@bitpay-labs/bitcore-wallet-service 11.10.14 → 11.11.1

package/src/lib/routes/middleware/authTssRequest.ts

@@ -5,15 +5,23 @@ import { Errors } from '../../errors/errordefinitions';
 import { WalletService, checkRequired } from '../../server';
 import { error } from '../helpers';
 import { getCredentials, getMessage } from './authRequest';
-import type { TssKeyGenModel } from '../../model/tsskeygen';
-import type { TssSigGenModel } from '../../model/tsssign';
+import type { ITssKeyMessageObject, TssKeyGenModel } from '../../model/tsskeygen';
+import type { ITssSigMessageObject, TssSigGenModel } from '../../model/tsssign';
+
+function verifyMessage(req: express.Request, signature: string, pubKey: string) {
+  const message = getMessage(req);
+  const isValid = !!Utils.verifyMessage(message, signature, pubKey);
+  if (!isValid) {
+    throw Errors.NOT_AUTHORIZED.withMessage('Invalid signature');
+  }
+}
 
 /**
- * Middleware to authenticate TSS requests and attach the TSS session to the request.
+ * Middleware to authenticate TSS key generation requests and attach the TSS session to the request.
  * It checks if the request has valid credentials, verifies the signature,
  * and retrieves the TSS session based on the request path.
  */
-export function authTssRequest(): express.RequestHandler {
+export function authTssKeyGenRequest(): express.RequestHandler {
   return async function(req, res, next) {
     try {
       const storage = WalletService.getStorage();
@@ -28,37 +36,74 @@ export function authTssRequest(): express.RequestHandler {
       } = credentials;
       
       const { id } = req.params as { [key: string]: string };
+      const body = req.body as { message: ITssKeyMessageObject | undefined };
 
-      let session: TssKeyGenModel | TssSigGenModel | null = null;
-      let partyId = null;
-      let pubKey = null;
-      if (req.path.includes('/tss/keygen/')) {
-        session = await storage.fetchTssKeyGenSession({ id });
-        partyId = session?.participants.indexOf(copayerId);
-        pubKey = partyId > -1 ? session.rounds[0].find(r => r.fromPartyId === partyId)?.messages.publicKey : null;
-      } else if (req.path.includes('/tss/sign/')) {
-        session = await storage.fetchTssSigSession({ id });
-        partyId = session?.participants.find(p => p.copayerId === copayerId)?.partyId;
-        pubKey = partyId == null ? null : session?.rounds[0]?.find(r => r.fromPartyId === partyId)?.messages.publicKey;
-      } else {
-        throw new Error('Unknown TSS request path: ' + req.path);
-      }
+      // Note: the copayer is not fetched from the db here bc it's not stored
+      //  until the key generation session is done and the wallet gets created.
 
+      const session: TssKeyGenModel = await storage.fetchTssKeyGenSession({ id });
       if (!session) {
-        throw Errors.NOT_AUTHORIZED.withMessage('Session not found');
-      }
-      if (!pubKey) {
-        throw Errors.NOT_AUTHORIZED.withMessage('Copayer not found in session');
+        // This is a brand new session. Caller should be party 0 with the initial round message.
+        if (body?.message?.round === 0 && body?.message?.partyId === 0) {
+          const pubKey = body?.message?.publicKey;
+          verifyMessage(req, signature, pubKey); // Self verification, but at least ensures that the caller owns the message's private key
+          return next();
+        } else {
+          // Session should have been initialized by the client already in BWC > TssKeyGen.newKey()
+          throw Errors.NOT_AUTHORIZED.withMessage('Session not found');
+        }
       }
+
       if (session.isExpired()) {
         throw Errors.TSS_SESSION_EXPIRED;
       }
 
-      const message = getMessage(req);
-      const isValid = !!Utils.verifyMessage(message, signature, pubKey);
-      if (!isValid) {
-        throw Errors.NOT_AUTHORIZED.withMessage('Invalid signature');
+      const isRound0Msg = body?.message?.round === 0;
+      const awaitingJoiners = session.participants.some(p => !p); // session.participants is initiated with n slots (initally null) that get populated as participants join
+      const participantIdx = session.participants.indexOf(copayerId); // equals -1 if the copayer has not joined yet
+      if (participantIdx === -1 && session.schemeVersion >= 1.2) {
+        // Check session.authPublicKeys to ensure initiator registered this participant
+        const msgPubKey = body?.message?.publicKey;
+        if (!msgPubKey) {
+          throw Errors.NOT_AUTHORIZED;
+        }
+        const _participantIdx = session.authPublicKeys.indexOf(msgPubKey);
+        if (_participantIdx === -1) {
+          throw Errors.NOT_AUTHORIZED;
+        }
+        if (session.participants[_participantIdx]) {
+          throw Errors.NOT_AUTHORIZED;
+        }
+      }
+      const partyId = participantIdx > -1
+        ? participantIdx
+        : (awaitingJoiners && isRound0Msg)
+          ? body?.message?.partyId // if participant has not joined session yet, use the partyId from the initial round message (verified below)
+          : -1;
+      
+      if (partyId < 0 || partyId >= session.n || !Number.isInteger(partyId)) {
+        throw Errors.NOT_AUTHORIZED.withMessage('Copayer not found in session');
+      }
+
+      let pubKey: string = null;
+      if (session?.schemeVersion <= 1.1) {
+        // session.authPublicKeys was not added until 1.2, so fetch public key from the first round messages instead (old way)
+        pubKey = session.rounds[0].find(r => r.fromPartyId === partyId)?.messages.publicKey;
+        if (!pubKey && participantIdx === -1) {
+          // Joining party hasn't submitted its round 0 message yet and legacy sessions have no registration,
+          //  so use the joining message's public key (verifyTssMessage verifies the message's payload against it)
+          pubKey = body?.message?.publicKey;
+        }
+      } else {
+        // authPublicKeys is set by the session leader, so this will verify that the leader and the calling participant here are on the same page
+        pubKey = session?.authPublicKeys[partyId];
+      }
+
+      if (!pubKey) {
+        throw Errors.NOT_AUTHORIZED.withMessage('Copayer not found in session');
       }
+
+      verifyMessage(req, signature, pubKey);
     
       req.session = session;
       return next();
@@ -69,4 +114,63 @@ export function authTssRequest(): express.RequestHandler {
       return error.returnError(new ClientError({ code: 'INTERNAL_ERROR' }), res, req);
     }
   };
+};
+
+export function authTssSignRequest(): express.RequestHandler {
+  return async function(req, res, next) {
+    try {
+      const storage = WalletService.getStorage();
+      const credentials = getCredentials(req);
+      if (!checkRequired(credentials, ['copayerId', 'signature'])) {
+        throw Errors.NOT_AUTHORIZED;
+      }
+    
+      const {
+        copayerId,
+        signature
+      } = credentials;
+      
+      const { id } = req.params as { [key: string]: string };
+      const body = req.body as { message: ITssSigMessageObject | undefined };
+      // Only some requests carry a body.message (e.g. POST /store only sends the final signature).
+      //  Omitting it is safe since routes that don't receive a message don't consume one.
+      const verifyMsg = !!body?.message;
+
+      const copayer = await storage.fetchCopayerLookup(copayerId);
+      if (!copayer) {
+        throw Errors.NOT_AUTHORIZED.withMessage('Copayer not found');
+      }
+      const pubKey = copayer.requestPubKeys[0].key;
+      if (verifyMsg && pubKey !== body?.message?.publicKey) {
+        throw Errors.NOT_AUTHORIZED.withMessage('Invalid public key');
+      }
+
+      const session: TssSigGenModel = await storage.fetchTssSigSession({ id });
+      // If !session, it needs to be initiated
+      if (session) {
+        if (session.isExpired()) {
+          throw Errors.TSS_SESSION_EXPIRED;
+        }
+        const party = session.participants.find(p => p.copayerId === copayerId);
+        if (!party) {
+          throw Errors.NOT_AUTHORIZED.withMessage('Copayer not found in session');
+        }
+        if (verifyMsg && party.partyId !== body?.message?.partyId) {
+          throw Errors.NOT_AUTHORIZED.withMessage('Copayer not found in session');
+        }
+
+        req.session = session;
+      } else if (body?.message?.round !== 0) {
+        throw Errors.TSS_SESSION_NOT_FOUND;
+      }
+      
+      verifyMessage(req, signature, pubKey);
+      return next();
+    } catch (err) {
+      if (err instanceof ClientError) {
+        return error.returnError(err, res, req);
+      }
+      return error.returnError(new ClientError({ code: 'INTERNAL_ERROR' }), res, req);
+    }
+  };
 };

package/src/lib/routes/services.ts

@@ -459,18 +459,6 @@ export function registerServiceRoutes(router: express.Router, context: RouteCont
     });
   });
 
-  router.post('/v1/service/wyre/walletOrderQuotation', (req, res) => {
-    respondWithAuthServer(req, res, context, server => {
-      return server.externalServices.wyre.wyreWalletOrderQuotation(req);
-    });
-  });
-
-  router.post('/v1/service/wyre/walletOrderReservation', (req, res) => {
-    respondWithAuthServer(req, res, context, server => {
-      return server.externalServices.wyre.wyreWalletOrderReservation(req);
-    });
-  });
-
   router.post('/v1/service/changelly/getCurrencies', (req, res) => {
     respondWithPublicServer(req, res, context, server => {
       return server.externalServices.changelly.changellyGetCurrencies(req);

package/src/lib/routes/tss.ts

@@ -2,7 +2,7 @@ import express from 'express';
 import * as Types from '../../types/expressapp';
 import { TssKeyGen, TssSign } from '../tss';
 import { authRequest } from './middleware/authRequest';
-import { authTssRequest } from './middleware/authTssRequest';
+import { authTssKeyGenRequest, authTssSignRequest } from './middleware/authTssRequest';
 import { createWalletLimiter } from './middleware/createWalletLimiter';
 import { verifyTssMessage } from './middleware/verifyTssMessage';
 
@@ -23,7 +23,7 @@ export class TssRouter {
     
     /** Key generation methods */
 
-    router.post('/v1/tss/keygen/:id', createWalletLimiter(opts), verifyTssMessage, async function(req, res) {
+    router.post('/v1/tss/keygen/:id', createWalletLimiter(opts), authTssKeyGenRequest(), verifyTssMessage, async function(req, res) {
       try {
         const id = req.params.id;
         // version was not given by client until 1.1, so fallback to 1.0
@@ -36,7 +36,20 @@ export class TssRouter {
       }
     });
 
-    router.get('/v1/tss/keygen/:id/:round', authTssRequest(), async function(req, res) {
+    router.post('/v1/tss/keygen/:id/register', authTssKeyGenRequest(), async function(req, res) {
+      try {
+        const id = req.params.id;
+        const copayerId = req.headers['x-identity'];
+        const data = req.body;
+
+        await TssKeyGen.registerParty({ id, copayerId, data });
+        return res.send();
+      } catch (err) {
+        return returnError(err ?? 'unknown', res, req);
+      }
+    });
+
+    router.get('/v1/tss/keygen/:id/:round', authTssKeyGenRequest(), async function(req, res) {
       let interval: NodeJS.Timeout;
       try {
         const abort = new AbortController();
@@ -74,7 +87,7 @@ export class TssRouter {
       }
     });
 
-    router.post('/v1/tss/keygen/:id/store', authTssRequest(), async function(req, res) {
+    router.post('/v1/tss/keygen/:id/store', authTssKeyGenRequest(), async function(req, res) {
       try {
         const id = req.params.id;
         const copayerId = req.headers['x-identity'];
@@ -87,7 +100,7 @@ export class TssRouter {
       }
     });
 
-    router.post('/v1/tss/keygen/:id/secret', authTssRequest(), async function(req, res) {
+    router.post('/v1/tss/keygen/:id/secret', authTssKeyGenRequest(), async function(req, res) {
       try {
         const id = req.params.id;
         const { secret } = req.body;
@@ -99,7 +112,7 @@ export class TssRouter {
       }
     });
 
-    router.get('/v1/tss/keygen/:id/secret', authTssRequest(), async function(req, res) {
+    router.get('/v1/tss/keygen/:id/secret', authTssKeyGenRequest(), async function(req, res) {
       try {
         const id = req.params.id;
         const copayerId = req.headers['x-identity'];
@@ -126,7 +139,7 @@ export class TssRouter {
       }
     });
 
-    router.get('/v1/tss/sign/:id/:round', authTssRequest(), async function(req, res) {
+    router.get('/v1/tss/sign/:id/:round', authTssSignRequest(), async function(req, res) {
       let interval: NodeJS.Timeout;
       try {
         const abort = new AbortController();
@@ -161,7 +174,7 @@ export class TssRouter {
       }
     });
 
-    router.post('/v1/tss/sign/:id/store', authTssRequest(), async function(req, res) {
+    router.post('/v1/tss/sign/:id/store', authTssSignRequest(), async function(req, res) {
       try {
         const id = req.params.id;
         const { signature } = req.body;

package/src/lib/routes/wallets.ts

@@ -229,15 +229,14 @@ export function registerWalletRoutes(router: express.Router, context: RouteConte
       }
 
       const storage = WalletService.getStorage();
-      const existing = await Promise.all<{ copayerId: string; verified: boolean }>(copayers.map(c => new Promise((resolve) => {
-        storage.fetchCopayerLookup(c.copayerId, (err, copayer) => {
-          if (err || !copayer) {
-            return resolve({ copayerId: c.copayerId, verified: false });
-          }
-          const verified = copayer.requestPubKeys.some(pubkey => Utils.verifyMessage(c.copayerId, c.signature, pubkey.key));
-          return resolve({ copayerId: c.copayerId, verified });
-        });
-      })));
+      const existing = await Promise.all<{ copayerId: string; verified: boolean }>(copayers.map(async c => {
+        const copayer = await storage.fetchCopayerLookup(c.copayerId).catch(() => null);
+        if (!copayer) {
+          return { copayerId: c.copayerId, verified: false };
+        }
+        const verified = copayer.requestPubKeys.some(pubkey => Utils.verifyMessage(c.copayerId, c.signature, pubkey.key));
+        return { copayerId: c.copayerId, verified };
+      }));
       return res.json(existing.filter(e => e.verified).map(e => e.copayerId));
     } catch (err) {
       return returnError(err, res, req);

package/src/lib/server.ts

@@ -27,7 +27,6 @@ import { SardineService } from '../externalservices/sardine';
 import { SimplexService } from '../externalservices/simplex';
 import { ThorswapService } from '../externalservices/thorswap';
 import { TransakService } from '../externalservices/transak';
-import { WyreService } from '../externalservices/wyre';
 import { serverMessages } from '../serverMessages';
 import { BCHAddressTranslator } from './bchaddresstranslator';
 import { BlockChainExplorer } from './blockchainexplorer';
@@ -160,7 +159,6 @@ export class WalletService implements IWalletService {
     simplex: SimplexService;
     thorswap: ThorswapService;
     transak: TransakService;
-    wyre: WyreService;
     coinGecko: CoinGeckoService;
   };
 
@@ -190,7 +188,6 @@ export class WalletService implements IWalletService {
       simplex: new SimplexService(),
       thorswap: new ThorswapService(),
       transak: new TransakService(),
-      wyre: new WyreService(),
       coinGecko: new CoinGeckoService(this.storage),
     };
   }
@@ -394,10 +391,7 @@ export class WalletService implements IWalletService {
         return cb(ex);
       }
 
-      server.storage.fetchCopayerLookup(opts.copayerId, (err, copayer) => {
-        if (err) {
-          return cb(err);
-        }
+      server.storage.fetchCopayerLookup(opts.copayerId).then(copayer => {
         if (!copayer) {
           return cb(Errors.NOT_AUTHORIZED.withMessage('Copayer not found'));
         }
@@ -420,7 +414,7 @@ export class WalletService implements IWalletService {
 
         server.copayerId = opts.copayerId;
         return cb(null, server);
-      });
+      }).catch(err => cb(err));
     };
 
     const withSession = cb => {
@@ -428,7 +422,7 @@ export class WalletService implements IWalletService {
         return;
       }
 
-      let server;
+      let server: WalletService;
       try {
         server = WalletService.getInstance(opts);
       } catch (ex) {
@@ -445,10 +439,7 @@ export class WalletService implements IWalletService {
           return cb(Errors.NOT_AUTHORIZED.withMessage('Session expired'));
         }
 
-        server.storage.fetchCopayerLookup(opts.copayerId, (err, copayer) => {
-          if (err) {
-            return cb(err);
-          }
+        server.storage.fetchCopayerLookup(opts.copayerId).then(copayer => {
           if (!copayer) {
             return cb(Errors.NOT_AUTHORIZED.withMessage('Copayer not found'));
           }
@@ -456,7 +447,7 @@ export class WalletService implements IWalletService {
           server.copayerId = opts.copayerId;
           server.walletId = copayer.walletId;
           return cb(null, server);
-        });
+        }).catch(err => cb(err));
       });
     };
 
@@ -1060,8 +1051,7 @@ export class WalletService implements IWalletService {
       derivationStrategy: wallet.derivationStrategy
     });
 
-    this.storage.fetchCopayerLookup(copayer.id, (err, res) => {
-      if (err) return cb(err);
+    this.storage.fetchCopayerLookup(copayer.id).then(res => {
       if (res) return cb(Errors.COPAYER_REGISTERED);
 
       if (opts.dryRun)
@@ -1113,7 +1103,7 @@ export class WalletService implements IWalletService {
           }
         );
       });
-    });
+    }).catch(err => cb(err));
   }
 
   _addKeyToCopayer(wallet: Wallet, copayer: Copayer, opts, cb) {
@@ -1143,8 +1133,7 @@ export class WalletService implements IWalletService {
   addAccess(opts, cb) {
     if (!checkRequired(opts, ['copayerId', 'requestPubKey', 'signature'], cb)) return;
 
-    this.storage.fetchCopayerLookup(opts.copayerId, (err, copayer) => {
-      if (err) return cb(err);
+    this.storage.fetchCopayerLookup(opts.copayerId).then(copayer => {
       if (!copayer) return cb(Errors.NOT_AUTHORIZED);
       this.storage.fetchWallet(copayer.walletId, (err, wallet) => {
         if (err) return cb(err);
@@ -1164,7 +1153,7 @@ export class WalletService implements IWalletService {
 
         this._addKeyToCopayer(wallet, copayer, opts, cb);
       });
-    });
+    }).catch(err => cb(err));
   }
 
   _setClientVersion(version) {

package/src/lib/storage.ts

@@ -288,27 +288,19 @@ export class Storage {
     );
   }
 
-  fetchCopayerLookup(copayerId: string, cb: (err?: any, copayer?: Copayer) => void) {
-    this.db.collection(collections.COPAYERS_LOOKUP).findOne(
-      {
-        copayerId
-      },
-      (err, result) => {
-        if (err) return cb(err);
-        if (!result) return cb();
-
-        if (!result.requestPubKeys) {
-          result.requestPubKeys = [
-            {
-              key: result.requestPubKey,
-              signature: result.signature
-            }
-          ];
+  async fetchCopayerLookup(copayerId: string): Promise<Copayer | undefined> {
+    const result = await this.db.collection(collections.COPAYERS_LOOKUP).findOne({ copayerId });
+    if (!result) return;
+    if (!result.requestPubKeys) {
+      result.requestPubKeys = [
+        {
+          key: result.requestPubKey,
+          signature: result.signature
         }
+      ];
+    }
 
-        return cb(null, Copayer.fromObj(result));
-      }
-    );
+    return Copayer.fromObj(result);
   }
 
   // TODO: should be done client-side
@@ -1806,16 +1798,48 @@ export class Storage {
     return this.db.collection(collections.TSS_KEYGEN).insertOne(doc);
   }
 
-  async storeTssKeyGenParticipant({ id, partyId, copayerId }: { id: string; partyId: number; copayerId: string }) {
-    return this.db.collection(collections.TSS_KEYGEN).updateOne(
-      { id },
+  async storeTssKeyGenAuthPublicKey({ id, partyId, authPublicKey, __v }: { id: string; partyId: number; authPublicKey: string; __v: number }) {
+    const result = await this.db.collection(collections.TSS_KEYGEN).updateOne(
+      { id, __v },
+      {
+        $set: {
+          [`authPublicKeys.${partyId}`]: authPublicKey
+        },
+        $inc: {
+          __v: 1
+        }
+      },
+      { upsert: false }
+    );
+    if (!result.matchedCount) {
+      if ((await this.db.collection(collections.TSS_KEYGEN).countDocuments({ id })) === 0) {
+        throw new Error('MONGO_DOC_NOT_FOUND: No document found for id ' + id);
+      }
+      throw new Error('MONGO_DOC_OUTDATED: No document found for version ' + __v);
+    }
+    return result;
+  }
+
+  async storeTssKeyGenParticipant({ id, partyId, copayerId, __v }: { id: string; partyId: number; copayerId: string; __v: number }) {
+    const result = await this.db.collection(collections.TSS_KEYGEN).updateOne(
+      { id, __v },
       {
         $set: {
           [`participants.${partyId}`]: copayerId
+        },
+        $inc: {
+          __v: 1
         }
       },
       { upsert: false }
     );
+    if (!result.matchedCount) {
+      if ((await this.db.collection(collections.TSS_KEYGEN).countDocuments({ id })) === 0) {
+        throw new Error('MONGO_DOC_NOT_FOUND: No document found for id ' + id);
+      }
+      throw new Error('MONGO_DOC_OUTDATED: No document found for version ' + __v);
+    }
+    return result;
   }
 
   async storeTssKeyGenMessage({ id, message, __v }: { id: string; message: ITssKeyMessageObject; __v: number }) {
@@ -1835,6 +1859,9 @@ export class Storage {
       { upsert: false }
     );
     if (!result.matchedCount) {
+      if ((await this.db.collection(collections.TSS_KEYGEN).countDocuments({ id })) === 0) {
+        throw new Error('MONGO_DOC_NOT_FOUND: No document found for id ' + id);
+      }
       throw new Error('MONGO_DOC_OUTDATED: No document found for version ' + __v);
     }
     return result;
@@ -1902,6 +1929,9 @@ export class Storage {
       { upsert: false }
     );
     if (!result.matchedCount) {
+      if ((await this.db.collection(collections.TSS_SIGN).countDocuments({ id })) === 0) {
+        throw new Error('MONGO_DOC_NOT_FOUND: No document found for id ' + id);
+      }
       throw new Error('MONGO_DOC_OUTDATED: No document found for version ' + __v);
     }
     return result;
@@ -1924,6 +1954,9 @@ export class Storage {
       { upsert: false }
     );
     if (!result.matchedCount) {
+      if ((await this.db.collection(collections.TSS_SIGN).countDocuments({ id })) === 0) {
+        throw new Error('MONGO_DOC_NOT_FOUND: No document found for id ' + id);
+      }
       throw new Error('MONGO_DOC_OUTDATED: No document found for version ' + __v);
     }
     return result;

package/src/lib/tss.ts

@@ -155,6 +155,57 @@ class TssKeyGenClass {
     return session;
   }
 
+  async registerParty(params: {
+    /** Session ID */
+    id: string;
+    /** Copayer ID of the requesting party */
+    copayerId: string;
+    /* Copayer data to register */
+    data: {
+      /** Party ID */
+      partyId: string | number;
+      /** Public key/Copayer ID of the party */
+      partyPubKey: string;
+    };
+  }) {
+    const { id, copayerId, data } = params;
+
+    const session = await this.getSessionForCopayer({ id, copayerId });
+    const reqPartyId = session.participants.indexOf(copayerId);
+    if (reqPartyId !== 0) {
+      throw Errors.TSS_NON_PARTICIPANT.withMessage('Only the first participant can register a party');
+    }
+
+    if (data.partyId == null || isNaN(data.partyId as number)) {
+      throw Errors.TSS_INVALID_PARTY_DATA.withMessage(`Invalid partyId: ${data.partyId}`);
+    }
+
+    const partyId = parseInt(data.partyId as string);
+    const pubKey = data.partyPubKey?.trim();
+
+    if (!(partyId > 0) || !pubKey || pubKey === copayerId || partyId >= session.n) {
+      throw Errors.TSS_INVALID_PARTY_DATA.withMessage(`Invalid data for party ${partyId} registration`);
+    }
+
+    if (session.authPublicKeys.includes(pubKey)) {
+      if (session.authPublicKeys.indexOf(pubKey) === partyId) {
+        // Already registered at partyId -> return idempotently
+        return;
+      } else {
+        // Trying to re-register a party that is already registered under a different party ID
+        throw Errors.TSS_PARTY_ALREADY_REGISTERED;
+      }
+    }
+    
+    // Has party already submitted initial rounds message? (case when this is a re-register)
+    if (session.rounds?.[0]?.some(round => round.fromPartyId === partyId)) {
+      throw Errors.TSS_ROUNDS_ALREADY_STARTED.withMessage(`Party ${partyId} has already submitted an initial message. Cannot register a new party ${partyId}`);
+    }
+
+    const storage = WalletService.getStorage();
+    await storage.storeTssKeyGenAuthPublicKey({ id, partyId, authPublicKey: pubKey, __v: session.__v });
+  }
+
   /**
    * Get messages for a given party in a TSS keygen session.
    * Only returns messages if all other parties have sent their messages for the round.
@@ -279,10 +330,29 @@ class TssKeyGenClass {
 
 
       if (!session.participants[message.partyId]) {
+        if (session.participants.includes(copayerId)) {
+          throw Errors.TSS_PARTY_ALREADY_REGISTERED;
+        }
         if (!this._checkPassword({ session, password })) {
           throw Errors.TSS_INVALID_PASSWORD;
         }
-        await storage.storeTssKeyGenParticipant({ id, partyId: message.partyId, copayerId });
+        // Sanity check for the public key of the participant in the session
+        // session.authPublicKeys was not added until version 1.2
+        if (session.schemeVersion >= 1.2 && session.authPublicKeys[message.partyId] !== message.publicKey) {
+          throw Errors.NOT_AUTHORIZED;
+        }
+        try {
+          await storage.storeTssKeyGenParticipant({ id, partyId: message.partyId, copayerId, __v: session.__v });
+        } catch (e) {
+          if (e?.message?.startsWith('MONGO_DOC_OUTDATED')) {
+            return this.processMessage(params);
+          } else if (e?.message?.startsWith('MONGO_DOC_NOT_FOUND')) {
+            throw Errors.TSS_SESSION_NOT_FOUND;
+          }
+          throw e;
+        }
+      } else if (session.participants[message.partyId] !== copayerId) {
+        throw Errors.TSS_NON_PARTICIPANT.withMessage('Incorrect copayerId for this partyId');
       }
 
       let result = false;
@@ -427,6 +497,8 @@ class TssKeyGenClass {
     } catch (e) {
       if (e?.message?.startsWith('MONGO_DOC_OUTDATED')) {
         return false;
+      } else if (e?.message?.startsWith('MONGO_DOC_NOT_FOUND')) {
+        throw Errors.TSS_SESSION_NOT_FOUND;
       }
       throw e;
     }
@@ -694,6 +766,8 @@ class TssSignClass {
         } catch (e) {
           if (e?.message?.startsWith('MONGO_DOC_OUTDATED')) {
             return this.processMessage(params);
+          } else if (e?.message?.startsWith('MONGO_DOC_NOT_FOUND')) {
+            throw Errors.TSS_SESSION_NOT_FOUND;
           }
           throw e;
         }
@@ -814,6 +888,8 @@ class TssSignClass {
     } catch (e) {
       if (e?.message?.startsWith('MONGO_DOC_OUTDATED')) {
         return false;
+      } else if (e?.message?.startsWith('MONGO_DOC_NOT_FOUND')) {
+        throw Errors.TSS_SESSION_NOT_FOUND;
       }
       throw e;
     }

package/src/types/externalservices.d.ts

@@ -20,7 +20,6 @@ export interface BuyCryptoConfig {
   sardine?: ExchangeConfig;
   simplex?: ExchangeConfig;
   transak?: ExchangeConfig;
-  wyre?: ExchangeConfig;
 }
 
 export interface SellCryptoConfig {