credentials.id)
-                ORDER BY coconut_credentials.id
-                LIMIT 1
+                UPDATE ecash_ticketbook
+                SET used_tickets = used_tickets - ?
+                WHERE id = ?
+                AND used_tickets = ?
            "#,
+            reverted_spent,
+            ticketbook_id,
+            expected_current_total_spent
        )
-        .fetch_optional(&self.connection_pool)
-        .await
+        .execute(&self.connection_pool)
+        .await?
+        .rows_affected();
+        Ok(affected > 0)
    }

-    /// Consumes in the database the specified credential.
-    ///
-    /// # Arguments
-    ///
-    /// * `id`: Database id.
-    /// * `gateway_id`: id of the gateway that received the credential
-    pub async fn consume_coconut_credential(
+    pub(crate) async fn get_pending_ticketbooks(
        &self,
-        id: i64,
-        gateway_id: &str,
+    ) -> Result<Vec<StoredPendingTicketbook>, sqlx::Error> {
+        sqlx::query_as("SELECT * FROM pending_issuance")
+            .fetch_all(&self.connection_pool)
+            .await
+    }
+
+    pub(crate) async fn remove_pending_ticketbook(
+        &self,
+        pending_id: i64,
    ) -> Result<(), sqlx::Error> {
        sqlx::query!(
-            "INSERT INTO credential_usage (credential_id, gateway_id_bs58) VALUES (?, ?)",
-            id,
-            gateway_id
+            "DELETE FROM pending_issuance WHERE deposit_id = ?",
+            pending_id
        )
        .execute(&self.connection_pool)
        .await?;
        Ok(())
    }

-    /// Marks the specified credential as expired
-    ///
-    /// # Arguments
-    ///
-    /// * `id`: Id of the credential to mark as expired.
-    pub async fn mark_expired(&self, id: i64) -> Result<(), sqlx::Error> {
+    pub(crate) async fn get_master_verification_key(
+        &self,
+        epoch_id: i64,
+    ) -> Result<Option<Vec<u8>>, sqlx::Error> {
        sqlx::query!(
-            "UPDATE coconut_credentials SET expired = TRUE WHERE id = ?",
-            id
+            "SELECT serialised_key FROM master_verification_key WHERE epoch_id = ?",
+            epoch_id
+        )
+        .fetch_optional(&self.connection_pool)
+        .await
+        .map(|maybe_record| maybe_record.map(|r| r.serialised_key))
+    }
+
+    pub(crate) async fn insert_master_verification_key(
+        &self,
+        epoch_id: i64,
+        data: &[u8],
+    ) -> Result<(), sqlx::Error> {
+        sqlx::query!(
+            "INSERT INTO master_verification_key(epoch_id, serialised_key) VALUES (?, ?)",
+            epoch_id,
+            data
        )
        .execute(&self.connection_pool)
        .await?;
        Ok(())
    }
+
+    pub(crate) async fn get_coin_index_signatures(
+        &self,
+        epoch_id: i64,
+    ) -> Result<Option<Vec<u8>>, sqlx::Error> {
+        sqlx::query!(
+            "SELECT serialised_signatures FROM coin_indices_signatures WHERE epoch_id = ?",
+            epoch_id
+        )
+        .fetch_optional(&self.connection_pool)
+        .await
+        .map(|maybe_record| maybe_record.map(|r| r.serialised_signatures))
+    }
+
+    pub(crate) async fn insert_coin_index_signatures(
+        &self,
+        epoch_id: i64,
+        data: &[u8],
+    ) -> Result<(), sqlx::Error> {
+        sqlx::query!(
+            "INSERT INTO coin_indices_signatures(epoch_id, serialised_signatures) VALUES (?, ?)",
+            epoch_id,
+            data
+        )
+        .execute(&self.connection_pool)
+        .await?;
+        Ok(())
+    }
+
+    pub(crate) async fn get_expiration_date_signatures(
+        &self,
+        expiration_date: Date,
+    ) -> Result<Option<RawExpirationDateSignatures>, sqlx::Error> {
+        sqlx::query_as!(
+            RawExpirationDateSignatures,
+            r#"
+                SELECT epoch_id as "epoch_id: u32", serialised_signatures
+                FROM expiration_date_signatures
+                WHERE expiration_date = ?
+            "#,
+            expiration_date
+        )
+        .fetch_optional(&self.connection_pool)
+        .await
+    }
+
+    pub(crate) async fn insert_expiration_date_signatures(
+        &self,
+        epoch_id: i64,
+        expiration_date: Date,
+        data: &[u8],
+    ) -> Result<(), sqlx::Error> {
+        sqlx::query!(
+            "INSERT INTO expiration_date_signatures(expiration_date, epoch_id, serialised_signatures) VALUES (?, ?, ?)",
+            expiration_date,
+            epoch_id,
+            data
+        )
+            .execute(&self.connection_pool)
+            .await?;
+        Ok(())
+    }
+}
+
+pub(crate) async fn get_next_unspent_ticketbook<'a, E>(
+    executor: E,
+    deadline: Date,
+    tickets: u32,
+) -> Result<Option<StoredIssuedTicketbook>, sqlx::Error>
+where
+    E: Executor<'a, Database = Sqlite>,
+{
+    sqlx::query_as(
+        r#"
+                SELECT *
+                FROM ecash_ticketbook
+                WHERE used_tickets + ? <= total_tickets
+                AND expiration_date >= ?
+                ORDER BY expiration_date ASC
+                LIMIT 1
+            "#,
+    )
+    .bind(tickets)
+    .bind(deadline)
+    .fetch_optional(executor)
+    .await
+}
+
+pub(crate) async fn increase_used_ticketbook_tickets<'a, E>(
+    executor: E,
+    ticketbook_id: i64,
+    extra_spent: u32,
+) -> Result<(), sqlx::Error>
+where
+    E: Executor<'a, Database = Sqlite>,
+{
+    sqlx::query!(
+        "UPDATE ecash_ticketbook SET used_tickets = used_tickets + ? WHERE id = ?",
+        extra_spent,
+        ticketbook_id
+    )
+    .execute(executor)
+    .await?;
+    Ok(())
 }
@@ -1,26 +1,30 @@
 // Copyright 2023 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0

-use std::fmt::{self, Debug, Formatter};
-
-use crate::backends::memory::CoconutCredentialManager;
+use crate::backends::memory::MemoryEcachTicketbookManager;
 use crate::error::StorageError;
-use crate::models::{StorableIssuedCredential, StoredIssuedCredential};
+use crate::models::{BasicTicketbookInformation, RetrievedPendingTicketbook, RetrievedTicketbook};
 use crate::storage::Storage;
 use async_trait::async_trait;
+use nym_compact_ecash::scheme::coin_indices_signatures::AnnotatedCoinIndexSignature;
+use nym_compact_ecash::scheme::expiration_date_signatures::AnnotatedExpirationDateSignature;
+use nym_compact_ecash::VerificationKeyAuth;
+use nym_credentials::{IssuanceTicketBook, IssuedTicketBook};
+use nym_ecash_time::Date;
+use std::fmt::{self, Debug, Formatter};

 pub type EphemeralCredentialStorage = EphemeralStorage;

 // note that clone here is fine as upon cloning the same underlying pool will be used
 #[derive(Clone)]
 pub struct EphemeralStorage {
-    coconut_credential_manager: CoconutCredentialManager,
+    storage_manager: MemoryEcachTicketbookManager,
 }

 impl Default for EphemeralStorage {
    fn default() -> Self {
        EphemeralStorage {
-            coconut_credential_manager: CoconutCredentialManager::new(),
+            storage_manager: MemoryEcachTicketbookManager::new(),
        }
    }
 }
@@ -35,55 +39,135 @@ impl Debug for EphemeralStorage {
 impl Storage for EphemeralStorage {
    type StorageError = StorageError;

-    async fn insert_issued_credential<'a>(
+    async fn cleanup_expired(&self) -> Result<(), Self::StorageError> {
+        self.storage_manager.cleanup_expired().await;
+        Ok(())
+    }
+
+    async fn insert_pending_ticketbook(
        &self,
-        bandwidth_credential: StorableIssuedCredential<'a>,
-    ) -> Result<(), StorageError> {
-        self.coconut_credential_manager
-            .insert_issued_credential(
-                bandwidth_credential.credential_type,
-                bandwidth_credential.serialization_revision,
-                bandwidth_credential.credential_data,
-                bandwidth_credential.epoch_id,
-            )
+        ticketbook: &IssuanceTicketBook,
+    ) -> Result<(), Self::StorageError> {
+        self.storage_manager
+            .insert_pending_ticketbook(ticketbook)
            .await;
        Ok(())
    }

-    async fn get_next_unspent_credential(
+    async fn insert_issued_ticketbook(
        &self,
-        gateway_id: &str,
-    ) -> Result<Option<StoredIssuedCredential>, Self::StorageError> {
-        // first try to get a free pass if available, otherwise fallback to bandwidth voucher
-        let maybe_freepass = self
-            .coconut_credential_manager
-            .get_next_unspect_freepass(gateway_id)
-            .await;
-        if maybe_freepass.is_some() {
-            return Ok(maybe_freepass);
-        }
+        ticketbook: &IssuedTicketBook,
+    ) -> Result<(), StorageError> {
+        self.storage_manager.insert_new_ticketbook(ticketbook).await;
+        Ok(())
+    }

+    async fn get_ticketbooks_info(
+        &self,
+    ) -> Result<Vec<BasicTicketbookInformation>, Self::StorageError> {
+        Ok(self.storage_manager.get_ticketbooks_info().await)
+    }
+
+    async fn get_pending_ticketbooks(
+        &self,
+    ) -> Result<Vec<RetrievedPendingTicketbook>, Self::StorageError> {
+        Ok(self.storage_manager.get_pending_ticketbooks().await)
+    }
+
+    async fn remove_pending_ticketbook(&self, pending_id: i64) -> Result<(), Self::StorageError> {
+        self.storage_manager
+            .remove_pending_ticketbook(pending_id)
+            .await;
+        Ok(())
+    }
+
+    /// Tries to retrieve one of the stored ticketbook,
+    /// that has not yet expired and has required number of unspent tickets.
+    /// it immediately updated the on-disk number of used tickets so that another task
+    /// could obtain their own tickets at the same time
+    async fn get_next_unspent_usable_ticketbook(
+        &self,
+        tickets: u32,
+    ) -> Result<Option<RetrievedTicketbook>, Self::StorageError> {
        Ok(self
-            .coconut_credential_manager
-            .get_next_unspect_bandwidth_voucher()
+            .storage_manager
+            .get_next_unspent_ticketbook_and_update(tickets)
            .await)
    }

-    async fn consume_coconut_credential(
+    async fn attempt_revert_ticketbook_withdrawal(
        &self,
-        id: i64,
-        gateway_id: &str,
-    ) -> Result<(), StorageError> {
-        self.coconut_credential_manager
-            .consume_coconut_credential(id, gateway_id)
-            .await;
+        ticketbook_id: i64,
+        previous_total_spent: u32,
+        withdrawn: u32,
+    ) -> Result<bool, Self::StorageError> {
+        Ok(self
+            .storage_manager
+            .revert_ticketbook_withdrawal(ticketbook_id, previous_total_spent, withdrawn)
+            .await)
+    }

+    async fn get_master_verification_key(
+        &self,
+        epoch_id: u64,
+    ) -> Result<Option<VerificationKeyAuth>, Self::StorageError> {
+        Ok(self
+            .storage_manager
+            .get_master_verification_key(epoch_id)
+            .await)
+    }
+
+    async fn insert_master_verification_key(
+        &self,
+        epoch_id: u64,
+        key: &VerificationKeyAuth,
+    ) -> Result<(), Self::StorageError> {
+        self.storage_manager
+            .insert_master_verification_key(epoch_id, key)
+            .await;
        Ok(())
    }

-    async fn mark_expired(&self, id: i64) -> Result<(), Self::StorageError> {
-        self.coconut_credential_manager.mark_expired(id).await;
+    async fn get_coin_index_signatures(
+        &self,
+        epoch_id: u64,
+    ) -> Result<Option<Vec<AnnotatedCoinIndexSignature>>, Self::StorageError> {
+        Ok(self
+            .storage_manager
+            .get_coin_index_signatures(epoch_id)
+            .await)
+    }

+    async fn insert_coin_index_signatures(
+        &self,
+        epoch_id: u64,
+        data: &[AnnotatedCoinIndexSignature],
+    ) -> Result<(), Self::StorageError> {
+        self.storage_manager
+            .insert_coin_index_signatures(epoch_id, data)
+            .await;
+        Ok(())
+    }
+
+    async fn get_expiration_date_signatures(
+        &self,
+        expiration_date: Date,
+    ) -> Result<Option<Vec<AnnotatedExpirationDateSignature>>, Self::StorageError> {
+        Ok(self
+            .storage_manager
+            .get_expiration_date_signatures(expiration_date)
+            .await)
+    }
+
+    async fn insert_expiration_date_signatures(
+        &self,
+        epoch_id: u64,
+        expiration_date: Date,
+        data: &[AnnotatedExpirationDateSignature],
+    ) -> Result<(), Self::StorageError> {
+        self.storage_manager
+            .insert_expiration_date_signatures(epoch_id, expiration_date, data)
+            .await;
        Ok(())
    }
 }
@@ -9,6 +9,9 @@ pub enum StorageError {
    #[error("Database experienced an internal error - {0}")]
    InternalDatabaseError(#[from] sqlx::Error),

+    #[error("experienced internal storage error due to database inconsistency: {reason}")]
+    DatabaseInconsistency { reason: String },
+
    #[cfg(not(target_arch = "wasm32"))]
    #[error("Failed to perform database migration - {0}")]
    MigrationError(#[from] sqlx::migrate::MigrateError),
@@ -19,6 +22,17 @@ pub enum StorageError {
    #[error("No unused credential in database. You need to buy at least one")]
    NoCredential,

+    #[error("No signatures for epoch {epoch_id} in the database")]
+    NoSignatures { epoch_id: i64 },
+
    #[error("Database unique constraint violation. Is the credential already imported?")]
    ConstraintUnique,
 }
+
+impl StorageError {
+    pub fn database_inconsistency<S: Into<String>>(reason: S) -> StorageError {
+        StorageError::DatabaseInconsistency {
+            reason: reason.into(),
+        }
+    }
+}
@@ -5,21 +5,20 @@

 use crate::ephemeral_storage::EphemeralStorage;

-#[cfg(not(target_arch = "wasm32"))]
-use crate::persistent_storage::PersistentStorage;
-#[cfg(not(target_arch = "wasm32"))]
-use std::path::Path;
-
 mod backends;
 pub mod ephemeral_storage;
 pub mod error;
 pub mod models;
-#[cfg(not(target_arch = "wasm32"))]
+
+#[cfg(all(not(target_arch = "wasm32"), feature = "persistent-storage"))]
 pub mod persistent_storage;
+
 pub mod storage;

-#[cfg(not(target_arch = "wasm32"))]
-pub async fn initialise_persistent_storage<P: AsRef<Path>>(path: P) -> PersistentStorage {
+#[cfg(all(not(target_arch = "wasm32"), feature = "persistent-storage"))]
+pub async fn initialise_persistent_storage<P: AsRef<std::path::Path>>(
+    path: P,
+) -> crate::persistent_storage::PersistentStorage {
    match persistent_storage::PersistentStorage::init(path).await {
        Err(err) => panic!("failed to initialise credential storage - {err}"),
        Ok(storage) => storage,
@@ -1,44 +1,62 @@
 // Copyright 2022-2024 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0

+use nym_credentials::{IssuanceTicketBook, IssuedTicketBook};
+use nym_ecash_time::Date;
 use zeroize::{Zeroize, ZeroizeOnDrop};

-// #[derive(Clone)]
-// pub struct CoconutCredential {
-//     #[allow(dead_code)]
-//     pub id: i64,
-//     pub voucher_value: String,
-//     pub voucher_info: String,
-//     pub serial_number: String,
-//     pub binding_number: String,
-//     pub signature: String,
-//     pub epoch_id: String,
-//     pub consumed: bool,
-// }
+pub struct RetrievedTicketbook {
+    pub ticketbook_id: i64,
+    pub ticketbook: IssuedTicketBook,
+}
+
+pub struct RetrievedPendingTicketbook {
+    pub pending_id: i64,
+    pub pending_ticketbook: IssuanceTicketBook,
+}
+
+#[cfg_attr(not(target_arch = "wasm32"), derive(sqlx::FromRow))]
+pub struct BasicTicketbookInformation {
+    pub id: i64,
+    pub expiration_date: Date,
+    pub epoch_id: u32,
+    pub total_tickets: u32,
+    pub used_tickets: u32,
+}

 #[cfg_attr(not(target_arch = "wasm32"), derive(sqlx::FromRow))]
 #[derive(Zeroize, ZeroizeOnDrop, Clone)]
-pub struct StoredIssuedCredential {
+pub struct StoredIssuedTicketbook {
    pub id: i64,

    pub serialization_revision: u8,
-    pub credential_data: Vec<u8>,
-    pub credential_type: String,
+
+    pub ticketbook_data: Vec<u8>,
+
+    #[zeroize(skip)]
+    pub expiration_date: Date,

    pub epoch_id: u32,
-    pub expired: bool,
-}

-pub struct StorableIssuedCredential<'a> {
-    pub serialization_revision: u8,
-    pub credential_data: &'a [u8],
-    pub credential_type: String,
-
-    pub epoch_id: u32,
+    pub total_tickets: u32,
+    pub used_tickets: u32,
 }

 #[cfg_attr(not(target_arch = "wasm32"), derive(sqlx::FromRow))]
-pub struct CredentialUsage {
-    pub credential_id: i64,
-    pub gateway_id_bs58: String,
+#[derive(Zeroize, ZeroizeOnDrop, Clone)]
+pub struct StoredPendingTicketbook {
+    pub deposit_id: i64,
+
+    pub serialization_revision: u8,
+
+    pub pending_ticketbook_data: Vec<u8>,
+
+    #[zeroize(skip)]
+    pub expiration_date: Date,
+}
+
+#[cfg_attr(not(target_arch = "wasm32"), derive(sqlx::FromRow))]
+pub struct RawExpirationDateSignatures {
+    pub epoch_id: u32,
+    pub serialised_signatures: Vec<u8>,
 }
@@ -1,125 +0,0 @@
-// Copyright 2023 - Nym Technologies SA <contact@nymtech.net>
-// SPDX-License-Identifier: Apache-2.0
-
-use crate::backends::sqlite::CoconutCredentialManager;
-use crate::error::StorageError;
-use crate::storage::Storage;
-
-use crate::models::{StorableIssuedCredential, StoredIssuedCredential};
-use async_trait::async_trait;
-use log::{debug, error};
-use sqlx::ConnectOptions;
-use std::path::Path;
-
-// note that clone here is fine as upon cloning the same underlying pool will be used
-#[derive(Clone)]
-pub struct PersistentStorage {
-    coconut_credential_manager: CoconutCredentialManager,
-}
-
-impl PersistentStorage {
-    /// Initialises `PersistentStorage` using the provided path.
-    ///
-    /// # Arguments
-    ///
-    /// * `database_path`: path to the database.
-    pub async fn init<P: AsRef<Path>>(database_path: P) -> Result<Self, StorageError> {
-        debug!(
-            "Attempting to connect to database {:?}",
-            database_path.as_ref().as_os_str()
-        );
-
-        let mut opts = sqlx::sqlite::SqliteConnectOptions::new()
-            .filename(database_path)
-            .create_if_missing(true);
-
-        opts.disable_statement_logging();
-
-        let connection_pool = match sqlx::SqlitePool::connect_with(opts).await {
-            Ok(db) => db,
-            Err(err) => {
-                error!("Failed to connect to SQLx database: {err}");
-                return Err(err.into());
-            }
-        };
-
-        if let Err(err) = sqlx::migrate!("./migrations").run(&connection_pool).await {
-            error!("Failed to perform migration on the SQLx database: {err}");
-            return Err(err.into());
-        }
-
-        Ok(PersistentStorage {
-            coconut_credential_manager: CoconutCredentialManager::new(connection_pool.clone()),
-        })
-    }
-}
-
-#[async_trait]
-impl Storage for PersistentStorage {
-    type StorageError = StorageError;
-
-    async fn insert_issued_credential<'a>(
-        &self,
-        bandwidth_credential: StorableIssuedCredential<'a>,
-    ) -> Result<(), Self::StorageError> {
-        self.coconut_credential_manager
-            .insert_issued_credential(
-                bandwidth_credential.credential_type,
-                bandwidth_credential.serialization_revision,
-                bandwidth_credential.credential_data,
-                bandwidth_credential.epoch_id,
-            )
-            .await
-            .map_err(|err| {
-                // There is one error we want to handle specifically.
-                // Check if database_error is `SqliteError` with code 2067 which
-                // means UNIQUE constraint violation
-                if let Some(db_error) = err.as_database_error() {
-                    if db_error.code().map_or(false, |code| code == "2067") {
-                        StorageError::ConstraintUnique
-                    } else {
-                        err.into()
-                    }
-                } else {
-                    err.into()
-                }
-            })
-    }
-
-    async fn get_next_unspent_credential(
-        &self,
-        gateway_id: &str,
-    ) -> Result<Option<StoredIssuedCredential>, Self::StorageError> {
-        // first try to get a free pass if available, otherwise fallback to bandwidth voucher
-        let maybe_freepass = self
-            .coconut_credential_manager
-            .get_next_unspect_freepass(gateway_id)
-            .await?;
-        if maybe_freepass.is_some() {
-            return Ok(maybe_freepass);
-        }
-
-        Ok(self
-            .coconut_credential_manager
-            .get_next_unspect_bandwidth_voucher()
-            .await?)
-    }
-
-    async fn consume_coconut_credential(
-        &self,
-        id: i64,
-        gateway_id: &str,
-    ) -> Result<(), StorageError> {
-        self.coconut_credential_manager
-            .consume_coconut_credential(id, gateway_id)
-            .await?;
-
-        Ok(())
-    }
-
-    async fn mark_expired(&self, id: i64) -> Result<(), Self::StorageError> {
-        self.coconut_credential_manager.mark_expired(id).await?;
-
-        Ok(())
-    }
-}
@@ -0,0 +1,54 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::error::StorageError;
+use bincode::Options;
+use nym_compact_ecash::scheme::coin_indices_signatures::AnnotatedCoinIndexSignature;
+use nym_compact_ecash::scheme::expiration_date_signatures::AnnotatedExpirationDateSignature;
+use serde::{Deserialize, Serialize};
+
+#[derive(Serialize)]
+struct StorageBorrowedSerdeWrapper<'a, T>(&'a T);
+
+#[derive(Serialize, Deserialize)]
+struct StorageSerdeWrapper<T>(T);
+
+pub(crate) fn serialise_coin_index_signatures(sigs: &[AnnotatedCoinIndexSignature]) -> Vec<u8> {
+    storage_serialiser()
+        .serialize(&StorageBorrowedSerdeWrapper(&sigs))
+        .unwrap()
+}
+
+pub(crate) fn deserialise_coin_index_signatures(
+    raw: &[u8],
+) -> Result<Vec<AnnotatedCoinIndexSignature>, StorageError> {
+    let de: StorageSerdeWrapper<_> = storage_serialiser().deserialize(raw).map_err(|_| {
+        StorageError::database_inconsistency("malformed stored coin index signatures")
+    })?;
+    Ok(de.0)
+}
+
+pub(crate) fn serialise_expiration_date_signatures(
+    sigs: &[AnnotatedExpirationDateSignature],
+) -> Vec<u8> {
+    storage_serialiser()
+        .serialize(&StorageBorrowedSerdeWrapper(&sigs))
+        .unwrap()
+}
+
+pub(crate) fn deserialise_expiration_date_signatures(
+    raw: &[u8],
+) -> Result<Vec<AnnotatedExpirationDateSignature>, StorageError> {
+    let de: StorageSerdeWrapper<_> = storage_serialiser().deserialize(raw).map_err(|_| {
+        StorageError::database_inconsistency("malformed expiration date signatures")
+    })?;
+    Ok(de.0)
+}
+
+// storage serialiser used for non-critical data, such as global expiration signatures or master verification keys,
+// i.e. data that could always be queried for again if malformed
+fn storage_serialiser() -> impl bincode::Options {
+    bincode::DefaultOptions::new()
+        .with_big_endian()
+        .with_varint_encoding()
+}
@@ -0,0 +1,307 @@
+// Copyright 2023 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::backends::sqlite::{
+    get_next_unspent_ticketbook, increase_used_ticketbook_tickets, SqliteEcashTicketbookManager,
+};
+use crate::error::StorageError;
+use crate::models::{BasicTicketbookInformation, RetrievedPendingTicketbook, RetrievedTicketbook};
+use crate::persistent_storage::helpers::{
+    deserialise_coin_index_signatures, deserialise_expiration_date_signatures,
+    serialise_coin_index_signatures, serialise_expiration_date_signatures,
+};
+use crate::storage::Storage;
+use async_trait::async_trait;
+use log::{debug, error};
+use nym_compact_ecash::scheme::coin_indices_signatures::AnnotatedCoinIndexSignature;
+use nym_compact_ecash::scheme::expiration_date_signatures::AnnotatedExpirationDateSignature;
+use nym_compact_ecash::VerificationKeyAuth;
+use nym_credentials::ecash::bandwidth::serialiser::VersionedSerialise;
+use nym_credentials::{IssuanceTicketBook, IssuedTicketBook};
+use nym_ecash_time::{ecash_today, Date, EcashTime};
+use sqlx::ConnectOptions;
+use std::path::Path;
+use zeroize::Zeroizing;
+
+mod helpers;
+
+// note that clone here is fine as upon cloning the same underlying pool will be used
+#[derive(Clone)]
+pub struct PersistentStorage {
+    storage_manager: SqliteEcashTicketbookManager,
+}
+
+impl PersistentStorage {
+    /// Initialises `PersistentStorage` using the provided path.
+    ///
+    /// # Arguments
+    ///
+    /// * `database_path`: path to the database.
+    pub async fn init<P: AsRef<Path>>(database_path: P) -> Result<Self, StorageError> {
+        debug!(
+            "Attempting to connect to database {:?}",
+            database_path.as_ref().as_os_str()
+        );
+
+        let mut opts = sqlx::sqlite::SqliteConnectOptions::new()
+            .filename(database_path)
+            .create_if_missing(true);
+
+        opts.disable_statement_logging();
+
+        let connection_pool = match sqlx::SqlitePool::connect_with(opts).await {
+            Ok(db) => db,
+            Err(err) => {
+                error!("Failed to connect to SQLx database: {err}");
+                return Err(err.into());
+            }
+        };
+
+        if let Err(err) = sqlx::migrate!("./migrations").run(&connection_pool).await {
+            error!("Failed to perform migration on the SQLx database: {err}");
+            return Err(err.into());
+        }
+
+        Ok(PersistentStorage {
+            storage_manager: SqliteEcashTicketbookManager::new(connection_pool.clone()),
+        })
+    }
+}
+
+#[async_trait]
+impl Storage for PersistentStorage {
+    type StorageError = StorageError;
+
+    /// remove all expired ticketbooks and expiration date signatures
+    async fn cleanup_expired(&self) -> Result<(), Self::StorageError> {
+        let ecash_yesterday = ecash_today().date().previous_day().unwrap();
+        self.storage_manager
+            .cleanup_expired(ecash_yesterday)
+            .await?;
+        Ok(())
+    }
+
+    async fn insert_pending_ticketbook(
+        &self,
+        ticketbook: &IssuanceTicketBook,
+    ) -> Result<(), Self::StorageError> {
+        let ser = ticketbook.pack();
+        let data = Zeroizing::new(ser.data);
+        let serialisation_revision = ser.revision;
+
+        self.storage_manager
+            .insert_pending_ticketbook(
+                serialisation_revision,
+                ticketbook.deposit_id(),
+                &data,
+                ticketbook.expiration_date(),
+            )
+            .await?;
+
+        Ok(())
+    }
+
+    async fn insert_issued_ticketbook(
+        &self,
+        ticketbook: &IssuedTicketBook,
+    ) -> Result<(), Self::StorageError> {
+        let ser = ticketbook.pack();
+        let data = Zeroizing::new(ser.data);
+        let serialisation_revision = ser.revision;
+
+        self.storage_manager
+            .insert_new_ticketbook(
+                serialisation_revision,
+                &data,
+                ticketbook.expiration_date(),
+                ticketbook.epoch_id() as u32,
+                ticketbook.params_total_tickets() as u32,
+                ticketbook.spent_tickets() as u32,
+            )
+            .await?;
+
+        Ok(())
+    }
+
+    async fn get_ticketbooks_info(
+        &self,
+    ) -> Result<Vec<BasicTicketbookInformation>, Self::StorageError> {
+        Ok(self.storage_manager.get_ticketbooks_info().await?)
+    }
+
+    async fn get_pending_ticketbooks(
+        &self,
+    ) -> Result<Vec<RetrievedPendingTicketbook>, Self::StorageError> {
+        let pending = self
+            .storage_manager
+            .get_pending_ticketbooks()
+            .await?
+            .into_iter()
+            .map(|p| {
+                IssuanceTicketBook::try_unpack(&p.pending_ticketbook_data, p.serialization_revision)
+                    .map_err(|err| {
+                        StorageError::database_inconsistency(format!(
+                            "failed to deserialise stored pending ticketbook: {err}"
+                        ))
+                    })
+                    .map(|pending_ticketbook| RetrievedPendingTicketbook {
+                        pending_id: p.deposit_id,
+                        pending_ticketbook,
+                    })
+            })
+            .collect::<Result<_, _>>()?;
+        Ok(pending)
+    }
+
+    async fn remove_pending_ticketbook(&self, pending_id: i64) -> Result<(), Self::StorageError> {
+        self.storage_manager
+            .remove_pending_ticketbook(pending_id)
+            .await?;
+        Ok(())
+    }
+
+    /// Tries to retrieve one of the stored ticketbook,
+    /// that has not yet expired and has required number of unspent tickets.
+    /// it immediately updated the on-disk number of used tickets so that another task
+    /// could obtain their own tickets at the same time
+    async fn get_next_unspent_usable_ticketbook(
+        &self,
+        tickets: u32,
+    ) -> Result<Option<RetrievedTicketbook>, Self::StorageError> {
+        let deadline = ecash_today().ecash_date();
+        let mut tx = self.storage_manager.begin_storage_tx().await?;
+
+        // we don't want ticketbooks with expiration in the past
+        let Some(raw) = get_next_unspent_ticketbook(&mut tx, deadline, tickets).await? else {
+            // make sure to finish our tx
+            tx.commit().await?;
+            return Ok(None);
+        };
+
+        let mut deserialised =
+            IssuedTicketBook::try_unpack(&raw.ticketbook_data, raw.serialization_revision)
+                .map_err(|err| {
+                    StorageError::database_inconsistency(format!(
+                        "failed to deserialise stored ticketbook: {err}"
+                    ))
+                })?;
+
+        increase_used_ticketbook_tickets(&mut tx, raw.id, tickets).await?;
+        tx.commit().await?;
+
+        // set the number of spent tickets on the crypto object
+        // TODO: I don't like how that's required and can be easily missed,
+        // perhaps we shouldn't be storing the `IssuedTicketBook` data in the db,
+        // but all of its fields instead?
+        deserialised.update_spent_tickets(raw.used_tickets as u64);
+        Ok(Some(RetrievedTicketbook {
+            ticketbook_id: raw.id,
+            ticketbook: deserialised,
+        }))
+    }
+
+    async fn attempt_revert_ticketbook_withdrawal(
+        &self,
+        ticketbook_id: i64,
+        withdrawn: u32,
+        expected_current_total_spent: u32,
+    ) -> Result<bool, Self::StorageError> {
+        Ok(self
+            .storage_manager
+            .decrease_used_ticketbook_tickets(
+                ticketbook_id,
+                withdrawn,
+                expected_current_total_spent,
+            )
+            .await?)
+    }
+
+    async fn get_master_verification_key(
+        &self,
+        epoch_id: u64,
+    ) -> Result<Option<VerificationKeyAuth>, Self::StorageError> {
+        let Some(raw) = self
+            .storage_manager
+            .get_master_verification_key(epoch_id as i64)
+            .await?
+        else {
+            return Ok(None);
+        };
+
+        let master_vk = VerificationKeyAuth::from_bytes(&raw).map_err(|_| {
+            StorageError::database_inconsistency("malformed stored master verification key")
+        })?;
+
+        Ok(Some(master_vk))
+    }
+
+    async fn insert_master_verification_key(
+        &self,
+        epoch_id: u64,
+        key: &VerificationKeyAuth,
+    ) -> Result<(), Self::StorageError> {
+        Ok(self
+            .storage_manager
+            .insert_master_verification_key(epoch_id as i64, &key.to_bytes())
+            .await?)
+    }
+
+    async fn get_coin_index_signatures(
+        &self,
+        epoch_id: u64,
+    ) -> Result<Option<Vec<AnnotatedCoinIndexSignature>>, Self::StorageError> {
+        let Some(raw) = self
+            .storage_manager
+            .get_coin_index_signatures(epoch_id as i64)
+            .await?
+        else {
+            return Ok(None);
+        };
+
+        Ok(Some(deserialise_coin_index_signatures(&raw)?))
+    }
+
+    async fn insert_coin_index_signatures(
+        &self,
+        epoch_id: u64,
+        sigs: &[AnnotatedCoinIndexSignature],
+    ) -> Result<(), Self::StorageError> {
+        self.storage_manager
+            .insert_coin_index_signatures(epoch_id as i64, &serialise_coin_index_signatures(sigs))
+            .await?;
+        Ok(())
+    }
+
+    async fn get_expiration_date_signatures(
+        &self,
+        expiration_date: Date,
+    ) -> Result<Option<Vec<AnnotatedExpirationDateSignature>>, Self::StorageError> {
+        let Some(raw) = self
+            .storage_manager
+            .get_expiration_date_signatures(expiration_date)
+            .await?
+        else {
+            return Ok(None);
+        };
+
+        Ok(Some(deserialise_expiration_date_signatures(
+            &raw.serialised_signatures,
+        )?))
+    }
+
+    async fn insert_expiration_date_signatures(
+        &self,
+        epoch_id: u64,
+        expiration_date: Date,
+        sigs: &[AnnotatedExpirationDateSignature],
+    ) -> Result<(), Self::StorageError> {
+        self.storage_manager
+            .insert_expiration_date_signatures(
+                epoch_id as i64,
+                expiration_date,
+                &serialise_expiration_date_signatures(sigs),
+            )
+            .await?;
+        Ok(())
+    }
+}
@@ -1,42 +1,93 @@
-// Copyright 2022 - Nym Technologies SA <contact@nymtech.net>
+// Copyright 2022-2024 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0

-use crate::models::{StorableIssuedCredential, StoredIssuedCredential};
+use crate::models::{BasicTicketbookInformation, RetrievedPendingTicketbook, RetrievedTicketbook};
 use async_trait::async_trait;
+use nym_compact_ecash::scheme::coin_indices_signatures::AnnotatedCoinIndexSignature;
+use nym_compact_ecash::scheme::expiration_date_signatures::AnnotatedExpirationDateSignature;
+use nym_compact_ecash::VerificationKeyAuth;
+use nym_credentials::{IssuanceTicketBook, IssuedTicketBook};
+use nym_ecash_time::Date;
 use std::error::Error;

+// for future reference, if you want to make a query for "how much bandwidth do we have left"
+// do something along the lines of
+// `SELECT total_tickets, used_tickets FROM ecash_ticketbook WHERE expiration_date >= ?`, today_date
+// then for each calculate the diff total_tickets - used_tickets and multiply the result by the size of the ticket
 #[async_trait]
 pub trait Storage: Send + Sync {
    type StorageError: Error;

-    async fn insert_issued_credential<'a>(
+    /// remove all expired ticketbooks and expiration date signatures
+    async fn cleanup_expired(&self) -> Result<(), Self::StorageError>;
+
+    async fn insert_pending_ticketbook(
        &self,
-        bandwidth_credential: StorableIssuedCredential<'a>,
+        ticketbook: &IssuanceTicketBook,
    ) -> Result<(), Self::StorageError>;

-    /// Tries to retrieve one of the stored, unused credentials,
-    /// that is also not marked as expired
-    async fn get_next_unspent_credential(
+    async fn insert_issued_ticketbook(
        &self,
-        gateway_id: &str,
-    ) -> Result<Option<StoredIssuedCredential>, Self::StorageError>;
-
-    /// Marks as consumed in the database the specified credential.
-    ///
-    /// # Arguments
-    ///
-    /// * `id`: Id of the credential to be consumed.
-    /// * `gateway_id`: id of the gateway that received the credential.
-    async fn consume_coconut_credential(
-        &self,
-        id: i64,
-        gateway_id: &str,
+        ticketbook: &IssuedTicketBook,
    ) -> Result<(), Self::StorageError>;

-    /// Marks the specified credential as expired
-    ///
-    /// # Arguments
-    ///
-    /// * `id`: Id of the credential to mark as expired.
-    async fn mark_expired(&self, id: i64) -> Result<(), Self::StorageError>;
+    async fn get_ticketbooks_info(
+        &self,
+    ) -> Result<Vec<BasicTicketbookInformation>, Self::StorageError>;
+
+    async fn get_pending_ticketbooks(
+        &self,
+    ) -> Result<Vec<RetrievedPendingTicketbook>, Self::StorageError>;
+
+    async fn remove_pending_ticketbook(&self, pending_id: i64) -> Result<(), Self::StorageError>;
+
+    /// Tries to retrieve one of the stored ticketbook,
+    /// that has not yet expired and has required number of unspent tickets.
+    /// it immediately updated the on-disk number of used tickets so that another task
+    /// could obtain their own tickets at the same time
+    async fn get_next_unspent_usable_ticketbook(
+        &self,
+        tickets: u32,
+    ) -> Result<Option<RetrievedTicketbook>, Self::StorageError>;
+
+    async fn attempt_revert_ticketbook_withdrawal(
+        &self,
+        ticketbook_id: i64,
+        withdrawn: u32,
+        expected_current_total_spent: u32,
+    ) -> Result<bool, Self::StorageError>;
+
+    async fn get_master_verification_key(
+        &self,
+        epoch_id: u64,
+    ) -> Result<Option<VerificationKeyAuth>, Self::StorageError>;
+
+    async fn insert_master_verification_key(
+        &self,
+        epoch_id: u64,
+        key: &VerificationKeyAuth,
+    ) -> Result<(), Self::StorageError>;
+
+    async fn get_coin_index_signatures(
+        &self,
+        epoch_id: u64,
+    ) -> Result<Option<Vec<AnnotatedCoinIndexSignature>>, Self::StorageError>;
+
+    async fn insert_coin_index_signatures(
+        &self,
+        epoch_id: u64,
+        data: &[AnnotatedCoinIndexSignature],
+    ) -> Result<(), Self::StorageError>;
+
+    async fn get_expiration_date_signatures(
+        &self,
+        expiration_date: Date,
+    ) -> Result<Option<Vec<AnnotatedExpirationDateSignature>>, Self::StorageError>;
+
+    async fn insert_expiration_date_signatures(
+        &self,
+        epoch_id: u64,
+        expiration_date: Date,
+        data: &[AnnotatedExpirationDateSignature],
+    ) -> Result<(), Self::StorageError>;
 }
@@ -10,11 +10,13 @@ license.workspace = true
 log = { workspace = true }
 thiserror = { workspace = true }
 tokio = { workspace = true }
+time.workspace = true

 nym-bandwidth-controller = { path = "../../common/bandwidth-controller" }
-nym-coconut = { path = "../nymcoconut" }
 nym-credentials = { path = "../../common/credentials" }
-nym-credential-storage = { path = "../../common/credential-storage" }
+nym-credential-storage = { path = "../../common/credential-storage", features = ["persistent-storage"] }
 nym-validator-client = { path = "../../common/client-libs/validator-client" }
 nym-config = { path = "../../common/config" }
 nym-client-core = { path = "../../common/client-core" }
+nym-compact-ecash = { path = "../../common/nym_offline_compact_ecash" }
+nym-ecash-time = { path = "../../common/ecash-time" }
@@ -3,6 +3,7 @@

 use nym_credential_storage::error::StorageError;
 use nym_credentials::error::Error as CredentialError;
+use nym_validator_client::coconut::EcashApiError;
 use nym_validator_client::nyxd::error::NyxdError;
 use std::num::ParseIntError;
 use thiserror::Error;
@@ -17,15 +18,30 @@ pub enum Error {
    #[error(transparent)]
    BandwidthControllerError(#[from] nym_bandwidth_controller::error::BandwidthControllerError),

+    #[error(transparent)]
+    EcashApiError(#[from] EcashApiError),
+
    #[error(transparent)]
    Nyxd(#[from] NyxdError),

    #[error(transparent)]
    Credential(#[from] CredentialError),

-    #[error("Could not use shared storage: {0}")]
-    SharedStorageError(#[from] StorageError),
+    #[error("could not use shared storage: {0}")]
+    SharedStorageError(Box<dyn std::error::Error + Send + Sync>),

    #[error("failed to parse credential value: {0}")]
    MalformedCredentialValue(#[from] ParseIntError),
 }
+
+impl Error {
+    pub fn storage_error(source: impl std::error::Error + Send + Sync + 'static) -> Self {
+        Error::SharedStorageError(Box::new(source))
+    }
+}
+
+impl From<StorageError> for Error {
+    fn from(value: StorageError) -> Self {
+        Self::storage_error(value)
+    }
+}
@@ -1,5 +1,4 @@
 pub mod errors;
-pub mod recovery_storage;
 pub mod utils;

 pub use errors::{Error, Result};
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
aniampio	28177d5d5d	Run fmt	2024-07-24 22:58:26 +01:00
aniampio	10b63f8667	Move functions around	2024-07-24 22:42:44 +01:00
aniampio	9989c226ae	Add type attribute	2024-07-24 22:41:36 +01:00
Jędrzej Stuczyński	31f85e61f0	fixed sdk-wasm build	2024-07-24 09:31:59 +01:00
Jędrzej Stuczyński	73ac5eb19b	post rebase fixes	2024-07-24 09:26:58 +01:00
Jędrzej Stuczyński	f1f06ceca2	fixed incorrect naming of the ecash contract lib	2024-07-24 09:12:51 +01:00
Jędrzej Stuczyński	f5841b2b60	chore: log info -> debug	2024-07-24 09:12:50 +01:00
Jędrzej Stuczyński	413ef2e11a	chore: fix unit tests	2024-07-24 09:12:50 +01:00
Jędrzej Stuczyński	96a4e8b636	updated ecash-contract parameters and generated schema	2024-07-24 09:12:50 +01:00
Jędrzej Stuczyński	4e79ef1b12	updated all ecash-related parameters - bloomfilter, expiration, sizes, etc.	2024-07-24 09:12:50 +01:00
Jędrzej Stuczyński	b5956933d9	improve client errors	2024-07-24 09:12:49 +01:00
Jędrzej Stuczyński	765589c444	testnet manager: create client against specific nym-node	2024-07-24 09:12:49 +01:00
Jędrzej Stuczyński	38663e41c3	testnet manager: start multiple gateways	2024-07-24 09:12:49 +01:00
Jędrzej Stuczyński	1463ddd339	fixed client crashing upon having bandwidth revoked	2024-07-24 09:12:49 +01:00
Jędrzej Stuczyński	d9a2e87fc6	fixed incorrect bloomfilter cutoff date calculation	2024-07-24 09:12:48 +01:00
Jędrzej Stuczyński	4630eb6cd4	improved bandwidth information propagation within the client	2024-07-24 09:12:48 +01:00
Jędrzej Stuczyński	aa00711138	fixed nym-node zk-nym config debug settings not being applied	2024-07-24 09:12:48 +01:00
Jędrzej Stuczyński	6b3292ddbc	changed the number of tickets to 100	2024-07-24 09:12:48 +01:00
Jędrzej Stuczyński	a5214af0df	Update README.md	2024-07-24 09:12:47 +01:00
Jędrzej Stuczyński	34d25f4faf	readme	2024-07-24 09:12:47 +01:00
Jędrzej Stuczyński	54e024962c	slightly less ghetto handling of .env files	2024-07-24 09:12:47 +01:00
Jędrzej Stuczyński	e552ebb736	removed outdated error	2024-07-24 09:12:44 +01:00
Jędrzej Stuczyński	39aa3b624f	fixed query for client bandwidth	2024-07-24 09:12:44 +01:00
Simon Wicky	2d2121b331	Another Grand Ecash Squasheroo add offline ecash library minor changes in coconut benchmarks add ecash smart contract change contract traits from coconut to ecash first wave of andrew's suggestion first wave of andrew's suggestion second wave of andrew's suggestion for ecash lib andrew's suggestion for ecash contract licensing commit safety comments for most unwraps more unwrap handling change chrono crate for time latest cargo lock error revamp small visibility fix small fix remove indexedmap from contract + some tweaks add cw2 version in ecash contract remove envryption key from contract change types from coconut to ecash types adapt api model for credential issuance adapt issued credential storage on API add signatures cache on API change API routes for new blind signing modify issued_credential table add issuance logic client-side credential and signature storage client side utils for credential issuance first wave of fix some of andrew's suggestions remove encryption key from deposit freepass issuance client side freepass issuance API side andrew's suggested fixes other suggested fix adapt change from PR below allow offline verification flag credential spending models credential spending models for client credential preperation for the client credential preperation for the client credential storage for spending on client bloom filter for API spent credential storage on validators API route for spending online and offline ecash API routes in the client lib credential storage on gateway ecash verifier to replace coconut verifier accept credentials on gateway bandwidth expiration for gateways client ask for more bandwidth if it runs out credential import adapt nym validator rewarder and sdk fix tests api tests and add constants cargo fmt and lock and small test fix cargo fmt and lock and small test fix cargo lock move stuff where they belong in ecash and static parameters move some constants, error handling and phase out time crate error revamp part 2 secret key by ref instead of clone change l in wallet and v visibility rework payinfo rework monster tuples fix expiration date signature cloning minor fixes final bits and bobs fixes final bits and bobs fixes rename l accessor to tickets_spent wave of fixes second wave of fixes change hash domain value removed benchmark flag remove useless stringification in storage nuke Bandwidth voucher change timestamps to offsetdatetime key name change post-rebase fixes update nym-connect 'time' dep due to broken semver upload ecash contract to the build server make wasm zknym-lib compile but it won't work properly just yet make wasm zknym-lib compile but it won't work properly just yet fix typo in ecash contract deps make sure to use 0.1.0 sphinx packet optimise pairings in 'check_vk_pairing' derive serde for ecash types simplified g1 tuple byte conversion further optimise the pairing unified signature type + renamed nym-api coconut module to ecash using bincode serialiser for more complex binary types using multimiller loop instead of rayon for verifying coin indices signatures batching signature verification wherever possible feature-locked rayon clippy refactor ecash contract a bit + introduce deposit storage reworked find_proposal_id various minor fixed add offline_zk_nyms to nym-node everywhere add missing #query change test value to fit new serialization optimised deposits storage removed duplicate decompression code using deposit_id instead of transaction hash removed freepasses split up ecash handling unified shared state fixed deposit_id parsing log recovered deposit id removed online verification add detailed build info to ecash contract fixed deserialisation of deposit amount received from nyxd queries changed deposit to only persist attached pubkey first iteration of split of verification and redemption basic tool for setting up new network expanded the tool with the option to bypass DKG rename + init network without DKG setting up locally running apis ecash key migration more local functionalities wip fixing sql schemas gateway immediately submitting redemption proposal and getting it passed if valid most of the gateway logic for split redemption with error recovery fixed gateway not persisting ecash signers simplify creation of compatible client create properly serialised ecash key from the beginning rebuild missing tickets and proposals on startup stop ticket issuance during DKG transition fixing build issues split out ecash storage on nym-api side master-verification-key route caching all the signatures and keys implemented aggregated routes for nym-apis swagger UI for ecash endpoints added explicit annotation for index and expiration signatures revamped client ticketbook storage save all recovery information in the same underlying storage wrapper for bloomfilter being more aggressive with marking tickets as used ensure client has correct signatures before making deposit fix deserialisation of AggregatedExpirationDateSignatureResponse + add ticketbook table split nym-api ecash routes handlers into multiple files fixed deserialisation of encoded expiration date add tt_gamma1 to challenge and change naming for paper consistency rotating double spending bloomfilter nym-api test fixes + make sure to insert initial BF params fixed ecash benchmark code updated contract schema updated CI to not upload gateway/mixnode binaries ticket bandwidth revocation added default deserialisation for zk nym config post-rebase fixes	2024-07-24 09:12:43 +01:00
Bogdan-Ștefan Neacşu	fd1d437211	Add 1GB/day/user bandwidth cap (#4717 ) * Add check for 1GB/day/user and remove stale check * Use saturated_sub * Remove from wg peers * Use 10 seconds instead of 1 * Query bandwidth message * Ad client query message too * Keep stale check * Make bandwidth cap value public * Fix consumed vs available bug * Don't overwrite existing registrations * Use self pub key instead of peer's	2024-07-23 20:49:49 +02:00
Jędrzej Stuczyński	6478736654	Merge pull request #4706 from nymtech/chore/remove-old-migration-code removed mixnode/gateway config migration code and disabled cli without explicit flag	2024-07-23 15:11:36 +01:00
Jon Häggblad	f86050d916	Default construct NodeRole for backwards compatibility (#4722 )	2024-07-22 16:04:29 +02:00
import this	4e51188d35	[DOCs/operators]: Guide to back up and restore nym-node (#4720 ) * add node backup & node restore guides * finished: ready to review * finished: ready to review	2024-07-22 11:17:55 +00:00
John Smith	22eb199936	Update isp-sheet.csv (#4718 ) * Update isp-sheet.csv Added a few known VPS providers which (a) support crypto payment (b) allow TOR in some shape or form (c) more or less know for their stability. Will add more eventually. * Update isp-sheet.csv added a few more providers	2024-07-22 10:57:57 +00:00
Tommy Verrall	a2fc1bbc96	Merge pull request #4719 from nymtech/serinko/bug-fix/wss-guide [DOCs/operators]: BugFix - add ssl cert to WSS server block	2024-07-19 12:48:36 +02:00
import this	621599692f	add ssl cert to WSS server block	2024-07-19 10:43:02 +00:00
import this	3ad3837c87	done: fix wrong URL and picture formatting (#4714 )	2024-07-17 10:47:41 +00:00
import this	4d745e3b7e	[DOCs/operators]: Correct ports for bonding (#4707 ) * fix port issue for nym-node mixnode * fix port issue for nym-node mixnode * simplify language * clarify moving node info * syntax fix	2024-07-16 14:00:38 +00:00
Sachin Kamath	3a053b8dd6	fix links (#4712 )	2024-07-15 18:06:56 +02:00
Bogdan-Ștefan Neacşu	1f144690da	Add upgrades to nym-node for authenticator changes (#4703 ) (#4710 ) * Add iterative upgrades to nym-node * Authenticator correct configuration * Add info log * Enable auth opts on entry gw * Move ephemeral config from exit_gateway * Fix fmt * Fix clippy * Pass custom transceiver for authenticator * Fix non-linux build * Feature gate wg_api * Change naming from semver to simple incremental * Move opts unwrap inside the mutable function * Remove unneeded authenticator_description	2024-07-12 14:45:59 +02:00
Tommy Verrall	eec1895acc	Merge pull request #4709 from nymtech/dependabot/npm_and_yarn/nym-wallet/webdriver/braces-3.0.3 Bump braces from 3.0.2 to 3.0.3 in /nym-wallet/webdriver	2024-07-12 12:14:04 +02:00
dependabot[bot]	99864cb7a9	Bump braces from 3.0.2 to 3.0.3 in /nym-wallet/webdriver Bumps [braces](https://github.com/micromatch/braces) from 3.0.2 to 3.0.3. - [Changelog](https://github.com/micromatch/braces/blob/master/CHANGELOG.md) - [Commits](https://github.com/micromatch/braces/compare/3.0.2...3.0.3) --- updated-dependencies: - dependency-name: braces dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>	2024-07-12 09:09:14 +00:00
Fouad	3155728119	fix explorer mui deps (#4708 )	2024-07-12 10:08:29 +01:00
Jędrzej Stuczyński	c253b22f69	fixed the positional argument	2024-07-11 16:20:20 +01:00
Jędrzej Stuczyński	66f3a3e9a8	removed mixnode/gateway config migration code and disabled commands without explicit flag	2024-07-11 15:53:10 +01:00
Sachin Kamath	65a1d6d91e	switch to new vanity link (#4705 )	2024-07-11 13:04:56 +01:00
mx	44cf9b054b	Max/dev portal update (#4696 ) * updated tutorials with archive + stub * removed out of date faq pages * added binary build instructions section * removed clients from docs * added clients to devportal * moved nym-vs-others to docs from devportal * removed ood quickstart stuff * tweaked integration options page * summary changes for new structure * moved sdk to devportal * removed sdk from docs * changed summary file for new structure * added intro client overview page * added wallet gif * fixed now broken links * removed old comm pages * added references to newer apps (oreowallet + zcash demo) * updated darkfi irc socks5 * fixed broken link --------- Co-authored-by: mfahampshire <mfahampshire@pm.me>	2024-07-10 13:54:13 +02:00
Tommy Verrall	39e2473ef3	Merge pull request #4702 from nymtech/release/2024.7-doubledecker Release/2024.7 doubledecker	2024-07-10 13:25:11 +02:00
import this	93a108863c	add node description and release changelog (#4701 )	2024-07-10 10:59:47 +00:00
import this	0905593123	[DOCs/operators]: Test WSS for exit-gateway, write a tutorial & update reversed proxy page (#4694 ) * initialise wss guide * update reverse proxy guide to post smoosh * finish draft - missing correct script and testing * syntax edit * syntax edit * update WSS configs and script * edit WSS configs and script * dinish wss guide - ready to review * dinish wss guide - ready to review	2024-07-10 10:59:22 +00:00
Tommy Verrall	ed9223d5a3	Merge branch 'develop' into release/2024.7-doubledecker	2024-07-10 11:46:21 +02:00
Tommy Verrall	962684ff56	Merge pull request #4667 from nymtech/feature/authenticator Add authenticator	2024-07-10 10:14:58 +02:00
Tommy Verrall	7b3804c078	Merge pull request #4697 from nymtech/event-parsing add event parsing to support cosmos_sdk > 0.50	2024-07-10 09:55:43 +02:00
Sachin Kamath	170f1823e1	fix tests	2024-07-09 21:54:57 +05:30
Sachin Kamath	dc2020559a	parse attributes from events instead of raw logs	2024-07-09 21:24:58 +05:30
Tommy Verrall	2b9444cce3	add an early return in parse_raw_str_logs for empty raw log strings. this accommodates for the v50 chain upgrade	2024-07-09 20:36:36 +05:30
Bogdan-Ștefan Neacşu	68c1c068ac	Add old config upgrade flow	2024-07-09 09:16:00 +00:00
Drazen Urch	3d0b70a237	Add mixnodes to self describing api cache (#4684 ) * Add mixnodes to self describing api cache * Use NodeRole enum * Add route for described mixnodes * Cleanup contract_cache * Remove nodestatuscache * wait_until_ready impl	2024-07-09 10:54:48 +02:00
Bogdan-Ștefan Neacşu	65a6edc78c	Add authenticator debug to entry gateway config	2024-07-08 11:00:53 +00:00
Sachin Kamath	2ec8349897	update social links (#4695 ) * replace vanity link * fix links	2024-07-05 14:19:09 +00:00
Bogdan-Ștefan Neacşu	38a2d94f80	Fix clippy	2024-07-05 11:36:15 +00:00
Bogdan-Ștefan Neacşu	c7fa910516	Fix add of req id	2024-07-05 10:36:18 +00:00
Bogdan-Ștefan Neacşu	2fe08274dd	Add another layer for request id field	2024-07-05 10:20:56 +00:00
mx	be89d848dc	Max/try fix doc search (#4692 ) * minimised dropdown bar * update ci scripts * theme changes to dev portal * theme changes to operators * theme changes to docs * theme -> themes * fixed theme -> themes import in book * removed bak files * remove logging from post_process + remove search feature from mdbook --------- Co-authored-by: mfahampshire <mfahampshire@pm.me>	2024-07-05 12:19:14 +02:00
Bogdan-Ștefan Neacşu	a230a9b8b9	Merge remote-tracking branch 'origin/develop' into feature/authenticator	2024-07-05 09:57:48 +00:00
Bogdan-Ștefan Neacşu	72eae7cdf3	Remove stale mid-registrations	2024-07-05 09:38:17 +00:00
Bogdan-Ștefan Neacşu	7cae195370	Typo	2024-07-05 07:54:29 +00:00
Bogdan-Ștefan Neacşu	dfb16e385c	Rand from workspace	2024-07-05 07:53:33 +00:00
Bogdan-Ștefan Neacşu	660e1cad0a	Reconstruction msg	2024-07-04 14:26:37 +00:00
Bogdan-Ștefan Neacşu	7c1aa57a7e	Add curr version	2024-07-04 14:15:25 +00:00
Bogdan-Ștefan Neacşu	a06e496f78	Add final req creation	2024-07-04 13:54:13 +00:00
Jon Häggblad	70599b97b9	Send bandwidth status messages when connecting (#4691 ) * Send bandwidth status messages when connecting * Rename to task_client * Move status message type to bandwidth controller	2024-07-04 13:10:16 +02:00
Bogdan-Ștefan Neacşu	02b194bde0	Function to create AuthReq	2024-07-04 10:40:53 +00:00
Bogdan-Ștefan Neacşu	20ec049db5	Remove more unnecessary structures	2024-07-04 09:41:17 +00:00
Tommy Verrall	ebac4e8564	Update ci-build-upload-binaries.yml	2024-07-04 09:57:37 +02:00
benedettadavico	da81664729	update versions and changelog	2024-07-04 09:36:09 +02:00
Bogdan-Ștefan Neacşu	fec3d46b33	Include auth in self description	2024-07-03 13:50:44 +00:00
Bogdan-Ștefan Neacşu	a4eb3a7dbf	Named fork for better logging	2024-07-03 13:03:32 +00:00
Bogdan-Ștefan Neacşu	28d15f2c4f	Remove unused import	2024-07-03 11:28:09 +00:00
Bogdan-Ștefan Neacşu	c6f93e38f5	Remove unused post function	2024-07-03 09:34:03 +00:00
Bogdan-Ștefan Neacşu	2159f71888	Fix wg feature	2024-07-03 09:04:01 +00:00
Bogdan-Ștefan Neacşu	a9abea3446	Fix macos build	2024-07-03 08:27:10 +00:00
Bogdan-Ștefan Neacşu	8e2713c9ba	Remove unwrap	2024-07-03 08:21:58 +00:00
Bogdan-Ștefan Neacşu	2ba0ef0e35	Remove unused wg http endpoint	2024-07-02 14:09:34 +00:00
Bogdan-Ștefan Neacşu	d3713cbc79	Fix user agent arg	2024-07-02 16:40:11 +03:00
Bogdan-Ștefan Neacşu	4d3fb2b585	Merge remote-tracking branch 'origin/develop' into feature/authenticator	2024-07-02 16:25:29 +03:00
benedetta davico	ebfb9c4bc1	Merge pull request #4686 from nymtech/bugfix/chain-upgrade-raw-logs Add an early return in `parse_raw_str_logs` for empty raw log strings.	2024-07-02 12:29:48 +02:00
Tommy Verrall	8e7918cc45	add an early return in parse_raw_str_logs for empty raw log strings. this accommodates for the v50 chain upgrade	2024-07-02 11:19:50 +02:00
Bogdan-Ștefan Neacşu	c465eb3efc	Fix error type	2024-07-02 08:58:48 +00:00
Bogdan-Ștefan Neacşu	b90136ac4e	Uniformise non-linux wg function	2024-07-01 15:10:36 +00:00
Bogdan-Ștefan Neacşu	ae5373168d	Fmt	2024-07-01 14:42:10 +00:00
Bogdan-Ștefan Neacşu	6f3942f6b7	Move implementation for final request	2024-07-01 14:38:48 +00:00
Bogdan-Ștefan Neacşu	13f38343aa	Finalize cli build	2024-07-01 13:44:59 +00:00
Bogdan-Ștefan Neacşu	f75b4843e8	Merge remote-tracking branch 'origin/develop' into feature/authenticator	2024-07-01 09:56:34 +00:00
Bogdan-Ștefan Neacşu	b43844bd7a	Embed into gateway	2024-06-21 15:51:02 +00:00
Bogdan-Ștefan Neacşu	cd89feb57e	Fix path	2024-06-20 15:15:05 +00:00
Bogdan-Ștefan Neacşu	17553d606e	Requests and responses	2024-06-20 16:58:21 +03:00
Bogdan-Ștefan Neacşu	b6d9ed960b	Specify version	2024-06-19 11:37:09 +03:00
Bogdan-Ștefan Neacşu	1d89a887fb	Add authenticator	2024-06-18 19:05:23 +03:00