@bitpay-labs/bitcore-wallet-service 11.11.2 → 11.11.3

package/package.json

@@ -2,7 +2,7 @@
   "name": "@bitpay-labs/bitcore-wallet-service",
   "description": "A service for Mutisig HD Bitcoin Wallets",
   "author": "BitPay Inc",
-  "version": "11.11.2",
+  "version": "11.11.3",
   "license": "MIT",
   "main": "ts_build/src/index.js",
   "types": "./ts_build/src/index.d.ts",
@@ -107,5 +107,5 @@
       "email": "kjoseph@bitpay.com"
     }
   ],
-  "gitHead": "1a044f2c984f6856f569981eebd91b051ab130d8"
+  "gitHead": "154120b032bb0cd42bad2559c0ef81873a8c7e8c"
 }

package/src/lib/common/constants.ts

@@ -226,7 +226,7 @@ export const Constants = {
 
   // May be different from the defaults if we rollback
   // or want to beta test new versions.
-  TSS_KEYGEN_SCHEME_VERSION_MAX: 1.2,
+  TSS_KEYGEN_SCHEME_VERSION_MAX: 1.3,
   TSS_SIGGEN_SCHEME_VERSION_MAX: 1.1,
   
   TSS_KEYGEN_SCHEME_VERSION_MIN: 1,

package/src/lib/common/utils.ts

@@ -571,5 +571,22 @@ export const Utils = {
     return retval;
   },
 
-  sleep(ms) { return new Promise(resolve => setTimeout(resolve, ms)); }
+  sleep(ms) {
+    return new Promise(resolve => setTimeout(resolve, ms));
+  },
+
+  convertXPubKeyForNetwork(xPubKey: string, chain: string, network: string) {
+    // Convert named network for non-UTXO chains to generic name (e.g. sepolia -> testnet)
+    network = !Bitcore_[chain] ? Utils.getGenericName(network) : network;
+    const lib = Bitcore_[chain] || BitcoreLib;
+    $.checkArgument(xPubKey, 'xPubKey is required at <convertXPubKeyForNetwork()>');
+    $.checkArgument(chain, 'chain is required at <convertXPubKeyForNetwork()>');
+    $.checkArgument(lib.Networks.get(network), 'invalid network at <convertXPubKeyForNetwork()>: ' + network);
+    const hdPubKeyObj = new lib.HDPublicKey(xPubKey).toObject();
+    hdPubKeyObj.network = network;
+    delete hdPubKeyObj.checksum;
+    delete hdPubKeyObj.xpubkey;
+    const newHdPubKey = lib.HDPublicKey.fromObject(hdPubKeyObj);
+    return newHdPubKey.toString();
+  }
 };

package/src/lib/model/tsskeygen.ts

@@ -80,9 +80,18 @@ export interface ITssKeyGenModel {
    */
   timeLimit?: number;
   /**
+   * @deprecated Use bwsJoinSecrets instead.
    * The BWC-generated secret for joining a BWS wallet
    */
   bwsJoinSecret?: string;
+  /**
+   * The BWC-generated secrets for joining a BWS wallet
+   */
+  bwsJoinSecrets?: {
+    [chainNetwork: string]: {
+      [partyId: number]: string;
+    };
+  };
   /**
    * The mongo doc version
    */
@@ -105,6 +114,11 @@ export class TssKeyGenModel implements ITssKeyGenModel {
   createdOn: number;
   timeLimit?: number;
   bwsJoinSecret?: string;
+  bwsJoinSecrets?: {
+    [chainNetwork: string]: {
+      [partyId: number]: string;
+    };
+  };
   __v: number;
 
 
@@ -151,6 +165,7 @@ export class TssKeyGenModel implements ITssKeyGenModel {
     x.keyShares = new Array(n);
     x.createdOn = Date.now();
     x.timeLimit = Math.min(timeLimit || Defaults.TSS_KEYGEN_TIME_LIMIT, 60) * ONE_MINUTE; // capped at 60 minutes
+    x.bwsJoinSecrets = {};
     x.__v = 0;
     return x;
   }
@@ -169,6 +184,7 @@ export class TssKeyGenModel implements ITssKeyGenModel {
     x.createdOn = obj.createdOn;
     x.timeLimit = obj.timeLimit;
     x.bwsJoinSecret = obj.bwsJoinSecret;
+    x.bwsJoinSecrets = obj.bwsJoinSecrets;
     x.__v = obj.__v;
     return x;
   }

package/src/lib/routes/maintenance.ts

@@ -1,4 +1,5 @@
 import express from 'express';
+import { ClientError } from '../errors/clienterror';
 import { WalletService } from '../server';
 import { Stats } from '../stats';
 import type * as Types from '../../types/expressapp';
@@ -27,6 +28,14 @@ export function registerMaintenanceRoutes(router: express.Router, context: Route
   });
 
   router.get('/v1/stats/', (req, res) => {
+    const { network, coin } = req.query;
+    if (network !== undefined && typeof network !== 'string') {
+      return returnError(new ClientError('Invalid network'), res, req);
+    }
+    if (coin !== undefined && typeof coin !== 'string') {
+      return returnError(new ClientError('Invalid coin'), res, req);
+    }
+
     setPublicCache(res, 1 * ONE_MINUTE);
     const opts: {
       network?: string;
@@ -35,8 +44,8 @@ export function registerMaintenanceRoutes(router: express.Router, context: Route
       to?: string;
     } = {};
 
-    if (req.query.network) opts.network = req.query.network as string;
-    if (req.query.coin) opts.coin = req.query.coin as string;
+    if (network) opts.network = network;
+    if (coin) opts.coin = coin;
     if (req.query.from) opts.from = req.query.from as string;
     if (req.query.to) opts.to = req.query.to as string;
 

package/src/lib/routes/middleware/authTssRequest.ts

@@ -11,9 +11,7 @@ import type { ITssSigMessageObject, TssSigGenModel } from '../../model/tsssign';
 function verifyMessage(req: express.Request, signature: string, pubKey: string) {
   const message = getMessage(req);
   const isValid = !!Utils.verifyMessage(message, signature, pubKey);
-  if (!isValid) {
-    throw Errors.NOT_AUTHORIZED.withMessage('Invalid signature');
-  }
+  return isValid;
 }
 
 /**
@@ -21,7 +19,8 @@ function verifyMessage(req: express.Request, signature: string, pubKey: string)
  * It checks if the request has valid credentials, verifies the signature,
  * and retrieves the TSS session based on the request path.
  */
-export function authTssKeyGenRequest(): express.RequestHandler {
+export function authTssKeyGenRequest(params: { bypassExpired?: boolean } = {}): express.RequestHandler {
+  const { bypassExpired } = params;
   return async function(req, res, next) {
     try {
       const storage = WalletService.getStorage();
@@ -46,7 +45,10 @@ export function authTssKeyGenRequest(): express.RequestHandler {
         // This is a brand new session. Caller should be party 0 with the initial round message.
         if (body?.message?.round === 0 && body?.message?.partyId === 0) {
           const pubKey = body?.message?.publicKey;
-          verifyMessage(req, signature, pubKey); // Self verification, but at least ensures that the caller owns the message's private key
+          if (!verifyMessage(req, signature, pubKey)) {
+            // Self verification, but at least ensures that the caller owns the message's private key
+            throw Errors.NOT_AUTHORIZED.withMessage('Invalid signature');
+          }
           return next();
         } else {
           // Session should have been initialized by the client already in BWC > TssKeyGen.newKey()
@@ -54,7 +56,7 @@ export function authTssKeyGenRequest(): express.RequestHandler {
         }
       }
 
-      if (session.isExpired()) {
+      if (!bypassExpired && session.isExpired()) {
         throw Errors.TSS_SESSION_EXPIRED;
       }
 
@@ -103,7 +105,9 @@ export function authTssKeyGenRequest(): express.RequestHandler {
         throw Errors.NOT_AUTHORIZED.withMessage('Copayer not found in session');
       }
 
-      verifyMessage(req, signature, pubKey);
+      if (!verifyMessage(req, signature, pubKey)) {
+        throw Errors.NOT_AUTHORIZED.withMessage('Invalid signature');
+      }
     
       req.session = session;
       return next();
@@ -116,7 +120,8 @@ export function authTssKeyGenRequest(): express.RequestHandler {
   };
 };
 
-export function authTssSignRequest(): express.RequestHandler {
+export function authTssSignRequest(params: { joinable?: boolean } = {}): express.RequestHandler {
+  const { joinable } = params;
   return async function(req, res, next) {
     try {
       const storage = WalletService.getStorage();
@@ -132,16 +137,22 @@ export function authTssSignRequest(): express.RequestHandler {
       
       const { id } = req.params as { [key: string]: string };
       const body = req.body as { message: ITssSigMessageObject | undefined };
-      // Only some requests carry a body.message (e.g. POST /store only sends the final signature).
-      //  Omitting it is safe since routes that don't receive a message don't consume one.
-      const verifyMsg = !!body?.message;
 
       const copayer = await storage.fetchCopayerLookup(copayerId);
       if (!copayer) {
         throw Errors.NOT_AUTHORIZED.withMessage('Copayer not found');
       }
-      const pubKey = copayer.requestPubKeys[0].key;
-      if (verifyMsg && pubKey !== body?.message?.publicKey) {
+      // I'm not aware of an instance where copayer.requestPubKeys.length > 1, but we iterate over them to find the key for the given signature.
+      const pubKey = copayer.requestPubKeys.find(pubKey => verifyMessage(req, signature, pubKey.key))?.key;
+      if (!pubKey) {
+        throw Errors.NOT_AUTHORIZED.withMessage('Invalid signature');
+      }
+
+      // Only some requests carry a body.message (e.g. POST /store only sends the final signature).
+      // Omitting it is safe since routes that don't receive a message don't change state.
+      // `verifyMsgFields` just indicates whether to check the message's fields for expected values (e.g. publicKey, partyId).
+      const verifyMsgFields = !!body?.message;
+      if (verifyMsgFields && pubKey !== body?.message?.publicKey) {
         throw Errors.NOT_AUTHORIZED.withMessage('Invalid public key');
       }
 
@@ -152,10 +163,12 @@ export function authTssSignRequest(): express.RequestHandler {
           throw Errors.TSS_SESSION_EXPIRED;
         }
         const party = session.participants.find(p => p.copayerId === copayerId);
-        if (!party) {
+        // A copayer joins an existing session by sending its round 0 message (participant is added in TssSign.processMessage)
+        const isJoining = !party && body?.message?.round === 0;
+        if (!party && !(joinable && isJoining)) {
           throw Errors.NOT_AUTHORIZED.withMessage('Copayer not found in session');
         }
-        if (verifyMsg && party.partyId !== body?.message?.partyId) {
+        if (verifyMsgFields && party && party.partyId !== body?.message?.partyId) {
           throw Errors.NOT_AUTHORIZED.withMessage('Copayer not found in session');
         }
 
@@ -164,7 +177,6 @@ export function authTssSignRequest(): express.RequestHandler {
         throw Errors.TSS_SESSION_NOT_FOUND;
       }
       
-      verifyMessage(req, signature, pubKey);
       return next();
     } catch (err) {
       if (err instanceof ClientError) {

package/src/lib/routes/middleware/verifyTssMessage.ts

@@ -14,7 +14,10 @@ export async function verifyTssMessage(req, res, next) {
       throw Errors.TSS_PUBKEY_MISSING;
     }
 
-    if (!message.broadcastMessages?.length && !message.p2pMessages?.length) {
+    // 1-of-N signing sessions won't have messages for other recipients.
+    //  req.session is unset for a new session, and keygen sessions have no `m`.
+    const isSoloSigner = req.session?.m === 1;
+    if (!isSoloSigner && !message.broadcastMessages?.length && !message.p2pMessages?.length) {
       throw Errors.TSS_INVALID_MESSAGE;
     }
 

package/src/lib/routes/services.ts

@@ -3,6 +3,7 @@ import express from 'express';
 import rp from 'request-promise-native';
 import config from '../../config';
 import { Common } from '../common';
+import { ClientError } from '../errors/clienterror';
 import type * as Types from '../../types/expressapp';
 import type { WalletService } from '../server';
 
@@ -125,13 +126,18 @@ export function registerServiceRoutes(router: express.Router, context: RouteCont
   });
 
   router.get('/v1/fiatrates/:code/', (req, res) => {
+    const { coin } = req.query;
+    if (coin !== undefined && typeof coin !== 'string') {
+      return context.returnError(new ClientError('Invalid coin'), res, req);
+    }
+
     setPublicCache(res, 5 * ONE_MINUTE);
     respondWithPublicServer(req, res, context, server =>
       callbackResult(resolve => {
         server.getFiatRate(
           {
             code: req.params['code'],
-            coin: req.query.coin || 'btc',
+            coin: coin || 'btc',
             ts: req.query.ts ? +req.query.ts : null
           },
           resolve

package/src/lib/routes/tss.ts

@@ -1,7 +1,6 @@
 import express from 'express';
 import * as Types from '../../types/expressapp';
 import { TssKeyGen, TssSign } from '../tss';
-import { authRequest } from './middleware/authRequest';
 import { authTssKeyGenRequest, authTssSignRequest } from './middleware/authTssRequest';
 import { createWalletLimiter } from './middleware/createWalletLimiter';
 import { verifyTssMessage } from './middleware/verifyTssMessage';
@@ -49,6 +48,36 @@ export class TssRouter {
       }
     });
 
+    // Must be before /keygen/:id/:round so "secret" doesn't get interpreted as a round number
+    router.get('/v1/tss/keygen/:id/secret', authTssKeyGenRequest({ bypassExpired: true }), async function(req, res) {
+      try {
+        const id = req.params.id;
+        const copayerId = req.headers['x-identity'];
+        const { chain, network } = req.query as { [key: string]: string };
+        const secret = await TssKeyGen.getBwsJoinSecret({ id, chain, network, copayerId });
+        return res.json({ secret });
+      } catch (err) {
+        return returnError(err ?? 'unknown', res, req);
+      }
+    });
+
+    router.post('/v1/tss/keygen/:id/secret', authTssKeyGenRequest({ bypassExpired: true }), async function(req, res) {
+      try {
+        const id = req.params.id;
+        const { chain, network, secrets, secret } = req.body;
+        const copayerId = req.headers['x-identity'];
+        if (secrets == null && secret != null) {
+          // Legacy (< v1.3) clients send a single unencrypted secret
+          await TssKeyGen.storeBwsJoinSecret({ id, secret, copayerId });
+        } else {
+          await TssKeyGen.storeBwsJoinSecrets({ id, chain, network, secrets, copayerId });
+        }
+        return res.send();
+      } catch (err) {
+        return returnError(err ?? 'unknown', res, req);
+      }
+    });
+
     router.get('/v1/tss/keygen/:id/:round', authTssKeyGenRequest(), async function(req, res) {
       let interval: NodeJS.Timeout;
       try {
@@ -58,10 +87,6 @@ export class TssRouter {
         const { id, round } = req.params as { [key: string]: string };
         const { maxWaitTime } = req.query as { [key: string]: string };
         const copayerId = req.headers['x-identity'];
-        if (round === 'secret') {
-          const secret = await TssKeyGen.getBwsJoinSecret({ id, copayerId });
-          return res.json({ secret });
-        }
 
         // Validate access and fetch session before committing to a streaming response, so that errors like
         //   "session not found" or "not a participant" can still be returned with a proper
@@ -100,33 +125,10 @@ export class TssRouter {
       }
     });
 
-    router.post('/v1/tss/keygen/:id/secret', authTssKeyGenRequest(), async function(req, res) {
-      try {
-        const id = req.params.id;
-        const { secret } = req.body;
-        const copayerId = req.headers['x-identity'];
-        await TssKeyGen.storeBwsJoinSecret({ id, secret, copayerId });
-        return res.send();
-      } catch (err) {
-        return returnError(err ?? 'unknown', res, req);
-      }
-    });
-
-    router.get('/v1/tss/keygen/:id/secret', authTssKeyGenRequest(), async function(req, res) {
-      try {
-        const id = req.params.id;
-        const copayerId = req.headers['x-identity'];
-        const secret = await TssKeyGen.getBwsJoinSecret({ id, copayerId });
-        return res.json({ secret });
-      } catch (err) {
-        return returnError(err ?? 'unknown', res, req);
-      }
-    });
-
 
     /** Signature Methods */
 
-    router.post('/v1/tss/sign/:id', authRequest(), verifyTssMessage, async function(req, res) {
+    router.post('/v1/tss/sign/:id', authTssSignRequest({ joinable: true }), verifyTssMessage, async function(req, res) {
       try {
         const id = req.params.id;
         // version was not given by client until 1.1, so fallback to 1.0
@@ -178,7 +180,8 @@ export class TssRouter {
       try {
         const id = req.params.id;
         const { signature } = req.body;
-        await TssSign.storeSignature({ id, signature });
+        const copayerId = req.headers['x-identity'];
+        await TssSign.storeSignature({ id, signature, copayerId });
         return res.send();
       } catch (err) {
         return returnError(err ?? 'unknown', res, req);

package/src/lib/server.ts

@@ -604,6 +604,7 @@ export class WalletService implements IWalletService {
    * @param {number} [opts.tssVersion] TSS version to use. Supplying this with n > 1 and a multisig chain (e.g. btc) will tell the wallet to use
    *                                   threshold insead of on-chain multisig. Otherwise, n > 1 and a non-multisig chain will default to TSS_KEYGEN_SCHEME_VERSION
    * @param {string} [opts.tssKeyId] TSS key session id. This is the id of the TSS key generation session that will be used to create the wallet.
+   * @param {string} [opts.tssKeygenCopayerId] The ID of the copayer creating the wallet. Required for TSS version >= 1.3.
    */
   async createWallet(opts, cb) {
     let pubKey;
@@ -674,6 +675,17 @@ export class WalletService implements IWalletService {
         return cb(new ClientError('Invalid TSS version'));
       }
 
+      if (opts.tssVersion >= 1.3) {
+        if (!opts.tssKeygenCopayerId) {
+          return cb(new ClientError('Copayer ID is required for TSS version >= 1.3'));
+        }
+        // This is only a sanity check to prevent problems down the line. If this is somehow
+        // spoofed, there are more strict authorization checks later in the wallet creation flow.
+        if (keySession.participants.indexOf(opts.tssKeygenCopayerId) !== 0) {
+          return cb(new ClientError('Only the TSS session leader can create a wallet'));
+        }
+      }
+
       // TSS wallets behave like a single-sig
       opts.m = 1;
       opts.n = 1;
@@ -1038,7 +1050,11 @@ export class WalletService implements IWalletService {
     this._notify(type, data, {}, cb);
   }
 
-  _addCopayerToWallet(wallet: Wallet, opts, cb) {
+  _addCopayerToWallet(
+    wallet: Wallet,
+    opts: JoinWalletOpts,
+    cb: (err: ClientError | null, result?: { copayerId: string | null; wallet: Wallet }) => void
+  ) {
     const copayer = Copayer.create({
       coin: wallet.coin,
       chain: wallet.chain, // chain === coin for stored clients
@@ -1194,20 +1210,11 @@ export class WalletService implements IWalletService {
 
   /**
    * Joins a wallet in creation.
-   * @param {Object} opts
-   * @param {string} opts.walletId The wallet id.
-   * @param {string} opts.coin The expected coin for this wallet (btc, bch, eth, doge, ltc). Default: btc
-   * @param {string} opts.chain The expected chain for this wallet (btc, bch, eth, doge, ltc). Default: btc
-   * @param {string} opts.name The copayer name.
-   * @param {string} opts.xPubKey Extended Public Key for this copayer
-   * @param {string} opts.hardwareSourcePublicKey Public key from a hardware device for this copayer
-   * @param {string} opts.clientDerivedPublicKey Public key from the client for this wallet
-   * @param {string} opts.requestPubKey Public Key used to check requests from this copayer.
-   * @param {string} opts.copayerSignature S(name|xPubKey|requestPubKey). Used by other copayers to verify that the copayer joining knows the wallet secret.
-   * @param {string} [opts.customData] Custom data for this copayer.
-   * @param {boolean} [opts.dryRun] Simulate the action but do not change server state.
    */
-  joinWallet(opts, cb) {
+  joinWallet(
+    opts: JoinWalletOpts,
+    cb: (err: ClientError | null, result?: { copayerId: string | null; wallet: Wallet }) => void
+  ) {
     // xPubKey is the canonical copayer identity in the current protocol. Alternate public-key
     // fields are ancillary metadata; supporting an xPubKey-less copayer requires a versioned
     // end-to-end identity protocol rather than a local identity fallback.
@@ -1226,6 +1233,9 @@ export class WalletService implements IWalletService {
       opts.chain = opts.coin; // chain === coin for stored clients
     }
     if (!Utils.checkValueInCollection(opts.chain, Constants.CHAINS)) return cb(new ClientError('Invalid coin'));
+    if (opts.tssKeygenChain != null && !Utils.checkValueInCollection(opts.tssKeygenChain, Constants.CHAINS)) {
+      return cb(new ClientError('Invalid TSS keygen chain'));
+    }
 
     // xPubKey is parsed and validated for every join; ancillary fields never suppress it.
     // A future update will re-add conditional logic which allows opts.hardwareSourcePublicKey
@@ -1286,8 +1296,16 @@ export class WalletService implements IWalletService {
 
         if (wallet.tssKeyId) {
           const keySession = await storage.fetchTssKeyGenSession({ id: wallet.tssKeyId });
-          const copayerId = Copayer.xPubToCopayerId(opts.chain, opts.xPubKey);
-          if (!keySession.participants.includes(copayerId)) {
+          // A sibling wallet on another network (e.g. livenet -> testnet) has an xPubKey serialized for that network,
+          // but the keygen session's copayer IDs were derived from the xPubKey serialized for the session's network.
+          const idChain = opts.tssKeygenChain || opts.chain;
+          const copayerIds = new Set([
+            Copayer.xPubToCopayerId(idChain, opts.xPubKey), // this is probably a duplicate of one of the next two entries, but just in case.
+            Copayer.xPubToCopayerId(idChain, Utils.convertXPubKeyForNetwork(opts.xPubKey, idChain, 'livenet')),
+            Copayer.xPubToCopayerId(idChain, Utils.convertXPubKeyForNetwork(opts.xPubKey, idChain, 'testnet'))
+          ]);
+
+          if (!keySession?.participants.some(id => copayerIds.has(id))) {
             return cb(Errors.TSS_NON_PARTICIPANT);
           }
           return this._addCopayerToWallet(wallet, opts, cb);
@@ -4177,7 +4195,7 @@ export class WalletService implements IWalletService {
         return cb(err);
       }
       wallet.beRegistered = true;
-      return this.storage.storeWallet(wallet, err => cb(err, true));
+      return this.storage.storeWalletRegistration(wallet, err => cb(err, true));
     });
   }
 
@@ -5838,3 +5856,30 @@ export const UPGRADES = {
 } as const;
 
 type Upgrade = typeof UPGRADES[keyof typeof UPGRADES];
+
+export interface JoinWalletOpts {
+  /** The wallet id. */
+  walletId: string;
+  /** The expected coin for this wallet (btc, bch, eth, doge, ltc). Default: btc */
+  coin?: string;
+  /** The expected chain for this wallet (btc, bch, eth, doge, ltc). Default: btc */
+  chain?: string;
+  /** The copayer name. */
+  name: string;
+  /** Extended Public Key for this copayer */
+  xPubKey: string;
+  /** Public key from a hardware device for this copayer */
+  hardwareSourcePublicKey?: string;
+  /** Public key from the client for this wallet */
+  clientDerivedPublicKey?: string;
+  /** Public Key used to check requests from this copayer. */
+  requestPubKey: string;
+  /** Signature proving knowledge of the wallet secret for this copayer. */
+  copayerSignature: string;
+  /** Custom data for this copayer. */
+  customData?: string;
+  /** Simulate the action but do not change server state. */
+  dryRun?: boolean;
+  /** The chain used for TSS key generation. */
+  tssKeygenChain?: string;
+};

package/src/lib/storage.ts

@@ -835,6 +835,26 @@ export class Storage {
     );
   }
 
+  storeWalletRegistration(wallet, cb) {
+    this.db.collection(collections.WALLETS).updateOne(
+      {
+        id: wallet.id
+      },
+      {
+        $set: {
+          beRegistered: wallet.beRegistered,
+          beAuthPrivateKey2: wallet.beAuthPrivateKey2,
+          beAuthPublicKey2: wallet.beAuthPublicKey2
+        }
+      },
+      {
+        w: 1,
+        upsert: false
+      },
+      cb
+    );
+  }
+
   deregisterWallet(walletId, cb) {
     this.db.collection(collections.WALLETS).updateOne(
       {
@@ -1961,6 +1981,10 @@ export class Storage {
     );
   }
 
+  /**
+   * Use only for legacy (< v1.3) clients, where bwsJoinSecrets was not available.
+   * @deprecated Use storeTssKeyBwsJoinSecrets instead.
+   */
   async storeTssKeyBwsJoinSecret({ id, secret }: { id: string; secret: string }) {
     return this.db.collection(collections.TSS_KEYGEN).updateOne({
       id
@@ -1973,6 +1997,21 @@ export class Storage {
     { upsert: false });
   }
 
+  async storeTssKeyBwsJoinSecrets(params: { id: string; chain: string; network: string; secrets: { [partyId: number]: string } }) {
+    const { id, chain, network, secrets } = params;
+    const _chain = chain.toLowerCase();
+    const _network = network.toLowerCase();
+    return this.db.collection(collections.TSS_KEYGEN).updateOne({
+      id
+    },
+    {
+      $set: {
+        [`bwsJoinSecrets.${_chain}:${_network}`]: secrets
+      }
+    },
+    { upsert: false });
+  }
+
   async fetchTssSigSession({ id }: { id: string }) {
     const doc = await this.db.collection(collections.TSS_SIGN).findOne({ id });
     if (!doc) {