Fix Box ws_fd

Add log
Testing
2024-02-13 12:06:10 +02:00 · 2024-02-13 11:45:25 +02:00 · 2024-02-12 20:10:09 +02:00 · 2024-02-12 13:05:30 +01:00 · 2024-02-12 12:39:40 +01:00 · 2024-02-12 12:14:51 +01:00
332 changed files with 25028 additions and 15079 deletions
@@ -1,61 +0,0 @@
-name: build-upload-binaries
-
-on:
-  workflow_dispatch:
-    inputs:
-      add_tokio_unstable:
-        description: 'True to add RUSTFLAGS="--cfg tokio_unstable"'
-        required: true
-        default: false
-        type: boolean
-
-env:
-  NETWORK: mainnet
-
-jobs:
-  publish-nym:
-    strategy:
-      fail-fast: false
-      matrix:
-        platform: [ubuntu-20.04]
-
-    runs-on: ${{ matrix.platform }}
-    env:
-      CARGO_TERM_COLOR: always
-    steps:
-      - uses: actions/checkout@v3
-
-      - name: Install Dependencies (Linux)
-        run: sudo apt-get update && sudo apt-get -y install libwebkit2gtk-4.0-dev build-essential curl wget libssl-dev libgtk-3-dev libudev-dev squashfs-tools
-        continue-on-error: true
-
-      - name: Sets env vars for tokio if set in manual dispatch inputs
-        run: |
-          echo 'RUSTFLAGS="--cfg tokio_unstable"' >> $GITHUB_ENV
-        if: github.event_name == 'workflow_dispatch' && inputs.add_tokio_unstable == true
-
-      - name: Install Rust stable
-        uses: actions-rs/toolchain@v1
-        with:
-          toolchain: stable
-
-      - name: Build all binaries
-        uses: actions-rs/cargo@v1
-        with:
-          command: build
-          args: --workspace --release
-
-      - name: Upload Artifact
-        uses: actions/upload-artifact@v3
-        with:
-          name: nym-binaries-artifacts
-          path: |
-            target/release/nym-client
-            target/release/nym-gateway
-            target/release/nym-mixnode
-            target/release/nym-socks5-client
-            target/release/nym-api
-            target/release/nym-network-requester
-            target/release/nym-network-statistics
-            target/release/nym-cli
-          retention-days: 30
@@ -2,20 +2,34 @@ name: ci-build-upload-binaries

 on:
  workflow_dispatch:
+    inputs:
+      add_tokio_unstable:
+        description: 'True to add RUSTFLAGS="--cfg tokio_unstable"'
+        required: true
+        default: false
+        type: boolean
+      enable_wireguard:
+        description: 'Add --features wireguard'
+        required: true
+        default: false
+        type: boolean
+  schedule:
+    - cron: '14 0 * * *'
  pull_request:
    paths:
-      - 'clients/**'
-      - 'common/**'
-      - 'explorer-api/**'
-      - 'gateway/**'
-      - 'integrations/**'
-      - 'mixnode/**'
-      - 'sdk/rust/nym-sdk/**'
-      - 'service-providers/**'
-      - 'nym-api/**'
-      - 'nym-outfox/**'
-      - 'tools/nym-cli/**'
-      - 'tools/ts-rs-cli/**'
+      - "clients/**"
+      - "common/**"
+      - "explorer-api/**"
+      - "gateway/**"
+      - "integrations/**"
+      - "mixnode/**"
+      - "nym-api/**"
+      - "nym-node/**"
+      - "nym-outfox/**"
+      - "nym-validator-rewarder/**"
+      - "sdk/rust/nym-sdk/**"
+      - "service-providers/**"
+      - "tools/**"

 jobs:
  publish-nym:
@@ -42,6 +56,18 @@ jobs:
      - name: Install Dependencies (Linux)
        run: sudo apt update && sudo apt install libudev-dev

+      - name: Sets env vars for tokio if set in manual dispatch inputs
+        run: |
+          echo 'RUSTFLAGS="--cfg tokio_unstable"' >> $GITHUB_ENV
+        if: github.event_name == 'workflow_dispatch' && inputs.add_tokio_unstable == true
+
+      - name: Set CARGO_FEATURES
+        run: |
+          echo 'CARGO_FEATURES=--features wireguard' >> $GITHUB_ENV
+        if: >
+          github.event_name == 'schedule' ||
+          (github.event_name == 'workflow_dispatch' && inputs.enable_wireguard == true)
+
      - name: Install Rust stable
        uses: actions-rs/toolchain@v1
        with:
@@ -51,9 +77,40 @@ jobs:
        uses: actions-rs/cargo@v1
        with:
          command: build
-          args: --workspace --release
+          args: --workspace --release ${{ env.CARGO_FEATURES }}
+
+      - name: Install cargo-deb
+        uses: actions-rs/cargo@v1
+        with:
+          command: install
+          args: cargo-deb
+
+      - name: Build deb packages
+        shell: bash
+        run: make deb
+
+      # If this was a manual workflow_dispatch, publish binaries.
+
+      - name: Upload Artifact
+        if: github.event_name == 'workflow_dispatch'
+        uses: actions/upload-artifact@v3
+        with:
+          name: nym-binaries-artifacts
+          path: |
+            target/release/nym-client
+            target/release/nym-gateway
+            target/release/nym-mixnode
+            target/release/nym-socks5-client
+            target/release/nym-api
+            target/release/nym-network-requester
+            target/release/nym-network-statistics
+            target/release/nym-cli
+          retention-days: 30
+
+      # If this was a pull_request or nightly, upload to build server

      - name: Prepare build output
+        # if: github.event_name == 'schedule' || github.event_name == 'pull_request'
        shell: bash
        env:
          OUTPUT_DIR: ci-builds/${{ github.ref_name }}
@@ -67,8 +124,10 @@ jobs:
          cp target/release/nym-network-statistics $OUTPUT_DIR
          cp target/release/nym-cli $OUTPUT_DIR
          cp target/release/explorer-api $OUTPUT_DIR
+          cp target/debian/*.deb $OUTPUT_DIR

      - name: Deploy branch to CI www
+        # if: github.event_name == 'schedule' || github.event_name == 'pull_request'
        continue-on-error: true
        uses: easingthemes/ssh-deploy@main
        env:
@@ -1,5 +1,8 @@
 name: ci-cargo-deny
-on: [workflow_dispatch]
+on:
+  workflow_dispatch:
+  pull_request:
+
 jobs:
  cargo-deny:
    runs-on: ubuntu-22.04
@@ -7,10 +10,7 @@ jobs:
      matrix:
        checks:
          # - advisories
-          - licenses
-          - bans sources
-
-    continue-on-error: ${{ matrix.checks == 'licenses' }}
+          - licenses bans sources

    steps:
    - uses: actions/checkout@v3
@@ -18,7 +18,7 @@ jobs:
      - uses: actions/checkout@v2

      - name: install yarn in root
-        run: cd ../.. yarn install
+        run: cd ../.. && yarn install

      - name: Install npm
        run: npm install
@@ -1,4 +1,4 @@
-name: Publish Nym binaries
+name: publish-nym-binaries

 on:
  workflow_dispatch:
@@ -1,4 +1,4 @@
-name: Publish Nym Connect - desktop (MacOS)
+name: publish-nym-connect-macos
 on:
  workflow_dispatch:
  release:
@@ -1,4 +1,4 @@
-name: Publish Nym Connect - desktop (Ubuntu)
+name: publish-nym-connect-ubuntu
 on:
  workflow_dispatch:
  release:
@@ -1,4 +1,4 @@
-name: Publish Nym Connect - desktop (Windows 10)
+name: publish-nym-connect-win10
 on:
  workflow_dispatch:
  release:
@@ -1,4 +1,4 @@
-name: Build release of Nym smart contracts
+name: publish-nym-contracts
 on:
  workflow_dispatch:
  release:
@@ -1,4 +1,4 @@
-name: Publish Nym Wallet (MacOS)
+name: publish-nym-wallet-macos
 on:
  workflow_dispatch:
  release:
@@ -1,4 +1,4 @@
-name: Publish Nym Wallet (Ubuntu)
+name: publish-nym-wallet-ubuntu
 on:
  workflow_dispatch:
  release:
@@ -1,4 +1,4 @@
-name: Publish Nym Wallet (Windows 10)
+name: publish-nym-wallet-win10
 on:
  workflow_dispatch:
  release:
@@ -1,4 +1,4 @@
-name: Publish Typescript SDK
+name: publish-sdk-npm
 on:
  workflow_dispatch:

@@ -1,4 +1,4 @@
-name: Releases - calculate file hashes
+name: release-calculate-hash

 on:
  workflow_call:
@@ -187,6 +187,16 @@ dependencies = [
 "syn 2.0.38",
 ]

+[[package]]
+name = "addr"
+version = "0.15.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a93b8a41dbe230ad5087cc721f8d41611de654542180586b315d9f4cf6b72bef"
+dependencies = [
+ "psl",
+ "psl-types",
+]
+
 [[package]]
 name = "addr2line"
 version = "0.21.0"
@@ -1461,7 +1471,7 @@ version = "6.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7e959d788268e3bf9d35ace83e81b124190378e4c91c9067524675e33394b8ba"
 dependencies = [
- "crossterm",
+ "crossterm 0.26.1",
 "strum 0.24.1",
 "strum_macros 0.24.3",
 "unicode-width",
@@ -1559,6 +1569,12 @@ version = "0.9.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "28c122c3980598d243d63d9a704629a2d748d101f278052ff068be5a4423ab6f"

+[[package]]
+name = "const-str"
+version = "0.5.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "aca749d3d3f5b87a0d6100509879f9cf486ab510803a4a4e1001da1ff61c2bd6"
+
 [[package]]
 name = "const_format"
 version = "0.2.32"
@@ -1604,9 +1620,9 @@ dependencies = [

 [[package]]
 name = "cookie"
-version = "0.17.0"
+version = "0.18.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7efb37c3e1ccb1ff97164ad95ac1606e8ccd35b3fa0a7d99a304c7f4a428cc24"
+checksum = "3cd91cf61412820176e137621345ee43b3f4423e589e7ae4e50d601d93e35ef8"
 dependencies = [
 "percent-encoding",
 "time",
@@ -1916,6 +1932,22 @@ dependencies = [
 "cfg-if",
 ]

+[[package]]
+name = "crossterm"
+version = "0.25.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e64e6c0fbe2c17357405f7c758c1ef960fce08bdfb2c03d88d2a18d7e09c4b67"
+dependencies = [
+ "bitflags 1.3.2",
+ "crossterm_winapi",
+ "libc",
+ "mio",
+ "parking_lot 0.12.1",
+ "signal-hook",
+ "signal-hook-mio",
+ "winapi",
+]
+
 [[package]]
 name = "crossterm"
 version = "0.26.1"
@@ -2002,6 +2034,27 @@ dependencies = [
 "subtle 2.4.1",
 ]

+[[package]]
+name = "csv"
+version = "1.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ac574ff4d437a7b5ad237ef331c17ccca63c46479e5b5453eb8e10bb99a759fe"
+dependencies = [
+ "csv-core",
+ "itoa",
+ "ryu",
+ "serde",
+]
+
+[[package]]
+name = "csv-core"
+version = "0.1.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5efa2b3d7902f4b634a20cae3c9c4e6209dc4779feb6863329607560143efa70"
+dependencies = [
+ "memchr",
+]
+
 [[package]]
 name = "ctor"
 version = "0.1.26"
@@ -3981,6 +4034,16 @@ dependencies = [
 "unicode-normalization",
 ]

+[[package]]
+name = "idna"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e14ddfc70884202db2244c223200c204c2bda1bc6e0998d11b5e024d657209e6"
+dependencies = [
+ "unicode-bidi",
+ "unicode-normalization",
+]
+
 [[package]]
 name = "idna"
 version = "0.4.0"
@@ -4097,6 +4160,22 @@ dependencies = [
 "generic-array 0.14.7",
 ]

+[[package]]
+name = "inquire"
+version = "0.6.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c33e7c1ddeb15c9abcbfef6029d8e29f69b52b6d6c891031b88ed91b5065803b"
+dependencies = [
+ "bitflags 1.3.2",
+ "crossterm 0.25.0",
+ "dyn-clone",
+ "lazy_static",
+ "newline-converter",
+ "thiserror",
+ "unicode-segmentation",
+ "unicode-width",
+]
+
 [[package]]
 name = "instant"
 version = "0.1.12"
@@ -5770,6 +5849,15 @@ dependencies = [
 "tokio",
 ]

+[[package]]
+name = "newline-converter"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1f71d09d5c87634207f894c6b31b6a2b2c64ea3bdcf71bd5599fdbbe1600c00f"
+dependencies = [
+ "unicode-segmentation",
+]
+
 [[package]]
 name = "nix"
 version = "0.24.3"
@@ -5983,6 +6071,8 @@ dependencies = [
 "pin-project",
 "rand 0.7.3",
 "rand 0.8.5",
+ "rand_chacha 0.2.2",
+ "rand_chacha 0.3.1",
 "reqwest",
 "rocket",
 "rocket_cors",
@@ -5991,6 +6081,7 @@ dependencies = [
 "serde",
 "serde_derive",
 "serde_json",
+ "sha2 0.9.9",
 "sqlx",
 "tap",
 "tempfile",
@@ -6047,6 +6138,7 @@ dependencies = [
 "clap 4.4.7",
 "clap_complete",
 "clap_complete_fig",
+ "const-str",
 "log",
 "opentelemetry",
 "opentelemetry-jaeger",
@@ -6089,6 +6181,7 @@ dependencies = [
 "clap_complete",
 "clap_complete_fig",
 "dotenvy",
+ "inquire",
 "log",
 "nym-bin-common",
 "nym-cli-commands",
@@ -6114,9 +6207,11 @@ dependencies = [
 "comfy-table",
 "cosmrs 0.15.0 (git+https://github.com/jstuczyn/cosmos-rust?branch=nym-temp/all-validator-features)",
 "cosmwasm-std",
+ "csv",
 "cw-utils",
 "handlebars",
 "humantime-serde",
+ "inquire",
 "k256",
 "log",
 "nym-bandwidth-controller",
@@ -6219,6 +6314,7 @@ dependencies = [
 "serde",
 "serde_json",
 "sha2 0.10.8",
+ "si-scale",
 "sqlx",
 "tap",
 "tempfile",
@@ -6309,6 +6405,8 @@ dependencies = [
 "cosmwasm-schema",
 "cosmwasm-std",
 "cw-utils",
+ "cw2",
+ "cw4",
 "nym-contracts-common",
 "nym-multisig-contract-common",
 ]
@@ -6634,10 +6732,13 @@ version = "0.1.0"
 dependencies = [
 "bincode",
 "bytes",
+ "nym-bin-common",
 "nym-sphinx",
 "rand 0.8.5",
 "serde",
 "thiserror",
+ "tokio",
+ "tokio-util",
 ]

 [[package]]
@@ -6645,21 +6746,27 @@ name = "nym-ip-packet-router"
 version = "0.1.0"
 dependencies = [
 "bincode",
+ "bs58 0.4.0",
 "bytes",
+ "clap 4.4.7",
 "etherparse",
 "futures",
+ "lazy_static",
 "log",
 "nym-bin-common",
 "nym-client-core",
 "nym-config",
+ "nym-crypto",
 "nym-exit-policy",
 "nym-ip-packet-requests",
+ "nym-network-defaults",
 "nym-network-requester",
 "nym-sdk",
 "nym-service-providers-common",
 "nym-sphinx",
 "nym-task",
 "nym-tun",
+ "nym-types",
 "nym-wireguard",
 "nym-wireguard-types",
 "rand 0.8.5",
@@ -6670,6 +6777,7 @@ dependencies = [
 "thiserror",
 "tokio",
 "tokio-tun",
+ "tokio-util",
 "url",
 ]

@@ -6818,6 +6926,7 @@ dependencies = [
 "cfg-if",
 "dotenvy",
 "hex-literal",
+ "log",
 "once_cell",
 "schemars",
 "serde",
@@ -6829,6 +6938,7 @@ dependencies = [
 name = "nym-network-requester"
 version = "1.1.32"
 dependencies = [
+ "addr",
 "anyhow",
 "async-file-watcher",
 "async-trait",
@@ -7725,9 +7835,9 @@ dependencies = [

 [[package]]
 name = "okapi"
-version = "0.7.0-rc.1"
+version = "0.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ce66b6366e049880a35c378123fddb630b1a1a3c37fa1ca70caaf4a09f6e2893"
+checksum = "9a64853d7ab065474e87696f7601cee817d200e86c42e04004e005cb3e20c3c5"
 dependencies = [
 "log",
 "schemars",
@@ -8056,7 +8166,7 @@ checksum = "61a386cd715229d399604b50d1361683fe687066f42d56f54be995bc6868f71c"
 dependencies = [
 "inlinable_string",
 "pear_codegen",
- "yansi 1.0.0-rc.1",
+ "yansi",
 ]

 [[package]]
@@ -8433,7 +8543,7 @@ dependencies = [
 "quote",
 "syn 2.0.38",
 "version_check",
- "yansi 1.0.0-rc.1",
+ "yansi",
 ]

 [[package]]
@@ -8558,14 +8668,28 @@ dependencies = [
 ]

 [[package]]
-name = "publicsuffix"
-version = "1.5.6"
+name = "psl"
+version = "2.1.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "95b4ce31ff0a27d93c8de1849cf58162283752f065a90d508f1105fa6c9a213f"
+checksum = "383703acfc34f7a00724846c14dc5ea4407c59e5aedcbbb18a1c0c1a23fe5013"
 dependencies = [
- "idna 0.2.3",
- "native-tls",
- "url",
+ "psl-types",
+]
+
+[[package]]
+name = "psl-types"
+version = "2.0.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "33cb294fe86a74cbcf50d4445b37da762029549ebeea341421c7c70370f86cac"
+
+[[package]]
+name = "publicsuffix"
+version = "2.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "96a8c1bda5ae1af7f99a2962e49df150414a43d62404644d98dd5c3a93d07457"
+dependencies = [
+ "idna 0.3.0",
+ "psl-types",
 ]

 [[package]]
@@ -9168,9 +9292,9 @@ dependencies = [

 [[package]]
 name = "rocket"
-version = "0.5.0-rc.3"
+version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "58734f7401ae5cfd129685b48f61182331745b357b96f2367f01aebaf1cc9cc9"
+checksum = "9e7bb57ccb26670d73b6a47396c83139447b9e7878cab627fdfe9ea8da489150"
 dependencies = [
 "async-stream",
 "async-trait",
@@ -9180,8 +9304,7 @@ dependencies = [
 "either",
 "figment",
 "futures",
- "indexmap 1.9.3",
- "is-terminal",
+ "indexmap 2.0.2",
 "log",
 "memchr",
 "multer",
@@ -9202,30 +9325,33 @@ dependencies = [
 "tokio-util",
 "ubyte",
 "version_check",
- "yansi 0.5.1",
+ "yansi",
 ]

 [[package]]
 name = "rocket_codegen"
-version = "0.5.0-rc.3"
+version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7093353f14228c744982e409259fb54878ba9563d08214f2d880d59ff2fc508b"
+checksum = "a2238066abf75f21be6cd7dc1a09d5414a671f4246e384e49fe3f8a4936bd04c"
 dependencies = [
 "devise",
 "glob",
- "indexmap 1.9.3",
+ "indexmap 2.0.2",
 "proc-macro2",
 "quote",
 "rocket_http",
 "syn 2.0.38",
 "unicode-xid",
+ "version_check",
 ]

 [[package]]
 name = "rocket_cors"
-version = "0.5.2"
-source = "git+https://github.com/lawliet89/rocket_cors?rev=dfd3662c49e2f6fc37df35091cb94d82f7fb5915#dfd3662c49e2f6fc37df35091cb94d82f7fb5915"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cfac3a1df83f8d4fc96aa41dba3b86c786417b7fc0f52ec76295df2ba781aa69"
 dependencies = [
+ "http",
 "log",
 "regex",
 "rocket",
@@ -9238,16 +9364,16 @@ dependencies = [

 [[package]]
 name = "rocket_http"
-version = "0.5.0-rc.3"
+version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "936012c99162a03a67f37f9836d5f938f662e26f2717809761a9ac46432090f4"
+checksum = "37a1663694d059fe5f943ea5481363e48050acedd241d46deb2e27f71110389e"
 dependencies = [
- "cookie 0.17.0",
+ "cookie 0.18.0",
 "either",
 "futures",
 "http",
 "hyper",
- "indexmap 1.9.3",
+ "indexmap 2.0.2",
 "log",
 "memchr",
 "pear",
@@ -9265,11 +9391,10 @@ dependencies = [

 [[package]]
 name = "rocket_okapi"
-version = "0.8.0-rc.3"
+version = "0.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "742098674565c8f0c35c77444f90344aafedebb71cfee9cdbf0185acc6b9cdb7"
+checksum = "e059407ecef9ee2f071fc971e10444fcf942149deb028879d6d8ca61a7ce9edc"
 dependencies = [
- "either",
 "log",
 "okapi",
 "rocket",
@@ -9281,9 +9406,9 @@ dependencies = [

 [[package]]
 name = "rocket_okapi_codegen"
-version = "0.8.0-rc.3"
+version = "0.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8c43f8edc57d88750a220b0ec1870a36c1106204ec99cc35131b49de3b954a4a"
+checksum = "cfb96114e69e5d7f80bfa0948cbc0120016e9b460954abe9eed37e9a2ad3f999"
 dependencies = [
 "darling 0.13.4",
 "proc-macro2",
@@ -9599,9 +9724,9 @@ dependencies = [

 [[package]]
 name = "schemars"
-version = "0.8.15"
+version = "0.8.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1f7b0ce13155372a76ee2e1c5ffba1fe61ede73fbea5630d61eee6fac4929c0c"
+checksum = "45a28f4c49489add4ce10783f7911893516f15afe45d015608d41faca6bc4d29"
 dependencies = [
 "dyn-clone",
 "indexmap 1.9.3",
@@ -9612,9 +9737,9 @@ dependencies = [

 [[package]]
 name = "schemars_derive"
-version = "0.8.15"
+version = "0.8.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e85e2a16b12bdb763244c69ab79363d71db2b4b918a2def53f80b02e0574b13c"
+checksum = "c767fd6fa65d9ccf9cf026122c1b555f2ef9a4f0cea69da4d7dbc3e258d30967"
 dependencies = [
 "proc-macro2",
 "quote",
@@ -10012,6 +10137,12 @@ dependencies = [
 "dirs 4.0.0",
 ]

+[[package]]
+name = "si-scale"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "44beb68bf488343b13ddbd74d1d5d5e6559a58b6dfaee74eb8d5ed4f7ed7666f"
+
 [[package]]
 name = "signal-hook"
 version = "0.3.17"
@@ -10371,9 +10502,9 @@ dependencies = [

 [[package]]
 name = "state"
-version = "0.5.3"
+version = "0.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dbe866e1e51e8260c9eed836a042a5e7f6726bb2b411dffeaa712e19c388f23b"
+checksum = "2b8c4a4445d81357df8b1a650d0d0d6fbbbfe99d064aa5e02f3e4022061476d8"
 dependencies = [
 "loom",
 ]
@@ -12625,17 +12756,14 @@ dependencies = [
 "static_assertions",
 ]

-[[package]]
-name = "yansi"
-version = "0.5.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "09041cd90cf85f7f8b2df60c646f853b7f535ce68f85244eb6731cf89fa498ec"
-
 [[package]]
 name = "yansi"
 version = "1.0.0-rc.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1367295b8f788d371ce2dbc842c7b709c73ee1364d30351dd300ec2203b12377"
+dependencies = [
+ "is-terminal",
+]

 [[package]]
 name = "yasna"
@@ -128,7 +128,7 @@ default-members = [
    "nym-validator-rewarder",
 ]

-exclude = ["explorer", "contracts", "nym-wallet", "nym-connect/mobile/src-tauri", "nym-connect/desktop", "nym-vpn/ui/src-tauri", "cpu-cycles"]
+exclude = ["explorer", "contracts", "nym-wallet", "nym-connect/mobile/src-tauri", "nym-connect/desktop", "nym-vpn/ui/src-tauri", "cpu-cycles", "sdk/ffi/cpp"]

 [workspace.package]
 authors = ["Nym Technologies SA"]
@@ -12,6 +12,7 @@ help:
 	@echo "  clippy: run clippy for all workspaces"
 	@echo "  test: run clippy, unit tests, and formatting."
 	@echo "  test-all: like test, but also includes the expensive tests"
+	@echo "  deb: build debian packages

 # -----------------------------------------------------------------------------
 # Meta targets
@@ -157,6 +158,12 @@ build-explorer-api:
 build-nym-cli:
 	cargo build -p nym-cli --release

+build-nym-gateway:
+	cargo build -p nym-gateway --release
+
+build-nym-mixnode:
+	cargo build -p nym-mixnode --release
+
 # -----------------------------------------------------------------------------
 # Misc
 # -----------------------------------------------------------------------------
@@ -169,6 +176,13 @@ run-api-tests:
 	cd nym-api/tests/functional_test && yarn test:qa

 # Build debian package, and update PPA
-# Requires base64 encode GPG key to be set up in environment PPA_SIGNING_KEY
-deb:
-	scripts/ppa.sh
+deb-mixnode: build-nym-mixnode
+	cargo deb -p nym-mixnode 
+
+deb-gateway: build-nym-gateway
+	cargo deb -p nym-gateway
+
+deb-cli: build-nym-cli
+	cargo deb -p nym-cli
+
+deb: deb-mixnode deb-gateway deb-cli
@@ -51,7 +51,7 @@ impl InitialisableClient for NativeClientInit {
    }
 }

-#[derive(Args, Clone)]
+#[derive(Args, Clone, Debug)]
 pub(crate) struct Init {
    #[command(flatten)]
    common_args: CommonClientInitArgs,
@@ -51,7 +51,7 @@ impl InitialisableClient for Socks5ClientInit {
    }
 }

-#[derive(Args, Clone)]
+#[derive(Args, Clone, Debug)]
 pub(crate) struct Init {
    #[command(flatten)]
    common_args: CommonClientInitArgs,
@@ -9,6 +9,7 @@ repository = { workspace = true }

 [dependencies]
 atty = "0.2"
+const-str = "0.5.6"
 clap = { workspace = true, features = ["derive"] }
 clap_complete = "4.0"
 clap_complete_fig = "4.0"
@@ -42,12 +42,20 @@ pub struct BinaryBuildInformation {

    // VERGEN_CARGO_DEBUG
    /// Provides the cargo debug mode that was used for the build.
-    pub cargo_debug: &'static str,
+    // NOTE: keep the old name cargo_profile instead of cargo_debug for backwards compatibility
+    pub cargo_profile: &'static str,
 }

 impl BinaryBuildInformation {
    // explicitly require the build_version to be passed as it's binary specific
    pub const fn new(binary_name: &'static str, build_version: &'static str) -> Self {
+        let cargo_debug = env!("VERGEN_CARGO_DEBUG");
+        let cargo_profile = if const_str::equal!(cargo_debug, "true") {
+            "debug"
+        } else {
+            "release"
+        };
+
        BinaryBuildInformation {
            binary_name,
            build_timestamp: env!("VERGEN_BUILD_TIMESTAMP"),
@@ -57,7 +65,7 @@ impl BinaryBuildInformation {
            commit_branch: env!("VERGEN_GIT_BRANCH"),
            rustc_version: env!("VERGEN_RUSTC_SEMVER"),
            rustc_channel: env!("VERGEN_RUSTC_CHANNEL"),
-            cargo_debug: env!("VERGEN_CARGO_DEBUG"),
+            cargo_profile,
        }
    }

@@ -71,7 +79,7 @@ impl BinaryBuildInformation {
            commit_branch: self.commit_branch.to_owned(),
            rustc_version: self.rustc_version.to_owned(),
            rustc_channel: self.rustc_channel.to_owned(),
-            cargo_debug: self.cargo_debug.to_owned(),
+            cargo_profile: self.cargo_profile.to_owned(),
        }
    }

@@ -117,7 +125,8 @@ pub struct BinaryBuildInformationOwned {

    // VERGEN_CARGO_DEBUG
    /// Provides the cargo debug mode that was used for the build.
-    pub cargo_debug: String,
+    // NOTE: keep the old name cargo_profile instead of cargo_debug for backwards compatibility
+    pub cargo_profile: String,
 }

 impl Display for BinaryBuildInformationOwned {
@@ -151,8 +160,8 @@ impl Display for BinaryBuildInformationOwned {
            self.rustc_version,
            "rustc Channel:",
            self.rustc_channel,
-            "cargo Debug:",
-            self.cargo_debug,
+            "cargo Profile:",
+            self.cargo_profile,
        )
    }
 }
@@ -46,6 +46,7 @@ nym-validator-client = { path = "../client-libs/validator-client", default-featu
 nym-task = { path = "../task" }
 nym-credential-storage = { path = "../credential-storage" }
 nym-network-defaults = { path = "../network-defaults" }
+si-scale = "0.2.2"

 [target."cfg(not(target_arch = \"wasm32\"))".dependencies.tokio-stream]
 version = "0.1.11"
@@ -109,6 +109,8 @@ pub async fn initialise_client<C>(
 ) -> Result<InitResultsWithConfig<C::Config>, C::Error>
 where
    C: InitialisableClient,
+    <C as InitialisableClient>::Config: std::fmt::Debug,
+    <C as InitialisableClient>::InitArgs: std::fmt::Debug,
 {
    info!("initialising {} client", C::NAME);

@@ -140,17 +142,32 @@ where

    // Attempt to use a user-provided gateway, if possible
    let user_chosen_gateway_id = common_args.gateway;
+    log::debug!("User chosen gateway id: {user_chosen_gateway_id:?}");
+
    let selection_spec = GatewaySelectionSpecification::new(
        user_chosen_gateway_id.map(|id| id.to_base58_string()),
        Some(common_args.latency_based_selection),
        false,
    );
+    log::debug!("Gateway selection specification: {selection_spec:?}");

    // Load and potentially override config
+    log::debug!("Init arguments: {init_args:#?}");
    let config = C::construct_config(&init_args);
+    log::debug!("Constructed config: {config:#?}");
    let paths = config.common_paths();
    let core = config.core_config();

+    log::info!(
+        "Using nym-api: {}",
+        core.client
+            .nym_api_urls
+            .iter()
+            .map(|url| url.as_str())
+            .collect::<Vec<&str>>()
+            .join(",")
+    );
+
    // Setup gateway by either registering a new one, or creating a new config from the selected
    // one but with keys kept, or reusing the gateway configuration.
    let key_store = OnDiskKeys::new(paths.keys.clone());
@@ -1,6 +1,7 @@
 // Copyright 2022-2023 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0

+use super::packet_statistics_control::PacketStatisticsReporter;
 use super::received_buffer::ReceivedBufferMessage;
 use super::topology_control::geo_aware_provider::GeoAwareTopologyProvider;
 use crate::client::base_client::storage::gateway_details::GatewayDetailsStore;
@@ -10,6 +11,7 @@ use crate::client::inbound_messages::{InputMessage, InputMessageReceiver, InputM
 use crate::client::key_manager::persistence::KeyStore;
 use crate::client::mix_traffic::transceiver::{GatewayReceiver, GatewayTransceiver, RemoteGateway};
 use crate::client::mix_traffic::{BatchMixMessageSender, MixTrafficController};
+use crate::client::packet_statistics_control::PacketStatisticsControl;
 use crate::client::real_messages_control;
 use crate::client::real_messages_control::RealMessagesController;
 use crate::client::received_buffer::{
@@ -50,6 +52,7 @@ use nym_topology::provider_trait::TopologyProvider;
 use nym_topology::HardcodedTopologyProvider;
 use nym_validator_client::nyxd::contract_traits::DkgQueryClient;
 use std::fmt::Debug;
+use std::os::fd::RawFd;
 use std::path::Path;
 use std::sync::Arc;
 use url::Url;
@@ -254,6 +257,7 @@ where
        self_address: Recipient,
        topology_accessor: TopologyAccessor,
        mix_tx: BatchMixMessageSender,
+        stats_tx: PacketStatisticsReporter,
        shutdown: TaskClient,
    ) {
        info!("Starting loop cover traffic stream...");
@@ -266,6 +270,7 @@ where
            topology_accessor,
            debug_config.traffic,
            debug_config.cover_traffic,
+            stats_tx,
        );

        stream.start_with_shutdown(shutdown);
@@ -285,6 +290,7 @@ where
        client_connection_rx: ConnectionCommandReceiver,
        shutdown: TaskClient,
        packet_type: PacketType,
+        stats_tx: PacketStatisticsReporter,
    ) {
        info!("Starting real traffic stream...");

@@ -299,6 +305,7 @@ where
            reply_controller_receiver,
            lane_queue_lengths,
            client_connection_rx,
+            stats_tx,
        )
        .start_with_shutdown(shutdown, packet_type);
    }
@@ -312,6 +319,7 @@ where
        reply_key_storage: SentReplyKeys,
        reply_controller_sender: ReplyControllerSender,
        shutdown: TaskClient,
+        packet_statistics_control: PacketStatisticsReporter,
    ) {
        info!("Starting received messages buffer controller...");
        let controller: ReceivedMessagesBufferController<SphinxMessageReceiver> =
@@ -321,6 +329,7 @@ where
                mixnet_receiver,
                reply_key_storage,
                reply_controller_sender,
+                packet_statistics_control,
            );
        controller.start_with_shutdown(shutdown)
    }
@@ -506,6 +515,13 @@ where
        Ok(())
    }

+    fn start_packet_statistics_control(shutdown: TaskClient) -> PacketStatisticsReporter {
+        info!("Starting packet statistics control...");
+        let (packet_statistics_control, packet_stats_reporter) = PacketStatisticsControl::new();
+        packet_statistics_control.start_with_shutdown(shutdown);
+        packet_stats_reporter
+    }
+
    fn start_mix_traffic_controller(
        gateway_transceiver: Box<dyn GatewayTransceiver + Send>,
        shutdown: TaskClient,
@@ -633,6 +649,9 @@ where
        )
        .await?;

+        let packet_stats_reporter =
+            Self::start_packet_statistics_control(shutdown.fork("packet_statistics_control"));
+
        let gateway_packet_router = PacketRouter::new(
            ack_sender,
            mixnet_messages_sender,
@@ -662,8 +681,10 @@ where
            reply_storage.key_storage(),
            reply_controller_sender.clone(),
            shutdown.fork("received_messages_buffer"),
+            packet_stats_reporter.clone(),
        );

+        let gateway_fd = gateway_transceiver.ws_fd();
        // The message_sender is the transmitter for any component generating sphinx packets
        // that are to be sent to the mixnet. They are used by cover traffic stream and real
        // traffic stream.
@@ -700,6 +721,7 @@ where
            client_connection_rx,
            shutdown.fork("real_traffic_controller"),
            self.config.debug.traffic.packet_type,
+            packet_stats_reporter.clone(),
        );

        if !self
@@ -714,6 +736,7 @@ where
                self_address,
                shared_topology_accessor.clone(),
                message_sender,
+                packet_stats_reporter,
                shutdown.fork("cover_traffic_stream"),
            );
        }
@@ -734,6 +757,7 @@ where
                    received_buffer_request_sender,
                },
            },
+            gateway_fd,
            client_state: ClientState {
                shared_lane_queue_lengths,
                reply_controller_sender,
@@ -749,6 +773,7 @@ pub struct BaseClient {
    pub client_input: ClientInputStatus,
    pub client_output: ClientOutputStatus,
    pub client_state: ClientState,
+    pub gateway_fd: Option<RawFd>,

    pub task_handle: TaskHandle,
 }
@@ -2,6 +2,7 @@
 // SPDX-License-Identifier: Apache-2.0

 use crate::client::mix_traffic::BatchMixMessageSender;
+use crate::client::packet_statistics_control::{PacketStatisticsEvent, PacketStatisticsReporter};
 use crate::client::topology_control::TopologyAccessor;
 use crate::{config, spawn_future};
 use futures::task::{Context, Poll};
@@ -61,6 +62,8 @@ where
    secondary_packet_size: Option<PacketSize>,

    packet_type: PacketType,
+
+    stats_tx: PacketStatisticsReporter,
 }

 impl<R> Stream for LoopCoverTrafficStream<R>
@@ -97,7 +100,8 @@ where
 // obviously when we finally make shared rng that is on 'higher' level, this should become
 // generic `R`
 impl LoopCoverTrafficStream<OsRng> {
-    pub fn new(
+    #[allow(clippy::too_many_arguments)]
+    pub(crate) fn new(
        ack_key: Arc<AckKey>,
        average_ack_delay: Duration,
        mix_tx: BatchMixMessageSender,
@@ -105,6 +109,7 @@ impl LoopCoverTrafficStream<OsRng> {
        topology_access: TopologyAccessor,
        traffic_config: config::Traffic,
        cover_config: config::CoverTraffic,
+        stats_tx: PacketStatisticsReporter,
    ) -> Self {
        let rng = OsRng;

@@ -122,6 +127,7 @@ impl LoopCoverTrafficStream<OsRng> {
            primary_packet_size: traffic_config.primary_packet_size,
            secondary_packet_size: traffic_config.secondary_packet_size,
            packet_type: traffic_config.packet_type,
+            stats_tx,
        }
    }

@@ -191,6 +197,10 @@ impl LoopCoverTrafficStream<OsRng> {
                    log::warn!("Failed to send cover message - channel closed");
                }
            }
+        } else {
+            self.stats_tx.report(PacketStatisticsEvent::CoverPacketSent(
+                cover_traffic_packet_size.size(),
+            ));
        }

        // TODO: I'm not entirely sure whether this is really required, because I'm not 100%
@@ -8,6 +8,7 @@ use nym_gateway_client::GatewayClient;
 pub use nym_gateway_client::{GatewayPacketRouter, PacketRouter};
 use nym_sphinx::forwarding::packet::MixPacket;
 use std::fmt::Debug;
+use std::os::fd::RawFd;
 use thiserror::Error;

 #[cfg(not(target_arch = "wasm32"))]
@@ -25,6 +26,7 @@ fn erase_err<E: std::error::Error + Send + Sync + 'static>(err: E) -> ErasedGate
 /// This combines combines the functionalities of being able to send and receive mix packets.
 pub trait GatewayTransceiver: GatewaySender + GatewayReceiver {
    fn gateway_identity(&self) -> identity::PublicKey;
+    fn ws_fd(&self) -> Option<RawFd>;
 }

 /// This trait defines the functionality of sending `MixPacket` into the mixnet,
@@ -66,6 +68,9 @@ impl<G: GatewayTransceiver + ?Sized + Send> GatewayTransceiver for Box<G> {
    fn gateway_identity(&self) -> identity::PublicKey {
        (**self).gateway_identity()
    }
+    fn ws_fd(&self) -> Option<RawFd> {
+        (**self).ws_fd()
+    }
 }

 #[cfg_attr(target_arch = "wasm32", async_trait(?Send))]
@@ -112,6 +117,9 @@ where
    fn gateway_identity(&self) -> identity::PublicKey {
        self.gateway_client.gateway_identity()
    }
+    fn ws_fd(&self) -> Option<RawFd> {
+        self.gateway_client.ws_fd()
+    }
 }

 #[cfg_attr(target_arch = "wasm32", async_trait(?Send))]
@@ -187,6 +195,9 @@ mod nonwasm_sealed {
        fn gateway_identity(&self) -> identity::PublicKey {
            self.local_identity
        }
+        fn ws_fd(&self) -> Option<RawFd> {
+            None
+        }
    }

    #[async_trait]
@@ -259,4 +270,7 @@ impl GatewayTransceiver for MockGateway {
    fn gateway_identity(&self) -> identity::PublicKey {
        self.dummy_identity
    }
+    fn ws_fd(&self) -> Option<RawFd> {
+        None
+    }
 }
@@ -7,6 +7,7 @@ pub(crate) mod helpers;
 pub mod inbound_messages;
 pub mod key_manager;
 pub mod mix_traffic;
+pub(crate) mod packet_statistics_control;
 pub mod real_messages_control;
 pub mod received_buffer;
 pub mod replies;
@@ -0,0 +1,503 @@
+use std::{
+    collections::VecDeque,
+    time::{Duration, Instant},
+};
+
+use si_scale::helpers::bibytes2;
+
+use crate::spawn_future;
+
+// Time interval between reporting packet statistics
+const PACKET_REPORT_INTERVAL_SECS: u64 = 2;
+// Interval for taking snapshots of the packet statistics
+const SNAPSHOT_INTERVAL_MS: u64 = 500;
+// When computing rates, we include snapshots that are up to this old. We set it to some odd number
+// a tad larger than an integer number of snapshot intervals, so that we don't have to worry about
+// threshold effects.
+// Also, set it larger than the packet report interval so that we don't miss notable singular events
+const RECORDING_WINDOW_MS: u64 = 2300;
+
+#[derive(Default, Debug, Clone)]
+struct PacketStatistics {
+    // Sent
+    real_packets_sent: u64,
+    real_packets_sent_size: usize,
+    cover_packets_sent: u64,
+    cover_packets_sent_size: usize,
+
+    // Received
+    real_packets_received: u64,
+    real_packets_received_size: usize,
+    cover_packets_received: u64,
+    cover_packets_received_size: usize,
+
+    // Acks
+    total_acks_received: u64,
+    total_acks_received_size: usize,
+    real_acks_received: u64,
+    real_acks_received_size: usize,
+    cover_acks_received: u64,
+    cover_acks_received_size: usize,
+
+    // Types of packets queued
+    // TODO: track the type sent instead
+    real_packets_queued: u64,
+    retransmissions_queued: u64,
+    reply_surbs_queued: u64,
+    additional_reply_surbs_queued: u64,
+}
+
+impl PacketStatistics {
+    fn handle_event(&mut self, event: PacketStatisticsEvent) {
+        match event {
+            PacketStatisticsEvent::RealPacketSent(packet_size) => {
+                self.real_packets_sent += 1;
+                self.real_packets_sent_size += packet_size;
+            }
+            PacketStatisticsEvent::CoverPacketSent(packet_size) => {
+                self.cover_packets_sent += 1;
+                self.cover_packets_sent_size += packet_size;
+            }
+            PacketStatisticsEvent::RealPacketReceived(packet_size) => {
+                self.real_packets_received += 1;
+                self.real_packets_received_size += packet_size;
+            }
+            PacketStatisticsEvent::CoverPacketReceived(packet_size) => {
+                self.cover_packets_received += 1;
+                self.cover_packets_received_size += packet_size;
+            }
+            PacketStatisticsEvent::AckReceived(packet_size) => {
+                self.total_acks_received += 1;
+                self.total_acks_received_size += packet_size;
+            }
+            PacketStatisticsEvent::RealAckReceived(packet_size) => {
+                self.real_acks_received += 1;
+                self.real_acks_received_size += packet_size;
+            }
+            PacketStatisticsEvent::CoverAckReceived(packet_size) => {
+                self.cover_acks_received += 1;
+                self.cover_acks_received_size += packet_size;
+            }
+            PacketStatisticsEvent::RealPacketQueued => {
+                self.real_packets_queued += 1;
+            }
+            PacketStatisticsEvent::RetransmissionQueued => {
+                self.retransmissions_queued += 1;
+            }
+            PacketStatisticsEvent::ReplySurbRequestQueued => {
+                self.reply_surbs_queued += 1;
+            }
+            PacketStatisticsEvent::AdditionalReplySurbRequestQueued => {
+                self.additional_reply_surbs_queued += 1;
+            }
+        }
+    }
+
+    fn summary(&self) -> (String, String) {
+        (
+            format!(
+                "packets sent: {} (real: {}, cover: {}, retransmissions: {})",
+                self.real_packets_sent + self.cover_packets_sent,
+                self.real_packets_sent,
+                self.cover_packets_sent,
+                self.retransmissions_queued,
+            ),
+            format!(
+                "packets received: {}, (real: {}, cover: {}, acks: {}, acks for cover: {})",
+                self.real_packets_received + self.cover_packets_received,
+                self.real_packets_received,
+                self.cover_packets_received,
+                self.real_acks_received,
+                self.cover_acks_received,
+            ),
+        )
+    }
+}
+
+impl std::ops::Sub for PacketStatistics {
+    type Output = Self;
+
+    fn sub(self, rhs: Self) -> Self::Output {
+        Self {
+            real_packets_sent: self.real_packets_sent - rhs.real_packets_sent,
+            real_packets_sent_size: self.real_packets_sent_size - rhs.real_packets_sent_size,
+            cover_packets_sent: self.cover_packets_sent - rhs.cover_packets_sent,
+            cover_packets_sent_size: self.cover_packets_sent_size - rhs.cover_packets_sent_size,
+
+            real_packets_received: self.real_packets_received - rhs.real_packets_received,
+            real_packets_received_size: self.real_packets_received_size
+                - rhs.real_packets_received_size,
+            cover_packets_received: self.cover_packets_received - rhs.cover_packets_received,
+            cover_packets_received_size: self.cover_packets_received_size
+                - rhs.cover_packets_received_size,
+
+            total_acks_received: self.total_acks_received - rhs.total_acks_received,
+            total_acks_received_size: self.total_acks_received_size - rhs.total_acks_received_size,
+            real_acks_received: self.real_acks_received - rhs.real_acks_received,
+            real_acks_received_size: self.real_acks_received_size - rhs.real_acks_received_size,
+            cover_acks_received: self.cover_acks_received - rhs.cover_acks_received,
+            cover_acks_received_size: self.cover_acks_received_size - rhs.cover_acks_received_size,
+
+            real_packets_queued: self.real_packets_queued - rhs.real_packets_queued,
+            retransmissions_queued: self.retransmissions_queued - rhs.retransmissions_queued,
+            reply_surbs_queued: self.reply_surbs_queued - rhs.reply_surbs_queued,
+            additional_reply_surbs_queued: self.additional_reply_surbs_queued
+                - rhs.additional_reply_surbs_queued,
+        }
+    }
+}
+
+#[derive(Debug, Clone)]
+struct PacketRates {
+    real_packets_sent: f64,
+    real_packets_sent_size: f64,
+    cover_packets_sent: f64,
+    cover_packets_sent_size: f64,
+
+    real_packets_received: f64,
+    real_packets_received_size: f64,
+    cover_packets_received: f64,
+    cover_packets_received_size: f64,
+
+    total_acks_received: f64,
+    total_acks_received_size: f64,
+    real_acks_received: f64,
+    real_acks_received_size: f64,
+    cover_acks_received: f64,
+    cover_acks_received_size: f64,
+
+    real_packets_queued: f64,
+    retransmissions_queued: f64,
+    reply_surbs_queued: f64,
+    additional_reply_surbs_queued: f64,
+}
+
+impl From<PacketStatistics> for PacketRates {
+    fn from(stats: PacketStatistics) -> Self {
+        Self {
+            real_packets_sent: stats.real_packets_sent as f64,
+            real_packets_sent_size: stats.real_packets_sent_size as f64,
+            cover_packets_sent: stats.cover_packets_sent as f64,
+            cover_packets_sent_size: stats.cover_packets_sent_size as f64,
+
+            real_packets_received: stats.real_packets_received as f64,
+            real_packets_received_size: stats.real_packets_received_size as f64,
+            cover_packets_received: stats.cover_packets_received as f64,
+            cover_packets_received_size: stats.cover_packets_received_size as f64,
+
+            total_acks_received: stats.total_acks_received as f64,
+            total_acks_received_size: stats.total_acks_received_size as f64,
+            real_acks_received: stats.real_acks_received as f64,
+            real_acks_received_size: stats.real_acks_received_size as f64,
+            cover_acks_received: stats.cover_acks_received as f64,
+            cover_acks_received_size: stats.cover_acks_received_size as f64,
+
+            real_packets_queued: stats.real_packets_queued as f64,
+            retransmissions_queued: stats.retransmissions_queued as f64,
+            reply_surbs_queued: stats.reply_surbs_queued as f64,
+            additional_reply_surbs_queued: stats.additional_reply_surbs_queued as f64,
+        }
+    }
+}
+
+impl std::ops::Sub for PacketRates {
+    type Output = Self;
+
+    fn sub(self, rhs: Self) -> Self::Output {
+        Self {
+            real_packets_sent: self.real_packets_sent - rhs.real_packets_sent,
+            real_packets_sent_size: self.real_packets_sent_size - rhs.real_packets_sent_size,
+            cover_packets_sent: self.cover_packets_sent - rhs.cover_packets_sent,
+            cover_packets_sent_size: self.cover_packets_sent_size - rhs.cover_packets_sent_size,
+
+            real_packets_received: self.real_packets_received - rhs.real_packets_received,
+            real_packets_received_size: self.real_packets_received_size
+                - rhs.real_packets_received_size,
+            cover_packets_received: self.cover_packets_received - rhs.cover_packets_received,
+            cover_packets_received_size: self.cover_packets_received_size
+                - rhs.cover_packets_received_size,
+
+            total_acks_received: self.total_acks_received - rhs.total_acks_received,
+            total_acks_received_size: self.total_acks_received_size - rhs.total_acks_received_size,
+            real_acks_received: self.real_acks_received - rhs.real_acks_received,
+            real_acks_received_size: self.real_acks_received_size - rhs.real_acks_received_size,
+            cover_acks_received: self.cover_acks_received - rhs.cover_acks_received,
+            cover_acks_received_size: self.cover_acks_received_size - rhs.cover_acks_received_size,
+
+            real_packets_queued: self.real_packets_queued - rhs.real_packets_queued,
+            retransmissions_queued: self.retransmissions_queued - rhs.retransmissions_queued,
+            reply_surbs_queued: self.reply_surbs_queued - rhs.reply_surbs_queued,
+            additional_reply_surbs_queued: self.additional_reply_surbs_queued
+                - rhs.additional_reply_surbs_queued,
+        }
+    }
+}
+
+impl std::ops::Div<f64> for PacketRates {
+    type Output = Self;
+
+    fn div(self, rhs: f64) -> Self::Output {
+        Self {
+            real_packets_sent: self.real_packets_sent / rhs,
+            real_packets_sent_size: self.real_packets_sent_size / rhs,
+            cover_packets_sent: self.cover_packets_sent / rhs,
+            cover_packets_sent_size: self.cover_packets_sent_size / rhs,
+
+            real_packets_received: self.real_packets_received / rhs,
+            real_packets_received_size: self.real_packets_received_size / rhs,
+            cover_packets_received: self.cover_packets_received / rhs,
+            cover_packets_received_size: self.cover_packets_received_size / rhs,
+
+            total_acks_received: self.total_acks_received / rhs,
+            total_acks_received_size: self.total_acks_received_size / rhs,
+            real_acks_received: self.real_acks_received / rhs,
+            real_acks_received_size: self.real_acks_received_size / rhs,
+            cover_acks_received: self.cover_acks_received / rhs,
+            cover_acks_received_size: self.cover_acks_received_size / rhs,
+
+            real_packets_queued: self.real_packets_queued / rhs,
+            retransmissions_queued: self.retransmissions_queued / rhs,
+            reply_surbs_queued: self.reply_surbs_queued / rhs,
+            additional_reply_surbs_queued: self.additional_reply_surbs_queued / rhs,
+        }
+    }
+}
+
+impl PacketRates {
+    fn summary(&self) -> String {
+        format!(
+            "down: {}/s, up: {}/s (cover down: {}/s, cover up: {}/s)",
+            bibytes2(self.real_packets_received_size),
+            bibytes2(self.real_packets_sent_size),
+            bibytes2(self.cover_packets_received_size),
+            bibytes2(self.cover_packets_sent_size),
+        )
+    }
+
+    fn detailed_summary(&self) -> String {
+        format!(
+            "RX: {:.1} mixpkt/s, {}/s (real: {}/s, acks: {}/s), TX: {:.1} mixpkt/s, {}/s (real: {}/s)",
+            self.real_packets_received + self.cover_packets_received,
+            bibytes2(self.real_packets_received_size + self.cover_packets_received_size),
+            bibytes2(self.real_packets_received_size),
+            bibytes2(self.total_acks_received_size),
+            self.real_packets_sent + self.cover_packets_sent,
+            bibytes2(self.real_packets_sent_size + self.cover_packets_sent_size),
+            bibytes2(self.real_packets_sent_size),
+        )
+    }
+}
+
+#[derive(Debug)]
+pub(crate) enum PacketStatisticsEvent {
+    // The real packets sent. Recall that acks are sent by the gateway, so it's not included here.
+    RealPacketSent(usize),
+    // The cover packets sent
+    CoverPacketSent(usize),
+
+    // Real packets received
+    RealPacketReceived(usize),
+    // Cover packets received
+    CoverPacketReceived(usize),
+
+    // Ack of any type received. This is mostly used as a consistency check, and should be the sum
+    // of real and cover acks received.
+    AckReceived(usize),
+    // Out of the total acks received, this is the subset of those that were real
+    RealAckReceived(usize),
+    // Out of the total acks received, this is the subset of those that were for cover traffic
+    CoverAckReceived(usize),
+
+    // Types of packets queued
+    RealPacketQueued,
+    RetransmissionQueued,
+    ReplySurbRequestQueued,
+    AdditionalReplySurbRequestQueued,
+}
+
+type PacketStatisticsReceiver = tokio::sync::mpsc::UnboundedReceiver<PacketStatisticsEvent>;
+
+#[derive(Clone)]
+pub(crate) struct PacketStatisticsReporter {
+    stats_tx: tokio::sync::mpsc::UnboundedSender<PacketStatisticsEvent>,
+}
+
+impl PacketStatisticsReporter {
+    pub(crate) fn new(stats_tx: tokio::sync::mpsc::UnboundedSender<PacketStatisticsEvent>) -> Self {
+        Self { stats_tx }
+    }
+
+    pub(crate) fn report(&self, event: PacketStatisticsEvent) {
+        self.stats_tx.send(event).unwrap_or_else(|err| {
+            log::error!("Failed to report packet stat: {:?}", err);
+        });
+    }
+}
+
+pub(crate) struct PacketStatisticsControl {
+    // Incoming packet stats events from other tasks
+    stats_rx: PacketStatisticsReceiver,
+
+    // Keep track of packet statistics over time
+    stats: PacketStatistics,
+
+    // We keep snapshots of the statistics over time so we can compute rates, and also keeping the
+    // full history allows for some more fancy averaging if we want to do that.
+    history: VecDeque<(Instant, PacketStatistics)>,
+
+    // Keep previous rates so that we can detect notable events
+    rates: VecDeque<(Instant, PacketRates)>,
+}
+
+impl PacketStatisticsControl {
+    pub(crate) fn new() -> (Self, PacketStatisticsReporter) {
+        let (stats_tx, stats_rx) = tokio::sync::mpsc::unbounded_channel();
+
+        (
+            Self {
+                stats_rx,
+                stats: PacketStatistics::default(),
+                history: VecDeque::new(),
+                rates: VecDeque::new(),
+            },
+            PacketStatisticsReporter::new(stats_tx),
+        )
+    }
+
+    // Add the current stats to the history, and remove old ones.
+    fn update_history(&mut self) {
+        // Update latest
+        self.history.push_back((Instant::now(), self.stats.clone()));
+
+        // Filter out old ones
+        let recording_window = Instant::now() - Duration::from_millis(RECORDING_WINDOW_MS);
+        while self
+            .history
+            .front()
+            .map_or(false, |&(t, _)| t < recording_window)
+        {
+            self.history.pop_front();
+        }
+    }
+
+    fn compute_rates(&self) -> Option<PacketRates> {
+        // NOTE: consider changing this to compute rates over the history instead of using current
+        // stats. Currently it should not make much of a difference since we call this just after
+        // updating the history, but it seems like it could be more internally consistent to do it
+        // that way.
+
+        // Do basic averaging over the entire history, which just uses the first and last
+        if let Some((start, start_stats)) = self.history.front() {
+            let duration_secs = Instant::now().duration_since(*start).as_secs_f64();
+            let delta = self.stats.clone() - start_stats.clone();
+            let rates = PacketRates::from(delta) / duration_secs;
+            Some(rates)
+        } else {
+            None
+        }
+    }
+
+    fn update_rates(&mut self) {
+        // Update latest
+        if let Some(rates) = self.compute_rates() {
+            self.rates.push_back((Instant::now(), rates));
+        }
+
+        // Filter out old ones
+        let recording_window = Instant::now() - Duration::from_millis(RECORDING_WINDOW_MS);
+        while self
+            .rates
+            .front()
+            .map_or(false, |&(t, _)| t < recording_window)
+        {
+            self.rates.pop_front();
+        }
+    }
+
+    fn report_rates(&self) {
+        if let Some((_, rates)) = self.rates.back() {
+            log::info!("{}", rates.summary());
+            log::debug!("{}", rates.detailed_summary());
+        }
+    }
+
+    fn report_counters(&self) {
+        log::trace!("packet statistics: {:?}", &self.stats);
+        let (summary_sent, summary_recv) = self.stats.summary();
+        log::debug!("{}", summary_sent);
+        log::debug!("{}", summary_recv);
+    }
+
+    fn check_for_notable_events(&self) {
+        let Some((_, latest_rates)) = self.rates.back() else {
+            return;
+        };
+
+        // If we get a burst of retransmissions
+        // TODO: consider making this the number of retransmissions since last report instead.
+        if latest_rates.retransmissions_queued > 0.0 {
+            log::debug!(
+                "retransmissions: {:.2} pkt/s",
+                latest_rates.retransmissions_queued
+            );
+
+            // Check what the number of retransmissions was during the recording window
+            if let Some((_, start_stats)) = self.history.front() {
+                let delta = self.stats.clone() - start_stats.clone();
+                log::info!(
+                    "mix packet retransmissions/real mix packets: {}/{}",
+                    delta.retransmissions_queued,
+                    delta.real_packets_queued,
+                );
+            } else {
+                log::warn!("Unable to check retransmissions during recording window");
+            }
+        }
+
+        // IDEA: if there is a burst of acks, that could indicate tokio task starvation.
+    }
+
+    pub(crate) async fn run_with_shutdown(&mut self, mut shutdown: nym_task::TaskClient) {
+        log::debug!("Started PacketStatisticsControl with graceful shutdown support");
+
+        let report_interval = Duration::from_secs(PACKET_REPORT_INTERVAL_SECS);
+        let mut report_interval = tokio::time::interval(report_interval);
+        let snapshot_interval = Duration::from_millis(SNAPSHOT_INTERVAL_MS);
+        let mut snapshot_interval = tokio::time::interval(snapshot_interval);
+
+        loop {
+            tokio::select! {
+                stats_event = self.stats_rx.recv() => match stats_event {
+                    Some(stats_event) => {
+                        log::trace!("PacketStatisticsControl: Received stats event");
+                        self.stats.handle_event(stats_event);
+                    },
+                    None => {
+                        log::trace!("PacketStatisticsControl: stopping since stats channel was closed");
+                        break;
+                    }
+                },
+                _ = snapshot_interval.tick() => {
+                    self.update_history();
+                    self.update_rates();
+                }
+                _ = report_interval.tick() => {
+                    self.report_rates();
+                    self.check_for_notable_events();
+                    self.report_counters();
+                }
+                _ = shutdown.recv_with_delay() => {
+                    log::trace!("PacketStatisticsControl: Received shutdown");
+                    break;
+                },
+            }
+        }
+        log::debug!("PacketStatisticsControl: Exiting");
+    }
+
+    pub(crate) fn start_with_shutdown(mut self, task_client: nym_task::TaskClient) {
+        spawn_future(async move {
+            self.run_with_shutdown(task_client).await;
+        })
+    }
+}
@@ -1,6 +1,8 @@
 // Copyright 2021 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0

+use crate::client::packet_statistics_control::{PacketStatisticsEvent, PacketStatisticsReporter};
+
 use super::action_controller::{AckActionSender, Action};
 use futures::StreamExt;
 use log::*;
@@ -17,6 +19,7 @@ pub(super) struct AcknowledgementListener {
    ack_key: Arc<AckKey>,
    ack_receiver: AcknowledgementReceiver,
    action_sender: AckActionSender,
+    stats_tx: PacketStatisticsReporter,
 }

 impl AcknowledgementListener {
@@ -24,16 +27,21 @@ impl AcknowledgementListener {
        ack_key: Arc<AckKey>,
        ack_receiver: AcknowledgementReceiver,
        action_sender: AckActionSender,
+        stats_tx: PacketStatisticsReporter,
    ) -> Self {
        AcknowledgementListener {
            ack_key,
            ack_receiver,
            action_sender,
+            stats_tx,
        }
    }

    async fn on_ack(&mut self, ack_content: Vec<u8>) {
        trace!("Received an ack");
+        self.stats_tx
+            .report(PacketStatisticsEvent::AckReceived(ack_content.len()));
+
        let frag_id = match recover_identifier(&self.ack_key, &ack_content)
            .map(FragmentIdentifier::try_from_bytes)
        {
@@ -48,11 +56,14 @@ impl AcknowledgementListener {
        // because nothing was inserted in the first place
        if frag_id == COVER_FRAG_ID {
            trace!("Received an ack for a cover message - no need to do anything");
+            self.stats_tx
+                .report(PacketStatisticsEvent::CoverAckReceived(ack_content.len()));
            return;
        }

        trace!("Received {} from the mix network", frag_id);
-
+        self.stats_tx
+            .report(PacketStatisticsEvent::RealAckReceived(ack_content.len()));
        self.action_sender
            .unbounded_send(Action::new_remove(frag_id))
            .unwrap();
@@ -8,6 +8,7 @@ use self::{
    sent_notification_listener::SentNotificationListener,
 };
 use crate::client::inbound_messages::InputMessageReceiver;
+use crate::client::packet_statistics_control::PacketStatisticsReporter;
 use crate::client::real_messages_control::message_handler::MessageHandler;
 use crate::client::replies::reply_controller::ReplyControllerSender;
 use crate::spawn_future;
@@ -208,6 +209,7 @@ where
        connectors: AcknowledgementControllerConnectors,
        message_handler: MessageHandler<R>,
        reply_controller_sender: ReplyControllerSender,
+        stats_tx: PacketStatisticsReporter,
    ) -> Self {
        let (retransmission_tx, retransmission_rx) = mpsc::unbounded();

@@ -224,6 +226,7 @@ where
            Arc::clone(&ack_key),
            connectors.ack_receiver,
            connectors.ack_action_sender.clone(),
+            stats_tx,
        );

        // will listen for any new messages from the client
@@ -35,6 +35,8 @@ use crate::client::replies::reply_controller;
 use crate::config;
 pub(crate) use acknowledgement_control::{AckActionSender, Action};

+use super::packet_statistics_control::PacketStatisticsReporter;
+
 pub(crate) mod acknowledgement_control;
 pub(crate) mod message_handler;
 pub(crate) mod real_traffic_stream;
@@ -143,6 +145,7 @@ impl RealMessagesController<OsRng> {
        reply_controller_receiver: ReplyControllerReceiver,
        lane_queue_lengths: LaneQueueLengths,
        client_connection_rx: ConnectionCommandReceiver,
+        stats_tx: PacketStatisticsReporter,
    ) -> Self {
        let rng = OsRng;

@@ -181,6 +184,7 @@ impl RealMessagesController<OsRng> {
            ack_controller_connectors,
            message_handler.clone(),
            reply_controller_sender,
+            stats_tx.clone(),
        );

        let reply_control = ReplyController::new(
@@ -199,6 +203,7 @@ impl RealMessagesController<OsRng> {
            topology_access,
            lane_queue_lengths,
            client_connection_rx,
+            stats_tx,
        );

        RealMessagesController {
@@ -3,6 +3,7 @@

 use self::sending_delay_controller::SendingDelayController;
 use crate::client::mix_traffic::BatchMixMessageSender;
+use crate::client::packet_statistics_control::{PacketStatisticsEvent, PacketStatisticsReporter};
 use crate::client::real_messages_control::acknowledgement_control::SentPacketNotificationSender;
 use crate::client::topology_control::TopologyAccessor;
 use crate::client::transmission_buffer::TransmissionBuffer;
@@ -113,6 +114,9 @@ where

    /// Report queue lengths so that upstream can backoff sending data, and keep connections open.
    lane_queue_lengths: LaneQueueLengths,
+
+    /// Channel used for sending statistics events to `PacketStatisticsControl`.
+    stats_tx: PacketStatisticsReporter,
 }

 #[derive(Debug)]
@@ -171,6 +175,7 @@ where
        topology_access: TopologyAccessor,
        lane_queue_lengths: LaneQueueLengths,
        client_connection_rx: ConnectionCommandReceiver,
+        stats_tx: PacketStatisticsReporter,
    ) -> Self {
        OutQueueControl {
            config,
@@ -184,6 +189,7 @@ where
            transmission_buffer: TransmissionBuffer::new(),
            client_connection_rx,
            lane_queue_lengths,
+            stats_tx,
        }
    }

@@ -214,7 +220,7 @@ where
    async fn on_message(&mut self, next_message: StreamMessage) {
        trace!("created new message");

-        let (next_message, fragment_id) = match next_message {
+        let (next_message, fragment_id, packet_size) = match next_message {
            StreamMessage::Cover => {
                let cover_traffic_packet_size = self.loop_cover_message_size();
                trace!("the next loop cover message will be put in a {cover_traffic_packet_size} packet");
@@ -250,15 +256,28 @@ where
                        "Somehow failed to generate a loop cover message with a valid topology",
                    ),
                    None,
+                    cover_traffic_packet_size.size(),
                )
            }
            StreamMessage::Real(real_message) => {
-                (real_message.mix_packet, real_message.fragment_id)
+                let packet_size = real_message.packet_size();
+                (
+                    real_message.mix_packet,
+                    real_message.fragment_id,
+                    packet_size,
+                )
            }
        };

        if let Err(err) = self.mix_tx.send(vec![next_message]).await {
            log::error!("Failed to send: {err}");
+        } else {
+            let event = if fragment_id.is_some() {
+                PacketStatisticsEvent::RealPacketSent(packet_size)
+            } else {
+                PacketStatisticsEvent::CoverPacketSent(packet_size)
+            };
+            self.stats_tx.report(event);
        }

        // notify ack controller about sending our message only after we actually managed to push it
@@ -340,6 +359,28 @@ where
        let lane_length = self.transmission_buffer.lane_length(&lane);
        self.lane_queue_lengths.set(&lane, lane_length);

+        // This is the last step in the pipeline where we know the type of the message, so
+        // lets count the number of retransmissions and reply surb messages sent here.
+        let stat_event = match lane {
+            TransmissionLane::General => None,
+            TransmissionLane::ConnectionId(_) => None,
+            TransmissionLane::ReplySurbRequest => {
+                Some(PacketStatisticsEvent::ReplySurbRequestQueued)
+            }
+            TransmissionLane::AdditionalReplySurbs => {
+                Some(PacketStatisticsEvent::AdditionalReplySurbRequestQueued)
+            }
+            TransmissionLane::Retransmission => Some(PacketStatisticsEvent::RetransmissionQueued),
+        };
+        if let Some(stat_event) = stat_event {
+            self.stats_tx.report(stat_event);
+        }
+        // To avoid comparing apples to oranges when presenting the fraction of packets that are
+        // retransmissions, we also need to keep track to the total number of real messages queued,
+        // even though we also track the actual number of messages sent later in the pipeline.
+        self.stats_tx
+            .report(PacketStatisticsEvent::RealPacketQueued);
+
        Some(real_next)
    }

@@ -433,6 +474,13 @@ where
            Poll::Ready(Some((real_messages, conn_id))) => {
                log::trace!("handling real_messages: size: {}", real_messages.len());

+                // This is the last step in the pipeline where we know the type of the message, so
+                // lets count the number of retransmissions here.
+                if conn_id == TransmissionLane::Retransmission {
+                    self.stats_tx
+                        .report(PacketStatisticsEvent::RetransmissionQueued);
+                }
+
                // First store what we got for the given connection id
                self.transmission_buffer.store(&conn_id, real_messages);
                let real_next = self.pop_next_message().expect("we just added one");
@@ -471,10 +519,10 @@ where
        let mult = self.sending_delay_controller.current_multiplier();
        let delay = self.current_average_message_sending_delay().as_millis();
        let status_str = if self.config.traffic.disable_main_poisson_packet_distribution {
-            format!("Status: {lanes} lanes, backlog: {backlog:.2} kiB ({packets}), no delay")
+            format!("Packet backlog: {backlog:.2} kiB ({packets}), {lanes} lanes, no delay")
        } else {
            format!(
-                "Status: {lanes} lanes, backlog: {backlog:.2} kiB ({packets}), avg delay: {delay}ms ({mult})"
+                "Packet backlog: {backlog:.2} kiB ({packets}), {lanes} lanes, avg delay: {delay}ms ({mult})"
            )
        };
        if packets > 1000 {
@@ -1,8 +1,10 @@
 // Copyright 2021 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0

-use crate::client::replies::reply_controller::ReplyControllerSender;
-use crate::client::replies::reply_storage::SentReplyKeys;
+use crate::client::{
+    packet_statistics_control::{PacketStatisticsEvent, PacketStatisticsReporter},
+    replies::{reply_controller::ReplyControllerSender, reply_storage::SentReplyKeys},
+};
 use crate::spawn_future;
 use futures::channel::mpsc;
 use futures::lock::Mutex;
@@ -43,15 +45,33 @@ struct ReceivedMessagesBufferInner<R: MessageReceiver> {
    // but perhaps it should be changed to include timestamps of when the message was reconstructed
    // and every now and then remove ids older than X
    recently_reconstructed: HashSet<i32>,
+
+    stats_tx: PacketStatisticsReporter,
 }

 impl<R: MessageReceiver> ReceivedMessagesBufferInner<R> {
-    fn recover_from_fragment(&mut self, fragment_data: &[u8]) -> Option<NymMessage> {
+    fn recover_from_fragment(
+        &mut self,
+        fragment_data: &[u8],
+        fragment_data_size: usize,
+    ) -> Option<NymMessage> {
        if nym_sphinx::cover::is_cover(fragment_data) {
            trace!("The message was a loop cover message! Skipping it");
+            // NOTE: it's important to note that there is quite a bit of difference in size of
+            // received and sent packets due to the sphinx layers being removed by the exit gateway
+            // before it reaches the mixnet client.
+            self.stats_tx
+                .report(PacketStatisticsEvent::CoverPacketReceived(
+                    fragment_data_size,
+                ));
            return None;
        }

+        self.stats_tx
+            .report(PacketStatisticsEvent::RealPacketReceived(
+                fragment_data_size,
+            ));
+
        let fragment = match self.message_receiver.recover_fragment(fragment_data) {
            Err(err) => {
                warn!("failed to recover fragment from raw data: {err}. The whole underlying message might be corrupted and unrecoverable!");
@@ -103,15 +123,17 @@ impl<R: MessageReceiver> ReceivedMessagesBufferInner<R> {
        reply_ciphertext: &mut [u8],
        reply_key: SurbEncryptionKey,
    ) -> Result<Option<NymMessage>, MessageRecoveryError> {
+        let reply_ciphertext_size = reply_ciphertext.len();
        // note: this performs decryption IN PLACE without extra allocation
        self.message_receiver
            .recover_plaintext_from_reply(reply_ciphertext, reply_key)?;
        let fragment_data = reply_ciphertext;

-        Ok(self.recover_from_fragment(fragment_data))
+        Ok(self.recover_from_fragment(fragment_data, reply_ciphertext_size))
    }

    fn process_received_regular_packet(&mut self, mut raw_fragment: Vec<u8>) -> Option<NymMessage> {
+        let raw_fragment_size = raw_fragment.len();
        let fragment_data = match self.message_receiver.recover_plaintext_from_regular_packet(
            self.local_encryption_keypair.private_key(),
            &mut raw_fragment,
@@ -123,7 +145,7 @@ impl<R: MessageReceiver> ReceivedMessagesBufferInner<R> {
            Ok(frag_data) => frag_data,
        };

-        self.recover_from_fragment(fragment_data)
+        self.recover_from_fragment(fragment_data, raw_fragment_size)
    }
 }

@@ -141,6 +163,7 @@ impl<R: MessageReceiver> ReceivedMessagesBuffer<R> {
        local_encryption_keypair: Arc<encryption::KeyPair>,
        reply_key_storage: SentReplyKeys,
        reply_controller_sender: ReplyControllerSender,
+        stats_tx: PacketStatisticsReporter,
    ) -> Self {
        ReceivedMessagesBuffer {
            inner: Arc::new(Mutex::new(ReceivedMessagesBufferInner {
@@ -149,6 +172,7 @@ impl<R: MessageReceiver> ReceivedMessagesBuffer<R> {
                message_receiver: R::new(),
                message_sender: None,
                recently_reconstructed: HashSet::new(),
+                stats_tx,
            })),
            reply_key_storage,
            reply_controller_sender,
@@ -353,7 +377,7 @@ impl<R: MessageReceiver> ReceivedMessagesBuffer<R> {
                };

            if let Some(completed) = completed_message {
-                info!("received {completed}");
+                debug!("received {completed}");
                completed_messages.push(completed)
            }
        }
@@ -480,11 +504,13 @@ impl<R: MessageReceiver + Clone + Send + 'static> ReceivedMessagesBufferControll
        mixnet_packet_receiver: MixnetMessageReceiver,
        reply_key_storage: SentReplyKeys,
        reply_controller_sender: ReplyControllerSender,
+        packet_statistics_reporter: PacketStatisticsReporter,
    ) -> Self {
        let received_buffer = ReceivedMessagesBuffer::new(
            local_encryption_keypair,
            reply_key_storage,
            reply_controller_sender,
+            packet_statistics_reporter,
        );

        ReceivedMessagesBufferController {
@@ -65,7 +65,7 @@ pub async fn current_gateways<R: Rng>(
        .ok_or(ClientCoreError::ListOfNymApisIsEmpty)?;
    let client = nym_validator_client::client::NymApiClient::new(nym_api.clone());

-    log::trace!("Fetching list of gateways from: {nym_api}");
+    log::debug!("Fetching list of gateways from: {nym_api}");

    let gateways = client.get_cached_described_gateways().await?;
    log::debug!("Found {} gateways", gateways.len());
@@ -178,7 +178,7 @@ impl<T> From<PersistedGatewayDetails<T>> for GatewayDetails<T> {
    }
 }

-#[derive(Clone)]
+#[derive(Clone, Debug)]
 pub enum GatewaySelectionSpecification<T = EmptyCustomDetails> {
    /// Uniformly choose a random remote gateway.
    UniformRemote { must_use_tls: bool },
@@ -26,6 +26,8 @@ use nym_task::TaskClient;
 use nym_validator_client::nyxd::contract_traits::DkgQueryClient;
 use rand::rngs::OsRng;
 use std::convert::TryFrom;
+use std::os::fd::AsRawFd;
+use std::os::fd::RawFd;
 use std::sync::Arc;
 use std::time::Duration;
 use tungstenite::protocol::Message;
@@ -34,6 +36,7 @@ use tungstenite::protocol::Message;
 use tokio::time::sleep;
 #[cfg(not(target_arch = "wasm32"))]
 use tokio_tungstenite::connect_async;
+use tokio_tungstenite::MaybeTlsStream;

 #[cfg(target_arch = "wasm32")]
 use wasm_utils::websocket::JSWebsocket;
@@ -146,6 +149,21 @@ impl<C, St> GatewayClient<C, St> {
        self.gateway_identity
    }

+    pub fn ws_fd(&self) -> Option<RawFd> {
+        match &self.connection {
+            SocketState::Available(conn) => match conn.get_ref() {
+                MaybeTlsStream::Plain(stream) => Some(stream.as_raw_fd()),
+                MaybeTlsStream::NativeTls(stream) => Some(stream.as_raw_fd()),
+                &_ => None,
+            },
+            SocketState::PartiallyDelegated(conn) => Some(conn.ws_fd()),
+            _ => {
+                log::warn!("No fd yet");
+                None
+            }
+        }
+    }
+
    pub fn remaining_bandwidth(&self) -> i64 {
        self.bandwidth_remaining
    }
@@ -11,6 +11,7 @@ use futures::{SinkExt, StreamExt};
 use log::*;
 use nym_gateway_requests::registration::handshake::SharedKeys;
 use nym_task::TaskClient;
+use std::os::fd::{AsRawFd, RawFd};
 use std::sync::Arc;
 use tungstenite::Message;

@@ -38,11 +39,15 @@ type WsConn = JSWebsocket;
 type SplitStreamReceiver = oneshot::Receiver<Result<SplitStream<WsConn>, GatewayClientError>>;

 pub(crate) struct PartiallyDelegated {
+    ws_fd: RawFd,
    sink_half: SplitSink<WsConn, Message>,
    delegated_stream: (SplitStreamReceiver, oneshot::Sender<()>),
 }

 impl PartiallyDelegated {
+    pub fn ws_fd(&self) -> RawFd {
+        self.ws_fd
+    }
    fn recover_received_plaintexts(ws_msgs: Vec<Message>, shared_key: &SharedKeys) -> Vec<Vec<u8>> {
        let mut plaintexts = Vec::with_capacity(ws_msgs.len());
        for ws_msg in ws_msgs {
@@ -92,6 +97,11 @@ impl PartiallyDelegated {
        let (notify_sender, notify_receiver) = oneshot::channel();
        let (stream_sender, stream_receiver) = oneshot::channel();

+        let ws_fd = match conn.get_ref() {
+            MaybeTlsStream::Plain(stream) => stream.as_raw_fd(),
+            MaybeTlsStream::NativeTls(stream) => stream.as_raw_fd(),
+            _ => 0.into(),
+        };
        let (sink, mut stream) = conn.split();

        let mixnet_receiver_future = async move {
@@ -141,6 +151,7 @@ impl PartiallyDelegated {
        tokio::spawn(mixnet_receiver_future);

        PartiallyDelegated {
+            ws_fd,
            sink_half: sink,
            delegated_stream: (stream_receiver, notify_sender),
        }
@@ -1,4 +1,4 @@
-// Copyright 2022 - Nym Technologies SA <contact@nymtech.net>
+// Copyright 2022-2024 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0

 use crate::collect_paged;
@@ -7,14 +7,22 @@ use crate::nyxd::error::NyxdError;
 use crate::nyxd::CosmWasmClient;
 use async_trait::async_trait;
 use cosmrs::AccountId;
-use nym_coconut_dkg_common::{
-    dealer::{ContractDealing, DealerDetailsResponse, PagedDealerResponse, PagedDealingsResponse},
-    msg::QueryMsg as DkgQueryMsg,
-    types::{DealerDetails, Epoch, EpochId, InitialReplacementData},
-    verification_key::{ContractVKShare, PagedVKSharesResponse},
-};
+use nym_coconut_dkg_common::types::ChunkIndex;
 use serde::Deserialize;

+pub use nym_coconut_dkg_common::{
+    dealer::{DealerDetailsResponse, PagedDealerResponse},
+    dealing::{
+        DealerDealingsStatusResponse, DealingChunkResponse, DealingChunkStatusResponse,
+        DealingMetadataResponse, DealingStatusResponse,
+    },
+    msg::QueryMsg as DkgQueryMsg,
+    types::{
+        DealerDetails, DealingIndex, Epoch, EpochId, EpochState, InitialReplacementData, State,
+    },
+    verification_key::{ContractVKShare, PagedVKSharesResponse, VkShareResponse},
+};
+
 #[cfg_attr(target_arch = "wasm32", async_trait(?Send))]
 #[cfg_attr(not(target_arch = "wasm32"), async_trait)]
 pub trait DkgQueryClient {
@@ -22,10 +30,16 @@ pub trait DkgQueryClient {
    where
        for<'a> T: Deserialize<'a>;

+    async fn get_state(&self) -> Result<State, NyxdError> {
+        let request = DkgQueryMsg::GetState {};
+        self.query_dkg_contract(request).await
+    }
+
    async fn get_current_epoch(&self) -> Result<Epoch, NyxdError> {
        let request = DkgQueryMsg::GetCurrentEpochState {};
        self.query_dkg_contract(request).await
    }
+
    async fn get_current_epoch_threshold(&self) -> Result<Option<u64>, NyxdError> {
        let request = DkgQueryMsg::GetCurrentEpochThreshold {};
        self.query_dkg_contract(request).await
@@ -64,17 +78,86 @@ pub trait DkgQueryClient {
        self.query_dkg_contract(request).await
    }

-    async fn get_dealings_paged(
+    async fn get_dealings_metadata(
        &self,
-        idx: u64,
-        start_after: Option<String>,
-        limit: Option<u32>,
-    ) -> Result<PagedDealingsResponse, NyxdError> {
-        let request = DkgQueryMsg::GetDealing {
-            idx,
-            limit,
-            start_after,
+        epoch_id: EpochId,
+        dealer: String,
+        dealing_index: DealingIndex,
+    ) -> Result<DealingMetadataResponse, NyxdError> {
+        let request = DkgQueryMsg::GetDealingsMetadata {
+            epoch_id,
+            dealer,
+            dealing_index,
        };
+
+        self.query_dkg_contract(request).await
+    }
+
+    async fn get_dealer_dealings_status(
+        &self,
+        epoch_id: EpochId,
+        dealer: String,
+    ) -> Result<DealerDealingsStatusResponse, NyxdError> {
+        let request = DkgQueryMsg::GetDealerDealingsStatus { epoch_id, dealer };
+
+        self.query_dkg_contract(request).await
+    }
+
+    async fn get_dealing_status(
+        &self,
+        epoch_id: EpochId,
+        dealer: String,
+        dealing_index: DealingIndex,
+    ) -> Result<DealingStatusResponse, NyxdError> {
+        let request = DkgQueryMsg::GetDealingStatus {
+            epoch_id,
+            dealer,
+            dealing_index,
+        };
+
+        self.query_dkg_contract(request).await
+    }
+
+    async fn get_dealing_chunk_status(
+        &self,
+        epoch_id: EpochId,
+        dealer: String,
+        dealing_index: DealingIndex,
+        chunk_index: ChunkIndex,
+    ) -> Result<DealingChunkStatusResponse, NyxdError> {
+        let request = DkgQueryMsg::GetDealingChunkStatus {
+            epoch_id,
+            dealer,
+            dealing_index,
+            chunk_index,
+        };
+
+        self.query_dkg_contract(request).await
+    }
+
+    async fn get_dealing_chunk(
+        &self,
+        epoch_id: EpochId,
+        dealer: String,
+        dealing_index: DealingIndex,
+        chunk_index: ChunkIndex,
+    ) -> Result<DealingChunkResponse, NyxdError> {
+        let request = DkgQueryMsg::GetDealingChunk {
+            epoch_id,
+            dealer,
+            dealing_index,
+            chunk_index,
+        };
+
+        self.query_dkg_contract(request).await
+    }
+
+    async fn get_vk_share(
+        &self,
+        epoch_id: EpochId,
+        owner: String,
+    ) -> Result<VkShareResponse, NyxdError> {
+        let request = DkgQueryMsg::GetVerificationKey { epoch_id, owner };
        self.query_dkg_contract(request).await
    }

@@ -91,6 +174,11 @@ pub trait DkgQueryClient {
        };
        self.query_dkg_contract(request).await
    }
+
+    async fn get_contract_cw2_version(&self) -> Result<cw2::ContractVersion, NyxdError> {
+        self.query_dkg_contract(DkgQueryMsg::GetCW2ContractVersion {})
+            .await
+    }
 }

 // extension trait to the query client to deal with the paged queries
@@ -106,10 +194,6 @@ pub trait PagedDkgQueryClient: DkgQueryClient {
        collect_paged!(self, get_past_dealers_paged, dealers)
    }

-    async fn get_all_epoch_dealings(&self, idx: u64) -> Result<Vec<ContractDealing>, NyxdError> {
-        collect_paged!(self, get_dealings_paged, dealings, idx)
-    }
-
    async fn get_all_verification_key_shares(
        &self,
        epoch_id: EpochId,
@@ -143,6 +227,7 @@ where
 mod tests {
    use super::*;
    use crate::nyxd::contract_traits::tests::IgnoreValue;
+    use nym_coconut_dkg_common::msg::QueryMsg;

    // it's enough that this compiles and clippy is happy about it
    #[allow(dead_code)]
@@ -151,6 +236,7 @@ mod tests {
        msg: DkgQueryMsg,
    ) {
        match msg {
+            DkgQueryMsg::GetState {} => client.get_state().ignore(),
            DkgQueryMsg::GetCurrentEpochState {} => client.get_current_epoch().ignore(),
            DkgQueryMsg::GetCurrentEpochThreshold {} => {
                client.get_current_epoch_threshold().ignore()
@@ -165,11 +251,42 @@ mod tests {
            DkgQueryMsg::GetPastDealers { limit, start_after } => {
                client.get_past_dealers_paged(start_after, limit).ignore()
            }
-            DkgQueryMsg::GetDealing {
-                idx,
-                limit,
-                start_after,
-            } => client.get_dealings_paged(idx, start_after, limit).ignore(),
+            DkgQueryMsg::GetDealingStatus {
+                epoch_id,
+                dealer,
+                dealing_index,
+            } => client
+                .get_dealing_status(epoch_id, dealer, dealing_index)
+                .ignore(),
+            DkgQueryMsg::GetDealingsMetadata {
+                epoch_id,
+                dealer,
+                dealing_index,
+            } => client
+                .get_dealings_metadata(epoch_id, dealer, dealing_index)
+                .ignore(),
+            QueryMsg::GetDealerDealingsStatus { epoch_id, dealer } => {
+                client.get_dealer_dealings_status(epoch_id, dealer).ignore()
+            }
+            DkgQueryMsg::GetDealingChunkStatus {
+                epoch_id,
+                dealer,
+                dealing_index,
+                chunk_index,
+            } => client
+                .get_dealing_chunk_status(epoch_id, dealer, dealing_index, chunk_index)
+                .ignore(),
+            DkgQueryMsg::GetDealingChunk {
+                epoch_id,
+                dealer,
+                dealing_index,
+                chunk_index,
+            } => client
+                .get_dealing_chunk(epoch_id, dealer, dealing_index, chunk_index)
+                .ignore(),
+            DkgQueryMsg::GetVerificationKey { epoch_id, owner } => {
+                client.get_vk_share(epoch_id, owner).ignore()
+            }
            DkgQueryMsg::GetVerificationKeys {
                epoch_id,
                limit,
@@ -177,6 +294,7 @@ mod tests {
            } => client
                .get_vk_shares_paged(epoch_id, start_after, limit)
                .ignore(),
+            DkgQueryMsg::GetCW2ContractVersion {} => client.get_contract_cw2_version().ignore(),
        };
    }
 }
@@ -8,11 +8,11 @@ use crate::nyxd::{Coin, Fee, SigningCosmWasmClient};
 use crate::signing::signer::OfflineSigner;
 use async_trait::async_trait;
 use cosmrs::AccountId;
-use cosmwasm_std::Addr;
+use nym_coconut_dkg_common::dealing::{DealingChunkInfo, PartialContractDealing};
 use nym_coconut_dkg_common::msg::ExecuteMsg as DkgExecuteMsg;
-use nym_coconut_dkg_common::types::EncodedBTEPublicKeyWithProof;
+use nym_coconut_dkg_common::types::{DealingIndex, EncodedBTEPublicKeyWithProof};
 use nym_coconut_dkg_common::verification_key::VerificationKeyShare;
-use nym_contracts_common::dealings::ContractSafeBytes;
+use nym_contracts_common::IdentityKey;

 #[cfg_attr(target_arch = "wasm32", async_trait(?Send))]
 #[cfg_attr(not(target_arch = "wasm32"), async_trait)]
@@ -25,6 +25,13 @@ pub trait DkgSigningClient {
        funds: Vec<Coin>,
    ) -> Result<ExecuteResult, NyxdError>;

+    async fn initiate_dkg(&self, fee: Option<Fee>) -> Result<ExecuteResult, NyxdError> {
+        let req = DkgExecuteMsg::InitiateDkg {};
+
+        self.execute_dkg_contract(fee, req, "initiating the DKG".to_string(), vec![])
+            .await
+    }
+
    async fn advance_dkg_epoch_state(&self, fee: Option<Fee>) -> Result<ExecuteResult, NyxdError> {
        let req = DkgExecuteMsg::AdvanceEpochState {};

@@ -42,12 +49,14 @@ pub trait DkgSigningClient {
    async fn register_dealer(
        &self,
        bte_key: EncodedBTEPublicKeyWithProof,
+        identity_key: IdentityKey,
        announce_address: String,
        resharing: bool,
        fee: Option<Fee>,
    ) -> Result<ExecuteResult, NyxdError> {
        let req = DkgExecuteMsg::RegisterDealer {
            bte_key_with_proof: bte_key,
+            identity_key,
            announce_address,
            resharing,
        };
@@ -56,18 +65,32 @@ pub trait DkgSigningClient {
            .await
    }

-    async fn submit_dealing_bytes(
+    async fn submit_dealing_metadata(
        &self,
-        dealing_bytes: ContractSafeBytes,
+        dealing_index: DealingIndex,
+        chunks: Vec<DealingChunkInfo>,
        resharing: bool,
        fee: Option<Fee>,
    ) -> Result<ExecuteResult, NyxdError> {
-        let req = DkgExecuteMsg::CommitDealing {
-            dealing_bytes,
+        let req = DkgExecuteMsg::CommitDealingsMetadata {
+            dealing_index,
+            chunks,
            resharing,
        };

-        self.execute_dkg_contract(fee, req, "dealing commitment".to_string(), vec![])
+        self.execute_dkg_contract(fee, req, "dealing metadata commitment".to_string(), vec![])
+            .await
+    }
+
+    async fn submit_dealing_chunk(
+        &self,
+        chunk: PartialContractDealing,
+        resharing: bool,
+        fee: Option<Fee>,
+    ) -> Result<ExecuteResult, NyxdError> {
+        let req = DkgExecuteMsg::CommitDealingsChunk { chunk, resharing };
+
+        self.execute_dkg_contract(fee, req, "dealing chunk commitment".to_string(), vec![])
            .await
    }

@@ -94,9 +117,10 @@ pub trait DkgSigningClient {
        resharing: bool,
        fee: Option<Fee>,
    ) -> Result<ExecuteResult, NyxdError> {
-        // the call to unchecked is fine as we're converting from pre-validated `AccountId`
-        let owner = Addr::unchecked(owner.to_string());
-        let req = DkgExecuteMsg::VerifyVerificationKeyShare { owner, resharing };
+        let req = DkgExecuteMsg::VerifyVerificationKeyShare {
+            owner: owner.to_string(),
+            resharing,
+        };

        self.execute_dkg_contract(
            fee,
@@ -146,28 +170,36 @@ mod tests {
        msg: DkgExecuteMsg,
    ) {
        match msg {
+            DkgExecuteMsg::InitiateDkg {} => client.initiate_dkg(None).ignore(),
            DkgExecuteMsg::RegisterDealer {
                bte_key_with_proof,
+                identity_key,
                announce_address,
                resharing,
            } => client
-                .register_dealer(bte_key_with_proof, announce_address, resharing, None)
+                .register_dealer(
+                    bte_key_with_proof,
+                    identity_key,
+                    announce_address,
+                    resharing,
+                    None,
+                )
                .ignore(),
-            DkgExecuteMsg::CommitDealing {
-                dealing_bytes,
+            DkgExecuteMsg::CommitDealingsMetadata {
+                dealing_index,
+                chunks,
                resharing,
            } => client
-                .submit_dealing_bytes(dealing_bytes, resharing, None)
+                .submit_dealing_metadata(dealing_index, chunks, resharing, None)
                .ignore(),
+            DkgExecuteMsg::CommitDealingsChunk { chunk, resharing } => {
+                client.submit_dealing_chunk(chunk, resharing, None).ignore()
+            }
            DkgExecuteMsg::CommitVerificationKeyShare { share, resharing } => client
                .submit_verification_key_share(share, resharing, None)
                .ignore(),
            DkgExecuteMsg::VerifyVerificationKeyShare { owner, resharing } => client
-                .verify_verification_key_share(
-                    &owner.into_string().parse().unwrap(),
-                    resharing,
-                    None,
-                )
+                .verify_verification_key_share(&owner.parse().unwrap(), resharing, None)
                .ignore(),
            DkgExecuteMsg::SurpassedThreshold {} => client.surpass_threshold(None).ignore(),
            DkgExecuteMsg::AdvanceEpochState {} => client.advance_dkg_epoch_state(None).ignore(),
@@ -8,26 +8,26 @@ use std::str::FromStr;
 // TODO: all of those could/should be derived via a macro

 // query clients
-mod coconut_bandwidth_query_client;
-mod dkg_query_client;
-mod ephemera_query_client;
-mod group_query_client;
-mod mixnet_query_client;
-mod multisig_query_client;
-mod name_service_query_client;
-mod sp_directory_query_client;
-mod vesting_query_client;
+pub mod coconut_bandwidth_query_client;
+pub mod dkg_query_client;
+pub mod ephemera_query_client;
+pub mod group_query_client;
+pub mod mixnet_query_client;
+pub mod multisig_query_client;
+pub mod name_service_query_client;
+pub mod sp_directory_query_client;
+pub mod vesting_query_client;

 // signing clients
-mod coconut_bandwidth_signing_client;
-mod dkg_signing_client;
-mod ephemera_signing_client;
-mod group_signing_client;
-mod mixnet_signing_client;
-mod multisig_signing_client;
-mod name_service_signing_client;
-mod sp_directory_signing_client;
-mod vesting_signing_client;
+pub mod coconut_bandwidth_signing_client;
+pub mod dkg_signing_client;
+pub mod ephemera_signing_client;
+pub mod group_signing_client;
+pub mod mixnet_signing_client;
+pub mod multisig_signing_client;
+pub mod name_service_signing_client;
+pub mod sp_directory_signing_client;
+pub mod vesting_signing_client;

 // re-export query traits
 pub use coconut_bandwidth_query_client::{
@@ -16,7 +16,6 @@ use crate::signing::tx_signer::TxSigner;
 use crate::signing::AccountData;
 use crate::{DirectSigningReqwestRpcNyxdClient, QueryReqwestRpcNyxdClient, ReqwestRpcClient};
 use async_trait::async_trait;
-use cosmrs::cosmwasm;
 use cosmrs::tendermint::{abci, evidence::Evidence, Genesis};
 use cosmrs::tx::{Raw, SignDoc};
 use cosmwasm_std::Addr;
@@ -40,7 +39,7 @@ pub use crate::rpc::TendermintRpcClient;
 pub use coin::Coin;
 pub use cosmrs::{
    bank::MsgSend,
-    bip32,
+    bip32, cosmwasm,
    crypto::PublicKey,
    query::{PageRequest, PageResponse},
    tendermint::{
@@ -14,7 +14,7 @@ pub use nym_coconut::{
    aggregate_signature_shares, aggregate_verification_keys, blind_sign, hash_to_scalar,
    prepare_blind_sign, prove_bandwidth_credential, Attribute, Base58, BlindSignRequest,
    BlindedSignature, Bytable, CoconutError, KeyPair, Parameters, PrivateAttribute,
-    PublicAttribute, Signature, SignatureShare, Theta, VerificationKey,
+    PublicAttribute, SecretKey, Signature, SignatureShare, Theta, VerificationKey,
 };

 #[derive(Debug, Serialize, Deserialize, Getters, CopyGetters, Clone, PartialEq, Eq)]
@@ -13,9 +13,11 @@ bs58 = "0.4"
 comfy-table = "6.0.0"
 cfg-if = "1.0.0"
 clap = { workspace = true, features = ["derive"] }
+csv = "1.3.0"
 cw-utils = { workspace = true }
 handlebars = "3.0.1"
 humantime-serde = "1.0"
+inquire = "0.6.2"
 k256 = { workspace = true, features = ["ecdsa", "sha256"] }
 log = { workspace = true }
 rand = {version = "0.6", features = ["std"] }
@@ -0,0 +1,4 @@
+n1q85lscptz860j3dx92f8phaeaw08j2l5dt7adq,50,nym
+n136ckky0n39eskewg04xhvahq9yp9f7sgtnxytt,50,unym
+n1xh7ru0zp67czxhvx0r5e8ur7rvg6n3ymmje0ju,50,nyx
+n13mpm4aj03alffnvz2x9ynjy4u3cxemxn2xw34w,50,unyx
@@ -1,4 +1,4 @@
-// Copyright 2021 - Nym Technologies SA <contact@nymtech.net>
+// Copyright 2023 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0

 use clap::{Args, Subcommand};
@@ -7,6 +7,7 @@ pub mod balance;
 pub mod create;
 pub mod pubkey;
 pub mod send;
+pub mod send_multiple;

 #[derive(Debug, Args)]
 #[clap(args_conflicts_with_subcommands = true, subcommand_required = true)]
@@ -25,4 +26,6 @@ pub enum AccountCommands {
    PubKey(crate::validator::account::pubkey::Args),
    /// Sends tokens to another account
    Send(crate::validator::account::send::Args),
+    /// Batch multiple token sends
+    SendMultiple(crate::validator::account::send_multiple::Args),
 }
@@ -0,0 +1,216 @@
+// Copyright 2023 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::context::SigningClient;
+use crate::utils::pretty_coin;
+use clap::Parser;
+use comfy_table::Table;
+use cosmrs::rpc::endpoint::tx::Response;
+use log::{error, info};
+use nym_validator_client::nyxd::{AccountId, Coin};
+use serde_json::json;
+use std::str::FromStr;
+use std::{fs, io::Write};
+
+#[derive(Debug, Parser)]
+pub struct Args {
+    #[clap(long)]
+    pub memo: Option<String>,
+
+    #[clap(
+        long,
+        help = "Input file path (CSV format) with account/amount pairs to send"
+    )]
+    pub input: String,
+
+    #[clap(
+        long,
+        help = "An output file path (CSV format) to create or append a log of results to"
+    )]
+    pub output: Option<String>,
+}
+
+pub async fn send_multiple(args: Args, client: &SigningClient) {
+    let memo = args
+        .memo
+        .unwrap_or_else(|| "Sending tokens with nym-cli".to_owned());
+
+    let rows = InputFileReader::new(&args.input);
+    if let Err(e) = rows {
+        error!("Failed to read input file: {}", e);
+        return;
+    }
+    let rows = rows.unwrap();
+
+    let mut table = Table::new();
+
+    if rows.rows.is_empty() {
+        error!("No transactions to send");
+        return;
+    }
+
+    println!(
+        "The following transfer will be made from account {} to:",
+        client.address()
+    );
+    table.set_header(vec!["Address", "Amount"]);
+
+    for row in rows.rows.iter() {
+        table.add_row(vec![row.address.to_string(), pretty_coin(&row.amount)]);
+    }
+
+    println!("{table}");
+
+    let ans = inquire::Confirm::new("Do you want to continue with the transfers?")
+        .with_default(false)
+        .with_help_message("You must confirm before the transaction will be sent")
+        .prompt();
+
+    if let Err(e) = ans {
+        info!("Aborting, {}...", e);
+        return;
+    }
+    if let Ok(false) = ans {
+        info!("Aborting!");
+        return;
+    }
+
+    info!("Transferring from {}...", client.address());
+
+    let multiple_sends: Vec<(AccountId, Vec<Coin>)> = rows
+        .rows
+        .iter()
+        .map(|row| (row.address.clone(), vec![row.amount.clone()]))
+        .collect();
+
+    let res = client
+        .send_multiple(multiple_sends, memo, None)
+        .await
+        .expect("failed to send tokens!");
+
+    info!("Sending result: {}", json!(res));
+
+    println!();
+    println!(
+        "Nodesguru: https://nym.explorers.guru/transaction/{}",
+        &res.hash
+    );
+    println!("Mintscan: https://www.mintscan.io/nyx/txs/{}", &res.hash);
+    println!("Transaction result code: {}", &res.tx_result.code.value());
+    println!("Transaction hash: {}", &res.hash);
+
+    if let Some(output_filename) = args.output {
+        println!("\nWriting output log to {}", output_filename);
+
+        if let Err(e) = write_output_file(rows, res, &output_filename) {
+            error!(
+                "Failed to write output file {} with error {}",
+                output_filename, e
+            );
+        }
+    }
+}
+
+fn write_output_file(
+    rows: InputFileReader,
+    res: Response,
+    output_filename: &String,
+) -> Result<(), anyhow::Error> {
+    let mut file = fs::OpenOptions::new()
+        .create(true)
+        .append(true)
+        .open(output_filename)?;
+
+    let now = time::OffsetDateTime::now_utc();
+    let now = now.format(&time::format_description::well_known::Rfc3339)?;
+
+    let data = rows
+        .rows
+        .iter()
+        .map(|row| {
+            format!(
+                "{},{},{},{},{}",
+                row.address, row.amount.amount, row.amount.denom, now, res.hash
+            )
+        })
+        .collect::<Vec<String>>()
+        .join("\n");
+
+    Ok(file.write_all(format!("{}\n", data).as_bytes())?)
+}
+
+#[derive(Debug)]
+pub struct InputFileRow {
+    pub address: AccountId,
+    pub amount: Coin,
+}
+
+pub struct InputFileReader {
+    pub rows: Vec<InputFileRow>,
+}
+
+impl InputFileReader {
+    pub fn new(path: &str) -> Result<InputFileReader, anyhow::Error> {
+        let mut rows: Vec<InputFileRow> = vec![];
+        let file_contents = fs::read_to_string(path)?;
+
+        let lines: Vec<String> = file_contents.lines().map(String::from).collect();
+        for line in lines {
+            let tokens: Vec<_> = line.split(',').collect();
+            if tokens.len() < 3 {
+                return Err(anyhow::anyhow!(
+                    "'{}' does not have enough columns, expecting <address>,<amount>,<denom>",
+                    line
+                ));
+            }
+            // try parse amount to u128
+            let amount = u128::from_str(tokens[1])
+                .map_err(|_| anyhow::anyhow!("'{}' has an invalid amount", line))?;
+
+            let denom: String = tokens[2].into();
+
+            // multiply when a whole token amount, e.g. 50nym (50.123456nym is not allowed, that must be input as 50123456unym)
+            let (amount, denom) = if !denom.starts_with('u') {
+                (amount * 1_000_000u128, format!("u{}", denom))
+            } else {
+                (amount, denom)
+            };
+
+            let address = AccountId::from_str(tokens[0])
+                .map_err(|e| anyhow::anyhow!("'{}' has an invalid address: {}", line, e))?;
+
+            let amount = Coin { amount, denom };
+
+            rows.push(InputFileRow { address, amount })
+        }
+
+        Ok(InputFileReader { rows })
+    }
+}
+
+#[cfg(test)]
+mod test_multiple_send_input_csv {
+    use super::*;
+    use nym_validator_client::nyxd::AccountId;
+    use std::str::FromStr;
+    #[test]
+    fn works_on_happy_path() {
+        let input_csv = InputFileReader::new("fixtures/test_send_multiple.csv").unwrap();
+        assert_eq!(
+            AccountId::from_str("n1q85lscptz860j3dx92f8phaeaw08j2l5dt7adq").unwrap(),
+            input_csv.rows[0].address
+        );
+
+        println!("{:?}", input_csv.rows);
+
+        assert_eq!(50_000_000u128, input_csv.rows[0].amount.amount);
+        assert_eq!(50u128, input_csv.rows[1].amount.amount);
+        assert_eq!(50_000_000u128, input_csv.rows[2].amount.amount);
+        assert_eq!(50u128, input_csv.rows[3].amount.amount);
+
+        assert_eq!("unym", input_csv.rows[0].amount.denom);
+        assert_eq!("unym", input_csv.rows[1].amount.denom);
+        assert_eq!("unyx", input_csv.rows[2].amount.denom);
+        assert_eq!("unyx", input_csv.rows[3].amount.denom);
+    }
+}
@@ -3,6 +3,7 @@

 use clap::Parser;
 use log::{debug, info};
+use nym_coconut_dkg_common::dealing::DEFAULT_DEALINGS;
 use std::str::FromStr;

 use nym_coconut_dkg_common::msg::InstantiateMsg;
@@ -93,6 +94,7 @@ pub async fn generate(args: Args) {
        multisig_addr: multisig_addr.to_string(),
        time_configuration: Some(time_configuration),
        mix_denom,
+        key_size: DEFAULT_DEALINGS as u32,
    };

    debug!("instantiate_msg: {:?}", instantiate_msg);
@@ -10,6 +10,8 @@ license.workspace = true
 cosmwasm-schema = { workspace = true }
 cosmwasm-std = { workspace = true }
 cw-utils = { workspace = true }
+cw2 = { workspace = true }
+cw4 = { workspace = true }

 contracts-common = { path = "../contracts-common", package = "nym-contracts-common" }
 nym-multisig-contract-common = { path = "../multisig-contract" }
@@ -1,7 +1,7 @@
 // Copyright 2022 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0

-use crate::types::{ContractSafeBytes, EncodedBTEPublicKeyWithProof, NodeIndex};
+use crate::types::{EncodedBTEPublicKeyWithProof, NodeIndex};
 use cosmwasm_schema::cw_serde;
 use cosmwasm_std::Addr;

@@ -9,6 +9,7 @@ use cosmwasm_std::Addr;
 pub struct DealerDetails {
    pub address: Addr,
    pub bte_public_key_with_proof: EncodedBTEPublicKeyWithProof,
+    pub ed25519_identity: String,
    pub announce_address: String,
    pub assigned_index: NodeIndex,
 }
@@ -64,38 +65,3 @@ impl PagedDealerResponse {
        }
    }
 }
-
-#[cw_serde]
-pub struct ContractDealing {
-    pub dealing: ContractSafeBytes,
-    pub dealer: Addr,
-}
-
-impl ContractDealing {
-    pub fn new(dealing: ContractSafeBytes, dealer: Addr) -> Self {
-        ContractDealing { dealing, dealer }
-    }
-}
-
-#[cw_serde]
-pub struct PagedDealingsResponse {
-    pub dealings: Vec<ContractDealing>,
-    pub per_page: usize,
-
-    /// Field indicating paging information for the following queries if the caller wishes to get further entries.
-    pub start_next_after: Option<Addr>,
-}
-
-impl PagedDealingsResponse {
-    pub fn new(
-        dealings: Vec<ContractDealing>,
-        per_page: usize,
-        start_next_after: Option<Addr>,
-    ) -> Self {
-        PagedDealingsResponse {
-            dealings,
-            per_page,
-            start_next_after,
-        }
-    }
-}
@@ -0,0 +1,290 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::types::{ChunkIndex, DealingIndex, EpochId, PartialContractDealingData};
+use contracts_common::dealings::ContractSafeBytes;
+use cosmwasm_schema::cw_serde;
+use cosmwasm_std::Addr;
+use std::collections::{BTreeMap, HashMap};
+
+/// Defines the maximum size of a dealing chunk. Currently set to 2kB
+pub const MAX_DEALING_CHUNK_SIZE: usize = 2048;
+
+/// Defines the maximum size of a full dealing.
+/// Currently set to 100kB (which is enough for a dealing created for 100 parties)
+pub const MAX_DEALING_SIZE: usize = 102400;
+
+pub const MAX_DEALING_CHUNKS: usize = MAX_DEALING_SIZE / MAX_DEALING_CHUNK_SIZE;
+
+// 2 public attributes, 2 private attributes, 1 fixed for coconut credential
+pub const DEFAULT_DEALINGS: usize = 2 + 2 + 1;
+
+pub fn chunk_dealing(
+    dealing_index: DealingIndex,
+    dealing_bytes: Vec<u8>,
+    chunk_size: usize,
+) -> HashMap<ChunkIndex, PartialContractDealing> {
+    let mut chunks = HashMap::new();
+    for (chunk_index, chunk) in dealing_bytes.chunks(chunk_size).enumerate() {
+        let chunk = PartialContractDealing {
+            dealing_index,
+            chunk_index: chunk_index as ChunkIndex,
+            data: ContractSafeBytes(chunk.to_vec()),
+        };
+        chunks.insert(chunk_index as ChunkIndex, chunk);
+    }
+
+    chunks
+}
+
+#[cw_serde]
+#[derive(Copy)]
+pub struct DealingChunkInfo {
+    pub size: u64,
+}
+
+impl DealingChunkInfo {
+    pub fn new(size: usize) -> Self {
+        DealingChunkInfo { size: size as u64 }
+    }
+
+    pub fn construct(dealing_len: usize, chunk_size: usize) -> Vec<Self> {
+        let (full_chunks, overflow) = (dealing_len / chunk_size, dealing_len % chunk_size);
+
+        let mut chunks = Vec::new();
+        for _ in 0..full_chunks {
+            chunks.push(DealingChunkInfo::new(chunk_size));
+        }
+
+        if overflow != 0 {
+            chunks.push(DealingChunkInfo::new(overflow));
+        }
+
+        chunks
+    }
+}
+
+#[cw_serde]
+#[derive(Copy)]
+pub struct SubmittedChunk {
+    pub info: DealingChunkInfo,
+
+    pub status: ChunkSubmissionStatus,
+}
+
+#[cw_serde]
+#[derive(Default, Copy)]
+pub struct ChunkSubmissionStatus {
+    // this field is updated by the contract itself to indicate when this particular chunk has been received
+    pub submission_height: Option<u64>,
+}
+
+impl ChunkSubmissionStatus {
+    pub fn submitted(&self) -> bool {
+        self.submission_height.is_some()
+    }
+}
+
+impl From<DealingChunkInfo> for SubmittedChunk {
+    fn from(value: DealingChunkInfo) -> Self {
+        SubmittedChunk::new(value)
+    }
+}
+
+impl SubmittedChunk {
+    pub fn new(info: DealingChunkInfo) -> Self {
+        SubmittedChunk {
+            info,
+            status: Default::default(),
+        }
+    }
+
+    pub fn submitted(&self) -> bool {
+        self.status.submitted()
+    }
+}
+
+#[cw_serde]
+pub struct DealingMetadata {
+    pub dealing_index: DealingIndex,
+
+    pub submitted_chunks: BTreeMap<ChunkIndex, SubmittedChunk>,
+}
+
+impl DealingMetadata {
+    pub fn new(dealing_index: DealingIndex, chunks: Vec<DealingChunkInfo>) -> Self {
+        DealingMetadata {
+            dealing_index,
+            submitted_chunks: chunks
+                .into_iter()
+                .enumerate()
+                .map(|(id, chunk)| (id as ChunkIndex, chunk.into()))
+                .collect(),
+        }
+    }
+
+    pub fn is_complete(&self) -> bool {
+        self.submitted_chunks.values().all(|c| c.submitted())
+    }
+
+    pub fn total_size(&self) -> usize {
+        self.submitted_chunks
+            .values()
+            .map(|c| c.info.size as usize)
+            .sum()
+    }
+
+    pub fn submission_statuses(&self) -> BTreeMap<ChunkIndex, ChunkSubmissionStatus> {
+        self.submitted_chunks
+            .iter()
+            .map(|(id, c)| (*id, c.status))
+            .collect()
+    }
+}
+
+#[cw_serde]
+pub struct PartialContractDealing {
+    pub dealing_index: DealingIndex,
+    pub chunk_index: ChunkIndex,
+    pub data: PartialContractDealingData,
+}
+
+impl PartialContractDealing {
+    pub fn new(
+        dealing_index: DealingIndex,
+        chunk_index: ChunkIndex,
+        data: PartialContractDealingData,
+    ) -> Self {
+        PartialContractDealing {
+            dealing_index,
+            chunk_index,
+            data,
+        }
+    }
+}
+
+#[cw_serde]
+pub struct DealingMetadataResponse {
+    pub epoch_id: EpochId,
+
+    pub dealer: Addr,
+
+    pub dealing_index: DealingIndex,
+
+    pub metadata: Option<DealingMetadata>,
+}
+
+#[cw_serde]
+pub struct DealingChunkResponse {
+    pub epoch_id: EpochId,
+
+    pub dealer: Addr,
+
+    pub dealing_index: DealingIndex,
+
+    pub chunk_index: ChunkIndex,
+
+    pub chunk: Option<PartialContractDealingData>,
+}
+
+#[cw_serde]
+pub struct DealingChunkStatusResponse {
+    pub epoch_id: EpochId,
+
+    pub dealer: Addr,
+
+    pub dealing_index: DealingIndex,
+
+    pub chunk_index: ChunkIndex,
+
+    pub status: ChunkSubmissionStatus,
+}
+
+#[cw_serde]
+pub struct DealingStatusResponse {
+    pub epoch_id: EpochId,
+
+    pub dealer: Addr,
+
+    pub dealing_index: DealingIndex,
+
+    pub status: DealingStatus,
+}
+
+#[cw_serde]
+pub struct DealingStatus {
+    pub has_metadata: bool,
+
+    pub fully_submitted: bool,
+
+    pub chunk_submission_status: BTreeMap<ChunkIndex, ChunkSubmissionStatus>,
+}
+
+impl From<Option<DealingMetadata>> for DealingStatus {
+    fn from(metadata: Option<DealingMetadata>) -> Self {
+        DealingStatus {
+            has_metadata: metadata.is_some(),
+            fully_submitted: metadata
+                .as_ref()
+                .map(|m| m.is_complete())
+                .unwrap_or_default(),
+            chunk_submission_status: metadata
+                .map(|m| m.submission_statuses())
+                .unwrap_or_default(),
+        }
+    }
+}
+
+#[cw_serde]
+pub struct DealerDealingsStatusResponse {
+    pub epoch_id: EpochId,
+
+    pub dealer: Addr,
+
+    pub all_dealings_fully_submitted: bool,
+
+    pub dealing_submission_status: BTreeMap<DealingIndex, DealingStatus>,
+}
+
+impl DealerDealingsStatusResponse {
+    pub fn full_dealings(&self) -> usize {
+        self.dealing_submission_status
+            .values()
+            .filter(|s| s.fully_submitted)
+            .count()
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn chunking_dealings() {
+        const CHUNK_SIZE: usize = 512;
+
+        let test_cases = [
+            (CHUNK_SIZE - 10, CHUNK_SIZE, 1),
+            (CHUNK_SIZE, CHUNK_SIZE, 1),
+            (CHUNK_SIZE + 10, CHUNK_SIZE, 2),
+            (CHUNK_SIZE * 2, CHUNK_SIZE, 2),
+            (CHUNK_SIZE * 2 + 1, CHUNK_SIZE, 3),
+            (CHUNK_SIZE * 10 + 42, CHUNK_SIZE, 11),
+        ];
+
+        for (dealing_len, chunk_size, expected_chunks) in test_cases {
+            let chunks = DealingChunkInfo::construct(dealing_len, chunk_size);
+            assert_eq!(expected_chunks, chunks.len());
+            assert_eq!(
+                dealing_len as u64,
+                chunks.iter().map(|c| c.size).sum::<u64>()
+            );
+
+            let mut expected_last = dealing_len % chunk_size;
+            if expected_last == 0 {
+                expected_last = chunk_size;
+            }
+            assert_eq!(chunks.last().unwrap().size, expected_last as u64);
+        }
+    }
+}
@@ -1,4 +1,8 @@
+// Copyright 2022-2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
 pub mod dealer;
+pub mod dealing;
 pub mod event_attributes;
 pub mod msg;
 pub mod types;
@@ -1,16 +1,23 @@
-// Copyright 2021 - Nym Technologies SA <contact@nymtech.net>
+// Copyright 2022-2024 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0

-use crate::types::{ContractSafeBytes, EncodedBTEPublicKeyWithProof, EpochId, TimeConfiguration};
+use crate::dealing::{DealingChunkInfo, PartialContractDealing};
+use crate::types::{
+    ChunkIndex, DealingIndex, EncodedBTEPublicKeyWithProof, EpochId, TimeConfiguration,
+};
 use crate::verification_key::VerificationKeyShare;
+use contracts_common::IdentityKey;
 use cosmwasm_schema::cw_serde;
-use cosmwasm_std::Addr;

 #[cfg(feature = "schema")]
 use crate::{
-    dealer::{DealerDetailsResponse, PagedDealerResponse, PagedDealingsResponse},
-    types::{Epoch, InitialReplacementData},
-    verification_key::PagedVKSharesResponse,
+    dealer::{DealerDetailsResponse, PagedDealerResponse},
+    dealing::{
+        DealerDealingsStatusResponse, DealingChunkResponse, DealingChunkStatusResponse,
+        DealingMetadataResponse, DealingStatusResponse,
+    },
+    types::{Epoch, InitialReplacementData, State},
+    verification_key::{PagedVKSharesResponse, VkShareResponse},
 };
 #[cfg(feature = "schema")]
 use cosmwasm_schema::QueryResponses;
@@ -21,18 +28,31 @@ pub struct InstantiateMsg {
    pub multisig_addr: String,
    pub time_configuration: Option<TimeConfiguration>,
    pub mix_denom: String,
+
+    /// Specifies the number of elements in the derived keys
+    pub key_size: u32,
 }

 #[cw_serde]
 pub enum ExecuteMsg {
+    // we could have just re-used AdvanceEpochState, but imo an explicit message is better
+    InitiateDkg {},
+
    RegisterDealer {
        bte_key_with_proof: EncodedBTEPublicKeyWithProof,
+        identity_key: IdentityKey,
        announce_address: String,
        resharing: bool,
    },

-    CommitDealing {
-        dealing_bytes: ContractSafeBytes,
+    CommitDealingsMetadata {
+        dealing_index: DealingIndex,
+        chunks: Vec<DealingChunkInfo>,
+        resharing: bool,
+    },
+
+    CommitDealingsChunk {
+        chunk: PartialContractDealing,
        resharing: bool,
    },

@@ -42,8 +62,7 @@ pub enum ExecuteMsg {
    },

    VerifyVerificationKeyShare {
-        // TODO: this should be using a String...
-        owner: Addr,
+        owner: String,
        resharing: bool,
    },

@@ -55,6 +74,9 @@ pub enum ExecuteMsg {
 #[cw_serde]
 #[cfg_attr(feature = "schema", derive(QueryResponses))]
 pub enum QueryMsg {
+    #[cfg_attr(feature = "schema", returns(State))]
+    GetState {},
+
    #[cfg_attr(feature = "schema", returns(Epoch))]
    GetCurrentEpochState {},

@@ -79,19 +101,53 @@ pub enum QueryMsg {
        start_after: Option<String>,
    },

-    #[cfg_attr(feature = "schema", returns(PagedDealingsResponse))]
-    GetDealing {
-        idx: u64,
-        limit: Option<u32>,
-        start_after: Option<String>,
+    #[cfg_attr(feature = "schema", returns(DealingMetadataResponse))]
+    GetDealingsMetadata {
+        epoch_id: EpochId,
+        dealer: String,
+        dealing_index: DealingIndex,
    },

+    #[cfg_attr(feature = "schema", returns(DealerDealingsStatusResponse))]
+    GetDealerDealingsStatus { epoch_id: EpochId, dealer: String },
+
+    #[cfg_attr(feature = "schema", returns(DealingStatusResponse))]
+    GetDealingStatus {
+        epoch_id: EpochId,
+        dealer: String,
+        dealing_index: DealingIndex,
+    },
+
+    #[cfg_attr(feature = "schema", returns(DealingChunkStatusResponse))]
+    GetDealingChunkStatus {
+        epoch_id: EpochId,
+        dealer: String,
+        dealing_index: DealingIndex,
+        chunk_index: ChunkIndex,
+    },
+
+    #[cfg_attr(feature = "schema", returns(DealingChunkResponse))]
+    GetDealingChunk {
+        epoch_id: EpochId,
+        dealer: String,
+        dealing_index: DealingIndex,
+        chunk_index: ChunkIndex,
+    },
+
+    #[cfg_attr(feature = "schema", returns(VkShareResponse))]
+    GetVerificationKey { epoch_id: EpochId, owner: String },
+
    #[cfg_attr(feature = "schema", returns(PagedVKSharesResponse))]
    GetVerificationKeys {
        epoch_id: EpochId,
        limit: Option<u32>,
        start_after: Option<String>,
    },
+
+    /// Gets the stored contract version information that's required by the CW2 spec interface for migrations.
+    #[serde(rename = "get_cw2_contract_version")]
+    #[cfg_attr(feature = "schema", returns(cw2::ContractVersion))]
+    GetCW2ContractVersion {},
 }

 #[cw_serde]
@@ -8,14 +8,18 @@ use std::str::FromStr;
 pub use crate::dealer::{DealerDetails, PagedDealerResponse};
 pub use contracts_common::dealings::ContractSafeBytes;
 pub use cosmwasm_std::{Addr, Coin, Timestamp};
+pub use cw4::Cw4Contract;

 pub type EncodedBTEPublicKeyWithProof = String;
 pub type EncodedBTEPublicKeyWithProofRef<'a> = &'a str;
 pub type NodeIndex = u64;
 pub type EpochId = u64;
-
-// 2 public attributes, 2 private attributes, 1 fixed for coconut credential
-pub const TOTAL_DEALINGS: usize = 2 + 2 + 1;
+pub type DealingIndex = u32;
+// we really don't need to hold more data than that (even u8 would have been enough),
+// but explicitly make it different type than `DealingIndex` so type system would detect any
+// accidental misuses
+pub type ChunkIndex = u16;
+pub type PartialContractDealingData = ContractSafeBytes;

 #[cw_serde]
 pub struct InitialReplacementData {
@@ -73,13 +77,23 @@ impl Default for TimeConfiguration {
    }
 }

+#[cw_serde]
+pub struct State {
+    pub mix_denom: String,
+    pub multisig_addr: Addr,
+    pub group_addr: Cw4Contract,
+
+    /// Specifies the number of elements in the derived keys
+    pub key_size: u32,
+}
+
 #[cw_serde]
 #[derive(Copy, Default)]
 pub struct Epoch {
    pub state: EpochState,
    pub epoch_id: EpochId,
    pub time_configuration: TimeConfiguration,
-    pub finish_timestamp: Timestamp,
+    pub finish_timestamp: Option<Timestamp>,
 }

 impl Epoch {
@@ -90,36 +104,40 @@ impl Epoch {
        current_timestamp: Timestamp,
    ) -> Self {
        let duration = match state {
+            EpochState::WaitingInitialisation => None,
            EpochState::PublicKeySubmission { .. } => {
-                time_configuration.public_key_submission_time_secs
+                Some(time_configuration.public_key_submission_time_secs)
+            }
+            EpochState::DealingExchange { .. } => {
+                Some(time_configuration.dealing_exchange_time_secs)
            }
-            EpochState::DealingExchange { .. } => time_configuration.dealing_exchange_time_secs,
            EpochState::VerificationKeySubmission { .. } => {
-                time_configuration.verification_key_submission_time_secs
+                Some(time_configuration.verification_key_submission_time_secs)
            }
            EpochState::VerificationKeyValidation { .. } => {
-                time_configuration.verification_key_validation_time_secs
+                Some(time_configuration.verification_key_validation_time_secs)
            }
            EpochState::VerificationKeyFinalization { .. } => {
-                time_configuration.verification_key_finalization_time_secs
+                Some(time_configuration.verification_key_finalization_time_secs)
            }
-            EpochState::InProgress => time_configuration.in_progress_time_secs,
+            EpochState::InProgress => Some(time_configuration.in_progress_time_secs),
        };
        Epoch {
            state,
            epoch_id,
            time_configuration,
-            finish_timestamp: current_timestamp.plus_seconds(duration),
+            finish_timestamp: duration.map(|d| current_timestamp.plus_seconds(d)),
        }
    }

-    pub fn final_timestamp_secs(&self) -> u64 {
-        let mut finish = self.finish_timestamp.seconds();
+    pub fn final_timestamp_secs(&self) -> Option<u64> {
+        let mut finish = self.finish_timestamp?.seconds();
        let time_configuration = self.time_configuration;
        let mut curr_epoch_state = self.state;
        while let Some(state) = curr_epoch_state.next() {
            curr_epoch_state = state;
            let adding = match curr_epoch_state {
+                EpochState::WaitingInitialisation => return None,
                EpochState::PublicKeySubmission { .. } => {
                    time_configuration.public_key_submission_time_secs
                }
@@ -137,12 +155,13 @@ impl Epoch {
            };
            finish += adding;
        }
-        finish
+        Some(finish)
    }
 }

 // currently (it is still extremely likely to change, we might be able to get rid of verification key-related complaints),
 // the epoch can be in the following states (in order):
+// 0. WaitingInitialisation -> the contract has been instantiated, but awaits for the admin to kick off the process (group members might still be getting added)
 // 1. PublicKeySubmission -> potential dealers are submitting their BTE and ed25519 public keys to participate in dealing exchange
 // 2. DealingExchange -> the actual (off-chain) dealing exchange is happening
 // 3. ComplaintSubmission -> receivers submitting evidence of other dealers sending malformed data
@@ -156,6 +175,7 @@ impl Epoch {
 #[cw_serde]
 #[derive(Copy)]
 pub enum EpochState {
+    WaitingInitialisation,
    PublicKeySubmission { resharing: bool },
    DealingExchange { resharing: bool },
    VerificationKeySubmission { resharing: bool },
@@ -166,13 +186,14 @@ pub enum EpochState {

 impl Default for EpochState {
    fn default() -> Self {
-        Self::PublicKeySubmission { resharing: false }
+        Self::WaitingInitialisation
    }
 }

 impl Display for EpochState {
    fn fmt(&self, f: &mut Formatter<'_>) -> std::fmt::Result {
        match self {
+            EpochState::WaitingInitialisation => write!(f, "Waiting for initialisation"),
            EpochState::PublicKeySubmission { resharing } => {
                write!(f, "PublicKeySubmission (resharing: {resharing})")
            }
@@ -194,8 +215,13 @@ impl Display for EpochState {
 }

 impl EpochState {
+    pub fn first() -> Self {
+        EpochState::PublicKeySubmission { resharing: false }
+    }
+
    pub fn next(self) -> Option<Self> {
        match self {
+            EpochState::WaitingInitialisation => None,
            EpochState::PublicKeySubmission { resharing } => {
                Some(EpochState::DealingExchange { resharing })
            }
@@ -226,4 +252,8 @@ impl EpochState {
    pub fn is_final(&self) -> bool {
        *self == EpochState::InProgress
    }
+
+    pub fn is_in_progress(&self) -> bool {
+        matches!(self, EpochState::InProgress)
+    }
 }
@@ -20,6 +20,13 @@ pub struct ContractVKShare {
    pub verified: bool,
 }

+#[cw_serde]
+pub struct VkShareResponse {
+    pub owner: Addr,
+    pub epoch_id: EpochId,
+    pub share: Option<ContractVKShare>,
+}
+
 #[cw_serde]
 pub struct PagedVKSharesResponse {
    pub shares: Vec<ContractVKShare>,
@@ -36,7 +43,10 @@ pub fn to_cosmos_msg(
    multisig_addr: String,
    expiration_time: Timestamp,
 ) -> StdResult<CosmosMsg> {
-    let verify_vk_share_req = ExecuteMsg::VerifyVerificationKeyShare { owner, resharing };
+    let verify_vk_share_req = ExecuteMsg::VerifyVerificationKeyShare {
+        owner: owner.to_string(),
+        resharing,
+    };
    let verify_vk_share_msg = CosmosMsg::Wasm(WasmMsg::Execute {
        contract_addr: coconut_dkg_addr,
        msg: to_binary(&verify_vk_share_req)?,
@@ -57,7 +67,14 @@ pub fn to_cosmos_msg(
    Ok(msg)
 }

-pub fn owner_from_cosmos_msgs(msgs: &[CosmosMsg]) -> Option<Addr> {
+// DKG SAFETY:
+// each legit verification proposal will only contain a single execute msg,
+// if they have more than one, we can safely ignore it
+pub fn owner_from_cosmos_msgs(msgs: &[CosmosMsg]) -> Option<String> {
+    if msgs.len() != 1 {
+        return None;
+    }
+
    if let Some(CosmosMsg::Wasm(WasmMsg::Execute {
        contract_addr: _,
        msg,
@@ -1,17 +1,17 @@
-// Copyright 2022 - Nym Technologies SA <contact@nymtech.net>
+// Copyright 2022-2024 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0

 use schemars::JsonSchema;
 use serde::{Deserialize, Deserializer, Serialize, Serializer};
 use std::fmt::{Display, Formatter};
-use std::ops::Deref;
+use std::ops::{Deref, DerefMut};

 // some sane upper-bound size on byte sizes
 // currently set to 128 bytes
 pub const MAX_DISPLAY_SIZE: usize = 128;

-// TODO: if we are to use this for different types, it might make sense to introduce something like
-// CommitmentTypeId field on the below for distinguishing different ones. it would somehow become part of the trait
+// helps to transfer bytes between contract boundary to decrease amount of data sent accross
+// after it's put to `Binary`
 #[derive(Debug, Clone, Ord, PartialOrd, Eq, PartialEq, Hash, JsonSchema)]
 pub struct ContractSafeBytes(pub Vec<u8>);

@@ -23,6 +23,24 @@ impl Deref for ContractSafeBytes {
    }
 }

+impl DerefMut for ContractSafeBytes {
+    fn deref_mut(&mut self) -> &mut Self::Target {
+        &mut self.0
+    }
+}
+
+impl From<Vec<u8>> for ContractSafeBytes {
+    fn from(value: Vec<u8>) -> Self {
+        ContractSafeBytes(value)
+    }
+}
+
+impl<'a> From<&'a [u8]> for ContractSafeBytes {
+    fn from(value: &'a [u8]) -> Self {
+        value.to_vec().into()
+    }
+}
+
 impl Display for ContractSafeBytes {
    fn fmt(&self, f: &mut Formatter<'_>) -> std::fmt::Result {
        if !self.0.is_empty() {
@@ -5,7 +5,9 @@ use nym_bandwidth_controller::acquire::state::State;
 use nym_client_core::config::disk_persistence::CommonClientPaths;
 use nym_config::DEFAULT_DATA_DIR;
 use nym_credential_storage::persistent_storage::PersistentStorage;
-use nym_validator_client::nyxd::contract_traits::{CoconutBandwidthSigningClient, DkgQueryClient};
+use nym_validator_client::nyxd::contract_traits::{
+    dkg_query_client::EpochState, CoconutBandwidthSigningClient, DkgQueryClient,
+};
 use nym_validator_client::nyxd::Coin;
 use std::path::PathBuf;
 use std::process::exit;
@@ -87,21 +89,29 @@ where
            .duration_since(SystemTime::UNIX_EPOCH)
            .expect("the system clock is set to 01/01/1970 (or earlier)")
            .as_secs();
+
        if epoch.state.is_final() {
-            if current_timestamp_secs + SAFETY_BUFFER_SECS >= epoch.finish_timestamp.seconds() {
-                info!("In the next {} minute(s), a transition will take place in the coconut system. Deposits should be halted in this time for safety reasons.", SAFETY_BUFFER_SECS / 60);
-                exit(0);
+            if let Some(finish_timestamp) = epoch.finish_timestamp {
+                if current_timestamp_secs + SAFETY_BUFFER_SECS >= finish_timestamp.seconds() {
+                    info!("In the next {} minute(s), a transition will take place in the coconut system. Deposits should be halted in this time for safety reasons.", SAFETY_BUFFER_SECS / 60);
+                    exit(0);
+                }
            }

            break;
-        } else {
+        } else if let Some(final_timestamp) = epoch.final_timestamp_secs() {
            // Use 1 additional second to not start the next iteration immediately and spam get_current_epoch queries
-            let secs_until_final = epoch
-                .final_timestamp_secs()
-                .saturating_sub(current_timestamp_secs)
-                + 1;
+            let secs_until_final = final_timestamp.saturating_sub(current_timestamp_secs) + 1;
            info!("Approximately {} seconds until coconut is available. Sleeping until then. You can safely kill the process at any moment.", secs_until_final);
            tokio::time::sleep(Duration::from_secs(secs_until_final)).await;
+        } else if matches!(epoch.state, EpochState::WaitingInitialisation) {
+            info!("dkg hasn't been initialised yet and it is not known when it will be. Going to check again later");
+            tokio::time::sleep(Duration::from_secs(60 * 5)).await;
+        } else {
+            // this should never be the case since the only case where final timestamp is unknown is when it's waiting for initialisation,
+            // but let's guard ourselves against future changes
+            info!("it is unknown when coconut will be come available. Going to check again later");
+            tokio::time::sleep(Duration::from_secs(60 * 5)).await;
        }
    }

@@ -14,8 +14,7 @@ use std::collections::HashMap;
 use std::ops::Neg;
 use zeroize::Zeroize;

-#[derive(Debug)]
-#[cfg_attr(test, derive(Clone, PartialEq, Eq))]
+#[derive(Debug, Clone, PartialEq, Eq)]
 pub struct Ciphertexts {
    pub rr: [G1Projective; NUM_CHUNKS],
    pub ss: [G1Projective; NUM_CHUNKS],
@@ -53,8 +53,7 @@ impl PublicKey {
    }
 }

-#[derive(Clone, Debug)]
-#[cfg_attr(test, derive(PartialEq, Eq))]
+#[derive(Clone, Debug, PartialEq, Eq)]
 pub struct PublicKeyWithProof {
    pub(crate) key: PublicKey,
    pub(crate) proof: ProofOfDiscreteLog,
@@ -67,8 +67,7 @@ impl<'a> Instance<'a> {
    }
 }

-#[derive(Debug)]
-#[cfg_attr(test, derive(Clone, PartialEq, Eq))]
+#[derive(Debug, Clone, PartialEq, Eq)]
 pub struct ProofOfChunking {
    y0: G1Projective,
    bb: Vec<G1Projective>,
@@ -13,8 +13,7 @@ use zeroize::Zeroize;
 const DISCRETE_LOG_DOMAIN: &[u8] =
    b"NYM_COCONUT_NIDKG_V01_CS01_WITH_BLS12381_XMD:SHA-256_SSWU_RO_PROOF_DISCRETE_LOG";

-#[derive(Clone, Debug)]
-#[cfg_attr(test, derive(PartialEq, Eq))]
+#[derive(Clone, Debug, PartialEq, Eq)]
 pub struct ProofOfDiscreteLog {
    pub(crate) rand_commitment: G1Projective,
    pub(crate) response: Scalar,
@@ -76,8 +76,7 @@ impl<'a> Instance<'a> {
    }
 }

-#[derive(Debug)]
-#[cfg_attr(test, derive(Clone, PartialEq, Eq))]
+#[derive(Debug, Clone, PartialEq, Eq)]
 pub struct ProofOfSecretSharing {
    ff: G1Projective,
    aa: G2Projective,
@@ -82,8 +82,7 @@ impl RecoveredVerificationKeys {
    }
 }

-#[derive(Debug)]
-#[cfg_attr(test, derive(PartialEq, Eq))]
+#[derive(Debug, Clone, PartialEq, Eq)]
 pub struct Dealing {
    pub public_coefficients: PublicCoefficients,
    pub ciphertexts: Ciphertexts,
@@ -321,9 +320,17 @@ impl<'a> TryFrom<&'a nym_contracts_common::dealings::ContractSafeBytes> for Deal
    }
 }

-// this assumes all dealings have been verified
+/// Attempt to run the `VkCombine` algorithm to obtain the public master verification key, `VK`
+/// alongside shares of the verification key, `shvk_{1}`, `shvk_{2}`, ... `svhk_{n}`, where n is the number of receivers.
+///
+/// # Arguments
+///
+/// * `dealings`: map of dealer indices to dealings they generated
+/// * `threshold`: explicit threshold value of the associated dealings
+/// * `receivers`:map of receiver indices to their public keys
+// note: this function assumes all dealings have already been verified
 pub fn try_recover_verification_keys(
-    dealings: &[Dealing],
+    dealings: &BTreeMap<NodeIndex, Dealing>,
    threshold: Threshold,
    receivers: &BTreeMap<NodeIndex, PublicKey>,
 ) -> Result<RecoveredVerificationKeys, DkgError> {
@@ -331,24 +338,31 @@ pub fn try_recover_verification_keys(
        return Err(DkgError::NoDealingsAvailable);
    }

-    let threshold_usize = threshold as usize;
+    let threshold = threshold as usize;
+
+    if dealings.len() < threshold {
+        return Err(DkgError::NotEnoughDealingsAvailable {
+            available: dealings.len(),
+            required: threshold,
+        });
+    }

    if !dealings
-        .iter()
-        .all(|dealing| dealing.public_coefficients.size() == threshold_usize)
+        .values()
+        .all(|dealing| dealing.public_coefficients.size() == threshold)
    {
        return Err(DkgError::MismatchedDealings);
    }

-    let indices = receivers.keys().collect::<Vec<_>>();
+    let dealer_indices = dealings.keys().collect::<Vec<_>>();

    // Compute A0, ..., A_{t-1}
-    let mut interpolated_coefficients = Vec::with_capacity(threshold_usize);
-    for k in 0..threshold_usize {
-        let mut samples = Vec::with_capacity(indices.len());
-        for (j, dealing) in dealings.iter().enumerate() {
+    let mut interpolated_coefficients = Vec::with_capacity(threshold);
+    for k in 0..threshold {
+        let mut samples = Vec::with_capacity(dealer_indices.len());
+        for (dealer_index, dealing) in dealings.iter() {
            samples.push((
-                Scalar::from(*indices[j]),
+                Scalar::from(*dealer_index),
                *dealing.public_coefficients.nth(k),
            ))
        }
@@ -365,7 +379,7 @@ pub fn try_recover_verification_keys(
    // shvk_j = A0^{j^0} * A1^{j^1} * ... * A_{t-1}^{j^{t-1}}
    let verification_key_shares = receivers
        .keys()
-        .map(|index| interpolated_coefficients.evaluate_at(&Scalar::from(*index)))
+        .map(|receiver_index| interpolated_coefficients.evaluate_at(&Scalar::from(*receiver_index)))
        .collect();

    Ok(RecoveredVerificationKeys {
@@ -457,14 +471,17 @@ mod tests {
        let dealings = node_indices
            .iter()
            .map(|&dealer_index| {
-                Dealing::create(&mut rng, &params, dealer_index, threshold, &receivers, None).0
+                (
+                    dealer_index,
+                    Dealing::create(&mut rng, &params, dealer_index, threshold, &receivers, None).0,
+                )
            })
-            .collect::<Vec<_>>();
+            .collect::<BTreeMap<_, _>>();

        let mut derived_secrets = Vec::new();
-        for (i, (ref mut dk, _)) in full_keys.iter_mut().enumerate() {
+        for (i, (ref dk, _)) in full_keys.iter().enumerate() {
            let shares = dealings
-                .iter()
+                .values()
                .map(|dealing| decrypt_share(dk, i, &dealing.ciphertexts, None).unwrap())
                .collect();
            derived_secrets.push(
@@ -513,9 +530,12 @@ mod tests {
        let dealings = node_indices
            .iter()
            .map(|&dealer_index| {
-                Dealing::create(&mut rng, &params, dealer_index, threshold, &receivers, None).0
+                (
+                    dealer_index,
+                    Dealing::create(&mut rng, &params, dealer_index, threshold, &receivers, None).0,
+                )
            })
-            .collect::<Vec<_>>();
+            .collect::<BTreeMap<_, _>>();

        let RecoveredVerificationKeys {
            recovered_master,
@@ -531,6 +551,66 @@ mod tests {
        .is_ok())
    }

+    #[test]
+    #[ignore] // expensive test
+    fn verifying_partial_verification_keys_with_different_dealers_and_receivers() {
+        let dummy_seed = [42u8; 32];
+        let mut rng = rand_chacha::ChaCha20Rng::from_seed(dummy_seed);
+        let params = setup();
+
+        let dealer_indices = [1, 2, 3, 8];
+        let receiver_indices = [3, 4, 5, 6, 7];
+        let threshold = 3;
+
+        let mut receivers = BTreeMap::new();
+        let mut full_keys = Vec::new();
+        for index in &receiver_indices {
+            let (dk, pk) = keygen(&params, &mut rng);
+            receivers.insert(*index, *pk.public_key());
+            full_keys.push((dk, pk))
+        }
+
+        let dealings = dealer_indices
+            .iter()
+            .map(|&dealer_index| {
+                (
+                    dealer_index,
+                    Dealing::create(&mut rng, &params, dealer_index, threshold, &receivers, None).0,
+                )
+            })
+            .collect::<BTreeMap<_, _>>();
+
+        let RecoveredVerificationKeys {
+            recovered_master,
+            recovered_partials,
+        } = try_recover_verification_keys(&dealings, threshold, &receivers).unwrap();
+
+        let g2 = G2Projective::generator();
+
+        let mut derived_secrets = Vec::new();
+        for (i, (dk, _)) in full_keys.iter().enumerate() {
+            let shares = dealings
+                .values()
+                .map(|dealing| decrypt_share(dk, i, &dealing.ciphertexts, None).unwrap())
+                .collect();
+
+            let recovered_secret = combine_shares(shares, &dealer_indices).unwrap();
+
+            // make sure it matches the associated vk
+            assert_eq!(recovered_partials[i], g2 * recovered_secret);
+
+            derived_secrets.push(recovered_secret)
+        }
+
+        assert!(verify_verification_keys(
+            &recovered_master,
+            &recovered_partials,
+            &receivers,
+            threshold
+        )
+        .is_ok())
+    }
+
    #[test]
    #[ignore] // expensive test
    fn dealing_roundtrip() {
@@ -3,7 +3,7 @@

 use thiserror::Error;

-#[derive(Debug, Error)]
+#[derive(Debug, Error, Clone)]
 pub enum DkgError {
    #[error("Provided set of values contained duplicate coordinate")]
    DuplicateCoordinate,
@@ -13,6 +13,7 @@ pub mod dealing;
 pub(crate) mod share;
 pub(crate) mod utils;

+pub use bls12_381::{G2Projective, Scalar};
 pub use dealing::*;
 pub use share::*;

@@ -52,7 +52,7 @@ fn single_sender() {
        .unwrap();

    // make sure each share is actually decryptable (even though proofs say they must be, perform this sanity check)
-    for (i, (ref mut dk, _)) in full_keys.iter_mut().enumerate() {
+    for (i, (ref dk, _)) in full_keys.iter().enumerate() {
        let _recovered = decrypt_share(dk, i, &dealing.ciphertexts, None).unwrap();
    }

@@ -91,10 +91,13 @@ fn full_threshold_secret_sharing() {
    let dealings = node_indices
        .iter()
        .map(|&dealer_index| {
-            Dealing::create(&mut rng, &params, dealer_index, threshold, &receivers, None).0
+            (
+                dealer_index,
+                Dealing::create(&mut rng, &params, dealer_index, threshold, &receivers, None).0,
+            )
        })
-        .collect::<Vec<_>>();
-    for dealing in dealings.iter() {
+        .collect::<BTreeMap<_, _>>();
+    for dealing in dealings.values() {
        dealing
            .verify(&params, threshold, &receivers, None)
            .unwrap();
@@ -109,9 +112,9 @@ fn full_threshold_secret_sharing() {
    let g2 = G2Projective::generator();

    let mut derived_secrets = Vec::new();
-    for (i, (ref mut dk, _)) in full_keys.iter_mut().enumerate() {
+    for (i, (ref dk, _)) in full_keys.iter().enumerate() {
        let shares = dealings
-            .iter()
+            .values()
            .map(|dealing| decrypt_share(dk, i, &dealing.ciphertexts, None).unwrap())
            .collect();

@@ -169,9 +172,12 @@ fn full_threshold_secret_resharing() {
    let first_dealings = node_indices
        .iter()
        .map(|&dealer_index| {
-            Dealing::create(&mut rng, &params, dealer_index, threshold, &receivers, None).0
+            (
+                dealer_index,
+                Dealing::create(&mut rng, &params, dealer_index, threshold, &receivers, None).0,
+            )
        })
-        .collect::<Vec<_>>();
+        .collect::<BTreeMap<_, _>>();

    // recover verification keys
    let RecoveredVerificationKeys {
@@ -180,9 +186,9 @@ fn full_threshold_secret_resharing() {
    } = try_recover_verification_keys(&first_dealings, threshold, &receivers).unwrap();

    let mut derived_secrets = Vec::new();
-    for (i, (ref mut dk, _)) in full_keys.iter_mut().enumerate() {
+    for (i, (ref dk, _)) in full_keys.iter().enumerate() {
        let shares = first_dealings
-            .iter()
+            .values()
            .map(|dealing| decrypt_share(dk, i, &dealing.ciphertexts, None).unwrap())
            .collect();

@@ -203,19 +209,22 @@ fn full_threshold_secret_resharing() {
        .iter()
        .zip(derived_secrets.iter())
        .map(|(&dealer_index, prior_secret)| {
-            Dealing::create(
-                &mut rng,
-                &params,
+            (
                dealer_index,
-                threshold,
-                &receivers,
-                Some(*prior_secret),
+                Dealing::create(
+                    &mut rng,
+                    &params,
+                    dealer_index,
+                    threshold,
+                    &receivers,
+                    Some(*prior_secret),
+                )
+                .0,
            )
-            .0
        })
-        .collect::<Vec<_>>();
+        .collect::<BTreeMap<_, _>>();

-    for (reshared_dealing, prior_vk) in resharing_dealings.iter().zip(recovered_partials.iter()) {
+    for (reshared_dealing, prior_vk) in resharing_dealings.values().zip(recovered_partials.iter()) {
        reshared_dealing
            .verify(&params, threshold, &receivers, Some(*prior_vk))
            .unwrap();
@@ -228,9 +237,9 @@ fn full_threshold_secret_resharing() {
    } = try_recover_verification_keys(&resharing_dealings, threshold, &receivers).unwrap();

    let mut reshared_secrets = Vec::new();
-    for (i, (ref mut dk, _)) in full_keys.iter_mut().enumerate() {
+    for (i, (ref dk, _)) in full_keys.iter().enumerate() {
        let shares = resharing_dealings
-            .iter()
+            .values()
            .map(|dealing| decrypt_share(dk, i, &dealing.ciphertexts, None).unwrap())
            .collect();

@@ -279,9 +288,12 @@ fn full_threshold_secret_resharing_left_party() {
    let first_dealings = node_indices
        .iter()
        .map(|&dealer_index| {
-            Dealing::create(&mut rng, &params, dealer_index, threshold, &receivers, None).0
+            (
+                dealer_index,
+                Dealing::create(&mut rng, &params, dealer_index, threshold, &receivers, None).0,
+            )
        })
-        .collect::<Vec<_>>();
+        .collect::<BTreeMap<_, _>>();

    // recover verification keys
    let RecoveredVerificationKeys {
@@ -290,9 +302,9 @@ fn full_threshold_secret_resharing_left_party() {
    } = try_recover_verification_keys(&first_dealings, threshold, &receivers).unwrap();

    let mut derived_secrets = Vec::new();
-    for (i, (ref mut dk, _)) in full_keys.iter_mut().enumerate() {
+    for (i, (ref dk, _)) in full_keys.iter().enumerate() {
        let shares = first_dealings
-            .iter()
+            .values()
            .map(|dealing| decrypt_share(dk, i, &dealing.ciphertexts, None).unwrap())
            .collect();

@@ -323,20 +335,23 @@ fn full_threshold_secret_resharing_left_party() {
        .iter()
        .zip(derived_secrets.iter().take(2))
        .map(|(&dealer_index, prior_secret)| {
-            Dealing::create(
-                &mut rng,
-                &params,
+            (
                dealer_index,
-                threshold,
-                &receivers,
-                Some(*prior_secret),
+                Dealing::create(
+                    &mut rng,
+                    &params,
+                    dealer_index,
+                    threshold,
+                    &receivers,
+                    Some(*prior_secret),
+                )
+                .0,
            )
-            .0
        })
-        .collect::<Vec<_>>();
+        .collect::<BTreeMap<_, _>>();

    for (reshared_dealing, prior_vk) in resharing_dealings
-        .iter()
+        .values()
        .zip(recovered_partials.iter().take(2))
    {
        reshared_dealing
@@ -351,9 +366,9 @@ fn full_threshold_secret_resharing_left_party() {
    } = try_recover_verification_keys(&resharing_dealings, threshold, &receivers).unwrap();

    let mut reshared_secrets = Vec::new();
-    for (i, (ref mut dk, _)) in full_keys.iter_mut().enumerate() {
+    for (i, (ref dk, _)) in full_keys.iter().enumerate() {
        let shares = resharing_dealings
-            .iter()
+            .values()
            .map(|dealing| decrypt_share(dk, i, &dealing.ciphertexts, None).unwrap())
            .collect();

@@ -8,12 +8,13 @@ documentation.workspace = true
 edition.workspace = true
 license.workspace = true

-# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
-
 [dependencies]
 bincode = "1.3.3"
 bytes = "1.5.0"
+nym-bin-common = { path = "../bin-common" }
 nym-sphinx = { path = "../nymsphinx" }
 rand = "0.8.5"
 serde = { workspace = true, features = ["derive"] }
 thiserror = { workspace = true }
+tokio = { workspace = true, features = ["time"] }
+tokio-util = { workspace = true, features = ["codec"] }
@@ -0,0 +1,123 @@
+use std::time::Duration;
+
+use bytes::{Buf, Bytes, BytesMut};
+use tokio_util::codec::{Decoder, Encoder};
+
+#[derive(thiserror::Error, Debug)]
+pub enum Error {
+    #[error("{0}")]
+    IO(#[from] std::io::Error),
+}
+
+pub const BUFFER_TIMEOUT: Duration = Duration::from_millis(20);
+
+// TODO: increase this to make max out effective sphinx payload size. Sphinx packets also carry the
+// MixAck so that's why we can't just use 2kb.
+pub const MAX_PACKET_SIZE: usize = 1500;
+
+// Each IP packet is prefixed by a 2 byte length prefix
+const LENGTH_PREFIX_SIZE: usize = 2;
+
+// Tokio codec for bundling multiple IP packets into one buffer that is at most 1500 bytes long.
+// These packets are separated by a 2 byte length prefix. We need a timer so that we don't wait too
+// long for the buffer to fill up, since this kills latency.
+pub struct MultiIpPacketCodec {
+    buffer: BytesMut,
+    buffer_timeout: tokio::time::Interval,
+}
+
+impl MultiIpPacketCodec {
+    pub fn new(buffer_timeout: Duration) -> Self {
+        MultiIpPacketCodec {
+            buffer: BytesMut::new(),
+            buffer_timeout: tokio::time::interval(buffer_timeout),
+        }
+    }
+
+    // Append a packet to the buffer and return the buffer if it's full
+    pub fn append_packet(&mut self, packet: Bytes) -> Option<Bytes> {
+        let mut bundled_packets = BytesMut::new();
+        self.encode(packet, &mut bundled_packets).unwrap();
+        if bundled_packets.is_empty() {
+            None
+        } else {
+            // log::info!("Sphinx packet utilization: {:.2}", self.buffer.len() as f64 / MAX_PACKET_SIZE as f64);
+            Some(bundled_packets.freeze())
+        }
+    }
+
+    // Flush the current buffer and return it.
+    fn flush_current_buffer(&mut self) -> Bytes {
+        let mut output_buffer = BytesMut::new();
+        std::mem::swap(&mut output_buffer, &mut self.buffer);
+        output_buffer.freeze()
+    }
+
+    // Wait for the buffer_timeout to tick and then flush the buffer.
+    // This is useful when we want to send the buffer even if it's not full.
+    pub async fn buffer_timeout(&mut self) -> Option<Bytes> {
+        // Wait for buffer_timeout to tick
+        let _ = self.buffer_timeout.tick().await;
+
+        // Flush the buffer and return it
+        let packets = self.flush_current_buffer();
+        if packets.is_empty() {
+            None
+        } else {
+            Some(packets)
+        }
+    }
+}
+
+impl Encoder<Bytes> for MultiIpPacketCodec {
+    type Error = Error;
+
+    fn encode(&mut self, packet: Bytes, dst: &mut BytesMut) -> Result<(), Self::Error> {
+        if self.buffer.is_empty() {
+            self.buffer_timeout.reset();
+        }
+        let packet_size = packet.len();
+
+        if self.buffer.len() + packet_size + LENGTH_PREFIX_SIZE > MAX_PACKET_SIZE {
+            // If the packet doesn't fit in the buffer, send the buffer and then add it to the buffer
+            dst.extend_from_slice(&self.buffer);
+            self.buffer = BytesMut::new();
+            self.buffer_timeout.reset();
+        }
+
+        // Add the packet size
+        self.buffer
+            .extend_from_slice(&(packet_size as u16).to_be_bytes());
+        // Add the packet to the buffer
+        self.buffer.extend_from_slice(&packet);
+
+        Ok(())
+    }
+}
+
+impl Decoder for MultiIpPacketCodec {
+    type Item = Bytes;
+    type Error = Error;
+
+    fn decode(&mut self, src: &mut BytesMut) -> Result<Option<Self::Item>, Self::Error> {
+        if src.len() < LENGTH_PREFIX_SIZE {
+            // Not enough bytes to read the length prefix
+            return Ok(None);
+        }
+
+        let packet_size = u16::from_be_bytes([src[0], src[1]]) as usize;
+
+        if src.len() < packet_size + LENGTH_PREFIX_SIZE {
+            // Not enough bytes to read the packet
+            return Ok(None);
+        }
+
+        // Remove the length prefix
+        src.advance(LENGTH_PREFIX_SIZE);
+
+        // Read the packet
+        let packet = src.split_to(packet_size);
+
+        Ok(Some(packet.freeze()))
+    }
+}
@@ -1,319 +1,8 @@
-use std::net::IpAddr;
+pub mod codec;
+pub mod request;
+pub mod response;

-use nym_sphinx::addressing::clients::Recipient;
-use serde::{Deserialize, Serialize};
-
-pub const CURRENT_VERSION: u8 = 1;
-
-fn generate_random() -> u64 {
-    use rand::RngCore;
-    let mut rng = rand::rngs::OsRng;
-    rng.next_u64()
-}
-
-#[derive(Clone, Debug, Serialize, Deserialize)]
-pub struct IpPacketRequest {
-    pub version: u8,
-    pub data: IpPacketRequestData,
-}
-
-impl IpPacketRequest {
-    pub fn new_static_connect_request(
-        ip: IpAddr,
-        reply_to: Recipient,
-        reply_to_hops: Option<u8>,
-        reply_to_avg_mix_delays: Option<f64>,
-    ) -> (Self, u64) {
-        let request_id = generate_random();
-        (
-            Self {
-                version: CURRENT_VERSION,
-                data: IpPacketRequestData::StaticConnect(StaticConnectRequest {
-                    request_id,
-                    ip,
-                    reply_to,
-                    reply_to_hops,
-                    reply_to_avg_mix_delays,
-                }),
-            },
-            request_id,
-        )
-    }
-
-    pub fn new_dynamic_connect_request(
-        reply_to: Recipient,
-        reply_to_hops: Option<u8>,
-        reply_to_avg_mix_delays: Option<f64>,
-    ) -> (Self, u64) {
-        let request_id = generate_random();
-        (
-            Self {
-                version: CURRENT_VERSION,
-                data: IpPacketRequestData::DynamicConnect(DynamicConnectRequest {
-                    request_id,
-                    reply_to,
-                    reply_to_hops,
-                    reply_to_avg_mix_delays,
-                }),
-            },
-            request_id,
-        )
-    }
-
-    pub fn new_ip_packet(ip_packet: bytes::Bytes) -> Self {
-        Self {
-            version: CURRENT_VERSION,
-            data: IpPacketRequestData::Data(DataRequest { ip_packet }),
-        }
-    }
-
-    pub fn id(&self) -> Option<u64> {
-        match &self.data {
-            IpPacketRequestData::StaticConnect(request) => Some(request.request_id),
-            IpPacketRequestData::DynamicConnect(request) => Some(request.request_id),
-            IpPacketRequestData::Data(_) => None,
-        }
-    }
-
-    pub fn recipient(&self) -> Option<&Recipient> {
-        match &self.data {
-            IpPacketRequestData::StaticConnect(request) => Some(&request.reply_to),
-            IpPacketRequestData::DynamicConnect(request) => Some(&request.reply_to),
-            IpPacketRequestData::Data(_) => None,
-        }
-    }
-
-    pub fn to_bytes(&self) -> Result<Vec<u8>, bincode::Error> {
-        use bincode::Options;
-        make_bincode_serializer().serialize(self)
-    }
-
-    pub fn from_reconstructed_message(
-        message: &nym_sphinx::receiver::ReconstructedMessage,
-    ) -> Result<Self, bincode::Error> {
-        use bincode::Options;
-        make_bincode_serializer().deserialize(&message.message)
-    }
-}
-
-#[allow(clippy::large_enum_variant)]
-#[derive(Clone, Debug, Serialize, Deserialize, PartialEq)]
-pub enum IpPacketRequestData {
-    StaticConnect(StaticConnectRequest),
-    DynamicConnect(DynamicConnectRequest),
-    Data(DataRequest),
-}
-
-#[derive(Clone, Debug, Serialize, Deserialize, PartialEq)]
-pub struct StaticConnectRequest {
-    pub request_id: u64,
-    pub ip: IpAddr,
-    // The nym-address the response should be sent back to
-    pub reply_to: Recipient,
-    // The number of mix node hops that responses should take, in addition to the entry and exit
-    // node. Zero means only client -> entry -> exit -> client.
-    pub reply_to_hops: Option<u8>,
-    // The average delay at each mix node, in milliseconds. Currently this is not supported by the
-    // ip packet router.
-    pub reply_to_avg_mix_delays: Option<f64>,
-}
-
-#[derive(Clone, Debug, Serialize, Deserialize, PartialEq)]
-pub struct DynamicConnectRequest {
-    pub request_id: u64,
-    // The nym-address the response should be sent back to
-    pub reply_to: Recipient,
-    // The number of mix node hops that responses should take, in addition to the entry and exit
-    // node. Zero means only client -> entry -> exit -> client.
-    pub reply_to_hops: Option<u8>,
-    // The average delay at each mix node, in milliseconds. Currently this is not supported by the
-    // ip packet router.
-    pub reply_to_avg_mix_delays: Option<f64>,
-}
-
-#[derive(Clone, Debug, Serialize, Deserialize, PartialEq)]
-pub struct DataRequest {
-    pub ip_packet: bytes::Bytes,
-}
-
-// ---
-
-#[derive(Clone, Debug, Serialize, Deserialize)]
-pub struct IpPacketResponse {
-    pub version: u8,
-    pub data: IpPacketResponseData,
-}
-
-impl IpPacketResponse {
-    pub fn new_static_connect_success(request_id: u64, reply_to: Recipient) -> Self {
-        Self {
-            version: CURRENT_VERSION,
-            data: IpPacketResponseData::StaticConnect(StaticConnectResponse {
-                request_id,
-                reply_to,
-                reply: StaticConnectResponseReply::Success,
-            }),
-        }
-    }
-
-    pub fn new_static_connect_failure(
-        request_id: u64,
-        reply_to: Recipient,
-        reason: StaticConnectFailureReason,
-    ) -> Self {
-        Self {
-            version: CURRENT_VERSION,
-            data: IpPacketResponseData::StaticConnect(StaticConnectResponse {
-                request_id,
-                reply_to,
-                reply: StaticConnectResponseReply::Failure(reason),
-            }),
-        }
-    }
-
-    pub fn new_dynamic_connect_success(request_id: u64, reply_to: Recipient, ip: IpAddr) -> Self {
-        Self {
-            version: CURRENT_VERSION,
-            data: IpPacketResponseData::DynamicConnect(DynamicConnectResponse {
-                request_id,
-                reply_to,
-                reply: DynamicConnectResponseReply::Success(DynamicConnectSuccess { ip }),
-            }),
-        }
-    }
-
-    pub fn new_dynamic_connect_failure(
-        request_id: u64,
-        reply_to: Recipient,
-        reason: DynamicConnectFailureReason,
-    ) -> Self {
-        Self {
-            version: CURRENT_VERSION,
-            data: IpPacketResponseData::DynamicConnect(DynamicConnectResponse {
-                request_id,
-                reply_to,
-                reply: DynamicConnectResponseReply::Failure(reason),
-            }),
-        }
-    }
-
-    pub fn new_ip_packet(ip_packet: bytes::Bytes) -> Self {
-        Self {
-            version: CURRENT_VERSION,
-            data: IpPacketResponseData::Data(DataResponse { ip_packet }),
-        }
-    }
-
-    pub fn id(&self) -> Option<u64> {
-        match &self.data {
-            IpPacketResponseData::StaticConnect(response) => Some(response.request_id),
-            IpPacketResponseData::DynamicConnect(response) => Some(response.request_id),
-            IpPacketResponseData::Data(_) => None,
-        }
-    }
-
-    pub fn recipient(&self) -> Option<&Recipient> {
-        match &self.data {
-            IpPacketResponseData::StaticConnect(response) => Some(&response.reply_to),
-            IpPacketResponseData::DynamicConnect(response) => Some(&response.reply_to),
-            IpPacketResponseData::Data(_) => None,
-        }
-    }
-
-    pub fn to_bytes(&self) -> Result<Vec<u8>, bincode::Error> {
-        use bincode::Options;
-        make_bincode_serializer().serialize(self)
-    }
-
-    pub fn from_reconstructed_message(
-        message: &nym_sphinx::receiver::ReconstructedMessage,
-    ) -> Result<Self, bincode::Error> {
-        use bincode::Options;
-        make_bincode_serializer().deserialize(&message.message)
-    }
-}
-
-#[allow(clippy::large_enum_variant)]
-#[derive(Clone, Debug, Serialize, Deserialize)]
-pub enum IpPacketResponseData {
-    StaticConnect(StaticConnectResponse),
-    DynamicConnect(DynamicConnectResponse),
-    Data(DataResponse),
-}
-
-#[derive(Clone, Debug, Serialize, Deserialize)]
-pub struct StaticConnectResponse {
-    pub request_id: u64,
-    pub reply_to: Recipient,
-    pub reply: StaticConnectResponseReply,
-}
-
-#[derive(Clone, Debug, Serialize, Deserialize)]
-pub enum StaticConnectResponseReply {
-    Success,
-    Failure(StaticConnectFailureReason),
-}
-
-impl StaticConnectResponseReply {
-    pub fn is_success(&self) -> bool {
-        match self {
-            StaticConnectResponseReply::Success => true,
-            StaticConnectResponseReply::Failure(_) => false,
-        }
-    }
-}
-
-#[derive(Clone, Debug, Serialize, Deserialize, thiserror::Error)]
-pub enum StaticConnectFailureReason {
-    #[error("requested ip address is already in use")]
-    RequestedIpAlreadyInUse,
-    #[error("requested nym-address is already in use")]
-    RequestedNymAddressAlreadyInUse,
-    #[error("{0}")]
-    Other(String),
-}
-
-#[derive(Clone, Debug, Serialize, Deserialize)]
-pub struct DynamicConnectResponse {
-    pub request_id: u64,
-    pub reply_to: Recipient,
-    pub reply: DynamicConnectResponseReply,
-}
-
-#[derive(Clone, Debug, Serialize, Deserialize)]
-pub enum DynamicConnectResponseReply {
-    Success(DynamicConnectSuccess),
-    Failure(DynamicConnectFailureReason),
-}
-
-impl DynamicConnectResponseReply {
-    pub fn is_success(&self) -> bool {
-        match self {
-            DynamicConnectResponseReply::Success(_) => true,
-            DynamicConnectResponseReply::Failure(_) => false,
-        }
-    }
-}
-
-#[derive(Clone, Debug, Serialize, Deserialize)]
-pub struct DynamicConnectSuccess {
-    pub ip: IpAddr,
-}
-
-#[derive(Clone, Debug, Serialize, Deserialize, thiserror::Error)]
-pub enum DynamicConnectFailureReason {
-    #[error("requested nym-address is already in use")]
-    RequestedNymAddressAlreadyInUse,
-    #[error("no available ip address")]
-    NoAvailableIp,
-    #[error("{0}")]
-    Other(String),
-}
-
-#[derive(Clone, Debug, Serialize, Deserialize)]
-pub struct DataResponse {
-    pub ip_packet: bytes::Bytes,
-}
+pub const CURRENT_VERSION: u8 = 3;

 fn make_bincode_serializer() -> impl bincode::Options {
    use bincode::Options;
@@ -321,63 +10,3 @@ fn make_bincode_serializer() -> impl bincode::Options {
        .with_big_endian()
        .with_varint_encoding()
 }
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn check_size_of_request() {
-        let connect = IpPacketRequest {
-            version: 4,
-            data: IpPacketRequestData::StaticConnect(
-                StaticConnectRequest {
-                    request_id: 123,
-                    ip: IpAddr::from([10, 0, 0, 1]),
-                    reply_to: Recipient::try_from_base58_string("D1rrpsysCGCYXy9saP8y3kmNpGtJZUXN9SvFoUcqAsM9.9Ssso1ea5NfkbMASdiseDSjTN1fSWda5SgEVjdSN4CvV@GJqd3ZxpXWSNxTfx7B1pPtswpetH4LnJdFeLeuY5KUuN").unwrap(),
-                    reply_to_hops: None,
-                    reply_to_avg_mix_delays: None,
-                },
-            )
-        };
-        assert_eq!(connect.to_bytes().unwrap().len(), 107);
-    }
-
-    #[test]
-    fn check_size_of_data() {
-        let data = IpPacketRequest {
-            version: 4,
-            data: IpPacketRequestData::Data(DataRequest {
-                ip_packet: bytes::Bytes::from(vec![1u8; 32]),
-            }),
-        };
-        assert_eq!(data.to_bytes().unwrap().len(), 35);
-    }
-
-    #[test]
-    fn serialize_and_deserialize_data_request() {
-        let data = IpPacketRequest {
-            version: 4,
-            data: IpPacketRequestData::Data(DataRequest {
-                ip_packet: bytes::Bytes::from(vec![1, 2, 4, 2, 5]),
-            }),
-        };
-
-        let serialized = data.to_bytes().unwrap();
-        let deserialized = IpPacketRequest::from_reconstructed_message(
-            &nym_sphinx::receiver::ReconstructedMessage {
-                message: serialized,
-                sender_tag: None,
-            },
-        )
-        .unwrap();
-
-        assert_eq!(deserialized.version, 4);
-        assert_eq!(
-            deserialized.data,
-            IpPacketRequestData::Data(DataRequest {
-                ip_packet: bytes::Bytes::from(vec![1, 2, 4, 2, 5]),
-            })
-        );
-    }
-}
@@ -0,0 +1,269 @@
+use std::net::IpAddr;
+
+use nym_sphinx::addressing::clients::Recipient;
+use serde::{Deserialize, Serialize};
+
+use crate::{make_bincode_serializer, CURRENT_VERSION};
+
+fn generate_random() -> u64 {
+    use rand::RngCore;
+    let mut rng = rand::rngs::OsRng;
+    rng.next_u64()
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub struct IpPacketRequest {
+    pub version: u8,
+    pub data: IpPacketRequestData,
+}
+
+impl IpPacketRequest {
+    pub fn new_static_connect_request(
+        ip: IpAddr,
+        reply_to: Recipient,
+        reply_to_hops: Option<u8>,
+        reply_to_avg_mix_delays: Option<f64>,
+        buffer_timeout: Option<u64>,
+    ) -> (Self, u64) {
+        let request_id = generate_random();
+        (
+            Self {
+                version: CURRENT_VERSION,
+                data: IpPacketRequestData::StaticConnect(StaticConnectRequest {
+                    request_id,
+                    ip,
+                    reply_to,
+                    reply_to_hops,
+                    reply_to_avg_mix_delays,
+                    buffer_timeout,
+                }),
+            },
+            request_id,
+        )
+    }
+
+    pub fn new_dynamic_connect_request(
+        reply_to: Recipient,
+        reply_to_hops: Option<u8>,
+        reply_to_avg_mix_delays: Option<f64>,
+        buffer_timeout: Option<u64>,
+    ) -> (Self, u64) {
+        let request_id = generate_random();
+        (
+            Self {
+                version: CURRENT_VERSION,
+                data: IpPacketRequestData::DynamicConnect(DynamicConnectRequest {
+                    request_id,
+                    reply_to,
+                    reply_to_hops,
+                    reply_to_avg_mix_delays,
+                    buffer_timeout,
+                }),
+            },
+            request_id,
+        )
+    }
+
+    pub fn new_disconnect_request(reply_to: Recipient) -> (Self, u64) {
+        let request_id = generate_random();
+        (
+            Self {
+                version: CURRENT_VERSION,
+                data: IpPacketRequestData::Disconnect(DisconnectRequest {
+                    request_id,
+                    reply_to,
+                }),
+            },
+            request_id,
+        )
+    }
+
+    pub fn new_data_request(ip_packets: bytes::Bytes) -> Self {
+        Self {
+            version: CURRENT_VERSION,
+            data: IpPacketRequestData::Data(DataRequest { ip_packets }),
+        }
+    }
+
+    pub fn id(&self) -> Option<u64> {
+        match &self.data {
+            IpPacketRequestData::StaticConnect(request) => Some(request.request_id),
+            IpPacketRequestData::DynamicConnect(request) => Some(request.request_id),
+            IpPacketRequestData::Disconnect(request) => Some(request.request_id),
+            IpPacketRequestData::Data(_) => None,
+            IpPacketRequestData::Ping(request) => Some(request.request_id),
+            IpPacketRequestData::Health(request) => Some(request.request_id),
+        }
+    }
+
+    pub fn recipient(&self) -> Option<&Recipient> {
+        match &self.data {
+            IpPacketRequestData::StaticConnect(request) => Some(&request.reply_to),
+            IpPacketRequestData::DynamicConnect(request) => Some(&request.reply_to),
+            IpPacketRequestData::Disconnect(request) => Some(&request.reply_to),
+            IpPacketRequestData::Data(_) => None,
+            IpPacketRequestData::Ping(request) => Some(&request.reply_to),
+            IpPacketRequestData::Health(request) => Some(&request.reply_to),
+        }
+    }
+
+    pub fn to_bytes(&self) -> Result<Vec<u8>, bincode::Error> {
+        use bincode::Options;
+        make_bincode_serializer().serialize(self)
+    }
+
+    pub fn from_reconstructed_message(
+        message: &nym_sphinx::receiver::ReconstructedMessage,
+    ) -> Result<Self, bincode::Error> {
+        use bincode::Options;
+        make_bincode_serializer().deserialize(&message.message)
+    }
+}
+
+#[allow(clippy::large_enum_variant)]
+#[derive(Clone, Debug, Serialize, Deserialize, PartialEq)]
+pub enum IpPacketRequestData {
+    StaticConnect(StaticConnectRequest),
+    DynamicConnect(DynamicConnectRequest),
+    Disconnect(DisconnectRequest),
+    Data(DataRequest),
+    Ping(PingRequest),
+    Health(HealthRequest),
+}
+
+// A static connect request is when the client provides the internal IP address it will use on the
+// ip packet router.
+#[derive(Clone, Debug, Serialize, Deserialize, PartialEq)]
+pub struct StaticConnectRequest {
+    pub request_id: u64,
+
+    pub ip: IpAddr,
+
+    // The nym-address the response should be sent back to
+    pub reply_to: Recipient,
+
+    // The number of mix node hops that responses should take, in addition to the entry and exit
+    // node. Zero means only client -> entry -> exit -> client.
+    pub reply_to_hops: Option<u8>,
+
+    // The average delay at each mix node, in milliseconds. Currently this is not supported by the
+    // ip packet router.
+    pub reply_to_avg_mix_delays: Option<f64>,
+
+    // The maximum time in milliseconds the IPR should wait when filling up a mix packet
+    // with ip packets.
+    pub buffer_timeout: Option<u64>,
+}
+
+// A dynamic connect request is when the client does not provide the internal IP address it will use
+// on the ip packet router, and instead requests one to be assigned to it.
+#[derive(Clone, Debug, Serialize, Deserialize, PartialEq)]
+pub struct DynamicConnectRequest {
+    pub request_id: u64,
+
+    // The nym-address the response should be sent back to
+    pub reply_to: Recipient,
+
+    // The number of mix node hops that responses should take, in addition to the entry and exit
+    // node. Zero means only client -> entry -> exit -> client.
+    pub reply_to_hops: Option<u8>,
+
+    // The average delay at each mix node, in milliseconds. Currently this is not supported by the
+    // ip packet router.
+    pub reply_to_avg_mix_delays: Option<f64>,
+
+    // The maximum time in milliseconds the IPR should wait when filling up a mix packet
+    // with ip packets.
+    pub buffer_timeout: Option<u64>,
+}
+
+// A disconnect request is when the client wants to disconnect from the ip packet router and free
+// up the allocated IP address.
+#[derive(Clone, Debug, Serialize, Deserialize, PartialEq)]
+pub struct DisconnectRequest {
+    pub request_id: u64,
+    // The nym-address the response should be sent back to
+    pub reply_to: Recipient,
+}
+
+// A data request is when the client wants to send an IP packet to a destination.
+#[derive(Clone, Debug, Serialize, Deserialize, PartialEq)]
+pub struct DataRequest {
+    pub ip_packets: bytes::Bytes,
+}
+
+// A ping request is when the client wants to check if the ip packet router is still alive.
+#[derive(Clone, Debug, Serialize, Deserialize, PartialEq)]
+pub struct PingRequest {
+    pub request_id: u64,
+    // The nym-address the response should be sent back to
+    pub reply_to: Recipient,
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize, PartialEq)]
+pub struct HealthRequest {
+    pub request_id: u64,
+    // The nym-address the response should be sent back to
+    pub reply_to: Recipient,
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn check_size_of_request() {
+        let connect = IpPacketRequest {
+            version: 4,
+            data: IpPacketRequestData::StaticConnect(
+                StaticConnectRequest {
+                    request_id: 123,
+                    ip: IpAddr::from([10, 0, 0, 1]),
+                    reply_to: Recipient::try_from_base58_string("D1rrpsysCGCYXy9saP8y3kmNpGtJZUXN9SvFoUcqAsM9.9Ssso1ea5NfkbMASdiseDSjTN1fSWda5SgEVjdSN4CvV@GJqd3ZxpXWSNxTfx7B1pPtswpetH4LnJdFeLeuY5KUuN").unwrap(),
+                    reply_to_hops: None,
+                    reply_to_avg_mix_delays: None,
+                    buffer_timeout: None,
+                },
+            )
+        };
+        assert_eq!(connect.to_bytes().unwrap().len(), 108);
+    }
+
+    #[test]
+    fn check_size_of_data() {
+        let data = IpPacketRequest {
+            version: 4,
+            data: IpPacketRequestData::Data(DataRequest {
+                ip_packets: bytes::Bytes::from(vec![1u8; 32]),
+            }),
+        };
+        assert_eq!(data.to_bytes().unwrap().len(), 35);
+    }
+
+    #[test]
+    fn serialize_and_deserialize_data_request() {
+        let data = IpPacketRequest {
+            version: 4,
+            data: IpPacketRequestData::Data(DataRequest {
+                ip_packets: bytes::Bytes::from(vec![1, 2, 4, 2, 5]),
+            }),
+        };
+
+        let serialized = data.to_bytes().unwrap();
+        let deserialized = IpPacketRequest::from_reconstructed_message(
+            &nym_sphinx::receiver::ReconstructedMessage {
+                message: serialized,
+                sender_tag: None,
+            },
+        )
+        .unwrap();
+
+        assert_eq!(deserialized.version, 4);
+        assert_eq!(
+            deserialized.data,
+            IpPacketRequestData::Data(DataRequest {
+                ip_packets: bytes::Bytes::from(vec![1, 2, 4, 2, 5]),
+            })
+        );
+    }
+}
@@ -0,0 +1,362 @@
+use std::net::IpAddr;
+
+use nym_sphinx::addressing::clients::Recipient;
+use serde::{Deserialize, Serialize};
+
+use crate::{make_bincode_serializer, CURRENT_VERSION};
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub struct IpPacketResponse {
+    pub version: u8,
+    pub data: IpPacketResponseData,
+}
+
+impl IpPacketResponse {
+    pub fn new_static_connect_success(request_id: u64, reply_to: Recipient) -> Self {
+        Self {
+            version: CURRENT_VERSION,
+            data: IpPacketResponseData::StaticConnect(StaticConnectResponse {
+                request_id,
+                reply_to,
+                reply: StaticConnectResponseReply::Success,
+            }),
+        }
+    }
+
+    pub fn new_static_connect_failure(
+        request_id: u64,
+        reply_to: Recipient,
+        reason: StaticConnectFailureReason,
+    ) -> Self {
+        Self {
+            version: CURRENT_VERSION,
+            data: IpPacketResponseData::StaticConnect(StaticConnectResponse {
+                request_id,
+                reply_to,
+                reply: StaticConnectResponseReply::Failure(reason),
+            }),
+        }
+    }
+
+    pub fn new_dynamic_connect_success(request_id: u64, reply_to: Recipient, ip: IpAddr) -> Self {
+        Self {
+            version: CURRENT_VERSION,
+            data: IpPacketResponseData::DynamicConnect(DynamicConnectResponse {
+                request_id,
+                reply_to,
+                reply: DynamicConnectResponseReply::Success(DynamicConnectSuccess { ip }),
+            }),
+        }
+    }
+
+    pub fn new_dynamic_connect_failure(
+        request_id: u64,
+        reply_to: Recipient,
+        reason: DynamicConnectFailureReason,
+    ) -> Self {
+        Self {
+            version: CURRENT_VERSION,
+            data: IpPacketResponseData::DynamicConnect(DynamicConnectResponse {
+                request_id,
+                reply_to,
+                reply: DynamicConnectResponseReply::Failure(reason),
+            }),
+        }
+    }
+
+    pub fn new_disconnect_success(request_id: u64, reply_to: Recipient) -> Self {
+        Self {
+            version: CURRENT_VERSION,
+            data: IpPacketResponseData::Disconnect(DisconnectResponse {
+                request_id,
+                reply_to,
+                reply: DisconnectResponseReply::Success,
+            }),
+        }
+    }
+
+    pub fn new_disconnect_failure(
+        request_id: u64,
+        reply_to: Recipient,
+        reason: DisconnectFailureReason,
+    ) -> Self {
+        Self {
+            version: CURRENT_VERSION,
+            data: IpPacketResponseData::Disconnect(DisconnectResponse {
+                request_id,
+                reply_to,
+                reply: DisconnectResponseReply::Failure(reason),
+            }),
+        }
+    }
+
+    pub fn new_unrequested_disconnect(
+        reply_to: Recipient,
+        reason: UnrequestedDisconnectReason,
+    ) -> Self {
+        Self {
+            version: CURRENT_VERSION,
+            data: IpPacketResponseData::UnrequestedDisconnect(UnrequestedDisconnect {
+                reply_to,
+                reason,
+            }),
+        }
+    }
+
+    pub fn new_ip_packet(ip_packet: bytes::Bytes) -> Self {
+        Self {
+            version: CURRENT_VERSION,
+            data: IpPacketResponseData::Data(DataResponse { ip_packet }),
+        }
+    }
+
+    pub fn new_version_mismatch(
+        request_id: u64,
+        reply_to: Recipient,
+        request_version: u8,
+        our_version: u8,
+    ) -> Self {
+        Self {
+            version: CURRENT_VERSION,
+            data: IpPacketResponseData::Error(ErrorResponse {
+                request_id,
+                reply_to,
+                reply: ErrorResponseReply::VersionMismatch {
+                    request_version,
+                    response_version: our_version,
+                },
+            }),
+        }
+    }
+
+    pub fn new_data_error_response(reply_to: Recipient, reply: ErrorResponseReply) -> Self {
+        Self {
+            version: CURRENT_VERSION,
+            data: IpPacketResponseData::Error(ErrorResponse {
+                request_id: 0,
+                reply_to,
+                reply,
+            }),
+        }
+    }
+
+    pub fn id(&self) -> Option<u64> {
+        match &self.data {
+            IpPacketResponseData::StaticConnect(response) => Some(response.request_id),
+            IpPacketResponseData::DynamicConnect(response) => Some(response.request_id),
+            IpPacketResponseData::Disconnect(response) => Some(response.request_id),
+            IpPacketResponseData::UnrequestedDisconnect(_) => None,
+            IpPacketResponseData::Data(_) => None,
+            IpPacketResponseData::Pong(response) => Some(response.request_id),
+            IpPacketResponseData::Health(response) => Some(response.request_id),
+            IpPacketResponseData::Error(response) => Some(response.request_id),
+        }
+    }
+
+    pub fn recipient(&self) -> Option<&Recipient> {
+        match &self.data {
+            IpPacketResponseData::StaticConnect(response) => Some(&response.reply_to),
+            IpPacketResponseData::DynamicConnect(response) => Some(&response.reply_to),
+            IpPacketResponseData::Disconnect(response) => Some(&response.reply_to),
+            IpPacketResponseData::UnrequestedDisconnect(response) => Some(&response.reply_to),
+            IpPacketResponseData::Data(_) => None,
+            IpPacketResponseData::Pong(response) => Some(&response.reply_to),
+            IpPacketResponseData::Health(response) => Some(&response.reply_to),
+            IpPacketResponseData::Error(response) => Some(&response.reply_to),
+        }
+    }
+
+    pub fn to_bytes(&self) -> Result<Vec<u8>, bincode::Error> {
+        use bincode::Options;
+        make_bincode_serializer().serialize(self)
+    }
+
+    pub fn from_reconstructed_message(
+        message: &nym_sphinx::receiver::ReconstructedMessage,
+    ) -> Result<Self, bincode::Error> {
+        use bincode::Options;
+        make_bincode_serializer().deserialize(&message.message)
+    }
+}
+
+#[allow(clippy::large_enum_variant)]
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub enum IpPacketResponseData {
+    // Response for a static connect request
+    StaticConnect(StaticConnectResponse),
+
+    // Response for a dynamic connect request
+    DynamicConnect(DynamicConnectResponse),
+
+    // Response for a disconnect initiqated by the client
+    Disconnect(DisconnectResponse),
+
+    // Message from the server that the client got disconnected without the client initiating it
+    UnrequestedDisconnect(UnrequestedDisconnect),
+
+    // Response to a data request
+    Data(DataResponse),
+
+    // Response to ping request
+    Pong(PongResponse),
+
+    // Response for a health request
+    Health(HealthResponse),
+
+    // Error response
+    Error(ErrorResponse),
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub struct StaticConnectResponse {
+    pub request_id: u64,
+    pub reply_to: Recipient,
+    pub reply: StaticConnectResponseReply,
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub enum StaticConnectResponseReply {
+    Success,
+    Failure(StaticConnectFailureReason),
+}
+
+impl StaticConnectResponseReply {
+    pub fn is_success(&self) -> bool {
+        match self {
+            StaticConnectResponseReply::Success => true,
+            StaticConnectResponseReply::Failure(_) => false,
+        }
+    }
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize, thiserror::Error)]
+pub enum StaticConnectFailureReason {
+    #[error("requested ip address is already in use")]
+    RequestedIpAlreadyInUse,
+    #[error("requested nym-address is already in use")]
+    RequestedNymAddressAlreadyInUse,
+    #[error("{0}")]
+    Other(String),
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub struct DynamicConnectResponse {
+    pub request_id: u64,
+    pub reply_to: Recipient,
+    pub reply: DynamicConnectResponseReply,
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub enum DynamicConnectResponseReply {
+    Success(DynamicConnectSuccess),
+    Failure(DynamicConnectFailureReason),
+}
+
+impl DynamicConnectResponseReply {
+    pub fn is_success(&self) -> bool {
+        match self {
+            DynamicConnectResponseReply::Success(_) => true,
+            DynamicConnectResponseReply::Failure(_) => false,
+        }
+    }
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub struct DynamicConnectSuccess {
+    pub ip: IpAddr,
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize, thiserror::Error)]
+pub enum DynamicConnectFailureReason {
+    #[error("requested nym-address is already in use")]
+    RequestedNymAddressAlreadyInUse,
+    #[error("no available ip address")]
+    NoAvailableIp,
+    #[error("{0}")]
+    Other(String),
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub struct DisconnectResponse {
+    pub request_id: u64,
+    pub reply_to: Recipient,
+    pub reply: DisconnectResponseReply,
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub enum DisconnectResponseReply {
+    Success,
+    Failure(DisconnectFailureReason),
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize, thiserror::Error)]
+pub enum DisconnectFailureReason {
+    #[error("requested nym-address is not currently connected")]
+    RequestedNymAddressNotConnected,
+    #[error("{0}")]
+    Other(String),
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub struct UnrequestedDisconnect {
+    pub reply_to: Recipient,
+    pub reason: UnrequestedDisconnectReason,
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize, thiserror::Error)]
+pub enum UnrequestedDisconnectReason {
+    #[error("client mixnet traffic timeout")]
+    ClientMixnetTrafficTimeout,
+    #[error("client tun traffic timeout")]
+    ClientTunTrafficTimeout,
+    #[error("{0}")]
+    Other(String),
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub struct DataResponse {
+    pub ip_packet: bytes::Bytes,
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub struct PongResponse {
+    pub request_id: u64,
+    pub reply_to: Recipient,
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub struct HealthResponse {
+    pub request_id: u64,
+    pub reply_to: Recipient,
+    pub reply: HealthResponseReply,
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub struct HealthResponseReply {
+    // Return the binary build information of the IPR
+    pub build_info: nym_bin_common::build_information::BinaryBuildInformationOwned,
+    // Return if the IPR has performed a successful routing test.
+    pub routable: Option<bool>,
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub struct ErrorResponse {
+    pub request_id: u64,
+    pub reply_to: Recipient,
+    pub reply: ErrorResponseReply,
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize, thiserror::Error)]
+pub enum ErrorResponseReply {
+    #[error("{msg}")]
+    Generic { msg: String },
+    #[error(
+        "version mismatch: response is v{request_version} and response is v{response_version}"
+    )]
+    VersionMismatch {
+        request_version: u8,
+        response_version: u8,
+    },
+    #[error("destination failed exit policy filter check: {dst}")]
+    ExitPolicyFilterCheckFailed { dst: String },
+}
@@ -11,6 +11,7 @@ repository.workspace = true
 cfg-if = { workspace = true }
 dotenvy = { workspace = true }
 hex-literal = "0.3.3"
+log = { workspace = true }
 once_cell = { workspace = true }
 schemars = { workspace = true, features = ["preserve_order"] }
 serde = { workspace = true, features = ["derive"]}
@@ -400,11 +400,25 @@ fn fix_deprecated_environmental_variables() {
    }
 }

+// Read the variables from the file and log what the corresponding values in the environment are.
+fn print_env_vars_with_keys_in_file<P: AsRef<Path> + Copy>(config_env_file: P) {
+    let items = dotenvy::from_path_iter(config_env_file)
+        .expect("Invalid path to environment configuration file");
+    for item in items {
+        let (key, val) = item.expect("Invalid item in environment configuration file");
+        log::debug!("{}: {}", key, val);
+    }
+}
+
 pub fn setup_env<P: AsRef<Path>>(config_env_file: Option<P>) {
    match std::env::var(var_names::CONFIGURED) {
        // if the configuration is not already set in the env vars
        Err(std::env::VarError::NotPresent) => {
-            if let Some(config_env_file) = config_env_file {
+            if let Some(config_env_file) = &config_env_file {
+                log::debug!(
+                    "Loading environment variables from {:?}",
+                    config_env_file.as_ref()
+                );
                dotenvy::from_path(config_env_file)
                    .expect("Invalid path to environment configuration file");
                fix_deprecated_environmental_variables();
@@ -412,17 +426,25 @@ pub fn setup_env<P: AsRef<Path>>(config_env_file: Option<P>) {
                // if nothing is set, the use mainnet defaults
                // if the user has not set `CONFIGURED`, then even if they set any of the env variables,
                // overwrite them
+                log::debug!("Loading mainnet defaults");
                crate::mainnet::export_to_env();
            }
        }
-        Err(_) => crate::mainnet::export_to_env(),
+        Err(_) => {
+            log::debug!("Environment variables already set. Using them");
+            crate::mainnet::export_to_env()
+        }
        _ => {
            fix_deprecated_environmental_variables();
        }
    }

    // if we haven't explicitly defined any of the constants, fallback to defaults
-    crate::mainnet::export_to_env_if_not_set()
+    crate::mainnet::export_to_env_if_not_set();
+
+    if let Some(config_env_file) = &config_env_file {
+        print_env_vars_with_keys_in_file(config_env_file);
+    }
 }

 // Name of the event triggered by the eth contract. If the event name is changed,
@@ -99,7 +99,9 @@ impl SecretKey {
        Self { x, ys }
    }

-    pub fn into_raw(&self) -> (Scalar, Vec<Scalar>) {
+    /// Extract the Scalar copy of the underlying secrets.
+    /// The caller of this function must exercise extreme care to not misuse the data and ensuring it gets zeroized
+    pub fn hazmat_to_raw(&self) -> (Scalar, Vec<Scalar>) {
        (self.x, self.ys.clone())
    }

@@ -228,10 +228,11 @@ pub fn check_vk_pairing(

    // safety: we made an explicit check for if the length of the slice is 0, thus unwrap here is fine
    #[allow(clippy::unwrap_used)]
-    if &vk.alpha != *dkg_values.last().as_ref().unwrap() {
+    if &vk.alpha != *dkg_values.first().as_ref().unwrap() {
        return false;
    }
-    if dkg_values
+    let dkg_betas = &dkg_values[1..];
+    if dkg_betas
        .iter()
        .zip(vk.beta_g2.iter())
        .any(|(dkg_beta, vk_beta)| dkg_beta != vk_beta)
@@ -329,8 +330,9 @@ mod tests {
        let params = setup(2).unwrap();
        let keypair = keygen(&params);
        let vk = keypair.verification_key();
-        let mut dkg_values = vk.beta_g2.clone();
-        dkg_values.push(vk.alpha);
+
+        let mut dkg_values = vec![vk.alpha];
+        dkg_values.append(&mut vk.beta_g2.clone());
        assert!(check_vk_pairing(&params, &dkg_values, vk));
    }

@@ -239,8 +239,15 @@ impl NymMessage {
        let (packets_used, space_left) =
            chunking::number_of_required_fragments(total_required_bytes, plaintext_per_packet);

-        let wasted_space = space_left as f32 / (bytes.len() + 1 + space_left) as f32;
-        log::trace!("Padding {self_display}: {} of raw plaintext bytes are required. They're going to be put into {packets_used} sphinx packets with {space_left} bytes of leftover space. {wasted_space}% of packet capacity is going to be wasted.", bytes.len() + 1);
+        let wasted_space_percentage =
+            (space_left as f32 / (bytes.len() + 1 + space_left) as f32) * 100.0;
+        log::trace!(
+            "Padding {self_display}: {} of raw plaintext bytes are required. \
+            They're going to be put into {packets_used} sphinx packets with {space_left} bytes \
+            of leftover space. {wasted_space_percentage:.1}% of packet capacity is going to \
+            be wasted.",
+            bytes.len() + 1
+        );

        bytes
            .into_iter()
@@ -1220,12 +1220,13 @@ dependencies = [
 "cw-controllers",
 "cw-multi-test",
 "cw-storage-plus",
+ "cw2",
 "cw4",
 "cw4-group",
- "lazy_static",
 "nym-coconut-dkg-common",
 "nym-group-contract-common",
 "rusty-fork",
+ "semver",
 "serde",
 "thiserror",
 ]
@@ -1237,6 +1238,8 @@ dependencies = [
 "cosmwasm-schema",
 "cosmwasm-std",
 "cw-utils",
+ "cw2",
+ "cw4",
 "nym-contracts-common",
 "nym-multisig-contract-common",
 ]
@@ -1879,9 +1882,9 @@ dependencies = [

 [[package]]
 name = "semver"
-version = "1.0.17"
+version = "1.0.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bebd363326d05ec3e2f532ab7660680f3b02130d780c299bca73469d521bc0ed"
+checksum = "b97ed7a9823b74f99c7742f5336af7be5ecd3eeafcb1507d1fa93347b1d589b0"

 [[package]]
 name = "serde"
@@ -48,5 +48,6 @@ cw3 = "=1.1.0"
 cw3-fixed-multisig = "=1.1.0"
 cw4 = "=1.1.0"
 cw20 = "=1.1.0"
+semver = "1.0.21"

 thiserror = "1.0.48"
@@ -20,15 +20,16 @@ cosmwasm-std = { workspace = true }
 cosmwasm-storage = { workspace = true }
 cw-storage-plus = { workspace = true }
 cw-controllers = { workspace = true }
+cw2 = { workspace = true }
 cw4 = { workspace = true }
 serde = { version = "1.0.103", default-features = false, features = ["derive"] }
+semver = { workspace = true, default-features = false }
 thiserror = { workspace = true }

 [dev-dependencies]
 cw-multi-test = { workspace = true }
 cw4-group = { path = "../multisig/cw4-group" }
 nym-group-contract-common = { path = "../../common/cosmwasm-smart-contracts/group-contract" }
-lazy_static = "1.4"
 rusty-fork = "0.3"

 [features]
@@ -2,6 +2,19 @@
  "$schema": "http://json-schema.org/draft-07/schema#",
  "title": "ExecuteMsg",
  "oneOf": [
+    {
+      "type": "object",
+      "required": [
+        "initiate_dkg"
+      ],
+      "properties": {
+        "initiate_dkg": {
+          "type": "object",
+          "additionalProperties": false
+        }
+      },
+      "additionalProperties": false
+    },
    {
      "type": "object",
      "required": [
@@ -13,6 +26,7 @@
          "required": [
            "announce_address",
            "bte_key_with_proof",
+            "identity_key",
            "resharing"
          ],
          "properties": {
@@ -22,6 +36,9 @@
            "bte_key_with_proof": {
              "type": "string"
            },
+            "identity_key": {
+              "type": "string"
+            },
            "resharing": {
              "type": "boolean"
            }
@@ -34,18 +51,52 @@
    {
      "type": "object",
      "required": [
-        "commit_dealing"
+        "commit_dealings_metadata"
      ],
      "properties": {
-        "commit_dealing": {
+        "commit_dealings_metadata": {
          "type": "object",
          "required": [
-            "dealing_bytes",
+            "chunks",
+            "dealing_index",
            "resharing"
          ],
          "properties": {
-            "dealing_bytes": {
-              "$ref": "#/definitions/ContractSafeBytes"
+            "chunks": {
+              "type": "array",
+              "items": {
+                "$ref": "#/definitions/DealingChunkInfo"
+              }
+            },
+            "dealing_index": {
+              "type": "integer",
+              "format": "uint32",
+              "minimum": 0.0
+            },
+            "resharing": {
+              "type": "boolean"
+            }
+          },
+          "additionalProperties": false
+        }
+      },
+      "additionalProperties": false
+    },
+    {
+      "type": "object",
+      "required": [
+        "commit_dealings_chunk"
+      ],
+      "properties": {
+        "commit_dealings_chunk": {
+          "type": "object",
+          "required": [
+            "chunk",
+            "resharing"
+          ],
+          "properties": {
+            "chunk": {
+              "$ref": "#/definitions/PartialContractDealing"
            },
            "resharing": {
              "type": "boolean"
@@ -95,7 +146,7 @@
          ],
          "properties": {
            "owner": {
-              "$ref": "#/definitions/Addr"
+              "type": "string"
            },
            "resharing": {
              "type": "boolean"
@@ -134,10 +185,6 @@
    }
  ],
  "definitions": {
-    "Addr": {
-      "description": "A human readable address.\n\nIn Cosmos, this is typically bech32 encoded. But for multi-chain smart contracts no assumptions should be made other than being UTF-8 encoded and of reasonable length.\n\nThis type represents a validated address. It can be created in the following ways 1. Use `Addr::unchecked(input)` 2. Use `let checked: Addr = deps.api.addr_validate(input)?` 3. Use `let checked: Addr = deps.api.addr_humanize(canonical_addr)?` 4. Deserialize from JSON. This must only be done from JSON that was validated before such as a contract's state. `Addr` must not be used in messages sent by the user because this would result in unvalidated instances.\n\nThis type is immutable. If you really need to mutate it (Really? Are you sure?), create a mutable copy using `let mut mutable = Addr::to_string()` and operate on that `String` instance.",
-      "type": "string"
-    },
    "ContractSafeBytes": {
      "type": "array",
      "items": {
@@ -145,6 +192,44 @@
        "format": "uint8",
        "minimum": 0.0
      }
+    },
+    "DealingChunkInfo": {
+      "type": "object",
+      "required": [
+        "size"
+      ],
+      "properties": {
+        "size": {
+          "type": "integer",
+          "format": "uint64",
+          "minimum": 0.0
+        }
+      },
+      "additionalProperties": false
+    },
+    "PartialContractDealing": {
+      "type": "object",
+      "required": [
+        "chunk_index",
+        "data",
+        "dealing_index"
+      ],
+      "properties": {
+        "chunk_index": {
+          "type": "integer",
+          "format": "uint16",
+          "minimum": 0.0
+        },
+        "data": {
+          "$ref": "#/definitions/ContractSafeBytes"
+        },
+        "dealing_index": {
+          "type": "integer",
+          "format": "uint32",
+          "minimum": 0.0
+        }
+      },
+      "additionalProperties": false
    }
  }
 }
@@ -4,6 +4,7 @@
  "type": "object",
  "required": [
    "group_addr",
+    "key_size",
    "mix_denom",
    "multisig_addr"
  ],
@@ -11,6 +12,12 @@
    "group_addr": {
      "type": "string"
    },
+    "key_size": {
+      "description": "Specifies the number of elements in the derived keys",
+      "type": "integer",
+      "format": "uint32",
+      "minimum": 0.0
+    },
    "mix_denom": {
      "type": "string"
    },
@@ -2,6 +2,19 @@
  "$schema": "http://json-schema.org/draft-07/schema#",
  "title": "QueryMsg",
  "oneOf": [
+    {
+      "type": "object",
+      "required": [
+        "get_state"
+      ],
+      "properties": {
+        "get_state": {
+          "type": "object",
+          "additionalProperties": false
+        }
+      },
+      "additionalProperties": false
+    },
    {
      "type": "object",
      "required": [
@@ -123,33 +136,194 @@
    {
      "type": "object",
      "required": [
-        "get_dealing"
+        "get_dealings_metadata"
      ],
      "properties": {
-        "get_dealing": {
+        "get_dealings_metadata": {
          "type": "object",
          "required": [
-            "idx"
+            "dealer",
+            "dealing_index",
+            "epoch_id"
          ],
          "properties": {
-            "idx": {
+            "dealer": {
+              "type": "string"
+            },
+            "dealing_index": {
+              "type": "integer",
+              "format": "uint32",
+              "minimum": 0.0
+            },
+            "epoch_id": {
+              "type": "integer",
+              "format": "uint64",
+              "minimum": 0.0
+            }
+          },
+          "additionalProperties": false
+        }
+      },
+      "additionalProperties": false
+    },
+    {
+      "type": "object",
+      "required": [
+        "get_dealer_dealings_status"
+      ],
+      "properties": {
+        "get_dealer_dealings_status": {
+          "type": "object",
+          "required": [
+            "dealer",
+            "epoch_id"
+          ],
+          "properties": {
+            "dealer": {
+              "type": "string"
+            },
+            "epoch_id": {
+              "type": "integer",
+              "format": "uint64",
+              "minimum": 0.0
+            }
+          },
+          "additionalProperties": false
+        }
+      },
+      "additionalProperties": false
+    },
+    {
+      "type": "object",
+      "required": [
+        "get_dealing_status"
+      ],
+      "properties": {
+        "get_dealing_status": {
+          "type": "object",
+          "required": [
+            "dealer",
+            "dealing_index",
+            "epoch_id"
+          ],
+          "properties": {
+            "dealer": {
+              "type": "string"
+            },
+            "dealing_index": {
+              "type": "integer",
+              "format": "uint32",
+              "minimum": 0.0
+            },
+            "epoch_id": {
+              "type": "integer",
+              "format": "uint64",
+              "minimum": 0.0
+            }
+          },
+          "additionalProperties": false
+        }
+      },
+      "additionalProperties": false
+    },
+    {
+      "type": "object",
+      "required": [
+        "get_dealing_chunk_status"
+      ],
+      "properties": {
+        "get_dealing_chunk_status": {
+          "type": "object",
+          "required": [
+            "chunk_index",
+            "dealer",
+            "dealing_index",
+            "epoch_id"
+          ],
+          "properties": {
+            "chunk_index": {
+              "type": "integer",
+              "format": "uint16",
+              "minimum": 0.0
+            },
+            "dealer": {
+              "type": "string"
+            },
+            "dealing_index": {
+              "type": "integer",
+              "format": "uint32",
+              "minimum": 0.0
+            },
+            "epoch_id": {
+              "type": "integer",
+              "format": "uint64",
+              "minimum": 0.0
+            }
+          },
+          "additionalProperties": false
+        }
+      },
+      "additionalProperties": false
+    },
+    {
+      "type": "object",
+      "required": [
+        "get_dealing_chunk"
+      ],
+      "properties": {
+        "get_dealing_chunk": {
+          "type": "object",
+          "required": [
+            "chunk_index",
+            "dealer",
+            "dealing_index",
+            "epoch_id"
+          ],
+          "properties": {
+            "chunk_index": {
+              "type": "integer",
+              "format": "uint16",
+              "minimum": 0.0
+            },
+            "dealer": {
+              "type": "string"
+            },
+            "dealing_index": {
+              "type": "integer",
+              "format": "uint32",
+              "minimum": 0.0
+            },
+            "epoch_id": {
+              "type": "integer",
+              "format": "uint64",
+              "minimum": 0.0
+            }
+          },
+          "additionalProperties": false
+        }
+      },
+      "additionalProperties": false
+    },
+    {
+      "type": "object",
+      "required": [
+        "get_verification_key"
+      ],
+      "properties": {
+        "get_verification_key": {
+          "type": "object",
+          "required": [
+            "epoch_id",
+            "owner"
+          ],
+          "properties": {
+            "epoch_id": {
              "type": "integer",
              "format": "uint64",
              "minimum": 0.0
            },
-            "limit": {
-              "type": [
-                "integer",
-                "null"
-              ],
-              "format": "uint32",
-              "minimum": 0.0
-            },
-            "start_after": {
-              "type": [
-                "string",
-                "null"
-              ]
+            "owner": {
+              "type": "string"
            }
          },
          "additionalProperties": false
@@ -193,6 +367,20 @@
        }
      },
      "additionalProperties": false
+    },
+    {
+      "description": "Gets the stored contract version information that's required by the CW2 spec interface for migrations.",
+      "type": "object",
+      "required": [
+        "get_cw2_contract_version"
+      ],
+      "properties": {
+        "get_cw2_contract_version": {
+          "type": "object",
+          "additionalProperties": false
+        }
+      },
+      "additionalProperties": false
    }
  ]
 }
@@ -0,0 +1,20 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "title": "ContractVersion",
+  "type": "object",
+  "required": [
+    "contract",
+    "version"
+  ],
+  "properties": {
+    "contract": {
+      "description": "contract is the crate name of the implementing contract, eg. `crate:cw20-base` we will use other prefixes for other languages, and their standard global namespacing",
+      "type": "string"
+    },
+    "version": {
+      "description": "version is any string that this implementation knows. It may be simple counter \"1\", \"2\". or semantic version on release tags \"v0.7.0\", or some custom feature flag list. the only code that needs to understand the version parsing is code that knows how to migrate from the given contract (and is tied to it's implementation somehow)",
+      "type": "string"
+    }
+  },
+  "additionalProperties": false
+}
@@ -42,7 +42,8 @@
        "address",
        "announce_address",
        "assigned_index",
-        "bte_public_key_with_proof"
+        "bte_public_key_with_proof",
+        "ed25519_identity"
      ],
      "properties": {
        "address": {
@@ -58,6 +59,9 @@
        },
        "bte_public_key_with_proof": {
          "type": "string"
+        },
+        "ed25519_identity": {
+          "type": "string"
        }
      },
      "additionalProperties": false
@@ -4,7 +4,6 @@
  "type": "object",
  "required": [
    "epoch_id",
-    "finish_timestamp",
    "state",
    "time_configuration"
  ],
@@ -15,7 +14,14 @@
      "minimum": 0.0
    },
    "finish_timestamp": {
-      "$ref": "#/definitions/Timestamp"
+      "anyOf": [
+        {
+          "$ref": "#/definitions/Timestamp"
+        },
+        {
+          "type": "null"
+        }
+      ]
    },
    "state": {
      "$ref": "#/definitions/EpochState"
@@ -31,6 +37,7 @@
        {
          "type": "string",
          "enum": [
+            "waiting_initialisation",
            "in_progress"
          ]
        },
@@ -0,0 +1,74 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "title": "DealerDealingsStatusResponse",
+  "type": "object",
+  "required": [
+    "all_dealings_fully_submitted",
+    "dealer",
+    "dealing_submission_status",
+    "epoch_id"
+  ],
+  "properties": {
+    "all_dealings_fully_submitted": {
+      "type": "boolean"
+    },
+    "dealer": {
+      "$ref": "#/definitions/Addr"
+    },
+    "dealing_submission_status": {
+      "type": "object",
+      "additionalProperties": {
+        "$ref": "#/definitions/DealingStatus"
+      }
+    },
+    "epoch_id": {
+      "type": "integer",
+      "format": "uint64",
+      "minimum": 0.0
+    }
+  },
+  "additionalProperties": false,
+  "definitions": {
+    "Addr": {
+      "description": "A human readable address.\n\nIn Cosmos, this is typically bech32 encoded. But for multi-chain smart contracts no assumptions should be made other than being UTF-8 encoded and of reasonable length.\n\nThis type represents a validated address. It can be created in the following ways 1. Use `Addr::unchecked(input)` 2. Use `let checked: Addr = deps.api.addr_validate(input)?` 3. Use `let checked: Addr = deps.api.addr_humanize(canonical_addr)?` 4. Deserialize from JSON. This must only be done from JSON that was validated before such as a contract's state. `Addr` must not be used in messages sent by the user because this would result in unvalidated instances.\n\nThis type is immutable. If you really need to mutate it (Really? Are you sure?), create a mutable copy using `let mut mutable = Addr::to_string()` and operate on that `String` instance.",
+      "type": "string"
+    },
+    "ChunkSubmissionStatus": {
+      "type": "object",
+      "properties": {
+        "submission_height": {
+          "type": [
+            "integer",
+            "null"
+          ],
+          "format": "uint64",
+          "minimum": 0.0
+        }
+      },
+      "additionalProperties": false
+    },
+    "DealingStatus": {
+      "type": "object",
+      "required": [
+        "chunk_submission_status",
+        "fully_submitted",
+        "has_metadata"
+      ],
+      "properties": {
+        "chunk_submission_status": {
+          "type": "object",
+          "additionalProperties": {
+            "$ref": "#/definitions/ChunkSubmissionStatus"
+          }
+        },
+        "fully_submitted": {
+          "type": "boolean"
+        },
+        "has_metadata": {
+          "type": "boolean"
+        }
+      },
+      "additionalProperties": false
+    }
+  }
+}
@@ -32,7 +32,8 @@
        "address",
        "announce_address",
        "assigned_index",
-        "bte_public_key_with_proof"
+        "bte_public_key_with_proof",
+        "ed25519_identity"
      ],
      "properties": {
        "address": {
@@ -48,6 +49,9 @@
        },
        "bte_public_key_with_proof": {
          "type": "string"
+        },
+        "ed25519_identity": {
+          "type": "string"
        }
      },
      "additionalProperties": false
@@ -1,33 +1,35 @@
 {
  "$schema": "http://json-schema.org/draft-07/schema#",
-  "title": "PagedDealingsResponse",
+  "title": "DealingResponse",
  "type": "object",
  "required": [
-    "dealings",
-    "per_page"
+    "dealer",
+    "dealing_index",
+    "epoch_id"
  ],
  "properties": {
-    "dealings": {
-      "type": "array",
-      "items": {
-        "$ref": "#/definitions/ContractDealing"
-      }
+    "dealer": {
+      "$ref": "#/definitions/Addr"
    },
-    "per_page": {
-      "type": "integer",
-      "format": "uint",
-      "minimum": 0.0
-    },
-    "start_next_after": {
-      "description": "Field indicating paging information for the following queries if the caller wishes to get further entries.",
+    "dealing": {
      "anyOf": [
        {
-          "$ref": "#/definitions/Addr"
+          "$ref": "#/definitions/ContractSafeBytes"
        },
        {
          "type": "null"
        }
      ]
+    },
+    "dealing_index": {
+      "type": "integer",
+      "format": "uint32",
+      "minimum": 0.0
+    },
+    "epoch_id": {
+      "type": "integer",
+      "format": "uint64",
+      "minimum": 0.0
    }
  },
  "additionalProperties": false,
@@ -36,22 +38,6 @@
      "description": "A human readable address.\n\nIn Cosmos, this is typically bech32 encoded. But for multi-chain smart contracts no assumptions should be made other than being UTF-8 encoded and of reasonable length.\n\nThis type represents a validated address. It can be created in the following ways 1. Use `Addr::unchecked(input)` 2. Use `let checked: Addr = deps.api.addr_validate(input)?` 3. Use `let checked: Addr = deps.api.addr_humanize(canonical_addr)?` 4. Deserialize from JSON. This must only be done from JSON that was validated before such as a contract's state. `Addr` must not be used in messages sent by the user because this would result in unvalidated instances.\n\nThis type is immutable. If you really need to mutate it (Really? Are you sure?), create a mutable copy using `let mut mutable = Addr::to_string()` and operate on that `String` instance.",
      "type": "string"
    },
-    "ContractDealing": {
-      "type": "object",
-      "required": [
-        "dealer",
-        "dealing"
-      ],
-      "properties": {
-        "dealer": {
-          "$ref": "#/definitions/Addr"
-        },
-        "dealing": {
-          "$ref": "#/definitions/ContractSafeBytes"
-        }
-      },
-      "additionalProperties": false
-    },
    "ContractSafeBytes": {
      "type": "array",
      "items": {
@@ -0,0 +1,56 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "title": "DealingChunkResponse",
+  "type": "object",
+  "required": [
+    "chunk_index",
+    "dealer",
+    "dealing_index",
+    "epoch_id"
+  ],
+  "properties": {
+    "chunk": {
+      "anyOf": [
+        {
+          "$ref": "#/definitions/ContractSafeBytes"
+        },
+        {
+          "type": "null"
+        }
+      ]
+    },
+    "chunk_index": {
+      "type": "integer",
+      "format": "uint16",
+      "minimum": 0.0
+    },
+    "dealer": {
+      "$ref": "#/definitions/Addr"
+    },
+    "dealing_index": {
+      "type": "integer",
+      "format": "uint32",
+      "minimum": 0.0
+    },
+    "epoch_id": {
+      "type": "integer",
+      "format": "uint64",
+      "minimum": 0.0
+    }
+  },
+  "additionalProperties": false,
+  "definitions": {
+    "Addr": {
+      "description": "A human readable address.\n\nIn Cosmos, this is typically bech32 encoded. But for multi-chain smart contracts no assumptions should be made other than being UTF-8 encoded and of reasonable length.\n\nThis type represents a validated address. It can be created in the following ways 1. Use `Addr::unchecked(input)` 2. Use `let checked: Addr = deps.api.addr_validate(input)?` 3. Use `let checked: Addr = deps.api.addr_humanize(canonical_addr)?` 4. Deserialize from JSON. This must only be done from JSON that was validated before such as a contract's state. `Addr` must not be used in messages sent by the user because this would result in unvalidated instances.\n\nThis type is immutable. If you really need to mutate it (Really? Are you sure?), create a mutable copy using `let mut mutable = Addr::to_string()` and operate on that `String` instance.",
+      "type": "string"
+    },
+    "ContractSafeBytes": {
+      "type": "array",
+      "items": {
+        "type": "integer",
+        "format": "uint8",
+        "minimum": 0.0
+      }
+    }
+  }
+}
@@ -0,0 +1,56 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "title": "DealingChunkStatusResponse",
+  "type": "object",
+  "required": [
+    "chunk_index",
+    "dealer",
+    "dealing_index",
+    "epoch_id",
+    "status"
+  ],
+  "properties": {
+    "chunk_index": {
+      "type": "integer",
+      "format": "uint16",
+      "minimum": 0.0
+    },
+    "dealer": {
+      "$ref": "#/definitions/Addr"
+    },
+    "dealing_index": {
+      "type": "integer",
+      "format": "uint32",
+      "minimum": 0.0
+    },
+    "epoch_id": {
+      "type": "integer",
+      "format": "uint64",
+      "minimum": 0.0
+    },
+    "status": {
+      "$ref": "#/definitions/ChunkSubmissionStatus"
+    }
+  },
+  "additionalProperties": false,
+  "definitions": {
+    "Addr": {
+      "description": "A human readable address.\n\nIn Cosmos, this is typically bech32 encoded. But for multi-chain smart contracts no assumptions should be made other than being UTF-8 encoded and of reasonable length.\n\nThis type represents a validated address. It can be created in the following ways 1. Use `Addr::unchecked(input)` 2. Use `let checked: Addr = deps.api.addr_validate(input)?` 3. Use `let checked: Addr = deps.api.addr_humanize(canonical_addr)?` 4. Deserialize from JSON. This must only be done from JSON that was validated before such as a contract's state. `Addr` must not be used in messages sent by the user because this would result in unvalidated instances.\n\nThis type is immutable. If you really need to mutate it (Really? Are you sure?), create a mutable copy using `let mut mutable = Addr::to_string()` and operate on that `String` instance.",
+      "type": "string"
+    },
+    "ChunkSubmissionStatus": {
+      "type": "object",
+      "properties": {
+        "submission_height": {
+          "type": [
+            "integer",
+            "null"
+          ],
+          "format": "uint64",
+          "minimum": 0.0
+        }
+      },
+      "additionalProperties": false
+    }
+  }
+}
@@ -0,0 +1,73 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "title": "DealingStatusResponse",
+  "type": "object",
+  "required": [
+    "dealer",
+    "dealing_index",
+    "epoch_id",
+    "status"
+  ],
+  "properties": {
+    "dealer": {
+      "$ref": "#/definitions/Addr"
+    },
+    "dealing_index": {
+      "type": "integer",
+      "format": "uint32",
+      "minimum": 0.0
+    },
+    "epoch_id": {
+      "type": "integer",
+      "format": "uint64",
+      "minimum": 0.0
+    },
+    "status": {
+      "$ref": "#/definitions/DealingStatus"
+    }
+  },
+  "additionalProperties": false,
+  "definitions": {
+    "Addr": {
+      "description": "A human readable address.\n\nIn Cosmos, this is typically bech32 encoded. But for multi-chain smart contracts no assumptions should be made other than being UTF-8 encoded and of reasonable length.\n\nThis type represents a validated address. It can be created in the following ways 1. Use `Addr::unchecked(input)` 2. Use `let checked: Addr = deps.api.addr_validate(input)?` 3. Use `let checked: Addr = deps.api.addr_humanize(canonical_addr)?` 4. Deserialize from JSON. This must only be done from JSON that was validated before such as a contract's state. `Addr` must not be used in messages sent by the user because this would result in unvalidated instances.\n\nThis type is immutable. If you really need to mutate it (Really? Are you sure?), create a mutable copy using `let mut mutable = Addr::to_string()` and operate on that `String` instance.",
+      "type": "string"
+    },
+    "ChunkSubmissionStatus": {
+      "type": "object",
+      "properties": {
+        "submission_height": {
+          "type": [
+            "integer",
+            "null"
+          ],
+          "format": "uint64",
+          "minimum": 0.0
+        }
+      },
+      "additionalProperties": false
+    },
+    "DealingStatus": {
+      "type": "object",
+      "required": [
+        "chunk_submission_status",
+        "fully_submitted",
+        "has_metadata"
+      ],
+      "properties": {
+        "chunk_submission_status": {
+          "type": "object",
+          "additionalProperties": {
+            "$ref": "#/definitions/ChunkSubmissionStatus"
+          }
+        },
+        "fully_submitted": {
+          "type": "boolean"
+        },
+        "has_metadata": {
+          "type": "boolean"
+        }
+      },
+      "additionalProperties": false
+    }
+  }
+}
@@ -0,0 +1,68 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "title": "PagedDealingsResponse",
+  "type": "object",
+  "required": [
+    "dealer",
+    "dealings",
+    "epoch_id"
+  ],
+  "properties": {
+    "dealer": {
+      "$ref": "#/definitions/Addr"
+    },
+    "dealings": {
+      "type": "array",
+      "items": {
+        "$ref": "#/definitions/PartialContractDealing"
+      }
+    },
+    "epoch_id": {
+      "type": "integer",
+      "format": "uint64",
+      "minimum": 0.0
+    },
+    "start_next_after": {
+      "description": "Field indicating paging information for the following queries if the caller wishes to get further entries.",
+      "type": [
+        "integer",
+        "null"
+      ],
+      "format": "uint32",
+      "minimum": 0.0
+    }
+  },
+  "additionalProperties": false,
+  "definitions": {
+    "Addr": {
+      "description": "A human readable address.\n\nIn Cosmos, this is typically bech32 encoded. But for multi-chain smart contracts no assumptions should be made other than being UTF-8 encoded and of reasonable length.\n\nThis type represents a validated address. It can be created in the following ways 1. Use `Addr::unchecked(input)` 2. Use `let checked: Addr = deps.api.addr_validate(input)?` 3. Use `let checked: Addr = deps.api.addr_humanize(canonical_addr)?` 4. Deserialize from JSON. This must only be done from JSON that was validated before such as a contract's state. `Addr` must not be used in messages sent by the user because this would result in unvalidated instances.\n\nThis type is immutable. If you really need to mutate it (Really? Are you sure?), create a mutable copy using `let mut mutable = Addr::to_string()` and operate on that `String` instance.",
+      "type": "string"
+    },
+    "ContractSafeBytes": {
+      "type": "array",
+      "items": {
+        "type": "integer",
+        "format": "uint8",
+        "minimum": 0.0
+      }
+    },
+    "PartialContractDealing": {
+      "type": "object",
+      "required": [
+        "data",
+        "index"
+      ],
+      "properties": {
+        "data": {
+          "$ref": "#/definitions/ContractSafeBytes"
+        },
+        "index": {
+          "type": "integer",
+          "format": "uint32",
+          "minimum": 0.0
+        }
+      },
+      "additionalProperties": false
+    }
+  }
+}
@@ -0,0 +1,107 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "title": "DealingMetadataResponse",
+  "type": "object",
+  "required": [
+    "dealer",
+    "dealing_index",
+    "epoch_id"
+  ],
+  "properties": {
+    "dealer": {
+      "$ref": "#/definitions/Addr"
+    },
+    "dealing_index": {
+      "type": "integer",
+      "format": "uint32",
+      "minimum": 0.0
+    },
+    "epoch_id": {
+      "type": "integer",
+      "format": "uint64",
+      "minimum": 0.0
+    },
+    "metadata": {
+      "anyOf": [
+        {
+          "$ref": "#/definitions/DealingMetadata"
+        },
+        {
+          "type": "null"
+        }
+      ]
+    }
+  },
+  "additionalProperties": false,
+  "definitions": {
+    "Addr": {
+      "description": "A human readable address.\n\nIn Cosmos, this is typically bech32 encoded. But for multi-chain smart contracts no assumptions should be made other than being UTF-8 encoded and of reasonable length.\n\nThis type represents a validated address. It can be created in the following ways 1. Use `Addr::unchecked(input)` 2. Use `let checked: Addr = deps.api.addr_validate(input)?` 3. Use `let checked: Addr = deps.api.addr_humanize(canonical_addr)?` 4. Deserialize from JSON. This must only be done from JSON that was validated before such as a contract's state. `Addr` must not be used in messages sent by the user because this would result in unvalidated instances.\n\nThis type is immutable. If you really need to mutate it (Really? Are you sure?), create a mutable copy using `let mut mutable = Addr::to_string()` and operate on that `String` instance.",
+      "type": "string"
+    },
+    "ChunkSubmissionStatus": {
+      "type": "object",
+      "properties": {
+        "submission_height": {
+          "type": [
+            "integer",
+            "null"
+          ],
+          "format": "uint64",
+          "minimum": 0.0
+        }
+      },
+      "additionalProperties": false
+    },
+    "DealingChunkInfo": {
+      "type": "object",
+      "required": [
+        "size"
+      ],
+      "properties": {
+        "size": {
+          "type": "integer",
+          "format": "uint64",
+          "minimum": 0.0
+        }
+      },
+      "additionalProperties": false
+    },
+    "DealingMetadata": {
+      "type": "object",
+      "required": [
+        "dealing_index",
+        "submitted_chunks"
+      ],
+      "properties": {
+        "dealing_index": {
+          "type": "integer",
+          "format": "uint32",
+          "minimum": 0.0
+        },
+        "submitted_chunks": {
+          "type": "object",
+          "additionalProperties": {
+            "$ref": "#/definitions/SubmittedChunk"
+          }
+        }
+      },
+      "additionalProperties": false
+    },
+    "SubmittedChunk": {
+      "type": "object",
+      "required": [
+        "info",
+        "status"
+      ],
+      "properties": {
+        "info": {
+          "$ref": "#/definitions/DealingChunkInfo"
+        },
+        "status": {
+          "$ref": "#/definitions/ChunkSubmissionStatus"
+        }
+      },
+      "additionalProperties": false
+    }
+  }
+}
@@ -42,7 +42,8 @@
        "address",
        "announce_address",
        "assigned_index",
-        "bte_public_key_with_proof"
+        "bte_public_key_with_proof",
+        "ed25519_identity"
      ],
      "properties": {
        "address": {
@@ -58,6 +59,9 @@
        },
        "bte_public_key_with_proof": {
          "type": "string"
+        },
+        "ed25519_identity": {
+          "type": "string"
        }
      },
      "additionalProperties": false
@@ -0,0 +1,43 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "title": "State",
+  "type": "object",
+  "required": [
+    "group_addr",
+    "key_size",
+    "mix_denom",
+    "multisig_addr"
+  ],
+  "properties": {
+    "group_addr": {
+      "$ref": "#/definitions/Cw4Contract"
+    },
+    "key_size": {
+      "description": "Specifies the number of elements in the derived keys",
+      "type": "integer",
+      "format": "uint32",
+      "minimum": 0.0
+    },
+    "mix_denom": {
+      "type": "string"
+    },
+    "multisig_addr": {
+      "$ref": "#/definitions/Addr"
+    }
+  },
+  "additionalProperties": false,
+  "definitions": {
+    "Addr": {
+      "description": "A human readable address.\n\nIn Cosmos, this is typically bech32 encoded. But for multi-chain smart contracts no assumptions should be made other than being UTF-8 encoded and of reasonable length.\n\nThis type represents a validated address. It can be created in the following ways 1. Use `Addr::unchecked(input)` 2. Use `let checked: Addr = deps.api.addr_validate(input)?` 3. Use `let checked: Addr = deps.api.addr_humanize(canonical_addr)?` 4. Deserialize from JSON. This must only be done from JSON that was validated before such as a contract's state. `Addr` must not be used in messages sent by the user because this would result in unvalidated instances.\n\nThis type is immutable. If you really need to mutate it (Really? Are you sure?), create a mutable copy using `let mut mutable = Addr::to_string()` and operate on that `String` instance.",
+      "type": "string"
+    },
+    "Cw4Contract": {
+      "description": "Cw4Contract is a wrapper around Addr that provides a lot of helpers for working with cw4 contracts\n\nIf you wish to persist this, convert to Cw4CanonicalContract via .canonical()",
+      "allOf": [
+        {
+          "$ref": "#/definitions/Addr"
+        }
+      ]
+    }
+  }
+}
@@ -0,0 +1,72 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "title": "VkShareResponse",
+  "type": "object",
+  "required": [
+    "epoch_id",
+    "owner"
+  ],
+  "properties": {
+    "epoch_id": {
+      "type": "integer",
+      "format": "uint64",
+      "minimum": 0.0
+    },
+    "owner": {
+      "$ref": "#/definitions/Addr"
+    },
+    "share": {
+      "anyOf": [
+        {
+          "$ref": "#/definitions/ContractVKShare"
+        },
+        {
+          "type": "null"
+        }
+      ]
+    }
+  },
+  "additionalProperties": false,
+  "definitions": {
+    "Addr": {
+      "description": "A human readable address.\n\nIn Cosmos, this is typically bech32 encoded. But for multi-chain smart contracts no assumptions should be made other than being UTF-8 encoded and of reasonable length.\n\nThis type represents a validated address. It can be created in the following ways 1. Use `Addr::unchecked(input)` 2. Use `let checked: Addr = deps.api.addr_validate(input)?` 3. Use `let checked: Addr = deps.api.addr_humanize(canonical_addr)?` 4. Deserialize from JSON. This must only be done from JSON that was validated before such as a contract's state. `Addr` must not be used in messages sent by the user because this would result in unvalidated instances.\n\nThis type is immutable. If you really need to mutate it (Really? Are you sure?), create a mutable copy using `let mut mutable = Addr::to_string()` and operate on that `String` instance.",
+      "type": "string"
+    },
+    "ContractVKShare": {
+      "type": "object",
+      "required": [
+        "announce_address",
+        "epoch_id",
+        "node_index",
+        "owner",
+        "share",
+        "verified"
+      ],
+      "properties": {
+        "announce_address": {
+          "type": "string"
+        },
+        "epoch_id": {
+          "type": "integer",
+          "format": "uint64",
+          "minimum": 0.0
+        },
+        "node_index": {
+          "type": "integer",
+          "format": "uint64",
+          "minimum": 0.0
+        },
+        "owner": {
+          "$ref": "#/definitions/Addr"
+        },
+        "share": {
+          "type": "string"
+        },
+        "verified": {
+          "type": "boolean"
+        }
+      },
+      "additionalProperties": false
+    }
+  }
+}
@@ -1,20 +1,26 @@
-// Copyright 2022 - Nym Technologies SA <contact@nymtech.net>
+// Copyright 2022-2024 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0

 use crate::dealers::queries::{
    query_current_dealers_paged, query_dealer_details, query_past_dealers_paged,
 };
 use crate::dealers::transactions::try_add_dealer;
-use crate::dealings::queries::query_dealings_paged;
-use crate::dealings::transactions::try_commit_dealings;
+use crate::dealings::queries::{
+    query_dealer_dealings_status, query_dealing_chunk, query_dealing_chunk_status,
+    query_dealing_metadata, query_dealing_status,
+};
+use crate::dealings::transactions::{try_commit_dealings_chunk, try_submit_dealings_metadata};
 use crate::epoch_state::queries::{
    query_current_epoch, query_current_epoch_threshold, query_initial_dealers,
 };
 use crate::epoch_state::storage::CURRENT_EPOCH;
-use crate::epoch_state::transactions::{advance_epoch_state, try_surpassed_threshold};
+use crate::epoch_state::transactions::{
+    advance_epoch_state, try_initiate_dkg, try_surpassed_threshold,
+};
 use crate::error::ContractError;
-use crate::state::{State, MULTISIG, STATE};
-use crate::verification_key_shares::queries::query_vk_shares_paged;
+use crate::state::queries::query_state;
+use crate::state::storage::{DKG_ADMIN, MULTISIG, STATE};
+use crate::verification_key_shares::queries::{query_vk_share, query_vk_shares_paged};
 use crate::verification_key_shares::transactions::try_commit_verification_key_share;
 use crate::verification_key_shares::transactions::try_verify_verification_key_share;
 use cosmwasm_std::{
@@ -22,7 +28,11 @@ use cosmwasm_std::{
 };
 use cw4::Cw4Contract;
 use nym_coconut_dkg_common::msg::{ExecuteMsg, InstantiateMsg, MigrateMsg, QueryMsg};
-use nym_coconut_dkg_common::types::{Epoch, EpochState};
+use nym_coconut_dkg_common::types::{Epoch, EpochState, State};
+use semver::Version;
+
+const CONTRACT_NAME: &str = "crate:nym-coconut-dkg";
+const CONTRACT_VERSION: &str = env!("CARGO_PKG_VERSION");

 /// Instantiate the contract.
 ///
@@ -33,13 +43,15 @@ use nym_coconut_dkg_common::types::{Epoch, EpochState};
 pub fn instantiate(
    mut deps: DepsMut<'_>,
    env: Env,
-    _info: MessageInfo,
+    info: MessageInfo,
    msg: InstantiateMsg,
 ) -> Result<Response, ContractError> {
    let multisig_addr = deps.api.addr_validate(&msg.multisig_addr)?;
    MULTISIG.set(deps.branch(), Some(multisig_addr.clone()))?;

-    let group_addr = Cw4Contract(deps.api.addr_validate(&msg.group_addr).map_err(|_| {
+    DKG_ADMIN.set(deps.branch(), Some(info.sender))?;
+
+    let group_addr = Cw4Contract::new(deps.api.addr_validate(&msg.group_addr).map_err(|_| {
        ContractError::InvalidGroup {
            addr: msg.group_addr.clone(),
        }
@@ -49,19 +61,22 @@ pub fn instantiate(
        group_addr,
        multisig_addr,
        mix_denom: msg.mix_denom,
+        key_size: msg.key_size,
    };
    STATE.save(deps.storage, &state)?;

    CURRENT_EPOCH.save(
        deps.storage,
        &Epoch::new(
-            EpochState::default(),
+            EpochState::WaitingInitialisation,
            0,
            msg.time_configuration.unwrap_or_default(),
            env.block.time,
        ),
    )?;

+    cw2::set_contract_version(deps.storage, CONTRACT_NAME, CONTRACT_VERSION)?;
+
    Ok(Response::default())
 }

@@ -74,15 +89,28 @@ pub fn execute(
    msg: ExecuteMsg,
 ) -> Result<Response, ContractError> {
    match msg {
+        ExecuteMsg::InitiateDkg {} => try_initiate_dkg(deps, env, info),
        ExecuteMsg::RegisterDealer {
            bte_key_with_proof,
+            identity_key,
            announce_address,
            resharing,
-        } => try_add_dealer(deps, info, bte_key_with_proof, announce_address, resharing),
-        ExecuteMsg::CommitDealing {
-            dealing_bytes,
+        } => try_add_dealer(
+            deps,
+            info,
+            bte_key_with_proof,
+            identity_key,
+            announce_address,
            resharing,
-        } => try_commit_dealings(deps, info, dealing_bytes, resharing),
+        ),
+        ExecuteMsg::CommitDealingsMetadata {
+            dealing_index,
+            chunks,
+            resharing,
+        } => try_submit_dealings_metadata(deps, info, dealing_index, chunks, resharing),
+        ExecuteMsg::CommitDealingsChunk { chunk, resharing } => {
+            try_commit_dealings_chunk(deps, env, info, chunk, resharing)
+        }
        ExecuteMsg::CommitVerificationKeyShare { share, resharing } => {
            try_commit_verification_key_share(deps, env, info, share, resharing)
        }
@@ -97,6 +125,7 @@ pub fn execute(
 #[entry_point]
 pub fn query(deps: Deps<'_>, _env: Env, msg: QueryMsg) -> Result<QueryResponse, ContractError> {
    let response = match msg {
+        QueryMsg::GetState {} => to_binary(&query_state(deps.storage)?)?,
        QueryMsg::GetCurrentEpochState {} => to_binary(&query_current_epoch(deps.storage)?)?,
        QueryMsg::GetCurrentEpochThreshold {} => {
            to_binary(&query_current_epoch_threshold(deps.storage)?)?
@@ -111,24 +140,90 @@ pub fn query(deps: Deps<'_>, _env: Env, msg: QueryMsg) -> Result<QueryResponse,
        QueryMsg::GetPastDealers { limit, start_after } => {
            to_binary(&query_past_dealers_paged(deps, start_after, limit)?)?
        }
-        QueryMsg::GetDealing {
-            idx,
-            limit,
-            start_after,
-        } => to_binary(&query_dealings_paged(deps, idx, start_after, limit)?)?,
+        QueryMsg::GetDealingsMetadata {
+            epoch_id,
+            dealer,
+            dealing_index,
+        } => to_binary(&query_dealing_metadata(
+            deps,
+            epoch_id,
+            dealer,
+            dealing_index,
+        )?)?,
+        QueryMsg::GetDealerDealingsStatus { epoch_id, dealer } => {
+            to_binary(&query_dealer_dealings_status(deps, epoch_id, dealer)?)?
+        }
+        QueryMsg::GetDealingStatus {
+            epoch_id,
+            dealer,
+            dealing_index,
+        } => to_binary(&query_dealing_status(
+            deps,
+            epoch_id,
+            dealer,
+            dealing_index,
+        )?)?,
+        QueryMsg::GetDealingChunkStatus {
+            epoch_id,
+            dealer,
+            dealing_index,
+            chunk_index,
+        } => to_binary(&query_dealing_chunk_status(
+            deps,
+            epoch_id,
+            dealer,
+            dealing_index,
+            chunk_index,
+        )?)?,
+        QueryMsg::GetDealingChunk {
+            epoch_id,
+            dealer,
+            dealing_index,
+            chunk_index,
+        } => to_binary(&query_dealing_chunk(
+            deps,
+            epoch_id,
+            dealer,
+            dealing_index,
+            chunk_index,
+        )?)?,
+        QueryMsg::GetVerificationKey { owner, epoch_id } => {
+            to_binary(&query_vk_share(deps, owner, epoch_id)?)?
+        }
        QueryMsg::GetVerificationKeys {
            epoch_id,
            limit,
            start_after,
        } => to_binary(&query_vk_shares_paged(deps, epoch_id, start_after, limit)?)?,
+        QueryMsg::GetCW2ContractVersion {} => to_binary(&cw2::get_contract_version(deps.storage)?)?,
    };

    Ok(response)
 }

 #[entry_point]
-pub fn migrate(_deps: DepsMut<'_>, _env: Env, _msg: MigrateMsg) -> Result<Response, ContractError> {
-    Ok(Default::default())
+pub fn migrate(deps: DepsMut<'_>, _env: Env, _msg: MigrateMsg) -> Result<Response, ContractError> {
+    fn parse_semver(raw: &str) -> Result<Version, ContractError> {
+        raw.parse()
+            .map_err(|error: semver::Error| ContractError::SemVerFailure {
+                value: CONTRACT_VERSION.to_string(),
+                error_message: error.to_string(),
+            })
+    }
+
+    // Note: don't remove this particular bit of code as we have to ALWAYS check whether we have to
+    // update the stored version
+    let build_version: Version = parse_semver(CONTRACT_VERSION)?;
+    let stored_version: Version = parse_semver(&cw2::get_contract_version(deps.storage)?.version)?;
+
+    if stored_version < build_version {
+        cw2::set_contract_version(deps.storage, CONTRACT_NAME, CONTRACT_VERSION)?;
+
+        // If state structure changed in any contract version in the way migration is needed, it
+        // should occur here, for example anything from `crate::queued_migrations::`
+    }
+
+    Ok(Response::new())
 }

 #[cfg(test)]
@@ -140,7 +235,8 @@ mod tests {
    use cosmwasm_std::{coins, Addr};
    use cw4::Member;
    use cw_multi_test::{App, AppBuilder, AppResponse, ContractWrapper, Executor};
-    use nym_coconut_dkg_common::msg::ExecuteMsg::RegisterDealer;
+    use nym_coconut_dkg_common::dealing::DEFAULT_DEALINGS;
+    use nym_coconut_dkg_common::msg::ExecuteMsg::{InitiateDkg, RegisterDealer};
    use nym_coconut_dkg_common::types::NodeIndex;
    use nym_group_contract_common::msg::InstantiateMsg as GroupInstantiateMsg;

@@ -178,6 +274,7 @@ mod tests {
            multisig_addr: MULTISIG_CONTRACT.to_string(),
            time_configuration: None,
            mix_denom: TEST_MIX_DENOM.to_string(),
+            key_size: DEFAULT_DEALINGS as u32,
        };
        app.instantiate_contract(
            coconut_dkg_code_id,
@@ -213,6 +310,7 @@ mod tests {
            multisig_addr: "multisig_addr".to_string(),
            time_configuration: None,
            mix_denom: "nym".to_string(),
+            key_size: 5,
        };
        let info = mock_info("creator", &[]);

@@ -235,6 +333,14 @@ mod tests {
        });
        let coconut_dkg_contract_addr = instantiate_with_group(&mut app, &members);

+        app.execute_contract(
+            Addr::unchecked(ADMIN_ADDRESS),
+            coconut_dkg_contract_addr.clone(),
+            &InitiateDkg {},
+            &[],
+        )
+        .unwrap();
+
        for (idx, member) in members.iter().enumerate() {
            let res = app
                .execute_contract(
@@ -242,6 +348,7 @@ mod tests {
                    coconut_dkg_contract_addr.clone(),
                    &RegisterDealer {
                        bte_key_with_proof: "bte_key_with_proof".to_string(),
+                        identity_key: "identity".to_string(),
                        announce_address: "127.0.0.1:8000".to_string(),
                        resharing: false,
                    },
@@ -256,6 +363,7 @@ mod tests {
                    coconut_dkg_contract_addr.clone(),
                    &RegisterDealer {
                        bte_key_with_proof: "bte_key_with_proof".to_string(),
+                        identity_key: "identity".to_string(),
                        announce_address: "127.0.0.1:8000".to_string(),
                        resharing: false,
                    },
@@ -272,6 +380,7 @@ mod tests {
                coconut_dkg_contract_addr,
                &RegisterDealer {
                    bte_key_with_proof: "bte_key_with_proof".to_string(),
+                    identity_key: "identity".to_string(),
                    announce_address: "127.0.0.1:8000".to_string(),
                    resharing: false,
                },
@@ -5,7 +5,7 @@ use crate::dealers::storage as dealers_storage;
 use crate::epoch_state::storage::INITIAL_REPLACEMENT_DATA;
 use crate::epoch_state::utils::check_epoch_state;
 use crate::error::ContractError;
-use crate::state::STATE;
+use crate::state::storage::STATE;
 use cosmwasm_std::{Addr, DepsMut, MessageInfo, Response};
 use nym_coconut_dkg_common::types::{DealerDetails, EncodedBTEPublicKeyWithProof, EpochState};

@@ -34,10 +34,13 @@ fn verify_dealer(deps: DepsMut<'_>, dealer: &Addr, resharing: bool) -> Result<()
    Ok(())
 }

+// future optimisation:
+// for a recurring dealer just let it refresh the keys without having to do all the storage operations
 pub fn try_add_dealer(
    mut deps: DepsMut<'_>,
    info: MessageInfo,
    bte_key_with_proof: EncodedBTEPublicKeyWithProof,
+    identity_key: String,
    announce_address: String,
    resharing: bool,
 ) -> Result<Response, ContractError> {
@@ -65,6 +68,7 @@ pub fn try_add_dealer(
    let dealer_details = DealerDetails {
        address: info.sender.clone(),
        bte_public_key_with_proof: bte_key_with_proof,
+        ed25519_identity: identity_key,
        announce_address,
        assigned_index: node_index,
    };
@@ -77,10 +81,10 @@ pub fn try_add_dealer(
 pub(crate) mod tests {
    use super::*;
    use crate::dealers::storage::current_dealers;
-    use crate::epoch_state::transactions::advance_epoch_state;
+    use crate::epoch_state::transactions::{advance_epoch_state, try_initiate_dkg};
    use crate::support::tests::fixtures::dealer_details_fixture;
    use crate::support::tests::helpers;
-    use crate::support::tests::helpers::{add_fixture_dealer, GROUP_MEMBERS};
+    use crate::support::tests::helpers::{add_fixture_dealer, ADMIN_ADDRESS, GROUP_MEMBERS};
    use cosmwasm_std::testing::{mock_env, mock_info};
    use cw4::Member;
    use nym_coconut_dkg_common::types::{InitialReplacementData, TimeConfiguration};
@@ -137,10 +141,13 @@ pub(crate) mod tests {
    #[test]
    fn invalid_state() {
        let mut deps = helpers::init_contract();
-        let owner = Addr::unchecked("owner");
        let mut env = mock_env();
+        try_initiate_dkg(deps.as_mut(), env.clone(), mock_info(ADMIN_ADDRESS, &[])).unwrap();
+
+        let owner = Addr::unchecked("owner");
        let info = mock_info(owner.as_str(), &[]);
        let bte_key_with_proof = String::from("bte_key_with_proof");
+        let identity = String::from("identity");
        let announce_address = String::from("localhost:8000");

        env.block.time = env
@@ -155,6 +162,7 @@ pub(crate) mod tests {
            deps.as_mut(),
            info,
            bte_key_with_proof,
+            identity,
            announce_address,
            false,
        )
@@ -163,7 +171,7 @@ pub(crate) mod tests {
            ret,
            ContractError::IncorrectEpochState {
                current_state: EpochState::DealingExchange { resharing: false }.to_string(),
-                expected_state: EpochState::default().to_string(),
+                expected_state: EpochState::PublicKeySubmission { resharing: false }.to_string(),
            }
        );
    }
@@ -1,195 +1,230 @@
-// Copyright 2022 - Nym Technologies SA <contact@nymtech.net>
+// Copyright 2022-2024 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0

-use crate::dealings::storage;
-use crate::dealings::storage::DEALINGS_BYTES;
-use cosmwasm_std::{Deps, Order, StdResult};
-use cw_storage_plus::Bound;
-use nym_coconut_dkg_common::dealer::{ContractDealing, PagedDealingsResponse};
-use nym_coconut_dkg_common::types::TOTAL_DEALINGS;
+use crate::dealings::storage::{StoredDealing, DEALINGS_METADATA};
+use crate::state::storage::STATE;
+use cosmwasm_std::{Deps, StdResult};
+use nym_coconut_dkg_common::dealing::{
+    DealerDealingsStatusResponse, DealingChunkResponse, DealingChunkStatusResponse,
+    DealingMetadataResponse, DealingStatus, DealingStatusResponse,
+};
+use nym_coconut_dkg_common::types::{ChunkIndex, DealingIndex, EpochId};
+use std::collections::BTreeMap;

-pub fn query_dealings_paged(
+/// Get the metadata associated with the particular dealing
+pub fn query_dealing_metadata(
    deps: Deps<'_>,
-    idx: u64,
-    start_after: Option<String>,
-    limit: Option<u32>,
-) -> StdResult<PagedDealingsResponse> {
-    let limit = limit
-        .unwrap_or(storage::DEALINGS_PAGE_DEFAULT_LIMIT)
-        .min(storage::DEALINGS_PAGE_MAX_LIMIT) as usize;
+    epoch_id: EpochId,
+    dealer: String,
+    dealing_index: DealingIndex,
+) -> StdResult<DealingMetadataResponse> {
+    let dealer = deps.api.addr_validate(&dealer)?;
+    let metadata = DEALINGS_METADATA.may_load(deps.storage, (epoch_id, &dealer, dealing_index))?;

-    let idx = idx as usize;
-    if idx >= TOTAL_DEALINGS {
-        return Ok(PagedDealingsResponse::new(vec![], limit, None));
+    Ok(DealingMetadataResponse {
+        epoch_id,
+        dealer,
+        dealing_index,
+        metadata,
+    })
+}
+
+/// Get the status of all dealings of particular dealer for given epoch.
+pub fn query_dealer_dealings_status(
+    deps: Deps<'_>,
+    epoch_id: EpochId,
+    dealer: String,
+) -> StdResult<DealerDealingsStatusResponse> {
+    let dealer = deps.api.addr_validate(&dealer)?;
+    let state = STATE.load(deps.storage)?;
+
+    let mut dealing_submission_status: BTreeMap<DealingIndex, DealingStatus> = BTreeMap::new();
+
+    // Since our key size is in single digit range, querying all of this at once on chain is fine
+    for dealing_index in 0..state.key_size {
+        let metadata =
+            DEALINGS_METADATA.may_load(deps.storage, (epoch_id, &dealer, dealing_index))?;
+        dealing_submission_status.insert(dealing_index, metadata.into());
    }

-    let addr = start_after
-        .map(|addr| deps.api.addr_validate(&addr))
-        .transpose()?;
+    Ok(DealerDealingsStatusResponse {
+        epoch_id,
+        dealer,
+        all_dealings_fully_submitted: dealing_submission_status
+            .values()
+            .all(|d| d.fully_submitted),
+        dealing_submission_status,
+    })
+}

-    let start = addr.as_ref().map(Bound::exclusive);
+/// Get the status of particular dealing, i.e. whether it has been fully submitted.
+pub fn query_dealing_status(
+    deps: Deps<'_>,
+    epoch_id: EpochId,
+    dealer: String,
+    dealing_index: DealingIndex,
+) -> StdResult<DealingStatusResponse> {
+    let dealer = deps.api.addr_validate(&dealer)?;
+    let metadata = DEALINGS_METADATA.may_load(deps.storage, (epoch_id, &dealer, dealing_index))?;

-    let dealings = DEALINGS_BYTES[idx]
-        .range(deps.storage, start, None, Order::Ascending)
-        .take(limit)
-        .map(|res| res.map(|(dealer, dealing)| ContractDealing::new(dealing, dealer)))
-        .collect::<StdResult<Vec<_>>>()?;
+    Ok(DealingStatusResponse {
+        epoch_id,
+        dealer,
+        dealing_index,
+        status: metadata.into(),
+    })
+}

-    let start_next_after = dealings.last().map(|dealing| dealing.dealer.clone());
+/// Get the status of particular chunk, i.e. whether (and when) it has been fully submitted.
+pub fn query_dealing_chunk_status(
+    deps: Deps<'_>,
+    epoch_id: EpochId,
+    dealer: String,
+    dealing_index: DealingIndex,
+    chunk_index: ChunkIndex,
+) -> StdResult<DealingChunkStatusResponse> {
+    let dealer = deps.api.addr_validate(&dealer)?;
+    let metadata = DEALINGS_METADATA.may_load(deps.storage, (epoch_id, &dealer, dealing_index))?;

-    Ok(PagedDealingsResponse::new(
-        dealings,
-        limit,
-        start_next_after,
-    ))
+    let status = metadata
+        .as_ref()
+        .and_then(|m| m.submitted_chunks.get(&chunk_index))
+        .map(|&c| c.status)
+        .unwrap_or_default();
+
+    Ok(DealingChunkStatusResponse {
+        epoch_id,
+        dealer,
+        dealing_index,
+        chunk_index,
+        status,
+    })
+}
+
+/// Get the particular chunk of the dealing.
+pub fn query_dealing_chunk(
+    deps: Deps<'_>,
+    epoch_id: EpochId,
+    dealer: String,
+    dealing_index: DealingIndex,
+    chunk_index: ChunkIndex,
+) -> StdResult<DealingChunkResponse> {
+    let dealer = deps.api.addr_validate(&dealer)?;
+    let chunk = StoredDealing::read(deps.storage, epoch_id, &dealer, dealing_index, chunk_index);
+
+    Ok(DealingChunkResponse {
+        epoch_id,
+        dealer,
+        dealing_index,
+        chunk_index,
+        chunk,
+    })
 }

 #[cfg(test)]
 pub(crate) mod tests {
    use super::*;
-    use crate::dealings::storage::{DEALINGS_PAGE_DEFAULT_LIMIT, DEALINGS_PAGE_MAX_LIMIT};
-    use crate::support::tests::fixtures::dealing_bytes_fixture;
+    use crate::support::tests::fixtures::{dealing_bytes_fixture, partial_dealing_fixture};
    use crate::support::tests::helpers::init_contract;
    use cosmwasm_std::{Addr, DepsMut};
+    use nym_coconut_dkg_common::dealing::{DealingChunkInfo, PartialContractDealing};

-    fn fill_dealings(deps: DepsMut<'_>, size: usize) {
-        for n in 0..size {
-            let dealing_share = dealing_bytes_fixture();
-            let sender = Addr::unchecked(format!("owner{}", n));
-            (0..TOTAL_DEALINGS).for_each(|idx| {
-                DEALINGS_BYTES[idx]
-                    .save(deps.storage, &sender, &dealing_share)
-                    .unwrap();
-            });
+    #[allow(unused)]
+    fn fill_dealings(
+        deps: DepsMut<'_>,
+        epoch: EpochId,
+        dealers: usize,
+        key_size: u32,
+        chunks: u16,
+    ) {
+        for i in 0..dealers {
+            let dealer = Addr::unchecked(format!("dealer{i}"));
+            for dealing_index in 0..key_size {
+                let data = dealing_bytes_fixture();
+                let chunks = data.0.chunks(data.len() / chunks as usize);
+
+                let mut chunk_infos = Vec::new();
+                for (chunk_index, chunk) in chunks.enumerate() {
+                    chunk_infos.push(DealingChunkInfo {
+                        size: chunk.len() as u64,
+                    });
+                    StoredDealing::save(
+                        deps.storage,
+                        epoch,
+                        &dealer,
+                        PartialContractDealing {
+                            dealing_index,
+                            chunk_index: chunk_index as ChunkIndex,
+                            data: chunk.into(),
+                        },
+                    )
+                }
+            }
        }
    }

    #[test]
-    fn empty_on_bad_idx() {
+    fn test_query_dealing_chunk() {
        let mut deps = init_contract();
-        fill_dealings(deps.as_mut(), 1000);

-        for idx in TOTAL_DEALINGS as u64..100 * TOTAL_DEALINGS as u64 {
-            let page1 = query_dealings_paged(deps.as_ref(), idx, None, None).unwrap();
-            assert_eq!(0, page1.dealings.len() as u32);
-        }
+        let bad_address = "FOOMP".to_string();
+        assert!(query_dealing_chunk(deps.as_ref(), 0, bad_address, 0, 0).is_err());
+
+        let empty = query_dealing_chunk(deps.as_ref(), 0, "foo".to_string(), 0, 0).unwrap();
+        assert_eq!(empty.epoch_id, 0);
+        assert_eq!(empty.dealing_index, 0);
+        assert_eq!(empty.chunk_index, 0);
+        assert_eq!(empty.dealer, Addr::unchecked("foo"));
+        assert!(empty.chunk.is_none());
+
+        // insert the dealing chunk
+        let dealing = partial_dealing_fixture();
+        StoredDealing::save(
+            deps.as_mut().storage,
+            0,
+            &Addr::unchecked("foo"),
+            dealing.clone(),
+        );
+
+        let retrieved = query_dealing_chunk(deps.as_ref(), 0, "foo".to_string(), 0, 0).unwrap();
+        assert_eq!(retrieved.epoch_id, 0);
+        assert_eq!(retrieved.dealing_index, dealing.dealing_index);
+        assert_eq!(retrieved.chunk_index, dealing.chunk_index);
+        assert_eq!(retrieved.dealer, Addr::unchecked("foo"));
+        assert_eq!(retrieved.chunk.unwrap(), dealing.data);
    }

    #[test]
-    fn dealings_empty_on_init() {
+    fn test_query_dealing_status() {
        let deps = init_contract();
-        for idx in 0..TOTAL_DEALINGS as u64 {
-            let response = query_dealings_paged(deps.as_ref(), idx, None, Option::from(2)).unwrap();
-            assert_eq!(0, response.dealings.len());
-        }
-    }

-    #[test]
-    fn dealings_paged_retrieval_obeys_limits() {
-        let mut deps = init_contract();
-        let limit = 2;
-        fill_dealings(deps.as_mut(), 1000);
+        let bad_address = "FOOMP".to_string();
+        assert!(query_dealing_status(deps.as_ref(), 0, bad_address, 0).is_err());

-        for idx in 0..TOTAL_DEALINGS as u64 {
-            let page1 =
-                query_dealings_paged(deps.as_ref(), idx, None, Option::from(limit)).unwrap();
-            assert_eq!(limit, page1.dealings.len() as u32);
-        }
-    }
+        let empty = query_dealing_status(deps.as_ref(), 0, "foo".to_string(), 0).unwrap();
+        assert_eq!(empty.epoch_id, 0);
+        assert_eq!(empty.dealing_index, 0);
+        assert_eq!(empty.dealer, Addr::unchecked("foo"));
+        assert!(!empty.status.fully_submitted);
+        assert!(!empty.status.has_metadata);
+        assert!(empty.status.chunk_submission_status.is_empty());

-    #[test]
-    fn dealings_paged_retrieval_has_default_limit() {
-        let mut deps = init_contract();
-        fill_dealings(deps.as_mut(), 1000);
+        // insert the metadata
+        //

-        for idx in 0..TOTAL_DEALINGS as u64 {
-            // query without explicitly setting a limit
-            let page1 = query_dealings_paged(deps.as_ref(), idx, None, None).unwrap();
-
-            assert_eq!(DEALINGS_PAGE_DEFAULT_LIMIT, page1.dealings.len() as u32);
-        }
-    }
-
-    #[test]
-    fn dealings_paged_retrieval_has_max_limit() {
-        let mut deps = init_contract();
-        fill_dealings(deps.as_mut(), 1000);
-
-        // query with a crazily high limit in an attempt to use too many resources
-        let crazy_limit = 1000 * DEALINGS_PAGE_MAX_LIMIT;
-        for idx in 0..TOTAL_DEALINGS as u64 {
-            let page1 =
-                query_dealings_paged(deps.as_ref(), idx, None, Option::from(crazy_limit)).unwrap();
-
-            // we default to a decent sized upper bound instead
-            let expected_limit = DEALINGS_PAGE_MAX_LIMIT;
-            assert_eq!(expected_limit, page1.dealings.len() as u32);
-        }
-    }
-
-    #[test]
-    fn dealings_pagination_works() {
-        let mut deps = init_contract();
-
-        fill_dealings(deps.as_mut(), 1);
-
-        let per_page = 2;
-
-        for idx in 0..TOTAL_DEALINGS as u64 {
-            let page1 =
-                query_dealings_paged(deps.as_ref(), idx, None, Option::from(per_page)).unwrap();
-
-            // page should have 1 result on it
-            assert_eq!(1, page1.dealings.len());
-        }
-
-        // save another
-        fill_dealings(deps.as_mut(), 2);
-
-        for idx in 0..TOTAL_DEALINGS as u64 {
-            // page1 should have 2 results on it
-            let page1 =
-                query_dealings_paged(deps.as_ref(), idx, None, Option::from(per_page)).unwrap();
-            assert_eq!(2, page1.dealings.len());
-        }
-
-        fill_dealings(deps.as_mut(), 3);
-
-        for idx in 0..TOTAL_DEALINGS as u64 {
-            // page1 still has 2 results
-            let page1 =
-                query_dealings_paged(deps.as_ref(), idx, None, Option::from(per_page)).unwrap();
-            assert_eq!(2, page1.dealings.len());
-
-            // retrieving the next page should start after the last key on this page
-            let start_after = page1.start_next_after.unwrap();
-            let page2 = query_dealings_paged(
-                deps.as_ref(),
-                idx,
-                Option::from(start_after.to_string()),
-                Option::from(per_page),
-            )
-            .unwrap();
-
-            assert_eq!(1, page2.dealings.len());
-        }
-
-        fill_dealings(deps.as_mut(), 4);
-
-        for idx in 0..TOTAL_DEALINGS as u64 {
-            let page1 =
-                query_dealings_paged(deps.as_ref(), idx, None, Option::from(per_page)).unwrap();
-            let start_after = page1.start_next_after.unwrap();
-            let page2 = query_dealings_paged(
-                deps.as_ref(),
-                idx,
-                Option::from(start_after.to_string()),
-                Option::from(per_page),
-            )
-            .unwrap();
-
-            // now we have 2 pages, with 2 results on the second page
-            assert_eq!(2, page2.dealings.len());
-        }
+        // // insert the dealing
+        // let dealing = partial_dealing_fixture();
+        // StoredDealing::save(
+        //     deps.as_mut().storage,
+        //     0,
+        //     &Addr::unchecked("foo"),
+        //     dealing.clone(),
+        // );
+        //
+        // let retrieved = query_dealing_status(deps.as_ref(), 0, "foo".to_string(), 0).unwrap();
+        // assert_eq!(retrieved.epoch_id, 0);
+        // assert_eq!(retrieved.dealing_index, dealing.dealing_index);
+        // assert_eq!(retrieved.dealer, Addr::unchecked("foo"));
+        // assert!(retrieved.dealing_submitted)
    }
 }
@@ -1,33 +1,426 @@
-// Copyright 2022 - Nym Technologies SA <contact@nymtech.net>
+// Copyright 2022-2024 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0

-use cosmwasm_std::Addr;
-use cw_storage_plus::Map;
-use nym_coconut_dkg_common::types::{ContractSafeBytes, TOTAL_DEALINGS};
+use crate::error::ContractError;
+use cosmwasm_std::{Addr, Storage};
+use cw_storage_plus::{Key, Map, Path, PrimaryKey};
+use nym_coconut_dkg_common::dealing::{DealingMetadata, PartialContractDealing};
+use nym_coconut_dkg_common::types::{
+    ChunkIndex, ContractSafeBytes, DealingIndex, EpochId, PartialContractDealingData,
+};

-pub(crate) const DEALINGS_PAGE_MAX_LIMIT: u32 = 2;
-pub(crate) const DEALINGS_PAGE_DEFAULT_LIMIT: u32 = 1;
+type Dealer<'a> = &'a Addr;

-type DealingKey<'a> = &'a Addr;
+/// Metadata for a dealing for given `EpochId`, submitted by particular `Dealer` for given `DealingIndex`.
+pub(crate) const DEALINGS_METADATA: Map<(EpochId, Dealer, DealingIndex), DealingMetadata> =
+    Map::new("dealings_metadata");

-// Note to whoever is looking at this implementation and is thinking of using something similar
-// for storing small commitments/hashes of data on chain:
-// If there's a lot of entries you want to store thinking, "oh, this digest is only 32 bytes, it's not that much",
-// the default cosmwasm' serializer will bloat it to around ~100B. So you really don't want to be using
-// Buckets/Maps, etc. for that purpose. Instead you want to use `storage` directly (look into the actual implementation of
-// `Map` or `Bucket` to see what I mean. Instead of using the `to_vec` method on serde_json_wasm, you'd
-// provide your data directly yourself.
-// but you must be extremely careful when doing so, as you might end up overwriting some existing data
-// if you don't choose your prefixes wisely.
-// I didn't have to do it here as I'm storing relatively little data and after just base58-encoding
-// my bytes, I was fine with the json overhead.
+pub(crate) fn metadata_exists(
+    storage: &dyn Storage,
+    epoch_id: EpochId,
+    dealer: Dealer,
+    dealing_index: DealingIndex,
+) -> bool {
+    DEALINGS_METADATA.has(storage, (epoch_id, dealer, dealing_index))
+}

-// if TOTAL_DEALINGS is modified to anything other then current value (5), this part will also need
-// to be modified
-pub(crate) const DEALINGS_BYTES: [Map<'_, DealingKey<'_>, ContractSafeBytes>; TOTAL_DEALINGS] = [
-    Map::new("dbyt1"),
-    Map::new("dbyt2"),
-    Map::new("dbyt3"),
-    Map::new("dbyt4"),
-    Map::new("dbyt5"),
-];
+pub(crate) fn must_read_metadata(
+    storage: &dyn Storage,
+    epoch_id: EpochId,
+    dealer: Dealer,
+    dealing_index: DealingIndex,
+) -> Result<DealingMetadata, ContractError> {
+    DEALINGS_METADATA
+        .may_load(storage, (epoch_id, dealer, dealing_index))?
+        .ok_or_else(|| ContractError::UnavailableDealingMetadata {
+            epoch_id,
+            dealer: dealer.to_owned(),
+            dealing_index,
+        })
+}
+
+pub(crate) fn store_metadata(
+    storage: &mut dyn Storage,
+    epoch_id: EpochId,
+    dealer: Dealer,
+    dealing_index: DealingIndex,
+    metadata: &DealingMetadata,
+) -> Result<(), ContractError> {
+    Ok(DEALINGS_METADATA.save(storage, (epoch_id, dealer, dealing_index), metadata)?)
+}
+
+// dealings data is stored in a multilevel map with the following hierarchy:
+//  - epoch-id:
+//      - issuer-address:
+//          - dealing id:
+//              - chunk_id:
+//                  - dealing content
+// NOTE: we're storing raw bytes bypassing serialization, so we can't use the `Map` type,
+// thus make sure you always use the below methods for using the storage!
+pub(crate) struct StoredDealing;
+
+impl StoredDealing {
+    const NAMESPACE: &'static [u8] = b"dealing";
+
+    // prefix-range related should we need it
+    #[cfg(test)]
+    fn deserialize_dealing_record(
+        kv: cosmwasm_std::Record,
+    ) -> cosmwasm_std::StdResult<(ChunkIndex, PartialContractDealingData)> {
+        let (k, v) = kv;
+        let index = <ChunkIndex as cw_storage_plus::KeyDeserialize>::from_vec(k)?;
+        let data = ContractSafeBytes(v);
+
+        Ok((index, data))
+    }
+
+    // prefix-range related should we need it
+    #[cfg(test)]
+    fn prefix(
+        prefix: (EpochId, Dealer, DealingIndex),
+    ) -> cw_storage_plus::Prefix<ChunkIndex, PartialContractDealingData, ChunkIndex> {
+        use cw_storage_plus::Prefixer;
+
+        cw_storage_plus::Prefix::with_deserialization_functions(
+            Self::NAMESPACE,
+            &prefix.prefix(),
+            &[],
+            // explicitly panic to make sure we're never attempting to call an unexpected deserializer on our data
+            |_, _, kv| Self::deserialize_dealing_record(kv),
+            |_, _, _| panic!("attempted to call custom de_fn_v"),
+        )
+    }
+
+    // prefix-range related should we need it
+    #[cfg(test)]
+    pub(crate) fn prefix_range<'a>(
+        storage: &'a dyn Storage,
+        prefix: (EpochId, Dealer, DealingIndex),
+        start: Option<cw_storage_plus::Bound<ChunkIndex>>,
+    ) -> impl Iterator<Item = cosmwasm_std::StdResult<PartialContractDealing>> + 'a {
+        let dealing_index = prefix.2;
+        Self::prefix(prefix)
+            .range(storage, start, None, cosmwasm_std::Order::Ascending)
+            .map(move |maybe_record| {
+                maybe_record.map(|(chunk_index, data)| PartialContractDealing {
+                    dealing_index,
+                    chunk_index,
+                    data,
+                })
+            })
+    }
+
+    fn storage_key(
+        epoch_id: EpochId,
+        dealer: Dealer,
+        dealing_index: DealingIndex,
+        chunk_index: ChunkIndex,
+    ) -> Path<Vec<u8>> {
+        // just replicate the behaviour from `Map::key`
+        // note: `PrimaryKey` trait is not implemented for tuple (T, U, V, W), only for up to (T, U, V)
+        // that's why we create a (T, U, (V, W)) tuple(s) instead
+        let key = (epoch_id, dealer, (dealing_index, chunk_index));
+        Path::new(
+            Self::NAMESPACE,
+            &key.key().iter().map(Key::as_ref).collect::<Vec<_>>(),
+        )
+    }
+
+    // pub(crate) fn exists(
+    //     storage: &dyn Storage,
+    //     epoch_id: EpochId,
+    //     dealer: &Addr,
+    //     dealing_index: DealingIndex,
+    //     chunk_index: ChunkIndex,
+    // ) -> StdResult<bool> {
+    //     // whenever the dealing is saved, the metadata is appropriately updated
+    //     // reading metadata is way cheaper than the dealing chunk itself
+    //     let Some(metadata) =
+    //         DEALINGS_METADATA.may_load(storage, (epoch_id, dealer, dealing_index))?
+    //     else {
+    //         return Ok(false);
+    //     };
+    //     let Some(chunk_info) = metadata.submitted_chunks.get(&chunk_index) else {
+    //         return Ok(false);
+    //     };
+    //     Ok(chunk_info.status.submitted())
+    //     // StoredDealing::storage_key(epoch_id, dealer, dealing_index).has(storage)
+    // }
+
+    pub(crate) fn save(
+        storage: &mut dyn Storage,
+        epoch_id: EpochId,
+        dealer: Dealer,
+        dealng_chunk: PartialContractDealing,
+    ) {
+        // NOTE: we're storing bytes directly here!
+        let storage_key = Self::storage_key(
+            epoch_id,
+            dealer,
+            dealng_chunk.dealing_index,
+            dealng_chunk.chunk_index,
+        );
+        storage.set(&storage_key, dealng_chunk.data.as_slice());
+    }
+
+    pub(crate) fn read(
+        storage: &dyn Storage,
+        epoch_id: EpochId,
+        dealer: Dealer,
+        dealing_index: DealingIndex,
+        chunk_index: ChunkIndex,
+    ) -> Option<PartialContractDealingData> {
+        let storage_key = Self::storage_key(epoch_id, dealer, dealing_index, chunk_index);
+        storage.get(&storage_key).map(ContractSafeBytes)
+    }
+
+    // iterate over all values, only to be used in tests due to the amount of data being returned
+    #[cfg(test)]
+    #[allow(clippy::type_complexity)]
+    pub(crate) fn unchecked_all_entries(
+        storage: &dyn Storage,
+    ) -> Vec<(
+        (EpochId, Addr, (DealingIndex, ChunkIndex)),
+        PartialContractDealingData,
+    )> {
+        use cw_storage_plus::KeyDeserialize;
+
+        type StorageKey<'a> = (EpochId, Dealer<'a>, (DealingIndex, ChunkIndex));
+
+        let empty_prefix: cw_storage_plus::Prefix<
+            StorageKey,
+            PartialContractDealingData,
+            StorageKey,
+        > = cw_storage_plus::Prefix::with_deserialization_functions(
+            Self::NAMESPACE,
+            &[],
+            &[],
+            |_, _, kv| StorageKey::from_vec(kv.0).map(|kt| (kt, ContractSafeBytes(kv.1))),
+            |_, _, _| unimplemented!(),
+        );
+
+        empty_prefix
+            .range(storage, None, None, cosmwasm_std::Order::Ascending)
+            .collect::<cosmwasm_std::StdResult<_>>()
+            .unwrap()
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::support::tests::helpers::init_contract;
+    use cw_storage_plus::Bound;
+    use std::collections::HashMap;
+
+    fn dealing_data(
+        epoch_id: EpochId,
+        dealer: Dealer,
+        dealing_index: DealingIndex,
+        chunk_index: ChunkIndex,
+    ) -> PartialContractDealingData {
+        ContractSafeBytes(
+            format!("{epoch_id},{dealer},{dealing_index},{chunk_index}")
+                .as_bytes()
+                .to_vec(),
+        )
+    }
+
+    #[test]
+    fn saving_dealing_chunks() {
+        let mut deps = init_contract();
+
+        fn exists_in_storage(
+            storage: &dyn Storage,
+            epoch_id: EpochId,
+            dealer: Dealer,
+            dealing_index: DealingIndex,
+            chunk_index: ChunkIndex,
+        ) -> bool {
+            StoredDealing::storage_key(epoch_id, dealer, dealing_index, chunk_index).has(storage)
+        }
+
+        // make sure to check all combinations of epoch id, dealer address and dealing index to ensure nothing overlaps
+        let epochs = [54, 423, 754];
+        let dealers = [
+            Addr::unchecked("dealer1"),
+            Addr::unchecked("dealer2"),
+            Addr::unchecked("dealer3"),
+            Addr::unchecked("dealer4"),
+            Addr::unchecked("dealer5"),
+        ];
+        let dealing_indices = [0, 1, 2, 3, 4, 5, 6, 7];
+        let chunk_indices = [0, 1, 2, 3, 4];
+
+        for epoch_id in &epochs {
+            for dealer in &dealers {
+                for dealing_index in &dealing_indices {
+                    for chunk_index in &chunk_indices {
+                        assert!(!exists_in_storage(
+                            &deps.storage,
+                            *epoch_id,
+                            dealer,
+                            *dealing_index,
+                            *chunk_index
+                        ));
+
+                        StoredDealing::save(
+                            deps.as_mut().storage,
+                            *epoch_id,
+                            dealer,
+                            PartialContractDealing {
+                                dealing_index: *dealing_index,
+                                chunk_index: *chunk_index,
+                                data: dealing_data(*epoch_id, dealer, *dealing_index, *chunk_index),
+                            },
+                        )
+                    }
+                }
+            }
+        }
+
+        let all: HashMap<_, _> = StoredDealing::unchecked_all_entries(&deps.storage)
+            .into_iter()
+            .collect();
+        assert_eq!(
+            all.len(),
+            epochs.len() * dealers.len() * dealing_indices.len() * chunk_indices.len()
+        );
+
+        for epoch_id in &epochs {
+            for dealer in &dealers {
+                for dealing_index in &dealing_indices {
+                    for chunk_index in &chunk_indices {
+                        assert!(exists_in_storage(
+                            &deps.storage,
+                            *epoch_id,
+                            dealer,
+                            *dealing_index,
+                            *chunk_index
+                        ));
+
+                        let content = StoredDealing::read(
+                            &deps.storage,
+                            *epoch_id,
+                            dealer,
+                            *dealing_index,
+                            *chunk_index,
+                        )
+                        .unwrap();
+                        let expected =
+                            dealing_data(*epoch_id, dealer, *dealing_index, *chunk_index);
+                        assert_eq!(expected, content);
+                        assert_eq!(
+                            &expected,
+                            all.get(&(*epoch_id, dealer.clone(), (*dealing_index, *chunk_index)))
+                                .unwrap()
+                        );
+                    }
+                }
+            }
+        }
+    }
+
+    #[test]
+    fn iterating_over_dealing_chunks() {
+        let mut deps = init_contract();
+
+        let epochs = [54, 423, 754];
+        let dealers = [
+            Addr::unchecked("dealer1"),
+            Addr::unchecked("dealer2"),
+            Addr::unchecked("dealer3"),
+            Addr::unchecked("dealer4"),
+            Addr::unchecked("dealer5"),
+        ];
+        let dealing_indices = [0, 1, 2, 3, 4, 5, 6, 7];
+        let chunk_indices = [0, 1, 2, 3, 4];
+
+        for epoch_id in &epochs {
+            for dealer in &dealers {
+                for dealing_index in &dealing_indices {
+                    for chunk_index in &chunk_indices {
+                        StoredDealing::save(
+                            deps.as_mut().storage,
+                            *epoch_id,
+                            dealer,
+                            PartialContractDealing {
+                                dealing_index: *dealing_index,
+                                chunk_index: *chunk_index,
+                                data: dealing_data(*epoch_id, dealer, *dealing_index, *chunk_index),
+                            },
+                        )
+                    }
+                }
+            }
+        }
+
+        // remember, we're not testing the iterator implementation
+
+        // nothing under epoch 0
+        let dealings =
+            StoredDealing::prefix_range(&deps.storage, (0, &dealers[0], dealing_indices[0]), None)
+                .collect::<Vec<_>>();
+        assert!(dealings.is_empty());
+
+        // nothing for dealer "foo"
+        let foo = Addr::unchecked("foo");
+        let dealings =
+            StoredDealing::prefix_range(&deps.storage, (epochs[0], &foo, dealing_indices[0]), None)
+                .collect::<Vec<_>>();
+        assert!(dealings.is_empty());
+
+        // nothing for dealing index 99
+        let dealings =
+            StoredDealing::prefix_range(&deps.storage, (epochs[0], &dealers[0], 99), None)
+                .collect::<Vec<_>>();
+        assert!(dealings.is_empty());
+
+        let all = StoredDealing::prefix_range(
+            &deps.storage,
+            (epochs[0], &dealers[0], dealing_indices[0]),
+            None,
+        )
+        .collect::<Vec<_>>();
+        assert_eq!(all.len(), chunk_indices.len());
+
+        for (i, dealing) in all.iter().enumerate() {
+            let expected =
+                dealing_data(epochs[0], &dealers[0], dealing_indices[0], chunk_indices[i]);
+            assert_eq!(expected, dealing.as_ref().unwrap().data);
+            assert_eq!(chunk_indices[i], dealing.as_ref().unwrap().chunk_index);
+        }
+
+        // for sanity sake, check another dealer with different epoch and different dealing index
+        let all_other = StoredDealing::prefix_range(
+            &deps.storage,
+            (epochs[2], &dealers[3], dealing_indices[4]),
+            None,
+        )
+        .collect::<Vec<_>>();
+        assert_eq!(all_other.len(), chunk_indices.len());
+
+        for (i, dealing) in all_other.iter().enumerate() {
+            let expected =
+                dealing_data(epochs[2], &dealers[3], dealing_indices[4], chunk_indices[i]);
+            assert_eq!(expected, dealing.as_ref().unwrap().data);
+            assert_eq!(chunk_indices[i], dealing.as_ref().unwrap().chunk_index);
+        }
+
+        let without_first = StoredDealing::prefix_range(
+            &deps.storage,
+            (epochs[0], &dealers[0], dealing_indices[0]),
+            Some(Bound::exclusive(chunk_indices[0])),
+        )
+        .collect::<Vec<_>>();
+        assert_eq!(&all[1..], without_first);
+
+        let mid = StoredDealing::prefix_range(
+            &deps.storage,
+            (epochs[0], &dealers[0], dealing_indices[0]),
+            Some(Bound::inclusive(chunk_indices[3])),
+        )
+        .collect::<Vec<_>>();
+        assert_eq!(&all[3..], mid);
+    }
+}
--- a/Show More
+++ b/Show More