add replay detection to packet processing

fixed nym-api config template

Cargo.toml

@@ -33,7 +33,7 @@ members = [
     "common/cosmwasm-smart-contracts/coconut-bandwidth-contract",
     "common/cosmwasm-smart-contracts/coconut-dkg",
     "common/cosmwasm-smart-contracts/contracts-common",
-    "common/cosmwasm-smart-contracts/ephemera",
+#    "common/cosmwasm-smart-contracts/ephemera",
     "common/cosmwasm-smart-contracts/group-contract",
     "common/cosmwasm-smart-contracts/mixnet-contract",
     "common/cosmwasm-smart-contracts/multisig-contract",
@@ -104,7 +104,7 @@ members = [
     "nym-outfox",
     "nym-validator-rewarder",
     "tools/internal/ssl-inject",
-    "tools/internal/sdk-version-bump",
+    # "tools/internal/sdk-version-bump",
     "tools/nym-cli",
     "tools/nym-nr-query",
     "tools/nymvisor",
@@ -158,7 +158,7 @@ log = "0.4"
 once_cell = "1.7.2"
 parking_lot = "0.12.1"
 rand = "0.8.5"
-reqwest = "0.11.22"
+reqwest = { version = "0.11.22", default_features = false, features = ["rustls-tls"] }
 schemars = "0.8.1"
 serde = "1.0.152"
 serde_json = "1.0.91"
@@ -168,9 +168,9 @@ time = "0.3.30"
 thiserror = "1.0.48"
 tokio = "1.33.0"
 tokio-util = "0.7.10"
-tokio-tungstenite = "0.20.1"
+tokio-tungstenite = { version = "0.20.1", features = ["rustls"] }
 tracing = "0.1.37"
-tungstenite = { version = "0.20.1", default-features = false }
+tungstenite = { version = "0.20.1", default-features = false, features = ["rustls"] }
 ts-rs = "7.0.0"
 utoipa = "3.5.0"
 utoipa-swagger-ui = "3.1.5"

common/client-libs/gateway-client/Cargo.toml

@@ -48,7 +48,7 @@ features = ["net", "sync", "time"]
 workspace = true
 # the choice of this particular tls feature was arbitrary;
 # if you reckon a different one would be more appropriate, feel free to change it
-features = ["native-tls"]
+# features = ["native-tls"]
 
 # wasm-only dependencies
 [target."cfg(target_arch = \"wasm32\")".dependencies.wasm-bindgen]

common/client-libs/validator-client/Cargo.toml

@@ -31,7 +31,6 @@ log = { workspace = true }
 url = { workspace = true, features = ["serde"] }
 tokio = { workspace = true, features = ["sync", "time"] }
 futures = { workspace = true }
-openssl = { version = "^0.10.55", features = ["vendored"], optional = true }
 
 nym-coconut-interface = { path = "../../coconut-interface" }
 nym-network-defaults = { path = "../../network-defaults" }
@@ -90,7 +89,7 @@ required-features = ["http-client"]
 
 [features]
 default = ["http-client"]
-http-client = ["cosmrs/rpc", "openssl"]
+http-client = ["cosmrs/rpc"]
 generate-ts = []
 contract-testing = ["nym-mixnet-contract-common/contract-testing"]
 

common/mixnode-common/Cargo.toml

@@ -24,6 +24,7 @@ tokio = { version = "1.24.1", features = [
 tokio-util = { workspace = true, features = ["codec"] }
 url = { workspace = true }
 thiserror = { workspace = true }
+fastbloom-rs = { git = "https://github.com/simonwicky/fastbloom"}
 
 ## tracing
 tracing = { version = "0.1.37", optional = true }

common/mixnode-common/src/packet_processor/error.rs

@@ -28,4 +28,7 @@ pub enum MixProcessingError {
 
     #[error("failed to process received outfox packet: {0}")]
     OutfoxProcessingError(#[from] OutfoxError),
+
+    #[error("this packet was already processed, it's a replay")]
+    ReplayedPacketDetected,
 }

common/mixnode-common/src/packet_processor/mod.rs

@@ -3,3 +3,4 @@
 
 pub mod error;
 pub mod processor;
+pub mod replay_detection;

common/mixnode-common/src/packet_processor/processor.rs

@@ -3,6 +3,7 @@
 
 use crate::measure;
 use crate::packet_processor::error::MixProcessingError;
+use crate::packet_processor::replay_detection::ReplayDetector;
 use log::*;
 use nym_sphinx_acknowledgements::surb_ack::SurbAck;
 use nym_sphinx_addressing::nodes::NymNodeRoutingAddress;
@@ -40,6 +41,9 @@ pub enum MixProcessingResult {
 pub struct SphinxPacketProcessor {
     /// Private sphinx key of this node required to unwrap received sphinx packet.
     sphinx_key: Arc<PrivateKey>,
+
+    /// Detector of replay attack
+    replay_detector: ReplayDetector,
 }
 
 impl SphinxPacketProcessor {
@@ -47,6 +51,7 @@ impl SphinxPacketProcessor {
     pub fn new(sphinx_key: PrivateKey) -> Self {
         SphinxPacketProcessor {
             sphinx_key: Arc::new(sphinx_key),
+            replay_detector: ReplayDetector::new(),
         }
     }
 
@@ -184,7 +189,7 @@ impl SphinxPacketProcessor {
         match packet {
             NymProcessedPacket::Sphinx(packet) => {
                 match packet {
-                    ProcessedPacket::ForwardHop(packet, address, delay) => self
+                    ProcessedPacket::ForwardHop(packet, address, delay, _) => self
                         .process_forward_hop(
                             NymPacket::Sphinx(*packet),
                             address,
@@ -193,12 +198,13 @@ impl SphinxPacketProcessor {
                         ),
                     // right now there's no use for the surb_id included in the header - probably it should get removed from the
                     // sphinx all together?
-                    ProcessedPacket::FinalHop(destination, _, payload) => self.process_final_hop(
-                        destination,
-                        payload.recover_plaintext()?,
-                        packet_size,
-                        packet_type,
-                    ),
+                    ProcessedPacket::FinalHop(destination, _, payload, _) => self
+                        .process_final_hop(
+                            destination,
+                            payload.recover_plaintext()?,
+                            packet_size,
+                            packet_type,
+                        ),
                 }
             }
             NymProcessedPacket::Outfox(packet) => {
@@ -239,6 +245,10 @@ impl SphinxPacketProcessor {
             // unwrap the sphinx packet and if possible and appropriate, cache keys
             let processed_packet = self.perform_initial_unwrapping(received)?;
 
+            //check for replay attack
+            self.replay_detector
+                .handle_replay_tag(&processed_packet.replay_tag())?;
+
             // for forward packets, extract next hop and set delay (but do NOT delay here)
             // for final packets, extract SURBAck
             let final_processing_result =

common/mixnode-common/src/packet_processor/replay_detection.rs

@@ -0,0 +1,76 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::packet_processor::error::MixProcessingError;
+use fastbloom_rs::{BloomFilter, FilterBuilder, Membership};
+use std::sync::{Arc, Mutex};
+
+const BLOOM_FILTER_SIZE: u64 = 10_000_000;
+const FP_RATE: f64 = 1e-4;
+
+//alias for convenience
+type ReplayTag = [u8];
+
+#[derive(Clone, Debug)]
+pub struct ReplayDetector(Arc<Mutex<ReplayDetectorInner>>);
+
+impl ReplayDetector {
+    pub fn new() -> Self {
+        ReplayDetector(Arc::new(Mutex::new(ReplayDetectorInner::new())))
+    }
+
+    //check if secret has been seen already
+    //if no, return Ok
+    //if yes, add the secret to the list, then return an error
+    pub fn handle_replay_tag(&self, replay_tag: &ReplayTag) -> Result<(), MixProcessingError> {
+        match self.0.lock() {
+            Ok(mut inner) => {
+                if !inner.lookup_then_insert(replay_tag) {
+                    Ok(())
+                } else {
+                    Err(MixProcessingError::ReplayedPacketDetected)
+                }
+            }
+            Err(err) => {
+                log::warn!("Failed to handle replay_tag : {err}");
+                Ok(()) //what is the sensible thing to do, if the lock is poisoned? Reset the filter ?
+            }
+        }
+    }
+}
+
+impl Default for ReplayDetector {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
+#[derive(Debug)]
+struct ReplayDetectorInner {
+    filter: BloomFilter,
+}
+
+impl ReplayDetectorInner {
+    pub fn new() -> Self {
+        ReplayDetectorInner {
+            filter: FilterBuilder::new(BLOOM_FILTER_SIZE, FP_RATE).build_bloom_filter(),
+        }
+    }
+
+    pub fn lookup_then_insert(&mut self, replay_tag: &ReplayTag) -> bool {
+        self.filter.contains_then_add(replay_tag)
+    }
+}
+
+#[cfg(test)]
+mod replay_detector_test {
+    use super::*;
+
+    #[test]
+    fn handle_replay_tag_correctly_detects_replay() {
+        let replay_detector = ReplayDetector::new();
+        let replay_tag = b"Hello World!";
+        assert!(replay_detector.handle_replay_tag(replay_tag).is_ok()); //first insert is fine
+        assert!(replay_detector.handle_replay_tag(replay_tag).is_err()); //second is not
+    }
+}

common/nymsphinx/types/Cargo.toml

@@ -8,9 +8,10 @@ license = { workspace = true }
 repository = { workspace = true }
 
 [dependencies]
-sphinx-packet = { version = "0.1.0", optional = true }
+#sphinx-packet = { version = "0.1.0", optional = true }
 nym-outfox = { path = "../../../nym-outfox", optional = true }
 thiserror = { workspace = true }
+sphinx-packet = { git = "https://github.com/nymtech/sphinx.git", branch = "simon/replay_tag", optional = true}
 
 [features]
 default = ["sphinx"]

common/nymsphinx/types/src/lib.rs

@@ -9,6 +9,7 @@ pub use nym_outfox::{
 // re-exporting types and constants available in sphinx
 #[cfg(feature = "outfox")]
 use nym_outfox::packet::{OutfoxPacket, OutfoxProcessedPacket};
+use sphinx_packet::header::keys::ReplayTag;
 #[cfg(feature = "sphinx")]
 pub use sphinx_packet::{
     constants::{
@@ -57,6 +58,15 @@ pub enum NymProcessedPacket {
     Outfox(OutfoxProcessedPacket),
 }
 
+impl NymProcessedPacket {
+    pub fn replay_tag(&self) -> ReplayTag {
+        match self {
+            NymProcessedPacket::Sphinx(sphinx) => sphinx.replay_tag(),
+            NymProcessedPacket::Outfox(_) => todo!(), //SW temporary while I add a replay tag to outfox
+        }
+    }
+}
+
 impl fmt::Debug for NymPacket {
     fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
         #[allow(unreachable_patterns)]

deny.toml

@@ -217,6 +217,7 @@ deny = [
     # Wrapper crates can optionally be specified to allow the crate when it
     # is a direct dependency of the otherwise banned crate
     #{ name = "ansi_term", version = "=0.11.0", wrappers = [] },
+    { name = "openssl"},
 ]
 
 # List of features to allow/deny

ephemera/Cargo.toml

@@ -37,7 +37,7 @@ nym-config = { path = "../common/config" }
 nym-ephemera-common = { path = "../common/cosmwasm-smart-contracts/ephemera" }
 pretty_env_logger = "0.4"
 refinery = { version = "0.8.7", features = ["rusqlite"], optional = true }
-reqwest = { version = "0.11.22", features = ["json"] }
+reqwest = { version = "0.11.22", default_features = false, features = ["rustls-tls", "json"] }
 # Rocksdb kills compilation times and we're not currently using it. The reason
 # we comment it out is that rust-analyzer runs with --all-features
 #rocksdb = { version = "0.21.0", optional = true }

nym-api/Cargo.toml

@@ -66,21 +66,20 @@ schemars = { workspace = true, features = ["preserve_order"] }
 zeroize = { workspace = true }
 
 ## ephemera-specific
-actix-web = "4"
-array-bytes = "6.0.0"
-chrono = { version = "0.4.24", default-features = false, features = ["clock"] }
-futures-util = "0.3.25"
-serde_derive = "1.0.149"
-tempfile = "3.3.0"
-uuid = { version = "1.3.0", features = ["serde", "v4"] }
+#actix-web = "4"
+#array-bytes = "6.0.0"
+#chrono = { version = "0.4.24", default-features = false, features = ["clock"] }
+#futures-util = "0.3.25"
+#serde_derive = "1.0.149"
+#uuid = { version = "1.3.0", features = ["serde", "v4"] }
 
 ## internal
-ephemera = { path = "../ephemera" }
+#ephemera = { path = "../ephemera" }
 nym-bandwidth-controller = { path = "../common/bandwidth-controller" }
 nym-coconut-bandwidth-contract-common = { path = "../common/cosmwasm-smart-contracts/coconut-bandwidth-contract" }
 nym-coconut-dkg-common = { path = "../common/cosmwasm-smart-contracts/coconut-dkg" }
 nym-coconut-interface = { path = "../common/coconut-interface" }
-nym-ephemera-common = { path = "../common/cosmwasm-smart-contracts/ephemera" }
+#nym-ephemera-common = { path = "../common/cosmwasm-smart-contracts/ephemera" }
 nym-config = { path = "../common/config" }
 cosmwasm-std = { workspace = true }
 nym-credential-storage = { path = "../common/credential-storage" }
@@ -123,6 +122,7 @@ sqlx = { workspace = true, features = [
 ] }
 
 [dev-dependencies]
+tempfile = "3.3.0"
 cw3 = { workspace = true }
 cw-utils = { workspace = true }
 rand_chacha = "0.3"

nym-api/src/coconut/dkg/state/dealing_exchange.rs

@@ -5,7 +5,7 @@ use super::serde_helpers::generated_dealings;
 use crate::coconut::dkg::state::DkgParticipant;
 use nym_coconut_dkg_common::types::DealingIndex;
 use nym_dkg::{Dealing, NodeIndex};
-use serde_derive::{Deserialize, Serialize};
+use serde::{Deserialize, Serialize};
 use std::collections::{BTreeMap, HashMap};
 
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]

nym-api/src/coconut/dkg/state/in_progress.rs

@@ -1,7 +1,7 @@
 // Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: GPL-3.0-only
 
-use serde_derive::{Deserialize, Serialize};
+use serde::{Deserialize, Serialize};
 
 #[derive(Debug, Clone, Copy, Default, Serialize, Deserialize)]
 #[serde(rename_all = "lowercase")]

nym-api/src/coconut/dkg/state/key_derivation.rs

@@ -5,7 +5,7 @@ use super::serde_helpers::recovered_keys;
 use cosmwasm_std::Addr;
 use nym_coconut_dkg_common::types::{DealingIndex, EpochId};
 use nym_dkg::{G2Projective, NodeIndex, RecoveredVerificationKeys, Threshold};
-use serde_derive::{Deserialize, Serialize};
+use serde::{Deserialize, Serialize};
 use std::collections::{BTreeMap, HashMap};
 use thiserror::Error;
 

nym-api/src/coconut/dkg/state/key_finalization.rs

@@ -1,7 +1,7 @@
 // Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: GPL-3.0-only
 
-use serde_derive::{Deserialize, Serialize};
+use serde::{Deserialize, Serialize};
 
 #[derive(Debug, Clone, Copy, Default, Serialize, Deserialize)]
 #[serde(rename_all = "lowercase")]

nym-api/src/coconut/dkg/state/key_validation.rs

@@ -1,7 +1,7 @@
 // Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: GPL-3.0-only
 
-use serde_derive::{Deserialize, Serialize};
+use serde::{Deserialize, Serialize};
 use std::collections::HashMap;
 
 type ProposalId = u64;

nym-api/src/coconut/dkg/state/registration.rs

@@ -7,7 +7,7 @@ use nym_coconut_dkg_common::dealer::DealerDetails;
 use nym_coconut_dkg_common::types::EncodedBTEPublicKeyWithProof;
 use nym_dkg::bte::PublicKeyWithProof;
 use nym_dkg::{bte, NodeIndex};
-use serde_derive::{Deserialize, Serialize};
+use serde::{Deserialize, Serialize};
 use thiserror::Error;
 
 #[derive(Clone, Deserialize, Debug, Serialize)]

nym-api/src/ephemera/mod.rs

@@ -1,11 +1,14 @@
 // Copyright 2023 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: GPL-3.0-only
 
+// while those files are completely unused now, I'm going to leave them here for future reference once we decide to revive the project to have a starting point
+// but whoever picks it up: you are forbidden from trying to use actix
+
 extern crate core;
 
 use clap::Parser;
 use ephemera::cli::init::Cmd;
-use serde_derive::{Deserialize, Serialize};
+use serde::{Deserialize, Serialize};
 use std::path::PathBuf;
 
 pub(crate) mod application;

nym-api/src/epoch_operations/helpers.rs

@@ -5,7 +5,7 @@ use crate::epoch_operations::RewardedSetUpdater;
 use cosmwasm_std::{Decimal, Fraction};
 use nym_mixnet_contract_common::reward_params::Performance;
 use nym_mixnet_contract_common::{ExecuteMsg, Interval, MixId};
-use serde_derive::{Deserialize, Serialize};
+use serde::{Deserialize, Serialize};
 
 #[derive(Debug, Clone, Copy, Serialize, Deserialize)]
 pub(crate) struct MixnodeWithPerformance {

nym-api/src/epoch_operations/mod.rs

@@ -12,7 +12,6 @@
 // 3. Eventually this whole procedure is going to get expanded to allow for distribution of rewarded set generation
 //    and hence this might be a good place for it.
 
-use crate::ephemera::reward::{EpochOperations, RewardManager};
 use crate::node_status_api::ONE_DAY;
 use crate::nym_contract_cache::cache::NymContractCache;
 use crate::support::nyxd::Client;
@@ -33,7 +32,6 @@ mod rewarding;
 mod transition_beginning;
 
 pub struct RewardedSetUpdater {
-    ephemera_reward_manager: Option<RewardManager>,
     nyxd_client: Client,
     nym_contract_cache: NymContractCache,
     storage: NymApiStorage,
@@ -47,13 +45,11 @@ impl RewardedSetUpdater {
     }
 
     pub(crate) fn new(
-        ephemera_reward_manager: Option<RewardManager>,
         nyxd_client: Client,
         nym_contract_cache: NymContractCache,
         storage: NymApiStorage,
     ) -> Self {
         RewardedSetUpdater {
-            ephemera_reward_manager,
             nyxd_client,
             nym_contract_cache,
             storage,
@@ -92,11 +88,6 @@ impl RewardedSetUpdater {
     /// 8. the whole process repeats once the new epoch finishes
     async fn perform_epoch_operations(&mut self, interval: Interval) -> Result<(), RewardingError> {
         let mut rewards = self.nodes_to_reward(interval).await;
-        if let Some(ephemera_reward_manager) = self.ephemera_reward_manager.as_mut() {
-            rewards = ephemera_reward_manager
-                .perform_epoch_operations(rewards)
-                .await?;
-        }
         rewards.sort_by_key(|a| a.mix_id);
 
         log::info!("The current epoch has finished.");
@@ -274,14 +265,12 @@ impl RewardedSetUpdater {
     }
 
     pub(crate) fn start(
-        ephemera_reward_manager: Option<RewardManager>,
         nyxd_client: Client,
         nym_contract_cache: &NymContractCache,
         storage: &NymApiStorage,
         shutdown: &TaskManager,
     ) {
         let mut rewarded_set_updater = RewardedSetUpdater::new(
-            ephemera_reward_manager,
             nyxd_client,
             nym_contract_cache.to_owned(),
             storage.to_owned(),

nym-api/src/main.rs

@@ -16,7 +16,6 @@ use crate::support::cli;
 use crate::support::config::Config;
 use crate::support::storage;
 use crate::support::storage::NymApiStorage;
-use ::ephemera::configuration::Configuration as EphemeraConfiguration;
 use ::nym_config::defaults::setup_env;
 use circulating_supply_api::cache::CirculatingSupplyCache;
 use clap::Parser;
@@ -32,7 +31,6 @@ use support::{http, nyxd};
 
 mod circulating_supply_api;
 mod coconut;
-mod ephemera;
 mod epoch_operations;
 pub(crate) mod network;
 mod network_monitor;
@@ -163,33 +161,6 @@ async fn start_nym_api_tasks(config: Config) -> anyhow::Result<ShutdownHandles>
     // and then only start the uptime updater (and the monitor itself, duh)
     // if the monitoring if it's enabled
     if config.network_monitor.enabled {
-        let ephemera_config =
-            match EphemeraConfiguration::try_load(config.get_ephemera_config_path()) {
-                Ok(c) => c,
-                Err(_) => {
-                    config
-                        .get_ephemera_args()
-                        .cmd
-                        .clone()
-                        .execute(Some(&config.get_id()));
-                    EphemeraConfiguration::try_load(config.get_ephemera_config_path())
-                        .expect("Config file should be created now")
-                }
-            };
-        let ephemera_reward_manager = if config.ephemera.enabled {
-            Some(
-                ephemera::application::NymApi::run(
-                    config.get_ephemera_args().clone(),
-                    ephemera_config,
-                    nyxd_client.clone(),
-                    &shutdown,
-                )
-                .await?,
-            )
-        } else {
-            None
-        };
-
         // if network monitor is enabled, the storage MUST BE available
         let storage = maybe_storage.unwrap();
 
@@ -207,13 +178,7 @@ async fn start_nym_api_tasks(config: Config) -> anyhow::Result<ShutdownHandles>
         // start 'rewarding' if its enabled
         if config.rewarding.enabled {
             epoch_operations::ensure_rewarding_permission(&nyxd_client).await?;
-            RewardedSetUpdater::start(
-                ephemera_reward_manager,
-                nyxd_client,
-                nym_contract_cache_state,
-                storage,
-                &shutdown,
-            );
+            RewardedSetUpdater::start(nyxd_client, nym_contract_cache_state, storage, &shutdown);
         }
     }
 

nym-api/src/node_describe_cache/mod.rs

@@ -6,7 +6,7 @@ use crate::support::caching::cache::{SharedCache, UninitialisedCache};
 use crate::support::caching::refresher::{CacheItemProvider, CacheRefresher};
 use crate::support::config;
 use crate::support::config::DEFAULT_NODE_DESCRIBE_BATCH_SIZE;
-use futures_util::{stream, StreamExt};
+use futures::{stream, StreamExt};
 use nym_api_requests::models::{
     IpPacketRouterDetails, NetworkRequesterDetails, NymNodeDescription,
 };

nym-api/src/support/config/mod.rs

@@ -106,8 +106,6 @@ pub struct Config {
     pub rewarding: Rewarding,
 
     pub coconut_signer: CoconutSigner,
-
-    pub ephemera: Ephemera,
 }
 
 impl NymConfigTemplate for Config {
@@ -127,7 +125,6 @@ impl Config {
             circulating_supply_cacher: Default::default(),
             rewarding: Default::default(),
             coconut_signer: CoconutSigner::new_default(id.as_ref()),
-            ephemera: Ephemera::new_default(id.as_ref()),
         }
     }
 
@@ -142,10 +139,6 @@ impl Config {
             bail!("can't enable coconut signer without providing a mnemonic")
         }
 
-        if !can_sign && self.ephemera.enabled {
-            bail!("can't enable ephemera without providing a mnemonic")
-        }
-
         Ok(())
     }
 
@@ -223,10 +216,6 @@ impl Config {
         }
     }
 
-    pub fn get_id(&self) -> String {
-        self.base.id.clone()
-    }
-
     pub fn get_nyxd_url(&self) -> Url {
         self.base.local_validator.clone()
     }
@@ -234,14 +223,6 @@ impl Config {
     pub fn get_mnemonic(&self) -> Option<&bip39::Mnemonic> {
         self.base.mnemonic.as_ref()
     }
-
-    pub fn get_ephemera_args(&self) -> &crate::ephemera::Args {
-        &self.ephemera.args
-    }
-
-    pub fn get_ephemera_config_path(&self) -> PathBuf {
-        self.ephemera.args.ephemera_config.clone()
-    }
 }
 
 // we only really care about the mnemonic being zeroized
@@ -558,25 +539,3 @@ impl Default for CoconutSignerDebug {
         }
     }
 }
-
-#[derive(Debug, Default, Deserialize, PartialEq, Eq, Serialize)]
-#[serde(default)]
-pub struct Ephemera {
-    pub enabled: bool,
-    args: crate::ephemera::Args,
-}
-
-impl Ephemera {
-    fn new_default(id: &str) -> Self {
-        Ephemera {
-            enabled: false,
-            args: crate::ephemera::Args {
-                ephemera_config: ephemera::configuration::Configuration::ephemera_config_file_home(
-                    Some(id),
-                )
-                .unwrap(),
-                ..Default::default()
-            },
-        }
-    }
-}

nym-api/src/support/config/template.rs

@@ -127,12 +127,4 @@ decryption_key_path = '{{ coconut_signer.storage_paths.decryption_key_path }}'
 # Path to the dkg dealer public key with proof
 public_key_with_proof_path = '{{ coconut_signer.storage_paths.public_key_with_proof_path }}'
 
-[ephemera]
-
-enabled = {{ ephemera.enabled }}
-
-[ephemera.args]
-
-ephemera_config = '{{ ephemera.args.ephemera_config }}'
-
 "#;

nym-api/src/support/nyxd/mod.rs

@@ -23,8 +23,7 @@ use nym_coconut_dkg_common::{
     verification_key::{ContractVKShare, VerificationKeyShare},
 };
 use nym_config::defaults::{ChainDetails, NymNetworkDetails};
-use nym_ephemera_common::msg::QueryMsg as EphemeraQueryMsg;
-use nym_ephemera_common::types::JsonPeerInfo;
+
 use nym_mixnet_contract_common::families::FamilyHead;
 use nym_mixnet_contract_common::mixnode::MixNodeDetails;
 use nym_mixnet_contract_common::reward_params::RewardingParams;
@@ -38,11 +37,10 @@ use nym_validator_client::nyxd::contract_traits::{NameServiceQueryClient, PagedD
 use nym_validator_client::nyxd::error::NyxdError;
 use nym_validator_client::nyxd::{
     contract_traits::{
-        CoconutBandwidthQueryClient, DkgQueryClient, DkgSigningClient, EphemeraQueryClient,
-        EphemeraSigningClient, GroupQueryClient, MixnetQueryClient, MixnetSigningClient,
-        MultisigQueryClient, MultisigSigningClient, NymContractsProvider, PagedEphemeraQueryClient,
-        PagedMixnetQueryClient, PagedMultisigQueryClient, PagedVestingQueryClient,
-        SpDirectoryQueryClient,
+        CoconutBandwidthQueryClient, DkgQueryClient, DkgSigningClient, GroupQueryClient,
+        MixnetQueryClient, MixnetSigningClient, MultisigQueryClient, MultisigSigningClient,
+        NymContractsProvider, PagedMixnetQueryClient, PagedMultisigQueryClient,
+        PagedVestingQueryClient, SpDirectoryQueryClient,
     },
     cosmwasm_client::types::ExecuteResult,
     CosmWasmClient, Fee,
@@ -569,23 +567,6 @@ impl crate::coconut::client::Client for Client {
     }
 }
 
-#[async_trait]
-impl crate::ephemera::client::Client for Client {
-    async fn get_ephemera_peers(&self) -> crate::ephemera::error::Result<Vec<JsonPeerInfo>> {
-        Ok(nyxd_query!(self, get_all_ephemera_peers().await?))
-    }
-
-    async fn register_ephemera_peer(
-        &self,
-        peer_info: JsonPeerInfo,
-    ) -> crate::ephemera::error::Result<ExecuteResult> {
-        Ok(nyxd_signing!(
-            self,
-            register_as_peer(peer_info, None).await?
-        ))
-    }
-}
-
 #[async_trait]
 impl DkgQueryClient for Client {
     async fn query_dkg_contract<T>(&self, query: DkgQueryMsg) -> std::result::Result<T, NyxdError>
@@ -596,19 +577,6 @@ impl DkgQueryClient for Client {
     }
 }
 
-#[async_trait]
-impl EphemeraQueryClient for Client {
-    async fn query_ephemera_contract<T>(
-        &self,
-        query: EphemeraQueryMsg,
-    ) -> std::result::Result<T, NyxdError>
-    where
-        for<'a> T: Deserialize<'a>,
-    {
-        nyxd_query!(self, query_ephemera_contract(query).await)
-    }
-}
-
 #[async_trait]
 impl SpDirectoryQueryClient for Client {
     async fn query_service_provider_contract<T>(

nym-connect/desktop/Cargo.lock

@@ -958,6 +958,12 @@ version = "0.9.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "28c122c3980598d243d63d9a704629a2d748d101f278052ff068be5a4423ab6f"
 
+[[package]]
+name = "const-str"
+version = "0.5.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "aca749d3d3f5b87a0d6100509879f9cf486ab510803a4a4e1001da1ff61c2bd6"
+
 [[package]]
 name = "constant_time_eq"
 version = "0.3.0"
@@ -3722,6 +3728,7 @@ dependencies = [
  "clap",
  "clap_complete",
  "clap_complete_fig",
+ "const-str",
  "log",
  "pretty_env_logger",
  "schemars",
@@ -3762,6 +3769,7 @@ dependencies = [
  "serde",
  "serde_json",
  "sha2 0.10.8",
+ "si-scale",
  "sqlx",
  "tap",
  "thiserror",
@@ -4138,6 +4146,7 @@ dependencies = [
  "cfg-if",
  "dotenvy",
  "hex-literal",
+ "log",
  "once_cell",
  "schemars",
  "serde",
@@ -6221,6 +6230,12 @@ dependencies = [
  "lazy_static",
 ]
 
+[[package]]
+name = "si-scale"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "44beb68bf488343b13ddbd74d1d5d5e6559a58b6dfaee74eb8d5ed4f7ed7666f"
+
 [[package]]
 name = "signal-hook"
 version = "0.3.17"

nym-node/Cargo.toml

@@ -37,12 +37,7 @@ mime = "0.3.17"
 hyper = { workspace = true }
 tower = { version = "0.4.13" }
 tower-http = { version = "0.4.4", features = ["fs"] }
-
-# `actix_extras`? what the hell?
-# hear me out first!
-# we can't use `axum_extras` because of freaking ephemera that depends on `actix_extras`.
-# however, it seems that pulling in `actix_extras` pulls in just enough shared features to improve `IntoParams` for our Query attributes
-utoipa = { workspace = true, features = ["actix_extras"] } # can't use `"axum_extras"` feature because ephemera uses `"actix_extras"` -.-'
+utoipa = { workspace = true, features = ["axum_extras"] }
 utoipa-swagger-ui = { workspace = true, features = ["axum"] }
 
 # if we ever wanted redoc/rapidoc bridges:

nym-outfox/Cargo.toml

@@ -18,7 +18,8 @@ curve25519-dalek = "3.2"
 chacha20poly1305 = "0.10.1"
 getrandom = { workspace = true, features = ["js"] }
 thiserror = { workspace = true }
-sphinx-packet = "0.1.0"
+#sphinx-packet = "0.1.0"
+sphinx-packet = { git = "https://github.com/nymtech/sphinx.git", branch = "simon/replay_tag"}
 rand = "0.7.3"
 log = "0.4"
 

nym-wallet/Cargo.lock

@@ -750,6 +750,12 @@ version = "0.9.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "28c122c3980598d243d63d9a704629a2d748d101f278052ff068be5a4423ab6f"
 
+[[package]]
+name = "const-str"
+version = "0.5.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "aca749d3d3f5b87a0d6100509879f9cf486ab510803a4a4e1001da1ff61c2bd6"
+
 [[package]]
 name = "convert_case"
 version = "0.4.0"
@@ -3109,6 +3115,7 @@ dependencies = [
  "clap",
  "clap_complete",
  "clap_complete_fig",
+ "const-str",
  "log",
  "pretty_env_logger",
  "schemars",
@@ -3317,6 +3324,7 @@ dependencies = [
  "cfg-if",
  "dotenvy",
  "hex-literal",
+ "log",
  "once_cell",
  "schemars",
  "serde",

sdk/lib/socks5-listener/Cargo.toml

@@ -23,7 +23,6 @@ nym-config-common = { path = "../../../common/config", package = "nym-config" }
 nym-credential-storage = { path = "../../../common/credential-storage" }
 nym-crypto = { path = "../../../common/crypto" }
 nym-socks5-client-core = { path = "../../../common/socks5-client-core", default-features = false }
-openssl = { version = "^0.10.55", features = ["vendored"] }
 serde = { workspace = true }
 tokio = { workspace = true, features = ["sync", "time"] }
 log = "0.4.17"