From 4b59cee9778a3c6a0be7ccd6f9f011db554ff560 Mon Sep 17 00:00:00 2001
From: Time Markov <time.markov@qtum.com>
Date: Fri, 21 Dec 2018 13:16:36 +0100
Subject: [PATCH 001/153] Set cpp-ethereum module branch to aleth

---
 .gitmodules      | 1 +
 src/cpp-ethereum | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/.gitmodules b/.gitmodules
index 7f1303ceb..8286ee5b4 100644
--- a/.gitmodules
+++ b/.gitmodules
@@ -1,3 +1,4 @@
 [submodule "src/cpp-ethereum"]
 	path = src/cpp-ethereum
 	url = https://github.com/qtumproject/cpp-eth-qtum.git
+	branch = time/aleth
diff --git a/src/cpp-ethereum b/src/cpp-ethereum
index d6081ecc9..a1c13afbb 160000
--- a/src/cpp-ethereum
+++ b/src/cpp-ethereum
@@ -1 +1 @@
-Subproject commit d6081ecc98e3c5f4701363672a3e6a8e875d74b2
+Subproject commit a1c13afbbf4c2e5114c31fad9c6604a8862153ae

From 81cdd3ec5dfcd2a4f0248f8dfcc3baa0c0e5b93f Mon Sep 17 00:00:00 2001
From: Time Markov <time.markov@qtum.com>
Date: Fri, 21 Dec 2018 13:23:02 +0100
Subject: [PATCH 002/153] Update build EVM environment

---
 src/validation.cpp | 53 ++++++++++++++++++++++++++++++++--------------
 src/validation.h   | 17 +++++++++++++++
 2 files changed, 54 insertions(+), 16 deletions(-)

diff --git a/src/validation.cpp b/src/validation.cpp
index e74c8350a..f9bbd2700 100644
--- a/src/validation.cpp
+++ b/src/validation.cpp
@@ -2232,6 +2232,32 @@ void writeVMlog(const std::vector<ResultExecute>& res, const CTransaction& tx, c
     fIsVMlogFile = true;
 }
 
+LastHashes::LastHashes()
+{}
+
+void LastHashes::set(const CBlockIndex *tip)
+{
+    clear();
+
+    m_lastHashes.resize(256);
+    for(int i=0;i<256;i++){
+        if(!tip)
+            break;
+        m_lastHashes[i]= uintToh256(*tip->phashBlock);
+        tip = tip->pprev;
+    }
+}
+
+dev::h256s LastHashes::precedingHashes(const dev::h256 &) const
+{
+    return m_lastHashes;
+}
+
+void LastHashes::clear()
+{
+    m_lastHashes.clear();
+}
+
 bool ByteCodeExec::performByteCode(dev::eth::Permanence type){
     for(QtumTransaction& tx : txs){
         //validate VM version
@@ -2293,27 +2319,22 @@ bool ByteCodeExec::processingResults(ByteCodeExecResult& resultBCE){
 }
 
 dev::eth::EnvInfo ByteCodeExec::BuildEVMEnvironment(){
-    dev::eth::EnvInfo env;
     CBlockIndex* tip = chainActive.Tip();
-    env.setNumber(dev::u256(tip->nHeight + 1));
-    env.setTimestamp(dev::u256(block.nTime));
-    env.setDifficulty(dev::u256(block.nBits));
+    dev::eth::BlockHeader header;
+    header.setNumber(tip->nHeight + 1);
+    header.setTimestamp(block.nTime);
+    header.setDifficulty(dev::u256(block.nBits));
+    header.setGasLimit(blockGasLimit);
+
+    lastHashes.set(tip);
 
-    dev::eth::LastHashes lh;
-    lh.resize(256);
-    for(int i=0;i<256;i++){
-        if(!tip)
-            break;
-        lh[i]= uintToh256(*tip->phashBlock);
-        tip = tip->pprev;
-    }
-    env.setLastHashes(std::move(lh));
-    env.setGasLimit(blockGasLimit);
     if(block.IsProofOfStake()){
-        env.setAuthor(EthAddrFromScript(block.vtx[1]->vout[1].scriptPubKey));
+        header.setAuthor(EthAddrFromScript(block.vtx[1]->vout[1].scriptPubKey));
     }else {
-        env.setAuthor(EthAddrFromScript(block.vtx[0]->vout[0].scriptPubKey));
+        header.setAuthor(EthAddrFromScript(block.vtx[0]->vout[0].scriptPubKey));
     }
+    dev::u256 gasUsed;
+    dev::eth::EnvInfo env(header, lastHashes, gasUsed);
     return env;
 }
 
diff --git a/src/validation.h b/src/validation.h
index 0417ca9a9..4fb0ac9aa 100644
--- a/src/validation.h
+++ b/src/validation.h
@@ -37,6 +37,7 @@
 #include <qtum/qtumstate.h>
 #include <qtum/qtumDGP.h>
 #include <libethereum/ChainParams.h>
+#include <libethereum/LastBlockHashesFace.h>
 #include <libethashseal/Ethash.h>
 #include <libethashseal/GenesisInfo.h>
 #include <script/standard.h>
@@ -681,6 +682,21 @@ class QtumTxConverter{
 
 };
 
+class LastHashes: public dev::eth::LastBlockHashesFace
+{
+public:
+    explicit LastHashes();
+
+    void set(CBlockIndex const* tip);
+
+    dev::h256s precedingHashes(dev::h256 const&) const;
+
+    void clear();
+
+private:
+    dev::h256s m_lastHashes;
+};
+
 class ByteCodeExec {
 
 public:
@@ -707,6 +723,7 @@ class ByteCodeExec {
 
     const uint64_t blockGasLimit;
 
+    LastHashes lastHashes;
 };
 ////////////////////////////////////////////////////////
 

From 24b3182bb861a74ef716437c40124441a26298a9 Mon Sep 17 00:00:00 2001
From: Time Markov <time.markov@qtum.com>
Date: Fri, 21 Dec 2018 13:25:31 +0100
Subject: [PATCH 003/153] Update rpc blockchain

---
 src/cpp-ethereum       | 2 +-
 src/rpc/blockchain.cpp | 6 +++---
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/src/cpp-ethereum b/src/cpp-ethereum
index a1c13afbb..8366d7310 160000
--- a/src/cpp-ethereum
+++ b/src/cpp-ethereum
@@ -1 +1 @@
-Subproject commit a1c13afbbf4c2e5114c31fad9c6604a8862153ae
+Subproject commit 8366d7310750036402bf7171c7ee2fdf4ba60ae9
diff --git a/src/rpc/blockchain.cpp b/src/rpc/blockchain.cpp
index 3666c24ec..3b0525f08 100644
--- a/src/rpc/blockchain.cpp
+++ b/src/rpc/blockchain.cpp
@@ -251,7 +251,7 @@ UniValue transactionReceiptToJSON(const dev::eth::TransactionReceipt& txRec)
 {
     UniValue result(UniValue::VOBJ);
     result.pushKV("stateRoot", txRec.stateRoot().hex());
-    result.pushKV("gasUsed", CAmount(txRec.gasUsed()));
+    result.pushKV("gasUsed", CAmount(txRec.cumulativeGasUsed()));
     result.pushKV("bloom", txRec.bloom().hex());
     UniValue logEntries(UniValue::VARR);
     dev::eth::LogEntries logs = txRec.log();
@@ -828,7 +828,7 @@ static UniValue getaccountinfo(const JSONRPCRequest& request)
     for (auto j: storage)
     {
         UniValue e(UniValue::VOBJ);
-        e.pushKV(dev::toHex(j.second.first), dev::toHex(j.second.second));
+        e.pushKV(dev::toHex(dev::h256(j.second.first)), dev::toHex(dev::h256(j.second.second)));
         storageUV.pushKV(j.first.hex(), e);
     }
         
@@ -911,7 +911,7 @@ static UniValue getstorage(const JSONRPCRequest& request)
     for (const auto& j: storage)
     {
         UniValue e(UniValue::VOBJ);
-        e.pushKV(dev::toHex(j.second.first), dev::toHex(j.second.second));
+        e.pushKV(dev::toHex(dev::h256(j.second.first)), dev::toHex(dev::h256(j.second.second)));
         result.pushKV(j.first.hex(), e);
     }
     return result;

From 18997462ce6dcade2c50fde33c40b2d869850624 Mon Sep 17 00:00:00 2001
From: Time Markov <time.markov@qtum.com>
Date: Fri, 21 Dec 2018 13:27:23 +0100
Subject: [PATCH 004/153] Update headers

---
 src/qtum/qtumtransaction.h | 2 +-
 src/qtum/storageresults.h  | 1 +
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/qtum/qtumtransaction.h b/src/qtum/qtumtransaction.h
index 73d7097a1..ca4963bf8 100644
--- a/src/qtum/qtumtransaction.h
+++ b/src/qtum/qtumtransaction.h
@@ -1,7 +1,7 @@
 #ifndef QTUMTRANSACTION_H
 #define QTUMTRANSACTION_H
 
-#include <libethcore/Transaction.h>
+#include <libethereum/Transaction.h>
 
 struct VersionVM{
     //this should be portable, see https://stackoverflow.com/questions/31726191/is-there-a-portable-alternative-to-c-bitfields
diff --git a/src/qtum/storageresults.h b/src/qtum/storageresults.h
index e2b4ab64f..d8c124e4d 100644
--- a/src/qtum/storageresults.h
+++ b/src/qtum/storageresults.h
@@ -2,6 +2,7 @@
 #include <primitives/transaction.h>
 #include <libethereum/State.h>
 #include <libethereum/Transaction.h>
+#include <leveldb/db.h>
 #include <util.h>
 
 using logEntriesSerializ = std::vector<std::pair<dev::Address, std::pair<dev::h256s, dev::bytes>>>;

From 18167878ed30b93fdaf0a64ed38f84fa832e167b Mon Sep 17 00:00:00 2001
From: Time Markov <time.markov@qtum.com>
Date: Fri, 21 Dec 2018 13:29:24 +0100
Subject: [PATCH 005/153] Update qtum state

---
 src/qtum/qtumstate.cpp | 6 +++---
 src/qtum/qtumstate.h   | 2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/src/qtum/qtumstate.cpp b/src/qtum/qtumstate.cpp
index e5905674b..477e19b58 100644
--- a/src/qtum/qtumstate.cpp
+++ b/src/qtum/qtumstate.cpp
@@ -81,7 +81,7 @@ ResultExecute QtumState::execute(EnvInfo const& _envInfo, SealEngineFace const&
             
             qtum::commit(cacheUTXO, stateUTXO, m_cache);
             cacheUTXO.clear();
-            bool removeEmptyAccounts = _envInfo.number() >= _sealEngine.chainParams().u256Param("EIP158ForkBlock");
+            bool removeEmptyAccounts = _envInfo.number() >= _sealEngine.chainParams().EIP158ForkBlock;
             commit(removeEmptyAccounts ? State::CommitBehaviour::RemoveEmptyAccounts : State::CommitBehaviour::KeepEmptyAccounts);
         }
     }
@@ -206,7 +206,7 @@ void QtumState::addBalance(dev::Address const& _id, dev::u256 const& _amount)
             // TODO: to save space we can combine this event with Balance by having
             //       Balance and Balance+Touch events.
         if (!a->isDirty() && a->isEmpty())
-            m_changeLog.emplace_back(dev::eth::detail::Change::Touch, _id);
+            m_changeLog.emplace_back(dev::eth::Change::Touch, _id);
 
             // Increase the account balance. This also is done for value 0 to mark
             // the account as dirty. Dirty account are not removed from the cache
@@ -223,7 +223,7 @@ void QtumState::addBalance(dev::Address const& _id, dev::u256 const& _amount)
     }
 
     if (_amount)
-        m_changeLog.emplace_back(dev::eth::detail::Change::Balance, _id, _amount);
+        m_changeLog.emplace_back(dev::eth::Change::Balance, _id, _amount);
 }
 
 dev::Address QtumState::createQtumAddress(dev::h256 hashTx, uint32_t voutNumber){
diff --git a/src/qtum/qtumstate.h b/src/qtum/qtumstate.h
index 233121087..e01433672 100644
--- a/src/qtum/qtumstate.h
+++ b/src/qtum/qtumstate.h
@@ -12,7 +12,7 @@
 #include <libethcore/SealEngine.h>
 
 using OnOpFunc = std::function<void(uint64_t, uint64_t, dev::eth::Instruction, dev::bigint, dev::bigint, 
-    dev::bigint, dev::eth::VM*, dev::eth::ExtVMFace const*)>;
+    dev::bigint, dev::eth::VMFace const*, dev::eth::ExtVMFace const*)>;
 using plusAndMinus = std::pair<dev::u256, dev::u256>;
 using valtype = std::vector<unsigned char>;
 

From aa5abfe839e3e9a513ccbcf6c123cfdc702575ec Mon Sep 17 00:00:00 2001
From: Time Markov <time.markov@qtum.com>
Date: Wed, 26 Dec 2018 12:58:22 +0100
Subject: [PATCH 006/153] Export the sha256 interface in secp256k1

---
 src/secp256k1/Makefile.am                |  2 +-
 src/secp256k1/include/secp256k1_sha256.h | 49 ++++++++++++++++++++++++
 src/secp256k1/src/hash.h                 | 41 --------------------
 src/secp256k1/src/hash_impl.h            | 20 +++++-----
 src/secp256k1/src/testrand_impl.h        |  2 +-
 5 files changed, 61 insertions(+), 53 deletions(-)
 create mode 100644 src/secp256k1/include/secp256k1_sha256.h
 delete mode 100644 src/secp256k1/src/hash.h

diff --git a/src/secp256k1/Makefile.am b/src/secp256k1/Makefile.am
index c071fbe27..60f280162 100644
--- a/src/secp256k1/Makefile.am
+++ b/src/secp256k1/Makefile.am
@@ -8,6 +8,7 @@ else
 JNI_LIB =
 endif
 include_HEADERS = include/secp256k1.h
+include_HEADERS += include/secp256k1_sha256.h
 noinst_HEADERS =
 noinst_HEADERS += src/scalar.h
 noinst_HEADERS += src/scalar_4x64.h
@@ -44,7 +45,6 @@ noinst_HEADERS += src/java/org_bitcoin_Secp256k1Context.h
 noinst_HEADERS += src/util.h
 noinst_HEADERS += src/testrand.h
 noinst_HEADERS += src/testrand_impl.h
-noinst_HEADERS += src/hash.h
 noinst_HEADERS += src/hash_impl.h
 noinst_HEADERS += src/field.h
 noinst_HEADERS += src/field_impl.h
diff --git a/src/secp256k1/include/secp256k1_sha256.h b/src/secp256k1/include/secp256k1_sha256.h
new file mode 100644
index 000000000..b967c8408
--- /dev/null
+++ b/src/secp256k1/include/secp256k1_sha256.h
@@ -0,0 +1,49 @@
+/**********************************************************************
+ * Copyright (c) 2014 Pieter Wuille                                   *
+ * Distributed under the MIT software license, see the accompanying   *
+ * file COPYING or http://www.opensource.org/licenses/mit-license.php.*
+ **********************************************************************/
+
+#ifndef _SECP256K1_HASH_
+#define _SECP256K1_HASH_
+
+#include <stddef.h>
+#include <stdint.h>
+
+# ifdef __cplusplus
+extern "C" {
+# endif
+
+typedef struct {
+    uint32_t s[8];
+    uint32_t buf[16]; /* In big endian */
+    size_t bytes;
+} secp256k1_sha256_t;
+
+void secp256k1_sha256_initialize(secp256k1_sha256_t *hash);
+void secp256k1_sha256_write(secp256k1_sha256_t *hash, const unsigned char *data, size_t size);
+void secp256k1_sha256_finalize(secp256k1_sha256_t *hash, unsigned char *out32);
+
+typedef struct {
+    secp256k1_sha256_t inner, outer;
+} secp256k1_hmac_sha256_t;
+
+void secp256k1_hmac_sha256_initialize(secp256k1_hmac_sha256_t *hash, const unsigned char *key, size_t size);
+void secp256k1_hmac_sha256_write(secp256k1_hmac_sha256_t *hash, const unsigned char *data, size_t size);
+void secp256k1_hmac_sha256_finalize(secp256k1_hmac_sha256_t *hash, unsigned char *out32);
+
+typedef struct {
+    unsigned char v[32];
+    unsigned char k[32];
+    int retry;
+} secp256k1_rfc6979_hmac_sha256_t;
+
+void secp256k1_rfc6979_hmac_sha256_initialize(secp256k1_rfc6979_hmac_sha256_t *rng, const unsigned char *key, size_t keylen);
+void secp256k1_rfc6979_hmac_sha256_generate(secp256k1_rfc6979_hmac_sha256_t *rng, unsigned char *out, size_t outlen);
+void secp256k1_rfc6979_hmac_sha256_finalize(secp256k1_rfc6979_hmac_sha256_t *rng);
+
+# ifdef __cplusplus
+}
+# endif
+
+#endif
diff --git a/src/secp256k1/src/hash.h b/src/secp256k1/src/hash.h
deleted file mode 100644
index e08d25d22..000000000
--- a/src/secp256k1/src/hash.h
+++ /dev/null
@@ -1,41 +0,0 @@
-/**********************************************************************
- * Copyright (c) 2014 Pieter Wuille                                   *
- * Distributed under the MIT software license, see the accompanying   *
- * file COPYING or http://www.opensource.org/licenses/mit-license.php.*
- **********************************************************************/
-
-#ifndef SECP256K1_HASH_H
-#define SECP256K1_HASH_H
-
-#include <stdlib.h>
-#include <stdint.h>
-
-typedef struct {
-    uint32_t s[8];
-    uint32_t buf[16]; /* In big endian */
-    size_t bytes;
-} secp256k1_sha256_t;
-
-static void secp256k1_sha256_initialize(secp256k1_sha256_t *hash);
-static void secp256k1_sha256_write(secp256k1_sha256_t *hash, const unsigned char *data, size_t size);
-static void secp256k1_sha256_finalize(secp256k1_sha256_t *hash, unsigned char *out32);
-
-typedef struct {
-    secp256k1_sha256_t inner, outer;
-} secp256k1_hmac_sha256_t;
-
-static void secp256k1_hmac_sha256_initialize(secp256k1_hmac_sha256_t *hash, const unsigned char *key, size_t size);
-static void secp256k1_hmac_sha256_write(secp256k1_hmac_sha256_t *hash, const unsigned char *data, size_t size);
-static void secp256k1_hmac_sha256_finalize(secp256k1_hmac_sha256_t *hash, unsigned char *out32);
-
-typedef struct {
-    unsigned char v[32];
-    unsigned char k[32];
-    int retry;
-} secp256k1_rfc6979_hmac_sha256_t;
-
-static void secp256k1_rfc6979_hmac_sha256_initialize(secp256k1_rfc6979_hmac_sha256_t *rng, const unsigned char *key, size_t keylen);
-static void secp256k1_rfc6979_hmac_sha256_generate(secp256k1_rfc6979_hmac_sha256_t *rng, unsigned char *out, size_t outlen);
-static void secp256k1_rfc6979_hmac_sha256_finalize(secp256k1_rfc6979_hmac_sha256_t *rng);
-
-#endif /* SECP256K1_HASH_H */
diff --git a/src/secp256k1/src/hash_impl.h b/src/secp256k1/src/hash_impl.h
index 4c9964ee0..beced9c3f 100644
--- a/src/secp256k1/src/hash_impl.h
+++ b/src/secp256k1/src/hash_impl.h
@@ -7,7 +7,7 @@
 #ifndef SECP256K1_HASH_IMPL_H
 #define SECP256K1_HASH_IMPL_H
 
-#include "hash.h"
+#include "include/secp256k1_sha256.h"
 
 #include <stdlib.h>
 #include <stdint.h>
@@ -33,7 +33,7 @@
 #define BE32(p) ((((p) & 0xFF) << 24) | (((p) & 0xFF00) << 8) | (((p) & 0xFF0000) >> 8) | (((p) & 0xFF000000) >> 24))
 #endif
 
-static void secp256k1_sha256_initialize(secp256k1_sha256_t *hash) {
+void secp256k1_sha256_initialize(secp256k1_sha256_t *hash) {
     hash->s[0] = 0x6a09e667ul;
     hash->s[1] = 0xbb67ae85ul;
     hash->s[2] = 0x3c6ef372ul;
@@ -128,7 +128,7 @@ static void secp256k1_sha256_transform(uint32_t* s, const uint32_t* chunk) {
     s[7] += h;
 }
 
-static void secp256k1_sha256_write(secp256k1_sha256_t *hash, const unsigned char *data, size_t len) {
+void secp256k1_sha256_write(secp256k1_sha256_t *hash, const unsigned char *data, size_t len) {
     size_t bufsize = hash->bytes & 0x3F;
     hash->bytes += len;
     while (bufsize + len >= 64) {
@@ -145,7 +145,7 @@ static void secp256k1_sha256_write(secp256k1_sha256_t *hash, const unsigned char
     }
 }
 
-static void secp256k1_sha256_finalize(secp256k1_sha256_t *hash, unsigned char *out32) {
+void secp256k1_sha256_finalize(secp256k1_sha256_t *hash, unsigned char *out32) {
     static const unsigned char pad[64] = {0x80, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0};
     uint32_t sizedesc[2];
     uint32_t out[8];
@@ -161,7 +161,7 @@ static void secp256k1_sha256_finalize(secp256k1_sha256_t *hash, unsigned char *o
     memcpy(out32, (const unsigned char*)out, 32);
 }
 
-static void secp256k1_hmac_sha256_initialize(secp256k1_hmac_sha256_t *hash, const unsigned char *key, size_t keylen) {
+void secp256k1_hmac_sha256_initialize(secp256k1_hmac_sha256_t *hash, const unsigned char *key, size_t keylen) {
     int n;
     unsigned char rkey[64];
     if (keylen <= 64) {
@@ -189,11 +189,11 @@ static void secp256k1_hmac_sha256_initialize(secp256k1_hmac_sha256_t *hash, cons
     memset(rkey, 0, 64);
 }
 
-static void secp256k1_hmac_sha256_write(secp256k1_hmac_sha256_t *hash, const unsigned char *data, size_t size) {
+void secp256k1_hmac_sha256_write(secp256k1_hmac_sha256_t *hash, const unsigned char *data, size_t size) {
     secp256k1_sha256_write(&hash->inner, data, size);
 }
 
-static void secp256k1_hmac_sha256_finalize(secp256k1_hmac_sha256_t *hash, unsigned char *out32) {
+void secp256k1_hmac_sha256_finalize(secp256k1_hmac_sha256_t *hash, unsigned char *out32) {
     unsigned char temp[32];
     secp256k1_sha256_finalize(&hash->inner, temp);
     secp256k1_sha256_write(&hash->outer, temp, 32);
@@ -202,7 +202,7 @@ static void secp256k1_hmac_sha256_finalize(secp256k1_hmac_sha256_t *hash, unsign
 }
 
 
-static void secp256k1_rfc6979_hmac_sha256_initialize(secp256k1_rfc6979_hmac_sha256_t *rng, const unsigned char *key, size_t keylen) {
+void secp256k1_rfc6979_hmac_sha256_initialize(secp256k1_rfc6979_hmac_sha256_t *rng, const unsigned char *key, size_t keylen) {
     secp256k1_hmac_sha256_t hmac;
     static const unsigned char zero[1] = {0x00};
     static const unsigned char one[1] = {0x01};
@@ -232,7 +232,7 @@ static void secp256k1_rfc6979_hmac_sha256_initialize(secp256k1_rfc6979_hmac_sha2
     rng->retry = 0;
 }
 
-static void secp256k1_rfc6979_hmac_sha256_generate(secp256k1_rfc6979_hmac_sha256_t *rng, unsigned char *out, size_t outlen) {
+void secp256k1_rfc6979_hmac_sha256_generate(secp256k1_rfc6979_hmac_sha256_t *rng, unsigned char *out, size_t outlen) {
     /* RFC6979 3.2.h. */
     static const unsigned char zero[1] = {0x00};
     if (rng->retry) {
@@ -263,7 +263,7 @@ static void secp256k1_rfc6979_hmac_sha256_generate(secp256k1_rfc6979_hmac_sha256
     rng->retry = 1;
 }
 
-static void secp256k1_rfc6979_hmac_sha256_finalize(secp256k1_rfc6979_hmac_sha256_t *rng) {
+void secp256k1_rfc6979_hmac_sha256_finalize(secp256k1_rfc6979_hmac_sha256_t *rng) {
     memset(rng->k, 0, 32);
     memset(rng->v, 0, 32);
     rng->retry = 0;
diff --git a/src/secp256k1/src/testrand_impl.h b/src/secp256k1/src/testrand_impl.h
index 125557420..b94c49161 100644
--- a/src/secp256k1/src/testrand_impl.h
+++ b/src/secp256k1/src/testrand_impl.h
@@ -11,7 +11,7 @@
 #include <string.h>
 
 #include "testrand.h"
-#include "hash.h"
+#include "include/secp256k1_sha256.h"
 
 static secp256k1_rfc6979_hmac_sha256_t secp256k1_test_rng;
 static uint32_t secp256k1_test_rng_precomputed[8];

From 978a43ddc4b72437880aac6ac07aad91ec3cd494 Mon Sep 17 00:00:00 2001
From: Time Markov <time.markov@qtum.com>
Date: Fri, 28 Dec 2018 09:26:54 +0100
Subject: [PATCH 007/153] Update qtum state log

---
 src/qtum/qtumstate.cpp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/qtum/qtumstate.cpp b/src/qtum/qtumstate.cpp
index 477e19b58..0fbbe2b92 100644
--- a/src/qtum/qtumstate.cpp
+++ b/src/qtum/qtumstate.cpp
@@ -272,7 +272,7 @@ void QtumState::updateUTXO(const std::unordered_map<dev::Address, Vin>& vins){
 void QtumState::printfErrorLog(const dev::eth::TransactionException er){
     std::stringstream ss;
     ss << er;
-    clog(ExecutiveWarnChannel) << "VM exception:" << ss.str();
+    clog(dev::VerbosityWarning, "exec") << "VM exception:" << ss.str();
 }
 
 ///////////////////////////////////////////////////////////////////////////////////////////

From 79977b2b4475793c6dd22b34d309e8d3020ae5ae Mon Sep 17 00:00:00 2001
From: Time Markov <time.markov@qtum.com>
Date: Tue, 8 Jan 2019 13:05:13 +0100
Subject: [PATCH 008/153] Update make file for evm

---
 src/Makefile.am | 128 ++++++++++++++++++++++++++++++------------------
 1 file changed, 79 insertions(+), 49 deletions(-)

diff --git a/src/Makefile.am b/src/Makefile.am
index 4036a6f08..6601b0e13 100644
--- a/src/Makefile.am
+++ b/src/Makefile.am
@@ -26,6 +26,9 @@ BITCOIN_INCLUDES += -I$(builddir) $(BDB_CPPFLAGS) $(BOOST_CPPFLAGS) $(LEVELDB_CP
 BITCOIN_INCLUDES += $(UNIVALUE_CFLAGS)
 
 BITCOIN_INCLUDES += -I$(srcdir)/cpp-ethereum
+BITCOIN_INCLUDES += -I$(srcdir)/cpp-ethereum/evmc/include
+BITCOIN_INCLUDES += -I$(srcdir)/cpp-ethereum/ethash/include
+BITCOIN_INCLUDES += -I$(srcdir)/cpp-ethereum/utils/libscrypt
 
 LIBBITCOIN_SERVER=libbitcoin_server.a
 LIBBITCOIN_COMMON=libbitcoin_common.a
@@ -427,6 +430,12 @@ libbitcoin_common_a_SOURCES = \
   script/sign.cpp \
   script/standard.cpp \
   warnings.cpp \
+  cpp-ethereum/aleth/buildinfo.c \
+  cpp-ethereum/aleth/buildinfo.h \
+  cpp-ethereum/evmc/lib/instructions/instruction_metrics.c \
+  cpp-ethereum/evmc/lib/instructions/instruction_names.c \
+  cpp-ethereum/libdevcore/Address.cpp \
+  cpp-ethereum/libdevcore/Address.h \
   cpp-ethereum/libdevcore/Base64.cpp \
   cpp-ethereum/libdevcore/Base64.h \
   cpp-ethereum/libdevcore/Common.cpp \
@@ -443,14 +452,18 @@ libbitcoin_common_a_SOURCES = \
   cpp-ethereum/libdevcore/FixedHash.h \
   cpp-ethereum/libdevcore/Guards.cpp \
   cpp-ethereum/libdevcore/Guards.h \
-  cpp-ethereum/libdevcore/Hash.cpp \
-  cpp-ethereum/libdevcore/Hash.h \
+  cpp-ethereum/libdevcrypto/Hash.cpp \
+  cpp-ethereum/libdevcrypto/Hash.h \
   cpp-ethereum/libdevcore/Log.cpp \
   cpp-ethereum/libdevcore/Log.h \
+  cpp-ethereum/libdevcore/LevelDB.cpp \
+  cpp-ethereum/libdevcore/LevelDB.h \
   cpp-ethereum/libdevcore/MemoryDB.cpp \
   cpp-ethereum/libdevcore/MemoryDB.h \
   cpp-ethereum/libdevcore/OverlayDB.cpp \
   cpp-ethereum/libdevcore/OverlayDB.h \
+  cpp-ethereum/libdevcore/StateCacheDB.cpp \
+  cpp-ethereum/libdevcore/StateCacheDB.h \
   cpp-ethereum/libdevcore/RLP.cpp \
   cpp-ethereum/libdevcore/RLP.h \
   cpp-ethereum/libdevcore/SHA3.cpp \
@@ -461,35 +474,46 @@ libbitcoin_common_a_SOURCES = \
   cpp-ethereum/libdevcore/TrieCommon.h \
   cpp-ethereum/libdevcore/Worker.cpp \
   cpp-ethereum/libdevcore/Worker.h \
+  cpp-ethereum/libdevcore/DBFactory.h \
+  cpp-ethereum/libdevcore/DBFactory.cpp \
+  cpp-ethereum/libdevcore/JsonUtils.h \
+  cpp-ethereum/libdevcore/JsonUtils.cpp \
+  cpp-ethereum/libevm/EVMC.cpp \
+  cpp-ethereum/libevm/EVMC.h \
   cpp-ethereum/libevm/ExtVMFace.cpp \
   cpp-ethereum/libevm/ExtVMFace.h \
-  cpp-ethereum/libevm/VM.cpp \
-  cpp-ethereum/libevm/VM.h \
-  cpp-ethereum/libevm/VMOpt.cpp \
-  cpp-ethereum/libevm/VMCalls.cpp \
+  cpp-ethereum/libaleth-interpreter/interpreter.h \
+  cpp-ethereum/libaleth-interpreter/VMConfig.h \
+  cpp-ethereum/libaleth-interpreter/VM.cpp \
+  cpp-ethereum/libaleth-interpreter/VM.h \
+  cpp-ethereum/libaleth-interpreter/VMOpt.cpp \
+  cpp-ethereum/libaleth-interpreter/VMCalls.cpp \
   cpp-ethereum/libevm/VMFactory.cpp \
   cpp-ethereum/libevm/VMFactory.h \
-  cpp-ethereum/libevmcore/Instruction.cpp \
-  cpp-ethereum/libevmcore/Instruction.h \
-  cpp-ethereum/libevmcore/Exceptions.h \
-  cpp-ethereum/libevmcore/EVMSchedule.h \
+  cpp-ethereum/libevm/Instruction.cpp \
+  cpp-ethereum/libevm/Instruction.h \
+  cpp-ethereum/libevm/LegacyVM.h \
+  cpp-ethereum/libevm/LegacyVM.cpp \
+  cpp-ethereum/libevm/LegacyVMCalls.cpp \
+  cpp-ethereum/libevm/LegacyVMConfig.h \
+  cpp-ethereum/libevm/LegacyVMOpt.cpp \
+  cpp-ethereum/libethcore/EVMSchedule.h \
+  cpp-ethereum/libethereum/ImportPerformanceLogger.cpp \
+  cpp-ethereum/libethereum/ImportPerformanceLogger.h \
   cpp-ethereum/libethereum/Account.cpp \
-  cpp-ethereum/libethereum/Defaults.cpp \
   cpp-ethereum/libethereum/GasPricer.cpp \
   cpp-ethereum/libethereum/State.cpp \
   cpp-ethereum/libethcore/ABI.cpp \
   cpp-ethereum/libethcore/ChainOperationParams.cpp \
   cpp-ethereum/libethcore/Common.cpp \
-  cpp-ethereum/libethcore/ICAP.cpp \
   cpp-ethereum/libethcore/Precompiled.cpp \
-  cpp-ethereum/libdevcore/TrieDB.cpp \
+  cpp-ethereum/libethcore/TransactionBase.cpp \
   cpp-ethereum/libdevcrypto/Common.cpp \
   cpp-ethereum/libdevcrypto/CryptoPP.cpp \
   cpp-ethereum/libdevcrypto/AES.cpp \
-  cpp-ethereum/libdevcrypto/ECDHE.cpp \
+  cpp-ethereum/libdevcrypto/LibSnark.cpp \
   cpp-ethereum/libethashseal/GenesisInfo.cpp \
   cpp-ethereum/libethereum/ChainParams.cpp \
-  cpp-ethereum/libethcore/Transaction.cpp \
   cpp-ethereum/libethereum/Transaction.cpp \
   cpp-ethereum/libethereum/Executive.cpp \
   cpp-ethereum/libethereum/ExtVM.cpp \
@@ -506,8 +530,9 @@ libbitcoin_common_a_SOURCES = \
   cpp-ethereum/libethereum/GenesisInfo.cpp \
   cpp-ethereum/libethashseal/Ethash.cpp \
   cpp-ethereum/libethashseal/EthashCPUMiner.cpp \
-  cpp-ethereum/libethashseal/EthashAux.cpp \
   cpp-ethereum/libethashseal/EthashProofOfWork.cpp \
+  cpp-ethereum/libethereum/ValidationSchemes.h \
+  cpp-ethereum/libethereum/ValidationSchemes.cpp \
   cpp-ethereum/libethereum/Account.h \
   cpp-ethereum/libethereum/Defaults.h \
   cpp-ethereum/libethereum/GasPricer.h \
@@ -517,15 +542,18 @@ libbitcoin_common_a_SOURCES = \
   cpp-ethereum/libethcore/Common.h \
   cpp-ethereum/libethcore/ICAP.h \
   cpp-ethereum/libethcore/Precompiled.h \
+  cpp-ethereum/libethcore/LogEntry.h \
+  cpp-ethereum/libethcore/LogEntry.cpp \
   cpp-ethereum/libdevcore/TrieDB.h \
   cpp-ethereum/libdevcrypto/Common.h \
   cpp-ethereum/libdevcrypto/CryptoPP.h \
   cpp-ethereum/libdevcrypto/AES.h \
   cpp-ethereum/libdevcrypto/ECDHE.h \
+  cpp-ethereum/libdevcrypto/LibSnark.h \
   cpp-ethereum/libethashseal/GenesisInfo.h \
   cpp-ethereum/libethereum/ChainParams.h \
-  cpp-ethereum/libethcore/Transaction.h \
   cpp-ethereum/libethcore/Exceptions.h \
+  cpp-ethereum/libethcore/TransactionBase.h \
   cpp-ethereum/libethereum/Transaction.h \
   cpp-ethereum/libethereum/Executive.h \
   cpp-ethereum/libethereum/ExtVM.h \
@@ -544,12 +572,6 @@ libbitcoin_common_a_SOURCES = \
   cpp-ethereum/libethashseal/EthashCPUMiner.h \
   cpp-ethereum/libethashseal/EthashAux.h \
   cpp-ethereum/libethashseal/EthashProofOfWork.h \
-  cpp-ethereum/libethash/internal.c \
-  cpp-ethereum/libethash/io.c \
-  cpp-ethereum/libethash/sha3.c \
-  cpp-ethereum/libethash/internal.h \
-  cpp-ethereum/libethash/io.h \
-  cpp-ethereum/libethash/sha3.h \
   cpp-ethereum/libdevcore/vector_ref.h \
   cpp-ethereum/libdevcore/Exceptions.h \
   cpp-ethereum/libdevcore/db.h \
@@ -569,26 +591,28 @@ libbitcoin_common_a_SOURCES = \
   cpp-ethereum/libethereum/LogFilter.h \
   cpp-ethereum/libdevcrypto/Exceptions.h \
   cpp-ethereum/libethashseal/genesis/mainNetwork.cpp \
-  cpp-ethereum/libethashseal/genesis/eip150Test.cpp \
-  cpp-ethereum/libethashseal/genesis/eip158Test.cpp \
-  cpp-ethereum/libethashseal/genesis/frontierTest.cpp \
-  cpp-ethereum/libethashseal/genesis/homesteadTest.cpp \
-  cpp-ethereum/libethashseal/genesis/mainNetworkTest.cpp \
-  cpp-ethereum/libethashseal/genesis/metropolisTest.cpp \
   cpp-ethereum/libethashseal/genesis/qtumMainNetwork.cpp \
-  cpp-ethereum/libethashseal/genesis/qtumTestNetwork.cpp \
   cpp-ethereum/libethashseal/genesis/ropsten.cpp \
-  cpp-ethereum/libethashseal/genesis/transitionnetTest.cpp \
-  cpp-ethereum/libethash/ethash.h \
-  cpp-ethereum/libethash/compiler.h \
-  cpp-ethereum/libethash/data_sizes.h \
-  cpp-ethereum/libethash/fnv.h \
-  cpp-ethereum/libethash/mmap.h \
-  cpp-ethereum/libethash/endian.h \
-  cpp-ethereum/libethash/io.h \
-  cpp-ethereum/libethash/ethash.h \
-  cpp-ethereum/libethash/internal.h \
-  cpp-ethereum/libethash/mmap_win32.c \
+  cpp-ethereum/libethashseal/genesis/test/qtumTestNetwork.cpp \
+  cpp-ethereum/libethashseal/genesis/test/transitionnetTest.cpp \
+  cpp-ethereum/libethashseal/genesis/test/mainNetworkTest.cpp \
+  cpp-ethereum/libethashseal/genesis/test/mainNetworkNoProofTest.cpp \
+  cpp-ethereum/libethashseal/genesis/test/homesteadToEIP150At5Test.cpp \
+  cpp-ethereum/libethashseal/genesis/test/homesteadToDaoAt5Test.cpp \
+  cpp-ethereum/libethashseal/genesis/test/homesteadTest.cpp \
+  cpp-ethereum/libethashseal/genesis/test/frontierToHomesteadAt5Test.cpp \
+  cpp-ethereum/libethashseal/genesis/test/frontierTest.cpp \
+  cpp-ethereum/libethashseal/genesis/test/frontierNoProofTest.cpp \
+  cpp-ethereum/libethashseal/genesis/test/experimentalTransitionTest.cpp \
+  cpp-ethereum/libethashseal/genesis/test/EIP158ToByzantiumAt5Test.cpp \
+  cpp-ethereum/libethashseal/genesis/test/eip158Test.cpp \
+  cpp-ethereum/libethashseal/genesis/test/eip150Test.cpp \
+  cpp-ethereum/libethashseal/genesis/test/constantinopleTest.cpp \
+  cpp-ethereum/libethashseal/genesis/test/constantinopleNoProofTest.cpp \
+  cpp-ethereum/libethashseal/genesis/test/byzantiumTransitionTest.cpp \
+  cpp-ethereum/libethashseal/genesis/test/ByzantiumToConstantinopleAt5Test.cpp \
+  cpp-ethereum/libethashseal/genesis/test/byzantiumTest.cpp \
+  cpp-ethereum/libethashseal/genesis/test/byzantiumNoProofTest.cpp \
   cpp-ethereum/utils/json_spirit/JsonSpiritHeaders.h \
   cpp-ethereum/utils/json_spirit/json_spirit.h \
   cpp-ethereum/utils/json_spirit/json_spirit_error_position.h \
@@ -599,18 +623,24 @@ libbitcoin_common_a_SOURCES = \
   cpp-ethereum/utils/json_spirit/json_spirit_value.h \
   cpp-ethereum/utils/json_spirit/json_spirit_writer.h \
   cpp-ethereum/utils/json_spirit/json_spirit_writer_template.h \
+  cpp-ethereum/ethash/lib/ethash/support/attributes.h \ 
+  cpp-ethereum/ethash/lib/ethash/bit_manipulation.h \
+  cpp-ethereum/ethash/lib/ethash/builtins.h \
+  cpp-ethereum/ethash/lib/ethash/endianness.hpp \
+  cpp-ethereum/ethash/lib/ethash/ethash.cpp \
+  cpp-ethereum/ethash/lib/ethash/ethash-internal.hpp \
+  cpp-ethereum/ethash/lib/ethash/keccak.c \
+  cpp-ethereum/ethash/lib/ethash/keccakf800.c \
+  cpp-ethereum/ethash/lib/ethash/keccakf1600.c \
+  cpp-ethereum/ethash/lib/ethash/kiss99.hpp \
+  cpp-ethereum/ethash/lib/ethash/managed.cpp \
+  cpp-ethereum/ethash/lib/ethash/primes.c \
+  cpp-ethereum/ethash/lib/ethash/primes.h \
+  cpp-ethereum/ethash/lib/ethash/progpow.cpp \
   $(BITCOIN_CORE_H)
 
 #only added json_spirit so that `make dist` works properly
 
-if TARGET_WINDOWS
-  libbitcoin_common_a_SOURCES += \
-    cpp-ethereum/libethash/io_win32.c \
-    cpp-ethereum/libethash/util_win32.c
-else
-  libbitcoin_common_a_SOURCES += cpp-ethereum/libethash/io_posix.c
-endif
-
 # util: shared between all executables.
 # This library *must* be included to make sure that the glibc
 # backward-compatibility objects and their sanity checks are linked.

From f896e8f01c9a3f37e03abc40947534aa44ed4b49 Mon Sep 17 00:00:00 2001
From: Time Markov <time.markov@qtum.com>
Date: Thu, 10 Jan 2019 11:52:56 +0100
Subject: [PATCH 009/153] Add libff

---
 configure.ac                                  |   7 +
 src/Makefile.am                               |  10 +-
 src/Makefile.bench.include                    |   2 +-
 src/Makefile.libff.include                    | 122 +++
 src/Makefile.qt.include                       |   2 +-
 src/Makefile.qttest.include                   |   2 +-
 src/Makefile.test.include                     |   2 +-
 src/libff/AUTHORS                             |  10 +
 src/libff/CMakeLists.txt                      | 232 +++++
 src/libff/LICENSE                             |  24 +
 src/libff/README.md                           | 113 +++
 src/libff/depends/CMakeLists.txt              |  11 +
 src/libff/libff/CMakeLists.txt                | 149 ++++
 .../algebra/curves/alt_bn128/alt_bn128_g1.cpp | 523 ++++++++++++
 .../algebra/curves/alt_bn128/alt_bn128_g1.hpp |  93 ++
 .../algebra/curves/alt_bn128/alt_bn128_g2.cpp | 504 +++++++++++
 .../algebra/curves/alt_bn128/alt_bn128_g2.hpp |  95 +++
 .../curves/alt_bn128/alt_bn128_init.cpp       | 275 ++++++
 .../curves/alt_bn128/alt_bn128_init.hpp       |  57 ++
 .../curves/alt_bn128/alt_bn128_pairing.cpp    | 547 ++++++++++++
 .../curves/alt_bn128/alt_bn128_pairing.hpp    |  93 ++
 .../algebra/curves/alt_bn128/alt_bn128_pp.cpp |  58 ++
 .../algebra/curves/alt_bn128/alt_bn128_pp.hpp |  50 ++
 .../libff/algebra/curves/bn128/bn128_g1.cpp   | 519 +++++++++++
 .../libff/algebra/curves/bn128/bn128_g1.hpp   |  94 ++
 .../libff/algebra/curves/bn128/bn128_g2.cpp   | 502 +++++++++++
 .../libff/algebra/curves/bn128/bn128_g2.hpp   |  91 ++
 .../libff/algebra/curves/bn128/bn128_gt.cpp   |  70 ++
 .../libff/algebra/curves/bn128/bn128_gt.hpp   |  57 ++
 .../libff/algebra/curves/bn128/bn128_init.cpp | 226 +++++
 .../libff/algebra/curves/bn128/bn128_init.hpp |  47 +
 .../algebra/curves/bn128/bn128_pairing.cpp    | 212 +++++
 .../algebra/curves/bn128/bn128_pairing.hpp    |  53 ++
 .../libff/algebra/curves/bn128/bn128_pp.cpp   |  75 ++
 .../libff/algebra/curves/bn128/bn128_pp.hpp   |  51 ++
 .../libff/algebra/curves/bn128/bn_utils.hpp   |  23 +
 .../libff/algebra/curves/bn128/bn_utils.tcc   |  40 +
 .../libff/algebra/curves/curve_utils.hpp      |  22 +
 .../libff/algebra/curves/curve_utils.tcc      |  37 +
 .../algebra/curves/edwards/edwards_g1.cpp     | 412 +++++++++
 .../algebra/curves/edwards/edwards_g1.hpp     |  95 +++
 .../algebra/curves/edwards/edwards_g2.cpp     | 413 +++++++++
 .../algebra/curves/edwards/edwards_g2.hpp     |  98 +++
 .../algebra/curves/edwards/edwards_init.cpp   | 270 ++++++
 .../algebra/curves/edwards/edwards_init.hpp   |  61 ++
 .../curves/edwards/edwards_pairing.cpp        | 776 +++++++++++++++++
 .../curves/edwards/edwards_pairing.hpp        | 123 +++
 .../algebra/curves/edwards/edwards_pp.cpp     |  58 ++
 .../algebra/curves/edwards/edwards_pp.hpp     |  50 ++
 .../libff/algebra/curves/mnt/mnt4/mnt4_g1.cpp | 504 +++++++++++
 .../libff/algebra/curves/mnt/mnt4/mnt4_g1.hpp | 106 +++
 .../libff/algebra/curves/mnt/mnt4/mnt4_g2.cpp | 495 +++++++++++
 .../libff/algebra/curves/mnt/mnt4/mnt4_g2.hpp | 108 +++
 .../algebra/curves/mnt/mnt4/mnt4_init.cpp     | 265 ++++++
 .../algebra/curves/mnt/mnt4/mnt4_init.hpp     |  67 ++
 .../algebra/curves/mnt/mnt4/mnt4_pairing.cpp  | 741 ++++++++++++++++
 .../algebra/curves/mnt/mnt4/mnt4_pairing.hpp  | 148 ++++
 .../libff/algebra/curves/mnt/mnt4/mnt4_pp.cpp | 105 +++
 .../libff/algebra/curves/mnt/mnt4/mnt4_pp.hpp |  80 ++
 .../libff/algebra/curves/mnt/mnt46_common.cpp |  21 +
 .../libff/algebra/curves/mnt/mnt46_common.hpp |  30 +
 .../libff/algebra/curves/mnt/mnt6/mnt6_g1.cpp | 503 +++++++++++
 .../libff/algebra/curves/mnt/mnt6/mnt6_g1.hpp | 106 +++
 .../libff/algebra/curves/mnt/mnt6/mnt6_g2.cpp | 502 +++++++++++
 .../libff/algebra/curves/mnt/mnt6/mnt6_g2.hpp | 108 +++
 .../algebra/curves/mnt/mnt6/mnt6_init.cpp     | 277 ++++++
 .../algebra/curves/mnt/mnt6/mnt6_init.hpp     |  69 ++
 .../algebra/curves/mnt/mnt6/mnt6_pairing.cpp  | 753 ++++++++++++++++
 .../algebra/curves/mnt/mnt6/mnt6_pairing.hpp  | 148 ++++
 .../libff/algebra/curves/mnt/mnt6/mnt6_pp.cpp | 106 +++
 .../libff/algebra/curves/mnt/mnt6/mnt6_pp.hpp |  75 ++
 .../libff/algebra/curves/public_params.hpp    | 103 +++
 .../algebra/curves/tests/test_bilinearity.cpp | 136 +++
 .../algebra/curves/tests/test_groups.cpp      | 176 ++++
 .../algebra/exponentiation/exponentiation.hpp |  31 +
 .../algebra/exponentiation/exponentiation.tcc |  53 ++
 src/libff/libff/algebra/fields/bigint.hpp     |  63 ++
 src/libff/libff/algebra/fields/bigint.tcc     | 226 +++++
 .../libff/algebra/fields/field_utils.hpp      |  57 ++
 .../libff/algebra/fields/field_utils.tcc      | 197 +++++
 src/libff/libff/algebra/fields/fp.hpp         | 184 ++++
 src/libff/libff/algebra/fields/fp.tcc         | 805 ++++++++++++++++++
 .../libff/algebra/fields/fp12_2over3over2.hpp | 117 +++
 .../libff/algebra/fields/fp12_2over3over2.tcc | 412 +++++++++
 src/libff/libff/algebra/fields/fp2.hpp        | 121 +++
 src/libff/libff/algebra/fields/fp2.tcc        | 257 ++++++
 src/libff/libff/algebra/fields/fp3.hpp        | 123 +++
 src/libff/libff/algebra/fields/fp3.tcc        | 259 ++++++
 src/libff/libff/algebra/fields/fp4.hpp        | 104 +++
 src/libff/libff/algebra/fields/fp4.tcc        | 245 ++++++
 src/libff/libff/algebra/fields/fp6_2over3.hpp | 108 +++
 src/libff/libff/algebra/fields/fp6_2over3.tcc | 274 ++++++
 src/libff/libff/algebra/fields/fp6_3over2.hpp | 105 +++
 src/libff/libff/algebra/fields/fp6_3over2.tcc | 216 +++++
 src/libff/libff/algebra/fields/fp_aux.tcc     | 389 +++++++++
 .../algebra/fields/tests/test_fields.cpp      | 245 ++++++
 .../scalar_multiplication/multiexp.hpp        | 133 +++
 .../scalar_multiplication/multiexp.tcc        | 719 ++++++++++++++++
 .../multiexp_profile.cpp                      | 128 +++
 .../algebra/scalar_multiplication/wnaf.hpp    |  43 +
 .../algebra/scalar_multiplication/wnaf.tcc    | 125 +++
 .../libff/common/default_types/ec_pp.hpp      |  62 ++
 src/libff/libff/common/double.cpp             | 195 +++++
 src/libff/libff/common/double.hpp             |  74 ++
 src/libff/libff/common/profiling.cpp          | 384 +++++++++
 src/libff/libff/common/profiling.hpp          |  51 ++
 src/libff/libff/common/rng.hpp                |  26 +
 src/libff/libff/common/rng.tcc                |  76 ++
 src/libff/libff/common/serialization.hpp      | 106 +++
 src/libff/libff/common/serialization.tcc      | 205 +++++
 src/libff/libff/common/template_utils.hpp     |  26 +
 src/libff/libff/common/utils.cpp              | 129 +++
 src/libff/libff/common/utils.hpp              |  62 ++
 src/libff/libff/common/utils.tcc              |  23 +
 114 files changed, 20340 insertions(+), 6 deletions(-)
 create mode 100644 src/Makefile.libff.include
 create mode 100755 src/libff/AUTHORS
 create mode 100755 src/libff/CMakeLists.txt
 create mode 100755 src/libff/LICENSE
 create mode 100755 src/libff/README.md
 create mode 100755 src/libff/depends/CMakeLists.txt
 create mode 100755 src/libff/libff/CMakeLists.txt
 create mode 100755 src/libff/libff/algebra/curves/alt_bn128/alt_bn128_g1.cpp
 create mode 100755 src/libff/libff/algebra/curves/alt_bn128/alt_bn128_g1.hpp
 create mode 100755 src/libff/libff/algebra/curves/alt_bn128/alt_bn128_g2.cpp
 create mode 100755 src/libff/libff/algebra/curves/alt_bn128/alt_bn128_g2.hpp
 create mode 100755 src/libff/libff/algebra/curves/alt_bn128/alt_bn128_init.cpp
 create mode 100755 src/libff/libff/algebra/curves/alt_bn128/alt_bn128_init.hpp
 create mode 100755 src/libff/libff/algebra/curves/alt_bn128/alt_bn128_pairing.cpp
 create mode 100755 src/libff/libff/algebra/curves/alt_bn128/alt_bn128_pairing.hpp
 create mode 100755 src/libff/libff/algebra/curves/alt_bn128/alt_bn128_pp.cpp
 create mode 100755 src/libff/libff/algebra/curves/alt_bn128/alt_bn128_pp.hpp
 create mode 100755 src/libff/libff/algebra/curves/bn128/bn128_g1.cpp
 create mode 100755 src/libff/libff/algebra/curves/bn128/bn128_g1.hpp
 create mode 100755 src/libff/libff/algebra/curves/bn128/bn128_g2.cpp
 create mode 100755 src/libff/libff/algebra/curves/bn128/bn128_g2.hpp
 create mode 100755 src/libff/libff/algebra/curves/bn128/bn128_gt.cpp
 create mode 100755 src/libff/libff/algebra/curves/bn128/bn128_gt.hpp
 create mode 100755 src/libff/libff/algebra/curves/bn128/bn128_init.cpp
 create mode 100755 src/libff/libff/algebra/curves/bn128/bn128_init.hpp
 create mode 100755 src/libff/libff/algebra/curves/bn128/bn128_pairing.cpp
 create mode 100755 src/libff/libff/algebra/curves/bn128/bn128_pairing.hpp
 create mode 100755 src/libff/libff/algebra/curves/bn128/bn128_pp.cpp
 create mode 100755 src/libff/libff/algebra/curves/bn128/bn128_pp.hpp
 create mode 100755 src/libff/libff/algebra/curves/bn128/bn_utils.hpp
 create mode 100755 src/libff/libff/algebra/curves/bn128/bn_utils.tcc
 create mode 100755 src/libff/libff/algebra/curves/curve_utils.hpp
 create mode 100755 src/libff/libff/algebra/curves/curve_utils.tcc
 create mode 100755 src/libff/libff/algebra/curves/edwards/edwards_g1.cpp
 create mode 100755 src/libff/libff/algebra/curves/edwards/edwards_g1.hpp
 create mode 100755 src/libff/libff/algebra/curves/edwards/edwards_g2.cpp
 create mode 100755 src/libff/libff/algebra/curves/edwards/edwards_g2.hpp
 create mode 100755 src/libff/libff/algebra/curves/edwards/edwards_init.cpp
 create mode 100755 src/libff/libff/algebra/curves/edwards/edwards_init.hpp
 create mode 100755 src/libff/libff/algebra/curves/edwards/edwards_pairing.cpp
 create mode 100755 src/libff/libff/algebra/curves/edwards/edwards_pairing.hpp
 create mode 100755 src/libff/libff/algebra/curves/edwards/edwards_pp.cpp
 create mode 100755 src/libff/libff/algebra/curves/edwards/edwards_pp.hpp
 create mode 100755 src/libff/libff/algebra/curves/mnt/mnt4/mnt4_g1.cpp
 create mode 100755 src/libff/libff/algebra/curves/mnt/mnt4/mnt4_g1.hpp
 create mode 100755 src/libff/libff/algebra/curves/mnt/mnt4/mnt4_g2.cpp
 create mode 100755 src/libff/libff/algebra/curves/mnt/mnt4/mnt4_g2.hpp
 create mode 100755 src/libff/libff/algebra/curves/mnt/mnt4/mnt4_init.cpp
 create mode 100755 src/libff/libff/algebra/curves/mnt/mnt4/mnt4_init.hpp
 create mode 100755 src/libff/libff/algebra/curves/mnt/mnt4/mnt4_pairing.cpp
 create mode 100755 src/libff/libff/algebra/curves/mnt/mnt4/mnt4_pairing.hpp
 create mode 100755 src/libff/libff/algebra/curves/mnt/mnt4/mnt4_pp.cpp
 create mode 100755 src/libff/libff/algebra/curves/mnt/mnt4/mnt4_pp.hpp
 create mode 100755 src/libff/libff/algebra/curves/mnt/mnt46_common.cpp
 create mode 100755 src/libff/libff/algebra/curves/mnt/mnt46_common.hpp
 create mode 100755 src/libff/libff/algebra/curves/mnt/mnt6/mnt6_g1.cpp
 create mode 100755 src/libff/libff/algebra/curves/mnt/mnt6/mnt6_g1.hpp
 create mode 100755 src/libff/libff/algebra/curves/mnt/mnt6/mnt6_g2.cpp
 create mode 100755 src/libff/libff/algebra/curves/mnt/mnt6/mnt6_g2.hpp
 create mode 100755 src/libff/libff/algebra/curves/mnt/mnt6/mnt6_init.cpp
 create mode 100755 src/libff/libff/algebra/curves/mnt/mnt6/mnt6_init.hpp
 create mode 100755 src/libff/libff/algebra/curves/mnt/mnt6/mnt6_pairing.cpp
 create mode 100755 src/libff/libff/algebra/curves/mnt/mnt6/mnt6_pairing.hpp
 create mode 100755 src/libff/libff/algebra/curves/mnt/mnt6/mnt6_pp.cpp
 create mode 100755 src/libff/libff/algebra/curves/mnt/mnt6/mnt6_pp.hpp
 create mode 100755 src/libff/libff/algebra/curves/public_params.hpp
 create mode 100755 src/libff/libff/algebra/curves/tests/test_bilinearity.cpp
 create mode 100755 src/libff/libff/algebra/curves/tests/test_groups.cpp
 create mode 100755 src/libff/libff/algebra/exponentiation/exponentiation.hpp
 create mode 100755 src/libff/libff/algebra/exponentiation/exponentiation.tcc
 create mode 100755 src/libff/libff/algebra/fields/bigint.hpp
 create mode 100755 src/libff/libff/algebra/fields/bigint.tcc
 create mode 100755 src/libff/libff/algebra/fields/field_utils.hpp
 create mode 100755 src/libff/libff/algebra/fields/field_utils.tcc
 create mode 100755 src/libff/libff/algebra/fields/fp.hpp
 create mode 100755 src/libff/libff/algebra/fields/fp.tcc
 create mode 100755 src/libff/libff/algebra/fields/fp12_2over3over2.hpp
 create mode 100755 src/libff/libff/algebra/fields/fp12_2over3over2.tcc
 create mode 100755 src/libff/libff/algebra/fields/fp2.hpp
 create mode 100755 src/libff/libff/algebra/fields/fp2.tcc
 create mode 100755 src/libff/libff/algebra/fields/fp3.hpp
 create mode 100755 src/libff/libff/algebra/fields/fp3.tcc
 create mode 100755 src/libff/libff/algebra/fields/fp4.hpp
 create mode 100755 src/libff/libff/algebra/fields/fp4.tcc
 create mode 100755 src/libff/libff/algebra/fields/fp6_2over3.hpp
 create mode 100755 src/libff/libff/algebra/fields/fp6_2over3.tcc
 create mode 100755 src/libff/libff/algebra/fields/fp6_3over2.hpp
 create mode 100755 src/libff/libff/algebra/fields/fp6_3over2.tcc
 create mode 100755 src/libff/libff/algebra/fields/fp_aux.tcc
 create mode 100755 src/libff/libff/algebra/fields/tests/test_fields.cpp
 create mode 100755 src/libff/libff/algebra/scalar_multiplication/multiexp.hpp
 create mode 100755 src/libff/libff/algebra/scalar_multiplication/multiexp.tcc
 create mode 100644 src/libff/libff/algebra/scalar_multiplication/multiexp_profile.cpp
 create mode 100755 src/libff/libff/algebra/scalar_multiplication/wnaf.hpp
 create mode 100755 src/libff/libff/algebra/scalar_multiplication/wnaf.tcc
 create mode 100755 src/libff/libff/common/default_types/ec_pp.hpp
 create mode 100755 src/libff/libff/common/double.cpp
 create mode 100755 src/libff/libff/common/double.hpp
 create mode 100755 src/libff/libff/common/profiling.cpp
 create mode 100755 src/libff/libff/common/profiling.hpp
 create mode 100755 src/libff/libff/common/rng.hpp
 create mode 100755 src/libff/libff/common/rng.tcc
 create mode 100755 src/libff/libff/common/serialization.hpp
 create mode 100755 src/libff/libff/common/serialization.tcc
 create mode 100755 src/libff/libff/common/template_utils.hpp
 create mode 100755 src/libff/libff/common/utils.cpp
 create mode 100755 src/libff/libff/common/utils.hpp
 create mode 100755 src/libff/libff/common/utils.tcc

diff --git a/configure.ac b/configure.ac
index adb449e48..ae580a2e2 100644
--- a/configure.ac
+++ b/configure.ac
@@ -582,6 +582,7 @@ case $host in
 esac
 
 CRYPTOPP_TARGET_FLAGS=""
+LIBFF_TARGET_FLAGS=""
 
 if test x$use_pkgconfig = xyes; then
   m4_ifndef([PKG_PROG_PKG_CONFIG], [AC_MSG_ERROR(PKG_PROG_PKG_CONFIG macro not found. Please install pkg-config and re-run autogen.sh.)])
@@ -870,6 +871,12 @@ AM_CONDITIONAL([EMBEDDED_CRYPTOPP],[true])
 AC_SUBST(CRYPTOPP_CPPFLAGS)
 AC_SUBST(LIBCRYPTOPP)
 
+LIBFF_CPPFLAGS=
+LIBFF=
+AM_CONDITIONAL([EMBEDDED_LIBFF],[true])
+AC_SUBST(LIBFF_CPPFLAGS)
+AC_SUBST(LIBFF)
+
 if test x$enable_wallet != xno; then
     dnl Check for libdb_cxx only if wallet enabled
     BITCOIN_FIND_BDB48
diff --git a/src/Makefile.am b/src/Makefile.am
index 6601b0e13..d46509411 100644
--- a/src/Makefile.am
+++ b/src/Makefile.am
@@ -20,6 +20,8 @@ LIBUNIVALUE = $(UNIVALUE_LIBS)
 endif
 
 BITCOIN_INCLUDES = -I$(srcdir)/secp256k1/include
+BITCOIN_INCLUDES += -I$(srcdir)/libff/libff
+BITCOIN_INCLUDES += -I$(srcdir)/libff
 
 BITCOIN_INCLUDES += -I$(builddir) $(BDB_CPPFLAGS) $(BOOST_CPPFLAGS) $(LEVELDB_CPPFLAGS) $(CRYPTO_CFLAGS) $(SSL_CFLAGS) -I$(srcdir)/cpp-ethereum/utils
 
@@ -39,6 +41,7 @@ LIBBITCOIN_CRYPTO_BASE=crypto/libbitcoin_crypto_base.a
 LIBBITCOINQT=qt/libbitcoinqt.a
 LIBSECP256K1=secp256k1/libsecp256k1.la
 LIBCRYPTOPP=cryptopp/libcryptopp.a
+LIBFF=libff/libff.a
 
 
 if ENABLE_ZMQ
@@ -706,9 +709,10 @@ qtumd_LDADD = \
   $(LIBLEVELDB_SSE42) \
   $(LIBMEMENV) \
   $(LIBCRYPTOPP) \
+  $(LIBFF) \
   $(LIBSECP256K1)
 
-qtumd_LDADD += $(BOOST_LIBS) $(BDB_LIBS) $(SSL_LIBS) $(CRYPTO_LIBS) $(MINIUPNPC_LIBS) $(EVENT_PTHREADS_LIBS) $(EVENT_LIBS) $(ZMQ_LIBS)
+qtumd_LDADD += $(BOOST_LIBS) $(BDB_LIBS) $(SSL_LIBS) $(CRYPTO_LIBS) $(MINIUPNPC_LIBS) $(EVENT_PTHREADS_LIBS) $(EVENT_LIBS) $(ZMQ_LIBS) -lgmp -lgmpxx
 
 # bitcoin-cli binary #
 qtum_cli_SOURCES = bitcoin-cli.cpp
@@ -812,7 +816,7 @@ clean-local:
 	-$(MAKE) -C secp256k1 clean
 	-$(MAKE) -C univalue clean
 	-rm -f leveldb/*/*.gcda leveldb/*/*.gcno leveldb/helpers/memenv/*.gcda leveldb/helpers/memenv/*.gcno
-	-rm -f cryptopp/*.o
+	-rm -f cryptopp/*.o libff/*.o
 	-rm -f config.h
 	-rm -rf test/__pycache__
 
@@ -843,6 +847,8 @@ endif
 
 include Makefile.cryptopp.include
 
+include Makefile.libff.include
+
 if ENABLE_TESTS
 include Makefile.test.include
 endif
diff --git a/src/Makefile.bench.include b/src/Makefile.bench.include
index 31b6f68ec..12345b6a0 100644
--- a/src/Makefile.bench.include
+++ b/src/Makefile.bench.include
@@ -66,7 +66,7 @@ if ENABLE_WALLET
 bench_bench_qtum_SOURCES += bench/coin_selection.cpp
 endif
 
-bench_bench_qtum_LDADD += $(BOOST_LIBS) $(BDB_LIBS) $(SSL_LIBS) $(CRYPTO_LIBS) $(MINIUPNPC_LIBS) $(EVENT_PTHREADS_LIBS) $(EVENT_LIBS)
+bench_bench_qtum_LDADD += $(BOOST_LIBS) $(BDB_LIBS) $(SSL_LIBS) $(CRYPTO_LIBS) $(MINIUPNPC_LIBS) $(EVENT_PTHREADS_LIBS) $(EVENT_LIBS) $(LIBFF) -lgmp -lgmpxx
 bench_bench_qtum_LDFLAGS = $(RELDFLAGS) $(AM_LDFLAGS) $(LIBTOOL_APP_LDFLAGS)
 
 CLEAN_BITCOIN_BENCH = bench/*.gcda bench/*.gcno $(GENERATED_BENCH_FILES)
diff --git a/src/Makefile.libff.include b/src/Makefile.libff.include
new file mode 100644
index 000000000..e13133204
--- /dev/null
+++ b/src/Makefile.libff.include
@@ -0,0 +1,122 @@
+# Copyright (c) 2016 The Bitcoin Core developers
+# Distributed under the MIT software license, see the accompanying
+# file COPYING or http://www.opensource.org/licenses/mit-license.php.
+
+LIBFF_INT = libff/libff.a
+
+EXTRA_LIBRARIES += $(LIBFF_INT)
+
+LIBFF += $(LIBFF_INT)
+
+LIBFF_CPPFLAGS += -I$(srcdir)/cryptopp/include
+
+LIBFF_CPPFLAGS_INT =
+LIBFF_CPPFLAGS_INT += -I$(srcdir)/libff
+LIBFF_CPPFLAGS_INT += $(LIBFF_TARGET_FLAGS)
+
+libff_libff_a_CPPFLAGS = $(AM_CPPFLAGS) $(LIBFF_CPPFLAGS_INT) $(LIBFF_CPPFLAGS) -DCURVE_ALT_BN128 -DNO_PROCPS
+libff_libff_a_CXXFLAGS = $(AM_CXXFLAGS) -DNDEBUG -fPIC -O2 -g2
+
+libff_libff_a_SOURCES=
+libff_libff_a_SOURCES += libff/libff/algebra/curves/alt_bn128/alt_bn128_g1.cpp
+libff_libff_a_SOURCES += libff/libff/algebra/curves/alt_bn128/alt_bn128_g1.hpp
+libff_libff_a_SOURCES += libff/libff/algebra/curves/alt_bn128/alt_bn128_g2.cpp
+libff_libff_a_SOURCES += libff/libff/algebra/curves/alt_bn128/alt_bn128_g2.hpp
+libff_libff_a_SOURCES += libff/libff/algebra/curves/alt_bn128/alt_bn128_init.cpp
+libff_libff_a_SOURCES += libff/libff/algebra/curves/alt_bn128/alt_bn128_init.hpp
+libff_libff_a_SOURCES += libff/libff/algebra/curves/alt_bn128/alt_bn128_pairing.cpp
+libff_libff_a_SOURCES += libff/libff/algebra/curves/alt_bn128/alt_bn128_pairing.hpp
+libff_libff_a_SOURCES += libff/libff/algebra/curves/alt_bn128/alt_bn128_pp.cpp
+libff_libff_a_SOURCES += libff/libff/algebra/curves/alt_bn128/alt_bn128_pp.hpp
+
+libff_libff_a_SOURCES += libff/libff/algebra/curves/edwards/edwards_g1.cpp
+libff_libff_a_SOURCES += libff/libff/algebra/curves/edwards/edwards_g1.hpp
+libff_libff_a_SOURCES += libff/libff/algebra/curves/edwards/edwards_g2.cpp
+libff_libff_a_SOURCES += libff/libff/algebra/curves/edwards/edwards_g2.hpp
+libff_libff_a_SOURCES += libff/libff/algebra/curves/edwards/edwards_init.cpp
+libff_libff_a_SOURCES += libff/libff/algebra/curves/edwards/edwards_init.hpp
+libff_libff_a_SOURCES += libff/libff/algebra/curves/edwards/edwards_pairing.cpp
+libff_libff_a_SOURCES += libff/libff/algebra/curves/edwards/edwards_pairing.hpp
+libff_libff_a_SOURCES += libff/libff/algebra/curves/edwards/edwards_pp.cpp
+libff_libff_a_SOURCES += libff/libff/algebra/curves/edwards/edwards_pp.hpp
+
+libff_libff_a_SOURCES += libff/libff/algebra/curves/mnt/mnt4/mnt4_g1.cpp
+libff_libff_a_SOURCES += libff/libff/algebra/curves/mnt/mnt4/mnt4_g1.hpp
+libff_libff_a_SOURCES += libff/libff/algebra/curves/mnt/mnt4/mnt4_g2.cpp
+libff_libff_a_SOURCES += libff/libff/algebra/curves/mnt/mnt4/mnt4_g2.hpp
+libff_libff_a_SOURCES += libff/libff/algebra/curves/mnt/mnt4/mnt4_init.cpp
+libff_libff_a_SOURCES += libff/libff/algebra/curves/mnt/mnt4/mnt4_init.hpp
+libff_libff_a_SOURCES += libff/libff/algebra/curves/mnt/mnt4/mnt4_pairing.cpp
+libff_libff_a_SOURCES += libff/libff/algebra/curves/mnt/mnt4/mnt4_pairing.hpp
+libff_libff_a_SOURCES += libff/libff/algebra/curves/mnt/mnt4/mnt4_pp.cpp
+libff_libff_a_SOURCES += libff/libff/algebra/curves/mnt/mnt4/mnt4_pp.hpp
+
+libff_libff_a_SOURCES += libff/libff/algebra/curves/mnt/mnt6/mnt6_g1.cpp
+libff_libff_a_SOURCES += libff/libff/algebra/curves/mnt/mnt6/mnt6_g1.hpp
+libff_libff_a_SOURCES += libff/libff/algebra/curves/mnt/mnt6/mnt6_g2.cpp
+libff_libff_a_SOURCES += libff/libff/algebra/curves/mnt/mnt6/mnt6_g2.hpp
+libff_libff_a_SOURCES += libff/libff/algebra/curves/mnt/mnt6/mnt6_init.cpp
+libff_libff_a_SOURCES += libff/libff/algebra/curves/mnt/mnt6/mnt6_init.hpp
+libff_libff_a_SOURCES += libff/libff/algebra/curves/mnt/mnt6/mnt6_pairing.cpp
+libff_libff_a_SOURCES += libff/libff/algebra/curves/mnt/mnt6/mnt6_pairing.hpp
+libff_libff_a_SOURCES += libff/libff/algebra/curves/mnt/mnt6/mnt6_pp.cpp
+libff_libff_a_SOURCES += libff/libff/algebra/curves/mnt/mnt6/mnt6_pp.hpp
+
+libff_libff_a_SOURCES += libff/libff/algebra/curves/mnt/mnt46_common.cpp
+libff_libff_a_SOURCES += libff/libff/algebra/curves/mnt/mnt46_common.hpp
+
+libff_libff_a_SOURCES += libff/libff/algebra/curves/tests/test_bilinearity.cpp
+libff_libff_a_SOURCES += libff/libff/algebra/curves/tests/test_groups.cpp
+
+libff_libff_a_SOURCES += libff/libff/algebra/curves/curve_utils.hpp
+libff_libff_a_SOURCES += libff/libff/algebra/curves/curve_utils.tcc
+
+libff_libff_a_SOURCES += libff/libff/algebra/exponentiation/exponentiation.hpp
+libff_libff_a_SOURCES += libff/libff/algebra/exponentiation/exponentiation.tcc
+
+libff_libff_a_SOURCES += libff/libff/algebra/fields/bigint.tcc
+libff_libff_a_SOURCES += libff/libff/algebra/fields/bigint.hpp
+libff_libff_a_SOURCES += libff/libff/algebra/fields/field_utils.tcc
+libff_libff_a_SOURCES += libff/libff/algebra/fields/field_utils.hpp
+libff_libff_a_SOURCES += libff/libff/algebra/fields/fp.tcc
+libff_libff_a_SOURCES += libff/libff/algebra/fields/fp.hpp
+libff_libff_a_SOURCES += libff/libff/algebra/fields/fp2.tcc
+libff_libff_a_SOURCES += libff/libff/algebra/fields/fp2.hpp
+libff_libff_a_SOURCES += libff/libff/algebra/fields/fp3.tcc
+libff_libff_a_SOURCES += libff/libff/algebra/fields/fp3.hpp
+libff_libff_a_SOURCES += libff/libff/algebra/fields/fp4.tcc
+libff_libff_a_SOURCES += libff/libff/algebra/fields/fp4.hpp
+libff_libff_a_SOURCES += libff/libff/algebra/fields/fp6_2over3.tcc
+libff_libff_a_SOURCES += libff/libff/algebra/fields/fp6_2over3.hpp
+libff_libff_a_SOURCES += libff/libff/algebra/fields/fp6_3over2.tcc
+libff_libff_a_SOURCES += libff/libff/algebra/fields/fp6_3over2.hpp
+libff_libff_a_SOURCES += libff/libff/algebra/fields/fp12_2over3over2.tcc
+libff_libff_a_SOURCES += libff/libff/algebra/fields/fp12_2over3over2.hpp
+libff_libff_a_SOURCES += libff/libff/algebra/fields/fp_aux.tcc
+libff_libff_a_SOURCES += libff/libff/algebra/fields/tests/test_fields.cpp
+
+libff_libff_a_SOURCES += libff/libff/algebra/scalar_multiplication/multiexp.tcc
+libff_libff_a_SOURCES += libff/libff/algebra/scalar_multiplication/multiexp.hpp
+libff_libff_a_SOURCES += libff/libff/algebra/scalar_multiplication/wnaf.tcc
+libff_libff_a_SOURCES += libff/libff/algebra/scalar_multiplication/wnaf.hpp
+
+
+libff_libff_a_SOURCES += libff/libff/common/default_types/ec_pp.hpp
+libff_libff_a_SOURCES += libff/libff/common/double.cpp
+libff_libff_a_SOURCES += libff/libff/common/double.hpp
+libff_libff_a_SOURCES += libff/libff/common/profiling.cpp
+libff_libff_a_SOURCES += libff/libff/common/profiling.hpp
+libff_libff_a_SOURCES += libff/libff/common/rng.tcc
+libff_libff_a_SOURCES += libff/libff/common/rng.hpp
+libff_libff_a_SOURCES += libff/libff/common/serialization.tcc
+libff_libff_a_SOURCES += libff/libff/common/serialization.hpp
+libff_libff_a_SOURCES += libff/libff/common/template_utils.hpp
+libff_libff_a_SOURCES += libff/libff/common/utils.cpp
+libff_libff_a_SOURCES += libff/libff/common/utils.hpp
+libff_libff_a_SOURCES += libff/libff/common/utils.tcc
+
+
+
+
+
+
diff --git a/src/Makefile.qt.include b/src/Makefile.qt.include
index b159247db..b677c7c28 100644
--- a/src/Makefile.qt.include
+++ b/src/Makefile.qt.include
@@ -595,7 +595,7 @@ endif
 qt_qtum_qt_LDADD += $(LIBBITCOIN_CLI) $(LIBBITCOIN_COMMON) $(LIBBITCOIN_UTIL) $(LIBBITCOIN_CONSENSUS) $(LIBBITCOIN_CRYPTO) $(LIBUNIVALUE) $(LIBLEVELDB) $(LIBLEVELDB_SSE42) $(LIBMEMENV) \
   $(BOOST_LIBS) $(QT_LIBS) $(QT_DBUS_LIBS) $(QR_LIBS) $(PROTOBUF_LIBS) $(BDB_LIBS) $(SSL_LIBS) $(CRYPTO_LIBS) $(MINIUPNPC_LIBS) $(LIBSECP256K1) \
   $(EVENT_PTHREADS_LIBS) $(EVENT_LIBS) $(LIBETHEREUM) $(LIBETHASHSEAL) $(LIBETHASH) \
-  $(LIBETHCORE) $(LIBDEVCORE) $(LIBJSONCPP) $(LIBEVM) $(LIBEVMCORE) $(LIBDEVCRYPTO) $(LIBCRYPTOPP) $(LIBSCRYIPT)
+  $(LIBETHCORE) $(LIBDEVCORE) $(LIBJSONCPP) $(LIBEVM) $(LIBEVMCORE) $(LIBDEVCRYPTO) $(LIBCRYPTOPP) $(LIBSCRYIPT) $(LIBFF) -lgmp -lgmpxx
 qt_qtum_qt_LDFLAGS = $(RELDFLAGS) $(AM_LDFLAGS) $(QT_LDFLAGS) $(LIBTOOL_APP_LDFLAGS)
 qt_qtum_qt_LIBTOOLFLAGS = $(AM_LIBTOOLFLAGS) --tag CXX
 
diff --git a/src/Makefile.qttest.include b/src/Makefile.qttest.include
index c19437682..01307f623 100644
--- a/src/Makefile.qttest.include
+++ b/src/Makefile.qttest.include
@@ -67,7 +67,7 @@ qt_test_test_qtum_qt_LDADD += $(LIBBITCOIN_CLI) $(LIBBITCOIN_COMMON) $(LIBBITCOI
   $(LIBETHCORE) $(LIBDEVCORE) $(LIBJSONCPP) $(LIBEVM) $(LIBEVMCORE) $(LIBDEVCRYPTO) $(LIBCRYPTOPP) \
   $(BOOST_LIBS) $(LIBSECP256K1ETH) $(LIBSCRYIPT) $(QT_DBUS_LIBS) $(QT_TEST_LIBS) $(QT_LIBS) \
   $(QR_LIBS) $(PROTOBUF_LIBS) $(BDB_LIBS) $(SSL_LIBS) $(CRYPTO_LIBS) $(MINIUPNPC_LIBS) $(LIBSECP256K1) \
-  $(EVENT_PTHREADS_LIBS) $(EVENT_LIBS)
+  $(EVENT_PTHREADS_LIBS) $(EVENT_LIBS) $(LIBFF) -lgmp -lgmpxx
 qt_test_test_qtum_qt_LDFLAGS = $(RELDFLAGS) $(AM_LDFLAGS) $(QT_LDFLAGS) $(LIBTOOL_APP_LDFLAGS)
 qt_test_test_qtum_qt_CXXFLAGS = $(AM_CXXFLAGS) $(QT_PIE_FLAGS)
 
diff --git a/src/Makefile.test.include b/src/Makefile.test.include
index e180c8944..fd505c19c 100644
--- a/src/Makefile.test.include
+++ b/src/Makefile.test.include
@@ -122,7 +122,7 @@ test_test_qtum_LDADD += $(LIBBITCOIN_SERVER) $(LIBBITCOIN_CLI) $(LIBBITCOIN_COMM
   $(LIBDEVCORE) $(LIBJSONCPP) $(LIBEVM) $(LIBEVMCORE) $(LIBDEVCRYPTO) $(LIBCRYPTOPP) $(LIBSECP256K1) $(LIBSCRYIPT) $(BOOST_LIBS)
 test_test_qtum_CXXFLAGS = $(AM_CXXFLAGS) $(PIE_FLAGS)
 
-test_test_qtum_LDADD += $(LIBBITCOIN_CONSENSUS) $(BDB_LIBS) $(SSL_LIBS) $(CRYPTO_LIBS) $(MINIUPNPC_LIBS)
+test_test_qtum_LDADD += $(LIBBITCOIN_CONSENSUS) $(BDB_LIBS) $(SSL_LIBS) $(CRYPTO_LIBS) $(MINIUPNPC_LIBS) $(LIBFF) -lgmp -lgmpxx
 test_test_qtum_LDFLAGS = $(RELDFLAGS) $(AM_LDFLAGS) $(LIBTOOL_APP_LDFLAGS) -static
 
 if ENABLE_ZMQ
diff --git a/src/libff/AUTHORS b/src/libff/AUTHORS
new file mode 100755
index 000000000..2a7d38930
--- /dev/null
+++ b/src/libff/AUTHORS
@@ -0,0 +1,10 @@
+SCIPR Lab:
+    Eli Ben-Sasson
+    Alessandro Chiesa
+    Eran Tromer
+    Madars Virza
+    Howard Wu
+
+External contributors:
+    Alexander Chernyakhovsky (Google Inc.)
+    Aleksejs Popovs
diff --git a/src/libff/CMakeLists.txt b/src/libff/CMakeLists.txt
new file mode 100755
index 000000000..1079483bc
--- /dev/null
+++ b/src/libff/CMakeLists.txt
@@ -0,0 +1,232 @@
+cmake_minimum_required(VERSION 2.8)
+
+project (libff)
+
+# Default to RelWithDebInfo configuration if no configuration is explicitly specified.
+if(NOT CMAKE_BUILD_TYPE AND NOT CMAKE_CONFIGURATION_TYPES)
+  set(CMAKE_BUILD_TYPE RelWithDebInfo CACHE STRING "Build type on single-configuration generators" FORCE)
+endif()
+
+set(
+  CURVE
+  "BN128"
+  CACHE
+  STRING
+  "Default curve: one of ALT_BN128, BN128, EDWARDS, MNT4, MNT6"
+)
+
+option(
+  DEBUG
+  "Enable debugging mode"
+  OFF
+)
+option(
+  LOWMEM
+  "Limit the size of multi-exponentiation tables, for low-memory platforms"
+  OFF
+)
+option(
+  MULTICORE
+  "Enable parallelized execution, using OpenMP"
+  OFF
+)
+option(
+  BINARY_OUTPUT
+  "In serialization, output raw binary data (instead of decimal), which is smaller and faster."
+  ON
+)
+option(
+  MONTGOMERY_OUTPUT
+  "Serialize Fp elements as their Montgomery representations (faster but not human-readable)"
+  ON
+)
+option(
+  USE_PT_COMPRESSION
+  "Use point compression"
+  ON
+)
+option(
+  PROFILE_OP_COUNTS
+  "Collect counts for field and curve operations"
+  OFF
+)
+option(
+  USE_MIXED_ADDITION
+  "Convert each element of the key pair to affine coordinates"
+  OFF
+)
+
+option(
+  WITH_PROCPS
+  "Use procps for memory profiling"
+  ON
+)
+
+option(
+  CPPDEBUG
+  "Enable debugging of C++ STL (does not imply DEBUG)"
+  OFF
+)
+
+option(
+  PERFORMANCE
+  "Enable link-time and aggressive optimizations"
+  OFF
+)
+
+option(
+  USE_ASM
+  "Use architecture-specific optimized assembly code"
+  ON
+)
+
+option(
+  IS_LIBFF_PARENT
+  "Install submodule dependencies if caller originates from here"
+  ON
+)
+
+if(CMAKE_COMPILER_IS_GNUCXX OR "${CMAKE_CXX_COMPILER_ID}" STREQUAL "Clang")
+  # Common compilation flags and warning configuration
+  set(
+    CMAKE_CXX_FLAGS
+    "${CMAKE_CXX_FLAGS} -std=c++11 -Wall -Wextra -Wfatal-errors"
+  )
+  if("${MULTICORE}")
+      set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -fopenmp")
+  endif()
+endif()
+
+find_path(GMP_INCLUDE_DIR NAMES gmp.h)
+find_library(GMP_LIBRARY gmp)
+if(GMP_LIBRARY MATCHES ${CMAKE_SHARED_LIBRARY_SUFFIX})
+  set(gmp_library_type SHARED)
+else()
+  set(gmp_library_type STATIC)
+endif()
+message(STATUS "GMP: ${GMP_LIBRARY}, ${GMP_INCLUDE_DIR}")
+add_library(GMP::gmp ${gmp_library_type} IMPORTED)
+set_target_properties(
+  GMP::gmp PROPERTIES
+  IMPORTED_LOCATION ${GMP_LIBRARY}
+  INTERFACE_INCLUDE_DIRECTORIES ${GMP_INCLUDE_DIR}
+)
+
+find_package(OpenSSL REQUIRED)
+INCLUDE_DIRECTORIES(${OPENSSL_INCLUDE_DIR})
+
+if("${WITH_PROCPS}")
+  include(FindPkgConfig)
+  pkg_check_modules(
+    PROCPS
+    REQUIRED
+
+    libprocps
+  )
+else()
+  add_definitions(
+    -DNO_PROCPS
+  )
+endif()
+
+add_definitions(
+  -DCURVE_${CURVE}
+)
+
+enable_testing()
+
+if(${CURVE} STREQUAL "BN128")
+  add_definitions(
+    -DBN_SUPPORT_SNARK=1
+  )
+endif()
+
+if("${DEBUG}")
+  add_definitions(-DDEBUG=1)
+endif()
+
+if("${LOWMEM}")
+  add_definitions(-DLOWMEM=1)
+endif()
+
+if("${MULTICORE}")
+  add_definitions(-DMULTICORE=1)
+endif()
+
+if("${BINARY_OUTPUT}")
+  add_definitions(-DBINARY_OUTPUT)
+endif()
+
+if("${MONTGOMERY_OUTPUT}")
+  add_definitions(-DMONTGOMERY_OUTPUT)
+endif()
+
+if(NOT "${USE_PT_COMPRESSION}")
+  add_definitions(-DNO_PT_COMPRESSION=1)
+endif()
+
+if("${PROFILE_OP_COUNTS}")
+  add_definitions(-DPROFILE_OP_COUNTS=1)
+endif()
+
+if("${USE_MIXED_ADDITION}")
+  add_definitions(-DUSE_MIXED_ADDITION=1)
+endif()
+
+if("${CPPDEBUG}")
+  add_definitions(-D_GLIBCXX_DEBUG -D_GLIBCXX_DEBUG_PEDANTIC)
+endif()
+
+if("${PERFORMANCE}")
+  add_definitions(-DNDEBUG)
+  set(
+    CMAKE_CXX_FLAGS
+    "${CMAKE_CXX_FLAGS} -flto -fuse-linker-plugin"
+  )
+  set(
+    CMAKE_EXE_LINKER_FLAGS
+    "${CMAKE_EXE_LINKER_FLAGS} -flto"
+  )
+endif()
+
+if("${USE_ASM}")
+  add_definitions(-DUSE_ASM)
+endif()
+
+# Configure CCache if available
+find_program(CCACHE_FOUND ccache)
+if(CCACHE_FOUND)
+        set_property(GLOBAL PROPERTY RULE_LAUNCH_COMPILE ccache)
+        set_property(GLOBAL PROPERTY RULE_LAUNCH_LINK ccache)
+endif(CCACHE_FOUND)
+
+if ("${IS_LIBFF_PARENT}")
+  find_program(
+    MARKDOWN
+
+    markdown_py
+    DOC "Path to markdown_py binary"
+  )
+  if(MARKDOWN-NOTFOUND)
+  else()
+     add_custom_target(
+       doc
+       ${MARKDOWN} -f ${CMAKE_CURRENT_BINARY_DIR}/README.html -x toc -x extra --noisy ${CMAKE_CURRENT_SOURCE_DIR}/README.md
+       WORKING_DIRECTORY ${CMAKE_CURRENT_BINARY_DIR}
+       COMMENT "Translating from markdown to HTML" VERBATIM
+     )
+  endif()
+
+  # Add a `make check` target that builds and tests
+  add_custom_target(check COMMAND ${CMAKE_CTEST_COMMAND})
+
+  # Add a `make profile` target that builds and profiles
+  add_custom_target(
+    profile
+    COMMAND ${CMAKE_COMMAND}
+     -E echo 'Built target finished'
+  )
+
+  add_subdirectory(depends)
+endif()
+add_subdirectory(libff)
diff --git a/src/libff/LICENSE b/src/libff/LICENSE
new file mode 100755
index 000000000..efc454e93
--- /dev/null
+++ b/src/libff/LICENSE
@@ -0,0 +1,24 @@
+The libff library is developed by SCIPR Lab (http://scipr-lab.org)
+and contributors.
+
+Copyright (c) 2012-2014 SCIPR Lab and contributors (see AUTHORS file).
+
+All files, with the exceptions below, are released under the MIT License:
+
+  Permission is hereby granted, free of charge, to any person obtaining a copy
+  of this software and associated documentation files (the "Software"), to deal
+  in the Software without restriction, including without limitation the rights
+  to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+  copies of the Software, and to permit persons to whom the Software is
+  furnished to do so, subject to the following conditions:
+
+  The above copyright notice and this permission notice shall be included in
+  all copies or substantial portions of the Software.
+
+  THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+  IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+  FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+  AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+  LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+  OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+  THE SOFTWARE.
diff --git a/src/libff/README.md b/src/libff/README.md
new file mode 100755
index 000000000..7fe8d7d85
--- /dev/null
+++ b/src/libff/README.md
@@ -0,0 +1,113 @@
+<h1 align="center">libff</h1>
+<h4 align="center">C++ library for Finite Fields and Elliptic Curves</h4>
+
+___libff___ is a C++ library for finite fields and elliptic curves. The library is developed by [SCIPR Lab] and contributors (see [AUTHORS] file) and is released under the MIT License (see [LICENSE] file).
+
+## Table of contents
+
+- [Directory structure](#directory-structure)
+- [Elliptic curve choices](#elliptic-curve-choices)
+- [Build guide](#build-guide)
+
+## Directory structure
+
+The directory structure is as follows:
+
+* [__libff__](libff): C++ source code, containing the following modules:
+  * [__algebra__](libff/algebra): fields and elliptic curve groups
+  * [__common__](libff/common): miscellaneous utilities
+* [__depends__](depends): dependency libraries
+
+## Elliptic curve choices
+
+The libsnark library currently provides three options:
+
+* `edwards`:
+   an instantiation based on an Edwards curve, providing 80 bits of security.
+
+* `bn128`:
+   an instantiation based on a Barreto-Naehrig curve, providing 128
+   bits of security. The underlying curve implementation is
+   \[ate-pairing], which has incorporated our patch that changes the
+   BN curve to one suitable for SNARK applications.
+
+    *   This implementation uses dynamically-generated machine code for the curve
+        arithmetic. Some modern systems disallow execution of code on the heap, and
+        will thus block this implementation.
+
+        For example, on Fedora 20 at its default settings, you will get the error
+        `zmInit ERR:can't protect` when running this code. To solve this,
+        run `sudo setsebool -P allow_execheap 1` to allow execution,
+        or use `make CURVE=ALT_BN128` instead.
+
+* `alt_bn128`:
+   an alternative to `bn128`, somewhat slower but avoids dynamic code generation.
+
+Note that `bn128` requires an x86-64 CPU while the other curve choices
+should be architecture-independent.
+
+## Build guide
+
+The library has the following dependencies:
+
+* [Boost](http://www.boost.org/)
+* [CMake](http://cmake.org/)
+* [GMP](http://gmplib.org/)
+* [libprocps](http://packages.ubuntu.com/trusty/libprocps-dev)
+
+The library has been tested on Linux, but it is compatible with Windows and Mac OS X.
+
+### Installation
+
+On Ubuntu 14.04 LTS:
+
+```
+sudo apt-get install build-essential git libboost-all-dev cmake libgmp3-dev libssl-dev libprocps3-dev pkg-config
+```
+
+Fetch dependencies from their GitHub repos:
+
+```
+git submodule init && git submodule update
+```
+
+### Compilation
+
+To compile, starting at the project root directory, create the build directory and Makefile:
+
+```
+mkdir build && cd build && cmake ..
+```
+Optionally, you can specify the install location by providing the desired install path prefix:
+```
+cmake .. -DCMAKE_INSTALL_PREFIX=/install/path
+```
+
+Then, to compile and install the library, run this within the build directory:
+```
+make
+make install
+```
+
+This will install `libff.a` into `/install/path/lib`; so your application should be linked using `-L/install/path/lib -lff`. It also installs the requisite headers into `/install/path/include`; so your application should be compiled using `-I/install/path/include`.
+
+## Testing
+
+To execute the tests for this library, run:
+```
+make check
+```
+
+## Profile
+
+To compile the multi-exponentiation profiler in this library, run:
+```
+make profile
+```
+The resulting profiler is named `multiexp_profile` and can be found in the `libff` folder under the build directory.
+
+[SCIPR Lab]: http://www.scipr-lab.org/ (Succinct Computational Integrity and Privacy Research Lab)
+
+[LICENSE]: LICENSE (LICENSE file in top directory of libff distribution)
+
+[AUTHORS]: AUTHORS (AUTHORS file in top directory of libff distribution)
diff --git a/src/libff/depends/CMakeLists.txt b/src/libff/depends/CMakeLists.txt
new file mode 100755
index 000000000..fa8ccef1e
--- /dev/null
+++ b/src/libff/depends/CMakeLists.txt
@@ -0,0 +1,11 @@
+if(${CURVE} STREQUAL "BN128")
+  include_directories(ate-pairing/include)
+  include_directories(xbyak)
+  add_library(
+    zm
+    STATIC
+
+    ate-pairing/src/zm.cpp
+    ate-pairing/src/zm2.cpp
+  )
+endif()
diff --git a/src/libff/libff/CMakeLists.txt b/src/libff/libff/CMakeLists.txt
new file mode 100755
index 000000000..bcc0bb06c
--- /dev/null
+++ b/src/libff/libff/CMakeLists.txt
@@ -0,0 +1,149 @@
+set(FF_EXTRASRCS)
+set(FF_EXTRALIBS)
+if(${CURVE} STREQUAL "BN128")
+  set(
+    FF_EXTRASRCS
+
+    ${FF_EXTRASRCS}
+    algebra/curves/bn128/bn128_g1.cpp
+    algebra/curves/bn128/bn128_g2.cpp
+    algebra/curves/bn128/bn128_gt.cpp
+    algebra/curves/bn128/bn128_init.cpp
+    algebra/curves/bn128/bn128_pairing.cpp
+    algebra/curves/bn128/bn128_pp.cpp
+  )
+  set(
+    FF_EXTRALIBS
+
+    ${FF_EXTRALIBS}
+    zm
+  )
+endif()
+
+add_library(
+  ff
+  STATIC
+
+  algebra/curves/alt_bn128/alt_bn128_g1.cpp
+  algebra/curves/alt_bn128/alt_bn128_g2.cpp
+  algebra/curves/alt_bn128/alt_bn128_init.cpp
+  algebra/curves/alt_bn128/alt_bn128_pairing.cpp
+  algebra/curves/alt_bn128/alt_bn128_pp.cpp
+  algebra/curves/edwards/edwards_g1.cpp
+  algebra/curves/edwards/edwards_g2.cpp
+  algebra/curves/edwards/edwards_init.cpp
+  algebra/curves/edwards/edwards_pairing.cpp
+  algebra/curves/edwards/edwards_pp.cpp
+  algebra/curves/mnt/mnt4/mnt4_g1.cpp
+  algebra/curves/mnt/mnt4/mnt4_g2.cpp
+  algebra/curves/mnt/mnt4/mnt4_init.cpp
+  algebra/curves/mnt/mnt4/mnt4_pairing.cpp
+  algebra/curves/mnt/mnt4/mnt4_pp.cpp
+  algebra/curves/mnt/mnt46_common.cpp
+  algebra/curves/mnt/mnt6/mnt6_g1.cpp
+  algebra/curves/mnt/mnt6/mnt6_g2.cpp
+  algebra/curves/mnt/mnt6/mnt6_init.cpp
+  algebra/curves/mnt/mnt6/mnt6_pairing.cpp
+  algebra/curves/mnt/mnt6/mnt6_pp.cpp
+  common/double.cpp
+  common/profiling.cpp
+  common/utils.cpp
+
+  ${FF_EXTRASRCS}
+)
+target_link_libraries(
+  ff
+
+  GMP::gmp
+  ${PROCPS_LIBRARIES}
+  ${FF_EXTRALIBS}
+)
+target_include_directories(
+  ff
+  PUBLIC ..
+)
+
+install(
+  DIRECTORY "" DESTINATION "include/libff"
+  FILES_MATCHING
+  PATTERN "*.hpp"
+  PATTERN "*.tcc"
+  PATTERN "tests" EXCLUDE
+  PATTERN "examples" EXCLUDE
+)
+
+install(
+  TARGETS ff DESTINATION lib
+)
+
+# Tests
+if ("${IS_LIBFF_PARENT}")
+  add_executable(
+    algebra_bilinearity_test
+    EXCLUDE_FROM_ALL
+
+    algebra/curves/tests/test_bilinearity.cpp
+  )
+  target_link_libraries(
+    algebra_bilinearity_test
+
+    ff
+  )
+
+  add_executable(
+    algebra_groups_test
+    EXCLUDE_FROM_ALL
+
+    algebra/curves/tests/test_groups.cpp
+  )
+  target_link_libraries(
+    algebra_groups_test
+
+    ff
+  )
+
+  add_executable(
+    algebra_fields_test
+    EXCLUDE_FROM_ALL
+
+    algebra/fields/tests/test_fields.cpp
+  )
+  target_link_libraries(
+    algebra_fields_test
+
+    ff
+  )
+
+  include(CTest)
+  add_test(
+    NAME algebra_bilinearity_test
+    COMMAND algebra_bilinearity_test
+  )
+  add_test(
+    NAME algebra_groups_test
+    COMMAND algebra_groups_test
+  )
+  add_test(
+    NAME algebra_fields_test
+    COMMAND algebra_fields_test
+  )
+
+  add_dependencies(check algebra_bilinearity_test)
+  add_dependencies(check algebra_groups_test)
+  add_dependencies(check algebra_fields_test)
+
+  add_executable(
+    multiexp_profile
+    EXCLUDE_FROM_ALL
+
+    algebra/scalar_multiplication/multiexp_profile.cpp
+  )
+  target_link_libraries(
+    multiexp_profile
+
+    ${OPENSSL_LIBRARIES}
+    ff
+  )
+
+  add_dependencies(profile multiexp_profile)
+endif()
diff --git a/src/libff/libff/algebra/curves/alt_bn128/alt_bn128_g1.cpp b/src/libff/libff/algebra/curves/alt_bn128/alt_bn128_g1.cpp
new file mode 100755
index 000000000..214e96c2d
--- /dev/null
+++ b/src/libff/libff/algebra/curves/alt_bn128/alt_bn128_g1.cpp
@@ -0,0 +1,523 @@
+/** @file
+ *****************************************************************************
+ * @author     This file is part of libff, developed by SCIPR Lab
+ *             and contributors (see AUTHORS).
+ * @copyright  MIT license (see LICENSE file)
+ *****************************************************************************/
+
+#include <libff/algebra/curves/alt_bn128/alt_bn128_g1.hpp>
+
+namespace libff {
+
+#ifdef PROFILE_OP_COUNTS
+long long alt_bn128_G1::add_cnt = 0;
+long long alt_bn128_G1::dbl_cnt = 0;
+#endif
+
+std::vector<size_t> alt_bn128_G1::wnaf_window_table;
+std::vector<size_t> alt_bn128_G1::fixed_base_exp_window_table;
+alt_bn128_G1 alt_bn128_G1::G1_zero;
+alt_bn128_G1 alt_bn128_G1::G1_one;
+
+alt_bn128_G1::alt_bn128_G1()
+{
+    this->X = G1_zero.X;
+    this->Y = G1_zero.Y;
+    this->Z = G1_zero.Z;
+}
+
+void alt_bn128_G1::print() const
+{
+    if (this->is_zero())
+    {
+        printf("O\n");
+    }
+    else
+    {
+        alt_bn128_G1 copy(*this);
+        copy.to_affine_coordinates();
+        gmp_printf("(%Nd , %Nd)\n",
+                   copy.X.as_bigint().data, alt_bn128_Fq::num_limbs,
+                   copy.Y.as_bigint().data, alt_bn128_Fq::num_limbs);
+    }
+}
+
+void alt_bn128_G1::print_coordinates() const
+{
+    if (this->is_zero())
+    {
+        printf("O\n");
+    }
+    else
+    {
+        gmp_printf("(%Nd : %Nd : %Nd)\n",
+                   this->X.as_bigint().data, alt_bn128_Fq::num_limbs,
+                   this->Y.as_bigint().data, alt_bn128_Fq::num_limbs,
+                   this->Z.as_bigint().data, alt_bn128_Fq::num_limbs);
+    }
+}
+
+void alt_bn128_G1::to_affine_coordinates()
+{
+    if (this->is_zero())
+    {
+        this->X = alt_bn128_Fq::zero();
+        this->Y = alt_bn128_Fq::one();
+        this->Z = alt_bn128_Fq::zero();
+    }
+    else
+    {
+        alt_bn128_Fq Z_inv = Z.inverse();
+        alt_bn128_Fq Z2_inv = Z_inv.squared();
+        alt_bn128_Fq Z3_inv = Z2_inv * Z_inv;
+        this->X = this->X * Z2_inv;
+        this->Y = this->Y * Z3_inv;
+        this->Z = alt_bn128_Fq::one();
+    }
+}
+
+void alt_bn128_G1::to_special()
+{
+    this->to_affine_coordinates();
+}
+
+bool alt_bn128_G1::is_special() const
+{
+    return (this->is_zero() || this->Z == alt_bn128_Fq::one());
+}
+
+bool alt_bn128_G1::is_zero() const
+{
+    return (this->Z.is_zero());
+}
+
+bool alt_bn128_G1::operator==(const alt_bn128_G1 &other) const
+{
+    if (this->is_zero())
+    {
+        return other.is_zero();
+    }
+
+    if (other.is_zero())
+    {
+        return false;
+    }
+
+    /* now neither is O */
+
+    // using Jacobian coordinates so:
+    // (X1:Y1:Z1) = (X2:Y2:Z2)
+    // iff
+    // X1/Z1^2 == X2/Z2^2 and Y1/Z1^3 == Y2/Z2^3
+    // iff
+    // X1 * Z2^2 == X2 * Z1^2 and Y1 * Z2^3 == Y2 * Z1^3
+
+    alt_bn128_Fq Z1_squared = (this->Z).squared();
+    alt_bn128_Fq Z2_squared = (other.Z).squared();
+
+    if ((this->X * Z2_squared) != (other.X * Z1_squared))
+    {
+        return false;
+    }
+
+    alt_bn128_Fq Z1_cubed = (this->Z) * Z1_squared;
+    alt_bn128_Fq Z2_cubed = (other.Z) * Z2_squared;
+
+    if ((this->Y * Z2_cubed) != (other.Y * Z1_cubed))
+    {
+        return false;
+    }
+
+    return true;
+}
+
+bool alt_bn128_G1::operator!=(const alt_bn128_G1& other) const
+{
+    return !(operator==(other));
+}
+
+alt_bn128_G1 alt_bn128_G1::operator+(const alt_bn128_G1 &other) const
+{
+    // handle special cases having to do with O
+    if (this->is_zero())
+    {
+        return other;
+    }
+
+    if (other.is_zero())
+    {
+        return *this;
+    }
+
+    // no need to handle points of order 2,4
+    // (they cannot exist in a prime-order subgroup)
+
+    // check for doubling case
+
+    // using Jacobian coordinates so:
+    // (X1:Y1:Z1) = (X2:Y2:Z2)
+    // iff
+    // X1/Z1^2 == X2/Z2^2 and Y1/Z1^3 == Y2/Z2^3
+    // iff
+    // X1 * Z2^2 == X2 * Z1^2 and Y1 * Z2^3 == Y2 * Z1^3
+
+    alt_bn128_Fq Z1Z1 = (this->Z).squared();
+    alt_bn128_Fq Z2Z2 = (other.Z).squared();
+
+    alt_bn128_Fq U1 = this->X * Z2Z2;
+    alt_bn128_Fq U2 = other.X * Z1Z1;
+
+    alt_bn128_Fq Z1_cubed = (this->Z) * Z1Z1;
+    alt_bn128_Fq Z2_cubed = (other.Z) * Z2Z2;
+
+    alt_bn128_Fq S1 = (this->Y) * Z2_cubed;      // S1 = Y1 * Z2 * Z2Z2
+    alt_bn128_Fq S2 = (other.Y) * Z1_cubed;      // S2 = Y2 * Z1 * Z1Z1
+
+    if (U1 == U2 && S1 == S2)
+    {
+        // dbl case; nothing of above can be reused
+        return this->dbl();
+    }
+
+    // rest of add case
+    alt_bn128_Fq H = U2 - U1;                            // H = U2-U1
+    alt_bn128_Fq S2_minus_S1 = S2-S1;
+    alt_bn128_Fq I = (H+H).squared();                    // I = (2 * H)^2
+    alt_bn128_Fq J = H * I;                              // J = H * I
+    alt_bn128_Fq r = S2_minus_S1 + S2_minus_S1;          // r = 2 * (S2-S1)
+    alt_bn128_Fq V = U1 * I;                             // V = U1 * I
+    alt_bn128_Fq X3 = r.squared() - J - (V+V);           // X3 = r^2 - J - 2 * V
+    alt_bn128_Fq S1_J = S1 * J;
+    alt_bn128_Fq Y3 = r * (V-X3) - (S1_J+S1_J);          // Y3 = r * (V-X3)-2 S1 J
+    alt_bn128_Fq Z3 = ((this->Z+other.Z).squared()-Z1Z1-Z2Z2) * H; // Z3 = ((Z1+Z2)^2-Z1Z1-Z2Z2) * H
+
+    return alt_bn128_G1(X3, Y3, Z3);
+}
+
+alt_bn128_G1 alt_bn128_G1::operator-() const
+{
+    return alt_bn128_G1(this->X, -(this->Y), this->Z);
+}
+
+
+alt_bn128_G1 alt_bn128_G1::operator-(const alt_bn128_G1 &other) const
+{
+    return (*this) + (-other);
+}
+
+alt_bn128_G1 alt_bn128_G1::add(const alt_bn128_G1 &other) const
+{
+    // handle special cases having to do with O
+    if (this->is_zero())
+    {
+        return other;
+    }
+
+    if (other.is_zero())
+    {
+        return *this;
+    }
+
+    // no need to handle points of order 2,4
+    // (they cannot exist in a prime-order subgroup)
+
+    // handle double case
+    if (this->operator==(other))
+    {
+        return this->dbl();
+    }
+
+#ifdef PROFILE_OP_COUNTS
+    this->add_cnt++;
+#endif
+    // NOTE: does not handle O and pts of order 2,4
+    // http://www.hyperelliptic.org/EFD/g1p/auto-shortw-jacobian-0.html#addition-add-2007-bl
+
+    alt_bn128_Fq Z1Z1 = (this->Z).squared();             // Z1Z1 = Z1^2
+    alt_bn128_Fq Z2Z2 = (other.Z).squared();             // Z2Z2 = Z2^2
+    alt_bn128_Fq U1 = (this->X) * Z2Z2;                  // U1 = X1 * Z2Z2
+    alt_bn128_Fq U2 = (other.X) * Z1Z1;                  // U2 = X2 * Z1Z1
+    alt_bn128_Fq S1 = (this->Y) * (other.Z) * Z2Z2;      // S1 = Y1 * Z2 * Z2Z2
+    alt_bn128_Fq S2 = (other.Y) * (this->Z) * Z1Z1;      // S2 = Y2 * Z1 * Z1Z1
+    alt_bn128_Fq H = U2 - U1;                            // H = U2-U1
+    alt_bn128_Fq S2_minus_S1 = S2-S1;
+    alt_bn128_Fq I = (H+H).squared();                    // I = (2 * H)^2
+    alt_bn128_Fq J = H * I;                              // J = H * I
+    alt_bn128_Fq r = S2_minus_S1 + S2_minus_S1;          // r = 2 * (S2-S1)
+    alt_bn128_Fq V = U1 * I;                             // V = U1 * I
+    alt_bn128_Fq X3 = r.squared() - J - (V+V);           // X3 = r^2 - J - 2 * V
+    alt_bn128_Fq S1_J = S1 * J;
+    alt_bn128_Fq Y3 = r * (V-X3) - (S1_J+S1_J);          // Y3 = r * (V-X3)-2 S1 J
+    alt_bn128_Fq Z3 = ((this->Z+other.Z).squared()-Z1Z1-Z2Z2) * H; // Z3 = ((Z1+Z2)^2-Z1Z1-Z2Z2) * H
+
+    return alt_bn128_G1(X3, Y3, Z3);
+}
+
+alt_bn128_G1 alt_bn128_G1::mixed_add(const alt_bn128_G1 &other) const
+{
+#ifdef DEBUG
+    assert(other.is_special());
+#endif
+
+    // handle special cases having to do with O
+    if (this->is_zero())
+    {
+        return other;
+    }
+
+    if (other.is_zero())
+    {
+        return *this;
+    }
+
+    // no need to handle points of order 2,4
+    // (they cannot exist in a prime-order subgroup)
+
+    // check for doubling case
+
+    // using Jacobian coordinates so:
+    // (X1:Y1:Z1) = (X2:Y2:Z2)
+    // iff
+    // X1/Z1^2 == X2/Z2^2 and Y1/Z1^3 == Y2/Z2^3
+    // iff
+    // X1 * Z2^2 == X2 * Z1^2 and Y1 * Z2^3 == Y2 * Z1^3
+
+    // we know that Z2 = 1
+
+    const alt_bn128_Fq Z1Z1 = (this->Z).squared();
+
+    const alt_bn128_Fq &U1 = this->X;
+    const alt_bn128_Fq U2 = other.X * Z1Z1;
+
+    const alt_bn128_Fq Z1_cubed = (this->Z) * Z1Z1;
+
+    const alt_bn128_Fq &S1 = (this->Y);                // S1 = Y1 * Z2 * Z2Z2
+    const alt_bn128_Fq S2 = (other.Y) * Z1_cubed;      // S2 = Y2 * Z1 * Z1Z1
+
+    if (U1 == U2 && S1 == S2)
+    {
+        // dbl case; nothing of above can be reused
+        return this->dbl();
+    }
+
+#ifdef PROFILE_OP_COUNTS
+    this->add_cnt++;
+#endif
+
+    // NOTE: does not handle O and pts of order 2,4
+    // http://www.hyperelliptic.org/EFD/g1p/auto-shortw-jacobian-0.html#addition-madd-2007-bl
+    alt_bn128_Fq H = U2-(this->X);                         // H = U2-X1
+    alt_bn128_Fq HH = H.squared() ;                        // HH = H&2
+    alt_bn128_Fq I = HH+HH;                                // I = 4*HH
+    I = I + I;
+    alt_bn128_Fq J = H*I;                                  // J = H*I
+    alt_bn128_Fq r = S2-(this->Y);                         // r = 2*(S2-Y1)
+    r = r + r;
+    alt_bn128_Fq V = (this->X) * I ;                       // V = X1*I
+    alt_bn128_Fq X3 = r.squared()-J-V-V;                   // X3 = r^2-J-2*V
+    alt_bn128_Fq Y3 = (this->Y)*J;                         // Y3 = r*(V-X3)-2*Y1*J
+    Y3 = r*(V-X3) - Y3 - Y3;
+    alt_bn128_Fq Z3 = ((this->Z)+H).squared() - Z1Z1 - HH; // Z3 = (Z1+H)^2-Z1Z1-HH
+
+    return alt_bn128_G1(X3, Y3, Z3);
+}
+
+alt_bn128_G1 alt_bn128_G1::dbl() const
+{
+#ifdef PROFILE_OP_COUNTS
+    this->dbl_cnt++;
+#endif
+    // handle point at infinity
+    if (this->is_zero())
+    {
+        return (*this);
+    }
+
+    // no need to handle points of order 2,4
+    // (they cannot exist in a prime-order subgroup)
+
+    // NOTE: does not handle O and pts of order 2,4
+    // http://www.hyperelliptic.org/EFD/g1p/auto-shortw-jacobian-0.html#doubling-dbl-2009-l
+
+    alt_bn128_Fq A = (this->X).squared();         // A = X1^2
+    alt_bn128_Fq B = (this->Y).squared();        // B = Y1^2
+    alt_bn128_Fq C = B.squared();                // C = B^2
+    alt_bn128_Fq D = (this->X + B).squared() - A - C;
+    D = D+D;                        // D = 2 * ((X1 + B)^2 - A - C)
+    alt_bn128_Fq E = A + A + A;                  // E = 3 * A
+    alt_bn128_Fq F = E.squared();                // F = E^2
+    alt_bn128_Fq X3 = F - (D+D);                 // X3 = F - 2 D
+    alt_bn128_Fq eightC = C+C;
+    eightC = eightC + eightC;
+    eightC = eightC + eightC;
+    alt_bn128_Fq Y3 = E * (D - X3) - eightC;     // Y3 = E * (D - X3) - 8 * C
+    alt_bn128_Fq Y1Z1 = (this->Y)*(this->Z);
+    alt_bn128_Fq Z3 = Y1Z1 + Y1Z1;               // Z3 = 2 * Y1 * Z1
+
+    return alt_bn128_G1(X3, Y3, Z3);
+}
+
+bool alt_bn128_G1::is_well_formed() const
+{
+    if (this->is_zero())
+    {
+        return true;
+    }
+    else
+    {
+        /*
+          y^2 = x^3 + b
+
+          We are using Jacobian coordinates, so equation we need to check is actually
+
+          (y/z^3)^2 = (x/z^2)^3 + b
+          y^2 / z^6 = x^3 / z^6 + b
+          y^2 = x^3 + b z^6
+        */
+        alt_bn128_Fq X2 = this->X.squared();
+        alt_bn128_Fq Y2 = this->Y.squared();
+        alt_bn128_Fq Z2 = this->Z.squared();
+
+        alt_bn128_Fq X3 = this->X * X2;
+        alt_bn128_Fq Z3 = this->Z * Z2;
+        alt_bn128_Fq Z6 = Z3.squared();
+
+        return (Y2 == X3 + alt_bn128_coeff_b * Z6);
+    }
+}
+
+alt_bn128_G1 alt_bn128_G1::zero()
+{
+    return G1_zero;
+}
+
+alt_bn128_G1 alt_bn128_G1::one()
+{
+    return G1_one;
+}
+
+alt_bn128_G1 alt_bn128_G1::random_element()
+{
+    return (scalar_field::random_element().as_bigint()) * G1_one;
+}
+
+std::ostream& operator<<(std::ostream &out, const alt_bn128_G1 &g)
+{
+    alt_bn128_G1 copy(g);
+    copy.to_affine_coordinates();
+
+    out << (copy.is_zero() ? 1 : 0) << OUTPUT_SEPARATOR;
+#ifdef NO_PT_COMPRESSION
+    out << copy.X << OUTPUT_SEPARATOR << copy.Y;
+#else
+    /* storing LSB of Y */
+    out << copy.X << OUTPUT_SEPARATOR << (copy.Y.as_bigint().data[0] & 1);
+#endif
+
+    return out;
+}
+
+std::istream& operator>>(std::istream &in, alt_bn128_G1 &g)
+{
+    char is_zero;
+    alt_bn128_Fq tX, tY;
+
+#ifdef NO_PT_COMPRESSION
+    in >> is_zero >> tX >> tY;
+    is_zero -= '0';
+#else
+    in.read((char*)&is_zero, 1); // this reads is_zero;
+    is_zero -= '0';
+    consume_OUTPUT_SEPARATOR(in);
+
+    unsigned char Y_lsb;
+    in >> tX;
+    consume_OUTPUT_SEPARATOR(in);
+    in.read((char*)&Y_lsb, 1);
+    Y_lsb -= '0';
+
+    // y = +/- sqrt(x^3 + b)
+    if (!is_zero)
+    {
+        alt_bn128_Fq tX2 = tX.squared();
+        alt_bn128_Fq tY2 = tX2*tX + alt_bn128_coeff_b;
+        tY = tY2.sqrt();
+
+        if ((tY.as_bigint().data[0] & 1) != Y_lsb)
+        {
+            tY = -tY;
+        }
+    }
+#endif
+    // using Jacobian coordinates
+    if (!is_zero)
+    {
+        g.X = tX;
+        g.Y = tY;
+        g.Z = alt_bn128_Fq::one();
+    }
+    else
+    {
+        g = alt_bn128_G1::zero();
+    }
+
+    return in;
+}
+
+std::ostream& operator<<(std::ostream& out, const std::vector<alt_bn128_G1> &v)
+{
+    out << v.size() << "\n";
+    for (const alt_bn128_G1& t : v)
+    {
+        out << t << OUTPUT_NEWLINE;
+    }
+
+    return out;
+}
+
+std::istream& operator>>(std::istream& in, std::vector<alt_bn128_G1> &v)
+{
+    v.clear();
+
+    size_t s;
+    in >> s;
+    consume_newline(in);
+
+    v.reserve(s);
+
+    for (size_t i = 0; i < s; ++i)
+    {
+        alt_bn128_G1 g;
+        in >> g;
+        consume_OUTPUT_NEWLINE(in);
+        v.emplace_back(g);
+    }
+
+    return in;
+}
+
+void alt_bn128_G1::batch_to_special_all_non_zeros(std::vector<alt_bn128_G1> &vec)
+{
+    std::vector<alt_bn128_Fq> Z_vec;
+    Z_vec.reserve(vec.size());
+
+    for (auto &el: vec)
+    {
+        Z_vec.emplace_back(el.Z);
+    }
+    batch_invert<alt_bn128_Fq>(Z_vec);
+
+    const alt_bn128_Fq one = alt_bn128_Fq::one();
+
+    for (size_t i = 0; i < vec.size(); ++i)
+    {
+        alt_bn128_Fq Z2 = Z_vec[i].squared();
+        alt_bn128_Fq Z3 = Z_vec[i] * Z2;
+
+        vec[i].X = vec[i].X * Z2;
+        vec[i].Y = vec[i].Y * Z3;
+        vec[i].Z = one;
+    }
+}
+
+} // libff
diff --git a/src/libff/libff/algebra/curves/alt_bn128/alt_bn128_g1.hpp b/src/libff/libff/algebra/curves/alt_bn128/alt_bn128_g1.hpp
new file mode 100755
index 000000000..bfeed20f1
--- /dev/null
+++ b/src/libff/libff/algebra/curves/alt_bn128/alt_bn128_g1.hpp
@@ -0,0 +1,93 @@
+/** @file
+ *****************************************************************************
+ * @author     This file is part of libff, developed by SCIPR Lab
+ *             and contributors (see AUTHORS).
+ * @copyright  MIT license (see LICENSE file)
+ *****************************************************************************/
+
+#ifndef ALT_BN128_G1_HPP_
+#define ALT_BN128_G1_HPP_
+#include <vector>
+
+#include <libff/algebra/curves/alt_bn128/alt_bn128_init.hpp>
+#include <libff/algebra/curves/curve_utils.hpp>
+
+namespace libff {
+
+class alt_bn128_G1;
+std::ostream& operator<<(std::ostream &, const alt_bn128_G1&);
+std::istream& operator>>(std::istream &, alt_bn128_G1&);
+
+class alt_bn128_G1 {
+public:
+#ifdef PROFILE_OP_COUNTS
+    static long long add_cnt;
+    static long long dbl_cnt;
+#endif
+    static std::vector<size_t> wnaf_window_table;
+    static std::vector<size_t> fixed_base_exp_window_table;
+    static alt_bn128_G1 G1_zero;
+    static alt_bn128_G1 G1_one;
+
+    typedef alt_bn128_Fq base_field;
+    typedef alt_bn128_Fr scalar_field;
+
+    alt_bn128_Fq X, Y, Z;
+
+    // using Jacobian coordinates
+    alt_bn128_G1();
+    alt_bn128_G1(const alt_bn128_Fq& X, const alt_bn128_Fq& Y, const alt_bn128_Fq& Z) : X(X), Y(Y), Z(Z) {};
+
+    void print() const;
+    void print_coordinates() const;
+
+    void to_affine_coordinates();
+    void to_special();
+    bool is_special() const;
+
+    bool is_zero() const;
+
+    bool operator==(const alt_bn128_G1 &other) const;
+    bool operator!=(const alt_bn128_G1 &other) const;
+
+    alt_bn128_G1 operator+(const alt_bn128_G1 &other) const;
+    alt_bn128_G1 operator-() const;
+    alt_bn128_G1 operator-(const alt_bn128_G1 &other) const;
+
+    alt_bn128_G1 add(const alt_bn128_G1 &other) const;
+    alt_bn128_G1 mixed_add(const alt_bn128_G1 &other) const;
+    alt_bn128_G1 dbl() const;
+
+    bool is_well_formed() const;
+
+    static alt_bn128_G1 zero();
+    static alt_bn128_G1 one();
+    static alt_bn128_G1 random_element();
+
+    static size_t size_in_bits() { return base_field::size_in_bits() + 1; }
+    static bigint<base_field::num_limbs> base_field_char() { return base_field::field_char(); }
+    static bigint<scalar_field::num_limbs> order() { return scalar_field::field_char(); }
+
+    friend std::ostream& operator<<(std::ostream &out, const alt_bn128_G1 &g);
+    friend std::istream& operator>>(std::istream &in, alt_bn128_G1 &g);
+
+    static void batch_to_special_all_non_zeros(std::vector<alt_bn128_G1> &vec);
+};
+
+template<mp_size_t m>
+alt_bn128_G1 operator*(const bigint<m> &lhs, const alt_bn128_G1 &rhs)
+{
+    return scalar_mul<alt_bn128_G1, m>(rhs, lhs);
+}
+
+template<mp_size_t m, const bigint<m>& modulus_p>
+alt_bn128_G1 operator*(const Fp_model<m,modulus_p> &lhs, const alt_bn128_G1 &rhs)
+{
+    return scalar_mul<alt_bn128_G1, m>(rhs, lhs.as_bigint());
+}
+
+std::ostream& operator<<(std::ostream& out, const std::vector<alt_bn128_G1> &v);
+std::istream& operator>>(std::istream& in, std::vector<alt_bn128_G1> &v);
+
+} // libff
+#endif // ALT_BN128_G1_HPP_
diff --git a/src/libff/libff/algebra/curves/alt_bn128/alt_bn128_g2.cpp b/src/libff/libff/algebra/curves/alt_bn128/alt_bn128_g2.cpp
new file mode 100755
index 000000000..4e8c9944b
--- /dev/null
+++ b/src/libff/libff/algebra/curves/alt_bn128/alt_bn128_g2.cpp
@@ -0,0 +1,504 @@
+/** @file
+ *****************************************************************************
+ * @author     This file is part of libff, developed by SCIPR Lab
+ *             and contributors (see AUTHORS).
+ * @copyright  MIT license (see LICENSE file)
+ *****************************************************************************/
+
+#include <libff/algebra/curves/alt_bn128/alt_bn128_g2.hpp>
+
+namespace libff {
+
+#ifdef PROFILE_OP_COUNTS
+long long alt_bn128_G2::add_cnt = 0;
+long long alt_bn128_G2::dbl_cnt = 0;
+#endif
+
+std::vector<size_t> alt_bn128_G2::wnaf_window_table;
+std::vector<size_t> alt_bn128_G2::fixed_base_exp_window_table;
+alt_bn128_G2 alt_bn128_G2::G2_zero;
+alt_bn128_G2 alt_bn128_G2::G2_one;
+
+alt_bn128_G2::alt_bn128_G2()
+{
+    this->X = G2_zero.X;
+    this->Y = G2_zero.Y;
+    this->Z = G2_zero.Z;
+}
+
+alt_bn128_Fq2 alt_bn128_G2::mul_by_b(const alt_bn128_Fq2 &elt)
+{
+    return alt_bn128_Fq2(alt_bn128_twist_mul_by_b_c0 * elt.c0, alt_bn128_twist_mul_by_b_c1 * elt.c1);
+}
+
+void alt_bn128_G2::print() const
+{
+    if (this->is_zero())
+    {
+        printf("O\n");
+    }
+    else
+    {
+        alt_bn128_G2 copy(*this);
+        copy.to_affine_coordinates();
+        gmp_printf("(%Nd*z + %Nd , %Nd*z + %Nd)\n",
+                   copy.X.c1.as_bigint().data, alt_bn128_Fq::num_limbs,
+                   copy.X.c0.as_bigint().data, alt_bn128_Fq::num_limbs,
+                   copy.Y.c1.as_bigint().data, alt_bn128_Fq::num_limbs,
+                   copy.Y.c0.as_bigint().data, alt_bn128_Fq::num_limbs);
+    }
+}
+
+void alt_bn128_G2::print_coordinates() const
+{
+    if (this->is_zero())
+    {
+        printf("O\n");
+    }
+    else
+    {
+        gmp_printf("(%Nd*z + %Nd : %Nd*z + %Nd : %Nd*z + %Nd)\n",
+                   this->X.c1.as_bigint().data, alt_bn128_Fq::num_limbs,
+                   this->X.c0.as_bigint().data, alt_bn128_Fq::num_limbs,
+                   this->Y.c1.as_bigint().data, alt_bn128_Fq::num_limbs,
+                   this->Y.c0.as_bigint().data, alt_bn128_Fq::num_limbs,
+                   this->Z.c1.as_bigint().data, alt_bn128_Fq::num_limbs,
+                   this->Z.c0.as_bigint().data, alt_bn128_Fq::num_limbs);
+    }
+}
+
+void alt_bn128_G2::to_affine_coordinates()
+{
+    if (this->is_zero())
+    {
+        this->X = alt_bn128_Fq2::zero();
+        this->Y = alt_bn128_Fq2::one();
+        this->Z = alt_bn128_Fq2::zero();
+    }
+    else
+    {
+        alt_bn128_Fq2 Z_inv = Z.inverse();
+        alt_bn128_Fq2 Z2_inv = Z_inv.squared();
+        alt_bn128_Fq2 Z3_inv = Z2_inv * Z_inv;
+        this->X = this->X * Z2_inv;
+        this->Y = this->Y * Z3_inv;
+        this->Z = alt_bn128_Fq2::one();
+    }
+}
+
+void alt_bn128_G2::to_special()
+{
+    this->to_affine_coordinates();
+}
+
+bool alt_bn128_G2::is_special() const
+{
+    return (this->is_zero() || this->Z == alt_bn128_Fq2::one());
+}
+
+bool alt_bn128_G2::is_zero() const
+{
+    return (this->Z.is_zero());
+}
+
+bool alt_bn128_G2::operator==(const alt_bn128_G2 &other) const
+{
+    if (this->is_zero())
+    {
+        return other.is_zero();
+    }
+
+    if (other.is_zero())
+    {
+        return false;
+    }
+
+    /* now neither is O */
+
+    // using Jacobian coordinates so:
+    // (X1:Y1:Z1) = (X2:Y2:Z2)
+    // iff
+    // X1/Z1^2 == X2/Z2^2 and Y1/Z1^3 == Y2/Z2^3
+    // iff
+    // X1 * Z2^2 == X2 * Z1^2 and Y1 * Z2^3 == Y2 * Z1^3
+
+    alt_bn128_Fq2 Z1_squared = (this->Z).squared();
+    alt_bn128_Fq2 Z2_squared = (other.Z).squared();
+
+    if ((this->X * Z2_squared) != (other.X * Z1_squared))
+    {
+        return false;
+    }
+
+    alt_bn128_Fq2 Z1_cubed = (this->Z) * Z1_squared;
+    alt_bn128_Fq2 Z2_cubed = (other.Z) * Z2_squared;
+
+    if ((this->Y * Z2_cubed) != (other.Y * Z1_cubed))
+    {
+        return false;
+    }
+
+    return true;
+}
+
+bool alt_bn128_G2::operator!=(const alt_bn128_G2& other) const
+{
+    return !(operator==(other));
+}
+
+alt_bn128_G2 alt_bn128_G2::operator+(const alt_bn128_G2 &other) const
+{
+    // handle special cases having to do with O
+    if (this->is_zero())
+    {
+        return other;
+    }
+
+    if (other.is_zero())
+    {
+        return *this;
+    }
+
+    // no need to handle points of order 2,4
+    // (they cannot exist in a prime-order subgroup)
+
+    // check for doubling case
+
+    // using Jacobian coordinates so:
+    // (X1:Y1:Z1) = (X2:Y2:Z2)
+    // iff
+    // X1/Z1^2 == X2/Z2^2 and Y1/Z1^3 == Y2/Z2^3
+    // iff
+    // X1 * Z2^2 == X2 * Z1^2 and Y1 * Z2^3 == Y2 * Z1^3
+
+    alt_bn128_Fq2 Z1Z1 = (this->Z).squared();
+    alt_bn128_Fq2 Z2Z2 = (other.Z).squared();
+
+    alt_bn128_Fq2 U1 = this->X * Z2Z2;
+    alt_bn128_Fq2 U2 = other.X * Z1Z1;
+
+    alt_bn128_Fq2 Z1_cubed = (this->Z) * Z1Z1;
+    alt_bn128_Fq2 Z2_cubed = (other.Z) * Z2Z2;
+
+    alt_bn128_Fq2 S1 = (this->Y) * Z2_cubed;      // S1 = Y1 * Z2 * Z2Z2
+    alt_bn128_Fq2 S2 = (other.Y) * Z1_cubed;      // S2 = Y2 * Z1 * Z1Z1
+
+    if (U1 == U2 && S1 == S2)
+    {
+        // dbl case; nothing of above can be reused
+        return this->dbl();
+    }
+
+    // rest of add case
+    alt_bn128_Fq2 H = U2 - U1;                            // H = U2-U1
+    alt_bn128_Fq2 S2_minus_S1 = S2-S1;
+    alt_bn128_Fq2 I = (H+H).squared();                    // I = (2 * H)^2
+    alt_bn128_Fq2 J = H * I;                              // J = H * I
+    alt_bn128_Fq2 r = S2_minus_S1 + S2_minus_S1;          // r = 2 * (S2-S1)
+    alt_bn128_Fq2 V = U1 * I;                             // V = U1 * I
+    alt_bn128_Fq2 X3 = r.squared() - J - (V+V);           // X3 = r^2 - J - 2 * V
+    alt_bn128_Fq2 S1_J = S1 * J;
+    alt_bn128_Fq2 Y3 = r * (V-X3) - (S1_J+S1_J);          // Y3 = r * (V-X3)-2 S1 J
+    alt_bn128_Fq2 Z3 = ((this->Z+other.Z).squared()-Z1Z1-Z2Z2) * H; // Z3 = ((Z1+Z2)^2-Z1Z1-Z2Z2) * H
+
+    return alt_bn128_G2(X3, Y3, Z3);
+}
+
+alt_bn128_G2 alt_bn128_G2::operator-() const
+{
+    return alt_bn128_G2(this->X, -(this->Y), this->Z);
+}
+
+
+alt_bn128_G2 alt_bn128_G2::operator-(const alt_bn128_G2 &other) const
+{
+    return (*this) + (-other);
+}
+
+alt_bn128_G2 alt_bn128_G2::add(const alt_bn128_G2 &other) const
+{
+    // handle special cases having to do with O
+    if (this->is_zero())
+    {
+        return other;
+    }
+
+    if (other.is_zero())
+    {
+        return *this;
+    }
+
+    // no need to handle points of order 2,4
+    // (they cannot exist in a prime-order subgroup)
+
+    // handle double case
+    if (this->operator==(other))
+    {
+        return this->dbl();
+    }
+
+#ifdef PROFILE_OP_COUNTS
+    this->add_cnt++;
+#endif
+    // NOTE: does not handle O and pts of order 2,4
+    // http://www.hyperelliptic.org/EFD/g1p/auto-shortw-projective.html#addition-add-1998-cmo-2
+
+    alt_bn128_Fq2 Z1Z1 = (this->Z).squared();             // Z1Z1 = Z1^2
+    alt_bn128_Fq2 Z2Z2 = (other.Z).squared();             // Z2Z2 = Z2^2
+    alt_bn128_Fq2 U1 = (this->X) * Z2Z2;                  // U1 = X1 * Z2Z2
+    alt_bn128_Fq2 U2 = (other.X) * Z1Z1;                  // U2 = X2 * Z1Z1
+    alt_bn128_Fq2 S1 = (this->Y) * (other.Z) * Z2Z2;      // S1 = Y1 * Z2 * Z2Z2
+    alt_bn128_Fq2 S2 = (other.Y) * (this->Z) * Z1Z1;      // S2 = Y2 * Z1 * Z1Z1
+    alt_bn128_Fq2 H = U2 - U1;                            // H = U2-U1
+    alt_bn128_Fq2 S2_minus_S1 = S2-S1;
+    alt_bn128_Fq2 I = (H+H).squared();                    // I = (2 * H)^2
+    alt_bn128_Fq2 J = H * I;                              // J = H * I
+    alt_bn128_Fq2 r = S2_minus_S1 + S2_minus_S1;          // r = 2 * (S2-S1)
+    alt_bn128_Fq2 V = U1 * I;                             // V = U1 * I
+    alt_bn128_Fq2 X3 = r.squared() - J - (V+V);           // X3 = r^2 - J - 2 * V
+    alt_bn128_Fq2 S1_J = S1 * J;
+    alt_bn128_Fq2 Y3 = r * (V-X3) - (S1_J+S1_J);          // Y3 = r * (V-X3)-2 S1 J
+    alt_bn128_Fq2 Z3 = ((this->Z+other.Z).squared()-Z1Z1-Z2Z2) * H; // Z3 = ((Z1+Z2)^2-Z1Z1-Z2Z2) * H
+
+    return alt_bn128_G2(X3, Y3, Z3);
+}
+
+alt_bn128_G2 alt_bn128_G2::mixed_add(const alt_bn128_G2 &other) const
+{
+#ifdef DEBUG
+    assert(other.is_special());
+#endif
+
+    // handle special cases having to do with O
+    if (this->is_zero())
+    {
+        return other;
+    }
+
+    if (other.is_zero())
+    {
+        return *this;
+    }
+
+    // no need to handle points of order 2,4
+    // (they cannot exist in a prime-order subgroup)
+
+    // check for doubling case
+
+    // using Jacobian coordinates so:
+    // (X1:Y1:Z1) = (X2:Y2:Z2)
+    // iff
+    // X1/Z1^2 == X2/Z2^2 and Y1/Z1^3 == Y2/Z2^3
+    // iff
+    // X1 * Z2^2 == X2 * Z1^2 and Y1 * Z2^3 == Y2 * Z1^3
+
+    // we know that Z2 = 1
+
+    const alt_bn128_Fq2 Z1Z1 = (this->Z).squared();
+
+    const alt_bn128_Fq2 &U1 = this->X;
+    const alt_bn128_Fq2 U2 = other.X * Z1Z1;
+
+    const alt_bn128_Fq2 Z1_cubed = (this->Z) * Z1Z1;
+
+    const alt_bn128_Fq2 &S1 = (this->Y);                // S1 = Y1 * Z2 * Z2Z2
+    const alt_bn128_Fq2 S2 = (other.Y) * Z1_cubed;      // S2 = Y2 * Z1 * Z1Z1
+
+    if (U1 == U2 && S1 == S2)
+    {
+        // dbl case; nothing of above can be reused
+        return this->dbl();
+    }
+
+#ifdef PROFILE_OP_COUNTS
+    this->add_cnt++;
+#endif
+
+    // NOTE: does not handle O and pts of order 2,4
+    // http://www.hyperelliptic.org/EFD/g1p/auto-shortw-jacobian-0.html#addition-madd-2007-bl
+    alt_bn128_Fq2 H = U2-(this->X);                         // H = U2-X1
+    alt_bn128_Fq2 HH = H.squared() ;                        // HH = H&2
+    alt_bn128_Fq2 I = HH+HH;                                // I = 4*HH
+    I = I + I;
+    alt_bn128_Fq2 J = H*I;                                  // J = H*I
+    alt_bn128_Fq2 r = S2-(this->Y);                         // r = 2*(S2-Y1)
+    r = r + r;
+    alt_bn128_Fq2 V = (this->X) * I ;                       // V = X1*I
+    alt_bn128_Fq2 X3 = r.squared()-J-V-V;                   // X3 = r^2-J-2*V
+    alt_bn128_Fq2 Y3 = (this->Y)*J;                         // Y3 = r*(V-X3)-2*Y1*J
+    Y3 = r*(V-X3) - Y3 - Y3;
+    alt_bn128_Fq2 Z3 = ((this->Z)+H).squared() - Z1Z1 - HH; // Z3 = (Z1+H)^2-Z1Z1-HH
+
+    return alt_bn128_G2(X3, Y3, Z3);
+}
+
+alt_bn128_G2 alt_bn128_G2::dbl() const
+{
+#ifdef PROFILE_OP_COUNTS
+    this->dbl_cnt++;
+#endif
+    // handle point at infinity
+    if (this->is_zero())
+    {
+        return (*this);
+    }
+
+    // NOTE: does not handle O and pts of order 2,4
+    // http://www.hyperelliptic.org/EFD/g1p/auto-shortw-projective.html#doubling-dbl-2007-bl
+
+    alt_bn128_Fq2 A = (this->X).squared();         // A = X1^2
+    alt_bn128_Fq2 B = (this->Y).squared();        // B = Y1^2
+    alt_bn128_Fq2 C = B.squared();                // C = B^2
+    alt_bn128_Fq2 D = (this->X + B).squared() - A - C;
+    D = D+D;                        // D = 2 * ((X1 + B)^2 - A - C)
+    alt_bn128_Fq2 E = A + A + A;                  // E = 3 * A
+    alt_bn128_Fq2 F = E.squared();                // F = E^2
+    alt_bn128_Fq2 X3 = F - (D+D);                 // X3 = F - 2 D
+    alt_bn128_Fq2 eightC = C+C;
+    eightC = eightC + eightC;
+    eightC = eightC + eightC;
+    alt_bn128_Fq2 Y3 = E * (D - X3) - eightC;     // Y3 = E * (D - X3) - 8 * C
+    alt_bn128_Fq2 Y1Z1 = (this->Y)*(this->Z);
+    alt_bn128_Fq2 Z3 = Y1Z1 + Y1Z1;               // Z3 = 2 * Y1 * Z1
+
+    return alt_bn128_G2(X3, Y3, Z3);
+}
+
+alt_bn128_G2 alt_bn128_G2::mul_by_q() const
+{
+    return alt_bn128_G2(alt_bn128_twist_mul_by_q_X * (this->X).Frobenius_map(1),
+                      alt_bn128_twist_mul_by_q_Y * (this->Y).Frobenius_map(1),
+                      (this->Z).Frobenius_map(1));
+}
+
+bool alt_bn128_G2::is_well_formed() const
+{
+    if (this->is_zero())
+    {
+        return true;
+    }
+    else
+    {
+        /*
+          y^2 = x^3 + b
+
+          We are using Jacobian coordinates, so equation we need to check is actually
+
+          (y/z^3)^2 = (x/z^2)^3 + b
+          y^2 / z^6 = x^3 / z^6 + b
+          y^2 = x^3 + b z^6
+        */
+        alt_bn128_Fq2 X2 = this->X.squared();
+        alt_bn128_Fq2 Y2 = this->Y.squared();
+        alt_bn128_Fq2 Z2 = this->Z.squared();
+
+        alt_bn128_Fq2 X3 = this->X * X2;
+        alt_bn128_Fq2 Z3 = this->Z * Z2;
+        alt_bn128_Fq2 Z6 = Z3.squared();
+
+        return (Y2 == X3 + alt_bn128_twist_coeff_b * Z6);
+    }
+}
+
+alt_bn128_G2 alt_bn128_G2::zero()
+{
+    return G2_zero;
+}
+
+alt_bn128_G2 alt_bn128_G2::one()
+{
+    return G2_one;
+}
+
+alt_bn128_G2 alt_bn128_G2::random_element()
+{
+    return (alt_bn128_Fr::random_element().as_bigint()) * G2_one;
+}
+
+std::ostream& operator<<(std::ostream &out, const alt_bn128_G2 &g)
+{
+    alt_bn128_G2 copy(g);
+    copy.to_affine_coordinates();
+    out << (copy.is_zero() ? 1 : 0) << OUTPUT_SEPARATOR;
+#ifdef NO_PT_COMPRESSION
+    out << copy.X << OUTPUT_SEPARATOR << copy.Y;
+#else
+    /* storing LSB of Y */
+    out << copy.X << OUTPUT_SEPARATOR << (copy.Y.c0.as_bigint().data[0] & 1);
+#endif
+
+    return out;
+}
+
+std::istream& operator>>(std::istream &in, alt_bn128_G2 &g)
+{
+    char is_zero;
+    alt_bn128_Fq2 tX, tY;
+
+#ifdef NO_PT_COMPRESSION
+    in >> is_zero >> tX >> tY;
+    is_zero -= '0';
+#else
+    in.read((char*)&is_zero, 1); // this reads is_zero;
+    is_zero -= '0';
+    consume_OUTPUT_SEPARATOR(in);
+
+    unsigned char Y_lsb;
+    in >> tX;
+    consume_OUTPUT_SEPARATOR(in);
+    in.read((char*)&Y_lsb, 1);
+    Y_lsb -= '0';
+
+    // y = +/- sqrt(x^3 + b)
+    if (!is_zero)
+    {
+        alt_bn128_Fq2 tX2 = tX.squared();
+        alt_bn128_Fq2 tY2 = tX2 * tX + alt_bn128_twist_coeff_b;
+        tY = tY2.sqrt();
+
+        if ((tY.c0.as_bigint().data[0] & 1) != Y_lsb)
+        {
+            tY = -tY;
+        }
+    }
+#endif
+    // using projective coordinates
+    if (!is_zero)
+    {
+        g.X = tX;
+        g.Y = tY;
+        g.Z = alt_bn128_Fq2::one();
+    }
+    else
+    {
+        g = alt_bn128_G2::zero();
+    }
+
+    return in;
+}
+
+void alt_bn128_G2::batch_to_special_all_non_zeros(std::vector<alt_bn128_G2> &vec)
+{
+    std::vector<alt_bn128_Fq2> Z_vec;
+    Z_vec.reserve(vec.size());
+
+    for (auto &el: vec)
+    {
+        Z_vec.emplace_back(el.Z);
+    }
+    batch_invert<alt_bn128_Fq2>(Z_vec);
+
+    const alt_bn128_Fq2 one = alt_bn128_Fq2::one();
+
+    for (size_t i = 0; i < vec.size(); ++i)
+    {
+        alt_bn128_Fq2 Z2 = Z_vec[i].squared();
+        alt_bn128_Fq2 Z3 = Z_vec[i] * Z2;
+
+        vec[i].X = vec[i].X * Z2;
+        vec[i].Y = vec[i].Y * Z3;
+        vec[i].Z = one;
+    }
+}
+
+} // libff
diff --git a/src/libff/libff/algebra/curves/alt_bn128/alt_bn128_g2.hpp b/src/libff/libff/algebra/curves/alt_bn128/alt_bn128_g2.hpp
new file mode 100755
index 000000000..2b628ebf7
--- /dev/null
+++ b/src/libff/libff/algebra/curves/alt_bn128/alt_bn128_g2.hpp
@@ -0,0 +1,95 @@
+/** @file
+ *****************************************************************************
+ * @author     This file is part of libff, developed by SCIPR Lab
+ *             and contributors (see AUTHORS).
+ * @copyright  MIT license (see LICENSE file)
+ *****************************************************************************/
+
+#ifndef ALT_BN128_G2_HPP_
+#define ALT_BN128_G2_HPP_
+#include <vector>
+
+#include <libff/algebra/curves/alt_bn128/alt_bn128_init.hpp>
+#include <libff/algebra/curves/curve_utils.hpp>
+
+namespace libff {
+
+class alt_bn128_G2;
+std::ostream& operator<<(std::ostream &, const alt_bn128_G2&);
+std::istream& operator>>(std::istream &, alt_bn128_G2&);
+
+class alt_bn128_G2 {
+public:
+#ifdef PROFILE_OP_COUNTS
+    static long long add_cnt;
+    static long long dbl_cnt;
+#endif
+    static std::vector<size_t> wnaf_window_table;
+    static std::vector<size_t> fixed_base_exp_window_table;
+    static alt_bn128_G2 G2_zero;
+    static alt_bn128_G2 G2_one;
+
+    typedef alt_bn128_Fq base_field;
+    typedef alt_bn128_Fq2 twist_field;
+    typedef alt_bn128_Fr scalar_field;
+
+    alt_bn128_Fq2 X, Y, Z;
+
+    // using Jacobian coordinates
+    alt_bn128_G2();
+    alt_bn128_G2(const alt_bn128_Fq2& X, const alt_bn128_Fq2& Y, const alt_bn128_Fq2& Z) : X(X), Y(Y), Z(Z) {};
+
+    static alt_bn128_Fq2 mul_by_b(const alt_bn128_Fq2 &elt);
+
+    void print() const;
+    void print_coordinates() const;
+
+    void to_affine_coordinates();
+    void to_special();
+    bool is_special() const;
+
+    bool is_zero() const;
+
+    bool operator==(const alt_bn128_G2 &other) const;
+    bool operator!=(const alt_bn128_G2 &other) const;
+
+    alt_bn128_G2 operator+(const alt_bn128_G2 &other) const;
+    alt_bn128_G2 operator-() const;
+    alt_bn128_G2 operator-(const alt_bn128_G2 &other) const;
+
+    alt_bn128_G2 add(const alt_bn128_G2 &other) const;
+    alt_bn128_G2 mixed_add(const alt_bn128_G2 &other) const;
+    alt_bn128_G2 dbl() const;
+    alt_bn128_G2 mul_by_q() const;
+
+    bool is_well_formed() const;
+
+    static alt_bn128_G2 zero();
+    static alt_bn128_G2 one();
+    static alt_bn128_G2 random_element();
+
+    static size_t size_in_bits() { return twist_field::size_in_bits() + 1; }
+    static bigint<base_field::num_limbs> base_field_char() { return base_field::field_char(); }
+    static bigint<scalar_field::num_limbs> order() { return scalar_field::field_char(); }
+
+    friend std::ostream& operator<<(std::ostream &out, const alt_bn128_G2 &g);
+    friend std::istream& operator>>(std::istream &in, alt_bn128_G2 &g);
+
+    static void batch_to_special_all_non_zeros(std::vector<alt_bn128_G2> &vec);
+};
+
+template<mp_size_t m>
+alt_bn128_G2 operator*(const bigint<m> &lhs, const alt_bn128_G2 &rhs)
+{
+    return scalar_mul<alt_bn128_G2, m>(rhs, lhs);
+}
+
+template<mp_size_t m, const bigint<m>& modulus_p>
+alt_bn128_G2 operator*(const Fp_model<m,modulus_p> &lhs, const alt_bn128_G2 &rhs)
+{
+    return scalar_mul<alt_bn128_G2, m>(rhs, lhs.as_bigint());
+}
+
+
+} // libff
+#endif // ALT_BN128_G2_HPP_
diff --git a/src/libff/libff/algebra/curves/alt_bn128/alt_bn128_init.cpp b/src/libff/libff/algebra/curves/alt_bn128/alt_bn128_init.cpp
new file mode 100755
index 000000000..64201f30c
--- /dev/null
+++ b/src/libff/libff/algebra/curves/alt_bn128/alt_bn128_init.cpp
@@ -0,0 +1,275 @@
+/** @file
+ *****************************************************************************
+ * @author     This file is part of libff, developed by SCIPR Lab
+ *             and contributors (see AUTHORS).
+ * @copyright  MIT license (see LICENSE file)
+ *****************************************************************************/
+
+#include <libff/algebra/curves/alt_bn128/alt_bn128_g1.hpp>
+#include <libff/algebra/curves/alt_bn128/alt_bn128_g2.hpp>
+#include <libff/algebra/curves/alt_bn128/alt_bn128_init.hpp>
+
+namespace libff {
+
+bigint<alt_bn128_r_limbs> alt_bn128_modulus_r;
+bigint<alt_bn128_q_limbs> alt_bn128_modulus_q;
+
+alt_bn128_Fq alt_bn128_coeff_b;
+alt_bn128_Fq2 alt_bn128_twist;
+alt_bn128_Fq2 alt_bn128_twist_coeff_b;
+alt_bn128_Fq alt_bn128_twist_mul_by_b_c0;
+alt_bn128_Fq alt_bn128_twist_mul_by_b_c1;
+alt_bn128_Fq2 alt_bn128_twist_mul_by_q_X;
+alt_bn128_Fq2 alt_bn128_twist_mul_by_q_Y;
+
+bigint<alt_bn128_q_limbs> alt_bn128_ate_loop_count;
+bool alt_bn128_ate_is_loop_count_neg;
+bigint<12*alt_bn128_q_limbs> alt_bn128_final_exponent;
+bigint<alt_bn128_q_limbs> alt_bn128_final_exponent_z;
+bool alt_bn128_final_exponent_is_z_neg;
+
+void init_alt_bn128_params()
+{
+    typedef bigint<alt_bn128_r_limbs> bigint_r;
+    typedef bigint<alt_bn128_q_limbs> bigint_q;
+
+    assert(sizeof(mp_limb_t) == 8 || sizeof(mp_limb_t) == 4); // Montgomery assumes this
+
+    /* parameters for scalar field Fr */
+
+    alt_bn128_modulus_r = bigint_r("21888242871839275222246405745257275088548364400416034343698204186575808495617");
+    assert(alt_bn128_Fr::modulus_is_valid());
+    if (sizeof(mp_limb_t) == 8)
+    {
+        alt_bn128_Fr::Rsquared = bigint_r("944936681149208446651664254269745548490766851729442924617792859073125903783");
+        alt_bn128_Fr::Rcubed = bigint_r("5866548545943845227489894872040244720403868105578784105281690076696998248512");
+        alt_bn128_Fr::inv = 0xc2e1f593efffffff;
+    }
+    if (sizeof(mp_limb_t) == 4)
+    {
+        alt_bn128_Fr::Rsquared = bigint_r("944936681149208446651664254269745548490766851729442924617792859073125903783");
+        alt_bn128_Fr::Rcubed = bigint_r("5866548545943845227489894872040244720403868105578784105281690076696998248512");
+        alt_bn128_Fr::inv = 0xefffffff;
+    }
+    alt_bn128_Fr::num_bits = 254;
+    alt_bn128_Fr::euler = bigint_r("10944121435919637611123202872628637544274182200208017171849102093287904247808");
+    alt_bn128_Fr::s = 28;
+    alt_bn128_Fr::t = bigint_r("81540058820840996586704275553141814055101440848469862132140264610111");
+    alt_bn128_Fr::t_minus_1_over_2 = bigint_r("40770029410420498293352137776570907027550720424234931066070132305055");
+    alt_bn128_Fr::multiplicative_generator = alt_bn128_Fr("5");
+    alt_bn128_Fr::root_of_unity = alt_bn128_Fr("19103219067921713944291392827692070036145651957329286315305642004821462161904");
+    alt_bn128_Fr::nqr = alt_bn128_Fr("5");
+    alt_bn128_Fr::nqr_to_t = alt_bn128_Fr("19103219067921713944291392827692070036145651957329286315305642004821462161904");
+
+    /* parameters for base field Fq */
+
+    alt_bn128_modulus_q = bigint_q("21888242871839275222246405745257275088696311157297823662689037894645226208583");
+    assert(alt_bn128_Fq::modulus_is_valid());
+    if (sizeof(mp_limb_t) == 8)
+    {
+        alt_bn128_Fq::Rsquared = bigint_q("3096616502983703923843567936837374451735540968419076528771170197431451843209");
+        alt_bn128_Fq::Rcubed = bigint_q("14921786541159648185948152738563080959093619838510245177710943249661917737183");
+        alt_bn128_Fq::inv = 0x87d20782e4866389;
+    }
+    if (sizeof(mp_limb_t) == 4)
+    {
+        alt_bn128_Fq::Rsquared = bigint_q("3096616502983703923843567936837374451735540968419076528771170197431451843209");
+        alt_bn128_Fq::Rcubed = bigint_q("14921786541159648185948152738563080959093619838510245177710943249661917737183");
+        alt_bn128_Fq::inv = 0xe4866389;
+    }
+    alt_bn128_Fq::num_bits = 254;
+    alt_bn128_Fq::euler = bigint_q("10944121435919637611123202872628637544348155578648911831344518947322613104291");
+    alt_bn128_Fq::s = 1;
+    alt_bn128_Fq::t = bigint_q("10944121435919637611123202872628637544348155578648911831344518947322613104291");
+    alt_bn128_Fq::t_minus_1_over_2 = bigint_q("5472060717959818805561601436314318772174077789324455915672259473661306552145");
+    alt_bn128_Fq::multiplicative_generator = alt_bn128_Fq("3");
+    alt_bn128_Fq::root_of_unity = alt_bn128_Fq("21888242871839275222246405745257275088696311157297823662689037894645226208582");
+    alt_bn128_Fq::nqr = alt_bn128_Fq("3");
+    alt_bn128_Fq::nqr_to_t = alt_bn128_Fq("21888242871839275222246405745257275088696311157297823662689037894645226208582");
+
+    /* parameters for twist field Fq2 */
+    alt_bn128_Fq2::euler = bigint<2*alt_bn128_q_limbs>("239547588008311421220994022608339370399626158265550411218223901127035046843189118723920525909718935985594116157406550130918127817069793474323196511433944");
+    alt_bn128_Fq2::s = 4;
+    alt_bn128_Fq2::t = bigint<2*alt_bn128_q_limbs>("29943448501038927652624252826042421299953269783193801402277987640879380855398639840490065738714866998199264519675818766364765977133724184290399563929243");
+    alt_bn128_Fq2::t_minus_1_over_2 = bigint<2*alt_bn128_q_limbs>("14971724250519463826312126413021210649976634891596900701138993820439690427699319920245032869357433499099632259837909383182382988566862092145199781964621");
+    alt_bn128_Fq2::non_residue = alt_bn128_Fq("21888242871839275222246405745257275088696311157297823662689037894645226208582");
+    alt_bn128_Fq2::nqr = alt_bn128_Fq2(alt_bn128_Fq("2"),alt_bn128_Fq("1"));
+    alt_bn128_Fq2::nqr_to_t = alt_bn128_Fq2(alt_bn128_Fq("5033503716262624267312492558379982687175200734934877598599011485707452665730"),alt_bn128_Fq("314498342015008975724433667930697407966947188435857772134235984660852259084"));
+    alt_bn128_Fq2::Frobenius_coeffs_c1[0] = alt_bn128_Fq("1");
+    alt_bn128_Fq2::Frobenius_coeffs_c1[1] = alt_bn128_Fq("21888242871839275222246405745257275088696311157297823662689037894645226208582");
+
+    /* parameters for Fq6 */
+    alt_bn128_Fq6::non_residue = alt_bn128_Fq2(alt_bn128_Fq("9"),alt_bn128_Fq("1"));
+    alt_bn128_Fq6::Frobenius_coeffs_c1[0] = alt_bn128_Fq2(alt_bn128_Fq("1"),alt_bn128_Fq("0"));
+    alt_bn128_Fq6::Frobenius_coeffs_c1[1] = alt_bn128_Fq2(alt_bn128_Fq("21575463638280843010398324269430826099269044274347216827212613867836435027261"),alt_bn128_Fq("10307601595873709700152284273816112264069230130616436755625194854815875713954"));
+    alt_bn128_Fq6::Frobenius_coeffs_c1[2] = alt_bn128_Fq2(alt_bn128_Fq("21888242871839275220042445260109153167277707414472061641714758635765020556616"),alt_bn128_Fq("0"));
+    alt_bn128_Fq6::Frobenius_coeffs_c1[3] = alt_bn128_Fq2(alt_bn128_Fq("3772000881919853776433695186713858239009073593817195771773381919316419345261"),alt_bn128_Fq("2236595495967245188281701248203181795121068902605861227855261137820944008926"));
+    alt_bn128_Fq6::Frobenius_coeffs_c1[4] = alt_bn128_Fq2(alt_bn128_Fq("2203960485148121921418603742825762020974279258880205651966"),alt_bn128_Fq("0"));
+    alt_bn128_Fq6::Frobenius_coeffs_c1[5] = alt_bn128_Fq2(alt_bn128_Fq("18429021223477853657660792034369865839114504446431234726392080002137598044644"),alt_bn128_Fq("9344045779998320333812420223237981029506012124075525679208581902008406485703"));
+    alt_bn128_Fq6::Frobenius_coeffs_c2[0] = alt_bn128_Fq2(alt_bn128_Fq("1"),alt_bn128_Fq("0"));
+    alt_bn128_Fq6::Frobenius_coeffs_c2[1] = alt_bn128_Fq2(alt_bn128_Fq("2581911344467009335267311115468803099551665605076196740867805258568234346338"),alt_bn128_Fq("19937756971775647987995932169929341994314640652964949448313374472400716661030"));
+    alt_bn128_Fq6::Frobenius_coeffs_c2[2] = alt_bn128_Fq2(alt_bn128_Fq("2203960485148121921418603742825762020974279258880205651966"),alt_bn128_Fq("0"));
+    alt_bn128_Fq6::Frobenius_coeffs_c2[3] = alt_bn128_Fq2(alt_bn128_Fq("5324479202449903542726783395506214481928257762400643279780343368557297135718"),alt_bn128_Fq("16208900380737693084919495127334387981393726419856888799917914180988844123039"));
+    alt_bn128_Fq6::Frobenius_coeffs_c2[4] = alt_bn128_Fq2(alt_bn128_Fq("21888242871839275220042445260109153167277707414472061641714758635765020556616"),alt_bn128_Fq("0"));
+    alt_bn128_Fq6::Frobenius_coeffs_c2[5] = alt_bn128_Fq2(alt_bn128_Fq("13981852324922362344252311234282257507216387789820983642040889267519694726527"),alt_bn128_Fq("7629828391165209371577384193250820201684255241773809077146787135900891633097"));
+
+    /* parameters for Fq12 */
+
+    alt_bn128_Fq12::non_residue = alt_bn128_Fq2(alt_bn128_Fq("9"),alt_bn128_Fq("1"));
+    alt_bn128_Fq12::Frobenius_coeffs_c1[0]  = alt_bn128_Fq2(alt_bn128_Fq("1"),alt_bn128_Fq("0"));
+    alt_bn128_Fq12::Frobenius_coeffs_c1[1]  = alt_bn128_Fq2(alt_bn128_Fq("8376118865763821496583973867626364092589906065868298776909617916018768340080"),alt_bn128_Fq("16469823323077808223889137241176536799009286646108169935659301613961712198316"));
+    alt_bn128_Fq12::Frobenius_coeffs_c1[2]  = alt_bn128_Fq2(alt_bn128_Fq("21888242871839275220042445260109153167277707414472061641714758635765020556617"),alt_bn128_Fq("0"));
+    alt_bn128_Fq12::Frobenius_coeffs_c1[3]  = alt_bn128_Fq2(alt_bn128_Fq("11697423496358154304825782922584725312912383441159505038794027105778954184319"),alt_bn128_Fq("303847389135065887422783454877609941456349188919719272345083954437860409601"));
+    alt_bn128_Fq12::Frobenius_coeffs_c1[4]  = alt_bn128_Fq2(alt_bn128_Fq("21888242871839275220042445260109153167277707414472061641714758635765020556616"),alt_bn128_Fq("0"));
+    alt_bn128_Fq12::Frobenius_coeffs_c1[5]  = alt_bn128_Fq2(alt_bn128_Fq("3321304630594332808241809054958361220322477375291206261884409189760185844239"),alt_bn128_Fq("5722266937896532885780051958958348231143373700109372999374820235121374419868"));
+    alt_bn128_Fq12::Frobenius_coeffs_c1[6]  = alt_bn128_Fq2(alt_bn128_Fq("21888242871839275222246405745257275088696311157297823662689037894645226208582"),alt_bn128_Fq("0"));
+    alt_bn128_Fq12::Frobenius_coeffs_c1[7]  = alt_bn128_Fq2(alt_bn128_Fq("13512124006075453725662431877630910996106405091429524885779419978626457868503"),alt_bn128_Fq("5418419548761466998357268504080738289687024511189653727029736280683514010267"));
+    alt_bn128_Fq12::Frobenius_coeffs_c1[8]  = alt_bn128_Fq2(alt_bn128_Fq("2203960485148121921418603742825762020974279258880205651966"),alt_bn128_Fq("0"));
+    alt_bn128_Fq12::Frobenius_coeffs_c1[9]  = alt_bn128_Fq2(alt_bn128_Fq("10190819375481120917420622822672549775783927716138318623895010788866272024264"),alt_bn128_Fq("21584395482704209334823622290379665147239961968378104390343953940207365798982"));
+    alt_bn128_Fq12::Frobenius_coeffs_c1[10] = alt_bn128_Fq2(alt_bn128_Fq("2203960485148121921418603742825762020974279258880205651967"),alt_bn128_Fq("0"));
+    alt_bn128_Fq12::Frobenius_coeffs_c1[11] = alt_bn128_Fq2(alt_bn128_Fq("18566938241244942414004596690298913868373833782006617400804628704885040364344"),alt_bn128_Fq("16165975933942742336466353786298926857552937457188450663314217659523851788715"));
+
+    /* choice of short Weierstrass curve and its twist */
+
+    alt_bn128_coeff_b = alt_bn128_Fq("3");
+    alt_bn128_twist = alt_bn128_Fq2(alt_bn128_Fq("9"), alt_bn128_Fq("1"));
+    alt_bn128_twist_coeff_b = alt_bn128_coeff_b * alt_bn128_twist.inverse();
+    alt_bn128_twist_mul_by_b_c0 = alt_bn128_coeff_b * alt_bn128_Fq2::non_residue;
+    alt_bn128_twist_mul_by_b_c1 = alt_bn128_coeff_b * alt_bn128_Fq2::non_residue;
+    alt_bn128_twist_mul_by_q_X = alt_bn128_Fq2(alt_bn128_Fq("21575463638280843010398324269430826099269044274347216827212613867836435027261"),
+                                           alt_bn128_Fq("10307601595873709700152284273816112264069230130616436755625194854815875713954"));
+    alt_bn128_twist_mul_by_q_Y = alt_bn128_Fq2(alt_bn128_Fq("2821565182194536844548159561693502659359617185244120367078079554186484126554"),
+                                           alt_bn128_Fq("3505843767911556378687030309984248845540243509899259641013678093033130930403"));
+
+    /* choice of group G1 */
+    alt_bn128_G1::G1_zero = alt_bn128_G1(alt_bn128_Fq::zero(),
+                                     alt_bn128_Fq::one(),
+                                     alt_bn128_Fq::zero());
+    alt_bn128_G1::G1_one = alt_bn128_G1(alt_bn128_Fq("1"),
+                                    alt_bn128_Fq("2"),
+                                    alt_bn128_Fq::one());
+    alt_bn128_G1::wnaf_window_table.resize(0);
+    alt_bn128_G1::wnaf_window_table.push_back(11);
+    alt_bn128_G1::wnaf_window_table.push_back(24);
+    alt_bn128_G1::wnaf_window_table.push_back(60);
+    alt_bn128_G1::wnaf_window_table.push_back(127);
+
+    alt_bn128_G1::fixed_base_exp_window_table.resize(0);
+    // window 1 is unbeaten in [-inf, 4.99]
+    alt_bn128_G1::fixed_base_exp_window_table.push_back(1);
+    // window 2 is unbeaten in [4.99, 10.99]
+    alt_bn128_G1::fixed_base_exp_window_table.push_back(5);
+    // window 3 is unbeaten in [10.99, 32.29]
+    alt_bn128_G1::fixed_base_exp_window_table.push_back(11);
+    // window 4 is unbeaten in [32.29, 55.23]
+    alt_bn128_G1::fixed_base_exp_window_table.push_back(32);
+    // window 5 is unbeaten in [55.23, 162.03]
+    alt_bn128_G1::fixed_base_exp_window_table.push_back(55);
+    // window 6 is unbeaten in [162.03, 360.15]
+    alt_bn128_G1::fixed_base_exp_window_table.push_back(162);
+    // window 7 is unbeaten in [360.15, 815.44]
+    alt_bn128_G1::fixed_base_exp_window_table.push_back(360);
+    // window 8 is unbeaten in [815.44, 2373.07]
+    alt_bn128_G1::fixed_base_exp_window_table.push_back(815);
+    // window 9 is unbeaten in [2373.07, 6977.75]
+    alt_bn128_G1::fixed_base_exp_window_table.push_back(2373);
+    // window 10 is unbeaten in [6977.75, 7122.23]
+    alt_bn128_G1::fixed_base_exp_window_table.push_back(6978);
+    // window 11 is unbeaten in [7122.23, 57818.46]
+    alt_bn128_G1::fixed_base_exp_window_table.push_back(7122);
+    // window 12 is never the best
+    alt_bn128_G1::fixed_base_exp_window_table.push_back(0);
+    // window 13 is unbeaten in [57818.46, 169679.14]
+    alt_bn128_G1::fixed_base_exp_window_table.push_back(57818);
+    // window 14 is never the best
+    alt_bn128_G1::fixed_base_exp_window_table.push_back(0);
+    // window 15 is unbeaten in [169679.14, 439758.91]
+    alt_bn128_G1::fixed_base_exp_window_table.push_back(169679);
+    // window 16 is unbeaten in [439758.91, 936073.41]
+    alt_bn128_G1::fixed_base_exp_window_table.push_back(439759);
+    // window 17 is unbeaten in [936073.41, 4666554.74]
+    alt_bn128_G1::fixed_base_exp_window_table.push_back(936073);
+    // window 18 is never the best
+    alt_bn128_G1::fixed_base_exp_window_table.push_back(0);
+    // window 19 is unbeaten in [4666554.74, 7580404.42]
+    alt_bn128_G1::fixed_base_exp_window_table.push_back(4666555);
+    // window 20 is unbeaten in [7580404.42, 34552892.20]
+    alt_bn128_G1::fixed_base_exp_window_table.push_back(7580404);
+    // window 21 is never the best
+    alt_bn128_G1::fixed_base_exp_window_table.push_back(0);
+    // window 22 is unbeaten in [34552892.20, inf]
+    alt_bn128_G1::fixed_base_exp_window_table.push_back(34552892);
+
+    /* choice of group G2 */
+
+    alt_bn128_G2::G2_zero = alt_bn128_G2(alt_bn128_Fq2::zero(),
+                                     alt_bn128_Fq2::one(),
+                                     alt_bn128_Fq2::zero());
+
+    alt_bn128_G2::G2_one = alt_bn128_G2(alt_bn128_Fq2(alt_bn128_Fq("10857046999023057135944570762232829481370756359578518086990519993285655852781"),
+                                                alt_bn128_Fq("11559732032986387107991004021392285783925812861821192530917403151452391805634")),
+                                    alt_bn128_Fq2(alt_bn128_Fq("8495653923123431417604973247489272438418190587263600148770280649306958101930"),
+                                                alt_bn128_Fq("4082367875863433681332203403145435568316851327593401208105741076214120093531")),
+                                    alt_bn128_Fq2::one());
+    alt_bn128_G2::wnaf_window_table.resize(0);
+    alt_bn128_G2::wnaf_window_table.push_back(5);
+    alt_bn128_G2::wnaf_window_table.push_back(15);
+    alt_bn128_G2::wnaf_window_table.push_back(39);
+    alt_bn128_G2::wnaf_window_table.push_back(109);
+
+    alt_bn128_G2::fixed_base_exp_window_table.resize(0);
+    // window 1 is unbeaten in [-inf, 5.10]
+    alt_bn128_G2::fixed_base_exp_window_table.push_back(1);
+    // window 2 is unbeaten in [5.10, 10.43]
+    alt_bn128_G2::fixed_base_exp_window_table.push_back(5);
+    // window 3 is unbeaten in [10.43, 25.28]
+    alt_bn128_G2::fixed_base_exp_window_table.push_back(10);
+    // window 4 is unbeaten in [25.28, 59.00]
+    alt_bn128_G2::fixed_base_exp_window_table.push_back(25);
+    // window 5 is unbeaten in [59.00, 154.03]
+    alt_bn128_G2::fixed_base_exp_window_table.push_back(59);
+    // window 6 is unbeaten in [154.03, 334.25]
+    alt_bn128_G2::fixed_base_exp_window_table.push_back(154);
+    // window 7 is unbeaten in [334.25, 742.58]
+    alt_bn128_G2::fixed_base_exp_window_table.push_back(334);
+    // window 8 is unbeaten in [742.58, 2034.40]
+    alt_bn128_G2::fixed_base_exp_window_table.push_back(743);
+    // window 9 is unbeaten in [2034.40, 4987.56]
+    alt_bn128_G2::fixed_base_exp_window_table.push_back(2034);
+    // window 10 is unbeaten in [4987.56, 8888.27]
+    alt_bn128_G2::fixed_base_exp_window_table.push_back(4988);
+    // window 11 is unbeaten in [8888.27, 26271.13]
+    alt_bn128_G2::fixed_base_exp_window_table.push_back(8888);
+    // window 12 is unbeaten in [26271.13, 39768.20]
+    alt_bn128_G2::fixed_base_exp_window_table.push_back(26271);
+    // window 13 is unbeaten in [39768.20, 106275.75]
+    alt_bn128_G2::fixed_base_exp_window_table.push_back(39768);
+    // window 14 is unbeaten in [106275.75, 141703.40]
+    alt_bn128_G2::fixed_base_exp_window_table.push_back(106276);
+    // window 15 is unbeaten in [141703.40, 462422.97]
+    alt_bn128_G2::fixed_base_exp_window_table.push_back(141703);
+    // window 16 is unbeaten in [462422.97, 926871.84]
+    alt_bn128_G2::fixed_base_exp_window_table.push_back(462423);
+    // window 17 is unbeaten in [926871.84, 4873049.17]
+    alt_bn128_G2::fixed_base_exp_window_table.push_back(926872);
+    // window 18 is never the best
+    alt_bn128_G2::fixed_base_exp_window_table.push_back(0);
+    // window 19 is unbeaten in [4873049.17, 5706707.88]
+    alt_bn128_G2::fixed_base_exp_window_table.push_back(4873049);
+    // window 20 is unbeaten in [5706707.88, 31673814.95]
+    alt_bn128_G2::fixed_base_exp_window_table.push_back(5706708);
+    // window 21 is never the best
+    alt_bn128_G2::fixed_base_exp_window_table.push_back(0);
+    // window 22 is unbeaten in [31673814.95, inf]
+    alt_bn128_G2::fixed_base_exp_window_table.push_back(31673815);
+
+    /* pairing parameters */
+
+    alt_bn128_ate_loop_count = bigint_q("29793968203157093288");
+    alt_bn128_ate_is_loop_count_neg = false;
+    alt_bn128_final_exponent = bigint<12*alt_bn128_q_limbs>("552484233613224096312617126783173147097382103762957654188882734314196910839907541213974502761540629817009608548654680343627701153829446747810907373256841551006201639677726139946029199968412598804882391702273019083653272047566316584365559776493027495458238373902875937659943504873220554161550525926302303331747463515644711876653177129578303191095900909191624817826566688241804408081892785725967931714097716709526092261278071952560171111444072049229123565057483750161460024353346284167282452756217662335528813519139808291170539072125381230815729071544861602750936964829313608137325426383735122175229541155376346436093930287402089517426973178917569713384748081827255472576937471496195752727188261435633271238710131736096299798168852925540549342330775279877006784354801422249722573783561685179618816480037695005515426162362431072245638324744480");
+    alt_bn128_final_exponent_z = bigint_q("4965661367192848881");
+    alt_bn128_final_exponent_is_z_neg = false;
+
+}
+} // libff
diff --git a/src/libff/libff/algebra/curves/alt_bn128/alt_bn128_init.hpp b/src/libff/libff/algebra/curves/alt_bn128/alt_bn128_init.hpp
new file mode 100755
index 000000000..7dfabe70e
--- /dev/null
+++ b/src/libff/libff/algebra/curves/alt_bn128/alt_bn128_init.hpp
@@ -0,0 +1,57 @@
+/** @file
+ *****************************************************************************
+ * @author     This file is part of libff, developed by SCIPR Lab
+ *             and contributors (see AUTHORS).
+ * @copyright  MIT license (see LICENSE file)
+ *****************************************************************************/
+
+#ifndef ALT_BN128_INIT_HPP_
+#define ALT_BN128_INIT_HPP_
+#include <libff/algebra/curves/public_params.hpp>
+#include <libff/algebra/fields/fp.hpp>
+#include <libff/algebra/fields/fp12_2over3over2.hpp>
+#include <libff/algebra/fields/fp2.hpp>
+#include <libff/algebra/fields/fp6_3over2.hpp>
+
+namespace libff {
+
+const mp_size_t alt_bn128_r_bitcount = 254;
+const mp_size_t alt_bn128_q_bitcount = 254;
+
+const mp_size_t alt_bn128_r_limbs = (alt_bn128_r_bitcount+GMP_NUMB_BITS-1)/GMP_NUMB_BITS;
+const mp_size_t alt_bn128_q_limbs = (alt_bn128_q_bitcount+GMP_NUMB_BITS-1)/GMP_NUMB_BITS;
+
+extern bigint<alt_bn128_r_limbs> alt_bn128_modulus_r;
+extern bigint<alt_bn128_q_limbs> alt_bn128_modulus_q;
+
+typedef Fp_model<alt_bn128_r_limbs, alt_bn128_modulus_r> alt_bn128_Fr;
+typedef Fp_model<alt_bn128_q_limbs, alt_bn128_modulus_q> alt_bn128_Fq;
+typedef Fp2_model<alt_bn128_q_limbs, alt_bn128_modulus_q> alt_bn128_Fq2;
+typedef Fp6_3over2_model<alt_bn128_q_limbs, alt_bn128_modulus_q> alt_bn128_Fq6;
+typedef Fp12_2over3over2_model<alt_bn128_q_limbs, alt_bn128_modulus_q> alt_bn128_Fq12;
+typedef alt_bn128_Fq12 alt_bn128_GT;
+
+// parameters for Barreto--Naehrig curve E/Fq : y^2 = x^3 + b
+extern alt_bn128_Fq alt_bn128_coeff_b;
+// parameters for twisted Barreto--Naehrig curve E'/Fq2 : y^2 = x^3 + b/xi
+extern alt_bn128_Fq2 alt_bn128_twist;
+extern alt_bn128_Fq2 alt_bn128_twist_coeff_b;
+extern alt_bn128_Fq alt_bn128_twist_mul_by_b_c0;
+extern alt_bn128_Fq alt_bn128_twist_mul_by_b_c1;
+extern alt_bn128_Fq2 alt_bn128_twist_mul_by_q_X;
+extern alt_bn128_Fq2 alt_bn128_twist_mul_by_q_Y;
+
+// parameters for pairing
+extern bigint<alt_bn128_q_limbs> alt_bn128_ate_loop_count;
+extern bool alt_bn128_ate_is_loop_count_neg;
+extern bigint<12*alt_bn128_q_limbs> alt_bn128_final_exponent;
+extern bigint<alt_bn128_q_limbs> alt_bn128_final_exponent_z;
+extern bool alt_bn128_final_exponent_is_z_neg;
+
+void init_alt_bn128_params();
+
+class alt_bn128_G1;
+class alt_bn128_G2;
+
+} // libff
+#endif // ALT_BN128_INIT_HPP_
diff --git a/src/libff/libff/algebra/curves/alt_bn128/alt_bn128_pairing.cpp b/src/libff/libff/algebra/curves/alt_bn128/alt_bn128_pairing.cpp
new file mode 100755
index 000000000..7b79540e6
--- /dev/null
+++ b/src/libff/libff/algebra/curves/alt_bn128/alt_bn128_pairing.cpp
@@ -0,0 +1,547 @@
+/** @file
+ *****************************************************************************
+ * @author     This file is part of libff, developed by SCIPR Lab
+ *             and contributors (see AUTHORS).
+ * @copyright  MIT license (see LICENSE file)
+ *****************************************************************************/
+
+#include <cassert>
+
+#include <libff/algebra/curves/alt_bn128/alt_bn128_g1.hpp>
+#include <libff/algebra/curves/alt_bn128/alt_bn128_g2.hpp>
+#include <libff/algebra/curves/alt_bn128/alt_bn128_init.hpp>
+#include <libff/algebra/curves/alt_bn128/alt_bn128_pairing.hpp>
+#include <libff/common/profiling.hpp>
+
+namespace libff {
+
+bool alt_bn128_ate_G1_precomp::operator==(const alt_bn128_ate_G1_precomp &other) const
+{
+    return (this->PX == other.PX &&
+            this->PY == other.PY);
+}
+
+std::ostream& operator<<(std::ostream &out, const alt_bn128_ate_G1_precomp &prec_P)
+{
+    out << prec_P.PX << OUTPUT_SEPARATOR << prec_P.PY;
+
+    return out;
+}
+
+std::istream& operator>>(std::istream &in, alt_bn128_ate_G1_precomp &prec_P)
+{
+    in >> prec_P.PX;
+    consume_OUTPUT_SEPARATOR(in);
+    in >> prec_P.PY;
+
+    return in;
+}
+
+bool  alt_bn128_ate_ell_coeffs::operator==(const alt_bn128_ate_ell_coeffs &other) const
+{
+    return (this->ell_0 == other.ell_0 &&
+            this->ell_VW == other.ell_VW &&
+            this->ell_VV == other.ell_VV);
+}
+
+std::ostream& operator<<(std::ostream &out, const alt_bn128_ate_ell_coeffs &c)
+{
+    out << c.ell_0 << OUTPUT_SEPARATOR << c.ell_VW << OUTPUT_SEPARATOR << c.ell_VV;
+    return out;
+}
+
+std::istream& operator>>(std::istream &in, alt_bn128_ate_ell_coeffs &c)
+{
+    in >> c.ell_0;
+    consume_OUTPUT_SEPARATOR(in);
+    in >> c.ell_VW;
+    consume_OUTPUT_SEPARATOR(in);
+    in >> c.ell_VV;
+
+    return in;
+}
+
+bool alt_bn128_ate_G2_precomp::operator==(const alt_bn128_ate_G2_precomp &other) const
+{
+    return (this->QX == other.QX &&
+            this->QY == other.QY &&
+            this->coeffs == other.coeffs);
+}
+
+std::ostream& operator<<(std::ostream& out, const alt_bn128_ate_G2_precomp &prec_Q)
+{
+    out << prec_Q.QX << OUTPUT_SEPARATOR << prec_Q.QY << "\n";
+    out << prec_Q.coeffs.size() << "\n";
+    for (const alt_bn128_ate_ell_coeffs &c : prec_Q.coeffs)
+    {
+        out << c << OUTPUT_NEWLINE;
+    }
+    return out;
+}
+
+std::istream& operator>>(std::istream& in, alt_bn128_ate_G2_precomp &prec_Q)
+{
+    in >> prec_Q.QX;
+    consume_OUTPUT_SEPARATOR(in);
+    in >> prec_Q.QY;
+    consume_newline(in);
+
+    prec_Q.coeffs.clear();
+    size_t s;
+    in >> s;
+
+    consume_newline(in);
+
+    prec_Q.coeffs.reserve(s);
+
+    for (size_t i = 0; i < s; ++i)
+    {
+        alt_bn128_ate_ell_coeffs c;
+        in >> c;
+        consume_OUTPUT_NEWLINE(in);
+        prec_Q.coeffs.emplace_back(c);
+    }
+
+    return in;
+}
+
+/* final exponentiations */
+
+alt_bn128_Fq12 alt_bn128_final_exponentiation_first_chunk(const alt_bn128_Fq12 &elt)
+{
+    enter_block("Call to alt_bn128_final_exponentiation_first_chunk");
+
+    /*
+      Computes result = elt^((q^6-1)*(q^2+1)).
+      Follows, e.g., Beuchat et al page 9, by computing result as follows:
+         elt^((q^6-1)*(q^2+1)) = (conj(elt) * elt^(-1))^(q^2+1)
+      More precisely:
+      A = conj(elt)
+      B = elt.inverse()
+      C = A * B
+      D = C.Frobenius_map(2)
+      result = D * C
+    */
+
+    const alt_bn128_Fq12 A = alt_bn128_Fq12(elt.c0,-elt.c1);
+    const alt_bn128_Fq12 B = elt.inverse();
+    const alt_bn128_Fq12 C = A * B;
+    const alt_bn128_Fq12 D = C.Frobenius_map(2);
+    const alt_bn128_Fq12 result = D * C;
+
+    leave_block("Call to alt_bn128_final_exponentiation_first_chunk");
+
+    return result;
+}
+
+alt_bn128_Fq12 alt_bn128_exp_by_neg_z(const alt_bn128_Fq12 &elt)
+{
+    enter_block("Call to alt_bn128_exp_by_neg_z");
+
+    alt_bn128_Fq12 result = elt.cyclotomic_exp(alt_bn128_final_exponent_z);
+    if (!alt_bn128_final_exponent_is_z_neg)
+    {
+        result = result.unitary_inverse();
+    }
+
+    leave_block("Call to alt_bn128_exp_by_neg_z");
+
+    return result;
+}
+
+alt_bn128_Fq12 alt_bn128_final_exponentiation_last_chunk(const alt_bn128_Fq12 &elt)
+{
+    enter_block("Call to alt_bn128_final_exponentiation_last_chunk");
+
+    /*
+      Follows Laura Fuentes-Castaneda et al. "Faster hashing to G2"
+      by computing:
+
+      result = elt^(q^3 * (12*z^3 + 6z^2 + 4z - 1) +
+                    q^2 * (12*z^3 + 6z^2 + 6z) +
+                    q   * (12*z^3 + 6z^2 + 4z) +
+                    1   * (12*z^3 + 12z^2 + 6z + 1))
+      which equals
+
+      result = elt^( 2z * ( 6z^2 + 3z + 1 ) * (q^4 - q^2 + 1)/r ).
+
+      Using the following addition chain:
+
+      A = exp_by_neg_z(elt)  // = elt^(-z)
+      B = A^2                // = elt^(-2*z)
+      C = B^2                // = elt^(-4*z)
+      D = C * B              // = elt^(-6*z)
+      E = exp_by_neg_z(D)    // = elt^(6*z^2)
+      F = E^2                // = elt^(12*z^2)
+      G = epx_by_neg_z(F)    // = elt^(-12*z^3)
+      H = conj(D)            // = elt^(6*z)
+      I = conj(G)            // = elt^(12*z^3)
+      J = I * E              // = elt^(12*z^3 + 6*z^2)
+      K = J * H              // = elt^(12*z^3 + 6*z^2 + 6*z)
+      L = K * B              // = elt^(12*z^3 + 6*z^2 + 4*z)
+      M = K * E              // = elt^(12*z^3 + 12*z^2 + 6*z)
+      N = M * elt            // = elt^(12*z^3 + 12*z^2 + 6*z + 1)
+      O = L.Frobenius_map(1) // = elt^(q*(12*z^3 + 6*z^2 + 4*z))
+      P = O * N              // = elt^(q*(12*z^3 + 6*z^2 + 4*z) * (12*z^3 + 12*z^2 + 6*z + 1))
+      Q = K.Frobenius_map(2) // = elt^(q^2 * (12*z^3 + 6*z^2 + 6*z))
+      R = Q * P              // = elt^(q^2 * (12*z^3 + 6*z^2 + 6*z) + q*(12*z^3 + 6*z^2 + 4*z) * (12*z^3 + 12*z^2 + 6*z + 1))
+      S = conj(elt)          // = elt^(-1)
+      T = S * L              // = elt^(12*z^3 + 6*z^2 + 4*z - 1)
+      U = T.Frobenius_map(3) // = elt^(q^3(12*z^3 + 6*z^2 + 4*z - 1))
+      V = U * R              // = elt^(q^3(12*z^3 + 6*z^2 + 4*z - 1) + q^2 * (12*z^3 + 6*z^2 + 6*z) + q*(12*z^3 + 6*z^2 + 4*z) * (12*z^3 + 12*z^2 + 6*z + 1))
+      result = V
+
+    */
+
+    const alt_bn128_Fq12 A = alt_bn128_exp_by_neg_z(elt);
+    const alt_bn128_Fq12 B = A.cyclotomic_squared();
+    const alt_bn128_Fq12 C = B.cyclotomic_squared();
+    const alt_bn128_Fq12 D = C * B;
+    const alt_bn128_Fq12 E = alt_bn128_exp_by_neg_z(D);
+    const alt_bn128_Fq12 F = E.cyclotomic_squared();
+    const alt_bn128_Fq12 G = alt_bn128_exp_by_neg_z(F);
+    const alt_bn128_Fq12 H = D.unitary_inverse();
+    const alt_bn128_Fq12 I = G.unitary_inverse();
+    const alt_bn128_Fq12 J = I * E;
+    const alt_bn128_Fq12 K = J * H;
+    const alt_bn128_Fq12 L = K * B;
+    const alt_bn128_Fq12 M = K * E;
+    const alt_bn128_Fq12 N = M * elt;
+    const alt_bn128_Fq12 O = L.Frobenius_map(1);
+    const alt_bn128_Fq12 P = O * N;
+    const alt_bn128_Fq12 Q = K.Frobenius_map(2);
+    const alt_bn128_Fq12 R = Q * P;
+    const alt_bn128_Fq12 S = elt.unitary_inverse();
+    const alt_bn128_Fq12 T = S * L;
+    const alt_bn128_Fq12 U = T.Frobenius_map(3);
+    const alt_bn128_Fq12 V = U * R;
+
+    const alt_bn128_Fq12 result = V;
+
+    leave_block("Call to alt_bn128_final_exponentiation_last_chunk");
+
+    return result;
+}
+
+alt_bn128_GT alt_bn128_final_exponentiation(const alt_bn128_Fq12 &elt)
+{
+    enter_block("Call to alt_bn128_final_exponentiation");
+    /* OLD naive version:
+        alt_bn128_GT result = elt^alt_bn128_final_exponent;
+    */
+    alt_bn128_Fq12 A = alt_bn128_final_exponentiation_first_chunk(elt);
+    alt_bn128_GT result = alt_bn128_final_exponentiation_last_chunk(A);
+
+    leave_block("Call to alt_bn128_final_exponentiation");
+    return result;
+}
+
+/* ate pairing */
+
+void doubling_step_for_flipped_miller_loop(const alt_bn128_Fq two_inv,
+                                           alt_bn128_G2 &current,
+                                           alt_bn128_ate_ell_coeffs &c)
+{
+    const alt_bn128_Fq2 X = current.X, Y = current.Y, Z = current.Z;
+
+    const alt_bn128_Fq2 A = two_inv * (X * Y);                     // A = X1 * Y1 / 2
+    const alt_bn128_Fq2 B = Y.squared();                           // B = Y1^2
+    const alt_bn128_Fq2 C = Z.squared();                           // C = Z1^2
+    const alt_bn128_Fq2 D = C+C+C;                                 // D = 3 * C
+    const alt_bn128_Fq2 E = alt_bn128_twist_coeff_b * D;             // E = twist_b * D
+    const alt_bn128_Fq2 F = E+E+E;                                 // F = 3 * E
+    const alt_bn128_Fq2 G = two_inv * (B+F);                       // G = (B+F)/2
+    const alt_bn128_Fq2 H = (Y+Z).squared() - (B+C);               // H = (Y1+Z1)^2-(B+C)
+    const alt_bn128_Fq2 I = E-B;                                   // I = E-B
+    const alt_bn128_Fq2 J = X.squared();                           // J = X1^2
+    const alt_bn128_Fq2 E_squared = E.squared();                   // E_squared = E^2
+
+    current.X = A * (B-F);                                       // X3 = A * (B-F)
+    current.Y = G.squared() - (E_squared+E_squared+E_squared);   // Y3 = G^2 - 3*E^2
+    current.Z = B * H;                                           // Z3 = B * H
+    c.ell_0 = alt_bn128_twist * I;                                 // ell_0 = xi * I
+    c.ell_VW = -H;                                               // ell_VW = - H (later: * yP)
+    c.ell_VV = J+J+J;                                            // ell_VV = 3*J (later: * xP)
+}
+
+void mixed_addition_step_for_flipped_miller_loop(const alt_bn128_G2 base,
+                                                 alt_bn128_G2 &current,
+                                                 alt_bn128_ate_ell_coeffs &c)
+{
+    const alt_bn128_Fq2 X1 = current.X, Y1 = current.Y, Z1 = current.Z;
+    const alt_bn128_Fq2 &x2 = base.X, &y2 = base.Y;
+
+    const alt_bn128_Fq2 D = X1 - x2 * Z1;          // D = X1 - X2*Z1
+    const alt_bn128_Fq2 E = Y1 - y2 * Z1;          // E = Y1 - Y2*Z1
+    const alt_bn128_Fq2 F = D.squared();           // F = D^2
+    const alt_bn128_Fq2 G = E.squared();           // G = E^2
+    const alt_bn128_Fq2 H = D*F;                   // H = D*F
+    const alt_bn128_Fq2 I = X1 * F;                // I = X1 * F
+    const alt_bn128_Fq2 J = H + Z1*G - (I+I);      // J = H + Z1*G - (I+I)
+
+    current.X = D * J;                           // X3 = D*J
+    current.Y = E * (I-J)-(H * Y1);              // Y3 = E*(I-J)-(H*Y1)
+    current.Z = Z1 * H;                          // Z3 = Z1*H
+    c.ell_0 = alt_bn128_twist * (E * x2 - D * y2); // ell_0 = xi * (E * X2 - D * Y2)
+    c.ell_VV = - E;                              // ell_VV = - E (later: * xP)
+    c.ell_VW = D;                                // ell_VW = D (later: * yP    )
+}
+
+alt_bn128_ate_G1_precomp alt_bn128_ate_precompute_G1(const alt_bn128_G1& P)
+{
+    enter_block("Call to alt_bn128_ate_precompute_G1");
+
+    alt_bn128_G1 Pcopy = P;
+    Pcopy.to_affine_coordinates();
+
+    alt_bn128_ate_G1_precomp result;
+    result.PX = Pcopy.X;
+    result.PY = Pcopy.Y;
+
+    leave_block("Call to alt_bn128_ate_precompute_G1");
+    return result;
+}
+
+alt_bn128_ate_G2_precomp alt_bn128_ate_precompute_G2(const alt_bn128_G2& Q)
+{
+    enter_block("Call to alt_bn128_ate_precompute_G2");
+
+    alt_bn128_G2 Qcopy(Q);
+    Qcopy.to_affine_coordinates();
+
+    alt_bn128_Fq two_inv = (alt_bn128_Fq("2").inverse()); // could add to global params if needed
+
+    alt_bn128_ate_G2_precomp result;
+    result.QX = Qcopy.X;
+    result.QY = Qcopy.Y;
+
+    alt_bn128_G2 R;
+    R.X = Qcopy.X;
+    R.Y = Qcopy.Y;
+    R.Z = alt_bn128_Fq2::one();
+
+    const bigint<alt_bn128_Fr::num_limbs> &loop_count = alt_bn128_ate_loop_count;
+    bool found_one = false;
+    alt_bn128_ate_ell_coeffs c;
+
+    for (long i = loop_count.max_bits(); i >= 0; --i)
+    {
+        const bool bit = loop_count.test_bit(i);
+        if (!found_one)
+        {
+            /* this skips the MSB itself */
+            found_one |= bit;
+            continue;
+        }
+
+        doubling_step_for_flipped_miller_loop(two_inv, R, c);
+        result.coeffs.push_back(c);
+
+        if (bit)
+        {
+            mixed_addition_step_for_flipped_miller_loop(Qcopy, R, c);
+            result.coeffs.push_back(c);
+        }
+    }
+
+    alt_bn128_G2 Q1 = Qcopy.mul_by_q();
+    assert(Q1.Z == alt_bn128_Fq2::one());
+    alt_bn128_G2 Q2 = Q1.mul_by_q();
+    assert(Q2.Z == alt_bn128_Fq2::one());
+
+    if (alt_bn128_ate_is_loop_count_neg)
+    {
+        R.Y = - R.Y;
+    }
+    Q2.Y = - Q2.Y;
+
+    mixed_addition_step_for_flipped_miller_loop(Q1, R, c);
+    result.coeffs.push_back(c);
+
+    mixed_addition_step_for_flipped_miller_loop(Q2, R, c);
+    result.coeffs.push_back(c);
+
+    leave_block("Call to alt_bn128_ate_precompute_G2");
+    return result;
+}
+
+alt_bn128_Fq12 alt_bn128_ate_miller_loop(const alt_bn128_ate_G1_precomp &prec_P,
+                                     const alt_bn128_ate_G2_precomp &prec_Q)
+{
+    enter_block("Call to alt_bn128_ate_miller_loop");
+
+    alt_bn128_Fq12 f = alt_bn128_Fq12::one();
+
+    bool found_one = false;
+    size_t idx = 0;
+
+    const bigint<alt_bn128_Fr::num_limbs> &loop_count = alt_bn128_ate_loop_count;
+    alt_bn128_ate_ell_coeffs c;
+
+    for (long i = loop_count.max_bits(); i >= 0; --i)
+    {
+        const bool bit = loop_count.test_bit(i);
+        if (!found_one)
+        {
+            /* this skips the MSB itself */
+            found_one |= bit;
+            continue;
+        }
+
+        /* code below gets executed for all bits (EXCEPT the MSB itself) of
+           alt_bn128_param_p (skipping leading zeros) in MSB to LSB
+           order */
+
+        c = prec_Q.coeffs[idx++];
+        f = f.squared();
+        f = f.mul_by_024(c.ell_0, prec_P.PY * c.ell_VW, prec_P.PX * c.ell_VV);
+
+        if (bit)
+        {
+            c = prec_Q.coeffs[idx++];
+            f = f.mul_by_024(c.ell_0, prec_P.PY * c.ell_VW, prec_P.PX * c.ell_VV);
+        }
+
+    }
+
+    if (alt_bn128_ate_is_loop_count_neg)
+    {
+    	f = f.inverse();
+    }
+
+    c = prec_Q.coeffs[idx++];
+    f = f.mul_by_024(c.ell_0,prec_P.PY * c.ell_VW,prec_P.PX * c.ell_VV);
+
+    c = prec_Q.coeffs[idx++];
+    f = f.mul_by_024(c.ell_0,prec_P.PY * c.ell_VW,prec_P.PX * c.ell_VV);
+
+    leave_block("Call to alt_bn128_ate_miller_loop");
+    return f;
+}
+
+alt_bn128_Fq12 alt_bn128_ate_double_miller_loop(const alt_bn128_ate_G1_precomp &prec_P1,
+                                     const alt_bn128_ate_G2_precomp &prec_Q1,
+                                     const alt_bn128_ate_G1_precomp &prec_P2,
+                                     const alt_bn128_ate_G2_precomp &prec_Q2)
+{
+    enter_block("Call to alt_bn128_ate_double_miller_loop");
+
+    alt_bn128_Fq12 f = alt_bn128_Fq12::one();
+
+    bool found_one = false;
+    size_t idx = 0;
+
+    const bigint<alt_bn128_Fr::num_limbs> &loop_count = alt_bn128_ate_loop_count;
+    for (long i = loop_count.max_bits(); i >= 0; --i)
+    {
+        const bool bit = loop_count.test_bit(i);
+        if (!found_one)
+        {
+            /* this skips the MSB itself */
+            found_one |= bit;
+            continue;
+        }
+
+        /* code below gets executed for all bits (EXCEPT the MSB itself) of
+           alt_bn128_param_p (skipping leading zeros) in MSB to LSB
+           order */
+
+        alt_bn128_ate_ell_coeffs c1 = prec_Q1.coeffs[idx];
+        alt_bn128_ate_ell_coeffs c2 = prec_Q2.coeffs[idx];
+        ++idx;
+
+        f = f.squared();
+
+        f = f.mul_by_024(c1.ell_0, prec_P1.PY * c1.ell_VW, prec_P1.PX * c1.ell_VV);
+        f = f.mul_by_024(c2.ell_0, prec_P2.PY * c2.ell_VW, prec_P2.PX * c2.ell_VV);
+
+        if (bit)
+        {
+            alt_bn128_ate_ell_coeffs c1 = prec_Q1.coeffs[idx];
+            alt_bn128_ate_ell_coeffs c2 = prec_Q2.coeffs[idx];
+            ++idx;
+
+            f = f.mul_by_024(c1.ell_0, prec_P1.PY * c1.ell_VW, prec_P1.PX * c1.ell_VV);
+            f = f.mul_by_024(c2.ell_0, prec_P2.PY * c2.ell_VW, prec_P2.PX * c2.ell_VV);
+        }
+    }
+
+    if (alt_bn128_ate_is_loop_count_neg)
+    {
+    	f = f.inverse();
+    }
+
+    alt_bn128_ate_ell_coeffs c1 = prec_Q1.coeffs[idx];
+    alt_bn128_ate_ell_coeffs c2 = prec_Q2.coeffs[idx];
+    ++idx;
+    f = f.mul_by_024(c1.ell_0, prec_P1.PY * c1.ell_VW, prec_P1.PX * c1.ell_VV);
+    f = f.mul_by_024(c2.ell_0, prec_P2.PY * c2.ell_VW, prec_P2.PX * c2.ell_VV);
+
+    c1 = prec_Q1.coeffs[idx];
+    c2 = prec_Q2.coeffs[idx];
+    ++idx;
+    f = f.mul_by_024(c1.ell_0, prec_P1.PY * c1.ell_VW, prec_P1.PX * c1.ell_VV);
+    f = f.mul_by_024(c2.ell_0, prec_P2.PY * c2.ell_VW, prec_P2.PX * c2.ell_VV);
+
+    leave_block("Call to alt_bn128_ate_double_miller_loop");
+
+    return f;
+}
+
+alt_bn128_Fq12 alt_bn128_ate_pairing(const alt_bn128_G1& P, const alt_bn128_G2 &Q)
+{
+    enter_block("Call to alt_bn128_ate_pairing");
+    alt_bn128_ate_G1_precomp prec_P = alt_bn128_ate_precompute_G1(P);
+    alt_bn128_ate_G2_precomp prec_Q = alt_bn128_ate_precompute_G2(Q);
+    alt_bn128_Fq12 result = alt_bn128_ate_miller_loop(prec_P, prec_Q);
+    leave_block("Call to alt_bn128_ate_pairing");
+    return result;
+}
+
+alt_bn128_GT alt_bn128_ate_reduced_pairing(const alt_bn128_G1 &P, const alt_bn128_G2 &Q)
+{
+    enter_block("Call to alt_bn128_ate_reduced_pairing");
+    const alt_bn128_Fq12 f = alt_bn128_ate_pairing(P, Q);
+    const alt_bn128_GT result = alt_bn128_final_exponentiation(f);
+    leave_block("Call to alt_bn128_ate_reduced_pairing");
+    return result;
+}
+
+/* choice of pairing */
+
+alt_bn128_G1_precomp alt_bn128_precompute_G1(const alt_bn128_G1& P)
+{
+    return alt_bn128_ate_precompute_G1(P);
+}
+
+alt_bn128_G2_precomp alt_bn128_precompute_G2(const alt_bn128_G2& Q)
+{
+    return alt_bn128_ate_precompute_G2(Q);
+}
+
+alt_bn128_Fq12 alt_bn128_miller_loop(const alt_bn128_G1_precomp &prec_P,
+                          const alt_bn128_G2_precomp &prec_Q)
+{
+    return alt_bn128_ate_miller_loop(prec_P, prec_Q);
+}
+
+alt_bn128_Fq12 alt_bn128_double_miller_loop(const alt_bn128_G1_precomp &prec_P1,
+                                 const alt_bn128_G2_precomp &prec_Q1,
+                                 const alt_bn128_G1_precomp &prec_P2,
+                                 const alt_bn128_G2_precomp &prec_Q2)
+{
+    return alt_bn128_ate_double_miller_loop(prec_P1, prec_Q1, prec_P2, prec_Q2);
+}
+
+alt_bn128_Fq12 alt_bn128_pairing(const alt_bn128_G1& P,
+                      const alt_bn128_G2 &Q)
+{
+    return alt_bn128_ate_pairing(P, Q);
+}
+
+alt_bn128_GT alt_bn128_reduced_pairing(const alt_bn128_G1 &P,
+                             const alt_bn128_G2 &Q)
+{
+    return alt_bn128_ate_reduced_pairing(P, Q);
+}
+} // libff
diff --git a/src/libff/libff/algebra/curves/alt_bn128/alt_bn128_pairing.hpp b/src/libff/libff/algebra/curves/alt_bn128/alt_bn128_pairing.hpp
new file mode 100755
index 000000000..3664c7156
--- /dev/null
+++ b/src/libff/libff/algebra/curves/alt_bn128/alt_bn128_pairing.hpp
@@ -0,0 +1,93 @@
+/** @file
+ *****************************************************************************
+ * @author     This file is part of libff, developed by SCIPR Lab
+ *             and contributors (see AUTHORS).
+ * @copyright  MIT license (see LICENSE file)
+ *****************************************************************************/
+
+#ifndef ALT_BN128_PAIRING_HPP_
+#define ALT_BN128_PAIRING_HPP_
+#include <vector>
+
+#include <libff/algebra/curves/alt_bn128/alt_bn128_init.hpp>
+
+namespace libff {
+
+/* final exponentiation */
+
+alt_bn128_GT alt_bn128_final_exponentiation(const alt_bn128_Fq12 &elt);
+
+/* ate pairing */
+
+struct alt_bn128_ate_G1_precomp {
+    alt_bn128_Fq PX;
+    alt_bn128_Fq PY;
+
+    bool operator==(const alt_bn128_ate_G1_precomp &other) const;
+    friend std::ostream& operator<<(std::ostream &out, const alt_bn128_ate_G1_precomp &prec_P);
+    friend std::istream& operator>>(std::istream &in, alt_bn128_ate_G1_precomp &prec_P);
+};
+
+struct alt_bn128_ate_ell_coeffs {
+    alt_bn128_Fq2 ell_0;
+    alt_bn128_Fq2 ell_VW;
+    alt_bn128_Fq2 ell_VV;
+
+    bool operator==(const alt_bn128_ate_ell_coeffs &other) const;
+    friend std::ostream& operator<<(std::ostream &out, const alt_bn128_ate_ell_coeffs &dc);
+    friend std::istream& operator>>(std::istream &in, alt_bn128_ate_ell_coeffs &dc);
+};
+
+struct alt_bn128_ate_G2_precomp {
+    alt_bn128_Fq2 QX;
+    alt_bn128_Fq2 QY;
+    std::vector<alt_bn128_ate_ell_coeffs> coeffs;
+
+    bool operator==(const alt_bn128_ate_G2_precomp &other) const;
+    friend std::ostream& operator<<(std::ostream &out, const alt_bn128_ate_G2_precomp &prec_Q);
+    friend std::istream& operator>>(std::istream &in, alt_bn128_ate_G2_precomp &prec_Q);
+};
+
+alt_bn128_ate_G1_precomp alt_bn128_ate_precompute_G1(const alt_bn128_G1& P);
+alt_bn128_ate_G2_precomp alt_bn128_ate_precompute_G2(const alt_bn128_G2& Q);
+
+alt_bn128_Fq12 alt_bn128_ate_miller_loop(const alt_bn128_ate_G1_precomp &prec_P,
+                              const alt_bn128_ate_G2_precomp &prec_Q);
+alt_bn128_Fq12 alt_bn128_ate_double_miller_loop(const alt_bn128_ate_G1_precomp &prec_P1,
+                                     const alt_bn128_ate_G2_precomp &prec_Q1,
+                                     const alt_bn128_ate_G1_precomp &prec_P2,
+                                     const alt_bn128_ate_G2_precomp &prec_Q2);
+
+alt_bn128_Fq12 alt_bn128_ate_pairing(const alt_bn128_G1& P,
+                          const alt_bn128_G2 &Q);
+alt_bn128_GT alt_bn128_ate_reduced_pairing(const alt_bn128_G1 &P,
+                                 const alt_bn128_G2 &Q);
+
+/* choice of pairing */
+
+typedef alt_bn128_ate_G1_precomp alt_bn128_G1_precomp;
+typedef alt_bn128_ate_G2_precomp alt_bn128_G2_precomp;
+
+alt_bn128_G1_precomp alt_bn128_precompute_G1(const alt_bn128_G1& P);
+
+alt_bn128_G2_precomp alt_bn128_precompute_G2(const alt_bn128_G2& Q);
+
+alt_bn128_Fq12 alt_bn128_miller_loop(const alt_bn128_G1_precomp &prec_P,
+                          const alt_bn128_G2_precomp &prec_Q);
+
+alt_bn128_Fq12 alt_bn128_double_miller_loop(const alt_bn128_G1_precomp &prec_P1,
+                                 const alt_bn128_G2_precomp &prec_Q1,
+                                 const alt_bn128_G1_precomp &prec_P2,
+                                 const alt_bn128_G2_precomp &prec_Q2);
+
+alt_bn128_Fq12 alt_bn128_pairing(const alt_bn128_G1& P,
+                      const alt_bn128_G2 &Q);
+
+alt_bn128_GT alt_bn128_reduced_pairing(const alt_bn128_G1 &P,
+                             const alt_bn128_G2 &Q);
+
+alt_bn128_GT alt_bn128_affine_reduced_pairing(const alt_bn128_G1 &P,
+                                    const alt_bn128_G2 &Q);
+
+} // libff
+#endif // ALT_BN128_PAIRING_HPP_
diff --git a/src/libff/libff/algebra/curves/alt_bn128/alt_bn128_pp.cpp b/src/libff/libff/algebra/curves/alt_bn128/alt_bn128_pp.cpp
new file mode 100755
index 000000000..a26f89c75
--- /dev/null
+++ b/src/libff/libff/algebra/curves/alt_bn128/alt_bn128_pp.cpp
@@ -0,0 +1,58 @@
+/** @file
+ *****************************************************************************
+ * @author     This file is part of libff, developed by SCIPR Lab
+ *             and contributors (see AUTHORS).
+ * @copyright  MIT license (see LICENSE file)
+ *****************************************************************************/
+
+#include <libff/algebra/curves/alt_bn128/alt_bn128_pp.hpp>
+
+namespace libff {
+
+void alt_bn128_pp::init_public_params()
+{
+    init_alt_bn128_params();
+}
+
+alt_bn128_GT alt_bn128_pp::final_exponentiation(const alt_bn128_Fq12 &elt)
+{
+    return alt_bn128_final_exponentiation(elt);
+}
+
+alt_bn128_G1_precomp alt_bn128_pp::precompute_G1(const alt_bn128_G1 &P)
+{
+    return alt_bn128_precompute_G1(P);
+}
+
+alt_bn128_G2_precomp alt_bn128_pp::precompute_G2(const alt_bn128_G2 &Q)
+{
+    return alt_bn128_precompute_G2(Q);
+}
+
+alt_bn128_Fq12 alt_bn128_pp::miller_loop(const alt_bn128_G1_precomp &prec_P,
+                                         const alt_bn128_G2_precomp &prec_Q)
+{
+    return alt_bn128_miller_loop(prec_P, prec_Q);
+}
+
+alt_bn128_Fq12 alt_bn128_pp::double_miller_loop(const alt_bn128_G1_precomp &prec_P1,
+                                                const alt_bn128_G2_precomp &prec_Q1,
+                                                const alt_bn128_G1_precomp &prec_P2,
+                                                const alt_bn128_G2_precomp &prec_Q2)
+{
+    return alt_bn128_double_miller_loop(prec_P1, prec_Q1, prec_P2, prec_Q2);
+}
+
+alt_bn128_Fq12 alt_bn128_pp::pairing(const alt_bn128_G1 &P,
+                                     const alt_bn128_G2 &Q)
+{
+    return alt_bn128_pairing(P, Q);
+}
+
+alt_bn128_Fq12 alt_bn128_pp::reduced_pairing(const alt_bn128_G1 &P,
+                                             const alt_bn128_G2 &Q)
+{
+    return alt_bn128_reduced_pairing(P, Q);
+}
+
+} // libff
diff --git a/src/libff/libff/algebra/curves/alt_bn128/alt_bn128_pp.hpp b/src/libff/libff/algebra/curves/alt_bn128/alt_bn128_pp.hpp
new file mode 100755
index 000000000..e1f083acb
--- /dev/null
+++ b/src/libff/libff/algebra/curves/alt_bn128/alt_bn128_pp.hpp
@@ -0,0 +1,50 @@
+/** @file
+*****************************************************************************
+* @author     This file is part of libff, developed by SCIPR Lab
+*             and contributors (see AUTHORS).
+* @copyright  MIT license (see LICENSE file)
+*****************************************************************************/
+
+#ifndef ALT_BN128_PP_HPP_
+#define ALT_BN128_PP_HPP_
+#include <libff/algebra/curves/alt_bn128/alt_bn128_g1.hpp>
+#include <libff/algebra/curves/alt_bn128/alt_bn128_g2.hpp>
+#include <libff/algebra/curves/alt_bn128/alt_bn128_init.hpp>
+#include <libff/algebra/curves/alt_bn128/alt_bn128_pairing.hpp>
+#include <libff/algebra/curves/public_params.hpp>
+
+namespace libff {
+
+class alt_bn128_pp {
+public:
+    typedef alt_bn128_Fr Fp_type;
+    typedef alt_bn128_G1 G1_type;
+    typedef alt_bn128_G2 G2_type;
+    typedef alt_bn128_G1_precomp G1_precomp_type;
+    typedef alt_bn128_G2_precomp G2_precomp_type;
+    typedef alt_bn128_Fq Fq_type;
+    typedef alt_bn128_Fq2 Fqe_type;
+    typedef alt_bn128_Fq12 Fqk_type;
+    typedef alt_bn128_GT GT_type;
+
+    static const bool has_affine_pairing = false;
+
+    static void init_public_params();
+    static alt_bn128_GT final_exponentiation(const alt_bn128_Fq12 &elt);
+    static alt_bn128_G1_precomp precompute_G1(const alt_bn128_G1 &P);
+    static alt_bn128_G2_precomp precompute_G2(const alt_bn128_G2 &Q);
+    static alt_bn128_Fq12 miller_loop(const alt_bn128_G1_precomp &prec_P,
+                                      const alt_bn128_G2_precomp &prec_Q);
+    static alt_bn128_Fq12 double_miller_loop(const alt_bn128_G1_precomp &prec_P1,
+                                             const alt_bn128_G2_precomp &prec_Q1,
+                                             const alt_bn128_G1_precomp &prec_P2,
+                                             const alt_bn128_G2_precomp &prec_Q2);
+    static alt_bn128_Fq12 pairing(const alt_bn128_G1 &P,
+                                  const alt_bn128_G2 &Q);
+    static alt_bn128_Fq12 reduced_pairing(const alt_bn128_G1 &P,
+                                          const alt_bn128_G2 &Q);
+};
+
+} // libff
+
+#endif // ALT_BN128_PP_HPP_
diff --git a/src/libff/libff/algebra/curves/bn128/bn128_g1.cpp b/src/libff/libff/algebra/curves/bn128/bn128_g1.cpp
new file mode 100755
index 000000000..b8389e689
--- /dev/null
+++ b/src/libff/libff/algebra/curves/bn128/bn128_g1.cpp
@@ -0,0 +1,519 @@
+/** @file
+ *****************************************************************************
+ * @author     This file is part of libff, developed by SCIPR Lab
+ *             and contributors (see AUTHORS).
+ * @copyright  MIT license (see LICENSE file)
+ *****************************************************************************/
+
+#include <libff/algebra/curves/bn128/bn128_g1.hpp>
+#include <libff/algebra/curves/bn128/bn_utils.hpp>
+
+namespace libff {
+
+#ifdef PROFILE_OP_COUNTS
+long long bn128_G1::add_cnt = 0;
+long long bn128_G1::dbl_cnt = 0;
+#endif
+
+std::vector<size_t> bn128_G1::wnaf_window_table;
+std::vector<size_t> bn128_G1::fixed_base_exp_window_table;
+bn128_G1 bn128_G1::G1_zero;
+bn128_G1 bn128_G1::G1_one;
+
+bn::Fp bn128_G1::sqrt(const bn::Fp &el)
+{
+    size_t v = bn128_Fq_s;
+    bn::Fp z = bn128_Fq_nqr_to_t;
+    bn::Fp w = mie::power(el, bn128_Fq_t_minus_1_over_2);
+    bn::Fp x = el * w;
+    bn::Fp b = x * w;
+
+#if DEBUG
+    // check if square with Euler's criterion
+    bn::Fp check = b;
+    for (size_t i = 0; i < v-1; ++i)
+    {
+        bn::Fp::square(check, check);
+    }
+
+    assert(check == bn::Fp(1));
+#endif
+
+    // compute square root with Tonelli--Shanks
+    // (does not terminate if not a square!)
+
+    while (b != bn::Fp(1))
+    {
+        size_t m = 0;
+        bn::Fp b2m = b;
+        while (b2m != bn::Fp(1))
+        {
+            // invariant: b2m = b^(2^m) after entering this loop
+            bn::Fp::square(b2m, b2m);
+            m += 1;
+        }
+
+        int j = v-m-1;
+        w = z;
+        while (j > 0)
+        {
+            bn::Fp::square(w, w);
+            --j;
+        } // w = z^2^(v-m-1)
+
+        z = w * w;
+        b = b * z;
+        x = x * w;
+        v = m;
+    }
+
+    return x;
+}
+
+bn128_G1::bn128_G1()
+{
+    this->coord[0] = G1_zero.coord[0];
+    this->coord[1] = G1_zero.coord[1];
+    this->coord[2] = G1_zero.coord[2];
+}
+
+void bn128_G1::print() const
+{
+    if (this->is_zero())
+    {
+        printf("O\n");
+    }
+    else
+    {
+        bn128_G1 copy(*this);
+        copy.to_affine_coordinates();
+        std::cout << "(" << copy.coord[0].toString(10) << " : " << copy.coord[1].toString(10) << " : " << copy.coord[2].toString(10) << ")\n";
+    }
+}
+
+void bn128_G1::print_coordinates() const
+{
+    if (this->is_zero())
+    {
+        printf("O\n");
+    }
+    else
+    {
+        std::cout << "(" << coord[0].toString(10) << " : " << coord[1].toString(10) << " : " << coord[2].toString(10) << ")\n";
+    }
+}
+
+void bn128_G1::to_affine_coordinates()
+{
+    if (this->is_zero())
+    {
+        coord[0] = 0;
+        coord[1] = 1;
+        coord[2] = 0;
+    }
+    else
+    {
+        bn::Fp r;
+        r = coord[2];
+        r.inverse();
+        bn::Fp::square(coord[2], r);
+        coord[0] *= coord[2];
+        r *= coord[2];
+        coord[1] *= r;
+        coord[2] = 1;
+    }
+}
+
+void bn128_G1::to_special()
+{
+    this->to_affine_coordinates();
+}
+
+bool bn128_G1::is_special() const
+{
+    return (this->is_zero() || this->coord[2] == 1);
+}
+
+bool bn128_G1::is_zero() const
+{
+    return coord[2].isZero();
+}
+
+bool bn128_G1::operator==(const bn128_G1 &other) const
+{
+    if (this->is_zero())
+    {
+        return other.is_zero();
+    }
+
+    if (other.is_zero())
+    {
+        return false;
+    }
+
+    /* now neither is O */
+
+    bn::Fp Z1sq, Z2sq, lhs, rhs;
+    bn::Fp::square(Z1sq, this->coord[2]);
+    bn::Fp::square(Z2sq, other.coord[2]);
+    bn::Fp::mul(lhs, Z2sq, this->coord[0]);
+    bn::Fp::mul(rhs, Z1sq, other.coord[0]);
+
+    if (lhs != rhs)
+    {
+        return false;
+    }
+
+    bn::Fp Z1cubed, Z2cubed;
+    bn::Fp::mul(Z1cubed, Z1sq, this->coord[2]);
+    bn::Fp::mul(Z2cubed, Z2sq, other.coord[2]);
+    bn::Fp::mul(lhs, Z2cubed, this->coord[1]);
+    bn::Fp::mul(rhs, Z1cubed, other.coord[1]);
+
+    return (lhs == rhs);
+}
+
+bool bn128_G1::operator!=(const bn128_G1& other) const
+{
+    return !(operator==(other));
+}
+
+bn128_G1 bn128_G1::operator+(const bn128_G1 &other) const
+{
+    // handle special cases having to do with O
+    if (this->is_zero())
+    {
+        return other;
+    }
+
+    if (other.is_zero())
+    {
+        return *this;
+    }
+
+    // no need to handle points of order 2,4
+    // (they cannot exist in a prime-order subgroup)
+
+    // handle double case, and then all the rest
+    if (this->operator==(other))
+    {
+        return this->dbl();
+    }
+    else
+    {
+        return this->add(other);
+    }
+}
+
+bn128_G1 bn128_G1::operator-() const
+{
+    bn128_G1 result(*this);
+    bn::Fp::neg(result.coord[1], result.coord[1]);
+    return result;
+}
+
+bn128_G1 bn128_G1::operator-(const bn128_G1 &other) const
+{
+    return (*this) + (-other);
+}
+
+bn128_G1 bn128_G1::add(const bn128_G1 &other) const
+{
+#ifdef PROFILE_OP_COUNTS
+    this->add_cnt++;
+#endif
+
+    bn128_G1 result;
+    bn::ecop::ECAdd(result.coord, this->coord, other.coord);
+    return result;
+}
+
+bn128_G1 bn128_G1::mixed_add(const bn128_G1 &other) const
+{
+    if (this->is_zero())
+    {
+        return other;
+    }
+
+    if (other.is_zero())
+    {
+        return *this;
+    }
+
+    // no need to handle points of order 2,4
+    // (they cannot exist in a prime-order subgroup)
+
+#ifdef DEBUG
+    assert(other.is_special());
+#endif
+
+    // check for doubling case
+
+    // using Jacobian coordinates so:
+    // (X1:Y1:Z1) = (X2:Y2:Z2)
+    // iff
+    // X1/Z1^2 == X2/Z2^2 and Y1/Z1^3 == Y2/Z2^3
+    // iff
+    // X1 * Z2^2 == X2 * Z1^2 and Y1 * Z2^3 == Y2 * Z1^3
+
+    // we know that Z2 = 1
+
+    bn::Fp Z1Z1;
+    bn::Fp::square(Z1Z1, this->coord[2]);
+    const bn::Fp &U1 = this->coord[0];
+    bn::Fp U2;
+    bn::Fp::mul(U2, other.coord[0], Z1Z1);
+    bn::Fp Z1_cubed;
+    bn::Fp::mul(Z1_cubed, this->coord[2], Z1Z1);
+
+    const bn::Fp &S1 = this->coord[1];
+    bn::Fp S2;
+    bn::Fp::mul(S2, other.coord[1], Z1_cubed); // S2 = Y2*Z1*Z1Z1
+
+    if (U1 == U2 && S1 == S2)
+    {
+        // dbl case; nothing of above can be reused
+        return this->dbl();
+    }
+
+#ifdef PROFILE_OP_COUNTS
+    this->add_cnt++;
+#endif
+
+    bn128_G1 result;
+    bn::Fp H, HH, I, J, r, V, tmp;
+    // H = U2-X1
+    bn::Fp::sub(H, U2, this->coord[0]);
+    // HH = H^2
+    bn::Fp::square(HH, H);
+    // I = 4*HH
+    bn::Fp::add(tmp, HH, HH);
+    bn::Fp::add(I, tmp, tmp);
+    // J = H*I
+    bn::Fp::mul(J, H, I);
+    // r = 2*(S2-Y1)
+    bn::Fp::sub(tmp, S2, this->coord[1]);
+    bn::Fp::add(r, tmp, tmp);
+    // V = X1*I
+    bn::Fp::mul(V, this->coord[0], I);
+    // X3 = r^2-J-2*V
+    bn::Fp::square(result.coord[0], r);
+    bn::Fp::sub(result.coord[0], result.coord[0], J);
+    bn::Fp::sub(result.coord[0], result.coord[0], V);
+    bn::Fp::sub(result.coord[0], result.coord[0], V);
+    // Y3 = r*(V-X3)-2*Y1*J
+    bn::Fp::sub(tmp, V, result.coord[0]);
+    bn::Fp::mul(result.coord[1], r, tmp);
+    bn::Fp::mul(tmp, this->coord[1], J);
+    bn::Fp::sub(result.coord[1], result.coord[1], tmp);
+    bn::Fp::sub(result.coord[1], result.coord[1], tmp);
+    // Z3 = (Z1+H)^2-Z1Z1-HH
+    bn::Fp::add(tmp, this->coord[2], H);
+    bn::Fp::square(result.coord[2], tmp);
+    bn::Fp::sub(result.coord[2], result.coord[2], Z1Z1);
+    bn::Fp::sub(result.coord[2], result.coord[2], HH);
+    return result;
+}
+
+bn128_G1 bn128_G1::dbl() const
+{
+#ifdef PROFILE_OP_COUNTS
+    this->dbl_cnt++;
+#endif
+
+    bn128_G1 result;
+    bn::ecop::ECDouble(result.coord, this->coord);
+    return result;
+}
+
+bn128_G1 bn128_G1::zero()
+{
+    return G1_zero;
+}
+
+bn128_G1 bn128_G1::one()
+{
+    return G1_one;
+}
+
+bn128_G1 bn128_G1::random_element()
+{
+    return bn128_Fr::random_element().as_bigint() * G1_one;
+}
+
+std::ostream& operator<<(std::ostream &out, const bn128_G1 &g)
+{
+    bn128_G1 gcopy(g);
+    gcopy.to_affine_coordinates();
+
+    out << (gcopy.is_zero() ? '1' : '0') << OUTPUT_SEPARATOR;
+
+#ifdef NO_PT_COMPRESSION
+    /* no point compression case */
+#ifndef BINARY_OUTPUT
+    out << gcopy.coord[0] << OUTPUT_SEPARATOR << gcopy.coord[1];
+#else
+    out.write((char*) &gcopy.coord[0], sizeof(gcopy.coord[0]));
+    out.write((char*) &gcopy.coord[1], sizeof(gcopy.coord[1]));
+#endif
+
+#else
+    /* point compression case */
+#ifndef BINARY_OUTPUT
+    out << gcopy.coord[0];
+#else
+    out.write((char*) &gcopy.coord[0], sizeof(gcopy.coord[0]));
+#endif
+    out << OUTPUT_SEPARATOR << (((unsigned char*)&gcopy.coord[1])[0] & 1 ? '1' : '0');
+#endif
+
+    return out;
+}
+
+bool bn128_G1::is_well_formed() const
+{
+    if (this->is_zero())
+    {
+        return true;
+    }
+    else
+    {
+        /*
+          y^2 = x^3 + b
+
+          We are using Jacobian coordinates, so equation we need to check is actually
+
+          (y/z^3)^2 = (x/z^2)^3 + b
+          y^2 / z^6 = x^3 / z^6 + b
+          y^2 = x^3 + b z^6
+        */
+        bn::Fp X2, Y2, Z2;
+        bn::Fp::square(X2, this->coord[0]);
+        bn::Fp::square(Y2, this->coord[1]);
+        bn::Fp::square(Z2, this->coord[2]);
+
+        bn::Fp X3, Z3, Z6;
+        bn::Fp::mul(X3, X2, this->coord[0]);
+        bn::Fp::mul(Z3, Z2, this->coord[2]);
+        bn::Fp::square(Z6, Z3);
+
+        return (Y2 == X3 + bn128_coeff_b * Z6);
+    }
+}
+
+std::istream& operator>>(std::istream &in, bn128_G1 &g)
+{
+    char is_zero;
+    in.read((char*)&is_zero, 1); // this reads is_zero;
+    is_zero -= '0';
+    consume_OUTPUT_SEPARATOR(in);
+
+#ifdef NO_PT_COMPRESSION
+    /* no point compression case */
+#ifndef BINARY_OUTPUT
+    in >> g.coord[0];
+    consume_OUTPUT_SEPARATOR(in);
+    in >> g.coord[1];
+#else
+    in.read((char*) &g.coord[0], sizeof(g.coord[0]));
+    in.read((char*) &g.coord[1], sizeof(g.coord[1]));
+#endif
+
+#else
+    /* point compression case */
+    bn::Fp tX;
+#ifndef BINARY_OUTPUT
+    in >> tX;
+#else
+    in.read((char*)&tX, sizeof(tX));
+#endif
+    consume_OUTPUT_SEPARATOR(in);
+    unsigned char Y_lsb;
+    in.read((char*)&Y_lsb, 1);
+    Y_lsb -= '0';
+
+    // y = +/- sqrt(x^3 + b)
+    if (!is_zero)
+    {
+        g.coord[0] = tX;
+        bn::Fp tX2, tY2;
+        bn::Fp::square(tX2, tX);
+        bn::Fp::mul(tY2, tX2, tX);
+        bn::Fp::add(tY2, tY2, bn128_coeff_b);
+
+        g.coord[1] = bn128_G1::sqrt(tY2);
+        if ((((unsigned char*)&g.coord[1])[0] & 1) != Y_lsb)
+        {
+            bn::Fp::neg(g.coord[1], g.coord[1]);
+        }
+    }
+#endif
+
+    /* finalize */
+    if (!is_zero)
+    {
+        g.coord[2] = bn::Fp(1);
+    }
+    else
+    {
+        g = bn128_G1::zero();
+    }
+
+    return in;
+}
+
+std::ostream& operator<<(std::ostream& out, const std::vector<bn128_G1> &v)
+{
+    out << v.size() << "\n";
+    for (const bn128_G1& t : v)
+    {
+        out << t << OUTPUT_NEWLINE;
+    }
+    return out;
+}
+
+std::istream& operator>>(std::istream& in, std::vector<bn128_G1> &v)
+{
+    v.clear();
+
+    size_t s;
+    in >> s;
+    consume_newline(in);
+    v.reserve(s);
+
+    for (size_t i = 0; i < s; ++i)
+    {
+        bn128_G1 g;
+        in >> g;
+        consume_OUTPUT_NEWLINE(in);
+        v.emplace_back(g);
+    }
+    return in;
+}
+
+void bn128_G1::batch_to_special_all_non_zeros(std::vector<bn128_G1> &vec)
+{
+    std::vector<bn::Fp> Z_vec;
+    Z_vec.reserve(vec.size());
+
+    for (auto &el: vec)
+    {
+        Z_vec.emplace_back(el.coord[2]);
+    }
+    bn_batch_invert<bn::Fp>(Z_vec);
+
+    const bn::Fp one = 1;
+
+    for (size_t i = 0; i < vec.size(); ++i)
+    {
+        bn::Fp Z2, Z3;
+        bn::Fp::square(Z2, Z_vec[i]);
+        bn::Fp::mul(Z3, Z2, Z_vec[i]);
+
+        bn::Fp::mul(vec[i].coord[0], vec[i].coord[0], Z2);
+        bn::Fp::mul(vec[i].coord[1], vec[i].coord[1], Z3);
+        vec[i].coord[2] = one;
+    }
+}
+
+} // libff
diff --git a/src/libff/libff/algebra/curves/bn128/bn128_g1.hpp b/src/libff/libff/algebra/curves/bn128/bn128_g1.hpp
new file mode 100755
index 000000000..4e40c7ce3
--- /dev/null
+++ b/src/libff/libff/algebra/curves/bn128/bn128_g1.hpp
@@ -0,0 +1,94 @@
+/** @file
+ *****************************************************************************
+ * @author     This file is part of libff, developed by SCIPR Lab
+ *             and contributors (see AUTHORS).
+ * @copyright  MIT license (see LICENSE file)
+ *****************************************************************************/
+
+#ifndef BN128_G1_HPP_
+#define BN128_G1_HPP_
+#include <vector>
+
+#include "depends/ate-pairing/include/bn.h"
+
+#include <libff/algebra/curves/bn128/bn128_init.hpp>
+#include <libff/algebra/curves/curve_utils.hpp>
+
+namespace libff {
+
+class bn128_G1;
+std::ostream& operator<<(std::ostream &, const bn128_G1&);
+std::istream& operator>>(std::istream &, bn128_G1&);
+
+class bn128_G1 {
+private:
+    static bn::Fp sqrt(const bn::Fp &el);
+public:
+#ifdef PROFILE_OP_COUNTS
+    static long long add_cnt;
+    static long long dbl_cnt;
+#endif
+    static std::vector<size_t> wnaf_window_table;
+    static std::vector<size_t> fixed_base_exp_window_table;
+    static bn128_G1 G1_zero;
+    static bn128_G1 G1_one;
+
+    bn::Fp coord[3];
+    bn128_G1();
+    typedef bn128_Fq base_field;
+    typedef bn128_Fr scalar_field;
+
+    void print() const;
+    void print_coordinates() const;
+
+    void to_affine_coordinates();
+    void to_special();
+    bool is_special() const;
+
+    bool is_zero() const;
+
+    bool operator==(const bn128_G1 &other) const;
+    bool operator!=(const bn128_G1 &other) const;
+
+    bn128_G1 operator+(const bn128_G1 &other) const;
+    bn128_G1 operator-() const;
+    bn128_G1 operator-(const bn128_G1 &other) const;
+
+    bn128_G1 add(const bn128_G1 &other) const;
+    bn128_G1 mixed_add(const bn128_G1 &other) const;
+    bn128_G1 dbl() const;
+
+    bool is_well_formed() const;
+
+    static bn128_G1 zero();
+    static bn128_G1 one();
+    static bn128_G1 random_element();
+
+    static size_t size_in_bits() { return bn128_Fq::size_in_bits() + 1; }
+    static bigint<base_field::num_limbs> base_field_char() { return base_field::field_char(); }
+    static bigint<scalar_field::num_limbs> order() { return scalar_field::field_char(); }
+
+    friend std::ostream& operator<<(std::ostream &out, const bn128_G1 &g);
+    friend std::istream& operator>>(std::istream &in, bn128_G1 &g);
+
+    static void batch_to_special_all_non_zeros(std::vector<bn128_G1> &vec);
+};
+
+template<mp_size_t m>
+bn128_G1 operator*(const bigint<m> &lhs, const bn128_G1 &rhs)
+{
+    return scalar_mul<bn128_G1, m>(rhs, lhs);
+}
+
+template<mp_size_t m, const bigint<m>& modulus_p>
+bn128_G1 operator*(const Fp_model<m,modulus_p> &lhs, const bn128_G1 &rhs)
+{
+    return scalar_mul<bn128_G1, m>(rhs, lhs.as_bigint());
+}
+
+std::ostream& operator<<(std::ostream& out, const std::vector<bn128_G1> &v);
+std::istream& operator>>(std::istream& in, std::vector<bn128_G1> &v);
+
+
+} // libff
+#endif // BN128_G1_HPP_
diff --git a/src/libff/libff/algebra/curves/bn128/bn128_g2.cpp b/src/libff/libff/algebra/curves/bn128/bn128_g2.cpp
new file mode 100755
index 000000000..cd8eb72f5
--- /dev/null
+++ b/src/libff/libff/algebra/curves/bn128/bn128_g2.cpp
@@ -0,0 +1,502 @@
+/** @file
+ *****************************************************************************
+ * @author     This file is part of libff, developed by SCIPR Lab
+ *             and contributors (see AUTHORS).
+ * @copyright  MIT license (see LICENSE file)
+ *****************************************************************************/
+
+#include <libff/algebra/curves/bn128/bn128_g2.hpp>
+#include <libff/algebra/curves/bn128/bn_utils.hpp>
+
+namespace libff {
+
+#ifdef PROFILE_OP_COUNTS
+long long bn128_G2::add_cnt = 0;
+long long bn128_G2::dbl_cnt = 0;
+#endif
+
+std::vector<size_t> bn128_G2::wnaf_window_table;
+std::vector<size_t> bn128_G2::fixed_base_exp_window_table;
+bn128_G2 bn128_G2::G2_zero;
+bn128_G2 bn128_G2::G2_one;
+
+bn::Fp2 bn128_G2::sqrt(const bn::Fp2 &el)
+{
+    size_t v = bn128_Fq2_s;
+    bn::Fp2 z = bn128_Fq2_nqr_to_t;
+    bn::Fp2 w = mie::power(el, bn128_Fq2_t_minus_1_over_2);
+    bn::Fp2 x = el * w;
+    bn::Fp2 b = x * w;
+
+#if DEBUG
+    // check if square with Euler's criterion
+    bn::Fp2 check = b;
+    for (size_t i = 0; i < v-1; ++i)
+    {
+        bn::Fp2::square(check, check);
+    }
+
+    assert(check == bn::Fp2(bn::Fp(1), bn::Fp(0)));
+#endif
+
+    // compute square root with Tonelli--Shanks
+    // (does not terminate if not a square!)
+
+    while (b != bn::Fp2(1))
+    {
+        size_t m = 0;
+        bn::Fp2 b2m = b;
+        while (b2m != bn::Fp2(bn::Fp(1), bn::Fp(0)))
+        {
+            // invariant: b2m = b^(2^m) after entering this loop
+            bn::Fp2::square(b2m, b2m);
+            m += 1;
+        }
+
+        int j = v-m-1;
+        w = z;
+        while (j > 0)
+        {
+            bn::Fp2::square(w, w);
+            --j;
+        } // w = z^2^(v-m-1)
+
+        z = w * w;
+        b = b * z;
+        x = x * w;
+        v = m;
+    }
+
+    return x;
+}
+
+bn128_G2::bn128_G2()
+{
+    this->coord[0] = G2_zero.coord[0];
+    this->coord[1] = G2_zero.coord[1];
+    this->coord[2] = G2_zero.coord[2];
+}
+
+void bn128_G2::print() const
+{
+    if (this->is_zero())
+    {
+        printf("O\n");
+    }
+    else
+    {
+        bn128_G2 copy(*this);
+        copy.to_affine_coordinates();
+        std::cout << "(" << copy.coord[0].toString(10) << " : " << copy.coord[1].toString(10) << " : " << copy.coord[2].toString(10) << ")\n";
+    }
+}
+
+void bn128_G2::print_coordinates() const
+{
+    if (this->is_zero())
+    {
+        printf("O\n");
+    }
+    else
+    {
+        std::cout << "(" << coord[0].toString(10) << " : " << coord[1].toString(10) << " : " << coord[2].toString(10) << ")\n";
+    }
+}
+
+void bn128_G2::to_affine_coordinates()
+{
+    if (this->is_zero())
+    {
+        coord[0] = 0;
+        coord[1] = 1;
+        coord[2] = 0;
+    }
+    else
+    {
+        bn::Fp2 r;
+        r = coord[2];
+        r.inverse();
+        bn::Fp2::square(coord[2], r);
+        coord[0] *= coord[2];
+        r *= coord[2];
+        coord[1] *= r;
+        coord[2] = 1;
+    }
+}
+
+void bn128_G2::to_special()
+{
+    this->to_affine_coordinates();
+}
+
+bool bn128_G2::is_special() const
+{
+    return (this->is_zero() || this->coord[2] == 1);
+}
+
+bool bn128_G2::is_zero() const
+{
+    return coord[2].isZero();
+}
+
+bool bn128_G2::operator==(const bn128_G2 &other) const
+{
+    if (this->is_zero())
+    {
+        return other.is_zero();
+    }
+
+    if (other.is_zero())
+    {
+        return false;
+    }
+
+    /* now neither is O */
+
+    bn::Fp2 Z1sq, Z2sq, lhs, rhs;
+    bn::Fp2::square(Z1sq, this->coord[2]);
+    bn::Fp2::square(Z2sq, other.coord[2]);
+    bn::Fp2::mul(lhs, Z2sq, this->coord[0]);
+    bn::Fp2::mul(rhs, Z1sq, other.coord[0]);
+
+    if (lhs != rhs)
+    {
+        return false;
+    }
+
+    bn::Fp2 Z1cubed, Z2cubed;
+    bn::Fp2::mul(Z1cubed, Z1sq, this->coord[2]);
+    bn::Fp2::mul(Z2cubed, Z2sq, other.coord[2]);
+    bn::Fp2::mul(lhs, Z2cubed, this->coord[1]);
+    bn::Fp2::mul(rhs, Z1cubed, other.coord[1]);
+
+    return (lhs == rhs);
+}
+
+bool bn128_G2::operator!=(const bn128_G2& other) const
+{
+    return !(operator==(other));
+}
+
+bn128_G2 bn128_G2::operator+(const bn128_G2 &other) const
+{
+    // handle special cases having to do with O
+    if (this->is_zero())
+    {
+        return other;
+    }
+
+    if (other.is_zero())
+    {
+        return *this;
+    }
+
+    // no need to handle points of order 2,4
+    // (they cannot exist in a prime-order subgroup)
+
+    // handle double case, and then all the rest
+    if (this->operator==(other))
+    {
+        return this->dbl();
+    }
+    else
+    {
+        return this->add(other);
+    }
+}
+
+bn128_G2 bn128_G2::operator-() const
+{
+    bn128_G2 result(*this);
+    bn::Fp2::neg(result.coord[1], result.coord[1]);
+    return result;
+}
+
+bn128_G2 bn128_G2::operator-(const bn128_G2 &other) const
+{
+    return (*this) + (-other);
+}
+
+bn128_G2 bn128_G2::add(const bn128_G2 &other) const
+{
+#ifdef PROFILE_OP_COUNTS
+    this->add_cnt++;
+#endif
+
+    bn128_G2 result;
+    bn::ecop::ECAdd(result.coord, this->coord, other.coord);
+    return result;
+}
+
+bn128_G2 bn128_G2::mixed_add(const bn128_G2 &other) const
+{
+    if (this->is_zero())
+    {
+        return other;
+    }
+
+    if (other.is_zero())
+    {
+        return *this;
+    }
+
+    // no need to handle points of order 2,4
+    // (they cannot exist in a prime-order subgroup)
+
+#ifdef DEBUG
+    assert(other.is_special());
+#endif
+
+    // check for doubling case
+
+    // using Jacobian coordinates so:
+    // (X1:Y1:Z1) = (X2:Y2:Z2)
+    // iff
+    // X1/Z1^2 == X2/Z2^2 and Y1/Z1^3 == Y2/Z2^3
+    // iff
+    // X1 * Z2^2 == X2 * Z1^2 and Y1 * Z2^3 == Y2 * Z1^3
+
+    // we know that Z2 = 1
+
+    bn::Fp2 Z1Z1;
+    bn::Fp2::square(Z1Z1, this->coord[2]);
+    const bn::Fp2 &U1 = this->coord[0];
+    bn::Fp2 U2;
+    bn::Fp2::mul(U2, other.coord[0], Z1Z1);
+    bn::Fp2 Z1_cubed;
+    bn::Fp2::mul(Z1_cubed, this->coord[2], Z1Z1);
+
+    const bn::Fp2 &S1 = this->coord[1];
+    bn::Fp2 S2;
+    bn::Fp2::mul(S2, other.coord[1], Z1_cubed); // S2 = Y2*Z1*Z1Z1
+
+    if (U1 == U2 && S1 == S2)
+    {
+        // dbl case; nothing of above can be reused
+        return this->dbl();
+    }
+
+#ifdef PROFILE_OP_COUNTS
+    this->add_cnt++;
+#endif
+
+    bn128_G2 result;
+    bn::Fp2 H, HH, I, J, r, V, tmp;
+    // H = U2-X1
+    bn::Fp2::sub(H, U2, this->coord[0]);
+    // HH = H^2
+    bn::Fp2::square(HH, H);
+    // I = 4*HH
+    bn::Fp2::add(tmp, HH, HH);
+    bn::Fp2::add(I, tmp, tmp);
+    // J = H*I
+    bn::Fp2::mul(J, H, I);
+    // r = 2*(S2-Y1)
+    bn::Fp2::sub(tmp, S2, this->coord[1]);
+    bn::Fp2::add(r, tmp, tmp);
+    // V = X1*I
+    bn::Fp2::mul(V, this->coord[0], I);
+    // X3 = r^2-J-2*V
+    bn::Fp2::square(result.coord[0], r);
+    bn::Fp2::sub(result.coord[0], result.coord[0], J);
+    bn::Fp2::sub(result.coord[0], result.coord[0], V);
+    bn::Fp2::sub(result.coord[0], result.coord[0], V);
+    // Y3 = r*(V-X3)-2*Y1*J
+    bn::Fp2::sub(tmp, V, result.coord[0]);
+    bn::Fp2::mul(result.coord[1], r, tmp);
+    bn::Fp2::mul(tmp, this->coord[1], J);
+    bn::Fp2::sub(result.coord[1], result.coord[1], tmp);
+    bn::Fp2::sub(result.coord[1], result.coord[1], tmp);
+    // Z3 = (Z1+H)^2-Z1Z1-HH
+    bn::Fp2::add(tmp, this->coord[2], H);
+    bn::Fp2::square(result.coord[2], tmp);
+    bn::Fp2::sub(result.coord[2], result.coord[2], Z1Z1);
+    bn::Fp2::sub(result.coord[2], result.coord[2], HH);
+    return result;
+}
+
+bn128_G2 bn128_G2::dbl() const
+{
+#ifdef PROFILE_OP_COUNTS
+    this->dbl_cnt++;
+#endif
+    bn128_G2 result;
+    bn::ecop::ECDouble(result.coord, this->coord);
+    return result;
+}
+
+bool bn128_G2::is_well_formed() const
+{
+    if (this->is_zero())
+    {
+        return true;
+    }
+    else
+    {
+        /*
+          y^2 = x^3 + b
+
+          We are using Jacobian coordinates, so equation we need to check is actually
+
+          (y/z^3)^2 = (x/z^2)^3 + b
+          y^2 / z^6 = x^3 / z^6 + b
+          y^2 = x^3 + b z^6
+        */
+        bn::Fp2 X2, Y2, Z2;
+        bn::Fp2::square(X2, this->coord[0]);
+        bn::Fp2::square(Y2, this->coord[1]);
+        bn::Fp2::square(Z2, this->coord[2]);
+
+        bn::Fp2 X3, Z3, Z6;
+        bn::Fp2::mul(X3, X2, this->coord[0]);
+        bn::Fp2::mul(Z3, Z2, this->coord[2]);
+        bn::Fp2::square(Z6, Z3);
+
+        return (Y2 == X3 + bn128_twist_coeff_b * Z6);
+    }
+}
+
+bn128_G2 bn128_G2::zero()
+{
+    return G2_zero;
+}
+
+bn128_G2 bn128_G2::one()
+{
+    return G2_one;
+}
+
+bn128_G2 bn128_G2::random_element()
+{
+    return bn128_Fr::random_element().as_bigint() * G2_one;
+}
+
+std::ostream& operator<<(std::ostream &out, const bn128_G2 &g)
+{
+    bn128_G2 gcopy(g);
+    gcopy.to_affine_coordinates();
+
+    out << (gcopy.is_zero() ? '1' : '0') << OUTPUT_SEPARATOR;
+
+#ifdef NO_PT_COMPRESSION
+    /* no point compression case */
+#ifndef BINARY_OUTPUT
+    out << gcopy.coord[0].a_ << OUTPUT_SEPARATOR << gcopy.coord[0].b_ << OUTPUT_SEPARATOR;
+    out << gcopy.coord[1].a_ << OUTPUT_SEPARATOR << gcopy.coord[1].b_;
+#else
+    out.write((char*) &gcopy.coord[0].a_, sizeof(gcopy.coord[0].a_));
+    out.write((char*) &gcopy.coord[0].b_, sizeof(gcopy.coord[0].b_));
+    out.write((char*) &gcopy.coord[1].a_, sizeof(gcopy.coord[1].a_));
+    out.write((char*) &gcopy.coord[1].b_, sizeof(gcopy.coord[1].b_));
+#endif
+
+#else
+    /* point compression case */
+#ifndef BINARY_OUTPUT
+    out << gcopy.coord[0].a_ << OUTPUT_SEPARATOR << gcopy.coord[0].b_;
+#else
+    out.write((char*) &gcopy.coord[0].a_, sizeof(gcopy.coord[0].a_));
+    out.write((char*) &gcopy.coord[0].b_, sizeof(gcopy.coord[0].b_));
+#endif
+    out << OUTPUT_SEPARATOR << (((unsigned char*)&gcopy.coord[1].a_)[0] & 1 ? '1' : '0');
+#endif
+
+    return out;
+}
+
+std::istream& operator>>(std::istream &in, bn128_G2 &g)
+{
+    char is_zero;
+    in.read((char*)&is_zero, 1); // this reads is_zero;
+    is_zero -= '0';
+    consume_OUTPUT_SEPARATOR(in);
+
+#ifdef NO_PT_COMPRESSION
+    /* no point compression case */
+#ifndef BINARY_OUTPUT
+    in >> g.coord[0].a_;
+    consume_OUTPUT_SEPARATOR(in);
+    in >> g.coord[0].b_;
+    consume_OUTPUT_SEPARATOR(in);
+    in >> g.coord[1].a_;
+    consume_OUTPUT_SEPARATOR(in);
+    in >> g.coord[1].b_;
+#else
+    in.read((char*) &g.coord[0].a_, sizeof(g.coord[0].a_));
+    in.read((char*) &g.coord[0].b_, sizeof(g.coord[0].b_));
+    in.read((char*) &g.coord[1].a_, sizeof(g.coord[1].a_));
+    in.read((char*) &g.coord[1].b_, sizeof(g.coord[1].b_));
+#endif
+
+#else
+    /* point compression case */
+    bn::Fp2 tX;
+#ifndef BINARY_OUTPUT
+    in >> tX.a_;
+    consume_OUTPUT_SEPARATOR(in);
+    in >> tX.b_;
+#else
+    in.read((char*)&tX.a_, sizeof(tX.a_));
+    in.read((char*)&tX.b_, sizeof(tX.b_));
+#endif
+    consume_OUTPUT_SEPARATOR(in);
+    unsigned char Y_lsb;
+    in.read((char*)&Y_lsb, 1);
+    Y_lsb -= '0';
+
+    // y = +/- sqrt(x^3 + b)
+    if (!is_zero)
+    {
+        g.coord[0] = tX;
+        bn::Fp2 tX2, tY2;
+        bn::Fp2::square(tX2, tX);
+        bn::Fp2::mul(tY2, tX2, tX);
+        bn::Fp2::add(tY2, tY2, bn128_twist_coeff_b);
+
+        g.coord[1] = bn128_G2::sqrt(tY2);
+        if ((((unsigned char*)&g.coord[1].a_)[0] & 1) != Y_lsb)
+        {
+            bn::Fp2::neg(g.coord[1], g.coord[1]);
+        }
+    }
+#endif
+
+    /* finalize */
+    if (!is_zero)
+    {
+        g.coord[2] = bn::Fp2(bn::Fp(1), bn::Fp(0));
+    }
+    else
+    {
+        g = bn128_G2::zero();
+    }
+
+    return in;
+}
+
+void bn128_G2::batch_to_special_all_non_zeros(std::vector<bn128_G2> &vec)
+{
+    std::vector<bn::Fp2> Z_vec;
+    Z_vec.reserve(vec.size());
+
+    for (auto &el: vec)
+    {
+        Z_vec.emplace_back(el.coord[2]);
+    }
+    bn_batch_invert<bn::Fp2>(Z_vec);
+
+    const bn::Fp2 one = 1;
+
+    for (size_t i = 0; i < vec.size(); ++i)
+    {
+        bn::Fp2 Z2, Z3;
+        bn::Fp2::square(Z2, Z_vec[i]);
+        bn::Fp2::mul(Z3, Z2, Z_vec[i]);
+
+        bn::Fp2::mul(vec[i].coord[0], vec[i].coord[0], Z2);
+        bn::Fp2::mul(vec[i].coord[1], vec[i].coord[1], Z3);
+        vec[i].coord[2] = one;
+    }
+}
+
+} // libff
diff --git a/src/libff/libff/algebra/curves/bn128/bn128_g2.hpp b/src/libff/libff/algebra/curves/bn128/bn128_g2.hpp
new file mode 100755
index 000000000..7cdd5d6fa
--- /dev/null
+++ b/src/libff/libff/algebra/curves/bn128/bn128_g2.hpp
@@ -0,0 +1,91 @@
+/** @file
+ *****************************************************************************
+ * @author     This file is part of libff, developed by SCIPR Lab
+ *             and contributors (see AUTHORS).
+ * @copyright  MIT license (see LICENSE file)
+ *****************************************************************************/
+
+#ifndef BN128_G2_HPP_
+#define BN128_G2_HPP_
+#include <iostream>
+#include <vector>
+
+#include "depends/ate-pairing/include/bn.h"
+
+#include <libff/algebra/curves/bn128/bn128_init.hpp>
+#include <libff/algebra/curves/curve_utils.hpp>
+
+namespace libff {
+
+class bn128_G2;
+std::ostream& operator<<(std::ostream &, const bn128_G2&);
+std::istream& operator>>(std::istream &, bn128_G2&);
+
+class bn128_G2 {
+private:
+    static bn::Fp2 sqrt(const bn::Fp2 &el);
+public:
+#ifdef PROFILE_OP_COUNTS
+    static long long add_cnt;
+    static long long dbl_cnt;
+#endif
+    static std::vector<size_t> wnaf_window_table;
+    static std::vector<size_t> fixed_base_exp_window_table;
+    static bn128_G2 G2_zero;
+    static bn128_G2 G2_one;
+
+    bn::Fp2 coord[3];
+    bn128_G2();
+    typedef bn128_Fq base_field;
+    typedef bn128_Fr scalar_field;
+
+    void print() const;
+    void print_coordinates() const;
+
+    void to_affine_coordinates();
+    void to_special();
+    bool is_special() const;
+
+    bool is_zero() const;
+
+    bool operator==(const bn128_G2 &other) const;
+    bool operator!=(const bn128_G2 &other) const;
+
+    bn128_G2 operator+(const bn128_G2 &other) const;
+    bn128_G2 operator-() const;
+    bn128_G2 operator-(const bn128_G2 &other) const;
+
+    bn128_G2 add(const bn128_G2 &other) const;
+    bn128_G2 mixed_add(const bn128_G2 &other) const;
+    bn128_G2 dbl() const;
+
+    bool is_well_formed() const;
+
+    static bn128_G2 zero();
+    static bn128_G2 one();
+    static bn128_G2 random_element();
+
+    static size_t size_in_bits() { return 2*base_field::size_in_bits() + 1; }
+    static bigint<base_field::num_limbs> base_field_char() { return base_field::field_char(); }
+    static bigint<scalar_field::num_limbs> order() { return scalar_field::field_char(); }
+
+    friend std::ostream& operator<<(std::ostream &out, const bn128_G2 &g);
+    friend std::istream& operator>>(std::istream &in, bn128_G2 &g);
+
+    static void batch_to_special_all_non_zeros(std::vector<bn128_G2> &vec);
+};
+
+template<mp_size_t m>
+bn128_G2 operator*(const bigint<m> &lhs, const bn128_G2 &rhs)
+{
+    return scalar_mul<bn128_G2, m>(rhs, lhs);
+}
+
+template<mp_size_t m, const bigint<m>& modulus_p>
+bn128_G2 operator*(const Fp_model<m, modulus_p> &lhs, const bn128_G2 &rhs)
+{
+    return scalar_mul<bn128_G2, m>(rhs, lhs.as_bigint());
+}
+
+} // libff
+#endif // BN128_G2_HPP_
diff --git a/src/libff/libff/algebra/curves/bn128/bn128_gt.cpp b/src/libff/libff/algebra/curves/bn128/bn128_gt.cpp
new file mode 100755
index 000000000..9cbcf6a70
--- /dev/null
+++ b/src/libff/libff/algebra/curves/bn128/bn128_gt.cpp
@@ -0,0 +1,70 @@
+/** @file
+ *****************************************************************************
+ * @author     This file is part of libff, developed by SCIPR Lab
+ *             and contributors (see AUTHORS).
+ * @copyright  MIT license (see LICENSE file)
+ *****************************************************************************/
+
+#include <libff/algebra/curves/bn128/bn128_gt.hpp>
+
+namespace libff {
+
+bn128_GT bn128_GT::GT_one;
+bn128_GT::bn128_GT()
+{
+    this->elem.clear();
+}
+
+bool bn128_GT::operator==(const bn128_GT &other) const
+{
+    return (this->elem == other.elem);
+}
+
+bool bn128_GT::operator!=(const bn128_GT& other) const
+{
+    return !(operator==(other));
+}
+
+bn128_GT bn128_GT::operator*(const bn128_GT &other) const
+{
+    bn128_GT result;
+    bn::Fp12::mul(result.elem, this->elem, other.elem);
+    return result;
+}
+
+bn128_GT bn128_GT::unitary_inverse() const
+{
+    bn128_GT result(*this);
+    bn::Fp6::neg(result.elem.b_, result.elem.b_);
+    return result;
+}
+
+bn128_GT bn128_GT::one()
+{
+    return GT_one;
+}
+
+std::ostream& operator<<(std::ostream &out, const bn128_GT &g)
+{
+#ifndef BINARY_OUTPUT
+    out << g.elem.a_ << OUTPUT_SEPARATOR << g.elem.b_;
+#else
+    out.write((char*) &g.elem.a_, sizeof(g.elem.a_));
+    out.write((char*) &g.elem.b_, sizeof(g.elem.b_));
+#endif
+    return out;
+}
+
+std::istream& operator>>(std::istream &in, bn128_GT &g)
+{
+#ifndef BINARY_OUTPUT
+    in >> g.elem.a_;
+    consume_OUTPUT_SEPARATOR(in);
+    in >> g.elem.b_;
+#else
+    in.read((char*) &g.elem.a_, sizeof(g.elem.a_));
+    in.read((char*) &g.elem.b_, sizeof(g.elem.b_));
+#endif
+    return in;
+}
+} // libff
diff --git a/src/libff/libff/algebra/curves/bn128/bn128_gt.hpp b/src/libff/libff/algebra/curves/bn128/bn128_gt.hpp
new file mode 100755
index 000000000..a4e18548a
--- /dev/null
+++ b/src/libff/libff/algebra/curves/bn128/bn128_gt.hpp
@@ -0,0 +1,57 @@
+/** @file
+ *****************************************************************************
+ * @author     This file is part of libff, developed by SCIPR Lab
+ *             and contributors (see AUTHORS).
+ * @copyright  MIT license (see LICENSE file)
+ *****************************************************************************/
+
+#ifndef BN128_GT_HPP_
+#define BN128_GT_HPP_
+#include <iostream>
+
+#include "depends/ate-pairing/include/bn.h"
+
+#include <libff/algebra/fields/field_utils.hpp>
+#include <libff/algebra/fields/fp.hpp>
+
+namespace libff {
+
+class bn128_GT;
+std::ostream& operator<<(std::ostream &, const bn128_GT&);
+std::istream& operator>>(std::istream &, bn128_GT&);
+
+class bn128_GT {
+public:
+    static bn128_GT GT_one;
+    bn::Fp12 elem;
+
+    bn128_GT();
+    bool operator==(const bn128_GT &other) const;
+    bool operator!=(const bn128_GT &other) const;
+
+    bn128_GT operator*(const bn128_GT &other) const;
+    bn128_GT unitary_inverse() const;
+
+    static bn128_GT one();
+
+    void print() { std::cout << this->elem << "\n"; };
+
+    friend std::ostream& operator<<(std::ostream &out, const bn128_GT &g);
+    friend std::istream& operator>>(std::istream &in, bn128_GT &g);
+};
+
+template<mp_size_t m>
+bn128_GT operator^(const bn128_GT &rhs, const bigint<m> &lhs)
+{
+    return power<bn128_GT, m>(rhs, lhs);
+}
+
+
+template<mp_size_t m, const bigint<m>& modulus_p>
+bn128_GT operator^(const bn128_GT &rhs, const Fp_model<m,modulus_p> &lhs)
+{
+    return power<bn128_GT, m>(rhs, lhs.as_bigint());
+}
+
+} // libff
+#endif // BN128_GT_HPP_
diff --git a/src/libff/libff/algebra/curves/bn128/bn128_init.cpp b/src/libff/libff/algebra/curves/bn128/bn128_init.cpp
new file mode 100755
index 000000000..f7cac6573
--- /dev/null
+++ b/src/libff/libff/algebra/curves/bn128/bn128_init.cpp
@@ -0,0 +1,226 @@
+/** @file
+ *****************************************************************************
+ * @author     This file is part of libff, developed by SCIPR Lab
+ *             and contributors (see AUTHORS).
+ * @copyright  MIT license (see LICENSE file)
+ *****************************************************************************/
+
+#include <libff/algebra/curves/bn128/bn128_g1.hpp>
+#include <libff/algebra/curves/bn128/bn128_g2.hpp>
+#include <libff/algebra/curves/bn128/bn128_gt.hpp>
+#include <libff/algebra/curves/bn128/bn128_init.hpp>
+
+namespace libff {
+
+bigint<bn128_r_limbs> bn128_modulus_r;
+bigint<bn128_q_limbs> bn128_modulus_q;
+
+bn::Fp bn128_coeff_b;
+size_t bn128_Fq_s;
+bn::Fp bn128_Fq_nqr_to_t;
+mie::Vuint bn128_Fq_t_minus_1_over_2;
+
+bn::Fp2 bn128_twist_coeff_b;
+size_t bn128_Fq2_s;
+bn::Fp2 bn128_Fq2_nqr_to_t;
+mie::Vuint bn128_Fq2_t_minus_1_over_2;
+
+void init_bn128_params()
+{
+    bn::Param::init(); // init ate-pairing library
+
+    typedef bigint<bn128_r_limbs> bigint_r;
+    typedef bigint<bn128_q_limbs> bigint_q;
+
+    assert(sizeof(mp_limb_t) == 8 || sizeof(mp_limb_t) == 4); // Montgomery assumes this
+
+    /* parameters for scalar field Fr */
+    bn128_modulus_r = bigint_r("21888242871839275222246405745257275088548364400416034343698204186575808495617");
+    assert(bn128_Fr::modulus_is_valid());
+    if (sizeof(mp_limb_t) == 8)
+    {
+        bn128_Fr::Rsquared = bigint_r("944936681149208446651664254269745548490766851729442924617792859073125903783");
+        bn128_Fr::Rcubed = bigint_r("5866548545943845227489894872040244720403868105578784105281690076696998248512");
+        bn128_Fr::inv = 0xc2e1f593efffffff;
+    }
+    if (sizeof(mp_limb_t) == 4)
+    {
+        bn128_Fr::Rsquared = bigint_r("944936681149208446651664254269745548490766851729442924617792859073125903783");
+        bn128_Fr::Rcubed = bigint_r("5866548545943845227489894872040244720403868105578784105281690076696998248512");
+        bn128_Fr::inv = 0xefffffff;
+    }
+    bn128_Fr::num_bits = 254;
+    bn128_Fr::euler = bigint_r("10944121435919637611123202872628637544274182200208017171849102093287904247808");
+    bn128_Fr::s = 28;
+    bn128_Fr::t = bigint_r("81540058820840996586704275553141814055101440848469862132140264610111");
+    bn128_Fr::t_minus_1_over_2 = bigint_r("40770029410420498293352137776570907027550720424234931066070132305055");
+    bn128_Fr::multiplicative_generator = bn128_Fr("5");
+    bn128_Fr::root_of_unity = bn128_Fr("19103219067921713944291392827692070036145651957329286315305642004821462161904");
+    bn128_Fr::nqr = bn128_Fr("5");
+    bn128_Fr::nqr_to_t = bn128_Fr("19103219067921713944291392827692070036145651957329286315305642004821462161904");
+
+    /* parameters for base field Fq */
+    bn128_modulus_q = bigint_q("21888242871839275222246405745257275088696311157297823662689037894645226208583");
+    assert(bn128_Fq::modulus_is_valid());
+    if (sizeof(mp_limb_t) == 8)
+    {
+        bn128_Fq::Rsquared = bigint_q("3096616502983703923843567936837374451735540968419076528771170197431451843209");
+        bn128_Fq::Rcubed = bigint_q("14921786541159648185948152738563080959093619838510245177710943249661917737183");
+        bn128_Fq::inv = 0x87d20782e4866389;
+    }
+    if (sizeof(mp_limb_t) == 4)
+    {
+        bn128_Fq::Rsquared = bigint_q("3096616502983703923843567936837374451735540968419076528771170197431451843209");
+        bn128_Fq::Rcubed = bigint_q("14921786541159648185948152738563080959093619838510245177710943249661917737183");
+        bn128_Fq::inv = 0xe4866389;
+    }
+    bn128_Fq::num_bits = 254;
+    bn128_Fq::euler = bigint_q("10944121435919637611123202872628637544348155578648911831344518947322613104291");
+    bn128_Fq::s = 1;
+    bn128_Fq::t = bigint_q("10944121435919637611123202872628637544348155578648911831344518947322613104291");
+    bn128_Fq::t_minus_1_over_2 = bigint_q("5472060717959818805561601436314318772174077789324455915672259473661306552145");
+    bn128_Fq::multiplicative_generator = bn128_Fq("3");
+    bn128_Fq::root_of_unity = bn128_Fq("21888242871839275222246405745257275088696311157297823662689037894645226208582");
+    bn128_Fq::nqr = bn128_Fq("3");
+    bn128_Fq::nqr_to_t = bn128_Fq("21888242871839275222246405745257275088696311157297823662689037894645226208582");
+
+    /* additional parameters for square roots in Fq/Fq2 */
+    bn128_coeff_b = bn::Fp(3);
+    bn128_Fq_s = 1;
+    bn128_Fq_nqr_to_t = bn::Fp("21888242871839275222246405745257275088696311157297823662689037894645226208582");
+    bn128_Fq_t_minus_1_over_2 = mie::Vuint("5472060717959818805561601436314318772174077789324455915672259473661306552145");
+
+    bn128_twist_coeff_b = bn::Fp2(bn::Fp("19485874751759354771024239261021720505790618469301721065564631296452457478373"),
+                                  bn::Fp("266929791119991161246907387137283842545076965332900288569378510910307636690"));
+    bn128_Fq2_s = 4;
+    bn128_Fq2_nqr_to_t = bn::Fp2(bn::Fp("5033503716262624267312492558379982687175200734934877598599011485707452665730"),
+                                 bn::Fp("314498342015008975724433667930697407966947188435857772134235984660852259084"));
+    bn128_Fq2_t_minus_1_over_2 = mie::Vuint("14971724250519463826312126413021210649976634891596900701138993820439690427699319920245032869357433499099632259837909383182382988566862092145199781964621");
+
+    /* choice of group G1 */
+    bn128_G1::G1_zero.coord[0] = bn::Fp(1);
+    bn128_G1::G1_zero.coord[1] = bn::Fp(1);
+    bn128_G1::G1_zero.coord[2] = bn::Fp(0);
+
+    bn128_G1::G1_one.coord[0] = bn::Fp(1);
+    bn128_G1::G1_one.coord[1] = bn::Fp(2);
+    bn128_G1::G1_one.coord[2] = bn::Fp(1);
+
+    bn128_G1::wnaf_window_table.resize(0);
+    bn128_G1::wnaf_window_table.push_back(10);
+    bn128_G1::wnaf_window_table.push_back(24);
+    bn128_G1::wnaf_window_table.push_back(40);
+    bn128_G1::wnaf_window_table.push_back(132);
+
+    bn128_G1::fixed_base_exp_window_table.resize(0);
+    // window 1 is unbeaten in [-inf, 4.24]
+    bn128_G1::fixed_base_exp_window_table.push_back(1);
+    // window 2 is unbeaten in [4.24, 10.43]
+    bn128_G1::fixed_base_exp_window_table.push_back(4);
+    // window 3 is unbeaten in [10.43, 24.88]
+    bn128_G1::fixed_base_exp_window_table.push_back(10);
+    // window 4 is unbeaten in [24.88, 62.10]
+    bn128_G1::fixed_base_exp_window_table.push_back(25);
+    // window 5 is unbeaten in [62.10, 157.80]
+    bn128_G1::fixed_base_exp_window_table.push_back(62);
+    // window 6 is unbeaten in [157.80, 362.05]
+    bn128_G1::fixed_base_exp_window_table.push_back(158);
+    // window 7 is unbeaten in [362.05, 806.67]
+    bn128_G1::fixed_base_exp_window_table.push_back(362);
+    // window 8 is unbeaten in [806.67, 2090.34]
+    bn128_G1::fixed_base_exp_window_table.push_back(807);
+    // window 9 is unbeaten in [2090.34, 4459.58]
+    bn128_G1::fixed_base_exp_window_table.push_back(2090);
+    // window 10 is unbeaten in [4459.58, 9280.12]
+    bn128_G1::fixed_base_exp_window_table.push_back(4460);
+    // window 11 is unbeaten in [9280.12, 43302.64]
+    bn128_G1::fixed_base_exp_window_table.push_back(9280);
+    // window 12 is unbeaten in [43302.64, 210998.73]
+    bn128_G1::fixed_base_exp_window_table.push_back(43303);
+    // window 13 is never the best
+    bn128_G1::fixed_base_exp_window_table.push_back(0);
+    // window 14 is never the best
+    bn128_G1::fixed_base_exp_window_table.push_back(0);
+    // window 15 is unbeaten in [210998.73, 506869.47]
+    bn128_G1::fixed_base_exp_window_table.push_back(210999);
+    // window 16 is unbeaten in [506869.47, 930023.36]
+    bn128_G1::fixed_base_exp_window_table.push_back(506869);
+    // window 17 is unbeaten in [930023.36, 8350812.20]
+    bn128_G1::fixed_base_exp_window_table.push_back(930023);
+    // window 18 is never the best
+    bn128_G1::fixed_base_exp_window_table.push_back(0);
+    // window 19 is never the best
+    bn128_G1::fixed_base_exp_window_table.push_back(0);
+    // window 20 is unbeaten in [8350812.20, 21708138.87]
+    bn128_G1::fixed_base_exp_window_table.push_back(8350812);
+    // window 21 is unbeaten in [21708138.87, 29482995.52]
+    bn128_G1::fixed_base_exp_window_table.push_back(21708139);
+    // window 22 is unbeaten in [29482995.52, inf]
+    bn128_G1::fixed_base_exp_window_table.push_back(29482996);
+
+    /* choice of group G2 */
+    bn128_G2::G2_zero.coord[0] = bn::Fp2(bn::Fp(1), bn::Fp(0));
+    bn128_G2::G2_zero.coord[1] = bn::Fp2(bn::Fp(1), bn::Fp(0));
+    bn128_G2::G2_zero.coord[2] = bn::Fp2(bn::Fp(0), bn::Fp(0));
+
+    bn128_G2::G2_one.coord[0] = bn::Fp2(bn::Fp("15267802884793550383558706039165621050290089775961208824303765753922461897946"),
+                                        bn::Fp("9034493566019742339402378670461897774509967669562610788113215988055021632533"));
+    bn128_G2::G2_one.coord[1] = bn::Fp2(bn::Fp("644888581738283025171396578091639672120333224302184904896215738366765861164"),
+                                        bn::Fp("20532875081203448695448744255224543661959516361327385779878476709582931298750"));
+    bn128_G2::G2_one.coord[2] = bn::Fp2(bn::Fp(1), bn::Fp(0));
+
+    bn128_G2::wnaf_window_table.resize(0);
+    bn128_G2::wnaf_window_table.push_back(7);
+    bn128_G2::wnaf_window_table.push_back(18);
+    bn128_G2::wnaf_window_table.push_back(35);
+    bn128_G2::wnaf_window_table.push_back(116);
+
+    bn128_G2::fixed_base_exp_window_table.resize(0);
+    // window 1 is unbeaten in [-inf, 4.13]
+    bn128_G2::fixed_base_exp_window_table.push_back(1);
+    // window 2 is unbeaten in [4.13, 10.72]
+    bn128_G2::fixed_base_exp_window_table.push_back(4);
+    // window 3 is unbeaten in [10.72, 25.60]
+    bn128_G2::fixed_base_exp_window_table.push_back(11);
+    // window 4 is unbeaten in [25.60, 60.99]
+    bn128_G2::fixed_base_exp_window_table.push_back(26);
+    // window 5 is unbeaten in [60.99, 153.66]
+    bn128_G2::fixed_base_exp_window_table.push_back(61);
+    // window 6 is unbeaten in [153.66, 353.13]
+    bn128_G2::fixed_base_exp_window_table.push_back(154);
+    // window 7 is unbeaten in [353.13, 771.87]
+    bn128_G2::fixed_base_exp_window_table.push_back(353);
+    // window 8 is unbeaten in [771.87, 2025.85]
+    bn128_G2::fixed_base_exp_window_table.push_back(772);
+    // window 9 is unbeaten in [2025.85, 4398.65]
+    bn128_G2::fixed_base_exp_window_table.push_back(2026);
+    // window 10 is unbeaten in [4398.65, 10493.42]
+    bn128_G2::fixed_base_exp_window_table.push_back(4399);
+    // window 11 is unbeaten in [10493.42, 37054.73]
+    bn128_G2::fixed_base_exp_window_table.push_back(10493);
+    // window 12 is unbeaten in [37054.73, 49928.78]
+    bn128_G2::fixed_base_exp_window_table.push_back(37055);
+    // window 13 is unbeaten in [49928.78, 114502.82]
+    bn128_G2::fixed_base_exp_window_table.push_back(49929);
+    // window 14 is unbeaten in [114502.82, 161445.26]
+    bn128_G2::fixed_base_exp_window_table.push_back(114503);
+    // window 15 is unbeaten in [161445.26, 470648.01]
+    bn128_G2::fixed_base_exp_window_table.push_back(161445);
+    // window 16 is unbeaten in [470648.01, 1059821.87]
+    bn128_G2::fixed_base_exp_window_table.push_back(470648);
+    // window 17 is unbeaten in [1059821.87, 5450848.25]
+    bn128_G2::fixed_base_exp_window_table.push_back(1059822);
+    // window 18 is never the best
+    bn128_G2::fixed_base_exp_window_table.push_back(0);
+    // window 19 is unbeaten in [5450848.25, 5566795.57]
+    bn128_G2::fixed_base_exp_window_table.push_back(5450848);
+    // window 20 is unbeaten in [5566795.57, 33055217.52]
+    bn128_G2::fixed_base_exp_window_table.push_back(5566796);
+    // window 21 is never the best
+    bn128_G2::fixed_base_exp_window_table.push_back(0);
+    // window 22 is unbeaten in [33055217.52, inf]
+    bn128_G2::fixed_base_exp_window_table.push_back(33055218);
+
+    bn128_GT::GT_one.elem = bn::Fp12(1);
+}
+} // libff
diff --git a/src/libff/libff/algebra/curves/bn128/bn128_init.hpp b/src/libff/libff/algebra/curves/bn128/bn128_init.hpp
new file mode 100755
index 000000000..dc7fdbf87
--- /dev/null
+++ b/src/libff/libff/algebra/curves/bn128/bn128_init.hpp
@@ -0,0 +1,47 @@
+/** @file
+ *****************************************************************************
+ * @author     This file is part of libff, developed by SCIPR Lab
+ *             and contributors (see AUTHORS).
+ * @copyright  MIT license (see LICENSE file)
+ *****************************************************************************/
+
+#ifndef BN128_INIT_HPP_
+#define BN128_INIT_HPP_
+#include "depends/ate-pairing/include/bn.h"
+
+#include <libff/algebra/curves/public_params.hpp>
+#include <libff/algebra/fields/fp.hpp>
+
+namespace libff {
+
+const mp_size_t bn128_r_bitcount = 254;
+const mp_size_t bn128_q_bitcount = 254;
+
+const mp_size_t bn128_r_limbs = (bn128_r_bitcount+GMP_NUMB_BITS-1)/GMP_NUMB_BITS;
+const mp_size_t bn128_q_limbs = (bn128_q_bitcount+GMP_NUMB_BITS-1)/GMP_NUMB_BITS;
+
+extern bigint<bn128_r_limbs> bn128_modulus_r;
+extern bigint<bn128_q_limbs> bn128_modulus_q;
+
+extern bn::Fp bn128_coeff_b;
+extern size_t bn128_Fq_s;
+extern bn::Fp bn128_Fq_nqr_to_t;
+extern mie::Vuint bn128_Fq_t_minus_1_over_2;
+
+extern bn::Fp2 bn128_twist_coeff_b;
+extern size_t bn128_Fq2_s;
+extern bn::Fp2 bn128_Fq2_nqr_to_t;
+extern mie::Vuint bn128_Fq2_t_minus_1_over_2;
+
+typedef Fp_model<bn128_r_limbs, bn128_modulus_r> bn128_Fr;
+typedef Fp_model<bn128_q_limbs, bn128_modulus_q> bn128_Fq;
+
+void init_bn128_params();
+
+class bn128_G1;
+class bn128_G2;
+class bn128_GT;
+typedef bn128_GT bn128_Fq12;
+
+} // libff
+#endif // BN128_INIT_HPP_
diff --git a/src/libff/libff/algebra/curves/bn128/bn128_pairing.cpp b/src/libff/libff/algebra/curves/bn128/bn128_pairing.cpp
new file mode 100755
index 000000000..05536173a
--- /dev/null
+++ b/src/libff/libff/algebra/curves/bn128/bn128_pairing.cpp
@@ -0,0 +1,212 @@
+/** @file
+ ********************************************************************************
+ Implements functions for computing Ate pairings over the bn128 curves, split into a
+ offline and online stages.
+ ********************************************************************************
+ * @author     This file is part of libff, developed by SCIPR Lab
+ *             and contributors (see AUTHORS).
+ * @copyright  MIT license (see LICENSE file)
+ *******************************************************************************/
+
+#include <sstream>
+
+#include <libff/algebra/curves/bn128/bn128_g1.hpp>
+#include <libff/algebra/curves/bn128/bn128_g2.hpp>
+#include <libff/algebra/curves/bn128/bn128_gt.hpp>
+#include <libff/algebra/curves/bn128/bn128_init.hpp>
+#include <libff/algebra/curves/bn128/bn128_pairing.hpp>
+#include <libff/common/profiling.hpp>
+
+namespace libff {
+
+bool bn128_ate_G1_precomp::operator==(const bn128_ate_G1_precomp &other) const
+{
+    return (this->P[0] == other.P[0] &&
+            this->P[1] == other.P[1] &&
+            this->P[2] == other.P[2]);
+}
+
+std::ostream& operator<<(std::ostream &out, const bn128_ate_G1_precomp &prec_P)
+{
+    for (size_t i = 0; i < 3; ++i)
+    {
+#ifndef BINARY_OUTPUT
+        out << prec_P.P[i] << "\n";
+#else
+        out.write((char*) &prec_P.P[i], sizeof(prec_P.P[i]));
+#endif
+    }
+    return out;
+}
+
+std::istream& operator>>(std::istream &in, bn128_ate_G1_precomp &prec_P)
+{
+    for (size_t i = 0; i < 3; ++i)
+    {
+#ifndef BINARY_OUTPUT
+        in >> prec_P.P[i];
+        consume_newline(in);
+#else
+        in.read((char*) &prec_P.P[i], sizeof(prec_P.P[i]));
+#endif
+    }
+    return in;
+}
+
+bool bn128_ate_G2_precomp::operator==(const bn128_ate_G2_precomp &other) const
+{
+    if (!(this->Q[0] == other.Q[0] &&
+          this->Q[1] == other.Q[1] &&
+          this->Q[2] == other.Q[2] &&
+          this->coeffs.size() == other.coeffs.size()))
+    {
+        return false;
+    }
+
+    /* work around for upstream serialization bug */
+    for (size_t i = 0; i < this->coeffs.size(); ++i)
+    {
+        std::stringstream this_ss, other_ss;
+        this_ss << this->coeffs[i];
+        other_ss << other.coeffs[i];
+        if (this_ss.str() != other_ss.str())
+        {
+            return false;
+        }
+    }
+
+    return true;
+}
+
+std::ostream& operator<<(std::ostream &out, const bn128_ate_G2_precomp &prec_Q)
+{
+    for (size_t i = 0; i < 3; ++i)
+    {
+#ifndef BINARY_OUTPUT
+        out << prec_Q.Q[i].a_ << "\n";
+        out << prec_Q.Q[i].b_ << "\n";
+#else
+        out.write((char*) &prec_Q.Q[i].a_, sizeof(prec_Q.Q[i].a_));
+        out.write((char*) &prec_Q.Q[i].b_, sizeof(prec_Q.Q[i].b_));
+#endif
+    }
+
+    out << prec_Q.coeffs.size() << "\n";
+
+    for (size_t i = 0; i < prec_Q.coeffs.size(); ++i)
+    {
+#ifndef BINARY_OUTPUT
+        out << prec_Q.coeffs[i].a_.a_ << "\n";
+        out << prec_Q.coeffs[i].a_.b_ << "\n";
+        out << prec_Q.coeffs[i].b_.a_ << "\n";
+        out << prec_Q.coeffs[i].b_.b_ << "\n";
+        out << prec_Q.coeffs[i].c_.a_ << "\n";
+        out << prec_Q.coeffs[i].c_.b_ << "\n";
+#else
+        out.write((char*) &prec_Q.coeffs[i].a_.a_, sizeof(prec_Q.coeffs[i].a_.a_));
+        out.write((char*) &prec_Q.coeffs[i].a_.b_, sizeof(prec_Q.coeffs[i].a_.b_));
+        out.write((char*) &prec_Q.coeffs[i].b_.a_, sizeof(prec_Q.coeffs[i].b_.a_));
+        out.write((char*) &prec_Q.coeffs[i].b_.b_, sizeof(prec_Q.coeffs[i].b_.b_));
+        out.write((char*) &prec_Q.coeffs[i].c_.a_, sizeof(prec_Q.coeffs[i].c_.a_));
+        out.write((char*) &prec_Q.coeffs[i].c_.b_, sizeof(prec_Q.coeffs[i].c_.b_));
+#endif
+    }
+
+    return out;
+}
+
+std::istream& operator>>(std::istream &in, bn128_ate_G2_precomp &prec_Q)
+{
+    for (size_t i = 0; i < 3; ++i)
+    {
+#ifndef BINARY_OUTPUT
+        in >> prec_Q.Q[i].a_;
+        consume_newline(in);
+        in >> prec_Q.Q[i].b_;
+        consume_newline(in);
+#else
+        in.read((char*) &prec_Q.Q[i].a_, sizeof(prec_Q.Q[i].a_));
+        in.read((char*) &prec_Q.Q[i].b_, sizeof(prec_Q.Q[i].b_));
+#endif
+    }
+
+    size_t count;
+    in >> count;
+    consume_newline(in);
+    prec_Q.coeffs.resize(count);
+    for (size_t i = 0; i < count; ++i)
+    {
+#ifndef BINARY_OUTPUT
+        in >> prec_Q.coeffs[i].a_.a_;
+        consume_newline(in);
+        in >> prec_Q.coeffs[i].a_.b_;
+        consume_newline(in);
+        in >> prec_Q.coeffs[i].b_.a_;
+        consume_newline(in);
+        in >> prec_Q.coeffs[i].b_.b_;
+        consume_newline(in);
+        in >> prec_Q.coeffs[i].c_.a_;
+        consume_newline(in);
+        in >> prec_Q.coeffs[i].c_.b_;
+        consume_newline(in);
+#else
+        in.read((char*) &prec_Q.coeffs[i].a_.a_, sizeof(prec_Q.coeffs[i].a_.a_));
+        in.read((char*) &prec_Q.coeffs[i].a_.b_, sizeof(prec_Q.coeffs[i].a_.b_));
+        in.read((char*) &prec_Q.coeffs[i].b_.a_, sizeof(prec_Q.coeffs[i].b_.a_));
+        in.read((char*) &prec_Q.coeffs[i].b_.b_, sizeof(prec_Q.coeffs[i].b_.b_));
+        in.read((char*) &prec_Q.coeffs[i].c_.a_, sizeof(prec_Q.coeffs[i].c_.a_));
+        in.read((char*) &prec_Q.coeffs[i].c_.b_, sizeof(prec_Q.coeffs[i].c_.b_));
+#endif
+    }
+    return in;
+}
+
+bn128_ate_G1_precomp bn128_ate_precompute_G1(const bn128_G1& P)
+{
+    enter_block("Call to bn128_ate_precompute_G1");
+
+    bn128_ate_G1_precomp result;
+    bn::ecop::NormalizeJac(result.P, P.coord);
+
+    leave_block("Call to bn128_ate_precompute_G1");
+    return result;
+}
+
+bn128_ate_G2_precomp bn128_ate_precompute_G2(const bn128_G2& Q)
+{
+    enter_block("Call to bn128_ate_precompute_G2");
+
+    bn128_ate_G2_precomp result;
+    bn::components::precomputeG2(result.coeffs, result.Q, Q.coord);
+
+    leave_block("Call to bn128_ate_precompute_G2");
+    return result;
+}
+
+bn128_Fq12 bn128_ate_miller_loop(const bn128_ate_G1_precomp &prec_P,
+                                 const bn128_ate_G2_precomp &prec_Q)
+{
+    bn128_Fq12 f;
+    bn::components::millerLoop(f.elem, prec_Q.coeffs, prec_P.P);
+    return f;
+}
+
+bn128_Fq12 bn128_double_ate_miller_loop(const bn128_ate_G1_precomp &prec_P1,
+                                        const bn128_ate_G2_precomp &prec_Q1,
+                                        const bn128_ate_G1_precomp &prec_P2,
+                                        const bn128_ate_G2_precomp &prec_Q2)
+{
+    bn128_Fq12 f;
+    bn::components::millerLoop2(f.elem, prec_Q1.coeffs, prec_P1.P, prec_Q2.coeffs, prec_P2.P);
+    return f;
+}
+
+bn128_GT bn128_final_exponentiation(const bn128_Fq12 &elt)
+{
+    enter_block("Call to bn128_final_exponentiation");
+    bn128_GT eltcopy = elt;
+    eltcopy.elem.final_exp();
+    leave_block("Call to bn128_final_exponentiation");
+    return eltcopy;
+}
+} // libff
diff --git a/src/libff/libff/algebra/curves/bn128/bn128_pairing.hpp b/src/libff/libff/algebra/curves/bn128/bn128_pairing.hpp
new file mode 100755
index 000000000..d5543da42
--- /dev/null
+++ b/src/libff/libff/algebra/curves/bn128/bn128_pairing.hpp
@@ -0,0 +1,53 @@
+/** @file
+ ********************************************************************************
+ Declares functions for computing Ate pairings over the bn128 curves, split into a
+ offline and online stages.
+ ********************************************************************************
+ * @author     This file is part of libff, developed by SCIPR Lab
+ *             and contributors (see AUTHORS).
+ * @copyright  MIT license (see LICENSE file)
+ *******************************************************************************/
+
+#ifndef BN128_PAIRING_HPP_
+#define BN128_PAIRING_HPP_
+#include "depends/ate-pairing/include/bn.h"
+
+#include <libff/algebra/curves/bn128/bn128_g1.hpp>
+#include <libff/algebra/curves/bn128/bn128_g2.hpp>
+#include <libff/algebra/curves/bn128/bn128_gt.hpp>
+
+namespace libff {
+
+struct bn128_ate_G1_precomp {
+    bn::Fp P[3];
+
+    bool operator==(const bn128_ate_G1_precomp &other) const;
+    friend std::ostream& operator<<(std::ostream &out, const bn128_ate_G1_precomp &prec_P);
+    friend std::istream& operator>>(std::istream &in, bn128_ate_G1_precomp &prec_P);
+};
+
+typedef bn::Fp6 bn128_ate_ell_coeffs;
+
+struct bn128_ate_G2_precomp {
+    bn::Fp2 Q[3];
+    std::vector<bn128_ate_ell_coeffs> coeffs;
+
+    bool operator==(const bn128_ate_G2_precomp &other) const;
+    friend std::ostream& operator<<(std::ostream &out, const bn128_ate_G2_precomp &prec_Q);
+    friend std::istream& operator>>(std::istream &in, bn128_ate_G2_precomp &prec_Q);
+};
+
+bn128_ate_G1_precomp bn128_ate_precompute_G1(const bn128_G1& P);
+bn128_ate_G2_precomp bn128_ate_precompute_G2(const bn128_G2& Q);
+
+bn128_Fq12 bn128_double_ate_miller_loop(const bn128_ate_G1_precomp &prec_P1,
+                                        const bn128_ate_G2_precomp &prec_Q1,
+                                        const bn128_ate_G1_precomp &prec_P2,
+                                        const bn128_ate_G2_precomp &prec_Q2);
+bn128_Fq12 bn128_ate_miller_loop(const bn128_ate_G1_precomp &prec_P,
+                                 const bn128_ate_G2_precomp &prec_Q);
+
+bn128_GT bn128_final_exponentiation(const bn128_Fq12 &elt);
+
+} // libff
+#endif // BN128_PAIRING_HPP_
diff --git a/src/libff/libff/algebra/curves/bn128/bn128_pp.cpp b/src/libff/libff/algebra/curves/bn128/bn128_pp.cpp
new file mode 100755
index 000000000..cea1ce354
--- /dev/null
+++ b/src/libff/libff/algebra/curves/bn128/bn128_pp.cpp
@@ -0,0 +1,75 @@
+/** @file
+ *****************************************************************************
+ * @author     This file is part of libff, developed by SCIPR Lab
+ *             and contributors (see AUTHORS).
+ * @copyright  MIT license (see LICENSE file)
+ *****************************************************************************/
+
+#include <libff/algebra/curves/bn128/bn128_pp.hpp>
+#include <libff/common/profiling.hpp>
+
+namespace libff {
+
+void bn128_pp::init_public_params()
+{
+    init_bn128_params();
+}
+
+bn128_GT bn128_pp::final_exponentiation(const bn128_GT &elt)
+{
+    return bn128_final_exponentiation(elt);
+}
+
+bn128_ate_G1_precomp bn128_pp::precompute_G1(const bn128_G1 &P)
+{
+    return bn128_ate_precompute_G1(P);
+}
+
+bn128_ate_G2_precomp bn128_pp::precompute_G2(const bn128_G2 &Q)
+{
+    return bn128_ate_precompute_G2(Q);
+}
+
+bn128_Fq12 bn128_pp::miller_loop(const bn128_ate_G1_precomp &prec_P,
+                                 const bn128_ate_G2_precomp &prec_Q)
+{
+    enter_block("Call to miller_loop<bn128_pp>");
+    bn128_Fq12 result = bn128_ate_miller_loop(prec_P, prec_Q);
+    leave_block("Call to miller_loop<bn128_pp>");
+    return result;
+}
+
+bn128_Fq12 bn128_pp::double_miller_loop(const bn128_ate_G1_precomp &prec_P1,
+                                        const bn128_ate_G2_precomp &prec_Q1,
+                                        const bn128_ate_G1_precomp &prec_P2,
+                                        const bn128_ate_G2_precomp &prec_Q2)
+{
+    enter_block("Call to double_miller_loop<bn128_pp>");
+    bn128_Fq12 result = bn128_double_ate_miller_loop(prec_P1, prec_Q1, prec_P2, prec_Q2);
+    leave_block("Call to double_miller_loop<bn128_pp>");
+    return result;
+}
+
+bn128_Fq12 bn128_pp::pairing(const bn128_G1 &P,
+                             const bn128_G2 &Q)
+{
+    enter_block("Call to pairing<bn128_pp>");
+    bn128_ate_G1_precomp prec_P = bn128_pp::precompute_G1(P);
+    bn128_ate_G2_precomp prec_Q = bn128_pp::precompute_G2(Q);
+
+    bn128_Fq12 result = bn128_pp::miller_loop(prec_P, prec_Q);
+    leave_block("Call to pairing<bn128_pp>");
+    return result;
+}
+
+bn128_GT bn128_pp::reduced_pairing(const bn128_G1 &P,
+                                   const bn128_G2 &Q)
+{
+    enter_block("Call to reduced_pairing<bn128_pp>");
+    const bn128_Fq12 f = bn128_pp::pairing(P, Q);
+    const bn128_GT result = bn128_pp::final_exponentiation(f);
+    leave_block("Call to reduced_pairing<bn128_pp>");
+    return result;
+}
+
+} // libff
diff --git a/src/libff/libff/algebra/curves/bn128/bn128_pp.hpp b/src/libff/libff/algebra/curves/bn128/bn128_pp.hpp
new file mode 100755
index 000000000..5b4075551
--- /dev/null
+++ b/src/libff/libff/algebra/curves/bn128/bn128_pp.hpp
@@ -0,0 +1,51 @@
+/** @file
+ *****************************************************************************
+ * @author     This file is part of libff, developed by SCIPR Lab
+ *             and contributors (see AUTHORS).
+ * @copyright  MIT license (see LICENSE file)
+ *****************************************************************************/
+
+#ifndef BN128_PP_HPP_
+#define BN128_PP_HPP_
+#include <libff/algebra/curves/bn128/bn128_g1.hpp>
+#include <libff/algebra/curves/bn128/bn128_g2.hpp>
+#include <libff/algebra/curves/bn128/bn128_gt.hpp>
+#include <libff/algebra/curves/bn128/bn128_init.hpp>
+#include <libff/algebra/curves/bn128/bn128_pairing.hpp>
+#include <libff/algebra/curves/public_params.hpp>
+
+namespace libff {
+
+class bn128_pp {
+public:
+    typedef bn128_Fr Fp_type;
+    typedef bn128_G1 G1_type;
+    typedef bn128_G2 G2_type;
+    typedef bn128_ate_G1_precomp G1_precomp_type;
+    typedef bn128_ate_G2_precomp G2_precomp_type;
+    typedef bn128_Fq Fq_type;
+    typedef bn128_Fq12 Fqk_type;
+    typedef bn128_GT GT_type;
+
+    static const bool has_affine_pairing = false;
+
+    static void init_public_params();
+    static bn128_GT final_exponentiation(const bn128_Fq12 &elt);
+    static bn128_ate_G1_precomp precompute_G1(const bn128_G1 &P);
+    static bn128_ate_G2_precomp precompute_G2(const bn128_G2 &Q);
+    static bn128_Fq12 miller_loop(const bn128_ate_G1_precomp &prec_P,
+                                  const bn128_ate_G2_precomp &prec_Q);
+    static bn128_Fq12 double_miller_loop(const bn128_ate_G1_precomp &prec_P1,
+                                         const bn128_ate_G2_precomp &prec_Q1,
+                                         const bn128_ate_G1_precomp &prec_P2,
+                                         const bn128_ate_G2_precomp &prec_Q2);
+
+    /* the following are used in test files */
+    static bn128_GT pairing(const bn128_G1 &P,
+                            const bn128_G2 &Q);
+    static bn128_GT reduced_pairing(const bn128_G1 &P,
+                                    const bn128_G2 &Q);
+};
+
+} // libff
+#endif // BN128_PP_HPP_
diff --git a/src/libff/libff/algebra/curves/bn128/bn_utils.hpp b/src/libff/libff/algebra/curves/bn128/bn_utils.hpp
new file mode 100755
index 000000000..b1d21aa1f
--- /dev/null
+++ b/src/libff/libff/algebra/curves/bn128/bn_utils.hpp
@@ -0,0 +1,23 @@
+/** @file
+ *****************************************************************************
+ * @author     This file is part of libff, developed by SCIPR Lab
+ *             and contributors (see AUTHORS).
+ * @copyright  MIT license (see LICENSE file)
+ *****************************************************************************/
+
+#ifndef BN_UTILS_HPP_
+#define BN_UTILS_HPP_
+#include <vector>
+
+#include "depends/ate-pairing/include/bn.h"
+
+namespace libff {
+
+template<typename FieldT>
+void bn_batch_invert(std::vector<FieldT> &vec);
+
+} // libff
+
+#include <libff/algebra/curves/bn128/bn_utils.tcc>
+
+#endif // BN_UTILS_HPP_
diff --git a/src/libff/libff/algebra/curves/bn128/bn_utils.tcc b/src/libff/libff/algebra/curves/bn128/bn_utils.tcc
new file mode 100755
index 000000000..637778ae4
--- /dev/null
+++ b/src/libff/libff/algebra/curves/bn128/bn_utils.tcc
@@ -0,0 +1,40 @@
+/** @file
+ *****************************************************************************
+ * @author     This file is part of libff, developed by SCIPR Lab
+ *             and contributors (see AUTHORS).
+ * @copyright  MIT license (see LICENSE file)
+ *****************************************************************************/
+
+#ifndef BN_UTILS_TCC_
+#define BN_UTILS_TCC_
+
+namespace libff {
+
+template<typename FieldT>
+void bn_batch_invert(std::vector<FieldT> &vec)
+{
+    std::vector<FieldT> prod;
+    prod.reserve(vec.size());
+
+    FieldT acc = 1;
+
+    for (auto el : vec)
+    {
+        assert(!el.isZero());
+        prod.emplace_back(acc);
+        FieldT::mul(acc, acc, el);
+    }
+
+    FieldT acc_inverse = acc;
+    acc_inverse.inverse();
+
+    for (long i = vec.size()-1; i >= 0; --i)
+    {
+        const FieldT old_el = vec[i];
+        FieldT::mul(vec[i], acc_inverse, prod[i]);
+        FieldT::mul(acc_inverse, acc_inverse, old_el);
+    }
+}
+
+} // libff
+#endif // FIELD_UTILS_TCC_
diff --git a/src/libff/libff/algebra/curves/curve_utils.hpp b/src/libff/libff/algebra/curves/curve_utils.hpp
new file mode 100755
index 000000000..aff03ba0b
--- /dev/null
+++ b/src/libff/libff/algebra/curves/curve_utils.hpp
@@ -0,0 +1,22 @@
+/** @file
+ *****************************************************************************
+ * @author     This file is part of libff, developed by SCIPR Lab
+ *             and contributors (see AUTHORS).
+ * @copyright  MIT license (see LICENSE file)
+ *****************************************************************************/
+
+#ifndef CURVE_UTILS_HPP_
+#define CURVE_UTILS_HPP_
+#include <cstdint>
+
+#include <libff/algebra/fields/bigint.hpp>
+
+namespace libff {
+
+template<typename GroupT, mp_size_t m>
+GroupT scalar_mul(const GroupT &base, const bigint<m> &scalar);
+
+} // libff
+#include <libff/algebra/curves/curve_utils.tcc>
+
+#endif // CURVE_UTILS_HPP_
diff --git a/src/libff/libff/algebra/curves/curve_utils.tcc b/src/libff/libff/algebra/curves/curve_utils.tcc
new file mode 100755
index 000000000..275c0f610
--- /dev/null
+++ b/src/libff/libff/algebra/curves/curve_utils.tcc
@@ -0,0 +1,37 @@
+/** @file
+ *****************************************************************************
+ * @author     This file is part of libff, developed by SCIPR Lab
+ *             and contributors (see AUTHORS).
+ * @copyright  MIT license (see LICENSE file)
+ *****************************************************************************/
+
+#ifndef CURVE_UTILS_TCC_
+#define CURVE_UTILS_TCC_
+
+namespace libff {
+
+template<typename GroupT, mp_size_t m>
+GroupT scalar_mul(const GroupT &base, const bigint<m> &scalar)
+{
+    GroupT result = GroupT::zero();
+
+    bool found_one = false;
+    for (long i = static_cast<long>(scalar.max_bits() - 1); i >= 0; --i)
+    {
+        if (found_one)
+        {
+            result = result.dbl();
+        }
+
+        if (scalar.test_bit(i))
+        {
+            found_one = true;
+            result = result + base;
+        }
+    }
+
+    return result;
+}
+
+} // libff
+#endif // CURVE_UTILS_TCC_
diff --git a/src/libff/libff/algebra/curves/edwards/edwards_g1.cpp b/src/libff/libff/algebra/curves/edwards/edwards_g1.cpp
new file mode 100755
index 000000000..d7749adab
--- /dev/null
+++ b/src/libff/libff/algebra/curves/edwards/edwards_g1.cpp
@@ -0,0 +1,412 @@
+/** @file
+ *****************************************************************************
+ * @author     This file is part of libff, developed by SCIPR Lab
+ *             and contributors (see AUTHORS).
+ * @copyright  MIT license (see LICENSE file)
+ *****************************************************************************/
+
+#include <libff/algebra/curves/edwards/edwards_g1.hpp>
+
+namespace libff {
+
+#ifdef PROFILE_OP_COUNTS
+long long edwards_G1::add_cnt = 0;
+long long edwards_G1::dbl_cnt = 0;
+#endif
+
+std::vector<size_t> edwards_G1::wnaf_window_table;
+std::vector<size_t> edwards_G1::fixed_base_exp_window_table;
+edwards_G1 edwards_G1::G1_zero;
+edwards_G1 edwards_G1::G1_one;
+
+edwards_G1::edwards_G1()
+{
+    this->X = G1_zero.X;
+    this->Y = G1_zero.Y;
+    this->Z = G1_zero.Z;
+}
+
+void edwards_G1::print() const
+{
+    if (this->is_zero())
+    {
+        printf("O\n");
+    }
+    else
+    {
+        edwards_G1 copy(*this);
+        copy.to_affine_coordinates();
+        gmp_printf("(%Nd , %Nd)\n",
+                   copy.X.as_bigint().data, edwards_Fq::num_limbs,
+                   copy.Y.as_bigint().data, edwards_Fq::num_limbs);
+    }
+}
+
+void edwards_G1::print_coordinates() const
+{
+    if (this->is_zero())
+    {
+        printf("O\n");
+    }
+    else
+    {
+        gmp_printf("(%Nd : %Nd : %Nd)\n",
+                   this->X.as_bigint().data, edwards_Fq::num_limbs,
+                   this->Y.as_bigint().data, edwards_Fq::num_limbs,
+                   this->Z.as_bigint().data, edwards_Fq::num_limbs);
+    }
+}
+
+void edwards_G1::to_affine_coordinates()
+{
+    if (this->is_zero())
+    {
+        this->X = edwards_Fq::zero();
+        this->Y = edwards_Fq::one();
+        this->Z = edwards_Fq::one();
+    }
+    else
+    {
+        // go from inverted coordinates to projective coordinates
+        edwards_Fq tX = this->Y * this->Z;
+        edwards_Fq tY = this->X * this->Z;
+        edwards_Fq tZ = this->X * this->Y;
+        // go from projective coordinates to affine coordinates
+        edwards_Fq tZ_inv = tZ.inverse();
+        this->X = tX * tZ_inv;
+        this->Y = tY * tZ_inv;
+        this->Z = edwards_Fq::one();
+    }
+}
+
+void edwards_G1::to_special()
+{
+    if (this->Z.is_zero())
+    {
+        return;
+    }
+
+#ifdef DEBUG
+    const edwards_G1 copy(*this);
+#endif
+
+    edwards_Fq Z_inv = this->Z.inverse();
+    this->X = this->X * Z_inv;
+    this->Y = this->Y * Z_inv;
+    this->Z = edwards_Fq::one();
+
+#ifdef DEBUG
+    assert((*this) == copy);
+#endif
+}
+
+bool edwards_G1::is_special() const
+{
+    return (this->is_zero() || this->Z == edwards_Fq::one());
+}
+
+bool edwards_G1::is_zero() const
+{
+    return (this->Y.is_zero() && this->Z.is_zero());
+}
+
+bool edwards_G1::operator==(const edwards_G1 &other) const
+{
+    if (this->is_zero())
+    {
+        return other.is_zero();
+    }
+
+    if (other.is_zero())
+    {
+        return false;
+    }
+
+    /* now neither is O */
+
+    // X1/Z1 = X2/Z2 <=> X1*Z2 = X2*Z1
+    if ((this->X * other.Z) != (other.X * this->Z))
+    {
+        return false;
+    }
+
+    // Y1/Z1 = Y2/Z2 <=> Y1*Z2 = Y2*Z1
+    if ((this->Y * other.Z) != (other.Y * this->Z))
+    {
+        return false;
+    }
+
+    return true;
+}
+
+bool edwards_G1::operator!=(const edwards_G1& other) const
+{
+    return !(operator==(other));
+}
+
+edwards_G1 edwards_G1::operator+(const edwards_G1 &other) const
+{
+    // handle special cases having to do with O
+    if (this->is_zero())
+    {
+        return other;
+    }
+
+    if (other.is_zero())
+    {
+        return (*this);
+    }
+
+    return this->add(other);
+}
+
+edwards_G1 edwards_G1::operator-() const
+{
+    return edwards_G1(-(this->X), this->Y, this->Z);
+}
+
+
+edwards_G1 edwards_G1::operator-(const edwards_G1 &other) const
+{
+    return (*this) + (-other);
+}
+
+edwards_G1 edwards_G1::add(const edwards_G1 &other) const
+{
+#ifdef PROFILE_OP_COUNTS
+    this->add_cnt++;
+#endif
+    // NOTE: does not handle O and pts of order 2,4
+    // http://www.hyperelliptic.org/EFD/g1p/auto-edwards-inverted.html#addition-add-2007-bl
+
+    edwards_Fq A = (this->Z) * (other.Z);                   // A = Z1*Z2
+    edwards_Fq B = edwards_coeff_d * A.squared();           // B = d*A^2
+    edwards_Fq C = (this->X) * (other.X);                   // C = X1*X2
+    edwards_Fq D = (this->Y) * (other.Y);                   // D = Y1*Y2
+    edwards_Fq E = C * D;                                   // E = C*D
+    edwards_Fq H = C - D;                                   // H = C-D
+    edwards_Fq I = (this->X+this->Y)*(other.X+other.Y)-C-D; // I = (X1+Y1)*(X2+Y2)-C-D
+    edwards_Fq X3 = (E+B)*H;                                // X3 = c*(E+B)*H
+    edwards_Fq Y3 = (E-B)*I;                                // Y3 = c*(E-B)*I
+    edwards_Fq Z3 = A*H*I;                                  // Z3 = A*H*I
+
+    return edwards_G1(X3, Y3, Z3);
+}
+
+edwards_G1 edwards_G1::mixed_add(const edwards_G1 &other) const
+{
+#ifdef PROFILE_OP_COUNTS
+    this->add_cnt++;
+#endif
+    // handle special cases having to do with O
+    if (this->is_zero())
+    {
+        return other;
+    }
+
+    if (other.is_zero())
+    {
+        return *this;
+    }
+
+#ifdef DEBUG
+    assert(other.is_special());
+#endif
+
+    // NOTE: does not handle O and pts of order 2,4
+    // http://www.hyperelliptic.org/EFD/g1p/auto-edwards-inverted.html#addition-madd-2007-lb
+
+    edwards_Fq A = this->Z;                                 // A = Z1
+    edwards_Fq B = edwards_coeff_d * A.squared();           // B = d*A^2
+    edwards_Fq C = (this->X) * (other.X);                   // C = X1*X2
+    edwards_Fq D = (this->Y) * (other.Y);                   // D = Y1*Y2
+    edwards_Fq E = C * D;                                   // E = C*D
+    edwards_Fq H = C - D;                                   // H = C-D
+    edwards_Fq I = (this->X+this->Y)*(other.X+other.Y)-C-D; // I = (X1+Y1)*(X2+Y2)-C-D
+    edwards_Fq X3 = (E+B)*H;                                // X3 = c*(E+B)*H
+    edwards_Fq Y3 = (E-B)*I;                                // Y3 = c*(E-B)*I
+    edwards_Fq Z3 = A*H*I;                                  // Z3 = A*H*I
+
+    return edwards_G1(X3, Y3, Z3);
+}
+
+edwards_G1 edwards_G1::dbl() const
+{
+#ifdef PROFILE_OP_COUNTS
+    this->dbl_cnt++;
+#endif
+    if (this->is_zero())
+    {
+        return (*this);
+    }
+    else
+    {
+        // NOTE: does not handle O and pts of order 2,4
+        // http://www.hyperelliptic.org/EFD/g1p/auto-edwards-inverted.html#doubling-dbl-2007-bl
+
+        edwards_Fq A = (this->X).squared();                      // A = X1^2
+        edwards_Fq B = (this->Y).squared();                      // B = Y1^2
+        edwards_Fq C = A+B;                                      // C = A+B
+        edwards_Fq D = A-B;                                      // D = A-B
+        edwards_Fq E = (this->X+this->Y).squared()-C;            // E = (X1+Y1)^2-C
+        edwards_Fq X3 = C*D;                                     // X3 = C*D
+        edwards_Fq dZZ = edwards_coeff_d * this->Z.squared();
+        edwards_Fq Y3 = E*(C-dZZ-dZZ);                           // Y3 = E*(C-2*d*Z1^2)
+        edwards_Fq Z3 = D*E;                                     // Z3 = D*E
+
+        return edwards_G1(X3, Y3, Z3);
+    }
+}
+
+bool edwards_G1::is_well_formed() const
+{
+    /* Note that point at infinity is the only special case we must check as
+       inverted representation does no cover points (0, +-c) and (+-c, 0). */
+    if (this->is_zero())
+    {
+        return true;
+    }
+    else
+    {
+        /*
+          a x^2 + y^2 = 1 + d x^2 y^2
+
+          We are using inverted, so equation we need to check is actually
+
+          a (z/x)^2 + (z/y)^2 = 1 + d z^4 / (x^2 * y^2)
+          z^2 (a y^2 + x^2 - dz^2) = x^2 y^2
+        */
+        edwards_Fq X2 = this->X.squared();
+        edwards_Fq Y2 = this->Y.squared();
+        edwards_Fq Z2 = this->Z.squared();
+
+        // for G1 a = 1
+        return (Z2 * (Y2 + X2 - edwards_coeff_d * Z2) == X2 * Y2);
+    }
+}
+
+edwards_G1 edwards_G1::zero()
+{
+    return G1_zero;
+}
+
+edwards_G1 edwards_G1::one()
+{
+    return G1_one;
+}
+
+edwards_G1 edwards_G1::random_element()
+{
+    return edwards_Fr::random_element().as_bigint() * G1_one;
+}
+
+std::ostream& operator<<(std::ostream &out, const edwards_G1 &g)
+{
+    edwards_G1 copy(g);
+    copy.to_affine_coordinates();
+#ifdef NO_PT_COMPRESSION
+    out << copy.X << OUTPUT_SEPARATOR << copy.Y;
+#else
+    /* storing LSB of Y */
+    out << copy.X << OUTPUT_SEPARATOR << (copy.Y.as_bigint().data[0] & 1);
+#endif
+
+    return out;
+}
+
+std::istream& operator>>(std::istream &in, edwards_G1 &g)
+{
+    edwards_Fq tX, tY;
+
+#ifdef NO_PT_COMPRESSION
+    in >> tX;
+    consume_OUTPUT_SEPARATOR(in);
+    in >> tY;
+#else
+    /*
+      a x^2 + y^2 = 1 + d x^2 y^2
+      y = sqrt((1-ax^2)/(1-dx^2))
+    */
+    unsigned char Y_lsb;
+    in >> tX;
+
+    consume_OUTPUT_SEPARATOR(in);
+    in.read((char*)&Y_lsb, 1);
+    Y_lsb -= '0';
+
+    edwards_Fq tX2 = tX.squared();
+    edwards_Fq tY2 = (edwards_Fq::one() - tX2) * // a = 1 for G1 (not a twist)
+        (edwards_Fq::one() - edwards_coeff_d * tX2).inverse();
+    tY = tY2.sqrt();
+
+    if ((tY.as_bigint().data[0] & 1) != Y_lsb)
+    {
+        tY = -tY;
+    }
+#endif
+
+    // using inverted coordinates
+    g.X = tY;
+    g.Y = tX;
+    g.Z = tX * tY;
+
+#ifdef USE_MIXED_ADDITION
+    g.to_special();
+#endif
+
+    return in;
+}
+
+std::ostream& operator<<(std::ostream& out, const std::vector<edwards_G1> &v)
+{
+    out << v.size() << "\n";
+    for (const edwards_G1& t : v)
+    {
+        out << t << OUTPUT_NEWLINE;
+    }
+
+    return out;
+}
+
+std::istream& operator>>(std::istream& in, std::vector<edwards_G1> &v)
+{
+    v.clear();
+
+    size_t s;
+    in >> s;
+    v.reserve(s);
+    consume_newline(in);
+
+    for (size_t i = 0; i < s; ++i)
+    {
+        edwards_G1 g;
+        in >> g;
+        v.emplace_back(g);
+        consume_OUTPUT_NEWLINE(in);
+    }
+
+    return in;
+}
+
+void edwards_G1::batch_to_special_all_non_zeros(std::vector<edwards_G1> &vec)
+{
+    std::vector<edwards_Fq> Z_vec;
+    Z_vec.reserve(vec.size());
+
+    for (auto &el: vec)
+    {
+        Z_vec.emplace_back(el.Z);
+    }
+    batch_invert<edwards_Fq>(Z_vec);
+
+    const edwards_Fq one = edwards_Fq::one();
+
+    for (size_t i = 0; i < vec.size(); ++i)
+    {
+        vec[i].X = vec[i].X * Z_vec[i];
+        vec[i].Y = vec[i].Y * Z_vec[i];
+        vec[i].Z = one;
+    }
+}
+
+} // libff
diff --git a/src/libff/libff/algebra/curves/edwards/edwards_g1.hpp b/src/libff/libff/algebra/curves/edwards/edwards_g1.hpp
new file mode 100755
index 000000000..91cc4d183
--- /dev/null
+++ b/src/libff/libff/algebra/curves/edwards/edwards_g1.hpp
@@ -0,0 +1,95 @@
+/** @file
+ *****************************************************************************
+ * @author     This file is part of libff, developed by SCIPR Lab
+ *             and contributors (see AUTHORS).
+ * @copyright  MIT license (see LICENSE file)
+ *****************************************************************************/
+
+#ifndef EDWARDS_G1_HPP_
+#define EDWARDS_G1_HPP_
+#include <vector>
+
+#include <libff/algebra/curves/curve_utils.hpp>
+#include <libff/algebra/curves/edwards/edwards_init.hpp>
+
+namespace libff {
+
+class edwards_G1;
+std::ostream& operator<<(std::ostream &, const edwards_G1&);
+std::istream& operator>>(std::istream &, edwards_G1&);
+
+class edwards_G1 {
+public:
+#ifdef PROFILE_OP_COUNTS
+    static long long add_cnt;
+    static long long dbl_cnt;
+#endif
+    static std::vector<size_t> wnaf_window_table;
+    static std::vector<size_t> fixed_base_exp_window_table;
+    static edwards_G1 G1_zero;
+    static edwards_G1 G1_one;
+
+    edwards_Fq X, Y, Z;
+    edwards_G1();
+private:
+    edwards_G1(const edwards_Fq& X, const edwards_Fq& Y, const edwards_Fq& Z) : X(X), Y(Y), Z(Z) {};
+
+public:
+    typedef edwards_Fq base_field;
+    typedef edwards_Fr scalar_field;
+    // using inverted coordinates
+    edwards_G1(const edwards_Fq& X, const edwards_Fq& Y) : X(Y), Y(X), Z(X*Y) {};
+
+    void print() const;
+    void print_coordinates() const;
+
+    void to_affine_coordinates();
+    void to_special();
+    bool is_special() const;
+
+    bool is_zero() const;
+
+    bool operator==(const edwards_G1 &other) const;
+    bool operator!=(const edwards_G1 &other) const;
+
+    edwards_G1 operator+(const edwards_G1 &other) const;
+    edwards_G1 operator-() const;
+    edwards_G1 operator-(const edwards_G1 &other) const;
+
+    edwards_G1 add(const edwards_G1 &other) const;
+    edwards_G1 mixed_add(const edwards_G1 &other) const;
+    edwards_G1 dbl() const;
+
+    bool is_well_formed() const;
+
+    static edwards_G1 zero();
+    static edwards_G1 one();
+    static edwards_G1 random_element();
+
+    static size_t size_in_bits() { return edwards_Fq::size_in_bits() + 1; }
+    static bigint<base_field::num_limbs> base_field_char() { return base_field::field_char(); }
+    static bigint<scalar_field::num_limbs> order() { return scalar_field::field_char(); }
+
+    friend std::ostream& operator<<(std::ostream &out, const edwards_G1 &g);
+    friend std::istream& operator>>(std::istream &in, edwards_G1 &g);
+
+    static void batch_to_special_all_non_zeros(std::vector<edwards_G1> &vec);
+};
+
+template<mp_size_t m>
+edwards_G1 operator*(const bigint<m> &lhs, const edwards_G1 &rhs)
+{
+    return scalar_mul<edwards_G1, m>(rhs, lhs);
+}
+
+template<mp_size_t m, const bigint<m>& modulus_p>
+edwards_G1 operator*(const Fp_model<m,modulus_p> &lhs, const edwards_G1 &rhs)
+{
+    return scalar_mul<edwards_G1, m>(rhs, lhs.as_bigint());
+}
+
+std::ostream& operator<<(std::ostream& out, const std::vector<edwards_G1> &v);
+std::istream& operator>>(std::istream& in, std::vector<edwards_G1> &v);
+
+} // libff
+#endif // EDWARDS_G1_HPP_
diff --git a/src/libff/libff/algebra/curves/edwards/edwards_g2.cpp b/src/libff/libff/algebra/curves/edwards/edwards_g2.cpp
new file mode 100755
index 000000000..923a54519
--- /dev/null
+++ b/src/libff/libff/algebra/curves/edwards/edwards_g2.cpp
@@ -0,0 +1,413 @@
+/** @file
+ *****************************************************************************
+ * @author     This file is part of libff, developed by SCIPR Lab
+ *             and contributors (see AUTHORS).
+ * @copyright  MIT license (see LICENSE file)
+ *****************************************************************************/
+
+#include <libff/algebra/curves/edwards/edwards_g2.hpp>
+
+namespace libff {
+
+#ifdef PROFILE_OP_COUNTS
+long long edwards_G2::add_cnt = 0;
+long long edwards_G2::dbl_cnt = 0;
+#endif
+
+std::vector<size_t> edwards_G2::wnaf_window_table;
+std::vector<size_t> edwards_G2::fixed_base_exp_window_table;
+
+edwards_G2 edwards_G2::G2_zero;
+edwards_G2 edwards_G2::G2_one;
+
+edwards_G2::edwards_G2()
+{
+    this->X = G2_zero.X;
+    this->Y = G2_zero.Y;
+    this->Z = G2_zero.Z;
+}
+
+edwards_Fq3 edwards_G2::mul_by_a(const edwards_Fq3 &elt)
+{
+	// should be
+	//  edwards_Fq3(edwards_twist_mul_by_a_c0 * elt.c2, edwards_twist_mul_by_a_c1 * elt.c0, edwards_twist_mul_by_a_c2 * elt.c1)
+	// but optimizing the fact that edwards_twist_mul_by_a_c1 = edwards_twist_mul_by_a_c2 = 1
+    return edwards_Fq3(edwards_twist_mul_by_a_c0 * elt.c2, elt.c0, elt.c1);
+}
+
+edwards_Fq3 edwards_G2::mul_by_d(const edwards_Fq3 &elt)
+{
+	return edwards_Fq3(edwards_twist_mul_by_d_c0 * elt.c2, edwards_twist_mul_by_d_c1 * elt.c0, edwards_twist_mul_by_d_c2 * elt.c1);
+}
+
+void edwards_G2::print() const
+{
+    if (this->is_zero())
+    {
+        printf("O\n");
+    }
+    else
+    {
+        edwards_G2 copy(*this);
+        copy.to_affine_coordinates();
+        gmp_printf("(%Nd*z^2 + %Nd*z + %Nd , %Nd*z^2 + %Nd*z + %Nd)\n",
+                   copy.X.c2.as_bigint().data, edwards_Fq::num_limbs,
+                   copy.X.c1.as_bigint().data, edwards_Fq::num_limbs,
+                   copy.X.c0.as_bigint().data, edwards_Fq::num_limbs,
+                   copy.Y.c2.as_bigint().data, edwards_Fq::num_limbs,
+                   copy.Y.c1.as_bigint().data, edwards_Fq::num_limbs,
+                   copy.Y.c0.as_bigint().data, edwards_Fq::num_limbs);
+    }
+}
+
+void edwards_G2::print_coordinates() const
+{
+    if (this->is_zero())
+    {
+        printf("O\n");
+    }
+    else
+    {
+        gmp_printf("(%Nd*z^2 + %Nd*z + %Nd : %Nd*z^2 + %Nd*z + %Nd : %Nd*z^2 + %Nd*z + %Nd)\n",
+                   this->X.c2.as_bigint().data, edwards_Fq::num_limbs,
+                   this->X.c1.as_bigint().data, edwards_Fq::num_limbs,
+                   this->X.c0.as_bigint().data, edwards_Fq::num_limbs,
+                   this->Y.c2.as_bigint().data, edwards_Fq::num_limbs,
+                   this->Y.c1.as_bigint().data, edwards_Fq::num_limbs,
+                   this->Y.c0.as_bigint().data, edwards_Fq::num_limbs,
+                   this->Z.c2.as_bigint().data, edwards_Fq::num_limbs,
+                   this->Z.c1.as_bigint().data, edwards_Fq::num_limbs,
+                   this->Z.c0.as_bigint().data, edwards_Fq::num_limbs);
+    }
+}
+
+void edwards_G2::to_affine_coordinates()
+{
+    if (this->is_zero())
+    {
+        this->X = edwards_Fq3::zero();
+        this->Y = edwards_Fq3::one();
+        this->Z = edwards_Fq3::one();
+    }
+    else
+    {
+        // go from inverted coordinates to projective coordinates
+        edwards_Fq3 tX = this->Y * this->Z;
+        edwards_Fq3 tY = this->X * this->Z;
+        edwards_Fq3 tZ = this->X * this->Y;
+        // go from projective coordinates to affine coordinates
+        edwards_Fq3 tZ_inv = tZ.inverse();
+        this->X = tX * tZ_inv;
+        this->Y = tY * tZ_inv;
+        this->Z = edwards_Fq3::one();
+    }
+}
+
+void edwards_G2::to_special()
+{
+    if (this->Z.is_zero())
+    {
+        return;
+    }
+
+#ifdef DEBUG
+    const edwards_G2 copy(*this);
+#endif
+
+    edwards_Fq3 Z_inv = this->Z.inverse();
+    this->X = this->X * Z_inv;
+    this->Y = this->Y * Z_inv;
+    this->Z = edwards_Fq3::one();
+
+#ifdef DEBUG
+    assert((*this) == copy);
+#endif
+}
+
+bool edwards_G2::is_special() const
+{
+    return (this->is_zero() || this->Z == edwards_Fq3::one());
+}
+
+bool edwards_G2::is_zero() const
+{
+    return (this->Y.is_zero() && this->Z.is_zero());
+}
+
+bool edwards_G2::operator==(const edwards_G2 &other) const
+{
+    if (this->is_zero())
+    {
+        return other.is_zero();
+    }
+
+    if (other.is_zero())
+    {
+        return false;
+    }
+
+    /* now neither is O */
+
+    // X1/Z1 = X2/Z2 <=> X1*Z2 = X2*Z1
+    if ((this->X * other.Z) != (other.X * this->Z))
+    {
+        return false;
+    }
+
+    // Y1/Z1 = Y2/Z2 <=> Y1*Z2 = Y2*Z1
+    if ((this->Y * other.Z) != (other.Y * this->Z))
+    {
+        return false;
+    }
+
+    return true;
+}
+
+bool edwards_G2::operator!=(const edwards_G2& other) const
+{
+    return !(operator==(other));
+}
+
+edwards_G2 edwards_G2::operator+(const edwards_G2 &other) const
+{
+    // handle special cases having to do with O
+    if (this->is_zero())
+    {
+        return other;
+    }
+
+    if (other.is_zero())
+    {
+        return (*this);
+    }
+
+    return this->add(other);
+}
+
+edwards_G2 edwards_G2::operator-() const
+{
+    return edwards_G2(-(this->X), this->Y, this->Z);
+}
+
+
+edwards_G2 edwards_G2::operator-(const edwards_G2 &other) const
+{
+    return (*this) + (-other);
+}
+
+edwards_G2 edwards_G2::add(const edwards_G2 &other) const
+{
+#ifdef PROFILE_OP_COUNTS
+    this->add_cnt++;
+#endif
+    // NOTE: does not handle O and pts of order 2,4
+    // http://www.hyperelliptic.org/EFD/g1p/auto-twisted-inverted.html#addition-add-2008-bbjlp
+
+    const edwards_Fq3 A = (this->Z) * (other.Z);                       // A = Z1*Z2
+    const edwards_Fq3 B = edwards_G2::mul_by_d(A.squared());           // B = d*A^2
+    const edwards_Fq3 C = (this->X) * (other.X);                       // C = X1*X2
+    const edwards_Fq3 D = (this->Y) * (other.Y);                       // D = Y1*Y2
+    const edwards_Fq3 E = C*D;                                         // E = C*D
+    const edwards_Fq3 H = C - edwards_G2::mul_by_a(D);                 // H = C-a*D
+    const edwards_Fq3 I = (this->X+this->Y)*(other.X+other.Y)-C-D;     // I = (X1+Y1)*(X2+Y2)-C-D
+    const edwards_Fq3 X3 = (E+B)*H;                                    // X3 = (E+B)*H
+    const edwards_Fq3 Y3 = (E-B)*I;                                    // Y3 = (E-B)*I
+    const edwards_Fq3 Z3 = A*H*I;                                      // Z3 = A*H*I
+
+    return edwards_G2(X3, Y3, Z3);
+}
+
+edwards_G2 edwards_G2::mixed_add(const edwards_G2 &other) const
+{
+#ifdef PROFILE_OP_COUNTS
+    this->add_cnt++;
+#endif
+    // handle special cases having to do with O
+    if (this->is_zero())
+    {
+        return other;
+    }
+
+    if (other.is_zero())
+    {
+        return *this;
+    }
+
+#ifdef DEBUG
+    assert(other.is_special());
+#endif
+
+    // NOTE: does not handle O and pts of order 2,4
+    // http://www.hyperelliptic.org/EFD/g1p/auto-edwards-inverted.html#addition-madd-2007-lb
+
+    const edwards_Fq3 A = this->Z;                                     // A = Z1*Z2
+    const edwards_Fq3 B = edwards_G2::mul_by_d(A.squared());           // B = d*A^2
+    const edwards_Fq3 C = (this->X) * (other.X);                       // C = X1*X2
+    const edwards_Fq3 D = (this->Y) * (other.Y);                       // D = Y1*Y2
+    const edwards_Fq3 E = C*D;                                         // E = C*D
+    const edwards_Fq3 H = C - edwards_G2::mul_by_a(D);                 // H = C-a*D
+    const edwards_Fq3 I = (this->X+this->Y)*(other.X+other.Y)-C-D;     // I = (X1+Y1)*(X2+Y2)-C-D
+    const edwards_Fq3 X3 = (E+B)*H;                                    // X3 = (E+B)*H
+    const edwards_Fq3 Y3 = (E-B)*I;                                    // Y3 = (E-B)*I
+    const edwards_Fq3 Z3 = A*H*I;                                      // Z3 = A*H*I
+
+    return edwards_G2(X3, Y3, Z3);
+}
+
+edwards_G2 edwards_G2::dbl() const
+{
+#ifdef PROFILE_OP_COUNTS
+    this->dbl_cnt++;
+#endif
+    if (this->is_zero())
+    {
+        return (*this);
+    }
+    else
+    {
+        // NOTE: does not handle O and pts of order 2,4
+        // http://www.hyperelliptic.org/EFD/g1p/auto-twisted-inverted.html#doubling-dbl-2008-bbjlp
+
+        const edwards_Fq3 A = (this->X).squared();                      // A = X1^2
+        const edwards_Fq3 B = (this->Y).squared();                      // B = Y1^2
+        const edwards_Fq3 U = edwards_G2::mul_by_a(B);                  // U = a*B
+        const edwards_Fq3 C = A+U;                                      // C = A+U
+        const edwards_Fq3 D = A-U;                                      // D = A-U
+        const edwards_Fq3 E = (this->X+this->Y).squared()-A-B;          // E = (X1+Y1)^2-A-B
+        const edwards_Fq3 X3 = C*D;                                     // X3 = C*D
+        const edwards_Fq3 dZZ = edwards_G2::mul_by_d(this->Z.squared());
+        const edwards_Fq3 Y3 = E*(C-dZZ-dZZ);                           // Y3 = E*(C-2*d*Z1^2)
+        const edwards_Fq3 Z3 = D*E;                                     // Z3 = D*E
+
+        return edwards_G2(X3, Y3, Z3);
+    }
+}
+
+edwards_G2 edwards_G2::mul_by_q() const
+{
+    return edwards_G2((this->X).Frobenius_map(1),
+                      edwards_twist_mul_by_q_Y * (this->Y).Frobenius_map(1),
+                      edwards_twist_mul_by_q_Z * (this->Z).Frobenius_map(1));
+}
+
+bool edwards_G2::is_well_formed() const
+{
+    /* Note that point at infinity is the only special case we must check as
+       inverted representation does no cover points (0, +-c) and (+-c, 0). */
+    if (this->is_zero())
+    {
+        return true;
+    }
+    else
+    {
+        /*
+          a x^2 + y^2 = 1 + d x^2 y^2
+
+          We are using inverted, so equation we need to check is actually
+
+          a (z/x)^2 + (z/y)^2 = 1 + d z^4 / (x^2 * y^2)
+          z^2 (a y^2 + x^2 - dz^2) = x^2 y^2
+        */
+        edwards_Fq3 X2 = this->X.squared();
+        edwards_Fq3 Y2 = this->Y.squared();
+        edwards_Fq3 Z2 = this->Z.squared();
+        edwards_Fq3 aY2 = edwards_G2::mul_by_a(Y2);
+        edwards_Fq3 dZ2 = edwards_G2::mul_by_d(Z2);
+        return (Z2 * (aY2 + X2 - dZ2) == X2 * Y2);
+    }
+}
+
+edwards_G2 edwards_G2::zero()
+{
+    return G2_zero;
+}
+
+edwards_G2 edwards_G2::one()
+{
+    return G2_one;
+}
+
+edwards_G2 edwards_G2::random_element()
+{
+    return edwards_Fr::random_element().as_bigint() * G2_one;
+}
+
+std::ostream& operator<<(std::ostream &out, const edwards_G2 &g)
+{
+    edwards_G2 copy(g);
+    copy.to_affine_coordinates();
+#ifdef NO_PT_COMPRESSION
+    out << copy.X << OUTPUT_SEPARATOR << copy.Y;
+#else
+    /* storing LSB of Y */
+    out << copy.X << OUTPUT_SEPARATOR << (copy.Y.c0.as_bigint().data[0] & 1);
+#endif
+    return out;
+}
+
+std::istream& operator>>(std::istream &in, edwards_G2 &g)
+{
+    edwards_Fq3 tX, tY;
+
+#ifdef NO_PT_COMPRESSION
+    in >> tX;
+    consume_OUTPUT_SEPARATOR(in);
+    in >> tY;
+#else
+    /*
+      a x^2 + y^2 = 1 + d x^2 y^2
+      y = sqrt((1-ax^2)/(1-dx^2))
+    */
+    unsigned char Y_lsb;
+    in >> tX;
+    consume_OUTPUT_SEPARATOR(in);
+
+    in.read((char*)&Y_lsb, 1);
+    Y_lsb -= '0';
+
+    edwards_Fq3 tX2 = tX.squared();
+    const edwards_Fq3 tY2 =
+        (edwards_Fq3::one() - edwards_G2::mul_by_a(tX2)) *
+        (edwards_Fq3::one() - edwards_G2::mul_by_d(tX2)).inverse();
+    tY = tY2.sqrt();
+
+    if ((tY.c0.as_bigint().data[0] & 1) != Y_lsb)
+    {
+        tY = -tY;
+    }
+#endif
+
+    // using inverted coordinates
+    g.X = tY;
+    g.Y = tX;
+    g.Z = tX * tY;
+
+#ifdef USE_MIXED_ADDITION
+    g.to_special();
+#endif
+
+    return in;
+}
+
+void edwards_G2::batch_to_special_all_non_zeros(std::vector<edwards_G2> &vec)
+{
+    std::vector<edwards_Fq3> Z_vec;
+    Z_vec.reserve(vec.size());
+
+    for (auto &el: vec)
+    {
+        Z_vec.emplace_back(el.Z);
+    }
+    batch_invert<edwards_Fq3>(Z_vec);
+
+    const edwards_Fq3 one = edwards_Fq3::one();
+
+    for (size_t i = 0; i < vec.size(); ++i)
+    {
+        vec[i].X = vec[i].X * Z_vec[i];
+        vec[i].Y = vec[i].Y * Z_vec[i];
+        vec[i].Z = one;
+    }
+}
+
+} // libff
diff --git a/src/libff/libff/algebra/curves/edwards/edwards_g2.hpp b/src/libff/libff/algebra/curves/edwards/edwards_g2.hpp
new file mode 100755
index 000000000..09d2319d1
--- /dev/null
+++ b/src/libff/libff/algebra/curves/edwards/edwards_g2.hpp
@@ -0,0 +1,98 @@
+/** @file
+ *****************************************************************************
+ * @author     This file is part of libff, developed by SCIPR Lab
+ *             and contributors (see AUTHORS).
+ * @copyright  MIT license (see LICENSE file)
+ *****************************************************************************/
+
+#ifndef EDWARDS_G2_HPP_
+#define EDWARDS_G2_HPP_
+#include <iostream>
+#include <vector>
+
+#include <libff/algebra/curves/curve_utils.hpp>
+#include <libff/algebra/curves/edwards/edwards_init.hpp>
+
+namespace libff {
+
+class edwards_G2;
+std::ostream& operator<<(std::ostream &, const edwards_G2&);
+std::istream& operator>>(std::istream &, edwards_G2&);
+
+class edwards_G2 {
+public:
+#ifdef PROFILE_OP_COUNTS
+    static long long add_cnt;
+    static long long dbl_cnt;
+#endif
+    static std::vector<size_t> wnaf_window_table;
+    static std::vector<size_t> fixed_base_exp_window_table;
+
+    static edwards_G2 G2_zero;
+    static edwards_G2 G2_one;
+
+    edwards_Fq3 X, Y, Z;
+    edwards_G2();
+private:
+    edwards_G2(const edwards_Fq3& X, const edwards_Fq3& Y, const edwards_Fq3& Z) : X(X), Y(Y), Z(Z) {};
+public:
+    static edwards_Fq3 mul_by_a(const edwards_Fq3 &elt);
+    static edwards_Fq3 mul_by_d(const edwards_Fq3 &elt);
+    typedef edwards_Fq base_field;
+    typedef edwards_Fq3 twist_field;
+    typedef edwards_Fr scalar_field;
+
+    // using inverted coordinates
+    edwards_G2(const edwards_Fq3& X, const edwards_Fq3& Y) : X(Y), Y(X), Z(X*Y) {};
+
+    void print() const;
+    void print_coordinates() const;
+
+    void to_affine_coordinates();
+    void to_special();
+    bool is_special() const;
+
+    bool is_zero() const;
+
+    bool operator==(const edwards_G2 &other) const;
+    bool operator!=(const edwards_G2 &other) const;
+
+    edwards_G2 operator+(const edwards_G2 &other) const;
+    edwards_G2 operator-() const;
+    edwards_G2 operator-(const edwards_G2 &other) const;
+
+    edwards_G2 add(const edwards_G2 &other) const;
+    edwards_G2 mixed_add(const edwards_G2 &other) const;
+    edwards_G2 dbl() const;
+    edwards_G2 mul_by_q() const;
+
+    bool is_well_formed() const;
+
+    static edwards_G2 zero();
+    static edwards_G2 one();
+    static edwards_G2 random_element();
+
+    static size_t size_in_bits() { return twist_field::size_in_bits() + 1; }
+    static bigint<base_field::num_limbs> base_field_char() { return base_field::field_char(); }
+    static bigint<scalar_field::num_limbs> order() { return scalar_field::field_char(); }
+
+    friend std::ostream& operator<<(std::ostream &out, const edwards_G2 &g);
+    friend std::istream& operator>>(std::istream &in, edwards_G2 &g);
+
+    static void batch_to_special_all_non_zeros(std::vector<edwards_G2> &vec);
+};
+
+template<mp_size_t m>
+edwards_G2 operator*(const bigint<m> &lhs, const edwards_G2 &rhs)
+{
+    return scalar_mul<edwards_G2, m>(rhs, lhs);
+}
+
+template<mp_size_t m, const bigint<m>& modulus_p>
+edwards_G2 operator*(const Fp_model<m, modulus_p> &lhs, const edwards_G2 &rhs)
+{
+   return scalar_mul<edwards_G2, m>(rhs, lhs.as_bigint());
+}
+
+} // libff
+#endif // EDWARDS_G2_HPP_
diff --git a/src/libff/libff/algebra/curves/edwards/edwards_init.cpp b/src/libff/libff/algebra/curves/edwards/edwards_init.cpp
new file mode 100755
index 000000000..bb6702c60
--- /dev/null
+++ b/src/libff/libff/algebra/curves/edwards/edwards_init.cpp
@@ -0,0 +1,270 @@
+/** @file
+ *****************************************************************************
+ * @author     This file is part of libff, developed by SCIPR Lab
+ *             and contributors (see AUTHORS).
+ * @copyright  MIT license (see LICENSE file)
+ *****************************************************************************/
+
+#include <libff/algebra/curves/edwards/edwards_g1.hpp>
+#include <libff/algebra/curves/edwards/edwards_g2.hpp>
+#include <libff/algebra/curves/edwards/edwards_init.hpp>
+
+namespace libff {
+
+bigint<edwards_r_limbs> edwards_modulus_r;
+bigint<edwards_q_limbs> edwards_modulus_q;
+
+edwards_Fq edwards_coeff_a;
+edwards_Fq edwards_coeff_d;
+edwards_Fq3 edwards_twist;
+edwards_Fq3 edwards_twist_coeff_a;
+edwards_Fq3 edwards_twist_coeff_d;
+edwards_Fq edwards_twist_mul_by_a_c0;
+edwards_Fq edwards_twist_mul_by_a_c1;
+edwards_Fq edwards_twist_mul_by_a_c2;
+edwards_Fq edwards_twist_mul_by_d_c0;
+edwards_Fq edwards_twist_mul_by_d_c1;
+edwards_Fq edwards_twist_mul_by_d_c2;
+edwards_Fq edwards_twist_mul_by_q_Y;
+edwards_Fq edwards_twist_mul_by_q_Z;
+
+bigint<edwards_q_limbs> edwards_ate_loop_count;
+bigint<6*edwards_q_limbs> edwards_final_exponent;
+bigint<edwards_q_limbs> edwards_final_exponent_last_chunk_abs_of_w0;
+bool edwards_final_exponent_last_chunk_is_w0_neg;
+bigint<edwards_q_limbs> edwards_final_exponent_last_chunk_w1;
+
+void init_edwards_params()
+{
+    typedef bigint<edwards_r_limbs> bigint_r;
+    typedef bigint<edwards_q_limbs> bigint_q;
+
+    assert(sizeof(mp_limb_t) == 8 || sizeof(mp_limb_t) == 4); // Montgomery assumes this
+
+    /* parameters for scalar field Fr */
+
+    edwards_modulus_r = bigint_r("1552511030102430251236801561344621993261920897571225601");
+    assert(edwards_Fr::modulus_is_valid());
+    if (sizeof(mp_limb_t) == 8)
+    {
+        edwards_Fr::Rsquared = bigint_r("621738487827897760168419760282818735947979812540885779");
+        edwards_Fr::Rcubed = bigint_r("899968968216802386013510389846941393831065658679774050");
+        edwards_Fr::inv = 0xdde553277fffffff;
+    }
+    if (sizeof(mp_limb_t) == 4)
+    {
+        edwards_Fr::Rsquared = bigint_r("621738487827897760168419760282818735947979812540885779");
+        edwards_Fr::Rcubed = bigint_r("899968968216802386013510389846941393831065658679774050");
+        edwards_Fr::inv = 0x7fffffff;
+    }
+    edwards_Fr::num_bits = 181;
+    edwards_Fr::euler = bigint_r("776255515051215125618400780672310996630960448785612800");
+    edwards_Fr::s = 31;
+    edwards_Fr::t = bigint_r("722944284836962004768104088187507350585386575");
+    edwards_Fr::t_minus_1_over_2 = bigint_r("361472142418481002384052044093753675292693287");
+    edwards_Fr::multiplicative_generator = edwards_Fr("19");
+    edwards_Fr::root_of_unity = edwards_Fr("695314865466598274460565335217615316274564719601897184");
+    edwards_Fr::nqr = edwards_Fr("11");
+    edwards_Fr::nqr_to_t = edwards_Fr("1326707053668679463752768729767248251415639579872144553");
+
+    /* parameters for base field Fq */
+
+    edwards_modulus_q = bigint_q("6210044120409721004947206240885978274523751269793792001");
+    assert(edwards_Fq::modulus_is_valid());
+    if (sizeof(mp_limb_t) == 8)
+    {
+        edwards_Fq::Rsquared = bigint_q("5943559676554581037560514598978484097352477055348195432");
+        edwards_Fq::Rcubed = bigint_q("1081560488703514202058739223469726982199727506489234349");
+        edwards_Fq::inv = 0x76eb690b7fffffff;
+    }
+    if (sizeof(mp_limb_t) == 4)
+    {
+        edwards_Fq::Rsquared = bigint_q("5943559676554581037560514598978484097352477055348195432");
+        edwards_Fq::Rcubed = bigint_q("1081560488703514202058739223469726982199727506489234349");
+        edwards_Fq::inv = 0x7fffffff;
+    }
+    edwards_Fq::num_bits = 183;
+    edwards_Fq::euler = bigint_q("3105022060204860502473603120442989137261875634896896000");
+    edwards_Fq::s = 31;
+    edwards_Fq::t = bigint_q("2891777139347848019072416350658041552884388375");
+    edwards_Fq::t_minus_1_over_2 = bigint_q("1445888569673924009536208175329020776442194187");
+    edwards_Fq::multiplicative_generator = edwards_Fq("61");
+    edwards_Fq::root_of_unity = edwards_Fq("4692813029219384139894873043933463717810008194158530536");
+    edwards_Fq::nqr = edwards_Fq("23");
+    edwards_Fq::nqr_to_t = edwards_Fq("2626736066325740702418554487368721595489070118548299138");
+
+    /* parameters for twist field Fq3 */
+
+    edwards_Fq3::euler = bigint<3*edwards_q_limbs>("119744082713971502962992613191067836698205043373978948903839934564152994858051284658545502971203325031831647424413111161318314144765646525057914792711854057586688000");
+    edwards_Fq3::s = 31;
+    edwards_Fq3::t = bigint<3*edwards_q_limbs>("111520367408144756185815309352304634357062208814526860512643991563611659089151103662834971185031649686239331424621037357783237607000066456438894190557165125");
+    edwards_Fq3::t_minus_1_over_2 = bigint<3*edwards_q_limbs>("55760183704072378092907654676152317178531104407263430256321995781805829544575551831417485592515824843119665712310518678891618803500033228219447095278582562");
+    edwards_Fq3::non_residue = edwards_Fq("61");
+    edwards_Fq3::nqr = edwards_Fq3(edwards_Fq("23"),edwards_Fq("0"),edwards_Fq("0"));
+    edwards_Fq3::nqr_to_t = edwards_Fq3(edwards_Fq("104810943629412208121981114244673004633270996333237516"),edwards_Fq("0"),edwards_Fq("0"));
+    edwards_Fq3::Frobenius_coeffs_c1[0] = edwards_Fq("1");
+    edwards_Fq3::Frobenius_coeffs_c1[1] = edwards_Fq("1073752683758513276629212192812154536507607213288832061");
+    edwards_Fq3::Frobenius_coeffs_c1[2] = edwards_Fq("5136291436651207728317994048073823738016144056504959939");
+    edwards_Fq3::Frobenius_coeffs_c2[0] = edwards_Fq("1");
+    edwards_Fq3::Frobenius_coeffs_c2[1] = edwards_Fq("5136291436651207728317994048073823738016144056504959939");
+    edwards_Fq3::Frobenius_coeffs_c2[2] = edwards_Fq("1073752683758513276629212192812154536507607213288832061");
+
+    /* parameters for Fq6 */
+
+    edwards_Fq6::non_residue = edwards_Fq("61");
+    edwards_Fq6::Frobenius_coeffs_c1[0] = edwards_Fq("1");
+    edwards_Fq6::Frobenius_coeffs_c1[1] = edwards_Fq("1073752683758513276629212192812154536507607213288832062");
+    edwards_Fq6::Frobenius_coeffs_c1[2] = edwards_Fq("1073752683758513276629212192812154536507607213288832061");
+    edwards_Fq6::Frobenius_coeffs_c1[3] = edwards_Fq("6210044120409721004947206240885978274523751269793792000");
+    edwards_Fq6::Frobenius_coeffs_c1[4] = edwards_Fq("5136291436651207728317994048073823738016144056504959939");
+    edwards_Fq6::Frobenius_coeffs_c1[5] = edwards_Fq("5136291436651207728317994048073823738016144056504959940");
+    edwards_Fq6::my_Fp2::non_residue = edwards_Fq3::non_residue;
+
+    /* choice of Edwards curve and its twist */
+
+    edwards_coeff_a = edwards_Fq::one();
+    edwards_coeff_d = edwards_Fq("600581931845324488256649384912508268813600056237543024");
+    edwards_twist = edwards_Fq3(edwards_Fq::zero(), edwards_Fq::one(), edwards_Fq::zero());
+    edwards_twist_coeff_a = edwards_coeff_a * edwards_twist;
+    edwards_twist_coeff_d = edwards_coeff_d * edwards_twist;
+    edwards_twist_mul_by_a_c0 = edwards_coeff_a * edwards_Fq3::non_residue;
+    edwards_twist_mul_by_a_c1 = edwards_coeff_a;
+    edwards_twist_mul_by_a_c2 = edwards_coeff_a;
+    edwards_twist_mul_by_d_c0 = edwards_coeff_d * edwards_Fq3::non_residue;
+    edwards_twist_mul_by_d_c1 = edwards_coeff_d;
+    edwards_twist_mul_by_d_c2 = edwards_coeff_d;
+    edwards_twist_mul_by_q_Y = edwards_Fq("1073752683758513276629212192812154536507607213288832062");
+    edwards_twist_mul_by_q_Z = edwards_Fq("1073752683758513276629212192812154536507607213288832062");
+
+    /* choice of group G1 */
+
+    edwards_G1::G1_zero = edwards_G1(edwards_Fq::zero(),
+                                     edwards_Fq::one());
+    edwards_G1::G1_one = edwards_G1(edwards_Fq("3713709671941291996998665608188072510389821008693530490"),
+                                    edwards_Fq("4869953702976555123067178261685365085639705297852816679"));
+
+    edwards_G1::wnaf_window_table.resize(0);
+    edwards_G1::wnaf_window_table.push_back(9);
+    edwards_G1::wnaf_window_table.push_back(14);
+    edwards_G1::wnaf_window_table.push_back(24);
+    edwards_G1::wnaf_window_table.push_back(117);
+
+    edwards_G1::fixed_base_exp_window_table.resize(0);
+    // window 1 is unbeaten in [-inf, 4.10]
+    edwards_G1::fixed_base_exp_window_table.push_back(1);
+    // window 2 is unbeaten in [4.10, 9.69]
+    edwards_G1::fixed_base_exp_window_table.push_back(4);
+    // window 3 is unbeaten in [9.69, 25.21]
+    edwards_G1::fixed_base_exp_window_table.push_back(10);
+    // window 4 is unbeaten in [25.21, 60.00]
+    edwards_G1::fixed_base_exp_window_table.push_back(25);
+    // window 5 is unbeaten in [60.00, 149.33]
+    edwards_G1::fixed_base_exp_window_table.push_back(60);
+    // window 6 is unbeaten in [149.33, 369.61]
+    edwards_G1::fixed_base_exp_window_table.push_back(149);
+    // window 7 is unbeaten in [369.61, 849.07]
+    edwards_G1::fixed_base_exp_window_table.push_back(370);
+    // window 8 is unbeaten in [849.07, 1764.94]
+    edwards_G1::fixed_base_exp_window_table.push_back(849);
+    // window 9 is unbeaten in [1764.94, 4429.59]
+    edwards_G1::fixed_base_exp_window_table.push_back(1765);
+    // window 10 is unbeaten in [4429.59, 13388.78]
+    edwards_G1::fixed_base_exp_window_table.push_back(4430);
+    // window 11 is unbeaten in [13388.78, 15368.00]
+    edwards_G1::fixed_base_exp_window_table.push_back(13389);
+    // window 12 is unbeaten in [15368.00, 74912.07]
+    edwards_G1::fixed_base_exp_window_table.push_back(15368);
+    // window 13 is unbeaten in [74912.07, 438107.20]
+    edwards_G1::fixed_base_exp_window_table.push_back(74912);
+    // window 14 is never the best
+    edwards_G1::fixed_base_exp_window_table.push_back(0);
+    // window 15 is unbeaten in [438107.20, 1045626.18]
+    edwards_G1::fixed_base_exp_window_table.push_back(438107);
+    // window 16 is never the best
+    edwards_G1::fixed_base_exp_window_table.push_back(0);
+    // window 17 is unbeaten in [1045626.18, 1577434.48]
+    edwards_G1::fixed_base_exp_window_table.push_back(1045626);
+    // window 18 is unbeaten in [1577434.48, 17350594.23]
+    edwards_G1::fixed_base_exp_window_table.push_back(1577434);
+    // window 19 is never the best
+    edwards_G1::fixed_base_exp_window_table.push_back(0);
+    // window 20 is never the best
+    edwards_G1::fixed_base_exp_window_table.push_back(0);
+    // window 21 is unbeaten in [17350594.23, inf]
+    edwards_G1::fixed_base_exp_window_table.push_back(17350594);
+    // window 22 is never the best
+    edwards_G1::fixed_base_exp_window_table.push_back(0);
+
+    /* choice of group G2 */
+
+    edwards_G2::G2_zero = edwards_G2(edwards_Fq3::zero(),
+                                     edwards_Fq3::one());
+    edwards_G2::G2_one = edwards_G2(edwards_Fq3(edwards_Fq("4531683359223370252210990718516622098304721701253228128"),
+                                                edwards_Fq("5339624155305731263217400504407647531329993548123477368"),
+                                                edwards_Fq("3964037981777308726208525982198654699800283729988686552")),
+                                    edwards_Fq3(edwards_Fq("364634864866983740775341816274081071386963546650700569"),
+                                                edwards_Fq("3264380230116139014996291397901297105159834497864380415"),
+                                                edwards_Fq("3504781284999684163274269077749440837914479176282903747")));
+
+    edwards_G2::wnaf_window_table.resize(0);
+    edwards_G2::wnaf_window_table.push_back(6);
+    edwards_G2::wnaf_window_table.push_back(12);
+    edwards_G2::wnaf_window_table.push_back(42);
+    edwards_G2::wnaf_window_table.push_back(97);
+
+    edwards_G2::fixed_base_exp_window_table.resize(0);
+    // window 1 is unbeaten in [-inf, 4.74]
+    edwards_G2::fixed_base_exp_window_table.push_back(1);
+    // window 2 is unbeaten in [4.74, 10.67]
+    edwards_G2::fixed_base_exp_window_table.push_back(5);
+    // window 3 is unbeaten in [10.67, 25.53]
+    edwards_G2::fixed_base_exp_window_table.push_back(11);
+    // window 4 is unbeaten in [25.53, 60.67]
+    edwards_G2::fixed_base_exp_window_table.push_back(26);
+    // window 5 is unbeaten in [60.67, 145.77]
+    edwards_G2::fixed_base_exp_window_table.push_back(61);
+    // window 6 is unbeaten in [145.77, 356.76]
+    edwards_G2::fixed_base_exp_window_table.push_back(146);
+    // window 7 is unbeaten in [356.76, 823.08]
+    edwards_G2::fixed_base_exp_window_table.push_back(357);
+    // window 8 is unbeaten in [823.08, 1589.45]
+    edwards_G2::fixed_base_exp_window_table.push_back(823);
+    // window 9 is unbeaten in [1589.45, 4135.70]
+    edwards_G2::fixed_base_exp_window_table.push_back(1589);
+    // window 10 is unbeaten in [4135.70, 14297.74]
+    edwards_G2::fixed_base_exp_window_table.push_back(4136);
+    // window 11 is unbeaten in [14297.74, 16744.85]
+    edwards_G2::fixed_base_exp_window_table.push_back(14298);
+    // window 12 is unbeaten in [16744.85, 51768.98]
+    edwards_G2::fixed_base_exp_window_table.push_back(16745);
+    // window 13 is unbeaten in [51768.98, 99811.01]
+    edwards_G2::fixed_base_exp_window_table.push_back(51769);
+    // window 14 is unbeaten in [99811.01, 193306.72]
+    edwards_G2::fixed_base_exp_window_table.push_back(99811);
+    // window 15 is unbeaten in [193306.72, 907184.68]
+    edwards_G2::fixed_base_exp_window_table.push_back(193307);
+    // window 16 is never the best
+    edwards_G2::fixed_base_exp_window_table.push_back(0);
+    // window 17 is unbeaten in [907184.68, 1389682.59]
+    edwards_G2::fixed_base_exp_window_table.push_back(907185);
+    // window 18 is unbeaten in [1389682.59, 6752695.74]
+    edwards_G2::fixed_base_exp_window_table.push_back(1389683);
+    // window 19 is never the best
+    edwards_G2::fixed_base_exp_window_table.push_back(0);
+    // window 20 is unbeaten in [6752695.74, 193642894.51]
+    edwards_G2::fixed_base_exp_window_table.push_back(6752696);
+    // window 21 is unbeaten in [193642894.51, 226760202.29]
+    edwards_G2::fixed_base_exp_window_table.push_back(193642895);
+    // window 22 is unbeaten in [226760202.29, inf]
+    edwards_G2::fixed_base_exp_window_table.push_back(226760202);
+
+    /* pairing parameters */
+
+    edwards_ate_loop_count = bigint_q("4492509698523932320491110403");
+    edwards_final_exponent = bigint<6*edwards_q_limbs>("36943107177961694649618797346446870138748651578611748415128207429491593976636391130175425245705674550269561361208979548749447898941828686017765730419416875539615941651269793928962468899856083169227457503942470721108165443528513330156264699608120624990672333642644221591552000");
+    edwards_final_exponent_last_chunk_abs_of_w0 = bigint_q("17970038794095729281964441603");
+    edwards_final_exponent_last_chunk_is_w0_neg = true;
+    edwards_final_exponent_last_chunk_w1 = bigint_q("4");
+
+}
+} // libff
diff --git a/src/libff/libff/algebra/curves/edwards/edwards_init.hpp b/src/libff/libff/algebra/curves/edwards/edwards_init.hpp
new file mode 100755
index 000000000..5871f8ad2
--- /dev/null
+++ b/src/libff/libff/algebra/curves/edwards/edwards_init.hpp
@@ -0,0 +1,61 @@
+/** @file
+ *****************************************************************************
+ * @author     This file is part of libff, developed by SCIPR Lab
+ *             and contributors (see AUTHORS).
+ * @copyright  MIT license (see LICENSE file)
+ *****************************************************************************/
+
+#ifndef EDWARDS_INIT_HPP_
+#define EDWARDS_INIT_HPP_
+#include <libff/algebra/curves/public_params.hpp>
+#include <libff/algebra/fields/fp.hpp>
+#include <libff/algebra/fields/fp3.hpp>
+#include <libff/algebra/fields/fp6_2over3.hpp>
+
+namespace libff {
+
+const mp_size_t edwards_r_bitcount = 181;
+const mp_size_t edwards_q_bitcount = 183;
+
+const mp_size_t edwards_r_limbs = (edwards_r_bitcount+GMP_NUMB_BITS-1)/GMP_NUMB_BITS;
+const mp_size_t edwards_q_limbs = (edwards_q_bitcount+GMP_NUMB_BITS-1)/GMP_NUMB_BITS;
+
+extern bigint<edwards_r_limbs> edwards_modulus_r;
+extern bigint<edwards_q_limbs> edwards_modulus_q;
+
+typedef Fp_model<edwards_r_limbs, edwards_modulus_r> edwards_Fr;
+typedef Fp_model<edwards_q_limbs, edwards_modulus_q> edwards_Fq;
+typedef Fp3_model<edwards_q_limbs, edwards_modulus_q> edwards_Fq3;
+typedef Fp6_2over3_model<edwards_q_limbs, edwards_modulus_q> edwards_Fq6;
+typedef edwards_Fq6 edwards_GT;
+
+// parameters for Edwards curve E_{1,d}(F_q)
+extern edwards_Fq edwards_coeff_a;
+extern edwards_Fq edwards_coeff_d;
+// parameters for twisted Edwards curve E_{a',d'}(F_q^3)
+extern edwards_Fq3 edwards_twist;
+extern edwards_Fq3 edwards_twist_coeff_a;
+extern edwards_Fq3 edwards_twist_coeff_d;
+extern edwards_Fq edwards_twist_mul_by_a_c0;
+extern edwards_Fq edwards_twist_mul_by_a_c1;
+extern edwards_Fq edwards_twist_mul_by_a_c2;
+extern edwards_Fq edwards_twist_mul_by_d_c0;
+extern edwards_Fq edwards_twist_mul_by_d_c1;
+extern edwards_Fq edwards_twist_mul_by_d_c2;
+extern edwards_Fq edwards_twist_mul_by_q_Y;
+extern edwards_Fq edwards_twist_mul_by_q_Z;
+
+// parameters for pairing
+extern bigint<edwards_q_limbs> edwards_ate_loop_count;
+extern bigint<6*edwards_q_limbs> edwards_final_exponent;
+extern bigint<edwards_q_limbs> edwards_final_exponent_last_chunk_abs_of_w0;
+extern bool edwards_final_exponent_last_chunk_is_w0_neg;
+extern bigint<edwards_q_limbs> edwards_final_exponent_last_chunk_w1;
+
+void init_edwards_params();
+
+class edwards_G1;
+class edwards_G2;
+
+} // libff
+#endif // EDWARDS_INIT_HPP_
diff --git a/src/libff/libff/algebra/curves/edwards/edwards_pairing.cpp b/src/libff/libff/algebra/curves/edwards/edwards_pairing.cpp
new file mode 100755
index 000000000..ea81ff52b
--- /dev/null
+++ b/src/libff/libff/algebra/curves/edwards/edwards_pairing.cpp
@@ -0,0 +1,776 @@
+/** @file
+ *****************************************************************************
+ * @author     This file is part of libff, developed by SCIPR Lab
+ *             and contributors (see AUTHORS).
+ * @copyright  MIT license (see LICENSE file)
+ *****************************************************************************/
+
+#include <cassert>
+
+#include <libff/algebra/curves/edwards/edwards_g1.hpp>
+#include <libff/algebra/curves/edwards/edwards_g2.hpp>
+#include <libff/algebra/curves/edwards/edwards_init.hpp>
+#include <libff/algebra/curves/edwards/edwards_pairing.hpp>
+#include <libff/common/profiling.hpp>
+
+namespace libff {
+
+bool edwards_Fq_conic_coefficients::operator==(const edwards_Fq_conic_coefficients &other) const
+{
+    return (this->c_ZZ == other.c_ZZ &&
+            this->c_XY == other.c_XY &&
+            this->c_XZ == other.c_XZ);
+}
+
+std::ostream& operator<<(std::ostream &out, const edwards_Fq_conic_coefficients &cc)
+{
+    out << cc.c_ZZ << OUTPUT_SEPARATOR << cc.c_XY << OUTPUT_SEPARATOR << cc.c_XZ;
+    return out;
+}
+
+std::istream& operator>>(std::istream &in, edwards_Fq_conic_coefficients &cc)
+{
+    in >> cc.c_ZZ;
+    consume_OUTPUT_SEPARATOR(in);
+    in >> cc.c_XY;
+    consume_OUTPUT_SEPARATOR(in);
+    in >> cc.c_XZ;
+    return in;
+}
+
+std::ostream& operator<<(std::ostream& out, const edwards_tate_G1_precomp &prec_P)
+{
+    out << prec_P.size() << "\n";
+    for (const edwards_Fq_conic_coefficients &cc : prec_P)
+    {
+        out << cc << OUTPUT_NEWLINE;
+    }
+
+    return out;
+}
+
+std::istream& operator>>(std::istream& in, edwards_tate_G1_precomp &prec_P)
+{
+    prec_P.clear();
+
+    size_t s;
+    in >> s;
+
+    consume_newline(in);
+    prec_P.reserve(s);
+
+    for (size_t i = 0; i < s; ++i)
+    {
+        edwards_Fq_conic_coefficients cc;
+        in >> cc;
+        consume_OUTPUT_NEWLINE(in);
+        prec_P.emplace_back(cc);
+    }
+
+    return in;
+}
+
+bool edwards_tate_G2_precomp::operator==(const edwards_tate_G2_precomp &other) const
+{
+    return (this->y0 == other.y0 &&
+            this->eta == other.eta);
+}
+
+std::ostream& operator<<(std::ostream &out, const edwards_tate_G2_precomp &prec_Q)
+{
+    out << prec_Q.y0 << OUTPUT_SEPARATOR << prec_Q.eta;
+    return out;
+}
+
+std::istream& operator>>(std::istream &in, edwards_tate_G2_precomp &prec_Q)
+{
+    in >> prec_Q.y0;
+    consume_OUTPUT_SEPARATOR(in);
+    in >> prec_Q.eta;
+    return in;
+}
+
+bool edwards_Fq3_conic_coefficients::operator==(const edwards_Fq3_conic_coefficients &other) const
+{
+    return (this->c_ZZ == other.c_ZZ &&
+            this->c_XY == other.c_XY &&
+            this->c_XZ == other.c_XZ);
+}
+
+std::ostream& operator<<(std::ostream &out, const edwards_Fq3_conic_coefficients &cc)
+{
+    out << cc.c_ZZ << OUTPUT_SEPARATOR << cc.c_XY << OUTPUT_SEPARATOR << cc.c_XZ;
+    return out;
+}
+
+std::istream& operator>>(std::istream &in, edwards_Fq3_conic_coefficients &cc)
+{
+    in >> cc.c_ZZ;
+    consume_OUTPUT_SEPARATOR(in);
+    in >> cc.c_XY;
+    consume_OUTPUT_SEPARATOR(in);
+    in >> cc.c_XZ;
+    return in;
+}
+
+std::ostream& operator<<(std::ostream& out, const edwards_ate_G2_precomp &prec_Q)
+{
+    out << prec_Q.size() << "\n";
+    for (const edwards_Fq3_conic_coefficients &cc : prec_Q)
+    {
+        out << cc << OUTPUT_NEWLINE;
+    }
+
+    return out;
+}
+
+std::istream& operator>>(std::istream& in, edwards_ate_G2_precomp &prec_Q)
+{
+    prec_Q.clear();
+
+    size_t s;
+    in >> s;
+
+    consume_newline(in);
+
+    prec_Q.reserve(s);
+
+    for (size_t i = 0; i < s; ++i)
+    {
+        edwards_Fq3_conic_coefficients cc;
+        in >> cc;
+        consume_OUTPUT_NEWLINE(in);
+        prec_Q.emplace_back(cc);
+    }
+
+    return in;
+}
+
+bool edwards_ate_G1_precomp::operator==(const edwards_ate_G1_precomp &other) const
+{
+    return (this->P_XY == other.P_XY &&
+            this->P_XZ == other.P_XZ &&
+            this->P_ZZplusYZ == other.P_ZZplusYZ);
+}
+
+std::ostream& operator<<(std::ostream &out, const edwards_ate_G1_precomp &prec_P)
+{
+    out << prec_P.P_XY << OUTPUT_SEPARATOR << prec_P.P_XZ << OUTPUT_SEPARATOR << prec_P.P_ZZplusYZ;
+
+    return out;
+}
+
+std::istream& operator>>(std::istream &in, edwards_ate_G1_precomp &prec_P)
+{
+    in >> prec_P.P_XY >> prec_P.P_XZ >> prec_P.P_ZZplusYZ;
+
+    return in;
+}
+
+/* final exponentiations */
+edwards_Fq6 edwards_final_exponentiation_last_chunk(const edwards_Fq6 &elt, const edwards_Fq6 &elt_inv)
+{
+    enter_block("Call to edwards_final_exponentiation_last_chunk");
+    const edwards_Fq6 elt_q = elt.Frobenius_map(1);
+    edwards_Fq6 w1_part = elt_q.cyclotomic_exp(edwards_final_exponent_last_chunk_w1);
+    edwards_Fq6 w0_part;
+    if (edwards_final_exponent_last_chunk_is_w0_neg)
+    {
+    	w0_part = elt_inv.cyclotomic_exp(edwards_final_exponent_last_chunk_abs_of_w0);
+    } else {
+    	w0_part = elt.cyclotomic_exp(edwards_final_exponent_last_chunk_abs_of_w0);
+    }
+    edwards_Fq6 result = w1_part * w0_part;
+    leave_block("Call to edwards_final_exponentiation_last_chunk");
+
+    return result;
+}
+
+edwards_Fq6 edwards_final_exponentiation_first_chunk(const edwards_Fq6 &elt, const edwards_Fq6 &elt_inv)
+{
+    enter_block("Call to edwards_final_exponentiation_first_chunk");
+
+    /* (q^3-1)*(q+1) */
+
+    /* elt_q3 = elt^(q^3) */
+    const edwards_Fq6 elt_q3 = elt.Frobenius_map(3);
+    /* elt_q3_over_elt = elt^(q^3-1) */
+    const edwards_Fq6 elt_q3_over_elt = elt_q3 * elt_inv;
+    /* alpha = elt^((q^3-1) * q) */
+    const edwards_Fq6 alpha = elt_q3_over_elt.Frobenius_map(1);
+    /* beta = elt^((q^3-1)*(q+1) */
+    const edwards_Fq6 beta = alpha * elt_q3_over_elt;
+    leave_block("Call to edwards_final_exponentiation_first_chunk");
+    return beta;
+}
+
+edwards_GT edwards_final_exponentiation(const edwards_Fq6 &elt)
+{
+    enter_block("Call to edwards_final_exponentiation");
+    const edwards_Fq6 elt_inv = elt.inverse();
+    const edwards_Fq6 elt_to_first_chunk = edwards_final_exponentiation_first_chunk(elt, elt_inv);
+    const edwards_Fq6 elt_inv_to_first_chunk = edwards_final_exponentiation_first_chunk(elt_inv, elt);
+    edwards_GT result = edwards_final_exponentiation_last_chunk(elt_to_first_chunk, elt_inv_to_first_chunk);
+    leave_block("Call to edwards_final_exponentiation");
+
+    return result;
+}
+
+edwards_tate_G2_precomp edwards_tate_precompute_G2(const edwards_G2& Q)
+{
+    enter_block("Call to edwards_tate_precompute_G2");
+    edwards_G2 Qcopy = Q;
+    Qcopy.to_affine_coordinates();
+    edwards_tate_G2_precomp result;
+    result.y0 = Qcopy.Y * Qcopy.Z.inverse(); // Y/Z
+    result.eta = (Qcopy.Z+Qcopy.Y) * edwards_Fq6::mul_by_non_residue(Qcopy.X).inverse(); // (Z+Y)/(nqr*X)
+    leave_block("Call to edwards_tate_precompute_G2");
+
+    return result;
+}
+
+struct extended_edwards_G1_projective {
+    edwards_Fq X;
+    edwards_Fq Y;
+    edwards_Fq Z;
+    edwards_Fq T;
+
+    void print() const
+        {
+            printf("extended edwards_G1 projective X/Y/Z/T:\n");
+            X.print();
+            Y.print();
+            Z.print();
+            T.print();
+        }
+
+    void test_invariant() const
+        {
+            assert(T*Z == X*Y);
+        }
+};
+
+void doubling_step_for_miller_loop(extended_edwards_G1_projective &current,
+                                   edwards_Fq_conic_coefficients &cc)
+{
+    const edwards_Fq &X = current.X, &Y = current.Y, &Z = current.Z, &T = current.T;
+    const edwards_Fq A = X.squared();     // A    = X1^2
+    const edwards_Fq B = Y.squared();     // B    = Y1^2
+    const edwards_Fq C = Z.squared();     // C    = Z1^2
+    const edwards_Fq D = (X+Y).squared(); // D    = (X1+Y1)^2
+    const edwards_Fq E = (Y+Z).squared(); // E    = (Y1+Z1)^2
+    const edwards_Fq F = D-(A+B);         // F    = D-(A+B)
+    const edwards_Fq G = E-(B+C);         // G    = E-(B+C)
+    const edwards_Fq &H = A;              // H    = A (edwards_a=1)
+    const edwards_Fq I = H+B;             // I    = H+B
+    const edwards_Fq J = C-I;             // J    = C-I
+    const edwards_Fq K = J+C;             // K    = J+C
+
+    cc.c_ZZ = Y*(T-X);            // c_ZZ = 2*Y1*(T1-X1)
+    cc.c_ZZ = cc.c_ZZ + cc.c_ZZ;
+
+    cc.c_XY = J+J+G;              // c_XY = 2*J+G
+    cc.c_XZ = X*T-B;              // c_XZ = 2*(X1*T1-B) (edwards_a=1)
+    cc.c_XZ = cc.c_XZ + cc.c_XZ;
+
+    current.X = F*K;              // X3 = F*K
+    current.Y = I*(B-H);          // Y3 = I*(B-H)
+    current.Z = I*K;              // Z3 = I*K
+    current.T = F*(B-H);          // T3 = F*(B-H)
+
+#ifdef DEBUG
+    current.test_invariant();
+#endif
+}
+
+void full_addition_step_for_miller_loop(const extended_edwards_G1_projective &base,
+                                        extended_edwards_G1_projective &current,
+                                        edwards_Fq_conic_coefficients &cc)
+{
+    const edwards_Fq &X1 = current.X, &Y1 = current.Y, &Z1 = current.Z, &T1 = current.T;
+    const edwards_Fq &X2 = base.X, &Y2 =  base.Y, &Z2 = base.Z, &T2 = base.T;
+
+    const edwards_Fq A = X1*X2;               // A    = X1*X2
+    const edwards_Fq B = Y1*Y2;               // B    = Y1*Y2
+    const edwards_Fq C = Z1*T2;               // C    = Z1*T2
+    const edwards_Fq D = T1*Z2;               // D    = T1*Z2
+    const edwards_Fq E = D+C;                 // E    = D+C
+    const edwards_Fq F = (X1-Y1)*(X2+Y2)+B-A; // F    = (X1-Y1)*(X2+Y2)+B-A
+    const edwards_Fq G = B + A;               // G    = B + A (edwards_a=1)
+    const edwards_Fq H = D-C;                 // H    = D-C
+    const edwards_Fq I = T1*T2;               // I    = T1*T2
+
+    cc.c_ZZ = (T1-X1)*(T2+X2)-I+A;    // c_ZZ = (T1-X1)*(T2+X2)-I+A
+    cc.c_XY = X1*Z2-X2*Z1+F;          // c_XY = X1*Z2-X2*Z1+F
+    cc.c_XZ = (Y1-T1)*(Y2+T2)-B+I-H;  // c_XZ = (Y1-T1)*(Y2+T2)-B+I-H
+    current.X = E*F;                  // X3   = E*F
+    current.Y = G*H;                  // Y3   = G*H
+    current.Z = F*G;                  // Z3   = F*G
+    current.T = E*H;                  // T3   = E*H
+
+#ifdef DEBUG
+    current.test_invariant();
+#endif
+}
+
+void mixed_addition_step_for_miller_loop(const extended_edwards_G1_projective &base,
+                                         extended_edwards_G1_projective &current,
+                                         edwards_Fq_conic_coefficients &cc)
+{
+    const edwards_Fq &X1 = current.X, &Y1 = current.Y, &Z1 = current.Z, &T1 = current.T;
+    const edwards_Fq &X2 = base.X, &Y2 =  base.Y, &T2 = base.T;
+
+    const edwards_Fq A = X1*X2;               // A    = X1*X2
+    const edwards_Fq B = Y1*Y2;               // B    = Y1*Y2
+    const edwards_Fq C = Z1*T2;               // C    = Z1*T2
+    const edwards_Fq D = T1;                  // D    = T1*Z2
+    const edwards_Fq E = D+C;                 // E    = D+C
+    const edwards_Fq F = (X1-Y1)*(X2+Y2)+B-A; // F    = (X1-Y1)*(X2+Y2)+B-A
+    const edwards_Fq G = B + A;               // G    = B + A (edwards_a=1)
+    const edwards_Fq H = D-C;                 // H    = D-C
+    const edwards_Fq I = T1*T2;               // I    = T1*T2
+
+    cc.c_ZZ = (T1-X1)*(T2+X2)-I+A;    // c_ZZ = (T1-X1)*(T2+X2)-I+A
+    cc.c_XY = X1-X2*Z1+F;             // c_XY = X1*Z2-X2*Z1+F
+    cc.c_XZ = (Y1-T1)*(Y2+T2)-B+I-H;  // c_XZ = (Y1-T1)*(Y2+T2)-B+I-H
+    current.X = E*F;                  // X3   = E*F
+    current.Y = G*H;                  // Y3   = G*H
+    current.Z = F*G;                  // Z3   = F*G
+    current.T = E*H;                  // T3   = E*H
+
+#ifdef DEBUG
+    current.test_invariant();
+#endif
+}
+
+edwards_tate_G1_precomp edwards_tate_precompute_G1(const edwards_G1& P)
+{
+    enter_block("Call to edwards_tate_precompute_G1");
+    edwards_tate_G1_precomp result;
+
+    edwards_G1 Pcopy = P;
+    Pcopy.to_affine_coordinates();
+
+    extended_edwards_G1_projective P_ext;
+    P_ext.X = Pcopy.X;
+    P_ext.Y = Pcopy.Y;
+    P_ext.Z = Pcopy.Z;
+    P_ext.T = Pcopy.X*Pcopy.Y;
+
+    extended_edwards_G1_projective R = P_ext;
+
+    bool found_one = false;
+    for (long i = edwards_modulus_r.max_bits(); i >= 0; --i)
+    {
+        const bool bit = edwards_modulus_r.test_bit(i);
+        if (!found_one)
+        {
+            /* this skips the MSB itself */
+            found_one |= bit;
+            continue;
+        }
+
+        /* code below gets executed for all bits (EXCEPT the MSB itself) of
+           edwards_modulus_r (skipping leading zeros) in MSB to LSB
+           order */
+        edwards_Fq_conic_coefficients cc;
+        doubling_step_for_miller_loop(R, cc);
+        result.push_back(cc);
+
+        if (bit)
+        {
+            mixed_addition_step_for_miller_loop(P_ext, R, cc);
+            result.push_back(cc);
+        }
+    }
+
+    leave_block("Call to edwards_tate_precompute_G1");
+    return result;
+}
+
+edwards_Fq6 edwards_tate_miller_loop(const edwards_tate_G1_precomp &prec_P,
+                          const edwards_tate_G2_precomp &prec_Q)
+{
+    enter_block("Call to edwards_tate_miller_loop");
+
+    edwards_Fq6 f = edwards_Fq6::one();
+
+    bool found_one = false;
+    size_t idx = 0;
+    for (long i = edwards_modulus_r.max_bits()-1; i >= 0; --i)
+    {
+        const bool bit = edwards_modulus_r.test_bit(i);
+        if (!found_one)
+        {
+            /* this skips the MSB itself */
+            found_one |= bit;
+            continue;
+        }
+
+        /* code below gets executed for all bits (EXCEPT the MSB itself) of
+           edwards_modulus_r (skipping leading zeros) in MSB to LSB
+           order */
+        edwards_Fq_conic_coefficients cc = prec_P[idx++];
+        edwards_Fq6 g_RR_at_Q = edwards_Fq6(edwards_Fq3(cc.c_XZ, edwards_Fq(0l), edwards_Fq(0l)) + cc.c_XY * prec_Q.y0,
+                                            cc.c_ZZ * prec_Q.eta);
+        f = f.squared() * g_RR_at_Q;
+        if (bit)
+        {
+            cc = prec_P[idx++];
+
+            edwards_Fq6 g_RP_at_Q = edwards_Fq6(edwards_Fq3(cc.c_XZ, edwards_Fq(0l), edwards_Fq(0l)) + cc.c_XY * prec_Q.y0,
+                                                cc.c_ZZ * prec_Q.eta);
+            f = f * g_RP_at_Q;
+        }
+    }
+    leave_block("Call to edwards_tate_miller_loop");
+
+    return f;
+}
+
+edwards_Fq6 edwards_tate_pairing(const edwards_G1& P, const edwards_G2 &Q)
+{
+    enter_block("Call to edwards_tate_pairing");
+    edwards_tate_G1_precomp prec_P = edwards_tate_precompute_G1(P);
+    edwards_tate_G2_precomp prec_Q = edwards_tate_precompute_G2(Q);
+    edwards_Fq6 result = edwards_tate_miller_loop(prec_P, prec_Q);
+    leave_block("Call to edwards_tate_pairing");
+    return result;
+}
+
+edwards_GT edwards_tate_reduced_pairing(const edwards_G1 &P, const edwards_G2 &Q)
+{
+    enter_block("Call to edwards_tate_reduced_pairing");
+    const edwards_Fq6 f = edwards_tate_pairing(P, Q);
+    const edwards_GT result = edwards_final_exponentiation(f);
+    leave_block("Call to edwards_tate_reduce_pairing");
+    return result;
+}
+
+struct extended_edwards_G2_projective {
+    edwards_Fq3 X;
+    edwards_Fq3 Y;
+    edwards_Fq3 Z;
+    edwards_Fq3 T;
+
+    void print() const
+        {
+            printf("extended edwards_G2 projective X/Y/Z/T:\n");
+            X.print();
+            Y.print();
+            Z.print();
+            T.print();
+        }
+
+    void test_invariant() const
+        {
+            assert(T*Z == X*Y);
+        }
+};
+
+void doubling_step_for_flipped_miller_loop(extended_edwards_G2_projective &current,
+                                           edwards_Fq3_conic_coefficients &cc)
+{
+    const edwards_Fq3 &X = current.X, &Y = current.Y, &Z = current.Z, &T = current.T;
+    const edwards_Fq3 A = X.squared();     // A    = X1^2
+    const edwards_Fq3 B = Y.squared();     // B    = Y1^2
+    const edwards_Fq3 C = Z.squared();     // C    = Z1^2
+    const edwards_Fq3 D = (X+Y).squared(); // D    = (X1+Y1)^2
+    const edwards_Fq3 E = (Y+Z).squared(); // E    = (Y1+Z1)^2
+    const edwards_Fq3 F = D-(A+B);         // F    = D-(A+B)
+    const edwards_Fq3 G = E-(B+C);         // G    = E-(B+C)
+    const edwards_Fq3 H = edwards_G2::mul_by_a(A); // edwards_param_twist_coeff_a is 1 * X for us
+                                   // H    = twisted_a * A
+    const edwards_Fq3 I = H+B;             // I    = H+B
+    const edwards_Fq3 J = C-I;             // J    = C-I
+    const edwards_Fq3 K = J+C;             // K    = J+C
+
+    cc.c_ZZ = Y*(T-X);            // c_ZZ = 2*Y1*(T1-X1)
+    cc.c_ZZ = cc.c_ZZ + cc.c_ZZ;
+
+    // c_XY = 2*(C-edwards_a * A * delta_3-B)+G (edwards_a = 1 for us)
+    cc.c_XY = C - edwards_G2::mul_by_a(A) - B; // edwards_param_twist_coeff_a is 1 * X for us
+    cc.c_XY = cc.c_XY + cc.c_XY + G;
+
+    // c_XZ = 2*(edwards_a*X1*T1*delta_3-B) (edwards_a = 1 for us)
+    cc.c_XZ = edwards_G2::mul_by_a(X * T) - B; // edwards_param_twist_coeff_a is 1 * X for us
+    cc.c_XZ = cc.c_XZ + cc.c_XZ;
+
+    current.X = F*K;              // X3 = F*K
+    current.Y = I*(B-H);          // Y3 = I*(B-H)
+    current.Z = I*K;              // Z3 = I*K
+    current.T = F*(B-H);          // T3 = F*(B-H)
+#ifdef DEBUG
+    current.test_invariant();
+#endif
+}
+
+void full_addition_step_for_flipped_miller_loop(const extended_edwards_G2_projective &base,
+                                                extended_edwards_G2_projective &current,
+                                                edwards_Fq3_conic_coefficients &cc)
+{
+    const edwards_Fq3 &X1 = current.X, &Y1 = current.Y, &Z1 = current.Z, &T1 = current.T;
+    const edwards_Fq3 &X2 = base.X, &Y2 =  base.Y, &Z2 = base.Z, &T2 = base.T;
+
+    const edwards_Fq3 A = X1*X2;               // A    = X1*X2
+    const edwards_Fq3 B = Y1*Y2;               // B    = Y1*Y2
+    const edwards_Fq3 C = Z1*T2;               // C    = Z1*T2
+    const edwards_Fq3 D = T1*Z2;               // D    = T1*Z2
+    const edwards_Fq3 E = D+C;                 // E    = D+C
+    const edwards_Fq3 F = (X1-Y1)*(X2+Y2)+B-A; // F    = (X1-Y1)*(X2+Y2)+B-A
+    // G = B + twisted_edwards_a * A
+    const edwards_Fq3 G = B + edwards_G2::mul_by_a(A); // edwards_param_twist_coeff_a is 1*X for us
+    const edwards_Fq3 H = D-C;                 // H    = D-C
+    const edwards_Fq3 I = T1*T2;               // I    = T1*T2
+
+    // c_ZZ = delta_3* ((T1-X1)*(T2+X2)-I+A)
+    cc.c_ZZ = edwards_G2::mul_by_a((T1-X1)*(T2+X2)-I+A); // edwards_param_twist_coeff_a is 1*X for us
+
+    cc.c_XY = X1*Z2-X2*Z1+F;          // c_XY = X1*Z2-X2*Z1+F
+    cc.c_XZ = (Y1-T1)*(Y2+T2)-B+I-H;  // c_XZ = (Y1-T1)*(Y2+T2)-B+I-H
+    current.X = E*F;                  // X3   = E*F
+    current.Y = G*H;                  // Y3   = G*H
+    current.Z = F*G;                  // Z3   = F*G
+    current.T = E*H;                  // T3   = E*H
+
+#ifdef DEBUG
+    current.test_invariant();
+#endif
+}
+
+void mixed_addition_step_for_flipped_miller_loop(const extended_edwards_G2_projective &base,
+                                                 extended_edwards_G2_projective &current,
+                                                 edwards_Fq3_conic_coefficients &cc)
+{
+    const edwards_Fq3 &X1 = current.X, &Y1 = current.Y, &Z1 = current.Z, &T1 = current.T;
+    const edwards_Fq3 &X2 = base.X, &Y2 =  base.Y, &T2 = base.T;
+
+    const edwards_Fq3 A = X1*X2;               // A    = X1*X2
+    const edwards_Fq3 B = Y1*Y2;               // B    = Y1*Y2
+    const edwards_Fq3 C = Z1*T2;               // C    = Z1*T2
+    const edwards_Fq3 E = T1+C;                // E    = T1+C
+    const edwards_Fq3 F = (X1-Y1)*(X2+Y2)+B-A; // F    = (X1-Y1)*(X2+Y2)+B-A
+    // G = B + twisted_edwards_a * A
+    const edwards_Fq3 G = B + edwards_G2::mul_by_a(A); // edwards_param_twist_coeff_a is 1*X for us
+    const edwards_Fq3 H = T1-C;                // H    = T1-C
+    const edwards_Fq3 I = T1*T2;               // I    = T1*T2
+
+    // c_ZZ = delta_3* ((T1-X1)*(T2+X2)-I+A)
+    cc.c_ZZ = edwards_G2::mul_by_a((T1-X1)*(T2+X2)-I+A); // edwards_param_twist_coeff_a is 1*X for us
+
+    cc.c_XY = X1-X2*Z1+F;             // c_XY = X1*Z2-X2*Z1+F
+    cc.c_XZ = (Y1-T1)*(Y2+T2)-B+I-H;  // c_XZ = (Y1-T1)*(Y2+T2)-B+I-H
+    current.X = E*F;                  // X3   = E*F
+    current.Y = G*H;                  // Y3   = G*H
+    current.Z = F*G;                  // Z3   = F*G
+    current.T = E*H;                  // T3   = E*H
+
+#ifdef DEBUG
+    current.test_invariant();
+#endif
+}
+
+edwards_ate_G1_precomp edwards_ate_precompute_G1(const edwards_G1& P)
+{
+    enter_block("Call to edwards_ate_precompute_G1");
+    edwards_G1 Pcopy = P;
+    Pcopy.to_affine_coordinates();
+    edwards_ate_G1_precomp result;
+    result.P_XY = Pcopy.X*Pcopy.Y;
+    result.P_XZ = Pcopy.X; // P.X * P.Z but P.Z = 1
+    result.P_ZZplusYZ = (edwards_Fq::one() + Pcopy.Y); // (P.Z + P.Y) * P.Z but P.Z = 1
+    leave_block("Call to edwards_ate_precompute_G1");
+    return result;
+}
+
+edwards_ate_G2_precomp edwards_ate_precompute_G2(const edwards_G2& Q)
+{
+    enter_block("Call to edwards_ate_precompute_G2");
+    const bigint<edwards_Fr::num_limbs> &loop_count = edwards_ate_loop_count;
+    edwards_ate_G2_precomp result;
+
+    edwards_G2 Qcopy(Q);
+    Qcopy.to_affine_coordinates();
+
+    extended_edwards_G2_projective Q_ext;
+    Q_ext.X = Qcopy.X;
+    Q_ext.Y = Qcopy.Y;
+    Q_ext.Z = Qcopy.Z;
+    Q_ext.T = Qcopy.X*Qcopy.Y;
+
+    extended_edwards_G2_projective R = Q_ext;
+
+    bool found_one = false;
+    for (long i = loop_count.max_bits()-1; i >= 0; --i)
+    {
+        const bool bit = loop_count.test_bit(i);
+        if (!found_one)
+        {
+            /* this skips the MSB itself */
+            found_one |= bit;
+            continue;
+        }
+
+        edwards_Fq3_conic_coefficients cc;
+        doubling_step_for_flipped_miller_loop(R, cc);
+        result.push_back(cc);
+        if (bit)
+        {
+            mixed_addition_step_for_flipped_miller_loop(Q_ext, R, cc);
+            result.push_back(cc);
+        }
+    }
+
+    leave_block("Call to edwards_ate_precompute_G2");
+    return result;
+}
+
+edwards_Fq6 edwards_ate_miller_loop(const edwards_ate_G1_precomp &prec_P,
+                                    const edwards_ate_G2_precomp &prec_Q)
+{
+    enter_block("Call to edwards_ate_miller_loop");
+    const bigint<edwards_Fr::num_limbs> &loop_count = edwards_ate_loop_count;
+
+    edwards_Fq6 f = edwards_Fq6::one();
+
+    bool found_one = false;
+    size_t idx = 0;
+    for (long i = loop_count.max_bits()-1; i >= 0; --i)
+    {
+        const bool bit = loop_count.test_bit(i);
+        if (!found_one)
+        {
+            /* this skips the MSB itself */
+            found_one |= bit;
+            continue;
+        }
+
+        /* code below gets executed for all bits (EXCEPT the MSB itself) of
+           edwards_param_p (skipping leading zeros) in MSB to LSB
+           order */
+        edwards_Fq3_conic_coefficients cc = prec_Q[idx++];
+
+        edwards_Fq6 g_RR_at_P = edwards_Fq6(prec_P.P_XY * cc.c_XY + prec_P.P_XZ * cc.c_XZ,
+                                            prec_P.P_ZZplusYZ * cc.c_ZZ);
+        f = f.squared() * g_RR_at_P;
+        if (bit)
+        {
+            cc = prec_Q[idx++];
+            edwards_Fq6 g_RQ_at_P = edwards_Fq6(prec_P.P_ZZplusYZ * cc.c_ZZ,
+                                                prec_P.P_XY * cc.c_XY + prec_P.P_XZ * cc.c_XZ);
+            f = f * g_RQ_at_P;
+        }
+    }
+    leave_block("Call to edwards_ate_miller_loop");
+
+    return f;
+}
+
+edwards_Fq6 edwards_ate_double_miller_loop(const edwards_ate_G1_precomp &prec_P1,
+                                           const edwards_ate_G2_precomp &prec_Q1,
+                                           const edwards_ate_G1_precomp &prec_P2,
+                                           const edwards_ate_G2_precomp &prec_Q2)
+{
+    enter_block("Call to edwards_ate_double_miller_loop");
+    const bigint<edwards_Fr::num_limbs> &loop_count = edwards_ate_loop_count;
+
+    edwards_Fq6 f = edwards_Fq6::one();
+
+    bool found_one = false;
+    size_t idx = 0;
+    for (long i = loop_count.max_bits()-1; i >= 0; --i)
+    {
+        const bool bit = loop_count.test_bit(i);
+        if (!found_one)
+        {
+            /* this skips the MSB itself */
+            found_one |= bit;
+            continue;
+        }
+
+        /* code below gets executed for all bits (EXCEPT the MSB itself) of
+           edwards_param_p (skipping leading zeros) in MSB to LSB
+           order */
+        edwards_Fq3_conic_coefficients cc1 = prec_Q1[idx];
+        edwards_Fq3_conic_coefficients cc2 = prec_Q2[idx];
+        ++idx;
+
+        edwards_Fq6 g_RR_at_P1 = edwards_Fq6(prec_P1.P_XY * cc1.c_XY + prec_P1.P_XZ * cc1.c_XZ,
+                                             prec_P1.P_ZZplusYZ * cc1.c_ZZ);
+
+        edwards_Fq6 g_RR_at_P2 = edwards_Fq6(prec_P2.P_XY * cc2.c_XY + prec_P2.P_XZ * cc2.c_XZ,
+                                             prec_P2.P_ZZplusYZ * cc2.c_ZZ);
+        f = f.squared() * g_RR_at_P1 * g_RR_at_P2;
+
+        if (bit)
+        {
+            cc1 = prec_Q1[idx];
+            cc2 = prec_Q2[idx];
+            ++idx;
+            edwards_Fq6 g_RQ_at_P1 = edwards_Fq6(prec_P1.P_ZZplusYZ * cc1.c_ZZ,
+                                                 prec_P1.P_XY * cc1.c_XY + prec_P1.P_XZ * cc1.c_XZ);
+            edwards_Fq6 g_RQ_at_P2 = edwards_Fq6(prec_P2.P_ZZplusYZ * cc2.c_ZZ,
+                                                 prec_P2.P_XY * cc2.c_XY + prec_P2.P_XZ * cc2.c_XZ);
+            f = f * g_RQ_at_P1 * g_RQ_at_P2;
+        }
+    }
+    leave_block("Call to edwards_ate_double_miller_loop");
+
+    return f;
+}
+
+edwards_Fq6 edwards_ate_pairing(const edwards_G1& P, const edwards_G2 &Q)
+{
+    enter_block("Call to edwards_ate_pairing");
+    edwards_ate_G1_precomp prec_P = edwards_ate_precompute_G1(P);
+    edwards_ate_G2_precomp prec_Q = edwards_ate_precompute_G2(Q);
+    edwards_Fq6 result = edwards_ate_miller_loop(prec_P, prec_Q);
+    leave_block("Call to edwards_ate_pairing");
+    return result;
+}
+
+edwards_GT edwards_ate_reduced_pairing(const edwards_G1 &P, const edwards_G2 &Q)
+{
+    enter_block("Call to edwards_ate_reduced_pairing");
+    const edwards_Fq6 f = edwards_ate_pairing(P, Q);
+    const edwards_GT result = edwards_final_exponentiation(f);
+    leave_block("Call to edwards_ate_reduced_pairing");
+    return result;
+}
+
+edwards_G1_precomp edwards_precompute_G1(const edwards_G1& P)
+{
+    return edwards_ate_precompute_G1(P);
+}
+
+edwards_G2_precomp edwards_precompute_G2(const edwards_G2& Q)
+{
+    return edwards_ate_precompute_G2(Q);
+}
+
+edwards_Fq6 edwards_miller_loop(const edwards_G1_precomp &prec_P,
+                                const edwards_G2_precomp &prec_Q)
+{
+    return edwards_ate_miller_loop(prec_P, prec_Q);
+}
+
+edwards_Fq6 edwards_double_miller_loop(const edwards_G1_precomp &prec_P1,
+                                       const edwards_G2_precomp &prec_Q1,
+                                       const edwards_G1_precomp &prec_P2,
+                                       const edwards_G2_precomp &prec_Q2)
+{
+    return edwards_ate_double_miller_loop(prec_P1, prec_Q1, prec_P2, prec_Q2);
+}
+
+edwards_Fq6 edwards_pairing(const edwards_G1& P,
+                            const edwards_G2 &Q)
+{
+    return edwards_ate_pairing(P, Q);
+}
+
+edwards_GT edwards_reduced_pairing(const edwards_G1 &P,
+                                   const edwards_G2 &Q)
+{
+    return edwards_ate_reduced_pairing(P, Q);
+}
+} // libff
diff --git a/src/libff/libff/algebra/curves/edwards/edwards_pairing.hpp b/src/libff/libff/algebra/curves/edwards/edwards_pairing.hpp
new file mode 100755
index 000000000..e5e642124
--- /dev/null
+++ b/src/libff/libff/algebra/curves/edwards/edwards_pairing.hpp
@@ -0,0 +1,123 @@
+/** @file
+ *****************************************************************************
+ * @author     This file is part of libff, developed by SCIPR Lab
+ *             and contributors (see AUTHORS).
+ * @copyright  MIT license (see LICENSE file)
+ *****************************************************************************/
+
+#ifndef EDWARDS_PAIRING_HPP_
+#define EDWARDS_PAIRING_HPP_
+#include <vector>
+
+#include <libff/algebra/curves/edwards/edwards_init.hpp>
+
+namespace libff {
+
+/* final exponentiation */
+
+edwards_Fq6 edwards_final_exponentiation_last_chunk(const edwards_Fq6 &elt,
+                                                    const edwards_Fq6 &elt_inv);
+edwards_Fq6 edwards_final_exponentiation_first_chunk(const edwards_Fq6 &elt,
+                                                     const edwards_Fq6 &elt_inv);
+edwards_GT edwards_final_exponentiation(const edwards_Fq6 &elt);
+
+/* Tate pairing */
+
+struct edwards_Fq_conic_coefficients {
+    edwards_Fq c_ZZ;
+    edwards_Fq c_XY;
+    edwards_Fq c_XZ;
+
+    bool operator==(const edwards_Fq_conic_coefficients &other) const;
+    friend std::ostream& operator<<(std::ostream &out, const edwards_Fq_conic_coefficients &cc);
+    friend std::istream& operator>>(std::istream &in, edwards_Fq_conic_coefficients &cc);
+};
+typedef std::vector<edwards_Fq_conic_coefficients> edwards_tate_G1_precomp;
+
+std::ostream& operator<<(std::ostream& out, const edwards_tate_G1_precomp &prec_P);
+std::istream& operator>>(std::istream& in, edwards_tate_G1_precomp &prec_P);
+
+struct edwards_tate_G2_precomp {
+    edwards_Fq3 y0, eta;
+
+    bool operator==(const edwards_tate_G2_precomp &other) const;
+    friend std::ostream& operator<<(std::ostream &out, const edwards_tate_G2_precomp &prec_Q);
+    friend std::istream& operator>>(std::istream &in, edwards_tate_G2_precomp &prec_Q);
+};
+
+edwards_tate_G1_precomp edwards_tate_precompute_G1(const edwards_G1& P);
+edwards_tate_G2_precomp edwards_tate_precompute_G2(const edwards_G2& Q);
+
+edwards_Fq6 edwards_tate_miller_loop(const edwards_tate_G1_precomp &prec_P,
+                                     const edwards_tate_G2_precomp &prec_Q);
+
+edwards_Fq6 edwards_tate_pairing(const edwards_G1& P,
+                                 const edwards_G2 &Q);
+edwards_GT edwards_tate_reduced_pairing(const edwards_G1 &P,
+                                        const edwards_G2 &Q);
+
+/* ate pairing */
+
+struct edwards_Fq3_conic_coefficients {
+    edwards_Fq3 c_ZZ;
+    edwards_Fq3 c_XY;
+    edwards_Fq3 c_XZ;
+
+    bool operator==(const edwards_Fq3_conic_coefficients &other) const;
+    friend std::ostream& operator<<(std::ostream &out, const edwards_Fq3_conic_coefficients &cc);
+    friend std::istream& operator>>(std::istream &in, edwards_Fq3_conic_coefficients &cc);
+};
+typedef std::vector<edwards_Fq3_conic_coefficients> edwards_ate_G2_precomp;
+
+std::ostream& operator<<(std::ostream& out, const edwards_ate_G2_precomp &prec_Q);
+std::istream& operator>>(std::istream& in, edwards_ate_G2_precomp &prec_Q);
+
+struct edwards_ate_G1_precomp {
+    edwards_Fq P_XY;
+    edwards_Fq P_XZ;
+    edwards_Fq P_ZZplusYZ;
+
+    bool operator==(const edwards_ate_G1_precomp &other) const;
+    friend std::ostream& operator<<(std::ostream &out, const edwards_ate_G1_precomp &prec_P);
+    friend std::istream& operator>>(std::istream &in, edwards_ate_G1_precomp &prec_P);
+};
+
+edwards_ate_G1_precomp edwards_ate_precompute_G1(const edwards_G1& P);
+edwards_ate_G2_precomp edwards_ate_precompute_G2(const edwards_G2& Q);
+
+edwards_Fq6 edwards_ate_miller_loop(const edwards_ate_G1_precomp &prec_P,
+                                    const edwards_ate_G2_precomp &prec_Q);
+edwards_Fq6 edwards_ate_double_miller_loop(const edwards_ate_G1_precomp &prec_P1,
+                                           const edwards_ate_G2_precomp &prec_Q1,
+                                           const edwards_ate_G1_precomp &prec_P2,
+                                           const edwards_ate_G2_precomp &prec_Q2);
+
+edwards_Fq6 edwards_ate_pairing(const edwards_G1& P,
+                                const edwards_G2 &Q);
+edwards_GT edwards_ate_reduced_pairing(const edwards_G1 &P,
+                                       const edwards_G2 &Q);
+
+/* choice of pairing */
+
+typedef edwards_ate_G1_precomp edwards_G1_precomp;
+typedef edwards_ate_G2_precomp edwards_G2_precomp;
+
+edwards_G1_precomp edwards_precompute_G1(const edwards_G1& P);
+edwards_G2_precomp edwards_precompute_G2(const edwards_G2& Q);
+
+edwards_Fq6 edwards_miller_loop(const edwards_G1_precomp &prec_P,
+                                const edwards_G2_precomp &prec_Q);
+
+edwards_Fq6 edwards_double_miller_loop(const edwards_G1_precomp &prec_P1,
+                                       const edwards_G2_precomp &prec_Q1,
+                                       const edwards_G1_precomp &prec_P2,
+                                       const edwards_G2_precomp &prec_Q2);
+
+edwards_Fq6 edwards_pairing(const edwards_G1& P,
+                            const edwards_G2 &Q);
+
+edwards_GT edwards_reduced_pairing(const edwards_G1 &P,
+                                   const edwards_G2 &Q);
+
+} // libff
+#endif // EDWARDS_PAIRING_HPP_
diff --git a/src/libff/libff/algebra/curves/edwards/edwards_pp.cpp b/src/libff/libff/algebra/curves/edwards/edwards_pp.cpp
new file mode 100755
index 000000000..a5516467f
--- /dev/null
+++ b/src/libff/libff/algebra/curves/edwards/edwards_pp.cpp
@@ -0,0 +1,58 @@
+/** @file
+ *****************************************************************************
+ * @author     This file is part of libff, developed by SCIPR Lab
+ *             and contributors (see AUTHORS).
+ * @copyright  MIT license (see LICENSE file)
+ *****************************************************************************/
+
+#include <libff/algebra/curves/edwards/edwards_pp.hpp>
+
+namespace libff {
+
+void edwards_pp::init_public_params()
+{
+    init_edwards_params();
+}
+
+edwards_GT edwards_pp::final_exponentiation(const edwards_Fq6 &elt)
+{
+    return edwards_final_exponentiation(elt);
+}
+
+edwards_G1_precomp edwards_pp::precompute_G1(const edwards_G1 &P)
+{
+    return edwards_precompute_G1(P);
+}
+
+edwards_G2_precomp edwards_pp::precompute_G2(const edwards_G2 &Q)
+{
+    return edwards_precompute_G2(Q);
+}
+
+edwards_Fq6 edwards_pp::miller_loop(const edwards_G1_precomp &prec_P,
+                                    const edwards_G2_precomp &prec_Q)
+{
+    return edwards_miller_loop(prec_P, prec_Q);
+}
+
+edwards_Fq6 edwards_pp::double_miller_loop(const edwards_G1_precomp &prec_P1,
+                                           const edwards_G2_precomp &prec_Q1,
+                                           const edwards_G1_precomp &prec_P2,
+                                           const edwards_G2_precomp &prec_Q2)
+{
+    return edwards_double_miller_loop(prec_P1, prec_Q1, prec_P2, prec_Q2);
+}
+
+edwards_Fq6 edwards_pp::pairing(const edwards_G1 &P,
+                                const edwards_G2 &Q)
+{
+    return edwards_pairing(P, Q);
+}
+
+edwards_Fq6 edwards_pp::reduced_pairing(const edwards_G1 &P,
+                                        const edwards_G2 &Q)
+{
+    return edwards_reduced_pairing(P, Q);
+}
+
+} // libff
diff --git a/src/libff/libff/algebra/curves/edwards/edwards_pp.hpp b/src/libff/libff/algebra/curves/edwards/edwards_pp.hpp
new file mode 100755
index 000000000..8f29a9cc9
--- /dev/null
+++ b/src/libff/libff/algebra/curves/edwards/edwards_pp.hpp
@@ -0,0 +1,50 @@
+/** @file
+ *****************************************************************************
+ * @author     This file is part of libff, developed by SCIPR Lab
+ *             and contributors (see AUTHORS).
+ * @copyright  MIT license (see LICENSE file)
+ *****************************************************************************/
+
+#ifndef EDWARDS_PP_HPP_
+#define EDWARDS_PP_HPP_
+#include <libff/algebra/curves/edwards/edwards_g1.hpp>
+#include <libff/algebra/curves/edwards/edwards_g2.hpp>
+#include <libff/algebra/curves/edwards/edwards_init.hpp>
+#include <libff/algebra/curves/edwards/edwards_pairing.hpp>
+#include <libff/algebra/curves/public_params.hpp>
+
+namespace libff {
+
+class edwards_pp {
+public:
+    typedef edwards_Fr Fp_type;
+    typedef edwards_G1 G1_type;
+    typedef edwards_G2 G2_type;
+    typedef edwards_G1_precomp G1_precomp_type;
+    typedef edwards_G2_precomp G2_precomp_type;
+    typedef edwards_Fq Fq_type;
+    typedef edwards_Fq3 Fqe_type;
+    typedef edwards_Fq6 Fqk_type;
+    typedef edwards_GT GT_type;
+
+    static const bool has_affine_pairing = false;
+
+    static void init_public_params();
+    static edwards_GT final_exponentiation(const edwards_Fq6 &elt);
+    static edwards_G1_precomp precompute_G1(const edwards_G1 &P);
+    static edwards_G2_precomp precompute_G2(const edwards_G2 &Q);
+    static edwards_Fq6 miller_loop(const edwards_G1_precomp &prec_P,
+                                   const edwards_G2_precomp &prec_Q);
+    static edwards_Fq6 double_miller_loop(const edwards_G1_precomp &prec_P1,
+                                          const edwards_G2_precomp &prec_Q1,
+                                          const edwards_G1_precomp &prec_P2,
+                                          const edwards_G2_precomp &prec_Q2);
+    /* the following are used in test files */
+    static edwards_Fq6 pairing(const edwards_G1 &P,
+                               const edwards_G2 &Q);
+    static edwards_Fq6 reduced_pairing(const edwards_G1 &P,
+                                       const edwards_G2 &Q);
+};
+
+} // libff
+#endif // EDWARDS_PP_HPP_
diff --git a/src/libff/libff/algebra/curves/mnt/mnt4/mnt4_g1.cpp b/src/libff/libff/algebra/curves/mnt/mnt4/mnt4_g1.cpp
new file mode 100755
index 000000000..ef061caa5
--- /dev/null
+++ b/src/libff/libff/algebra/curves/mnt/mnt4/mnt4_g1.cpp
@@ -0,0 +1,504 @@
+/** @file
+ *****************************************************************************
+
+ Implementation of interfaces for the MNT4 G1 group.
+
+ See mnt4_g1.hpp .
+
+ *****************************************************************************
+ * @author     This file is part of libff, developed by SCIPR Lab
+ *             and contributors (see AUTHORS).
+ * @copyright  MIT license (see LICENSE file)
+ *****************************************************************************/
+
+#include <libff/algebra/curves/mnt/mnt4/mnt4_g1.hpp>
+
+namespace libff {
+
+#ifdef PROFILE_OP_COUNTS
+long long mnt4_G1::add_cnt = 0;
+long long mnt4_G1::dbl_cnt = 0;
+#endif
+
+std::vector<size_t> mnt4_G1::wnaf_window_table;
+std::vector<size_t> mnt4_G1::fixed_base_exp_window_table;
+mnt4_G1 mnt4_G1::G1_zero;
+mnt4_G1 mnt4_G1::G1_one;
+mnt4_Fq mnt4_G1::coeff_a;
+mnt4_Fq mnt4_G1::coeff_b;
+
+mnt4_G1::mnt4_G1()
+{
+    this->X_ = G1_zero.X_;
+    this->Y_ = G1_zero.Y_;
+    this->Z_ = G1_zero.Z_;
+}
+
+void mnt4_G1::print() const
+{
+    if (this->is_zero())
+    {
+        printf("O\n");
+    }
+    else
+    {
+        mnt4_G1 copy(*this);
+        copy.to_affine_coordinates();
+        gmp_printf("(%Nd , %Nd)\n",
+                   copy.X_.as_bigint().data, mnt4_Fq::num_limbs,
+                   copy.Y_.as_bigint().data, mnt4_Fq::num_limbs);
+    }
+}
+
+void mnt4_G1::print_coordinates() const
+{
+    if (this->is_zero())
+    {
+        printf("O\n");
+    }
+    else
+    {
+        gmp_printf("(%Nd : %Nd : %Nd)\n",
+                   this->X_.as_bigint().data, mnt4_Fq::num_limbs,
+                   this->Y_.as_bigint().data, mnt4_Fq::num_limbs,
+                   this->Z_.as_bigint().data, mnt4_Fq::num_limbs);
+    }
+}
+
+void mnt4_G1::to_affine_coordinates()
+{
+    if (this->is_zero())
+    {
+        this->X_ = mnt4_Fq::zero();
+        this->Y_ = mnt4_Fq::one();
+        this->Z_ = mnt4_Fq::zero();
+    }
+    else
+    {
+        const mnt4_Fq Z_inv = Z_.inverse();
+        this->X_ = this->X_ * Z_inv;
+        this->Y_ = this->Y_ * Z_inv;
+        this->Z_ = mnt4_Fq::one();
+    }
+}
+
+void mnt4_G1::to_special()
+{
+    this->to_affine_coordinates();
+}
+
+bool mnt4_G1::is_special() const
+{
+    return (this->is_zero() || this->Z_ == mnt4_Fq::one());
+}
+
+bool mnt4_G1::is_zero() const
+{
+    return (this->X_.is_zero() && this->Z_.is_zero());
+}
+
+bool mnt4_G1::operator==(const mnt4_G1 &other) const
+{
+    if (this->is_zero())
+    {
+        return other.is_zero();
+    }
+
+    if (other.is_zero())
+    {
+        return false;
+    }
+
+    /* now neither is O */
+
+    // X1/Z1 = X2/Z2 <=> X1*Z2 = X2*Z1
+    if ((this->X_ * other.Z_) != (other.X_ * this->Z_))
+    {
+        return false;
+    }
+
+    // Y1/Z1 = Y2/Z2 <=> Y1*Z2 = Y2*Z1
+    if ((this->Y_ * other.Z_) != (other.Y_ * this->Z_))
+    {
+        return false;
+    }
+
+    return true;
+}
+
+bool mnt4_G1::operator!=(const mnt4_G1& other) const
+{
+    return !(operator==(other));
+}
+
+mnt4_G1 mnt4_G1::operator+(const mnt4_G1 &other) const
+{
+    // handle special cases having to do with O
+    if (this->is_zero())
+    {
+        return other;
+    }
+
+    if (other.is_zero())
+    {
+        return *this;
+    }
+
+    // no need to handle points of order 2,4
+    // (they cannot exist in a prime-order subgroup)
+
+    // handle double case, and then all the rest
+    /*
+      The code below is equivalent to (but faster than) the snippet below:
+
+      if (this->operator==(other))
+      {
+      return this->dbl();
+      }
+      else
+      {
+      return this->add(other);
+      }
+    */
+
+    const mnt4_Fq X1Z2 = (this->X_) * (other.Z_);        // X1Z2 = X1*Z2
+    const mnt4_Fq X2Z1 = (this->Z_) * (other.X_);        // X2Z1 = X2*Z1
+
+    // (used both in add and double checks)
+
+    const mnt4_Fq Y1Z2 = (this->Y_) * (other.Z_);        // Y1Z2 = Y1*Z2
+    const mnt4_Fq Y2Z1 = (this->Z_) * (other.Y_);        // Y2Z1 = Y2*Z1
+
+    if (X1Z2 == X2Z1 && Y1Z2 == Y2Z1)
+    {
+        // perform dbl case
+        const mnt4_Fq XX   = (this->X_).squared();                   // XX  = X1^2
+        const mnt4_Fq ZZ   = (this->Z_).squared();                   // ZZ  = Z1^2
+        const mnt4_Fq w    = mnt4_G1::coeff_a * ZZ + (XX + XX + XX); // w   = a*ZZ + 3*XX
+        const mnt4_Fq Y1Z1 = (this->Y_) * (this->Z_);
+        const mnt4_Fq s    = Y1Z1 + Y1Z1;                            // s   = 2*Y1*Z1
+        const mnt4_Fq ss   = s.squared();                            // ss  = s^2
+        const mnt4_Fq sss  = s * ss;                                 // sss = s*ss
+        const mnt4_Fq R    = (this->Y_) * s;                         // R   = Y1*s
+        const mnt4_Fq RR   = R.squared();                            // RR  = R^2
+        const mnt4_Fq B    = ((this->X_)+R).squared()-XX-RR;         // B   = (X1+R)^2 - XX - RR
+        const mnt4_Fq h    = w.squared() - (B+B);                    // h   = w^2 - 2*B
+        const mnt4_Fq X3   = h * s;                                  // X3  = h*s
+        const mnt4_Fq Y3   = w * (B-h)-(RR+RR);                      // Y3  = w*(B-h) - 2*RR
+        const mnt4_Fq Z3   = sss;                                    // Z3  = sss
+
+        return mnt4_G1(X3, Y3, Z3);
+    }
+
+    // if we have arrived here we are in the add case
+    const mnt4_Fq Z1Z2 = (this->Z_) * (other.Z_);        // Z1Z2 = Z1*Z2
+    const mnt4_Fq u    = Y2Z1 - Y1Z2; // u    = Y2*Z1-Y1Z2
+    const mnt4_Fq uu   = u.squared();                  // uu   = u^2
+    const mnt4_Fq v    = X2Z1 - X1Z2; // v    = X2*Z1-X1Z2
+    const mnt4_Fq vv   = v.squared();                  // vv   = v^2
+    const mnt4_Fq vvv  = v * vv;                       // vvv  = v*vv
+    const mnt4_Fq R    = vv * X1Z2;                    // R    = vv*X1Z2
+    const mnt4_Fq A    = uu * Z1Z2 - (vvv + R + R);    // A    = uu*Z1Z2 - vvv - 2*R
+    const mnt4_Fq X3   = v * A;                        // X3   = v*A
+    const mnt4_Fq Y3   = u * (R-A) - vvv * Y1Z2;       // Y3   = u*(R-A) - vvv*Y1Z2
+    const mnt4_Fq Z3   = vvv * Z1Z2;                   // Z3   = vvv*Z1Z2
+
+    return mnt4_G1(X3, Y3, Z3);
+}
+
+mnt4_G1 mnt4_G1::operator-() const
+{
+    return mnt4_G1(this->X_, -(this->Y_), this->Z_);
+}
+
+
+mnt4_G1 mnt4_G1::operator-(const mnt4_G1 &other) const
+{
+    return (*this) + (-other);
+}
+
+mnt4_G1 mnt4_G1::add(const mnt4_G1 &other) const
+{
+    // handle special cases having to do with O
+    if (this->is_zero())
+    {
+        return other;
+    }
+
+    if (other.is_zero())
+    {
+        return (*this);
+    }
+
+    // no need to handle points of order 2,4
+    // (they cannot exist in a prime-order subgroup)
+
+    // handle double case
+    if (this->operator==(other))
+    {
+        return this->dbl();
+    }
+
+#ifdef PROFILE_OP_COUNTS
+    this->add_cnt++;
+#endif
+    // NOTE: does not handle O and pts of order 2,4
+    // http://www.hyperelliptic.org/EFD/g1p/auto-shortw-projective.html#addition-add-1998-cmo-2
+
+    const mnt4_Fq Y1Z2 = (this->Y_) * (other.Z_);        // Y1Z2 = Y1*Z2
+    const mnt4_Fq X1Z2 = (this->X_) * (other.Z_);        // X1Z2 = X1*Z2
+    const mnt4_Fq Z1Z2 = (this->Z_) * (other.Z_);        // Z1Z2 = Z1*Z2
+    const mnt4_Fq u    = (other.Y_) * (this->Z_) - Y1Z2; // u    = Y2*Z1-Y1Z2
+    const mnt4_Fq uu   = u.squared();                    // uu   = u^2
+    const mnt4_Fq v    = (other.X_) * (this->Z_) - X1Z2; // v    = X2*Z1-X1Z2
+    const mnt4_Fq vv   = v.squared();                    // vv   = v^2
+    const mnt4_Fq vvv  = v * vv;                         // vvv  = v*vv
+    const mnt4_Fq R    = vv * X1Z2;                      // R    = vv*X1Z2
+    const mnt4_Fq A    = uu * Z1Z2 - (vvv + R + R);      // A    = uu*Z1Z2 - vvv - 2*R
+    const mnt4_Fq X3   = v * A;                          // X3   = v*A
+    const mnt4_Fq Y3   = u * (R-A) - vvv * Y1Z2;         // Y3   = u*(R-A) - vvv*Y1Z2
+    const mnt4_Fq Z3   = vvv * Z1Z2;                     // Z3   = vvv*Z1Z2
+
+    return mnt4_G1(X3, Y3, Z3);
+}
+
+mnt4_G1 mnt4_G1::mixed_add(const mnt4_G1 &other) const
+{
+#ifdef PROFILE_OP_COUNTS
+    this->add_cnt++;
+#endif
+    // NOTE: does not handle O and pts of order 2,4
+    // http://www.hyperelliptic.org/EFD/g1p/auto-shortw-projective.html#addition-add-1998-cmo-2
+    //assert(other.Z == mnt4_Fq::one());
+
+    if (this->is_zero())
+    {
+        return other;
+    }
+
+    if (other.is_zero())
+    {
+        return (*this);
+    }
+
+#ifdef DEBUG
+    assert(other.is_special());
+#endif
+
+    const mnt4_Fq &X1Z2 = (this->X_);                    // X1Z2 = X1*Z2 (but other is special and not zero)
+    const mnt4_Fq X2Z1 = (this->Z_) * (other.X_);        // X2Z1 = X2*Z1
+
+    // (used both in add and double checks)
+
+    const mnt4_Fq &Y1Z2 = (this->Y_);                    // Y1Z2 = Y1*Z2 (but other is special and not zero)
+    const mnt4_Fq Y2Z1 = (this->Z_) * (other.Y_);        // Y2Z1 = Y2*Z1
+
+    if (X1Z2 == X2Z1 && Y1Z2 == Y2Z1)
+    {
+        return this->dbl();
+    }
+
+    const mnt4_Fq u = Y2Z1 - this->Y_;              // u = Y2*Z1-Y1
+    const mnt4_Fq uu = u.squared();                 // uu = u2
+    const mnt4_Fq v = X2Z1 - this->X_;              // v = X2*Z1-X1
+    const mnt4_Fq vv = v.squared();                 // vv = v2
+    const mnt4_Fq vvv = v*vv;                       // vvv = v*vv
+    const mnt4_Fq R = vv * this->X_;                // R = vv*X1
+    const mnt4_Fq A = uu * this->Z_ - vvv - R - R;  // A = uu*Z1-vvv-2*R
+    const mnt4_Fq X3 = v * A;                       // X3 = v*A
+    const mnt4_Fq Y3 = u*(R-A) - vvv * this->Y_;    // Y3 = u*(R-A)-vvv*Y1
+    const mnt4_Fq Z3 = vvv * this->Z_;              // Z3 = vvv*Z1
+
+    return mnt4_G1(X3, Y3, Z3);
+}
+
+mnt4_G1 mnt4_G1::dbl() const
+{
+#ifdef PROFILE_OP_COUNTS
+    this->dbl_cnt++;
+#endif
+    if (this->is_zero())
+    {
+        return (*this);
+    }
+    else
+    {
+        // NOTE: does not handle O and pts of order 2,4
+        // http://www.hyperelliptic.org/EFD/g1p/auto-shortw-projective.html#doubling-dbl-2007-bl
+
+        const mnt4_Fq XX   = (this->X_).squared();                   // XX  = X1^2
+        const mnt4_Fq ZZ   = (this->Z_).squared();                   // ZZ  = Z1^2
+        const mnt4_Fq w    = mnt4_G1::coeff_a * ZZ + (XX + XX + XX); // w   = a*ZZ + 3*XX
+        const mnt4_Fq Y1Z1 = (this->Y_) * (this->Z_);
+        const mnt4_Fq s    = Y1Z1 + Y1Z1;                            // s   = 2*Y1*Z1
+        const mnt4_Fq ss   = s.squared();                            // ss  = s^2
+        const mnt4_Fq sss  = s * ss;                                 // sss = s*ss
+        const mnt4_Fq R    = (this->Y_) * s;                         // R   = Y1*s
+        const mnt4_Fq RR   = R.squared();                            // RR  = R^2
+        const mnt4_Fq B    = ((this->X_)+R).squared()-XX-RR;         // B   = (X1+R)^2 - XX - RR
+        const mnt4_Fq h    = w.squared() - (B+B);                    // h   = w^2 - 2*B
+        const mnt4_Fq X3   = h * s;                                  // X3  = h*s
+        const mnt4_Fq Y3   = w * (B-h)-(RR+RR);                      // Y3  = w*(B-h) - 2*RR
+        const mnt4_Fq Z3   = sss;                                    // Z3  = sss
+
+        return mnt4_G1(X3, Y3, Z3);
+    }
+}
+
+bool mnt4_G1::is_well_formed() const
+{
+    if (this->is_zero())
+    {
+        return true;
+    }
+    else
+    {
+        /*
+          y^2 = x^3 + ax + b
+
+          We are using projective, so equation we need to check is actually
+
+          (y/z)^2 = (x/z)^3 + a (x/z) + b
+          z y^2 = x^3  + a z^2 x + b z^3
+
+          z (y^2 - b z^2) = x ( x^2 + a z^2)
+        */
+        const mnt4_Fq X2 = this->X_.squared();
+        const mnt4_Fq Y2 = this->Y_.squared();
+        const mnt4_Fq Z2 = this->Z_.squared();
+
+        return (this->Z_ * (Y2 - mnt4_G1::coeff_b * Z2) == this->X_ * (X2 + mnt4_G1::coeff_a * Z2));
+    }
+}
+
+mnt4_G1 mnt4_G1::zero()
+{
+    return G1_zero;
+}
+
+mnt4_G1 mnt4_G1::one()
+{
+    return G1_one;
+}
+
+mnt4_G1 mnt4_G1::random_element()
+{
+    return (scalar_field::random_element().as_bigint()) * G1_one;
+}
+
+std::ostream& operator<<(std::ostream &out, const mnt4_G1 &g)
+{
+    mnt4_G1 copy(g);
+    copy.to_affine_coordinates();
+
+    out << (copy.is_zero() ? 1 : 0) << OUTPUT_SEPARATOR;
+#ifdef NO_PT_COMPRESSION
+    out << copy.X_ << OUTPUT_SEPARATOR << copy.Y_;
+#else
+    /* storing LSB of Y */
+    out << copy.X_ << OUTPUT_SEPARATOR << (copy.Y_.as_bigint().data[0] & 1);
+#endif
+
+    return out;
+}
+
+std::istream& operator>>(std::istream &in, mnt4_G1 &g)
+{
+    char is_zero;
+    mnt4_Fq tX, tY;
+
+#ifdef NO_PT_COMPRESSION
+    in >> is_zero >> tX >> tY;
+    is_zero -= '0';
+#else
+    in.read((char*)&is_zero, 1);
+    is_zero -= '0';
+    consume_OUTPUT_SEPARATOR(in);
+
+    unsigned char Y_lsb;
+    in >> tX;
+    consume_OUTPUT_SEPARATOR(in);
+    in.read((char*)&Y_lsb, 1);
+    Y_lsb -= '0';
+
+    // y = +/- sqrt(x^3 + a*x + b)
+    if (!is_zero)
+    {
+        mnt4_Fq tX2 = tX.squared();
+        mnt4_Fq tY2 = (tX2 + mnt4_G1::coeff_a) * tX + mnt4_G1::coeff_b;
+        tY = tY2.sqrt();
+
+        if ((tY.as_bigint().data[0] & 1) != Y_lsb)
+        {
+            tY = -tY;
+        }
+    }
+#endif
+    // using projective coordinates
+    if (!is_zero)
+    {
+        g.X_ = tX;
+        g.Y_ = tY;
+        g.Z_ = mnt4_Fq::one();
+    }
+    else
+    {
+        g = mnt4_G1::zero();
+    }
+
+    return in;
+}
+
+std::ostream& operator<<(std::ostream& out, const std::vector<mnt4_G1> &v)
+{
+    out << v.size() << "\n";
+    for (const mnt4_G1& t : v)
+    {
+        out << t << OUTPUT_NEWLINE;
+    }
+
+    return out;
+}
+
+std::istream& operator>>(std::istream& in, std::vector<mnt4_G1> &v)
+{
+    v.clear();
+
+    size_t s;
+    in >> s;
+
+    consume_newline(in);
+
+    v.reserve(s);
+
+    for (size_t i = 0; i < s; ++i)
+    {
+        mnt4_G1 g;
+        in >> g;
+        consume_OUTPUT_NEWLINE(in);
+        v.emplace_back(g);
+    }
+
+    return in;
+}
+
+void mnt4_G1::batch_to_special_all_non_zeros(std::vector<mnt4_G1> &vec)
+{
+    std::vector<mnt4_Fq> Z_vec;
+    Z_vec.reserve(vec.size());
+
+    for (auto &el: vec)
+    {
+        Z_vec.emplace_back(el.Z());
+    }
+    batch_invert<mnt4_Fq>(Z_vec);
+
+    const mnt4_Fq one = mnt4_Fq::one();
+
+    for (size_t i = 0; i < vec.size(); ++i)
+    {
+        vec[i] = mnt4_G1(vec[i].X() * Z_vec[i], vec[i].Y() * Z_vec[i], one);
+    }
+}
+
+} // libff
diff --git a/src/libff/libff/algebra/curves/mnt/mnt4/mnt4_g1.hpp b/src/libff/libff/algebra/curves/mnt/mnt4/mnt4_g1.hpp
new file mode 100755
index 000000000..a4dfc7e76
--- /dev/null
+++ b/src/libff/libff/algebra/curves/mnt/mnt4/mnt4_g1.hpp
@@ -0,0 +1,106 @@
+/** @file
+ *****************************************************************************
+
+ Declaration of interfaces for the MNT4 G1 group.
+
+ *****************************************************************************
+ * @author     This file is part of libff, developed by SCIPR Lab
+ *             and contributors (see AUTHORS).
+ * @copyright  MIT license (see LICENSE file)
+ *****************************************************************************/
+
+#ifndef MNT4_G1_HPP_
+#define MNT4_G1_HPP_
+
+#include <vector>
+
+#include <libff/algebra/curves/curve_utils.hpp>
+#include <libff/algebra/curves/mnt/mnt4/mnt4_init.hpp>
+
+namespace libff {
+
+class mnt4_G1;
+std::ostream& operator<<(std::ostream &, const mnt4_G1&);
+std::istream& operator>>(std::istream &, mnt4_G1&);
+
+class mnt4_G1 {
+private:
+    mnt4_Fq X_, Y_, Z_;
+public:
+#ifdef PROFILE_OP_COUNTS
+    static long long add_cnt;
+    static long long dbl_cnt;
+#endif
+    static std::vector<size_t> wnaf_window_table;
+    static std::vector<size_t> fixed_base_exp_window_table;
+    static mnt4_G1 G1_zero;
+    static mnt4_G1 G1_one;
+    static mnt4_Fq coeff_a;
+    static mnt4_Fq coeff_b;
+
+    typedef mnt4_Fq base_field;
+    typedef mnt4_Fr scalar_field;
+
+    // using projective coordinates
+    mnt4_G1();
+    mnt4_G1(const mnt4_Fq& X, const mnt4_Fq& Y) : X_(X), Y_(Y), Z_(base_field::one()) {}
+    mnt4_G1(const mnt4_Fq& X, const mnt4_Fq& Y, const mnt4_Fq& Z) : X_(X), Y_(Y), Z_(Z) {}
+
+    mnt4_Fq X() const { return X_; }
+    mnt4_Fq Y() const { return Y_; }
+    mnt4_Fq Z() const { return Z_; }
+
+    void print() const;
+    void print_coordinates() const;
+
+    void to_affine_coordinates();
+    void to_special();
+    bool is_special() const;
+
+    bool is_zero() const;
+
+    bool operator==(const mnt4_G1 &other) const;
+    bool operator!=(const mnt4_G1 &other) const;
+
+    mnt4_G1 operator+(const mnt4_G1 &other) const;
+    mnt4_G1 operator-() const;
+    mnt4_G1 operator-(const mnt4_G1 &other) const;
+
+    mnt4_G1 add(const mnt4_G1 &other) const;
+    mnt4_G1 mixed_add(const mnt4_G1 &other) const;
+    mnt4_G1 dbl() const;
+
+    bool is_well_formed() const;
+
+    static mnt4_G1 zero();
+    static mnt4_G1 one();
+    static mnt4_G1 random_element();
+
+    static size_t size_in_bits() { return mnt4_Fq::size_in_bits() + 1; }
+    static bigint<mnt4_Fq::num_limbs> base_field_char() { return mnt4_Fq::field_char(); }
+    static bigint<mnt4_Fr::num_limbs> order() { return mnt4_Fr::field_char(); }
+
+    friend std::ostream& operator<<(std::ostream &out, const mnt4_G1 &g);
+    friend std::istream& operator>>(std::istream &in, mnt4_G1 &g);
+
+    static void batch_to_special_all_non_zeros(std::vector<mnt4_G1> &vec);
+};
+
+template<mp_size_t m>
+mnt4_G1 operator*(const bigint<m> &lhs, const mnt4_G1 &rhs)
+{
+    return scalar_mul<mnt4_G1, m>(rhs, lhs);
+}
+
+template<mp_size_t m, const bigint<m>& modulus_p>
+mnt4_G1 operator*(const Fp_model<m,modulus_p> &lhs, const mnt4_G1 &rhs)
+{
+    return scalar_mul<mnt4_G1, m>(rhs, lhs.as_bigint());
+}
+
+std::ostream& operator<<(std::ostream& out, const std::vector<mnt4_G1> &v);
+std::istream& operator>>(std::istream& in, std::vector<mnt4_G1> &v);
+
+} // libff
+
+#endif // MNT4_G1_HPP_
diff --git a/src/libff/libff/algebra/curves/mnt/mnt4/mnt4_g2.cpp b/src/libff/libff/algebra/curves/mnt/mnt4/mnt4_g2.cpp
new file mode 100755
index 000000000..757bba378
--- /dev/null
+++ b/src/libff/libff/algebra/curves/mnt/mnt4/mnt4_g2.cpp
@@ -0,0 +1,495 @@
+/** @file
+ *****************************************************************************
+
+ Implementation of interfaces for the MNT4 G2 group.
+
+ See mnt4_g2.hpp .
+
+ *****************************************************************************
+ * @author     This file is part of libff, developed by SCIPR Lab
+ *             and contributors (see AUTHORS).
+ * @copyright  MIT license (see LICENSE file)
+ *****************************************************************************/
+
+#include <libff/algebra/curves/mnt/mnt4/mnt4_g2.hpp>
+
+namespace libff {
+
+#ifdef PROFILE_OP_COUNTS
+long long mnt4_G2::add_cnt = 0;
+long long mnt4_G2::dbl_cnt = 0;
+#endif
+
+std::vector<size_t> mnt4_G2::wnaf_window_table;
+std::vector<size_t> mnt4_G2::fixed_base_exp_window_table;
+mnt4_Fq2 mnt4_G2::twist;
+mnt4_Fq2 mnt4_G2::coeff_a;
+mnt4_Fq2 mnt4_G2::coeff_b;
+mnt4_G2 mnt4_G2::G2_zero;
+mnt4_G2 mnt4_G2::G2_one;
+
+mnt4_Fq2 mnt4_G2::mul_by_a(const mnt4_Fq2 &elt)
+{
+    return mnt4_Fq2(mnt4_twist_mul_by_a_c0 * elt.c0, mnt4_twist_mul_by_a_c1 * elt.c1);
+}
+
+mnt4_Fq2 mnt4_G2::mul_by_b(const mnt4_Fq2 &elt)
+{
+    return mnt4_Fq2(mnt4_twist_mul_by_b_c0 * elt.c1, mnt4_twist_mul_by_b_c1 * elt.c0);
+}
+
+mnt4_G2::mnt4_G2()
+{
+    this->X_ = G2_zero.X_;
+    this->Y_ = G2_zero.Y_;
+    this->Z_ = G2_zero.Z_;
+}
+
+void mnt4_G2::print() const
+{
+    if (this->is_zero())
+    {
+        printf("O\n");
+    }
+    else
+    {
+        mnt4_G2 copy(*this);
+        copy.to_affine_coordinates();
+        gmp_printf("(%Nd*z + %Nd , %Nd*z + %Nd)\n",
+                   copy.X_.c1.as_bigint().data, mnt4_Fq::num_limbs,
+                   copy.X_.c0.as_bigint().data, mnt4_Fq::num_limbs,
+                   copy.Y_.c1.as_bigint().data, mnt4_Fq::num_limbs,
+                   copy.Y_.c0.as_bigint().data, mnt4_Fq::num_limbs);
+    }
+}
+
+void mnt4_G2::print_coordinates() const
+{
+    if (this->is_zero())
+    {
+        printf("O\n");
+    }
+    else
+    {
+        gmp_printf("(%Nd*z + %Nd : %Nd*z + %Nd : %Nd*z + %Nd)\n",
+                   this->X_.c1.as_bigint().data, mnt4_Fq::num_limbs,
+                   this->X_.c0.as_bigint().data, mnt4_Fq::num_limbs,
+                   this->Y_.c1.as_bigint().data, mnt4_Fq::num_limbs,
+                   this->Y_.c0.as_bigint().data, mnt4_Fq::num_limbs,
+                   this->Z_.c1.as_bigint().data, mnt4_Fq::num_limbs,
+                   this->Z_.c0.as_bigint().data, mnt4_Fq::num_limbs);
+    }
+}
+
+void mnt4_G2::to_affine_coordinates()
+{
+    if (this->is_zero())
+    {
+        this->X_ = mnt4_Fq2::zero();
+        this->Y_ = mnt4_Fq2::one();
+        this->Z_ = mnt4_Fq2::zero();
+    }
+    else
+    {
+        const mnt4_Fq2 Z_inv = Z_.inverse();
+        X_ = X_ * Z_inv;
+        Y_ = Y_ * Z_inv;
+        Z_ = mnt4_Fq2::one();
+    }
+}
+
+void mnt4_G2::to_special()
+{
+    this->to_affine_coordinates();
+}
+
+bool mnt4_G2::is_special() const
+{
+    return (this->is_zero() || this->Z_ == mnt4_Fq2::one());
+}
+
+bool mnt4_G2::is_zero() const
+{
+    return (this->X_.is_zero() && this->Z_.is_zero());
+}
+
+bool mnt4_G2::operator==(const mnt4_G2 &other) const
+{
+    if (this->is_zero())
+    {
+        return other.is_zero();
+    }
+
+    if (other.is_zero())
+    {
+        return false;
+    }
+
+    /* now neither is O */
+
+    // X1/Z1 = X2/Z2 <=> X1*Z2 = X2*Z1
+    if ((this->X_ * other.Z_) != (other.X_ * this->Z_))
+    {
+        return false;
+    }
+
+    // Y1/Z1 = Y2/Z2 <=> Y1*Z2 = Y2*Z1
+    if ((this->Y_ * other.Z_) != (other.Y_ * this->Z_))
+    {
+        return false;
+    }
+
+    return true;
+}
+
+bool mnt4_G2::operator!=(const mnt4_G2& other) const
+{
+    return !(operator==(other));
+}
+
+mnt4_G2 mnt4_G2::operator+(const mnt4_G2 &other) const
+{
+    // handle special cases having to do with O
+    if (this->is_zero())
+    {
+        return other;
+    }
+
+    if (other.is_zero())
+    {
+        return *this;
+    }
+
+    // no need to handle points of order 2,4
+    // (they cannot exist in a prime-order subgroup)
+
+    // handle double case, and then all the rest
+    /*
+      The code below is equivalent to (but faster than) the snippet below:
+
+      if (this->operator==(other))
+      {
+      return this->dbl();
+      }
+      else
+      {
+      return this->add(other);
+      }
+    */
+
+    const mnt4_Fq2 X1Z2 = (this->X_) * (other.Z_);        // X1Z2 = X1*Z2
+    const mnt4_Fq2 X2Z1 = (this->Z_) * (other.X_);        // X2Z1 = X2*Z1
+
+    // (used both in add and double checks)
+
+    const mnt4_Fq2 Y1Z2 = (this->Y_) * (other.Z_);        // Y1Z2 = Y1*Z2
+    const mnt4_Fq2 Y2Z1 = (this->Z_) * (other.Y_);        // Y2Z1 = Y2*Z1
+
+    if (X1Z2 == X2Z1 && Y1Z2 == Y2Z1)
+    {
+        // perform dbl case
+        const mnt4_Fq2 XX   = (this->X_).squared();                   // XX  = X1^2
+        const mnt4_Fq2 ZZ   = (this->Z_).squared();                   // ZZ  = Z1^2
+        const mnt4_Fq2 w    = mnt4_G2::mul_by_a(ZZ) + (XX + XX + XX); // w   = a*ZZ + 3*XX
+        const mnt4_Fq2 Y1Z1 = (this->Y_) * (this->Z_);
+        const mnt4_Fq2 s    = Y1Z1 + Y1Z1;                            // s   = 2*Y1*Z1
+        const mnt4_Fq2 ss   = s.squared();                            // ss  = s^2
+        const mnt4_Fq2 sss  = s * ss;                                 // sss = s*ss
+        const mnt4_Fq2 R    = (this->Y_) * s;                         // R   = Y1*s
+        const mnt4_Fq2 RR   = R.squared();                            // RR  = R^2
+        const mnt4_Fq2 B    = ((this->X_)+R).squared()-XX-RR;         // B   = (X1+R)^2 - XX - RR
+        const mnt4_Fq2 h    = w.squared() - (B+B);                    // h   = w^2 - 2*B
+        const mnt4_Fq2 X3   = h * s;                                  // X3  = h*s
+        const mnt4_Fq2 Y3   = w * (B-h)-(RR+RR);                      // Y3  = w*(B-h) - 2*RR
+        const mnt4_Fq2 Z3   = sss;                                    // Z3  = sss
+
+        return mnt4_G2(X3, Y3, Z3);
+    }
+
+    // if we have arrived here we are in the add case
+    const mnt4_Fq2 Z1Z2 = (this->Z_) * (other.Z_);      // Z1Z2 = Z1*Z2
+    const mnt4_Fq2 u    = Y2Z1 - Y1Z2;                  // u    = Y2*Z1-Y1Z2
+    const mnt4_Fq2 uu   = u.squared();                  // uu   = u^2
+    const mnt4_Fq2 v    = X2Z1 - X1Z2;                  // v    = X2*Z1-X1Z2
+    const mnt4_Fq2 vv   = v.squared();                  // vv   = v^2
+    const mnt4_Fq2 vvv  = v * vv;                       // vvv  = v*vv
+    const mnt4_Fq2 R    = vv * X1Z2;                    // R    = vv*X1Z2
+    const mnt4_Fq2 A    = uu * Z1Z2 - (vvv + R + R);    // A    = uu*Z1Z2 - vvv - 2*R
+    const mnt4_Fq2 X3   = v * A;                        // X3   = v*A
+    const mnt4_Fq2 Y3   = u * (R-A) - vvv * Y1Z2;       // Y3   = u*(R-A) - vvv*Y1Z2
+    const mnt4_Fq2 Z3   = vvv * Z1Z2;                   // Z3   = vvv*Z1Z2
+
+    return mnt4_G2(X3, Y3, Z3);
+}
+
+mnt4_G2 mnt4_G2::operator-() const
+{
+    return mnt4_G2(this->X_, -(this->Y_), this->Z_);
+}
+
+
+mnt4_G2 mnt4_G2::operator-(const mnt4_G2 &other) const
+{
+    return (*this) + (-other);
+}
+
+mnt4_G2 mnt4_G2::add(const mnt4_G2 &other) const
+{
+    // handle special cases having to do with O
+    if (this->is_zero())
+    {
+        return other;
+    }
+
+    if (other.is_zero())
+    {
+        return (*this);
+    }
+
+    // no need to handle points of order 2,4
+    // (they cannot exist in a prime-order subgroup)
+
+    // handle double case
+    if (this->operator==(other))
+    {
+        return this->dbl();
+    }
+
+#ifdef PROFILE_OP_COUNTS
+    this->add_cnt++;
+#endif
+    // NOTE: does not handle O and pts of order 2,4
+    // http://www.hyperelliptic.org/EFD/g1p/auto-shortw-projective.html#addition-add-1998-cmo-2
+
+    const mnt4_Fq2 Y1Z2 = (this->Y_) * (other.Z_);        // Y1Z2 = Y1*Z2
+    const mnt4_Fq2 X1Z2 = (this->X_) * (other.Z_);        // X1Z2 = X1*Z2
+    const mnt4_Fq2 Z1Z2 = (this->Z_) * (other.Z_);        // Z1Z2 = Z1*Z2
+    const mnt4_Fq2 u    = (other.Y_) * (this->Z_) - Y1Z2; // u    = Y2*Z1-Y1Z2
+    const mnt4_Fq2 uu   = u.squared();                    // uu   = u^2
+    const mnt4_Fq2 v    = (other.X_) * (this->Z_) - X1Z2; // v    = X2*Z1-X1Z2
+    const mnt4_Fq2 vv   = v.squared();                    // vv   = v^2
+    const mnt4_Fq2 vvv  = v * vv;                         // vvv  = v*vv
+    const mnt4_Fq2 R    = vv * X1Z2;                      // R    = vv*X1Z2
+    const mnt4_Fq2 A    = uu * Z1Z2 - (vvv + R + R);      // A    = uu*Z1Z2 - vvv - 2*R
+    const mnt4_Fq2 X3   = v * A;                          // X3   = v*A
+    const mnt4_Fq2 Y3   = u * (R-A) - vvv * Y1Z2;         // Y3   = u*(R-A) - vvv*Y1Z2
+    const mnt4_Fq2 Z3   = vvv * Z1Z2;                     // Z3   = vvv*Z1Z2
+
+    return mnt4_G2(X3, Y3, Z3);
+}
+
+mnt4_G2 mnt4_G2::mixed_add(const mnt4_G2 &other) const
+{
+#ifdef PROFILE_OP_COUNTS
+    this->add_cnt++;
+#endif
+    // NOTE: does not handle O and pts of order 2,4
+    // http://www.hyperelliptic.org/EFD/g1p/auto-shortw-projective.html#addition-add-1998-cmo-2
+    //assert(other.Z == mnt4_Fq2::one());
+
+    if (this->is_zero())
+    {
+        return other;
+    }
+
+    if (other.is_zero())
+    {
+        return (*this);
+    }
+
+#ifdef DEBUG
+    assert(other.is_special());
+#endif
+
+    const mnt4_Fq2 &X1Z2 = (this->X_);                   // X1Z2 = X1*Z2 (but other is special and not zero)
+    const mnt4_Fq2 X2Z1 = (this->Z_) * (other.X_);       // X2Z1 = X2*Z1
+
+    // (used both in add and double checks)
+
+    const mnt4_Fq2 &Y1Z2 = (this->Y_);                   // Y1Z2 = Y1*Z2 (but other is special and not zero)
+    const mnt4_Fq2 Y2Z1 = (this->Z_) * (other.Y_);       // Y2Z1 = Y2*Z1
+
+    if (X1Z2 == X2Z1 && Y1Z2 == Y2Z1)
+    {
+        return this->dbl();
+    }
+
+    const mnt4_Fq2 u = Y2Z1 - this->Y_;              // u = Y2*Z1-Y1
+    const mnt4_Fq2 uu = u.squared();                 // uu = u2
+    const mnt4_Fq2 v = X2Z1 - this->X_;              // v = X2*Z1-X1
+    const mnt4_Fq2 vv = v.squared();                 // vv = v2
+    const mnt4_Fq2 vvv = v*vv;                       // vvv = v*vv
+    const mnt4_Fq2 R = vv * this->X_;                // R = vv*X1
+    const mnt4_Fq2 A = uu * this->Z_ - vvv - R - R;  // A = uu*Z1-vvv-2*R
+    const mnt4_Fq2 X3 = v * A;                       // X3 = v*A
+    const mnt4_Fq2 Y3 = u*(R-A) - vvv * this->Y_;    // Y3 = u*(R-A)-vvv*Y1
+    const mnt4_Fq2 Z3 = vvv * this->Z_;              // Z3 = vvv*Z1
+
+    return mnt4_G2(X3, Y3, Z3);
+}
+
+mnt4_G2 mnt4_G2::dbl() const
+{
+#ifdef PROFILE_OP_COUNTS
+    this->dbl_cnt++;
+#endif
+    if (this->is_zero())
+    {
+        return (*this);
+    }
+    else
+    {
+        // NOTE: does not handle O and pts of order 2,4
+        // http://www.hyperelliptic.org/EFD/g1p/auto-shortw-projective.html#doubling-dbl-2007-bl
+
+        const mnt4_Fq2 XX   = (this->X_).squared();                     // XX  = X1^2
+        const mnt4_Fq2 ZZ   = (this->Z_).squared();                     // ZZ  = Z1^2
+        const mnt4_Fq2 w    = mnt4_G2::mul_by_a(ZZ) + (XX + XX + XX);   // w   = a*ZZ + 3*XX
+        const mnt4_Fq2 Y1Z1 = (this->Y_) * (this->Z_);
+        const mnt4_Fq2 s    = Y1Z1 + Y1Z1;                              // s   = 2*Y1*Z1
+        const mnt4_Fq2 ss   = s.squared();                              // ss  = s^2
+        const mnt4_Fq2 sss  = s * ss;                                   // sss = s*ss
+        const mnt4_Fq2 R    = (this->Y_) * s;                           // R   = Y1*s
+        const mnt4_Fq2 RR   = R.squared();                              // RR  = R^2
+        const mnt4_Fq2 B    = ((this->X_)+R).squared()-XX-RR;           // B   = (X1+R)^2 - XX - RR
+        const mnt4_Fq2 h    = w.squared() - (B+B);                      // h   = w^2-2*B
+        const mnt4_Fq2 X3   = h * s;                                    // X3  = h*s
+        const mnt4_Fq2 Y3   = w * (B-h)-(RR+RR);                        // Y3  = w*(B-h) - 2*RR
+        const mnt4_Fq2 Z3   = sss;                                      // Z3  = sss
+
+        return mnt4_G2(X3, Y3, Z3);
+    }
+}
+
+mnt4_G2 mnt4_G2::mul_by_q() const
+{
+    return mnt4_G2(mnt4_twist_mul_by_q_X * (this->X_).Frobenius_map(1),
+                   mnt4_twist_mul_by_q_Y * (this->Y_).Frobenius_map(1),
+                   (this->Z_).Frobenius_map(1));
+}
+
+bool mnt4_G2::is_well_formed() const
+{
+    if (this->is_zero())
+    {
+        return true;
+    }
+    else
+    {
+        /*
+          y^2 = x^3 + ax + b
+
+          We are using projective, so equation we need to check is actually
+
+          (y/z)^2 = (x/z)^3 + a (x/z) + b
+          z y^2 = x^3  + a z^2 x + b z^3
+
+          z (y^2 - b z^2) = x ( x^2 + a z^2)
+        */
+        const mnt4_Fq2 X2 = this->X_.squared();
+        const mnt4_Fq2 Y2 = this->Y_.squared();
+        const mnt4_Fq2 Z2 = this->Z_.squared();
+        const mnt4_Fq2 aZ2 =  mnt4_twist_coeff_a * Z2;
+
+        return (this->Z_ * (Y2 - mnt4_twist_coeff_b * Z2) == this->X_ * (X2 + aZ2));
+    }
+}
+
+mnt4_G2 mnt4_G2::zero()
+{
+    return G2_zero;
+}
+
+mnt4_G2 mnt4_G2::one()
+{
+    return G2_one;
+}
+
+mnt4_G2 mnt4_G2::random_element()
+{
+    return (mnt4_Fr::random_element().as_bigint()) * G2_one;
+}
+
+std::ostream& operator<<(std::ostream &out, const mnt4_G2 &g)
+{
+    mnt4_G2 copy(g);
+    copy.to_affine_coordinates();
+
+    out << (copy.is_zero() ? 1 : 0) << OUTPUT_SEPARATOR;
+#ifdef NO_PT_COMPRESSION
+    out << copy.X_ << OUTPUT_SEPARATOR << copy.Y_;
+#else
+    /* storing LSB of Y */
+    out << copy.X_ << OUTPUT_SEPARATOR << (copy.Y_.c0.as_bigint().data[0] & 1);
+#endif
+
+    return out;
+}
+
+std::istream& operator>>(std::istream &in, mnt4_G2 &g)
+{
+    char is_zero;
+    mnt4_Fq2 tX, tY;
+
+#ifdef NO_PT_COMPRESSION
+    in >> is_zero >> tX >> tY;
+    is_zero -= '0';
+#else
+    in.read((char*)&is_zero, 1); // this reads is_zero;
+    is_zero -= '0';
+    consume_OUTPUT_SEPARATOR(in);
+
+    unsigned char Y_lsb;
+    in >> tX;
+    consume_OUTPUT_SEPARATOR(in);
+    in.read((char*)&Y_lsb, 1);
+    Y_lsb -= '0';
+
+    // y = +/- sqrt(x^3 + a*x + b)
+    if (!is_zero)
+    {
+        mnt4_Fq2 tX2 = tX.squared();
+        mnt4_Fq2 tY2 = (tX2 + mnt4_twist_coeff_a ) * tX + mnt4_twist_coeff_b;
+        tY = tY2.sqrt();
+
+        if ((tY.c0.as_bigint().data[0] & 1) != Y_lsb)
+        {
+            tY = -tY;
+        }
+    }
+#endif
+    // using projective coordinates
+    if (!is_zero)
+    {
+        g.X_ = tX;
+        g.Y_ = tY;
+        g.Z_ = mnt4_Fq2::one();
+    }
+    else
+    {
+        g = mnt4_G2::zero();
+    }
+
+    return in;
+}
+
+void mnt4_G2::batch_to_special_all_non_zeros(std::vector<mnt4_G2> &vec)
+{
+    std::vector<mnt4_Fq2> Z_vec;
+    Z_vec.reserve(vec.size());
+
+    for (auto &el: vec)
+    {
+        Z_vec.emplace_back(el.Z());
+    }
+    batch_invert<mnt4_Fq2>(Z_vec);
+
+    const mnt4_Fq2 one = mnt4_Fq2::one();
+
+    for (size_t i = 0; i < vec.size(); ++i)
+    {
+        vec[i] = mnt4_G2(vec[i].X() * Z_vec[i], vec[i].Y() * Z_vec[i], one);
+    }
+}
+
+} // libff
diff --git a/src/libff/libff/algebra/curves/mnt/mnt4/mnt4_g2.hpp b/src/libff/libff/algebra/curves/mnt/mnt4/mnt4_g2.hpp
new file mode 100755
index 000000000..9d403214b
--- /dev/null
+++ b/src/libff/libff/algebra/curves/mnt/mnt4/mnt4_g2.hpp
@@ -0,0 +1,108 @@
+/** @file
+ *****************************************************************************
+
+ Declaration of interfaces for the MNT4 G2 group.
+
+ *****************************************************************************
+ * @author     This file is part of libff, developed by SCIPR Lab
+ *             and contributors (see AUTHORS).
+ * @copyright  MIT license (see LICENSE file)
+ *****************************************************************************/
+
+#ifndef MNT4_G2_HPP_
+#define MNT4_G2_HPP_
+
+#include <vector>
+
+#include <libff/algebra/curves/curve_utils.hpp>
+#include <libff/algebra/curves/mnt/mnt4/mnt4_init.hpp>
+
+namespace libff {
+
+class mnt4_G2;
+std::ostream& operator<<(std::ostream &, const mnt4_G2&);
+std::istream& operator>>(std::istream &, mnt4_G2&);
+
+class mnt4_G2 {
+private:
+    mnt4_Fq2 X_, Y_, Z_;
+public:
+#ifdef PROFILE_OP_COUNTS
+    static long long add_cnt;
+    static long long dbl_cnt;
+#endif
+    static std::vector<size_t> wnaf_window_table;
+    static std::vector<size_t> fixed_base_exp_window_table;
+    static mnt4_G2 G2_zero;
+    static mnt4_G2 G2_one;
+    static mnt4_Fq2 twist;
+    static mnt4_Fq2 coeff_a;
+    static mnt4_Fq2 coeff_b;
+
+    typedef mnt4_Fq base_field;
+    typedef mnt4_Fq2 twist_field;
+    typedef mnt4_Fr scalar_field;
+
+    // using projective coordinates
+    mnt4_G2();
+    mnt4_G2(const mnt4_Fq2& X, const mnt4_Fq2& Y, const mnt4_Fq2& Z) : X_(X), Y_(Y), Z_(Z) {};
+
+    mnt4_Fq2 X() const { return X_; }
+    mnt4_Fq2 Y() const { return Y_; }
+    mnt4_Fq2 Z() const { return Z_; }
+
+    static mnt4_Fq2 mul_by_a(const mnt4_Fq2 &elt);
+    static mnt4_Fq2 mul_by_b(const mnt4_Fq2 &elt);
+
+    void print() const;
+    void print_coordinates() const;
+
+    void to_affine_coordinates();
+    void to_special();
+    bool is_special() const;
+
+    bool is_zero() const;
+
+    bool operator==(const mnt4_G2 &other) const;
+    bool operator!=(const mnt4_G2 &other) const;
+
+    mnt4_G2 operator+(const mnt4_G2 &other) const;
+    mnt4_G2 operator-() const;
+    mnt4_G2 operator-(const mnt4_G2 &other) const;
+
+    mnt4_G2 add(const mnt4_G2 &other) const;
+    mnt4_G2 mixed_add(const mnt4_G2 &other) const;
+    mnt4_G2 dbl() const;
+    mnt4_G2 mul_by_q() const;
+
+    bool is_well_formed() const;
+
+    static mnt4_G2 zero();
+    static mnt4_G2 one();
+    static mnt4_G2 random_element();
+
+    static size_t size_in_bits() { return mnt4_Fq2::size_in_bits() + 1; }
+    static bigint<mnt4_Fq::num_limbs> base_field_char() { return mnt4_Fq::field_char(); }
+    static bigint<mnt4_Fr::num_limbs> order() { return mnt4_Fr::field_char(); }
+
+    friend std::ostream& operator<<(std::ostream &out, const mnt4_G2 &g);
+    friend std::istream& operator>>(std::istream &in, mnt4_G2 &g);
+
+    static void batch_to_special_all_non_zeros(std::vector<mnt4_G2> &vec);
+};
+
+template<mp_size_t m>
+mnt4_G2 operator*(const bigint<m> &lhs, const mnt4_G2 &rhs)
+{
+    return scalar_mul<mnt4_G2, m>(rhs, lhs);
+}
+
+template<mp_size_t m, const bigint<m>& modulus_p>
+mnt4_G2 operator*(const Fp_model<m,modulus_p> &lhs, const mnt4_G2 &rhs)
+{
+    return scalar_mul<mnt4_G2, m>(rhs, lhs.as_bigint());
+}
+
+} // libff
+
+#endif // MNT4_G2_HPP_
diff --git a/src/libff/libff/algebra/curves/mnt/mnt4/mnt4_init.cpp b/src/libff/libff/algebra/curves/mnt/mnt4/mnt4_init.cpp
new file mode 100755
index 000000000..b252d8c55
--- /dev/null
+++ b/src/libff/libff/algebra/curves/mnt/mnt4/mnt4_init.cpp
@@ -0,0 +1,265 @@
+/** @file
+ *****************************************************************************
+
+ Implementation of interfaces for initializing MNT4.
+
+ See mnt4_init.hpp .
+
+ *****************************************************************************
+ * @author     This file is part of libff, developed by SCIPR Lab
+ *             and contributors (see AUTHORS).
+ * @copyright  MIT license (see LICENSE file)
+ *****************************************************************************/
+
+#include <libff/algebra/curves/mnt/mnt4/mnt4_g1.hpp>
+#include <libff/algebra/curves/mnt/mnt4/mnt4_g2.hpp>
+#include <libff/algebra/curves/mnt/mnt4/mnt4_init.hpp>
+
+namespace libff {
+
+// bigint<mnt4_r_limbs> mnt4_modulus_r = mnt46_modulus_A;
+// bigint<mnt4_q_limbs> mnt4_modulus_q = mnt46_modulus_B;
+
+mnt4_Fq2 mnt4_twist;
+mnt4_Fq2 mnt4_twist_coeff_a;
+mnt4_Fq2 mnt4_twist_coeff_b;
+mnt4_Fq mnt4_twist_mul_by_a_c0;
+mnt4_Fq mnt4_twist_mul_by_a_c1;
+mnt4_Fq mnt4_twist_mul_by_b_c0;
+mnt4_Fq mnt4_twist_mul_by_b_c1;
+mnt4_Fq mnt4_twist_mul_by_q_X;
+mnt4_Fq mnt4_twist_mul_by_q_Y;
+
+bigint<mnt4_q_limbs> mnt4_ate_loop_count;
+bool mnt4_ate_is_loop_count_neg;
+bigint<4*mnt4_q_limbs> mnt4_final_exponent;
+bigint<mnt4_q_limbs> mnt4_final_exponent_last_chunk_abs_of_w0;
+bool mnt4_final_exponent_last_chunk_is_w0_neg;
+bigint<mnt4_q_limbs> mnt4_final_exponent_last_chunk_w1;
+
+void init_mnt4_params()
+{
+    typedef bigint<mnt4_r_limbs> bigint_r;
+    typedef bigint<mnt4_q_limbs> bigint_q;
+
+    assert(sizeof(mp_limb_t) == 8 || sizeof(mp_limb_t) == 4); // Montgomery assumes this
+
+    /* parameters for scalar field Fr */
+    mnt4_modulus_r = bigint_r("475922286169261325753349249653048451545124878552823515553267735739164647307408490559963137");
+    assert(mnt4_Fr::modulus_is_valid());
+    if (sizeof(mp_limb_t) == 8)
+    {
+        mnt4_Fr::Rsquared = bigint_r("163983144722506446826715124368972380525894397127205577781234305496325861831001705438796139");
+        mnt4_Fr::Rcubed = bigint_r("207236281459091063710247635236340312578688659363066707916716212805695955118593239854980171");
+        mnt4_Fr::inv = 0xbb4334a3ffffffff;
+    }
+    if (sizeof(mp_limb_t) == 4)
+    {
+        mnt4_Fr::Rsquared = bigint_r("163983144722506446826715124368972380525894397127205577781234305496325861831001705438796139");
+        mnt4_Fr::Rcubed = bigint_r("207236281459091063710247635236340312578688659363066707916716212805695955118593239854980171");
+        mnt4_Fr::inv = 0xffffffff;
+    }
+    mnt4_Fr::num_bits = 298;
+    mnt4_Fr::euler = bigint_r("237961143084630662876674624826524225772562439276411757776633867869582323653704245279981568");
+    mnt4_Fr::s = 34;
+    mnt4_Fr::t = bigint_r("27702323054502562488973446286577291993024111641153199339359284829066871159442729");
+    mnt4_Fr::t_minus_1_over_2 = bigint_r("13851161527251281244486723143288645996512055820576599669679642414533435579721364");
+    mnt4_Fr::multiplicative_generator = mnt4_Fr("10");
+    mnt4_Fr::root_of_unity = mnt4_Fr("120638817826913173458768829485690099845377008030891618010109772937363554409782252579816313");
+    mnt4_Fr::nqr = mnt4_Fr("5");
+    mnt4_Fr::nqr_to_t = mnt4_Fr("406220604243090401056429458730298145937262552508985450684842547562990900634752279902740880");
+
+    /* parameters for base field Fq */
+    mnt4_modulus_q = bigint_q("475922286169261325753349249653048451545124879242694725395555128576210262817955800483758081");
+    assert(mnt4_Fq::modulus_is_valid());
+    if (sizeof(mp_limb_t) == 8)
+    {
+        mnt4_Fq::Rsquared = bigint_q("273000478523237720910981655601160860640083126627235719712980612296263966512828033847775776");
+        mnt4_Fq::Rcubed = bigint_q("427298980065529822574935274648041073124704261331681436071990730954930769758106792920349077");
+        mnt4_Fq::inv = 0xb071a1b67165ffff;
+    }
+    if (sizeof(mp_limb_t) == 4)
+    {
+        mnt4_Fq::Rsquared = bigint_q("273000478523237720910981655601160860640083126627235719712980612296263966512828033847775776");
+        mnt4_Fq::Rcubed = bigint_q("427298980065529822574935274648041073124704261331681436071990730954930769758106792920349077");
+        mnt4_Fq::inv = 0x7165ffff;
+    }
+    mnt4_Fq::num_bits = 298;
+    mnt4_Fq::euler = bigint_q("237961143084630662876674624826524225772562439621347362697777564288105131408977900241879040");
+    mnt4_Fq::s = 17;
+    mnt4_Fq::t = bigint_q("3630998887399759870554727551674258816109656366292531779446068791017229177993437198515");
+    mnt4_Fq::t_minus_1_over_2 = bigint_q("1815499443699879935277363775837129408054828183146265889723034395508614588996718599257");
+    mnt4_Fq::multiplicative_generator = mnt4_Fq("17");
+    mnt4_Fq::root_of_unity = mnt4_Fq("264706250571800080758069302369654305530125675521263976034054878017580902343339784464690243");
+    mnt4_Fq::nqr = mnt4_Fq("17");
+    mnt4_Fq::nqr_to_t = mnt4_Fq("264706250571800080758069302369654305530125675521263976034054878017580902343339784464690243");
+
+    /* parameters for twist field Fq2 */
+    mnt4_Fq2::euler = bigint<2*mnt4_q_limbs>("113251011236288135098249345249154230895914381858788918106847214243419142422924133497460817468249854833067260038985710370091920860837014281886963086681184370139950267830740466401280");
+    mnt4_Fq2::s = 18;
+    mnt4_Fq2::t = bigint<2*mnt4_q_limbs>("864036645784668999467844736092790457885088972921668381552484239528039111503022258739172496553419912972009735404859240494475714575477709059806542104196047745818712370534824115");
+    mnt4_Fq2::t_minus_1_over_2 = bigint<2*mnt4_q_limbs>("432018322892334499733922368046395228942544486460834190776242119764019555751511129369586248276709956486004867702429620247237857287738854529903271052098023872909356185267412057");
+    mnt4_Fq2::non_residue = mnt4_Fq("17");
+    mnt4_Fq2::nqr = mnt4_Fq2(mnt4_Fq("8"),mnt4_Fq("1"));
+    mnt4_Fq2::nqr_to_t = mnt4_Fq2(mnt4_Fq("0"),mnt4_Fq("29402818985595053196743631544512156561638230562612542604956687802791427330205135130967658"));
+    mnt4_Fq2::Frobenius_coeffs_c1[0] = mnt4_Fq("1");
+    mnt4_Fq2::Frobenius_coeffs_c1[1] = mnt4_Fq("475922286169261325753349249653048451545124879242694725395555128576210262817955800483758080");
+
+    /* parameters for Fq4 */
+    mnt4_Fq4::non_residue = mnt4_Fq("17");
+    mnt4_Fq4::Frobenius_coeffs_c1[0] = mnt4_Fq("1");
+    mnt4_Fq4::Frobenius_coeffs_c1[1] = mnt4_Fq("7684163245453501615621351552473337069301082060976805004625011694147890954040864167002308");
+    mnt4_Fq4::Frobenius_coeffs_c1[2] = mnt4_Fq("475922286169261325753349249653048451545124879242694725395555128576210262817955800483758080");
+    mnt4_Fq4::Frobenius_coeffs_c1[3] = mnt4_Fq("468238122923807824137727898100575114475823797181717920390930116882062371863914936316755773");
+
+    /* choice of short Weierstrass curve and its twist */
+    mnt4_G1::coeff_a = mnt4_Fq("2");
+    mnt4_G1::coeff_b = mnt4_Fq("423894536526684178289416011533888240029318103673896002803341544124054745019340795360841685");
+    mnt4_twist = mnt4_Fq2(mnt4_Fq::zero(), mnt4_Fq::one());
+    mnt4_twist_coeff_a = mnt4_Fq2(mnt4_G1::coeff_a * mnt4_Fq2::non_residue, mnt4_Fq::zero());
+    mnt4_twist_coeff_b = mnt4_Fq2(mnt4_Fq::zero(), mnt4_G1::coeff_b * mnt4_Fq2::non_residue);
+    mnt4_G2::twist = mnt4_twist;
+    mnt4_G2::coeff_a = mnt4_twist_coeff_a;
+    mnt4_G2::coeff_b = mnt4_twist_coeff_b;
+    mnt4_twist_mul_by_a_c0 = mnt4_G1::coeff_a * mnt4_Fq2::non_residue;
+    mnt4_twist_mul_by_a_c1 = mnt4_G1::coeff_a * mnt4_Fq2::non_residue;
+    mnt4_twist_mul_by_b_c0 = mnt4_G1::coeff_b * mnt4_Fq2::non_residue.squared();
+    mnt4_twist_mul_by_b_c1 = mnt4_G1::coeff_b * mnt4_Fq2::non_residue;
+    mnt4_twist_mul_by_q_X = mnt4_Fq("475922286169261325753349249653048451545124879242694725395555128576210262817955800483758080");
+    mnt4_twist_mul_by_q_Y = mnt4_Fq("7684163245453501615621351552473337069301082060976805004625011694147890954040864167002308");
+
+    /* choice of group G1 */
+    mnt4_G1::G1_zero = mnt4_G1(mnt4_Fq::zero(),
+                               mnt4_Fq::one(),
+                               mnt4_Fq::zero());
+
+
+    mnt4_G1::G1_one = mnt4_G1(mnt4_Fq("60760244141852568949126569781626075788424196370144486719385562369396875346601926534016838"),
+                              mnt4_Fq("363732850702582978263902770815145784459747722357071843971107674179038674942891694705904306"),
+                              mnt4_Fq::one());
+
+    mnt4_G1::wnaf_window_table.resize(0);
+    mnt4_G1::wnaf_window_table.push_back(11);
+    mnt4_G1::wnaf_window_table.push_back(24);
+    mnt4_G1::wnaf_window_table.push_back(60);
+    mnt4_G1::wnaf_window_table.push_back(127);
+
+    mnt4_G1::fixed_base_exp_window_table.resize(0);
+    // window 1 is unbeaten in [-inf, 5.09]
+    mnt4_G1::fixed_base_exp_window_table.push_back(1);
+    // window 2 is unbeaten in [5.09, 9.64]
+    mnt4_G1::fixed_base_exp_window_table.push_back(5);
+    // window 3 is unbeaten in [9.64, 24.79]
+    mnt4_G1::fixed_base_exp_window_table.push_back(10);
+    // window 4 is unbeaten in [24.79, 60.29]
+    mnt4_G1::fixed_base_exp_window_table.push_back(25);
+    // window 5 is unbeaten in [60.29, 144.37]
+    mnt4_G1::fixed_base_exp_window_table.push_back(60);
+    // window 6 is unbeaten in [144.37, 344.90]
+    mnt4_G1::fixed_base_exp_window_table.push_back(144);
+    // window 7 is unbeaten in [344.90, 855.00]
+    mnt4_G1::fixed_base_exp_window_table.push_back(345);
+    // window 8 is unbeaten in [855.00, 1804.62]
+    mnt4_G1::fixed_base_exp_window_table.push_back(855);
+    // window 9 is unbeaten in [1804.62, 3912.30]
+    mnt4_G1::fixed_base_exp_window_table.push_back(1805);
+    // window 10 is unbeaten in [3912.30, 11264.50]
+    mnt4_G1::fixed_base_exp_window_table.push_back(3912);
+    // window 11 is unbeaten in [11264.50, 27897.51]
+    mnt4_G1::fixed_base_exp_window_table.push_back(11265);
+    // window 12 is unbeaten in [27897.51, 57596.79]
+    mnt4_G1::fixed_base_exp_window_table.push_back(27898);
+    // window 13 is unbeaten in [57596.79, 145298.71]
+    mnt4_G1::fixed_base_exp_window_table.push_back(57597);
+    // window 14 is unbeaten in [145298.71, 157204.59]
+    mnt4_G1::fixed_base_exp_window_table.push_back(145299);
+    // window 15 is unbeaten in [157204.59, 601600.62]
+    mnt4_G1::fixed_base_exp_window_table.push_back(157205);
+    // window 16 is unbeaten in [601600.62, 1107377.25]
+    mnt4_G1::fixed_base_exp_window_table.push_back(601601);
+    // window 17 is unbeaten in [1107377.25, 1789646.95]
+    mnt4_G1::fixed_base_exp_window_table.push_back(1107377);
+    // window 18 is unbeaten in [1789646.95, 4392626.92]
+    mnt4_G1::fixed_base_exp_window_table.push_back(1789647);
+    // window 19 is unbeaten in [4392626.92, 8221210.60]
+    mnt4_G1::fixed_base_exp_window_table.push_back(4392627);
+    // window 20 is unbeaten in [8221210.60, 42363731.19]
+    mnt4_G1::fixed_base_exp_window_table.push_back(8221211);
+    // window 21 is never the best
+    mnt4_G1::fixed_base_exp_window_table.push_back(0);
+    // window 22 is unbeaten in [42363731.19, inf]
+    mnt4_G1::fixed_base_exp_window_table.push_back(42363731);
+
+    /* choice of group G2 */
+    mnt4_G2::G2_zero = mnt4_G2(mnt4_Fq2::zero(),
+                               mnt4_Fq2::one(),
+                               mnt4_Fq2::zero());
+
+    mnt4_G2::G2_one = mnt4_G2(mnt4_Fq2(mnt4_Fq("438374926219350099854919100077809681842783509163790991847867546339851681564223481322252708"),
+                                       mnt4_Fq("37620953615500480110935514360923278605464476459712393277679280819942849043649216370485641")),
+                              mnt4_Fq2(mnt4_Fq("37437409008528968268352521034936931842973546441370663118543015118291998305624025037512482"),
+                                       mnt4_Fq("424621479598893882672393190337420680597584695892317197646113820787463109735345923009077489")),
+                              mnt4_Fq2::one());
+
+    mnt4_G2::wnaf_window_table.resize(0);
+    mnt4_G2::wnaf_window_table.push_back(5);
+    mnt4_G2::wnaf_window_table.push_back(15);
+    mnt4_G2::wnaf_window_table.push_back(39);
+    mnt4_G2::wnaf_window_table.push_back(109);
+
+    mnt4_G2::fixed_base_exp_window_table.resize(0);
+    // window 1 is unbeaten in [-inf, 4.17]
+    mnt4_G2::fixed_base_exp_window_table.push_back(1);
+    // window 2 is unbeaten in [4.17, 10.12]
+    mnt4_G2::fixed_base_exp_window_table.push_back(4);
+    // window 3 is unbeaten in [10.12, 24.65]
+    mnt4_G2::fixed_base_exp_window_table.push_back(10);
+    // window 4 is unbeaten in [24.65, 60.03]
+    mnt4_G2::fixed_base_exp_window_table.push_back(25);
+    // window 5 is unbeaten in [60.03, 143.16]
+    mnt4_G2::fixed_base_exp_window_table.push_back(60);
+    // window 6 is unbeaten in [143.16, 344.73]
+    mnt4_G2::fixed_base_exp_window_table.push_back(143);
+    // window 7 is unbeaten in [344.73, 821.24]
+    mnt4_G2::fixed_base_exp_window_table.push_back(345);
+    // window 8 is unbeaten in [821.24, 1793.92]
+    mnt4_G2::fixed_base_exp_window_table.push_back(821);
+    // window 9 is unbeaten in [1793.92, 3919.59]
+    mnt4_G2::fixed_base_exp_window_table.push_back(1794);
+    // window 10 is unbeaten in [3919.59, 11301.46]
+    mnt4_G2::fixed_base_exp_window_table.push_back(3920);
+    // window 11 is unbeaten in [11301.46, 18960.09]
+    mnt4_G2::fixed_base_exp_window_table.push_back(11301);
+    // window 12 is unbeaten in [18960.09, 44198.62]
+    mnt4_G2::fixed_base_exp_window_table.push_back(18960);
+    // window 13 is unbeaten in [44198.62, 150799.57]
+    mnt4_G2::fixed_base_exp_window_table.push_back(44199);
+    // window 14 is never the best
+    mnt4_G2::fixed_base_exp_window_table.push_back(0);
+    // window 15 is unbeaten in [150799.57, 548694.81]
+    mnt4_G2::fixed_base_exp_window_table.push_back(150800);
+    // window 16 is unbeaten in [548694.81, 1051769.08]
+    mnt4_G2::fixed_base_exp_window_table.push_back(548695);
+    // window 17 is unbeaten in [1051769.08, 2023925.59]
+    mnt4_G2::fixed_base_exp_window_table.push_back(1051769);
+    // window 18 is unbeaten in [2023925.59, 3787108.68]
+    mnt4_G2::fixed_base_exp_window_table.push_back(2023926);
+    // window 19 is unbeaten in [3787108.68, 7107480.30]
+    mnt4_G2::fixed_base_exp_window_table.push_back(3787109);
+    // window 20 is unbeaten in [7107480.30, 38760027.14]
+    mnt4_G2::fixed_base_exp_window_table.push_back(7107480);
+    // window 21 is never the best
+    mnt4_G2::fixed_base_exp_window_table.push_back(0);
+    // window 22 is unbeaten in [38760027.14, inf]
+    mnt4_G2::fixed_base_exp_window_table.push_back(38760027);
+
+    /* pairing parameters */
+    mnt4_ate_loop_count = bigint_q("689871209842287392837045615510547309923794944");
+    mnt4_ate_is_loop_count_neg = false;
+    mnt4_final_exponent = bigint<4*mnt4_q_limbs>("107797360357109903430794490309592072278927783803031854357910908121903439838772861497177116410825586743089760869945394610511917274977971559062689561855016270594656570874331111995170645233717143416875749097203441437192367065467706065411650403684877366879441766585988546560");
+    mnt4_final_exponent_last_chunk_abs_of_w0 = bigint_q("689871209842287392837045615510547309923794945");
+    mnt4_final_exponent_last_chunk_is_w0_neg = false;
+    mnt4_final_exponent_last_chunk_w1 = bigint_q("1");
+}
+
+} // libff
diff --git a/src/libff/libff/algebra/curves/mnt/mnt4/mnt4_init.hpp b/src/libff/libff/algebra/curves/mnt/mnt4/mnt4_init.hpp
new file mode 100755
index 000000000..600d16c8b
--- /dev/null
+++ b/src/libff/libff/algebra/curves/mnt/mnt4/mnt4_init.hpp
@@ -0,0 +1,67 @@
+/** @file
+ *****************************************************************************
+
+ Declaration of interfaces for initializing MNT4.
+
+ *****************************************************************************
+ * @author     This file is part of libff, developed by SCIPR Lab
+ *             and contributors (see AUTHORS).
+ * @copyright  MIT license (see LICENSE file)
+ *****************************************************************************/
+
+#ifndef MNT4_INIT_HPP_
+#define MNT4_INIT_HPP_
+
+#include <libff/algebra/curves/mnt/mnt46_common.hpp>
+#include <libff/algebra/curves/public_params.hpp>
+#include <libff/algebra/fields/fp.hpp>
+#include <libff/algebra/fields/fp2.hpp>
+#include <libff/algebra/fields/fp4.hpp>
+
+namespace libff {
+
+#define mnt4_modulus_r mnt46_modulus_A
+#define mnt4_modulus_q mnt46_modulus_B
+
+const mp_size_t mnt4_r_bitcount = mnt46_A_bitcount;
+const mp_size_t mnt4_q_bitcount = mnt46_B_bitcount;
+
+const mp_size_t mnt4_r_limbs = mnt46_A_limbs;
+const mp_size_t mnt4_q_limbs = mnt46_B_limbs;
+
+extern bigint<mnt4_r_limbs> mnt4_modulus_r;
+extern bigint<mnt4_q_limbs> mnt4_modulus_q;
+
+typedef Fp_model<mnt4_r_limbs, mnt4_modulus_r> mnt4_Fr;
+typedef Fp_model<mnt4_q_limbs, mnt4_modulus_q> mnt4_Fq;
+typedef Fp2_model<mnt4_q_limbs, mnt4_modulus_q> mnt4_Fq2;
+typedef Fp4_model<mnt4_q_limbs, mnt4_modulus_q> mnt4_Fq4;
+typedef mnt4_Fq4 mnt4_GT;
+
+// parameters for twisted short Weierstrass curve E'/Fq2 : y^2 = x^3 + (a * twist^2) * x + (b * twist^3)
+extern mnt4_Fq2 mnt4_twist;
+extern mnt4_Fq2 mnt4_twist_coeff_a;
+extern mnt4_Fq2 mnt4_twist_coeff_b;
+extern mnt4_Fq mnt4_twist_mul_by_a_c0;
+extern mnt4_Fq mnt4_twist_mul_by_a_c1;
+extern mnt4_Fq mnt4_twist_mul_by_b_c0;
+extern mnt4_Fq mnt4_twist_mul_by_b_c1;
+extern mnt4_Fq mnt4_twist_mul_by_q_X;
+extern mnt4_Fq mnt4_twist_mul_by_q_Y;
+
+// parameters for pairing
+extern bigint<mnt4_q_limbs> mnt4_ate_loop_count;
+extern bool mnt4_ate_is_loop_count_neg;
+extern bigint<4*mnt4_q_limbs> mnt4_final_exponent;
+extern bigint<mnt4_q_limbs> mnt4_final_exponent_last_chunk_abs_of_w0;
+extern bool mnt4_final_exponent_last_chunk_is_w0_neg;
+extern bigint<mnt4_q_limbs> mnt4_final_exponent_last_chunk_w1;
+
+void init_mnt4_params();
+
+class mnt4_G1;
+class mnt4_G2;
+
+} // libff
+
+#endif // MNT4_INIT_HPP_
diff --git a/src/libff/libff/algebra/curves/mnt/mnt4/mnt4_pairing.cpp b/src/libff/libff/algebra/curves/mnt/mnt4/mnt4_pairing.cpp
new file mode 100755
index 000000000..be1085254
--- /dev/null
+++ b/src/libff/libff/algebra/curves/mnt/mnt4/mnt4_pairing.cpp
@@ -0,0 +1,741 @@
+/** @file
+ *****************************************************************************
+
+ Implementation of interfaces for pairing operations on MNT4.
+
+ See mnt4_pairing.hpp .
+
+ *****************************************************************************
+ * @author     This file is part of libff, developed by SCIPR Lab
+ *             and contributors (see AUTHORS).
+ * @copyright  MIT license (see LICENSE file)
+ *****************************************************************************/
+
+#include <cassert>
+
+#include <libff/algebra/curves/mnt/mnt4/mnt4_g1.hpp>
+#include <libff/algebra/curves/mnt/mnt4/mnt4_g2.hpp>
+#include <libff/algebra/curves/mnt/mnt4/mnt4_init.hpp>
+#include <libff/algebra/curves/mnt/mnt4/mnt4_pairing.hpp>
+#include <libff/algebra/scalar_multiplication/wnaf.hpp>
+#include <libff/common/profiling.hpp>
+
+namespace libff {
+
+bool mnt4_ate_G1_precomp::operator==(const mnt4_ate_G1_precomp &other) const
+{
+    return (this->PX == other.PX &&
+            this->PY == other.PY &&
+            this->PX_twist == other.PX_twist &&
+            this->PY_twist == other.PY_twist);
+}
+
+std::ostream& operator<<(std::ostream &out, const mnt4_ate_G1_precomp &prec_P)
+{
+    out << prec_P.PX << OUTPUT_SEPARATOR << prec_P.PY << OUTPUT_SEPARATOR << prec_P.PX_twist << OUTPUT_SEPARATOR << prec_P.PY_twist;
+
+    return out;
+}
+
+std::istream& operator>>(std::istream &in, mnt4_ate_G1_precomp &prec_P)
+{
+    in >> prec_P.PX;
+    consume_OUTPUT_SEPARATOR(in);
+    in >> prec_P.PY;
+    consume_OUTPUT_SEPARATOR(in);
+    in >> prec_P.PX_twist;
+    consume_OUTPUT_SEPARATOR(in);
+    in >> prec_P.PY_twist;
+
+    return in;
+}
+
+bool mnt4_ate_dbl_coeffs::operator==(const mnt4_ate_dbl_coeffs &other) const
+{
+    return (this->c_H == other.c_H &&
+            this->c_4C == other.c_4C &&
+            this->c_J == other.c_J &&
+            this->c_L == other.c_L);
+}
+
+std::ostream& operator<<(std::ostream &out, const mnt4_ate_dbl_coeffs &dc)
+{
+    out << dc.c_H << OUTPUT_SEPARATOR << dc.c_4C << OUTPUT_SEPARATOR << dc.c_J << OUTPUT_SEPARATOR << dc.c_L;
+    return out;
+}
+
+std::istream& operator>>(std::istream &in, mnt4_ate_dbl_coeffs &dc)
+{
+    in >> dc.c_H;
+    consume_OUTPUT_SEPARATOR(in);
+    in >> dc.c_4C;
+    consume_OUTPUT_SEPARATOR(in);
+    in >> dc.c_J;
+    consume_OUTPUT_SEPARATOR(in);
+    in >> dc.c_L;
+
+    return in;
+}
+
+bool mnt4_ate_add_coeffs::operator==(const mnt4_ate_add_coeffs &other) const
+{
+    return (this->c_L1 == other.c_L1 &&
+            this->c_RZ == other.c_RZ);
+}
+
+std::ostream& operator<<(std::ostream &out, const mnt4_ate_add_coeffs &ac)
+{
+    out << ac.c_L1 << OUTPUT_SEPARATOR << ac.c_RZ;
+    return out;
+}
+
+std::istream& operator>>(std::istream &in, mnt4_ate_add_coeffs &ac)
+{
+    in >> ac.c_L1;
+    consume_OUTPUT_SEPARATOR(in);
+    in >> ac.c_RZ;
+    return in;
+}
+
+bool mnt4_ate_G2_precomp::operator==(const mnt4_ate_G2_precomp &other) const
+{
+    return (this->QX == other.QX &&
+            this->QY == other.QY &&
+            this->QY2 == other.QY2 &&
+            this->QX_over_twist == other.QX_over_twist &&
+            this->QY_over_twist == other.QY_over_twist &&
+            this->dbl_coeffs == other.dbl_coeffs &&
+            this->add_coeffs == other.add_coeffs);
+}
+
+std::ostream& operator<<(std::ostream& out, const mnt4_ate_G2_precomp &prec_Q)
+{
+    out << prec_Q.QX << OUTPUT_SEPARATOR
+        << prec_Q.QY << OUTPUT_SEPARATOR
+        << prec_Q.QY2  << OUTPUT_SEPARATOR
+        << prec_Q.QX_over_twist << OUTPUT_SEPARATOR
+        << prec_Q.QY_over_twist << "\n";
+    out << prec_Q.dbl_coeffs.size() << "\n";
+    for (const mnt4_ate_dbl_coeffs &dc : prec_Q.dbl_coeffs)
+    {
+        out << dc << OUTPUT_NEWLINE;
+    }
+    out << prec_Q.add_coeffs.size() << "\n";
+    for (const mnt4_ate_add_coeffs &ac : prec_Q.add_coeffs)
+    {
+        out << ac << OUTPUT_NEWLINE;
+    }
+
+    return out;
+}
+
+std::istream& operator>>(std::istream& in, mnt4_ate_G2_precomp &prec_Q)
+{
+    in >> prec_Q.QX;
+    consume_OUTPUT_SEPARATOR(in);
+    in >> prec_Q.QY;
+    consume_OUTPUT_SEPARATOR(in);
+    in >> prec_Q.QY2;
+    consume_OUTPUT_SEPARATOR(in);
+    in >> prec_Q.QX_over_twist;
+    consume_OUTPUT_SEPARATOR(in);
+    in >> prec_Q.QY_over_twist;
+    consume_newline(in);
+
+    prec_Q.dbl_coeffs.clear();
+    size_t dbl_s;
+    in >> dbl_s;
+    consume_newline(in);
+
+    prec_Q.dbl_coeffs.reserve(dbl_s);
+
+    for (size_t i = 0; i < dbl_s; ++i)
+    {
+        mnt4_ate_dbl_coeffs dc;
+        in >> dc;
+        consume_OUTPUT_NEWLINE(in);
+        prec_Q.dbl_coeffs.emplace_back(dc);
+    }
+
+    prec_Q.add_coeffs.clear();
+    size_t add_s;
+    in >> add_s;
+    consume_newline(in);
+
+    prec_Q.add_coeffs.reserve(add_s);
+
+    for (size_t i = 0; i < add_s; ++i)
+    {
+        mnt4_ate_add_coeffs ac;
+        in >> ac;
+        consume_OUTPUT_NEWLINE(in);
+        prec_Q.add_coeffs.emplace_back(ac);
+    }
+
+    return in;
+}
+
+/* final exponentiations */
+
+mnt4_Fq4 mnt4_final_exponentiation_last_chunk(const mnt4_Fq4 &elt, const mnt4_Fq4 &elt_inv)
+{
+    enter_block("Call to mnt4_final_exponentiation_last_chunk");
+    const mnt4_Fq4 elt_q = elt.Frobenius_map(1);
+    mnt4_Fq4 w1_part = elt_q.cyclotomic_exp(mnt4_final_exponent_last_chunk_w1);
+    mnt4_Fq4 w0_part;
+    if (mnt4_final_exponent_last_chunk_is_w0_neg)
+    {
+    	w0_part = elt_inv.cyclotomic_exp(mnt4_final_exponent_last_chunk_abs_of_w0);
+    } else {
+    	w0_part = elt.cyclotomic_exp(mnt4_final_exponent_last_chunk_abs_of_w0);
+    }
+    mnt4_Fq4 result = w1_part * w0_part;
+    leave_block("Call to mnt4_final_exponentiation_last_chunk");
+
+    return result;
+}
+
+mnt4_Fq4 mnt4_final_exponentiation_first_chunk(const mnt4_Fq4 &elt, const mnt4_Fq4 &elt_inv)
+{
+    enter_block("Call to mnt4_final_exponentiation_first_chunk");
+
+    /* (q^2-1) */
+
+    /* elt_q2 = elt^(q^2) */
+    const mnt4_Fq4 elt_q2 = elt.Frobenius_map(2);
+    /* elt_q3_over_elt = elt^(q^2-1) */
+    const mnt4_Fq4 elt_q2_over_elt = elt_q2 * elt_inv;
+
+    leave_block("Call to mnt4_final_exponentiation_first_chunk");
+    return elt_q2_over_elt;
+}
+
+mnt4_GT mnt4_final_exponentiation(const mnt4_Fq4 &elt)
+{
+    enter_block("Call to mnt4_final_exponentiation");
+    const mnt4_Fq4 elt_inv = elt.inverse();
+    const mnt4_Fq4 elt_to_first_chunk = mnt4_final_exponentiation_first_chunk(elt, elt_inv);
+    const mnt4_Fq4 elt_inv_to_first_chunk = mnt4_final_exponentiation_first_chunk(elt_inv, elt);
+    mnt4_GT result = mnt4_final_exponentiation_last_chunk(elt_to_first_chunk, elt_inv_to_first_chunk);
+    leave_block("Call to mnt4_final_exponentiation");
+
+    return result;
+}
+
+/* affine ate miller loop */
+
+mnt4_affine_ate_G1_precomputation mnt4_affine_ate_precompute_G1(const mnt4_G1& P)
+{
+    enter_block("Call to mnt4_affine_ate_precompute_G1");
+
+    mnt4_G1 Pcopy = P;
+    Pcopy.to_affine_coordinates();
+
+    mnt4_affine_ate_G1_precomputation result;
+    result.PX = Pcopy.X();
+    result.PY = Pcopy.Y();
+    result.PY_twist_squared = Pcopy.Y() * mnt4_twist.squared();
+
+    leave_block("Call to mnt4_affine_ate_precompute_G1");
+    return result;
+}
+
+mnt4_affine_ate_G2_precomputation mnt4_affine_ate_precompute_G2(const mnt4_G2& Q)
+{
+    enter_block("Call to mnt4_affine_ate_precompute_G2");
+
+    mnt4_G2 Qcopy(Q);
+    Qcopy.to_affine_coordinates();
+
+    mnt4_affine_ate_G2_precomputation result;
+    result.QX = Qcopy.X();
+    result.QY = Qcopy.Y();
+
+    mnt4_Fq2 RX = Qcopy.X();
+    mnt4_Fq2 RY = Qcopy.Y();
+
+    const bigint<mnt4_Fr::num_limbs> &loop_count = mnt4_ate_loop_count;
+    bool found_nonzero = false;
+
+    std::vector<long> NAF = find_wnaf(1, loop_count);
+    for (long i = NAF.size() - 1; i >= 0; --i)
+    {
+        if (!found_nonzero)
+        {
+            /* this skips the MSB itself */
+            found_nonzero |= (NAF[i] != 0);
+            continue;
+        }
+
+        mnt4_affine_ate_coeffs c;
+        c.old_RX = RX;
+        c.old_RY = RY;
+        mnt4_Fq2 old_RX_2 = c.old_RX.squared();
+        c.gamma = (old_RX_2 + old_RX_2 + old_RX_2 + mnt4_twist_coeff_a) * (c.old_RY + c.old_RY).inverse();
+        c.gamma_twist = c.gamma * mnt4_twist;
+        c.gamma_X = c.gamma * c.old_RX;
+        result.coeffs.push_back(c);
+
+        RX = c.gamma.squared() - (c.old_RX+c.old_RX);
+        RY = c.gamma * (c.old_RX - RX) - c.old_RY;
+
+        if (NAF[i] != 0)
+        {
+            mnt4_affine_ate_coeffs c;
+            c.old_RX = RX;
+            c.old_RY = RY;
+            if (NAF[i] > 0)
+            {
+                c.gamma = (c.old_RY - result.QY) * (c.old_RX - result.QX).inverse();
+            }
+            else
+            {
+                c.gamma = (c.old_RY + result.QY) * (c.old_RX - result.QX).inverse();
+            }
+            c.gamma_twist = c.gamma * mnt4_twist;
+            c.gamma_X = c.gamma * result.QX;
+            result.coeffs.push_back(c);
+
+            RX = c.gamma.squared() - (c.old_RX+result.QX);
+            RY = c.gamma * (c.old_RX - RX) - c.old_RY;
+        }
+    }
+
+    /* TODO: maybe handle neg
+       if (mnt4_ate_is_loop_count_neg)
+       {
+       mnt4_ate_add_coeffs ac;
+       mnt4_affine_ate_dbl_coeffs c;
+       c.old_RX = RX;
+       c.old_RY = -RY;
+       old_RX_2 = c.old_RY.squared();
+       c.gamma = (old_RX_2 + old_RX_2 + old_RX_2 + mnt4_coeff_a) * (c.old_RY + c.old_RY).inverse();
+       c.gamma_twist = c.gamma * mnt4_twist;
+       c.gamma_X = c.gamma * c.old_RX;
+       result.coeffs.push_back(c);
+       }
+    */
+
+    leave_block("Call to mnt4_affine_ate_precompute_G2");
+    return result;
+}
+
+mnt4_Fq4 mnt4_affine_ate_miller_loop(const mnt4_affine_ate_G1_precomputation &prec_P,
+                                     const mnt4_affine_ate_G2_precomputation &prec_Q)
+{
+    enter_block("Call to mnt4_affine_ate_miller_loop");
+
+    mnt4_Fq4 f = mnt4_Fq4::one();
+
+    bool found_nonzero = false;
+    size_t idx = 0;
+    const bigint<mnt4_Fr::num_limbs> &loop_count = mnt4_ate_loop_count;
+
+    std::vector<long> NAF = find_wnaf(1, loop_count);
+    for (long i = NAF.size() - 1; i >= 0; --i)
+    {
+        if (!found_nonzero)
+        {
+            /* this skips the MSB itself */
+            found_nonzero |= (NAF[i] != 0);
+            continue;
+        }
+
+        /* code below gets executed for all bits (EXCEPT the MSB itself) of
+           mnt4_param_p (skipping leading zeros) in MSB to LSB
+           order */
+        mnt4_affine_ate_coeffs c = prec_Q.coeffs[idx++];
+
+        mnt4_Fq4 g_RR_at_P = mnt4_Fq4(prec_P.PY_twist_squared,
+                                      - prec_P.PX * c.gamma_twist + c.gamma_X - c.old_RY);
+        f = f.squared().mul_by_023(g_RR_at_P);
+
+        if (NAF[i] != 0)
+        {
+            mnt4_affine_ate_coeffs c = prec_Q.coeffs[idx++];
+            mnt4_Fq4 g_RQ_at_P;
+            if (NAF[i] > 0)
+            {
+                g_RQ_at_P = mnt4_Fq4(prec_P.PY_twist_squared,
+                                     - prec_P.PX * c.gamma_twist + c.gamma_X - prec_Q.QY);
+            }
+            else
+            {
+                g_RQ_at_P = mnt4_Fq4(prec_P.PY_twist_squared,
+                                     - prec_P.PX * c.gamma_twist + c.gamma_X + prec_Q.QY);
+            }
+            f = f.mul_by_023(g_RQ_at_P);
+        }
+    }
+
+    /* TODO: maybe handle neg
+       if (mnt4_ate_is_loop_count_neg)
+       {
+       // TODO:
+       mnt4_affine_ate_coeffs ac = prec_Q.coeffs[idx++];
+       mnt4_Fq4 g_RnegR_at_P = mnt4_Fq4(prec_P.PY_twist_squared,
+       - prec_P.PX * c.gamma_twist + c.gamma_X - c.old_RY);
+       f = (f * g_RnegR_at_P).inverse();
+       }
+    */
+
+    leave_block("Call to mnt4_affine_ate_miller_loop");
+
+    return f;
+}
+
+/* ate pairing */
+
+struct extended_mnt4_G2_projective {
+    mnt4_Fq2 X;
+    mnt4_Fq2 Y;
+    mnt4_Fq2 Z;
+    mnt4_Fq2 T;
+
+    void print() const
+    {
+        printf("extended mnt4_G2 projective X/Y/Z/T:\n");
+        X.print();
+        Y.print();
+        Z.print();
+        T.print();
+    }
+
+    void test_invariant() const
+    {
+        assert(T == Z.squared());
+    }
+};
+
+void doubling_step_for_flipped_miller_loop(extended_mnt4_G2_projective &current,
+                                           mnt4_ate_dbl_coeffs &dc)
+{
+    const mnt4_Fq2 X = current.X, Y = current.Y, Z = current.Z, T = current.T;
+
+    const mnt4_Fq2 A = T.squared(); // A = T1^2
+    const mnt4_Fq2 B = X.squared(); // B = X1^2
+    const mnt4_Fq2 C = Y.squared(); // C = Y1^2
+    const mnt4_Fq2 D = C.squared(); // D = C^2
+    const mnt4_Fq2 E = (X+C).squared() - B - D; // E = (X1+C)^2-B-D
+    const mnt4_Fq2 F = (B+B+B) + mnt4_twist_coeff_a * A; // F = 3*B +  a  *A
+    const mnt4_Fq2 G = F.squared(); // G = F^2
+
+    current.X = -(E+E+E+E) + G; // X3 = -4*E+G
+    current.Y = -mnt4_Fq("8")*D + F*(E+E-current.X); // Y3 = -8*D+F*(2*E-X3)
+    current.Z = (Y+Z).squared() - C - Z.squared(); // Z3 = (Y1+Z1)^2-C-Z1^2
+    current.T = current.Z.squared(); // T3 = Z3^2
+
+    dc.c_H = (current.Z + T).squared() - current.T - A; // H = (Z3+T1)^2-T3-A
+    dc.c_4C = C+C+C+C; // fourC = 4*C
+    dc.c_J = (F+T).squared() - G - A; // J = (F+T1)^2-G-A
+    dc.c_L = (F+X).squared() - G - B; // L = (F+X1)^2-G-B
+
+#ifdef DEBUG
+    current.test_invariant();
+#endif
+}
+
+void mixed_addition_step_for_flipped_miller_loop(const mnt4_Fq2 base_X, const mnt4_Fq2 base_Y, const mnt4_Fq2 base_Y_squared,
+                                                 extended_mnt4_G2_projective &current,
+                                                 mnt4_ate_add_coeffs &ac)
+{
+    const mnt4_Fq2 X1 = current.X, Y1 = current.Y, Z1 = current.Z, T1 = current.T;
+    const mnt4_Fq2 &x2 = base_X,    &y2 =  base_Y, &y2_squared = base_Y_squared;
+
+    const mnt4_Fq2 B = x2 * T1; // B = x2 * T1
+    const mnt4_Fq2 D = ((y2 + Z1).squared() - y2_squared - T1) * T1; // D = ((y2 + Z1)^2 - y2squared - T1) * T1
+    const mnt4_Fq2 H = B - X1; // H = B - X1
+    const mnt4_Fq2 I = H.squared(); // I = H^2
+    const mnt4_Fq2 E = I + I + I + I; // E = 4*I
+    const mnt4_Fq2 J = H * E; // J = H * E
+    const mnt4_Fq2 V = X1 * E; // V = X1 * E
+    const mnt4_Fq2 L1 = D - (Y1 + Y1); // L1 = D - 2 * Y1
+
+    current.X = L1.squared() - J - (V+V); // X3 = L1^2 - J - 2*V
+    current.Y = L1 * (V-current.X) - (Y1+Y1) * J; // Y3 = L1 * (V-X3) - 2*Y1 * J
+    current.Z = (Z1+H).squared() - T1 - I; // Z3 = (Z1 + H)^2 - T1 - I
+    current.T = current.Z.squared(); // T3 = Z3^2
+
+    ac.c_L1 = L1;
+    ac.c_RZ = current.Z;
+#ifdef DEBUG
+    current.test_invariant();
+#endif
+}
+
+mnt4_ate_G1_precomp mnt4_ate_precompute_G1(const mnt4_G1& P)
+{
+    enter_block("Call to mnt4_ate_precompute_G1");
+
+    mnt4_G1 Pcopy = P;
+    Pcopy.to_affine_coordinates();
+
+    mnt4_ate_G1_precomp result;
+    result.PX = Pcopy.X();
+    result.PY = Pcopy.Y();
+    result.PX_twist = Pcopy.X() * mnt4_twist;
+    result.PY_twist = Pcopy.Y() * mnt4_twist;
+
+    leave_block("Call to mnt4_ate_precompute_G1");
+    return result;
+}
+
+mnt4_ate_G2_precomp mnt4_ate_precompute_G2(const mnt4_G2& Q)
+{
+    enter_block("Call to mnt4_ate_precompute_G2");
+
+    mnt4_G2 Qcopy(Q);
+    Qcopy.to_affine_coordinates();
+
+    mnt4_ate_G2_precomp result;
+    result.QX = Qcopy.X();
+    result.QY = Qcopy.Y();
+    result.QY2 = Qcopy.Y().squared();
+    result.QX_over_twist = Qcopy.X() * mnt4_twist.inverse();
+    result.QY_over_twist = Qcopy.Y() * mnt4_twist.inverse();
+
+    extended_mnt4_G2_projective R;
+    R.X = Qcopy.X();
+    R.Y = Qcopy.Y();
+    R.Z = mnt4_Fq2::one();
+    R.T = mnt4_Fq2::one();
+
+    const bigint<mnt4_Fr::num_limbs> &loop_count = mnt4_ate_loop_count;
+    bool found_one = false;
+
+    for (long i = loop_count.max_bits() - 1; i >= 0; --i)
+    {
+        const bool bit = loop_count.test_bit(i);
+        if (!found_one)
+        {
+            /* this skips the MSB itself */
+            found_one |= bit;
+            continue;
+        }
+
+        mnt4_ate_dbl_coeffs dc;
+        doubling_step_for_flipped_miller_loop(R, dc);
+        result.dbl_coeffs.push_back(dc);
+        if (bit)
+        {
+            mnt4_ate_add_coeffs ac;
+            mixed_addition_step_for_flipped_miller_loop(result.QX, result.QY, result.QY2, R, ac);
+            result.add_coeffs.push_back(ac);
+        }
+    }
+
+    if (mnt4_ate_is_loop_count_neg)
+    {
+    	mnt4_Fq2 RZ_inv = R.Z.inverse();
+    	mnt4_Fq2 RZ2_inv = RZ_inv.squared();
+    	mnt4_Fq2 RZ3_inv = RZ2_inv * RZ_inv;
+    	mnt4_Fq2 minus_R_affine_X = R.X * RZ2_inv;
+    	mnt4_Fq2 minus_R_affine_Y = - R.Y * RZ3_inv;
+    	mnt4_Fq2 minus_R_affine_Y2 = minus_R_affine_Y.squared();
+    	mnt4_ate_add_coeffs ac;
+        mixed_addition_step_for_flipped_miller_loop(minus_R_affine_X, minus_R_affine_Y, minus_R_affine_Y2, R, ac);
+        result.add_coeffs.push_back(ac);
+    }
+
+    leave_block("Call to mnt4_ate_precompute_G2");
+    return result;
+}
+
+mnt4_Fq4 mnt4_ate_miller_loop(const mnt4_ate_G1_precomp &prec_P,
+                              const mnt4_ate_G2_precomp &prec_Q)
+{
+    enter_block("Call to mnt4_ate_miller_loop");
+
+    mnt4_Fq2 L1_coeff = mnt4_Fq2(prec_P.PX, mnt4_Fq::zero()) - prec_Q.QX_over_twist;
+
+    mnt4_Fq4 f = mnt4_Fq4::one();
+
+    bool found_one = false;
+    size_t dbl_idx = 0;
+    size_t add_idx = 0;
+
+    const bigint<mnt4_Fr::num_limbs> &loop_count = mnt4_ate_loop_count;
+    for (long i = loop_count.max_bits() - 1; i >= 0; --i)
+    {
+        const bool bit = loop_count.test_bit(i);
+
+        if (!found_one)
+        {
+            /* this skips the MSB itself */
+            found_one |= bit;
+            continue;
+        }
+
+        /* code below gets executed for all bits (EXCEPT the MSB itself) of
+           mnt4_param_p (skipping leading zeros) in MSB to LSB
+           order */
+        mnt4_ate_dbl_coeffs dc = prec_Q.dbl_coeffs[dbl_idx++];
+
+        mnt4_Fq4 g_RR_at_P = mnt4_Fq4(- dc.c_4C - dc.c_J * prec_P.PX_twist + dc.c_L,
+                                      dc.c_H * prec_P.PY_twist);
+        f = f.squared() * g_RR_at_P;
+        if (bit)
+        {
+            mnt4_ate_add_coeffs ac = prec_Q.add_coeffs[add_idx++];
+
+            mnt4_Fq4 g_RQ_at_P = mnt4_Fq4(ac.c_RZ * prec_P.PY_twist,
+                                          -(prec_Q.QY_over_twist * ac.c_RZ + L1_coeff * ac.c_L1));
+            f = f * g_RQ_at_P;
+        }
+    }
+
+    if (mnt4_ate_is_loop_count_neg)
+    {
+    	mnt4_ate_add_coeffs ac = prec_Q.add_coeffs[add_idx++];
+    	mnt4_Fq4 g_RnegR_at_P = mnt4_Fq4(ac.c_RZ * prec_P.PY_twist,
+                                         -(prec_Q.QY_over_twist * ac.c_RZ + L1_coeff * ac.c_L1));
+    	f = (f * g_RnegR_at_P).inverse();
+    }
+
+    leave_block("Call to mnt4_ate_miller_loop");
+
+    return f;
+}
+
+mnt4_Fq4 mnt4_ate_double_miller_loop(const mnt4_ate_G1_precomp &prec_P1,
+                                     const mnt4_ate_G2_precomp &prec_Q1,
+                                     const mnt4_ate_G1_precomp &prec_P2,
+                                     const mnt4_ate_G2_precomp &prec_Q2)
+{
+    enter_block("Call to mnt4_ate_double_miller_loop");
+
+    mnt4_Fq2 L1_coeff1 = mnt4_Fq2(prec_P1.PX, mnt4_Fq::zero()) - prec_Q1.QX_over_twist;
+    mnt4_Fq2 L1_coeff2 = mnt4_Fq2(prec_P2.PX, mnt4_Fq::zero()) - prec_Q2.QX_over_twist;
+
+    mnt4_Fq4 f = mnt4_Fq4::one();
+
+    bool found_one = false;
+    size_t dbl_idx = 0;
+    size_t add_idx = 0;
+
+    const bigint<mnt4_Fr::num_limbs> &loop_count = mnt4_ate_loop_count;
+    for (long i = loop_count.max_bits() - 1; i >= 0; --i)
+    {
+        const bool bit = loop_count.test_bit(i);
+
+        if (!found_one)
+        {
+            /* this skips the MSB itself */
+            found_one |= bit;
+            continue;
+        }
+
+        /* code below gets executed for all bits (EXCEPT the MSB itself) of
+           mnt4_param_p (skipping leading zeros) in MSB to LSB
+           order */
+        mnt4_ate_dbl_coeffs dc1 = prec_Q1.dbl_coeffs[dbl_idx];
+        mnt4_ate_dbl_coeffs dc2 = prec_Q2.dbl_coeffs[dbl_idx];
+        ++dbl_idx;
+
+        mnt4_Fq4 g_RR_at_P1 = mnt4_Fq4(- dc1.c_4C - dc1.c_J * prec_P1.PX_twist + dc1.c_L,
+                                       dc1.c_H * prec_P1.PY_twist);
+
+        mnt4_Fq4 g_RR_at_P2 = mnt4_Fq4(- dc2.c_4C - dc2.c_J * prec_P2.PX_twist + dc2.c_L,
+                                       dc2.c_H * prec_P2.PY_twist);
+
+        f = f.squared() * g_RR_at_P1 * g_RR_at_P2;
+
+        if (bit)
+        {
+            mnt4_ate_add_coeffs ac1 = prec_Q1.add_coeffs[add_idx];
+            mnt4_ate_add_coeffs ac2 = prec_Q2.add_coeffs[add_idx];
+            ++add_idx;
+
+            mnt4_Fq4 g_RQ_at_P1 = mnt4_Fq4(ac1.c_RZ * prec_P1.PY_twist,
+                                           -(prec_Q1.QY_over_twist * ac1.c_RZ + L1_coeff1 * ac1.c_L1));
+            mnt4_Fq4 g_RQ_at_P2 = mnt4_Fq4(ac2.c_RZ * prec_P2.PY_twist,
+                                           -(prec_Q2.QY_over_twist * ac2.c_RZ + L1_coeff2 * ac2.c_L1));
+
+            f = f * g_RQ_at_P1 * g_RQ_at_P2;
+        }
+    }
+
+    if (mnt4_ate_is_loop_count_neg)
+    {
+    	mnt4_ate_add_coeffs ac1 = prec_Q1.add_coeffs[add_idx];
+        mnt4_ate_add_coeffs ac2 = prec_Q2.add_coeffs[add_idx];
+    	++add_idx;
+    	mnt4_Fq4 g_RnegR_at_P1 = mnt4_Fq4(ac1.c_RZ * prec_P1.PY_twist,
+                                          -(prec_Q1.QY_over_twist * ac1.c_RZ + L1_coeff1 * ac1.c_L1));
+    	mnt4_Fq4 g_RnegR_at_P2 = mnt4_Fq4(ac2.c_RZ * prec_P2.PY_twist,
+                                          -(prec_Q2.QY_over_twist * ac2.c_RZ + L1_coeff2 * ac2.c_L1));
+
+    	f = (f * g_RnegR_at_P1 * g_RnegR_at_P2).inverse();
+    }
+
+    leave_block("Call to mnt4_ate_double_miller_loop");
+
+    return f;
+}
+
+mnt4_Fq4 mnt4_ate_pairing(const mnt4_G1& P, const mnt4_G2 &Q)
+{
+    enter_block("Call to mnt4_ate_pairing");
+    mnt4_ate_G1_precomp prec_P = mnt4_ate_precompute_G1(P);
+    mnt4_ate_G2_precomp prec_Q = mnt4_ate_precompute_G2(Q);
+    mnt4_Fq4 result = mnt4_ate_miller_loop(prec_P, prec_Q);
+    leave_block("Call to mnt4_ate_pairing");
+    return result;
+}
+
+mnt4_GT mnt4_ate_reduced_pairing(const mnt4_G1 &P, const mnt4_G2 &Q)
+{
+    enter_block("Call to mnt4_ate_reduced_pairing");
+    const mnt4_Fq4 f = mnt4_ate_pairing(P, Q);
+    const mnt4_GT result = mnt4_final_exponentiation(f);
+    leave_block("Call to mnt4_ate_reduced_pairing");
+    return result;
+}
+
+mnt4_G1_precomp mnt4_precompute_G1(const mnt4_G1& P)
+{
+    return mnt4_ate_precompute_G1(P);
+}
+
+mnt4_G2_precomp mnt4_precompute_G2(const mnt4_G2& Q)
+{
+    return mnt4_ate_precompute_G2(Q);
+}
+
+mnt4_Fq4 mnt4_miller_loop(const mnt4_G1_precomp &prec_P,
+                          const mnt4_G2_precomp &prec_Q)
+{
+    return mnt4_ate_miller_loop(prec_P, prec_Q);
+}
+
+mnt4_Fq4 mnt4_double_miller_loop(const mnt4_G1_precomp &prec_P1,
+                                 const mnt4_G2_precomp &prec_Q1,
+                                 const mnt4_G1_precomp &prec_P2,
+                                 const mnt4_G2_precomp &prec_Q2)
+{
+    return mnt4_ate_double_miller_loop(prec_P1, prec_Q1, prec_P2, prec_Q2);
+}
+
+mnt4_Fq4 mnt4_pairing(const mnt4_G1& P,
+                      const mnt4_G2 &Q)
+{
+    return mnt4_ate_pairing(P, Q);
+}
+
+mnt4_GT mnt4_reduced_pairing(const mnt4_G1 &P,
+                             const mnt4_G2 &Q)
+{
+    return mnt4_ate_reduced_pairing(P, Q);
+}
+
+mnt4_GT mnt4_affine_reduced_pairing(const mnt4_G1 &P,
+                                    const mnt4_G2 &Q)
+{
+    const mnt4_affine_ate_G1_precomputation prec_P = mnt4_affine_ate_precompute_G1(P);
+    const mnt4_affine_ate_G2_precomputation prec_Q = mnt4_affine_ate_precompute_G2(Q);
+    const mnt4_Fq4 f = mnt4_affine_ate_miller_loop(prec_P, prec_Q);
+    const mnt4_GT result = mnt4_final_exponentiation(f);
+    return result;
+}
+
+} // libff
diff --git a/src/libff/libff/algebra/curves/mnt/mnt4/mnt4_pairing.hpp b/src/libff/libff/algebra/curves/mnt/mnt4/mnt4_pairing.hpp
new file mode 100755
index 000000000..827411b0f
--- /dev/null
+++ b/src/libff/libff/algebra/curves/mnt/mnt4/mnt4_pairing.hpp
@@ -0,0 +1,148 @@
+/** @file
+ *****************************************************************************
+
+ Declaration of interfaces for pairing operations on MNT4.
+
+ *****************************************************************************
+ * @author     This file is part of libff, developed by SCIPR Lab
+ *             and contributors (see AUTHORS).
+ * @copyright  MIT license (see LICENSE file)
+ *****************************************************************************/
+
+#ifndef MNT4_PAIRING_HPP_
+#define MNT4_PAIRING_HPP_
+
+#include <vector>
+
+#include <libff/algebra/curves/mnt/mnt4/mnt4_init.hpp>
+
+namespace libff {
+
+/* final exponentiation */
+
+mnt4_Fq4 mnt4_final_exponentiation_last_chunk(const mnt4_Fq4 &elt,
+                                              const mnt4_Fq4 &elt_inv);
+mnt4_Fq4 mnt4_final_exponentiation_first_chunk(const mnt4_Fq4 &elt,
+                                               const mnt4_Fq4 &elt_inv);
+mnt4_GT mnt4_final_exponentiation(const mnt4_Fq4 &elt);
+
+/* affine ate miller loop */
+
+struct mnt4_affine_ate_G1_precomputation {
+    mnt4_Fq PX;
+    mnt4_Fq PY;
+    mnt4_Fq2 PY_twist_squared;
+};
+
+struct mnt4_affine_ate_coeffs {
+    // TODO: trim (not all of them are needed)
+    mnt4_Fq2 old_RX;
+    mnt4_Fq2 old_RY;
+    mnt4_Fq2 gamma;
+    mnt4_Fq2 gamma_twist;
+    mnt4_Fq2 gamma_X;
+};
+
+struct mnt4_affine_ate_G2_precomputation {
+    mnt4_Fq2 QX;
+    mnt4_Fq2 QY;
+    std::vector<mnt4_affine_ate_coeffs> coeffs;
+};
+
+mnt4_affine_ate_G1_precomputation mnt4_affine_ate_precompute_G1(const mnt4_G1& P);
+mnt4_affine_ate_G2_precomputation mnt4_affine_ate_precompute_G2(const mnt4_G2& Q);
+
+mnt4_Fq4 mnt4_affine_ate_miller_loop(const mnt4_affine_ate_G1_precomputation &prec_P,
+                                     const mnt4_affine_ate_G2_precomputation &prec_Q);
+
+/* ate pairing */
+
+struct mnt4_ate_G1_precomp {
+    mnt4_Fq PX;
+    mnt4_Fq PY;
+    mnt4_Fq2 PX_twist;
+    mnt4_Fq2 PY_twist;
+
+    bool operator==(const mnt4_ate_G1_precomp &other) const;
+    friend std::ostream& operator<<(std::ostream &out, const mnt4_ate_G1_precomp &prec_P);
+    friend std::istream& operator>>(std::istream &in, mnt4_ate_G1_precomp &prec_P);
+};
+
+struct mnt4_ate_dbl_coeffs {
+    mnt4_Fq2 c_H;
+    mnt4_Fq2 c_4C;
+    mnt4_Fq2 c_J;
+    mnt4_Fq2 c_L;
+
+    bool operator==(const mnt4_ate_dbl_coeffs &other) const;
+    friend std::ostream& operator<<(std::ostream &out, const mnt4_ate_dbl_coeffs &dc);
+    friend std::istream& operator>>(std::istream &in, mnt4_ate_dbl_coeffs &dc);
+};
+
+struct mnt4_ate_add_coeffs {
+    mnt4_Fq2 c_L1;
+    mnt4_Fq2 c_RZ;
+
+    bool operator==(const mnt4_ate_add_coeffs &other) const;
+    friend std::ostream& operator<<(std::ostream &out, const mnt4_ate_add_coeffs &dc);
+    friend std::istream& operator>>(std::istream &in, mnt4_ate_add_coeffs &dc);
+};
+
+struct mnt4_ate_G2_precomp {
+    mnt4_Fq2 QX;
+    mnt4_Fq2 QY;
+    mnt4_Fq2 QY2;
+    mnt4_Fq2 QX_over_twist;
+    mnt4_Fq2 QY_over_twist;
+    std::vector<mnt4_ate_dbl_coeffs> dbl_coeffs;
+    std::vector<mnt4_ate_add_coeffs> add_coeffs;
+
+    bool operator==(const mnt4_ate_G2_precomp &other) const;
+    friend std::ostream& operator<<(std::ostream &out, const mnt4_ate_G2_precomp &prec_Q);
+    friend std::istream& operator>>(std::istream &in, mnt4_ate_G2_precomp &prec_Q);
+};
+
+mnt4_ate_G1_precomp mnt4_ate_precompute_G1(const mnt4_G1& P);
+mnt4_ate_G2_precomp mnt4_ate_precompute_G2(const mnt4_G2& Q);
+
+mnt4_Fq4 mnt4_ate_miller_loop(const mnt4_ate_G1_precomp &prec_P,
+                                    const mnt4_ate_G2_precomp &prec_Q);
+mnt4_Fq4 mnt4_ate_double_miller_loop(const mnt4_ate_G1_precomp &prec_P1,
+                                           const mnt4_ate_G2_precomp &prec_Q1,
+                                           const mnt4_ate_G1_precomp &prec_P2,
+                                           const mnt4_ate_G2_precomp &prec_Q2);
+
+mnt4_Fq4 mnt4_ate_pairing(const mnt4_G1& P,
+                          const mnt4_G2 &Q);
+mnt4_GT mnt4_ate_reduced_pairing(const mnt4_G1 &P,
+                                 const mnt4_G2 &Q);
+
+/* choice of pairing */
+
+typedef mnt4_ate_G1_precomp mnt4_G1_precomp;
+typedef mnt4_ate_G2_precomp mnt4_G2_precomp;
+
+mnt4_G1_precomp mnt4_precompute_G1(const mnt4_G1& P);
+
+mnt4_G2_precomp mnt4_precompute_G2(const mnt4_G2& Q);
+
+mnt4_Fq4 mnt4_miller_loop(const mnt4_G1_precomp &prec_P,
+                          const mnt4_G2_precomp &prec_Q);
+
+mnt4_Fq4 mnt4_double_miller_loop(const mnt4_G1_precomp &prec_P1,
+                                 const mnt4_G2_precomp &prec_Q1,
+                                 const mnt4_G1_precomp &prec_P2,
+                                 const mnt4_G2_precomp &prec_Q2);
+
+mnt4_Fq4 mnt4_pairing(const mnt4_G1& P,
+                      const mnt4_G2 &Q);
+
+mnt4_GT mnt4_reduced_pairing(const mnt4_G1 &P,
+                             const mnt4_G2 &Q);
+
+mnt4_GT mnt4_affine_reduced_pairing(const mnt4_G1 &P,
+                                    const mnt4_G2 &Q);
+
+} // libff
+
+#endif // MNT4_PAIRING_HPP_
diff --git a/src/libff/libff/algebra/curves/mnt/mnt4/mnt4_pp.cpp b/src/libff/libff/algebra/curves/mnt/mnt4/mnt4_pp.cpp
new file mode 100755
index 000000000..5d589f3ac
--- /dev/null
+++ b/src/libff/libff/algebra/curves/mnt/mnt4/mnt4_pp.cpp
@@ -0,0 +1,105 @@
+/** @file
+ *****************************************************************************
+
+ Implementation of interfaces for public parameters of MNT4.
+
+ See mnt4_pp.hpp .
+
+ *****************************************************************************
+ * @author     This file is part of libff, developed by SCIPR Lab
+ *             and contributors (see AUTHORS).
+ * @copyright  MIT license (see LICENSE file)
+ *****************************************************************************/
+
+#include <libff/algebra/curves/mnt/mnt4/mnt4_pp.hpp>
+
+namespace libff {
+
+void mnt4_pp::init_public_params()
+{
+    init_mnt4_params();
+}
+
+mnt4_GT mnt4_pp::final_exponentiation(const mnt4_Fq4 &elt)
+{
+    return mnt4_final_exponentiation(elt);
+}
+
+mnt4_G1_precomp mnt4_pp::precompute_G1(const mnt4_G1 &P)
+{
+    return mnt4_precompute_G1(P);
+}
+
+mnt4_G2_precomp mnt4_pp::precompute_G2(const mnt4_G2 &Q)
+{
+    return mnt4_precompute_G2(Q);
+}
+
+mnt4_Fq4 mnt4_pp::miller_loop(const mnt4_G1_precomp &prec_P,
+                              const mnt4_G2_precomp &prec_Q)
+{
+    return mnt4_miller_loop(prec_P, prec_Q);
+}
+
+mnt4_affine_ate_G1_precomputation mnt4_pp::affine_ate_precompute_G1(const mnt4_G1 &P)
+{
+    return mnt4_affine_ate_precompute_G1(P);
+}
+
+mnt4_affine_ate_G2_precomputation mnt4_pp::affine_ate_precompute_G2(const mnt4_G2 &Q)
+{
+    return mnt4_affine_ate_precompute_G2(Q);
+}
+
+mnt4_Fq4 mnt4_pp::affine_ate_miller_loop(const mnt4_affine_ate_G1_precomputation &prec_P,
+                                         const mnt4_affine_ate_G2_precomputation &prec_Q)
+{
+    return mnt4_affine_ate_miller_loop(prec_P, prec_Q);
+}
+
+mnt4_Fq4 mnt4_pp::affine_ate_e_over_e_miller_loop(const mnt4_affine_ate_G1_precomputation &prec_P1,
+                                                  const mnt4_affine_ate_G2_precomputation &prec_Q1,
+                                                  const mnt4_affine_ate_G1_precomputation &prec_P2,
+                                                  const mnt4_affine_ate_G2_precomputation &prec_Q2)
+{
+    return mnt4_affine_ate_miller_loop(prec_P1, prec_Q1) * mnt4_affine_ate_miller_loop(prec_P2, prec_Q2).unitary_inverse();
+}
+
+mnt4_Fq4 mnt4_pp::affine_ate_e_times_e_over_e_miller_loop(const mnt4_affine_ate_G1_precomputation &prec_P1,
+                                                          const mnt4_affine_ate_G2_precomputation &prec_Q1,
+                                                          const mnt4_affine_ate_G1_precomputation &prec_P2,
+                                                          const mnt4_affine_ate_G2_precomputation &prec_Q2,
+                                                          const mnt4_affine_ate_G1_precomputation &prec_P3,
+                                                          const mnt4_affine_ate_G2_precomputation &prec_Q3)
+{
+    return ((mnt4_affine_ate_miller_loop(prec_P1, prec_Q1) * mnt4_affine_ate_miller_loop(prec_P2, prec_Q2)) *
+            mnt4_affine_ate_miller_loop(prec_P3, prec_Q3).unitary_inverse());
+}
+
+mnt4_Fq4 mnt4_pp::double_miller_loop(const mnt4_G1_precomp &prec_P1,
+                                     const mnt4_G2_precomp &prec_Q1,
+                                     const mnt4_G1_precomp &prec_P2,
+                                     const mnt4_G2_precomp &prec_Q2)
+{
+    return mnt4_double_miller_loop(prec_P1, prec_Q1, prec_P2, prec_Q2);
+}
+
+mnt4_Fq4 mnt4_pp::pairing(const mnt4_G1 &P,
+                          const mnt4_G2 &Q)
+{
+    return mnt4_pairing(P, Q);
+}
+
+mnt4_Fq4 mnt4_pp::reduced_pairing(const mnt4_G1 &P,
+                                  const mnt4_G2 &Q)
+{
+    return mnt4_reduced_pairing(P, Q);
+}
+
+mnt4_Fq4 mnt4_pp::affine_reduced_pairing(const mnt4_G1 &P,
+                                         const mnt4_G2 &Q)
+{
+    return mnt4_affine_reduced_pairing(P, Q);
+}
+
+} // libff
diff --git a/src/libff/libff/algebra/curves/mnt/mnt4/mnt4_pp.hpp b/src/libff/libff/algebra/curves/mnt/mnt4/mnt4_pp.hpp
new file mode 100755
index 000000000..438cb122f
--- /dev/null
+++ b/src/libff/libff/algebra/curves/mnt/mnt4/mnt4_pp.hpp
@@ -0,0 +1,80 @@
+/** @file
+ *****************************************************************************
+
+ Declaration of interfaces for public parameters of MNT4.
+
+ *****************************************************************************
+ * @author     This file is part of libff, developed by SCIPR Lab
+ *             and contributors (see AUTHORS).
+ * @copyright  MIT license (see LICENSE file)
+ *****************************************************************************/
+
+#ifndef MNT4_PP_HPP_
+#define MNT4_PP_HPP_
+
+#include <libff/algebra/curves/mnt/mnt4/mnt4_g1.hpp>
+#include <libff/algebra/curves/mnt/mnt4/mnt4_g2.hpp>
+#include <libff/algebra/curves/mnt/mnt4/mnt4_init.hpp>
+#include <libff/algebra/curves/mnt/mnt4/mnt4_pairing.hpp>
+#include <libff/algebra/curves/public_params.hpp>
+
+namespace libff {
+
+class mnt4_pp {
+public:
+    typedef mnt4_Fr Fp_type;
+    typedef mnt4_G1 G1_type;
+    typedef mnt4_G2 G2_type;
+    typedef mnt4_G1_precomp G1_precomp_type;
+    typedef mnt4_G2_precomp G2_precomp_type;
+    typedef mnt4_affine_ate_G1_precomputation affine_ate_G1_precomp_type;
+    typedef mnt4_affine_ate_G2_precomputation affine_ate_G2_precomp_type;
+    typedef mnt4_Fq Fq_type;
+    typedef mnt4_Fq2 Fqe_type;
+    typedef mnt4_Fq4 Fqk_type;
+    typedef mnt4_GT GT_type;
+
+    static const bool has_affine_pairing = true;
+
+    static void init_public_params();
+    static mnt4_GT final_exponentiation(const mnt4_Fq4 &elt);
+
+    static mnt4_G1_precomp precompute_G1(const mnt4_G1 &P);
+    static mnt4_G2_precomp precompute_G2(const mnt4_G2 &Q);
+
+    static mnt4_Fq4 miller_loop(const mnt4_G1_precomp &prec_P,
+                                const mnt4_G2_precomp &prec_Q);
+
+    static mnt4_affine_ate_G1_precomputation affine_ate_precompute_G1(const mnt4_G1 &P);
+    static mnt4_affine_ate_G2_precomputation affine_ate_precompute_G2(const mnt4_G2 &Q);
+    static mnt4_Fq4 affine_ate_miller_loop(const mnt4_affine_ate_G1_precomputation &prec_P,
+                                           const mnt4_affine_ate_G2_precomputation &prec_Q);
+
+    static mnt4_Fq4 affine_ate_e_over_e_miller_loop(const mnt4_affine_ate_G1_precomputation &prec_P1,
+                                                    const mnt4_affine_ate_G2_precomputation &prec_Q1,
+                                                    const mnt4_affine_ate_G1_precomputation &prec_P2,
+                                                    const mnt4_affine_ate_G2_precomputation &prec_Q2);
+    static mnt4_Fq4 affine_ate_e_times_e_over_e_miller_loop(const mnt4_affine_ate_G1_precomputation &prec_P1,
+                                                            const mnt4_affine_ate_G2_precomputation &prec_Q1,
+                                                            const mnt4_affine_ate_G1_precomputation &prec_P2,
+                                                            const mnt4_affine_ate_G2_precomputation &prec_Q2,
+                                                            const mnt4_affine_ate_G1_precomputation &prec_P3,
+                                                            const mnt4_affine_ate_G2_precomputation &prec_Q3);
+
+    static mnt4_Fq4 double_miller_loop(const mnt4_G1_precomp &prec_P1,
+                                       const mnt4_G2_precomp &prec_Q1,
+                                       const mnt4_G1_precomp &prec_P2,
+                                       const mnt4_G2_precomp &prec_Q2);
+
+    /* the following are used in test files */
+    static mnt4_Fq4 pairing(const mnt4_G1 &P,
+                            const mnt4_G2 &Q);
+    static mnt4_Fq4 reduced_pairing(const mnt4_G1 &P,
+                                    const mnt4_G2 &Q);
+    static mnt4_Fq4 affine_reduced_pairing(const mnt4_G1 &P,
+                                           const mnt4_G2 &Q);
+};
+
+} // libff
+
+#endif // MNT4_PP_HPP_
diff --git a/src/libff/libff/algebra/curves/mnt/mnt46_common.cpp b/src/libff/libff/algebra/curves/mnt/mnt46_common.cpp
new file mode 100755
index 000000000..e28898550
--- /dev/null
+++ b/src/libff/libff/algebra/curves/mnt/mnt46_common.cpp
@@ -0,0 +1,21 @@
+/** @file
+ *****************************************************************************
+
+ Implementation of functionality that is shared among MNT curves.
+
+ See mnt46_common.hpp .
+
+ *****************************************************************************
+ * @author     This file is part of libff, developed by SCIPR Lab
+ *             and contributors (see AUTHORS).
+ * @copyright  MIT license (see LICENSE file)
+ *****************************************************************************/
+
+#include <libff/algebra/curves/mnt/mnt46_common.hpp>
+
+namespace libff {
+
+bigint<mnt46_A_limbs> mnt46_modulus_A;
+bigint<mnt46_B_limbs> mnt46_modulus_B;
+
+} // libff
diff --git a/src/libff/libff/algebra/curves/mnt/mnt46_common.hpp b/src/libff/libff/algebra/curves/mnt/mnt46_common.hpp
new file mode 100755
index 000000000..2029fe89c
--- /dev/null
+++ b/src/libff/libff/algebra/curves/mnt/mnt46_common.hpp
@@ -0,0 +1,30 @@
+/** @file
+ *****************************************************************************
+
+ Declaration of functionality that is shared among MNT curves.
+
+ *****************************************************************************
+ * @author     This file is part of libff, developed by SCIPR Lab
+ *             and contributors (see AUTHORS).
+ * @copyright  MIT license (see LICENSE file)
+ *****************************************************************************/
+
+#ifndef MNT46_COMMON_HPP_
+#define MNT46_COMMON_HPP_
+
+#include <libff/algebra/fields/bigint.hpp>
+
+namespace libff {
+
+const mp_size_t mnt46_A_bitcount = 298;
+const mp_size_t mnt46_B_bitcount = 298;
+
+const mp_size_t mnt46_A_limbs = (mnt46_A_bitcount+GMP_NUMB_BITS-1)/GMP_NUMB_BITS;
+const mp_size_t mnt46_B_limbs = (mnt46_B_bitcount+GMP_NUMB_BITS-1)/GMP_NUMB_BITS;
+
+extern bigint<mnt46_A_limbs> mnt46_modulus_A;
+extern bigint<mnt46_B_limbs> mnt46_modulus_B;
+
+} // libff
+
+#endif
diff --git a/src/libff/libff/algebra/curves/mnt/mnt6/mnt6_g1.cpp b/src/libff/libff/algebra/curves/mnt/mnt6/mnt6_g1.cpp
new file mode 100755
index 000000000..aea73e4db
--- /dev/null
+++ b/src/libff/libff/algebra/curves/mnt/mnt6/mnt6_g1.cpp
@@ -0,0 +1,503 @@
+/** @file
+ *****************************************************************************
+
+ Implementation of interfaces for the MNT6 G1 group.
+
+ See mnt6_g1.hpp .
+
+ *****************************************************************************
+ * @author     This file is part of libff, developed by SCIPR Lab
+ *             and contributors (see AUTHORS).
+ * @copyright  MIT license (see LICENSE file)
+ *****************************************************************************/
+
+#include <libff/algebra/curves/mnt/mnt6/mnt6_g1.hpp>
+
+namespace libff {
+
+#ifdef PROFILE_OP_COUNTS
+long long mnt6_G1::add_cnt = 0;
+long long mnt6_G1::dbl_cnt = 0;
+#endif
+
+std::vector<size_t> mnt6_G1::wnaf_window_table;
+std::vector<size_t> mnt6_G1::fixed_base_exp_window_table;
+mnt6_G1 mnt6_G1::G1_zero;
+mnt6_G1 mnt6_G1::G1_one;
+mnt6_Fq mnt6_G1::coeff_a;
+mnt6_Fq mnt6_G1::coeff_b;
+
+mnt6_G1::mnt6_G1()
+{
+    this->X_ = G1_zero.X_;
+    this->Y_ = G1_zero.Y_;
+    this->Z_ = G1_zero.Z_;
+}
+
+void mnt6_G1::print() const
+{
+    if (this->is_zero())
+    {
+        printf("O\n");
+    }
+    else
+    {
+        mnt6_G1 copy(*this);
+        copy.to_affine_coordinates();
+        gmp_printf("(%Nd , %Nd)\n",
+                   copy.X_.as_bigint().data, mnt6_Fq::num_limbs,
+                   copy.Y_.as_bigint().data, mnt6_Fq::num_limbs);
+    }
+}
+
+void mnt6_G1::print_coordinates() const
+{
+    if (this->is_zero())
+    {
+        printf("O\n");
+    }
+    else
+    {
+        gmp_printf("(%Nd : %Nd : %Nd)\n",
+                   this->X_.as_bigint().data, mnt6_Fq::num_limbs,
+                   this->Y_.as_bigint().data, mnt6_Fq::num_limbs,
+                   this->Z_.as_bigint().data, mnt6_Fq::num_limbs);
+    }
+}
+
+void mnt6_G1::to_affine_coordinates()
+{
+    if (this->is_zero())
+    {
+        this->X_ = mnt6_Fq::zero();
+        this->Y_ = mnt6_Fq::one();
+        this->Z_ = mnt6_Fq::zero();
+    }
+    else
+    {
+        const mnt6_Fq Z_inv = Z_.inverse();
+        this->X_ = this->X_ * Z_inv;
+        this->Y_ = this->Y_ * Z_inv;
+        this->Z_ = mnt6_Fq::one();
+    }
+}
+
+void mnt6_G1::to_special()
+{
+    this->to_affine_coordinates();
+}
+
+bool mnt6_G1::is_special() const
+{
+    return (this->is_zero() || this->Z_ == mnt6_Fq::one());
+}
+
+bool mnt6_G1::is_zero() const
+{
+    return (this->X_.is_zero() && this->Z_.is_zero());
+}
+
+bool mnt6_G1::operator==(const mnt6_G1 &other) const
+{
+    if (this->is_zero())
+    {
+        return other.is_zero();
+    }
+
+    if (other.is_zero())
+    {
+        return false;
+    }
+
+    /* now neither is O */
+
+    // X1/Z1 = X2/Z2 <=> X1*Z2 = X2*Z1
+    if ((this->X_ * other.Z_) != (other.X_ * this->Z_))
+    {
+        return false;
+    }
+
+    // Y1/Z1 = Y2/Z2 <=> Y1*Z2 = Y2*Z1
+    if ((this->Y_ * other.Z_) != (other.Y_ * this->Z_))
+    {
+        return false;
+    }
+
+    return true;
+}
+
+bool mnt6_G1::operator!=(const mnt6_G1& other) const
+{
+    return !(operator==(other));
+}
+
+mnt6_G1 mnt6_G1::operator+(const mnt6_G1 &other) const
+{
+    // handle special cases having to do with O
+    if (this->is_zero())
+    {
+        return other;
+    }
+
+    if (other.is_zero())
+    {
+        return *this;
+    }
+
+    // no need to handle points of order 2,4
+    // (they cannot exist in a prime-order subgroup)
+
+    // handle double case, and then all the rest
+    /*
+      The code below is equivalent to (but faster than) the snippet below:
+
+      if (this->operator==(other))
+      {
+      return this->dbl();
+      }
+      else
+      {
+      return this->add(other);
+      }
+    */
+
+    const mnt6_Fq X1Z2 = (this->X_) * (other.Z_);        // X1Z2 = X1*Z2
+    const mnt6_Fq X2Z1 = (this->Z_) * (other.X_);        // X2Z1 = X2*Z1
+
+    // (used both in add and double checks)
+
+    const mnt6_Fq Y1Z2 = (this->Y_) * (other.Z_);        // Y1Z2 = Y1*Z2
+    const mnt6_Fq Y2Z1 = (this->Z_) * (other.Y_);        // Y2Z1 = Y2*Z1
+
+    if (X1Z2 == X2Z1 && Y1Z2 == Y2Z1)
+    {
+        // perform dbl case
+        const mnt6_Fq XX   = (this->X_).squared();                   // XX  = X1^2
+        const mnt6_Fq ZZ   = (this->Z_).squared();                   // ZZ  = Z1^2
+        const mnt6_Fq w    = mnt6_G1::coeff_a * ZZ + (XX + XX + XX); // w   = a*ZZ + 3*XX
+        const mnt6_Fq Y1Z1 = (this->Y_) * (this->Z_);
+        const mnt6_Fq s    = Y1Z1 + Y1Z1;                            // s   = 2*Y1*Z1
+        const mnt6_Fq ss   = s.squared();                            // ss  = s^2
+        const mnt6_Fq sss  = s * ss;                                 // sss = s*ss
+        const mnt6_Fq R    = (this->Y_) * s;                         // R   = Y1*s
+        const mnt6_Fq RR   = R.squared();                            // RR  = R^2
+        const mnt6_Fq B    = ((this->X_)+R).squared()-XX-RR;         // B   = (X1+R)^2 - XX - RR
+        const mnt6_Fq h    = w.squared() - (B+B);                    // h   = w^2 - 2*B
+        const mnt6_Fq X3   = h * s;                                  // X3  = h*s
+        const mnt6_Fq Y3   = w * (B-h)-(RR+RR);                      // Y3  = w*(B-h) - 2*RR
+        const mnt6_Fq Z3   = sss;                                    // Z3  = sss
+
+        return mnt6_G1(X3, Y3, Z3);
+    }
+
+    // if we have arrived here we are in the add case
+    const mnt6_Fq Z1Z2 = (this->Z_) * (other.Z_);      // Z1Z2 = Z1*Z2
+    const mnt6_Fq u    = Y2Z1 - Y1Z2;                  // u    = Y2*Z1-Y1Z2
+    const mnt6_Fq uu   = u.squared();                  // uu   = u^2
+    const mnt6_Fq v    = X2Z1 - X1Z2;                  // v    = X2*Z1-X1Z2
+    const mnt6_Fq vv   = v.squared();                  // vv   = v^2
+    const mnt6_Fq vvv  = v * vv;                       // vvv  = v*vv
+    const mnt6_Fq R    = vv * X1Z2;                    // R    = vv*X1Z2
+    const mnt6_Fq A    = uu * Z1Z2 - (vvv + R + R);    // A    = uu*Z1Z2 - vvv - 2*R
+    const mnt6_Fq X3   = v * A;                        // X3   = v*A
+    const mnt6_Fq Y3   = u * (R-A) - vvv * Y1Z2;       // Y3   = u*(R-A) - vvv*Y1Z2
+    const mnt6_Fq Z3   = vvv * Z1Z2;                   // Z3   = vvv*Z1Z2
+
+    return mnt6_G1(X3, Y3, Z3);
+}
+
+mnt6_G1 mnt6_G1::operator-() const
+{
+    return mnt6_G1(this->X_, -(this->Y_), this->Z_);
+}
+
+
+mnt6_G1 mnt6_G1::operator-(const mnt6_G1 &other) const
+{
+    return (*this) + (-other);
+}
+
+mnt6_G1 mnt6_G1::add(const mnt6_G1 &other) const
+{
+    // handle special cases having to do with O
+    if (this->is_zero())
+    {
+        return other;
+    }
+
+    if (other.is_zero())
+    {
+        return (*this);
+    }
+
+    // no need to handle points of order 2,4
+    // (they cannot exist in a prime-order subgroup)
+
+    // handle double case
+    if (this->operator==(other))
+    {
+        return this->dbl();
+    }
+
+#ifdef PROFILE_OP_COUNTS
+    this->add_cnt++;
+#endif
+    // NOTE: does not handle O and pts of order 2,4
+    // http://www.hyperelliptic.org/EFD/g1p/auto-shortw-projective.html#addition-add-1998-cmo-2
+
+    const mnt6_Fq Y1Z2 = (this->Y_) * (other.Z_);        // Y1Z2 = Y1*Z2
+    const mnt6_Fq X1Z2 = (this->X_) * (other.Z_);        // X1Z2 = X1*Z2
+    const mnt6_Fq Z1Z2 = (this->Z_) * (other.Z_);        // Z1Z2 = Z1*Z2
+    const mnt6_Fq u    = (other.Y_) * (this->Z_) - Y1Z2; // u    = Y2*Z1-Y1Z2
+    const mnt6_Fq uu   = u.squared();                    // uu   = u^2
+    const mnt6_Fq v    = (other.X_) * (this->Z_) - X1Z2; // v    = X2*Z1-X1Z2
+    const mnt6_Fq vv   = v.squared();                    // vv   = v^2
+    const mnt6_Fq vvv  = v * vv;                         // vvv  = v*vv
+    const mnt6_Fq R    = vv * X1Z2;                      // R    = vv*X1Z2
+    const mnt6_Fq A    = uu * Z1Z2 - (vvv + R + R);      // A    = uu*Z1Z2 - vvv - 2*R
+    const mnt6_Fq X3   = v * A;                          // X3   = v*A
+    const mnt6_Fq Y3   = u * (R-A) - vvv * Y1Z2;         // Y3   = u*(R-A) - vvv*Y1Z2
+    const mnt6_Fq Z3   = vvv * Z1Z2;                     // Z3   = vvv*Z1Z2
+
+    return mnt6_G1(X3, Y3, Z3);
+}
+
+mnt6_G1 mnt6_G1::mixed_add(const mnt6_G1 &other) const
+{
+#ifdef PROFILE_OP_COUNTS
+    this->add_cnt++;
+#endif
+    // NOTE: does not handle O and pts of order 2,4
+    // http://www.hyperelliptic.org/EFD/g1p/auto-shortw-projective.html#addition-add-1998-cmo-2
+    //assert(other.Z == mnt6_Fq::one());
+
+    if (this->is_zero())
+    {
+        return other;
+    }
+
+    if (other.is_zero())
+    {
+        return (*this);
+    }
+
+#ifdef DEBUG
+    assert(other.is_special());
+#endif
+
+    const mnt6_Fq &X1Z2 = (this->X_);                    // X1Z2 = X1*Z2 (but other is special and not zero)
+    const mnt6_Fq X2Z1 = (this->Z_) * (other.X_);        // X2Z1 = X2*Z1
+
+    // (used both in add and double checks)
+
+    const mnt6_Fq &Y1Z2 = (this->Y_);                    // Y1Z2 = Y1*Z2 (but other is special and not zero)
+    const mnt6_Fq Y2Z1 = (this->Z_) * (other.Y_);        // Y2Z1 = Y2*Z1
+
+    if (X1Z2 == X2Z1 && Y1Z2 == Y2Z1)
+    {
+        return this->dbl();
+    }
+
+    mnt6_Fq u = Y2Z1 - this->Y_;             // u = Y2*Z1-Y1
+    mnt6_Fq uu = u.squared();                // uu = u2
+    mnt6_Fq v = X2Z1 - this->X_;             // v = X2*Z1-X1
+    mnt6_Fq vv = v.squared();                // vv = v2
+    mnt6_Fq vvv = v*vv;                      // vvv = v*vv
+    mnt6_Fq R = vv * this->X_;               // R = vv*X1
+    mnt6_Fq A = uu * this->Z_ - vvv - R - R; // A = uu*Z1-vvv-2*R
+    mnt6_Fq X3 = v * A;                      // X3 = v*A
+    mnt6_Fq Y3 = u*(R-A) - vvv * this->Y_;   // Y3 = u*(R-A)-vvv*Y1
+    mnt6_Fq Z3 = vvv * this->Z_;             // Z3 = vvv*Z1
+
+    return mnt6_G1(X3, Y3, Z3);
+}
+
+mnt6_G1 mnt6_G1::dbl() const
+{
+#ifdef PROFILE_OP_COUNTS
+    this->dbl_cnt++;
+#endif
+    if (this->is_zero())
+    {
+        return (*this);
+    }
+    else
+    {
+        // NOTE: does not handle O and pts of order 2,4
+        // http://www.hyperelliptic.org/EFD/g1p/auto-shortw-projective.html#doubling-dbl-2007-bl
+
+        const mnt6_Fq XX   = (this->X_).squared();                   // XX  = X1^2
+        const mnt6_Fq ZZ   = (this->Z_).squared();                   // ZZ  = Z1^2
+        const mnt6_Fq w    = mnt6_G1::coeff_a * ZZ + (XX + XX + XX); // w   = a*ZZ + 3*XX
+        const mnt6_Fq Y1Z1 = (this->Y_) * (this->Z_);
+        const mnt6_Fq s    = Y1Z1 + Y1Z1;                            // s   = 2*Y1*Z1
+        const mnt6_Fq ss   = s.squared();                            // ss  = s^2
+        const mnt6_Fq sss  = s * ss;                                 // sss = s*ss
+        const mnt6_Fq R    = (this->Y_) * s;                         // R   = Y1*s
+        const mnt6_Fq RR   = R.squared();                            // RR  = R^2
+        const mnt6_Fq B    = ((this->X_)+R).squared()-XX-RR;         // B   = (X1+R)^2 - XX - RR
+        const mnt6_Fq h    = w.squared() - (B+B);                    // h   = w^2 - 2*B
+        const mnt6_Fq X3   = h * s;                                  // X3  = h*s
+        const mnt6_Fq Y3   = w * (B-h)-(RR+RR);                      // Y3  = w*(B-h) - 2*RR
+        const mnt6_Fq Z3   = sss;                                    // Z3  = sss
+
+        return mnt6_G1(X3, Y3, Z3);
+    }
+}
+
+bool mnt6_G1::is_well_formed() const
+{
+    if (this->is_zero())
+    {
+        return true;
+    }
+    else
+    {
+        /*
+          y^2 = x^3 + ax + b
+
+          We are using projective, so equation we need to check is actually
+
+          (y/z)^2 = (x/z)^3 + a (x/z) + b
+          z y^2 = x^3  + a z^2 x + b z^3
+
+          z (y^2 - b z^2) = x ( x^2 + a z^2)
+        */
+        const mnt6_Fq X2 = this->X_.squared();
+        const mnt6_Fq Y2 = this->Y_.squared();
+        const mnt6_Fq Z2 = this->Z_.squared();
+
+        return (this->Z_ * (Y2 - mnt6_G1::coeff_b * Z2) == this->X_ * (X2 + mnt6_G1::coeff_a * Z2));
+    }
+}
+
+mnt6_G1 mnt6_G1::zero()
+{
+    return G1_zero;
+}
+
+mnt6_G1 mnt6_G1::one()
+{
+    return G1_one;
+}
+
+mnt6_G1 mnt6_G1::random_element()
+{
+    return (scalar_field::random_element().as_bigint()) * G1_one;
+}
+
+std::ostream& operator<<(std::ostream &out, const mnt6_G1 &g)
+{
+    mnt6_G1 copy(g);
+    copy.to_affine_coordinates();
+
+    out << (copy.is_zero() ? 1 : 0) << OUTPUT_SEPARATOR;
+#ifdef NO_PT_COMPRESSION
+    out << copy.X_ << OUTPUT_SEPARATOR << copy.Y_;
+#else
+    /* storing LSB of Y */
+    out << copy.X_ << OUTPUT_SEPARATOR << (copy.Y_.as_bigint().data[0] & 1);
+#endif
+
+    return out;
+}
+
+std::istream& operator>>(std::istream &in, mnt6_G1 &g)
+{
+    char is_zero;
+    mnt6_Fq tX, tY;
+
+#ifdef NO_PT_COMPRESSION
+    in >> is_zero >> tX >> tY;
+    is_zero -= '0';
+#else
+    in.read((char*)&is_zero, 1); // this reads is_zero;
+    is_zero -= '0';
+    consume_OUTPUT_SEPARATOR(in);
+
+    unsigned char Y_lsb;
+    in >> tX;
+    consume_OUTPUT_SEPARATOR(in);
+    in.read((char*)&Y_lsb, 1);
+    Y_lsb -= '0';
+
+    // y = +/- sqrt(x^3 + a*x + b)
+    if (!is_zero)
+    {
+        mnt6_Fq tX2 = tX.squared();
+        mnt6_Fq tY2 = (tX2 + mnt6_G1::coeff_a) * tX + mnt6_G1::coeff_b;
+        tY = tY2.sqrt();
+
+        if ((tY.as_bigint().data[0] & 1) != Y_lsb)
+        {
+            tY = -tY;
+        }
+    }
+#endif
+    // using projective coordinates
+    if (!is_zero)
+    {
+        g.X_ = tX;
+        g.Y_ = tY;
+        g.Z_ = mnt6_Fq::one();
+    }
+    else
+    {
+        g = mnt6_G1::zero();
+    }
+
+    return in;
+}
+
+std::ostream& operator<<(std::ostream& out, const std::vector<mnt6_G1> &v)
+{
+    out << v.size() << "\n";
+    for (const mnt6_G1& t : v)
+    {
+        out << t << OUTPUT_NEWLINE;
+    }
+
+    return out;
+}
+
+std::istream& operator>>(std::istream& in, std::vector<mnt6_G1> &v)
+{
+    v.clear();
+
+    size_t s;
+    in >> s;
+    consume_newline(in);
+
+    v.reserve(s);
+
+    for (size_t i = 0; i < s; ++i)
+    {
+        mnt6_G1 g;
+        in >> g;
+        consume_OUTPUT_NEWLINE(in);
+        v.emplace_back(g);
+    }
+
+    return in;
+}
+
+void mnt6_G1::batch_to_special_all_non_zeros(std::vector<mnt6_G1> &vec)
+{
+    std::vector<mnt6_Fq> Z_vec;
+    Z_vec.reserve(vec.size());
+
+    for (auto &el: vec)
+    {
+        Z_vec.emplace_back(el.Z());
+    }
+    batch_invert<mnt6_Fq>(Z_vec);
+
+    const mnt6_Fq one = mnt6_Fq::one();
+
+    for (size_t i = 0; i < vec.size(); ++i)
+    {
+        vec[i] = mnt6_G1(vec[i].X() * Z_vec[i], vec[i].Y() * Z_vec[i], one);
+    }
+}
+
+} // libff
diff --git a/src/libff/libff/algebra/curves/mnt/mnt6/mnt6_g1.hpp b/src/libff/libff/algebra/curves/mnt/mnt6/mnt6_g1.hpp
new file mode 100755
index 000000000..a2a08ea79
--- /dev/null
+++ b/src/libff/libff/algebra/curves/mnt/mnt6/mnt6_g1.hpp
@@ -0,0 +1,106 @@
+/** @file
+ *****************************************************************************
+
+ Declaration of interfaces for the MNT6 G1 group.
+
+ *****************************************************************************
+ * @author     This file is part of libff, developed by SCIPR Lab
+ *             and contributors (see AUTHORS).
+ * @copyright  MIT license (see LICENSE file)
+ *****************************************************************************/
+
+#ifndef MNT6_G1_HPP_
+#define MNT6_G1_HPP_
+
+#include <vector>
+
+#include <libff/algebra/curves/curve_utils.hpp>
+#include <libff/algebra/curves/mnt/mnt6/mnt6_init.hpp>
+
+namespace libff {
+
+class mnt6_G1;
+std::ostream& operator<<(std::ostream &, const mnt6_G1&);
+std::istream& operator>>(std::istream &, mnt6_G1&);
+
+class mnt6_G1 {
+private:
+    mnt6_Fq X_, Y_, Z_;
+public:
+#ifdef PROFILE_OP_COUNTS
+    static long long add_cnt;
+    static long long dbl_cnt;
+#endif
+    static std::vector<size_t> wnaf_window_table;
+    static std::vector<size_t> fixed_base_exp_window_table;
+    static mnt6_G1 G1_zero;
+    static mnt6_G1 G1_one;
+    static mnt6_Fq coeff_a;
+    static mnt6_Fq coeff_b;
+
+    typedef mnt6_Fq base_field;
+    typedef mnt6_Fr scalar_field;
+
+    // using projective coordinates
+    mnt6_G1();
+    mnt6_G1(const mnt6_Fq& X, const mnt6_Fq& Y) : X_(X), Y_(Y), Z_(base_field::one()) {}
+    mnt6_G1(const mnt6_Fq& X, const mnt6_Fq& Y, const mnt6_Fq& Z) : X_(X), Y_(Y), Z_(Z) {}
+
+    mnt6_Fq X() const { return X_; }
+    mnt6_Fq Y() const { return Y_; }
+    mnt6_Fq Z() const { return Z_; }
+
+    void print() const;
+    void print_coordinates() const;
+
+    void to_affine_coordinates();
+    void to_special();
+    bool is_special() const;
+
+    bool is_zero() const;
+
+    bool operator==(const mnt6_G1 &other) const;
+    bool operator!=(const mnt6_G1 &other) const;
+
+    mnt6_G1 operator+(const mnt6_G1 &other) const;
+    mnt6_G1 operator-() const;
+    mnt6_G1 operator-(const mnt6_G1 &other) const;
+
+    mnt6_G1 add(const mnt6_G1 &other) const;
+    mnt6_G1 mixed_add(const mnt6_G1 &other) const;
+    mnt6_G1 dbl() const;
+
+    bool is_well_formed() const;
+
+    static mnt6_G1 zero();
+    static mnt6_G1 one();
+    static mnt6_G1 random_element();
+
+    static size_t size_in_bits() { return base_field::size_in_bits() + 1; }
+    static bigint<base_field::num_limbs> base_field_char() { return base_field::field_char(); }
+    static bigint<scalar_field::num_limbs> order() { return scalar_field::field_char(); }
+
+    friend std::ostream& operator<<(std::ostream &out, const mnt6_G1 &g);
+    friend std::istream& operator>>(std::istream &in, mnt6_G1 &g);
+
+    static void batch_to_special_all_non_zeros(std::vector<mnt6_G1> &vec);
+};
+
+template<mp_size_t m>
+mnt6_G1 operator*(const bigint<m> &lhs, const mnt6_G1 &rhs)
+{
+    return scalar_mul<mnt6_G1, m>(rhs, lhs);
+}
+
+template<mp_size_t m, const bigint<m>& modulus_p>
+mnt6_G1 operator*(const Fp_model<m,modulus_p> &lhs, const mnt6_G1 &rhs)
+{
+    return scalar_mul<mnt6_G1, m>(rhs, lhs.as_bigint());
+}
+
+std::ostream& operator<<(std::ostream& out, const std::vector<mnt6_G1> &v);
+std::istream& operator>>(std::istream& in, std::vector<mnt6_G1> &v);
+
+} // libff
+
+#endif // MNT6_G1_HPP_
diff --git a/src/libff/libff/algebra/curves/mnt/mnt6/mnt6_g2.cpp b/src/libff/libff/algebra/curves/mnt/mnt6/mnt6_g2.cpp
new file mode 100755
index 000000000..1bcc4dd36
--- /dev/null
+++ b/src/libff/libff/algebra/curves/mnt/mnt6/mnt6_g2.cpp
@@ -0,0 +1,502 @@
+/** @file
+ *****************************************************************************
+
+ Implementation of interfaces for the MNT6 G2 group.
+
+ See mnt6_g2.hpp .
+
+ *****************************************************************************
+ * @author     This file is part of libff, developed by SCIPR Lab
+ *             and contributors (see AUTHORS).
+ * @copyright  MIT license (see LICENSE file)
+ *****************************************************************************/
+
+#include <libff/algebra/curves/mnt/mnt6/mnt6_g2.hpp>
+
+namespace libff {
+
+#ifdef PROFILE_OP_COUNTS
+long long mnt6_G2::add_cnt = 0;
+long long mnt6_G2::dbl_cnt = 0;
+#endif
+
+std::vector<size_t> mnt6_G2::wnaf_window_table;
+std::vector<size_t> mnt6_G2::fixed_base_exp_window_table;
+mnt6_Fq3 mnt6_G2::twist;
+mnt6_Fq3 mnt6_G2::coeff_a;
+mnt6_Fq3 mnt6_G2::coeff_b;
+mnt6_G2 mnt6_G2::G2_zero;
+mnt6_G2 mnt6_G2::G2_one;
+
+mnt6_G2::mnt6_G2()
+{
+    this->X_ = G2_zero.X_;
+    this->Y_ = G2_zero.Y_;
+    this->Z_ = G2_zero.Z_;
+}
+
+mnt6_Fq3 mnt6_G2::mul_by_a(const mnt6_Fq3 &elt)
+{
+    return mnt6_Fq3(mnt6_twist_mul_by_a_c0 * elt.c1, mnt6_twist_mul_by_a_c1 * elt.c2, mnt6_twist_mul_by_a_c2 * elt.c0);
+}
+
+mnt6_Fq3 mnt6_G2::mul_by_b(const mnt6_Fq3 &elt)
+{
+    return mnt6_Fq3(mnt6_twist_mul_by_b_c0 * elt.c0, mnt6_twist_mul_by_b_c1 * elt.c1, mnt6_twist_mul_by_b_c2 * elt.c2);
+}
+
+void mnt6_G2::print() const
+{
+    if (this->is_zero())
+    {
+        printf("O\n");
+    }
+    else
+    {
+        mnt6_G2 copy(*this);
+        copy.to_affine_coordinates();
+        gmp_printf("(%Nd*z^2 + %Nd*z + %Nd , %Nd*z^2 + %Nd*z + %Nd)\n",
+                   copy.X_.c2.as_bigint().data, mnt6_Fq::num_limbs,
+                   copy.X_.c1.as_bigint().data, mnt6_Fq::num_limbs,
+                   copy.X_.c0.as_bigint().data, mnt6_Fq::num_limbs,
+                   copy.Y_.c2.as_bigint().data, mnt6_Fq::num_limbs,
+                   copy.Y_.c1.as_bigint().data, mnt6_Fq::num_limbs,
+                   copy.Y_.c0.as_bigint().data, mnt6_Fq::num_limbs);
+    }
+}
+
+void mnt6_G2::print_coordinates() const
+{
+    if (this->is_zero())
+    {
+        printf("O\n");
+    }
+    else
+    {
+        gmp_printf("(%Nd*z^2 + %Nd*z + %Nd : %Nd*z^2 + %Nd*z + %Nd : %Nd*z^2 + %Nd*z + %Nd)\n",
+                   this->X_.c2.as_bigint().data, mnt6_Fq::num_limbs,
+                   this->X_.c1.as_bigint().data, mnt6_Fq::num_limbs,
+                   this->X_.c0.as_bigint().data, mnt6_Fq::num_limbs,
+                   this->Y_.c2.as_bigint().data, mnt6_Fq::num_limbs,
+                   this->Y_.c1.as_bigint().data, mnt6_Fq::num_limbs,
+                   this->Y_.c0.as_bigint().data, mnt6_Fq::num_limbs,
+                   this->Z_.c2.as_bigint().data, mnt6_Fq::num_limbs,
+                   this->Z_.c1.as_bigint().data, mnt6_Fq::num_limbs,
+                   this->Z_.c0.as_bigint().data, mnt6_Fq::num_limbs);
+    }
+}
+
+void mnt6_G2::to_affine_coordinates()
+{
+    if (this->is_zero())
+    {
+        this->X_ = mnt6_Fq3::zero();
+        this->Y_ = mnt6_Fq3::one();
+        this->Z_ = mnt6_Fq3::zero();
+    }
+    else
+    {
+        const mnt6_Fq3 Z_inv = Z_.inverse();
+        this->X_ = this->X_ * Z_inv;
+        this->Y_ = this->Y_ * Z_inv;
+        this->Z_ = mnt6_Fq3::one();
+    }
+}
+
+void mnt6_G2::to_special()
+{
+    this->to_affine_coordinates();
+}
+
+bool mnt6_G2::is_special() const
+{
+    return (this->is_zero() || this->Z_ == mnt6_Fq3::one());
+}
+
+bool mnt6_G2::is_zero() const
+{
+    // TODO: use zero for here
+    return (this->X_.is_zero() && this->Z_.is_zero());
+}
+
+bool mnt6_G2::operator==(const mnt6_G2 &other) const
+{
+    if (this->is_zero())
+    {
+        return other.is_zero();
+    }
+
+    if (other.is_zero())
+    {
+        return false;
+    }
+
+    /* now neither is O */
+
+    // X1/Z1 = X2/Z2 <=> X1*Z2 = X2*Z1
+    if ((this->X_ * other.Z_) != (other.X_ * this->Z_))
+    {
+        return false;
+    }
+
+    // Y1/Z1 = Y2/Z2 <=> Y1*Z2 = Y2*Z1
+    if ((this->Y_ * other.Z_) != (other.Y_ * this->Z_))
+    {
+        return false;
+    }
+
+    return true;
+}
+
+bool mnt6_G2::operator!=(const mnt6_G2& other) const
+{
+    return !(operator==(other));
+}
+
+mnt6_G2 mnt6_G2::operator+(const mnt6_G2 &other) const
+{
+    // handle special cases having to do with O
+    if (this->is_zero())
+    {
+        return other;
+    }
+
+    if (other.is_zero())
+    {
+        return *this;
+    }
+
+    // no need to handle points of order 2,4
+    // (they cannot exist in a prime-order subgroup)
+
+    // handle double case, and then all the rest
+    /*
+      The code below is equivalent to (but faster than) the snippet below:
+
+      if (this->operator==(other))
+      {
+      return this->dbl();
+      }
+      else
+      {
+      return this->add(other);
+      }
+    */
+
+    const mnt6_Fq3 X1Z2 = (this->X_) * (other.Z_);        // X1Z2 = X1*Z2
+    const mnt6_Fq3 X2Z1 = (this->Z_) * (other.X_);        // X2Z1 = X2*Z1
+
+    // (used both in add and double checks)
+
+    const mnt6_Fq3 Y1Z2 = (this->Y_) * (other.Z_);        // Y1Z2 = Y1*Z2
+    const mnt6_Fq3 Y2Z1 = (this->Z_) * (other.Y_);        // Y2Z1 = Y2*Z1
+
+    if (X1Z2 == X2Z1 && Y1Z2 == Y2Z1)
+    {
+        // perform dbl case
+        const mnt6_Fq3 XX   = (this->X_).squared();                   // XX  = X1^2
+        const mnt6_Fq3 ZZ   = (this->Z_).squared();                   // ZZ  = Z1^2
+        const mnt6_Fq3 w    = mnt6_G2::mul_by_a(ZZ) + (XX + XX + XX); // w   = a*ZZ + 3*XX
+        const mnt6_Fq3 Y1Z1 = (this->Y_) * (this->Z_);
+        const mnt6_Fq3 s    = Y1Z1 + Y1Z1;                             // s   = 2*Y1*Z1
+        const mnt6_Fq3 ss   = s.squared();                             // ss  = s^2
+        const mnt6_Fq3 sss  = s * ss;                                  // sss = s*ss
+        const mnt6_Fq3 R    = (this->Y_) * s;                          // R   = Y1*s
+        const mnt6_Fq3 RR   = R.squared();                             // RR  = R^2
+        const mnt6_Fq3 B    = ((this->X_)+R).squared()-XX-RR;          // B   = (X1+R)^2 - XX - RR
+        const mnt6_Fq3 h    = w.squared() - (B+B);                     // h   = w^2 - 2*B
+        const mnt6_Fq3 X3   = h * s;                                   // X3  = h*s
+        const mnt6_Fq3 Y3   = w * (B-h)-(RR+RR);                       // Y3  = w*(B-h) - 2*RR
+        const mnt6_Fq3 Z3   = sss;                                     // Z3  = sss
+
+        return mnt6_G2(X3, Y3, Z3);
+    }
+
+    // if we have arrived here we are in the add case
+    const mnt6_Fq3 Z1Z2 = (this->Z_) * (other.Z_);   // Z1Z2 = Z1*Z2
+    const mnt6_Fq3 u    = Y2Z1 - Y1Z2;               // u    = Y2*Z1-Y1Z2
+    const mnt6_Fq3 uu   = u.squared();               // uu   = u^2
+    const mnt6_Fq3 v    = X2Z1 - X1Z2;               // v    = X2*Z1-X1Z2
+    const mnt6_Fq3 vv   = v.squared();               // vv   = v^2
+    const mnt6_Fq3 vvv  = v * vv;                    // vvv  = v*vv
+    const mnt6_Fq3 R    = vv * X1Z2;                 // R    = vv*X1Z2
+    const mnt6_Fq3 A    = uu * Z1Z2 - (vvv + R + R); // A    = uu*Z1Z2 - vvv - 2*R
+    const mnt6_Fq3 X3   = v * A;                     // X3   = v*A
+    const mnt6_Fq3 Y3   = u * (R-A) - vvv * Y1Z2;    // Y3   = u*(R-A) - vvv*Y1Z2
+    const mnt6_Fq3 Z3   = vvv * Z1Z2;                // Z3   = vvv*Z1Z2
+
+    return mnt6_G2(X3, Y3, Z3);
+}
+
+mnt6_G2 mnt6_G2::operator-() const
+{
+    return mnt6_G2(this->X_, -(this->Y_), this->Z_);
+}
+
+
+mnt6_G2 mnt6_G2::operator-(const mnt6_G2 &other) const
+{
+    return (*this) + (-other);
+}
+
+mnt6_G2 mnt6_G2::add(const mnt6_G2 &other) const
+{
+    // handle special cases having to do with O
+    if (this->is_zero())
+    {
+        return other;
+    }
+
+    if (other.is_zero())
+    {
+        return (*this);
+    }
+
+    // no need to handle points of order 2,4
+    // (they cannot exist in a prime-order subgroup)
+
+    // handle double case
+    if (this->operator==(other))
+    {
+        return this->dbl();
+    }
+
+#ifdef PROFILE_OP_COUNTS
+    this->add_cnt++;
+#endif
+    // NOTE: does not handle O and pts of order 2,4
+    // http://www.hyperelliptic.org/EFD/g1p/auto-shortw-projective.html#addition-add-1998-cmo-2
+
+    const mnt6_Fq3 Y1Z2 = (this->Y_) * (other.Z_);        // Y1Z2 = Y1*Z2
+    const mnt6_Fq3 X1Z2 = (this->X_) * (other.Z_);        // X1Z2 = X1*Z2
+    const mnt6_Fq3 Z1Z2 = (this->Z_) * (other.Z_);        // Z1Z2 = Z1*Z2
+    const mnt6_Fq3 u    = (other.Y_) * (this->Z_) - Y1Z2; // u    = Y2*Z1-Y1Z2
+    const mnt6_Fq3 uu   = u.squared();                    // uu   = u^2
+    const mnt6_Fq3 v    = (other.X_) * (this->Z_) - X1Z2; // v    = X2*Z1-X1Z2
+    const mnt6_Fq3 vv   = v.squared();                    // vv   = v^2
+    const mnt6_Fq3 vvv  = v * vv;                         // vvv  = v*vv
+    const mnt6_Fq3 R    = vv * X1Z2;                      // R    = vv*X1Z2
+    const mnt6_Fq3 A    = uu * Z1Z2 - (vvv + R + R);      // A    = uu*Z1Z2 - vvv - 2*R
+    const mnt6_Fq3 X3   = v * A;                          // X3   = v*A
+    const mnt6_Fq3 Y3   = u * (R-A) - vvv * Y1Z2;         // Y3   = u*(R-A) - vvv*Y1Z2
+    const mnt6_Fq3 Z3   = vvv * Z1Z2;                     // Z3   = vvv*Z1Z2
+
+    return mnt6_G2(X3, Y3, Z3);
+}
+
+mnt6_G2 mnt6_G2::mixed_add(const mnt6_G2 &other) const
+{
+#ifdef PROFILE_OP_COUNTS
+    this->add_cnt++;
+#endif
+    // NOTE: does not handle O and pts of order 2,4
+    // http://www.hyperelliptic.org/EFD/g1p/auto-shortw-projective.html#addition-add-1998-cmo-2
+    //assert(other.Z == mnt6_Fq3::one());
+
+    if (this->is_zero())
+    {
+        return other;
+    }
+
+    if (other.is_zero())
+    {
+        return (*this);
+    }
+
+#ifdef DEBUG
+    assert(other.is_special());
+#endif
+
+    const mnt6_Fq3 &X1Z2 = (this->X_);                   // X1Z2 = X1*Z2 (but other is special and not zero)
+    const mnt6_Fq3 X2Z1 = (this->Z_) * (other.X_);       // X2Z1 = X2*Z1
+
+    // (used both in add and double checks)
+
+    const mnt6_Fq3 &Y1Z2 = (this->Y_);                   // Y1Z2 = Y1*Z2 (but other is special and not zero)
+    const mnt6_Fq3 Y2Z1 = (this->Z_) * (other.Y_);       // Y2Z1 = Y2*Z1
+
+    if (X1Z2 == X2Z1 && Y1Z2 == Y2Z1)
+    {
+        return this->dbl();
+    }
+
+    const mnt6_Fq3 u = Y2Z1 - this->Y_;             // u = Y2*Z1-Y1
+    const mnt6_Fq3 uu = u.squared();                // uu = u2
+    const mnt6_Fq3 v = X2Z1 - this->X_;             // v = X2*Z1-X1
+    const mnt6_Fq3 vv = v.squared();                // vv = v2
+    const mnt6_Fq3 vvv = v*vv;                      // vvv = v*vv
+    const mnt6_Fq3 R = vv * this->X_;               // R = vv*X1
+    const mnt6_Fq3 A = uu * this->Z_ - vvv - R - R; // A = uu*Z1-vvv-2*R
+    const mnt6_Fq3 X3 = v * A;                      // X3 = v*A
+    const mnt6_Fq3 Y3 = u*(R-A) - vvv * this->Y_;   // Y3 = u*(R-A)-vvv*Y1
+    const mnt6_Fq3 Z3 = vvv * this->Z_;             // Z3 = vvv*Z1
+
+    return mnt6_G2(X3, Y3, Z3);
+}
+
+mnt6_G2 mnt6_G2::dbl() const
+{
+#ifdef PROFILE_OP_COUNTS
+    this->dbl_cnt++;
+#endif
+    if (this->is_zero())
+    {
+        return (*this);
+    }
+    else
+    {
+        // NOTE: does not handle O and pts of order 2,4
+        // http://www.hyperelliptic.org/EFD/g1p/auto-shortw-projective.html#doubling-dbl-2007-bl
+
+        const mnt6_Fq3 XX   = (this->X_).squared();                   // XX  = X1^2
+        const mnt6_Fq3 ZZ   = (this->Z_).squared();                   // ZZ  = Z1^2
+        const mnt6_Fq3 w    = mnt6_G2::mul_by_a(ZZ) + (XX + XX + XX); // w   = a*ZZ + 3*XX
+        const mnt6_Fq3 Y1Z1 = (this->Y_) * (this->Z_);
+        const mnt6_Fq3 s    = Y1Z1 + Y1Z1;                            // s   = 2*Y1*Z1
+        const mnt6_Fq3 ss   = s.squared();                            // ss  = s^2
+        const mnt6_Fq3 sss  = s * ss;                                 // sss = s*ss
+        const mnt6_Fq3 R    = (this->Y_) * s;                         // R   = Y1*s
+        const mnt6_Fq3 RR   = R.squared();                            // RR  = R^2
+        const mnt6_Fq3 B    = ((this->X_)+R).squared()-XX-RR;         // B   = (X1+R)^2 - XX - RR
+        const mnt6_Fq3 h    = w.squared() - (B+B);                    // h   = w^2-2*B
+        const mnt6_Fq3 X3   = h * s;                                  // X3  = h*s
+        const mnt6_Fq3 Y3   = w * (B-h)-(RR+RR);                      // Y3  = w*(B-h) - 2*RR
+        const mnt6_Fq3 Z3   = sss;                                    // Z3  = sss
+
+        return mnt6_G2(X3, Y3, Z3);
+    }
+}
+
+mnt6_G2 mnt6_G2::mul_by_q() const
+{
+    return mnt6_G2(mnt6_twist_mul_by_q_X * (this->X_).Frobenius_map(1),
+                   mnt6_twist_mul_by_q_Y * (this->Y_).Frobenius_map(1),
+                   (this->Z_).Frobenius_map(1));
+}
+
+bool mnt6_G2::is_well_formed() const
+{
+    if (this->is_zero())
+    {
+        return true;
+    }
+    else
+    {
+
+        /*
+          y^2 = x^3 + ax + b
+
+          We are using projective, so equation we need to check is actually
+
+          (y/z)^2 = (x/z)^3 + a (x/z) + b
+          z y^2 = x^3  + a z^2 x + b z^3
+
+          z (y^2 - b z^2) = x ( x^2 + a z^2)
+        */
+        const mnt6_Fq3 X2 = this->X_.squared();
+        const mnt6_Fq3 Y2 = this->Y_.squared();
+        const mnt6_Fq3 Z2 = this->Z_.squared();
+        const mnt6_Fq3 aZ2 = mnt6_twist_coeff_a * Z2;
+
+        return (this->Z_ * (Y2 - mnt6_twist_coeff_b * Z2) == this->X_ * (X2 + aZ2));
+    }
+}
+
+mnt6_G2 mnt6_G2::zero()
+{
+    return G2_zero;
+}
+
+mnt6_G2 mnt6_G2::one()
+{
+    return G2_one;
+}
+
+mnt6_G2 mnt6_G2::random_element()
+{
+    return (mnt6_Fr::random_element().as_bigint()) * G2_one;
+}
+
+std::ostream& operator<<(std::ostream &out, const mnt6_G2 &g)
+{
+    mnt6_G2 copy(g);
+    copy.to_affine_coordinates();
+
+    out << (copy.is_zero() ? 1 : 0) << OUTPUT_SEPARATOR;
+#ifdef NO_PT_COMPRESSION
+    out << copy.X_ << OUTPUT_SEPARATOR << copy.Y_;
+#else
+    /* storing LSB of Y */
+    out << copy.X_ << OUTPUT_SEPARATOR << (copy.Y_.c0.as_bigint().data[0] & 1);
+#endif
+
+    return out;
+}
+
+std::istream& operator>>(std::istream &in, mnt6_G2 &g)
+{
+    char is_zero;
+    mnt6_Fq3 tX, tY;
+
+#ifdef NO_PT_COMPRESSION
+    in >> is_zero >> tX >> tY;
+    is_zero -= '0';
+#else
+    in.read((char*)&is_zero, 1); // this reads is_zero;
+    is_zero -= '0';
+    consume_OUTPUT_SEPARATOR(in);
+
+    unsigned char Y_lsb;
+    in >> tX;
+    consume_OUTPUT_SEPARATOR(in);
+    in.read((char*)&Y_lsb, 1);
+    Y_lsb -= '0';
+
+    // y = +/- sqrt(x^3 + a*x + b)
+    if (!is_zero)
+    {
+        const mnt6_Fq3 tX2 = tX.squared();
+        const mnt6_Fq3 tY2 = (tX2 + mnt6_twist_coeff_a) * tX + mnt6_twist_coeff_b;
+        tY = tY2.sqrt();
+
+        if ((tY.c0.as_bigint().data[0] & 1) != Y_lsb)
+        {
+            tY = -tY;
+        }
+    }
+#endif
+    // using projective coordinates
+    if (!is_zero)
+    {
+        g.X_ = tX;
+        g.Y_ = tY;
+        g.Z_ = mnt6_Fq3::one();
+    }
+    else
+    {
+        g = mnt6_G2::zero();
+    }
+
+    return in;
+}
+
+void mnt6_G2::batch_to_special_all_non_zeros(std::vector<mnt6_G2> &vec)
+{
+    std::vector<mnt6_Fq3> Z_vec;
+    Z_vec.reserve(vec.size());
+
+    for (auto &el: vec)
+    {
+        Z_vec.emplace_back(el.Z());
+    }
+    batch_invert<mnt6_Fq3>(Z_vec);
+
+    const mnt6_Fq3 one = mnt6_Fq3::one();
+
+    for (size_t i = 0; i < vec.size(); ++i)
+    {
+        vec[i] = mnt6_G2(vec[i].X() * Z_vec[i], vec[i].Y() * Z_vec[i], one);
+    }
+}
+
+} // libff
diff --git a/src/libff/libff/algebra/curves/mnt/mnt6/mnt6_g2.hpp b/src/libff/libff/algebra/curves/mnt/mnt6/mnt6_g2.hpp
new file mode 100755
index 000000000..2dc11e342
--- /dev/null
+++ b/src/libff/libff/algebra/curves/mnt/mnt6/mnt6_g2.hpp
@@ -0,0 +1,108 @@
+/** @file
+ *****************************************************************************
+
+ Declaration of interfaces for the MNT6 G2 group.
+
+ *****************************************************************************
+ * @author     This file is part of libff, developed by SCIPR Lab
+ *             and contributors (see AUTHORS).
+ * @copyright  MIT license (see LICENSE file)
+ *****************************************************************************/
+
+#ifndef MNT6_G2_HPP_
+#define MNT6_G2_HPP_
+
+#include <vector>
+
+#include <libff/algebra/curves/curve_utils.hpp>
+#include <libff/algebra/curves/mnt/mnt6/mnt6_init.hpp>
+
+namespace libff {
+
+class mnt6_G2;
+std::ostream& operator<<(std::ostream &, const mnt6_G2&);
+std::istream& operator>>(std::istream &, mnt6_G2&);
+
+class mnt6_G2 {
+private:
+    mnt6_Fq3 X_, Y_, Z_;
+public:
+#ifdef PROFILE_OP_COUNTS
+    static long long add_cnt;
+    static long long dbl_cnt;
+#endif
+    static std::vector<size_t> wnaf_window_table;
+    static std::vector<size_t> fixed_base_exp_window_table;
+    static mnt6_G2 G2_zero;
+    static mnt6_G2 G2_one;
+    static mnt6_Fq3 twist;
+    static mnt6_Fq3 coeff_a;
+    static mnt6_Fq3 coeff_b;
+
+    typedef mnt6_Fq base_field;
+    typedef mnt6_Fq3 twist_field;
+    typedef mnt6_Fr scalar_field;
+
+    // using projective coordinates
+    mnt6_G2();
+    mnt6_G2(const mnt6_Fq3& X, const mnt6_Fq3& Y, const mnt6_Fq3& Z) : X_(X), Y_(Y), Z_(Z) {}
+
+    mnt6_Fq3 X() const { return X_; }
+    mnt6_Fq3 Y() const { return Y_; }
+    mnt6_Fq3 Z() const { return Z_; }
+
+    static mnt6_Fq3 mul_by_a(const mnt6_Fq3 &elt);
+    static mnt6_Fq3 mul_by_b(const mnt6_Fq3 &elt);
+
+    void print() const;
+    void print_coordinates() const;
+
+    void to_affine_coordinates();
+    void to_special();
+    bool is_special() const;
+
+    bool is_zero() const;
+
+    bool operator==(const mnt6_G2 &other) const;
+    bool operator!=(const mnt6_G2 &other) const;
+
+    mnt6_G2 operator+(const mnt6_G2 &other) const;
+    mnt6_G2 operator-() const;
+    mnt6_G2 operator-(const mnt6_G2 &other) const;
+
+    mnt6_G2 add(const mnt6_G2 &other) const;
+    mnt6_G2 mixed_add(const mnt6_G2 &other) const;
+    mnt6_G2 dbl() const;
+    mnt6_G2 mul_by_q() const;
+
+    bool is_well_formed() const;
+
+    static mnt6_G2 zero();
+    static mnt6_G2 one();
+    static mnt6_G2 random_element();
+
+    static size_t size_in_bits() { return twist_field::size_in_bits() + 1; }
+    static bigint<base_field::num_limbs> base_field_char() { return base_field::field_char(); }
+    static bigint<scalar_field::num_limbs> order() { return scalar_field::field_char(); }
+
+    friend std::ostream& operator<<(std::ostream &out, const mnt6_G2 &g);
+    friend std::istream& operator>>(std::istream &in, mnt6_G2 &g);
+
+    static void batch_to_special_all_non_zeros(std::vector<mnt6_G2> &vec);
+};
+
+template<mp_size_t m>
+mnt6_G2 operator*(const bigint<m> &lhs, const mnt6_G2 &rhs)
+{
+    return scalar_mul<mnt6_G2, m>(rhs, lhs);
+}
+
+template<mp_size_t m, const bigint<m>& modulus_p>
+mnt6_G2 operator*(const Fp_model<m,modulus_p> &lhs, const mnt6_G2 &rhs)
+{
+    return scalar_mul<mnt6_G2, m>(rhs, lhs.as_bigint());
+}
+
+} // libff
+
+#endif // MNT6_G2_HPP_
diff --git a/src/libff/libff/algebra/curves/mnt/mnt6/mnt6_init.cpp b/src/libff/libff/algebra/curves/mnt/mnt6/mnt6_init.cpp
new file mode 100755
index 000000000..2182a15bf
--- /dev/null
+++ b/src/libff/libff/algebra/curves/mnt/mnt6/mnt6_init.cpp
@@ -0,0 +1,277 @@
+/** @file
+ *****************************************************************************
+
+ Implementation of interfaces for initializing MNT6.
+
+ See mnt6_init.hpp .
+
+ *****************************************************************************
+ * @author     This file is part of libff, developed by SCIPR Lab
+ *             and contributors (see AUTHORS).
+ * @copyright  MIT license (see LICENSE file)
+ *****************************************************************************/
+
+#include <libff/algebra/curves/mnt/mnt6/mnt6_g1.hpp>
+#include <libff/algebra/curves/mnt/mnt6/mnt6_g2.hpp>
+#include <libff/algebra/curves/mnt/mnt6/mnt6_init.hpp>
+
+namespace libff {
+
+//bigint<mnt6_r_limbs> mnt6_modulus_r = mnt46_modulus_B;
+//bigint<mnt6_q_limbs> mnt6_modulus_q = mnt46_modulus_A;
+
+mnt6_Fq3 mnt6_twist;
+mnt6_Fq3 mnt6_twist_coeff_a;
+mnt6_Fq3 mnt6_twist_coeff_b;
+mnt6_Fq mnt6_twist_mul_by_a_c0;
+mnt6_Fq mnt6_twist_mul_by_a_c1;
+mnt6_Fq mnt6_twist_mul_by_a_c2;
+mnt6_Fq mnt6_twist_mul_by_b_c0;
+mnt6_Fq mnt6_twist_mul_by_b_c1;
+mnt6_Fq mnt6_twist_mul_by_b_c2;
+mnt6_Fq mnt6_twist_mul_by_q_X;
+mnt6_Fq mnt6_twist_mul_by_q_Y;
+
+bigint<mnt6_q_limbs> mnt6_ate_loop_count;
+bool mnt6_ate_is_loop_count_neg;
+bigint<6*mnt6_q_limbs> mnt6_final_exponent;
+bigint<mnt6_q_limbs> mnt6_final_exponent_last_chunk_abs_of_w0;
+bool mnt6_final_exponent_last_chunk_is_w0_neg;
+bigint<mnt6_q_limbs> mnt6_final_exponent_last_chunk_w1;
+
+void init_mnt6_params()
+{
+    typedef bigint<mnt6_r_limbs> bigint_r;
+    typedef bigint<mnt6_q_limbs> bigint_q;
+
+    assert(sizeof(mp_limb_t) == 8 || sizeof(mp_limb_t) == 4); // Montgomery assumes this
+
+    /* parameters for scalar field Fr */
+    mnt6_modulus_r = bigint_r("475922286169261325753349249653048451545124879242694725395555128576210262817955800483758081");
+    assert(mnt6_Fr::modulus_is_valid());
+    if (sizeof(mp_limb_t) == 8)
+    {
+        mnt6_Fr::Rsquared = bigint_r("273000478523237720910981655601160860640083126627235719712980612296263966512828033847775776");
+        mnt6_Fr::Rcubed = bigint_r("427298980065529822574935274648041073124704261331681436071990730954930769758106792920349077");
+        mnt6_Fr::inv = 0xb071a1b67165ffff;
+    }
+    if (sizeof(mp_limb_t) == 4)
+    {
+        mnt6_Fr::Rsquared = bigint_r("273000478523237720910981655601160860640083126627235719712980612296263966512828033847775776");
+        mnt6_Fr::Rcubed = bigint_r("427298980065529822574935274648041073124704261331681436071990730954930769758106792920349077");
+        mnt6_Fr::inv = 0x7165ffff;
+    }
+    mnt6_Fr::num_bits = 298;
+    mnt6_Fr::euler = bigint_r("237961143084630662876674624826524225772562439621347362697777564288105131408977900241879040");
+    mnt6_Fr::s = 17;
+    mnt6_Fr::t = bigint_r("3630998887399759870554727551674258816109656366292531779446068791017229177993437198515");
+    mnt6_Fr::t_minus_1_over_2 = bigint_r("1815499443699879935277363775837129408054828183146265889723034395508614588996718599257");
+    mnt6_Fr::multiplicative_generator = mnt6_Fr("17");
+    mnt6_Fr::root_of_unity = mnt6_Fr("264706250571800080758069302369654305530125675521263976034054878017580902343339784464690243");
+    mnt6_Fr::nqr = mnt6_Fr("17");
+    mnt6_Fr::nqr_to_t = mnt6_Fr("264706250571800080758069302369654305530125675521263976034054878017580902343339784464690243");
+
+    /* parameters for base field Fq */
+    mnt6_modulus_q = bigint_q("475922286169261325753349249653048451545124878552823515553267735739164647307408490559963137");
+    assert(mnt6_Fq::modulus_is_valid());
+    if (sizeof(mp_limb_t) == 8)
+    {
+        mnt6_Fq::Rsquared = bigint_q("163983144722506446826715124368972380525894397127205577781234305496325861831001705438796139");
+        mnt6_Fq::Rcubed = bigint_q("207236281459091063710247635236340312578688659363066707916716212805695955118593239854980171");
+        mnt6_Fq::inv = 0xbb4334a3ffffffff;
+    }
+    if (sizeof(mp_limb_t) == 4)
+    {
+        mnt6_Fq::Rsquared = bigint_q("163983144722506446826715124368972380525894397127205577781234305496325861831001705438796139");
+        mnt6_Fq::Rcubed = bigint_q("207236281459091063710247635236340312578688659363066707916716212805695955118593239854980171");
+        mnt6_Fq::inv = 0xffffffff;
+    }
+    mnt6_Fq::num_bits = 298;
+    mnt6_Fq::euler = bigint_q("237961143084630662876674624826524225772562439276411757776633867869582323653704245279981568");
+    mnt6_Fq::s = 34;
+    mnt6_Fq::t = bigint_q("27702323054502562488973446286577291993024111641153199339359284829066871159442729");
+    mnt6_Fq::t_minus_1_over_2 = bigint_q("13851161527251281244486723143288645996512055820576599669679642414533435579721364");
+    mnt6_Fq::multiplicative_generator = mnt6_Fq("10");
+    mnt6_Fq::root_of_unity = mnt6_Fq("120638817826913173458768829485690099845377008030891618010109772937363554409782252579816313");
+    mnt6_Fq::nqr = mnt6_Fq("5");
+    mnt6_Fq::nqr_to_t = mnt6_Fq("406220604243090401056429458730298145937262552508985450684842547562990900634752279902740880");
+
+    /* parameters for twist field Fq3 */
+    mnt6_Fq3::euler = bigint<3*mnt6_q_limbs>("53898680178554951715397245154796036139463891589001478629193136369124915637741423690184935056189295242736833704290747216410090671804540908400210778934462129625646263095398323485795557551284190224166851571615834194321908328559167529729507439069424158411618728014749106176");
+    mnt6_Fq3::s = 34;
+    mnt6_Fq3::t = bigint<3*mnt6_q_limbs>("6274632199033507112809136178669989590936327770934612330653836993631547740397674926811006741620285348354004521888069251599964996777072188956687550402067383940523288107407084140669968625447269322370045302856694231080113482726640944570478452261237446033817102203");
+    mnt6_Fq3::t_minus_1_over_2 = bigint<3*mnt6_q_limbs>("3137316099516753556404568089334994795468163885467306165326918496815773870198837463405503370810142674177002260944034625799982498388536094478343775201033691970261644053703542070334984312723634661185022651428347115540056741363320472285239226130618723016908551101");
+    mnt6_Fq3::non_residue = mnt6_Fq("5");
+    mnt6_Fq3::nqr = mnt6_Fq3(mnt6_Fq("5"),mnt6_Fq("0"),mnt6_Fq("0"));
+    mnt6_Fq3::nqr_to_t = mnt6_Fq3(mnt6_Fq("154361449678783505076984156275977937654331103361174469632346230549735979552469642799720052"),mnt6_Fq("0"),mnt6_Fq("0"));
+    mnt6_Fq3::Frobenius_coeffs_c1[0] = mnt6_Fq("1");
+    mnt6_Fq3::Frobenius_coeffs_c1[1] = mnt6_Fq("471738898967521029133040851318449165997304108729558973770077319830005517129946578866686956");
+    mnt6_Fq3::Frobenius_coeffs_c1[2] = mnt6_Fq("4183387201740296620308398334599285547820769823264541783190415909159130177461911693276180");
+    mnt6_Fq3::Frobenius_coeffs_c2[0] = mnt6_Fq("1");
+    mnt6_Fq3::Frobenius_coeffs_c2[1] = mnt6_Fq("4183387201740296620308398334599285547820769823264541783190415909159130177461911693276180");
+    mnt6_Fq3::Frobenius_coeffs_c2[2] = mnt6_Fq("471738898967521029133040851318449165997304108729558973770077319830005517129946578866686956");
+
+    /* parameters for Fq6 */
+    mnt6_Fq6::non_residue = mnt6_Fq("5");
+    mnt6_Fq6::Frobenius_coeffs_c1[0] = mnt6_Fq("1");
+    mnt6_Fq6::Frobenius_coeffs_c1[1] = mnt6_Fq("471738898967521029133040851318449165997304108729558973770077319830005517129946578866686957");
+    mnt6_Fq6::Frobenius_coeffs_c1[2] = mnt6_Fq("471738898967521029133040851318449165997304108729558973770077319830005517129946578866686956");
+    mnt6_Fq6::Frobenius_coeffs_c1[3] = mnt6_Fq("475922286169261325753349249653048451545124878552823515553267735739164647307408490559963136");
+    mnt6_Fq6::Frobenius_coeffs_c1[4] = mnt6_Fq("4183387201740296620308398334599285547820769823264541783190415909159130177461911693276180");
+    mnt6_Fq6::Frobenius_coeffs_c1[5] = mnt6_Fq("4183387201740296620308398334599285547820769823264541783190415909159130177461911693276181");
+    mnt6_Fq6::my_Fp2::non_residue = mnt6_Fq3::non_residue;
+
+    /* choice of short Weierstrass curve and its twist */
+    mnt6_G1::coeff_a = mnt6_Fq("11");
+    mnt6_G1::coeff_b = mnt6_Fq("106700080510851735677967319632585352256454251201367587890185989362936000262606668469523074");
+    mnt6_twist = mnt6_Fq3(mnt6_Fq::zero(), mnt6_Fq::one(), mnt6_Fq::zero());
+    mnt6_twist_coeff_a = mnt6_Fq3(mnt6_Fq::zero(), mnt6_Fq::zero(),
+                                  mnt6_G1::coeff_a);
+    mnt6_twist_coeff_b = mnt6_Fq3(mnt6_G1::coeff_b * mnt6_Fq3::non_residue,
+                                  mnt6_Fq::zero(), mnt6_Fq::zero());
+    mnt6_G2::twist = mnt6_twist;
+    mnt6_G2::coeff_a = mnt6_twist_coeff_a;
+    mnt6_G2::coeff_b = mnt6_twist_coeff_b;
+    mnt6_twist_mul_by_a_c0 = mnt6_G1::coeff_a * mnt6_Fq3::non_residue;
+    mnt6_twist_mul_by_a_c1 = mnt6_G1::coeff_a * mnt6_Fq3::non_residue;
+    mnt6_twist_mul_by_a_c2 = mnt6_G1::coeff_a;
+    mnt6_twist_mul_by_b_c0 = mnt6_G1::coeff_b * mnt6_Fq3::non_residue;
+    mnt6_twist_mul_by_b_c1 = mnt6_G1::coeff_b * mnt6_Fq3::non_residue;
+    mnt6_twist_mul_by_b_c2 = mnt6_G1::coeff_b * mnt6_Fq3::non_residue;
+    mnt6_twist_mul_by_q_X = mnt6_Fq("4183387201740296620308398334599285547820769823264541783190415909159130177461911693276180");
+    mnt6_twist_mul_by_q_Y = mnt6_Fq("475922286169261325753349249653048451545124878552823515553267735739164647307408490559963136");
+
+    /* choice of group G1 */
+    mnt6_G1::G1_zero = mnt6_G1(mnt6_Fq::zero(),
+                               mnt6_Fq::one(),
+                               mnt6_Fq::zero());
+    mnt6_G1::G1_one = mnt6_G1(mnt6_Fq("336685752883082228109289846353937104185698209371404178342968838739115829740084426881123453"),
+                              mnt6_Fq("402596290139780989709332707716568920777622032073762749862342374583908837063963736098549800"),
+                              mnt6_Fq::one());
+
+    mnt6_G1::wnaf_window_table.resize(0);
+    mnt6_G1::wnaf_window_table.push_back(11);
+    mnt6_G1::wnaf_window_table.push_back(24);
+    mnt6_G1::wnaf_window_table.push_back(60);
+    mnt6_G1::wnaf_window_table.push_back(127);
+
+    mnt6_G1::fixed_base_exp_window_table.resize(0);
+    // window 1 is unbeaten in [-inf, 3.96]
+    mnt6_G1::fixed_base_exp_window_table.push_back(1);
+    // window 2 is unbeaten in [3.96, 9.67]
+    mnt6_G1::fixed_base_exp_window_table.push_back(4);
+    // window 3 is unbeaten in [9.67, 25.13]
+    mnt6_G1::fixed_base_exp_window_table.push_back(10);
+    // window 4 is unbeaten in [25.13, 60.31]
+    mnt6_G1::fixed_base_exp_window_table.push_back(25);
+    // window 5 is unbeaten in [60.31, 146.07]
+    mnt6_G1::fixed_base_exp_window_table.push_back(60);
+    // window 6 is unbeaten in [146.07, 350.09]
+    mnt6_G1::fixed_base_exp_window_table.push_back(146);
+    // window 7 is unbeaten in [350.09, 844.54]
+    mnt6_G1::fixed_base_exp_window_table.push_back(350);
+    // window 8 is unbeaten in [844.54, 1839.64]
+    mnt6_G1::fixed_base_exp_window_table.push_back(845);
+    // window 9 is unbeaten in [1839.64, 3904.26]
+    mnt6_G1::fixed_base_exp_window_table.push_back(1840);
+    // window 10 is unbeaten in [3904.26, 11309.42]
+    mnt6_G1::fixed_base_exp_window_table.push_back(3904);
+    // window 11 is unbeaten in [11309.42, 24015.57]
+    mnt6_G1::fixed_base_exp_window_table.push_back(11309);
+    // window 12 is unbeaten in [24015.57, 72288.57]
+    mnt6_G1::fixed_base_exp_window_table.push_back(24016);
+    // window 13 is unbeaten in [72288.57, 138413.22]
+    mnt6_G1::fixed_base_exp_window_table.push_back(72289);
+    // window 14 is unbeaten in [138413.22, 156390.30]
+    mnt6_G1::fixed_base_exp_window_table.push_back(138413);
+    // window 15 is unbeaten in [156390.30, 562560.50]
+    mnt6_G1::fixed_base_exp_window_table.push_back(156390);
+    // window 16 is unbeaten in [562560.50, 1036742.02]
+    mnt6_G1::fixed_base_exp_window_table.push_back(562560);
+    // window 17 is unbeaten in [1036742.02, 2053818.86]
+    mnt6_G1::fixed_base_exp_window_table.push_back(1036742);
+    // window 18 is unbeaten in [2053818.86, 4370223.95]
+    mnt6_G1::fixed_base_exp_window_table.push_back(2053819);
+    // window 19 is unbeaten in [4370223.95, 8215703.81]
+    mnt6_G1::fixed_base_exp_window_table.push_back(4370224);
+    // window 20 is unbeaten in [8215703.81, 42682375.43]
+    mnt6_G1::fixed_base_exp_window_table.push_back(8215704);
+    // window 21 is never the best
+    mnt6_G1::fixed_base_exp_window_table.push_back(0);
+    // window 22 is unbeaten in [42682375.43, inf]
+    mnt6_G1::fixed_base_exp_window_table.push_back(42682375);
+
+    /* choice of group G2 */
+    mnt6_G2::G2_zero = mnt6_G2(mnt6_Fq3::zero(),
+                               mnt6_Fq3::one(),
+                               mnt6_Fq3::zero());
+    mnt6_G2::G2_one = mnt6_G2(mnt6_Fq3(mnt6_Fq("421456435772811846256826561593908322288509115489119907560382401870203318738334702321297427"),
+                                       mnt6_Fq("103072927438548502463527009961344915021167584706439945404959058962657261178393635706405114"),
+                                       mnt6_Fq("143029172143731852627002926324735183809768363301149009204849580478324784395590388826052558")),
+                              mnt6_Fq3(mnt6_Fq("464673596668689463130099227575639512541218133445388869383893594087634649237515554342751377"),
+                                       mnt6_Fq("100642907501977375184575075967118071807821117960152743335603284583254620685343989304941678"),
+                                       mnt6_Fq("123019855502969896026940545715841181300275180157288044663051565390506010149881373807142903")),
+                              mnt6_Fq3::one());
+
+    mnt6_G2::wnaf_window_table.resize(0);
+    mnt6_G2::wnaf_window_table.push_back(5);
+    mnt6_G2::wnaf_window_table.push_back(15);
+    mnt6_G2::wnaf_window_table.push_back(39);
+    mnt6_G2::wnaf_window_table.push_back(109);
+
+    mnt6_G2::fixed_base_exp_window_table.resize(0);
+    // window 1 is unbeaten in [-inf, 4.25]
+    mnt6_G2::fixed_base_exp_window_table.push_back(1);
+    // window 2 is unbeaten in [4.25, 10.22]
+    mnt6_G2::fixed_base_exp_window_table.push_back(4);
+    // window 3 is unbeaten in [10.22, 24.85]
+    mnt6_G2::fixed_base_exp_window_table.push_back(10);
+    // window 4 is unbeaten in [24.85, 60.06]
+    mnt6_G2::fixed_base_exp_window_table.push_back(25);
+    // window 5 is unbeaten in [60.06, 143.61]
+    mnt6_G2::fixed_base_exp_window_table.push_back(60);
+    // window 6 is unbeaten in [143.61, 345.66]
+    mnt6_G2::fixed_base_exp_window_table.push_back(144);
+    // window 7 is unbeaten in [345.66, 818.56]
+    mnt6_G2::fixed_base_exp_window_table.push_back(346);
+    // window 8 is unbeaten in [818.56, 1782.06]
+    mnt6_G2::fixed_base_exp_window_table.push_back(819);
+    // window 9 is unbeaten in [1782.06, 4002.45]
+    mnt6_G2::fixed_base_exp_window_table.push_back(1782);
+    // window 10 is unbeaten in [4002.45, 10870.18]
+    mnt6_G2::fixed_base_exp_window_table.push_back(4002);
+    // window 11 is unbeaten in [10870.18, 18022.51]
+    mnt6_G2::fixed_base_exp_window_table.push_back(10870);
+    // window 12 is unbeaten in [18022.51, 43160.74]
+    mnt6_G2::fixed_base_exp_window_table.push_back(18023);
+    // window 13 is unbeaten in [43160.74, 149743.32]
+    mnt6_G2::fixed_base_exp_window_table.push_back(43161);
+    // window 14 is never the best
+    mnt6_G2::fixed_base_exp_window_table.push_back(0);
+    // window 15 is unbeaten in [149743.32, 551844.13]
+    mnt6_G2::fixed_base_exp_window_table.push_back(149743);
+    // window 16 is unbeaten in [551844.13, 1041827.91]
+    mnt6_G2::fixed_base_exp_window_table.push_back(551844);
+    // window 17 is unbeaten in [1041827.91, 1977371.53]
+    mnt6_G2::fixed_base_exp_window_table.push_back(1041828);
+    // window 18 is unbeaten in [1977371.53, 3703619.51]
+    mnt6_G2::fixed_base_exp_window_table.push_back(1977372);
+    // window 19 is unbeaten in [3703619.51, 7057236.87]
+    mnt6_G2::fixed_base_exp_window_table.push_back(3703620);
+    // window 20 is unbeaten in [7057236.87, 38554491.67]
+    mnt6_G2::fixed_base_exp_window_table.push_back(7057237);
+    // window 21 is never the best
+    mnt6_G2::fixed_base_exp_window_table.push_back(0);
+    // window 22 is unbeaten in [38554491.67, inf]
+    mnt6_G2::fixed_base_exp_window_table.push_back(38554492);
+
+    /* pairing parameters */
+    mnt6_ate_loop_count = bigint_q("689871209842287392837045615510547309923794944");
+    mnt6_ate_is_loop_count_neg = true;
+    mnt6_final_exponent = bigint<6*mnt6_q_limbs>("24416320138090509697890595414313438768353977489862543935904010715439066975957855922532159264213056712140358746422742237328406558352706591021642230618060502855451264045397444793186876199015256781648746888625527075466063075011307800862173764236311342105211681121426931616843635215852236649271569251468773714424208521977615548771268520882870120900360322044218806712027729351845307690474985502587527753847200130592058098363641559341826790559426614919168");
+    mnt6_final_exponent_last_chunk_abs_of_w0 = bigint_q("689871209842287392837045615510547309923794944");
+    mnt6_final_exponent_last_chunk_is_w0_neg = true;
+    mnt6_final_exponent_last_chunk_w1 = bigint_q("1");
+}
+
+} // libff
diff --git a/src/libff/libff/algebra/curves/mnt/mnt6/mnt6_init.hpp b/src/libff/libff/algebra/curves/mnt/mnt6/mnt6_init.hpp
new file mode 100755
index 000000000..e4e2c942c
--- /dev/null
+++ b/src/libff/libff/algebra/curves/mnt/mnt6/mnt6_init.hpp
@@ -0,0 +1,69 @@
+/** @file
+ *****************************************************************************
+
+ Declaration of interfaces for initializing MNT6.
+
+ *****************************************************************************
+ * @author     This file is part of libff, developed by SCIPR Lab
+ *             and contributors (see AUTHORS).
+ * @copyright  MIT license (see LICENSE file)
+ *****************************************************************************/
+
+#ifndef MNT6_INIT_HPP_
+#define MNT6_INIT_HPP_
+
+#include <libff/algebra/curves/mnt/mnt46_common.hpp>
+#include <libff/algebra/curves/public_params.hpp>
+#include <libff/algebra/fields/fp.hpp>
+#include <libff/algebra/fields/fp3.hpp>
+#include <libff/algebra/fields/fp6_2over3.hpp>
+
+namespace libff {
+
+#define mnt6_modulus_r mnt46_modulus_B
+#define mnt6_modulus_q mnt46_modulus_A
+
+const mp_size_t mnt6_r_bitcount = mnt46_B_bitcount;
+const mp_size_t mnt6_q_bitcount = mnt46_A_bitcount;
+
+const mp_size_t mnt6_r_limbs = mnt46_B_limbs;
+const mp_size_t mnt6_q_limbs = mnt46_A_limbs;
+
+extern bigint<mnt6_r_limbs> mnt6_modulus_r;
+extern bigint<mnt6_q_limbs> mnt6_modulus_q;
+
+typedef Fp_model<mnt6_r_limbs, mnt6_modulus_r> mnt6_Fr;
+typedef Fp_model<mnt6_q_limbs, mnt6_modulus_q> mnt6_Fq;
+typedef Fp3_model<mnt6_q_limbs, mnt6_modulus_q> mnt6_Fq3;
+typedef Fp6_2over3_model<mnt6_q_limbs, mnt6_modulus_q> mnt6_Fq6;
+typedef mnt6_Fq6 mnt6_GT;
+
+// parameters for twisted short Weierstrass curve E'/Fq3 : y^2 = x^3 + (a * twist^2) * x + (b * twist^3)
+extern mnt6_Fq3 mnt6_twist;
+extern mnt6_Fq3 mnt6_twist_coeff_a;
+extern mnt6_Fq3 mnt6_twist_coeff_b;
+extern mnt6_Fq mnt6_twist_mul_by_a_c0;
+extern mnt6_Fq mnt6_twist_mul_by_a_c1;
+extern mnt6_Fq mnt6_twist_mul_by_a_c2;
+extern mnt6_Fq mnt6_twist_mul_by_b_c0;
+extern mnt6_Fq mnt6_twist_mul_by_b_c1;
+extern mnt6_Fq mnt6_twist_mul_by_b_c2;
+extern mnt6_Fq mnt6_twist_mul_by_q_X;
+extern mnt6_Fq mnt6_twist_mul_by_q_Y;
+
+// parameters for pairing
+extern bigint<mnt6_q_limbs> mnt6_ate_loop_count;
+extern bool mnt6_ate_is_loop_count_neg;
+extern bigint<6*mnt6_q_limbs> mnt6_final_exponent;
+extern bigint<mnt6_q_limbs> mnt6_final_exponent_last_chunk_abs_of_w0;
+extern bool mnt6_final_exponent_last_chunk_is_w0_neg;
+extern bigint<mnt6_q_limbs> mnt6_final_exponent_last_chunk_w1;
+
+void init_mnt6_params();
+
+class mnt6_G1;
+class mnt6_G2;
+
+} // libff
+
+#endif // MNT6_INIT_HPP_
diff --git a/src/libff/libff/algebra/curves/mnt/mnt6/mnt6_pairing.cpp b/src/libff/libff/algebra/curves/mnt/mnt6/mnt6_pairing.cpp
new file mode 100755
index 000000000..75a85a865
--- /dev/null
+++ b/src/libff/libff/algebra/curves/mnt/mnt6/mnt6_pairing.cpp
@@ -0,0 +1,753 @@
+/** @file
+ *****************************************************************************
+
+ Implementation of interfaces for pairing operations on MNT6.
+
+ See mnt6_pairing.hpp .
+
+ *****************************************************************************
+ * @author     This file is part of libff, developed by SCIPR Lab
+ *             and contributors (see AUTHORS).
+ * @copyright  MIT license (see LICENSE file)
+ *****************************************************************************/
+
+#include <cassert>
+
+#include <libff/algebra/curves/mnt/mnt6/mnt6_g1.hpp>
+#include <libff/algebra/curves/mnt/mnt6/mnt6_g2.hpp>
+#include <libff/algebra/curves/mnt/mnt6/mnt6_init.hpp>
+#include <libff/algebra/curves/mnt/mnt6/mnt6_pairing.hpp>
+#include <libff/algebra/scalar_multiplication/wnaf.hpp>
+#include <libff/common/profiling.hpp>
+
+namespace libff {
+
+bool mnt6_ate_G1_precomp::operator==(const mnt6_ate_G1_precomp &other) const
+{
+    return (this->PX == other.PX &&
+            this->PY == other.PY &&
+            this->PX_twist == other.PX_twist &&
+            this->PY_twist == other.PY_twist);
+}
+
+std::ostream& operator<<(std::ostream &out, const mnt6_ate_G1_precomp &prec_P)
+{
+    out << prec_P.PX << OUTPUT_SEPARATOR << prec_P.PY << OUTPUT_SEPARATOR << prec_P.PX_twist << OUTPUT_SEPARATOR << prec_P.PY_twist;
+
+    return out;
+}
+
+std::istream& operator>>(std::istream &in, mnt6_ate_G1_precomp &prec_P)
+{
+    in >> prec_P.PX;
+    consume_OUTPUT_SEPARATOR(in);
+    in >> prec_P.PY;
+    consume_OUTPUT_SEPARATOR(in);
+    in >> prec_P.PX_twist;
+    consume_OUTPUT_SEPARATOR(in);
+    in >> prec_P.PY_twist;
+
+    return in;
+}
+
+bool mnt6_ate_dbl_coeffs::operator==(const mnt6_ate_dbl_coeffs &other) const
+{
+    return (this->c_H == other.c_H &&
+            this->c_4C == other.c_4C &&
+            this->c_J == other.c_J &&
+            this->c_L == other.c_L);
+}
+
+std::ostream& operator<<(std::ostream &out, const mnt6_ate_dbl_coeffs &dc)
+{
+    out << dc.c_H << OUTPUT_SEPARATOR << dc.c_4C << OUTPUT_SEPARATOR << dc.c_J << OUTPUT_SEPARATOR << dc.c_L;
+    return out;
+}
+
+std::istream& operator>>(std::istream &in, mnt6_ate_dbl_coeffs &dc)
+{
+    in >> dc.c_H;
+    consume_OUTPUT_SEPARATOR(in);
+    in >> dc.c_4C;
+    consume_OUTPUT_SEPARATOR(in);
+    in >> dc.c_J;
+    consume_OUTPUT_SEPARATOR(in);
+    in >> dc.c_L;
+
+    return in;
+}
+
+bool mnt6_ate_add_coeffs::operator==(const mnt6_ate_add_coeffs &other) const
+{
+    return (this->c_L1 == other.c_L1 &&
+            this->c_RZ == other.c_RZ);
+}
+
+std::ostream& operator<<(std::ostream &out, const mnt6_ate_add_coeffs &ac)
+{
+    out << ac.c_L1 << OUTPUT_SEPARATOR << ac.c_RZ;
+    return out;
+}
+
+std::istream& operator>>(std::istream &in, mnt6_ate_add_coeffs &ac)
+{
+    in >> ac.c_L1;
+    consume_OUTPUT_SEPARATOR(in);
+    in >> ac.c_RZ;
+
+    return in;
+}
+
+
+bool mnt6_ate_G2_precomp::operator==(const mnt6_ate_G2_precomp &other) const
+{
+    return (this->QX == other.QX &&
+            this->QY == other.QY &&
+            this->QY2 == other.QY2 &&
+            this->QX_over_twist == other.QX_over_twist &&
+            this->QY_over_twist == other.QY_over_twist &&
+            this->dbl_coeffs == other.dbl_coeffs &&
+            this->add_coeffs == other.add_coeffs);
+}
+
+std::ostream& operator<<(std::ostream& out, const mnt6_ate_G2_precomp &prec_Q)
+{
+    out << prec_Q.QX << OUTPUT_SEPARATOR
+        << prec_Q.QY << OUTPUT_SEPARATOR
+        << prec_Q.QY2  << OUTPUT_SEPARATOR
+        << prec_Q.QX_over_twist << OUTPUT_SEPARATOR
+        << prec_Q.QY_over_twist << "\n";
+    out << prec_Q.dbl_coeffs.size() << "\n";
+    for (const mnt6_ate_dbl_coeffs &dc : prec_Q.dbl_coeffs)
+    {
+        out << dc << OUTPUT_NEWLINE;
+    }
+    out << prec_Q.add_coeffs.size() << "\n";
+    for (const mnt6_ate_add_coeffs &ac : prec_Q.add_coeffs)
+    {
+        out << ac << OUTPUT_NEWLINE;
+    }
+
+    return out;
+}
+
+std::istream& operator>>(std::istream& in, mnt6_ate_G2_precomp &prec_Q)
+{
+    in >> prec_Q.QX;
+    consume_OUTPUT_SEPARATOR(in);
+    in >> prec_Q.QY;
+    consume_OUTPUT_SEPARATOR(in);
+    in >> prec_Q.QY2;
+    consume_OUTPUT_SEPARATOR(in);
+    in >> prec_Q.QX_over_twist;
+    consume_OUTPUT_SEPARATOR(in);
+    in >> prec_Q.QY_over_twist;
+    consume_newline(in);
+
+    prec_Q.dbl_coeffs.clear();
+    size_t dbl_s;
+    in >> dbl_s;
+    consume_newline(in);
+
+    prec_Q.dbl_coeffs.reserve(dbl_s);
+
+    for (size_t i = 0; i < dbl_s; ++i)
+    {
+        mnt6_ate_dbl_coeffs dc;
+        in >> dc;
+        consume_OUTPUT_NEWLINE(in);
+        prec_Q.dbl_coeffs.emplace_back(dc);
+    }
+
+    prec_Q.add_coeffs.clear();
+    size_t add_s;
+    in >> add_s;
+    consume_newline(in);
+
+    prec_Q.add_coeffs.reserve(add_s);
+
+    for (size_t i = 0; i < add_s; ++i)
+    {
+        mnt6_ate_add_coeffs ac;
+        in >> ac;
+        consume_OUTPUT_NEWLINE(in);
+        prec_Q.add_coeffs.emplace_back(ac);
+    }
+
+    return in;
+}
+
+/* final exponentiations */
+
+mnt6_Fq6 mnt6_final_exponentiation_last_chunk(const mnt6_Fq6 &elt, const mnt6_Fq6 &elt_inv)
+{
+    enter_block("Call to mnt6_final_exponentiation_last_chunk");
+    const mnt6_Fq6 elt_q = elt.Frobenius_map(1);
+    mnt6_Fq6 w1_part = elt_q.cyclotomic_exp(mnt6_final_exponent_last_chunk_w1);
+    mnt6_Fq6 w0_part;
+    if (mnt6_final_exponent_last_chunk_is_w0_neg)
+    {
+    	w0_part = elt_inv.cyclotomic_exp(mnt6_final_exponent_last_chunk_abs_of_w0);
+    } else {
+    	w0_part = elt.cyclotomic_exp(mnt6_final_exponent_last_chunk_abs_of_w0);
+    }
+    mnt6_Fq6 result = w1_part * w0_part;
+    leave_block("Call to mnt6_final_exponentiation_last_chunk");
+
+    return result;
+}
+
+mnt6_Fq6 mnt6_final_exponentiation_first_chunk(const mnt6_Fq6 &elt, const mnt6_Fq6 &elt_inv)
+{
+    enter_block("Call to mnt6_final_exponentiation_first_chunk");
+
+    /* (q^3-1)*(q+1) */
+
+    /* elt_q3 = elt^(q^3) */
+    const mnt6_Fq6 elt_q3 = elt.Frobenius_map(3);
+    /* elt_q3_over_elt = elt^(q^3-1) */
+    const mnt6_Fq6 elt_q3_over_elt = elt_q3 * elt_inv;
+    /* alpha = elt^((q^3-1) * q) */
+    const mnt6_Fq6 alpha = elt_q3_over_elt.Frobenius_map(1);
+    /* beta = elt^((q^3-1)*(q+1) */
+    const mnt6_Fq6 beta = alpha * elt_q3_over_elt;
+    leave_block("Call to mnt6_final_exponentiation_first_chunk");
+    return beta;
+}
+
+mnt6_GT mnt6_final_exponentiation(const mnt6_Fq6 &elt)
+{
+    enter_block("Call to mnt6_final_exponentiation");
+    const mnt6_Fq6 elt_inv = elt.inverse();
+    const mnt6_Fq6 elt_to_first_chunk = mnt6_final_exponentiation_first_chunk(elt, elt_inv);
+    const mnt6_Fq6 elt_inv_to_first_chunk = mnt6_final_exponentiation_first_chunk(elt_inv, elt);
+    mnt6_GT result = mnt6_final_exponentiation_last_chunk(elt_to_first_chunk, elt_inv_to_first_chunk);
+    leave_block("Call to mnt6_final_exponentiation");
+
+    return result;
+}
+
+/* affine ate miller loop */
+
+mnt6_affine_ate_G1_precomputation mnt6_affine_ate_precompute_G1(const mnt6_G1& P)
+{
+    enter_block("Call to mnt6_affine_ate_precompute_G1");
+
+    mnt6_G1 Pcopy = P;
+    Pcopy.to_affine_coordinates();
+
+    mnt6_affine_ate_G1_precomputation result;
+    result.PX = Pcopy.X();
+    result.PY = Pcopy.Y();
+    result.PY_twist_squared = Pcopy.Y() * mnt6_twist.squared();
+
+    leave_block("Call to mnt6_affine_ate_precompute_G1");
+    return result;
+}
+
+mnt6_affine_ate_G2_precomputation mnt6_affine_ate_precompute_G2(const mnt6_G2& Q)
+{
+    enter_block("Call to mnt6_affine_ate_precompute_G2");
+
+    mnt6_G2 Qcopy(Q);
+    Qcopy.to_affine_coordinates();
+
+    mnt6_affine_ate_G2_precomputation result;
+    result.QX = Qcopy.X();
+    result.QY = Qcopy.Y();
+
+    mnt6_Fq3 RX = Qcopy.X();
+    mnt6_Fq3 RY = Qcopy.Y();
+
+    const bigint<mnt6_Fr::num_limbs> &loop_count = mnt6_ate_loop_count;
+    bool found_nonzero = false;
+
+    std::vector<long> NAF = find_wnaf(1, loop_count);
+    for (long i = NAF.size() - 1; i >= 0; --i)
+    {
+        if (!found_nonzero)
+        {
+            /* this skips the MSB itself */
+            found_nonzero |= (NAF[i] != 0);
+            continue;
+        }
+
+        mnt6_affine_ate_coeffs c;
+        c.old_RX = RX;
+        c.old_RY = RY;
+        mnt6_Fq3 old_RX_2 = c.old_RX.squared();
+        c.gamma = (old_RX_2 + old_RX_2 + old_RX_2 + mnt6_twist_coeff_a) * (c.old_RY + c.old_RY).inverse();
+        c.gamma_twist = c.gamma * mnt6_twist;
+        c.gamma_X = c.gamma * c.old_RX;
+        result.coeffs.push_back(c);
+
+        RX = c.gamma.squared() - (c.old_RX+c.old_RX);
+        RY = c.gamma * (c.old_RX - RX) - c.old_RY;
+
+        if (NAF[i] != 0)
+        {
+            mnt6_affine_ate_coeffs c;
+            c.old_RX = RX;
+            c.old_RY = RY;
+            if (NAF[i] > 0)
+            {
+                c.gamma = (c.old_RY - result.QY) * (c.old_RX - result.QX).inverse();
+            }
+            else
+            {
+                c.gamma = (c.old_RY + result.QY) * (c.old_RX - result.QX).inverse();
+            }
+            c.gamma_twist = c.gamma * mnt6_twist;
+            c.gamma_X = c.gamma * result.QX;
+            result.coeffs.push_back(c);
+
+            RX = c.gamma.squared() - (c.old_RX+result.QX);
+            RY = c.gamma * (c.old_RX - RX) - c.old_RY;
+        }
+    }
+
+    /* TODO: maybe handle neg
+    if (mnt6_ate_is_loop_count_neg)
+    {
+    	mnt6_ate_add_coeffs ac;
+		mnt6_affine_ate_dbl_coeffs c;
+		c.old_RX = RX;
+		c.old_RY = -RY;
+		old_RX_2 = c.old_RY.squared();
+		c.gamma = (old_RX_2 + old_RX_2 + old_RX_2 + mnt6_coeff_a) * (c.old_RY + c.old_RY).inverse();
+		c.gamma_twist = c.gamma * mnt6_twist;
+		c.gamma_X = c.gamma * c.old_RX;
+		result.coeffs.push_back(c);
+    }
+    */
+
+    leave_block("Call to mnt6_affine_ate_precompute_G2");
+    return result;
+}
+
+mnt6_Fq6 mnt6_affine_ate_miller_loop(const mnt6_affine_ate_G1_precomputation &prec_P,
+                                     const mnt6_affine_ate_G2_precomputation &prec_Q)
+{
+    enter_block("Call to mnt6_affine_ate_miller_loop");
+
+    mnt6_Fq6 f = mnt6_Fq6::one();
+
+    const bigint<mnt6_Fr::num_limbs> &loop_count = mnt6_ate_loop_count;
+    bool found_nonzero = false;
+    size_t idx = 0;
+
+    std::vector<long> NAF = find_wnaf(1, loop_count);
+    for (long i = NAF.size() - 1; i >= 0; --i)
+    {
+        if (!found_nonzero)
+        {
+            /* this skips the MSB itself */
+            found_nonzero |= (NAF[i] != 0);
+            continue;
+        }
+
+        /* code below gets executed for all bits (EXCEPT the MSB itself) of
+           mnt6_param_p (skipping leading zeros) in MSB to LSB
+           order */
+        mnt6_affine_ate_coeffs c = prec_Q.coeffs[idx++];
+
+        mnt6_Fq6 g_RR_at_P = mnt6_Fq6(prec_P.PY_twist_squared,
+                                      - prec_P.PX * c.gamma_twist + c.gamma_X - c.old_RY);
+        f = f.squared().mul_by_2345(g_RR_at_P);
+
+        if (NAF[i] != 0)
+        {
+            mnt6_affine_ate_coeffs c = prec_Q.coeffs[idx++];
+            mnt6_Fq6 g_RQ_at_P;
+            if (NAF[i] > 0)
+            {
+                g_RQ_at_P = mnt6_Fq6(prec_P.PY_twist_squared,
+                                     - prec_P.PX * c.gamma_twist + c.gamma_X - prec_Q.QY);
+            }
+            else
+            {
+                g_RQ_at_P = mnt6_Fq6(prec_P.PY_twist_squared,
+                                     - prec_P.PX * c.gamma_twist + c.gamma_X + prec_Q.QY);
+            }
+            f = f.mul_by_2345(g_RQ_at_P);
+        }
+
+    }
+
+    /* TODO: maybe handle neg
+    if (mnt6_ate_is_loop_count_neg)
+    {
+    	// TODO:
+    	mnt6_affine_ate_coeffs ac = prec_Q.coeffs[idx++];
+    	mnt6_Fq6 g_RnegR_at_P = mnt6_Fq6(prec_P.PY_twist_squared,
+                                          - prec_P.PX * c.gamma_twist + c.gamma_X - c.old_RY);
+    	f = (f * g_RnegR_at_P).inverse();
+    }
+    */
+
+    leave_block("Call to mnt6_affine_ate_miller_loop");
+
+    return f;
+}
+
+/* ate pairing */
+
+struct extended_mnt6_G2_projective {
+    mnt6_Fq3 X;
+    mnt6_Fq3 Y;
+    mnt6_Fq3 Z;
+    mnt6_Fq3 T;
+
+    void print() const
+    {
+        printf("extended mnt6_G2 projective X/Y/Z/T:\n");
+        X.print();
+        Y.print();
+        Z.print();
+        T.print();
+    }
+
+    void test_invariant() const
+    {
+        assert(T == Z.squared());
+    }
+};
+
+void doubling_step_for_flipped_miller_loop(extended_mnt6_G2_projective &current,
+                                           mnt6_ate_dbl_coeffs &dc)
+{
+    const mnt6_Fq3 X = current.X, Y = current.Y, Z = current.Z, T = current.T;
+
+    const mnt6_Fq3 A = T.squared(); // A = T1^2
+    const mnt6_Fq3 B = X.squared(); // B = X1^2
+    const mnt6_Fq3 C = Y.squared(); // C = Y1^2
+    const mnt6_Fq3 D = C.squared(); // D = C^2
+    const mnt6_Fq3 E = (X+C).squared() - B - D; // E = (X1+C)^2-B-D
+    const mnt6_Fq3 F = (B+B+B) + mnt6_twist_coeff_a * A; // F = 3*B +  a  *A
+    const mnt6_Fq3 G = F.squared(); // G = F^2
+
+    current.X = -(E+E+E+E) + G; // X3 = -4*E+G
+    current.Y = -mnt6_Fq("8")*D + F*(E+E-current.X); // Y3 = -8*D+F*(2*E-X3)
+    current.Z = (Y+Z).squared() - C - Z.squared(); // Z3 = (Y1+Z1)^2-C-Z1^2
+    current.T = current.Z.squared(); // T3 = Z3^2
+
+    dc.c_H = (current.Z + T).squared() - current.T - A; // H = (Z3+T1)^2-T3-A
+    dc.c_4C = C+C+C+C; // fourC = 4*C
+    dc.c_J = (F+T).squared() - G - A; // J = (F+T1)^2-G-A
+    dc.c_L = (F+X).squared() - G - B; // L = (F+X1)^2-G-B
+
+#ifdef DEBUG
+    current.test_invariant();
+#endif
+}
+
+void mixed_addition_step_for_flipped_miller_loop(const mnt6_Fq3 base_X, const mnt6_Fq3 base_Y, const mnt6_Fq3 base_Y_squared,
+                                                 extended_mnt6_G2_projective &current,
+                                                 mnt6_ate_add_coeffs &ac)
+{
+    const mnt6_Fq3 X1 = current.X, Y1 = current.Y, Z1 = current.Z, T1 = current.T;
+    const mnt6_Fq3 &x2 = base_X,    &y2 =  base_Y, &y2_squared = base_Y_squared;
+
+    const mnt6_Fq3 B = x2 * T1; // B = x2 * T1
+    const mnt6_Fq3 D = ((y2 + Z1).squared() - y2_squared - T1) * T1; // D = ((y2 + Z1)^2 - y2squared - T1) * T1
+    const mnt6_Fq3 H = B - X1; // H = B - X1
+    const mnt6_Fq3 I = H.squared(); // I = H^2
+    const mnt6_Fq3 E = I + I + I + I; // E = 4*I
+    const mnt6_Fq3 J = H * E; // J = H * E
+    const mnt6_Fq3 V = X1 * E; // V = X1 * E
+    const mnt6_Fq3 L1 = D - (Y1 + Y1); // L1 = D - 2 * Y1
+
+    current.X = L1.squared() - J - (V+V); // X3 = L1^2 - J - 2*V
+    current.Y = L1 * (V-current.X) - (Y1+Y1) * J; // Y3 = L1 * (V-X3) - 2*Y1 * J
+    current.Z = (Z1+H).squared() - T1 - I; // Z3 = (Z1 + H)^2 - T1 - I
+    current.T = current.Z.squared(); // T3 = Z3^2
+
+    ac.c_L1 = L1;
+    ac.c_RZ = current.Z;
+#ifdef DEBUG
+    current.test_invariant();
+#endif
+}
+
+mnt6_ate_G1_precomp mnt6_ate_precompute_G1(const mnt6_G1& P)
+{
+    enter_block("Call to mnt6_ate_precompute_G1");
+
+    mnt6_G1 Pcopy = P;
+    Pcopy.to_affine_coordinates();
+
+    mnt6_ate_G1_precomp result;
+    result.PX = Pcopy.X();
+    result.PY = Pcopy.Y();
+    result.PX_twist = Pcopy.X() * mnt6_twist;
+    result.PY_twist = Pcopy.Y() * mnt6_twist;
+
+    leave_block("Call to mnt6_ate_precompute_G1");
+    return result;
+}
+
+mnt6_ate_G2_precomp mnt6_ate_precompute_G2(const mnt6_G2& Q)
+{
+    enter_block("Call to mnt6_ate_precompute_G2");
+
+    mnt6_G2 Qcopy(Q);
+    Qcopy.to_affine_coordinates();
+
+    mnt6_Fq3 mnt6_twist_inv = mnt6_twist.inverse(); // could add to global params if needed
+
+    mnt6_ate_G2_precomp result;
+    result.QX = Qcopy.X();
+    result.QY = Qcopy.Y();
+    result.QY2 = Qcopy.Y().squared();
+    result.QX_over_twist = Qcopy.X() * mnt6_twist_inv;
+    result.QY_over_twist = Qcopy.Y() * mnt6_twist_inv;
+
+    extended_mnt6_G2_projective R;
+    R.X = Qcopy.X();
+    R.Y = Qcopy.Y();
+    R.Z = mnt6_Fq3::one();
+    R.T = mnt6_Fq3::one();
+
+    const bigint<mnt6_Fr::num_limbs> &loop_count = mnt6_ate_loop_count;
+    bool found_one = false;
+    for (long i = loop_count.max_bits() - 1; i >= 0; --i)
+    {
+        const bool bit = loop_count.test_bit(i);
+
+        if (!found_one)
+        {
+            /* this skips the MSB itself */
+            found_one |= bit;
+            continue;
+        }
+
+        mnt6_ate_dbl_coeffs dc;
+        doubling_step_for_flipped_miller_loop(R, dc);
+        result.dbl_coeffs.push_back(dc);
+
+        if (bit)
+        {
+            mnt6_ate_add_coeffs ac;
+            mixed_addition_step_for_flipped_miller_loop(result.QX, result.QY, result.QY2, R, ac);
+            result.add_coeffs.push_back(ac);
+        }
+    }
+
+    if (mnt6_ate_is_loop_count_neg)
+    {
+    	mnt6_Fq3 RZ_inv = R.Z.inverse();
+    	mnt6_Fq3 RZ2_inv = RZ_inv.squared();
+    	mnt6_Fq3 RZ3_inv = RZ2_inv * RZ_inv;
+    	mnt6_Fq3 minus_R_affine_X = R.X * RZ2_inv;
+    	mnt6_Fq3 minus_R_affine_Y = - R.Y * RZ3_inv;
+    	mnt6_Fq3 minus_R_affine_Y2 = minus_R_affine_Y.squared();
+    	mnt6_ate_add_coeffs ac;
+        mixed_addition_step_for_flipped_miller_loop(minus_R_affine_X, minus_R_affine_Y, minus_R_affine_Y2, R, ac);
+        result.add_coeffs.push_back(ac);
+    }
+
+    leave_block("Call to mnt6_ate_precompute_G2");
+    return result;
+}
+
+mnt6_Fq6 mnt6_ate_miller_loop(const mnt6_ate_G1_precomp &prec_P,
+                              const mnt6_ate_G2_precomp &prec_Q)
+{
+    enter_block("Call to mnt6_ate_miller_loop");
+
+    mnt6_Fq3 L1_coeff = mnt6_Fq3(prec_P.PX, mnt6_Fq::zero(), mnt6_Fq::zero()) - prec_Q.QX_over_twist;
+
+    mnt6_Fq6 f = mnt6_Fq6::one();
+
+    bool found_one = false;
+    size_t dbl_idx = 0;
+    size_t add_idx = 0;
+
+    const bigint<mnt6_Fr::num_limbs> &loop_count = mnt6_ate_loop_count;
+
+    for (long i = loop_count.max_bits() - 1; i >= 0; --i)
+    {
+        const bool bit = loop_count.test_bit(i);
+
+        if (!found_one)
+        {
+            /* this skips the MSB itself */
+            found_one |= bit;
+            continue;
+        }
+
+        /* code below gets executed for all bits (EXCEPT the MSB itself) of
+           mnt6_param_p (skipping leading zeros) in MSB to LSB
+           order */
+        mnt6_ate_dbl_coeffs dc = prec_Q.dbl_coeffs[dbl_idx++];
+
+        mnt6_Fq6 g_RR_at_P = mnt6_Fq6(- dc.c_4C - dc.c_J * prec_P.PX_twist + dc.c_L,
+                                      dc.c_H * prec_P.PY_twist);
+        f = f.squared() * g_RR_at_P;
+
+        if (bit)
+        {
+            mnt6_ate_add_coeffs ac = prec_Q.add_coeffs[add_idx++];
+            mnt6_Fq6 g_RQ_at_P = mnt6_Fq6(ac.c_RZ * prec_P.PY_twist,
+                                          -(prec_Q.QY_over_twist * ac.c_RZ + L1_coeff * ac.c_L1));
+            f = f * g_RQ_at_P;
+        }
+
+    }
+
+    if (mnt6_ate_is_loop_count_neg)
+    {
+    	mnt6_ate_add_coeffs ac = prec_Q.add_coeffs[add_idx++];
+    	mnt6_Fq6 g_RnegR_at_P = mnt6_Fq6(ac.c_RZ * prec_P.PY_twist,
+                                         -(prec_Q.QY_over_twist * ac.c_RZ + L1_coeff * ac.c_L1));
+    	f = (f * g_RnegR_at_P).inverse();
+    }
+
+    leave_block("Call to mnt6_ate_miller_loop");
+
+    return f;
+}
+
+mnt6_Fq6 mnt6_ate_double_miller_loop(const mnt6_ate_G1_precomp &prec_P1,
+                                     const mnt6_ate_G2_precomp &prec_Q1,
+                                     const mnt6_ate_G1_precomp &prec_P2,
+                                     const mnt6_ate_G2_precomp &prec_Q2)
+{
+    enter_block("Call to mnt6_ate_double_miller_loop");
+
+    mnt6_Fq3 L1_coeff1 = mnt6_Fq3(prec_P1.PX, mnt6_Fq::zero(), mnt6_Fq::zero()) - prec_Q1.QX_over_twist;
+    mnt6_Fq3 L1_coeff2 = mnt6_Fq3(prec_P2.PX, mnt6_Fq::zero(), mnt6_Fq::zero()) - prec_Q2.QX_over_twist;
+
+    mnt6_Fq6 f = mnt6_Fq6::one();
+
+    bool found_one = false;
+    size_t dbl_idx = 0;
+    size_t add_idx = 0;
+
+    const bigint<mnt6_Fr::num_limbs> &loop_count = mnt6_ate_loop_count;
+
+    for (long i = loop_count.max_bits() - 1; i >= 0; --i)
+    {
+        const bool bit = loop_count.test_bit(i);
+
+        if (!found_one)
+        {
+            /* this skips the MSB itself */
+            found_one |= bit;
+            continue;
+        }
+
+        /* code below gets executed for all bits (EXCEPT the MSB itself) of
+           mnt6_param_p (skipping leading zeros) in MSB to LSB
+           order */
+        mnt6_ate_dbl_coeffs dc1 = prec_Q1.dbl_coeffs[dbl_idx];
+        mnt6_ate_dbl_coeffs dc2 = prec_Q2.dbl_coeffs[dbl_idx];
+        ++dbl_idx;
+
+        mnt6_Fq6 g_RR_at_P1 = mnt6_Fq6(- dc1.c_4C - dc1.c_J * prec_P1.PX_twist + dc1.c_L,
+                                       dc1.c_H * prec_P1.PY_twist);
+
+        mnt6_Fq6 g_RR_at_P2 = mnt6_Fq6(- dc2.c_4C - dc2.c_J * prec_P2.PX_twist + dc2.c_L,
+                                       dc2.c_H * prec_P2.PY_twist);
+
+        f = f.squared() * g_RR_at_P1 * g_RR_at_P2;
+
+        if (bit)
+        {
+            mnt6_ate_add_coeffs ac1 = prec_Q1.add_coeffs[add_idx];
+            mnt6_ate_add_coeffs ac2 = prec_Q2.add_coeffs[add_idx];
+            ++add_idx;
+
+            mnt6_Fq6 g_RQ_at_P1 = mnt6_Fq6(ac1.c_RZ * prec_P1.PY_twist,
+                                           -(prec_Q1.QY_over_twist * ac1.c_RZ + L1_coeff1 * ac1.c_L1));
+            mnt6_Fq6 g_RQ_at_P2 = mnt6_Fq6(ac2.c_RZ * prec_P2.PY_twist,
+                                           -(prec_Q2.QY_over_twist * ac2.c_RZ + L1_coeff2 * ac2.c_L1));
+
+            f = f * g_RQ_at_P1 * g_RQ_at_P2;
+        }
+    }
+
+    if (mnt6_ate_is_loop_count_neg)
+    {
+    	mnt6_ate_add_coeffs ac1 = prec_Q1.add_coeffs[add_idx];
+        mnt6_ate_add_coeffs ac2 = prec_Q2.add_coeffs[add_idx];
+    	++add_idx;
+    	mnt6_Fq6 g_RnegR_at_P1 = mnt6_Fq6(ac1.c_RZ * prec_P1.PY_twist,
+                                          -(prec_Q1.QY_over_twist * ac1.c_RZ + L1_coeff1 * ac1.c_L1));
+    	mnt6_Fq6 g_RnegR_at_P2 = mnt6_Fq6(ac2.c_RZ * prec_P2.PY_twist,
+                                          -(prec_Q2.QY_over_twist * ac2.c_RZ + L1_coeff2 * ac2.c_L1));
+
+    	f = (f * g_RnegR_at_P1 * g_RnegR_at_P2).inverse();
+    }
+
+    leave_block("Call to mnt6_ate_double_miller_loop");
+
+    return f;
+}
+
+mnt6_Fq6 mnt6_ate_pairing(const mnt6_G1& P, const mnt6_G2 &Q)
+{
+    enter_block("Call to mnt6_ate_pairing");
+    mnt6_ate_G1_precomp prec_P = mnt6_ate_precompute_G1(P);
+    mnt6_ate_G2_precomp prec_Q = mnt6_ate_precompute_G2(Q);
+    mnt6_Fq6 result = mnt6_ate_miller_loop(prec_P, prec_Q);
+    leave_block("Call to mnt6_ate_pairing");
+    return result;
+}
+
+mnt6_GT mnt6_ate_reduced_pairing(const mnt6_G1 &P, const mnt6_G2 &Q)
+{
+    enter_block("Call to mnt6_ate_reduced_pairing");
+    const mnt6_Fq6 f = mnt6_ate_pairing(P, Q);
+    const mnt6_GT result = mnt6_final_exponentiation(f);
+    leave_block("Call to mnt6_ate_reduced_pairing");
+    return result;
+}
+
+mnt6_G1_precomp mnt6_precompute_G1(const mnt6_G1& P)
+{
+    return mnt6_ate_precompute_G1(P);
+}
+
+mnt6_G2_precomp mnt6_precompute_G2(const mnt6_G2& Q)
+{
+    return mnt6_ate_precompute_G2(Q);
+}
+
+mnt6_Fq6 mnt6_miller_loop(const mnt6_G1_precomp &prec_P,
+                          const mnt6_G2_precomp &prec_Q)
+{
+    return mnt6_ate_miller_loop(prec_P, prec_Q);
+}
+
+mnt6_Fq6 mnt6_double_miller_loop(const mnt6_G1_precomp &prec_P1,
+                                 const mnt6_G2_precomp &prec_Q1,
+                                 const mnt6_G1_precomp &prec_P2,
+                                 const mnt6_G2_precomp &prec_Q2)
+{
+    return mnt6_ate_double_miller_loop(prec_P1, prec_Q1, prec_P2, prec_Q2);
+}
+
+mnt6_Fq6 mnt6_pairing(const mnt6_G1& P,
+                      const mnt6_G2 &Q)
+{
+    return mnt6_ate_pairing(P, Q);
+}
+
+mnt6_GT mnt6_reduced_pairing(const mnt6_G1 &P,
+                             const mnt6_G2 &Q)
+{
+    return mnt6_ate_reduced_pairing(P, Q);
+}
+
+mnt6_GT mnt6_affine_reduced_pairing(const mnt6_G1 &P,
+                                    const mnt6_G2 &Q)
+{
+    const mnt6_affine_ate_G1_precomputation prec_P = mnt6_affine_ate_precompute_G1(P);
+    const mnt6_affine_ate_G2_precomputation prec_Q = mnt6_affine_ate_precompute_G2(Q);
+    const mnt6_Fq6 f = mnt6_affine_ate_miller_loop(prec_P, prec_Q);
+    const mnt6_GT result = mnt6_final_exponentiation(f);
+    return result;
+}
+
+} // libff
diff --git a/src/libff/libff/algebra/curves/mnt/mnt6/mnt6_pairing.hpp b/src/libff/libff/algebra/curves/mnt/mnt6/mnt6_pairing.hpp
new file mode 100755
index 000000000..f636c8be6
--- /dev/null
+++ b/src/libff/libff/algebra/curves/mnt/mnt6/mnt6_pairing.hpp
@@ -0,0 +1,148 @@
+/** @file
+ *****************************************************************************
+
+ Declaration of interfaces for pairing operations on MNT6.
+
+ *****************************************************************************
+ * @author     This file is part of libff, developed by SCIPR Lab
+ *             and contributors (see AUTHORS).
+ * @copyright  MIT license (see LICENSE file)
+ *****************************************************************************/
+
+#ifndef MNT6_PAIRING_HPP_
+#define MNT6_PAIRING_HPP_
+
+#include <vector>
+
+#include <libff/algebra/curves/mnt/mnt6/mnt6_init.hpp>
+
+namespace libff {
+
+/* final exponentiation */
+
+mnt6_Fq6 mnt6_final_exponentiation_last_chunk(const mnt6_Fq6 &elt,
+                                              const mnt6_Fq6 &elt_inv);
+mnt6_Fq6 mnt6_final_exponentiation_first_chunk(const mnt6_Fq6 &elt,
+                                               const mnt6_Fq6 &elt_inv);
+mnt6_GT mnt6_final_exponentiation(const mnt6_Fq6 &elt);
+
+/* affine ate miller loop */
+
+struct mnt6_affine_ate_G1_precomputation {
+    mnt6_Fq PX;
+    mnt6_Fq PY;
+    mnt6_Fq3 PY_twist_squared;
+};
+
+struct mnt6_affine_ate_coeffs {
+    // TODO: trim (not all of them are needed)
+    mnt6_Fq3 old_RX;
+    mnt6_Fq3 old_RY;
+    mnt6_Fq3 gamma;
+    mnt6_Fq3 gamma_twist;
+    mnt6_Fq3 gamma_X;
+};
+
+struct mnt6_affine_ate_G2_precomputation {
+    mnt6_Fq3 QX;
+    mnt6_Fq3 QY;
+    std::vector<mnt6_affine_ate_coeffs> coeffs;
+};
+
+mnt6_affine_ate_G1_precomputation mnt6_affine_ate_precompute_G1(const mnt6_G1& P);
+mnt6_affine_ate_G2_precomputation mnt6_affine_ate_precompute_G2(const mnt6_G2& Q);
+
+mnt6_Fq6 mnt6_affine_ate_miller_loop(const mnt6_affine_ate_G1_precomputation &prec_P,
+                                     const mnt6_affine_ate_G2_precomputation &prec_Q);
+
+/* ate pairing */
+
+struct mnt6_ate_G1_precomp {
+    mnt6_Fq PX;
+    mnt6_Fq PY;
+    mnt6_Fq3 PX_twist;
+    mnt6_Fq3 PY_twist;
+
+    bool operator==(const mnt6_ate_G1_precomp &other) const;
+    friend std::ostream& operator<<(std::ostream &out, const mnt6_ate_G1_precomp &prec_P);
+    friend std::istream& operator>>(std::istream &in, mnt6_ate_G1_precomp &prec_P);
+};
+
+struct mnt6_ate_dbl_coeffs {
+    mnt6_Fq3 c_H;
+    mnt6_Fq3 c_4C;
+    mnt6_Fq3 c_J;
+    mnt6_Fq3 c_L;
+
+    bool operator==(const mnt6_ate_dbl_coeffs &other) const;
+    friend std::ostream& operator<<(std::ostream &out, const mnt6_ate_dbl_coeffs &dc);
+    friend std::istream& operator>>(std::istream &in, mnt6_ate_dbl_coeffs &dc);
+};
+
+struct mnt6_ate_add_coeffs {
+    mnt6_Fq3 c_L1;
+    mnt6_Fq3 c_RZ;
+
+    bool operator==(const mnt6_ate_add_coeffs &other) const;
+    friend std::ostream& operator<<(std::ostream &out, const mnt6_ate_add_coeffs &dc);
+    friend std::istream& operator>>(std::istream &in, mnt6_ate_add_coeffs &dc);
+};
+
+struct mnt6_ate_G2_precomp {
+    mnt6_Fq3 QX;
+    mnt6_Fq3 QY;
+    mnt6_Fq3 QY2;
+    mnt6_Fq3 QX_over_twist;
+    mnt6_Fq3 QY_over_twist;
+    std::vector<mnt6_ate_dbl_coeffs> dbl_coeffs;
+    std::vector<mnt6_ate_add_coeffs> add_coeffs;
+
+    bool operator==(const mnt6_ate_G2_precomp &other) const;
+    friend std::ostream& operator<<(std::ostream &out, const mnt6_ate_G2_precomp &prec_Q);
+    friend std::istream& operator>>(std::istream &in, mnt6_ate_G2_precomp &prec_Q);
+};
+
+mnt6_ate_G1_precomp mnt6_ate_precompute_G1(const mnt6_G1& P);
+mnt6_ate_G2_precomp mnt6_ate_precompute_G2(const mnt6_G2& Q);
+
+mnt6_Fq6 mnt6_ate_miller_loop(const mnt6_ate_G1_precomp &prec_P,
+                              const mnt6_ate_G2_precomp &prec_Q);
+mnt6_Fq6 mnt6_ate_double_miller_loop(const mnt6_ate_G1_precomp &prec_P1,
+                                     const mnt6_ate_G2_precomp &prec_Q1,
+                                     const mnt6_ate_G1_precomp &prec_P2,
+                                     const mnt6_ate_G2_precomp &prec_Q2);
+
+mnt6_Fq6 mnt6_ate_pairing(const mnt6_G1& P,
+                          const mnt6_G2 &Q);
+mnt6_GT mnt6_ate_reduced_pairing(const mnt6_G1 &P,
+                                 const mnt6_G2 &Q);
+
+/* choice of pairing */
+
+typedef mnt6_ate_G1_precomp mnt6_G1_precomp;
+typedef mnt6_ate_G2_precomp mnt6_G2_precomp;
+
+mnt6_G1_precomp mnt6_precompute_G1(const mnt6_G1& P);
+
+mnt6_G2_precomp mnt6_precompute_G2(const mnt6_G2& Q);
+
+mnt6_Fq6 mnt6_miller_loop(const mnt6_G1_precomp &prec_P,
+                          const mnt6_G2_precomp &prec_Q);
+
+mnt6_Fq6 mnt6_double_miller_loop(const mnt6_G1_precomp &prec_P1,
+                                 const mnt6_G2_precomp &prec_Q1,
+                                 const mnt6_G1_precomp &prec_P2,
+                                 const mnt6_G2_precomp &prec_Q2);
+
+mnt6_Fq6 mnt6_pairing(const mnt6_G1& P,
+                      const mnt6_G2 &Q);
+
+mnt6_GT mnt6_reduced_pairing(const mnt6_G1 &P,
+                             const mnt6_G2 &Q);
+
+mnt6_GT mnt6_affine_reduced_pairing(const mnt6_G1 &P,
+                                    const mnt6_G2 &Q);
+
+} // libff
+
+#endif // MNT6_PAIRING_HPP_
diff --git a/src/libff/libff/algebra/curves/mnt/mnt6/mnt6_pp.cpp b/src/libff/libff/algebra/curves/mnt/mnt6/mnt6_pp.cpp
new file mode 100755
index 000000000..df63999de
--- /dev/null
+++ b/src/libff/libff/algebra/curves/mnt/mnt6/mnt6_pp.cpp
@@ -0,0 +1,106 @@
+/** @file
+ *****************************************************************************
+
+ Implementation of interfaces for public parameters of MNT6.
+
+ See mnt6_pp.hpp .
+
+ *****************************************************************************
+ * @author     This file is part of libff, developed by SCIPR Lab
+ *             and contributors (see AUTHORS).
+ * @copyright  MIT license (see LICENSE file)
+ *****************************************************************************/
+
+#include <libff/algebra/curves/mnt/mnt6/mnt6_pp.hpp>
+
+namespace libff {
+
+void mnt6_pp::init_public_params()
+{
+    init_mnt6_params();
+}
+
+mnt6_GT mnt6_pp::final_exponentiation(const mnt6_Fq6 &elt)
+{
+    return mnt6_final_exponentiation(elt);
+}
+
+mnt6_G1_precomp mnt6_pp::precompute_G1(const mnt6_G1 &P)
+{
+    return mnt6_precompute_G1(P);
+}
+
+mnt6_G2_precomp mnt6_pp::precompute_G2(const mnt6_G2 &Q)
+{
+    return mnt6_precompute_G2(Q);
+}
+
+
+mnt6_Fq6 mnt6_pp::miller_loop(const mnt6_G1_precomp &prec_P,
+                              const mnt6_G2_precomp &prec_Q)
+{
+    return mnt6_miller_loop(prec_P, prec_Q);
+}
+
+mnt6_affine_ate_G1_precomputation mnt6_pp::affine_ate_precompute_G1(const mnt6_G1 &P)
+{
+    return mnt6_affine_ate_precompute_G1(P);
+}
+
+mnt6_affine_ate_G2_precomputation mnt6_pp::affine_ate_precompute_G2(const mnt6_G2 &Q)
+{
+    return mnt6_affine_ate_precompute_G2(Q);
+}
+
+mnt6_Fq6 mnt6_pp::affine_ate_miller_loop(const mnt6_affine_ate_G1_precomputation &prec_P,
+                                         const mnt6_affine_ate_G2_precomputation &prec_Q)
+{
+    return mnt6_affine_ate_miller_loop(prec_P, prec_Q);
+}
+
+mnt6_Fq6 mnt6_pp::double_miller_loop(const mnt6_G1_precomp &prec_P1,
+                                     const mnt6_G2_precomp &prec_Q1,
+                                     const mnt6_G1_precomp &prec_P2,
+                                     const mnt6_G2_precomp &prec_Q2)
+{
+    return mnt6_double_miller_loop(prec_P1, prec_Q1, prec_P2, prec_Q2);
+}
+
+mnt6_Fq6 mnt6_pp::affine_ate_e_over_e_miller_loop(const mnt6_affine_ate_G1_precomputation &prec_P1,
+                                                  const mnt6_affine_ate_G2_precomputation &prec_Q1,
+                                                  const mnt6_affine_ate_G1_precomputation &prec_P2,
+                                                  const mnt6_affine_ate_G2_precomputation &prec_Q2)
+{
+    return mnt6_affine_ate_miller_loop(prec_P1, prec_Q1) * mnt6_affine_ate_miller_loop(prec_P2, prec_Q2).unitary_inverse();
+}
+
+mnt6_Fq6 mnt6_pp::affine_ate_e_times_e_over_e_miller_loop(const mnt6_affine_ate_G1_precomputation &prec_P1,
+                                                          const mnt6_affine_ate_G2_precomputation &prec_Q1,
+                                                          const mnt6_affine_ate_G1_precomputation &prec_P2,
+                                                          const mnt6_affine_ate_G2_precomputation &prec_Q2,
+                                                          const mnt6_affine_ate_G1_precomputation &prec_P3,
+                                                          const mnt6_affine_ate_G2_precomputation &prec_Q3)
+{
+    return ((mnt6_affine_ate_miller_loop(prec_P1, prec_Q1) * mnt6_affine_ate_miller_loop(prec_P2, prec_Q2)) *
+            mnt6_affine_ate_miller_loop(prec_P3, prec_Q3).unitary_inverse());
+}
+
+mnt6_Fq6 mnt6_pp::pairing(const mnt6_G1 &P,
+                          const mnt6_G2 &Q)
+{
+    return mnt6_pairing(P, Q);
+}
+
+mnt6_Fq6 mnt6_pp::reduced_pairing(const mnt6_G1 &P,
+                                  const mnt6_G2 &Q)
+{
+    return mnt6_reduced_pairing(P, Q);
+}
+
+mnt6_Fq6 mnt6_pp::affine_reduced_pairing(const mnt6_G1 &P,
+                                         const mnt6_G2 &Q)
+{
+    return mnt6_affine_reduced_pairing(P, Q);
+}
+
+} // libff
diff --git a/src/libff/libff/algebra/curves/mnt/mnt6/mnt6_pp.hpp b/src/libff/libff/algebra/curves/mnt/mnt6/mnt6_pp.hpp
new file mode 100755
index 000000000..889152acd
--- /dev/null
+++ b/src/libff/libff/algebra/curves/mnt/mnt6/mnt6_pp.hpp
@@ -0,0 +1,75 @@
+/** @file
+ *****************************************************************************
+
+ Declaration of interfaces for public parameters of MNT6.
+
+ *****************************************************************************
+ * @author     This file is part of libff, developed by SCIPR Lab
+ *             and contributors (see AUTHORS).
+ * @copyright  MIT license (see LICENSE file)
+ *****************************************************************************/
+
+#ifndef MNT6_PP_HPP_
+#define MNT6_PP_HPP_
+
+#include <libff/algebra/curves/mnt/mnt6/mnt6_g1.hpp>
+#include <libff/algebra/curves/mnt/mnt6/mnt6_g2.hpp>
+#include <libff/algebra/curves/mnt/mnt6/mnt6_init.hpp>
+#include <libff/algebra/curves/mnt/mnt6/mnt6_pairing.hpp>
+#include <libff/algebra/curves/public_params.hpp>
+
+namespace libff {
+
+class mnt6_pp {
+public:
+    typedef mnt6_Fr Fp_type;
+    typedef mnt6_G1 G1_type;
+    typedef mnt6_G2 G2_type;
+    typedef mnt6_affine_ate_G1_precomputation affine_ate_G1_precomp_type;
+    typedef mnt6_affine_ate_G2_precomputation affine_ate_G2_precomp_type;
+    typedef mnt6_G1_precomp G1_precomp_type;
+    typedef mnt6_G2_precomp G2_precomp_type;
+    typedef mnt6_Fq Fq_type;
+    typedef mnt6_Fq3 Fqe_type;
+    typedef mnt6_Fq6 Fqk_type;
+    typedef mnt6_GT GT_type;
+
+    static const bool has_affine_pairing = true;
+
+    static void init_public_params();
+    static mnt6_GT final_exponentiation(const mnt6_Fq6 &elt);
+    static mnt6_G1_precomp precompute_G1(const mnt6_G1 &P);
+    static mnt6_G2_precomp precompute_G2(const mnt6_G2 &Q);
+    static mnt6_Fq6 miller_loop(const mnt6_G1_precomp &prec_P,
+                                const mnt6_G2_precomp &prec_Q);
+    static mnt6_affine_ate_G1_precomputation affine_ate_precompute_G1(const mnt6_G1 &P);
+    static mnt6_affine_ate_G2_precomputation affine_ate_precompute_G2(const mnt6_G2 &Q);
+    static mnt6_Fq6 affine_ate_miller_loop(const mnt6_affine_ate_G1_precomputation &prec_P,
+                                           const mnt6_affine_ate_G2_precomputation &prec_Q);
+    static mnt6_Fq6 affine_ate_e_over_e_miller_loop(const mnt6_affine_ate_G1_precomputation &prec_P1,
+                                                    const mnt6_affine_ate_G2_precomputation &prec_Q1,
+                                                    const mnt6_affine_ate_G1_precomputation &prec_P2,
+                                                    const mnt6_affine_ate_G2_precomputation &prec_Q2);
+    static mnt6_Fq6 affine_ate_e_times_e_over_e_miller_loop(const mnt6_affine_ate_G1_precomputation &prec_P1,
+                                                            const mnt6_affine_ate_G2_precomputation &prec_Q1,
+                                                            const mnt6_affine_ate_G1_precomputation &prec_P2,
+                                                            const mnt6_affine_ate_G2_precomputation &prec_Q2,
+                                                            const mnt6_affine_ate_G1_precomputation &prec_P3,
+                                                            const mnt6_affine_ate_G2_precomputation &prec_Q3);
+    static mnt6_Fq6 double_miller_loop(const mnt6_G1_precomp &prec_P1,
+                                       const mnt6_G2_precomp &prec_Q1,
+                                       const mnt6_G1_precomp &prec_P2,
+                                       const mnt6_G2_precomp &prec_Q2);
+
+    /* the following are used in test files */
+    static mnt6_Fq6 pairing(const mnt6_G1 &P,
+                            const mnt6_G2 &Q);
+    static mnt6_Fq6 reduced_pairing(const mnt6_G1 &P,
+                                    const mnt6_G2 &Q);
+    static mnt6_Fq6 affine_reduced_pairing(const mnt6_G1 &P,
+                                           const mnt6_G2 &Q);
+};
+
+} // libff
+
+#endif // MNT6_PP_HPP_
diff --git a/src/libff/libff/algebra/curves/public_params.hpp b/src/libff/libff/algebra/curves/public_params.hpp
new file mode 100755
index 000000000..a19271e45
--- /dev/null
+++ b/src/libff/libff/algebra/curves/public_params.hpp
@@ -0,0 +1,103 @@
+/** @file
+ *****************************************************************************
+ * @author     This file is part of libff, developed by SCIPR Lab
+ *             and contributors (see AUTHORS).
+ * @copyright  MIT license (see LICENSE file)
+ *****************************************************************************/
+
+#ifndef PUBLIC_PARAMS_HPP_
+#define PUBLIC_PARAMS_HPP_
+#include <vector>
+
+namespace libff {
+
+/*
+  for every curve the user should define corresponding
+  public_params with the following typedefs:
+
+  Fp_type
+  G1_type
+  G2_type
+  G1_precomp_type
+  G2_precomp_type
+  affine_ate_G1_precomp_type
+  affine_ate_G2_precomp_type
+  Fq_type
+  Fqe_type
+  Fqk_type
+  GT_type
+
+  one should also define the following static methods:
+
+  void init_public_params();
+
+  GT<EC_ppT> final_exponentiation(const Fqk<EC_ppT> &elt);
+
+  G1_precomp<EC_ppT> precompute_G1(const G1<EC_ppT> &P);
+  G2_precomp<EC_ppT> precompute_G2(const G2<EC_ppT> &Q);
+
+  Fqk<EC_ppT> miller_loop(const G1_precomp<EC_ppT> &prec_P,
+                          const G2_precomp<EC_ppT> &prec_Q);
+
+  affine_ate_G1_precomp<EC_ppT> affine_ate_precompute_G1(const G1<EC_ppT> &P);
+  affine_ate_G2_precomp<EC_ppT> affine_ate_precompute_G2(const G2<EC_ppT> &Q);
+
+
+  Fqk<EC_ppT> affine_ate_miller_loop(const affine_ate_G1_precomp<EC_ppT> &prec_P,
+                                     const affine_ate_G2_precomp<EC_ppT> &prec_Q);
+  Fqk<EC_ppT> affine_ate_e_over_e_miller_loop(const affine_ate_G1_precomp<EC_ppT> &prec_P1,
+                                              const affine_ate_G2_precomp<EC_ppT> &prec_Q1,
+                                              const affine_ate_G1_precomp<EC_ppT> &prec_P2,
+                                              const affine_ate_G2_precomp<EC_ppT> &prec_Q2);
+  Fqk<EC_ppT> affine_ate_e_times_e_over_e_miller_loop(const affine_ate_G1_precomp<EC_ppT> &prec_P1,
+                                                      const affine_ate_G2_precomp<EC_ppT> &prec_Q1,
+                                                      const affine_ate_G1_precomp<EC_ppT> &prec_P2,
+                                                      const affine_ate_G2_precomp<EC_ppT> &prec_Q2,
+                                                      const affine_ate_G1_precomp<EC_ppT> &prec_P3,
+                                                      const affine_ate_G2_precomp<EC_ppT> &prec_Q3);
+  Fqk<EC_ppT> double_miller_loop(const G1_precomp<EC_ppT> &prec_P1,
+                                 const G2_precomp<EC_ppT> &prec_Q1,
+                                 const G1_precomp<EC_ppT> &prec_P2,
+                                 const G2_precomp<EC_ppT> &prec_Q2);
+
+  Fqk<EC_ppT> pairing(const G1<EC_ppT> &P,
+                      const G2<EC_ppT> &Q);
+  GT<EC_ppT> reduced_pairing(const G1<EC_ppT> &P,
+                             const G2<EC_ppT> &Q);
+  GT<EC_ppT> affine_reduced_pairing(const G1<EC_ppT> &P,
+                                    const G2<EC_ppT> &Q);
+*/
+
+template<typename EC_ppT>
+using Fr = typename EC_ppT::Fp_type;
+template<typename EC_ppT>
+using G1 = typename EC_ppT::G1_type;
+template<typename EC_ppT>
+using G2 = typename EC_ppT::G2_type;
+template<typename EC_ppT>
+using G1_precomp = typename EC_ppT::G1_precomp_type;
+template<typename EC_ppT>
+using G2_precomp = typename EC_ppT::G2_precomp_type;
+template<typename EC_ppT>
+using affine_ate_G1_precomp = typename EC_ppT::affine_ate_G1_precomp_type;
+template<typename EC_ppT>
+using affine_ate_G2_precomp = typename EC_ppT::affine_ate_G2_precomp_type;
+template<typename EC_ppT>
+using Fq = typename EC_ppT::Fq_type;
+template<typename EC_ppT>
+using Fqe = typename EC_ppT::Fqe_type;
+template<typename EC_ppT>
+using Fqk = typename EC_ppT::Fqk_type;
+template<typename EC_ppT>
+using GT = typename EC_ppT::GT_type;
+
+template<typename EC_ppT>
+using Fr_vector = std::vector<Fr<EC_ppT> >;
+template<typename EC_ppT>
+using G1_vector = std::vector<G1<EC_ppT> >;
+template<typename EC_ppT>
+using G2_vector = std::vector<G2<EC_ppT> >;
+
+} // libff
+
+#endif // PUBLIC_PARAMS_HPP_
diff --git a/src/libff/libff/algebra/curves/tests/test_bilinearity.cpp b/src/libff/libff/algebra/curves/tests/test_bilinearity.cpp
new file mode 100755
index 000000000..5f3f8f24b
--- /dev/null
+++ b/src/libff/libff/algebra/curves/tests/test_bilinearity.cpp
@@ -0,0 +1,136 @@
+/**
+ *****************************************************************************
+ * @author     This file is part of libff, developed by SCIPR Lab
+ *             and contributors (see AUTHORS).
+ * @copyright  MIT license (see LICENSE file)
+ *****************************************************************************/
+#include <libff/algebra/curves/edwards/edwards_pp.hpp>
+#include <libff/common/profiling.hpp>
+#ifdef CURVE_BN128
+#include <libff/algebra/curves/bn128/bn128_pp.hpp>
+#endif
+#include <libff/algebra/curves/alt_bn128/alt_bn128_pp.hpp>
+#include <libff/algebra/curves/mnt/mnt4/mnt4_pp.hpp>
+#include <libff/algebra/curves/mnt/mnt6/mnt6_pp.hpp>
+
+using namespace libff;
+
+template<typename ppT>
+void pairing_test()
+{
+    GT<ppT> GT_one = GT<ppT>::one();
+
+    printf("Running bilinearity tests:\n");
+    G1<ppT> P = (Fr<ppT>::random_element()) * G1<ppT>::one();
+    //G1<ppT> P = Fr<ppT>("2") * G1<ppT>::one();
+    G2<ppT> Q = (Fr<ppT>::random_element()) * G2<ppT>::one();
+    //G2<ppT> Q = Fr<ppT>("3") * G2<ppT>::one();
+
+    printf("P:\n");
+    P.print();
+    P.print_coordinates();
+    printf("Q:\n");
+    Q.print();
+    Q.print_coordinates();
+    printf("\n\n");
+
+    Fr<ppT> s = Fr<ppT>::random_element();
+    //Fr<ppT> s = Fr<ppT>("2");
+    G1<ppT> sP = s * P;
+    G2<ppT> sQ = s * Q;
+
+    printf("Pairing bilinearity tests (three must match):\n");
+    GT<ppT> ans1 = ppT::reduced_pairing(sP, Q);
+    GT<ppT> ans2 = ppT::reduced_pairing(P, sQ);
+    GT<ppT> ans3 = ppT::reduced_pairing(P, Q)^s;
+    ans1.print();
+    ans2.print();
+    ans3.print();
+    assert(ans1 == ans2);
+    assert(ans2 == ans3);
+
+    assert(ans1 != GT_one);
+    assert((ans1^Fr<ppT>::field_char()) == GT_one);
+    printf("\n\n");
+}
+
+template<typename ppT>
+void double_miller_loop_test()
+{
+    const G1<ppT> P1 = (Fr<ppT>::random_element()) * G1<ppT>::one();
+    const G1<ppT> P2 = (Fr<ppT>::random_element()) * G1<ppT>::one();
+    const G2<ppT> Q1 = (Fr<ppT>::random_element()) * G2<ppT>::one();
+    const G2<ppT> Q2 = (Fr<ppT>::random_element()) * G2<ppT>::one();
+
+    const G1_precomp<ppT> prec_P1 = ppT::precompute_G1(P1);
+    const G1_precomp<ppT> prec_P2 = ppT::precompute_G1(P2);
+    const G2_precomp<ppT> prec_Q1 = ppT::precompute_G2(Q1);
+    const G2_precomp<ppT> prec_Q2 = ppT::precompute_G2(Q2);
+
+    const Fqk<ppT> ans_1 = ppT::miller_loop(prec_P1, prec_Q1);
+    const Fqk<ppT> ans_2 = ppT::miller_loop(prec_P2, prec_Q2);
+    const Fqk<ppT> ans_12 = ppT::double_miller_loop(prec_P1, prec_Q1, prec_P2, prec_Q2);
+    assert(ans_1 * ans_2 == ans_12);
+}
+
+template<typename ppT>
+void affine_pairing_test()
+{
+    GT<ppT> GT_one = GT<ppT>::one();
+
+    printf("Running bilinearity tests:\n");
+    G1<ppT> P = (Fr<ppT>::random_element()) * G1<ppT>::one();
+    G2<ppT> Q = (Fr<ppT>::random_element()) * G2<ppT>::one();
+
+    printf("P:\n");
+    P.print();
+    printf("Q:\n");
+    Q.print();
+    printf("\n\n");
+
+    Fr<ppT> s = Fr<ppT>::random_element();
+    G1<ppT> sP = s * P;
+    G2<ppT> sQ = s * Q;
+
+    printf("Pairing bilinearity tests (three must match):\n");
+    GT<ppT> ans1 = ppT::affine_reduced_pairing(sP, Q);
+    GT<ppT> ans2 = ppT::affine_reduced_pairing(P, sQ);
+    GT<ppT> ans3 = ppT::affine_reduced_pairing(P, Q)^s;
+    ans1.print();
+    ans2.print();
+    ans3.print();
+    assert(ans1 == ans2);
+    assert(ans2 == ans3);
+
+    assert(ans1 != GT_one);
+    assert((ans1^Fr<ppT>::field_char()) == GT_one);
+    printf("\n\n");
+}
+
+int main(void)
+{
+    start_profiling();
+    edwards_pp::init_public_params();
+    pairing_test<edwards_pp>();
+    double_miller_loop_test<edwards_pp>();
+
+    mnt6_pp::init_public_params();
+    pairing_test<mnt6_pp>();
+    double_miller_loop_test<mnt6_pp>();
+    affine_pairing_test<mnt6_pp>();
+
+    mnt4_pp::init_public_params();
+    pairing_test<mnt4_pp>();
+    double_miller_loop_test<mnt4_pp>();
+    affine_pairing_test<mnt4_pp>();
+
+    alt_bn128_pp::init_public_params();
+    pairing_test<alt_bn128_pp>();
+    double_miller_loop_test<alt_bn128_pp>();
+
+#ifdef CURVE_BN128       // BN128 has fancy dependencies so it may be disabled
+    bn128_pp::init_public_params();
+    pairing_test<bn128_pp>();
+    double_miller_loop_test<bn128_pp>();
+#endif
+}
diff --git a/src/libff/libff/algebra/curves/tests/test_groups.cpp b/src/libff/libff/algebra/curves/tests/test_groups.cpp
new file mode 100755
index 000000000..5e00df7e8
--- /dev/null
+++ b/src/libff/libff/algebra/curves/tests/test_groups.cpp
@@ -0,0 +1,176 @@
+/**
+ *****************************************************************************
+ * @author     This file is part of libff, developed by SCIPR Lab
+ *             and contributors (see AUTHORS).
+ * @copyright  MIT license (see LICENSE file)
+ *****************************************************************************/
+#include <libff/algebra/curves/edwards/edwards_pp.hpp>
+#include <libff/algebra/curves/mnt/mnt4/mnt4_pp.hpp>
+#include <libff/algebra/curves/mnt/mnt6/mnt6_pp.hpp>
+#include <libff/common/profiling.hpp>
+#ifdef CURVE_BN128
+#include <libff/algebra/curves/bn128/bn128_pp.hpp>
+#endif
+#include <sstream>
+
+#include <libff/algebra/curves/alt_bn128/alt_bn128_pp.hpp>
+
+using namespace libff;
+
+template<typename GroupT>
+void test_mixed_add()
+{
+    GroupT base, el, result;
+
+    base = GroupT::zero();
+    el = GroupT::zero();
+    el.to_special();
+    result = base.mixed_add(el);
+    assert(result == base + el);
+
+    base = GroupT::zero();
+    el = GroupT::random_element();
+    el.to_special();
+    result = base.mixed_add(el);
+    assert(result == base + el);
+
+    base = GroupT::random_element();
+    el = GroupT::zero();
+    el.to_special();
+    result = base.mixed_add(el);
+    assert(result == base + el);
+
+    base = GroupT::random_element();
+    el = GroupT::random_element();
+    el.to_special();
+    result = base.mixed_add(el);
+    assert(result == base + el);
+
+    base = GroupT::random_element();
+    el = base;
+    el.to_special();
+    result = base.mixed_add(el);
+    assert(result == base.dbl());
+}
+
+template<typename GroupT>
+void test_group()
+{
+    bigint<1> rand1 = bigint<1>("76749407");
+    bigint<1> rand2 = bigint<1>("44410867");
+    bigint<1> randsum = bigint<1>("121160274");
+
+    GroupT zero = GroupT::zero();
+    assert(zero == zero);
+    GroupT one = GroupT::one();
+    assert(one == one);
+    GroupT two = bigint<1>(2l) * GroupT::one();
+    assert(two == two);
+    GroupT five = bigint<1>(5l) * GroupT::one();
+
+    GroupT three = bigint<1>(3l) * GroupT::one();
+    GroupT four = bigint<1>(4l) * GroupT::one();
+
+    assert(two+five == three+four);
+
+    GroupT a = GroupT::random_element();
+    GroupT b = GroupT::random_element();
+
+    assert(one != zero);
+    assert(a != zero);
+    assert(a != one);
+
+    assert(b != zero);
+    assert(b != one);
+
+    assert(a.dbl() == a + a);
+    assert(b.dbl() == b + b);
+    assert(one.add(two) == three);
+    assert(two.add(one) == three);
+    assert(a + b == b + a);
+    assert(a - a == zero);
+    assert(a - b == a + (-b));
+    assert(a - b == (-b) + a);
+
+    // handle special cases
+    assert(zero + (-a) == -a);
+    assert(zero - a == -a);
+    assert(a - zero == a);
+    assert(a + zero == a);
+    assert(zero + a == a);
+
+    assert((a + b).dbl() == (a + b) + (b + a));
+    assert(bigint<1>("2") * (a + b) == (a + b) + (b + a));
+
+    assert((rand1 * a) + (rand2 * a) == (randsum * a));
+
+    assert(GroupT::order() * a == zero);
+    assert(GroupT::order() * one == zero);
+    assert((GroupT::order() * a) - a != zero);
+    assert((GroupT::order() * one) - one != zero);
+
+    test_mixed_add<GroupT>();
+}
+
+template<typename GroupT>
+void test_mul_by_q()
+{
+    GroupT a = GroupT::random_element();
+    assert((GroupT::base_field_char()*a) == a.mul_by_q());
+}
+
+template<typename GroupT>
+void test_output()
+{
+    GroupT g = GroupT::zero();
+
+    for (size_t i = 0; i < 1000; ++i)
+    {
+        std::stringstream ss;
+        ss << g;
+        GroupT gg;
+        ss >> gg;
+        assert(g == gg);
+        /* use a random point in next iteration */
+        g = GroupT::random_element();
+    }
+}
+
+int main(void)
+{
+    edwards_pp::init_public_params();
+    test_group<G1<edwards_pp> >();
+    test_output<G1<edwards_pp> >();
+    test_group<G2<edwards_pp> >();
+    test_output<G2<edwards_pp> >();
+    test_mul_by_q<G2<edwards_pp> >();
+
+    mnt4_pp::init_public_params();
+    test_group<G1<mnt4_pp> >();
+    test_output<G1<mnt4_pp> >();
+    test_group<G2<mnt4_pp> >();
+    test_output<G2<mnt4_pp> >();
+    test_mul_by_q<G2<mnt4_pp> >();
+
+    mnt6_pp::init_public_params();
+    test_group<G1<mnt6_pp> >();
+    test_output<G1<mnt6_pp> >();
+    test_group<G2<mnt6_pp> >();
+    test_output<G2<mnt6_pp> >();
+    test_mul_by_q<G2<mnt6_pp> >();
+
+    alt_bn128_pp::init_public_params();
+    test_group<G1<alt_bn128_pp> >();
+    test_output<G1<alt_bn128_pp> >();
+    test_group<G2<alt_bn128_pp> >();
+    test_output<G2<alt_bn128_pp> >();
+    test_mul_by_q<G2<alt_bn128_pp> >();
+
+#ifdef CURVE_BN128       // BN128 has fancy dependencies so it may be disabled
+    bn128_pp::init_public_params();
+    test_group<G1<bn128_pp> >();
+    test_output<G1<bn128_pp> >();
+    test_group<G2<bn128_pp> >();
+    test_output<G2<bn128_pp> >();
+#endif
+}
diff --git a/src/libff/libff/algebra/exponentiation/exponentiation.hpp b/src/libff/libff/algebra/exponentiation/exponentiation.hpp
new file mode 100755
index 000000000..0970983c7
--- /dev/null
+++ b/src/libff/libff/algebra/exponentiation/exponentiation.hpp
@@ -0,0 +1,31 @@
+/** @file
+ *****************************************************************************
+
+ Declaration of interfaces for (square-and-multiply) exponentiation.
+
+ *****************************************************************************
+ * @author     This file is part of libff, developed by SCIPR Lab
+ *             and contributors (see AUTHORS).
+ * @copyright  MIT license (see LICENSE file)
+ *****************************************************************************/
+
+#ifndef EXPONENTIATION_HPP_
+#define EXPONENTIATION_HPP_
+
+#include <cstdint>
+
+#include <libff/algebra/fields/bigint.hpp>
+
+namespace libff {
+
+template<typename FieldT, mp_size_t m>
+FieldT power(const FieldT &base, const bigint<m> &exponent);
+
+template<typename FieldT>
+FieldT power(const FieldT &base, const unsigned long exponent);
+
+} // libff
+
+#include <libff/algebra/exponentiation/exponentiation.tcc>
+
+#endif // EXPONENTIATION_HPP_
diff --git a/src/libff/libff/algebra/exponentiation/exponentiation.tcc b/src/libff/libff/algebra/exponentiation/exponentiation.tcc
new file mode 100755
index 000000000..3da5287d6
--- /dev/null
+++ b/src/libff/libff/algebra/exponentiation/exponentiation.tcc
@@ -0,0 +1,53 @@
+/** @file
+ *****************************************************************************
+
+ Implementation of interfaces for (square-and-multiply) exponentiation.
+
+ See exponentiation.hpp .
+
+ *****************************************************************************
+ * @author     This file is part of libff, developed by SCIPR Lab
+ *             and contributors (see AUTHORS).
+ * @copyright  MIT license (see LICENSE file)
+ *****************************************************************************/
+
+#ifndef EXPONENTIATION_TCC_
+#define EXPONENTIATION_TCC_
+
+#include <libff/common/utils.hpp>
+
+namespace libff {
+
+template<typename FieldT, mp_size_t m>
+FieldT power(const FieldT &base, const bigint<m> &exponent)
+{
+    FieldT result = FieldT::one();
+
+    bool found_one = false;
+
+    for (long i = exponent.max_bits() - 1; i >= 0; --i)
+    {
+        if (found_one)
+        {
+            result = result * result;
+        }
+
+        if (exponent.test_bit(i))
+        {
+            found_one = true;
+            result = result * base;
+        }
+    }
+
+    return result;
+}
+
+template<typename FieldT>
+FieldT power(const FieldT &base, const unsigned long exponent)
+{
+    return power<FieldT>(base, bigint<1>(exponent));
+}
+
+} // libff
+
+#endif // EXPONENTIATION_TCC_
diff --git a/src/libff/libff/algebra/fields/bigint.hpp b/src/libff/libff/algebra/fields/bigint.hpp
new file mode 100755
index 000000000..47db2d3cb
--- /dev/null
+++ b/src/libff/libff/algebra/fields/bigint.hpp
@@ -0,0 +1,63 @@
+/** @file
+ *****************************************************************************
+ Declaration of bigint wrapper class around GMP's MPZ long integers.
+ *****************************************************************************
+ * @author     This file is part of libff, developed by SCIPR Lab
+ *             and contributors (see AUTHORS).
+ * @copyright  MIT license (see LICENSE file)
+ *****************************************************************************/
+
+#ifndef BIGINT_HPP_
+#define BIGINT_HPP_
+#include <cstddef>
+#include <iostream>
+
+#include <gmp.h>
+
+#include <libff/common/serialization.hpp>
+
+namespace libff {
+
+template<mp_size_t n> class bigint;
+template<mp_size_t n> std::ostream& operator<<(std::ostream &, const bigint<n>&);
+template<mp_size_t n> std::istream& operator>>(std::istream &, bigint<n>&);
+
+/**
+ * Wrapper class around GMP's MPZ long integers. It supports arithmetic operations,
+ * serialization and randomization. Serialization is fragile, see common/serialization.hpp.
+ */
+
+template<mp_size_t n>
+class bigint {
+public:
+    static const mp_size_t N = n;
+
+    mp_limb_t data[n] = {0};
+
+    bigint() = default;
+    bigint(const unsigned long x); /// Initalize from a small integer
+    bigint(const char* s); /// Initialize from a string containing an integer in decimal notation
+    bigint(const mpz_t r); /// Initialize from MPZ element
+
+    void print() const;
+    void print_hex() const;
+    bool operator==(const bigint<n>& other) const;
+    bool operator!=(const bigint<n>& other) const;
+    void clear();
+    bool is_zero() const;
+    size_t max_bits() const { return n * GMP_NUMB_BITS; } /// Returns the number of bits representable by this bigint type
+    size_t num_bits() const; /// Returns the number of bits in this specific bigint value, i.e., position of the most-significant 1
+
+    unsigned long as_ulong() const; /// Return the last limb of the integer
+    void to_mpz(mpz_t r) const;
+    bool test_bit(const std::size_t bitno) const;
+
+    bigint& randomize();
+
+    friend std::ostream& operator<< <n>(std::ostream &out, const bigint<n> &b);
+    friend std::istream& operator>> <n>(std::istream &in, bigint<n> &b);
+};
+
+} // libff
+#include <libff/algebra/fields/bigint.tcc>
+#endif
diff --git a/src/libff/libff/algebra/fields/bigint.tcc b/src/libff/libff/algebra/fields/bigint.tcc
new file mode 100755
index 000000000..6a2b6f62f
--- /dev/null
+++ b/src/libff/libff/algebra/fields/bigint.tcc
@@ -0,0 +1,226 @@
+/** @file
+ *****************************************************************************
+ Implementation of bigint wrapper class around GMP's MPZ long integers.
+ *****************************************************************************
+ * @author     This file is part of libff, developed by SCIPR Lab
+ *             and contributors (see AUTHORS).
+ * @copyright  MIT license (see LICENSE file)
+ *****************************************************************************/
+
+#ifndef BIGINT_TCC_
+#define BIGINT_TCC_
+#include <cassert>
+#include <cstring>
+#include <random>
+
+namespace libff {
+
+template<mp_size_t n>
+bigint<n>::bigint(const unsigned long x) /// Initalize from a small integer
+{
+    assert(8*sizeof(x) <= GMP_NUMB_BITS);
+    this->data[0] = x;
+}
+
+template<mp_size_t n>
+bigint<n>::bigint(const char* s) /// Initialize from a string containing an integer in decimal notation
+{
+    size_t l = strlen(s);
+    unsigned char* s_copy = new unsigned char[l];
+
+    for (size_t i = 0; i < l; ++i)
+    {
+        assert(s[i] >= '0' && s[i] <= '9');
+        s_copy[i] = s[i] - '0';
+    }
+
+    mp_size_t limbs_written = mpn_set_str(this->data, s_copy, l, 10);
+    assert(limbs_written <= n);
+
+    delete[] s_copy;
+}
+
+template<mp_size_t n>
+bigint<n>::bigint(const mpz_t r) /// Initialize from MPZ element
+{
+    mpz_t k;
+    mpz_init_set(k, r);
+
+    for (size_t i = 0; i < n; ++i)
+    {
+        data[i] = mpz_get_ui(k);
+        mpz_fdiv_q_2exp(k, k, GMP_NUMB_BITS);
+    }
+
+    assert(mpz_sgn(k) == 0);
+    mpz_clear(k);
+}
+
+template<mp_size_t n>
+void bigint<n>::print() const
+{
+    gmp_printf("%Nd\n", this->data, n);
+}
+
+template<mp_size_t n>
+void bigint<n>::print_hex() const
+{
+    gmp_printf("%Nx\n", this->data, n);
+}
+
+template<mp_size_t n>
+bool bigint<n>::operator==(const bigint<n>& other) const
+{
+    return (mpn_cmp(this->data, other.data, n) == 0);
+}
+
+template<mp_size_t n>
+bool bigint<n>::operator!=(const bigint<n>& other) const
+{
+    return !(operator==(other));
+}
+
+template<mp_size_t n>
+void bigint<n>::clear()
+{
+    mpn_zero(this->data, n);
+}
+
+template<mp_size_t n>
+bool bigint<n>::is_zero() const
+{
+    for (size_t i = 0; i < n; ++i)
+    {
+        if (this->data[i])
+        {
+            return false;
+        }
+    }
+
+    return true;
+}
+
+template<mp_size_t n>
+size_t bigint<n>::num_bits() const
+{
+/*
+    for (long i = max_bits(); i >= 0; --i)
+    {
+        if (this->test_bit(i))
+        {
+            return i+1;
+        }
+    }
+
+    return 0;
+*/
+    for (long i = n-1; i >= 0; --i)
+    {
+        mp_limb_t x = this->data[i];
+        if (x == 0)
+        {
+            continue;
+        }
+        else
+        {
+            return ((i+1) * GMP_NUMB_BITS) - __builtin_clzl(x);
+        }
+    }
+    return 0;
+}
+
+template<mp_size_t n>
+unsigned long bigint<n>::as_ulong() const
+{
+    return this->data[0];
+}
+
+template<mp_size_t n>
+void bigint<n>::to_mpz(mpz_t r) const
+{
+    mpz_set_ui(r, 0);
+
+    for (int i = n-1; i >= 0; --i)
+    {
+        mpz_mul_2exp(r, r, GMP_NUMB_BITS);
+        mpz_add_ui(r, r, this->data[i]);
+    }
+}
+
+template<mp_size_t n>
+bool bigint<n>::test_bit(const std::size_t bitno) const
+{
+    if (bitno >= n * GMP_NUMB_BITS)
+    {
+        return false;
+    }
+    else
+    {
+        const std::size_t part = bitno/GMP_NUMB_BITS;
+        const std::size_t bit = bitno - (GMP_NUMB_BITS*part);
+        const mp_limb_t one = 1;
+        return (this->data[part] & (one<<bit)) != 0;
+    }
+}
+
+template<mp_size_t n>
+bigint<n>& bigint<n>::randomize()
+{
+    static_assert(GMP_NUMB_BITS == sizeof(mp_limb_t) * 8, "Wrong GMP_NUMB_BITS value");
+	std::random_device rd;
+	constexpr size_t num_random_words = sizeof(mp_limb_t) * n / sizeof(std::random_device::result_type);
+	auto random_words = reinterpret_cast<std::random_device::result_type*>(this->data);
+	for (size_t i = 0; i < num_random_words; ++i)
+	{
+		random_words[i] = rd();
+	}
+
+    return (*this);
+}
+
+
+template<mp_size_t n>
+std::ostream& operator<<(std::ostream &out, const bigint<n> &b)
+{
+#ifdef BINARY_OUTPUT
+    out.write((char*)b.data, sizeof(b.data[0]) * n);
+#else
+    mpz_t t;
+    mpz_init(t);
+    b.to_mpz(t);
+
+    out << t;
+
+    mpz_clear(t);
+#endif
+    return out;
+}
+
+template<mp_size_t n>
+std::istream& operator>>(std::istream &in, bigint<n> &b)
+{
+#ifdef BINARY_OUTPUT
+    in.read((char*)b.data, sizeof(b.data[0]) * n);
+#else
+    std::string s;
+    in >> s;
+
+    size_t l = s.size();
+    unsigned char* s_copy = new unsigned char[l];
+
+    for (size_t i = 0; i < l; ++i)
+    {
+        assert(s[i] >= '0' && s[i] <= '9');
+        s_copy[i] = s[i] - '0';
+    }
+
+    mp_size_t limbs_written = mpn_set_str(b.data, s_copy, l, 10);
+    assert(limbs_written <= n);
+
+    delete[] s_copy;
+#endif
+    return in;
+}
+
+} // libff
+#endif // BIGINT_TCC_
diff --git a/src/libff/libff/algebra/fields/field_utils.hpp b/src/libff/libff/algebra/fields/field_utils.hpp
new file mode 100755
index 000000000..04365caaf
--- /dev/null
+++ b/src/libff/libff/algebra/fields/field_utils.hpp
@@ -0,0 +1,57 @@
+/** @file
+ *****************************************************************************
+ * @author     This file is part of libff, developed by SCIPR Lab
+ *             and contributors (see AUTHORS).
+ * @copyright  MIT license (see LICENSE file)
+ *****************************************************************************/
+
+#ifndef FIELD_UTILS_HPP_
+#define FIELD_UTILS_HPP_
+#include <cstdint>
+
+#include <libff/algebra/fields/bigint.hpp>
+#include <libff/common/double.hpp>
+#include <libff/common/utils.hpp>
+
+namespace libff {
+
+// returns root of unity of order n (for n a power of 2), if one exists
+template<typename FieldT>
+typename std::enable_if<std::is_same<FieldT, Double>::value, FieldT>::type
+get_root_of_unity(const size_t n);
+
+template<typename FieldT>
+typename std::enable_if<!std::is_same<FieldT, Double>::value, FieldT>::type
+get_root_of_unity(const size_t n);
+
+template<typename FieldT>
+std::vector<FieldT> pack_int_vector_into_field_element_vector(const std::vector<size_t> &v, const size_t w);
+
+template<typename FieldT>
+std::vector<FieldT> pack_bit_vector_into_field_element_vector(const bit_vector &v, const size_t chunk_bits);
+
+template<typename FieldT>
+std::vector<FieldT> pack_bit_vector_into_field_element_vector(const bit_vector &v);
+
+template<typename FieldT>
+std::vector<FieldT> convert_bit_vector_to_field_element_vector(const bit_vector &v);
+
+template<typename FieldT>
+bit_vector convert_field_element_vector_to_bit_vector(const std::vector<FieldT> &v);
+
+template<typename FieldT>
+bit_vector convert_field_element_to_bit_vector(const FieldT &el);
+
+template<typename FieldT>
+bit_vector convert_field_element_to_bit_vector(const FieldT &el, const size_t bitcount);
+
+template<typename FieldT>
+FieldT convert_bit_vector_to_field_element(const bit_vector &v);
+
+template<typename FieldT>
+void batch_invert(std::vector<FieldT> &vec);
+
+} // libff
+#include <libff/algebra/fields/field_utils.tcc>
+
+#endif // FIELD_UTILS_HPP_
diff --git a/src/libff/libff/algebra/fields/field_utils.tcc b/src/libff/libff/algebra/fields/field_utils.tcc
new file mode 100755
index 000000000..216caaea7
--- /dev/null
+++ b/src/libff/libff/algebra/fields/field_utils.tcc
@@ -0,0 +1,197 @@
+/** @file
+ *****************************************************************************
+ Implementation of misc. math and serialization utility functions
+ *****************************************************************************
+ * @author     This file is part of libff, developed by SCIPR Lab
+ *             and contributors (see AUTHORS).
+ * @copyright  MIT license (see LICENSE file)
+ *****************************************************************************/
+
+#ifndef FIELD_UTILS_TCC_
+#define FIELD_UTILS_TCC_
+
+#include <complex>
+#include <stdexcept>
+
+#include <libff/common/double.hpp>
+#include <libff/common/utils.hpp>
+
+namespace libff {
+
+template<typename FieldT>
+FieldT coset_shift()
+{
+    return FieldT::multiplicative_generator.squared();
+}
+
+template<typename FieldT>
+typename std::enable_if<std::is_same<FieldT, Double>::value, FieldT>::type
+get_root_of_unity(const size_t n)
+{
+    const double PI = 3.141592653589793238460264338328L;
+
+    return FieldT(cos(2 * PI / n), sin(2 * PI / n));
+}
+
+template<typename FieldT>
+typename std::enable_if<!std::is_same<FieldT, Double>::value, FieldT>::type
+get_root_of_unity(const size_t n)
+{
+    const size_t logn = log2(n);
+    if (n != (1u << logn)) throw std::invalid_argument("libff::get_root_of_unity: expected n == (1u << logn)");
+    if (logn > FieldT::s) throw std::invalid_argument("libff::get_root_of_unity: expected logn <= FieldT::s");
+
+    FieldT omega = FieldT::root_of_unity;
+    for (size_t i = FieldT::s; i > logn; --i)
+    {
+        omega *= omega;
+    }
+
+    return omega;
+}
+
+template<typename FieldT>
+std::vector<FieldT> pack_int_vector_into_field_element_vector(const std::vector<size_t> &v, const size_t w)
+{
+    const size_t chunk_bits = FieldT::capacity();
+    const size_t repacked_size = div_ceil(v.size() * w, chunk_bits);
+    std::vector<FieldT> result(repacked_size);
+
+    for (size_t i = 0; i < repacked_size; ++i)
+    {
+        bigint<FieldT::num_limbs> b;
+        for (size_t j = 0; j < chunk_bits; ++j)
+        {
+            const size_t word_index = (i * chunk_bits + j) / w;
+            const size_t pos_in_word = (i * chunk_bits + j) % w;
+            const size_t word_or_0 = (word_index < v.size() ? v[word_index] : 0);
+            const size_t bit = (word_or_0 >> pos_in_word) & 1;
+
+            b.data[j / GMP_NUMB_BITS] |= bit << (j % GMP_NUMB_BITS);
+        }
+        result[i] = FieldT(b);
+    }
+
+    return result;
+}
+
+template<typename FieldT>
+std::vector<FieldT> pack_bit_vector_into_field_element_vector(const bit_vector &v, const size_t chunk_bits)
+{
+    assert(chunk_bits <= FieldT::capacity());
+
+    const size_t repacked_size = div_ceil(v.size(), chunk_bits);
+    std::vector<FieldT> result(repacked_size);
+
+    for (size_t i = 0; i < repacked_size; ++i)
+    {
+        bigint<FieldT::num_limbs> b;
+        for (size_t j = 0; j < chunk_bits; ++j)
+        {
+            b.data[j / GMP_NUMB_BITS] |= ((i * chunk_bits + j) < v.size() && v[i * chunk_bits + j] ? 1ll : 0ll) << (j % GMP_NUMB_BITS);
+        }
+        result[i] = FieldT(b);
+    }
+
+    return result;
+}
+
+template<typename FieldT>
+std::vector<FieldT> pack_bit_vector_into_field_element_vector(const bit_vector &v)
+{
+    return pack_bit_vector_into_field_element_vector<FieldT>(v, FieldT::capacity());
+}
+
+template<typename FieldT>
+std::vector<FieldT> convert_bit_vector_to_field_element_vector(const bit_vector &v)
+{
+    std::vector<FieldT> result;
+    result.reserve(v.size());
+
+    for (const bool b : v)
+    {
+        result.emplace_back(b ? FieldT::one() : FieldT::zero());
+    }
+
+    return result;
+}
+
+template<typename FieldT>
+bit_vector convert_field_element_vector_to_bit_vector(const std::vector<FieldT> &v)
+{
+    bit_vector result;
+
+    for (const FieldT &el : v)
+    {
+        const bit_vector el_bits = convert_field_element_to_bit_vector<FieldT>(el);
+        result.insert(result.end(), el_bits.begin(), el_bits.end());
+    }
+
+    return result;
+}
+
+template<typename FieldT>
+bit_vector convert_field_element_to_bit_vector(const FieldT &el)
+{
+    bit_vector result;
+
+    bigint<FieldT::num_limbs> b = el.as_bigint();
+    for (size_t i = 0; i < FieldT::size_in_bits(); ++i)
+    {
+        result.push_back(b.test_bit(i));
+    }
+
+    return result;
+}
+
+template<typename FieldT>
+bit_vector convert_field_element_to_bit_vector(const FieldT &el, const size_t bitcount)
+{
+    bit_vector result = convert_field_element_to_bit_vector(el);
+    result.resize(bitcount);
+
+    return result;
+}
+
+template<typename FieldT>
+FieldT convert_bit_vector_to_field_element(const bit_vector &v)
+{
+    assert(v.size() <= FieldT::size_in_bits());
+
+    FieldT res = FieldT::zero();
+    FieldT c = FieldT::one();
+    for (bool b : v)
+    {
+        res += b ? c : FieldT::zero();
+        c += c;
+    }
+    return res;
+}
+
+template<typename FieldT>
+void batch_invert(std::vector<FieldT> &vec)
+{
+    std::vector<FieldT> prod;
+    prod.reserve(vec.size());
+
+    FieldT acc = FieldT::one();
+
+    for (auto el : vec)
+    {
+        assert(!el.is_zero());
+        prod.emplace_back(acc);
+        acc = acc * el;
+    }
+
+    FieldT acc_inverse = acc.inverse();
+
+    for (long i = static_cast<long>(vec.size()-1); i >= 0; --i)
+    {
+        const FieldT old_el = vec[i];
+        vec[i] = acc_inverse * prod[i];
+        acc_inverse = acc_inverse * old_el;
+    }
+}
+
+} // libff
+#endif // FIELD_UTILS_TCC_
diff --git a/src/libff/libff/algebra/fields/fp.hpp b/src/libff/libff/algebra/fields/fp.hpp
new file mode 100755
index 000000000..01f88838a
--- /dev/null
+++ b/src/libff/libff/algebra/fields/fp.hpp
@@ -0,0 +1,184 @@
+/** @file
+ *****************************************************************************
+ Declaration of arithmetic in the finite field F[p], for prime p of fixed length.
+ *****************************************************************************
+ * @author     This file is part of libff, developed by SCIPR Lab
+ *             and contributors (see AUTHORS).
+ * @copyright  MIT license (see LICENSE file)
+ *****************************************************************************/
+
+#ifndef FP_HPP_
+#define FP_HPP_
+
+#include <libff/algebra/exponentiation/exponentiation.hpp>
+#include <libff/algebra/fields/bigint.hpp>
+
+namespace libff {
+
+template<mp_size_t n, const bigint<n>& modulus>
+class Fp_model;
+
+template<mp_size_t n, const bigint<n>& modulus>
+std::ostream& operator<<(std::ostream &, const Fp_model<n, modulus>&);
+
+template<mp_size_t n, const bigint<n>& modulus>
+std::istream& operator>>(std::istream &, Fp_model<n, modulus> &);
+
+/**
+ * Arithmetic in the finite field F[p], for prime p of fixed length.
+ *
+ * This class implements Fp-arithmetic, for a large prime p, using a fixed number
+ * of words. It is optimized for tight memory consumption, so the modulus p is
+ * passed as a template parameter, to avoid per-element overheads.
+ *
+ * The implementation is mostly a wrapper around GMP's MPN (constant-size integers).
+ * But for the integer sizes of interest for libff (3 to 5 limbs of 64 bits each),
+ * we implement performance-critical routines, like addition and multiplication,
+ * using hand-optimzied assembly code.
+*/
+template<mp_size_t n, const bigint<n>& modulus>
+class Fp_model {
+public:
+    bigint<n> mont_repr;
+public:
+    static const mp_size_t num_limbs = n;
+    static const constexpr bigint<n>& mod = modulus;
+#ifdef PROFILE_OP_COUNTS
+    static long long add_cnt;
+    static long long sub_cnt;
+    static long long mul_cnt;
+    static long long sqr_cnt;
+    static long long inv_cnt;
+#endif
+    static size_t num_bits;
+    static bigint<n> euler; // (modulus-1)/2
+    static size_t s; // modulus = 2^s * t + 1
+    static bigint<n> t; // with t odd
+    static bigint<n> t_minus_1_over_2; // (t-1)/2
+    static Fp_model<n, modulus> nqr; // a quadratic nonresidue
+    static Fp_model<n, modulus> nqr_to_t; // nqr^t
+    static Fp_model<n, modulus> multiplicative_generator; // generator of Fp^*
+    static Fp_model<n, modulus> root_of_unity; // generator^((modulus-1)/2^s)
+    static mp_limb_t inv; // modulus^(-1) mod W, where W = 2^(word size)
+    static bigint<n> Rsquared; // R^2, where R = W^k, where k = ??
+    static bigint<n> Rcubed;   // R^3
+
+    static bool modulus_is_valid() { return modulus.data[n-1] != 0; } // mpn inverse assumes that highest limb is non-zero
+
+    Fp_model() {};
+    Fp_model(const bigint<n> &b);
+    Fp_model(const long x, const bool is_unsigned=false);
+
+    void set_ulong(const unsigned long x);
+
+    void mul_reduce(const bigint<n> &other);
+
+    void clear();
+
+    /* Return the standard (not Montgomery) representation of the
+       Field element's requivalence class. I.e. Fp(2).as_bigint()
+        would return bigint(2) */
+    bigint<n> as_bigint() const;
+    /* Return the last limb of the standard representation of the
+       field element. E.g. on 64-bit architectures Fp(123).as_ulong()
+       and Fp(2^64+123).as_ulong() would both return 123. */
+    unsigned long as_ulong() const;
+
+    bool operator==(const Fp_model& other) const;
+    bool operator!=(const Fp_model& other) const;
+    bool is_zero() const;
+
+    void print() const;
+
+    Fp_model& operator+=(const Fp_model& other);
+    Fp_model& operator-=(const Fp_model& other);
+    Fp_model& operator*=(const Fp_model& other);
+    Fp_model& operator^=(const unsigned long pow);
+
+    template<mp_size_t m>
+    Fp_model& operator^=(const bigint<m> &pow);
+
+    Fp_model operator+(const Fp_model& other) const;
+    Fp_model operator-(const Fp_model& other) const;
+    Fp_model operator*(const Fp_model& other) const;
+    Fp_model operator-() const;
+    Fp_model squared() const;
+    Fp_model& invert();
+    Fp_model inverse() const;
+    Fp_model sqrt() const; // HAS TO BE A SQUARE (else does not terminate)
+
+    Fp_model operator^(const unsigned long pow) const;
+    template<mp_size_t m>
+    Fp_model operator^(const bigint<m> &pow) const;
+
+    static size_t size_in_bits() { return num_bits; }
+    static size_t capacity() { return num_bits - 1; }
+    static bigint<n> field_char() { return modulus; }
+
+    static Fp_model<n, modulus> zero();
+    static Fp_model<n, modulus> one();
+    static Fp_model<n, modulus> random_element();
+    static Fp_model<n, modulus> geometric_generator(); // generator^k, for k = 1 to m, domain size m
+    static Fp_model<n, modulus> arithmetic_generator();// generator++, for k = 1 to m, domain size m
+
+    friend std::ostream& operator<< <n,modulus>(std::ostream &out, const Fp_model<n, modulus> &p);
+    friend std::istream& operator>> <n,modulus>(std::istream &in, Fp_model<n, modulus> &p);
+};
+
+#ifdef PROFILE_OP_COUNTS
+template<mp_size_t n, const bigint<n>& modulus>
+long long Fp_model<n, modulus>::add_cnt = 0;
+
+template<mp_size_t n, const bigint<n>& modulus>
+long long Fp_model<n, modulus>::sub_cnt = 0;
+
+template<mp_size_t n, const bigint<n>& modulus>
+long long Fp_model<n, modulus>::mul_cnt = 0;
+
+template<mp_size_t n, const bigint<n>& modulus>
+long long Fp_model<n, modulus>::sqr_cnt = 0;
+
+template<mp_size_t n, const bigint<n>& modulus>
+long long Fp_model<n, modulus>::inv_cnt = 0;
+#endif
+
+template<mp_size_t n, const bigint<n>& modulus>
+size_t Fp_model<n, modulus>::num_bits;
+
+template<mp_size_t n, const bigint<n>& modulus>
+bigint<n> Fp_model<n, modulus>::euler;
+
+template<mp_size_t n, const bigint<n>& modulus>
+size_t Fp_model<n, modulus>::s;
+
+template<mp_size_t n, const bigint<n>& modulus>
+bigint<n> Fp_model<n, modulus>::t;
+
+template<mp_size_t n, const bigint<n>& modulus>
+bigint<n> Fp_model<n, modulus>::t_minus_1_over_2;
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp_model<n, modulus> Fp_model<n, modulus>::nqr;
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp_model<n, modulus> Fp_model<n, modulus>::nqr_to_t;
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp_model<n, modulus> Fp_model<n, modulus>::multiplicative_generator;
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp_model<n, modulus> Fp_model<n, modulus>::root_of_unity;
+
+template<mp_size_t n, const bigint<n>& modulus>
+mp_limb_t Fp_model<n, modulus>::inv;
+
+template<mp_size_t n, const bigint<n>& modulus>
+bigint<n> Fp_model<n, modulus>::Rsquared;
+
+template<mp_size_t n, const bigint<n>& modulus>
+bigint<n> Fp_model<n, modulus>::Rcubed;
+
+} // libff
+#include <libff/algebra/fields/fp.tcc>
+
+#endif // FP_HPP_
diff --git a/src/libff/libff/algebra/fields/fp.tcc b/src/libff/libff/algebra/fields/fp.tcc
new file mode 100755
index 000000000..17f9e7b82
--- /dev/null
+++ b/src/libff/libff/algebra/fields/fp.tcc
@@ -0,0 +1,805 @@
+/** @file
+ *****************************************************************************
+ Implementation of arithmetic in the finite field F[p], for prime p of fixed length.
+ *****************************************************************************
+ * @author     This file is part of libff, developed by SCIPR Lab
+ *             and contributors (see AUTHORS).
+ * @copyright  MIT license (see LICENSE file)
+ *****************************************************************************/
+
+#ifndef FP_TCC_
+#define FP_TCC_
+#include <cassert>
+#include <cmath>
+#include <cstdlib>
+#include <limits>
+
+#include <libff/algebra/fields/field_utils.hpp>
+#include <libff/algebra/fields/fp_aux.tcc>
+
+namespace libff {
+
+template<mp_size_t n, const bigint<n>& modulus>
+void Fp_model<n,modulus>::mul_reduce(const bigint<n> &other)
+{
+    /* stupid pre-processor tricks; beware */
+#if defined(__x86_64__) && defined(USE_ASM)
+    if (n == 3)
+    { // Use asm-optimized Comba multiplication and reduction
+        mp_limb_t res[2*n];
+        mp_limb_t c0, c1, c2;
+        COMBA_3_BY_3_MUL(c0, c1, c2, res, this->mont_repr.data, other.data);
+
+        mp_limb_t k;
+        mp_limb_t tmp1, tmp2, tmp3;
+        REDUCE_6_LIMB_PRODUCT(k, tmp1, tmp2, tmp3, inv, res, modulus.data);
+
+        /* subtract t > mod */
+        __asm__
+            ("/* check for overflow */        \n\t"
+             MONT_CMP(16)
+             MONT_CMP(8)
+             MONT_CMP(0)
+
+             "/* subtract mod if overflow */  \n\t"
+             "subtract%=:                     \n\t"
+             MONT_FIRSTSUB
+             MONT_NEXTSUB(8)
+             MONT_NEXTSUB(16)
+             "done%=:                         \n\t"
+             :
+             : [tmp] "r" (res+n), [M] "r" (modulus.data)
+             : "cc", "memory", "%rax");
+        mpn_copyi(this->mont_repr.data, res+n, n);
+    }
+    else if (n == 4)
+    { // use asm-optimized "CIOS method"
+
+        mp_limb_t tmp[n+1];
+        mp_limb_t T0=0, T1=1, cy=2, u=3; // TODO: fix this
+
+        __asm__ (MONT_PRECOMPUTE
+                 MONT_FIRSTITER(1)
+                 MONT_FIRSTITER(2)
+                 MONT_FIRSTITER(3)
+                 MONT_FINALIZE(3)
+                 MONT_ITERFIRST(1)
+                 MONT_ITERITER(1, 1)
+                 MONT_ITERITER(1, 2)
+                 MONT_ITERITER(1, 3)
+                 MONT_FINALIZE(3)
+                 MONT_ITERFIRST(2)
+                 MONT_ITERITER(2, 1)
+                 MONT_ITERITER(2, 2)
+                 MONT_ITERITER(2, 3)
+                 MONT_FINALIZE(3)
+                 MONT_ITERFIRST(3)
+                 MONT_ITERITER(3, 1)
+                 MONT_ITERITER(3, 2)
+                 MONT_ITERITER(3, 3)
+                 MONT_FINALIZE(3)
+                 "/* check for overflow */        \n\t"
+                 MONT_CMP(24)
+                 MONT_CMP(16)
+                 MONT_CMP(8)
+                 MONT_CMP(0)
+
+                 "/* subtract mod if overflow */  \n\t"
+                 "subtract%=:                     \n\t"
+                 MONT_FIRSTSUB
+                 MONT_NEXTSUB(8)
+                 MONT_NEXTSUB(16)
+                 MONT_NEXTSUB(24)
+                 "done%=:                         \n\t"
+                 :
+                 : [tmp] "r" (tmp), [A] "r" (this->mont_repr.data), [B] "r" (other.data), [inv] "r" (inv), [M] "r" (modulus.data),
+                   [T0] "r" (T0), [T1] "r" (T1), [cy] "r" (cy), [u] "r" (u)
+                 : "cc", "memory", "%rax", "%rdx"
+        );
+        mpn_copyi(this->mont_repr.data, tmp, n);
+    }
+    else if (n == 5)
+    { // use asm-optimized "CIOS method"
+
+        mp_limb_t tmp[n+1];
+        mp_limb_t T0=0, T1=1, cy=2, u=3; // TODO: fix this
+
+        __asm__ (MONT_PRECOMPUTE
+                 MONT_FIRSTITER(1)
+                 MONT_FIRSTITER(2)
+                 MONT_FIRSTITER(3)
+                 MONT_FIRSTITER(4)
+                 MONT_FINALIZE(4)
+                 MONT_ITERFIRST(1)
+                 MONT_ITERITER(1, 1)
+                 MONT_ITERITER(1, 2)
+                 MONT_ITERITER(1, 3)
+                 MONT_ITERITER(1, 4)
+                 MONT_FINALIZE(4)
+                 MONT_ITERFIRST(2)
+                 MONT_ITERITER(2, 1)
+                 MONT_ITERITER(2, 2)
+                 MONT_ITERITER(2, 3)
+                 MONT_ITERITER(2, 4)
+                 MONT_FINALIZE(4)
+                 MONT_ITERFIRST(3)
+                 MONT_ITERITER(3, 1)
+                 MONT_ITERITER(3, 2)
+                 MONT_ITERITER(3, 3)
+                 MONT_ITERITER(3, 4)
+                 MONT_FINALIZE(4)
+                 MONT_ITERFIRST(4)
+                 MONT_ITERITER(4, 1)
+                 MONT_ITERITER(4, 2)
+                 MONT_ITERITER(4, 3)
+                 MONT_ITERITER(4, 4)
+                 MONT_FINALIZE(4)
+                 "/* check for overflow */        \n\t"
+                 MONT_CMP(32)
+                 MONT_CMP(24)
+                 MONT_CMP(16)
+                 MONT_CMP(8)
+                 MONT_CMP(0)
+
+                 "/* subtract mod if overflow */  \n\t"
+                 "subtract%=:                     \n\t"
+                 MONT_FIRSTSUB
+                 MONT_NEXTSUB(8)
+                 MONT_NEXTSUB(16)
+                 MONT_NEXTSUB(24)
+                 MONT_NEXTSUB(32)
+                 "done%=:                         \n\t"
+                 :
+                 : [tmp] "r" (tmp), [A] "r" (this->mont_repr.data), [B] "r" (other.data), [inv] "r" (inv), [M] "r" (modulus.data),
+                   [T0] "r" (T0), [T1] "r" (T1), [cy] "r" (cy), [u] "r" (u)
+                 : "cc", "memory", "%rax", "%rdx"
+        );
+        mpn_copyi(this->mont_repr.data, tmp, n);
+    }
+    else
+#endif
+    {
+        mp_limb_t res[2*n];
+        mpn_mul_n(res, this->mont_repr.data, other.data, n);
+
+        /*
+          The Montgomery reduction here is based on Algorithm 14.32 in
+          Handbook of Applied Cryptography
+          <http://cacr.uwaterloo.ca/hac/about/chap14.pdf>.
+         */
+        for (size_t i = 0; i < n; ++i)
+        {
+            mp_limb_t k = inv * res[i];
+            /* calculate res = res + k * mod * b^i */
+            mp_limb_t carryout = mpn_addmul_1(res+i, modulus.data, n, k);
+            carryout = mpn_add_1(res+n+i, res+n+i, n-i, carryout);
+            assert(carryout == 0);
+        }
+
+        if (mpn_cmp(res+n, modulus.data, n) >= 0)
+        {
+            const mp_limb_t borrow = mpn_sub(res+n, res+n, n, modulus.data, n);
+            assert(borrow == 0);
+        }
+
+        mpn_copyi(this->mont_repr.data, res+n, n);
+    }
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp_model<n,modulus>::Fp_model(const bigint<n> &b)
+{
+    mpn_copyi(this->mont_repr.data, Rsquared.data, n);
+    mul_reduce(b);
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp_model<n,modulus>::Fp_model(const long x, const bool is_unsigned)
+{
+    static_assert(std::numeric_limits<mp_limb_t>::max() >= static_cast<unsigned long>(std::numeric_limits<long>::max()), "long won't fit in mp_limb_t");
+    if (is_unsigned || x >= 0)
+    {
+        this->mont_repr.data[0] = (mp_limb_t)x;
+    }
+    else
+    {
+        const mp_limb_t borrow = mpn_sub_1(this->mont_repr.data, modulus.data, n, (mp_limb_t)-x);
+        assert(borrow == 0);
+    }
+
+    mul_reduce(Rsquared);
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+void Fp_model<n,modulus>::set_ulong(const unsigned long x)
+{
+    this->mont_repr.clear();
+    this->mont_repr.data[0] = x;
+    mul_reduce(Rsquared);
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+void Fp_model<n,modulus>::clear()
+{
+    this->mont_repr.clear();
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+bigint<n> Fp_model<n,modulus>::as_bigint() const
+{
+    bigint<n> one;
+    one.clear();
+    one.data[0] = 1;
+
+    Fp_model<n, modulus> res(*this);
+    res.mul_reduce(one);
+
+    return (res.mont_repr);
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+unsigned long Fp_model<n,modulus>::as_ulong() const
+{
+    return this->as_bigint().as_ulong();
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+bool Fp_model<n,modulus>::operator==(const Fp_model& other) const
+{
+    return (this->mont_repr == other.mont_repr);
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+bool Fp_model<n,modulus>::operator!=(const Fp_model& other) const
+{
+    return (this->mont_repr != other.mont_repr);
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+bool Fp_model<n,modulus>::is_zero() const
+{
+    return (this->mont_repr.is_zero()); // zero maps to zero
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+void Fp_model<n,modulus>::print() const
+{
+    Fp_model<n,modulus> tmp;
+    tmp.mont_repr.data[0] = 1;
+    tmp.mul_reduce(this->mont_repr);
+
+    tmp.mont_repr.print();
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp_model<n,modulus> Fp_model<n,modulus>::zero()
+{
+    Fp_model<n,modulus> res;
+    res.mont_repr.clear();
+    return res;
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp_model<n,modulus> Fp_model<n,modulus>::one()
+{
+    Fp_model<n,modulus> res;
+    res.mont_repr.data[0] = 1;
+    res.mul_reduce(Rsquared);
+    return res;
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp_model<n,modulus> Fp_model<n,modulus>::geometric_generator()
+{
+    Fp_model<n,modulus> res;
+    res.mont_repr.data[0] = 2;
+    res.mul_reduce(Rsquared);
+    return res;
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp_model<n,modulus> Fp_model<n,modulus>::arithmetic_generator()
+{
+    Fp_model<n,modulus> res;
+    res.mont_repr.data[0] = 1;
+    res.mul_reduce(Rsquared);
+    return res;
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp_model<n,modulus>& Fp_model<n,modulus>::operator+=(const Fp_model<n,modulus>& other)
+{
+#ifdef PROFILE_OP_COUNTS
+    this->add_cnt++;
+#endif
+#if defined(__x86_64__) && defined(USE_ASM)
+    if (n == 3)
+    {
+        __asm__
+            ("/* perform bignum addition */   \n\t"
+             ADD_FIRSTADD
+             ADD_NEXTADD(8)
+             ADD_NEXTADD(16)
+             "/* if overflow: subtract     */ \n\t"
+             "/* (tricky point: if A and B are in the range we do not need to do anything special for the possible carry flag) */ \n\t"
+             "jc      subtract%=              \n\t"
+
+             "/* check for overflow */        \n\t"
+             ADD_CMP(16)
+             ADD_CMP(8)
+             ADD_CMP(0)
+
+             "/* subtract mod if overflow */  \n\t"
+             "subtract%=:                     \n\t"
+             ADD_FIRSTSUB
+             ADD_NEXTSUB(8)
+             ADD_NEXTSUB(16)
+             "done%=:                         \n\t"
+             :
+             : [A] "r" (this->mont_repr.data), [B] "r" (other.mont_repr.data), [mod] "r" (modulus.data)
+             : "cc", "memory", "%rax");
+    }
+    else if (n == 4)
+    {
+        __asm__
+            ("/* perform bignum addition */   \n\t"
+             ADD_FIRSTADD
+             ADD_NEXTADD(8)
+             ADD_NEXTADD(16)
+             ADD_NEXTADD(24)
+             "/* if overflow: subtract     */ \n\t"
+             "/* (tricky point: if A and B are in the range we do not need to do anything special for the possible carry flag) */ \n\t"
+             "jc      subtract%=              \n\t"
+
+             "/* check for overflow */        \n\t"
+             ADD_CMP(24)
+             ADD_CMP(16)
+             ADD_CMP(8)
+             ADD_CMP(0)
+
+             "/* subtract mod if overflow */  \n\t"
+             "subtract%=:                     \n\t"
+             ADD_FIRSTSUB
+             ADD_NEXTSUB(8)
+             ADD_NEXTSUB(16)
+             ADD_NEXTSUB(24)
+             "done%=:                         \n\t"
+             :
+             : [A] "r" (this->mont_repr.data), [B] "r" (other.mont_repr.data), [mod] "r" (modulus.data)
+             : "cc", "memory", "%rax");
+    }
+    else if (n == 5)
+    {
+        __asm__
+            ("/* perform bignum addition */   \n\t"
+             ADD_FIRSTADD
+             ADD_NEXTADD(8)
+             ADD_NEXTADD(16)
+             ADD_NEXTADD(24)
+             ADD_NEXTADD(32)
+             "/* if overflow: subtract     */ \n\t"
+             "/* (tricky point: if A and B are in the range we do not need to do anything special for the possible carry flag) */ \n\t"
+             "jc      subtract%=              \n\t"
+
+             "/* check for overflow */        \n\t"
+             ADD_CMP(32)
+             ADD_CMP(24)
+             ADD_CMP(16)
+             ADD_CMP(8)
+             ADD_CMP(0)
+
+             "/* subtract mod if overflow */  \n\t"
+             "subtract%=:                     \n\t"
+             ADD_FIRSTSUB
+             ADD_NEXTSUB(8)
+             ADD_NEXTSUB(16)
+             ADD_NEXTSUB(24)
+             ADD_NEXTSUB(32)
+             "done%=:                         \n\t"
+             :
+             : [A] "r" (this->mont_repr.data), [B] "r" (other.mont_repr.data), [mod] "r" (modulus.data)
+             : "cc", "memory", "%rax");
+    }
+    else
+#endif
+    {
+        mp_limb_t scratch[n+1];
+        const mp_limb_t carry = mpn_add_n(scratch, this->mont_repr.data, other.mont_repr.data, n);
+        scratch[n] = carry;
+
+        if (carry || mpn_cmp(scratch, modulus.data, n) >= 0)
+        {
+            const mp_limb_t borrow = mpn_sub(scratch, scratch, n+1, modulus.data, n);
+            assert(borrow == 0);
+        }
+
+        mpn_copyi(this->mont_repr.data, scratch, n);
+    }
+
+    return *this;
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp_model<n,modulus>& Fp_model<n,modulus>::operator-=(const Fp_model<n,modulus>& other)
+{
+#ifdef PROFILE_OP_COUNTS
+    this->sub_cnt++;
+#endif
+#if defined(__x86_64__) && defined(USE_ASM)
+    if (n == 3)
+    {
+        __asm__
+            (SUB_FIRSTSUB
+             SUB_NEXTSUB(8)
+             SUB_NEXTSUB(16)
+
+             "jnc     done%=\n\t"
+
+             SUB_FIRSTADD
+             SUB_NEXTADD(8)
+             SUB_NEXTADD(16)
+
+             "done%=:\n\t"
+             :
+             : [A] "r" (this->mont_repr.data), [B] "r" (other.mont_repr.data), [mod] "r" (modulus.data)
+             : "cc", "memory", "%rax");
+    }
+    else if (n == 4)
+    {
+        __asm__
+            (SUB_FIRSTSUB
+             SUB_NEXTSUB(8)
+             SUB_NEXTSUB(16)
+             SUB_NEXTSUB(24)
+
+             "jnc     done%=\n\t"
+
+             SUB_FIRSTADD
+             SUB_NEXTADD(8)
+             SUB_NEXTADD(16)
+             SUB_NEXTADD(24)
+
+             "done%=:\n\t"
+             :
+             : [A] "r" (this->mont_repr.data), [B] "r" (other.mont_repr.data), [mod] "r" (modulus.data)
+             : "cc", "memory", "%rax");
+    }
+    else if (n == 5)
+    {
+        __asm__
+            (SUB_FIRSTSUB
+             SUB_NEXTSUB(8)
+             SUB_NEXTSUB(16)
+             SUB_NEXTSUB(24)
+             SUB_NEXTSUB(32)
+
+             "jnc     done%=\n\t"
+
+             SUB_FIRSTADD
+             SUB_NEXTADD(8)
+             SUB_NEXTADD(16)
+             SUB_NEXTADD(24)
+             SUB_NEXTADD(32)
+
+             "done%=:\n\t"
+             :
+             : [A] "r" (this->mont_repr.data), [B] "r" (other.mont_repr.data), [mod] "r" (modulus.data)
+             : "cc", "memory", "%rax");
+    }
+    else
+#endif
+    {
+        mp_limb_t scratch[n+1];
+        if (mpn_cmp(this->mont_repr.data, other.mont_repr.data, n) < 0)
+        {
+            const mp_limb_t carry = mpn_add_n(scratch, this->mont_repr.data, modulus.data, n);
+            scratch[n] = carry;
+        }
+        else
+        {
+            mpn_copyi(scratch, this->mont_repr.data, n);
+            scratch[n] = 0;
+        }
+
+        const mp_limb_t borrow = mpn_sub(scratch, scratch, n+1, other.mont_repr.data, n);
+        assert(borrow == 0);
+
+        mpn_copyi(this->mont_repr.data, scratch, n);
+    }
+    return *this;
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp_model<n,modulus>& Fp_model<n,modulus>::operator*=(const Fp_model<n,modulus>& other)
+{
+#ifdef PROFILE_OP_COUNTS
+    this->mul_cnt++;
+#endif
+
+    mul_reduce(other.mont_repr);
+    return *this;
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp_model<n,modulus>& Fp_model<n,modulus>::operator^=(const unsigned long pow)
+{
+    (*this) = power<Fp_model<n, modulus> >(*this, pow);
+    return (*this);
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+template<mp_size_t m>
+Fp_model<n,modulus>& Fp_model<n,modulus>::operator^=(const bigint<m> &pow)
+{
+    (*this) = power<Fp_model<n, modulus>, m>(*this, pow);
+    return (*this);
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp_model<n,modulus> Fp_model<n,modulus>::operator+(const Fp_model<n,modulus>& other) const
+{
+    Fp_model<n, modulus> r(*this);
+    return (r += other);
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp_model<n,modulus> Fp_model<n,modulus>::operator-(const Fp_model<n,modulus>& other) const
+{
+    Fp_model<n, modulus> r(*this);
+    return (r -= other);
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp_model<n,modulus> Fp_model<n,modulus>::operator*(const Fp_model<n,modulus>& other) const
+{
+    Fp_model<n, modulus> r(*this);
+    return (r *= other);
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp_model<n,modulus> Fp_model<n,modulus>::operator^(const unsigned long pow) const
+{
+    Fp_model<n, modulus> r(*this);
+    return (r ^= pow);
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+template<mp_size_t m>
+Fp_model<n,modulus> Fp_model<n,modulus>::operator^(const bigint<m> &pow) const
+{
+    Fp_model<n, modulus> r(*this);
+    return (r ^= pow);
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp_model<n,modulus> Fp_model<n,modulus>::operator-() const
+{
+#ifdef PROFILE_OP_COUNTS
+    this->sub_cnt++;
+#endif
+
+    if (this->is_zero())
+    {
+        return (*this);
+    }
+    else
+    {
+        Fp_model<n, modulus> r;
+        mpn_sub_n(r.mont_repr.data, modulus.data, this->mont_repr.data, n);
+        return r;
+    }
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp_model<n,modulus> Fp_model<n,modulus>::squared() const
+{
+#ifdef PROFILE_OP_COUNTS
+    this->sqr_cnt++;
+    this->mul_cnt--; // zero out the upcoming mul
+#endif
+    /* stupid pre-processor tricks; beware */
+#if defined(__x86_64__) && defined(USE_ASM)
+    if (n == 3)
+    { // use asm-optimized Comba squaring
+        mp_limb_t res[2*n];
+        mp_limb_t c0, c1, c2;
+        COMBA_3_BY_3_SQR(c0, c1, c2, res, this->mont_repr.data);
+
+        mp_limb_t k;
+        mp_limb_t tmp1, tmp2, tmp3;
+        REDUCE_6_LIMB_PRODUCT(k, tmp1, tmp2, tmp3, inv, res, modulus.data);
+
+        /* subtract t > mod */
+        __asm__ volatile
+            ("/* check for overflow */        \n\t"
+             MONT_CMP(16)
+             MONT_CMP(8)
+             MONT_CMP(0)
+
+             "/* subtract mod if overflow */  \n\t"
+             "subtract%=:                     \n\t"
+             MONT_FIRSTSUB
+             MONT_NEXTSUB(8)
+             MONT_NEXTSUB(16)
+             "done%=:                         \n\t"
+             :
+             : [tmp] "r" (res+n), [M] "r" (modulus.data)
+             : "cc", "memory", "%rax");
+
+        Fp_model<n, modulus> r;
+        mpn_copyi(r.mont_repr.data, res+n, n);
+        return r;
+    }
+    else
+#endif
+    {
+        Fp_model<n, modulus> r(*this);
+        return (r *= r);
+    }
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp_model<n,modulus>& Fp_model<n,modulus>::invert()
+{
+#ifdef PROFILE_OP_COUNTS
+    this->inv_cnt++;
+#endif
+
+    assert(!this->is_zero());
+
+    bigint<n> g; /* gp should have room for vn = n limbs */
+
+    mp_limb_t s[n+1]; /* sp should have room for vn+1 limbs */
+    mp_size_t sn;
+
+    bigint<n> v = modulus; // both source operands are destroyed by mpn_gcdext
+
+    /* computes gcd(u, v) = g = u*s + v*t, so s*u will be 1 (mod v) */
+    const mp_size_t gn = mpn_gcdext(g.data, s, &sn, this->mont_repr.data, n, v.data, n);
+    assert(gn == 1 && g.data[0] == 1); /* inverse exists */
+
+    mp_limb_t q; /* division result fits into q, as sn <= n+1 */
+    /* sn < 0 indicates negative sn; will fix up later */
+
+    if (std::abs(sn) >= n)
+    {
+        /* if sn could require modulus reduction, do it here */
+        mpn_tdiv_qr(&q, this->mont_repr.data, 0, s, std::abs(sn), modulus.data, n);
+    }
+    else
+    {
+        /* otherwise just copy it over */
+        mpn_zero(this->mont_repr.data, n);
+        mpn_copyi(this->mont_repr.data, s, std::abs(sn));
+    }
+
+    /* fix up the negative sn */
+    if (sn < 0)
+    {
+        const mp_limb_t borrow = mpn_sub_n(this->mont_repr.data, modulus.data, this->mont_repr.data, n);
+        assert(borrow == 0);
+    }
+
+    mul_reduce(Rcubed);
+    return *this;
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp_model<n,modulus> Fp_model<n,modulus>::inverse() const
+{
+    Fp_model<n, modulus> r(*this);
+    return (r.invert());
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp_model<n, modulus> Fp_model<n,modulus>::random_element() /// returns random element of Fp_model
+{
+    /* note that as Montgomery representation is a bijection then
+       selecting a random element of {xR} is the same as selecting a
+       random element of {x} */
+    Fp_model<n, modulus> r;
+    do
+    {
+        r.mont_repr.randomize();
+
+        /* clear all bits higher than MSB of modulus */
+        size_t bitno = GMP_NUMB_BITS * n - 1;
+        while (modulus.test_bit(bitno) == false)
+        {
+            const std::size_t part = bitno/GMP_NUMB_BITS;
+            const std::size_t bit = bitno - (GMP_NUMB_BITS*part);
+
+            r.mont_repr.data[part] &= ~(1ul<<bit);
+
+            bitno--;
+        }
+    }
+   /* if r.data is still >= modulus -- repeat (rejection sampling) */
+    while (mpn_cmp(r.mont_repr.data, modulus.data, n) >= 0);
+
+    return r;
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp_model<n,modulus> Fp_model<n,modulus>::sqrt() const
+{
+    Fp_model<n,modulus> one = Fp_model<n,modulus>::one();
+
+    size_t v = Fp_model<n,modulus>::s;
+    Fp_model<n,modulus> z = Fp_model<n,modulus>::nqr_to_t;
+    Fp_model<n,modulus> w = (*this)^Fp_model<n,modulus>::t_minus_1_over_2;
+    Fp_model<n,modulus> x = (*this) * w;
+    Fp_model<n,modulus> b = x * w; // b = (*this)^t
+
+#if DEBUG
+    // check if square with euler's criterion
+    Fp_model<n,modulus> check = b;
+    for (size_t i = 0; i < v-1; ++i)
+    {
+        check = check.squared();
+    }
+    if (check != one)
+    {
+        assert(0);
+    }
+#endif
+
+    // compute square root with Tonelli--Shanks
+    // (does not terminate if not a square!)
+
+    while (b != one)
+    {
+        size_t m = 0;
+        Fp_model<n,modulus> b2m = b;
+        while (b2m != one)
+        {
+            /* invariant: b2m = b^(2^m) after entering this loop */
+            b2m = b2m.squared();
+            m += 1;
+        }
+
+        int j = v-m-1;
+        w = z;
+        while (j > 0)
+        {
+            w = w.squared();
+            --j;
+        } // w = z^2^(v-m-1)
+
+        z = w.squared();
+        b = b * z;
+        x = x * w;
+        v = m;
+    }
+
+    return x;
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+std::ostream& operator<<(std::ostream &out, const Fp_model<n, modulus> &p)
+{
+#ifndef MONTGOMERY_OUTPUT
+    Fp_model<n,modulus> tmp;
+    tmp.mont_repr.data[0] = 1;
+    tmp.mul_reduce(p.mont_repr);
+    out << tmp.mont_repr;
+#else
+    out << p.mont_repr;
+#endif
+    return out;
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+std::istream& operator>>(std::istream &in, Fp_model<n, modulus> &p)
+{
+#ifndef MONTGOMERY_OUTPUT
+    in >> p.mont_repr;
+    p.mul_reduce(Fp_model<n, modulus>::Rsquared);
+#else
+    in >> p.mont_repr;
+#endif
+    return in;
+}
+
+} // libff
+#endif // FP_TCC_
diff --git a/src/libff/libff/algebra/fields/fp12_2over3over2.hpp b/src/libff/libff/algebra/fields/fp12_2over3over2.hpp
new file mode 100755
index 000000000..6c31291f6
--- /dev/null
+++ b/src/libff/libff/algebra/fields/fp12_2over3over2.hpp
@@ -0,0 +1,117 @@
+/** @file
+ *****************************************************************************
+ Declaration of arithmetic in the finite field F[((p^2)^3)^2].
+ *****************************************************************************
+ * @author     This file is part of libff, developed by SCIPR Lab
+ *             and contributors (see AUTHORS).
+ * @copyright  MIT license (see LICENSE file)
+ *****************************************************************************/
+
+#ifndef FP12_2OVER3OVER2_HPP_
+#define FP12_2OVER3OVER2_HPP_
+#include <vector>
+
+#include <libff/algebra/fields/fp.hpp>
+#include <libff/algebra/fields/fp2.hpp>
+#include <libff/algebra/fields/fp6_3over2.hpp>
+
+namespace libff {
+
+template<mp_size_t n, const bigint<n>& modulus>
+class Fp12_2over3over2_model;
+
+template<mp_size_t n, const bigint<n>& modulus>
+std::ostream& operator<<(std::ostream &, const Fp12_2over3over2_model<n, modulus> &);
+
+template<mp_size_t n, const bigint<n>& modulus>
+std::istream& operator>>(std::istream &, Fp12_2over3over2_model<n, modulus> &);
+
+/**
+ * Arithmetic in the finite field F[((p^2)^3)^2].
+ *
+ * Let p := modulus. This interface provides arithmetic for the extension field
+ * Fp12 = Fp6[W]/(W^2-V) where Fp6 = Fp2[V]/(V^3-non_residue) and non_residue is in Fp2
+ *
+ * ASSUMPTION: p = 1 (mod 6)
+ */
+template<mp_size_t n, const bigint<n>& modulus>
+class Fp12_2over3over2_model {
+public:
+    typedef Fp_model<n, modulus> my_Fp;
+    typedef Fp2_model<n, modulus> my_Fp2;
+    typedef Fp6_3over2_model<n, modulus> my_Fp6;
+
+    static Fp2_model<n, modulus> non_residue;
+    static Fp2_model<n, modulus> Frobenius_coeffs_c1[12]; // non_residue^((modulus^i-1)/6) for i=0,...,11
+
+    my_Fp6 c0, c1;
+    Fp12_2over3over2_model() {};
+    Fp12_2over3over2_model(const my_Fp6& c0, const my_Fp6& c1) : c0(c0), c1(c1) {};
+
+    void clear() { c0.clear(); c1.clear(); }
+    void print() const { printf("c0/c1:\n"); c0.print(); c1.print(); }
+
+    static Fp12_2over3over2_model<n, modulus> zero();
+    static Fp12_2over3over2_model<n, modulus> one();
+    static Fp12_2over3over2_model<n, modulus> random_element();
+
+    bool is_zero() const { return c0.is_zero() && c1.is_zero(); }
+    bool operator==(const Fp12_2over3over2_model &other) const;
+    bool operator!=(const Fp12_2over3over2_model &other) const;
+
+    Fp12_2over3over2_model operator+(const Fp12_2over3over2_model &other) const;
+    Fp12_2over3over2_model operator-(const Fp12_2over3over2_model &other) const;
+    Fp12_2over3over2_model operator*(const Fp12_2over3over2_model &other) const;
+    Fp12_2over3over2_model operator-() const;
+    Fp12_2over3over2_model squared() const; // default is squared_complex
+    Fp12_2over3over2_model squared_karatsuba() const;
+    Fp12_2over3over2_model squared_complex() const;
+    Fp12_2over3over2_model inverse() const;
+    Fp12_2over3over2_model Frobenius_map(unsigned long power) const;
+    Fp12_2over3over2_model unitary_inverse() const;
+    Fp12_2over3over2_model cyclotomic_squared() const;
+
+    Fp12_2over3over2_model mul_by_024(const my_Fp2 &ell_0, const my_Fp2 &ell_VW, const my_Fp2 &ell_VV) const;
+
+    static my_Fp6 mul_by_non_residue(const my_Fp6 &elt);
+
+    template<mp_size_t m>
+    Fp12_2over3over2_model cyclotomic_exp(const bigint<m> &exponent) const;
+
+    static bigint<n> base_field_char() { return modulus; }
+    static size_t extension_degree() { return 12; }
+
+    friend std::ostream& operator<< <n, modulus>(std::ostream &out, const Fp12_2over3over2_model<n, modulus> &el);
+    friend std::istream& operator>> <n, modulus>(std::istream &in, Fp12_2over3over2_model<n, modulus> &el);
+};
+
+template<mp_size_t n, const bigint<n>& modulus>
+std::ostream& operator<<(std::ostream& out, const std::vector<Fp12_2over3over2_model<n, modulus> > &v);
+
+template<mp_size_t n, const bigint<n>& modulus>
+std::istream& operator>>(std::istream& in, std::vector<Fp12_2over3over2_model<n, modulus> > &v);
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp12_2over3over2_model<n, modulus> operator*(const Fp_model<n, modulus> &lhs, const Fp12_2over3over2_model<n, modulus> &rhs);
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp12_2over3over2_model<n, modulus> operator*(const Fp2_model<n, modulus> &lhs, const Fp12_2over3over2_model<n, modulus> &rhs);
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp12_2over3over2_model<n, modulus> operator*(const Fp6_3over2_model<n, modulus> &lhs, const Fp12_2over3over2_model<n, modulus> &rhs);
+
+template<mp_size_t n, const bigint<n>& modulus, mp_size_t m>
+Fp12_2over3over2_model<n, modulus> operator^(const Fp12_2over3over2_model<n, modulus> &self, const bigint<m> &exponent);
+
+template<mp_size_t n, const bigint<n>& modulus, mp_size_t m, const bigint<m>& exp_modulus>
+Fp12_2over3over2_model<n, modulus> operator^(const Fp12_2over3over2_model<n, modulus> &self, const Fp_model<m, exp_modulus> &exponent);
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp2_model<n, modulus> Fp12_2over3over2_model<n, modulus>::non_residue;
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp2_model<n, modulus> Fp12_2over3over2_model<n, modulus>::Frobenius_coeffs_c1[12];
+
+} // libff
+#include <libff/algebra/fields/fp12_2over3over2.tcc>
+#endif // FP12_2OVER3OVER2_HPP_
diff --git a/src/libff/libff/algebra/fields/fp12_2over3over2.tcc b/src/libff/libff/algebra/fields/fp12_2over3over2.tcc
new file mode 100755
index 000000000..6220c4f51
--- /dev/null
+++ b/src/libff/libff/algebra/fields/fp12_2over3over2.tcc
@@ -0,0 +1,412 @@
+/** @file
+ *****************************************************************************
+ Implementation of arithmetic in the finite field F[((p^2)^3)^2].
+ *****************************************************************************
+ * @author     This file is part of libff, developed by SCIPR Lab
+ *             and contributors (see AUTHORS).
+ * @copyright  MIT license (see LICENSE file)
+ *****************************************************************************/
+
+#ifndef FP12_2OVER3OVER2_TCC_
+#define FP12_2OVER3OVER2_TCC_
+
+namespace libff {
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp6_3over2_model<n, modulus> Fp12_2over3over2_model<n,modulus>::mul_by_non_residue(const Fp6_3over2_model<n, modulus> &elt)
+{
+    return Fp6_3over2_model<n, modulus>(non_residue * elt.c2, elt.c0, elt.c1);
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp12_2over3over2_model<n,modulus> Fp12_2over3over2_model<n,modulus>::zero()
+{
+    return Fp12_2over3over2_model<n, modulus>(my_Fp6::zero(), my_Fp6::zero());
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp12_2over3over2_model<n,modulus> Fp12_2over3over2_model<n,modulus>::one()
+{
+    return Fp12_2over3over2_model<n, modulus>(my_Fp6::one(), my_Fp6::zero());
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp12_2over3over2_model<n,modulus> Fp12_2over3over2_model<n,modulus>::random_element()
+{
+    Fp12_2over3over2_model<n, modulus> r;
+    r.c0 = my_Fp6::random_element();
+    r.c1 = my_Fp6::random_element();
+
+    return r;
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+bool Fp12_2over3over2_model<n,modulus>::operator==(const Fp12_2over3over2_model<n,modulus> &other) const
+{
+    return (this->c0 == other.c0 && this->c1 == other.c1);
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+bool Fp12_2over3over2_model<n,modulus>::operator!=(const Fp12_2over3over2_model<n,modulus> &other) const
+{
+    return !(operator==(other));
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp12_2over3over2_model<n,modulus> Fp12_2over3over2_model<n,modulus>::operator+(const Fp12_2over3over2_model<n,modulus> &other) const
+{
+    return Fp12_2over3over2_model<n,modulus>(this->c0 + other.c0,
+                                             this->c1 + other.c1);
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp12_2over3over2_model<n,modulus> Fp12_2over3over2_model<n,modulus>::operator-(const Fp12_2over3over2_model<n,modulus> &other) const
+{
+    return Fp12_2over3over2_model<n,modulus>(this->c0 - other.c0,
+                                             this->c1 - other.c1);
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp12_2over3over2_model<n, modulus> operator*(const Fp_model<n, modulus> &lhs, const Fp12_2over3over2_model<n, modulus> &rhs)
+{
+    return Fp12_2over3over2_model<n,modulus>(lhs*rhs.c0,
+                                             lhs*rhs.c1);
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp12_2over3over2_model<n, modulus> operator*(const Fp2_model<n, modulus> &lhs, const Fp12_2over3over2_model<n, modulus> &rhs)
+{
+    return Fp12_2over3over2_model<n,modulus>(lhs*rhs.c0,
+                                             lhs*rhs.c1);
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp12_2over3over2_model<n, modulus> operator*(const Fp6_3over2_model<n, modulus> &lhs, const Fp12_2over3over2_model<n, modulus> &rhs)
+{
+    return Fp12_2over3over2_model<n,modulus>(lhs*rhs.c0,
+                                             lhs*rhs.c1);
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp12_2over3over2_model<n,modulus> Fp12_2over3over2_model<n,modulus>::operator*(const Fp12_2over3over2_model<n,modulus> &other) const
+{
+    /* Devegili OhEig Scott Dahab --- Multiplication and Squaring on Pairing-Friendly Fields.pdf; Section 3 (Karatsuba) */
+
+    const my_Fp6 &A = other.c0, &B = other.c1,
+        &a = this->c0, &b = this->c1;
+    const my_Fp6 aA = a * A;
+    const my_Fp6 bB = b * B;
+
+    return Fp12_2over3over2_model<n,modulus>(aA + Fp12_2over3over2_model<n, modulus>::mul_by_non_residue(bB),
+                                             (a + b)*(A+B) - aA - bB);
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp12_2over3over2_model<n,modulus> Fp12_2over3over2_model<n,modulus>::operator-() const
+{
+    return Fp12_2over3over2_model<n,modulus>(-this->c0,
+                                             -this->c1);
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp12_2over3over2_model<n,modulus> Fp12_2over3over2_model<n,modulus>::squared() const
+{
+    return squared_complex();
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp12_2over3over2_model<n,modulus> Fp12_2over3over2_model<n,modulus>::squared_karatsuba() const
+{
+    /* Devegili OhEig Scott Dahab --- Multiplication and Squaring on Pairing-Friendly Fields.pdf; Section 3 (Karatsuba squaring) */
+
+    const my_Fp6 &a = this->c0, &b = this->c1;
+    const my_Fp6 asq = a.squared();
+    const my_Fp6 bsq = b.squared();
+
+    return Fp12_2over3over2_model<n,modulus>(asq + Fp12_2over3over2_model<n, modulus>::mul_by_non_residue(bsq),
+                                             (a + b).squared() - asq - bsq);
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp12_2over3over2_model<n,modulus> Fp12_2over3over2_model<n,modulus>::squared_complex() const
+{
+    /* Devegili OhEig Scott Dahab --- Multiplication and Squaring on Pairing-Friendly Fields.pdf; Section 3 (Complex squaring) */
+
+    const my_Fp6 &a = this->c0, &b = this->c1;
+    const my_Fp6 ab = a * b;
+
+    return Fp12_2over3over2_model<n,modulus>((a + b) * (a + Fp12_2over3over2_model<n, modulus>::mul_by_non_residue(b)) - ab - Fp12_2over3over2_model<n, modulus>::mul_by_non_residue(ab),
+                                             ab + ab);
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp12_2over3over2_model<n,modulus> Fp12_2over3over2_model<n,modulus>::inverse() const
+{
+    /* From "High-Speed Software Implementation of the Optimal Ate Pairing over Barreto-Naehrig Curves"; Algorithm 8 */
+
+    const my_Fp6 &a = this->c0, &b = this->c1;
+    const my_Fp6 t0 = a.squared();
+    const my_Fp6 t1 = b.squared();
+    const my_Fp6 t2 = t0 - Fp12_2over3over2_model<n, modulus>::mul_by_non_residue(t1);
+    const my_Fp6 t3 = t2.inverse();
+    const my_Fp6 c0 = a * t3;
+    const my_Fp6 c1 = - (b * t3);
+
+    return Fp12_2over3over2_model<n,modulus>(c0, c1);
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp12_2over3over2_model<n,modulus> Fp12_2over3over2_model<n,modulus>::Frobenius_map(unsigned long power) const
+{
+    return Fp12_2over3over2_model<n,modulus>(c0.Frobenius_map(power),
+                                             Frobenius_coeffs_c1[power % 12] * c1.Frobenius_map(power));
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp12_2over3over2_model<n,modulus> Fp12_2over3over2_model<n,modulus>::unitary_inverse() const
+{
+    return Fp12_2over3over2_model<n,modulus>(this->c0,
+                                             -this->c1);
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp12_2over3over2_model<n,modulus> Fp12_2over3over2_model<n,modulus>::cyclotomic_squared() const
+{
+    /* OLD: naive implementation
+       return (*this).squared();
+    */
+    my_Fp2 z0 = this->c0.c0;
+    my_Fp2 z4 = this->c0.c1;
+    my_Fp2 z3 = this->c0.c2;
+    my_Fp2 z2 = this->c1.c0;
+    my_Fp2 z1 = this->c1.c1;
+    my_Fp2 z5 = this->c1.c2;
+
+    my_Fp2 t0, t1, t2, t3, t4, t5, tmp;
+
+    // t0 + t1*y = (z0 + z1*y)^2 = a^2
+    tmp = z0 * z1;
+    t0 = (z0 + z1) * (z0 + my_Fp6::non_residue * z1) - tmp - my_Fp6::non_residue * tmp;
+    t1 = tmp + tmp;
+    // t2 + t3*y = (z2 + z3*y)^2 = b^2
+    tmp = z2 * z3;
+    t2 = (z2 + z3) * (z2 + my_Fp6::non_residue * z3) - tmp - my_Fp6::non_residue * tmp;
+    t3 = tmp + tmp;
+    // t4 + t5*y = (z4 + z5*y)^2 = c^2
+    tmp = z4 * z5;
+    t4 = (z4 + z5) * (z4 + my_Fp6::non_residue * z5) - tmp - my_Fp6::non_residue * tmp;
+    t5 = tmp + tmp;
+
+    // for A
+
+    // z0 = 3 * t0 - 2 * z0
+    z0 = t0 - z0;
+    z0 = z0 + z0;
+    z0 = z0 + t0;
+    // z1 = 3 * t1 + 2 * z1
+    z1 = t1 + z1;
+    z1 = z1 + z1;
+    z1 = z1 + t1;
+
+    // for B
+
+    // z2 = 3 * (xi * t5) + 2 * z2
+    tmp = my_Fp6::non_residue * t5;
+    z2 = tmp + z2;
+    z2 = z2 + z2;
+    z2 = z2 + tmp;
+
+    // z3 = 3 * t4 - 2 * z3
+    z3 = t4 - z3;
+    z3 = z3 + z3;
+    z3 = z3 + t4;
+
+    // for C
+
+    // z4 = 3 * t2 - 2 * z4
+    z4 = t2 - z4;
+    z4 = z4 + z4;
+    z4 = z4 + t2;
+
+    // z5 = 3 * t3 + 2 * z5
+    z5 = t3 + z5;
+    z5 = z5 + z5;
+    z5 = z5 + t3;
+
+    return Fp12_2over3over2_model<n,modulus>(my_Fp6(z0,z4,z3),my_Fp6(z2,z1,z5));
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp12_2over3over2_model<n,modulus> Fp12_2over3over2_model<n,modulus>::mul_by_024(const Fp2_model<n, modulus> &ell_0,
+                                                                                const Fp2_model<n, modulus> &ell_VW,
+                                                                                const Fp2_model<n, modulus> &ell_VV) const
+{
+    /* OLD: naive implementation
+       Fp12_2over3over2_model<n,modulus> a(my_Fp6(ell_0, my_Fp2::zero(), ell_VV),
+       my_Fp6(my_Fp2::zero(), ell_VW, my_Fp2::zero()));
+
+       return (*this) * a;
+    */
+    my_Fp2 z0 = this->c0.c0;
+    my_Fp2 z1 = this->c0.c1;
+    my_Fp2 z2 = this->c0.c2;
+    my_Fp2 z3 = this->c1.c0;
+    my_Fp2 z4 = this->c1.c1;
+    my_Fp2 z5 = this->c1.c2;
+
+    my_Fp2 x0 = ell_0;
+    my_Fp2 x2 = ell_VV;
+    my_Fp2 x4 = ell_VW;
+
+    my_Fp2 t0, t1, t2, s0, T3, T4, D0, D2, D4, S1;
+
+    D0 = z0 * x0;
+    D2 = z2 * x2;
+    D4 = z4 * x4;
+    t2 = z0 + z4;
+    t1 = z0 + z2;
+    s0 = z1 + z3 + z5;
+
+    // For z.a_.a_ = z0.
+    S1 = z1 * x2;
+    T3 = S1 + D4;
+    T4 = my_Fp6::non_residue * T3 + D0;
+    z0 = T4;
+
+    // For z.a_.b_ = z1
+    T3 = z5 * x4;
+    S1 = S1 + T3;
+    T3 = T3 + D2;
+    T4 = my_Fp6::non_residue * T3;
+    T3 = z1 * x0;
+    S1 = S1 + T3;
+    T4 = T4 + T3;
+    z1 = T4;
+
+    // For z.a_.c_ = z2
+    t0 = x0 + x2;
+    T3 = t1 * t0 - D0 - D2;
+    T4 = z3 * x4;
+    S1 = S1 + T4;
+    T3 = T3 + T4;
+
+    // For z.b_.a_ = z3 (z3 needs z2)
+    t0 = z2 + z4;
+    z2 = T3;
+    t1 = x2 + x4;
+    T3 = t0 * t1 - D2 - D4;
+    T4 = my_Fp6::non_residue * T3;
+    T3 = z3 * x0;
+    S1 = S1 + T3;
+    T4 = T4 + T3;
+    z3 = T4;
+
+    // For z.b_.b_ = z4
+    T3 = z5 * x2;
+    S1 = S1 + T3;
+    T4 = my_Fp6::non_residue * T3;
+    t0 = x0 + x4;
+    T3 = t2 * t0 - D0 - D4;
+    T4 = T4 + T3;
+    z4 = T4;
+
+    // For z.b_.c_ = z5.
+    t0 = x0 + x2 + x4;
+    T3 = s0 * t0 - S1;
+    z5 = T3;
+
+    return Fp12_2over3over2_model<n,modulus>(my_Fp6(z0,z1,z2),my_Fp6(z3,z4,z5));
+
+}
+
+template<mp_size_t n, const bigint<n>& modulus, mp_size_t m>
+Fp12_2over3over2_model<n, modulus> operator^(const Fp12_2over3over2_model<n, modulus> &self, const bigint<m> &exponent)
+{
+    return power<Fp12_2over3over2_model<n, modulus> >(self, exponent);
+}
+
+template<mp_size_t n, const bigint<n>& modulus, mp_size_t m, const bigint<m>& exp_modulus>
+Fp12_2over3over2_model<n, modulus> operator^(const Fp12_2over3over2_model<n, modulus> &self, const Fp_model<m, exp_modulus> &exponent)
+{
+    return self^(exponent.as_bigint());
+}
+
+
+template<mp_size_t n, const bigint<n>& modulus>
+template<mp_size_t m>
+Fp12_2over3over2_model<n, modulus> Fp12_2over3over2_model<n,modulus>::cyclotomic_exp(const bigint<m> &exponent) const
+{
+    Fp12_2over3over2_model<n,modulus> res = Fp12_2over3over2_model<n,modulus>::one();
+
+    bool found_one = false;
+    for (long i = m-1; i >= 0; --i)
+    {
+        for (long j = GMP_NUMB_BITS - 1; j >= 0; --j)
+        {
+            if (found_one)
+            {
+                res = res.cyclotomic_squared();
+            }
+
+            if (exponent.data[i] & (1ul<<j))
+            {
+                found_one = true;
+                res = res * (*this);
+            }
+        }
+    }
+
+    return res;
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+std::ostream& operator<<(std::ostream &out, const Fp12_2over3over2_model<n, modulus> &el)
+{
+    out << el.c0 << OUTPUT_SEPARATOR << el.c1;
+    return out;
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+std::istream& operator>>(std::istream &in, Fp12_2over3over2_model<n, modulus> &el)
+{
+    in >> el.c0 >> el.c1;
+    return in;
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+std::ostream& operator<<(std::ostream& out, const std::vector<Fp12_2over3over2_model<n, modulus> > &v)
+{
+    out << v.size() << "\n";
+    for (const Fp12_2over3over2_model<n, modulus>& t : v)
+    {
+        out << t << OUTPUT_NEWLINE;
+    }
+
+    return out;
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+std::istream& operator>>(std::istream& in, std::vector<Fp12_2over3over2_model<n, modulus> > &v)
+{
+    v.clear();
+
+    size_t s;
+    in >> s;
+
+    char b;
+    in.read(&b, 1);
+
+    v.reserve(s);
+
+    for (size_t i = 0; i < s; ++i)
+    {
+        Fp12_2over3over2_model<n, modulus> el;
+        in >> el;
+        v.emplace_back(el);
+    }
+
+    return in;
+}
+
+} // libff
+#endif // FP12_2OVER3OVER2_TCC_
diff --git a/src/libff/libff/algebra/fields/fp2.hpp b/src/libff/libff/algebra/fields/fp2.hpp
new file mode 100755
index 000000000..a0ffd1dea
--- /dev/null
+++ b/src/libff/libff/algebra/fields/fp2.hpp
@@ -0,0 +1,121 @@
+/** @file
+ *****************************************************************************
+ Implementation of arithmetic in the finite field F[p^2].
+ *****************************************************************************
+ * @author     This file is part of libff, developed by SCIPR Lab
+ *             and contributors (see AUTHORS).
+ * @copyright  MIT license (see LICENSE file)
+ *****************************************************************************/
+
+#ifndef FP2_HPP_
+#define FP2_HPP_
+#include <vector>
+
+#include <libff/algebra/fields/fp.hpp>
+
+namespace libff {
+
+template<mp_size_t n, const bigint<n>& modulus>
+class Fp2_model;
+
+template<mp_size_t n, const bigint<n>& modulus>
+std::ostream& operator<<(std::ostream &, const Fp2_model<n, modulus> &);
+
+template<mp_size_t n, const bigint<n>& modulus>
+std::istream& operator>>(std::istream &, Fp2_model<n, modulus> &);
+
+/**
+ * Arithmetic in the field F[p^2].
+ *
+ * Let p := modulus. This interface provides arithmetic for the extension field
+ * Fp2 = Fp[U]/(U^2-non_residue), where non_residue is in Fp.
+ *
+ * ASSUMPTION: p = 1 (mod 6)
+ */
+template<mp_size_t n, const bigint<n>& modulus>
+class Fp2_model {
+public:
+    typedef Fp_model<n, modulus> my_Fp;
+
+    static bigint<2*n> euler; // (modulus^2-1)/2
+    static size_t s;       // modulus^2 = 2^s * t + 1
+    static bigint<2*n> t;  // with t odd
+    static bigint<2*n> t_minus_1_over_2; // (t-1)/2
+    static my_Fp non_residue; // X^4-non_residue irreducible over Fp; used for constructing Fp2 = Fp[X] / (X^2 - non_residue)
+    static Fp2_model<n, modulus> nqr; // a quadratic nonresidue in Fp2
+    static Fp2_model<n, modulus> nqr_to_t; // nqr^t
+    static my_Fp Frobenius_coeffs_c1[2]; // non_residue^((modulus^i-1)/2) for i=0,1
+
+    my_Fp c0, c1;
+    Fp2_model() {};
+    Fp2_model(const my_Fp& c0, const my_Fp& c1) : c0(c0), c1(c1) {};
+
+    void clear() { c0.clear(); c1.clear(); }
+    void print() const { printf("c0/c1:\n"); c0.print(); c1.print(); }
+
+    static Fp2_model<n, modulus> zero();
+    static Fp2_model<n, modulus> one();
+    static Fp2_model<n, modulus> random_element();
+
+    bool is_zero() const { return c0.is_zero() && c1.is_zero(); }
+    bool operator==(const Fp2_model &other) const;
+    bool operator!=(const Fp2_model &other) const;
+
+    Fp2_model operator+(const Fp2_model &other) const;
+    Fp2_model operator-(const Fp2_model &other) const;
+    Fp2_model operator*(const Fp2_model &other) const;
+    Fp2_model operator-() const;
+    Fp2_model squared() const; // default is squared_complex
+    Fp2_model inverse() const;
+    Fp2_model Frobenius_map(unsigned long power) const;
+    Fp2_model sqrt() const; // HAS TO BE A SQUARE (else does not terminate)
+    Fp2_model squared_karatsuba() const;
+    Fp2_model squared_complex() const;
+
+    template<mp_size_t m>
+    Fp2_model operator^(const bigint<m> &other) const;
+
+    static size_t size_in_bits() { return 2*my_Fp::size_in_bits(); }
+    static bigint<n> base_field_char() { return modulus; }
+
+    friend std::ostream& operator<< <n, modulus>(std::ostream &out, const Fp2_model<n, modulus> &el);
+    friend std::istream& operator>> <n, modulus>(std::istream &in, Fp2_model<n, modulus> &el);
+};
+
+template<mp_size_t n, const bigint<n>& modulus>
+std::ostream& operator<<(std::ostream& out, const std::vector<Fp2_model<n, modulus> > &v);
+
+template<mp_size_t n, const bigint<n>& modulus>
+std::istream& operator>>(std::istream& in, std::vector<Fp2_model<n, modulus> > &v);
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp2_model<n, modulus> operator*(const Fp_model<n, modulus> &lhs, const Fp2_model<n, modulus> &rhs);
+
+template<mp_size_t n, const bigint<n>& modulus>
+bigint<2*n> Fp2_model<n, modulus>::euler;
+
+template<mp_size_t n, const bigint<n>& modulus>
+size_t Fp2_model<n, modulus>::s;
+
+template<mp_size_t n, const bigint<n>& modulus>
+bigint<2*n> Fp2_model<n, modulus>::t;
+
+template<mp_size_t n, const bigint<n>& modulus>
+bigint<2*n> Fp2_model<n, modulus>::t_minus_1_over_2;
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp_model<n, modulus> Fp2_model<n, modulus>::non_residue;
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp2_model<n, modulus> Fp2_model<n, modulus>::nqr;
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp2_model<n, modulus> Fp2_model<n, modulus>::nqr_to_t;
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp_model<n, modulus> Fp2_model<n, modulus>::Frobenius_coeffs_c1[2];
+
+} // libff
+#include <libff/algebra/fields/fp2.tcc>
+
+#endif // FP2_HPP_
diff --git a/src/libff/libff/algebra/fields/fp2.tcc b/src/libff/libff/algebra/fields/fp2.tcc
new file mode 100755
index 000000000..bc5cca796
--- /dev/null
+++ b/src/libff/libff/algebra/fields/fp2.tcc
@@ -0,0 +1,257 @@
+/** @file
+ *****************************************************************************
+ Implementation of arithmetic in the finite field F[p^2].
+ *****************************************************************************
+ * @author     This file is part of libff, developed by SCIPR Lab
+ *             and contributors (see AUTHORS).
+ * @copyright  MIT license (see LICENSE file)
+ *****************************************************************************/
+
+#ifndef FP2_TCC_
+#define FP2_TCC_
+
+#include <libff/algebra/fields/field_utils.hpp>
+
+namespace libff {
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp2_model<n,modulus> Fp2_model<n,modulus>::zero()
+{
+    return Fp2_model<n, modulus>(my_Fp::zero(), my_Fp::zero());
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp2_model<n,modulus> Fp2_model<n,modulus>::one()
+{
+    return Fp2_model<n, modulus>(my_Fp::one(), my_Fp::zero());
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp2_model<n,modulus> Fp2_model<n,modulus>::random_element()
+{
+    Fp2_model<n, modulus> r;
+    r.c0 = my_Fp::random_element();
+    r.c1 = my_Fp::random_element();
+
+    return r;
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+bool Fp2_model<n,modulus>::operator==(const Fp2_model<n,modulus> &other) const
+{
+    return (this->c0 == other.c0 && this->c1 == other.c1);
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+bool Fp2_model<n,modulus>::operator!=(const Fp2_model<n,modulus> &other) const
+{
+    return !(operator==(other));
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp2_model<n,modulus> Fp2_model<n,modulus>::operator+(const Fp2_model<n,modulus> &other) const
+{
+    return Fp2_model<n,modulus>(this->c0 + other.c0,
+                                this->c1 + other.c1);
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp2_model<n,modulus> Fp2_model<n,modulus>::operator-(const Fp2_model<n,modulus> &other) const
+{
+    return Fp2_model<n,modulus>(this->c0 - other.c0,
+                                this->c1 - other.c1);
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp2_model<n, modulus> operator*(const Fp_model<n, modulus> &lhs, const Fp2_model<n, modulus> &rhs)
+{
+    return Fp2_model<n,modulus>(lhs*rhs.c0,
+                                lhs*rhs.c1);
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp2_model<n,modulus> Fp2_model<n,modulus>::operator*(const Fp2_model<n,modulus> &other) const
+{
+    /* Devegili OhEig Scott Dahab --- Multiplication and Squaring on Pairing-Friendly Fields.pdf; Section 3 (Karatsuba) */
+    const my_Fp
+        &A = other.c0, &B = other.c1,
+        &a = this->c0, &b = this->c1;
+    const my_Fp aA = a * A;
+    const my_Fp bB = b * B;
+
+    return Fp2_model<n,modulus>(aA + non_residue * bB,
+                                (a + b)*(A+B) - aA - bB);
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp2_model<n,modulus> Fp2_model<n,modulus>::operator-() const
+{
+    return Fp2_model<n,modulus>(-this->c0,
+                                -this->c1);
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp2_model<n,modulus> Fp2_model<n,modulus>::squared() const
+{
+    return squared_complex();
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp2_model<n,modulus> Fp2_model<n,modulus>::squared_karatsuba() const
+{
+    /* Devegili OhEig Scott Dahab --- Multiplication and Squaring on Pairing-Friendly Fields.pdf; Section 3 (Karatsuba squaring) */
+    const my_Fp &a = this->c0, &b = this->c1;
+    const my_Fp asq = a.squared();
+    const my_Fp bsq = b.squared();
+
+    return Fp2_model<n,modulus>(asq + non_residue * bsq,
+                                (a + b).squared() - asq - bsq);
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp2_model<n,modulus> Fp2_model<n,modulus>::squared_complex() const
+{
+    /* Devegili OhEig Scott Dahab --- Multiplication and Squaring on Pairing-Friendly Fields.pdf; Section 3 (Complex squaring) */
+    const my_Fp &a = this->c0, &b = this->c1;
+    const my_Fp ab = a * b;
+
+    return Fp2_model<n,modulus>((a + b) * (a + non_residue * b) - ab - non_residue * ab,
+                                ab + ab);
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp2_model<n,modulus> Fp2_model<n,modulus>::inverse() const
+{
+    const my_Fp &a = this->c0, &b = this->c1;
+
+    /* From "High-Speed Software Implementation of the Optimal Ate Pairing over Barreto-Naehrig Curves"; Algorithm 8 */
+    const my_Fp t0 = a.squared();
+    const my_Fp t1 = b.squared();
+    const my_Fp t2 = t0 - non_residue * t1;
+    const my_Fp t3 = t2.inverse();
+    const my_Fp c0 = a * t3;
+    const my_Fp c1 = - (b * t3);
+
+    return Fp2_model<n,modulus>(c0, c1);
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp2_model<n,modulus> Fp2_model<n,modulus>::Frobenius_map(unsigned long power) const
+{
+    return Fp2_model<n,modulus>(c0,
+                                Frobenius_coeffs_c1[power % 2] * c1);
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp2_model<n,modulus> Fp2_model<n,modulus>::sqrt() const
+{
+    Fp2_model<n,modulus> one = Fp2_model<n,modulus>::one();
+
+    size_t v = Fp2_model<n,modulus>::s;
+    Fp2_model<n,modulus> z = Fp2_model<n,modulus>::nqr_to_t;
+    Fp2_model<n,modulus> w = (*this)^Fp2_model<n,modulus>::t_minus_1_over_2;
+    Fp2_model<n,modulus> x = (*this) * w;
+    Fp2_model<n,modulus> b = x * w; // b = (*this)^t
+
+#if DEBUG
+    // check if square with euler's criterion
+    Fp2_model<n,modulus> check = b;
+    for (size_t i = 0; i < v-1; ++i)
+    {
+        check = check.squared();
+    }
+    if (check != one)
+    {
+        assert(0);
+    }
+#endif
+
+    // compute square root with Tonelli--Shanks
+    // (does not terminate if not a square!)
+
+    while (b != one)
+    {
+        size_t m = 0;
+        Fp2_model<n,modulus> b2m = b;
+        while (b2m != one)
+        {
+            /* invariant: b2m = b^(2^m) after entering this loop */
+            b2m = b2m.squared();
+            m += 1;
+        }
+
+        int j = v-m-1;
+        w = z;
+        while (j > 0)
+        {
+            w = w.squared();
+            --j;
+        } // w = z^2^(v-m-1)
+
+        z = w.squared();
+        b = b * z;
+        x = x * w;
+        v = m;
+    }
+
+    return x;
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+template<mp_size_t m>
+Fp2_model<n,modulus> Fp2_model<n,modulus>::operator^(const bigint<m> &pow) const
+{
+    return power<Fp2_model<n, modulus>, m>(*this, pow);
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+std::ostream& operator<<(std::ostream &out, const Fp2_model<n, modulus> &el)
+{
+    out << el.c0 << OUTPUT_SEPARATOR << el.c1;
+    return out;
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+std::istream& operator>>(std::istream &in, Fp2_model<n, modulus> &el)
+{
+    in >> el.c0 >> el.c1;
+    return in;
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+std::ostream& operator<<(std::ostream& out, const std::vector<Fp2_model<n, modulus> > &v)
+{
+    out << v.size() << "\n";
+    for (const Fp2_model<n, modulus>& t : v)
+    {
+        out << t << OUTPUT_NEWLINE;
+    }
+
+    return out;
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+std::istream& operator>>(std::istream& in, std::vector<Fp2_model<n, modulus> > &v)
+{
+    v.clear();
+
+    size_t s;
+    in >> s;
+
+    char b;
+    in.read(&b, 1);
+
+    v.reserve(s);
+
+    for (size_t i = 0; i < s; ++i)
+    {
+        Fp2_model<n, modulus> el;
+        in >> el;
+        v.emplace_back(el);
+    }
+
+    return in;
+}
+
+} // libff
+#endif // FP2_TCC_
diff --git a/src/libff/libff/algebra/fields/fp3.hpp b/src/libff/libff/algebra/fields/fp3.hpp
new file mode 100755
index 000000000..cd34fbf13
--- /dev/null
+++ b/src/libff/libff/algebra/fields/fp3.hpp
@@ -0,0 +1,123 @@
+/** @file
+ *****************************************************************************
+ Declaration of arithmetic in the finite  field F[p^3].
+ *****************************************************************************
+ * @author     This file is part of libff, developed by SCIPR Lab
+ *             and contributors (see AUTHORS).
+ * @copyright  MIT license (see LICENSE file)
+ *****************************************************************************/
+
+#ifndef FP3_HPP_
+#define FP3_HPP_
+#include <vector>
+
+#include <libff/algebra/fields/fp.hpp>
+
+namespace libff {
+
+template<mp_size_t n, const bigint<n>& modulus>
+class Fp3_model;
+
+template<mp_size_t n, const bigint<n>& modulus>
+std::ostream& operator<<(std::ostream &, const Fp3_model<n, modulus> &);
+
+template<mp_size_t n, const bigint<n>& modulus>
+std::istream& operator>>(std::istream &, Fp3_model<n, modulus> &);
+
+/**
+ * Arithmetic in the field F[p^3].
+ *
+ * Let p := modulus. This interface provides arithmetic for the extension field
+ * Fp3 = Fp[U]/(U^3-non_residue), where non_residue is in Fp.
+ *
+ * ASSUMPTION: p = 1 (mod 6)
+ */
+template<mp_size_t n, const bigint<n>& modulus>
+class Fp3_model {
+public:
+    typedef Fp_model<n, modulus> my_Fp;
+
+    static bigint<3*n> euler; // (modulus^3-1)/2
+    static size_t s;       // modulus^3 = 2^s * t + 1
+    static bigint<3*n> t;  // with t odd
+    static bigint<3*n> t_minus_1_over_2; // (t-1)/2
+    static my_Fp non_residue; // X^6-non_residue irreducible over Fp; used for constructing Fp3 = Fp[X] / (X^3 - non_residue)
+    static Fp3_model<n, modulus> nqr; // a quadratic nonresidue in Fp3
+    static Fp3_model<n, modulus> nqr_to_t; // nqr^t
+    static my_Fp Frobenius_coeffs_c1[3]; // non_residue^((modulus^i-1)/3)   for i=0,1,2
+    static my_Fp Frobenius_coeffs_c2[3]; // non_residue^((2*modulus^i-2)/3) for i=0,1,2
+
+    my_Fp c0, c1, c2;
+    Fp3_model() {};
+    Fp3_model(const my_Fp& c0, const my_Fp& c1, const my_Fp& c2) : c0(c0), c1(c1), c2(c2) {};
+
+    void clear() { c0.clear(); c1.clear(); c2.clear(); }
+    void print() const { printf("c0/c1/c2:\n"); c0.print(); c1.print(); c2.print(); }
+
+    static Fp3_model<n, modulus> zero();
+    static Fp3_model<n, modulus> one();
+    static Fp3_model<n, modulus> random_element();
+
+    bool is_zero() const { return c0.is_zero() && c1.is_zero() && c2.is_zero(); }
+    bool operator==(const Fp3_model &other) const;
+    bool operator!=(const Fp3_model &other) const;
+
+    Fp3_model operator+(const Fp3_model &other) const;
+    Fp3_model operator-(const Fp3_model &other) const;
+    Fp3_model operator*(const Fp3_model &other) const;
+    Fp3_model operator-() const;
+    Fp3_model squared() const;
+    Fp3_model inverse() const;
+    Fp3_model Frobenius_map(unsigned long power) const;
+    Fp3_model sqrt() const; // HAS TO BE A SQUARE (else does not terminate)
+
+    template<mp_size_t m>
+    Fp3_model operator^(const bigint<m> &other) const;
+
+    static size_t size_in_bits() { return 3*my_Fp::size_in_bits(); }
+    static bigint<n> base_field_char() { return modulus; }
+
+    friend std::ostream& operator<< <n, modulus>(std::ostream &out, const Fp3_model<n, modulus> &el);
+    friend std::istream& operator>> <n, modulus>(std::istream &in, Fp3_model<n, modulus> &el);
+};
+
+template<mp_size_t n, const bigint<n>& modulus>
+std::ostream& operator<<(std::ostream& out, const std::vector<Fp3_model<n, modulus> > &v);
+
+template<mp_size_t n, const bigint<n>& modulus>
+std::istream& operator>>(std::istream& in, std::vector<Fp3_model<n, modulus> > &v);
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp3_model<n, modulus> operator*(const Fp_model<n, modulus> &lhs, const Fp3_model<n, modulus> &rhs);
+
+template<mp_size_t n, const bigint<n>& modulus>
+bigint<3*n> Fp3_model<n, modulus>::euler;
+
+template<mp_size_t n, const bigint<n>& modulus>
+size_t Fp3_model<n, modulus>::s;
+
+template<mp_size_t n, const bigint<n>& modulus>
+bigint<3*n> Fp3_model<n, modulus>::t;
+
+template<mp_size_t n, const bigint<n>& modulus>
+bigint<3*n> Fp3_model<n, modulus>::t_minus_1_over_2;
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp_model<n, modulus> Fp3_model<n, modulus>::non_residue;
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp3_model<n, modulus> Fp3_model<n, modulus>::nqr;
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp3_model<n, modulus> Fp3_model<n, modulus>::nqr_to_t;
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp_model<n, modulus> Fp3_model<n, modulus>::Frobenius_coeffs_c1[3];
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp_model<n, modulus> Fp3_model<n, modulus>::Frobenius_coeffs_c2[3];
+
+} // libff
+#include <libff/algebra/fields/fp3.tcc>
+
+#endif // FP3_HPP_
diff --git a/src/libff/libff/algebra/fields/fp3.tcc b/src/libff/libff/algebra/fields/fp3.tcc
new file mode 100755
index 000000000..d3ea3fa64
--- /dev/null
+++ b/src/libff/libff/algebra/fields/fp3.tcc
@@ -0,0 +1,259 @@
+/** @file
+ *****************************************************************************
+ Implementation of arithmetic in the finite field F[p^3].
+ *****************************************************************************
+ * @author     This file is part of libff, developed by SCIPR Lab
+ *             and contributors (see AUTHORS).
+ * @copyright  MIT license (see LICENSE file)
+ *****************************************************************************/
+
+#ifndef FP3_TCC_
+#define FP3_TCC_
+
+#include <libff/algebra/fields/field_utils.hpp>
+
+namespace libff {
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp3_model<n,modulus> Fp3_model<n,modulus>::zero()
+{
+    return Fp3_model<n, modulus>(my_Fp::zero(), my_Fp::zero(), my_Fp::zero());
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp3_model<n,modulus> Fp3_model<n,modulus>::one()
+{
+    return Fp3_model<n, modulus>(my_Fp::one(), my_Fp::zero(), my_Fp::zero());
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp3_model<n,modulus> Fp3_model<n,modulus>::random_element()
+{
+    Fp3_model<n, modulus> r;
+    r.c0 = my_Fp::random_element();
+    r.c1 = my_Fp::random_element();
+    r.c2 = my_Fp::random_element();
+
+    return r;
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+bool Fp3_model<n,modulus>::operator==(const Fp3_model<n,modulus> &other) const
+{
+    return (this->c0 == other.c0 && this->c1 == other.c1 && this->c2 == other.c2);
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+bool Fp3_model<n,modulus>::operator!=(const Fp3_model<n,modulus> &other) const
+{
+    return !(operator==(other));
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp3_model<n,modulus> Fp3_model<n,modulus>::operator+(const Fp3_model<n,modulus> &other) const
+{
+    return Fp3_model<n,modulus>(this->c0 + other.c0,
+                                this->c1 + other.c1,
+                                this->c2 + other.c2);
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp3_model<n,modulus> Fp3_model<n,modulus>::operator-(const Fp3_model<n,modulus> &other) const
+{
+    return Fp3_model<n,modulus>(this->c0 - other.c0,
+                                this->c1 - other.c1,
+                                this->c2 - other.c2);
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp3_model<n, modulus> operator*(const Fp_model<n, modulus> &lhs, const Fp3_model<n, modulus> &rhs)
+{
+    return Fp3_model<n,modulus>(lhs*rhs.c0,
+                                lhs*rhs.c1,
+                                lhs*rhs.c2);
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp3_model<n,modulus> Fp3_model<n,modulus>::operator*(const Fp3_model<n,modulus> &other) const
+{
+    /* Devegili OhEig Scott Dahab --- Multiplication and Squaring on Pairing-Friendly Fields.pdf; Section 4 (Karatsuba) */
+    const my_Fp
+        &A = other.c0, &B = other.c1, &C = other.c2,
+        &a = this->c0, &b = this->c1, &c = this->c2;
+    const my_Fp aA = a*A;
+    const my_Fp bB = b*B;
+    const my_Fp cC = c*C;
+
+    return Fp3_model<n,modulus>(aA + non_residue*((b+c)*(B+C)-bB-cC),
+                                (a+b)*(A+B)-aA-bB+non_residue*cC,
+                                (a+c)*(A+C)-aA+bB-cC);
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp3_model<n,modulus> Fp3_model<n,modulus>::operator-() const
+{
+    return Fp3_model<n,modulus>(-this->c0,
+                                -this->c1,
+                                -this->c2);
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp3_model<n,modulus> Fp3_model<n,modulus>::squared() const
+{
+    /* Devegili OhEig Scott Dahab --- Multiplication and Squaring on Pairing-Friendly Fields.pdf; Section 4 (CH-SQR2) */
+    const my_Fp
+        &a = this->c0, &b = this->c1, &c = this->c2;
+    const my_Fp s0 = a.squared();
+    const my_Fp ab = a*b;
+    const my_Fp s1 = ab + ab;
+    const my_Fp s2 = (a - b + c).squared();
+    const my_Fp bc = b*c;
+    const my_Fp s3 = bc + bc;
+    const my_Fp s4 = c.squared();
+
+    return Fp3_model<n,modulus>(s0 + non_residue * s3,
+                                s1 + non_residue * s4,
+                                s1 + s2 + s3 - s0 - s4);
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp3_model<n,modulus> Fp3_model<n,modulus>::inverse() const
+{
+    const my_Fp
+        &a = this->c0, &b = this->c1, &c = this->c2;
+
+    /* From "High-Speed Software Implementation of the Optimal Ate Pairing over Barreto-Naehrig Curves"; Algorithm 17 */
+    const my_Fp t0 = a.squared();
+    const my_Fp t1 = b.squared();
+    const my_Fp t2 = c.squared();
+    const my_Fp t3 = a*b;
+    const my_Fp t4 = a*c;
+    const my_Fp t5 = b*c;
+    const my_Fp c0 = t0 - non_residue * t5;
+    const my_Fp c1 = non_residue * t2 - t3;
+    const my_Fp c2 = t1 - t4; // typo in paper referenced above. should be "-" as per Scott, but is "*"
+    const my_Fp t6 = (a * c0 + non_residue * (c * c1 + b * c2)).inverse();
+    return Fp3_model<n,modulus>(t6 * c0, t6 * c1, t6 * c2);
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp3_model<n,modulus> Fp3_model<n,modulus>::Frobenius_map(unsigned long power) const
+{
+    return Fp3_model<n,modulus>(c0,
+                                Frobenius_coeffs_c1[power % 3] * c1,
+                                Frobenius_coeffs_c2[power % 3] * c2);
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp3_model<n,modulus> Fp3_model<n,modulus>::sqrt() const
+{
+    Fp3_model<n,modulus> one = Fp3_model<n,modulus>::one();
+
+    size_t v = Fp3_model<n,modulus>::s;
+    Fp3_model<n,modulus> z = Fp3_model<n,modulus>::nqr_to_t;
+    Fp3_model<n,modulus> w = (*this)^Fp3_model<n,modulus>::t_minus_1_over_2;
+    Fp3_model<n,modulus> x = (*this) * w;
+    Fp3_model<n,modulus> b = x * w; // b = (*this)^t
+
+#if DEBUG
+    // check if square with euler's criterion
+    Fp3_model<n,modulus> check = b;
+    for (size_t i = 0; i < v-1; ++i)
+    {
+        check = check.squared();
+    }
+    if (check != one)
+    {
+        assert(0);
+    }
+#endif
+
+    // compute square root with Tonelli--Shanks
+    // (does not terminate if not a square!)
+
+    while (b != one)
+    {
+        size_t m = 0;
+        Fp3_model<n,modulus> b2m = b;
+        while (b2m != one)
+        {
+            /* invariant: b2m = b^(2^m) after entering this loop */
+            b2m = b2m.squared();
+            m += 1;
+        }
+
+        int j = v-m-1;
+        w = z;
+        while (j > 0)
+        {
+            w = w.squared();
+            --j;
+        } // w = z^2^(v-m-1)
+
+        z = w.squared();
+        b = b * z;
+        x = x * w;
+        v = m;
+    }
+
+    return x;
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+template<mp_size_t m>
+Fp3_model<n,modulus> Fp3_model<n,modulus>::operator^(const bigint<m> &pow) const
+{
+    return power<Fp3_model<n, modulus> >(*this, pow);
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+std::ostream& operator<<(std::ostream &out, const Fp3_model<n, modulus> &el)
+{
+    out << el.c0 << OUTPUT_SEPARATOR << el.c1 << OUTPUT_SEPARATOR << el.c2;
+    return out;
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+std::istream& operator>>(std::istream &in, Fp3_model<n, modulus> &el)
+{
+    in >> el.c0 >> el.c1 >> el.c2;
+    return in;
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+std::ostream& operator<<(std::ostream& out, const std::vector<Fp3_model<n, modulus> > &v)
+{
+    out << v.size() << "\n";
+    for (const Fp3_model<n, modulus>& t : v)
+    {
+        out << t << OUTPUT_NEWLINE;
+    }
+
+    return out;
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+std::istream& operator>>(std::istream& in, std::vector<Fp3_model<n, modulus> > &v)
+{
+    v.clear();
+
+    size_t s;
+    in >> s;
+
+    char b;
+    in.read(&b, 1);
+
+    v.reserve(s);
+
+    for (size_t i = 0; i < s; ++i)
+    {
+        Fp3_model<n, modulus> el;
+        in >> el;
+        v.emplace_back(el);
+    }
+
+    return in;
+}
+
+} // libff
+#endif // FP3_TCC_
diff --git a/src/libff/libff/algebra/fields/fp4.hpp b/src/libff/libff/algebra/fields/fp4.hpp
new file mode 100755
index 000000000..a9630436b
--- /dev/null
+++ b/src/libff/libff/algebra/fields/fp4.hpp
@@ -0,0 +1,104 @@
+/** @file
+ *****************************************************************************
+
+ Declaration of interfaces for the (extension) field Fp4.
+
+ The field Fp4 equals Fp2[V]/(V^2-U) where Fp2 = Fp[U]/(U^2-non_residue) and non_residue is in Fp.
+
+ ASSUMPTION: the modulus p is 1 mod 6.
+
+ *****************************************************************************
+ * @author     This file is part of libff, developed by SCIPR Lab
+ *             and contributors (see AUTHORS).
+ * @copyright  MIT license (see LICENSE file)
+ *****************************************************************************/
+
+#ifndef FP4_HPP_
+#define FP4_HPP_
+
+#include <libff/algebra/fields/fp.hpp>
+#include <libff/algebra/fields/fp2.hpp>
+
+namespace libff {
+
+template<mp_size_t n, const bigint<n>& modulus>
+class Fp4_model;
+
+template<mp_size_t n, const bigint<n>& modulus>
+std::ostream& operator<<(std::ostream &, const Fp4_model<n, modulus> &);
+
+template<mp_size_t n, const bigint<n>& modulus>
+std::istream& operator>>(std::istream &, Fp4_model<n, modulus> &);
+
+template<mp_size_t n, const bigint<n>& modulus>
+class Fp4_model {
+public:
+    typedef Fp_model<n, modulus> my_Fp;
+    typedef Fp2_model<n, modulus> my_Fp2;
+    typedef my_Fp2 my_Fpe;
+
+    static my_Fp non_residue;
+    static my_Fp Frobenius_coeffs_c1[4]; // non_residue^((modulus^i-1)/4) for i=0,1,2,3
+
+    my_Fp2 c0, c1;
+    Fp4_model() {};
+    Fp4_model(const my_Fp2& c0, const my_Fp2& c1) : c0(c0), c1(c1) {};
+
+    void print() const { printf("c0/c1:\n"); c0.print(); c1.print(); }
+    void clear() { c0.clear(); c1.clear(); }
+
+    static Fp4_model<n, modulus> zero();
+    static Fp4_model<n, modulus> one();
+    static Fp4_model<n, modulus> random_element();
+
+    bool is_zero() const { return c0.is_zero() && c1.is_zero(); }
+    bool operator==(const Fp4_model &other) const;
+    bool operator!=(const Fp4_model &other) const;
+
+    Fp4_model operator+(const Fp4_model &other) const;
+    Fp4_model operator-(const Fp4_model &other) const;
+    Fp4_model operator*(const Fp4_model &other) const;
+    Fp4_model mul_by_023(const Fp4_model &other) const;
+    Fp4_model operator-() const;
+    Fp4_model squared() const;
+    Fp4_model inverse() const;
+    Fp4_model Frobenius_map(unsigned long power) const;
+    Fp4_model unitary_inverse() const;
+    Fp4_model cyclotomic_squared() const;
+
+    static my_Fp2 mul_by_non_residue(const my_Fp2 &elt);
+
+    template<mp_size_t m>
+    Fp4_model cyclotomic_exp(const bigint<m> &exponent) const;
+
+    static bigint<n> base_field_char() { return modulus; }
+    static constexpr size_t extension_degree() { return 4; }
+
+    friend std::ostream& operator<< <n, modulus>(std::ostream &out, const Fp4_model<n, modulus> &el);
+    friend std::istream& operator>> <n, modulus>(std::istream &in, Fp4_model<n, modulus> &el);
+};
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp4_model<n, modulus> operator*(const Fp_model<n, modulus> &lhs, const Fp4_model<n, modulus> &rhs);
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp4_model<n, modulus> operator*(const Fp2_model<n, modulus> &lhs, const Fp4_model<n, modulus> &rhs);
+
+template<mp_size_t n, const bigint<n>& modulus, mp_size_t m>
+Fp4_model<n, modulus> operator^(const Fp4_model<n, modulus> &self, const bigint<m> &exponent);
+
+template<mp_size_t n, const bigint<n>& modulus, mp_size_t m, const bigint<m>& modulus_p>
+Fp4_model<n, modulus> operator^(const Fp4_model<n, modulus> &self, const Fp_model<m, modulus_p> &exponent);
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp_model<n, modulus> Fp4_model<n, modulus>::non_residue;
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp_model<n, modulus> Fp4_model<n, modulus>::Frobenius_coeffs_c1[4];
+
+
+} // libff
+
+#include <libff/algebra/fields/fp4.tcc>
+
+#endif // FP4_HPP_
diff --git a/src/libff/libff/algebra/fields/fp4.tcc b/src/libff/libff/algebra/fields/fp4.tcc
new file mode 100755
index 000000000..608a58443
--- /dev/null
+++ b/src/libff/libff/algebra/fields/fp4.tcc
@@ -0,0 +1,245 @@
+/** @file
+ *****************************************************************************
+
+ Implementation of interfaces for the (extension) field Fp4.
+
+ See fp4.hpp .
+
+ *****************************************************************************
+ * @author     This file is part of libff, developed by SCIPR Lab
+ *             and contributors (see AUTHORS).
+ * @copyright  MIT license (see LICENSE file)
+ *****************************************************************************/
+
+#ifndef FP4_TCC_
+#define FP4_TCC_
+
+#include <libff/algebra/fields/field_utils.hpp>
+#include <libff/algebra/scalar_multiplication/wnaf.hpp>
+
+namespace libff {
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp2_model<n, modulus> Fp4_model<n, modulus>::mul_by_non_residue(const Fp2_model<n, modulus> &elt)
+{
+    return Fp2_model<n, modulus>(non_residue * elt.c1, elt.c0);
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp4_model<n, modulus> Fp4_model<n, modulus>::zero()
+{
+    return Fp4_model<n,modulus>(my_Fp2::zero(),
+                                my_Fp2::zero());
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp4_model<n, modulus> Fp4_model<n, modulus>::one()
+{
+    return Fp4_model<n,modulus>(my_Fp2::one(),
+                                my_Fp2::zero());
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp4_model<n,modulus> Fp4_model<n,modulus>::random_element()
+{
+    Fp4_model<n, modulus> r;
+    r.c0 = my_Fp2::random_element();
+    r.c1 = my_Fp2::random_element();
+
+    return r;
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+bool Fp4_model<n,modulus>::operator==(const Fp4_model<n,modulus> &other) const
+{
+    return (this->c0 == other.c0 && this->c1 == other.c1);
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+bool Fp4_model<n,modulus>::operator!=(const Fp4_model<n,modulus> &other) const
+{
+    return !(operator==(other));
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp4_model<n,modulus> Fp4_model<n,modulus>::operator+(const Fp4_model<n,modulus> &other) const
+{
+    return Fp4_model<n,modulus>(this->c0 + other.c0,
+                                this->c1 + other.c1);
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp4_model<n,modulus> Fp4_model<n,modulus>::operator-(const Fp4_model<n,modulus> &other) const
+{
+    return Fp4_model<n,modulus>(this->c0 - other.c0,
+                                this->c1 - other.c1);
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp4_model<n, modulus> operator*(const Fp_model<n, modulus> &lhs, const Fp4_model<n, modulus> &rhs)
+{
+    return Fp4_model<n,modulus>(lhs*rhs.c0,
+                                lhs*rhs.c1);
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp4_model<n, modulus> operator*(const Fp2_model<n, modulus> &lhs, const Fp4_model<n, modulus> &rhs)
+{
+    return Fp4_model<n,modulus>(lhs*rhs.c0,
+                                lhs*rhs.c1);
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp4_model<n,modulus> Fp4_model<n,modulus>::operator*(const Fp4_model<n,modulus> &other) const
+{
+    /* Devegili OhEig Scott Dahab --- Multiplication and Squaring on Pairing-Friendly Fields.pdf; Section 3 (Karatsuba) */
+
+    const my_Fp2 &B = other.c1, &A = other.c0,
+        &b = this->c1, &a = this->c0;
+    const my_Fp2 aA = a*A;
+    const my_Fp2 bB = b*B;
+
+    const my_Fp2 beta_bB = Fp4_model<n,modulus>::mul_by_non_residue(bB);
+    return Fp4_model<n,modulus>(aA + beta_bB,
+                                (a+b)*(A+B) - aA  - bB);
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp4_model<n,modulus> Fp4_model<n,modulus>::mul_by_023(const Fp4_model<n,modulus> &other) const
+{
+    /* Devegili OhEig Scott Dahab --- Multiplication and Squaring on Pairing-Friendly Fields.pdf; Section 3 (Karatsuba) */
+    assert(other.c0.c1.is_zero());
+
+    const my_Fp2 &B = other.c1, &A = other.c0,
+        &b = this->c1, &a = this->c0;
+    const my_Fp2 aA = my_Fp2(a.c0 * A.c0, a.c1 * A.c0);
+    const my_Fp2 bB = b*B;
+
+    const my_Fp2 beta_bB = Fp4_model<n,modulus>::mul_by_non_residue(bB);
+    return Fp4_model<n,modulus>(aA + beta_bB,
+                                (a+b)*(A+B) - aA  - bB);
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp4_model<n,modulus> Fp4_model<n,modulus>::operator-() const
+{
+    return Fp4_model<n,modulus>(-this->c0,
+                                -this->c1);
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp4_model<n,modulus> Fp4_model<n,modulus>::squared() const
+{
+    /* Devegili OhEig Scott Dahab --- Multiplication and Squaring on Pairing-Friendly Fields.pdf; Section 3 (Complex) */
+
+    const my_Fp2 &b = this->c1, &a = this->c0;
+    const my_Fp2 ab = a * b;
+
+    return Fp4_model<n,modulus>((a+b)*(a+Fp4_model<n,modulus>::mul_by_non_residue(b))-ab-Fp4_model<n,modulus>::mul_by_non_residue(ab),
+                                ab + ab);
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp4_model<n,modulus> Fp4_model<n,modulus>::inverse() const
+{
+    /* From "High-Speed Software Implementation of the Optimal Ate Pairing over Barreto-Naehrig Curves"; Algorithm 8 */
+    const my_Fp2 &b = this->c1, &a = this->c0;
+    const my_Fp2 t1 = b.squared();
+    const my_Fp2 t0 = a.squared() - Fp4_model<n,modulus>::mul_by_non_residue(t1);
+    const my_Fp2 new_t1 = t0.inverse();
+
+    return Fp4_model<n,modulus>(a * new_t1, - (b * new_t1));
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp4_model<n,modulus> Fp4_model<n,modulus>::Frobenius_map(unsigned long power) const
+{
+    return Fp4_model<n,modulus>(c0.Frobenius_map(power),
+                                Frobenius_coeffs_c1[power % 4] * c1.Frobenius_map(power));
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp4_model<n,modulus> Fp4_model<n,modulus>::unitary_inverse() const
+{
+    return Fp4_model<n,modulus>(this->c0,
+                                -this->c1);
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp4_model<n,modulus> Fp4_model<n,modulus>::cyclotomic_squared() const
+{
+    const my_Fp2 A = this->c1.squared();
+    const my_Fp2 B = this->c1 + this->c0;
+    const my_Fp2 C = B.squared() - A;
+    const my_Fp2 D = Fp4_model<n,modulus>::mul_by_non_residue(A); // Fp2(A.c1 * non_residue, A.c0)
+    const my_Fp2 E = C - D;
+    const my_Fp2 F = D + D + my_Fp2::one();
+    const my_Fp2 G = E - my_Fp2::one();
+
+    return Fp4_model<n,modulus>(F, G);
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+template<mp_size_t m>
+Fp4_model<n, modulus> Fp4_model<n,modulus>::cyclotomic_exp(const bigint<m> &exponent) const
+{
+    Fp4_model<n,modulus> res = Fp4_model<n,modulus>::one();
+    Fp4_model<n,modulus> this_inverse = this->unitary_inverse();
+
+    bool found_nonzero = false;
+    std::vector<long> NAF = find_wnaf(1, exponent);
+
+    for (long i = static_cast<long>(NAF.size() - 1); i >= 0; --i)
+    {
+        if (found_nonzero)
+        {
+            res = res.cyclotomic_squared();
+        }
+
+        if (NAF[i] != 0)
+        {
+            found_nonzero = true;
+
+            if (NAF[i] > 0)
+            {
+                res = res * (*this);
+            }
+            else
+            {
+                res = res * this_inverse;
+            }
+        }
+    }
+
+    return res;
+}
+
+template<mp_size_t n, const bigint<n>& modulus, mp_size_t m>
+Fp4_model<n, modulus> operator^(const Fp4_model<n, modulus> &self, const bigint<m> &exponent)
+{
+    return power<Fp4_model<n, modulus> >(self, exponent);
+}
+
+template<mp_size_t n, const bigint<n>& modulus, mp_size_t m, const bigint<m>& modulus_p>
+Fp4_model<n, modulus> operator^(const Fp4_model<n, modulus> &self, const Fp_model<m, modulus_p> &exponent)
+{
+    return self^(exponent.as_bigint());
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+std::ostream& operator<<(std::ostream &out, const Fp4_model<n, modulus> &el)
+{
+    out << el.c0 << OUTPUT_SEPARATOR << el.c1;
+    return out;
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+std::istream& operator>>(std::istream &in, Fp4_model<n, modulus> &el)
+{
+    in >> el.c0 >> el.c1;
+    return in;
+}
+
+} // libff
+
+#endif // FP4_TCC_
diff --git a/src/libff/libff/algebra/fields/fp6_2over3.hpp b/src/libff/libff/algebra/fields/fp6_2over3.hpp
new file mode 100755
index 000000000..7a2568720
--- /dev/null
+++ b/src/libff/libff/algebra/fields/fp6_2over3.hpp
@@ -0,0 +1,108 @@
+/** @file
+ *****************************************************************************
+ Declaration of arithmetic in the finite field F[(p^3)^2]
+ *****************************************************************************
+ * @author     This file is part of libff, developed by SCIPR Lab
+ *             and contributors (see AUTHORS).
+ * @copyright  MIT license (see LICENSE file)
+ *****************************************************************************/
+
+#ifndef FP6_2OVER3_HPP_
+#define FP6_2OVER3_HPP_
+#include <libff/algebra/fields/fp.hpp>
+#include <libff/algebra/fields/fp2.hpp>
+#include <libff/algebra/fields/fp3.hpp>
+
+namespace libff {
+
+/**
+ * Arithmetic in the finite field F[(p^3)^2].
+ *
+ * Let p := modulus. This interface provides arithmetic for the extension field
+ * Fp6 = Fp3[Y]/(Y^2-X) where Fp3 = Fp[X]/(X^3-non_residue) and non_residue is in Fp.
+ *
+ * ASSUMPTION: p = 1 (mod 6)
+ */
+template<mp_size_t n, const bigint<n>& modulus>
+class Fp6_2over3_model;
+
+template<mp_size_t n, const bigint<n>& modulus>
+std::ostream& operator<<(std::ostream &, const Fp6_2over3_model<n, modulus> &);
+
+template<mp_size_t n, const bigint<n>& modulus>
+std::istream& operator>>(std::istream &, Fp6_2over3_model<n, modulus> &);
+
+template<mp_size_t n, const bigint<n>& modulus>
+class Fp6_2over3_model {
+public:
+    typedef Fp_model<n, modulus> my_Fp;
+    typedef Fp2_model<n, modulus> my_Fp2;
+    typedef Fp3_model<n, modulus> my_Fp3;
+    typedef my_Fp3 my_Fpe;
+
+    static my_Fp non_residue;
+    static my_Fp Frobenius_coeffs_c1[6]; // non_residue^((modulus^i-1)/6)   for i=0,1,2,3,4,5
+
+    my_Fp3 c0, c1;
+    Fp6_2over3_model() {};
+    Fp6_2over3_model(const my_Fp3& c0, const my_Fp3& c1) : c0(c0), c1(c1) {};
+
+    void print() const { printf("c0/c1:\n"); c0.print(); c1.print(); }
+    void clear() { c0.clear(); c1.clear(); }
+
+    static Fp6_2over3_model<n, modulus> zero();
+    static Fp6_2over3_model<n, modulus> one();
+    static Fp6_2over3_model<n, modulus> random_element();
+
+    bool is_zero() const { return c0.is_zero() && c1.is_zero(); }
+    bool operator==(const Fp6_2over3_model &other) const;
+    bool operator!=(const Fp6_2over3_model &other) const;
+
+    Fp6_2over3_model operator+(const Fp6_2over3_model &other) const;
+    Fp6_2over3_model operator-(const Fp6_2over3_model &other) const;
+    Fp6_2over3_model operator*(const Fp6_2over3_model &other) const;
+    Fp6_2over3_model mul_by_2345(const Fp6_2over3_model &other) const;
+    Fp6_2over3_model operator-() const;
+    Fp6_2over3_model squared() const;
+    Fp6_2over3_model inverse() const;
+    Fp6_2over3_model Frobenius_map(unsigned long power) const;
+    Fp6_2over3_model unitary_inverse() const;
+    Fp6_2over3_model cyclotomic_squared() const;
+
+    static my_Fp3 mul_by_non_residue(const my_Fp3 &elem);
+
+    template<mp_size_t m>
+    Fp6_2over3_model cyclotomic_exp(const bigint<m> &exponent) const;
+
+    static bigint<n> base_field_char() { return modulus; }
+    static constexpr size_t extension_degree() { return 6; }
+
+    friend std::ostream& operator<< <n, modulus>(std::ostream &out, const Fp6_2over3_model<n, modulus> &el);
+    friend std::istream& operator>> <n, modulus>(std::istream &in, Fp6_2over3_model<n, modulus> &el);
+};
+
+template<mp_size_t n, const bigint<n>& modulus>
+std::ostream& operator<<(std::ostream& out, const std::vector<Fp6_2over3_model<n, modulus> > &v);
+
+template<mp_size_t n, const bigint<n>& modulus>
+std::istream& operator>>(std::istream& in, std::vector<Fp6_2over3_model<n, modulus> > &v);
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp6_2over3_model<n, modulus> operator*(const Fp_model<n, modulus> &lhs, const Fp6_2over3_model<n, modulus> &rhs);
+
+template<mp_size_t n, const bigint<n>& modulus, mp_size_t m>
+Fp6_2over3_model<n, modulus> operator^(const Fp6_2over3_model<n, modulus> &self, const bigint<m> &exponent);
+
+template<mp_size_t n, const bigint<n>& modulus, mp_size_t m, const bigint<m>& exp_modulus>
+Fp6_2over3_model<n, modulus> operator^(const Fp6_2over3_model<n, modulus> &self, const Fp_model<m, exp_modulus> &exponent);
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp_model<n, modulus> Fp6_2over3_model<n, modulus>::non_residue;
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp_model<n, modulus> Fp6_2over3_model<n, modulus>::Frobenius_coeffs_c1[6];
+
+} // libff
+#include <libff/algebra/fields/fp6_2over3.tcc>
+
+#endif // FP6_2OVER3_HPP_
diff --git a/src/libff/libff/algebra/fields/fp6_2over3.tcc b/src/libff/libff/algebra/fields/fp6_2over3.tcc
new file mode 100755
index 000000000..0b671d9d4
--- /dev/null
+++ b/src/libff/libff/algebra/fields/fp6_2over3.tcc
@@ -0,0 +1,274 @@
+/** @file
+ *****************************************************************************
+ Implementation of arithmetic in the finite field F[(p^3)^2].
+ *****************************************************************************
+ * @author     This file is part of libff, developed by SCIPR Lab
+ *             and contributors (see AUTHORS).
+ * @copyright  MIT license (see LICENSE file)
+ *****************************************************************************/
+
+#ifndef FP6_2OVER3_TCC_
+#define FP6_2OVER3_TCC_
+#include <libff/algebra/fields/field_utils.hpp>
+#include <libff/algebra/scalar_multiplication/wnaf.hpp>
+
+namespace libff {
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp3_model<n,modulus> Fp6_2over3_model<n, modulus>::mul_by_non_residue(const Fp3_model<n,modulus> &elem)
+{
+    return Fp3_model<n, modulus>(non_residue * elem.c2, elem.c0, elem.c1);
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp6_2over3_model<n, modulus> Fp6_2over3_model<n, modulus>::zero()
+{
+    return Fp6_2over3_model<n,modulus>(my_Fp3::zero(),
+                                my_Fp3::zero());
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp6_2over3_model<n, modulus> Fp6_2over3_model<n, modulus>::one()
+{
+    return Fp6_2over3_model<n,modulus>(my_Fp3::one(),
+                                my_Fp3::zero());
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp6_2over3_model<n,modulus> Fp6_2over3_model<n,modulus>::random_element()
+{
+    Fp6_2over3_model<n, modulus> r;
+    r.c0 = my_Fp3::random_element();
+    r.c1 = my_Fp3::random_element();
+
+    return r;
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+bool Fp6_2over3_model<n,modulus>::operator==(const Fp6_2over3_model<n,modulus> &other) const
+{
+    return (this->c0 == other.c0 && this->c1 == other.c1);
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+bool Fp6_2over3_model<n,modulus>::operator!=(const Fp6_2over3_model<n,modulus> &other) const
+{
+    return !(operator==(other));
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp6_2over3_model<n,modulus> Fp6_2over3_model<n,modulus>::operator+(const Fp6_2over3_model<n,modulus> &other) const
+{
+    return Fp6_2over3_model<n,modulus>(this->c0 + other.c0,
+                                this->c1 + other.c1);
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp6_2over3_model<n,modulus> Fp6_2over3_model<n,modulus>::operator-(const Fp6_2over3_model<n,modulus> &other) const
+{
+    return Fp6_2over3_model<n,modulus>(this->c0 - other.c0,
+                                this->c1 - other.c1);
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp6_2over3_model<n, modulus> operator*(const Fp_model<n, modulus> &lhs, const Fp6_2over3_model<n, modulus> &rhs)
+{
+    return Fp6_2over3_model<n,modulus>(lhs*rhs.c0,
+                                lhs*rhs.c1);
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp6_2over3_model<n,modulus> Fp6_2over3_model<n,modulus>::operator*(const Fp6_2over3_model<n,modulus> &other) const
+{
+    /* Devegili OhEig Scott Dahab --- Multiplication and Squaring on Pairing-Friendly Fields.pdf; Section 3 (Karatsuba) */
+
+    const my_Fp3 &B = other.c1, &A = other.c0,
+                 &b = this->c1, &a = this->c0;
+    const my_Fp3 aA = a*A;
+    const my_Fp3 bB = b*B;
+    const my_Fp3 beta_bB = Fp6_2over3_model<n,modulus>::mul_by_non_residue(bB);
+
+    return Fp6_2over3_model<n,modulus>(aA + beta_bB,
+                                       (a+b)*(A+B) - aA  - bB);
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp6_2over3_model<n,modulus> Fp6_2over3_model<n,modulus>::mul_by_2345(const Fp6_2over3_model<n,modulus> &other) const
+{
+    /* Devegili OhEig Scott Dahab --- Multiplication and Squaring on Pairing-Friendly Fields.pdf; Section 3 (Karatsuba) */
+    assert(other.c0.c0.is_zero());
+    assert(other.c0.c1.is_zero());
+
+    const my_Fp3 &B = other.c1, &A = other.c0,
+                 &b = this->c1, &a = this->c0;
+    const my_Fp3 aA = my_Fp3(a.c1 * A.c2 * non_residue, a.c2 * A.c2 * non_residue, a.c0 * A.c2);
+    const my_Fp3 bB = b*B;
+    const my_Fp3 beta_bB = Fp6_2over3_model<n,modulus>::mul_by_non_residue(bB);
+
+    return Fp6_2over3_model<n,modulus>(aA + beta_bB,
+                                       (a+b)*(A+B) - aA  - bB);
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp6_2over3_model<n,modulus> Fp6_2over3_model<n,modulus>::operator-() const
+{
+    return Fp6_2over3_model<n,modulus>(-this->c0,
+                                -this->c1);
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp6_2over3_model<n,modulus> Fp6_2over3_model<n,modulus>::squared() const
+{
+    /* Devegili OhEig Scott Dahab --- Multiplication and Squaring on Pairing-Friendly Fields.pdf; Section 3 (Complex) */
+    const my_Fp3 &b = this->c1, &a = this->c0;
+    const my_Fp3 ab = a * b;
+
+    return Fp6_2over3_model<n,modulus>((a+b)*(a+Fp6_2over3_model<n,modulus>::mul_by_non_residue(b))-ab-Fp6_2over3_model<n,modulus>::mul_by_non_residue(ab),
+                                ab + ab);
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp6_2over3_model<n,modulus> Fp6_2over3_model<n,modulus>::inverse() const
+{
+    /* From "High-Speed Software Implementation of the Optimal Ate Pairing over Barreto-Naehrig Curves"; Algorithm 8 */
+
+    const my_Fp3 &b = this->c1, &a = this->c0;
+    const my_Fp3 t1 = b.squared();
+    const my_Fp3 t0 = a.squared() - Fp6_2over3_model<n,modulus>::mul_by_non_residue(t1);
+    const my_Fp3 new_t1 = t0.inverse();
+
+    return Fp6_2over3_model<n,modulus>(a * new_t1,
+                                       - (b * new_t1));
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp6_2over3_model<n,modulus> Fp6_2over3_model<n,modulus>::Frobenius_map(unsigned long power) const
+{
+    return Fp6_2over3_model<n,modulus>(c0.Frobenius_map(power),
+                                       Frobenius_coeffs_c1[power % 6] * c1.Frobenius_map(power));
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp6_2over3_model<n,modulus> Fp6_2over3_model<n,modulus>::unitary_inverse() const
+{
+    return Fp6_2over3_model<n,modulus>(this->c0,
+                                -this->c1);
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp6_2over3_model<n,modulus> Fp6_2over3_model<n,modulus>::cyclotomic_squared() const
+{
+    my_Fp2 a = my_Fp2(c0.c0, c1.c1);
+    //my_Fp a_a = c0.c0; // a = Fp2([c0[0],c1[1]])
+    //my_Fp a_b = c1.c1;
+
+    my_Fp2 b = my_Fp2(c1.c0, c0.c2);
+    //my_Fp b_a = c1.c0; // b = Fp2([c1[0],c0[2]])
+    //my_Fp b_b = c0.c2;
+
+    my_Fp2 c = my_Fp2(c0.c1, c1.c2);
+    //my_Fp c_a = c0.c1; // c = Fp2([c0[1],c1[2]])
+    //my_Fp c_b = c1.c2;
+
+    my_Fp2 asq = a.squared();
+    my_Fp2 bsq = b.squared();
+    my_Fp2 csq = c.squared();
+
+    // A = vector(3*a^2 - 2*Fp2([vector(a)[0],-vector(a)[1]]))
+    //my_Fp A_a = my_Fp(3l) * asq_a - my_Fp(2l) * a_a;
+    my_Fp A_a = asq.c0 - a.c0;
+    A_a = A_a + A_a + asq.c0;
+    //my_Fp A_b = my_Fp(3l) * asq_b + my_Fp(2l) * a_b;
+    my_Fp A_b = asq.c1 + a.c1;
+    A_b = A_b + A_b + asq.c1;
+
+    // B = vector(3*Fp2([non_residue*c2[1],c2[0]]) + 2*Fp2([vector(b)[0],-vector(b)[1]]))
+    //my_Fp B_a = my_Fp(3l) * my_Fp3::non_residue * csq_b + my_Fp(2l) * b_a;
+    my_Fp B_tmp = my_Fp3::non_residue * csq.c1;
+    my_Fp B_a = B_tmp + b.c0;
+    B_a = B_a + B_a + B_tmp;
+
+    //my_Fp B_b = my_Fp(3l) * csq_a - my_Fp(2l) * b_b;
+    my_Fp B_b = csq.c0 - b.c1;
+    B_b = B_b + B_b + csq.c0;
+
+    // C = vector(3*b^2 - 2*Fp2([vector(c)[0],-vector(c)[1]]))
+    //my_Fp C_a = my_Fp(3l) * bsq_a - my_Fp(2l) * c_a;
+    my_Fp C_a = bsq.c0 - c.c0;
+    C_a = C_a + C_a + bsq.c0;
+    // my_Fp C_b = my_Fp(3l) * bsq_b + my_Fp(2l) * c_b;
+    my_Fp C_b = bsq.c1 + c.c1;
+    C_b = C_b + C_b + bsq.c1;
+
+    // e0 = Fp3([A[0],C[0],B[1]])
+    // e1 = Fp3([B[0],A[1],C[1]])
+    // fin = Fp6e([e0,e1])
+    // return fin
+
+    return Fp6_2over3_model<n, modulus>(my_Fp3(A_a, C_a, B_b),
+                                        my_Fp3(B_a, A_b, C_b));
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+template<mp_size_t m>
+Fp6_2over3_model<n, modulus> Fp6_2over3_model<n,modulus>::cyclotomic_exp(const bigint<m> &exponent) const
+{
+    Fp6_2over3_model<n,modulus> res = Fp6_2over3_model<n,modulus>::one();
+    Fp6_2over3_model<n,modulus> this_inverse = this->unitary_inverse();
+
+    bool found_nonzero = false;
+    std::vector<long> NAF = find_wnaf(1, exponent);
+
+    for (long i = static_cast<long>(NAF.size() - 1); i >= 0; --i)
+    {
+        if (found_nonzero)
+        {
+            res = res.cyclotomic_squared();
+        }
+
+        if (NAF[i] != 0)
+        {
+            found_nonzero = true;
+
+            if (NAF[i] > 0)
+            {
+                res = res * (*this);
+            }
+            else
+            {
+                res = res * this_inverse;
+            }
+        }
+    }
+
+    return res;
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+std::ostream& operator<<(std::ostream &out, const Fp6_2over3_model<n, modulus> &el)
+{
+    out << el.c0 << OUTPUT_SEPARATOR << el.c1;
+    return out;
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+std::istream& operator>>(std::istream &in, Fp6_2over3_model<n, modulus> &el)
+{
+    in >> el.c0 >> el.c1;
+    return in;
+}
+
+template<mp_size_t n, const bigint<n>& modulus, mp_size_t m>
+Fp6_2over3_model<n, modulus> operator^(const Fp6_2over3_model<n, modulus> &self, const bigint<m> &exponent)
+{
+    return power<Fp6_2over3_model<n, modulus>, m>(self, exponent);
+}
+
+template<mp_size_t n, const bigint<n>& modulus, mp_size_t m, const bigint<m>& exp_modulus>
+Fp6_2over3_model<n, modulus> operator^(const Fp6_2over3_model<n, modulus> &self, const Fp_model<m, exp_modulus> &exponent)
+{
+    return self^(exponent.as_bigint());
+}
+
+} // libff
+#endif // FP6_2OVER3_TCC_
diff --git a/src/libff/libff/algebra/fields/fp6_3over2.hpp b/src/libff/libff/algebra/fields/fp6_3over2.hpp
new file mode 100755
index 000000000..816ce85fe
--- /dev/null
+++ b/src/libff/libff/algebra/fields/fp6_3over2.hpp
@@ -0,0 +1,105 @@
+/** @file
+ *****************************************************************************
+ Declaration of arithmetic in the finite field F[(p^2)^3]
+ *****************************************************************************
+ * @author     This file is part of libff, developed by SCIPR Lab
+ *             and contributors (see AUTHORS).
+ * @copyright  MIT license (see LICENSE file)
+ *****************************************************************************/
+
+#ifndef FP6_3OVER2_HPP_
+#define FP6_3OVER2_HPP_
+#include <vector>
+
+#include <libff/algebra/fields/fp.hpp>
+#include <libff/algebra/fields/fp2.hpp>
+
+namespace libff {
+
+template<mp_size_t n, const bigint<n>& modulus>
+class Fp6_3over2_model;
+
+template<mp_size_t n, const bigint<n>& modulus>
+std::ostream& operator<<(std::ostream &, const Fp6_3over2_model<n, modulus> &);
+
+template<mp_size_t n, const bigint<n>& modulus>
+std::istream& operator>>(std::istream &, Fp6_3over2_model<n, modulus> &);
+
+/**
+ * Arithmetic in the finite field F[(p^2)^3].
+ *
+ * Let p := modulus. This interface provides arithmetic for the extension field
+ *  Fp6 = Fp2[V]/(V^3-non_residue) where non_residue is in Fp.
+ *
+ * ASSUMPTION: p = 1 (mod 6)
+ */
+template<mp_size_t n, const bigint<n>& modulus>
+class Fp6_3over2_model {
+public:
+    typedef Fp_model<n, modulus> my_Fp;
+    typedef Fp2_model<n, modulus> my_Fp2;
+
+    static my_Fp2 non_residue;
+    static my_Fp2 Frobenius_coeffs_c1[6]; // non_residue^((modulus^i-1)/3)   for i=0,1,2,3,4,5
+    static my_Fp2 Frobenius_coeffs_c2[6]; // non_residue^((2*modulus^i-2)/3) for i=0,1,2,3,4,5
+
+    my_Fp2 c0, c1, c2;
+    Fp6_3over2_model() {};
+    Fp6_3over2_model(const my_Fp2& c0, const my_Fp2& c1, const my_Fp2& c2) : c0(c0), c1(c1), c2(c2) {};
+
+    void clear() { c0.clear(); c1.clear(); c2.clear(); }
+    void print() const { printf("c0/c1/c2:\n"); c0.print(); c1.print(); c2.print(); }
+
+    static Fp6_3over2_model<n, modulus> zero();
+    static Fp6_3over2_model<n, modulus> one();
+    static Fp6_3over2_model<n, modulus> random_element();
+
+    bool is_zero() const { return c0.is_zero() && c1.is_zero() && c2.is_zero(); }
+    bool operator==(const Fp6_3over2_model &other) const;
+    bool operator!=(const Fp6_3over2_model &other) const;
+
+    Fp6_3over2_model operator+(const Fp6_3over2_model &other) const;
+    Fp6_3over2_model operator-(const Fp6_3over2_model &other) const;
+    Fp6_3over2_model operator*(const Fp6_3over2_model &other) const;
+    Fp6_3over2_model operator-() const;
+    Fp6_3over2_model squared() const;
+    Fp6_3over2_model inverse() const;
+    Fp6_3over2_model Frobenius_map(unsigned long power) const;
+
+    static my_Fp2 mul_by_non_residue(const my_Fp2 &elt);
+
+    template<mp_size_t m>
+    Fp6_3over2_model operator^(const bigint<m> &other) const;
+
+    static bigint<n> base_field_char() { return modulus; }
+    static size_t extension_degree() { return 6; }
+
+    friend std::ostream& operator<< <n, modulus>(std::ostream &out, const Fp6_3over2_model<n, modulus> &el);
+    friend std::istream& operator>> <n, modulus>(std::istream &in, Fp6_3over2_model<n, modulus> &el);
+};
+
+template<mp_size_t n, const bigint<n>& modulus>
+std::ostream& operator<<(std::ostream& out, const std::vector<Fp6_3over2_model<n, modulus> > &v);
+
+template<mp_size_t n, const bigint<n>& modulus>
+std::istream& operator>>(std::istream& in, std::vector<Fp6_3over2_model<n, modulus> > &v);
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp6_3over2_model<n, modulus> operator*(const Fp_model<n, modulus> &lhs, const Fp6_3over2_model<n, modulus> &rhs);
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp6_3over2_model<n, modulus> operator*(const Fp2_model<n, modulus> &lhs, const Fp6_3over2_model<n, modulus> &rhs);
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp2_model<n, modulus> Fp6_3over2_model<n, modulus>::non_residue;
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp2_model<n, modulus> Fp6_3over2_model<n, modulus>::Frobenius_coeffs_c1[6];
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp2_model<n, modulus> Fp6_3over2_model<n, modulus>::Frobenius_coeffs_c2[6];
+
+} // libff
+#include <libff/algebra/fields/fp6_3over2.tcc>
+
+#endif // FP6_3OVER2_HPP_
diff --git a/src/libff/libff/algebra/fields/fp6_3over2.tcc b/src/libff/libff/algebra/fields/fp6_3over2.tcc
new file mode 100755
index 000000000..de3056787
--- /dev/null
+++ b/src/libff/libff/algebra/fields/fp6_3over2.tcc
@@ -0,0 +1,216 @@
+/** @file
+ *****************************************************************************
+ Implementation of arithmetic in the finite field F[(p^2)^3].
+ *****************************************************************************
+ * @author     This file is part of libff, developed by SCIPR Lab
+ *             and contributors (see AUTHORS).
+ * @copyright  MIT license (see LICENSE file)
+ *****************************************************************************/
+
+#ifndef FP6_3OVER2_TCC_
+#define FP6_3OVER2_TCC_
+#include <libff/algebra/fields/field_utils.hpp>
+
+namespace libff {
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp2_model<n, modulus> Fp6_3over2_model<n,modulus>::mul_by_non_residue(const Fp2_model<n, modulus> &elt)
+{
+    return Fp2_model<n, modulus>(non_residue * elt);
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp6_3over2_model<n,modulus> Fp6_3over2_model<n,modulus>::zero()
+{
+    return Fp6_3over2_model<n, modulus>(my_Fp2::zero(), my_Fp2::zero(), my_Fp2::zero());
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp6_3over2_model<n,modulus> Fp6_3over2_model<n,modulus>::one()
+{
+    return Fp6_3over2_model<n, modulus>(my_Fp2::one(), my_Fp2::zero(), my_Fp2::zero());
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp6_3over2_model<n,modulus> Fp6_3over2_model<n,modulus>::random_element()
+{
+    Fp6_3over2_model<n, modulus> r;
+    r.c0 = my_Fp2::random_element();
+    r.c1 = my_Fp2::random_element();
+    r.c2 = my_Fp2::random_element();
+
+    return r;
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+bool Fp6_3over2_model<n,modulus>::operator==(const Fp6_3over2_model<n,modulus> &other) const
+{
+    return (this->c0 == other.c0 && this->c1 == other.c1 && this->c2 == other.c2);
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+bool Fp6_3over2_model<n,modulus>::operator!=(const Fp6_3over2_model<n,modulus> &other) const
+{
+    return !(operator==(other));
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp6_3over2_model<n,modulus> Fp6_3over2_model<n,modulus>::operator+(const Fp6_3over2_model<n,modulus> &other) const
+{
+    return Fp6_3over2_model<n,modulus>(this->c0 + other.c0,
+                                       this->c1 + other.c1,
+                                       this->c2 + other.c2);
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp6_3over2_model<n,modulus> Fp6_3over2_model<n,modulus>::operator-(const Fp6_3over2_model<n,modulus> &other) const
+{
+    return Fp6_3over2_model<n,modulus>(this->c0 - other.c0,
+                                       this->c1 - other.c1,
+                                       this->c2 - other.c2);
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp6_3over2_model<n, modulus> operator*(const Fp_model<n, modulus> &lhs, const Fp6_3over2_model<n, modulus> &rhs)
+{
+    return Fp6_3over2_model<n,modulus>(lhs*rhs.c0,
+                                       lhs*rhs.c1,
+                                       lhs*rhs.c2);
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp6_3over2_model<n, modulus> operator*(const Fp2_model<n, modulus> &lhs, const Fp6_3over2_model<n, modulus> &rhs)
+{
+    return Fp6_3over2_model<n,modulus>(lhs*rhs.c0,
+                                       lhs*rhs.c1,
+                                       lhs*rhs.c2);
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp6_3over2_model<n,modulus> Fp6_3over2_model<n,modulus>::operator*(const Fp6_3over2_model<n,modulus> &other) const
+{
+    /* Devegili OhEig Scott Dahab --- Multiplication and Squaring on Pairing-Friendly Fields.pdf; Section 4 (Karatsuba) */
+
+    const my_Fp2 &A = other.c0, &B = other.c1, &C = other.c2,
+                 &a = this->c0, &b = this->c1, &c = this->c2;
+    const my_Fp2 aA = a*A;
+    const my_Fp2 bB = b*B;
+    const my_Fp2 cC = c*C;
+
+    return Fp6_3over2_model<n,modulus>(aA + Fp6_3over2_model<n,modulus>::mul_by_non_residue((b+c)*(B+C)-bB-cC),
+                                       (a+b)*(A+B)-aA-bB+Fp6_3over2_model<n,modulus>::mul_by_non_residue(cC),
+                                       (a+c)*(A+C)-aA+bB-cC);
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp6_3over2_model<n,modulus> Fp6_3over2_model<n,modulus>::operator-() const
+{
+    return Fp6_3over2_model<n,modulus>(-this->c0,
+                                       -this->c1,
+                                       -this->c2);
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp6_3over2_model<n,modulus> Fp6_3over2_model<n,modulus>::squared() const
+{
+    /* Devegili OhEig Scott Dahab --- Multiplication and Squaring on Pairing-Friendly Fields.pdf; Section 4 (CH-SQR2) */
+
+    const my_Fp2 &a = this->c0, &b = this->c1, &c = this->c2;
+    const my_Fp2 s0 = a.squared();
+    const my_Fp2 ab = a*b;
+    const my_Fp2 s1 = ab + ab;
+    const my_Fp2 s2 = (a - b + c).squared();
+    const my_Fp2 bc = b*c;
+    const my_Fp2 s3 = bc + bc;
+    const my_Fp2 s4 = c.squared();
+
+    return Fp6_3over2_model<n,modulus>(s0 + Fp6_3over2_model<n,modulus>::mul_by_non_residue(s3),
+                                       s1 + Fp6_3over2_model<n,modulus>::mul_by_non_residue(s4),
+                                       s1 + s2 + s3 - s0 - s4);
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp6_3over2_model<n,modulus> Fp6_3over2_model<n,modulus>::inverse() const
+{
+    /* From "High-Speed Software Implementation of the Optimal Ate Pairing over Barreto-Naehrig Curves"; Algorithm 17 */
+
+    const my_Fp2 &a = this->c0, &b = this->c1, &c = this->c2;
+    const my_Fp2 t0 = a.squared();
+    const my_Fp2 t1 = b.squared();
+    const my_Fp2 t2 = c.squared();
+    const my_Fp2 t3 = a*b;
+    const my_Fp2 t4 = a*c;
+    const my_Fp2 t5 = b*c;
+    const my_Fp2 c0 = t0 - Fp6_3over2_model<n,modulus>::mul_by_non_residue(t5);
+    const my_Fp2 c1 = Fp6_3over2_model<n,modulus>::mul_by_non_residue(t2) - t3;
+    const my_Fp2 c2 = t1 - t4; // typo in paper referenced above. should be "-" as per Scott, but is "*"
+    const my_Fp2 t6 = (a * c0 + Fp6_3over2_model<n,modulus>::mul_by_non_residue((c * c1 + b * c2))).inverse();
+    return Fp6_3over2_model<n,modulus>(t6 * c0, t6 * c1, t6 * c2);
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+Fp6_3over2_model<n,modulus> Fp6_3over2_model<n,modulus>::Frobenius_map(unsigned long power) const
+{
+    return Fp6_3over2_model<n,modulus>(c0.Frobenius_map(power),
+                                       Frobenius_coeffs_c1[power % 6] * c1.Frobenius_map(power),
+                                       Frobenius_coeffs_c2[power % 6] * c2.Frobenius_map(power));
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+template<mp_size_t m>
+Fp6_3over2_model<n,modulus> Fp6_3over2_model<n,modulus>::operator^(const bigint<m> &pow) const
+{
+    return power<Fp6_3over2_model<n, modulus>, m>(*this, pow);
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+std::ostream& operator<<(std::ostream &out, const Fp6_3over2_model<n, modulus> &el)
+{
+    out << el.c0 << OUTPUT_SEPARATOR << el.c1 << OUTPUT_SEPARATOR << el.c2;
+    return out;
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+std::istream& operator>>(std::istream &in, Fp6_3over2_model<n, modulus> &el)
+{
+    in >> el.c0 >> el.c1 >> el.c2;
+    return in;
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+std::ostream& operator<<(std::ostream& out, const std::vector<Fp6_3over2_model<n, modulus> > &v)
+{
+    out << v.size() << "\n";
+    for (const Fp6_3over2_model<n, modulus>& t : v)
+    {
+        out << t << OUTPUT_NEWLINE;
+    }
+
+    return out;
+}
+
+template<mp_size_t n, const bigint<n>& modulus>
+std::istream& operator>>(std::istream& in, std::vector<Fp6_3over2_model<n, modulus> > &v)
+{
+    v.clear();
+
+    size_t s;
+    in >> s;
+
+    char b;
+    in.read(&b, 1);
+
+    v.reserve(s);
+
+    for (size_t i = 0; i < s; ++i)
+    {
+        Fp6_3over2_model<n, modulus> el;
+        in >> el;
+        v.emplace_back(el);
+    }
+
+    return in;
+}
+
+} // libff
+#endif // FP6_3_OVER_2_TCC_
diff --git a/src/libff/libff/algebra/fields/fp_aux.tcc b/src/libff/libff/algebra/fields/fp_aux.tcc
new file mode 100755
index 000000000..c577ee25e
--- /dev/null
+++ b/src/libff/libff/algebra/fields/fp_aux.tcc
@@ -0,0 +1,389 @@
+/** @file
+ *****************************************************************************
+ Assembly code snippets for F[p] finite field arithmetic, used by fp.tcc .
+ Specific to x86-64, and used only if USE_ASM is defined.
+ On other architectures or without USE_ASM, fp.tcc uses a portable
+ C++ implementation instead.
+ *****************************************************************************
+ * @author     This file is part of libff, developed by SCIPR Lab
+ *             and contributors (see AUTHORS).
+ * @copyright  MIT license (see LICENSE file)
+ *****************************************************************************/
+
+#ifndef FP_AUX_TCC_
+#define FP_AUX_TCC_
+
+namespace libff {
+
+#define STR_HELPER(x) #x
+#define STR(x) STR_HELPER(x)
+
+/* addq is faster than adcq, even if preceded by clc */
+#define ADD_FIRSTADD                            \
+    "movq    (%[B]), %%rax           \n\t"      \
+    "addq    %%rax, (%[A])           \n\t"
+
+#define ADD_NEXTADD(ofs)                                \
+    "movq    " STR(ofs) "(%[B]), %%rax          \n\t"   \
+    "adcq    %%rax, " STR(ofs) "(%[A])          \n\t"
+
+#define ADD_CMP(ofs)                                  \
+    "movq    " STR(ofs) "(%[mod]), %%rax   \n\t"      \
+    "cmpq    %%rax, " STR(ofs) "(%[A])     \n\t"      \
+    "jb      done%=              \n\t"                \
+    "ja      subtract%=          \n\t"
+
+#define ADD_FIRSTSUB                            \
+    "movq    (%[mod]), %%rax     \n\t"          \
+    "subq    %%rax, (%[A])       \n\t"
+
+#define ADD_FIRSTSUB                            \
+    "movq    (%[mod]), %%rax     \n\t"          \
+    "subq    %%rax, (%[A])       \n\t"
+
+#define ADD_NEXTSUB(ofs)                                \
+    "movq    " STR(ofs) "(%[mod]), %%rax    \n\t"       \
+    "sbbq    %%rax, " STR(ofs) "(%[A])      \n\t"
+
+#define SUB_FIRSTSUB                            \
+    "movq    (%[B]), %%rax\n\t"                 \
+    "subq    %%rax, (%[A])\n\t"
+
+#define SUB_NEXTSUB(ofs)                        \
+    "movq    " STR(ofs) "(%[B]), %%rax\n\t"     \
+    "sbbq    %%rax, " STR(ofs) "(%[A])\n\t"
+
+#define SUB_FIRSTADD                            \
+    "movq    (%[mod]), %%rax\n\t"               \
+    "addq    %%rax, (%[A])\n\t"
+
+#define SUB_NEXTADD(ofs)                        \
+    "movq    " STR(ofs) "(%[mod]), %%rax\n\t"   \
+    "adcq    %%rax, " STR(ofs) "(%[A])\n\t"
+
+#define MONT_CMP(ofs)                                 \
+    "movq    " STR(ofs) "(%[M]), %%rax   \n\t"        \
+    "cmpq    %%rax, " STR(ofs) "(%[tmp])   \n\t"      \
+    "jb      done%=              \n\t"                \
+    "ja      subtract%=          \n\t"
+
+#define MONT_FIRSTSUB                           \
+    "movq    (%[M]), %%rax     \n\t"            \
+    "subq    %%rax, (%[tmp])     \n\t"
+
+#define MONT_NEXTSUB(ofs)                               \
+    "movq    " STR(ofs) "(%[M]), %%rax    \n\t"         \
+    "sbbq    %%rax, " STR(ofs) "(%[tmp])   \n\t"
+
+/*
+  The x86-64 Montgomery multiplication here is similar
+  to Algorithm 2 (CIOS method) in http://eprint.iacr.org/2012/140.pdf
+  and the PowerPC pseudocode of gmp-ecm library (c) Paul Zimmermann and Alexander Kruppa
+  (see comments on top of powerpc64/mulredc.m4).
+*/
+
+#define MONT_PRECOMPUTE                                                 \
+    "xorq    %[cy], %[cy]            \n\t"                              \
+    "movq    0(%[A]), %%rax          \n\t"                              \
+    "mulq    0(%[B])                 \n\t"                              \
+    "movq    %%rax, %[T0]            \n\t"                              \
+    "movq    %%rdx, %[T1]            # T1:T0 <- A[0] * B[0] \n\t"       \
+    "mulq    %[inv]                  \n\t"                              \
+    "movq    %%rax, %[u]             # u <- T0 * inv \n\t"              \
+    "mulq    0(%[M])                 \n\t"                              \
+    "addq    %[T0], %%rax            \n\t"                              \
+    "adcq    %%rdx, %[T1]            \n\t"                              \
+    "adcq    $0, %[cy]               # cy:T1 <- (M[0]*u + T1 * b + T0) / b\n\t"
+
+#define MONT_FIRSTITER(j)                                               \
+    "xorq    %[T0], %[T0]            \n\t"                              \
+    "movq    0(%[A]), %%rax          \n\t"                              \
+    "mulq    " STR((j*8)) "(%[B])                 \n\t"                 \
+    "addq    %[T1], %%rax            \n\t"                              \
+    "movq    %%rax, " STR(((j-1)*8)) "(%[tmp])        \n\t"             \
+    "adcq    $0, %%rdx               \n\t"                              \
+    "movq    %%rdx, %[T1]            # now T1:tmp[j-1] <-- X[0] * Y[j] + T1\n\t" \
+    "movq    " STR((j*8)) "(%[M]), %%rax          \n\t"                 \
+    "mulq    %[u]                    \n\t"                              \
+    "addq    %%rax, " STR(((j-1)*8)) "(%[tmp])        \n\t"             \
+    "adcq    %[cy], %%rdx            \n\t"                              \
+    "adcq    $0, %[T0]               \n\t"                              \
+    "xorq    %[cy], %[cy]            \n\t"                              \
+    "addq    %%rdx, %[T1]            \n\t"                              \
+    "adcq    %[T0], %[cy]            # cy:T1:tmp[j-1] <---- (X[0] * Y[j] + T1) + (M[j] * u + cy * b) \n\t"
+
+#define MONT_ITERFIRST(i)                            \
+    "xorq    %[cy], %[cy]            \n\t"              \
+    "movq    " STR((i*8)) "(%[A]), %%rax          \n\t" \
+    "mulq    0(%[B])                 \n\t"              \
+    "addq    0(%[tmp]), %%rax        \n\t"              \
+    "adcq    8(%[tmp]), %%rdx        \n\t"              \
+    "adcq    $0, %[cy]               \n\t"              \
+    "movq    %%rax, %[T0]            \n\t"                              \
+    "movq    %%rdx, %[T1]            # cy:T1:T0 <- A[i] * B[0] + tmp[1] * b + tmp[0]\n\t" \
+    "mulq    %[inv]                  \n\t"                              \
+    "movq    %%rax, %[u]             # u <- T0 * inv\n\t"               \
+    "mulq    0(%[M])                 \n\t"                              \
+    "addq    %[T0], %%rax            \n\t"                              \
+    "adcq    %%rdx, %[T1]            \n\t"                              \
+    "adcq    $0, %[cy]               # cy:T1 <- (M[0]*u + cy * b * b + T1 * b + T0) / b\n\t"
+
+#define MONT_ITERITER(i, j)                                             \
+    "xorq    %[T0], %[T0]            \n\t"                              \
+    "movq    " STR((i*8)) "(%[A]), %%rax          \n\t"                 \
+    "mulq    " STR((j*8)) "(%[B])                 \n\t"                 \
+    "addq    %[T1], %%rax            \n\t"                              \
+    "movq    %%rax, " STR(((j-1)*8)) "(%[tmp])        \n\t"                              \
+    "adcq    $0, %%rdx               \n\t"                              \
+    "movq    %%rdx, %[T1]            # now T1:tmp[j-1] <-- X[i] * Y[j] + T1 \n\t" \
+    "movq    " STR((j*8)) "(%[M]), %%rax          \n\t"                 \
+    "mulq    %[u]                    \n\t"                              \
+    "addq    %%rax, " STR(((j-1)*8)) "(%[tmp])        \n\t"             \
+    "adcq    %[cy], %%rdx            \n\t"                              \
+    "adcq    $0, %[T0]               \n\t"                              \
+    "xorq    %[cy], %[cy]            \n\t"                              \
+    "addq    %%rdx, %[T1]            \n\t"                              \
+    "adcq    %[T0], %[cy]            # cy:T1:tmp[j-1] <-- (X[i] * Y[j] + T1) + M[j] * u + cy * b \n\t" \
+    "addq    " STR(((j+1)*8)) "(%[tmp]), %[T1]       \n\t" \
+    "adcq    $0, %[cy]               # cy:T1:tmp[j-1] <-- (X[i] * Y[j] + T1) + M[j] * u + (tmp[j+1] + cy) * b \n\t"
+
+#define MONT_FINALIZE(j)                  \
+    "movq    %[T1], " STR((j*8)) "(%[tmp])       \n\t"          \
+    "movq    %[cy], " STR(((j+1)*8)) "(%[tmp])       \n\t"
+
+/*
+  Comba multiplication and squaring routines are based on the
+  public-domain tomsfastmath library by Tom St Denis
+  <http://www.libtom.org/>
+  <https://github.com/libtom/tomsfastmath/blob/master/src/sqr/fp_sqr_comba.c
+  <https://github.com/libtom/tomsfastmath/blob/master/src/mul/fp_mul_comba.c>
+
+  Compared to the above, we save 5-20% of cycles by using careful register
+  renaming to implement Comba forward operation.
+ */
+
+#define COMBA_3_BY_3_MUL(c0_, c1_, c2_, res_, A_, B_)    \
+    asm volatile (                              \
+        "movq  0(%[A]), %%rax             \n\t" \
+        "mulq  0(%[B])                    \n\t" \
+        "movq  %%rax, 0(%[res])           \n\t" \
+        "movq  %%rdx, %[c0]               \n\t" \
+                                                \
+        "xorq  %[c1], %[c1]               \n\t" \
+        "movq  0(%[A]), %%rax             \n\t" \
+        "mulq  8(%[B])                    \n\t" \
+        "addq  %%rax, %[c0]               \n\t" \
+        "adcq  %%rdx, %[c1]               \n\t" \
+                                                \
+        "xorq  %[c2], %[c2]               \n\t" \
+        "movq  8(%[A]), %%rax             \n\t" \
+        "mulq  0(%[B])                    \n\t" \
+        "addq  %%rax, %[c0]               \n\t" \
+        "movq  %[c0], 8(%[res])           \n\t" \
+        "adcq  %%rdx, %[c1]               \n\t" \
+        "adcq  $0, %[c2]                  \n\t" \
+                                                \
+        "// register renaming (c1, c2, c0)\n\t" \
+        "xorq  %[c0], %[c0]               \n\t" \
+        "movq  0(%[A]), %%rax             \n\t" \
+        "mulq  16(%[B])                   \n\t" \
+        "addq  %%rax, %[c1]               \n\t" \
+        "adcq  %%rdx, %[c2]               \n\t" \
+        "adcq  $0, %[c0]                  \n\t" \
+                                                \
+        "movq  8(%[A]), %%rax             \n\t" \
+        "mulq  8(%[B])                    \n\t" \
+        "addq  %%rax, %[c1]               \n\t" \
+        "adcq  %%rdx, %[c2]               \n\t" \
+        "adcq  $0, %[c0]                  \n\t" \
+                                                \
+        "movq  16(%[A]), %%rax            \n\t" \
+        "mulq  0(%[B])                    \n\t" \
+        "addq  %%rax, %[c1]               \n\t" \
+        "movq  %[c1], 16(%[res])          \n\t" \
+        "adcq  %%rdx, %[c2]               \n\t" \
+        "adcq  $0, %[c0]                  \n\t" \
+                                                \
+        "// register renaming (c2, c0, c1)\n\t" \
+        "xorq  %[c1], %[c1]               \n\t" \
+        "movq  8(%[A]), %%rax             \n\t" \
+        "mulq  16(%[B])                   \n\t" \
+        "addq  %%rax, %[c2]               \n\t" \
+        "adcq  %%rdx, %[c0]               \n\t" \
+        "adcq  $0, %[c1]                  \n\t" \
+                                                \
+        "movq  16(%[A]), %%rax            \n\t" \
+        "mulq  8(%[B])                    \n\t" \
+        "addq  %%rax, %[c2]               \n\t" \
+        "movq  %[c2], 24(%[res])          \n\t" \
+        "adcq  %%rdx, %[c0]               \n\t" \
+        "adcq  $0, %[c1]                  \n\t" \
+                                                \
+        "// register renaming (c0, c1, c2)\n\t" \
+        "xorq  %[c2], %[c2]               \n\t" \
+        "movq  16(%[A]), %%rax            \n\t" \
+        "mulq  16(%[B])                   \n\t" \
+        "addq  %%rax, %[c0]               \n\t" \
+        "movq  %[c0], 32(%[res])          \n\t" \
+        "adcq  %%rdx, %[c1]               \n\t" \
+        "movq  %[c1], 40(%[res])          \n\t" \
+        : [c0] "=&r" (c0_), [c1] "=&r" (c1_), [c2] "=&r" (c2_) \
+        : [res] "r" (res_), [A] "r" (A_), [B] "r" (B_)     \
+        : "%rax", "%rdx", "cc", "memory")
+
+#define COMBA_3_BY_3_SQR(c0_, c1_, c2_, res_, A_)    \
+    asm volatile (                              \
+        "xorq  %[c1], %[c1]               \n\t" \
+        "xorq  %[c2], %[c2]               \n\t" \
+        "movq  0(%[A]), %%rax             \n\t" \
+        "mulq  %%rax                      \n\t" \
+        "movq  %%rax, 0(%[res])           \n\t" \
+        "movq  %%rdx, %[c0]               \n\t" \
+                                                \
+        "movq  0(%[A]), %%rax             \n\t" \
+        "mulq  8(%[A])                    \n\t" \
+        "addq  %%rax, %[c0]               \n\t" \
+        "adcq  %%rdx, %[c1]               \n\t" \
+        "addq  %%rax, %[c0]               \n\t" \
+        "movq  %[c0], 8(%[res])           \n\t" \
+        "adcq  %%rdx, %[c1]               \n\t" \
+        "adcq  $0, %[c2]                  \n\t" \
+                                                \
+        "// register renaming (c1, c2, c0)\n\t" \
+        "movq  0(%[A]), %%rax             \n\t" \
+        "xorq  %[c0], %[c0]               \n\t" \
+        "mulq  16(%[A])                   \n\t" \
+        "addq  %%rax, %[c1]               \n\t" \
+        "adcq  %%rdx, %[c2]               \n\t" \
+        "adcq  $0, %[c0]                  \n\t" \
+        "addq  %%rax, %[c1]               \n\t" \
+        "adcq  %%rdx, %[c2]               \n\t" \
+        "adcq  $0, %[c0]                  \n\t" \
+                                                \
+        "movq  8(%[A]), %%rax             \n\t" \
+        "mulq  %%rax                      \n\t" \
+        "addq  %%rax, %[c1]               \n\t" \
+        "movq  %[c1], 16(%[res])          \n\t" \
+        "adcq  %%rdx, %[c2]               \n\t" \
+        "adcq  $0, %[c0]                  \n\t" \
+                                                \
+        "// register renaming (c2, c0, c1)\n\t" \
+        "movq  8(%[A]), %%rax             \n\t" \
+        "xorq  %[c1], %[c1]               \n\t" \
+        "mulq  16(%[A])                   \n\t" \
+        "addq  %%rax, %[c2]               \n\t" \
+        "adcq  %%rdx, %[c0]               \n\t" \
+        "adcq  $0, %[c1]                  \n\t" \
+        "addq  %%rax, %[c2]               \n\t" \
+        "movq  %[c2], 24(%[res])          \n\t" \
+        "adcq  %%rdx, %[c0]               \n\t" \
+        "adcq  $0, %[c1]                  \n\t" \
+                                                \
+        "// register renaming (c0, c1, c2)\n\t" \
+        "movq  16(%[A]), %%rax            \n\t" \
+        "mulq  %%rax                      \n\t" \
+        "addq  %%rax, %[c0]               \n\t" \
+        "movq  %[c0], 32(%[res])          \n\t" \
+        "adcq  %%rdx, %[c1]               \n\t" \
+        "movq  %[c1], 40(%[res])          \n\t" \
+                                                \
+        : [c0] "=&r" (c0_), [c1] "=&r" (c1_), [c2] "=&r" (c2_) \
+        : [res] "r" (res_), [A] "r" (A_) \
+        : "%rax", "%rdx", "cc", "memory")
+
+/*
+  The Montgomery reduction here is based on Algorithm 14.32 in
+  Handbook of Applied Cryptography
+  <http://cacr.uwaterloo.ca/hac/about/chap14.pdf>.
+ */
+#define REDUCE_6_LIMB_PRODUCT(k_, tmp1_, tmp2_, tmp3_, inv_, res_, mod_) \
+    __asm__ volatile                               \
+        ("///////////////////////////////////\n\t" \
+         "movq   0(%[res]), %%rax            \n\t" \
+         "mulq   %[modprime]                 \n\t" \
+         "movq   %%rax, %[k]                 \n\t" \
+                                                   \
+         "movq   (%[mod]), %%rax             \n\t" \
+         "mulq   %[k]                        \n\t" \
+         "movq   %%rax, %[tmp1]              \n\t" \
+         "movq   %%rdx, %[tmp2]              \n\t" \
+                                                   \
+         "xorq   %[tmp3], %[tmp3]            \n\t" \
+         "movq   8(%[mod]), %%rax            \n\t" \
+         "mulq   %[k]                        \n\t" \
+         "addq   %[tmp1], 0(%[res])          \n\t" \
+         "adcq   %%rax, %[tmp2]              \n\t" \
+         "adcq   %%rdx, %[tmp3]              \n\t" \
+                                                   \
+         "xorq   %[tmp1], %[tmp1]            \n\t" \
+         "movq   16(%[mod]), %%rax           \n\t" \
+         "mulq   %[k]                        \n\t" \
+         "addq   %[tmp2], 8(%[res])          \n\t" \
+         "adcq   %%rax, %[tmp3]              \n\t" \
+         "adcq   %%rdx, %[tmp1]              \n\t" \
+                                                   \
+         "addq   %[tmp3], 16(%[res])         \n\t" \
+         "adcq   %[tmp1], 24(%[res])         \n\t" \
+         "adcq   $0, 32(%[res])              \n\t" \
+         "adcq   $0, 40(%[res])              \n\t" \
+                                                   \
+         "///////////////////////////////////\n\t" \
+         "movq   8(%[res]), %%rax            \n\t" \
+         "mulq   %[modprime]                 \n\t" \
+         "movq   %%rax, %[k]                 \n\t" \
+                                                   \
+         "movq   (%[mod]), %%rax             \n\t" \
+         "mulq   %[k]                        \n\t" \
+         "movq   %%rax, %[tmp1]              \n\t" \
+         "movq   %%rdx, %[tmp2]              \n\t" \
+                                                   \
+         "xorq   %[tmp3], %[tmp3]            \n\t" \
+         "movq   8(%[mod]), %%rax            \n\t" \
+         "mulq   %[k]                        \n\t" \
+         "addq   %[tmp1], 8(%[res])          \n\t" \
+         "adcq   %%rax, %[tmp2]              \n\t" \
+         "adcq   %%rdx, %[tmp3]              \n\t" \
+                                                   \
+         "xorq   %[tmp1], %[tmp1]            \n\t" \
+         "movq   16(%[mod]), %%rax           \n\t" \
+         "mulq   %[k]                        \n\t" \
+         "addq   %[tmp2], 16(%[res])         \n\t" \
+         "adcq   %%rax, %[tmp3]              \n\t" \
+         "adcq   %%rdx, %[tmp1]              \n\t" \
+                                                   \
+         "addq   %[tmp3], 24(%[res])         \n\t" \
+         "adcq   %[tmp1], 32(%[res])         \n\t" \
+         "adcq   $0, 40(%[res])              \n\t" \
+                                                   \
+         "///////////////////////////////////\n\t" \
+         "movq   16(%[res]), %%rax           \n\t" \
+         "mulq   %[modprime]                 \n\t" \
+         "movq   %%rax, %[k]                 \n\t" \
+                                                   \
+         "movq   (%[mod]), %%rax             \n\t" \
+         "mulq   %[k]                        \n\t" \
+         "movq   %%rax, %[tmp1]              \n\t" \
+         "movq   %%rdx, %[tmp2]              \n\t" \
+                                                   \
+         "xorq   %[tmp3], %[tmp3]            \n\t" \
+         "movq   8(%[mod]), %%rax            \n\t" \
+         "mulq   %[k]                        \n\t" \
+         "addq   %[tmp1], 16(%[res])         \n\t" \
+         "adcq   %%rax, %[tmp2]              \n\t" \
+         "adcq   %%rdx, %[tmp3]              \n\t" \
+                                                   \
+         "xorq   %[tmp1], %[tmp1]            \n\t" \
+         "movq   16(%[mod]), %%rax           \n\t" \
+         "mulq   %[k]                        \n\t" \
+         "addq   %[tmp2], 24(%[res])         \n\t" \
+         "adcq   %%rax, %[tmp3]              \n\t" \
+         "adcq   %%rdx, %[tmp1]              \n\t" \
+                                                   \
+         "addq   %[tmp3], 32(%[res])         \n\t" \
+         "adcq   %[tmp1], 40(%[res])         \n\t" \
+         : [k] "=&r" (k_), [tmp1] "=&r" (tmp1_), [tmp2] "=&r" (tmp2_), [tmp3] "=&r" (tmp3_) \
+         : [modprime] "r" (inv_), [res] "r" (res_), [mod] "r" (mod_) \
+         : "%rax", "%rdx", "cc", "memory")
+
+} // libff
+#endif // FP_AUX_TCC_
diff --git a/src/libff/libff/algebra/fields/tests/test_fields.cpp b/src/libff/libff/algebra/fields/tests/test_fields.cpp
new file mode 100755
index 000000000..4efe72d41
--- /dev/null
+++ b/src/libff/libff/algebra/fields/tests/test_fields.cpp
@@ -0,0 +1,245 @@
+/**
+ *****************************************************************************
+ * @author     This file is part of libff, developed by SCIPR Lab
+ *             and contributors (see AUTHORS).
+ * @copyright  MIT license (see LICENSE file)
+ *****************************************************************************/
+#include <libff/algebra/curves/edwards/edwards_pp.hpp>
+#include <libff/algebra/curves/mnt/mnt4/mnt4_pp.hpp>
+#include <libff/algebra/curves/mnt/mnt6/mnt6_pp.hpp>
+#include <libff/common/profiling.hpp>
+#ifdef CURVE_BN128
+#include <libff/algebra/curves/bn128/bn128_pp.hpp>
+#endif
+#include <libff/algebra/curves/alt_bn128/alt_bn128_pp.hpp>
+#include <libff/algebra/fields/fp12_2over3over2.hpp>
+#include <libff/algebra/fields/fp6_3over2.hpp>
+
+using namespace libff;
+
+template<typename FieldT>
+void test_field()
+{
+    bigint<1> rand1 = bigint<1>("76749407");
+    bigint<1> rand2 = bigint<1>("44410867");
+    bigint<1> randsum = bigint<1>("121160274");
+
+    FieldT zero = FieldT::zero();
+    FieldT one = FieldT::one();
+    FieldT a = FieldT::random_element();
+    FieldT a_ser;
+    a_ser = reserialize<FieldT>(a);
+    assert(a_ser == a);
+
+    FieldT b = FieldT::random_element();
+    FieldT c = FieldT::random_element();
+    FieldT d = FieldT::random_element();
+
+    assert(a != zero);
+    assert(a != one);
+
+    assert(a * a == a.squared());
+    assert((a + b).squared() == a.squared() + a*b + b*a + b.squared());
+    assert((a + b)*(c + d) == a*c + a*d + b*c + b*d);
+    assert(a - b == a + (-b));
+    assert(a - b == (-b) + a);
+
+    assert((a ^ rand1) * (a ^ rand2) == (a^randsum));
+
+    assert(a * a.inverse() == one);
+    assert((a + b) * c.inverse() == a * c.inverse() + (b.inverse() * c).inverse());
+
+}
+
+template<typename FieldT>
+void test_sqrt()
+{
+    for (size_t i = 0; i < 100; ++i)
+    {
+        FieldT a = FieldT::random_element();
+        FieldT asq = a.squared();
+        assert(asq.sqrt() == a || asq.sqrt() == -a);
+    }
+}
+
+template<typename FieldT>
+void test_two_squarings()
+{
+    FieldT a = FieldT::random_element();
+    assert(a.squared() == a * a);
+    assert(a.squared() == a.squared_complex());
+    assert(a.squared() == a.squared_karatsuba());
+}
+
+template<typename FieldT>
+void test_Frobenius()
+{
+    FieldT a = FieldT::random_element();
+    assert(a.Frobenius_map(0) == a);
+    FieldT a_q = a ^ FieldT::base_field_char();
+    for (size_t power = 1; power < 10; ++power)
+    {
+        const FieldT a_qi = a.Frobenius_map(power);
+        assert(a_qi == a_q);
+
+        a_q = a_q ^ FieldT::base_field_char();
+    }
+}
+
+template<typename FieldT>
+void test_unitary_inverse()
+{
+    assert(FieldT::extension_degree() % 2 == 0);
+    FieldT a = FieldT::random_element();
+    FieldT aqcubed_minus1 = a.Frobenius_map(FieldT::extension_degree()/2) * a.inverse();
+    assert(aqcubed_minus1.inverse() == aqcubed_minus1.unitary_inverse());
+}
+
+template<typename FieldT>
+void test_cyclotomic_squaring();
+
+template<>
+void test_cyclotomic_squaring<Fqk<edwards_pp> >()
+{
+    typedef Fqk<edwards_pp> FieldT;
+    assert(FieldT::extension_degree() % 2 == 0);
+    FieldT a = FieldT::random_element();
+    FieldT a_unitary = a.Frobenius_map(FieldT::extension_degree()/2) * a.inverse();
+    // beta = a^((q^(k/2)-1)*(q+1))
+    FieldT beta = a_unitary.Frobenius_map(1) * a_unitary;
+    assert(beta.cyclotomic_squared() == beta.squared());
+}
+
+template<>
+void test_cyclotomic_squaring<Fqk<mnt4_pp> >()
+{
+    typedef Fqk<mnt4_pp> FieldT;
+    assert(FieldT::extension_degree() % 2 == 0);
+    FieldT a = FieldT::random_element();
+    FieldT a_unitary = a.Frobenius_map(FieldT::extension_degree()/2) * a.inverse();
+    // beta = a^(q^(k/2)-1)
+    FieldT beta = a_unitary;
+    assert(beta.cyclotomic_squared() == beta.squared());
+}
+
+template<>
+void test_cyclotomic_squaring<Fqk<mnt6_pp> >()
+{
+    typedef Fqk<mnt6_pp> FieldT;
+    assert(FieldT::extension_degree() % 2 == 0);
+    FieldT a = FieldT::random_element();
+    FieldT a_unitary = a.Frobenius_map(FieldT::extension_degree()/2) * a.inverse();
+    // beta = a^((q^(k/2)-1)*(q+1))
+    FieldT beta = a_unitary.Frobenius_map(1) * a_unitary;
+    assert(beta.cyclotomic_squared() == beta.squared());
+}
+
+template<typename ppT>
+void test_all_fields()
+{
+    test_field<Fr<ppT> >();
+    test_field<Fq<ppT> >();
+    test_field<Fqe<ppT> >();
+    test_field<Fqk<ppT> >();
+
+    test_sqrt<Fr<ppT> >();
+    test_sqrt<Fq<ppT> >();
+    test_sqrt<Fqe<ppT> >();
+
+    test_Frobenius<Fqe<ppT> >();
+    test_Frobenius<Fqk<ppT> >();
+
+    test_unitary_inverse<Fqk<ppT> >();
+}
+
+template<typename Fp4T>
+void test_Fp4_tom_cook()
+{
+    typedef typename Fp4T::my_Fp FieldT;
+    for (size_t i = 0; i < 100; ++i)
+    {
+        const Fp4T a = Fp4T::random_element();
+        const Fp4T b = Fp4T::random_element();
+        const Fp4T correct_res = a * b;
+
+        Fp4T res;
+
+        const FieldT
+            &a0 = a.c0.c0,
+            &a1 = a.c1.c0,
+            &a2 = a.c0.c1,
+            &a3 = a.c1.c1;
+
+        const FieldT
+            &b0 = b.c0.c0,
+            &b1 = b.c1.c0,
+            &b2 = b.c0.c1,
+            &b3 = b.c1.c1;
+
+        FieldT
+            &c0 = res.c0.c0,
+            &c1 = res.c1.c0,
+            &c2 = res.c0.c1,
+            &c3 = res.c1.c1;
+
+        const FieldT v0 = a0 * b0;
+        const FieldT v1 = (a0 + a1 + a2 + a3) * (b0 + b1 + b2 + b3);
+        const FieldT v2 = (a0 - a1 + a2 - a3) * (b0 - b1 + b2 - b3);
+        const FieldT v3 = (a0 + FieldT(2)*a1 + FieldT(4)*a2 + FieldT(8)*a3) * (b0 + FieldT(2)*b1 + FieldT(4)*b2 + FieldT(8)*b3);
+        const FieldT v4 = (a0 - FieldT(2)*a1 + FieldT(4)*a2 - FieldT(8)*a3) * (b0 - FieldT(2)*b1 + FieldT(4)*b2 - FieldT(8)*b3);
+        const FieldT v5 = (a0 + FieldT(3)*a1 + FieldT(9)*a2 + FieldT(27)*a3) * (b0 + FieldT(3)*b1 + FieldT(9)*b2 + FieldT(27)*b3);
+        const FieldT v6 = a3 * b3;
+
+        const FieldT beta = Fp4T::non_residue;
+
+        c0 = v0 + beta*(FieldT(4).inverse()*v0 - FieldT(6).inverse()*(v1 + v2) + FieldT(24).inverse() * (v3 + v4) - FieldT(5) * v6);
+        c1 = - FieldT(3).inverse()*v0 + v1 - FieldT(2).inverse()*v2 - FieldT(4).inverse()*v3 + FieldT(20).inverse() * v4 + FieldT(30).inverse() * v5 - FieldT(12) * v6 + beta * ( - FieldT(12).inverse() * (v0 - v1) + FieldT(24).inverse()*(v2 - v3) - FieldT(120).inverse() * (v4 - v5) - FieldT(3) * v6);
+        c2 = - (FieldT(5)*(FieldT(4).inverse()))* v0 + (FieldT(2)*(FieldT(3).inverse()))*(v1 + v2) - FieldT(24).inverse()*(v3 + v4) + FieldT(4)*v6 + beta*v6;
+        c3 = FieldT(12).inverse() * (FieldT(5)*v0 - FieldT(7)*v1) - FieldT(24).inverse()*(v2 - FieldT(7)*v3 + v4 + v5) + FieldT(15)*v6;
+
+        assert(res == correct_res);
+
+        // {v0, v3, v4, v5}
+        const FieldT u = (FieldT::one() - beta).inverse();
+        assert(v0 == u * c0 + beta * u * c2 - beta * u * FieldT(2).inverse() * v1 - beta * u * FieldT(2).inverse() * v2 + beta * v6);
+        assert(v3 == - FieldT(15) * u * c0 - FieldT(30) * u * c1 - FieldT(3) * (FieldT(4) + beta) * u * c2 - FieldT(6) * (FieldT(4) + beta) * u * c3 + (FieldT(24) - FieldT(3) * beta * FieldT(2).inverse()) * u * v1 + (-FieldT(8) + beta * FieldT(2).inverse()) * u * v2
+               - FieldT(3) * (-FieldT(16) + beta) * v6);
+        assert(v4 == - FieldT(15) * u * c0 + FieldT(30) * u * c1 - FieldT(3) * (FieldT(4) + beta) * u * c2 + FieldT(6) * (FieldT(4) + beta) * u * c3 + (FieldT(24) - FieldT(3) * beta * FieldT(2).inverse()) * u * v2 + (-FieldT(8) + beta * FieldT(2).inverse()) * u * v1
+               - FieldT(3) * (-FieldT(16) + beta) * v6);
+        assert(v5 == - FieldT(80) * u * c0 - FieldT(240) * u * c1 - FieldT(8) * (FieldT(9) + beta) * u * c2 - FieldT(24) * (FieldT(9) + beta) * u * c3 - FieldT(2) * (-FieldT(81) + beta) * u * v1 + (-FieldT(81) + beta) * u * v2
+               - FieldT(8) * (-FieldT(81) + beta) * v6);
+
+        // c0 + beta c2 - (beta v1)/2 - (beta v2)/ 2 - (-1 + beta) beta v6,
+        // -15 c0 - 30 c1 - 3 (4 + beta) c2 - 6 (4 + beta) c3 + (24 - (3 beta)/2) v1 + (-8 + beta/2) v2 + 3 (-16 + beta) (-1 + beta) v6,
+        // -15 c0 + 30 c1 - 3 (4 + beta) c2 + 6 (4 + beta) c3 + (-8 + beta/2) v1 + (24 - (3 beta)/2) v2 + 3 (-16 + beta) (-1 + beta) v6,
+        // -80 c0 - 240 c1 - 8 (9 + beta) c2 - 24 (9 + beta) c3 - 2 (-81 + beta) v1 + (-81 + beta) v2 + 8 (-81 + beta) (-1 + beta) v6
+    }
+}
+
+int main(void)
+{
+    edwards_pp::init_public_params();
+    test_all_fields<edwards_pp>();
+    test_cyclotomic_squaring<Fqk<edwards_pp> >();
+
+    mnt4_pp::init_public_params();
+    test_all_fields<mnt4_pp>();
+    test_Fp4_tom_cook<mnt4_Fq4>();
+    test_two_squarings<Fqe<mnt4_pp> >();
+    test_cyclotomic_squaring<Fqk<mnt4_pp> >();
+
+    mnt6_pp::init_public_params();
+    test_all_fields<mnt6_pp>();
+    test_cyclotomic_squaring<Fqk<mnt6_pp> >();
+
+    alt_bn128_pp::init_public_params();
+    test_field<alt_bn128_Fq6>();
+    test_Frobenius<alt_bn128_Fq6>();
+    test_all_fields<alt_bn128_pp>();
+
+#ifdef CURVE_BN128       // BN128 has fancy dependencies so it may be disabled
+    bn128_pp::init_public_params();
+    test_field<Fr<bn128_pp> >();
+    test_field<Fq<bn128_pp> >();
+#endif
+}
diff --git a/src/libff/libff/algebra/scalar_multiplication/multiexp.hpp b/src/libff/libff/algebra/scalar_multiplication/multiexp.hpp
new file mode 100755
index 000000000..bbbdb040c
--- /dev/null
+++ b/src/libff/libff/algebra/scalar_multiplication/multiexp.hpp
@@ -0,0 +1,133 @@
+/** @file
+ *****************************************************************************
+
+ Declaration of interfaces for multi-exponentiation routines.
+
+ *****************************************************************************
+ * @author     This file is part of libff, developed by SCIPR Lab
+ *             and contributors (see AUTHORS).
+ * @copyright  MIT license (see LICENSE file)
+ *****************************************************************************/
+
+#ifndef MULTIEXP_HPP_
+#define MULTIEXP_HPP_
+
+#include <cstddef>
+#include <vector>
+
+namespace libff {
+
+enum multi_exp_method {
+ /**
+  * Naive multi-exponentiation individually multiplies each base by the
+  * corresponding scalar and adds up the results.
+  * multi_exp_method_naive uses opt_window_wnaf_exp for exponentiation,
+  * while multi_exp_method_plain uses operator *.
+  */
+ multi_exp_method_naive,
+ multi_exp_method_naive_plain,
+ /**
+  * A variant of the Bos-Coster algorithm [1],
+  * with implementation suggestions from [2].
+  *
+  * [1] = Bos and Coster, "Addition chain heuristics", CRYPTO '89
+  * [2] = Bernstein, Duif, Lange, Schwabe, and Yang, "High-speed high-security signatures", CHES '11
+  */
+ multi_exp_method_bos_coster,
+ /**
+  * A special case of Pippenger's algorithm from Page 15 of
+  * Bernstein, Doumen, Lange, Oosterwijk,
+  * "Faster batch forgery identification", INDOCRYPT 2012
+  * (https://eprint.iacr.org/2012/549.pdf)
+  * When compiled with USE_MIXED_ADDITION, assumes input is in special form.
+  * Requires that T implements .dbl() (and, if USE_MIXED_ADDITION is defined,
+  * .to_special(), .mixed_add(), and batch_to_special()).
+  */
+ multi_exp_method_BDLO12
+};
+
+/**
+ * Computes the sum
+ * \sum_i scalar_start[i] * vec_start[i]
+ * using the selected method.
+ * Input is split into the given number of chunks, and, when compiled with
+ * MULTICORE, the chunks are processed in parallel.
+ */
+template<typename T, typename FieldT, multi_exp_method Method>
+T multi_exp(typename std::vector<T>::const_iterator vec_start,
+            typename std::vector<T>::const_iterator vec_end,
+            typename std::vector<FieldT>::const_iterator scalar_start,
+            typename std::vector<FieldT>::const_iterator scalar_end,
+            const size_t chunks);
+
+
+/**
+ * A variant of multi_exp that takes advantage of the method mixed_add (instead
+ * of the operator '+').
+ * Assumes input is in special form, and includes special pre-processing for
+ * scalars equal to 0 or 1.
+ */
+template<typename T, typename FieldT, multi_exp_method Method>
+T multi_exp_with_mixed_addition(typename std::vector<T>::const_iterator vec_start,
+                                typename std::vector<T>::const_iterator vec_end,
+                                typename std::vector<FieldT>::const_iterator scalar_start,
+                                typename std::vector<FieldT>::const_iterator scalar_end,
+                                const size_t chunks);
+
+/**
+ * A convenience function for calculating a pure inner product, where the
+ * more complicated methods are not required.
+ */
+template <typename T>
+T inner_product(typename std::vector<T>::const_iterator a_start,
+                typename std::vector<T>::const_iterator a_end,
+                typename std::vector<T>::const_iterator b_start,
+                typename std::vector<T>::const_iterator b_end);
+
+/**
+ * A window table stores window sizes for different instance sizes for fixed-base multi-scalar multiplications.
+ */
+template<typename T>
+using window_table = std::vector<std::vector<T> >;
+
+/**
+ * Compute window size for the given number of scalars.
+ */
+template<typename T>
+size_t get_exp_window_size(const size_t num_scalars);
+
+/**
+ * Compute table of window sizes.
+ */
+template<typename T>
+window_table<T> get_window_table(const size_t scalar_size,
+                                 const size_t window,
+                                 const T &g);
+
+template<typename T, typename FieldT>
+T windowed_exp(const size_t scalar_size,
+               const size_t window,
+               const window_table<T> &powers_of_g,
+               const FieldT &pow);
+
+template<typename T, typename FieldT>
+std::vector<T> batch_exp(const size_t scalar_size,
+                         const size_t window,
+                         const window_table<T> &table,
+                         const std::vector<FieldT> &v);
+
+template<typename T, typename FieldT>
+std::vector<T> batch_exp_with_coeff(const size_t scalar_size,
+                                    const size_t window,
+                                    const window_table<T> &table,
+                                    const FieldT &coeff,
+                                    const std::vector<FieldT> &v);
+
+template<typename T>
+void batch_to_special(std::vector<T> &vec);
+
+} // libff
+
+#include <libff/algebra/scalar_multiplication/multiexp.tcc>
+
+#endif // MULTIEXP_HPP_
diff --git a/src/libff/libff/algebra/scalar_multiplication/multiexp.tcc b/src/libff/libff/algebra/scalar_multiplication/multiexp.tcc
new file mode 100755
index 000000000..69eb184d9
--- /dev/null
+++ b/src/libff/libff/algebra/scalar_multiplication/multiexp.tcc
@@ -0,0 +1,719 @@
+/** @file
+ *****************************************************************************
+
+ Implementation of interfaces for multi-exponentiation routines.
+
+ See multiexp.hpp .
+
+ *****************************************************************************
+ * @author     This file is part of libff, developed by SCIPR Lab
+ *             and contributors (see AUTHORS).
+ * @copyright  MIT license (see LICENSE file)
+ *****************************************************************************/
+
+#ifndef MULTIEXP_TCC_
+#define MULTIEXP_TCC_
+
+#include <algorithm>
+#include <cassert>
+#include <type_traits>
+
+#include <libff/algebra/fields/bigint.hpp>
+#include <libff/algebra/fields/fp_aux.tcc>
+#include <libff/algebra/scalar_multiplication/multiexp.hpp>
+#include <libff/algebra/scalar_multiplication/wnaf.hpp>
+#include <libff/common/profiling.hpp>
+#include <libff/common/utils.hpp>
+
+namespace libff {
+
+template<mp_size_t n>
+class ordered_exponent {
+// to use std::push_heap and friends later
+public:
+    size_t idx;
+    bigint<n> r;
+
+    ordered_exponent(const size_t idx, const bigint<n> &r) : idx(idx), r(r) {};
+
+    bool operator<(const ordered_exponent<n> &other) const
+    {
+#if defined(__x86_64__) && defined(USE_ASM)
+        if (n == 3)
+        {
+            long res;
+            __asm__
+                ("// check for overflow           \n\t"
+                 "mov $0, %[res]                  \n\t"
+                 ADD_CMP(16)
+                 ADD_CMP(8)
+                 ADD_CMP(0)
+                 "jmp done%=                      \n\t"
+                 "subtract%=:                     \n\t"
+                 "mov $1, %[res]                  \n\t"
+                 "done%=:                         \n\t"
+                 : [res] "=&r" (res)
+                 : [A] "r" (other.r.data), [mod] "r" (this->r.data)
+                 : "cc", "%rax");
+            return res;
+        }
+        else if (n == 4)
+        {
+            long res;
+            __asm__
+                ("// check for overflow           \n\t"
+                 "mov $0, %[res]                  \n\t"
+                 ADD_CMP(24)
+                 ADD_CMP(16)
+                 ADD_CMP(8)
+                 ADD_CMP(0)
+                 "jmp done%=                      \n\t"
+                 "subtract%=:                     \n\t"
+                 "mov $1, %[res]                  \n\t"
+                 "done%=:                         \n\t"
+                 : [res] "=&r" (res)
+                 : [A] "r" (other.r.data), [mod] "r" (this->r.data)
+                 : "cc", "%rax");
+            return res;
+        }
+        else if (n == 5)
+        {
+            long res;
+            __asm__
+                ("// check for overflow           \n\t"
+                 "mov $0, %[res]                  \n\t"
+                 ADD_CMP(32)
+                 ADD_CMP(24)
+                 ADD_CMP(16)
+                 ADD_CMP(8)
+                 ADD_CMP(0)
+                 "jmp done%=                      \n\t"
+                 "subtract%=:                     \n\t"
+                 "mov $1, %[res]                  \n\t"
+                 "done%=:                         \n\t"
+                 : [res] "=&r" (res)
+                 : [A] "r" (other.r.data), [mod] "r" (this->r.data)
+                 : "cc", "%rax");
+            return res;
+        }
+        else
+#endif
+        {
+            return (mpn_cmp(this->r.data, other.r.data, n) < 0);
+        }
+    }
+};
+
+/**
+ * multi_exp_inner<T, FieldT, Method>() implementes the specified
+ * multiexponentiation method.
+ * this implementation relies on some rather arcane template magic:
+ * function templates cannot be partially specialized, so we cannot just write
+ *     template<typename T, typename FieldT>
+ *     T multi_exp_inner<T, FieldT, multi_exp_method_naive>
+ * thus we resort to using std::enable_if. the basic idea is that *overloading*
+ * is what's actually happening here, it's just that, for any given value of
+ * Method, only one of the templates will be valid, and thus the correct
+ * implementation will be used.
+ */
+
+template<typename T, typename FieldT, multi_exp_method Method,
+    typename std::enable_if<(Method == multi_exp_method_naive), int>::type = 0>
+T multi_exp_inner(
+    typename std::vector<T>::const_iterator vec_start,
+    typename std::vector<T>::const_iterator vec_end,
+    typename std::vector<FieldT>::const_iterator scalar_start,
+    typename std::vector<FieldT>::const_iterator scalar_end)
+{
+    T result(T::zero());
+
+    typename std::vector<T>::const_iterator vec_it;
+    typename std::vector<FieldT>::const_iterator scalar_it;
+
+    for (vec_it = vec_start, scalar_it = scalar_start; vec_it != vec_end; ++vec_it, ++scalar_it)
+    {
+        bigint<FieldT::num_limbs> scalar_bigint = scalar_it->as_bigint();
+        result = result + opt_window_wnaf_exp(*vec_it, scalar_bigint, scalar_bigint.num_bits());
+    }
+    assert(scalar_it == scalar_end);
+
+    return result;
+}
+
+template<typename T, typename FieldT, multi_exp_method Method,
+    typename std::enable_if<(Method == multi_exp_method_naive_plain), int>::type = 0>
+T multi_exp_inner(
+    typename std::vector<T>::const_iterator vec_start,
+    typename std::vector<T>::const_iterator vec_end,
+    typename std::vector<FieldT>::const_iterator scalar_start,
+    typename std::vector<FieldT>::const_iterator scalar_end)
+{
+    T result(T::zero());
+
+    typename std::vector<T>::const_iterator vec_it;
+    typename std::vector<FieldT>::const_iterator scalar_it;
+
+    for (vec_it = vec_start, scalar_it = scalar_start; vec_it != vec_end; ++vec_it, ++scalar_it)
+    {
+        result = result + (*scalar_it) * (*vec_it);
+    }
+    assert(scalar_it == scalar_end);
+
+    return result;
+}
+
+template<typename T, typename FieldT, multi_exp_method Method,
+    typename std::enable_if<(Method == multi_exp_method_BDLO12), int>::type = 0>
+T multi_exp_inner(
+    typename std::vector<T>::const_iterator bases,
+    typename std::vector<T>::const_iterator bases_end,
+    typename std::vector<FieldT>::const_iterator exponents,
+    typename std::vector<FieldT>::const_iterator exponents_end)
+{
+    UNUSED(exponents_end);
+    size_t length = bases_end - bases;
+
+    // empirically, this seems to be a decent estimate of the optimal value of c
+    size_t log2_length = log2(length);
+    size_t c = log2_length - (log2_length / 3 - 2);
+
+    const mp_size_t exp_num_limbs =
+        std::remove_reference<decltype(*exponents)>::type::num_limbs;
+    std::vector<bigint<exp_num_limbs> > bn_exponents(length);
+    size_t num_bits = 0;
+
+    for (size_t i = 0; i < length; i++)
+    {
+        bn_exponents[i] = exponents[i].as_bigint();
+        num_bits = std::max(num_bits, bn_exponents[i].num_bits());
+    }
+
+    size_t num_groups = (num_bits + c - 1) / c;
+
+    T result;
+    bool result_nonzero = false;
+
+    for (size_t k = num_groups - 1; k <= num_groups; k--)
+    {
+        if (result_nonzero)
+        {
+            for (size_t i = 0; i < c; i++)
+            {
+                result = result.dbl();
+            }
+        }
+
+        std::vector<T> buckets(1 << c);
+        std::vector<bool> bucket_nonzero(1 << c);
+
+        for (size_t i = 0; i < length; i++)
+        {
+            size_t id = 0;
+            for (size_t j = 0; j < c; j++)
+            {
+                if (bn_exponents[i].test_bit(k*c + j))
+                {
+                    id |= 1 << j;
+                }
+            }
+
+            if (id == 0)
+            {
+                continue;
+            }
+
+            if (bucket_nonzero[id])
+            {
+#ifdef USE_MIXED_ADDITION
+                buckets[id] = buckets[id].mixed_add(bases[i]);
+#else
+                buckets[id] = buckets[id] + bases[i];
+#endif
+            }
+            else
+            {
+                buckets[id] = bases[i];
+                bucket_nonzero[id] = true;
+            }
+        }
+
+#ifdef USE_MIXED_ADDITION
+        batch_to_special(buckets);
+#endif
+
+        T running_sum;
+        bool running_sum_nonzero = false;
+
+        for (size_t i = (1u << c) - 1; i > 0; i--)
+        {
+            if (bucket_nonzero[i])
+            {
+                if (running_sum_nonzero)
+                {
+#ifdef USE_MIXED_ADDITION
+                    running_sum = running_sum.mixed_add(buckets[i]);
+#else
+                    running_sum = running_sum + buckets[i];
+#endif
+                }
+                else
+                {
+                    running_sum = buckets[i];
+                    running_sum_nonzero = true;
+                }
+            }
+
+            if (running_sum_nonzero)
+            {
+                if (result_nonzero)
+                {
+                    result = result + running_sum;
+                }
+                else
+                {
+                    result = running_sum;
+                    result_nonzero = true;
+                }
+            }
+        }
+    }
+
+    return result;
+}
+
+template<typename T, typename FieldT, multi_exp_method Method,
+    typename std::enable_if<(Method == multi_exp_method_bos_coster), int>::type = 0>
+T multi_exp_inner(
+    typename std::vector<T>::const_iterator vec_start,
+    typename std::vector<T>::const_iterator vec_end,
+    typename std::vector<FieldT>::const_iterator scalar_start,
+    typename std::vector<FieldT>::const_iterator scalar_end)
+{
+    const mp_size_t n = std::remove_reference<decltype(*scalar_start)>::type::num_limbs;
+
+    if (vec_start == vec_end)
+    {
+        return T::zero();
+    }
+
+    if (vec_start + 1 == vec_end)
+    {
+        return (*scalar_start)*(*vec_start);
+    }
+
+    std::vector<ordered_exponent<n> > opt_q;
+    const size_t vec_len = scalar_end - scalar_start;
+    const size_t odd_vec_len = (vec_len % 2 == 1 ? vec_len : vec_len + 1);
+    opt_q.reserve(odd_vec_len);
+    std::vector<T> g;
+    g.reserve(odd_vec_len);
+
+    typename std::vector<T>::const_iterator vec_it;
+    typename std::vector<FieldT>::const_iterator scalar_it;
+    size_t i;
+    for (i=0, vec_it = vec_start, scalar_it = scalar_start; vec_it != vec_end; ++vec_it, ++scalar_it, ++i)
+    {
+        g.emplace_back(*vec_it);
+
+        opt_q.emplace_back(ordered_exponent<n>(i, scalar_it->as_bigint()));
+    }
+    std::make_heap(opt_q.begin(),opt_q.end());
+    assert(scalar_it == scalar_end);
+
+    if (vec_len != odd_vec_len)
+    {
+        g.emplace_back(T::zero());
+        opt_q.emplace_back(ordered_exponent<n>(odd_vec_len - 1, bigint<n>(0ul)));
+    }
+    assert(g.size() % 2 == 1);
+    assert(opt_q.size() == g.size());
+
+    T opt_result = T::zero();
+
+    while (true)
+    {
+        ordered_exponent<n> &a = opt_q[0];
+        ordered_exponent<n> &b = (opt_q[1] < opt_q[2] ? opt_q[2] : opt_q[1]);
+
+        const size_t abits = a.r.num_bits();
+
+        if (b.r.is_zero())
+        {
+            // opt_result = opt_result + (a.r * g[a.idx]);
+            opt_result = opt_result + opt_window_wnaf_exp(g[a.idx], a.r, abits);
+            break;
+        }
+
+        const size_t bbits = b.r.num_bits();
+        const size_t limit = (abits-bbits >= 20 ? 20 : abits-bbits);
+
+        if (bbits < 1ul<<limit)
+        {
+            /*
+              In this case, exponentiating to the power of a is cheaper than
+              subtracting b from a multiple times, so let's do it directly
+            */
+            // opt_result = opt_result + (a.r * g[a.idx]);
+            opt_result = opt_result + opt_window_wnaf_exp(g[a.idx], a.r, abits);
+#ifdef DEBUG
+            printf("Skipping the following pair (%zu bit number vs %zu bit):\n", abits, bbits);
+            a.r.print();
+            b.r.print();
+#endif
+            a.r.clear();
+        }
+        else
+        {
+            // x A + y B => (x-y) A + y (B+A)
+            mpn_sub_n(a.r.data, a.r.data, b.r.data, n);
+            g[b.idx] = g[b.idx] + g[a.idx];
+        }
+
+        // regardless of whether a was cleared or subtracted from we push it down, then take back up
+
+        /* heapify A down */
+        size_t a_pos = 0;
+        while (2*a_pos + 2< odd_vec_len)
+        {
+            // this is a max-heap so to maintain a heap property we swap with the largest of the two
+            if (opt_q[2*a_pos+1] < opt_q[2*a_pos+2])
+            {
+                std::swap(opt_q[a_pos], opt_q[2*a_pos+2]);
+                a_pos = 2*a_pos+2;
+            }
+            else
+            {
+                std::swap(opt_q[a_pos], opt_q[2*a_pos+1]);
+                a_pos = 2*a_pos+1;
+            }
+        }
+
+        /* now heapify A up appropriate amount of times */
+        while (a_pos > 0 && opt_q[(a_pos-1)/2] < opt_q[a_pos])
+        {
+            std::swap(opt_q[a_pos], opt_q[(a_pos-1)/2]);
+            a_pos = (a_pos-1) / 2;
+        }
+    }
+
+    return opt_result;
+}
+
+template<typename T, typename FieldT, multi_exp_method Method>
+T multi_exp(typename std::vector<T>::const_iterator vec_start,
+            typename std::vector<T>::const_iterator vec_end,
+            typename std::vector<FieldT>::const_iterator scalar_start,
+            typename std::vector<FieldT>::const_iterator scalar_end,
+            const size_t chunks)
+{
+    const size_t total = vec_end - vec_start;
+    if ((total < chunks) || (chunks == 1))
+    {
+        // no need to split into "chunks", can call implementation directly
+        return multi_exp_inner<T, FieldT, Method>(
+            vec_start, vec_end, scalar_start, scalar_end);
+    }
+
+    const size_t one = total/chunks;
+
+    std::vector<T> partial(chunks, T::zero());
+
+#ifdef MULTICORE
+#pragma omp parallel for
+#endif
+    for (size_t i = 0; i < chunks; ++i)
+    {
+        partial[i] = multi_exp_inner<T, FieldT, Method>(
+             vec_start + i*one,
+             (i == chunks-1 ? vec_end : vec_start + (i+1)*one),
+             scalar_start + i*one,
+             (i == chunks-1 ? scalar_end : scalar_start + (i+1)*one));
+    }
+
+    T final = T::zero();
+
+    for (size_t i = 0; i < chunks; ++i)
+    {
+        final = final + partial[i];
+    }
+
+    return final;
+}
+
+template<typename T, typename FieldT, multi_exp_method Method>
+T multi_exp_with_mixed_addition(typename std::vector<T>::const_iterator vec_start,
+                                typename std::vector<T>::const_iterator vec_end,
+                                typename std::vector<FieldT>::const_iterator scalar_start,
+                                typename std::vector<FieldT>::const_iterator scalar_end,
+                                const size_t chunks)
+{
+    assert(std::distance(vec_start, vec_end) == std::distance(scalar_start, scalar_end));
+    enter_block("Process scalar vector");
+    auto value_it = vec_start;
+    auto scalar_it = scalar_start;
+
+    const FieldT zero = FieldT::zero();
+    const FieldT one = FieldT::one();
+    std::vector<FieldT> p;
+    std::vector<T> g;
+
+    T acc = T::zero();
+
+    size_t num_skip = 0;
+    size_t num_add = 0;
+    size_t num_other = 0;
+
+    for (; scalar_it != scalar_end; ++scalar_it, ++value_it)
+    {
+        if (*scalar_it == zero)
+        {
+            // do nothing
+            ++num_skip;
+        }
+        else if (*scalar_it == one)
+        {
+#ifdef USE_MIXED_ADDITION
+            acc = acc.mixed_add(*value_it);
+#else
+            acc = acc + (*value_it);
+#endif
+            ++num_add;
+        }
+        else
+        {
+            p.emplace_back(*scalar_it);
+            g.emplace_back(*value_it);
+            ++num_other;
+        }
+    }
+    print_indent(); printf("* Elements of w skipped: %zu (%0.2f%%)\n", num_skip, 100.*num_skip/(num_skip+num_add+num_other));
+    print_indent(); printf("* Elements of w processed with special addition: %zu (%0.2f%%)\n", num_add, 100.*num_add/(num_skip+num_add+num_other));
+    print_indent(); printf("* Elements of w remaining: %zu (%0.2f%%)\n", num_other, 100.*num_other/(num_skip+num_add+num_other));
+
+    leave_block("Process scalar vector");
+
+    return acc + multi_exp<T, FieldT, Method>(g.begin(), g.end(), p.begin(), p.end(), chunks);
+}
+
+template <typename T>
+T inner_product(typename std::vector<T>::const_iterator a_start,
+                typename std::vector<T>::const_iterator a_end,
+                typename std::vector<T>::const_iterator b_start,
+                typename std::vector<T>::const_iterator b_end)
+{
+    return multi_exp<T, T, multi_exp_method_naive_plain>(
+        a_start, a_end,
+        b_start, b_end, 1);
+}
+
+template<typename T>
+size_t get_exp_window_size(const size_t num_scalars)
+{
+    if (T::fixed_base_exp_window_table.empty())
+    {
+#ifdef LOWMEM
+        return 14;
+#else
+        return 17;
+#endif
+    }
+    size_t window = 1;
+    for (long i = T::fixed_base_exp_window_table.size()-1; i >= 0; --i)
+    {
+#ifdef DEBUG
+        if (!inhibit_profiling_info)
+        {
+            printf("%ld %zu %zu\n", i, num_scalars, T::fixed_base_exp_window_table[i]);
+        }
+#endif
+        if (T::fixed_base_exp_window_table[i] != 0 && num_scalars >= T::fixed_base_exp_window_table[i])
+        {
+            window = i+1;
+            break;
+        }
+    }
+
+    if (!inhibit_profiling_info)
+    {
+        print_indent(); printf("Choosing window size %zu for %zu elements\n", window, num_scalars);
+    }
+
+#ifdef LOWMEM
+    window = std::min((size_t)14, window);
+#endif
+    return window;
+}
+
+template<typename T>
+window_table<T> get_window_table(const size_t scalar_size,
+                                 const size_t window,
+                                 const T &g)
+{
+    const size_t in_window = 1ul<<window;
+    const size_t outerc = (scalar_size+window-1)/window;
+    const size_t last_in_window = 1ul<<(scalar_size - (outerc-1)*window);
+#ifdef DEBUG
+    if (!inhibit_profiling_info)
+    {
+        print_indent(); printf("* scalar_size=%zu; window=%zu; in_window=%zu; outerc=%zu\n", scalar_size, window, in_window, outerc);
+    }
+#endif
+
+    window_table<T> powers_of_g(outerc, std::vector<T>(in_window, T::zero()));
+
+    T gouter = g;
+
+    for (size_t outer = 0; outer < outerc; ++outer)
+    {
+        T ginner = T::zero();
+        size_t cur_in_window = outer == outerc-1 ? last_in_window : in_window;
+        for (size_t inner = 0; inner < cur_in_window; ++inner)
+        {
+            powers_of_g[outer][inner] = ginner;
+            ginner = ginner + gouter;
+        }
+
+        for (size_t i = 0; i < window; ++i)
+        {
+            gouter = gouter + gouter;
+        }
+    }
+
+    return powers_of_g;
+}
+
+template<typename T, typename FieldT>
+T windowed_exp(const size_t scalar_size,
+               const size_t window,
+               const window_table<T> &powers_of_g,
+               const FieldT &pow)
+{
+    const size_t outerc = (scalar_size+window-1)/window;
+    const bigint<FieldT::num_limbs> pow_val = pow.as_bigint();
+
+    /* exp */
+    T res = powers_of_g[0][0];
+
+    for (size_t outer = 0; outer < outerc; ++outer)
+    {
+        size_t inner = 0;
+        for (size_t i = 0; i < window; ++i)
+        {
+            if (pow_val.test_bit(outer*window + i))
+            {
+                inner |= 1u << i;
+            }
+        }
+
+        res = res + powers_of_g[outer][inner];
+    }
+
+    return res;
+}
+
+template<typename T, typename FieldT>
+std::vector<T> batch_exp(const size_t scalar_size,
+                         const size_t window,
+                         const window_table<T> &table,
+                         const std::vector<FieldT> &v)
+{
+    if (!inhibit_profiling_info)
+    {
+        print_indent();
+    }
+    std::vector<T> res(v.size(), table[0][0]);
+
+#ifdef MULTICORE
+#pragma omp parallel for
+#endif
+    for (size_t i = 0; i < v.size(); ++i)
+    {
+        res[i] = windowed_exp(scalar_size, window, table, v[i]);
+
+        if (!inhibit_profiling_info && (i % 10000 == 0))
+        {
+            printf(".");
+            fflush(stdout);
+        }
+    }
+
+    if (!inhibit_profiling_info)
+    {
+        printf(" DONE!\n");
+    }
+
+    return res;
+}
+
+template<typename T, typename FieldT>
+std::vector<T> batch_exp_with_coeff(const size_t scalar_size,
+                                    const size_t window,
+                                    const window_table<T> &table,
+                                    const FieldT &coeff,
+                                    const std::vector<FieldT> &v)
+{
+    if (!inhibit_profiling_info)
+    {
+        print_indent();
+    }
+    std::vector<T> res(v.size(), table[0][0]);
+
+#ifdef MULTICORE
+#pragma omp parallel for
+#endif
+    for (size_t i = 0; i < v.size(); ++i)
+    {
+        res[i] = windowed_exp(scalar_size, window, table, coeff * v[i]);
+
+        if (!inhibit_profiling_info && (i % 10000 == 0))
+        {
+            printf(".");
+            fflush(stdout);
+        }
+    }
+
+    if (!inhibit_profiling_info)
+    {
+        printf(" DONE!\n");
+    }
+
+    return res;
+}
+
+template<typename T>
+void batch_to_special(std::vector<T> &vec)
+{
+    enter_block("Batch-convert elements to special form");
+
+    std::vector<T> non_zero_vec;
+    for (size_t i = 0; i < vec.size(); ++i)
+    {
+        if (!vec[i].is_zero())
+        {
+            non_zero_vec.emplace_back(vec[i]);
+        }
+    }
+
+    T::batch_to_special_all_non_zeros(non_zero_vec);
+    auto it = non_zero_vec.begin();
+    T zero_special = T::zero();
+    zero_special.to_special();
+
+    for (size_t i = 0; i < vec.size(); ++i)
+    {
+        if (!vec[i].is_zero())
+        {
+            vec[i] = *it;
+            ++it;
+        }
+        else
+        {
+            vec[i] = zero_special;
+        }
+    }
+    leave_block("Batch-convert elements to special form");
+}
+
+} // libff
+
+#endif // MULTIEXP_TCC_
diff --git a/src/libff/libff/algebra/scalar_multiplication/multiexp_profile.cpp b/src/libff/libff/algebra/scalar_multiplication/multiexp_profile.cpp
new file mode 100644
index 000000000..0434bb25c
--- /dev/null
+++ b/src/libff/libff/algebra/scalar_multiplication/multiexp_profile.cpp
@@ -0,0 +1,128 @@
+#include <cstdio>
+#include <vector>
+
+#include <libff/algebra/curves/bn128/bn128_pp.hpp>
+#include <libff/algebra/scalar_multiplication/multiexp.hpp>
+#include <libff/common/profiling.hpp>
+#include <libff/common/rng.hpp>
+
+using namespace libff;
+
+template <typename GroupT>
+using run_result_t = std::pair<long long, std::vector<GroupT> >;
+
+template <typename T>
+using test_instances_t = std::vector<std::vector<T> >;
+
+template<typename GroupT>
+test_instances_t<GroupT> generate_group_elements(size_t count, size_t size)
+{
+    // generating a random group element is expensive,
+    // so for now we only generate a single one and repeat it
+    test_instances_t<GroupT> result(count);
+
+    for (size_t i = 0; i < count; i++) {
+        GroupT x = GroupT::random_element();
+        x.to_special(); // djb requires input to be in special form
+        for (size_t j = 0; j < size; j++) {
+            result[i].push_back(x);
+            // result[i].push_back(GroupT::random_element());
+        }
+    }
+
+    return result;
+}
+
+template<typename FieldT>
+test_instances_t<FieldT> generate_scalars(size_t count, size_t size)
+{
+    // we use SHA512_rng because it is much faster than
+    // FieldT::random_element()
+    test_instances_t<FieldT> result(count);
+
+    for (size_t i = 0; i < count; i++) {
+        for (size_t j = 0; j < size; j++) {
+            result[i].push_back(SHA512_rng<FieldT>(i * size + j));
+        }
+    }
+
+    return result;
+}
+
+template<typename GroupT, typename FieldT, multi_exp_method Method>
+run_result_t<GroupT> profile_multiexp(
+    test_instances_t<GroupT> group_elements,
+    test_instances_t<FieldT> scalars)
+{
+    long long start_time = get_nsec_time();
+
+    std::vector<GroupT> answers;
+    for (size_t i = 0; i < group_elements.size(); i++) {
+        answers.push_back(multi_exp<GroupT, FieldT, Method>(
+            group_elements[i].cbegin(), group_elements[i].cend(),
+            scalars[i].cbegin(), scalars[i].cend(),
+            1));
+    }
+
+    long long time_delta = get_nsec_time() - start_time;
+
+    return run_result_t<GroupT>(time_delta, answers);
+}
+
+template<typename GroupT, typename FieldT>
+void print_performance_csv(
+    size_t expn_start,
+    size_t expn_end_fast,
+    size_t expn_end_naive,
+    bool compare_answers)
+{
+    for (size_t expn = expn_start; expn <= expn_end_fast; expn++) {
+        printf("%ld", expn); fflush(stdout);
+
+        test_instances_t<GroupT> group_elements =
+            generate_group_elements<GroupT>(10, 1 << expn);
+        test_instances_t<FieldT> scalars =
+            generate_scalars<FieldT>(10, 1 << expn);
+
+        run_result_t<GroupT> result_bos_coster =
+            profile_multiexp<GroupT, FieldT, multi_exp_method_bos_coster>(
+                group_elements, scalars);
+        printf("\t%lld", result_bos_coster.first); fflush(stdout);
+
+        run_result_t<GroupT> result_djb =
+            profile_multiexp<GroupT, FieldT, multi_exp_method_BDLO12>(
+                group_elements, scalars);
+        printf("\t%lld", result_djb.first); fflush(stdout);
+
+        if (compare_answers && (result_bos_coster.second != result_djb.second)) {
+            fprintf(stderr, "Answers NOT MATCHING (bos coster != djb)\n");
+        }
+
+        if (expn <= expn_end_naive) {
+            run_result_t<GroupT> result_naive =
+                profile_multiexp<GroupT, FieldT, multi_exp_method_naive>(
+                    group_elements, scalars);
+            printf("\t%lld", result_naive.first); fflush(stdout);
+
+            if (compare_answers && (result_bos_coster.second != result_naive.second)) {
+                fprintf(stderr, "Answers NOT MATCHING (bos coster != naive)\n");
+            }
+        }
+
+        printf("\n");
+    }
+}
+
+int main(void)
+{
+    print_compilation_info();
+
+    printf("Profiling BN128_G1\n");
+    bn128_pp::init_public_params();
+    print_performance_csv<G1<bn128_pp>, Fr<bn128_pp> >(2, 20, 14, true);
+
+    printf("Profiling BN128_G2\n");
+    print_performance_csv<G2<bn128_pp>, Fr<bn128_pp> >(2, 20, 14, true);
+
+    return 0;
+}
diff --git a/src/libff/libff/algebra/scalar_multiplication/wnaf.hpp b/src/libff/libff/algebra/scalar_multiplication/wnaf.hpp
new file mode 100755
index 000000000..6c65cde2a
--- /dev/null
+++ b/src/libff/libff/algebra/scalar_multiplication/wnaf.hpp
@@ -0,0 +1,43 @@
+/** @file
+ *****************************************************************************
+
+ Declaration of interfaces for wNAF ("width-w Non-Adjacent Form") exponentiation routines.
+
+ *****************************************************************************
+ * @author     This file is part of libff, developed by SCIPR Lab
+ *             and contributors (see AUTHORS).
+ * @copyright  MIT license (see LICENSE file)
+ *****************************************************************************/
+
+#ifndef WNAF_HPP_
+#define WNAF_HPP_
+
+#include <vector>
+
+#include <libff/algebra/fields/bigint.hpp>
+
+namespace libff {
+
+/**
+ * Find the wNAF representation of the given scalar relative to the given window size.
+ */
+template<mp_size_t n>
+std::vector<long> find_wnaf(const size_t window_size, const bigint<n> &scalar);
+
+/**
+ * In additive notation, use wNAF exponentiation (with the given window size) to compute scalar * base.
+ */
+template<typename T, mp_size_t n>
+T fixed_window_wnaf_exp(const size_t window_size, const T &base, const bigint<n> &scalar);
+
+/**
+ * In additive notation, use wNAF exponentiation (with the window size determined by T) to compute scalar * base.
+ */
+template<typename T, mp_size_t n>
+T opt_window_wnaf_exp(const T &base, const bigint<n> &scalar, const size_t scalar_bits);
+
+} // libff
+
+#include <libff/algebra/scalar_multiplication/wnaf.tcc>
+
+#endif // WNAF_HPP_
diff --git a/src/libff/libff/algebra/scalar_multiplication/wnaf.tcc b/src/libff/libff/algebra/scalar_multiplication/wnaf.tcc
new file mode 100755
index 000000000..5a8205e7f
--- /dev/null
+++ b/src/libff/libff/algebra/scalar_multiplication/wnaf.tcc
@@ -0,0 +1,125 @@
+/** @file
+ *****************************************************************************
+
+ Implementation of interfaces for wNAF ("weighted Non-Adjacent Form") exponentiation routines.
+
+ See wnaf.hpp .
+
+ *****************************************************************************
+ * @author     This file is part of libff, developed by SCIPR Lab
+ *             and contributors (see AUTHORS).
+ * @copyright  MIT license (see LICENSE file)
+ *****************************************************************************/
+
+#ifndef WNAF_TCC_
+#define WNAF_TCC_
+
+#include <gmp.h>
+
+namespace libff {
+
+template<mp_size_t n>
+std::vector<long> find_wnaf(const size_t window_size, const bigint<n> &scalar)
+{
+    const size_t length = scalar.max_bits(); // upper bound
+    std::vector<long> res(length+1);
+    bigint<n> c = scalar;
+    long j = 0;
+    while (!c.is_zero())
+    {
+        long u;
+        if ((c.data[0] & 1) == 1)
+        {
+            u = c.data[0] % (1u << (window_size+1));
+            if (u > (1 << window_size))
+            {
+                u = u - (1 << (window_size+1));
+            }
+
+            if (u > 0)
+            {
+                mpn_sub_1(c.data, c.data, n, u);
+            }
+            else
+            {
+                mpn_add_1(c.data, c.data, n, -u);
+            }
+        }
+        else
+        {
+            u = 0;
+        }
+        res[j] = u;
+        ++j;
+
+        mpn_rshift(c.data, c.data, n, 1); // c = c/2
+    }
+
+    return res;
+}
+
+template<typename T, mp_size_t n>
+T fixed_window_wnaf_exp(const size_t window_size, const T &base, const bigint<n> &scalar)
+{
+    std::vector<long> naf = find_wnaf(window_size, scalar);
+    std::vector<T> table(1ul<<(window_size-1));
+    T tmp = base;
+    T dbl = base.dbl();
+    for (size_t i = 0; i < 1ul<<(window_size-1); ++i)
+    {
+        table[i] = tmp;
+        tmp = tmp + dbl;
+    }
+
+    T res = T::zero();
+    bool found_nonzero = false;
+    for (long i = naf.size()-1; i >= 0; --i)
+    {
+        if (found_nonzero)
+        {
+            res = res.dbl();
+        }
+
+        if (naf[i] != 0)
+        {
+            found_nonzero = true;
+            if (naf[i] > 0)
+            {
+                res = res + table[naf[i]/2];
+            }
+            else
+            {
+                res = res - table[(-naf[i])/2];
+            }
+        }
+    }
+
+    return res;
+}
+
+template<typename T, mp_size_t n>
+T opt_window_wnaf_exp(const T &base, const bigint<n> &scalar, const size_t scalar_bits)
+{
+    size_t best = 0;
+    for (long i = T::wnaf_window_table.size() - 1; i >= 0; --i)
+    {
+        if (scalar_bits >= T::wnaf_window_table[i])
+        {
+            best = i+1;
+            break;
+        }
+    }
+
+    if (best > 0)
+    {
+        return fixed_window_wnaf_exp(best, base, scalar);
+    }
+    else
+    {
+        return scalar * base;
+    }
+}
+
+} // libff
+
+#endif // WNAF_TCC_
diff --git a/src/libff/libff/common/default_types/ec_pp.hpp b/src/libff/libff/common/default_types/ec_pp.hpp
new file mode 100755
index 000000000..d30de3ded
--- /dev/null
+++ b/src/libff/libff/common/default_types/ec_pp.hpp
@@ -0,0 +1,62 @@
+/** @file
+ *****************************************************************************
+
+ This file defines default_ec_pp based on the CURVE=... make flag, which selects
+ which elliptic curve is used to implement group arithmetic and pairings.
+
+ *****************************************************************************
+ * @author     This file is part of libff, developed by SCIPR Lab
+ *             and contributors (see AUTHORS).
+ * @copyright  MIT license (see LICENSE file)
+ *****************************************************************************/
+
+#ifndef EC_PP_HPP_
+#define EC_PP_HPP_
+
+/************************ Pick the elliptic curve ****************************/
+
+#ifdef CURVE_ALT_BN128
+#define LIBFF_DEFAULT_EC_PP_DEFINED
+#include <libff/algebra/curves/alt_bn128/alt_bn128_pp.hpp>
+namespace libff {
+typedef alt_bn128_pp default_ec_pp;
+} // libff
+#endif
+
+#ifdef CURVE_BN128
+#define LIBFF_DEFAULT_EC_PP_DEFINED
+#include <libff/algebra/curves/bn128/bn128_pp.hpp>
+namespace libff {
+typedef bn128_pp default_ec_pp;
+} // libff
+#endif
+
+#ifdef CURVE_EDWARDS
+#define LIBFF_DEFAULT_EC_PP_DEFINED
+#include <libff/algebra/curves/edwards/edwards_pp.hpp>
+namespace libff {
+typedef edwards_pp default_ec_pp;
+} // libff
+#endif
+
+#ifdef CURVE_MNT4
+#define LIBFF_DEFAULT_EC_PP_DEFINED
+#include <libff/algebra/curves/mnt/mnt4/mnt4_pp.hpp>
+namespace libff {
+typedef mnt4_pp default_ec_pp;
+} // libff
+#endif
+
+#ifdef CURVE_MNT6
+#define LIBFF_DEFAULT_EC_PP_DEFINED
+#include <libff/algebra/curves/mnt/mnt6/mnt6_pp.hpp>
+namespace libff {
+typedef mnt6_pp default_ec_pp;
+} // libff
+#endif
+
+#ifndef LIBFF_DEFAULT_EC_PP_DEFINED
+#error You must define one of the CURVE_* symbols to pick a curve for pairings.
+#endif
+
+#endif // EC_PP_HPP_
diff --git a/src/libff/libff/common/double.cpp b/src/libff/libff/common/double.cpp
new file mode 100755
index 000000000..6d9b93c0e
--- /dev/null
+++ b/src/libff/libff/common/double.cpp
@@ -0,0 +1,195 @@
+/** @file
+ *****************************************************************************
+
+ Implementation of complex domain data type.
+
+ *****************************************************************************
+ * @author     This file is part of libff, developed by SCIPR Lab
+ *             and contributors (see AUTHORS).
+ * @copyright  MIT license (see LICENSE file)
+ *****************************************************************************/
+
+#include <cmath>
+#include <complex>
+
+#include <math.h>
+
+#include <libff/algebra/fields/bigint.hpp>
+#include <libff/common/double.hpp>
+
+namespace libff {
+
+  const double PI = 3.141592653589793238460264338328L;
+
+  Double::Double()
+  {
+    val = std::complex<double>(0, 0);
+  }
+
+  Double::Double(double real)
+  {
+    val = std::complex<double>(real, 0);
+  }
+
+  Double::Double(double real, double imag)
+  {
+    val = std::complex<double>(real, imag);
+  }
+
+  Double::Double(std::complex<double> num)
+  {
+    val = num;
+  }
+
+  unsigned Double::add_cnt = 0;
+  unsigned Double::sub_cnt = 0;
+  unsigned Double::mul_cnt = 0;
+  unsigned Double::inv_cnt = 0;
+
+  Double Double::operator+(const Double &other) const
+  {
+#ifdef PROFILE_OP_COUNTS
+    ++add_cnt;
+#endif
+
+    return Double(val + other.val);
+  }
+
+  Double Double::operator-(const Double &other) const
+  {
+#ifdef PROFILE_OP_COUNTS
+    ++sub_cnt;
+#endif
+
+    return Double(val - other.val);
+  }
+
+  Double Double::operator*(const Double &other) const
+  {
+#ifdef PROFILE_OP_COUNTS
+    ++mul_cnt;
+#endif
+
+    return Double(val * other.val);
+  }
+
+  Double Double::operator-() const
+  {
+    if (val.imag() == 0) return Double(-val.real());
+
+    return Double(-val.real(), -val.imag());
+  }
+
+  Double& Double::operator+=(const Double &other)
+  {
+#ifdef PROFILE_OP_COUNTS
+    ++add_cnt;
+#endif
+
+    this->val = std::complex<double>(val + other.val);
+    return *this;
+  }
+
+  Double& Double::operator-=(const Double &other)
+  {
+#ifdef PROFILE_OP_COUNTS
+    ++sub_cnt;
+#endif
+
+    this->val = std::complex<double>(val - other.val);
+    return *this;
+  }
+
+  Double& Double::operator*=(const Double &other)
+  {
+#ifdef PROFILE_OP_COUNTS
+    ++mul_cnt;
+#endif
+
+    this->val *= std::complex<double>(other.val);
+    return *this;
+  }
+
+  bool Double::operator==(const Double &other) const
+  {
+    return (std::abs(val.real() - other.val.real()) < 0.000001)
+        && (std::abs(val.imag() - other.val.imag()) < 0.000001);
+  }
+
+  bool Double::operator!=(const Double &other) const
+  {
+    return Double(val) == other ? 0 : 1;
+  }
+
+  bool Double::operator<(const Double &other) const
+  {
+    return (val.real() < other.val.real());
+  }
+
+  bool Double::operator>(const Double &other) const
+  {
+    return (val.real() > other.val.real());
+  }
+
+  Double Double::operator^(const libff::bigint<1> power) const
+  {
+    return Double(pow(val, power.as_ulong()));
+  }
+
+  Double Double::operator^(const size_t power) const
+  {
+    return Double(pow(val, power));
+  }
+
+  Double Double::inverse() const
+  {
+#ifdef PROFILE_OP_COUNTS
+    ++inv_cnt;
+#endif
+
+    return Double(std::complex<double>(1) / val);
+  }
+
+  libff::bigint<1> Double::as_bigint() const
+  {
+    return libff::bigint<1>(val.real());
+  }
+
+  unsigned long Double::as_ulong() const
+  {
+    return round(val.real());
+  }
+
+  Double Double::squared() const
+  {
+    return Double(val * val);
+  }
+
+  Double Double::one()
+  {
+    return Double(1);
+  }
+
+  Double Double::zero()
+  {
+    return Double(0);
+  }
+
+  Double Double::random_element()
+  {
+    return Double(std::rand() % 1001);
+  }
+
+  Double Double::geometric_generator()
+  {
+    return Double(2);
+  }
+
+  Double Double::arithmetic_generator()
+  {
+    return Double(1);
+  }
+
+  Double Double::multiplicative_generator = Double(2);
+
+} // libff
diff --git a/src/libff/libff/common/double.hpp b/src/libff/libff/common/double.hpp
new file mode 100755
index 000000000..f74cead07
--- /dev/null
+++ b/src/libff/libff/common/double.hpp
@@ -0,0 +1,74 @@
+/** @file
+ *****************************************************************************
+
+ Declaration of complex domain data type.
+
+ *****************************************************************************
+ * @author     This file is part of libff, developed by SCIPR Lab
+ *             and contributors (see AUTHORS).
+ * @copyright  MIT license (see LICENSE file)
+ *****************************************************************************/
+
+#ifndef DOUBLE_HPP_
+#define DOUBLE_HPP_
+
+#include <complex>
+
+#include <libff/algebra/fields/bigint.hpp>
+
+namespace libff {
+
+  class Double 
+  {
+    public:
+      std::complex<double> val;
+
+      Double();
+
+      Double(double real);
+
+      Double(double real, double imag);
+
+      Double(std::complex<double> num);
+
+      static unsigned add_cnt;
+      static unsigned sub_cnt;
+      static unsigned mul_cnt;
+      static unsigned inv_cnt;
+
+      Double operator+(const Double &other) const;
+      Double operator-(const Double &other) const;
+      Double operator*(const Double &other) const;
+      Double operator-() const;
+
+      Double& operator+=(const Double &other);
+      Double& operator-=(const Double &other);
+      Double& operator*=(const Double &other);
+
+      bool operator==(const Double &other) const;
+      bool operator!=(const Double &other) const;
+
+      bool operator<(const Double &other) const;
+      bool operator>(const Double &other) const;
+
+      Double operator^(const libff::bigint<1> power) const;
+      Double operator^(const size_t power) const;
+
+      libff::bigint<1> as_bigint() const;
+      unsigned long as_ulong() const;
+      Double inverse() const;
+      Double squared() const;
+
+      static Double one();
+      static Double zero();
+      static Double random_element();
+      static Double geometric_generator();
+      static Double arithmetic_generator();
+
+      static Double multiplicative_generator;
+      static Double root_of_unity; // See get_root_of_unity() in field_utils
+      static size_t s;
+  };
+} // libff
+
+#endif // DOUBLE_HPP_
diff --git a/src/libff/libff/common/profiling.cpp b/src/libff/libff/common/profiling.cpp
new file mode 100755
index 000000000..f2a198583
--- /dev/null
+++ b/src/libff/libff/common/profiling.cpp
@@ -0,0 +1,384 @@
+/** @file
+ *****************************************************************************
+
+ Implementation of functions for profiling code blocks.
+
+ See profiling.hpp .
+
+ *****************************************************************************
+ * @author     This file is part of libff, developed by SCIPR Lab
+ *             and contributors (see AUTHORS).
+ * @copyright  MIT license (see LICENSE file)
+ *****************************************************************************/
+
+#include <cassert>
+#include <chrono>
+#include <cstdio>
+#include <ctime>
+#include <list>
+#include <stdexcept>
+#include <vector>
+
+#include <libff/common/default_types/ec_pp.hpp>
+#include <libff/common/profiling.hpp>
+#include <libff/common/utils.hpp>
+
+#ifndef NO_PROCPS
+#include <proc/readproc.h>
+#endif
+
+namespace libff {
+
+long long get_nsec_time()
+{
+    auto timepoint = std::chrono::high_resolution_clock::now();
+    return std::chrono::duration_cast<std::chrono::nanoseconds>(timepoint.time_since_epoch()).count();
+}
+
+/* Return total CPU time consumsed by all threads of the process, in nanoseconds. */
+long long get_nsec_cpu_time()
+{
+#if _MSC_VER
+	return 0;
+#else
+    ::timespec ts;
+    if ( ::clock_gettime(CLOCK_PROCESS_CPUTIME_ID, &ts) )
+        throw ::std::runtime_error("clock_gettime(CLOCK_PROCESS_CPUTIME_ID) failed");
+        // If we expected this to work, don't silently ignore failures, because that would hide the problem and incur an unnecessarily system-call overhead. So if we ever observe this exception, we should probably add a suitable #ifdef .
+        //TODO: clock_gettime(CLOCK_PROCESS_CPUTIME_ID) is not supported by native Windows. What about Cygwin? Should we #ifdef on CLOCK_PROCESS_CPUTIME_ID or on __linux__?
+    return ts.tv_sec * 1000000000ll + ts.tv_nsec;
+#endif
+}
+
+long long start_time, last_time;
+long long start_cpu_time, last_cpu_time;
+
+void start_profiling()
+{
+    printf("Reset time counters for profiling\n");
+
+    last_time = start_time = get_nsec_time();
+    last_cpu_time = start_cpu_time = get_nsec_cpu_time();
+}
+
+std::map<std::string, size_t> invocation_counts;
+std::map<std::string, long long> enter_times;
+std::map<std::string, long long> last_times;
+std::map<std::string, long long> cumulative_times;
+//TODO: Instead of analogous maps for time and cpu_time, use a single struct-valued map
+std::map<std::string, long long> enter_cpu_times;
+std::map<std::string, long long> last_cpu_times;
+std::map<std::pair<std::string, std::string>, long long> op_counts;
+std::map<std::pair<std::string, std::string>, long long> cumulative_op_counts; // ((msg, data_point), value)
+    // TODO: Convert op_counts and cumulative_op_counts from pair to structs
+size_t indentation = 0;
+
+std::vector<std::string> block_names;
+
+std::list<std::pair<std::string, long long*> > op_data_points = {
+#ifdef PROFILE_OP_COUNTS
+    std::make_pair("Fradd", &Fr<default_ec_pp>::add_cnt),
+    std::make_pair("Frsub", &Fr<default_ec_pp>::sub_cnt),
+    std::make_pair("Frmul", &Fr<default_ec_pp>::mul_cnt),
+    std::make_pair("Frinv", &Fr<default_ec_pp>::inv_cnt),
+    std::make_pair("Fqadd", &Fq<default_ec_pp>::add_cnt),
+    std::make_pair("Fqsub", &Fq<default_ec_pp>::sub_cnt),
+    std::make_pair("Fqmul", &Fq<default_ec_pp>::mul_cnt),
+    std::make_pair("Fqinv", &Fq<default_ec_pp>::inv_cnt),
+    std::make_pair("G1add", &G1<default_ec_pp>::add_cnt),
+    std::make_pair("G1dbl", &G1<default_ec_pp>::dbl_cnt),
+    std::make_pair("G2add", &G2<default_ec_pp>::add_cnt),
+    std::make_pair("G2dbl", &G2<default_ec_pp>::dbl_cnt)
+#endif
+};
+
+bool inhibit_profiling_info = false;
+bool inhibit_profiling_counters = false;
+
+void clear_profiling_counters()
+{
+    invocation_counts.clear();
+    last_times.clear();
+    last_cpu_times.clear();
+    cumulative_times.clear();
+}
+
+void print_cumulative_time_entry(const std::string &key, const long long factor)
+{
+    const double total_ms = (cumulative_times.at(key) * 1e-6);
+    const size_t cnt = invocation_counts.at(key);
+    const double avg_ms = total_ms / cnt;
+    printf("   %-45s: %12.5fms = %lld * %0.5fms (%zu invocations, %0.5fms = %lld * %0.5fms per invocation)\n", key.c_str(), total_ms, factor, total_ms/factor, cnt, avg_ms, factor, avg_ms/factor);
+}
+
+void print_cumulative_times(const long long factor)
+{
+    printf("Dumping times:\n");
+    for (auto& kv : cumulative_times)
+    {
+        print_cumulative_time_entry(kv.first, factor);
+    }
+}
+
+void print_cumulative_op_counts(const bool only_fq)
+{
+#ifdef PROFILE_OP_COUNTS
+    printf("Dumping operation counts:\n");
+    for (auto& msg : invocation_counts)
+    {
+        printf("  %-45s: ", msg.first.c_str());
+        bool first = true;
+        for (auto& data_point : op_data_points)
+        {
+            if (only_fq && data_point.first.compare(0, 2, "Fq") != 0)
+            {
+                continue;
+            }
+
+            if (!first)
+            {
+                printf(", ");
+            }
+            printf("%-5s = %7.0f (%3zu)",
+                   data_point.first.c_str(),
+                   1. * cumulative_op_counts[std::make_pair(msg.first, data_point.first)] / msg.second,
+                   msg.second);
+            first = false;
+        }
+        printf("\n");
+    }
+#else
+    UNUSED(only_fq);
+#endif
+}
+
+void print_op_profiling(const std::string &msg)
+{
+#ifdef PROFILE_OP_COUNTS
+    printf("\n");
+    print_indent();
+
+    printf("(opcounts) = (");
+    bool first = true;
+    for (std::pair<std::string, long long*> p : op_data_points)
+    {
+        if (!first)
+        {
+            printf(", ");
+        }
+
+        printf("%s=%lld", p.first.c_str(), *(p.second)-op_counts[std::make_pair(msg, p.first)]);
+        first = false;
+    }
+    printf(")");
+#else
+    UNUSED(msg);
+#endif
+}
+
+static void print_times_from_last_and_start(long long     now, long long     last,
+                                            long long cpu_now, long long cpu_last)
+{
+    long long time_from_start = now - start_time;
+    long long time_from_last = now - last;
+
+    long long cpu_time_from_start = cpu_now - start_cpu_time;
+    long long cpu_time_from_last = cpu_now - cpu_last;
+
+    if (time_from_last != 0) {
+        double parallelism_from_last = 1.0 * cpu_time_from_last / time_from_last;
+        printf("[%0.4fs x%0.2f]", time_from_last * 1e-9, parallelism_from_last);
+    } else {
+        printf("[             ]");
+    }
+    if (time_from_start != 0) {
+        double parallelism_from_start = 1.0 * cpu_time_from_start / time_from_start;
+        printf("\t(%0.4fs x%0.2f from start)", time_from_start * 1e-9, parallelism_from_start);
+    }
+}
+
+void print_time(const char* msg)
+{
+    if (inhibit_profiling_info)
+    {
+        return;
+    }
+
+    long long now = get_nsec_time();
+    long long cpu_now = get_nsec_cpu_time();
+
+    printf("%-35s\t", msg);
+    print_times_from_last_and_start(now, last_time, cpu_now, last_cpu_time);
+#ifdef PROFILE_OP_COUNTS
+    print_op_profiling(msg);
+#endif
+    printf("\n");
+
+    fflush(stdout);
+    last_time = now;
+    last_cpu_time = cpu_now;
+}
+
+void print_header(const char *msg)
+{
+    printf("\n================================================================================\n");
+    printf("%s\n", msg);
+    printf("================================================================================\n\n");
+}
+
+void print_indent()
+{
+    for (size_t i = 0; i < indentation; ++i)
+    {
+        printf("  ");
+    }
+}
+
+void op_profiling_enter(const std::string &msg)
+{
+    for (std::pair<std::string, long long*> p : op_data_points)
+    {
+        op_counts[std::make_pair(msg, p.first)] = *(p.second);
+    }
+}
+
+void enter_block(const std::string &msg, const bool indent)
+{
+    if (inhibit_profiling_counters)
+    {
+        return;
+    }
+
+    block_names.emplace_back(msg);
+    long long t = get_nsec_time();
+    enter_times[msg] = t;
+    long long cpu_t = get_nsec_cpu_time();
+    enter_cpu_times[msg] = cpu_t;
+
+    if (inhibit_profiling_info)
+    {
+        return;
+    }
+
+#ifdef MULTICORE
+#pragma omp critical
+#endif
+    {
+        op_profiling_enter(msg);
+
+        print_indent();
+        printf("(enter) %-35s\t", msg.c_str());
+        print_times_from_last_and_start(t, t, cpu_t, cpu_t);
+        printf("\n");
+        fflush(stdout);
+
+        if (indent)
+        {
+            ++indentation;
+        }
+    }
+}
+
+void leave_block(const std::string &msg, const bool indent)
+{
+    if (inhibit_profiling_counters)
+    {
+        return;
+    }
+
+#ifndef MULTICORE
+    assert(*(--block_names.end()) == msg);
+#endif
+    block_names.pop_back();
+
+    ++invocation_counts[msg];
+
+    long long t = get_nsec_time();
+    last_times[msg] = (t - enter_times[msg]);
+    cumulative_times[msg] += (t - enter_times[msg]);
+
+    long long cpu_t = get_nsec_cpu_time();
+    last_cpu_times[msg] = (cpu_t - enter_cpu_times[msg]);
+
+#ifdef PROFILE_OP_COUNTS
+    for (std::pair<std::string, long long*> p : op_data_points)
+    {
+        cumulative_op_counts[std::make_pair(msg, p.first)] += *(p.second)-op_counts[std::make_pair(msg, p.first)];
+    }
+#endif
+
+    if (inhibit_profiling_info)
+    {
+        return;
+    }
+
+#ifdef MULTICORE
+#pragma omp critical
+#endif
+    {
+        if (indent)
+        {
+            --indentation;
+        }
+
+        print_indent();
+        printf("(leave) %-35s\t", msg.c_str());
+        print_times_from_last_and_start(t, enter_times[msg], cpu_t, enter_cpu_times[msg]);
+        print_op_profiling(msg);
+        printf("\n");
+        fflush(stdout);
+    }
+}
+
+void print_mem(const std::string &s)
+{
+#ifndef NO_PROCPS
+    struct proc_t usage;
+    look_up_our_self(&usage);
+    if (s.empty())
+    {
+        printf("* Peak vsize (physical memory+swap) in mebibytes: %lu\n", usage.vsize >> 20);
+    }
+    else
+    {
+        printf("* Peak vsize (physical memory+swap) in mebibytes (%s): %lu\n", s.c_str(), usage.vsize >> 20);
+    }
+#else
+    printf("* Memory profiling not supported in NO_PROCPS mode\n");
+#endif
+}
+
+void print_compilation_info()
+{
+#ifdef __GNUC__
+    printf("g++ version: %s\n", __VERSION__);
+    printf("Compiled on %s %s\n", __DATE__, __TIME__);
+#endif
+#ifdef STATIC
+    printf("STATIC: yes\n");
+#else
+    printf("STATIC: no\n");
+#endif
+#ifdef MULTICORE
+    printf("MULTICORE: yes\n");
+#else
+    printf("MULTICORE: no\n");
+#endif
+#ifdef DEBUG
+    printf("DEBUG: yes\n");
+#else
+    printf("DEBUG: no\n");
+#endif
+#ifdef PROFILE_OP_COUNTS
+    printf("PROFILE_OP_COUNTS: yes\n");
+#else
+    printf("PROFILE_OP_COUNTS: no\n");
+#endif
+#ifdef _GLIBCXX_DEBUG
+    printf("_GLIBCXX_DEBUG: yes\n");
+#else
+    printf("_GLIBCXX_DEBUG: no\n");
+#endif
+}
+
+} // libff
diff --git a/src/libff/libff/common/profiling.hpp b/src/libff/libff/common/profiling.hpp
new file mode 100755
index 000000000..c298da756
--- /dev/null
+++ b/src/libff/libff/common/profiling.hpp
@@ -0,0 +1,51 @@
+/** @file
+ *****************************************************************************
+
+ Declaration of functions for profiling code blocks.
+
+ Reports time, operation counts, memory usage, and others.
+
+ *****************************************************************************
+ * @author     This file is part of libff, developed by SCIPR Lab
+ *             and contributors (see AUTHORS).
+ * @copyright  MIT license (see LICENSE file)
+ *****************************************************************************/
+
+#ifndef PROFILING_HPP_
+#define PROFILING_HPP_
+
+#include <cstddef>
+#include <map>
+#include <string>
+#include <vector>
+
+namespace libff {
+
+void start_profiling();
+long long get_nsec_time();
+void print_time(const char* msg);
+void print_header(const char* msg);
+
+void print_indent();
+
+extern bool inhibit_profiling_info;
+extern bool inhibit_profiling_counters;
+extern std::map<std::string, size_t> invocation_counts;
+extern std::map<std::string, long long> last_times;
+extern std::map<std::string, long long> cumulative_times;
+
+void clear_profiling_counters();
+
+void print_cumulative_time_entry(const std::string &key, const long long factor=1);
+void print_cumulative_times(const long long factor=1);
+void print_cumulative_op_counts(const bool only_fq=false);
+
+void enter_block(const std::string &msg, const bool indent=true);
+void leave_block(const std::string &msg, const bool indent=true);
+
+void print_mem(const std::string &s = "");
+void print_compilation_info();
+
+} // libff
+
+#endif // PROFILING_HPP_
diff --git a/src/libff/libff/common/rng.hpp b/src/libff/libff/common/rng.hpp
new file mode 100755
index 000000000..c5b312042
--- /dev/null
+++ b/src/libff/libff/common/rng.hpp
@@ -0,0 +1,26 @@
+/** @file
+ *****************************************************************************
+
+ Declaration of functions for generating randomness.
+
+ *****************************************************************************
+ * @author     This file is part of libff, developed by SCIPR Lab
+ *             and contributors (see AUTHORS).
+ * @copyright  MIT license (see LICENSE file)
+ *****************************************************************************/
+
+#ifndef RNG_HPP_
+#define RNG_HPP_
+
+#include <cstdint>
+
+namespace libff {
+
+template<typename FieldT>
+FieldT SHA512_rng(const uint64_t idx);
+
+} // libff
+
+#include <libff/common/rng.tcc>
+
+#endif // RNG_HPP_
diff --git a/src/libff/libff/common/rng.tcc b/src/libff/libff/common/rng.tcc
new file mode 100755
index 000000000..92eecea1d
--- /dev/null
+++ b/src/libff/libff/common/rng.tcc
@@ -0,0 +1,76 @@
+/** @file
+ *****************************************************************************
+
+ Implementation of functions for generating randomness.
+
+ See rng.hpp .
+
+ *****************************************************************************
+ * @author     This file is part of libff, developed by SCIPR Lab
+ *             and contributors (see AUTHORS).
+ * @copyright  MIT license (see LICENSE file)
+ *****************************************************************************/
+
+#ifndef RNG_TCC_
+#define RNG_TCC_
+
+#include <gmp.h>
+#include <openssl/sha.h>
+
+#include <libff/algebra/fields/bigint.hpp>
+#include <libff/common/rng.hpp>
+#include <libff/common/utils.hpp>
+
+namespace libff {
+
+template<typename FieldT>
+FieldT SHA512_rng(const uint64_t idx)
+{
+    assert(GMP_NUMB_BITS == 64); // current Python code cannot handle larger values, so testing here for some assumptions.
+    assert(is_little_endian());
+
+    assert(FieldT::size_in_bits() <= SHA512_DIGEST_LENGTH * 8);
+
+    bigint<FieldT::num_limbs> rval;
+    uint64_t iter = 0;
+    do
+    {
+        mp_limb_t hash[((SHA512_DIGEST_LENGTH*8) + GMP_NUMB_BITS - 1)/GMP_NUMB_BITS];
+
+        SHA512_CTX sha512;
+        SHA512_Init(&sha512);
+        SHA512_Update(&sha512, &idx, sizeof(idx));
+        SHA512_Update(&sha512, &iter, sizeof(iter));
+        SHA512_Final((unsigned char*)hash, &sha512);
+
+        for (mp_size_t i = 0; i < FieldT::num_limbs; ++i)
+        {
+            rval.data[i] = hash[i];
+        }
+
+        /* clear all bits higher than MSB of modulus */
+        size_t bitno = GMP_NUMB_BITS * FieldT::num_limbs - 1;
+
+        /* mod is non-zero so the loop will always terminate */
+        while (FieldT::mod.test_bit(bitno) == false)
+        {
+            const std::size_t part = bitno/GMP_NUMB_BITS;
+            const std::size_t bit = bitno - (GMP_NUMB_BITS*part);
+
+            rval.data[part] &= ~(1ul<<bit);
+
+            bitno--;
+        }
+
+        ++iter;
+    }
+
+    /* if r.data is still >= modulus -- repeat (rejection sampling) */
+    while (mpn_cmp(rval.data, FieldT::mod.data, FieldT::num_limbs) >= 0);
+
+    return FieldT(rval);
+}
+
+} // libff
+
+#endif // RNG_TCC_
diff --git a/src/libff/libff/common/serialization.hpp b/src/libff/libff/common/serialization.hpp
new file mode 100755
index 000000000..e811555e1
--- /dev/null
+++ b/src/libff/libff/common/serialization.hpp
@@ -0,0 +1,106 @@
+/** @file
+ *****************************************************************************
+
+ Declaration of serialization routines and constants.
+
+ *****************************************************************************
+ * @author     This file is part of libff, developed by SCIPR Lab
+ *             and contributors (see AUTHORS).
+ * @copyright  MIT license (see LICENSE file)
+ *****************************************************************************/
+
+#ifndef SERIALIZATION_HPP_
+#define SERIALIZATION_HPP_
+
+#include <istream>
+#include <map>
+#include <ostream>
+#include <set>
+#include <vector>
+
+namespace libff {
+
+/*
+ * @todo
+ * The serialization is fragile. Shoud be rewritten using a standard, portable-format
+ * library like boost::serialize.
+ *
+ * However, for now the following conventions are used within the code.
+ *
+ * All algebraic objects support either binary or decimal output using
+ * the standard C++ stream operators (operator<<, operator>>).
+ *
+ * The binary mode is activated by defining a BINARY_OUTPUT
+ * preprocessor macro (e.g. g++ -DBINARY_OUTPUT ...).
+ *
+ * Binary output assumes that the stream is to be binary read at its
+ * current position so any white space should be consumed beforehand.
+ *
+ * Consecutive algebraic objects are separated by OUTPUT_NEWLINE and
+ * within themselves (e.g. X and Y coordinates for field elements) with
+ * OUTPUT_SEPARATOR (as defined below).
+ *
+ * Therefore to dump two integers, two Fp elements and another integer
+ * one would:
+ *
+ * out << 3 << "\n";
+ * out << 4 << "\n";
+ * out << FieldT(56) << OUTPUT_NEWLINE;
+ * out << FieldT(78) << OUTPUT_NEWLINE;
+ * out << 9 << "\n";
+ *
+ * Then reading back it its reader's responsibility (!) to consume "\n"
+ * after 4, but Fp::operator<< will correctly consume OUTPUT_NEWLINE.
+ *
+ * The reader should also consume "\n" after 9, so that another field
+ * element can be properly chained. This is especially important for
+ * binary output.
+ *
+ * The binary serialization of algebraic objects is currently *not*
+ * portable between machines of different word sizes.
+ */
+
+#ifdef BINARY_OUTPUT
+#define OUTPUT_NEWLINE ""
+#define OUTPUT_SEPARATOR ""
+#else
+#define OUTPUT_NEWLINE "\n"
+#define OUTPUT_SEPARATOR " "
+#endif
+
+inline void consume_newline(std::istream &in);
+inline void consume_OUTPUT_NEWLINE(std::istream &in);
+inline void consume_OUTPUT_SEPARATOR(std::istream &in);
+
+inline void output_bool(std::ostream &out, const bool b);
+inline void input_bool(std::istream &in, bool &b);
+
+inline void output_bool_vector(std::ostream &out, const std::vector<bool> &v);
+inline void input_bool_vector(std::istream &in, std::vector<bool> &v);
+
+template<typename T>
+T reserialize(const T &obj);
+
+template<typename T>
+std::ostream& operator<<(std::ostream& out, const std::vector<T> &v);
+
+template<typename T>
+std::istream& operator>>(std::ostream& out, std::vector<T> &v);
+
+template<typename T1, typename T2>
+std::ostream& operator<<(std::ostream& out, const std::map<T1, T2> &m);
+
+template<typename T1, typename T2>
+std::istream& operator>>(std::istream& in, std::map<T1, T2> &m);
+
+template<typename T>
+std::ostream& operator<<(std::ostream& out, const std::set<T> &s);
+
+template<typename T>
+std::istream& operator>>(std::istream& in, std::set<T> &s);
+
+} // libff
+
+#include <libff/common/serialization.tcc>
+
+#endif // SERIALIZATION_HPP_
diff --git a/src/libff/libff/common/serialization.tcc b/src/libff/libff/common/serialization.tcc
new file mode 100755
index 000000000..71ce32bef
--- /dev/null
+++ b/src/libff/libff/common/serialization.tcc
@@ -0,0 +1,205 @@
+/** @file
+ *****************************************************************************
+
+ Implementation of serialization routines.
+
+ See serialization.hpp .
+
+ *****************************************************************************
+ * @author     This file is part of libff, developed by SCIPR Lab
+ *             and contributors (see AUTHORS).
+ * @copyright  MIT license (see LICENSE file)
+ *****************************************************************************/
+
+#ifndef SERIALIZATION_TCC_
+#define SERIALIZATION_TCC_
+
+#include <cassert>
+#include <sstream>
+
+#include <libff/common/utils.hpp>
+
+namespace libff {
+
+inline void consume_newline(std::istream &in)
+{
+    char c;
+    in.read(&c, 1);
+}
+
+inline void consume_OUTPUT_NEWLINE(std::istream &in)
+{
+#ifdef BINARY_OUTPUT
+    // nothing to consume
+    UNUSED(in);
+#else
+    char c;
+    in.read(&c, 1);
+#endif
+}
+
+inline void consume_OUTPUT_SEPARATOR(std::istream &in)
+{
+#ifdef BINARY_OUTPUT
+    // nothing to consume
+    UNUSED(in);
+#else
+    char c;
+    in.read(&c, 1);
+#endif
+}
+
+inline void output_bool(std::ostream &out, const bool b)
+{
+    out << (b ? 1 : 0) << "\n";
+}
+
+inline void input_bool(std::istream &in, bool &b)
+{
+    size_t tmp;
+    in >> tmp;
+    consume_newline(in);
+    assert(tmp == 0 || tmp == 1);
+
+    b = (tmp == 1 ? true : false);
+}
+
+inline void output_bool_vector(std::ostream &out, const std::vector<bool> &v)
+{
+    out << v.size() << "\n";
+    for (const bool b : v)
+    {
+        output_bool(out, b);
+    }
+}
+
+inline void input_bool_vector(std::istream &in, std::vector<bool> &v)
+{
+    size_t size;
+    in >> size;
+    consume_newline(in);
+    v.resize(size);
+    for (size_t i = 0; i < size; ++i)
+    {
+        bool b;
+        input_bool(in, b);
+        v[i] = b;
+    }
+}
+
+template<typename T>
+T reserialize(const T &obj)
+{
+    std::stringstream ss;
+    ss << obj;
+    T tmp;
+    ss >> tmp;
+    assert(obj == tmp);
+    return tmp;
+}
+
+template<typename T>
+std::ostream& operator<<(std::ostream& out, const std::vector<T> &v)
+{
+    static_assert(!std::is_same<T, bool>::value, "this does not work for std::vector<bool>");
+    out << v.size() << "\n";
+    for (const T& t : v)
+    {
+        out << t << OUTPUT_NEWLINE;
+    }
+
+    return out;
+}
+
+template<typename T>
+std::istream& operator>>(std::istream& in, std::vector<T> &v)
+{
+    static_assert(!std::is_same<T, bool>::value, "this does not work for std::vector<bool>");
+    size_t size;
+    in >> size;
+    consume_newline(in);
+
+    v.resize(0);
+    for (size_t i = 0; i < size; ++i)
+    {
+        T elt;
+        in >> elt;
+        consume_OUTPUT_NEWLINE(in);
+        v.push_back(elt);
+    }
+
+    return in;
+}
+
+template<typename T1, typename T2>
+std::ostream& operator<<(std::ostream& out, const std::map<T1, T2> &m)
+{
+    out << m.size() << "\n";
+
+    for (auto &it : m)
+    {
+        out << it.first << "\n";
+        out << it.second << "\n";
+    }
+
+    return out;
+}
+
+template<typename T1, typename T2>
+std::istream& operator>>(std::istream& in, std::map<T1, T2> &m)
+{
+    m.clear();
+    size_t size;
+    in >> size;
+    consume_newline(in);
+
+    for (size_t i = 0; i < size; ++i)
+    {
+        T1 k;
+        T2 v;
+        in >> k;
+        consume_newline(in);
+        in >> v;
+        consume_newline(in);
+        m[k] = v;
+    }
+
+    return in;
+}
+
+template<typename T>
+std::ostream& operator<<(std::ostream& out, const std::set<T> &s)
+{
+    out << s.size() << "\n";
+
+    for (auto &el : s)
+    {
+        out << el << "\n";
+    }
+
+    return out;
+}
+
+
+template<typename T>
+std::istream& operator>>(std::istream& in, std::set<T> &s)
+{
+    s.clear();
+    size_t size;
+    in >> size;
+    consume_newline(in);
+
+    for (size_t i = 0; i < size; ++i)
+    {
+        T el;
+        in >> el;
+        consume_newline(in);
+        s.insert(el);
+    }
+
+    return in;
+}
+
+}
+
+#endif // SERIALIZATION_TCC_
diff --git a/src/libff/libff/common/template_utils.hpp b/src/libff/libff/common/template_utils.hpp
new file mode 100755
index 000000000..6805c678e
--- /dev/null
+++ b/src/libff/libff/common/template_utils.hpp
@@ -0,0 +1,26 @@
+/** @file
+ *****************************************************************************
+
+ Declaration of functions for supporting the use of templates.
+
+ *****************************************************************************
+ * @author     This file is part of libff, developed by SCIPR Lab
+ *             and contributors (see AUTHORS).
+ * @copyright  MIT license (see LICENSE file)
+ *****************************************************************************/
+
+#ifndef TEMPLATE_UTILS_HPP_
+#define TEMPLATE_UTILS_HPP_
+
+namespace libff {
+
+/* A commonly used SFINAE helper type */
+template<typename T>
+struct void_type
+{
+    typedef void type;
+};
+
+} // libff
+
+#endif // TEMPLATE_UTILS_HPP_
diff --git a/src/libff/libff/common/utils.cpp b/src/libff/libff/common/utils.cpp
new file mode 100755
index 000000000..38d230c14
--- /dev/null
+++ b/src/libff/libff/common/utils.cpp
@@ -0,0 +1,129 @@
+/** @file
+ *****************************************************************************
+ Implementation of misc math and serialization utility functions
+ *****************************************************************************
+ * @author     This file is part of libff, developed by SCIPR Lab
+ *             and contributors (see AUTHORS).
+ * @copyright  MIT license (see LICENSE file)
+ *****************************************************************************/
+
+#include <algorithm>
+#include <cassert>
+#include <cstdarg>
+#include <cstdint>
+
+#include <libff/common/utils.hpp>
+
+namespace libff {
+
+size_t get_power_of_two(size_t n)
+{
+    n--;
+    n |= n >> 1;
+    n |= n >> 2;
+    n |= n >> 4;
+    n |= n >> 8;
+    n |= n >> 16;
+    n++;
+
+    return n;
+}
+
+size_t log2(size_t n)
+/* returns ceil(log2(n)), so 1ul<<log2(n) is the smallest power of 2,
+   that is not less than n. */
+{
+    size_t r = ((n & (n-1)) == 0 ? 0 : 1); // add 1 if n is not power of 2
+
+    while (n > 1)
+    {
+        n >>= 1;
+        r++;
+    }
+
+    return r;
+}
+
+size_t to_twos_complement(int i, size_t w)
+{
+    assert(i >= -(1l<<(w-1)));
+    assert(i < (1l<<(w-1)));
+    return (i >= 0) ? i : i + (1l<<w);
+}
+
+int from_twos_complement(size_t i, size_t w)
+{
+    assert(i < (1ul<<w));
+    return (i < (1ul<<(w-1))) ? i : i - (1ul<<w);
+}
+
+size_t bitreverse(size_t n, const size_t l)
+{
+    size_t r = 0;
+    for (size_t k = 0; k < l; ++k)
+    {
+        r = (r << 1) | (n & 1);
+        n >>= 1;
+    }
+    return r;
+}
+
+bit_vector int_list_to_bits(const std::initializer_list<unsigned long> &l, const size_t wordsize)
+{
+    bit_vector res(wordsize*l.size());
+    for (size_t i = 0; i < l.size(); ++i)
+    {
+        for (size_t j = 0; j < wordsize; ++j)
+        {
+            res[i*wordsize + j] = (*(l.begin()+i) & (1ul<<(wordsize-1-j)));
+        }
+    }
+    return res;
+}
+
+long long div_ceil(long long x, long long y)
+{
+    return (x + (y-1)) / y;
+}
+
+bool is_little_endian()
+{
+    uint64_t a = 0x12345678;
+    unsigned char *c = (unsigned char*)(&a);
+    return (*c = 0x78);
+}
+
+std::string FORMAT(const std::string &prefix, const char* format, ...)
+{
+    const static size_t MAX_FMT = 256;
+    char buf[MAX_FMT];
+    va_list args;
+    va_start(args, format);
+    vsnprintf(buf, MAX_FMT, format, args);
+    va_end(args);
+
+    return prefix + std::string(buf);
+}
+
+void serialize_bit_vector(std::ostream &out, const bit_vector &v)
+{
+    out << v.size() << "\n";
+    for (size_t i = 0; i < v.size(); ++i)
+    {
+        out << v[i] << "\n";
+    }
+}
+
+void deserialize_bit_vector(std::istream &in, bit_vector &v)
+{
+    size_t size;
+    in >> size;
+    v.resize(size);
+    for (size_t i = 0; i < size; ++i)
+    {
+        bool b;
+        in >> b;
+        v[i] = b;
+    }
+}
+} // libff
diff --git a/src/libff/libff/common/utils.hpp b/src/libff/libff/common/utils.hpp
new file mode 100755
index 000000000..dc77547e9
--- /dev/null
+++ b/src/libff/libff/common/utils.hpp
@@ -0,0 +1,62 @@
+/** @file
+ *****************************************************************************
+ Declaration of misc math and serialization utility functions
+ *****************************************************************************
+ * @author     This file is part of libff, developed by SCIPR Lab
+ *             and contributors (see AUTHORS).
+ * @copyright  MIT license (see LICENSE file)
+ *****************************************************************************/
+
+#ifndef UTILS_HPP_
+#define UTILS_HPP_
+
+#include <cassert>
+#include <iostream>
+#include <sstream>
+#include <string>
+#include <vector>
+
+namespace libff {
+
+typedef std::vector<bool> bit_vector;
+
+size_t get_power_of_two(size_t n);
+
+/// returns ceil(log2(n)), so 1ul<<log2(n) is the smallest power of 2, that is not less than n
+size_t log2(size_t n);
+
+inline size_t exp2(size_t k) { return size_t(1) << k; }
+
+size_t to_twos_complement(int i, size_t w);
+int from_twos_complement(size_t i, size_t w);
+
+size_t bitreverse(size_t n, const size_t l);
+bit_vector int_list_to_bits(const std::initializer_list<unsigned long> &l, const size_t wordsize);
+long long div_ceil(long long x, long long y);
+
+bool is_little_endian();
+
+std::string FORMAT(const std::string &prefix, const char* format, ...);
+
+/* A variadic template to suppress unused argument warnings */
+template<typename ... Types>
+void UNUSED(Types&&...) {}
+
+#ifdef DEBUG
+#define FMT libff::FORMAT
+#else
+#define FMT(...) (libff::UNUSED(__VA_ARGS__), "")
+#endif
+
+void serialize_bit_vector(std::ostream &out, const bit_vector &v);
+void deserialize_bit_vector(std::istream &in, bit_vector &v);
+
+template<typename T>
+size_t size_in_bits(const std::vector<T> &v);
+
+#define ARRAY_SIZE(arr) (sizeof(arr)/sizeof(arr[0]))
+
+} // libff
+
+#include <libff/common/utils.tcc> /* note that utils has a templatized part (utils.tcc) and non-templatized part (utils.cpp) */
+#endif // UTILS_HPP_
diff --git a/src/libff/libff/common/utils.tcc b/src/libff/libff/common/utils.tcc
new file mode 100755
index 000000000..1b10dca60
--- /dev/null
+++ b/src/libff/libff/common/utils.tcc
@@ -0,0 +1,23 @@
+/** @file
+ *****************************************************************************
+ Implementation of templatized utility functions
+ *****************************************************************************
+ * @author     This file is part of libff, developed by SCIPR Lab
+ *             and contributors (see AUTHORS).
+ * @copyright  MIT license (see LICENSE file)
+ *****************************************************************************/
+
+#ifndef UTILS_TCC_
+#define UTILS_TCC_
+
+namespace libff {
+
+template<typename T>
+size_t size_in_bits(const std::vector<T> &v)
+{
+    return v.size() * T::size_in_bits();
+}
+
+} // libff
+
+#endif // UTILS_TCC_

From c49b94e5f668b29ccfc53aec81c22e248516d1b5 Mon Sep 17 00:00:00 2001
From: Time Markov <time.markov@qtum.com>
Date: Mon, 14 Jan 2019 13:26:47 +0100
Subject: [PATCH 010/153] Update DGP scheadule

---
 src/qtum/qtumDGP.cpp | 52 +++++++++++++++++++++++++++-----------------
 src/qtum/qtumDGP.h   |  8 +++----
 2 files changed, 36 insertions(+), 24 deletions(-)

diff --git a/src/qtum/qtumDGP.cpp b/src/qtum/qtumDGP.cpp
index 8a7229c65..aff9fb3aa 100644
--- a/src/qtum/qtumDGP.cpp
+++ b/src/qtum/qtumDGP.cpp
@@ -1,20 +1,31 @@
 #include <qtum/qtumDGP.h>
 
-void QtumDGP::initDataEIP158(){
-    std::vector<uint32_t> tempData = {dev::eth::EIP158Schedule.tierStepGas[0], dev::eth::EIP158Schedule.tierStepGas[1], dev::eth::EIP158Schedule.tierStepGas[2],
-                                      dev::eth::EIP158Schedule.tierStepGas[3], dev::eth::EIP158Schedule.tierStepGas[4], dev::eth::EIP158Schedule.tierStepGas[5],
-                                      dev::eth::EIP158Schedule.tierStepGas[6], dev::eth::EIP158Schedule.tierStepGas[7], dev::eth::EIP158Schedule.expGas,
-                                      dev::eth::EIP158Schedule.expByteGas, dev::eth::EIP158Schedule.sha3Gas, dev::eth::EIP158Schedule.sha3WordGas,
-                                      dev::eth::EIP158Schedule.sloadGas, dev::eth::EIP158Schedule.sstoreSetGas, dev::eth::EIP158Schedule.sstoreResetGas,
-                                      dev::eth::EIP158Schedule.sstoreRefundGas, dev::eth::EIP158Schedule.jumpdestGas, dev::eth::EIP158Schedule.logGas,
-                                      dev::eth::EIP158Schedule.logDataGas, dev::eth::EIP158Schedule.logTopicGas, dev::eth::EIP158Schedule.createGas,
-                                      dev::eth::EIP158Schedule.callGas, dev::eth::EIP158Schedule.callStipend, dev::eth::EIP158Schedule.callValueTransferGas,
-                                      dev::eth::EIP158Schedule.callNewAccountGas, dev::eth::EIP158Schedule.suicideRefundGas, dev::eth::EIP158Schedule.memoryGas,
-                                      dev::eth::EIP158Schedule.quadCoeffDiv, dev::eth::EIP158Schedule.createDataGas, dev::eth::EIP158Schedule.txGas,
-                                      dev::eth::EIP158Schedule.txCreateGas, dev::eth::EIP158Schedule.txDataZeroGas, dev::eth::EIP158Schedule.txDataNonZeroGas,
-                                      dev::eth::EIP158Schedule.copyGas, dev::eth::EIP158Schedule.extcodesizeGas, dev::eth::EIP158Schedule.extcodecopyGas,
-                                      dev::eth::EIP158Schedule.balanceGas, dev::eth::EIP158Schedule.suicideGas, dev::eth::EIP158Schedule.maxCodeSize};
-    dataEIP158Schedule = tempData;
+std::vector<uint32_t> createDataSchedule(const dev::eth::EVMSchedule& schedule)
+{
+    std::vector<uint32_t> tempData = {schedule.tierStepGas[0], schedule.tierStepGas[1], schedule.tierStepGas[2],
+                                      schedule.tierStepGas[3], schedule.tierStepGas[4], schedule.tierStepGas[5],
+                                      schedule.tierStepGas[6], schedule.tierStepGas[7], schedule.expGas,
+                                      schedule.expByteGas, schedule.sha3Gas, schedule.sha3WordGas,
+                                      schedule.sloadGas, schedule.sstoreSetGas, schedule.sstoreResetGas,
+                                      schedule.sstoreRefundGas, schedule.jumpdestGas, schedule.logGas,
+                                      schedule.logDataGas, schedule.logTopicGas, schedule.createGas,
+                                      schedule.callGas, schedule.callStipend, schedule.callValueTransferGas,
+                                      schedule.callNewAccountGas, schedule.suicideRefundGas, schedule.memoryGas,
+                                      schedule.quadCoeffDiv, schedule.createDataGas, schedule.txGas,
+                                      schedule.txCreateGas, schedule.txDataZeroGas, schedule.txDataNonZeroGas,
+                                      schedule.copyGas, schedule.extcodesizeGas, schedule.extcodecopyGas,
+                                      schedule.balanceGas, schedule.suicideGas, schedule.maxCodeSize};
+    return tempData;
+}
+
+std::vector<uint32_t> const& scheduleDataForBlockNumber(unsigned int blockHeight)
+{
+    const dev::eth::EVMSchedule& schedule = globalSealEngine->chainParams().scheduleForBlockNumber(blockHeight);
+    return createDataSchedule(schedule);
+}
+
+void QtumDGP::initDataSchedule(){
+    dataSchedule = scheduleDataForBlockNumber(0);
 }
 
 bool QtumDGP::checkLimitSchedule(const std::vector<uint32_t>& defaultData, const std::vector<uint32_t>& checkData){
@@ -33,9 +44,10 @@ bool QtumDGP::checkLimitSchedule(const std::vector<uint32_t>& defaultData, const
 
 dev::eth::EVMSchedule QtumDGP::getGasSchedule(unsigned int blockHeight){
     clear();
-    dev::eth::EVMSchedule schedule = dev::eth::EIP158Schedule;
+    dataSchedule = scheduleDataForBlockNumber(blockHeight);
+    dev::eth::EVMSchedule schedule = globalSealEngine->chainParams().scheduleForBlockNumber(blockHeight);
     if(initStorages(GasScheduleDGP, blockHeight, ParseHex("26fadbe2"))){
-        schedule = createEVMSchedule();
+        schedule = createEVMSchedule(schedule);
     }
     return schedule;
 }
@@ -184,8 +196,8 @@ void QtumDGP::parseDataOneUint64(uint64_t& value){
     }
 }
 
-dev::eth::EVMSchedule QtumDGP::createEVMSchedule(){
-    dev::eth::EVMSchedule schedule = dev::eth::EIP158Schedule;
+dev::eth::EVMSchedule QtumDGP::createEVMSchedule(const dev::eth::EVMSchedule &_schedule){
+    dev::eth::EVMSchedule schedule = _schedule;
     std::vector<uint32_t> uint32Values;
 
     if(!dgpevm){
@@ -194,7 +206,7 @@ dev::eth::EVMSchedule QtumDGP::createEVMSchedule(){
         parseDataScheduleContract(uint32Values);
     }
 
-    if(!checkLimitSchedule(dataEIP158Schedule, uint32Values))
+    if(!checkLimitSchedule(dataSchedule, uint32Values))
         return schedule;
 
     if(uint32Values.size() >= 39){
diff --git a/src/qtum/qtumDGP.h b/src/qtum/qtumDGP.h
index 19fafd325..cf062a4e7 100644
--- a/src/qtum/qtumDGP.h
+++ b/src/qtum/qtumDGP.h
@@ -28,7 +28,7 @@ class QtumDGP {
     
 public:
 
-    QtumDGP(QtumState* _state, bool _dgpevm = true) : dgpevm(_dgpevm), state(_state) { initDataEIP158(); }
+    QtumDGP(QtumState* _state, bool _dgpevm = true) : dgpevm(_dgpevm), state(_state) { initDataSchedule(); }
 
     dev::eth::EVMSchedule getGasSchedule(unsigned int blockHeight);
 
@@ -48,7 +48,7 @@ class QtumDGP {
 
     void initDataTemplate(const dev::Address& addr, std::vector<unsigned char>& data);
 
-    void initDataEIP158();
+    void initDataSchedule();
 
     bool checkLimitSchedule(const std::vector<uint32_t>& defaultData, const std::vector<uint32_t>& checkData);
 
@@ -66,7 +66,7 @@ class QtumDGP {
 
     void parseDataOneUint64(uint64_t& value);
 
-    dev::eth::EVMSchedule createEVMSchedule();
+    dev::eth::EVMSchedule createEVMSchedule(const dev::eth::EVMSchedule& schedule);
 
     void clear();    
 
@@ -86,7 +86,7 @@ class QtumDGP {
 
     std::vector<std::pair<unsigned int, dev::Address>> paramsInstance;
 
-    std::vector<uint32_t> dataEIP158Schedule;
+    std::vector<uint32_t> dataSchedule;
 
 };
 #endif

From d08e5ec4eaf153668893f15c4e159b01886043d7 Mon Sep 17 00:00:00 2001
From: Time Markov <time.markov@qtum.com>
Date: Tue, 15 Jan 2019 09:31:49 +0100
Subject: [PATCH 011/153] Add QIP 7 block height parameter

---
 src/chainparams.cpp              | 10 ++++++++++
 src/chainparams.h                |  3 +++
 src/consensus/params.h           |  2 ++
 src/init.cpp                     |  2 +-
 src/qtum/qtumDGP.cpp             |  4 ++--
 src/test/qtumtests/dgp_tests.cpp |  4 +++-
 src/test/test_bitcoin.cpp        |  2 +-
 src/util.cpp                     | 25 +++++++++++++++++++++++++
 src/util.h                       |  2 ++
 9 files changed, 49 insertions(+), 5 deletions(-)

diff --git a/src/chainparams.cpp b/src/chainparams.cpp
index ace59a2a4..7b6d579f3 100644
--- a/src/chainparams.cpp
+++ b/src/chainparams.cpp
@@ -89,6 +89,7 @@ class CMainParams : public CChainParams {
         consensus.BIP34Hash = uint256S("0x000075aef83cf2853580f8ae8ce6f8c3096cfa21d98334d6e3f95e5582ed986c");
         consensus.BIP65Height = 0; // 000000000000000004c2b624ed5d7756c508d90fd0da2c7c679febfa6c4735f0
         consensus.BIP66Height = 0; // 00000000000000000379eaa19dce8c9b722d46ae6a57c2f1a988119488b50931
+        consensus.QIP7Height = 0x7fffffff;
         consensus.powLimit = uint256S("0000ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff");
         consensus.posLimit = uint256S("00000000ffffffffffffffffffffffffffffffffffffffffffffffffffffffff");
         consensus.nPowTargetTimespan = 16 * 60; // 16 minutes
@@ -203,6 +204,7 @@ class CTestNetParams : public CChainParams {
         consensus.BIP34Hash = uint256S("0x0000e803ee215c0684ca0d2f9220594d3f828617972aad66feb2ba51f5e14222");
         consensus.BIP65Height = 0; // 00000000007f6655f22f98e72ed80d8b06dc761d5da09df0fa1dc4be4f861eb6
         consensus.BIP66Height = 0; // 000000002104c8c45e99a8853285a3b592602a3ccde2b832481da85e9e4ba182
+        consensus.QIP7Height = 0x7fffffff;
         consensus.powLimit = uint256S("0000ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff");
         consensus.posLimit = uint256S("0000ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff");
         consensus.nPowTargetTimespan = 16 * 60; // 16 minutes
@@ -306,6 +308,7 @@ class CRegTestParams : public CChainParams {
         consensus.BIP34Hash = uint256S("0x665ed5b402ac0b44efc37d8926332994363e8a7278b7ee9a58fb972efadae943");
         consensus.BIP65Height = 0; // BIP65 activated on regtest (Used in rpc activation tests)
         consensus.BIP66Height = 0; // BIP66 activated on regtest (Used in rpc activation tests)
+        consensus.QIP7Height = 0x7fffffff;
         consensus.powLimit = uint256S("7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff");
         consensus.posLimit = uint256S("7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff");
         consensus.nPowTargetTimespan = 16 * 60; // 16 minutes
@@ -432,3 +435,10 @@ void UpdateVersionBitsParameters(Consensus::DeploymentPos d, int64_t nStartTime,
 {
     globalChainParams->UpdateVersionBitsParameters(d, nStartTime, nTimeout);
 }
+
+std::string CChainParams::EVMGenesisInfo(dev::eth::Network network) const
+{
+    std::string genesisInfo = dev::eth::genesisInfo(network);
+    ReplaceInt(consensus.QIP7Height, "QIP7_STARTING_BLOCK", genesisInfo);
+    return genesisInfo;
+}
diff --git a/src/chainparams.h b/src/chainparams.h
index 722e52ff4..36d308df1 100644
--- a/src/chainparams.h
+++ b/src/chainparams.h
@@ -10,9 +10,11 @@
 #include <consensus/params.h>
 #include <primitives/block.h>
 #include <protocol.h>
+#include <libethashseal/GenesisInfo.h>
 
 #include <memory>
 #include <vector>
+#include <string>
 
 struct SeedSpec6 {
     uint8_t addr[16];
@@ -81,6 +83,7 @@ class CChainParams
     const CCheckpointData& Checkpoints() const { return checkpointData; }
     const ChainTxData& TxData() const { return chainTxData; }
     void UpdateVersionBitsParameters(Consensus::DeploymentPos d, int64_t nStartTime, int64_t nTimeout);
+    std::string EVMGenesisInfo(dev::eth::Network network) const;
 protected:
     CChainParams() {}
 
diff --git a/src/consensus/params.h b/src/consensus/params.h
index 5dedc7caf..127987b35 100644
--- a/src/consensus/params.h
+++ b/src/consensus/params.h
@@ -58,6 +58,8 @@ struct Params {
     int BIP65Height;
     /** Block height at which BIP66 becomes active */
     int BIP66Height;
+    /** Block height at which QIP7 becomes active */
+    int QIP7Height;
     /**
      * Minimum blocks including miner confirmation of the total of 2016 blocks in a retargeting period,
      * (nPowTargetTimespan / nPowTargetSpacing) which is also used for BIP9 deployments.
diff --git a/src/init.cpp b/src/init.cpp
index ae7ae18dc..775cf519d 100644
--- a/src/init.cpp
+++ b/src/init.cpp
@@ -1572,7 +1572,7 @@ bool AppInitMain()
                 const dev::h256 hashDB(dev::sha3(dev::rlp("")));
                 dev::eth::BaseState existsQtumstate = fStatus ? dev::eth::BaseState::PreExisting : dev::eth::BaseState::Empty;
                 globalState = std::unique_ptr<QtumState>(new QtumState(dev::u256(0), QtumState::openDB(dirQtum, hashDB, dev::WithExisting::Trust), dirQtum, existsQtumstate));
-                dev::eth::ChainParams cp((dev::eth::genesisInfo(dev::eth::Network::qtumMainNetwork)));
+                dev::eth::ChainParams cp((chainparams.EVMGenesisInfo(dev::eth::Network::qtumMainNetwork)));
                 globalSealEngine = std::unique_ptr<dev::eth::SealEngineFace>(cp.createSealEngine());
 
                 pstorageresult.reset(new StorageResults(qtumStateDir.string()));
diff --git a/src/qtum/qtumDGP.cpp b/src/qtum/qtumDGP.cpp
index aff9fb3aa..6b20e306a 100644
--- a/src/qtum/qtumDGP.cpp
+++ b/src/qtum/qtumDGP.cpp
@@ -18,9 +18,9 @@ std::vector<uint32_t> createDataSchedule(const dev::eth::EVMSchedule& schedule)
     return tempData;
 }
 
-std::vector<uint32_t> const& scheduleDataForBlockNumber(unsigned int blockHeight)
+std::vector<uint32_t> scheduleDataForBlockNumber(unsigned int blockHeight)
 {
-    const dev::eth::EVMSchedule& schedule = globalSealEngine->chainParams().scheduleForBlockNumber(blockHeight);
+    dev::eth::EVMSchedule schedule = globalSealEngine->chainParams().scheduleForBlockNumber(blockHeight);
     return createDataSchedule(schedule);
 }
 
diff --git a/src/test/qtumtests/dgp_tests.cpp b/src/test/qtumtests/dgp_tests.cpp
index da5d824e9..d8cee9eba 100644
--- a/src/test/qtumtests/dgp_tests.cpp
+++ b/src/test/qtumtests/dgp_tests.cpp
@@ -1,6 +1,7 @@
 #include <boost/test/unit_test.hpp>
 #include <qtumtests/test_utils.h>
 #include <script/standard.h>
+#include <chainparams.h>
 
 namespace dgpTest{
 
@@ -283,7 +284,8 @@ EVMScheduleCustom EVMScheduleContractGasSchedule3(true,true,true,true,{{13,13,10
 dev::h256 hash = dev::h256(ParseHex("aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"));
 
 void contractLoading(){
-    dev::eth::ChainParams cp((dev::eth::genesisInfo(dev::eth::Network::qtumMainNetwork)));
+    const CChainParams& chainparams = Params();
+    dev::eth::ChainParams cp((chainparams.EVMGenesisInfo(dev::eth::Network::qtumMainNetwork)));
     globalState->populateFrom(cp.genesisState);
     globalSealEngine = std::unique_ptr<dev::eth::SealEngineFace>(cp.createSealEngine());
     globalState->db().commit();
diff --git a/src/test/test_bitcoin.cpp b/src/test/test_bitcoin.cpp
index 71ee9f902..b5b48d8d4 100755
--- a/src/test/test_bitcoin.cpp
+++ b/src/test/test_bitcoin.cpp
@@ -100,7 +100,7 @@ TestingSetup::TestingSetup(const std::string& chainName) : BasicTestingSetup(cha
         boost::filesystem::create_directories(pathTemp);
         const dev::h256 hashDB(dev::sha3(dev::rlp("")));
         globalState = std::unique_ptr<QtumState>(new QtumState(dev::u256(0), QtumState::openDB(pathTemp.string(), hashDB, dev::WithExisting::Trust), pathTemp.string(), dev::eth::BaseState::Empty));
-        dev::eth::ChainParams cp((dev::eth::genesisInfo(dev::eth::Network::qtumTestNetwork)));
+        dev::eth::ChainParams cp((chainparams.EVMGenesisInfo(dev::eth::Network::qtumTestNetwork)));
         globalSealEngine = std::unique_ptr<dev::eth::SealEngineFace>(cp.createSealEngine());
         globalState->populateFrom(cp.genesisState);
         globalState->setRootUTXO(uintToh256(chainparams.GenesisBlock().hashUTXORoot));
diff --git a/src/util.cpp b/src/util.cpp
index 8ec63ffd3..bc0c744ce 100644
--- a/src/util.cpp
+++ b/src/util.cpp
@@ -34,6 +34,7 @@
 #include <sched.h>
 #include <sys/resource.h>
 #include <sys/stat.h>
+#include <regex>
 
 #else
 
@@ -1259,3 +1260,27 @@ int ScheduleBatchPriority(void)
     return 1;
 #endif
 }
+
+std::string toHexString(int64_t intValue) {
+
+    std::string hexStr;
+
+    // Integer value to hex string
+    std::stringstream sstream;
+    sstream << "0x" << std::setfill ('0') << std::setw(2) << std::hex << (int64_t)intValue;
+
+    hexStr= sstream.str();
+    sstream.clear();
+
+    return hexStr;
+}
+
+void ReplaceInt(const int64_t& number, const std::string& key, std::string& str)
+{
+    // Convert the number into hex string
+    std::string num_hex = toHexString(number);
+
+    // Search for key in str and replace it with the hex string
+    std::string str_replaced = std::regex_replace(str, std::regex(key), num_hex);
+    str = str_replaced;
+}
diff --git a/src/util.h b/src/util.h
index 29173cc83..c57677577 100644
--- a/src/util.h
+++ b/src/util.h
@@ -378,6 +378,8 @@ std::string CopyrightHolders(const std::string& strPrefix);
 
 bool CheckHex(const std::string& str);
 
+void ReplaceInt(const int64_t& number, const std::string& key, std::string& str);
+
 /**
  * On platforms that support it, tell the kernel the calling thread is
  * CPU-intensive and non-interactive. See SCHED_BATCH in sched(7) for details.

From a48b120754f76ef0254b0b9b836206d70eac6c9a Mon Sep 17 00:00:00 2001
From: Time Markov <time.markov@qtum.com>
Date: Wed, 16 Jan 2019 12:37:29 +0100
Subject: [PATCH 012/153] Change exception name in out of gas tests

---
 src/test/qtumtests/bytecodeexec_tests.cpp | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/src/test/qtumtests/bytecodeexec_tests.cpp b/src/test/qtumtests/bytecodeexec_tests.cpp
index 48f4a0303..69dc9af86 100644
--- a/src/test/qtumtests/bytecodeexec_tests.cpp
+++ b/src/test/qtumtests/bytecodeexec_tests.cpp
@@ -135,14 +135,14 @@ BOOST_AUTO_TEST_CASE(bytecodeexec_create_contract){
     checkBCEResult(result.second, 69382, 430618, 1, CAmount(GASLIMIT));
 }
 
-BOOST_AUTO_TEST_CASE(bytecodeexec_create_contract_OutOfGasBase){
+BOOST_AUTO_TEST_CASE(bytecodeexec_create_contract_OutOfGasIntrinsic){
     initState();
     QtumTransaction txEth = createQtumTransaction(CODE[0], 0, dev::u256(100), dev::u256(1), HASHTX, dev::Address());
     std::vector<QtumTransaction> txs(1, txEth);
     auto result = executeBC(txs);
 
     std::vector<dev::Address> addrs = {dev::Address()};
-    checkExecResult(result.first, 1, 0, dev::eth::TransactionException::OutOfGasBase, addrs, valtype(), dev::u256(0));
+    checkExecResult(result.first, 1, 0, dev::eth::TransactionException::OutOfGasIntrinsic, addrs, valtype(), dev::u256(0));
     checkBCEResult(result.second, 100, 0, 0, 100);
 }
 
@@ -157,7 +157,7 @@ BOOST_AUTO_TEST_CASE(bytecodeexec_create_contract_OutOfGas){
     checkBCEResult(result.second, CAmount(GASLIMIT), 0, 0, CAmount(GASLIMIT));
 }
 
-BOOST_AUTO_TEST_CASE(bytecodeexec_OutOfGasBase_create_contract_normal_create_contract){
+BOOST_AUTO_TEST_CASE(bytecodeexec_OutOfGasIntrinsic_create_contract_normal_create_contract){
     initState();
     std::vector<dev::Address> newAddressGen;
     std::vector<QtumTransaction> txs;
@@ -172,7 +172,7 @@ BOOST_AUTO_TEST_CASE(bytecodeexec_OutOfGasBase_create_contract_normal_create_con
     auto result = executeBC(txs);
 
     valtype code = ParseHex("60606040525b600b5b5b565b0000a165627a7a723058209cedb722bf57a30e3eb00eeefc392103ea791a2001deed29f5c3809ff10eb1dd0029");
-    checkExecResult(result.first, 10, 5, dev::eth::TransactionException::OutOfGasBase, newAddressGen, code, dev::u256(0), true);
+    checkExecResult(result.first, 10, 5, dev::eth::TransactionException::OutOfGasIntrinsic, newAddressGen, code, dev::u256(0), true);
     checkBCEResult(result.second, 347410, 2153090, 5, CAmount(GASLIMIT * 5 + 500));
 }
 
@@ -227,7 +227,7 @@ BOOST_AUTO_TEST_CASE(bytecodeexec_call_contract_transfer){
     checkBCEResult(result.second, 21037, 478963, 1, CAmount(GASLIMIT), 1);
 }
 
-BOOST_AUTO_TEST_CASE(bytecodeexec_call_contract_transfer_OutOfGasBase_return_value){
+BOOST_AUTO_TEST_CASE(bytecodeexec_call_contract_transfer_OutOfGasIntrinsic_return_value){
     initState();
     QtumTransaction txEthCreate = createQtumTransaction(CODE[0], 0, GASLIMIT, dev::u256(1), HASHTX, dev::Address());
     std::vector<QtumTransaction> txsCreate(1, txEthCreate);
@@ -238,7 +238,7 @@ BOOST_AUTO_TEST_CASE(bytecodeexec_call_contract_transfer_OutOfGasBase_return_val
     auto result = executeBC(txsCall);
 
     std::vector<dev::Address> addrs = {txEthCall.receiveAddress()};
-    checkExecResult(result.first, 1, 1, dev::eth::TransactionException::OutOfGasBase, addrs, valtype(), dev::u256(0));
+    checkExecResult(result.first, 1, 1, dev::eth::TransactionException::OutOfGasIntrinsic, addrs, valtype(), dev::u256(0));
     checkBCEResult(result.second, 1, 0, 0, 1, 1);
 }
 

From f18b5a7a2877dd6eca76e5f34bf05309ffebe8eb Mon Sep 17 00:00:00 2001
From: Time Markov <time.markov@qtum.com>
Date: Mon, 28 Jan 2019 12:10:43 +0100
Subject: [PATCH 013/153] Add gmp package for building dependencies

---
 depends/packages/gmp.mk      | 18 ++++++++++++++++++
 depends/packages/packages.mk |  2 +-
 src/util.cpp                 |  2 +-
 3 files changed, 20 insertions(+), 2 deletions(-)
 create mode 100644 depends/packages/gmp.mk

diff --git a/depends/packages/gmp.mk b/depends/packages/gmp.mk
new file mode 100644
index 000000000..0577b6f01
--- /dev/null
+++ b/depends/packages/gmp.mk
@@ -0,0 +1,18 @@
+package=gmp
+$(package)_version=6.1.2
+$(package)_sha256_hash=87b565e89a9a684fe4ebeeddb8399dce2599f9c9049854ca8c0dfbdea0e21912
+$(package)_build_subdir=$(package)-$($(package)_version)
+$(package)_file_name=$(package)-$($(package)_version).tar.xz
+$(package)_download_path=https://gmplib.org/download/$(package)
+
+define $(package)_config_cmds
+  ../configure --enable-static=yes --enable-shared=no --enable-cxx -without-readline --host=$(host) --prefix=$(host_prefix)
+endef
+
+define $(package)_build_cmds
+  $(MAKE)
+endef
+
+define $(package)_stage_cmds
+  $(MAKE) DESTDIR=$($(package)_staging_dir) install 
+endef
diff --git a/depends/packages/packages.mk b/depends/packages/packages.mk
index 5fe6f98da..4e8ab3599 100644
--- a/depends/packages/packages.mk
+++ b/depends/packages/packages.mk
@@ -1,4 +1,4 @@
-packages:=boost openssl libevent zeromq
+packages:=boost openssl libevent zeromq gmp
 
 qt_native_packages = native_protobuf
 qt_packages = qrencode protobuf zlib
diff --git a/src/util.cpp b/src/util.cpp
index bc0c744ce..5d357e60c 100644
--- a/src/util.cpp
+++ b/src/util.cpp
@@ -9,6 +9,7 @@
 #include <random.h>
 #include <serialize.h>
 #include <utilstrencodings.h>
+#include <regex>
 
 #include <stdarg.h>
 
@@ -34,7 +35,6 @@
 #include <sched.h>
 #include <sys/resource.h>
 #include <sys/stat.h>
-#include <regex>
 
 #else
 

From 9a9ac5e404e66765070e596b87f0580b18c53ad3 Mon Sep 17 00:00:00 2001
From: Time Markov <time.markov@qtum.com>
Date: Mon, 28 Jan 2019 14:49:24 +0100
Subject: [PATCH 014/153] Add gmp library detection in the configuration file

---
 configure.ac                | 10 ++++++++++
 depends/packages/gmp.mk     |  4 ++--
 src/Makefile.am             |  2 +-
 src/Makefile.bench.include  |  2 +-
 src/Makefile.qt.include     |  2 +-
 src/Makefile.qttest.include |  2 +-
 src/Makefile.test.include   |  2 +-
 7 files changed, 17 insertions(+), 7 deletions(-)

diff --git a/configure.ac b/configure.ac
index ae580a2e2..75a7555ed 100644
--- a/configure.ac
+++ b/configure.ac
@@ -1148,6 +1148,14 @@ else
   fi
 fi
 
+# These packages don't provide pkgconfig config files across all
+# platforms, so we use older autoconf detection mechanisms:
+AC_CHECK_HEADER([gmp.h],,AC_MSG_ERROR(libgmp headers missing))
+AC_CHECK_LIB([gmp],[[__gmpn_sub_n]],GMP_LIBS=-lgmp, [AC_MSG_ERROR(libgmp missing)])
+
+AC_CHECK_HEADER([gmpxx.h],,AC_MSG_ERROR(libgmpxx headers missing))
+AC_CHECK_LIB([gmpxx],[main],GMPXX_LIBS=-lgmpxx, [AC_MSG_ERROR(libgmpxx missing)])
+
 save_CXXFLAGS="${CXXFLAGS}"
 CXXFLAGS="${CXXFLAGS} ${CRYPTO_CFLAGS} ${SSL_CFLAGS}"
 AC_CHECK_DECLS([EVP_MD_CTX_new],,,[AC_INCLUDES_DEFAULT
@@ -1419,6 +1427,8 @@ AC_SUBST(EVENT_PTHREADS_LIBS)
 AC_SUBST(ZMQ_LIBS)
 AC_SUBST(PROTOBUF_LIBS)
 AC_SUBST(QR_LIBS)
+AC_SUBST(GMP_LIBS)
+AC_SUBST(GMPXX_LIBS)
 AC_CONFIG_FILES([Makefile src/Makefile doc/man/Makefile share/setup.nsi share/qt/Info.plist test/config.ini])
 AC_CONFIG_FILES([contrib/devtools/split-debug.sh],[chmod +x contrib/devtools/split-debug.sh])
 AM_COND_IF([HAVE_DOXYGEN], [AC_CONFIG_FILES([doc/Doxyfile])])
diff --git a/depends/packages/gmp.mk b/depends/packages/gmp.mk
index 0577b6f01..6476afea6 100644
--- a/depends/packages/gmp.mk
+++ b/depends/packages/gmp.mk
@@ -6,11 +6,11 @@ $(package)_file_name=$(package)-$($(package)_version).tar.xz
 $(package)_download_path=https://gmplib.org/download/$(package)
 
 define $(package)_config_cmds
-  ../configure --enable-static=yes --enable-shared=no --enable-cxx -without-readline --host=$(host) --prefix=$(host_prefix)
+  ../configure --enable-static=yes --enable-shared=no --enable-cxx -without-readline --host=$(host) --prefix=$(host_prefix) --build=$(build)
 endef
 
 define $(package)_build_cmds
-  $(MAKE)
+  $(MAKE) CPPFLAGS='-fPIC'
 endef
 
 define $(package)_stage_cmds
diff --git a/src/Makefile.am b/src/Makefile.am
index d46509411..0dc42dd84 100644
--- a/src/Makefile.am
+++ b/src/Makefile.am
@@ -712,7 +712,7 @@ qtumd_LDADD = \
   $(LIBFF) \
   $(LIBSECP256K1)
 
-qtumd_LDADD += $(BOOST_LIBS) $(BDB_LIBS) $(SSL_LIBS) $(CRYPTO_LIBS) $(MINIUPNPC_LIBS) $(EVENT_PTHREADS_LIBS) $(EVENT_LIBS) $(ZMQ_LIBS) -lgmp -lgmpxx
+qtumd_LDADD += $(BOOST_LIBS) $(BDB_LIBS) $(SSL_LIBS) $(CRYPTO_LIBS) $(MINIUPNPC_LIBS) $(EVENT_PTHREADS_LIBS) $(EVENT_LIBS) $(ZMQ_LIBS) $(GMP_LIBS) $(GMPXX_LIBS)
 
 # bitcoin-cli binary #
 qtum_cli_SOURCES = bitcoin-cli.cpp
diff --git a/src/Makefile.bench.include b/src/Makefile.bench.include
index 12345b6a0..668e609ce 100644
--- a/src/Makefile.bench.include
+++ b/src/Makefile.bench.include
@@ -66,7 +66,7 @@ if ENABLE_WALLET
 bench_bench_qtum_SOURCES += bench/coin_selection.cpp
 endif
 
-bench_bench_qtum_LDADD += $(BOOST_LIBS) $(BDB_LIBS) $(SSL_LIBS) $(CRYPTO_LIBS) $(MINIUPNPC_LIBS) $(EVENT_PTHREADS_LIBS) $(EVENT_LIBS) $(LIBFF) -lgmp -lgmpxx
+bench_bench_qtum_LDADD += $(BOOST_LIBS) $(BDB_LIBS) $(SSL_LIBS) $(CRYPTO_LIBS) $(MINIUPNPC_LIBS) $(EVENT_PTHREADS_LIBS) $(EVENT_LIBS) $(LIBFF) $(GMP_LIBS) $(GMPXX_LIBS)
 bench_bench_qtum_LDFLAGS = $(RELDFLAGS) $(AM_LDFLAGS) $(LIBTOOL_APP_LDFLAGS)
 
 CLEAN_BITCOIN_BENCH = bench/*.gcda bench/*.gcno $(GENERATED_BENCH_FILES)
diff --git a/src/Makefile.qt.include b/src/Makefile.qt.include
index b677c7c28..8db1ab493 100644
--- a/src/Makefile.qt.include
+++ b/src/Makefile.qt.include
@@ -595,7 +595,7 @@ endif
 qt_qtum_qt_LDADD += $(LIBBITCOIN_CLI) $(LIBBITCOIN_COMMON) $(LIBBITCOIN_UTIL) $(LIBBITCOIN_CONSENSUS) $(LIBBITCOIN_CRYPTO) $(LIBUNIVALUE) $(LIBLEVELDB) $(LIBLEVELDB_SSE42) $(LIBMEMENV) \
   $(BOOST_LIBS) $(QT_LIBS) $(QT_DBUS_LIBS) $(QR_LIBS) $(PROTOBUF_LIBS) $(BDB_LIBS) $(SSL_LIBS) $(CRYPTO_LIBS) $(MINIUPNPC_LIBS) $(LIBSECP256K1) \
   $(EVENT_PTHREADS_LIBS) $(EVENT_LIBS) $(LIBETHEREUM) $(LIBETHASHSEAL) $(LIBETHASH) \
-  $(LIBETHCORE) $(LIBDEVCORE) $(LIBJSONCPP) $(LIBEVM) $(LIBEVMCORE) $(LIBDEVCRYPTO) $(LIBCRYPTOPP) $(LIBSCRYIPT) $(LIBFF) -lgmp -lgmpxx
+  $(LIBETHCORE) $(LIBDEVCORE) $(LIBJSONCPP) $(LIBEVM) $(LIBEVMCORE) $(LIBDEVCRYPTO) $(LIBCRYPTOPP) $(LIBSCRYIPT) $(LIBFF) $(GMP_LIBS) $(GMPXX_LIBS)
 qt_qtum_qt_LDFLAGS = $(RELDFLAGS) $(AM_LDFLAGS) $(QT_LDFLAGS) $(LIBTOOL_APP_LDFLAGS)
 qt_qtum_qt_LIBTOOLFLAGS = $(AM_LIBTOOLFLAGS) --tag CXX
 
diff --git a/src/Makefile.qttest.include b/src/Makefile.qttest.include
index 01307f623..1fa89122f 100644
--- a/src/Makefile.qttest.include
+++ b/src/Makefile.qttest.include
@@ -67,7 +67,7 @@ qt_test_test_qtum_qt_LDADD += $(LIBBITCOIN_CLI) $(LIBBITCOIN_COMMON) $(LIBBITCOI
   $(LIBETHCORE) $(LIBDEVCORE) $(LIBJSONCPP) $(LIBEVM) $(LIBEVMCORE) $(LIBDEVCRYPTO) $(LIBCRYPTOPP) \
   $(BOOST_LIBS) $(LIBSECP256K1ETH) $(LIBSCRYIPT) $(QT_DBUS_LIBS) $(QT_TEST_LIBS) $(QT_LIBS) \
   $(QR_LIBS) $(PROTOBUF_LIBS) $(BDB_LIBS) $(SSL_LIBS) $(CRYPTO_LIBS) $(MINIUPNPC_LIBS) $(LIBSECP256K1) \
-  $(EVENT_PTHREADS_LIBS) $(EVENT_LIBS) $(LIBFF) -lgmp -lgmpxx
+  $(EVENT_PTHREADS_LIBS) $(EVENT_LIBS) $(LIBFF) $(GMP_LIBS) $(GMPXX_LIBS)
 qt_test_test_qtum_qt_LDFLAGS = $(RELDFLAGS) $(AM_LDFLAGS) $(QT_LDFLAGS) $(LIBTOOL_APP_LDFLAGS)
 qt_test_test_qtum_qt_CXXFLAGS = $(AM_CXXFLAGS) $(QT_PIE_FLAGS)
 
diff --git a/src/Makefile.test.include b/src/Makefile.test.include
index fd505c19c..cb7d3b757 100644
--- a/src/Makefile.test.include
+++ b/src/Makefile.test.include
@@ -122,7 +122,7 @@ test_test_qtum_LDADD += $(LIBBITCOIN_SERVER) $(LIBBITCOIN_CLI) $(LIBBITCOIN_COMM
   $(LIBDEVCORE) $(LIBJSONCPP) $(LIBEVM) $(LIBEVMCORE) $(LIBDEVCRYPTO) $(LIBCRYPTOPP) $(LIBSECP256K1) $(LIBSCRYIPT) $(BOOST_LIBS)
 test_test_qtum_CXXFLAGS = $(AM_CXXFLAGS) $(PIE_FLAGS)
 
-test_test_qtum_LDADD += $(LIBBITCOIN_CONSENSUS) $(BDB_LIBS) $(SSL_LIBS) $(CRYPTO_LIBS) $(MINIUPNPC_LIBS) $(LIBFF) -lgmp -lgmpxx
+test_test_qtum_LDADD += $(LIBBITCOIN_CONSENSUS) $(BDB_LIBS) $(SSL_LIBS) $(CRYPTO_LIBS) $(MINIUPNPC_LIBS) $(LIBFF) $(GMP_LIBS) $(GMPXX_LIBS)
 test_test_qtum_LDFLAGS = $(RELDFLAGS) $(AM_LDFLAGS) $(LIBTOOL_APP_LDFLAGS) -static
 
 if ENABLE_ZMQ

From 3ac6e564945c82ea1afe457e78b9fa44c0cd0da5 Mon Sep 17 00:00:00 2001
From: Time Markov <time.markov@qtum.com>
Date: Wed, 30 Jan 2019 14:01:43 +0100
Subject: [PATCH 015/153] Fix build

---
 build-aux/m4/ax_boost_program_options.m4 | 108 +++++++++++++++++++++++
 configure.ac                             |   3 +-
 depends/packages/boost.mk                |   2 +-
 3 files changed, 111 insertions(+), 2 deletions(-)
 create mode 100644 build-aux/m4/ax_boost_program_options.m4

diff --git a/build-aux/m4/ax_boost_program_options.m4 b/build-aux/m4/ax_boost_program_options.m4
new file mode 100644
index 000000000..2bdb59371
--- /dev/null
+++ b/build-aux/m4/ax_boost_program_options.m4
@@ -0,0 +1,108 @@
+# ============================================================================
+#  http://www.gnu.org/software/autoconf-archive/ax_boost_program_options.html
+# ============================================================================
+#
+# SYNOPSIS
+#
+#   AX_BOOST_PROGRAM_OPTIONS
+#
+# DESCRIPTION
+#
+#   Test for program options library from the Boost C++ libraries. The macro
+#   requires a preceding call to AX_BOOST_BASE. Further documentation is
+#   available at <http://randspringer.de/boost/index.html>.
+#
+#   This macro calls:
+#
+#     AC_SUBST(BOOST_PROGRAM_OPTIONS_LIB)
+#
+#   And sets:
+#
+#     HAVE_BOOST_PROGRAM_OPTIONS
+#
+# LICENSE
+#
+#   Copyright (c) 2009 Thomas Porschberg <thomas@randspringer.de>
+#
+#   Copying and distribution of this file, with or without modification, are
+#   permitted in any medium without royalty provided the copyright notice
+#   and this notice are preserved. This file is offered as-is, without any
+#   warranty.
+
+#serial 24
+
+AC_DEFUN([AX_BOOST_PROGRAM_OPTIONS],
+[
+	AC_ARG_WITH([boost-program-options],
+		AS_HELP_STRING([--with-boost-program-options@<:@=special-lib@:>@],
+                       [use the program options library from boost - it is possible to specify a certain library for the linker
+                        e.g. --with-boost-program-options=boost_program_options-gcc-mt-1_33_1 ]),
+        [
+        if test "$withval" = "no"; then
+			want_boost="no"
+        elif test "$withval" = "yes"; then
+            want_boost="yes"
+            ax_boost_user_program_options_lib=""
+        else
+		    want_boost="yes"
+		ax_boost_user_program_options_lib="$withval"
+		fi
+        ],
+        [want_boost="yes"]
+	)
+
+	if test "x$want_boost" = "xyes"; then
+        AC_REQUIRE([AC_PROG_CC])
+	    export want_boost
+		CPPFLAGS_SAVED="$CPPFLAGS"
+		CPPFLAGS="$CPPFLAGS $BOOST_CPPFLAGS"
+		export CPPFLAGS
+		LDFLAGS_SAVED="$LDFLAGS"
+		LDFLAGS="$LDFLAGS $BOOST_LDFLAGS"
+		export LDFLAGS
+		AC_CACHE_CHECK([whether the Boost::Program_Options library is available],
+					   ax_cv_boost_program_options,
+					   [AC_LANG_PUSH(C++)
+				AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[@%:@include <boost/program_options/errors.hpp>
+                                                          ]],
+                                  [[boost::program_options::error err("Error message");
+                                   return 0;]])],
+                           ax_cv_boost_program_options=yes, ax_cv_boost_program_options=no)
+					AC_LANG_POP([C++])
+		])
+		if test "$ax_cv_boost_program_options" = yes; then
+				AC_DEFINE(HAVE_BOOST_PROGRAM_OPTIONS,,[define if the Boost::PROGRAM_OPTIONS library is available])
+                  BOOSTLIBDIR=`echo $BOOST_LDFLAGS | sed -e 's/@<:@^\/@:>@*//'`
+                if test "x$ax_boost_user_program_options_lib" = "x"; then
+                for libextension in `ls $BOOSTLIBDIR/libboost_program_options*.so* 2>/dev/null | sed 's,.*/,,' | sed -e 's;^lib\(boost_program_options.*\)\.so.*$;\1;'` `ls $BOOSTLIBDIR/libboost_program_options*.dylib* 2>/dev/null | sed 's,.*/,,' | sed -e 's;^lib\(boost_program_options.*\)\.dylib.*$;\1;'` `ls $BOOSTLIBDIR/libboost_program_options*.a* 2>/dev/null | sed 's,.*/,,' | sed -e 's;^lib\(boost_program_options.*\)\.a.*$;\1;'` ; do
+                     ax_lib=${libextension}
+				    AC_CHECK_LIB($ax_lib, exit,
+                                 [BOOST_PROGRAM_OPTIONS_LIB="-l$ax_lib"; AC_SUBST(BOOST_PROGRAM_OPTIONS_LIB) link_program_options="yes"; break],
+                                 [link_program_options="no"])
+				done
+                if test "x$link_program_options" != "xyes"; then
+                for libextension in `ls $BOOSTLIBDIR/boost_program_options*.dll* 2>/dev/null | sed 's,.*/,,' | sed -e 's;^\(boost_program_options.*\)\.dll.*$;\1;'` `ls $BOOSTLIBDIR/boost_program_options*.a* 2>/dev/null | sed 's,.*/,,' | sed -e 's;^\(boost_program_options.*\)\.a.*$;\1;'` ; do
+                     ax_lib=${libextension}
+				    AC_CHECK_LIB($ax_lib, exit,
+                                 [BOOST_PROGRAM_OPTIONS_LIB="-l$ax_lib"; AC_SUBST(BOOST_PROGRAM_OPTIONS_LIB) link_program_options="yes"; break],
+                                 [link_program_options="no"])
+				done
+                fi
+                else
+                  for ax_lib in $ax_boost_user_program_options_lib boost_program_options-$ax_boost_user_program_options_lib; do
+				      AC_CHECK_LIB($ax_lib, main,
+                                   [BOOST_PROGRAM_OPTIONS_LIB="-l$ax_lib"; AC_SUBST(BOOST_PROGRAM_OPTIONS_LIB) link_program_options="yes"; break],
+                                   [link_program_options="no"])
+                  done
+                fi
+            if test "x$ax_lib" = "x"; then
+                AC_MSG_ERROR(Could not find a version of the boost_program_options library!)
+            fi
+				if test "x$link_program_options" != "xyes"; then
+					AC_MSG_ERROR([Could not link against [$ax_lib] !])
+				fi
+		fi
+		CPPFLAGS="$CPPFLAGS_SAVED"
+	LDFLAGS="$LDFLAGS_SAVED"
+	fi
+])
diff --git a/configure.ac b/configure.ac
index 75a7555ed..b2747d0d8 100644
--- a/configure.ac
+++ b/configure.ac
@@ -914,6 +914,7 @@ if test x$want_boost = xno; then
 fi
 AX_BOOST_SYSTEM
 AX_BOOST_FILESYSTEM
+AX_BOOST_PROGRAM_OPTIONS
 AX_BOOST_THREAD
 AX_BOOST_RANDOM
 AX_BOOST_CHRONO
@@ -983,7 +984,7 @@ fi
 
 if test x$use_boost = xyes; then
 
-BOOST_LIBS="$BOOST_LDFLAGS $BOOST_SYSTEM_LIB $BOOST_FILESYSTEM_LIB $BOOST_THREAD_LIB $BOOST_CHRONO_LIB $BOOST_RANDOM_LIB"
+BOOST_LIBS="$BOOST_LDFLAGS $BOOST_SYSTEM_LIB $BOOST_FILESYSTEM_LIB $BOOST_PROGRAM_OPTIONS_LIB $BOOST_THREAD_LIB $BOOST_CHRONO_LIB $BOOST_RANDOM_LIB"
 
 
 dnl If boost (prior to 1.57) was built without c++11, it emulated scoped enums
diff --git a/depends/packages/boost.mk b/depends/packages/boost.mk
index 0eaa61c46..56f4798f7 100644
--- a/depends/packages/boost.mk
+++ b/depends/packages/boost.mk
@@ -19,7 +19,7 @@ $(package)_toolset_$(host_os)=gcc
 $(package)_archiver_$(host_os)=$($(package)_ar)
 $(package)_toolset_darwin=darwin
 $(package)_archiver_darwin=$($(package)_libtool)
-$(package)_config_libraries=chrono,filesystem,system,thread,test,random
+$(package)_config_libraries=chrono,filesystem,program_options,system,thread,test,random
 $(package)_cxxflags=-std=c++11 -fvisibility=hidden
 $(package)_cxxflags_linux=-fPIC
 endef

From aca09b86ce0f75cfc55c734e10e9c0d0aeff3b4d Mon Sep 17 00:00:00 2001
From: Time Markov <time.markov@qtum.com>
Date: Thu, 31 Jan 2019 12:28:53 +0100
Subject: [PATCH 016/153] Add constantinople fork tests

---
 src/Makefile.test.include                     |   3 +-
 .../qtumtests/constantinoplefork_tests.cpp    | 224 ++++++++++++++++++
 src/test/qtumtests/dgp_tests.cpp              |  13 +-
 3 files changed, 238 insertions(+), 2 deletions(-)
 create mode 100644 src/test/qtumtests/constantinoplefork_tests.cpp

diff --git a/src/Makefile.test.include b/src/Makefile.test.include
index cb7d3b757..f99340c04 100644
--- a/src/Makefile.test.include
+++ b/src/Makefile.test.include
@@ -95,7 +95,8 @@ BITCOIN_TESTS =\
   test/qtumtests/qtumtxconverter_tests.cpp \
   test/qtumtests/bytecodeexec_tests.cpp \
   test/qtumtests/condensingtransaction_tests.cpp \
-  test/qtumtests/dgp_tests.cpp
+  test/qtumtests/dgp_tests.cpp \
+  test/qtumtests/constantinoplefork_tests.cpp
 
 if ENABLE_WALLET
 BITCOIN_TESTS += \
diff --git a/src/test/qtumtests/constantinoplefork_tests.cpp b/src/test/qtumtests/constantinoplefork_tests.cpp
new file mode 100644
index 000000000..5c93eccba
--- /dev/null
+++ b/src/test/qtumtests/constantinoplefork_tests.cpp
@@ -0,0 +1,224 @@
+#include <boost/test/unit_test.hpp>
+#include <qtumtests/test_utils.h>
+#include <script/standard.h>
+#include <chainparams.h>
+
+namespace ConstantinopleTest{
+
+dev::u256 GASLIMIT = dev::u256(500000);
+dev::h256 HASHTX = dev::h256(ParseHex("aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"));
+
+// Codes used to check that the newer forks up to constantinople are present
+std::vector<valtype> CODE = {
+    /*
+    // Contract for Byzantium check
+    contract Proxy {
+        address public implementation;
+
+        function upgradeTo(address _address) public {
+            implementation = _address;
+        }
+
+        function () payable public {
+            address _impl = implementation;
+            require(_impl != address(0));
+
+            assembly {
+                let ptr := mload(0x40)
+                calldatacopy(ptr, 0, calldatasize)
+                let result := delegatecall(gas, _impl, ptr, calldatasize, 0, 0)
+                let size := returndatasize
+                returndatacopy(ptr, 0, size)
+
+                switch result
+                case 0 { revert(ptr, size) }
+                default { return(ptr, size) }
+            }
+        }
+    }
+    */
+    valtype(ParseHex("608060405234801561001057600080fd5b50610187806100206000396000f30060806040526004361061004b5763ffffffff7c01000000000000000000000000000000000000000000000000000000006000350416633659cfe681146100955780635c60da1b146100c5575b60005473ffffffffffffffffffffffffffffffffffffffff1680151561007057600080fd5b60405136600082376000803683855af43d806000843e818015610091578184f35b8184fd5b3480156100a157600080fd5b506100c373ffffffffffffffffffffffffffffffffffffffff60043516610103565b005b3480156100d157600080fd5b506100da61013f565b6040805173ffffffffffffffffffffffffffffffffffffffff9092168252519081900360200190f35b6000805473ffffffffffffffffffffffffffffffffffffffff191673ffffffffffffffffffffffffffffffffffffffff92909216919091179055565b60005473ffffffffffffffffffffffffffffffffffffffff16815600a165627a7a723058209f0b14aef0ec22d6019dddc8ad7a0c8f0fbb76c8847e588da0a1559bc958db040029")),
+
+    /*
+    // Contract for Byzantium check
+    contract TokenVersion1 {
+        mapping (address => uint) balances;
+
+        event Transfer(address _from, address _to, uint256 _value);
+
+        function balanceOf(address _address) public view returns (uint) {
+            return balances[_address];
+        }
+
+        function transfer(address _to, uint256 _value) public {
+            require(balances[msg.sender] >= _value);
+            balances[msg.sender] -= _value;
+            balances[_to] += _value;
+            emit Transfer(msg.sender, _to, _value);
+        }
+
+        function mint(address _to, uint256 _value) public {
+            balances[_to] += _value * 2;
+            emit Transfer(0x0, _to, _value);
+        }
+    }
+    */
+    valtype(ParseHex("608060405234801561001057600080fd5b506101e3806100206000396000f3006080604052600436106100565763ffffffff7c010000000000000000000000000000000000000000000000000000000060003504166340c10f19811461005b57806370a082311461008e578063a9059cbb146100ce575b600080fd5b34801561006757600080fd5b5061008c73ffffffffffffffffffffffffffffffffffffffff600435166024356100ff565b005b34801561009a57600080fd5b506100bc73ffffffffffffffffffffffffffffffffffffffff60043516610134565b60408051918252519081900360200190f35b3480156100da57600080fd5b5061008c73ffffffffffffffffffffffffffffffffffffffff6004351660243561015c565b73ffffffffffffffffffffffffffffffffffffffff909116600090815260208190526040902080546002909202919091019055565b73ffffffffffffffffffffffffffffffffffffffff1660009081526020819052604090205490565b3360009081526020819052604090205481111561017857600080fd5b336000908152602081905260408082208054849003905573ffffffffffffffffffffffffffffffffffffffff93909316815291909120805490910190555600a165627a7a72305820c517c25d8609e1668bebed32141ed2c2415e8b77ba9f2aef29c6d84e5756b4c20029")),
+
+    // upgradeTo(address _address)
+    valtype(ParseHex("3659cfe6000000000000000000000000c4c1d7375918557df2ef8f1d1f0b2329cb248a15")),
+
+    // mint(address _to, uint256 _value)
+    valtype(ParseHex("40c10f1900000000000000000000000001010101010101010101010101010101010101010000000000000000000000000000000000000000000000000000000000000010")),
+
+    /*
+    // Contract for Constantinople check
+    contract ConstantinopleCheck2 {
+        event Constantinople(bool);
+
+        // call this function to check if we are on constantinple
+        function IsItConstantinople() public view returns (bool){
+            (bool success) = address(this).call(abi.encodeWithSignature("ConstantinopleCheckFunction()"));
+            emit Constantinople(success);
+            return success;
+        }
+
+        // reverts if not constantinople
+        // call IsItConstantinople() not this one (is available to be called though)
+        // using shl for low gas use. "now" has to be called to make sure this function doesnt return a constant
+        function ConstantinopleCheckFunction() public view returns (bytes32){
+            bytes32 test = bytes32(now);
+            assembly {
+                test := shl(test, 1)
+            }
+            return test; // explicitly return test so we are sure that the optimizer doesnt optimize this out
+        }
+    }
+    */
+    valtype(ParseHex("608060405234801561001057600080fd5b506101d5806100206000396000f30060806040526004361061004b5763ffffffff7c01000000000000000000000000000000000000000000000000000000006000350416634ac429f28114610050578063f8af251414610077575b600080fd5b34801561005c57600080fd5b506100656100a0565b60408051918252519081900360200190f35b34801561008357600080fd5b5061008c6100a7565b604080519115158252519081900360200190f35b6001421b90565b60408051600481526024810182526020810180517bffffffffffffffffffffffffffffffffffffffffffffffffffffffff167f4ac429f2000000000000000000000000000000000000000000000000000000001781529151815160009384933093909290918291808383895b8381101561012b578181015183820152602001610113565b50505050905090810190601f1680156101585780820380516001836020036101000a031916815260200191505b509150506000604051808303816000865af160408051821515815290519194507f27cb433ab98fc487efab30ed965c7b21cb0c65b05a72ae5bf5a9815af956fe1693508190036020019150a19190505600a165627a7a7230582069c72d05c3b31b65dc0b5de1dc97b02549a66fe816407fc4e98bcee6792074c40029")),
+
+    // IsItConstantinople()
+    valtype(ParseHex("f8af2514"))
+};
+
+void genesisLoading(){
+    const CChainParams& chainparams = Params();
+    dev::eth::ChainParams cp((chainparams.EVMGenesisInfo(dev::eth::Network::qtumMainNetwork)));
+    cp.constantinopleForkBlock = dev::u256(1000);
+    globalState->populateFrom(cp.genesisState);
+    globalSealEngine = std::unique_ptr<dev::eth::SealEngineFace>(cp.createSealEngine());
+    globalState->db().commit();
+}
+
+void createNewBlocks(TestChain100Setup* testChain100Setup, size_t n){
+    std::function<void(size_t n)> generateBlocks = [&](size_t n){
+        dev::h256 oldHashStateRoot = globalState->rootHash();
+        dev::h256 oldHashUTXORoot = globalState->rootHashUTXO();
+        for(size_t i = 0; i < n; i++){
+            testChain100Setup->CreateAndProcessBlock({}, GetScriptForRawPubKey(testChain100Setup->coinbaseKey.GetPubKey()));
+        }
+        globalState->setRoot(oldHashStateRoot);
+        globalState->setRootUTXO(oldHashUTXORoot);
+    };
+
+    generateBlocks(n);
+}
+BOOST_FIXTURE_TEST_SUITE(constantinoplefork_tests, TestChain100Setup)
+
+BOOST_AUTO_TEST_CASE(checking_returndata_opcode_after_fork){
+    // Initialize
+    initState();
+    genesisLoading();
+    createNewBlocks(this,999 - COINBASE_MATURITY);
+
+    // Create contracts
+    std::vector<QtumTransaction> txs;
+    txs.push_back(createQtumTransaction(CODE[0], 0, GASLIMIT, dev::u256(1), HASHTX, dev::Address()));
+    txs.push_back(createQtumTransaction(CODE[1], 0, GASLIMIT, dev::u256(1), ++HASHTX, dev::Address()));
+    executeBC(txs);
+
+    // Call upgrade to
+    dev::Address proxy = createQtumAddress(txs[0].getHashWith(), txs[0].getNVout());
+    std::vector<QtumTransaction> txsCall;
+    txsCall.push_back(createQtumTransaction(CODE[2], 0, GASLIMIT, dev::u256(1), ++HASHTX, proxy));
+    executeBC(txsCall);
+
+    // Call mint
+    std::vector<QtumTransaction> txsMint;
+    txsMint.push_back(createQtumTransaction(CODE[3], 0, GASLIMIT, dev::u256(1), ++HASHTX, proxy));
+    auto result = executeBC(txsMint);
+    BOOST_CHECK(result.first[0].execRes.excepted == dev::eth::TransactionException::None);
+
+    // Call balance of
+    std::vector<QtumTransaction> txsbalance;
+    txsbalance.push_back(createQtumTransaction(ParseHex("70a082310000000000000000000000000101010101010101010101010101010101010101"), 0, GASLIMIT, dev::u256(1), ++HASHTX, proxy));
+    result = executeBC(txsbalance);
+    BOOST_CHECK(dev::h256(result.first[0].execRes.output) == dev::h256(0x0000000000000000000000000000000000000000000000000000000000000020));
+}
+
+BOOST_AUTO_TEST_CASE(checking_returndata_opcode_before_fork){
+    // Initialize
+    initState();
+    genesisLoading();
+    createNewBlocks(this,998 - COINBASE_MATURITY);
+
+    // Create contracts
+    std::vector<QtumTransaction> txs;
+    txs.push_back(createQtumTransaction(CODE[0], 0, GASLIMIT, dev::u256(1), HASHTX, dev::Address()));
+    txs.push_back(createQtumTransaction(CODE[1], 0, GASLIMIT, dev::u256(1), ++HASHTX, dev::Address()));
+    executeBC(txs);
+
+    // Call upgrade to
+    dev::Address proxy = createQtumAddress(txs[0].getHashWith(), txs[0].getNVout());
+    std::vector<QtumTransaction> txsCall;
+    txsCall.push_back(createQtumTransaction(CODE[2], 0, GASLIMIT, dev::u256(1), ++HASHTX, proxy));
+    executeBC(txsCall);
+
+    // Call mint
+    std::vector<QtumTransaction> txsMint;
+    txsMint.push_back(createQtumTransaction(CODE[3], 0, GASLIMIT, dev::u256(1), ++HASHTX, proxy));
+    auto result = executeBC(txsMint);
+    BOOST_CHECK(result.first[0].execRes.excepted == dev::eth::TransactionException::BadInstruction);
+}
+
+BOOST_AUTO_TEST_CASE(checking_constantinople_after_fork){
+    // Initialize
+    initState();
+    genesisLoading();
+    createNewBlocks(this,999 - COINBASE_MATURITY);
+
+    // Create contract
+    std::vector<QtumTransaction> txs;
+    txs.push_back(createQtumTransaction(CODE[4], 0, GASLIMIT, dev::u256(1), HASHTX, dev::Address()));
+    executeBC(txs);
+
+    // Call is it constantinople
+    dev::Address proxy = createQtumAddress(txs[0].getHashWith(), txs[0].getNVout());
+    std::vector<QtumTransaction> txIsItConstantinople;
+    txIsItConstantinople.push_back(createQtumTransaction(CODE[5], 0, GASLIMIT, dev::u256(1), ++HASHTX, proxy));
+    auto result = executeBC(txIsItConstantinople);
+    BOOST_CHECK(dev::h256(result.first[0].execRes.output) == dev::h256(0x0000000000000000000000000000000000000000000000000000000000000001));
+}
+
+BOOST_AUTO_TEST_CASE(checking_constantinople_before_fork){
+    // Initialize
+    initState();
+    genesisLoading();
+    createNewBlocks(this,998 - COINBASE_MATURITY);
+
+    // Create contract
+    std::vector<QtumTransaction> txs;
+    txs.push_back(createQtumTransaction(CODE[4], 0, GASLIMIT, dev::u256(1), HASHTX, dev::Address()));
+    executeBC(txs);
+
+    // Call is it constantinople
+    dev::Address proxy = createQtumAddress(txs[0].getHashWith(), txs[0].getNVout());
+    std::vector<QtumTransaction> txIsItConstantinople;
+    txIsItConstantinople.push_back(createQtumTransaction(CODE[5], 0, GASLIMIT, dev::u256(1), ++HASHTX, proxy));
+    auto result = executeBC(txIsItConstantinople);
+    BOOST_CHECK(dev::h256(result.first[0].execRes.output) == dev::h256(0x0000000000000000000000000000000000000000000000000000000000000000));
+}
+
+BOOST_AUTO_TEST_SUITE_END()
+
+}
diff --git a/src/test/qtumtests/dgp_tests.cpp b/src/test/qtumtests/dgp_tests.cpp
index d8cee9eba..365f3c4cf 100644
--- a/src/test/qtumtests/dgp_tests.cpp
+++ b/src/test/qtumtests/dgp_tests.cpp
@@ -286,6 +286,7 @@ dev::h256 hash = dev::h256(ParseHex("aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
 void contractLoading(){
     const CChainParams& chainparams = Params();
     dev::eth::ChainParams cp((chainparams.EVMGenesisInfo(dev::eth::Network::qtumMainNetwork)));
+    cp.constantinopleForkBlock = dev::u256(1400);
     globalState->populateFrom(cp.genesisState);
     globalSealEngine = std::unique_ptr<dev::eth::SealEngineFace>(cp.createSealEngine());
     globalState->db().commit();
@@ -304,7 +305,9 @@ bool compareEVMSchedule(const dev::eth::EVMSchedule& a, const dev::eth::EVMSched
     a.txDataNonZeroGas == b.txDataNonZeroGas && a.copyGas == b.copyGas && a.extcodesizeGas == b.extcodesizeGas &&
     a.extcodecopyGas == b.extcodecopyGas && a.balanceGas == b.balanceGas && a.suicideGas == b.suicideGas &&
     a.maxCodeSize == b.maxCodeSize && a.exceptionalFailedCodeDeposit == b.exceptionalFailedCodeDeposit &&
-    a.haveDelegateCall == b.haveDelegateCall && a.eip150Mode == b.eip150Mode && a.eip158Mode == b.eip158Mode)
+    a.haveDelegateCall == b.haveDelegateCall && a.eip150Mode == b.eip150Mode && a.eip158Mode == b.eip158Mode&&
+    a.haveRevert == b.haveRevert && a.haveStaticCall == b.haveStaticCall && a.haveReturnData == b.haveReturnData &&
+    a.blockRewardOverwrite == b.blockRewardOverwrite)
         return true;
     return false;
 }
@@ -375,6 +378,14 @@ BOOST_AUTO_TEST_CASE(gas_schedule_default_state_test2){
     BOOST_CHECK(compareEVMSchedule(schedule, dev::eth::EIP158Schedule));
 }
 
+BOOST_AUTO_TEST_CASE(gas_schedule_default_state_test3){
+    initState();
+    contractLoading();
+    QtumDGP qtumDGP(globalState.get());
+    dev::eth::EVMSchedule schedule = qtumDGP.getGasSchedule(1400);
+    BOOST_CHECK(compareEVMSchedule(schedule, dev::eth::ConstantinopleSchedule));
+}
+
 BOOST_AUTO_TEST_CASE(gas_schedule_one_paramsInstance_introductory_block_1_test1){
     initState();
     contractLoading();

From bf3c5941eb77ee2cf6b29771268dfec331d923d8 Mon Sep 17 00:00:00 2001
From: Time Markov <time.markov@qtum.com>
Date: Thu, 31 Jan 2019 13:31:24 +0100
Subject: [PATCH 017/153] Update build description

---
 README.md            | 6 +++---
 doc/build-freebsd.md | 2 +-
 doc/build-netbsd.md  | 1 +
 doc/build-openbsd.md | 2 +-
 doc/build-osx.md     | 2 +-
 doc/build-unix.md    | 9 +++++----
 6 files changed, 12 insertions(+), 10 deletions(-)

diff --git a/README.md b/README.md
index 677ecdb57..da071a904 100644
--- a/README.md
+++ b/README.md
@@ -110,7 +110,7 @@ Building Qtum Core
     This is a quick start script for compiling Qtum on  Ubuntu
 
 
-    sudo apt-get install build-essential libtool autotools-dev automake pkg-config libssl-dev libevent-dev bsdmainutils git cmake libboost-all-dev
+    sudo apt-get install build-essential libtool autotools-dev automake pkg-config libssl-dev libevent-dev bsdmainutils git cmake libboost-all-dev libgmp3-dev
     sudo apt-get install software-properties-common
     sudo add-apt-repository ppa:bitcoin/bitcoin
     sudo apt-get update
@@ -143,7 +143,7 @@ Here is a brief description for compiling Qtum on CentOS, for more details pleas
     
     # Installing Dependencies for Qtum
     sudo yum install epel-release
-    sudo yum install libtool libdb4-cxx-devel openssl-devel libevent-devel
+    sudo yum install libtool libdb4-cxx-devel openssl-devel libevent-devel gmp-devel
     
     # If you want to build the Qt GUI:
     sudo yum install qt5-qttools-devel protobuf-devel qrencode-devel
@@ -172,7 +172,7 @@ Then install [Homebrew](https://brew.sh).
 
 #### Dependencies
 
-    brew install cmake automake berkeley-db4 libtool boost --c++11 --without-single --without-static miniupnpc openssl pkg-config protobuf qt5 libevent imagemagick --with-librsvg qrencode
+    brew install cmake automake berkeley-db4 libtool boost --c++11 --without-single --without-static miniupnpc openssl pkg-config protobuf qt5 libevent imagemagick --with-librsvg qrencode gmp
 
 NOTE: Building with Qt4 is still supported, however, could result in a broken UI. Building with Qt5 is recommended.
 
diff --git a/doc/build-freebsd.md b/doc/build-freebsd.md
index 0e6eedcab..103cbd098 100644
--- a/doc/build-freebsd.md
+++ b/doc/build-freebsd.md
@@ -11,7 +11,7 @@ This guide does not contain instructions for building the GUI.
 You will need the following dependencies, which can be installed as root via pkg:
 
 ```
-pkg install autoconf automake boost-libs git gmake libevent libtool openssl pkgconf
+pkg install autoconf automake boost-libs git gmake libevent libtool openssl pkgconf gmp
 ```
 
 For the wallet (optional):
diff --git a/doc/build-netbsd.md b/doc/build-netbsd.md
index 67ba87a24..68b287b4f 100644
--- a/doc/build-netbsd.md
+++ b/doc/build-netbsd.md
@@ -21,6 +21,7 @@ libevent
 libtool
 pkg-config
 python37
+gmp
 
 git clone https://github.com/qtumproject/qtum --recursive
 ```
diff --git a/doc/build-openbsd.md b/doc/build-openbsd.md
index f07029e74..3e200b78a 100644
--- a/doc/build-openbsd.md
+++ b/doc/build-openbsd.md
@@ -12,7 +12,7 @@ Preparation
 Run the following as root to install the base dependencies for building:
 
 ```bash
-pkg_add git gmake libevent libtool boost
+pkg_add git gmake libevent libtool boost gmp
 pkg_add autoconf # (select highest version, e.g. 2.69)
 pkg_add automake # (select highest version, e.g. 1.15)
 pkg_add python # (select highest version, e.g. 3.6)
diff --git a/doc/build-osx.md b/doc/build-osx.md
index 281654a56..8c5a13090 100644
--- a/doc/build-osx.md
+++ b/doc/build-osx.md
@@ -16,7 +16,7 @@ Then install [Homebrew](https://brew.sh).
 Dependencies
 ----------------------
 
-    brew install cmake automake berkeley-db4 libtool boost --c++11 --without-single --without-static miniupnpc openssl pkg-config protobuf qt5 libevent
+    brew install cmake automake berkeley-db4 libtool boost --c++11 --without-single --without-static miniupnpc openssl pkg-config protobuf qt5 libevent gmp
 
 See [dependencies.md](dependencies.md) for a complete overview.
 
diff --git a/doc/build-unix.md b/doc/build-unix.md
index c3408205b..f8c8fdc8a 100644
--- a/doc/build-unix.md
+++ b/doc/build-unix.md
@@ -36,6 +36,7 @@ These dependencies are required:
  libssl      | Crypto           | Random Number Generation, Elliptic Curve Cryptography
  libboost    | Utility          | Library for threading, data structures, etc
  libevent    | Networking       | OS independent asynchronous networking
+ libgmp      | Math             | The GNU Multiple Precision Arithmetic Library
 
 Optional dependencies:
 
@@ -70,7 +71,7 @@ tuned to conserve memory with additional CXXFLAGS:
 
 Build requirements:
 
-    sudo apt-get install build-essential libtool autotools-dev automake pkg-config libssl-dev libevent-dev bsdmainutils python3 libboost-system-dev libboost-filesystem-dev libboost-chrono-dev libboost-test-dev libboost-thread-dev
+    sudo apt-get install build-essential libtool autotools-dev automake pkg-config libssl-dev libevent-dev bsdmainutils python3 libboost-system-dev libboost-filesystem-dev libboost-chrono-dev libboost-test-dev libboost-thread-dev libgmp3-dev
 
 BerkeleyDB is required for the wallet.
 
@@ -121,7 +122,7 @@ built by default.
 
 Build requirements:
 
-    sudo dnf install gcc-c++ libtool make autoconf automake openssl-devel libevent-devel boost-devel libdb4-devel libdb4-cxx-devel python3
+    sudo dnf install gcc-c++ libtool make autoconf automake openssl-devel libevent-devel boost-devel libdb4-devel libdb4-cxx-devel python3 gmp-devel
 
 Optional:
 
@@ -143,7 +144,7 @@ You need to build boost manually, and if it's not in standard library paths, you
 Build requirements:
 
     sudo yum install epel-release
-    sudo yum install gcc-c++ libtool libdb4-cxx-devel openssl-devel libevent-devel
+    sudo yum install gcc-c++ libtool libdb4-cxx-devel openssl-devel libevent-devel gmp-devel
     
 To build with Qt 5 (recommended) you need the following:
 
@@ -262,7 +263,7 @@ Setup and Build Example: Arch Linux
 -----------------------------------
 This example lists the steps necessary to setup and build a command line only, non-wallet distribution of the latest changes on Arch Linux:
 
-    pacman -S git base-devel boost libevent python
+    pacman -S git base-devel boost libevent python gmp
     git clone https://github.com/qtumproject/qtum --recursive
     cd qtum/
     ./autogen.sh

From 59e57c37763acc76ad26aec10d63b35660969d4a Mon Sep 17 00:00:00 2001
From: Time Markov <time.markov@qtum.com>
Date: Mon, 4 Feb 2019 10:36:04 +0100
Subject: [PATCH 018/153] Update submodule

---
 src/cpp-ethereum | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/cpp-ethereum b/src/cpp-ethereum
index 8366d7310..d2637ab1a 160000
--- a/src/cpp-ethereum
+++ b/src/cpp-ethereum
@@ -1 +1 @@
-Subproject commit 8366d7310750036402bf7171c7ee2fdf4ba60ae9
+Subproject commit d2637ab1a7e0217876547b7abf7b6b6043e703f2

From ccb59e22a27752ae453d6a84608961ce18794bcb Mon Sep 17 00:00:00 2001
From: Time Markov <time.markov@qtum.com>
Date: Mon, 4 Feb 2019 12:03:36 +0100
Subject: [PATCH 019/153] Update min boost version required to 1.64 The boost
 1.64 is required for the EVM

---
 configure.ac | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/configure.ac b/configure.ac
index b2747d0d8..908a6e43b 100644
--- a/configure.ac
+++ b/configure.ac
@@ -905,7 +905,7 @@ fi
 if test x$use_boost = xyes; then
 
 dnl Minimum required Boost version
-define(MINIMUM_REQUIRED_BOOST, 1.58.0)
+define(MINIMUM_REQUIRED_BOOST, 1.64.0)
 
 dnl Check for boost libs
 AX_BOOST_BASE([MINIMUM_REQUIRED_BOOST])

From 8b50e9c50612cd6069c8c6dde52cab642fb01e42 Mon Sep 17 00:00:00 2001
From: Time Markov <time.markov@qtum.com>
Date: Mon, 4 Feb 2019 14:52:06 +0100
Subject: [PATCH 020/153] Add QIP7 activation block to the unit tests params

---
 src/chainparams.cpp | 1 +
 src/cpp-ethereum    | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/chainparams.cpp b/src/chainparams.cpp
index 7b6d579f3..21643a1bc 100644
--- a/src/chainparams.cpp
+++ b/src/chainparams.cpp
@@ -397,6 +397,7 @@ class CUnitTestParams : public CRegTestParams
         consensus.BIP34Hash = uint256();
         consensus.BIP65Height = 1351; // BIP65 activated on regtest (Used in rpc activation tests)
         consensus.BIP66Height = 1251; // BIP66 activated on regtest (Used in rpc activation tests)
+        consensus.QIP7Height = 0x7fffffff; // QIP7 is not activated by default for all unit tests, it is activated when tested by specific unit tests
 
         // QTUM have 500 blocks of maturity, increased values for regtest in unit tests in order to correspond with it
         consensus.nSubsidyHalvingInterval = 750;
diff --git a/src/cpp-ethereum b/src/cpp-ethereum
index d2637ab1a..d5cbe3c59 160000
--- a/src/cpp-ethereum
+++ b/src/cpp-ethereum
@@ -1 +1 @@
-Subproject commit d2637ab1a7e0217876547b7abf7b6b6043e703f2
+Subproject commit d5cbe3c5934f0b9ae4b0dbbe4dc264389d5281c5

From 8cab7b8ce451b95cad8015d47d531f579f2aeaef Mon Sep 17 00:00:00 2001
From: Time Markov <time.markov@qtum.com>
Date: Fri, 15 Feb 2019 12:00:05 +0100
Subject: [PATCH 021/153] Add op_sender code

---
 src/script/interpreter.cpp |  1 +
 src/script/script.cpp      |  1 +
 src/script/script.h        | 10 ++++++++++
 src/script/standard.cpp    | 20 ++++++++++++++++++++
 src/script/standard.h      |  2 ++
 5 files changed, 34 insertions(+)

diff --git a/src/script/interpreter.cpp b/src/script/interpreter.cpp
index 0ecb9eb0c..9a25c1793 100644
--- a/src/script/interpreter.cpp
+++ b/src/script/interpreter.cpp
@@ -1070,6 +1070,7 @@ bool EvalScript(std::vector<std::vector<unsigned char> >& stack, const CScript&
                 break;
 
                 //////////////////////////////////////////////////////// qtum
+                case OP_SENDER:
                 case OP_SPEND:
                 {
                     return true; // temp
diff --git a/src/script/script.cpp b/src/script/script.cpp
index 494b2eb5f..035a1adf5 100644
--- a/src/script/script.cpp
+++ b/src/script/script.cpp
@@ -143,6 +143,7 @@ const char* GetOpName(opcodetype opcode)
     case OP_CREATE                 : return "OP_CREATE";
     case OP_CALL                   : return "OP_CALL";
     case OP_SPEND                  : return "OP_SPEND";
+    case OP_SENDER                 : return "OP_SENDER";
 
     case OP_INVALIDOPCODE          : return "OP_INVALIDOPCODE";
 
diff --git a/src/script/script.h b/src/script/script.h
index 571608ded..3a5059800 100644
--- a/src/script/script.h
+++ b/src/script/script.h
@@ -185,8 +185,12 @@ enum opcodetype
     OP_CREATE = 0xc1,
     OP_CALL = 0xc2,
     OP_SPEND = 0xc3,
+    OP_SENDER = 0xc4,
 
     // template matching params
+    OP_ADDRESS_TYPE = 0xf2,
+    OP_ADDRESS = 0xf3,
+    OP_SCRIPT_SIG = 0xf4,
     OP_GAS_PRICE = 0xf5,
     OP_VERSION = 0xf6,
     OP_GAS_LIMIT = 0xf7,
@@ -613,10 +617,16 @@ class CScript : public CScriptBase
     {
         return Find(OP_CALL) == 1;
     }
+
     bool HasOpSpend() const
     {
         return size()==1 && *begin() == OP_SPEND;
     }
+
+    bool HasOpSender() const
+    {
+        return Find(OP_SENDER) == 1;
+    }
     /////////////////////////////////////////
 
     void clear()
diff --git a/src/script/standard.cpp b/src/script/standard.cpp
index 55edd6f0f..62294570e 100644
--- a/src/script/standard.cpp
+++ b/src/script/standard.cpp
@@ -42,6 +42,8 @@ const char* GetTxnOutputType(txnouttype t)
     case TX_WITNESS_UNKNOWN: return "witness_unknown";
     case TX_CREATE: return "create";
     case TX_CALL: return "call";
+    case TX_CREATE_SENDER: return "create_sender";
+    case TX_CALL_SENDER: return "call_sender";
     }
     return nullptr;
 }
@@ -70,6 +72,12 @@ bool Solver(const CScript& scriptPubKey, txnouttype& typeRet, std::vector<std::v
 
         // Call contract tx
         mTemplates.insert(std::make_pair(TX_CALL, CScript() << OP_VERSION << OP_GAS_LIMIT << OP_GAS_PRICE << OP_DATA << OP_PUBKEYHASH << OP_CALL));
+
+        // Contract creation tx with sender
+        mTemplates.insert(std::make_pair(TX_CREATE_SENDER, CScript() << OP_ADDRESS_TYPE << OP_ADDRESS << OP_SCRIPT_SIG << OP_SENDER << OP_VERSION << OP_GAS_LIMIT << OP_GAS_PRICE << OP_DATA << OP_CREATE));
+
+        // Call contract tx with sender
+        mTemplates.insert(std::make_pair(TX_CALL_SENDER, CScript() << OP_ADDRESS_TYPE << OP_ADDRESS << OP_SCRIPT_SIG << OP_SENDER << OP_VERSION << OP_GAS_LIMIT << OP_GAS_PRICE << OP_DATA << OP_PUBKEYHASH << OP_CALL));
     }
 
     vSolutionsRet.clear();
@@ -263,6 +271,18 @@ bool Solver(const CScript& scriptPubKey, txnouttype& typeRet, std::vector<std::v
                         break;
                 }
             }
+            else if(opcode2 == OP_ADDRESS_TYPE)
+            {
+                //TBD
+            }
+            else if(opcode2 == OP_ADDRESS)
+            {
+                //TBD
+            }
+            else if(opcode2 == OP_SCRIPT_SIG)
+            {
+                //TBD
+            }
             ///////////////////////////////////////////////////////////
             else if (opcode1 != opcode2 || vch1 != vch2)
             {
diff --git a/src/script/standard.h b/src/script/standard.h
index e6cc7c92f..031e2b6bc 100644
--- a/src/script/standard.h
+++ b/src/script/standard.h
@@ -74,6 +74,8 @@ enum txnouttype
     TX_WITNESS_UNKNOWN, //!< Only for Witness versions not already defined above
     TX_CREATE,
     TX_CALL,
+    TX_CREATE_SENDER,
+    TX_CALL_SENDER,
 };
 
 class CNoDestination {

From a37f904f2b190fea80b73094c7a9312796f61b1a Mon Sep 17 00:00:00 2001
From: Time Markov <time.markov@qtum.com>
Date: Mon, 18 Feb 2019 09:13:57 +0100
Subject: [PATCH 022/153] Update the addressfield to allow any valid pubkeyhash
 address for sender

---
 src/qt/addressfield.cpp   | 9 ++++++++-
 src/qt/createcontract.cpp | 1 +
 src/qt/sendtocontract.cpp | 1 +
 3 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/src/qt/addressfield.cpp b/src/qt/addressfield.cpp
index ba06ce5cc..7ea103d7b 100644
--- a/src/qt/addressfield.cpp
+++ b/src/qt/addressfield.cpp
@@ -110,7 +110,14 @@ void AddressField::on_refresh()
     int index = m_stringList.indexOf(currentAddress);
     m_stringModel.setStringList(m_stringList);
     setModel(&m_stringModel);
-    setCurrentIndex(index);
+    if(!isEditable())
+    {
+        setCurrentIndex(index);
+    }
+    else
+    {
+        setCurrentText(currentAddress);
+    }
 }
 
 void AddressField::on_addressTypeChanged()
diff --git a/src/qt/createcontract.cpp b/src/qt/createcontract.cpp
index a31bd4cc1..bd8ac97f2 100644
--- a/src/qt/createcontract.cpp
+++ b/src/qt/createcontract.cpp
@@ -70,6 +70,7 @@ CreateContract::CreateContract(const PlatformStyle *platformStyle, QWidget *pare
     ui->lineEditGasLimit->setValue(DEFAULT_GAS_LIMIT_OP_CREATE);
     ui->pushButtonCreateContract->setEnabled(false);
     ui->lineEditSenderAddress->setSenderAddress(true);
+    ui->lineEditSenderAddress->setComboBoxEditable(true);
 
     // Create new PRC command line interface
     QStringList lstMandatory;
diff --git a/src/qt/sendtocontract.cpp b/src/qt/sendtocontract.cpp
index 8a5e06082..02ca0fc64 100644
--- a/src/qt/sendtocontract.cpp
+++ b/src/qt/sendtocontract.cpp
@@ -84,6 +84,7 @@ SendToContract::SendToContract(const PlatformStyle *platformStyle, QWidget *pare
     ui->textEditInterface->setIsValidManually(true);
     ui->pushButtonSendToContract->setEnabled(false);
     ui->lineEditSenderAddress->setSenderAddress(true);
+    ui->lineEditSenderAddress->setComboBoxEditable(true);
 
     // Create new PRC command line interface
     QStringList lstMandatory;

From a3a9b94f7ac5e7f43043058a2a4401999c1788a9 Mon Sep 17 00:00:00 2001
From: Time Markov <time.markov@qtum.com>
Date: Mon, 18 Feb 2019 12:53:45 +0100
Subject: [PATCH 023/153] Update createcontract and sendtocontract for
 senderaddress with no UTXO

---
 src/wallet/rpcwallet.cpp | 71 +++++++++++++++++++++++-----------------
 src/wallet/wallet.cpp    |  2 +-
 src/wallet/wallet.h      |  2 +-
 3 files changed, 43 insertions(+), 32 deletions(-)

diff --git a/src/wallet/rpcwallet.cpp b/src/wallet/rpcwallet.cpp
index 02add9e30..d78481e0b 100755
--- a/src/wallet/rpcwallet.cpp
+++ b/src/wallet/rpcwallet.cpp
@@ -748,36 +748,41 @@ static UniValue createcontract(const JSONRPCRequest& request){
 
     CCoinControl coinControl;
 
+    CTxDestination signSenderAddress = CNoDestination();
     if(fHasSender){
-    //find a UTXO with sender address
-
-     UniValue results(UniValue::VARR);
-     std::vector<COutput> vecOutputs;
+        // Find a UTXO with sender address
+        std::vector<COutput> vecOutputs;
 
-     coinControl.fAllowOtherInputs=true;
+        coinControl.fAllowOtherInputs=true;
 
-     assert(pwallet != NULL);
-     pwallet->AvailableCoins(vecOutputs, false, NULL, true);
+        assert(pwallet != NULL);
+        pwallet->AvailableCoins(vecOutputs, false, NULL, true);
 
-     for (const COutput& out : vecOutputs) {
-         CTxDestination destAdress;
-         const CScript& scriptPubKey = out.tx->tx->vout[out.i].scriptPubKey;
-         bool fValidAddress = ExtractDestination(scriptPubKey, destAdress);
+        for (const COutput& out : vecOutputs) {
+            CTxDestination destAdress;
+            const CScript& scriptPubKey = out.tx->tx->vout[out.i].scriptPubKey;
+            bool fValidAddress = ExtractDestination(scriptPubKey, destAdress);
 
-         if (!fValidAddress || senderAddress != destAdress)
-             continue;
+            if (!fValidAddress || senderAddress != destAdress)
+                continue;
 
-         coinControl.Select(COutPoint(out.tx->GetHash(),out.i));
+            coinControl.Select(COutPoint(out.tx->GetHash(),out.i));
 
-         break;
+            break;
 
-     }
+        }
 
-        if(!coinControl.HasSelected()){
-            throw JSONRPCError(RPC_TYPE_ERROR, "Sender address does not have any unspent outputs");
+        if(coinControl.HasSelected())
+        {
+            // Change to the sender
+            if(fChangeToSender){
+                coinControl.destChange=senderAddress;
+            }
         }
-        if(fChangeToSender){
-            coinControl.destChange=senderAddress;
+        else
+        {
+            // Sign the sender in case of no UTXO
+            signSenderAddress = senderAddress;
         }
     }
     EnsureWalletIsUnlocked(pwallet);
@@ -806,7 +811,7 @@ static UniValue createcontract(const JSONRPCRequest& request){
     vecSend.push_back(recipient);
 
     CTransactionRef tx;
-    if (!pwallet->CreateTransaction(vecSend, tx, reservekey, nFeeRequired, nChangePosRet, strError, coinControl, true, nGasFee, fHasSender)) {
+    if (!pwallet->CreateTransaction(vecSend, tx, reservekey, nFeeRequired, nChangePosRet, strError, coinControl, true, nGasFee, fHasSender, signSenderAddress)) {
         if (nFeeRequired > pwallet->GetBalance())
             strError = strprintf("Error: This transaction requires a transaction fee of at least %s because of its amount, complexity, or use of recently received funds!", FormatMoney(nFeeRequired));
         throw JSONRPCError(RPC_WALLET_ERROR, strError);
@@ -815,7 +820,7 @@ static UniValue createcontract(const JSONRPCRequest& request){
     CTxDestination txSenderDest;
     ExtractDestination(pwallet->mapWallet.at(tx->vin[0].prevout.hash).tx->vout[tx->vin[0].prevout.n].scriptPubKey,txSenderDest);
 
-    if (fHasSender && !(senderAddress == txSenderDest)){
+    if (fHasSender && coinControl.HasSelected() && !(senderAddress == txSenderDest)){
            throw JSONRPCError(RPC_TYPE_ERROR, "Sender could not be set, transaction was not committed!");
     }
 
@@ -966,9 +971,9 @@ static UniValue sendtocontract(const JSONRPCRequest& request){
 
     CCoinControl coinControl;
 
+    CTxDestination signSenderAddress = CNoDestination();
     if(fHasSender){
-
-        UniValue results(UniValue::VARR);
+        // Find a UTXO with sender address
         std::vector<COutput> vecOutputs;
 
         coinControl.fAllowOtherInputs=true;
@@ -991,11 +996,17 @@ static UniValue sendtocontract(const JSONRPCRequest& request){
 
         }
 
-        if(!coinControl.HasSelected()){
-            throw JSONRPCError(RPC_TYPE_ERROR, "Sender address does not have any unspent outputs");
+        if(coinControl.HasSelected())
+        {
+            // Change to the sender
+            if(fChangeToSender){
+                coinControl.destChange=senderAddress;
+            }
         }
-        if(fChangeToSender){
-            coinControl.destChange=senderAddress;
+        else
+        {
+            // Sign the sender in case of no UTXO
+            signSenderAddress = senderAddress;
         }
     }
 
@@ -1025,7 +1036,7 @@ static UniValue sendtocontract(const JSONRPCRequest& request){
     vecSend.push_back(recipient);
 
     CTransactionRef tx;
-    if (!pwallet->CreateTransaction(vecSend, tx, reservekey, nFeeRequired, nChangePosRet, strError, coinControl, true, nGasFee, fHasSender)) {
+    if (!pwallet->CreateTransaction(vecSend, tx, reservekey, nFeeRequired, nChangePosRet, strError, coinControl, true, nGasFee, fHasSender, signSenderAddress)) {
         if (nFeeRequired > pwallet->GetBalance())
             strError = strprintf("Error: This transaction requires a transaction fee of at least %s because of its amount, complexity, or use of recently received funds!", FormatMoney(nFeeRequired));
         throw JSONRPCError(RPC_WALLET_ERROR, strError);
@@ -1034,7 +1045,7 @@ static UniValue sendtocontract(const JSONRPCRequest& request){
     CTxDestination txSenderDest;
     ExtractDestination(pwallet->mapWallet.at(tx->vin[0].prevout.hash).tx->vout[tx->vin[0].prevout.n].scriptPubKey,txSenderDest);
 
-    if (fHasSender && !(senderAddress == txSenderDest)){
+    if (fHasSender && coinControl.HasSelected() && !(senderAddress == txSenderDest)){
         throw JSONRPCError(RPC_TYPE_ERROR, "Sender could not be set, transaction was not committed!");
     }
 
diff --git a/src/wallet/wallet.cpp b/src/wallet/wallet.cpp
index 2dcdc98ba..b3bff7859 100644
--- a/src/wallet/wallet.cpp
+++ b/src/wallet/wallet.cpp
@@ -2989,7 +2989,7 @@ OutputType CWallet::TransactionChangeType(OutputType change_type, const std::vec
 }
 
 bool CWallet::CreateTransaction(const std::vector<CRecipient>& vecSend, CTransactionRef& tx, CReserveKey& reservekey, CAmount& nFeeRet,
-                         int& nChangePosInOut, std::string& strFailReason, const CCoinControl& coin_control, bool sign, CAmount nGasFee, bool hasSender)
+                         int& nChangePosInOut, std::string& strFailReason, const CCoinControl& coin_control, bool sign, CAmount nGasFee, bool hasSender, const CTxDestination& signSenderAddress)
 {
     CAmount nValue = 0;
     int nChangePosRequest = nChangePosInOut;
diff --git a/src/wallet/wallet.h b/src/wallet/wallet.h
index 2695e545c..682847366 100644
--- a/src/wallet/wallet.h
+++ b/src/wallet/wallet.h
@@ -1022,7 +1022,7 @@ class CWallet final : public CCryptoKeyStore, public CValidationInterface
      * @note passing nChangePosInOut as -1 will result in setting a random position
      */
     bool CreateTransaction(const std::vector<CRecipient>& vecSend, CTransactionRef& tx, CReserveKey& reservekey, CAmount& nFeeRet, int& nChangePosInOut,
-                           std::string& strFailReason, const CCoinControl& coin_control, bool sign = true, CAmount nGasFee=0, bool hasSender=false);
+                           std::string& strFailReason, const CCoinControl& coin_control, bool sign = true, CAmount nGasFee=0, bool hasSender=false, const CTxDestination& signSenderAddress = CNoDestination());
     bool CommitTransaction(CTransactionRef tx, mapValue_t mapValue, std::vector<std::pair<std::string, std::string>> orderForm, std::string fromAccount, CReserveKey& reservekey, CConnman* connman, CValidationState& state);
 
     void ListAccountCreditDebit(const std::string& strAccount, std::list<CAccountingEntry>& entries);

From f26e67362b7141d505d979a54432acb3bd51f328 Mon Sep 17 00:00:00 2001
From: Time Markov <time.markov@qtum.com>
Date: Tue, 19 Feb 2019 12:01:26 +0100
Subject: [PATCH 024/153] Add hash function for sender outputs

---
 src/script/interpreter.cpp | 53 ++++++++++++++++++++++++++++++++++++++
 src/script/interpreter.h   |  3 +++
 2 files changed, 56 insertions(+)

diff --git a/src/script/interpreter.cpp b/src/script/interpreter.cpp
index 9a25c1793..b5efc980d 100644
--- a/src/script/interpreter.cpp
+++ b/src/script/interpreter.cpp
@@ -11,6 +11,7 @@
 #include <pubkey.h>
 #include <script/script.h>
 #include <uint256.h>
+#include <script/standard.h>
 
 
 namespace {
@@ -1253,6 +1254,58 @@ PrecomputedTransactionData::PrecomputedTransactionData(const T& txTo)
 template PrecomputedTransactionData::PrecomputedTransactionData(const CTransaction& txTo);
 template PrecomputedTransactionData::PrecomputedTransactionData(const CMutableTransaction& txTo);
 
+template <class T>
+uint256 SignatureHashOut(const CScript& scriptCode, const T& txTo, unsigned int nOut, int nHashType, const CScript& scriptSender, SigVersion sigversion, const PrecomputedTransactionData* cache)
+{
+    assert(nOut < txTo.vout.size());
+
+    uint256 hashPrevouts;
+    uint256 hashSequence;
+    uint256 hashOutputs;
+    const bool cacheready = cache && cache->ready;
+
+    if (!(nHashType & SIGHASH_ANYONECANPAY)) {
+        hashPrevouts = cacheready ? cache->hashPrevouts : GetPrevoutHash(txTo);
+    }
+
+    if (!(nHashType & SIGHASH_ANYONECANPAY) && (nHashType & 0x1f) != SIGHASH_SINGLE && (nHashType & 0x1f) != SIGHASH_NONE) {
+        hashSequence = cacheready ? cache->hashSequence : GetSequenceHash(txTo);
+    }
+
+
+    if ((nHashType & 0x1f) != SIGHASH_SINGLE && (nHashType & 0x1f) != SIGHASH_NONE) {
+        hashOutputs = cacheready ? cache->hashOutputs : GetOutputsHash(txTo);
+    } else if ((nHashType & 0x1f) == SIGHASH_SINGLE && nOut < txTo.vout.size()) {
+        CHashWriter ss(SER_GETHASH, 0);
+        ss << txTo.vout[nOut];
+        hashOutputs = ss.GetHash();
+    }
+
+    CHashWriter ss(SER_GETHASH, 0);
+
+    // Version
+    ss << txTo.nVersion;
+    // Input prevouts/nSequence (none/all, depending on flags)
+    ss << hashPrevouts;
+    ss << hashSequence;
+    // The output being signed
+    ss << txTo.vout[nOut];
+    ss << scriptCode;
+    ss << scriptSender;
+    // Outputs (none/one/all, depending on flags)
+    ss << hashOutputs;
+    // Locktime
+    ss << txTo.nLockTime;
+    // Sighash type
+    ss << nHashType;
+
+    return ss.GetHash();
+}
+
+// explicit instantiation
+template uint256 SignatureHashOut(const CScript& scriptCode, const CTransaction& txTo, unsigned int nOut, int nHashType, const CScript& scriptSender, SigVersion sigversion, const PrecomputedTransactionData* cache);
+template uint256 SignatureHashOut(const CScript& scriptCode, const CMutableTransaction& txTo, unsigned int nOut, int nHashType, const CScript& scriptSender, SigVersion sigversion, const PrecomputedTransactionData* cache);
+
 template <class T>
 uint256 SignatureHash(const CScript& scriptCode, const T& txTo, unsigned int nIn, int nHashType, const CAmount& amount, SigVersion sigversion, const PrecomputedTransactionData* cache)
 {
diff --git a/src/script/interpreter.h b/src/script/interpreter.h
index 2743e1fe6..eaec3f91b 100644
--- a/src/script/interpreter.h
+++ b/src/script/interpreter.h
@@ -147,6 +147,9 @@ static constexpr size_t WITNESS_V0_KEYHASH_SIZE = 20;
 template <class T>
 uint256 SignatureHash(const CScript& scriptCode, const T& txTo, unsigned int nIn, int nHashType, const CAmount& amount, SigVersion sigversion, const PrecomputedTransactionData* cache = nullptr);
 
+template <class T>
+uint256 SignatureHashOut(const CScript& scriptCode, const T& txTo, unsigned int nOut, int nHashType, const CScript& scriptSender, SigVersion sigversion, const PrecomputedTransactionData* cache = nullptr);
+
 class BaseSignatureChecker
 {
 public:

From a9423c2c9ba3c77165b377c65884e19cfd49e9a3 Mon Sep 17 00:00:00 2001
From: Time Markov <time.markov@qtum.com>
Date: Tue, 19 Feb 2019 14:21:22 +0100
Subject: [PATCH 025/153] Add generic transaction signature output checker

---
 src/script/interpreter.cpp | 38 +++++++++++++++++++++++++++++++++-----
 src/script/interpreter.h   | 23 ++++++++++++++++++++++-
 2 files changed, 55 insertions(+), 6 deletions(-)

diff --git a/src/script/interpreter.cpp b/src/script/interpreter.cpp
index b5efc980d..a40cca625 100644
--- a/src/script/interpreter.cpp
+++ b/src/script/interpreter.cpp
@@ -1255,7 +1255,7 @@ template PrecomputedTransactionData::PrecomputedTransactionData(const CTransacti
 template PrecomputedTransactionData::PrecomputedTransactionData(const CMutableTransaction& txTo);
 
 template <class T>
-uint256 SignatureHashOut(const CScript& scriptCode, const T& txTo, unsigned int nOut, int nHashType, const CScript& scriptSender, SigVersion sigversion, const PrecomputedTransactionData* cache)
+uint256 SignatureHashOutput(const CScript& scriptCode, const T& txTo, unsigned int nOut, int nHashType, const CScript& scriptSender, SigVersion sigversion, const PrecomputedTransactionData* cache)
 {
     assert(nOut < txTo.vout.size());
 
@@ -1302,10 +1302,6 @@ uint256 SignatureHashOut(const CScript& scriptCode, const T& txTo, unsigned int
     return ss.GetHash();
 }
 
-// explicit instantiation
-template uint256 SignatureHashOut(const CScript& scriptCode, const CTransaction& txTo, unsigned int nOut, int nHashType, const CScript& scriptSender, SigVersion sigversion, const PrecomputedTransactionData* cache);
-template uint256 SignatureHashOut(const CScript& scriptCode, const CMutableTransaction& txTo, unsigned int nOut, int nHashType, const CScript& scriptSender, SigVersion sigversion, const PrecomputedTransactionData* cache);
-
 template <class T>
 uint256 SignatureHash(const CScript& scriptCode, const T& txTo, unsigned int nIn, int nHashType, const CAmount& amount, SigVersion sigversion, const PrecomputedTransactionData* cache)
 {
@@ -1492,6 +1488,38 @@ bool GenericTransactionSignatureChecker<T>::CheckSequence(const CScriptNum& nSeq
 template class GenericTransactionSignatureChecker<CTransaction>;
 template class GenericTransactionSignatureChecker<CMutableTransaction>;
 
+template <class T>
+bool GenericTransactionSignatureOutputChecker<T>::VerifySignature(const std::vector<unsigned char>& vchSig, const CPubKey& pubkey, const uint256& sighash) const
+{
+    return pubkey.Verify(sighash, vchSig);
+}
+
+template <class T>
+bool GenericTransactionSignatureOutputChecker<T>::CheckSig(const std::vector<unsigned char>& vchSigIn, const std::vector<unsigned char>& vchPubKey, const CScript& scriptCode, SigVersion sigversion) const
+{
+    CPubKey pubkey(vchPubKey);
+    if (!pubkey.IsValid())
+        return false;
+
+    // Hash type is one byte tacked on to the end of the signature
+    std::vector<unsigned char> vchSig(vchSigIn);
+    if (vchSig.empty())
+        return false;
+    int nHashType = vchSig.back();
+    vchSig.pop_back();
+
+    uint256 sighash = SignatureHashOutput(scriptCode, *txTo, nOut, nHashType, scriptSender, sigversion, this->txdata);
+
+    if (!VerifySignature(vchSig, pubkey, sighash))
+        return false;
+
+    return true;
+}
+
+// explicit instantiation
+template class GenericTransactionSignatureOutputChecker<CTransaction>;
+template class GenericTransactionSignatureOutputChecker<CMutableTransaction>;
+
 static bool VerifyWitnessProgram(const CScriptWitness& witness, int witversion, const std::vector<unsigned char>& program, unsigned int flags, const BaseSignatureChecker& checker, ScriptError* serror)
 {
     std::vector<std::vector<unsigned char> > stack;
diff --git a/src/script/interpreter.h b/src/script/interpreter.h
index eaec3f91b..34e122a85 100644
--- a/src/script/interpreter.h
+++ b/src/script/interpreter.h
@@ -148,7 +148,7 @@ template <class T>
 uint256 SignatureHash(const CScript& scriptCode, const T& txTo, unsigned int nIn, int nHashType, const CAmount& amount, SigVersion sigversion, const PrecomputedTransactionData* cache = nullptr);
 
 template <class T>
-uint256 SignatureHashOut(const CScript& scriptCode, const T& txTo, unsigned int nOut, int nHashType, const CScript& scriptSender, SigVersion sigversion, const PrecomputedTransactionData* cache = nullptr);
+uint256 SignatureHashOutput(const CScript& scriptCode, const T& txTo, unsigned int nOut, int nHashType, const CScript& scriptSender, SigVersion sigversion, const PrecomputedTransactionData* cache = nullptr);
 
 class BaseSignatureChecker
 {
@@ -194,6 +194,27 @@ class GenericTransactionSignatureChecker : public BaseSignatureChecker
 using TransactionSignatureChecker = GenericTransactionSignatureChecker<CTransaction>;
 using MutableTransactionSignatureChecker = GenericTransactionSignatureChecker<CMutableTransaction>;
 
+template <class T>
+class GenericTransactionSignatureOutputChecker : public BaseSignatureChecker
+{
+private:
+    const T* txTo;
+    unsigned int nOut;
+    const CScript scriptSender;
+    const PrecomputedTransactionData* txdata;
+
+protected:
+    virtual bool VerifySignature(const std::vector<unsigned char>& vchSig, const CPubKey& vchPubKey, const uint256& sighash) const;
+
+public:
+    GenericTransactionSignatureOutputChecker(const T* txToIn, unsigned int nInOut, const CScript& scriptSenderIn) : txTo(txToIn), nOut(nInOut), scriptSender(scriptSenderIn), txdata(nullptr) {}
+    GenericTransactionSignatureOutputChecker(const T* txToIn, unsigned int nInOut, const CScript& scriptSenderIn, const PrecomputedTransactionData& txdataIn) : txTo(txToIn), nOut(nInOut), scriptSender(scriptSenderIn), txdata(&txdataIn) {}
+    bool CheckSig(const std::vector<unsigned char>& scriptSig, const std::vector<unsigned char>& vchPubKey, const CScript& scriptCode, SigVersion sigversion) const override;
+};
+
+using TransactionSignatureOutputChecker = GenericTransactionSignatureOutputChecker<CTransaction>;
+using MutableTransactionSignatureOutputChecker = GenericTransactionSignatureOutputChecker<CMutableTransaction>;
+
 bool EvalScript(std::vector<std::vector<unsigned char> >& stack, const CScript& script, unsigned int flags, const BaseSignatureChecker& checker, SigVersion sigversion, ScriptError* error = nullptr);
 bool VerifyScript(const CScript& scriptSig, const CScript& scriptPubKey, const CScriptWitness* witness, unsigned int flags, const BaseSignatureChecker& checker, ScriptError* serror = nullptr);
 

From 9d1b6946423e3a74bfbbdfaa012793386976a48c Mon Sep 17 00:00:00 2001
From: Time Markov <time.markov@qtum.com>
Date: Tue, 19 Feb 2019 16:43:21 +0100
Subject: [PATCH 026/153] Add mutable transaction signature output creator

---
 src/script/interpreter.h |  4 ++--
 src/script/sign.cpp      | 15 +++++++++++++++
 src/script/sign.h        | 14 ++++++++++++++
 3 files changed, 31 insertions(+), 2 deletions(-)

diff --git a/src/script/interpreter.h b/src/script/interpreter.h
index 34e122a85..9384cfb74 100644
--- a/src/script/interpreter.h
+++ b/src/script/interpreter.h
@@ -207,8 +207,8 @@ class GenericTransactionSignatureOutputChecker : public BaseSignatureChecker
     virtual bool VerifySignature(const std::vector<unsigned char>& vchSig, const CPubKey& vchPubKey, const uint256& sighash) const;
 
 public:
-    GenericTransactionSignatureOutputChecker(const T* txToIn, unsigned int nInOut, const CScript& scriptSenderIn) : txTo(txToIn), nOut(nInOut), scriptSender(scriptSenderIn), txdata(nullptr) {}
-    GenericTransactionSignatureOutputChecker(const T* txToIn, unsigned int nInOut, const CScript& scriptSenderIn, const PrecomputedTransactionData& txdataIn) : txTo(txToIn), nOut(nInOut), scriptSender(scriptSenderIn), txdata(&txdataIn) {}
+    GenericTransactionSignatureOutputChecker(const T* txToIn, unsigned int nOutIn, const CScript& scriptSenderIn) : txTo(txToIn), nOut(nOutIn), scriptSender(scriptSenderIn), txdata(nullptr) {}
+    GenericTransactionSignatureOutputChecker(const T* txToIn, unsigned int nOutIn, const CScript& scriptSenderIn, const PrecomputedTransactionData& txdataIn) : txTo(txToIn), nOut(nOutIn), scriptSender(scriptSenderIn), txdata(&txdataIn) {}
     bool CheckSig(const std::vector<unsigned char>& scriptSig, const std::vector<unsigned char>& vchPubKey, const CScript& scriptCode, SigVersion sigversion) const override;
 };
 
diff --git a/src/script/sign.cpp b/src/script/sign.cpp
index a701d8051..a6134f46e 100644
--- a/src/script/sign.cpp
+++ b/src/script/sign.cpp
@@ -32,6 +32,21 @@ bool MutableTransactionSignatureCreator::CreateSig(const SigningProvider& provid
     return true;
 }
 
+MutableTransactionSignatureOutputCreator::MutableTransactionSignatureOutputCreator(const CMutableTransaction* txToIn, unsigned int nOutIn, const CScript& scriptSenderIn, int nHashTypeIn) : txTo(txToIn), nOut(nOutIn), nHashType(nHashTypeIn), scriptSender(scriptSenderIn), checker(txTo, nOut, scriptSenderIn) {}
+
+bool MutableTransactionSignatureOutputCreator::CreateSig(const SigningProvider& provider, std::vector<unsigned char>& vchSig, const CKeyID& address, const CScript& scriptCode, SigVersion sigversion) const
+{
+    CKey key;
+    if (!provider.GetKey(address, key))
+        return false;
+
+    uint256 hash = SignatureHashOutput(scriptCode, *txTo, nOut, nHashType, scriptSender, sigversion);
+    if (!key.Sign(hash, vchSig))
+        return false;
+    vchSig.push_back((unsigned char)nHashType);
+    return true;
+}
+
 static bool GetCScript(const SigningProvider& provider, const SignatureData& sigdata, const CScriptID& scriptid, CScript& script)
 {
     if (provider.GetCScript(scriptid, script)) {
diff --git a/src/script/sign.h b/src/script/sign.h
index 0b9d5a1e9..e2244e4ef 100644
--- a/src/script/sign.h
+++ b/src/script/sign.h
@@ -81,6 +81,20 @@ class MutableTransactionSignatureCreator : public BaseSignatureCreator {
     bool CreateSig(const SigningProvider& provider, std::vector<unsigned char>& vchSig, const CKeyID& keyid, const CScript& scriptCode, SigVersion sigversion) const override;
 };
 
+/** A signature creator for transactions outputs. */
+class MutableTransactionSignatureOutputCreator : public BaseSignatureCreator {
+    const CMutableTransaction* txTo;
+    unsigned int nOut;
+    int nHashType;
+    CScript scriptSender;
+    const MutableTransactionSignatureOutputChecker checker;
+
+public:
+    MutableTransactionSignatureOutputCreator(const CMutableTransaction* txToIn, unsigned int nOutIn, const CScript& scriptSenderIn, int nHashTypeIn = SIGHASH_ALL);
+    const BaseSignatureChecker& Checker() const override { return checker; }
+    bool CreateSig(const SigningProvider& provider, std::vector<unsigned char>& vchSig, const CKeyID& keyid, const CScript& scriptCode, SigVersion sigversion) const override;
+};
+
 /** A signature creator that just produces 71-byte empty signatures. */
 extern const BaseSignatureCreator& DUMMY_SIGNATURE_CREATOR;
 /** A signature creator that just produces 72-byte empty signatures. */

From f4767be7999ffa03c614b99fb45f9a02faa0bdd3 Mon Sep 17 00:00:00 2001
From: Time Markov <time.markov@qtum.com>
Date: Wed, 20 Feb 2019 11:53:13 +0100
Subject: [PATCH 027/153] Add method to get the script without OP_SENDER

---
 src/script/script.cpp | 13 +++++++++++++
 src/script/script.h   |  2 ++
 2 files changed, 15 insertions(+)

diff --git a/src/script/script.cpp b/src/script/script.cpp
index 035a1adf5..2feb1a9bf 100644
--- a/src/script/script.cpp
+++ b/src/script/script.cpp
@@ -359,3 +359,16 @@ bool GetScriptOp(CScriptBase::const_iterator& pc, CScriptBase::const_iterator en
     opcodeRet = static_cast<opcodetype>(opcode);
     return true;
 }
+
+CScript CScript::WithoutOpSender() const
+{
+    opcodetype opcode;
+    for (const_iterator pc = begin(); pc != end() && GetOp(pc, opcode);)
+    {
+        if (opcode == OP_SENDER)
+        {
+            return CScript(pc, end());
+        }
+    }
+    return CScript(begin(), end());
+}
diff --git a/src/script/script.h b/src/script/script.h
index 3a5059800..69bc9c6e4 100644
--- a/src/script/script.h
+++ b/src/script/script.h
@@ -627,6 +627,8 @@ class CScript : public CScriptBase
     {
         return Find(OP_SENDER) == 1;
     }
+
+    CScript WithoutOpSender() const;
     /////////////////////////////////////////
 
     void clear()

From 0086d968a9c45f2324c5f2ccf99360350cb452ba Mon Sep 17 00:00:00 2001
From: Time Markov <time.markov@qtum.com>
Date: Wed, 20 Feb 2019 13:50:27 +0100
Subject: [PATCH 028/153] Add has op sender check

---
 src/primitives/transaction.cpp | 21 +++++++++++++++++++++
 src/primitives/transaction.h   |  3 +++
 2 files changed, 24 insertions(+)

diff --git a/src/primitives/transaction.cpp b/src/primitives/transaction.cpp
index 21b685fae..49e9ff478 100644
--- a/src/primitives/transaction.cpp
+++ b/src/primitives/transaction.cpp
@@ -155,3 +155,24 @@ bool CTransaction::HasOpCall() const
     }
     return false;
 }
+
+template <class T>
+bool hasOpSender(const T& txTo)
+{
+    for(const CTxOut& v : txTo.vout){
+        if(v.scriptPubKey.HasOpSender()){
+            return true;
+        }
+    }
+    return false;
+}
+
+bool CTransaction::HasOpSender() const
+{
+    return hasOpSender(*this);
+}
+
+bool CMutableTransaction::HasOpSender() const
+{
+    return hasOpSender(*this);
+}
diff --git a/src/primitives/transaction.h b/src/primitives/transaction.h
index 8c4ca5500..6f6e0e3d2 100644
--- a/src/primitives/transaction.h
+++ b/src/primitives/transaction.h
@@ -357,6 +357,7 @@ class CTransaction
     {
         return (HasOpCall() ? OpCode::OpCall : 0) + (HasOpCreate() ? OpCode::OpCreate : 0);
     }
+    bool HasOpSender() const;
 
     bool IsCoinBase() const
     {
@@ -430,6 +431,8 @@ struct CMutableTransaction
      */
     uint256 GetHash() const;
 
+    bool HasOpSender() const;
+
     bool HasWitness() const
     {
         for (size_t i = 0; i < vin.size(); i++) {

From 41dc9ba82bd081e9022ce9633f49ba1d5584556d Mon Sep 17 00:00:00 2001
From: Time Markov <time.markov@qtum.com>
Date: Wed, 20 Feb 2019 15:41:37 +0100
Subject: [PATCH 029/153] Get outputs hash in case OP_SENDER is present in an
 output

---
 src/script/interpreter.cpp | 32 +++++++++++++++++++++++++++++---
 src/script/interpreter.h   |  2 +-
 2 files changed, 30 insertions(+), 4 deletions(-)

diff --git a/src/script/interpreter.cpp b/src/script/interpreter.cpp
index a40cca625..fc1f1eded 100644
--- a/src/script/interpreter.cpp
+++ b/src/script/interpreter.cpp
@@ -1236,6 +1236,28 @@ uint256 GetOutputsHash(const T& txTo)
     return ss.GetHash();
 }
 
+CTxOut GetOutputWithoutSender(const CTxOut& output)
+{
+    return CTxOut(output.nValue, output.scriptPubKey.WithoutOpSender());
+}
+
+template <class T>
+uint256 GetOutputsOpSenderHash(const T& txTo)
+{
+    CHashWriter ss(SER_GETHASH, 0);
+    for (const auto& txout : txTo.vout) {
+        if(txout.scriptPubKey.HasOpSender())
+        {
+            ss << GetOutputWithoutSender(txout);
+        }
+        else
+        {
+            ss << txout;
+        }
+    }
+    return ss.GetHash();
+}
+
 } // namespace
 
 template <class T>
@@ -1246,6 +1268,10 @@ PrecomputedTransactionData::PrecomputedTransactionData(const T& txTo)
         hashPrevouts = GetPrevoutHash(txTo);
         hashSequence = GetSequenceHash(txTo);
         hashOutputs = GetOutputsHash(txTo);
+        if(txTo.HasOpSender())
+        {
+            hashOutputsOpSender = GetOutputsOpSenderHash(txTo);
+        }
         ready = true;
     }
 }
@@ -1274,10 +1300,10 @@ uint256 SignatureHashOutput(const CScript& scriptCode, const T& txTo, unsigned i
 
 
     if ((nHashType & 0x1f) != SIGHASH_SINGLE && (nHashType & 0x1f) != SIGHASH_NONE) {
-        hashOutputs = cacheready ? cache->hashOutputs : GetOutputsHash(txTo);
+        hashOutputs = cacheready ? cache->hashOutputsOpSender : GetOutputsOpSenderHash(txTo);
     } else if ((nHashType & 0x1f) == SIGHASH_SINGLE && nOut < txTo.vout.size()) {
         CHashWriter ss(SER_GETHASH, 0);
-        ss << txTo.vout[nOut];
+        ss << GetOutputWithoutSender(txTo.vout[nOut]);
         hashOutputs = ss.GetHash();
     }
 
@@ -1289,7 +1315,7 @@ uint256 SignatureHashOutput(const CScript& scriptCode, const T& txTo, unsigned i
     ss << hashPrevouts;
     ss << hashSequence;
     // The output being signed
-    ss << txTo.vout[nOut];
+    ss << GetOutputWithoutSender(txTo.vout[nOut]);
     ss << scriptCode;
     ss << scriptSender;
     // Outputs (none/one/all, depending on flags)
diff --git a/src/script/interpreter.h b/src/script/interpreter.h
index 9384cfb74..a54b7e2f2 100644
--- a/src/script/interpreter.h
+++ b/src/script/interpreter.h
@@ -127,7 +127,7 @@ bool CheckSignatureEncoding(const std::vector<unsigned char> &vchSig, unsigned i
 
 struct PrecomputedTransactionData
 {
-    uint256 hashPrevouts, hashSequence, hashOutputs;
+    uint256 hashPrevouts, hashSequence, hashOutputs, hashOutputsOpSender;
     bool ready = false;
 
     template <class T>

From 17ad286584fa097f98f8bbe841ba829a0f7c2869 Mon Sep 17 00:00:00 2001
From: Time Markov <time.markov@qtum.com>
Date: Thu, 21 Feb 2019 09:17:11 +0100
Subject: [PATCH 030/153] Compute cache for op sender signature

---
 src/script/interpreter.cpp | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/script/interpreter.cpp b/src/script/interpreter.cpp
index fc1f1eded..ac07b41d6 100644
--- a/src/script/interpreter.cpp
+++ b/src/script/interpreter.cpp
@@ -1263,8 +1263,8 @@ uint256 GetOutputsOpSenderHash(const T& txTo)
 template <class T>
 PrecomputedTransactionData::PrecomputedTransactionData(const T& txTo)
 {
-    // Cache is calculated only for transactions with witness
-    if (txTo.HasWitness()) {
+    // Cache is calculated only for transactions with witness or those that have op sender output signature
+    if (txTo.HasWitness() || txTo.HasOpSender()) {
         hashPrevouts = GetPrevoutHash(txTo);
         hashSequence = GetSequenceHash(txTo);
         hashOutputs = GetOutputsHash(txTo);

From 06cd0ec4f779e13b4e986c10481c232c9cc60bcd Mon Sep 17 00:00:00 2001
From: Time Markov <time.markov@qtum.com>
Date: Thu, 21 Feb 2019 16:56:42 +0100
Subject: [PATCH 031/153] Update signature for sender outputs

---
 src/script/interpreter.cpp | 16 ++++++++--------
 src/script/interpreter.h   |  8 ++++----
 src/script/script.cpp      | 29 ++++++++++++++++++++++++-----
 src/script/script.h        | 16 +++++++++++++++-
 src/script/sign.cpp        | 18 ++++++++++++++++--
 src/script/sign.h          |  6 ++++--
 src/wallet/rpcwallet.cpp   | 20 ++++++++++++++++++++
 src/wallet/wallet.cpp      | 27 +++++++++++++++++++++++++++
 8 files changed, 118 insertions(+), 22 deletions(-)

diff --git a/src/script/interpreter.cpp b/src/script/interpreter.cpp
index ac07b41d6..e028230f9 100644
--- a/src/script/interpreter.cpp
+++ b/src/script/interpreter.cpp
@@ -1236,9 +1236,9 @@ uint256 GetOutputsHash(const T& txTo)
     return ss.GetHash();
 }
 
-CTxOut GetOutputWithoutSender(const CTxOut& output)
+CTxOut GetOutputWithoutSenderSig(const CTxOut& output)
 {
-    return CTxOut(output.nValue, output.scriptPubKey.WithoutOpSender());
+    return CTxOut(output.nValue, output.scriptPubKey.WithoutSenderSig());
 }
 
 template <class T>
@@ -1248,7 +1248,7 @@ uint256 GetOutputsOpSenderHash(const T& txTo)
     for (const auto& txout : txTo.vout) {
         if(txout.scriptPubKey.HasOpSender())
         {
-            ss << GetOutputWithoutSender(txout);
+            ss << GetOutputWithoutSenderSig(txout);
         }
         else
         {
@@ -1281,7 +1281,7 @@ template PrecomputedTransactionData::PrecomputedTransactionData(const CTransacti
 template PrecomputedTransactionData::PrecomputedTransactionData(const CMutableTransaction& txTo);
 
 template <class T>
-uint256 SignatureHashOutput(const CScript& scriptCode, const T& txTo, unsigned int nOut, int nHashType, const CScript& scriptSender, SigVersion sigversion, const PrecomputedTransactionData* cache)
+uint256 SignatureHashOutput(const CScript& scriptCode, const T& txTo, unsigned int nOut, int nHashType, const CAmount& amount, SigVersion sigversion, const PrecomputedTransactionData* cache)
 {
     assert(nOut < txTo.vout.size());
 
@@ -1303,7 +1303,7 @@ uint256 SignatureHashOutput(const CScript& scriptCode, const T& txTo, unsigned i
         hashOutputs = cacheready ? cache->hashOutputsOpSender : GetOutputsOpSenderHash(txTo);
     } else if ((nHashType & 0x1f) == SIGHASH_SINGLE && nOut < txTo.vout.size()) {
         CHashWriter ss(SER_GETHASH, 0);
-        ss << GetOutputWithoutSender(txTo.vout[nOut]);
+        ss << GetOutputWithoutSenderSig(txTo.vout[nOut]);
         hashOutputs = ss.GetHash();
     }
 
@@ -1315,9 +1315,9 @@ uint256 SignatureHashOutput(const CScript& scriptCode, const T& txTo, unsigned i
     ss << hashPrevouts;
     ss << hashSequence;
     // The output being signed
-    ss << GetOutputWithoutSender(txTo.vout[nOut]);
+    ss << GetOutputWithoutSenderSig(txTo.vout[nOut]);
     ss << scriptCode;
-    ss << scriptSender;
+    ss << amount;
     // Outputs (none/one/all, depending on flags)
     ss << hashOutputs;
     // Locktime
@@ -1534,7 +1534,7 @@ bool GenericTransactionSignatureOutputChecker<T>::CheckSig(const std::vector<uns
     int nHashType = vchSig.back();
     vchSig.pop_back();
 
-    uint256 sighash = SignatureHashOutput(scriptCode, *txTo, nOut, nHashType, scriptSender, sigversion, this->txdata);
+    uint256 sighash = SignatureHashOutput(scriptCode, *txTo, nOut, nHashType, amount, sigversion, this->txdata);
 
     if (!VerifySignature(vchSig, pubkey, sighash))
         return false;
diff --git a/src/script/interpreter.h b/src/script/interpreter.h
index a54b7e2f2..ba429f929 100644
--- a/src/script/interpreter.h
+++ b/src/script/interpreter.h
@@ -148,7 +148,7 @@ template <class T>
 uint256 SignatureHash(const CScript& scriptCode, const T& txTo, unsigned int nIn, int nHashType, const CAmount& amount, SigVersion sigversion, const PrecomputedTransactionData* cache = nullptr);
 
 template <class T>
-uint256 SignatureHashOutput(const CScript& scriptCode, const T& txTo, unsigned int nOut, int nHashType, const CScript& scriptSender, SigVersion sigversion, const PrecomputedTransactionData* cache = nullptr);
+uint256 SignatureHashOutput(const CScript& scriptCode, const T& txTo, unsigned int nOut, int nHashType, const CAmount& amount, SigVersion sigversion, const PrecomputedTransactionData* cache = nullptr);
 
 class BaseSignatureChecker
 {
@@ -200,15 +200,15 @@ class GenericTransactionSignatureOutputChecker : public BaseSignatureChecker
 private:
     const T* txTo;
     unsigned int nOut;
-    const CScript scriptSender;
+    const CAmount amount;
     const PrecomputedTransactionData* txdata;
 
 protected:
     virtual bool VerifySignature(const std::vector<unsigned char>& vchSig, const CPubKey& vchPubKey, const uint256& sighash) const;
 
 public:
-    GenericTransactionSignatureOutputChecker(const T* txToIn, unsigned int nOutIn, const CScript& scriptSenderIn) : txTo(txToIn), nOut(nOutIn), scriptSender(scriptSenderIn), txdata(nullptr) {}
-    GenericTransactionSignatureOutputChecker(const T* txToIn, unsigned int nOutIn, const CScript& scriptSenderIn, const PrecomputedTransactionData& txdataIn) : txTo(txToIn), nOut(nOutIn), scriptSender(scriptSenderIn), txdata(&txdataIn) {}
+    GenericTransactionSignatureOutputChecker(const T* txToIn, unsigned int nOutIn, const CAmount& amountIn) : txTo(txToIn), nOut(nOutIn), amount(amountIn), txdata(nullptr) {}
+    GenericTransactionSignatureOutputChecker(const T* txToIn, unsigned int nOutIn, const CAmount& amountIn, const PrecomputedTransactionData& txdataIn) : txTo(txToIn), nOut(nOutIn), amount(amountIn), txdata(&txdataIn) {}
     bool CheckSig(const std::vector<unsigned char>& scriptSig, const std::vector<unsigned char>& vchPubKey, const CScript& scriptCode, SigVersion sigversion) const override;
 };
 
diff --git a/src/script/script.cpp b/src/script/script.cpp
index 2feb1a9bf..56a8805b9 100644
--- a/src/script/script.cpp
+++ b/src/script/script.cpp
@@ -1,4 +1,4 @@
-// Copyright (c) 2009-2010 Satoshi Nakamoto
+// Copyright (c) 2009-2010 Satoshi Nakamoto
 // Copyright (c) 2009-2018 The Bitcoin Core developers
 // Distributed under the MIT software license, see the accompanying
 // file COPYING or http://www.opensource.org/licenses/mit-license.php.
@@ -360,15 +360,34 @@ bool GetScriptOp(CScriptBase::const_iterator& pc, CScriptBase::const_iterator en
     return true;
 }
 
-CScript CScript::WithoutOpSender() const
+bool CScript::ReplaceParam(opcodetype findOp, int posBefore, const std::vector<unsigned char> &vchParam, CScript &scriptRet) const
 {
+    if(posBefore < 0)
+        return false;
+
+    // Find parameter with opcode and replace the parameter before with other value
+    bool ret = false;
+    std::vector<const_iterator> opcodes;
+    int minSize = posBefore + 1;
     opcodetype opcode;
+    opcodes.push_back(begin());
     for (const_iterator pc = begin(); pc != end() && GetOp(pc, opcode);)
     {
-        if (opcode == OP_SENDER)
+        if (opcode == findOp)
         {
-            return CScript(pc, end());
+            int size = opcodes.size();
+            if(size > minSize)
+            {
+                int firstPart = size -1 -posBefore;
+                int secondPart = size -posBefore;
+                scriptRet = CScript(begin(), opcodes[firstPart]) << vchParam;
+                scriptRet += CScript(opcodes[secondPart], end());
+                ret = true;
+            }
+            break;
         }
+        opcodes.push_back(pc);
     }
-    return CScript(begin(), end());
+
+    return ret;
 }
diff --git a/src/script/script.h b/src/script/script.h
index 69bc9c6e4..d8c7d90e6 100644
--- a/src/script/script.h
+++ b/src/script/script.h
@@ -628,7 +628,21 @@ class CScript : public CScriptBase
         return Find(OP_SENDER) == 1;
     }
 
-    CScript WithoutOpSender() const;
+    bool UpdateSenderSig(const std::vector<unsigned char>& scriptSig, CScript& scriptRet) const
+    {
+        return ReplaceParam(OP_SENDER, 1, scriptSig, scriptRet);
+    }
+
+    CScript WithoutSenderSig() const
+    {
+        std::vector<unsigned char> scriptSig;
+        CScript scriptRet;
+        if(!UpdateSenderSig(scriptSig, scriptRet))
+            scriptRet = CScript(begin(), end());
+        return scriptRet;
+    }
+
+    bool ReplaceParam(opcodetype findOp, int posBefore, const std::vector<unsigned char>& vchParam, CScript& scriptRet) const;
     /////////////////////////////////////////
 
     void clear()
diff --git a/src/script/sign.cpp b/src/script/sign.cpp
index a6134f46e..ee2469a68 100644
--- a/src/script/sign.cpp
+++ b/src/script/sign.cpp
@@ -32,7 +32,7 @@ bool MutableTransactionSignatureCreator::CreateSig(const SigningProvider& provid
     return true;
 }
 
-MutableTransactionSignatureOutputCreator::MutableTransactionSignatureOutputCreator(const CMutableTransaction* txToIn, unsigned int nOutIn, const CScript& scriptSenderIn, int nHashTypeIn) : txTo(txToIn), nOut(nOutIn), nHashType(nHashTypeIn), scriptSender(scriptSenderIn), checker(txTo, nOut, scriptSenderIn) {}
+MutableTransactionSignatureOutputCreator::MutableTransactionSignatureOutputCreator(const CMutableTransaction* txToIn, unsigned int nOutIn, const CAmount& amountIn, int nHashTypeIn) : txTo(txToIn), nOut(nOutIn), nHashType(nHashTypeIn), amount(amountIn), checker(txTo, nOut, amountIn) {}
 
 bool MutableTransactionSignatureOutputCreator::CreateSig(const SigningProvider& provider, std::vector<unsigned char>& vchSig, const CKeyID& address, const CScript& scriptCode, SigVersion sigversion) const
 {
@@ -40,7 +40,7 @@ bool MutableTransactionSignatureOutputCreator::CreateSig(const SigningProvider&
     if (!provider.GetKey(address, key))
         return false;
 
-    uint256 hash = SignatureHashOutput(scriptCode, *txTo, nOut, nHashType, scriptSender, sigversion);
+    uint256 hash = SignatureHashOutput(scriptCode, *txTo, nOut, nHashType, amount, sigversion);
     if (!key.Sign(hash, vchSig))
         return false;
     vchSig.push_back((unsigned char)nHashType);
@@ -720,3 +720,17 @@ FlatSigningProvider Merge(const FlatSigningProvider& a, const FlatSigningProvide
     ret.keys.insert(b.keys.begin(), b.keys.end());
     return ret;
 }
+
+bool UpdateOutput(CTxOut &output, const SignatureData &data)
+{
+    bool ret = false;
+    CDataStream streamSig(SER_NETWORK, PROTOCOL_VERSION);
+    streamSig << data.scriptSig;
+    CScript scriptPubKey;
+    if(output.scriptPubKey.UpdateSenderSig(ToByteVector(streamSig), scriptPubKey))
+    {
+        output.scriptPubKey = scriptPubKey;
+        ret = true;
+    }
+    return ret;
+}
diff --git a/src/script/sign.h b/src/script/sign.h
index e2244e4ef..04f7b23a0 100644
--- a/src/script/sign.h
+++ b/src/script/sign.h
@@ -86,11 +86,11 @@ class MutableTransactionSignatureOutputCreator : public BaseSignatureCreator {
     const CMutableTransaction* txTo;
     unsigned int nOut;
     int nHashType;
-    CScript scriptSender;
+    CAmount amount;
     const MutableTransactionSignatureOutputChecker checker;
 
 public:
-    MutableTransactionSignatureOutputCreator(const CMutableTransaction* txToIn, unsigned int nOutIn, const CScript& scriptSenderIn, int nHashTypeIn = SIGHASH_ALL);
+    MutableTransactionSignatureOutputCreator(const CMutableTransaction* txToIn, unsigned int nOutIn, const CAmount& amountIn, int nHashTypeIn = SIGHASH_ALL);
     const BaseSignatureChecker& Checker() const override { return checker; }
     bool CreateSig(const SigningProvider& provider, std::vector<unsigned char>& vchSig, const CKeyID& keyid, const CScript& scriptCode, SigVersion sigversion) const override;
 };
@@ -740,6 +740,8 @@ bool SignPSBTInput(const SigningProvider& provider, PartiallySignedTransaction&
 SignatureData DataFromTransaction(const CMutableTransaction& tx, unsigned int nIn, const CTxOut& txout);
 void UpdateInput(CTxIn& input, const SignatureData& data);
 
+bool UpdateOutput(CTxOut& output, const SignatureData& data);
+
 /* Check whether we know how to sign for an output like this, assuming we
  * have all private keys. While this function does not need private keys, the passed
  * provider is used to look up public keys and redeemscripts by hash.
diff --git a/src/wallet/rpcwallet.cpp b/src/wallet/rpcwallet.cpp
index d78481e0b..3b4482586 100755
--- a/src/wallet/rpcwallet.cpp
+++ b/src/wallet/rpcwallet.cpp
@@ -800,6 +800,16 @@ static UniValue createcontract(const JSONRPCRequest& request){
 
     // Build OP_EXEC script
     CScript scriptPubKey = CScript() << CScriptNum(VersionVM::GetEVMDefault().toRaw()) << CScriptNum(nGasLimit) << CScriptNum(nGasPrice) << ParseHex(bytecode) <<OP_CREATE;
+    if(IsValidDestination(signSenderAddress))
+    {
+        CKeyID key_id = GetKeyForDestination(*pwallet, signSenderAddress);
+        CKey key;
+        if (!pwallet->GetKey(key_id, key)) {
+            throw JSONRPCError(RPC_WALLET_ERROR, "Private key not available");
+        }
+        std::vector<unsigned char> scriptSig;
+        scriptPubKey = (CScript() << CScriptNum(1) << ToByteVector(key_id) << ToByteVector(scriptSig) << OP_SENDER) + scriptPubKey;
+    }
 
     // Create and send the transaction
     CReserveKey reservekey(pwallet);
@@ -1025,6 +1035,16 @@ static UniValue sendtocontract(const JSONRPCRequest& request){
 
     // Build OP_EXEC_ASSIGN script
     CScript scriptPubKey = CScript() << CScriptNum(VersionVM::GetEVMDefault().toRaw()) << CScriptNum(nGasLimit) << CScriptNum(nGasPrice) << ParseHex(datahex) << ParseHex(contractaddress) << OP_CALL;
+    if(IsValidDestination(signSenderAddress))
+    {
+        CKeyID key_id = GetKeyForDestination(*pwallet, signSenderAddress);
+        CKey key;
+        if (!pwallet->GetKey(key_id, key)) {
+            throw JSONRPCError(RPC_WALLET_ERROR, "Private key not available");
+        }
+        std::vector<unsigned char> scriptSig;
+        scriptPubKey = (CScript() << CScriptNum(1) << ToByteVector(key_id) << ToByteVector(scriptSig) << OP_SENDER) + scriptPubKey;
+    }
 
     // Create and send the transaction
     CReserveKey reservekey(pwallet);
diff --git a/src/wallet/wallet.cpp b/src/wallet/wallet.cpp
index b3bff7859..6cf0a702d 100644
--- a/src/wallet/wallet.cpp
+++ b/src/wallet/wallet.cpp
@@ -3369,6 +3369,33 @@ bool CWallet::CreateTransaction(const std::vector<CRecipient>& vecSend, CTransac
 
         if (sign)
         {
+            // Signing transaction outputs
+            int nOut = 0;
+            for (const auto& output : txNew.vout)
+            {
+                if(output.scriptPubKey.HasOpSender())
+                {
+                    const CScript& scriptPubKey = GetScriptForDestination(signSenderAddress);
+                    SignatureData sigdata;
+
+                    if (!ProduceSignature(*this, MutableTransactionSignatureOutputCreator(&txNew, nOut, output.nValue, SIGHASH_ALL), scriptPubKey, sigdata))
+                    {
+                        strFailReason = _("Signing transaction output failed");
+                        return false;
+                    }
+                    else
+                    {
+                        if(!UpdateOutput(txNew.vout.at(nOut), sigdata))
+                        {
+                            strFailReason = _("Update transaction output failed");
+                            return false;
+                        }
+                    }
+                }
+                nOut++;
+            }
+
+            // Signing transaction inputs
             int nIn = 0;
             for (const auto& coin : selected_coins)
             {

From b0d019491012df6dc58d32799abaf0fb70966f75 Mon Sep 17 00:00:00 2001
From: Time Markov <time.markov@qtum.com>
Date: Mon, 25 Feb 2019 10:28:17 +0100
Subject: [PATCH 032/153] Update get sender address

---
 src/script/standard.cpp |  5 +++++
 src/script/standard.h   |  3 +++
 src/validation.cpp      | 11 +++++++----
 3 files changed, 15 insertions(+), 4 deletions(-)

diff --git a/src/script/standard.cpp b/src/script/standard.cpp
index 62294570e..d019b2479 100644
--- a/src/script/standard.cpp
+++ b/src/script/standard.cpp
@@ -485,3 +485,8 @@ bool IsValidContractSenderAddress(const CTxDestination &dest)
     const CKeyID *keyID = boost::get<CKeyID>(&dest);
     return keyID != 0;
 }
+
+bool ExtractSenderData(const CScript &outputPubKey, CScript *senderPubKey, CScript *senderSig)
+{
+    return false;
+}
diff --git a/src/script/standard.h b/src/script/standard.h
index 031e2b6bc..4f8121fd3 100644
--- a/src/script/standard.h
+++ b/src/script/standard.h
@@ -139,6 +139,9 @@ bool IsValidDestination(const CTxDestination& dest);
 /** Check whether a CTxDestination can be used as contract sender address. */
 bool IsValidContractSenderAddress(const CTxDestination& dest);
 
+/** Parse a output public key for the sender public key and sender signature. */
+bool ExtractSenderData(const CScript& outputPubKey, CScript* senderPubKey, CScript* senderSig);
+
 /** Get the name of a txnouttype as a C string, or nullptr if unknown. */
 const char* GetTxnOutputType(txnouttype t);
 
diff --git a/src/validation.cpp b/src/validation.cpp
index 155ea4b87..3d4df8f4f 100644
--- a/src/validation.cpp
+++ b/src/validation.cpp
@@ -2127,12 +2127,15 @@ bool CheckReward(const CBlock& block, CValidationState& state, int nHeight, cons
     return true;
 }
 
-valtype GetSenderAddress(const CTransaction& tx, const CCoinsViewCache* coinsView, const std::vector<CTransactionRef>* blockTxs){
+valtype GetSenderAddress(const CTransaction& tx, const CCoinsViewCache* coinsView, const std::vector<CTransactionRef>* blockTxs, uint32_t nOut){
     CScript script;
     bool scriptFilled=false; //can't use script.empty() because an empty script is technically valid
 
-    // First check the current (or in-progress) block for zero-confirmation change spending that won't yet be in txindex
-    if(blockTxs){
+    // Try get the sender script from the output script
+    scriptFilled = ExtractSenderData(tx.vout[nOut].scriptPubKey, &script, nullptr);
+
+    // Check the current (or in-progress) block for zero-confirmation change spending that won't yet be in txindex
+    if(!scriptFilled && blockTxs){
         for(auto btx : *blockTxs){
             if(btx->GetHash() == tx.vin[0].prevout.hash){
                 script = btx->vout[tx.vin[0].prevout.n].scriptPubKey;
@@ -2427,7 +2430,7 @@ QtumTransaction QtumTxConverter::createEthTX(const EthTransactionParams& etp, ui
     else{
         txEth = QtumTransaction(txBit.vout[nOut].nValue, etp.gasPrice, etp.gasLimit, etp.receiveAddress, etp.code, dev::u256(0));
     }
-    dev::Address sender(GetSenderAddress(txBit, view, blockTransactions));
+    dev::Address sender(GetSenderAddress(txBit, view, blockTransactions, nOut));
     txEth.forceSender(sender);
     txEth.setHashWith(uintToh256(txBit.GetHash()));
     txEth.setNVout(nOut);

From 6e739f912660b68bc1c2170c87055628d701444f Mon Sep 17 00:00:00 2001
From: Time Markov <time.markov@qtum.com>
Date: Mon, 25 Feb 2019 13:57:20 +0100
Subject: [PATCH 033/153] Add method for extracting sender data

---
 src/script/interpreter.cpp |  1 +
 src/script/standard.cpp    | 86 +++++++++++++++++++++++++++++++++-----
 src/script/standard.h      |  4 +-
 3 files changed, 78 insertions(+), 13 deletions(-)

diff --git a/src/script/interpreter.cpp b/src/script/interpreter.cpp
index e028230f9..49dcb04ef 100644
--- a/src/script/interpreter.cpp
+++ b/src/script/interpreter.cpp
@@ -1072,6 +1072,7 @@ bool EvalScript(std::vector<std::vector<unsigned char> >& stack, const CScript&
 
                 //////////////////////////////////////////////////////// qtum
                 case OP_SENDER:
+                    break;
                 case OP_SPEND:
                 {
                     return true; // temp
diff --git a/src/script/standard.cpp b/src/script/standard.cpp
index d019b2479..c99157d8f 100644
--- a/src/script/standard.cpp
+++ b/src/script/standard.cpp
@@ -14,6 +14,7 @@
 #include <qtum/qtumstate.h>
 #include <qtum/qtumtransaction.h>
 #include <validation.h>
+#include <streams.h>
 
 typedef std::vector<unsigned char> valtype;
 
@@ -40,10 +41,10 @@ const char* GetTxnOutputType(txnouttype t)
     case TX_WITNESS_V0_KEYHASH: return "witness_v0_keyhash";
     case TX_WITNESS_V0_SCRIPTHASH: return "witness_v0_scripthash";
     case TX_WITNESS_UNKNOWN: return "witness_unknown";
-    case TX_CREATE: return "create";
-    case TX_CALL: return "call";
     case TX_CREATE_SENDER: return "create_sender";
     case TX_CALL_SENDER: return "call_sender";
+    case TX_CREATE: return "create";
+    case TX_CALL: return "call";
     }
     return nullptr;
 }
@@ -67,17 +68,17 @@ bool Solver(const CScript& scriptPubKey, txnouttype& typeRet, std::vector<std::v
         // Sender provides N pubkeys, receivers provides M signatures
         mTemplates.insert(std::make_pair(TX_MULTISIG, CScript() << OP_SMALLINTEGER << OP_PUBKEYS << OP_SMALLINTEGER << OP_CHECKMULTISIG));
 
-        // Contract creation tx
-        mTemplates.insert(std::make_pair(TX_CREATE, CScript() << OP_VERSION << OP_GAS_LIMIT << OP_GAS_PRICE << OP_DATA << OP_CREATE));
-
-        // Call contract tx
-        mTemplates.insert(std::make_pair(TX_CALL, CScript() << OP_VERSION << OP_GAS_LIMIT << OP_GAS_PRICE << OP_DATA << OP_PUBKEYHASH << OP_CALL));
-
         // Contract creation tx with sender
         mTemplates.insert(std::make_pair(TX_CREATE_SENDER, CScript() << OP_ADDRESS_TYPE << OP_ADDRESS << OP_SCRIPT_SIG << OP_SENDER << OP_VERSION << OP_GAS_LIMIT << OP_GAS_PRICE << OP_DATA << OP_CREATE));
 
         // Call contract tx with sender
         mTemplates.insert(std::make_pair(TX_CALL_SENDER, CScript() << OP_ADDRESS_TYPE << OP_ADDRESS << OP_SCRIPT_SIG << OP_SENDER << OP_VERSION << OP_GAS_LIMIT << OP_GAS_PRICE << OP_DATA << OP_PUBKEYHASH << OP_CALL));
+
+        // Contract creation tx
+        mTemplates.insert(std::make_pair(TX_CREATE, CScript() << OP_VERSION << OP_GAS_LIMIT << OP_GAS_PRICE << OP_DATA << OP_CREATE));
+
+        // Call contract tx
+        mTemplates.insert(std::make_pair(TX_CALL, CScript() << OP_VERSION << OP_GAS_LIMIT << OP_GAS_PRICE << OP_DATA << OP_PUBKEYHASH << OP_CALL));
     }
 
     vSolutionsRet.clear();
@@ -135,6 +136,8 @@ bool Solver(const CScript& scriptPubKey, txnouttype& typeRet, std::vector<std::v
         opcodetype opcode1, opcode2;
         std::vector<unsigned char> vch1, vch2;
 
+        uint64_t addressType = 0;
+
         VersionVM version;
         version.rootVM=20; //set to some invalid value
 
@@ -273,15 +276,45 @@ bool Solver(const CScript& scriptPubKey, txnouttype& typeRet, std::vector<std::v
             }
             else if(opcode2 == OP_ADDRESS_TYPE)
             {
-                //TBD
+                try {
+                    uint64_t val = CScriptNum::vch_to_uint64(vch1);
+                    if(val < 1 && val > 5)
+                        return false;
+
+                    addressType = val;
+                }
+                catch (const scriptnum_error &err) {
+                    return false;
+                }
             }
             else if(opcode2 == OP_ADDRESS)
             {
-                //TBD
+                // Get the destination
+                CTxDestination dest;
+                if(addressType == 1 && vch1.size() == sizeof(CKeyID))
+                {
+                    dest = CKeyID(uint160(vch1));
+                }
+                else
+                {
+                    return false;
+                }
+
+                // Get the public key for the destination
+                CScript senderPubKey = GetScriptForDestination(dest);
+                CDataStream ss(SER_NETWORK, PROTOCOL_VERSION);
+                ss << senderPubKey;
+                vSolutionsRet.push_back(std::vector<unsigned char>(ss.begin(), ss.end()));
             }
             else if(opcode2 == OP_SCRIPT_SIG)
             {
-                //TBD
+                if(0 <= opcode1 && opcode1 <= OP_PUSHDATA4)
+                {
+                    if(vch1.empty())
+                        return false;
+
+                    vSolutionsRet.push_back(vch1);
+                }
             }
             ///////////////////////////////////////////////////////////
             else if (opcode1 != opcode2 || vch1 != vch2)
@@ -488,5 +521,36 @@ bool IsValidContractSenderAddress(const CTxDestination &dest)
 
 bool ExtractSenderData(const CScript &outputPubKey, CScript *senderPubKey, CScript *senderSig)
 {
+    if(outputPubKey.HasOpSender())
+    {
+        try
+        {
+            txnouttype typ;
+            std::vector<valtype> vSolutions;
+            if (!Solver(outputPubKey, typ, vSolutions))
+                return false;
+
+            if(vSolutions.size() < 2)
+                return false;
+
+            if(senderPubKey)
+            {
+                CDataStream ss(vSolutions[0], SER_NETWORK, PROTOCOL_VERSION);
+                ss >> *senderPubKey;
+            }
+
+            if(senderSig)
+            {
+                CDataStream ss(vSolutions[1], SER_NETWORK, PROTOCOL_VERSION);
+                ss >> *senderSig;
+            }
+        }
+        catch(...)
+        {
+            return false;
+        }
+
+        return true;
+    }
     return false;
 }
diff --git a/src/script/standard.h b/src/script/standard.h
index 4f8121fd3..120d6127c 100644
--- a/src/script/standard.h
+++ b/src/script/standard.h
@@ -72,10 +72,10 @@ enum txnouttype
     TX_WITNESS_V0_SCRIPTHASH,
     TX_WITNESS_V0_KEYHASH,
     TX_WITNESS_UNKNOWN, //!< Only for Witness versions not already defined above
-    TX_CREATE,
-    TX_CALL,
     TX_CREATE_SENDER,
     TX_CALL_SENDER,
+    TX_CREATE,
+    TX_CALL,
 };
 
 class CNoDestination {

From 52dcae7bfe180b300dc7890b5a70098ea19f98b7 Mon Sep 17 00:00:00 2001
From: Time Markov <time.markov@qtum.com>
Date: Mon, 25 Feb 2019 16:12:51 +0100
Subject: [PATCH 034/153] Fix sender template parsing

---
 src/script/standard.cpp | 10 ++++------
 src/validation.cpp      | 16 ++++++++++++----
 src/validation.h        |  5 ++++-
 3 files changed, 20 insertions(+), 11 deletions(-)

diff --git a/src/script/standard.cpp b/src/script/standard.cpp
index c99157d8f..fe690ddac 100644
--- a/src/script/standard.cpp
+++ b/src/script/standard.cpp
@@ -279,12 +279,12 @@ bool Solver(const CScript& scriptPubKey, txnouttype& typeRet, std::vector<std::v
                 try {
                     uint64_t val = CScriptNum::vch_to_uint64(vch1);
                     if(val < 1 && val > 5)
-                        return false;
+                        break;
 
                     addressType = val;
                 }
                 catch (const scriptnum_error &err) {
-                    return false;
+                    break;
                 }
             }
             else if(opcode2 == OP_ADDRESS)
@@ -296,9 +296,7 @@ bool Solver(const CScript& scriptPubKey, txnouttype& typeRet, std::vector<std::v
                     dest = CKeyID(uint160(vch1));
                 }
                 else
-                {
-                    return false;
-                }
+                    break;
 
                 // Get the public key for the destination
                 CScript senderPubKey = GetScriptForDestination(dest);
@@ -311,7 +309,7 @@ bool Solver(const CScript& scriptPubKey, txnouttype& typeRet, std::vector<std::v
                 if(0 <= opcode1 && opcode1 <= OP_PUSHDATA4)
                 {
                     if(vch1.empty())
-                        return false;
+                        break;
 
                     vSolutionsRet.push_back(vch1);
                 }
diff --git a/src/validation.cpp b/src/validation.cpp
index 3d4df8f4f..0ce03d596 100644
--- a/src/validation.cpp
+++ b/src/validation.cpp
@@ -2358,16 +2358,19 @@ bool QtumTxConverter::extractionQtumTransactions(ExtractQtumTX& qtumtx){
 }
 
 bool QtumTxConverter::receiveStack(const CScript& scriptPubKey){
+    sender = false;
     EvalScript(stack, scriptPubKey, SCRIPT_EXEC_BYTE_CODE, BaseSignatureChecker(), SigVersion::BASE, nullptr);
     if (stack.empty())
         return false;
 
     CScript scriptRest(stack.back().begin(), stack.back().end());
     stack.pop_back();
+    sender = scriptPubKey.HasOpSender();
 
     opcode = (opcodetype)(*scriptRest.begin());
-    if((opcode == OP_CREATE && stack.size() < 4) || (opcode == OP_CALL && stack.size() < 5)){
+    if((opcode == OP_CREATE && stack.size() < stackSize(4)) || (opcode == OP_CALL && stack.size() < stackSize(5))){
         stack.clear();
+        sender = false;
         return false;
     }
 
@@ -2384,10 +2387,10 @@ bool QtumTxConverter::parseEthTXParams(EthTransactionParams& params){
             stack.pop_back();
             receiveAddress = dev::Address(vecAddr);
         }
-        if(stack.size() < 4)
+        if(stack.size() < stackSize(4))
             return false;
 
-        if(stack.back().size() < 1){
+        if(stack.back().size() < stackSize(1)){
             return false;
         }
         valtype code(stack.back());
@@ -2404,7 +2407,7 @@ bool QtumTxConverter::parseEthTXParams(EthTransactionParams& params){
             //overflows past 64bits, reject this tx
             return false;
         }
-        if(stack.back().size() > 4){
+        if(stack.back().size() > stackSize(4)){
             return false;
         }
         VersionVM version = VersionVM::fromRaw((uint32_t)CScriptNum::vch_to_uint64(stack.back()));
@@ -2438,6 +2441,11 @@ QtumTransaction QtumTxConverter::createEthTX(const EthTransactionParams& etp, ui
 
     return txEth;
 }
+
+size_t QtumTxConverter::stackSize(size_t size){
+    // OP_SENDER add 3 more parameters in stack besides those for OP_CREATE or OP_CALL
+    return sender ? size + 3 : size;
+}
 ///////////////////////////////////////////////////////////////////////
 
 /** Apply the effects of this block (with given index) on the UTXO set represented by coins.
diff --git a/src/validation.h b/src/validation.h
index 0417ca9a9..a590a4b72 100644
--- a/src/validation.h
+++ b/src/validation.h
@@ -661,7 +661,7 @@ class QtumTxConverter{
 
 public:
 
-    QtumTxConverter(CTransaction tx, CCoinsViewCache* v = NULL, const std::vector<CTransactionRef>* blockTxs = NULL) : txBit(tx), view(v), blockTransactions(blockTxs){}
+    QtumTxConverter(CTransaction tx, CCoinsViewCache* v = NULL, const std::vector<CTransactionRef>* blockTxs = NULL) : txBit(tx), view(v), blockTransactions(blockTxs), sender(false){}
 
     bool extractionQtumTransactions(ExtractQtumTX& qtumTx);
 
@@ -673,11 +673,14 @@ class QtumTxConverter{
 
     QtumTransaction createEthTX(const EthTransactionParams& etp, const uint32_t nOut);
 
+    size_t stackSize(size_t size);
+
     const CTransaction txBit;
     const CCoinsViewCache* view;
     std::vector<valtype> stack;
     opcodetype opcode;
     const std::vector<CTransactionRef> *blockTransactions;
+    bool sender;
 
 };
 

From 501cd20f9ad076533f896b182038af94d64f87e7 Mon Sep 17 00:00:00 2001
From: Time Markov <time.markov@qtum.com>
Date: Tue, 26 Feb 2019 14:03:57 +0100
Subject: [PATCH 035/153] Check sender signature in the transaction output

---
 src/script/sigcache.cpp | 13 +++++++++++++
 src/script/sigcache.h   | 11 +++++++++++
 src/validation.cpp      | 24 ++++++++++++++++++++++++
 src/validation.h        | 10 ++++++++--
 4 files changed, 56 insertions(+), 2 deletions(-)

diff --git a/src/script/sigcache.cpp b/src/script/sigcache.cpp
index 68f054229..427d4ef34 100644
--- a/src/script/sigcache.cpp
+++ b/src/script/sigcache.cpp
@@ -92,3 +92,16 @@ bool CachingTransactionSignatureChecker::VerifySignature(const std::vector<unsig
         signatureCache.Set(entry);
     return true;
 }
+
+bool CachingTransactionSignatureOutputChecker::VerifySignature(const std::vector<unsigned char>& vchSig, const CPubKey& pubkey, const uint256& sighash) const
+{
+    uint256 entry;
+    signatureCache.ComputeEntry(entry, sighash, vchSig, pubkey);
+    if (signatureCache.Get(entry, !store))
+        return true;
+    if (!TransactionSignatureOutputChecker::VerifySignature(vchSig, pubkey, sighash))
+        return false;
+    if (store)
+        signatureCache.Set(entry);
+    return true;
+}
diff --git a/src/script/sigcache.h b/src/script/sigcache.h
index 807b61b54..dbee34664 100644
--- a/src/script/sigcache.h
+++ b/src/script/sigcache.h
@@ -51,6 +51,17 @@ class CachingTransactionSignatureChecker : public TransactionSignatureChecker
     bool VerifySignature(const std::vector<unsigned char>& vchSig, const CPubKey& vchPubKey, const uint256& sighash) const override;
 };
 
+class CachingTransactionSignatureOutputChecker : public TransactionSignatureOutputChecker
+{
+private:
+    bool store;
+
+public:
+    CachingTransactionSignatureOutputChecker(const CTransaction* txToIn, unsigned int nOutIn, const CAmount& amountIn, bool storeIn, PrecomputedTransactionData& txdataIn) : TransactionSignatureOutputChecker(txToIn, nOutIn, amountIn, txdataIn), store(storeIn) {}
+
+    bool VerifySignature(const std::vector<unsigned char>& vchSig, const CPubKey& vchPubKey, const uint256& sighash) const override;
+};
+
 void InitSignatureCache();
 
 #endif // BITCOIN_SCRIPT_SIGCACHE_H
diff --git a/src/validation.cpp b/src/validation.cpp
index 0ce03d596..380d49667 100644
--- a/src/validation.cpp
+++ b/src/validation.cpp
@@ -1523,6 +1523,16 @@ void UpdateCoins(const CTransaction& tx, CCoinsViewCache& inputs, int nHeight)
 }
 
 bool CScriptCheck::operator()() {
+    if(checkOutput())
+    {
+        // Check the sender signature inside the output, used to identify VM sender
+        CScript senderPubKey, senderSig;
+        if(!ExtractSenderData(ptxTo->vout[nOut].scriptPubKey, &senderPubKey, &senderSig))
+            return false;
+        return VerifyScript(senderSig, senderPubKey, nullptr, nFlags, CachingTransactionSignatureOutputChecker(ptxTo, nOut, ptxTo->vout[nOut].nValue, cacheStore, *txdata), &error);
+    }
+
+    // Check the input signature
     const CScript &scriptSig = ptxTo->vin[nIn].scriptSig;
     const CScriptWitness *witness = &ptxTo->vin[nIn].scriptWitness;
     return VerifyScript(scriptSig, m_tx_out.scriptPubKey, witness, nFlags, CachingTransactionSignatureChecker(ptxTo, nIn, m_tx_out.nValue, cacheStore, *txdata), &error);
@@ -1634,6 +1644,20 @@ bool CheckInputs(const CTransaction& tx, CValidationState &state, const CCoinsVi
                 }
             }
 
+            for (unsigned int i = 0; i < tx.vout.size(); i++) {
+                // Verify sender output signature
+                if(tx.vout[i].scriptPubKey.HasOpSender())
+                {
+                    CScriptCheck check(tx, i, 0, cacheSigStore, &txdata);
+                    if (pvChecks) {
+                        pvChecks->push_back(CScriptCheck());
+                        check.swap(pvChecks->back());
+                    } else if (!check()) {
+                        return state.DoS(100,false, REJECT_INVALID, strprintf("sender-output-script-verify-failed (%s)", ScriptErrorString(check.GetScriptError())));
+                    }
+                }
+            }
+
             if (cacheFullScriptStore && !pvChecks) {
                 // We executed all of the provided scripts, and were told to
                 // cache the result. Do so now.
diff --git a/src/validation.h b/src/validation.h
index a590a4b72..61ca205ba 100644
--- a/src/validation.h
+++ b/src/validation.h
@@ -474,11 +474,14 @@ class CScriptCheck
     bool cacheStore;
     ScriptError error;
     PrecomputedTransactionData *txdata;
+    int nOut;
 
 public:
-    CScriptCheck(): ptxTo(nullptr), nIn(0), nFlags(0), cacheStore(false), error(SCRIPT_ERR_UNKNOWN_ERROR) {}
+    CScriptCheck(): ptxTo(nullptr), nIn(0), nFlags(0), cacheStore(false), error(SCRIPT_ERR_UNKNOWN_ERROR), nOut(-1) {}
     CScriptCheck(const CTxOut& outIn, const CTransaction& txToIn, unsigned int nInIn, unsigned int nFlagsIn, bool cacheIn, PrecomputedTransactionData* txdataIn) :
-        m_tx_out(outIn), ptxTo(&txToIn), nIn(nInIn), nFlags(nFlagsIn), cacheStore(cacheIn), error(SCRIPT_ERR_UNKNOWN_ERROR), txdata(txdataIn) { }
+        m_tx_out(outIn), ptxTo(&txToIn), nIn(nInIn), nFlags(nFlagsIn), cacheStore(cacheIn), error(SCRIPT_ERR_UNKNOWN_ERROR), txdata(txdataIn), nOut(-1) { }
+    CScriptCheck(const CTransaction& txToIn, int nOutIn, unsigned int nFlagsIn, bool cacheIn, PrecomputedTransactionData* txdataIn) :
+        ptxTo(&txToIn), nIn(0), nFlags(nFlagsIn), cacheStore(cacheIn), error(SCRIPT_ERR_UNKNOWN_ERROR), txdata(txdataIn), nOut(nOutIn) { }
 
     bool operator()();
 
@@ -490,9 +493,12 @@ class CScriptCheck
         std::swap(cacheStore, check.cacheStore);
         std::swap(error, check.error);
         std::swap(txdata, check.txdata);
+        std::swap(nOut, check.nOut);
     }
 
     ScriptError GetScriptError() const { return error; }
+
+    bool checkOutput() const { return nOut > -1; }
 };
 
 /** Initializes the script-execution cache */

From 8f47195678c88df565e2eab45f4884341764415d Mon Sep 17 00:00:00 2001
From: Time Markov <time.markov@qtum.com>
Date: Tue, 26 Feb 2019 16:03:41 +0100
Subject: [PATCH 036/153] Extract sender data with or without contract
 consensus

---
 src/script/standard.cpp | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/src/script/standard.cpp b/src/script/standard.cpp
index fe690ddac..132743678 100644
--- a/src/script/standard.cpp
+++ b/src/script/standard.cpp
@@ -523,20 +523,25 @@ bool ExtractSenderData(const CScript &outputPubKey, CScript *senderPubKey, CScri
     {
         try
         {
+            // Solve the contract with or without contract consensus
             txnouttype typ;
             std::vector<valtype> vSolutions;
-            if (!Solver(outputPubKey, typ, vSolutions))
+            if (!Solver(outputPubKey, typ, vSolutions, true) &&
+                    !Solver(outputPubKey, typ, vSolutions, false))
                 return false;
 
+            // Check the size of the returned data
             if(vSolutions.size() < 2)
                 return false;
 
+            // Get the sender public key
             if(senderPubKey)
             {
                 CDataStream ss(vSolutions[0], SER_NETWORK, PROTOCOL_VERSION);
                 ss >> *senderPubKey;
             }
 
+            // Get the sender signature
             if(senderSig)
             {
                 CDataStream ss(vSolutions[1], SER_NETWORK, PROTOCOL_VERSION);

From 86fedd4c1f06137c9d6cff49b0025fd73f9a62f3 Mon Sep 17 00:00:00 2001
From: Time Markov <time.markov@qtum.com>
Date: Wed, 27 Feb 2019 10:25:13 +0100
Subject: [PATCH 037/153] Update getting sender destination in RPC for create
 and send to contract

---
 src/wallet/rpcwallet.cpp | 36 ++++++++++++++++++++++++++++++++----
 1 file changed, 32 insertions(+), 4 deletions(-)

diff --git a/src/wallet/rpcwallet.cpp b/src/wallet/rpcwallet.cpp
index 3b4482586..459f9c8b4 100755
--- a/src/wallet/rpcwallet.cpp
+++ b/src/wallet/rpcwallet.cpp
@@ -66,6 +66,34 @@ std::shared_ptr<CWallet> GetWalletForJSONRPCRequest(const JSONRPCRequest& reques
     return wallets.size() == 1 || (request.fHelp && wallets.size() > 0) ? wallets[0] : nullptr;
 }
 
+bool GetSenderDest(CWallet * const pwallet, const CTransactionRef& tx, CTxDestination& txSenderDest)
+{
+    // Initialize variables
+    CScript senderPubKey;
+
+    // Get sender destination
+    if(tx->HasOpSender())
+    {
+        // Get destination from the outputs
+        for(CTxOut out : tx->vout)
+        {
+            if(out.scriptPubKey.HasOpSender())
+            {
+                ExtractSenderData(out.scriptPubKey, &senderPubKey, 0);
+                break;
+            }
+        }
+    }
+    else
+    {
+        // Get destination from the inputs
+        senderPubKey = pwallet->mapWallet.at(tx->vin[0].prevout.hash).tx->vout[tx->vin[0].prevout.n].scriptPubKey;
+    }
+
+    // Extract destination from script
+    return ExtractDestination(senderPubKey, txSenderDest);
+}
+
 std::string HelpRequiringPassphrase(CWallet * const pwallet)
 {
     return pwallet && pwallet->IsCrypted()
@@ -828,9 +856,9 @@ static UniValue createcontract(const JSONRPCRequest& request){
     }
 
     CTxDestination txSenderDest;
-    ExtractDestination(pwallet->mapWallet.at(tx->vin[0].prevout.hash).tx->vout[tx->vin[0].prevout.n].scriptPubKey,txSenderDest);
+    GetSenderDest(pwallet, tx, txSenderDest);
 
-    if (fHasSender && coinControl.HasSelected() && !(senderAddress == txSenderDest)){
+    if (fHasSender && !(senderAddress == txSenderDest)){
            throw JSONRPCError(RPC_TYPE_ERROR, "Sender could not be set, transaction was not committed!");
     }
 
@@ -1063,9 +1091,9 @@ static UniValue sendtocontract(const JSONRPCRequest& request){
     }
 
     CTxDestination txSenderDest;
-    ExtractDestination(pwallet->mapWallet.at(tx->vin[0].prevout.hash).tx->vout[tx->vin[0].prevout.n].scriptPubKey,txSenderDest);
+    GetSenderDest(pwallet, tx, txSenderDest);
 
-    if (fHasSender && coinControl.HasSelected() && !(senderAddress == txSenderDest)){
+    if (fHasSender && !(senderAddress == txSenderDest)){
         throw JSONRPCError(RPC_TYPE_ERROR, "Sender could not be set, transaction was not committed!");
     }
 

From 2a1e5698bd716fd502b3450ad273285f1c2cd97f Mon Sep 17 00:00:00 2001
From: Time Markov <time.markov@qtum.com>
Date: Wed, 27 Feb 2019 13:06:23 +0100
Subject: [PATCH 038/153] Remove the check for presence of unspent outputs in
 address for sending tokens

---
 src/qt/sendtokenpage.cpp | 9 +--------
 1 file changed, 1 insertion(+), 8 deletions(-)

diff --git a/src/qt/sendtokenpage.cpp b/src/qt/sendtokenpage.cpp
index 9502d378b..feaa074ee 100644
--- a/src/qt/sendtokenpage.cpp
+++ b/src/qt/sendtokenpage.cpp
@@ -157,7 +157,7 @@ void SendTokenPage::on_confirmClicked()
         return;
     }
 
-    if(m_model && m_model->wallet().isUnspentAddress(m_selectedToken->sender))
+    if(m_model)
     {
         int unit = m_model->getOptionsModel()->getDisplayUnit();
         uint64_t gasLimit = ui->lineEditGasLimit->value();
@@ -199,13 +199,6 @@ void SendTokenPage::on_confirmClicked()
             clearAll();
         }
     }
-    else
-    {
-        QString message = tr("To send %1 you need QTUM on address <br /> %2.")
-                .arg(QString::fromStdString(m_selectedToken->symbol)).arg(QString::fromStdString(m_selectedToken->sender));
-
-        QMessageBox::warning(this, tr("Send token"), message);
-    }
 }
 
 void SendTokenPage::setTokenData(std::string address, std::string sender, std::string symbol, int8_t decimals, std::string balance)

From 0f28184ae4d81c3f299e06f1dc159a0529737b46 Mon Sep 17 00:00:00 2001
From: Time Markov <time.markov@qtum.com>
Date: Thu, 28 Feb 2019 09:12:57 +0100
Subject: [PATCH 039/153] Set the refund sender be the one that provide the
 coins for creating the contract

---
 src/qtum/qtumtransaction.h |  7 ++++++-
 src/validation.cpp         | 15 +++++++++++----
 src/validation.h           |  2 +-
 3 files changed, 18 insertions(+), 6 deletions(-)

diff --git a/src/qtum/qtumtransaction.h b/src/qtum/qtumtransaction.h
index 73d7097a1..1a48d76e9 100644
--- a/src/qtum/qtumtransaction.h
+++ b/src/qtum/qtumtransaction.h
@@ -68,10 +68,15 @@ class QtumTransaction : public dev::eth::Transaction{
     VersionVM getVersion() const{
         return version;
     }
+
+    void setRefundSender(const dev::Address _refundSender) { refundSender = _refundSender; }
+
+    dev::Address getRefundSender() const { return refundSender; }
+
 private:
 
     uint32_t nVout;
     VersionVM version;
-
+    dev::Address refundSender;
 };
 #endif
diff --git a/src/validation.cpp b/src/validation.cpp
index 380d49667..a47012700 100644
--- a/src/validation.cpp
+++ b/src/validation.cpp
@@ -2151,12 +2151,13 @@ bool CheckReward(const CBlock& block, CValidationState& state, int nHeight, cons
     return true;
 }
 
-valtype GetSenderAddress(const CTransaction& tx, const CCoinsViewCache* coinsView, const std::vector<CTransactionRef>* blockTxs, uint32_t nOut){
+valtype GetSenderAddress(const CTransaction& tx, const CCoinsViewCache* coinsView, const std::vector<CTransactionRef>* blockTxs, int nOut = -1){
     CScript script;
     bool scriptFilled=false; //can't use script.empty() because an empty script is technically valid
 
     // Try get the sender script from the output script
-    scriptFilled = ExtractSenderData(tx.vout[nOut].scriptPubKey, &script, nullptr);
+    if(nOut > -1)
+        scriptFilled = ExtractSenderData(tx.vout[nOut].scriptPubKey, &script, nullptr);
 
     // Check the current (or in-progress) block for zero-confirmation change spending that won't yet be in txindex
     if(!scriptFilled && blockTxs){
@@ -2307,7 +2308,8 @@ bool ByteCodeExec::processingResults(ByteCodeExecResult& resultBCE){
                 return false;
             }
             if(amount > 0){
-                CScript script(CScript() << OP_DUP << OP_HASH160 << txs[i].sender().asBytes() << OP_EQUALVERIFY << OP_CHECKSIG);
+                // Refund the rest of the amount to the sender that provide the coins for the contract
+                CScript script(CScript() << OP_DUP << OP_HASH160 << txs[i].getRefundSender().asBytes() << OP_EQUALVERIFY << OP_CHECKSIG);
                 resultBCE.refundOutputs.push_back(CTxOut(amount, script));
                 resultBCE.refundSender += amount;
             }
@@ -2360,6 +2362,10 @@ dev::Address ByteCodeExec::EthAddrFromScript(const CScript& script){
 }
 
 bool QtumTxConverter::extractionQtumTransactions(ExtractQtumTX& qtumtx){
+    // Get the address of the sender that pay the coins for the contract transactions
+    refundSender = dev::Address(GetSenderAddress(txBit, view, blockTransactions));
+
+    // Extract contract transactions
     std::vector<QtumTransaction> resultTX;
     std::vector<EthTransactionParams> resultETP;
     for(size_t i = 0; i < txBit.vout.size(); i++){
@@ -2457,11 +2463,12 @@ QtumTransaction QtumTxConverter::createEthTX(const EthTransactionParams& etp, ui
     else{
         txEth = QtumTransaction(txBit.vout[nOut].nValue, etp.gasPrice, etp.gasLimit, etp.receiveAddress, etp.code, dev::u256(0));
     }
-    dev::Address sender(GetSenderAddress(txBit, view, blockTransactions, nOut));
+    dev::Address sender(GetSenderAddress(txBit, view, blockTransactions, (int)nOut));
     txEth.forceSender(sender);
     txEth.setHashWith(uintToh256(txBit.GetHash()));
     txEth.setNVout(nOut);
     txEth.setVersion(etp.version);
+    txEth.setRefundSender(refundSender);
 
     return txEth;
 }
diff --git a/src/validation.h b/src/validation.h
index 61ca205ba..d10db986f 100644
--- a/src/validation.h
+++ b/src/validation.h
@@ -687,7 +687,7 @@ class QtumTxConverter{
     opcodetype opcode;
     const std::vector<CTransactionRef> *blockTransactions;
     bool sender;
-
+    dev::Address refundSender;
 };
 
 class ByteCodeExec {

From 57decc9f1e080de09be19c6b6d9ad5af1eaf8366 Mon Sep 17 00:00:00 2001
From: Time Markov <time.markov@qtum.com>
Date: Thu, 28 Feb 2019 13:19:57 +0100
Subject: [PATCH 040/153] Extend CheckSenderScript to include check for the
 sender encoded into the output

---
 src/policy/policy.h |  5 +++++
 src/validation.cpp  | 38 ++++++++++++++++++++++++++++++++++++++
 2 files changed, 43 insertions(+)

diff --git a/src/policy/policy.h b/src/policy/policy.h
index d83191c06..952104634 100644
--- a/src/policy/policy.h
+++ b/src/policy/policy.h
@@ -75,6 +75,11 @@ static constexpr unsigned int STANDARD_NOT_MANDATORY_VERIFY_FLAGS = STANDARD_SCR
 static constexpr unsigned int STANDARD_LOCKTIME_VERIFY_FLAGS = LOCKTIME_VERIFY_SEQUENCE |
                                                                LOCKTIME_MEDIAN_TIME_PAST;
 
+/** The number of sender stack items in a standard sender signature script */
+static const unsigned int STANDARD_SENDER_STACK_ITEMS = 2;
+/** The maximum size of each sender stack item in a standard sender signature script */
+static const unsigned int MAX_STANDARD_SENDER_STACK_ITEM_SIZE = 80;
+
 CAmount GetDustThreshold(const CTxOut& txout, const CFeeRate& dustRelayFee);
 
 bool IsDust(const CTxOut& txout, const CFeeRate& dustRelayFee);
diff --git a/src/validation.cpp b/src/validation.cpp
index a47012700..8186e2123 100644
--- a/src/validation.cpp
+++ b/src/validation.cpp
@@ -2025,10 +2025,48 @@ static int64_t nBlocksTotal = 0;
 
 /////////////////////////////////////////////////////////////////////// qtum
 bool CheckSenderScript(const CCoinsViewCache& view, const CTransaction& tx){
+    // Check for the sender that pays the coins
     CScript script = view.AccessCoin(tx.vin[0].prevout).out.scriptPubKey;
     if(!script.IsPayToPubkeyHash() && !script.IsPayToPubkey()){
         return false;
     }
+
+    // Check for additional EVM sender
+    if(!tx.HasOpSender())
+        return true;
+
+    // Check for the EVM sender that is encoded into the output
+    for (const CTxOut& txout : tx.vout)
+    {
+        if(txout.scriptPubKey.HasOpSender())
+        {
+            // Extract the sender data
+            CScript senderPubKey, senderSig;
+            if(!ExtractSenderData(txout.scriptPubKey, &senderPubKey, &senderSig))
+                return false;
+
+            // Check that the pub key is valid sender that can be used in the EVM
+            if(!senderPubKey.IsPayToPubkeyHash() && !senderPubKey.IsPayToPubkey())
+                return false;
+
+            // Get the signature stack
+            std::vector <std::vector<unsigned char> > stack;
+            if (!EvalScript(stack, senderSig, SCRIPT_VERIFY_NONE, BaseSignatureChecker(), SigVersion::BASE))
+                return false;
+
+            // Check that the signature script contains only signature and public key (2 items)
+            if(stack.size() != STANDARD_SENDER_STACK_ITEMS)
+                return false;
+
+            // Check that the items size is no more than 80 bytes
+            for(size_t i=0; i < stack.size(); i++)
+            {
+                if(stack[i].size() > MAX_STANDARD_SENDER_STACK_ITEM_SIZE)
+                    return false;
+            }
+        }
+    }
+
     return true;
 }
 

From db9cd79ceea897558149947c4a2161a56024db8a Mon Sep 17 00:00:00 2001
From: Time Markov <time.markov@qtum.com>
Date: Thu, 28 Feb 2019 14:47:47 +0100
Subject: [PATCH 041/153] Check the sender max script signature size

---
 src/script/script.h     | 3 +++
 src/script/standard.cpp | 4 ++++
 2 files changed, 7 insertions(+)

diff --git a/src/script/script.h b/src/script/script.h
index d8c7d90e6..9e00e0009 100644
--- a/src/script/script.h
+++ b/src/script/script.h
@@ -31,6 +31,9 @@ static const int MAX_PUBKEYS_PER_MULTISIG = 20;
 // Maximum script length in bytes
 static const int MAX_SCRIPT_SIZE = 129000; // (129 kb)
 
+// Maximum base script length in bytes
+static const int MAX_BASE_SCRIPT_SIZE = 10000;
+
 // Maximum number of values on script interpreter stack
 static const int MAX_STACK_SIZE = 1000;
 
diff --git a/src/script/standard.cpp b/src/script/standard.cpp
index 132743678..63be0311f 100644
--- a/src/script/standard.cpp
+++ b/src/script/standard.cpp
@@ -311,6 +311,10 @@ bool Solver(const CScript& scriptPubKey, txnouttype& typeRet, std::vector<std::v
                     if(vch1.empty())
                         break;
 
+                    // Check the max size of the signature script
+                    if(vch1.size() > MAX_BASE_SCRIPT_SIZE)
+                        return false;
+
                     vSolutionsRet.push_back(vch1);
                 }
             }

From c4b55e29cb2fef15d2743927da1f1a9b49efab29 Mon Sep 17 00:00:00 2001
From: Time Markov <time.markov@qtum.com>
Date: Fri, 1 Mar 2019 09:36:04 +0100
Subject: [PATCH 042/153] Enable zero balance address as sender address by
 default

---
 src/qt/addressfield.cpp   | 13 +++----------
 src/qt/createcontract.cpp |  1 -
 src/qt/sendtocontract.cpp |  1 -
 3 files changed, 3 insertions(+), 12 deletions(-)

diff --git a/src/qt/addressfield.cpp b/src/qt/addressfield.cpp
index 7ea103d7b..b66042161 100644
--- a/src/qt/addressfield.cpp
+++ b/src/qt/addressfield.cpp
@@ -22,7 +22,7 @@ AddressField::AddressField(QWidget *parent) :
     m_addressColumn(0),
     m_typeRole(Qt::UserRole),
     m_senderAddress(false),
-    m_includeZeroValue(false)
+    m_includeZeroValue(true)
 
 {
     // Set editable state
@@ -88,7 +88,7 @@ void AddressField::on_refresh()
         {
             QStringList addresses;
 
-            // Add all available addresses if 0 address ballance for token is enabled
+            // Add all available addresses
             if(m_includeZeroValue)
             {
                 // Include zero or unconfirmed coins too
@@ -110,14 +110,7 @@ void AddressField::on_refresh()
     int index = m_stringList.indexOf(currentAddress);
     m_stringModel.setStringList(m_stringList);
     setModel(&m_stringModel);
-    if(!isEditable())
-    {
-        setCurrentIndex(index);
-    }
-    else
-    {
-        setCurrentText(currentAddress);
-    }
+    setCurrentIndex(index);
 }
 
 void AddressField::on_addressTypeChanged()
diff --git a/src/qt/createcontract.cpp b/src/qt/createcontract.cpp
index bd8ac97f2..a31bd4cc1 100644
--- a/src/qt/createcontract.cpp
+++ b/src/qt/createcontract.cpp
@@ -70,7 +70,6 @@ CreateContract::CreateContract(const PlatformStyle *platformStyle, QWidget *pare
     ui->lineEditGasLimit->setValue(DEFAULT_GAS_LIMIT_OP_CREATE);
     ui->pushButtonCreateContract->setEnabled(false);
     ui->lineEditSenderAddress->setSenderAddress(true);
-    ui->lineEditSenderAddress->setComboBoxEditable(true);
 
     // Create new PRC command line interface
     QStringList lstMandatory;
diff --git a/src/qt/sendtocontract.cpp b/src/qt/sendtocontract.cpp
index 02ca0fc64..8a5e06082 100644
--- a/src/qt/sendtocontract.cpp
+++ b/src/qt/sendtocontract.cpp
@@ -84,7 +84,6 @@ SendToContract::SendToContract(const PlatformStyle *platformStyle, QWidget *pare
     ui->textEditInterface->setIsValidManually(true);
     ui->pushButtonSendToContract->setEnabled(false);
     ui->lineEditSenderAddress->setSenderAddress(true);
-    ui->lineEditSenderAddress->setComboBoxEditable(true);
 
     // Create new PRC command line interface
     QStringList lstMandatory;

From 0c49a71c62b39f5b7284029fe4c4af2cbc58af31 Mon Sep 17 00:00:00 2001
From: Time Markov <time.markov@qtum.com>
Date: Fri, 1 Mar 2019 11:50:14 +0100
Subject: [PATCH 043/153] Worn in case send token fail

---
 src/qt/sendtokenpage.cpp |  4 ++++
 src/qt/token.cpp         | 10 ++++++++--
 src/qt/token.h           |  1 +
 3 files changed, 13 insertions(+), 2 deletions(-)

diff --git a/src/qt/sendtokenpage.cpp b/src/qt/sendtokenpage.cpp
index feaa074ee..3b75bdf9c 100644
--- a/src/qt/sendtokenpage.cpp
+++ b/src/qt/sendtokenpage.cpp
@@ -196,6 +196,10 @@ void SendTokenPage::on_confirmClicked()
                 tokenTx.label = label;
                 m_model->wallet().addTokenTxEntry(tokenTx);
             }
+            else
+            {
+                QMessageBox::warning(this, tr("Send token"), QString::fromStdString(m_tokenABI->getErrorMessage()));
+            }
             clearAll();
         }
     }
diff --git a/src/qt/token.cpp b/src/qt/token.cpp
index c9e3a8537..3a2361eb7 100755
--- a/src/qt/token.cpp
+++ b/src/qt/token.cpp
@@ -52,6 +52,7 @@ struct TokenData
     int evtBurn;
 
     std::string txid;
+    QString errorMessage;
 
     TokenData():
         call(0),
@@ -544,8 +545,8 @@ bool Token::exec(const std::vector<std::string> &input, int func, std::vector<st
     ExecRPCCommand* cmd = sendTo ? d->send : d->call;
     QVariant result;
     QString resultJson;
-    QString errorMessage;
-    if(!cmd->exec(d->model->node(), d->model->wallet(), d->lstParams, result, resultJson, errorMessage))
+    d->errorMessage.clear();
+    if(!cmd->exec(d->model->node(), d->model->wallet(), d->lstParams, result, resultJson, d->errorMessage))
         return false;
 
     // Get the result from calling function
@@ -664,3 +665,8 @@ void Token::setModel(WalletModel *model)
 {
     d->model = model;
 }
+
+std::string Token::getErrorMessage()
+{
+    return d->errorMessage.toStdString();
+}
diff --git a/src/qt/token.h b/src/qt/token.h
index 0ff4f4b19..4685ea926 100755
--- a/src/qt/token.h
+++ b/src/qt/token.h
@@ -49,6 +49,7 @@ class Token
 
     // Get transaction data
     std::string getTxId();
+    std::string getErrorMessage();
 
     // ABI Functions
     bool name(std::string& result, bool sendTo = false);

From 12bc063307a9500ab0b592118de18f656e55f633 Mon Sep 17 00:00:00 2001
From: Time Markov <time.markov@qtum.com>
Date: Fri, 1 Mar 2019 16:16:14 +0100
Subject: [PATCH 044/153] Check op sender is only valid for contract outputs

---
 src/validation.cpp | 30 +++++++++++++++++++++++++++---
 src/validation.h   |  2 ++
 2 files changed, 29 insertions(+), 3 deletions(-)

diff --git a/src/validation.cpp b/src/validation.cpp
index 8186e2123..072df05ce 100644
--- a/src/validation.cpp
+++ b/src/validation.cpp
@@ -744,6 +744,9 @@ static bool AcceptToMemoryPoolWorker(const CChainParams& chainparams, CTxMemPool
         dev::u256 txMinGasPrice = 0;
 
         //////////////////////////////////////////////////////////// // qtum
+        if(!CheckOpSender(tx)){
+            return state.DoS(100, false, REJECT_INVALID, "bad-txns-invalid-sender");
+        }
         if(tx.HasCreateOrCall()){
 
             if(!CheckSenderScript(view, tx)){
@@ -2024,6 +2027,24 @@ static int64_t nTimeTotal = 0;
 static int64_t nBlocksTotal = 0;
 
 /////////////////////////////////////////////////////////////////////// qtum
+bool CheckOpSender(const CTransaction& tx){
+    if(!tx.HasOpSender())
+        return true;
+
+    // Check that the sender address inside the output is only valid for contract outputs
+    for (const CTxOut& txout : tx.vout)
+    {
+        if(txout.scriptPubKey.HasOpSender() &&
+                !(txout.scriptPubKey.HasOpCreate() ||
+                  txout.scriptPubKey.HasOpCall()))
+        {
+            return false;
+        }
+    }
+
+    return true;
+}
+
 bool CheckSenderScript(const CCoinsViewCache& view, const CTransaction& tx){
     // Check for the sender that pays the coins
     CScript script = view.AccessCoin(tx.vin[0].prevout).out.scriptPubKey;
@@ -2031,11 +2052,11 @@ bool CheckSenderScript(const CCoinsViewCache& view, const CTransaction& tx){
         return false;
     }
 
-    // Check for additional EVM sender
+    // Check for additional VM sender
     if(!tx.HasOpSender())
         return true;
 
-    // Check for the EVM sender that is encoded into the output
+    // Check for the VM sender that is encoded into the output
     for (const CTxOut& txout : tx.vout)
     {
         if(txout.scriptPubKey.HasOpSender())
@@ -2045,7 +2066,7 @@ bool CheckSenderScript(const CCoinsViewCache& view, const CTransaction& tx){
             if(!ExtractSenderData(txout.scriptPubKey, &senderPubKey, &senderSig))
                 return false;
 
-            // Check that the pub key is valid sender that can be used in the EVM
+            // Check that the pub key is valid sender that can be used in the VM
             if(!senderPubKey.IsPayToPubkeyHash() && !senderPubKey.IsPayToPubkey())
                 return false;
 
@@ -2824,6 +2845,9 @@ bool CChainState::ConnectBlock(const CBlock& block, CValidationState& state, CBl
         }
 
 ///////////////////////////////////////////////////////////////////////////////////////// qtum
+        if(!CheckOpSender(tx)){
+            return state.DoS(100, false, REJECT_INVALID, "bad-txns-invalid-sender");
+        }
         if(!tx.HasOpSpend()){
             checkBlock.vtx.push_back(block.vtx[i]);
         }
diff --git a/src/validation.h b/src/validation.h
index d10db986f..d2d64d886 100644
--- a/src/validation.h
+++ b/src/validation.h
@@ -629,6 +629,8 @@ bool CheckReward(const CBlock& block, CValidationState& state, int nHeight, cons
 //////////////////////////////////////////////////////// qtum
 std::vector<ResultExecute> CallContract(const dev::Address& addrContract, std::vector<unsigned char> opcode, const dev::Address& sender = dev::Address(), uint64_t gasLimit=0);
 
+bool CheckOpSender(const CTransaction& tx);
+
 bool CheckSenderScript(const CCoinsViewCache& view, const CTransaction& tx);
 
 bool CheckMinGasPrice(std::vector<EthTransactionParams>& etps, const uint64_t& minGasPrice);

From b99225f2455e1eb76c15c14abea346294bf78278 Mon Sep 17 00:00:00 2001
From: Time Markov <time.markov@qtum.com>
Date: Mon, 4 Mar 2019 14:00:05 +0100
Subject: [PATCH 045/153] Add QIP 5 block height parameter

---
 src/chainparams.cpp    | 3 +++
 src/consensus/params.h | 2 ++
 src/validation.cpp     | 9 ++++++---
 src/validation.h       | 2 +-
 4 files changed, 12 insertions(+), 4 deletions(-)

diff --git a/src/chainparams.cpp b/src/chainparams.cpp
index ace59a2a4..91fdf4c81 100644
--- a/src/chainparams.cpp
+++ b/src/chainparams.cpp
@@ -89,6 +89,7 @@ class CMainParams : public CChainParams {
         consensus.BIP34Hash = uint256S("0x000075aef83cf2853580f8ae8ce6f8c3096cfa21d98334d6e3f95e5582ed986c");
         consensus.BIP65Height = 0; // 000000000000000004c2b624ed5d7756c508d90fd0da2c7c679febfa6c4735f0
         consensus.BIP66Height = 0; // 00000000000000000379eaa19dce8c9b722d46ae6a57c2f1a988119488b50931
+        consensus.QIP5Height = 0x7fffffff;
         consensus.powLimit = uint256S("0000ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff");
         consensus.posLimit = uint256S("00000000ffffffffffffffffffffffffffffffffffffffffffffffffffffffff");
         consensus.nPowTargetTimespan = 16 * 60; // 16 minutes
@@ -203,6 +204,7 @@ class CTestNetParams : public CChainParams {
         consensus.BIP34Hash = uint256S("0x0000e803ee215c0684ca0d2f9220594d3f828617972aad66feb2ba51f5e14222");
         consensus.BIP65Height = 0; // 00000000007f6655f22f98e72ed80d8b06dc761d5da09df0fa1dc4be4f861eb6
         consensus.BIP66Height = 0; // 000000002104c8c45e99a8853285a3b592602a3ccde2b832481da85e9e4ba182
+        consensus.QIP5Height = 0x7fffffff;
         consensus.powLimit = uint256S("0000ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff");
         consensus.posLimit = uint256S("0000ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff");
         consensus.nPowTargetTimespan = 16 * 60; // 16 minutes
@@ -306,6 +308,7 @@ class CRegTestParams : public CChainParams {
         consensus.BIP34Hash = uint256S("0x665ed5b402ac0b44efc37d8926332994363e8a7278b7ee9a58fb972efadae943");
         consensus.BIP65Height = 0; // BIP65 activated on regtest (Used in rpc activation tests)
         consensus.BIP66Height = 0; // BIP66 activated on regtest (Used in rpc activation tests)
+        consensus.QIP5Height = 0x7fffffff;
         consensus.powLimit = uint256S("7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff");
         consensus.posLimit = uint256S("7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff");
         consensus.nPowTargetTimespan = 16 * 60; // 16 minutes
diff --git a/src/consensus/params.h b/src/consensus/params.h
index 5dedc7caf..ba80a34b0 100644
--- a/src/consensus/params.h
+++ b/src/consensus/params.h
@@ -58,6 +58,8 @@ struct Params {
     int BIP65Height;
     /** Block height at which BIP66 becomes active */
     int BIP66Height;
+    /** Block height at which QIP5 becomes active */
+    int QIP5Height;
     /**
      * Minimum blocks including miner confirmation of the total of 2016 blocks in a retargeting period,
      * (nPowTargetTimespan / nPowTargetSpacing) which is also used for BIP9 deployments.
diff --git a/src/validation.cpp b/src/validation.cpp
index 072df05ce..535bf9feb 100644
--- a/src/validation.cpp
+++ b/src/validation.cpp
@@ -744,7 +744,7 @@ static bool AcceptToMemoryPoolWorker(const CChainParams& chainparams, CTxMemPool
         dev::u256 txMinGasPrice = 0;
 
         //////////////////////////////////////////////////////////// // qtum
-        if(!CheckOpSender(tx)){
+        if(!CheckOpSender(tx, chainparams, GetSpendHeight(view))){
             return state.DoS(100, false, REJECT_INVALID, "bad-txns-invalid-sender");
         }
         if(tx.HasCreateOrCall()){
@@ -2027,10 +2027,13 @@ static int64_t nTimeTotal = 0;
 static int64_t nBlocksTotal = 0;
 
 /////////////////////////////////////////////////////////////////////// qtum
-bool CheckOpSender(const CTransaction& tx){
+bool CheckOpSender(const CTransaction& tx, const CChainParams& chainparams, int nHeight){
     if(!tx.HasOpSender())
         return true;
 
+    if(!(nHeight >= chainparams.GetConsensus().QIP5Height))
+        return false;
+
     // Check that the sender address inside the output is only valid for contract outputs
     for (const CTxOut& txout : tx.vout)
     {
@@ -2845,7 +2848,7 @@ bool CChainState::ConnectBlock(const CBlock& block, CValidationState& state, CBl
         }
 
 ///////////////////////////////////////////////////////////////////////////////////////// qtum
-        if(!CheckOpSender(tx)){
+        if(!CheckOpSender(tx, chainparams, pindex->nHeight)){
             return state.DoS(100, false, REJECT_INVALID, "bad-txns-invalid-sender");
         }
         if(!tx.HasOpSpend()){
diff --git a/src/validation.h b/src/validation.h
index d2d64d886..9ce88c6d7 100644
--- a/src/validation.h
+++ b/src/validation.h
@@ -629,7 +629,7 @@ bool CheckReward(const CBlock& block, CValidationState& state, int nHeight, cons
 //////////////////////////////////////////////////////// qtum
 std::vector<ResultExecute> CallContract(const dev::Address& addrContract, std::vector<unsigned char> opcode, const dev::Address& sender = dev::Address(), uint64_t gasLimit=0);
 
-bool CheckOpSender(const CTransaction& tx);
+bool CheckOpSender(const CTransaction& tx, const CChainParams& chainparams, int nHeight);
 
 bool CheckSenderScript(const CCoinsViewCache& view, const CTransaction& tx);
 

From 31dbc865e74949743f29b112a52f61d3d79f4267 Mon Sep 17 00:00:00 2001
From: Time Markov <time.markov@qtum.com>
Date: Mon, 4 Mar 2019 14:02:45 +0100
Subject: [PATCH 046/153] Update opsender block height in regtest mode

---
 src/chainparams.cpp | 10 ++++++++++
 src/chainparams.h   |  6 ++++++
 src/init.cpp        | 16 ++++++++++++++++
 3 files changed, 32 insertions(+)

diff --git a/src/chainparams.cpp b/src/chainparams.cpp
index 91fdf4c81..f2414986d 100644
--- a/src/chainparams.cpp
+++ b/src/chainparams.cpp
@@ -435,3 +435,13 @@ void UpdateVersionBitsParameters(Consensus::DeploymentPos d, int64_t nStartTime,
 {
     globalChainParams->UpdateVersionBitsParameters(d, nStartTime, nTimeout);
 }
+
+void CChainParams::UpdateOpSenderBlockHeight(int nHeight)
+{
+    consensus.QIP5Height = nHeight;
+}
+
+void UpdateOpSenderBlockHeight(int nHeight)
+{
+    globalChainParams->UpdateOpSenderBlockHeight(nHeight);
+}
diff --git a/src/chainparams.h b/src/chainparams.h
index 722e52ff4..898450c57 100644
--- a/src/chainparams.h
+++ b/src/chainparams.h
@@ -81,6 +81,7 @@ class CChainParams
     const CCheckpointData& Checkpoints() const { return checkpointData; }
     const ChainTxData& TxData() const { return chainTxData; }
     void UpdateVersionBitsParameters(Consensus::DeploymentPos d, int64_t nStartTime, int64_t nTimeout);
+    void UpdateOpSenderBlockHeight(int nHeight);
 protected:
     CChainParams() {}
 
@@ -126,4 +127,9 @@ void SelectParams(const std::string& chain);
  */
 void UpdateVersionBitsParameters(Consensus::DeploymentPos d, int64_t nStartTime, int64_t nTimeout);
 
+/**
+ * Allows modifying the Op Sender block height regtest parameter.
+ */
+void UpdateOpSenderBlockHeight(int nHeight);
+
 #endif // BITCOIN_CHAINPARAMS_H
diff --git a/src/init.cpp b/src/init.cpp
index 8c3704ff6..7de76041f 100644
--- a/src/init.cpp
+++ b/src/init.cpp
@@ -493,6 +493,7 @@ void SetupServerArgs()
     gArgs.AddArg("-printtoconsole", "Send trace/debug info to console (default: 1 when no -daemon. To disable logging to file, set -nodebuglogfile)", false, OptionsCategory::DEBUG_TEST);
     gArgs.AddArg("-shrinkdebugfile", "Shrink debug.log file on client startup (default: 1 when no -debug)", false, OptionsCategory::DEBUG_TEST);
     gArgs.AddArg("-uacomment=<cmt>", "Append comment to the user agent string", false, OptionsCategory::DEBUG_TEST);
+    gArgs.AddArg("-opsender-block=<n>", "Use given block height to check opsender fork (regtest-only)", true, OptionsCategory::DEBUG_TEST);
 
     SetupChainParamsBaseOptions();
 
@@ -1193,6 +1194,21 @@ bool AppInitParameterInteraction()
             }
         }
     }
+
+    if (gArgs.IsArgSet("-opsender-block")) {
+        // Allow overriding opsender block for testing
+        if (!chainparams.MineBlocksOnDemand()) {
+            return InitError("Op Sender block height may only be overridden on regtest.");
+        }
+
+        int opsenderBlock = gArgs.GetArg("-opsender-block", 0x7fffffff);
+        if(opsenderBlock >= 0)
+        {
+            UpdateOpSenderBlockHeight(opsenderBlock);
+            LogPrintf("Activate Op Sender at block height %d\n.", opsenderBlock);
+        }
+    }
+
     return true;
 }
 

From 0d6eb1179f6ce547d3b52791f7759585899e8ff7 Mon Sep 17 00:00:00 2001
From: Time Markov <time.markov@qtum.com>
Date: Mon, 4 Mar 2019 15:46:22 +0100
Subject: [PATCH 047/153] Create op sender transaction when op sender is
 activated

---
 src/wallet/rpcwallet.cpp | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/src/wallet/rpcwallet.cpp b/src/wallet/rpcwallet.cpp
index 459f9c8b4..a2c8df09f 100755
--- a/src/wallet/rpcwallet.cpp
+++ b/src/wallet/rpcwallet.cpp
@@ -32,6 +32,7 @@
 #include <wallet/walletdb.h>
 #include <wallet/walletutil.h>
 #include <miner.h>
+#include <chainparams.h>
 
 #include <stdint.h>
 
@@ -809,6 +810,11 @@ static UniValue createcontract(const JSONRPCRequest& request){
         }
         else
         {
+            // Create op sender transaction when op sender is activated
+            int nHeight = chainActive.Height();
+            if(!(nHeight >= Params().GetConsensus().QIP5Height))
+                throw JSONRPCError(RPC_TYPE_ERROR, "Sender address does not have any unspent outputs");
+
             // Sign the sender in case of no UTXO
             signSenderAddress = senderAddress;
         }
@@ -1043,6 +1049,11 @@ static UniValue sendtocontract(const JSONRPCRequest& request){
         }
         else
         {
+            // Create op sender transaction when op sender is activated
+            int nHeight = chainActive.Height();
+            if(!(nHeight >= Params().GetConsensus().QIP5Height))
+                throw JSONRPCError(RPC_TYPE_ERROR, "Sender address does not have any unspent outputs");
+
             // Sign the sender in case of no UTXO
             signSenderAddress = senderAddress;
         }

From 8224529d75441b605001aa4c79ad6398f6eae10f Mon Sep 17 00:00:00 2001
From: Time Markov <time.markov@qtum.com>
Date: Mon, 4 Mar 2019 16:55:28 +0100
Subject: [PATCH 048/153] Include the zero value addresses in the GUI
 components when the op sender is activated

---
 src/interfaces/wallet.cpp |  4 +++-
 src/interfaces/wallet.h   |  2 +-
 src/qt/addressfield.cpp   | 14 +++++++++++---
 src/qt/addressfield.h     |  3 ++-
 src/qt/walletmodel.cpp    |  5 +++--
 src/qt/walletmodel.h      |  2 +-
 6 files changed, 21 insertions(+), 9 deletions(-)

diff --git a/src/interfaces/wallet.cpp b/src/interfaces/wallet.cpp
index ab48ed2bb..467f0d278 100644
--- a/src/interfaces/wallet.cpp
+++ b/src/interfaces/wallet.cpp
@@ -566,7 +566,7 @@ class WalletImpl : public Wallet
 
         return result;
     }
-    bool tryGetAvailableAddresses(std::vector<std::string> &spendableAddresses, std::vector<std::string> &allAddresses) override
+    bool tryGetAvailableAddresses(std::vector<std::string> &spendableAddresses, std::vector<std::string> &allAddresses, bool &includeZeroValue) override
     {
         TRY_LOCK(cs_main, locked_chain);
         if (!locked_chain) return false;
@@ -577,6 +577,8 @@ class WalletImpl : public Wallet
 
         spendableAddresses = availableAddresses(false);
         allAddresses = availableAddresses(true);
+        includeZeroValue = ::chainActive.Height() >= Params().GetConsensus().QIP5Height;
+
         return true;
     }
     CoinsList listCoins() override
diff --git a/src/interfaces/wallet.h b/src/interfaces/wallet.h
index b46886c64..a1f6b7842 100644
--- a/src/interfaces/wallet.h
+++ b/src/interfaces/wallet.h
@@ -223,7 +223,7 @@ class Wallet
     virtual bool isMineAddress(const std::string &strAddress) = 0;
 
     //! Try get available coins addresses
-    virtual bool tryGetAvailableAddresses(std::vector<std::string> &spendableAddresses, std::vector<std::string> &allAddresses) = 0;
+    virtual bool tryGetAvailableAddresses(std::vector<std::string> &spendableAddresses, std::vector<std::string> &allAddresses, bool &includeZeroValue) = 0;
 
     //! Return AvailableCoins + LockedCoins grouped by wallet address.
     //! (put change in one group with wallet address)
diff --git a/src/qt/addressfield.cpp b/src/qt/addressfield.cpp
index b66042161..078d9201e 100644
--- a/src/qt/addressfield.cpp
+++ b/src/qt/addressfield.cpp
@@ -22,7 +22,8 @@ AddressField::AddressField(QWidget *parent) :
     m_addressColumn(0),
     m_typeRole(Qt::UserRole),
     m_senderAddress(false),
-    m_includeZeroValue(true)
+    m_includeZeroValue(false),
+    m_isSetIncludeZeroValue(false)
 
 {
     // Set editable state
@@ -155,21 +156,28 @@ void AddressField::setWalletModel(WalletModel *walletModel)
 {
     m_walletModel = walletModel;
 
-    connect(m_walletModel, SIGNAL(availableAddressesChanged(QStringList,QStringList)), this, SLOT(on_availableAddressesChanged(QStringList,QStringList)));
+    connect(m_walletModel, SIGNAL(availableAddressesChanged(QStringList,QStringList,bool)), this, SLOT(on_availableAddressesChanged(QStringList,QStringList,bool)));
 }
 
-void AddressField::on_availableAddressesChanged(QStringList spendableAddresses, QStringList allAddresses)
+void AddressField::on_availableAddressesChanged(QStringList spendableAddresses, QStringList allAddresses, bool includeZeroValue)
 {
     // The addresses are checked that are mine in the model
     m_spendableAddresses = spendableAddresses;
     m_allAddresses = allAddresses;
 
+    // Use the slot value as default in case the Include Zero Value is not set in the component
+    if(!m_isSetIncludeZeroValue)
+    {
+        m_includeZeroValue = includeZeroValue;
+    }
+
     on_refresh();
 }
 
 void AddressField::setIncludeZeroValue(bool includeZeroValue)
 {
     m_includeZeroValue = includeZeroValue;
+    m_isSetIncludeZeroValue = true;
 
     on_refresh();
 }
diff --git a/src/qt/addressfield.h b/src/qt/addressfield.h
index c6c550de1..73a0b893f 100644
--- a/src/qt/addressfield.h
+++ b/src/qt/addressfield.h
@@ -95,7 +95,7 @@ public Q_SLOTS:
     /**
      * @brief on_availableAddressesChanged Available addresses changed
      */
-    void on_availableAddressesChanged(QStringList spendableAddresses, QStringList allAddresses);
+    void on_availableAddressesChanged(QStringList spendableAddresses, QStringList allAddresses, bool includeZeroValue);
 
 private:
     void appendAddress(const QString& strAddress);
@@ -112,6 +112,7 @@ public Q_SLOTS:
     QStringList m_spendableAddresses;
     QStringList m_allAddresses;
     bool m_includeZeroValue;
+    bool m_isSetIncludeZeroValue;
 };
 
 #endif // ADDRESSFIELD_H
diff --git a/src/qt/walletmodel.cpp b/src/qt/walletmodel.cpp
index 14f00b871..84e7c20c7 100644
--- a/src/qt/walletmodel.cpp
+++ b/src/qt/walletmodel.cpp
@@ -756,7 +756,8 @@ void WalletModel::checkCoinAddressesChanged()
     // Get the list of coin addresses and emit it to the subscribers
     std::vector<std::string> spendableAddresses;
     std::vector<std::string> allAddresses;
-    if(updateCoinAddresses && m_wallet->tryGetAvailableAddresses(spendableAddresses, allAddresses))
+    bool includeZeroValue = false;
+    if(updateCoinAddresses && m_wallet->tryGetAvailableAddresses(spendableAddresses, allAddresses, includeZeroValue))
     {
         QStringList listSpendableAddresses;
         for(std::string address : spendableAddresses)
@@ -766,7 +767,7 @@ void WalletModel::checkCoinAddressesChanged()
         for(std::string address : allAddresses)
             listAllAddresses.append(QString::fromStdString(address));
 
-        Q_EMIT availableAddressesChanged(listSpendableAddresses, listAllAddresses);
+        Q_EMIT availableAddressesChanged(listSpendableAddresses, listAllAddresses, includeZeroValue);
 
         updateCoinAddresses = false;
     }
diff --git a/src/qt/walletmodel.h b/src/qt/walletmodel.h
index 465ec0023..025ab14d5 100644
--- a/src/qt/walletmodel.h
+++ b/src/qt/walletmodel.h
@@ -301,7 +301,7 @@ class WalletModel : public QObject
     void unload();
 
     // Signal that available coin addresses are changed
-    void availableAddressesChanged(QStringList spendableAddresses, QStringList allAddresses);
+    void availableAddressesChanged(QStringList spendableAddresses, QStringList allAddresses, bool includeZeroValue);
 
 public Q_SLOTS:
     /* Wallet status might have changed */

From 6cdc24bcd7b96391f681d6ba457fc4ce355e37d7 Mon Sep 17 00:00:00 2001
From: Time Markov <time.markov@qtum.com>
Date: Tue, 5 Mar 2019 15:19:23 +0100
Subject: [PATCH 049/153] Return the sender as default refund sender

---
 src/qtum/qtumtransaction.h | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/src/qtum/qtumtransaction.h b/src/qtum/qtumtransaction.h
index 1a48d76e9..67608ff9f 100644
--- a/src/qtum/qtumtransaction.h
+++ b/src/qtum/qtumtransaction.h
@@ -46,13 +46,13 @@ class QtumTransaction : public dev::eth::Transaction{
 
 public:
 
-    QtumTransaction() : nVout(0) {}
+    QtumTransaction() : nVout(0), hasRefundSender(false) {}
 
     QtumTransaction(dev::u256 const& _value, dev::u256 const& _gasPrice, dev::u256 const& _gas, dev::bytes const& _data, dev::u256 const& _nonce = dev::Invalid256):
-		dev::eth::Transaction(_value, _gasPrice, _gas, _data, _nonce) {}
+        dev::eth::Transaction(_value, _gasPrice, _gas, _data, _nonce) , nVout(0), hasRefundSender(false) {}
 
     QtumTransaction(dev::u256 const& _value, dev::u256 const& _gasPrice, dev::u256 const& _gas, dev::Address const& _dest, dev::bytes const& _data, dev::u256 const& _nonce = dev::Invalid256):
-		dev::eth::Transaction(_value, _gasPrice, _gas, _dest, _data, _nonce) {}
+        dev::eth::Transaction(_value, _gasPrice, _gas, _dest, _data, _nonce) , nVout(0), hasRefundSender(false) {}
 
     void setHashWith(const dev::h256 hash) { m_hashWith = hash; }
 
@@ -69,14 +69,15 @@ class QtumTransaction : public dev::eth::Transaction{
         return version;
     }
 
-    void setRefundSender(const dev::Address _refundSender) { refundSender = _refundSender; }
+    void setRefundSender(const dev::Address _refundSender) { refundSender = _refundSender; hasRefundSender = true;}
 
-    dev::Address getRefundSender() const { return refundSender; }
+    dev::Address getRefundSender() const { return hasRefundSender ? refundSender : sender();}
 
 private:
 
     uint32_t nVout;
     VersionVM version;
     dev::Address refundSender;
+    bool hasRefundSender;
 };
 #endif

From df4fda5e6763b3e234b9c104912d7b1017bb0e8b Mon Sep 17 00:00:00 2001
From: Time Markov <time.markov@qtum.com>
Date: Tue, 5 Mar 2019 16:04:44 +0100
Subject: [PATCH 050/153] Set opsender valid code in unit tests

---
 src/test/data/script_tests.json | 1 -
 1 file changed, 1 deletion(-)

diff --git a/src/test/data/script_tests.json b/src/test/data/script_tests.json
index 670b769f4..817527fc6 100755
--- a/src/test/data/script_tests.json
+++ b/src/test/data/script_tests.json
@@ -895,7 +895,6 @@
 ["1", "IF 0xbe ELSE 1 ENDIF", "P2SH,STRICTENC", "BAD_OPCODE"],
 ["1", "IF 0xbf ELSE 1 ENDIF", "P2SH,STRICTENC", "BAD_OPCODE"],
 ["1", "IF 0xc0 ELSE 1 ENDIF", "P2SH,STRICTENC", "BAD_OPCODE"],
-["1", "IF 0xc4 ELSE 1 ENDIF", "P2SH,STRICTENC", "BAD_OPCODE"],
 ["1", "IF 0xc5 ELSE 1 ENDIF", "P2SH,STRICTENC", "BAD_OPCODE"],
 ["1", "IF 0xc6 ELSE 1 ENDIF", "P2SH,STRICTENC", "BAD_OPCODE"],
 ["1", "IF 0xc7 ELSE 1 ENDIF", "P2SH,STRICTENC", "BAD_OPCODE"],

From ac79caf9e7acae9094357b0f081cd78803187d4b Mon Sep 17 00:00:00 2001
From: Time Markov <time.markov@qtum.com>
Date: Thu, 7 Mar 2019 11:27:10 +0100
Subject: [PATCH 051/153] Change method name to correctedStackSize

---
 src/validation.cpp | 10 +++++-----
 src/validation.h   |  2 +-
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/src/validation.cpp b/src/validation.cpp
index 535bf9feb..77f7219ba 100644
--- a/src/validation.cpp
+++ b/src/validation.cpp
@@ -2460,7 +2460,7 @@ bool QtumTxConverter::receiveStack(const CScript& scriptPubKey){
     sender = scriptPubKey.HasOpSender();
 
     opcode = (opcodetype)(*scriptRest.begin());
-    if((opcode == OP_CREATE && stack.size() < stackSize(4)) || (opcode == OP_CALL && stack.size() < stackSize(5))){
+    if((opcode == OP_CREATE && stack.size() < correctedStackSize(4)) || (opcode == OP_CALL && stack.size() < correctedStackSize(5))){
         stack.clear();
         sender = false;
         return false;
@@ -2479,10 +2479,10 @@ bool QtumTxConverter::parseEthTXParams(EthTransactionParams& params){
             stack.pop_back();
             receiveAddress = dev::Address(vecAddr);
         }
-        if(stack.size() < stackSize(4))
+        if(stack.size() < correctedStackSize(4))
             return false;
 
-        if(stack.back().size() < stackSize(1)){
+        if(stack.back().size() < correctedStackSize(1)){
             return false;
         }
         valtype code(stack.back());
@@ -2499,7 +2499,7 @@ bool QtumTxConverter::parseEthTXParams(EthTransactionParams& params){
             //overflows past 64bits, reject this tx
             return false;
         }
-        if(stack.back().size() > stackSize(4)){
+        if(stack.back().size() > correctedStackSize(4)){
             return false;
         }
         VersionVM version = VersionVM::fromRaw((uint32_t)CScriptNum::vch_to_uint64(stack.back()));
@@ -2535,7 +2535,7 @@ QtumTransaction QtumTxConverter::createEthTX(const EthTransactionParams& etp, ui
     return txEth;
 }
 
-size_t QtumTxConverter::stackSize(size_t size){
+size_t QtumTxConverter::correctedStackSize(size_t size){
     // OP_SENDER add 3 more parameters in stack besides those for OP_CREATE or OP_CALL
     return sender ? size + 3 : size;
 }
diff --git a/src/validation.h b/src/validation.h
index 9ce88c6d7..df284e9c4 100644
--- a/src/validation.h
+++ b/src/validation.h
@@ -681,7 +681,7 @@ class QtumTxConverter{
 
     QtumTransaction createEthTX(const EthTransactionParams& etp, const uint32_t nOut);
 
-    size_t stackSize(size_t size);
+    size_t correctedStackSize(size_t size);
 
     const CTransaction txBit;
     const CCoinsViewCache* view;

From 403709f4051d2809e4efdf745f5315663f119376 Mon Sep 17 00:00:00 2001
From: Time Markov <time.markov@qtum.com>
Date: Thu, 7 Mar 2019 12:36:45 +0100
Subject: [PATCH 052/153] Add address type enum

---
 src/script/standard.cpp  | 4 ++--
 src/script/standard.h    | 9 +++++++++
 src/wallet/rpcwallet.cpp | 4 ++--
 3 files changed, 13 insertions(+), 4 deletions(-)

diff --git a/src/script/standard.cpp b/src/script/standard.cpp
index 63be0311f..2970e204e 100644
--- a/src/script/standard.cpp
+++ b/src/script/standard.cpp
@@ -278,7 +278,7 @@ bool Solver(const CScript& scriptPubKey, txnouttype& typeRet, std::vector<std::v
             {
                 try {
                     uint64_t val = CScriptNum::vch_to_uint64(vch1);
-                    if(val < 1 && val > 5)
+                    if(val < addresstype::PUBKEYHASH || val > addresstype::NONSTANDARD)
                         break;
 
                     addressType = val;
@@ -291,7 +291,7 @@ bool Solver(const CScript& scriptPubKey, txnouttype& typeRet, std::vector<std::v
             {
                 // Get the destination
                 CTxDestination dest;
-                if(addressType == 1 && vch1.size() == sizeof(CKeyID))
+                if(addressType == addresstype::PUBKEYHASH && vch1.size() == sizeof(CKeyID))
                 {
                     dest = CKeyID(uint160(vch1));
                 }
diff --git a/src/script/standard.h b/src/script/standard.h
index 120d6127c..77a060a9b 100644
--- a/src/script/standard.h
+++ b/src/script/standard.h
@@ -133,6 +133,15 @@ struct WitnessUnknown
  */
 typedef boost::variant<CNoDestination, CKeyID, CScriptID, WitnessV0ScriptHash, WitnessV0KeyHash, WitnessUnknown> CTxDestination;
 
+enum addresstype
+{
+    PUBKEYHASH = 1,
+    SCRIPTHASH = 2,
+    WITNESSSCRIPTHASH = 3,
+    WITNESSPUBKEYHASH = 4,
+    NONSTANDARD = 5
+};
+
 /** Check whether a CTxDestination is a CNoDestination. */
 bool IsValidDestination(const CTxDestination& dest);
 
diff --git a/src/wallet/rpcwallet.cpp b/src/wallet/rpcwallet.cpp
index a2c8df09f..2c8114849 100755
--- a/src/wallet/rpcwallet.cpp
+++ b/src/wallet/rpcwallet.cpp
@@ -842,7 +842,7 @@ static UniValue createcontract(const JSONRPCRequest& request){
             throw JSONRPCError(RPC_WALLET_ERROR, "Private key not available");
         }
         std::vector<unsigned char> scriptSig;
-        scriptPubKey = (CScript() << CScriptNum(1) << ToByteVector(key_id) << ToByteVector(scriptSig) << OP_SENDER) + scriptPubKey;
+        scriptPubKey = (CScript() << CScriptNum(addresstype::PUBKEYHASH) << ToByteVector(key_id) << ToByteVector(scriptSig) << OP_SENDER) + scriptPubKey;
     }
 
     // Create and send the transaction
@@ -1082,7 +1082,7 @@ static UniValue sendtocontract(const JSONRPCRequest& request){
             throw JSONRPCError(RPC_WALLET_ERROR, "Private key not available");
         }
         std::vector<unsigned char> scriptSig;
-        scriptPubKey = (CScript() << CScriptNum(1) << ToByteVector(key_id) << ToByteVector(scriptSig) << OP_SENDER) + scriptPubKey;
+        scriptPubKey = (CScript() << CScriptNum(addresstype::PUBKEYHASH) << ToByteVector(key_id) << ToByteVector(scriptSig) << OP_SENDER) + scriptPubKey;
     }
 
     // Create and send the transaction

From 0ba0a3e4b90d9221729ef911813270607abd7661 Mon Sep 17 00:00:00 2001
From: Time Markov <time.markov@qtum.com>
Date: Thu, 7 Mar 2019 16:50:37 +0100
Subject: [PATCH 053/153] Add additional opsender checks

---
 src/consensus/tx_verify.cpp |  2 +-
 src/validation.cpp          | 15 ++++++++++-----
 2 files changed, 11 insertions(+), 6 deletions(-)

diff --git a/src/consensus/tx_verify.cpp b/src/consensus/tx_verify.cpp
index c528a0c83..5ffa19cf3 100644
--- a/src/consensus/tx_verify.cpp
+++ b/src/consensus/tx_verify.cpp
@@ -184,7 +184,7 @@ bool CheckTransaction(const CTransaction& tx, CValidationState &state, bool fChe
             return state.DoS(100, false, REJECT_INVALID, "bad-txns-txouttotal-toolarge");
 
         /////////////////////////////////////////////////////////// // qtuma
-        if (txout.scriptPubKey.HasOpCall() || txout.scriptPubKey.HasOpCreate()) {
+        if (txout.scriptPubKey.HasOpCall() || txout.scriptPubKey.HasOpCreate() || txout.scriptPubKey.HasOpSender()) {
             std::vector<valtype> vSolutions;
             txnouttype whichType;
             if (!Solver(txout.scriptPubKey, whichType, vSolutions, true)) {
diff --git a/src/validation.cpp b/src/validation.cpp
index 77f7219ba..e15ebb3bf 100644
--- a/src/validation.cpp
+++ b/src/validation.cpp
@@ -2037,12 +2037,17 @@ bool CheckOpSender(const CTransaction& tx, const CChainParams& chainparams, int
     // Check that the sender address inside the output is only valid for contract outputs
     for (const CTxOut& txout : tx.vout)
     {
-        if(txout.scriptPubKey.HasOpSender() &&
+        bool hashOpSender = txout.scriptPubKey.HasOpSender();
+        if(hashOpSender &&
                 !(txout.scriptPubKey.HasOpCreate() ||
                   txout.scriptPubKey.HasOpCall()))
         {
             return false;
         }
+
+        // Solve the script that match the sender templates
+        if(hashOpSender && !ExtractSenderData(txout.scriptPubKey, nullptr, nullptr))
+            return false;
     }
 
     return true;
@@ -4314,8 +4319,8 @@ bool CheckBlock(const CBlock& block, CValidationState& state, const Consensus::P
             return state.DoS(100, false, REJECT_INVALID, "bad-cb-multiple", false, "more than one coinbase");
 
     //Don't allow contract opcodes in coinbase
-    if(block.vtx[0]->HasOpSpend() || block.vtx[0]->HasCreateOrCall()){
-        return state.DoS(100, false, REJECT_INVALID, "bad-cb-contract", false, "coinbase must not contain OP_SPEND, OP_CALL, or OP_CREATE");
+    if(block.vtx[0]->HasOpSpend() || block.vtx[0]->HasCreateOrCall() || block.vtx[0]->HasOpSender()){
+        return state.DoS(100, false, REJECT_INVALID, "bad-cb-contract", false, "coinbase must not contain OP_SPEND, OP_CALL, OP_CREATE or OP_SENDER");
     }
 
     // Second transaction must be coinbase in case of PoS block, the rest must not be
@@ -4340,8 +4345,8 @@ bool CheckBlock(const CBlock& block, CValidationState& state, const Consensus::P
 
         //Don't allow contract opcodes in coinstake
         //We might allow this later, but it hasn't been tested enough to determine if safe
-        if(block.vtx[1]->HasOpSpend() || block.vtx[1]->HasCreateOrCall()){
-            return state.DoS(100, false, REJECT_INVALID, "bad-cs-contract", false, "coinstake must not contain OP_SPEND, OP_CALL, or OP_CREATE");
+        if(block.vtx[1]->HasOpSpend() || block.vtx[1]->HasCreateOrCall() || block.vtx[1]->HasOpSender()){
+            return state.DoS(100, false, REJECT_INVALID, "bad-cs-contract", false, "coinstake must not contain OP_SPEND, OP_CALL, OP_CREATE or OP_SENDER");
         }
     }
 

From 05f8bd71a94b19688d6400d2570b9779def0c34e Mon Sep 17 00:00:00 2001
From: Time Markov <time.markov@qtum.com>
Date: Wed, 13 Mar 2019 11:50:48 +0100
Subject: [PATCH 054/153] Fix check for the code size

---
 src/validation.cpp | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/validation.cpp b/src/validation.cpp
index e15ebb3bf..02ca2deca 100644
--- a/src/validation.cpp
+++ b/src/validation.cpp
@@ -2487,7 +2487,7 @@ bool QtumTxConverter::parseEthTXParams(EthTransactionParams& params){
         if(stack.size() < correctedStackSize(4))
             return false;
 
-        if(stack.back().size() < correctedStackSize(1)){
+        if(stack.back().size() < 1){
             return false;
         }
         valtype code(stack.back());
@@ -2504,7 +2504,7 @@ bool QtumTxConverter::parseEthTXParams(EthTransactionParams& params){
             //overflows past 64bits, reject this tx
             return false;
         }
-        if(stack.back().size() > correctedStackSize(4)){
+        if(stack.back().size() > 4){
             return false;
         }
         VersionVM version = VersionVM::fromRaw((uint32_t)CScriptNum::vch_to_uint64(stack.back()));

From ada2c6ee7ac3f7973620c5c91a1feb0b3dc1c7f7 Mon Sep 17 00:00:00 2001
From: Time Markov <time.markov@qtum.com>
Date: Wed, 13 Mar 2019 12:54:29 +0100
Subject: [PATCH 055/153] Include the first VIN for AnyoneCanPay when computing
 the signature hash of the output

---
 src/script/interpreter.cpp | 24 +++++++++++++++++++++++-
 1 file changed, 23 insertions(+), 1 deletion(-)

diff --git a/src/script/interpreter.cpp b/src/script/interpreter.cpp
index 49dcb04ef..c4b02e236 100644
--- a/src/script/interpreter.cpp
+++ b/src/script/interpreter.cpp
@@ -1227,6 +1227,22 @@ uint256 GetSequenceHash(const T& txTo)
     return ss.GetHash();
 }
 
+template <class T>
+uint256 GetFirstPrevoutHash(const T& txTo)
+{
+    CHashWriter ss(SER_GETHASH, 0);
+    ss << txTo.vin[0].prevout;
+    return ss.GetHash();
+}
+
+template <class T>
+uint256 GetFirstSequenceHash(const T& txTo)
+{
+    CHashWriter ss(SER_GETHASH, 0);
+    ss << txTo.vin[0].nSequence;
+    return ss.GetHash();
+}
+
 template <class T>
 uint256 GetOutputsHash(const T& txTo)
 {
@@ -1291,6 +1307,12 @@ uint256 SignatureHashOutput(const CScript& scriptCode, const T& txTo, unsigned i
     uint256 hashOutputs;
     const bool cacheready = cache && cache->ready;
 
+    if (nHashType & SIGHASH_ANYONECANPAY) {
+        assert(0 < txTo.vin.size());
+        hashPrevouts = GetFirstPrevoutHash(txTo);
+        hashSequence = GetFirstSequenceHash(txTo);
+    }
+
     if (!(nHashType & SIGHASH_ANYONECANPAY)) {
         hashPrevouts = cacheready ? cache->hashPrevouts : GetPrevoutHash(txTo);
     }
@@ -1312,7 +1334,7 @@ uint256 SignatureHashOutput(const CScript& scriptCode, const T& txTo, unsigned i
 
     // Version
     ss << txTo.nVersion;
-    // Input prevouts/nSequence (none/all, depending on flags)
+    // Input prevouts/nSequence (none/first/all, depending on flags)
     ss << hashPrevouts;
     ss << hashSequence;
     // The output being signed

From 697c766e665bc492961ed314723d4e93bb803366 Mon Sep 17 00:00:00 2001
From: Time Markov <time.markov@qtum.com>
Date: Mon, 18 Mar 2019 16:18:02 +0100
Subject: [PATCH 056/153] Added op_sender check in EvalScript

---
 src/miner.cpp              |  3 ++-
 src/script/interpreter.cpp |  6 +++++-
 src/script/interpreter.h   |  4 ++++
 src/validation.cpp         | 23 ++++++++++++++++++++---
 src/validation.h           |  5 ++++-
 5 files changed, 35 insertions(+), 6 deletions(-)

diff --git a/src/miner.cpp b/src/miner.cpp
index e8878d842..84095e7aa 100644
--- a/src/miner.cpp
+++ b/src/miner.cpp
@@ -442,7 +442,8 @@ bool BlockAssembler::AttemptToAddContractToBlock(CTxMemPool::txiter iter, uint64
     uint64_t nBlockWeight = this->nBlockWeight;
     uint64_t nBlockSigOpsCost = this->nBlockSigOpsCost;
 
-    QtumTxConverter convert(iter->GetTx(), NULL, &pblock->vtx);
+    unsigned int contractflags = GetContractScriptFlags(nHeight, chainparams.GetConsensus());
+    QtumTxConverter convert(iter->GetTx(), NULL, &pblock->vtx, contractflags);
 
     ExtractQtumTX resultConverter;
     if(!convert.extractionQtumTransactions(resultConverter)){
diff --git a/src/script/interpreter.cpp b/src/script/interpreter.cpp
index c4b02e236..b9c6c9d34 100644
--- a/src/script/interpreter.cpp
+++ b/src/script/interpreter.cpp
@@ -1072,7 +1072,11 @@ bool EvalScript(std::vector<std::vector<unsigned char> >& stack, const CScript&
 
                 //////////////////////////////////////////////////////// qtum
                 case OP_SENDER:
-                    break;
+                {
+                    if(!(flags & SCRIPT_OUTPUT_SENDER))
+                        return set_error(serror, SCRIPT_ERR_BAD_OPCODE);
+                }
+                break;
                 case OP_SPEND:
                 {
                     return true; // temp
diff --git a/src/script/interpreter.h b/src/script/interpreter.h
index ba429f929..f2c51a905 100644
--- a/src/script/interpreter.h
+++ b/src/script/interpreter.h
@@ -118,6 +118,10 @@ enum
     //
     SCRIPT_VERIFY_CONST_SCRIPTCODE = (1U << 16),
 
+    // Support sender address in contract output
+    //
+    SCRIPT_OUTPUT_SENDER = (1U << 29),
+
     // Performs the compiled byte code
     //
     SCRIPT_EXEC_BYTE_CODE = (1U << 30),
diff --git a/src/validation.cpp b/src/validation.cpp
index 02ca2deca..831b7df82 100644
--- a/src/validation.cpp
+++ b/src/validation.cpp
@@ -759,7 +759,8 @@ static bool AcceptToMemoryPoolWorker(const CChainParams& chainparams, CTxMemPool
             size_t count = 0;
             for(const CTxOut& o : tx.vout)
                 count += o.scriptPubKey.HasOpCreate() || o.scriptPubKey.HasOpCall() ? 1 : 0;
-            QtumTxConverter converter(tx, NULL);
+            unsigned int contractflags = GetContractScriptFlags(GetSpendHeight(view), chainparams.GetConsensus());
+            QtumTxConverter converter(tx, NULL, NULL, contractflags);
             ExtractQtumTX resultConverter;
             if(!converter.extractionQtumTransactions(resultConverter)){
                 return state.DoS(100, error("AcceptToMempool(): Contract transaction of the wrong format"), REJECT_INVALID, "bad-tx-bad-contract-format");
@@ -2012,9 +2013,24 @@ static unsigned int GetBlockScriptFlags(const CBlockIndex* pindex, const Consens
         flags |= SCRIPT_VERIFY_NULLDUMMY;
     }
 
+    // Start support sender address in contract output
+    if (pindex->nHeight >= consensusparams.QIP5Height) {
+        flags |= SCRIPT_OUTPUT_SENDER;
+    }
+
     return flags;
 }
 
+unsigned int GetContractScriptFlags(int nHeight, const Consensus::Params& consensusparams) {
+    unsigned int flags = SCRIPT_EXEC_BYTE_CODE;
+
+    // Start support sender address in contract output
+    if (nHeight >= consensusparams.QIP5Height) {
+        flags |= SCRIPT_OUTPUT_SENDER;
+    }
+
+    return flags;
+}
 
 
 static int64_t nTimeCheck = 0;
@@ -2456,7 +2472,7 @@ bool QtumTxConverter::extractionQtumTransactions(ExtractQtumTX& qtumtx){
 
 bool QtumTxConverter::receiveStack(const CScript& scriptPubKey){
     sender = false;
-    EvalScript(stack, scriptPubKey, SCRIPT_EXEC_BYTE_CODE, BaseSignatureChecker(), SigVersion::BASE, nullptr);
+    EvalScript(stack, scriptPubKey, nFlags, BaseSignatureChecker(), SigVersion::BASE, nullptr);
     if (stack.empty())
         return false;
 
@@ -2747,6 +2763,7 @@ bool CChainState::ConnectBlock(const CBlock& block, CValidationState& state, CBl
 
     // Get the script flags for this block
     unsigned int flags = GetBlockScriptFlags(pindex, chainparams.GetConsensus());
+    unsigned int contractflags = GetContractScriptFlags(pindex->nHeight, chainparams.GetConsensus());
 
     int64_t nTime2 = GetTimeMicros(); nTimeForks += nTime2 - nTime1;
     LogPrint(BCLog::BENCH, "    - Fork checks: %.2fms [%.2fs (%.2fms/blk)]\n", MILLI * (nTime2 - nTime1), nTimeForks * MICRO, nTimeForks * MILLI / nBlocksTotal);
@@ -2865,7 +2882,7 @@ bool CChainState::ConnectBlock(const CBlock& block, CValidationState& state, CBl
                 return state.DoS(100, false, REJECT_INVALID, "bad-txns-invalid-sender-script");
             }
 
-            QtumTxConverter convert(tx, &view, &block.vtx);
+            QtumTxConverter convert(tx, &view, &block.vtx, contractflags);
 
             ExtractQtumTX resultConvertQtumTX;
             if(!convert.extractionQtumTransactions(resultConvertQtumTX)){
diff --git a/src/validation.h b/src/validation.h
index df284e9c4..e22d46840 100644
--- a/src/validation.h
+++ b/src/validation.h
@@ -627,6 +627,8 @@ inline bool IsBlockPruned(const CBlockIndex* pblockindex)
 bool CheckReward(const CBlock& block, CValidationState& state, int nHeight, const Consensus::Params& consensusParams, CAmount nFees, CAmount gasRefunds, CAmount nActualStakeReward, const std::vector<CTxOut>& vouts);
 
 //////////////////////////////////////////////////////// qtum
+unsigned int GetContractScriptFlags(int nHeight, const Consensus::Params& consensusparams);
+
 std::vector<ResultExecute> CallContract(const dev::Address& addrContract, std::vector<unsigned char> opcode, const dev::Address& sender = dev::Address(), uint64_t gasLimit=0);
 
 bool CheckOpSender(const CTransaction& tx, const CChainParams& chainparams, int nHeight);
@@ -669,7 +671,7 @@ class QtumTxConverter{
 
 public:
 
-    QtumTxConverter(CTransaction tx, CCoinsViewCache* v = NULL, const std::vector<CTransactionRef>* blockTxs = NULL) : txBit(tx), view(v), blockTransactions(blockTxs), sender(false){}
+    QtumTxConverter(CTransaction tx, CCoinsViewCache* v = NULL, const std::vector<CTransactionRef>* blockTxs = NULL, unsigned int flags = SCRIPT_EXEC_BYTE_CODE) : txBit(tx), view(v), blockTransactions(blockTxs), sender(false), nFlags(flags){}
 
     bool extractionQtumTransactions(ExtractQtumTX& qtumTx);
 
@@ -690,6 +692,7 @@ class QtumTxConverter{
     const std::vector<CTransactionRef> *blockTransactions;
     bool sender;
     dev::Address refundSender;
+    unsigned int nFlags;
 };
 
 class ByteCodeExec {

From 979a914e9d726d879549433ceaa7033c8d6b42c5 Mon Sep 17 00:00:00 2001
From: djaen <david.jaenson@qtum.org>
Date: Tue, 19 Mar 2019 08:56:27 +0100
Subject: [PATCH 057/153] Added tests for OP_SENDER

---
 test/functional/qtum_op_sender.py         | 479 ++++++++++++++++++++++
 test/functional/test_framework/address.py |   4 +-
 test/functional/test_framework/script.py  |   2 +
 test/functional/test_runner.py            |   1 +
 4 files changed, 484 insertions(+), 2 deletions(-)
 create mode 100755 test/functional/qtum_op_sender.py

diff --git a/test/functional/qtum_op_sender.py b/test/functional/qtum_op_sender.py
new file mode 100755
index 000000000..59cca07c6
--- /dev/null
+++ b/test/functional/qtum_op_sender.py
@@ -0,0 +1,479 @@
+#!/usr/bin/env python3
+
+from test_framework.test_framework import BitcoinTestFramework
+from test_framework.util import *
+from test_framework.script import *
+from test_framework.mininode import *
+from test_framework.qtum import *
+from test_framework.address import *
+from test_framework.blocktools import *
+
+
+# If this is an OP_SENDER output, make sure that the signature is an empty byte vector
+def GetOutputWithoutSenderSig(output):
+    op_sender_index = -1
+    for i, opcode in enumerate(CScript(output.scriptPubKey)):
+        if opcode == OP_SENDER:
+            op_sender_index = i
+    if i > 0:
+        operations = []
+        for i, opcode in enumerate(CScript(output.scriptPubKey)):
+            if i == op_sender_index - 1:
+                operations.append(b'')
+            else:
+                operations.append(opcode)
+        return CTxOut(output.nValue, CScript(operations))
+    else:
+        return CTxOut(output.nValue, output.scriptPubKey)
+
+"""
+    The signature construct is similar to the SegwitSignatureHash construct with the exception
+    of using the target output in place of the target input and a change in the data of SIGHASH_ANYONECANPAY.
+"""
+def SignatureHashOutput(scriptCode, txTo, nOut, hashtype, amount):
+    hashPrevouts = 0
+    hashSequence = 0
+    hashOutputs = 0
+
+    if not (hashtype & SIGHASH_ANYONECANPAY):
+        serialize_prevouts = bytes()
+        for i in txTo.vin:
+            serialize_prevouts += i.prevout.serialize()
+        hashPrevouts = uint256_from_str(hash256(serialize_prevouts))
+    else:
+        hashPrevouts = uint256_from_str(hash256(txTo.vin[0].prevout.serialize()))
+        hashSequence = uint256_from_str(hash256(struct.pack("<I", txTo.vin[0].nSequence)))
+
+    if (not (hashtype & SIGHASH_ANYONECANPAY) and (hashtype & 0x1f) != SIGHASH_SINGLE and (hashtype & 0x1f) != SIGHASH_NONE):
+        serialize_sequence = bytes()
+        for i in txTo.vin:
+            serialize_sequence += struct.pack("<I", i.nSequence)
+        hashSequence = uint256_from_str(hash256(serialize_sequence))
+
+    if ((hashtype & 0x1f) != SIGHASH_SINGLE and (hashtype & 0x1f) != SIGHASH_NONE):
+        serialize_outputs = bytes()
+        for o in txTo.vout:
+            serialize_outputs += GetOutputWithoutSenderSig(o).serialize()
+        hashOutputs = uint256_from_str(hash256(serialize_outputs))
+    elif ((hashtype & 0x1f) == SIGHASH_SINGLE and nOut < len(txTo.vout)):
+        # Isn't this just repeating the part of the signature done below?
+        serialize_outputs = GetOutputWithoutSenderSig(txTo.vout[nOut]).serialize()
+        hashOutputs = uint256_from_str(hash256(serialize_outputs))
+
+    ss = bytes()
+    ss += struct.pack("<i", txTo.nVersion)
+    ss += ser_uint256(hashPrevouts)
+    ss += ser_uint256(hashSequence)
+    ss += GetOutputWithoutSenderSig(txTo.vout[nOut]).serialize()
+    ss += ser_string(scriptCode)
+    ss += struct.pack("<q", amount)
+    ss += ser_uint256(hashOutputs)
+    ss += struct.pack("<i", txTo.nLockTime)
+    ss += struct.pack("<I", hashtype)
+
+    return hash256(ss)
+
+def sign_op_spend_outputs(tx, keys, hashtypes):
+    key_index = 0
+    for i in range(len(tx.vout)):
+        outputOperations = [op for op in CScript(tx.vout[i].scriptPubKey)]
+        if any(op == OP_SENDER for op in outputOperations):
+            inputScriptCode = [OP_DUP, OP_HASH160, hash160(keys[key_index].get_pubkey()), OP_EQUALVERIFY, OP_CHECKSIG]
+            sighash = SignatureHashOutput(CScript(inputScriptCode), tx, i, hashtypes[i], tx.vout[i].nValue)
+            signature = keys[key_index].sign(sighash)
+            outputOperations[2] = ser_string(CScript([signature + struct.pack('B', hashtypes[i]), keys[key_index].get_pubkey()]))
+            tx.vout[key_index].scriptPubKey = CScript(outputOperations)
+            key_index += 1
+    return tx
+
+
+# assume SIGHASH_ALL
+def sign_transaction_sighash_all(tx, key):
+    pre_input_sigs = []
+    post_input_sigs = []
+    for inpt in tx.vin:
+        pre_input_sigs.append(CScript([key.get_pubkey(), OP_CHECKSIG]))
+
+    for i in range(len(tx.vin)):
+        for j in range(len(tx.vin)):
+            if j != i:
+                tx.vin[j].scriptSig = CScript([])
+            else:
+                tx.vin[j].scriptSig = pre_input_sigs[j]
+
+        sigdata = tx.serialize() + b'\x01\x00\x00\x00'
+        sighash = hash256(sigdata)
+        sigtx = key.sign(sighash, low_s=True)
+        post_input_sigs.append(CScript([sigtx + b'\x01']))
+
+    for i in range(len(tx.vin)):
+        tx.vin[i].scriptSig = post_input_sigs[i]
+
+    return tx
+
+def wif_to_ceckey(wif):
+    _, privkey, _ = base58_to_byte(wif, 38)
+    bytes_privkey = hex_str_to_bytes(str(privkey)[2:-1])
+    key = CECKey()
+    # Assume always compressed, ignore last byte which specifies compression
+    key.set_compressed(True)
+    key.set_secretbytes(bytes_privkey[:-1])
+    return key
+
+HASHTYPES = [SIGHASH_ALL, SIGHASH_SINGLE, SIGHASH_NONE, SIGHASH_ANYONECANPAY]
+
+class QtumOpSenderTest(BitcoinTestFramework):
+    def set_test_params(self):
+        self.setup_clean_chain = True
+        self.num_nodes = 2
+        self.extra_args = [[], []]
+
+    def create_op_sender_tx(self, keys, outputs, hashtypes, gasCost, publish=True):
+        unspent = self.unspents.pop()
+        amount = sum(output.nValue for output in outputs)
+        change = int(unspent['amount'])*COIN - gasCost - amount
+        wif = self.nodes[0].dumpprivkey(unspent['address'])
+        vin_key = wif_to_ceckey(wif)
+        tx = CTransaction()
+        prevout = COutPoint(int(unspent['txid'], 16), unspent['vout'])
+        tx.vin = [CTxIn(prevout, scriptSig=CScript([vin_key.get_pubkey(), OP_CHECKSIG]))]
+        tx.vout = outputs[:]
+        tx.vout.append(CTxOut(change, scriptPubKey=CScript([OP_TRUE])))
+        # Sign the outputs
+        tx = sign_op_spend_outputs(tx, keys, hashtypes)
+        # Sign the inputs
+        tx = sign_transaction_sighash_all(tx, vin_key)
+        if publish:
+            txid = self.nodes[0].sendrawtransaction(bytes_to_hex_str(tx.serialize()))
+            self.nodes[0].getrawtransaction(txid)
+            self.sync_all()
+            self.nodes[1].getrawtransaction(txid)
+        unspent['key'] = vin_key
+        return tx, unspent
+        
+    def single_op_sender_op_create_tx_test(self):
+        num_contracts = len(self.nodes[0].listcontracts().keys())
+        bytecode = '60606040523415600b57fe5b5b60398060196000396000f30060606040525b600b5b5b565b0000a165627a7a72305820e3bed070fd3a81dd00e02efd22d18a3b47b70860155d6063e47e1e2674fc5acb0029'
+        key = CECKey()
+        key.set_secretbytes(b'\x00')
+        output = CTxOut(0, CScript([CScriptNum(1), hash160(key.get_pubkey()), b'', OP_SENDER, b'\x04', CScriptNum(1000000), CScriptNum(40), hex_str_to_bytes(bytecode), OP_CREATE]))
+
+        for hashtype in HASHTYPES:
+            self.create_op_sender_tx([key], [output], [hashtype], 40000000)
+
+        self.nodes[0].generate(10)
+        self.sync_all()
+        assert_equal(len(self.nodes[0].listcontracts().keys()), num_contracts+len(HASHTYPES))
+        assert_equal(self.nodes[0].listcontracts(), self.nodes[1].listcontracts())
+
+    def single_op_sender_op_call_tx_test(self):
+        contract_address = sorted(self.nodes[0].listcontracts().keys())[-1]
+        key = CECKey()
+        key.set_secretbytes(b'\x01')
+        output = CTxOut(COIN, CScript([CScriptNum(1), hash160(key.get_pubkey()), b'', OP_SENDER, 
+                b'\x04', CScriptNum(1000000), CScriptNum(40), hex_str_to_bytes("00"), hex_str_to_bytes(contract_address), OP_CALL]))
+
+        for hashtype in HASHTYPES:
+            self.create_op_sender_tx([key], [output], [hashtype], 40000000)
+
+        self.nodes[0].generate(10)
+        self.sync_all()
+        assert_equal(self.nodes[0].listcontracts()[contract_address], len(HASHTYPES))
+
+    def all_sigtypes_outputs_in_single_tx_test(self):
+        contract_address = sorted(self.nodes[0].listcontracts().keys())[-1]
+        old_balance = self.nodes[0].listcontracts()[contract_address]
+        outputs = []
+        keys = []
+        for i, hashtype in enumerate(HASHTYPES):
+            key = CECKey()
+            key.set_secretbytes(hex_str_to_bytes(hex(i)[2:].zfill(4)))
+            output = CTxOut(COIN, CScript([CScriptNum(1), hash160(key.get_pubkey()), b'', OP_SENDER, 
+                    b'\x04', CScriptNum(1000000), CScriptNum(40), hex_str_to_bytes("00"), hex_str_to_bytes(contract_address), OP_CALL]))
+            keys.append(key)
+            outputs.append(output)
+
+        self.create_op_sender_tx(keys, outputs, HASHTYPES, len(outputs)*40000000)
+        self.nodes[0].generate(10)
+        assert_equal(self.nodes[0].listcontracts()[contract_address], old_balance+len(outputs))
+
+    """
+        Make sure that signed outputs cannot be reused in different transactions
+    """
+    def replay_sighash_op_sender_output_test(self):
+        contract_address = sorted(self.nodes[0].listcontracts().keys())[-1]
+        old_balance = self.nodes[0].listcontracts()[contract_address]
+        key = CECKey()
+        key.set_secretbytes(b'\x01')
+        for hashtype in HASHTYPES:
+            output = CTxOut(COIN, CScript([CScriptNum(1), hash160(key.get_pubkey()), b'', OP_SENDER, 
+                    b'\x04', CScriptNum(1000000), CScriptNum(40), hex_str_to_bytes("00"), hex_str_to_bytes(contract_address), OP_CALL]))
+            old_tx, input_txout = self.create_op_sender_tx([key], [output], [hashtype], 40000000, publish=True)
+            self.nodes[0].generate(1)
+
+            unspent = self.unspents.pop()
+            amount = COIN
+            change = int(unspent['amount'])*COIN - 40000000 - amount
+            wif = self.nodes[0].dumpprivkey(unspent['address'])
+            vin_key = wif_to_ceckey(wif)
+            tx = CTransaction()
+            prevout = COutPoint(int(unspent['txid'], 16), unspent['vout'])
+            tx.vin = [CTxIn(prevout, scriptSig=CScript([vin_key.get_pubkey(), OP_CHECKSIG]))]
+            tx.vout = [old_tx.vout[0]]
+            tx.vout.append(CTxOut(change, scriptPubKey=CScript([OP_TRUE])))
+            # Sign the inputs
+            tx = sign_transaction_sighash_all(tx, vin_key)
+            assert_raises_rpc_error(-26, 'sender-output-script-verify-failed', self.nodes[0].sendrawtransaction, bytes_to_hex_str(tx.serialize()))
+
+    def mixed_opsender_and_non_op_sender_tx_and_refund_verification_test(self):
+        self.nodes[0].generate(1)
+        assert_equal(self.nodes[0].getrawmempool(), [])
+        old_contracts = self.nodes[0].listcontracts().keys()
+        """
+        pragma solidity ^0.5.2;
+
+        contract Test {
+            address private creator;
+            mapping(address => uint) private balances;
+
+            constructor() public {
+                creator = msg.sender;
+            }
+
+            function getBalance(address key) external view returns (uint) {
+                return balances[key];
+            }
+
+            function () payable external {
+                balances[msg.sender] += msg.value;
+            }
+
+            function getCreator() external view returns (address) {
+                return creator;
+            }
+        }
+        f8b2cb4f: getBalance(address)
+        0ee2cb10: getCreator()
+        """
+        bytecode = "608060405234801561001057600080fd5b50336000806101000a81548173ffffffffffffffffffffffffffffffffffffffff021916908373ffffffffffffffffffffffffffffffffffffffff1602179055506101ef806100606000396000f3fe608060405260043610610046576000357c0100000000000000000000000000000000000000000000000000000000900480630ee2cb1014610095578063f8b2cb4f146100ec575b34600160003373ffffffffffffffffffffffffffffffffffffffff1673ffffffffffffffffffffffffffffffffffffffff16815260200190815260200160002060008282540192505081905550005b3480156100a157600080fd5b506100aa610151565b604051808273ffffffffffffffffffffffffffffffffffffffff1673ffffffffffffffffffffffffffffffffffffffff16815260200191505060405180910390f35b3480156100f857600080fd5b5061013b6004803603602081101561010f57600080fd5b81019080803573ffffffffffffffffffffffffffffffffffffffff16906020019092919050505061017a565b6040518082815260200191505060405180910390f35b60008060009054906101000a900473ffffffffffffffffffffffffffffffffffffffff16905090565b6000600160008373ffffffffffffffffffffffffffffffffffffffff1673ffffffffffffffffffffffffffffffffffffffff16815260200190815260200160002054905091905056fea165627a7a72305820cec11cb4c48d27aed8e6cd757d284387d8a017d594555d9b0d1b6f4d331441ac0029"
+        key = CECKey()
+        key.set_secretbytes(b'\x00')
+        outputs = [
+            CTxOut(0, CScript([CScriptNum(1), hash160(key.get_pubkey()), b'', OP_SENDER, b'\x04', CScriptNum(1000000), CScriptNum(40), hex_str_to_bytes(bytecode), OP_CREATE])),
+            CTxOut(0, CScript([b'\x04', CScriptNum(1000000), CScriptNum(40), hex_str_to_bytes(bytecode), OP_CREATE]))
+        ]
+        tx, input_txout = self.create_op_sender_tx([key], outputs, [SIGHASH_ALL], 2*40000000)
+        block_hash = self.nodes[0].generate(1)[0]
+        new_contracts = list(set(self.nodes[0].listcontracts().keys()) - set(old_contracts))
+        assert_equal(len(new_contracts), 2)
+
+        creators = [
+            hex(int(self.nodes[0].callcontract(new_contracts[0], "0ee2cb10")['executionResult']['output'], 16))[2:].zfill(40),
+            hex(int(self.nodes[0].callcontract(new_contracts[1], "0ee2cb10")['executionResult']['output'], 16))[2:].zfill(40)
+        ]
+
+        expected_creators = [
+            bytes_to_hex_str(hash160(key.get_pubkey())),
+            p2pkh_to_hex_hash(input_txout['address'])
+        ]
+        assert_equal(sorted(creators), sorted(expected_creators))
+
+        # Make sure that gas is refunded to vin0's address
+        coinbase_txid = self.nodes[0].getblock(block_hash)['tx'][0]
+        coinbase_vout = self.nodes[0].getrawtransaction(coinbase_txid, True)['vout']
+        assert_equal(input_txout['address'], coinbase_vout[1]['scriptPubKey']['addresses'][0])
+        assert_equal(input_txout['address'], coinbase_vout[2]['scriptPubKey']['addresses'][0])
+
+        contract_address = new_contracts[0]
+        key = CECKey()
+        key.set_secretbytes(b'\x01')
+        outputs = [
+            CTxOut(COIN, CScript([CScriptNum(1), hash160(key.get_pubkey()), b'', OP_SENDER, b'\x04', CScriptNum(1000000), CScriptNum(40), hex_str_to_bytes("00"), hex_str_to_bytes(contract_address), OP_CALL])),
+            CTxOut(COIN, CScript([b'\x04', CScriptNum(1000000), CScriptNum(40), hex_str_to_bytes("00"), hex_str_to_bytes(contract_address), OP_CALL]))
+        ]
+        tx, input_txout = self.create_op_sender_tx([key], outputs, [SIGHASH_ALL], 2*40000000)
+        self.nodes[0].generate(1)
+        for sender in [bytes_to_hex_str(hash160(key.get_pubkey())), p2pkh_to_hex_hash(input_txout['address'])]:
+            balance = int(self.nodes[0].callcontract(new_contracts[0], "f8b2cb4f"+(sender.zfill(64)))['executionResult']['output'], 16)
+            assert_equal(COIN, balance)
+
+    def large_contract_deployment_tx_test(self):
+        key = CECKey()
+        key.set_secretbytes(b'\x01')
+        output = CTxOut(0, CScript([CScriptNum(1), hash160(key.get_pubkey()), b'', OP_SENDER, b'\x04', CScriptNum(1000000), CScriptNum(50), b'\x00'*100000, OP_CREATE]))
+        tx, input_txout = self.create_op_sender_tx([key], [output], [SIGHASH_ALL], 50*1000000)
+        txid = self.nodes[0].sendrawtransaction(bytes_to_hex_str(tx.serialize()))
+        self.nodes[0].getrawtransaction(txid)
+        self.sync_all()
+        self.nodes[1].getrawtransaction(txid)
+
+    def invalid_op_sender_signature_tx_test(self):
+        contract_address = sorted(self.nodes[0].listcontracts().keys())[-1]
+        key = CECKey()
+        key.set_secretbytes(b'\x01')
+        output = CTxOut(COIN, CScript([CScriptNum(1), hash160(key.get_pubkey()), b'', OP_SENDER, 
+                b'\x04', CScriptNum(1000000), CScriptNum(40), hex_str_to_bytes("00"), OP_CREATE]))
+
+        for hashtype in HASHTYPES:
+            tx, input_txout = self.create_op_sender_tx([key], [output], [hashtype], 40000000, False)
+            ops = [op for op in tx.vout[0].scriptPubKey]
+            signature = ops[2]
+            # Try inverting every byte one by one in the signature, then
+            for i in range(0, len(signature)):
+                inverted_sig_byte = struct.pack('B', ~signature[i] & 0xff) 
+                modified_signature = signature[:i] + inverted_sig_byte + signature[i+1:]
+                ops[2] = modified_signature
+                tx.vout[0].scriptPubKey = CScript(ops)
+                tx = sign_transaction_sighash_all(tx, input_txout['key'])
+                tx.rehash()
+                # if we change either of these bytes, we get messed up data push sizes and trigger another error
+                if i in [0, 1, 74 if len(signature) == 140 else 73]:
+                    assert_raises_rpc_error(-26, 'bad-txns-invalid-sender-script', self.nodes[0].sendrawtransaction, bytes_to_hex_str(tx.serialize()))
+                else:
+                    assert_raises_rpc_error(-26, 'sender-output-script-verify-failed', self.nodes[0].sendrawtransaction, bytes_to_hex_str(tx.serialize()))
+
+                tip = self.nodes[0].getblock(self.nodes[0].getbestblockhash())
+                block = create_block(int(tip['hash'], 16), create_coinbase(tip['height'] + 1), tip['time'])
+                block.vtx.append(tx)
+                block.hashMerkleRoot = block.calc_merkle_root()
+                block.solve()
+                assert(self.nodes[0].submitblock(bytes_to_hex_str(block.serialize())) != None)
+            
+            # Make sure that the unmodified tx can be submitted without error
+            ops[2] = signature
+            tx.vout[0].scriptPubKey = CScript(ops)
+            tx = sign_transaction_sighash_all(tx, input_txout['key'])
+            txid = self.nodes[0].sendrawtransaction(bytes_to_hex_str(tx.serialize()))
+            self.nodes[0].getrawtransaction(txid)
+            self.sync_all()
+            self.nodes[1].getrawtransaction(txid)
+
+
+    def invalid_op_sender_address_tx_test(self):
+        contract_address = sorted(self.nodes[0].listcontracts().keys())[-1]
+        key = CECKey()
+        key.set_secretbytes(b'\x01')
+        output = CTxOut(COIN, CScript([CScriptNum(1), hash160(key.get_pubkey()), b'', OP_SENDER, 
+                b'\x04', CScriptNum(1000000), CScriptNum(40), hex_str_to_bytes("00"), OP_CREATE]))
+
+        for hashtype in HASHTYPES:
+            tx, input_txout = self.create_op_sender_tx([key], [output], [hashtype], 40000000, False)
+            ops = [op for op in tx.vout[0].scriptPubKey]
+            address = ops[1]
+            # Try inverting every byte one by one in the address, then
+            #  - send to mempool
+            #  - submit in a block
+            for i in range(0, len(address)):
+                inverted_address_byte = struct.pack('B', ~address[i] & 0xff) 
+                modified_address = address[:i] + inverted_address_byte + address[i+1:]
+                ops[1] = modified_address
+                tx.vout[0].scriptPubKey = CScript(ops)
+                tx = sign_transaction_sighash_all(tx, input_txout['key'])
+                assert_raises_rpc_error(-26, 'sender-output-script-verify-failed', self.nodes[0].sendrawtransaction, bytes_to_hex_str(tx.serialize()))
+                tip = self.nodes[0].getblock(self.nodes[0].getbestblockhash())
+                block = create_block(int(tip['hash'], 16), create_coinbase(tip['height'] + 1), tip['time'])
+                block.vtx.append(tx)
+                block.hashMerkleRoot = block.calc_merkle_root()
+                block.solve()
+                assert(self.nodes[0].submitblock(bytes_to_hex_str(block.serialize())) != None)
+            
+            # Make sure that the unmodified tx can be submitted without error
+            ops[1] = address
+            tx.vout[0].scriptPubKey = CScript(ops)
+            tx = sign_transaction_sighash_all(tx, input_txout['key'])
+            txid = self.nodes[0].sendrawtransaction(bytes_to_hex_str(tx.serialize()))
+            self.nodes[0].getrawtransaction(txid)
+            self.sync_all()
+            self.nodes[1].getrawtransaction(txid)
+
+
+    def non_standard_op_sender_test(self):
+        unspent = self.unspents.pop()
+        tx = CTransaction()
+        tx.vin = [CTxIn(COutPoint(int(unspent['txid'], 16), unspent['vout']), scriptSig=CScript([]))]
+        tx.vout = [CTxOut(int(unspent['amount'])*COIN-100000, scriptPubKey=CScript([OP_SENDER]))]
+        tx = rpc_sign_transaction(self.nodes[0], tx)
+        assert_raises_rpc_error(-26, 'bad-txns-contract-nonstandard', self.nodes[0].sendrawtransaction, bytes_to_hex_str(tx.serialize()))
+
+
+    def pre_hf_single_op_sender_op_create_tx_rejected_test(self):
+        num_contracts = len(self.nodes[0].listcontracts().keys())
+        bytecode = '60606040523415600b57fe5b5b60398060196000396000f30060606040525b600b5b5b565b0000a165627a7a72305820e3bed070fd3a81dd00e02efd22d18a3b47b70860155d6063e47e1e2674fc5acb0029'
+        key = CECKey()
+        key.set_secretbytes(b'\x00')
+        output = CTxOut(0, CScript([CScriptNum(1), hash160(key.get_pubkey()), b'', OP_SENDER, b'\x04', CScriptNum(1000000), CScriptNum(40), hex_str_to_bytes(bytecode), OP_CREATE]))
+
+        for hashtype in HASHTYPES:
+            tx, _ = self.create_op_sender_tx([key], [output], [hashtype], 40000000, publish=False)
+            assert_raises_rpc_error(-26, 'bad-txns-invalid-sender', self.nodes[0].sendrawtransaction, bytes_to_hex_str(tx.serialize()))
+
+    # Make sure that the OP_SENDER opcode cannot be used in a vin before HF
+    # If it were possible, then the chain would split due to "old" nodes would interpret OP_SENDER as OP_UNKNOWN
+    def pre_hf_op_sender_in_vin_rejected_test(self):
+        unspent = self.unspents.pop()
+        input_tx = CTransaction()
+        input_tx.vin = [CTxIn(COutPoint(int(unspent['txid'], 16), unspent['vout']), scriptSig=CScript([]))]
+        input_tx.vout = [CTxOut(int(unspent['amount'])*COIN-100000, scriptPubKey=CScript([OP_TRUE]))]
+        input_tx = rpc_sign_transaction(self.nodes[0], input_tx)
+        input_txid = self.nodes[0].sendrawtransaction(bytes_to_hex_str(input_tx.serialize()))
+
+        spending_tx = CTransaction()
+        spending_tx.vin = [CTxIn(COutPoint(int(input_txid, 16), 0), scriptSig=CScript([OP_SENDER]))]
+        spending_tx.vout = [CTxOut(int(unspent['amount'])*COIN-200000, scriptPubKey=CScript([OP_TRUE]*40))]
+        try:
+            txid = self.nodes[0].sendrawtransaction(bytes_to_hex_str(spending_tx.serialize()))
+            self.nodes[0].getrawtransaction(txid)
+        except:
+            # Success
+            return
+        # Sending a tx with OP_SENDER in the scriptSig should fail
+        assert(False)
+
+    def pre_hf_double_op_sender_in_vout_rejected_test(self):
+        unspent = self.unspents.pop()
+        input_tx = CTransaction()
+        input_tx.vin = [CTxIn(COutPoint(int(unspent['txid'], 16), unspent['vout']), scriptSig=CScript([]))]
+        input_tx.vout = [CTxOut(int(unspent['amount'])*COIN-100000, scriptPubKey=CScript([OP_TRUE, OP_SENDER, OP_SENDER]))]
+        input_tx = rpc_sign_transaction(self.nodes[0], input_tx)
+        input_txid = self.nodes[0].sendrawtransaction(bytes_to_hex_str(input_tx.serialize()))
+
+        spending_tx = CTransaction()
+        spending_tx.vin = [CTxIn(COutPoint(int(input_txid, 16), 0), scriptSig=CScript([]))]
+        spending_tx.vout = [CTxOut(int(unspent['amount'])*COIN-200000, scriptPubKey=CScript([OP_TRUE]*40))]
+        try:
+            txid = self.nodes[0].sendrawtransaction(bytes_to_hex_str(spending_tx.serialize()))
+            pp.pprint(self.nodes[0].getrawtransaction(txid, True))
+        except:
+            # Success
+            return
+        # Sending a tx with OP_SENDER in the scriptSig should fail
+        assert(False)
+
+    def run_test(self):
+        self.nodes[0].generate(100+COINBASE_MATURITY)
+        self.unspents = self.nodes[0].listunspent()
+        
+        # Make sure that op_sender txs are not accepted before the HF
+        self.pre_hf_single_op_sender_op_create_tx_rejected_test()
+        self.pre_hf_op_sender_in_vin_rejected_test()
+        self.pre_hf_double_op_sender_in_vout_rejected_test()
+        self.nodes[0].generate(1)
+        self.sync_all()
+
+        # Trigger the HF
+        self.restart_node(0, ['-opsender-block=602'])
+        self.restart_node(1, ['-opsender-block=602'])
+        connect_nodes_bi(self.nodes, 0, 1)
+        
+        self.single_op_sender_op_create_tx_test()
+        self.single_op_sender_op_call_tx_test()
+        self.all_sigtypes_outputs_in_single_tx_test()
+        self.replay_sighash_op_sender_output_test()
+        self.mixed_opsender_and_non_op_sender_tx_and_refund_verification_test()
+        self.large_contract_deployment_tx_test()
+        self.invalid_op_sender_signature_tx_test()
+        self.invalid_op_sender_address_tx_test()
+
+
+if __name__ == '__main__':
+    QtumOpSenderTest().main()
diff --git a/test/functional/test_framework/address.py b/test/functional/test_framework/address.py
index c050e5f8d..befe0f563 100644
--- a/test/functional/test_framework/address.py
+++ b/test/functional/test_framework/address.py
@@ -56,8 +56,8 @@ def base58_to_byte(v, length):
   hexresult = binascii.hexlify(bytes(result.encode('latin-1')))
 
   version = int(hexresult[0:2], 16)
-  hsh = hexresult[2:42]
-  checksum = hexresult[42:]
+  hsh = hexresult[2:-8]
+  checksum = hexresult[-8:]
   return (version, hsh, checksum)
 
 def keyhash_to_p2pkh(hash, main = False):
diff --git a/test/functional/test_framework/script.py b/test/functional/test_framework/script.py
index 88cb4bb19..e072bc22f 100644
--- a/test/functional/test_framework/script.py
+++ b/test/functional/test_framework/script.py
@@ -227,6 +227,7 @@ def __new__(cls, n):
 OP_CREATE = CScriptOp(0xc1)
 OP_CALL = CScriptOp(0xc2)
 OP_SPEND = CScriptOp(0xc3)
+OP_SENDER = CScriptOp(0xc4)
 
 # template matching params
 OP_SMALLINTEGER = CScriptOp(0xfa)
@@ -351,6 +352,7 @@ def __new__(cls, n):
     OP_CREATE: 'OP_CREATE',
     OP_CALL: 'OP_CALL',
     OP_SPEND: 'OP_SPEND',
+    OP_SENDER: 'OP_SENDER',
     OP_SMALLINTEGER : 'OP_SMALLINTEGER',
     OP_PUBKEYS : 'OP_PUBKEYS',
     OP_PUBKEYHASH : 'OP_PUBKEYHASH',
diff --git a/test/functional/test_runner.py b/test/functional/test_runner.py
index f51eb1a04..e4a7e3b60 100755
--- a/test/functional/test_runner.py
+++ b/test/functional/test_runner.py
@@ -197,6 +197,7 @@
     'qtum_prioritize_create_over_call.py',
     'qtum_callcontract_timestamp.py',
     'qtum_transaction_receipt_origin_contract_address.py',
+    'qtum_op_sender.py',
 ]
 
 EXTENDED_SCRIPTS = [

From b4dcf946806f5889e29c13b078b122fd81b11f70 Mon Sep 17 00:00:00 2001
From: Time Markov <time.markov@qtum.com>
Date: Mon, 1 Apr 2019 16:23:03 +0200
Subject: [PATCH 058/153] Fix building for Aleth 1.6.0-alpha.1

---
 src/Makefile.am  | 2 +-
 src/cpp-ethereum | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/Makefile.am b/src/Makefile.am
index 0dc42dd84..b0c2b8fee 100644
--- a/src/Makefile.am
+++ b/src/Makefile.am
@@ -613,7 +613,7 @@ libbitcoin_common_a_SOURCES = \
   cpp-ethereum/libethashseal/genesis/test/constantinopleTest.cpp \
   cpp-ethereum/libethashseal/genesis/test/constantinopleNoProofTest.cpp \
   cpp-ethereum/libethashseal/genesis/test/byzantiumTransitionTest.cpp \
-  cpp-ethereum/libethashseal/genesis/test/ByzantiumToConstantinopleAt5Test.cpp \
+  cpp-ethereum/libethashseal/genesis/test/ByzantiumToConstantinopleFixAt5Test.cpp \
   cpp-ethereum/libethashseal/genesis/test/byzantiumTest.cpp \
   cpp-ethereum/libethashseal/genesis/test/byzantiumNoProofTest.cpp \
   cpp-ethereum/utils/json_spirit/JsonSpiritHeaders.h \
diff --git a/src/cpp-ethereum b/src/cpp-ethereum
index d5cbe3c59..1545a46c7 160000
--- a/src/cpp-ethereum
+++ b/src/cpp-ethereum
@@ -1 +1 @@
-Subproject commit d5cbe3c5934f0b9ae4b0dbbe4dc264389d5281c5
+Subproject commit 1545a46c78f5e9114cf9f8e961c70b61ede6270d

From 76296a89dee5f23df1ceb69fec469b44b2be8697 Mon Sep 17 00:00:00 2001
From: Time Markov <time.markov@qtum.com>
Date: Tue, 7 May 2019 13:56:05 +0200
Subject: [PATCH 059/153] Add method to update regtest constantinople block
 height for testing

---
 src/chainparams.cpp                           | 21 ++++++++++++++++---
 src/chainparams.h                             |  7 +++++++
 src/init.cpp                                  | 16 ++++++++++++++
 .../qtumtests/constantinoplefork_tests.cpp    |  3 +--
 src/test/qtumtests/dgp_tests.cpp              |  3 +--
 5 files changed, 43 insertions(+), 7 deletions(-)

diff --git a/src/chainparams.cpp b/src/chainparams.cpp
index 21643a1bc..1c9ee3b8c 100644
--- a/src/chainparams.cpp
+++ b/src/chainparams.cpp
@@ -308,7 +308,7 @@ class CRegTestParams : public CChainParams {
         consensus.BIP34Hash = uint256S("0x665ed5b402ac0b44efc37d8926332994363e8a7278b7ee9a58fb972efadae943");
         consensus.BIP65Height = 0; // BIP65 activated on regtest (Used in rpc activation tests)
         consensus.BIP66Height = 0; // BIP66 activated on regtest (Used in rpc activation tests)
-        consensus.QIP7Height = 0x7fffffff;
+        consensus.QIP7Height = 0;
         consensus.powLimit = uint256S("7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff");
         consensus.posLimit = uint256S("7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff");
         consensus.nPowTargetTimespan = 16 * 60; // 16 minutes
@@ -397,7 +397,7 @@ class CUnitTestParams : public CRegTestParams
         consensus.BIP34Hash = uint256();
         consensus.BIP65Height = 1351; // BIP65 activated on regtest (Used in rpc activation tests)
         consensus.BIP66Height = 1251; // BIP66 activated on regtest (Used in rpc activation tests)
-        consensus.QIP7Height = 0x7fffffff; // QIP7 is not activated by default for all unit tests, it is activated when tested by specific unit tests
+        consensus.QIP7Height = 0; // QIP7 activated on regtest
 
         // QTUM have 500 blocks of maturity, increased values for regtest in unit tests in order to correspond with it
         consensus.nSubsidyHalvingInterval = 750;
@@ -438,8 +438,23 @@ void UpdateVersionBitsParameters(Consensus::DeploymentPos d, int64_t nStartTime,
 }
 
 std::string CChainParams::EVMGenesisInfo(dev::eth::Network network) const
+{
+    return EVMGenesisInfo(network, consensus.QIP7Height);
+}
+
+std::string CChainParams::EVMGenesisInfo(dev::eth::Network network, int nHeight) const
 {
     std::string genesisInfo = dev::eth::genesisInfo(network);
-    ReplaceInt(consensus.QIP7Height, "QIP7_STARTING_BLOCK", genesisInfo);
+    ReplaceInt(nHeight, "QIP7_STARTING_BLOCK", genesisInfo);
     return genesisInfo;
 }
+
+void CChainParams::UpdateConstantinopleBlockHeight(int nHeight)
+{
+    consensus.QIP7Height = nHeight;
+}
+
+void UpdateConstantinopleBlockHeight(int nHeight)
+{
+    globalChainParams->UpdateConstantinopleBlockHeight(nHeight);
+}
diff --git a/src/chainparams.h b/src/chainparams.h
index 36d308df1..2646b473e 100644
--- a/src/chainparams.h
+++ b/src/chainparams.h
@@ -84,6 +84,8 @@ class CChainParams
     const ChainTxData& TxData() const { return chainTxData; }
     void UpdateVersionBitsParameters(Consensus::DeploymentPos d, int64_t nStartTime, int64_t nTimeout);
     std::string EVMGenesisInfo(dev::eth::Network network) const;
+    std::string EVMGenesisInfo(dev::eth::Network network, int nHeight) const;
+    void UpdateConstantinopleBlockHeight(int nHeight);
 protected:
     CChainParams() {}
 
@@ -129,4 +131,9 @@ void SelectParams(const std::string& chain);
  */
 void UpdateVersionBitsParameters(Consensus::DeploymentPos d, int64_t nStartTime, int64_t nTimeout);
 
+/**
+ * Allows modifying the constantinople block height regtest parameter.
+ */
+void UpdateConstantinopleBlockHeight(int nHeight);
+
 #endif // BITCOIN_CHAINPARAMS_H
diff --git a/src/init.cpp b/src/init.cpp
index 7d3a43c84..c0f5d4de8 100644
--- a/src/init.cpp
+++ b/src/init.cpp
@@ -493,6 +493,7 @@ void SetupServerArgs()
     gArgs.AddArg("-printtoconsole", "Send trace/debug info to console (default: 1 when no -daemon. To disable logging to file, set -nodebuglogfile)", false, OptionsCategory::DEBUG_TEST);
     gArgs.AddArg("-shrinkdebugfile", "Shrink debug.log file on client startup (default: 1 when no -debug)", false, OptionsCategory::DEBUG_TEST);
     gArgs.AddArg("-uacomment=<cmt>", "Append comment to the user agent string", false, OptionsCategory::DEBUG_TEST);
+    gArgs.AddArg("-constantinopleheight=<n>", "Use given block height to check constantinople fork (regtest-only)", true, OptionsCategory::DEBUG_TEST);
 
     SetupChainParamsBaseOptions();
 
@@ -1193,6 +1194,21 @@ bool AppInitParameterInteraction()
             }
         }
     }
+
+    if (gArgs.IsArgSet("-constantinopleheight")) {
+        // Allow overriding constantinople block for testing
+        if (!chainparams.MineBlocksOnDemand()) {
+            return InitError("Constantinople block height may only be overridden on regtest.");
+        }
+
+        int constantinopleBlock = gArgs.GetArg("-constantinopleheight", 0x7fffffff);
+        if(constantinopleBlock >= 0)
+        {
+            UpdateConstantinopleBlockHeight(constantinopleBlock);
+            LogPrintf("Activate constantinople at block height %d\n.", constantinopleBlock);
+        }
+    }
+
     return true;
 }
 
diff --git a/src/test/qtumtests/constantinoplefork_tests.cpp b/src/test/qtumtests/constantinoplefork_tests.cpp
index 5c93eccba..fda79c56b 100644
--- a/src/test/qtumtests/constantinoplefork_tests.cpp
+++ b/src/test/qtumtests/constantinoplefork_tests.cpp
@@ -103,8 +103,7 @@ std::vector<valtype> CODE = {
 
 void genesisLoading(){
     const CChainParams& chainparams = Params();
-    dev::eth::ChainParams cp((chainparams.EVMGenesisInfo(dev::eth::Network::qtumMainNetwork)));
-    cp.constantinopleForkBlock = dev::u256(1000);
+    dev::eth::ChainParams cp((chainparams.EVMGenesisInfo(dev::eth::Network::qtumMainNetwork, 1000)));
     globalState->populateFrom(cp.genesisState);
     globalSealEngine = std::unique_ptr<dev::eth::SealEngineFace>(cp.createSealEngine());
     globalState->db().commit();
diff --git a/src/test/qtumtests/dgp_tests.cpp b/src/test/qtumtests/dgp_tests.cpp
index 365f3c4cf..7b6f9a14c 100644
--- a/src/test/qtumtests/dgp_tests.cpp
+++ b/src/test/qtumtests/dgp_tests.cpp
@@ -285,8 +285,7 @@ dev::h256 hash = dev::h256(ParseHex("aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
 
 void contractLoading(){
     const CChainParams& chainparams = Params();
-    dev::eth::ChainParams cp((chainparams.EVMGenesisInfo(dev::eth::Network::qtumMainNetwork)));
-    cp.constantinopleForkBlock = dev::u256(1400);
+    dev::eth::ChainParams cp((chainparams.EVMGenesisInfo(dev::eth::Network::qtumMainNetwork, 1400)));
     globalState->populateFrom(cp.genesisState);
     globalSealEngine = std::unique_ptr<dev::eth::SealEngineFace>(cp.createSealEngine());
     globalState->db().commit();

From 8f0d20139b541469b0892c8d9ef27390daaa843d Mon Sep 17 00:00:00 2001
From: Time Markov <time.markov@qtum.com>
Date: Fri, 10 May 2019 13:34:16 +0200
Subject: [PATCH 060/153] Update the default value for constantinople block

---
 src/init.cpp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/init.cpp b/src/init.cpp
index c0f5d4de8..28bf9c14b 100644
--- a/src/init.cpp
+++ b/src/init.cpp
@@ -1201,7 +1201,7 @@ bool AppInitParameterInteraction()
             return InitError("Constantinople block height may only be overridden on regtest.");
         }
 
-        int constantinopleBlock = gArgs.GetArg("-constantinopleheight", 0x7fffffff);
+        int constantinopleBlock = gArgs.GetArg("-constantinopleheight", 0);
         if(constantinopleBlock >= 0)
         {
             UpdateConstantinopleBlockHeight(constantinopleBlock);

From 318c258cc08d84c5dd8d328697f2f7c4f23b7950 Mon Sep 17 00:00:00 2001
From: Time Markov <time.markov@qtum.com>
Date: Fri, 10 May 2019 14:44:52 +0200
Subject: [PATCH 061/153] Update Op Sender fork activation rules be consistent
 with other forks Changed name from -opsender-block to -opsenderheight. Start
 in regtest by default. Default value for -opsenderheight is 0.

---
 src/chainparams.cpp | 2 +-
 src/init.cpp        | 6 +++---
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/src/chainparams.cpp b/src/chainparams.cpp
index e79029518..bbf573461 100644
--- a/src/chainparams.cpp
+++ b/src/chainparams.cpp
@@ -311,7 +311,7 @@ class CRegTestParams : public CChainParams {
         consensus.BIP34Hash = uint256S("0x665ed5b402ac0b44efc37d8926332994363e8a7278b7ee9a58fb972efadae943");
         consensus.BIP65Height = 0; // BIP65 activated on regtest (Used in rpc activation tests)
         consensus.BIP66Height = 0; // BIP66 activated on regtest (Used in rpc activation tests)
-        consensus.QIP5Height = 0x7fffffff;
+        consensus.QIP5Height = 0;
         consensus.powLimit = uint256S("7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff");
         consensus.posLimit = uint256S("7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff");
         consensus.nPowTargetTimespan = 16 * 60; // 16 minutes
diff --git a/src/init.cpp b/src/init.cpp
index 7de76041f..08710d8d4 100644
--- a/src/init.cpp
+++ b/src/init.cpp
@@ -493,7 +493,7 @@ void SetupServerArgs()
     gArgs.AddArg("-printtoconsole", "Send trace/debug info to console (default: 1 when no -daemon. To disable logging to file, set -nodebuglogfile)", false, OptionsCategory::DEBUG_TEST);
     gArgs.AddArg("-shrinkdebugfile", "Shrink debug.log file on client startup (default: 1 when no -debug)", false, OptionsCategory::DEBUG_TEST);
     gArgs.AddArg("-uacomment=<cmt>", "Append comment to the user agent string", false, OptionsCategory::DEBUG_TEST);
-    gArgs.AddArg("-opsender-block=<n>", "Use given block height to check opsender fork (regtest-only)", true, OptionsCategory::DEBUG_TEST);
+    gArgs.AddArg("-opsenderheight=<n>", "Use given block height to check opsender fork (regtest-only)", true, OptionsCategory::DEBUG_TEST);
 
     SetupChainParamsBaseOptions();
 
@@ -1195,13 +1195,13 @@ bool AppInitParameterInteraction()
         }
     }
 
-    if (gArgs.IsArgSet("-opsender-block")) {
+    if (gArgs.IsArgSet("-opsenderheight")) {
         // Allow overriding opsender block for testing
         if (!chainparams.MineBlocksOnDemand()) {
             return InitError("Op Sender block height may only be overridden on regtest.");
         }
 
-        int opsenderBlock = gArgs.GetArg("-opsender-block", 0x7fffffff);
+        int opsenderBlock = gArgs.GetArg("-opsenderheight", 0);
         if(opsenderBlock >= 0)
         {
             UpdateOpSenderBlockHeight(opsenderBlock);

From 9bc16b1f6a6501c2a695c5b669dc2c2fbc058da0 Mon Sep 17 00:00:00 2001
From: Time Markov <time.markov@qtum.com>
Date: Mon, 24 Jun 2019 14:47:05 +0200
Subject: [PATCH 062/153] Parse revert message

---
 src/rpc/blockchain.cpp | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/src/rpc/blockchain.cpp b/src/rpc/blockchain.cpp
index e29e096d3..5e9790363 100644
--- a/src/rpc/blockchain.cpp
+++ b/src/rpc/blockchain.cpp
@@ -31,6 +31,7 @@
 #include <validationinterface.h>
 #include <warnings.h>
 #include <libdevcore/CommonData.h>
+#include <libethcore/ABI.h>
 #include <pow.h>
 #include <pos.h>
 #include <txdb.h>
@@ -231,6 +232,25 @@ UniValue blockToJSON(const CBlock& block, const CBlockIndex* blockindex, bool tx
 }
 
 //////////////////////////////////////////////////////////////////////////// // qtum
+std::string revertMessage(const dev::bytes& rawData)
+{
+    std::string message;
+    try
+    {
+        dev::bytesConstRef oRawData(&rawData);
+        dev::bytes errorFunc = oRawData.cropped(0, 4).toBytes();
+        if(dev::toHex(errorFunc) == "08c379a0")
+        {
+            dev::bytesConstRef oData = oRawData.cropped(4);
+            message = dev::eth::ABIDeserialiser<std::string>::deserialise(oData);
+        }
+    }
+    catch(...)
+    {}
+
+    return message;
+}
+
 UniValue executionResultToJSON(const dev::eth::ExecutionResult& exRes)
 {
     UniValue result(UniValue::VOBJ);
@@ -244,6 +264,7 @@ UniValue executionResultToJSON(const dev::eth::ExecutionResult& exRes)
     result.pushKV("gasRefunded", CAmount(exRes.gasRefunded));
     result.pushKV("depositSize", static_cast<int32_t>(exRes.depositSize));
     result.pushKV("gasForDeposit", CAmount(exRes.gasForDeposit));
+    result.pushKV("revertMessage", revertMessage(exRes.output));
     return result;
 }
 

From 2d003ec57afcc7b903161419258c4a8d416c222c Mon Sep 17 00:00:00 2001
From: Time Markov <time.markov@qtum.com>
Date: Tue, 25 Jun 2019 15:41:45 +0200
Subject: [PATCH 063/153] Add support for EVM exception message decoding

---
 src/cpp-ethereum            |  2 +-
 src/qtum/storageresults.cpp | 12 ++++++++----
 src/qtum/storageresults.h   |  2 ++
 src/rpc/blockchain.cpp      | 23 ++---------------------
 src/validation.cpp          | 27 ++++++++++++++++++++++++++-
 src/validation.h            |  2 ++
 6 files changed, 41 insertions(+), 27 deletions(-)

diff --git a/src/cpp-ethereum b/src/cpp-ethereum
index 1545a46c7..c692328d6 160000
--- a/src/cpp-ethereum
+++ b/src/cpp-ethereum
@@ -1 +1 @@
-Subproject commit 1545a46c78f5e9114cf9f8e961c70b61ede6270d
+Subproject commit c692328d649b363806f748b5b584c1f9a8cfab76
diff --git a/src/qtum/storageresults.cpp b/src/qtum/storageresults.cpp
index 60c1f5382..76ac50da7 100644
--- a/src/qtum/storageresults.cpp
+++ b/src/qtum/storageresults.cpp
@@ -77,11 +77,12 @@ void StorageResults::commitResults(){
                     tris.contractAddresses.push_back(i.second[j].contractAddress);
                     tris.logs.push_back(logEntriesSerialization(i.second[j].logs));
                     tris.excepted.push_back(uint32_t(static_cast<int>(i.second[j].excepted)));
+                    tris.exceptedMessage.push_back(i.second[j].exceptedMessage);
                 }
 
-                dev::RLPStream streamRLP(11);
+                dev::RLPStream streamRLP(12);
                 streamRLP << tris.blockHashes << tris.blockNumbers << tris.transactionHashes << tris.transactionIndexes << tris.senders;
-                streamRLP << tris.receivers << tris.cumulativeGasUsed << tris.gasUsed << tris.contractAddresses << tris.logs << tris.excepted;
+                streamRLP << tris.receivers << tris.cumulativeGasUsed << tris.gasUsed << tris.contractAddresses << tris.logs << tris.excepted << tris.exceptedMessage;
 
                 dev::bytes data = streamRLP.out();
                 std::string stringData(data.begin(), data.end());
@@ -116,13 +117,16 @@ bool StorageResults::readResult(dev::h256 const& _key, std::vector<TransactionRe
         tris.gasUsed = state[7].toVector<dev::u256>();
         tris.contractAddresses = state[8].toVector<dev::h160>();
         tris.logs = state[9].toVector<logEntriesSerializ>();
-        if(state.itemCount() == 11)
+        if(state.itemCount() >= 11)
             tris.excepted = state[10].toVector<uint32_t>();
+        if(state.itemCount() >= 12)
+            tris.exceptedMessage = state[11].toVector<std::string>();
 
         for(size_t j = 0; j < tris.blockHashes.size(); j++){
             TransactionReceiptInfo tri{h256Touint(tris.blockHashes[j]), tris.blockNumbers[j], h256Touint(tris.transactionHashes[j]), tris.transactionIndexes[j], tris.senders[j],
                                        tris.receivers[j], uint64_t(tris.cumulativeGasUsed[j]), uint64_t(tris.gasUsed[j]), tris.contractAddresses[j], logEntriesDeserialize(tris.logs[j]), 
-                                       state.itemCount() == 11 ? static_cast<dev::eth::TransactionException>(tris.excepted[j]) : dev::eth::TransactionException::NoInformation
+                                       state.itemCount() >= 11 ? static_cast<dev::eth::TransactionException>(tris.excepted[j]) : dev::eth::TransactionException::NoInformation,
+                                       state.itemCount() >= 12 ? tris.exceptedMessage[j] : ""
                                     };
             _result.push_back(tri);
         }
diff --git a/src/qtum/storageresults.h b/src/qtum/storageresults.h
index d8c124e4d..49da1752b 100644
--- a/src/qtum/storageresults.h
+++ b/src/qtum/storageresults.h
@@ -19,6 +19,7 @@ struct TransactionReceiptInfo{
     dev::Address contractAddress;
     dev::eth::LogEntries logs;
     dev::eth::TransactionException excepted;
+    std::string exceptedMessage;
 };
 
 struct TransactionReceiptInfoSerialized{
@@ -33,6 +34,7 @@ struct TransactionReceiptInfoSerialized{
     std::vector<dev::h160> contractAddresses;
     std::vector<logEntriesSerializ> logs;
     std::vector<uint32_t> excepted;
+    std::vector<std::string> exceptedMessage;
 };
 
 class StorageResults{
diff --git a/src/rpc/blockchain.cpp b/src/rpc/blockchain.cpp
index 5e9790363..91d68507b 100644
--- a/src/rpc/blockchain.cpp
+++ b/src/rpc/blockchain.cpp
@@ -31,7 +31,6 @@
 #include <validationinterface.h>
 #include <warnings.h>
 #include <libdevcore/CommonData.h>
-#include <libethcore/ABI.h>
 #include <pow.h>
 #include <pos.h>
 #include <txdb.h>
@@ -232,25 +231,6 @@ UniValue blockToJSON(const CBlock& block, const CBlockIndex* blockindex, bool tx
 }
 
 //////////////////////////////////////////////////////////////////////////// // qtum
-std::string revertMessage(const dev::bytes& rawData)
-{
-    std::string message;
-    try
-    {
-        dev::bytesConstRef oRawData(&rawData);
-        dev::bytes errorFunc = oRawData.cropped(0, 4).toBytes();
-        if(dev::toHex(errorFunc) == "08c379a0")
-        {
-            dev::bytesConstRef oData = oRawData.cropped(4);
-            message = dev::eth::ABIDeserialiser<std::string>::deserialise(oData);
-        }
-    }
-    catch(...)
-    {}
-
-    return message;
-}
-
 UniValue executionResultToJSON(const dev::eth::ExecutionResult& exRes)
 {
     UniValue result(UniValue::VOBJ);
@@ -264,7 +244,7 @@ UniValue executionResultToJSON(const dev::eth::ExecutionResult& exRes)
     result.pushKV("gasRefunded", CAmount(exRes.gasRefunded));
     result.pushKV("depositSize", static_cast<int32_t>(exRes.depositSize));
     result.pushKV("gasForDeposit", CAmount(exRes.gasForDeposit));
-    result.pushKV("revertMessage", revertMessage(exRes.output));
+    result.pushKV("exceptedMessage", exceptedMessage(exRes.excepted, exRes.output));
     return result;
 }
 
@@ -1171,6 +1151,7 @@ void assignJSON(UniValue& entry, const TransactionReceiptInfo& resExec) {
     std::stringstream ss;
     ss << resExec.excepted;
     entry.pushKV("excepted",ss.str());
+    entry.pushKV("exceptedMessage", resExec.exceptedMessage);
 }
 
 void assignJSON(UniValue& logEntry, const dev::eth::LogEntry& log,
diff --git a/src/validation.cpp b/src/validation.cpp
index dd32b00b6..6e9f9811c 100644
--- a/src/validation.cpp
+++ b/src/validation.cpp
@@ -41,6 +41,7 @@
 #include <utilstrencodings.h>
 #include <validationinterface.h>
 #include <warnings.h>
+#include <libethcore/ABI.h>
 
 #include <serialize.h>
 #include <pubkey.h>
@@ -3068,7 +3069,7 @@ bool CChainState::ConnectBlock(const CBlock& block, CValidationState& state, CBl
                         heightIndexes[log.address].second.push_back(tx.GetHash());
                     }
                     tri.push_back(TransactionReceiptInfo{block.GetHash(), uint32_t(pindex->nHeight), tx.GetHash(), uint32_t(i), resultConvertQtumTX.first[k].from(), resultConvertQtumTX.first[k].to(),
-                                countCumulativeGasUsed, uint64_t(resultExec[k].execRes.gasUsed), resultExec[k].execRes.newAddress, resultExec[k].txRec.log(), resultExec[k].execRes.excepted});
+                                countCumulativeGasUsed, uint64_t(resultExec[k].execRes.gasUsed), resultExec[k].execRes.newAddress, resultExec[k].txRec.log(), resultExec[k].execRes.excepted, exceptedMessage(resultExec[k].execRes.excepted, resultExec[k].execRes.output)});
                 }
 
                 pstorageresult->addResult(uintToh256(tx.GetHash()), tri);
@@ -6505,6 +6506,30 @@ double GuessVerificationProgress(const ChainTxData& data, const CBlockIndex *pin
     return pindex->nChainTx / fTxTotal;
 }
 
+std::string exceptedMessage(const dev::eth::TransactionException& excepted, const dev::bytes& output)
+{
+    std::string message;
+    try
+    {
+        // Process the revert message from the output
+        if(excepted == dev::eth::TransactionException::RevertInstruction)
+        {
+            // Get function: Error(string)
+            dev::bytesConstRef oRawData(&output);
+            dev::bytes errorFunc = oRawData.cropped(0, 4).toBytes();
+            if(dev::toHex(errorFunc) == "08c379a0")
+            {
+                dev::bytesConstRef oData = oRawData.cropped(4);
+                message = dev::eth::ABIDeserialiser<std::string>::deserialise(oData);
+            }
+        }
+    }
+    catch(...)
+    {}
+
+    return message;
+}
+
 class CMainCleanup
 {
 public:
diff --git a/src/validation.h b/src/validation.h
index b3f7026c0..f6d5041db 100644
--- a/src/validation.h
+++ b/src/validation.h
@@ -996,6 +996,8 @@ void EnforceContractVoutLimit(ByteCodeExecResult& bcer, ByteCodeExecResult& bcer
 
 void writeVMlog(const std::vector<ResultExecute>& res, const CTransaction& tx = CTransaction(), const CBlock& block = CBlock());
 
+std::string exceptedMessage(const dev::eth::TransactionException& excepted, const dev::bytes& output);
+
 struct EthTransactionParams{
     VersionVM version;
     dev::u256 gasLimit;

From 7c6de93af566b117fd1dca3fa1480f93357cd64f Mon Sep 17 00:00:00 2001
From: Time Markov <time.markov@qtum.com>
Date: Wed, 10 Jul 2019 13:01:43 +0200
Subject: [PATCH 064/153] Update submodule

---
 src/cpp-ethereum | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/cpp-ethereum b/src/cpp-ethereum
index c692328d6..e6b6f2dab 160000
--- a/src/cpp-ethereum
+++ b/src/cpp-ethereum
@@ -1 +1 @@
-Subproject commit c692328d649b363806f748b5b584c1f9a8cfab76
+Subproject commit e6b6f2dab37fa4e5d0f5a502f21c81bd1bac39bd

From 1843bb900cbb04071439402d3229405ec06690b6 Mon Sep 17 00:00:00 2001
From: Time Markov <time.markov@qtum.com>
Date: Fri, 8 Mar 2019 15:23:43 +0100
Subject: [PATCH 065/153] Add new target timespan parameter that produce target
 multiplier of 20000

---
 src/chainparams.cpp    | 5 ++++-
 src/consensus/params.h | 1 +
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/src/chainparams.cpp b/src/chainparams.cpp
index a1345f292..fac9e8aad 100644
--- a/src/chainparams.cpp
+++ b/src/chainparams.cpp
@@ -92,6 +92,7 @@ class CMainParams : public CChainParams {
         consensus.powLimit = uint256S("0000ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff");
         consensus.posLimit = uint256S("00000000ffffffffffffffffffffffffffffffffffffffffffffffffffffffff");
         consensus.nPowTargetTimespan = 16 * 60; // 16 minutes
+        consensus.nPowTargetTimespanV2 = 20128; // 5.59 hours
         consensus.nPowTargetSpacing = 2 * 64;
         consensus.fPowAllowMinDifficultyBlocks = false;
         consensus.fPowNoRetargeting = true;
@@ -209,6 +210,7 @@ class CTestNetParams : public CChainParams {
         consensus.powLimit = uint256S("0000ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff");
         consensus.posLimit = uint256S("0000ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff");
         consensus.nPowTargetTimespan = 16 * 60; // 16 minutes
+        consensus.nPowTargetTimespanV2 = 20128; // 5.59 hours
         consensus.nPowTargetSpacing = 2 * 64;
         consensus.fPowAllowMinDifficultyBlocks = false;
         consensus.fPowNoRetargeting = true;
@@ -313,7 +315,8 @@ class CRegTestParams : public CChainParams {
         consensus.BIP66Height = 0; // BIP66 activated on regtest (Used in rpc activation tests)
         consensus.powLimit = uint256S("7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff");
         consensus.posLimit = uint256S("7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff");
-        consensus.nPowTargetTimespan = 16 * 60; // 16 minutes
+        consensus.nPowTargetTimespan = 16 * 60; // 16 minutes (960 = 832 + 128; multiplier is 832)
+        consensus.nPowTargetTimespanV2 = 20128; // 5.59 hours (20128 = 20000 + 128; multiplier is 20000)
         consensus.nPowTargetSpacing = 2 * 64;
         consensus.fPowAllowMinDifficultyBlocks = true;
         consensus.fPowNoRetargeting = true;
diff --git a/src/consensus/params.h b/src/consensus/params.h
index bf3737d47..43efd2d78 100644
--- a/src/consensus/params.h
+++ b/src/consensus/params.h
@@ -74,6 +74,7 @@ struct Params {
     bool fPoSNoRetargeting;
     int64_t nPowTargetSpacing;
     int64_t nPowTargetTimespan;
+    int64_t nPowTargetTimespanV2;
     int64_t DifficultyAdjustmentInterval() const { return nPowTargetTimespan / nPowTargetSpacing; }
     uint256 nMinimumChainWork;
     uint256 defaultAssumeValid;

From a1220e899b2ed689acb7d824d940f7074a43b0b1 Mon Sep 17 00:00:00 2001
From: Time Markov <time.markov@qtum.com>
Date: Fri, 8 Mar 2019 16:47:21 +0100
Subject: [PATCH 066/153] Add QIP 9 block height parameter

---
 src/chainparams.cpp    | 3 +++
 src/consensus/params.h | 2 ++
 2 files changed, 5 insertions(+)

diff --git a/src/chainparams.cpp b/src/chainparams.cpp
index fac9e8aad..e3247401c 100644
--- a/src/chainparams.cpp
+++ b/src/chainparams.cpp
@@ -89,6 +89,7 @@ class CMainParams : public CChainParams {
         consensus.BIP34Hash = uint256S("0x000075aef83cf2853580f8ae8ce6f8c3096cfa21d98334d6e3f95e5582ed986c");
         consensus.BIP65Height = 0; // 000000000000000004c2b624ed5d7756c508d90fd0da2c7c679febfa6c4735f0
         consensus.BIP66Height = 0; // 00000000000000000379eaa19dce8c9b722d46ae6a57c2f1a988119488b50931
+        consensus.QIP9Height = 0x7fffffff;
         consensus.powLimit = uint256S("0000ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff");
         consensus.posLimit = uint256S("00000000ffffffffffffffffffffffffffffffffffffffffffffffffffffffff");
         consensus.nPowTargetTimespan = 16 * 60; // 16 minutes
@@ -207,6 +208,7 @@ class CTestNetParams : public CChainParams {
         consensus.BIP34Hash = uint256S("0x0000e803ee215c0684ca0d2f9220594d3f828617972aad66feb2ba51f5e14222");
         consensus.BIP65Height = 0; // 00000000007f6655f22f98e72ed80d8b06dc761d5da09df0fa1dc4be4f861eb6
         consensus.BIP66Height = 0; // 000000002104c8c45e99a8853285a3b592602a3ccde2b832481da85e9e4ba182
+        consensus.QIP9Height = 0x7fffffff;
         consensus.powLimit = uint256S("0000ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff");
         consensus.posLimit = uint256S("0000ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff");
         consensus.nPowTargetTimespan = 16 * 60; // 16 minutes
@@ -313,6 +315,7 @@ class CRegTestParams : public CChainParams {
         consensus.BIP34Hash = uint256S("0x665ed5b402ac0b44efc37d8926332994363e8a7278b7ee9a58fb972efadae943");
         consensus.BIP65Height = 0; // BIP65 activated on regtest (Used in rpc activation tests)
         consensus.BIP66Height = 0; // BIP66 activated on regtest (Used in rpc activation tests)
+        consensus.QIP9Height = 0x7fffffff;
         consensus.powLimit = uint256S("7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff");
         consensus.posLimit = uint256S("7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff");
         consensus.nPowTargetTimespan = 16 * 60; // 16 minutes (960 = 832 + 128; multiplier is 832)
diff --git a/src/consensus/params.h b/src/consensus/params.h
index 43efd2d78..4eab96b5c 100644
--- a/src/consensus/params.h
+++ b/src/consensus/params.h
@@ -58,6 +58,8 @@ struct Params {
     int BIP65Height;
     /** Block height at which BIP66 becomes active */
     int BIP66Height;
+    /** Block height at which QIP9 becomes active */
+    int QIP9Height;
     /**
      * Minimum blocks including miner confirmation of the total of 2016 blocks in a retargeting period,
      * (nPowTargetTimespan / nPowTargetSpacing) which is also used for BIP9 deployments.

From 3b3e387e993ab767f1d065429a229bb43716ddd7 Mon Sep 17 00:00:00 2001
From: Time Markov <time.markov@qtum.com>
Date: Mon, 11 Mar 2019 12:14:02 +0100
Subject: [PATCH 067/153] Update difficult adjustment interval

---
 src/consensus/params.h | 6 +++++-
 src/pow.cpp            | 4 ++--
 src/rpc/mining.cpp     | 2 +-
 3 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/src/consensus/params.h b/src/consensus/params.h
index 4eab96b5c..9ea3c96ad 100644
--- a/src/consensus/params.h
+++ b/src/consensus/params.h
@@ -77,7 +77,11 @@ struct Params {
     int64_t nPowTargetSpacing;
     int64_t nPowTargetTimespan;
     int64_t nPowTargetTimespanV2;
-    int64_t DifficultyAdjustmentInterval() const { return nPowTargetTimespan / nPowTargetSpacing; }
+    int64_t DifficultyAdjustmentInterval(int height) const
+    {
+        int64_t targetSpacing = height < QIP9Height ? nPowTargetTimespan : nPowTargetTimespanV2;
+        return targetSpacing / nPowTargetSpacing;
+    }
     uint256 nMinimumChainWork;
     uint256 defaultAssumeValid;
     int nLastPOWBlock;
diff --git a/src/pow.cpp b/src/pow.cpp
index f6e91d036..e0aa18145 100644
--- a/src/pow.cpp
+++ b/src/pow.cpp
@@ -55,7 +55,7 @@ unsigned int GetNextWorkRequired(const CBlockIndex* pindexLast, const CBlockHead
         {
             // Return the last non-special-min-difficulty-rules-block
             const CBlockIndex* pindex = pindexLast;
-            while (pindex->pprev && pindex->nHeight % params.DifficultyAdjustmentInterval() != 0 && pindex->nBits == nTargetLimit)
+            while (pindex->pprev && pindex->nHeight % params.DifficultyAdjustmentInterval(pindex->nHeight) != 0 && pindex->nBits == nTargetLimit)
                 pindex = pindex->pprev;
             return pindex->nBits;
         }
@@ -88,7 +88,7 @@ unsigned int CalculateNextWorkRequired(const CBlockIndex* pindexLast, int64_t nF
     // ppcoin: retarget with exponential moving toward target spacing
     arith_uint256 bnNew;
     bnNew.SetCompact(pindexLast->nBits);
-    int64_t nInterval = params.DifficultyAdjustmentInterval();
+    int64_t nInterval = params.DifficultyAdjustmentInterval(pindexLast->nHeight);
     bnNew *= ((nInterval - 1) * nTargetSpacing + nActualSpacing + nActualSpacing);
     bnNew /= ((nInterval + 1) * nTargetSpacing);
 
diff --git a/src/rpc/mining.cpp b/src/rpc/mining.cpp
index 997bb4e82..ceac42a5a 100644
--- a/src/rpc/mining.cpp
+++ b/src/rpc/mining.cpp
@@ -61,7 +61,7 @@ static UniValue GetNetworkHashPS(int lookup, int height) {
 
     // If lookup is -1, then use blocks since last difficulty change.
     if (lookup <= 0)
-        lookup = pb->nHeight % Params().GetConsensus().DifficultyAdjustmentInterval() + 1;
+        lookup = pb->nHeight % Params().GetConsensus().DifficultyAdjustmentInterval(pb->nHeight) + 1;
 
     // If lookup is larger than chain, then set it to chain length.
     if (lookup > pb->nHeight)

From b45fe86f45620925c0e4920fc31e03f695f114a9 Mon Sep 17 00:00:00 2001
From: Time Markov <time.markov@qtum.com>
Date: Mon, 11 Mar 2019 13:34:19 +0100
Subject: [PATCH 068/153] Add network weight fix to use fixed denominator

---
 src/rpc/blockchain.cpp | 16 +++++++++++++++-
 1 file changed, 15 insertions(+), 1 deletion(-)

diff --git a/src/rpc/blockchain.cpp b/src/rpc/blockchain.cpp
index d96e58f18..ddd3e3c72 100644
--- a/src/rpc/blockchain.cpp
+++ b/src/rpc/blockchain.cpp
@@ -111,6 +111,13 @@ double GetPoSKernelPS()
     CBlockIndex* pindex = pindexBestHeader;
     CBlockIndex* pindexPrevStake = NULL;
 
+    const Consensus::Params& consensusParams = Params().GetConsensus();
+    bool dynamicStakeSpacing = true;
+    if(pindex)
+    {
+        dynamicStakeSpacing = pindex->nHeight < consensusParams.QIP9Height;
+    }
+
     while (pindex && nStakesHandled < nPoSInterval)
     {
         if (pindex->IsProofOfStake())
@@ -118,7 +125,8 @@ double GetPoSKernelPS()
             if (pindexPrevStake)
             {
                 dStakeKernelsTriedAvg += GetDifficulty(pindexPrevStake) * 4294967296.0;
-                nStakesTime += pindexPrevStake->nTime - pindex->nTime;
+                if(dynamicStakeSpacing)
+                    nStakesTime += pindexPrevStake->nTime - pindex->nTime;
                 nStakesHandled++;
             }
             pindexPrevStake = pindex;
@@ -127,6 +135,12 @@ double GetPoSKernelPS()
         pindex = pindex->pprev;
     }
 
+    if(!dynamicStakeSpacing)
+    {
+        // Using a fixed denominator reduces the variation spikes
+        nStakesTime = consensusParams.nPowTargetSpacing * nStakesHandled;
+    }
+
     double result = 0;
 
     if (nStakesTime)

From 1b6b63d13759eb9770b18d2ab53e00b2abbcdfc1 Mon Sep 17 00:00:00 2001
From: Time Markov <time.markov@qtum.com>
Date: Mon, 13 May 2019 15:05:15 +0200
Subject: [PATCH 069/153] Update difficulty change block height in regtest mode

---
 src/chainparams.cpp | 22 +++++++++++++++++++++-
 src/chainparams.h   |  6 ++++++
 src/init.cpp        | 16 ++++++++++++++++
 3 files changed, 43 insertions(+), 1 deletion(-)

diff --git a/src/chainparams.cpp b/src/chainparams.cpp
index e3247401c..5df879198 100644
--- a/src/chainparams.cpp
+++ b/src/chainparams.cpp
@@ -315,7 +315,7 @@ class CRegTestParams : public CChainParams {
         consensus.BIP34Hash = uint256S("0x665ed5b402ac0b44efc37d8926332994363e8a7278b7ee9a58fb972efadae943");
         consensus.BIP65Height = 0; // BIP65 activated on regtest (Used in rpc activation tests)
         consensus.BIP66Height = 0; // BIP66 activated on regtest (Used in rpc activation tests)
-        consensus.QIP9Height = 0x7fffffff;
+        consensus.QIP9Height = 0;
         consensus.powLimit = uint256S("7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff");
         consensus.posLimit = uint256S("7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff");
         consensus.nPowTargetTimespan = 16 * 60; // 16 minutes (960 = 832 + 128; multiplier is 832)
@@ -444,3 +444,23 @@ void UpdateVersionBitsParameters(Consensus::DeploymentPos d, int64_t nStartTime,
 {
     globalChainParams->UpdateVersionBitsParameters(d, nStartTime, nTimeout);
 }
+
+void CChainParams::UpdateDifficultyChangeBlockHeight(int nHeight)
+{
+    consensus.nSubsidyHalvingInterval = 985500; // qtum halving every 4 years
+    consensus.posLimit = uint256S("00000000ffffffffffffffffffffffffffffffffffffffffffffffffffffffff");
+    consensus.QIP9Height = nHeight;
+    consensus.fPowAllowMinDifficultyBlocks = false;
+    consensus.fPowNoRetargeting = true;
+    consensus.fPoSNoRetargeting = false;
+    consensus.nLastPOWBlock = 5000;
+    consensus.nMPoSRewardRecipients = 10;
+    consensus.nFirstMPoSBlock = consensus.nLastPOWBlock + 
+                                consensus.nMPoSRewardRecipients + 
+                                COINBASE_MATURITY;
+}
+
+void UpdateDifficultyChangeBlockHeight(int nHeight)
+{
+    globalChainParams->UpdateDifficultyChangeBlockHeight(nHeight);
+}
diff --git a/src/chainparams.h b/src/chainparams.h
index 722e52ff4..a72fe400a 100644
--- a/src/chainparams.h
+++ b/src/chainparams.h
@@ -81,6 +81,7 @@ class CChainParams
     const CCheckpointData& Checkpoints() const { return checkpointData; }
     const ChainTxData& TxData() const { return chainTxData; }
     void UpdateVersionBitsParameters(Consensus::DeploymentPos d, int64_t nStartTime, int64_t nTimeout);
+    void UpdateDifficultyChangeBlockHeight(int nHeight);
 protected:
     CChainParams() {}
 
@@ -126,4 +127,9 @@ void SelectParams(const std::string& chain);
  */
 void UpdateVersionBitsParameters(Consensus::DeploymentPos d, int64_t nStartTime, int64_t nTimeout);
 
+/**
+ * Allows modifying the difficulty change block height regtest parameter.
+ */
+void UpdateDifficultyChangeBlockHeight(int nHeight);
+
 #endif // BITCOIN_CHAINPARAMS_H
diff --git a/src/init.cpp b/src/init.cpp
index 2dc66e3a4..45e8783b7 100644
--- a/src/init.cpp
+++ b/src/init.cpp
@@ -496,6 +496,7 @@ void SetupServerArgs()
     gArgs.AddArg("-printtoconsole", "Send trace/debug info to console (default: 1 when no -daemon. To disable logging to file, set -nodebuglogfile)", false, OptionsCategory::DEBUG_TEST);
     gArgs.AddArg("-shrinkdebugfile", "Shrink debug.log file on client startup (default: 1 when no -debug)", false, OptionsCategory::DEBUG_TEST);
     gArgs.AddArg("-uacomment=<cmt>", "Append comment to the user agent string", false, OptionsCategory::DEBUG_TEST);
+    gArgs.AddArg("-difficultychangeheight=<n>", "Use given block height to check difficulty change fork (regtest-only)", true, OptionsCategory::DEBUG_TEST);
 
     SetupChainParamsBaseOptions();
 
@@ -1197,6 +1198,21 @@ bool AppInitParameterInteraction()
             }
         }
     }
+
+    if (gArgs.IsArgSet("-difficultychangeheight")) {
+        // Allow overriding difficulty change block for testing
+        if (!chainparams.MineBlocksOnDemand()) {
+            return InitError("Difficulty change block height may only be overridden on regtest.");
+        }
+
+        int difficultyChangeBlock = gArgs.GetArg("-difficultychangeheight", 0);
+        if(difficultyChangeBlock >= 0)
+        {
+            UpdateDifficultyChangeBlockHeight(difficultyChangeBlock);
+            LogPrintf("Activate difficulty change at block height %d\n.", difficultyChangeBlock);
+        }
+    }
+
     return true;
 }
 

From f9d6922809345febb6ef18395066973d2b16bcf1 Mon Sep 17 00:00:00 2001
From: Time Markov <time.markov@qtum.com>
Date: Fri, 15 Mar 2019 12:53:44 +0100
Subject: [PATCH 070/153] Add QIP 6 block height parameter

---
 src/chainparams.cpp              | 11 +++++++++++
 src/chainparams.h                |  2 ++
 src/consensus/params.h           |  2 ++
 src/cpp-ethereum                 |  2 +-
 src/init.cpp                     |  2 +-
 src/test/qtumtests/dgp_tests.cpp |  4 +++-
 src/test/test_bitcoin.cpp        |  2 +-
 src/util.cpp                     | 25 +++++++++++++++++++++++++
 src/util.h                       |  2 ++
 9 files changed, 48 insertions(+), 4 deletions(-)

diff --git a/src/chainparams.cpp b/src/chainparams.cpp
index a1345f292..013b0d864 100644
--- a/src/chainparams.cpp
+++ b/src/chainparams.cpp
@@ -89,6 +89,7 @@ class CMainParams : public CChainParams {
         consensus.BIP34Hash = uint256S("0x000075aef83cf2853580f8ae8ce6f8c3096cfa21d98334d6e3f95e5582ed986c");
         consensus.BIP65Height = 0; // 000000000000000004c2b624ed5d7756c508d90fd0da2c7c679febfa6c4735f0
         consensus.BIP66Height = 0; // 00000000000000000379eaa19dce8c9b722d46ae6a57c2f1a988119488b50931
+        consensus.QIP6Height = 0x7fffffff;
         consensus.powLimit = uint256S("0000ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff");
         consensus.posLimit = uint256S("00000000ffffffffffffffffffffffffffffffffffffffffffffffffffffffff");
         consensus.nPowTargetTimespan = 16 * 60; // 16 minutes
@@ -206,6 +207,7 @@ class CTestNetParams : public CChainParams {
         consensus.BIP34Hash = uint256S("0x0000e803ee215c0684ca0d2f9220594d3f828617972aad66feb2ba51f5e14222");
         consensus.BIP65Height = 0; // 00000000007f6655f22f98e72ed80d8b06dc761d5da09df0fa1dc4be4f861eb6
         consensus.BIP66Height = 0; // 000000002104c8c45e99a8853285a3b592602a3ccde2b832481da85e9e4ba182
+        consensus.QIP6Height = 0x7fffffff;
         consensus.powLimit = uint256S("0000ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff");
         consensus.posLimit = uint256S("0000ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff");
         consensus.nPowTargetTimespan = 16 * 60; // 16 minutes
@@ -311,6 +313,7 @@ class CRegTestParams : public CChainParams {
         consensus.BIP34Hash = uint256S("0x665ed5b402ac0b44efc37d8926332994363e8a7278b7ee9a58fb972efadae943");
         consensus.BIP65Height = 0; // BIP65 activated on regtest (Used in rpc activation tests)
         consensus.BIP66Height = 0; // BIP66 activated on regtest (Used in rpc activation tests)
+        consensus.QIP6Height = 0x7fffffff;
         consensus.powLimit = uint256S("7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff");
         consensus.posLimit = uint256S("7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff");
         consensus.nPowTargetTimespan = 16 * 60; // 16 minutes
@@ -400,6 +403,7 @@ class CUnitTestParams : public CRegTestParams
         consensus.BIP34Hash = uint256();
         consensus.BIP65Height = 1351; // BIP65 activated on regtest (Used in rpc activation tests)
         consensus.BIP66Height = 1251; // BIP66 activated on regtest (Used in rpc activation tests)
+        consensus.QIP6Height = 0x7fffffff;
 
         // QTUM have 500 blocks of maturity, increased values for regtest in unit tests in order to correspond with it
         consensus.nSubsidyHalvingInterval = 750;
@@ -438,3 +442,10 @@ void UpdateVersionBitsParameters(Consensus::DeploymentPos d, int64_t nStartTime,
 {
     globalChainParams->UpdateVersionBitsParameters(d, nStartTime, nTimeout);
 }
+
+std::string CChainParams::EVMGenesisInfo(dev::eth::Network network) const
+{
+    std::string genesisInfo = dev::eth::genesisInfo(network);
+    ReplaceInt(consensus.QIP6Height, "QIP6_STARTING_BLOCK", genesisInfo);
+    return genesisInfo;
+}
diff --git a/src/chainparams.h b/src/chainparams.h
index 722e52ff4..60597123d 100644
--- a/src/chainparams.h
+++ b/src/chainparams.h
@@ -10,6 +10,7 @@
 #include <consensus/params.h>
 #include <primitives/block.h>
 #include <protocol.h>
+#include <libethashseal/GenesisInfo.h>
 
 #include <memory>
 #include <vector>
@@ -81,6 +82,7 @@ class CChainParams
     const CCheckpointData& Checkpoints() const { return checkpointData; }
     const ChainTxData& TxData() const { return chainTxData; }
     void UpdateVersionBitsParameters(Consensus::DeploymentPos d, int64_t nStartTime, int64_t nTimeout);
+    std::string EVMGenesisInfo(dev::eth::Network network) const;
 protected:
     CChainParams() {}
 
diff --git a/src/consensus/params.h b/src/consensus/params.h
index bf3737d47..6496540cc 100644
--- a/src/consensus/params.h
+++ b/src/consensus/params.h
@@ -58,6 +58,8 @@ struct Params {
     int BIP65Height;
     /** Block height at which BIP66 becomes active */
     int BIP66Height;
+    /** Block height at which QIP6 becomes active */
+    int QIP6Height;
     /**
      * Minimum blocks including miner confirmation of the total of 2016 blocks in a retargeting period,
      * (nPowTargetTimespan / nPowTargetSpacing) which is also used for BIP9 deployments.
diff --git a/src/cpp-ethereum b/src/cpp-ethereum
index d6081ecc9..6b9a538ce 160000
--- a/src/cpp-ethereum
+++ b/src/cpp-ethereum
@@ -1 +1 @@
-Subproject commit d6081ecc98e3c5f4701363672a3e6a8e875d74b2
+Subproject commit 6b9a538ce46a8c5b4dc421fa718888957f97e908
diff --git a/src/init.cpp b/src/init.cpp
index 2dc66e3a4..e3bab77cd 100644
--- a/src/init.cpp
+++ b/src/init.cpp
@@ -1586,7 +1586,7 @@ bool AppInitMain()
                 const dev::h256 hashDB(dev::sha3(dev::rlp("")));
                 dev::eth::BaseState existsQtumstate = fStatus ? dev::eth::BaseState::PreExisting : dev::eth::BaseState::Empty;
                 globalState = std::unique_ptr<QtumState>(new QtumState(dev::u256(0), QtumState::openDB(dirQtum, hashDB, dev::WithExisting::Trust), dirQtum, existsQtumstate));
-                dev::eth::ChainParams cp((dev::eth::genesisInfo(dev::eth::Network::qtumMainNetwork)));
+                dev::eth::ChainParams cp((chainparams.EVMGenesisInfo(dev::eth::Network::qtumMainNetwork)));
                 globalSealEngine = std::unique_ptr<dev::eth::SealEngineFace>(cp.createSealEngine());
 
                 pstorageresult.reset(new StorageResults(qtumStateDir.string()));
diff --git a/src/test/qtumtests/dgp_tests.cpp b/src/test/qtumtests/dgp_tests.cpp
index da5d824e9..d8cee9eba 100644
--- a/src/test/qtumtests/dgp_tests.cpp
+++ b/src/test/qtumtests/dgp_tests.cpp
@@ -1,6 +1,7 @@
 #include <boost/test/unit_test.hpp>
 #include <qtumtests/test_utils.h>
 #include <script/standard.h>
+#include <chainparams.h>
 
 namespace dgpTest{
 
@@ -283,7 +284,8 @@ EVMScheduleCustom EVMScheduleContractGasSchedule3(true,true,true,true,{{13,13,10
 dev::h256 hash = dev::h256(ParseHex("aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"));
 
 void contractLoading(){
-    dev::eth::ChainParams cp((dev::eth::genesisInfo(dev::eth::Network::qtumMainNetwork)));
+    const CChainParams& chainparams = Params();
+    dev::eth::ChainParams cp((chainparams.EVMGenesisInfo(dev::eth::Network::qtumMainNetwork)));
     globalState->populateFrom(cp.genesisState);
     globalSealEngine = std::unique_ptr<dev::eth::SealEngineFace>(cp.createSealEngine());
     globalState->db().commit();
diff --git a/src/test/test_bitcoin.cpp b/src/test/test_bitcoin.cpp
index 71ee9f902..b5b48d8d4 100755
--- a/src/test/test_bitcoin.cpp
+++ b/src/test/test_bitcoin.cpp
@@ -100,7 +100,7 @@ TestingSetup::TestingSetup(const std::string& chainName) : BasicTestingSetup(cha
         boost::filesystem::create_directories(pathTemp);
         const dev::h256 hashDB(dev::sha3(dev::rlp("")));
         globalState = std::unique_ptr<QtumState>(new QtumState(dev::u256(0), QtumState::openDB(pathTemp.string(), hashDB, dev::WithExisting::Trust), pathTemp.string(), dev::eth::BaseState::Empty));
-        dev::eth::ChainParams cp((dev::eth::genesisInfo(dev::eth::Network::qtumTestNetwork)));
+        dev::eth::ChainParams cp((chainparams.EVMGenesisInfo(dev::eth::Network::qtumTestNetwork)));
         globalSealEngine = std::unique_ptr<dev::eth::SealEngineFace>(cp.createSealEngine());
         globalState->populateFrom(cp.genesisState);
         globalState->setRootUTXO(uintToh256(chainparams.GenesisBlock().hashUTXORoot));
diff --git a/src/util.cpp b/src/util.cpp
index 8ec63ffd3..5d357e60c 100644
--- a/src/util.cpp
+++ b/src/util.cpp
@@ -9,6 +9,7 @@
 #include <random.h>
 #include <serialize.h>
 #include <utilstrencodings.h>
+#include <regex>
 
 #include <stdarg.h>
 
@@ -1259,3 +1260,27 @@ int ScheduleBatchPriority(void)
     return 1;
 #endif
 }
+
+std::string toHexString(int64_t intValue) {
+
+    std::string hexStr;
+
+    // Integer value to hex string
+    std::stringstream sstream;
+    sstream << "0x" << std::setfill ('0') << std::setw(2) << std::hex << (int64_t)intValue;
+
+    hexStr= sstream.str();
+    sstream.clear();
+
+    return hexStr;
+}
+
+void ReplaceInt(const int64_t& number, const std::string& key, std::string& str)
+{
+    // Convert the number into hex string
+    std::string num_hex = toHexString(number);
+
+    // Search for key in str and replace it with the hex string
+    std::string str_replaced = std::regex_replace(str, std::regex(key), num_hex);
+    str = str_replaced;
+}
diff --git a/src/util.h b/src/util.h
index 29173cc83..c57677577 100644
--- a/src/util.h
+++ b/src/util.h
@@ -378,6 +378,8 @@ std::string CopyrightHolders(const std::string& strPrefix);
 
 bool CheckHex(const std::string& str);
 
+void ReplaceInt(const int64_t& number, const std::string& key, std::string& str);
+
 /**
  * On platforms that support it, tell the kernel the calling thread is
  * CPU-intensive and non-interactive. See SCHED_BATCH in sched(7) for details.

From be1f156eef53d5b571d6b9e9d2b762d55dac9cb3 Mon Sep 17 00:00:00 2001
From: Time Markov <time.markov@qtum.com>
Date: Mon, 18 Mar 2019 12:58:03 +0100
Subject: [PATCH 071/153] Add btc_ecrecover unit tests

---
 src/Makefile.test.include                     |   3 +-
 src/chainparams.cpp                           |   2 +-
 src/test/qtumtests/btcecrecoverfork_tests.cpp | 125 ++++++++++++++++++
 3 files changed, 128 insertions(+), 2 deletions(-)
 create mode 100644 src/test/qtumtests/btcecrecoverfork_tests.cpp

diff --git a/src/Makefile.test.include b/src/Makefile.test.include
index e180c8944..d212059db 100644
--- a/src/Makefile.test.include
+++ b/src/Makefile.test.include
@@ -95,7 +95,8 @@ BITCOIN_TESTS =\
   test/qtumtests/qtumtxconverter_tests.cpp \
   test/qtumtests/bytecodeexec_tests.cpp \
   test/qtumtests/condensingtransaction_tests.cpp \
-  test/qtumtests/dgp_tests.cpp
+  test/qtumtests/dgp_tests.cpp \
+  test/qtumtests/btcecrecoverfork_tests.cpp
 
 if ENABLE_WALLET
 BITCOIN_TESTS += \
diff --git a/src/chainparams.cpp b/src/chainparams.cpp
index 013b0d864..66f2c61dc 100644
--- a/src/chainparams.cpp
+++ b/src/chainparams.cpp
@@ -403,7 +403,7 @@ class CUnitTestParams : public CRegTestParams
         consensus.BIP34Hash = uint256();
         consensus.BIP65Height = 1351; // BIP65 activated on regtest (Used in rpc activation tests)
         consensus.BIP66Height = 1251; // BIP66 activated on regtest (Used in rpc activation tests)
-        consensus.QIP6Height = 0x7fffffff;
+        consensus.QIP6Height = 1000;
 
         // QTUM have 500 blocks of maturity, increased values for regtest in unit tests in order to correspond with it
         consensus.nSubsidyHalvingInterval = 750;
diff --git a/src/test/qtumtests/btcecrecoverfork_tests.cpp b/src/test/qtumtests/btcecrecoverfork_tests.cpp
new file mode 100644
index 000000000..8983e61d7
--- /dev/null
+++ b/src/test/qtumtests/btcecrecoverfork_tests.cpp
@@ -0,0 +1,125 @@
+#include <boost/test/unit_test.hpp>
+#include <qtumtests/test_utils.h>
+#include <script/standard.h>
+#include <chainparams.h>
+
+namespace BtcEcrecoverTest{
+
+dev::u256 GASLIMIT = dev::u256(500000);
+dev::h256 HASHTX = dev::h256(ParseHex("aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"));
+
+// Contract for btc_ecrecover check
+std::vector<valtype> CODE = {
+    /*
+    pragma solidity ^0.4.0;
+    library Crypto {
+        function btc_ecrecover(bytes32 msgh, uint8 v, bytes32 r, bytes32 s) public view returns(bytes key)
+        {
+            uint256[4] memory input;
+            input[0] = uint256(msgh);
+            input[1] = v;
+            input[2] = uint256(r);
+            input[3] = uint256(s);
+
+            uint256[2] memory p;
+            assembly
+            {
+                if iszero(call(not(0), 0x85, 0, input, 0x80, p, 0x40))
+                {
+                    revert(0, 0)
+                }
+            }
+            key = toBytes(p[0]);
+        }
+
+        function toBytes(uint256 x) internal pure returns (bytes b)
+        {
+            b = new bytes(32);
+            assembly { mstore(add(b, 32), x) }
+        }
+    }
+    */
+    // Contract that call btc_ecrecover
+    valtype(ParseHex("6060604052341561000f57600080fd5b6102958061001e6000396000f300606060405260043610610041576000357c0100000000000000000000000000000000000000000000000000000000900463ffffffff16806369bc096314610046575b600080fd5b61008660048080356000191690602001909190803560ff169060200190919080356000191690602001909190803560001916906020019091905050610101565b6040518080602001828103825283818151815260200191508051906020019080838360005b838110156100c65780820151818401526020810190506100ab565b50505050905090810190601f1680156100f35780820380516001836020036101000a031916815260200191505b509250505060405180910390f35b610109610206565b61011161021a565b610119610242565b866001900482600060048110151561012d57fe5b6020020181815250508560ff1682600160048110151561014957fe5b602002018181525050846001900482600260048110151561016657fe5b602002018181525050836001900482600360048110151561018357fe5b60200201818152505060408160808460006085600019f115156101a557600080fd5b6101c18160006002811015156101b757fe5b60200201516101cd565b92505050949350505050565b6101d5610206565b60206040518059106101e45750595b9080825280601f01601f19166020018201604052509050816020820152919050565b602060405190810160405280600081525090565b6080604051908101604052806004905b600081526020019060019003908161022a5790505090565b60408051908101604052806002905b600081526020019060019003908161025157905050905600a165627a7a72305820f7efe1b53a84d5eb09de6a3e8468390253480c7028e7985fc5d7cf546771f5c60029")),
+
+    // btc_ecrecover(bytes32 msgh, uint8 v, bytes32 r, bytes32 s)
+    valtype(ParseHex("69bc09631476abb745d423bf09273f1afd887d951181d25adc66c4834a70491911b7f750000000000000000000000000000000000000000000000000000000000000001ce6ca9bba58c88611fad66a6ce8f996908195593807c4b38bd528d2cff09d4eb33e5bfbbf4d3e39b1a2fd816a7680c19ebebaf3a141b239934ad43cb33fcec8ce")),
+
+    // Valid key result
+    valtype(ParseHex("0000000000000000000000005b0bf163d8d62090d634bc5c20bb47602cc686fe")),
+
+    // Not valid key result
+    valtype(ParseHex("0000000000000000000000000000000000000000000000000000000000000000"))
+};
+
+dev::bytes parseOutput(const dev::bytes& output)
+{
+    return dev::bytes(output.begin() + 64, output.end());
+}
+
+void genesisLoading(){
+    const CChainParams& chainparams = Params();
+    dev::eth::ChainParams cp((chainparams.EVMGenesisInfo(dev::eth::Network::qtumMainNetwork)));
+    globalState->populateFrom(cp.genesisState);
+    globalSealEngine = std::unique_ptr<dev::eth::SealEngineFace>(cp.createSealEngine());
+    globalState->db().commit();
+}
+
+void createNewBlocks(TestChain100Setup* testChain100Setup, size_t n){
+    std::function<void(size_t n)> generateBlocks = [&](size_t n){
+        dev::h256 oldHashStateRoot = globalState->rootHash();
+        dev::h256 oldHashUTXORoot = globalState->rootHashUTXO();
+        for(size_t i = 0; i < n; i++){
+            testChain100Setup->CreateAndProcessBlock({}, GetScriptForRawPubKey(testChain100Setup->coinbaseKey.GetPubKey()));
+        }
+        globalState->setRoot(oldHashStateRoot);
+        globalState->setRootUTXO(oldHashUTXORoot);
+    };
+
+    generateBlocks(n);
+}
+BOOST_FIXTURE_TEST_SUITE(btcecrecoverfork_tests, TestChain100Setup)
+
+BOOST_AUTO_TEST_CASE(checking_constantinople_after_fork){
+    // Initialize
+    initState();
+    genesisLoading();
+    createNewBlocks(this,999 - COINBASE_MATURITY);
+
+    // Create contract
+    std::vector<QtumTransaction> txs;
+    txs.push_back(createQtumTransaction(CODE[0], 0, GASLIMIT, dev::u256(1), HASHTX, dev::Address()));
+    executeBC(txs);
+
+    // Call btc_ecrecover
+    dev::Address proxy = createQtumAddress(txs[0].getHashWith(), txs[0].getNVout());
+    std::vector<QtumTransaction> txBtcEcrecover;
+    txBtcEcrecover.push_back(createQtumTransaction(CODE[1], 0, GASLIMIT, dev::u256(1), ++HASHTX, proxy));
+    auto result = executeBC(txBtcEcrecover);
+    dev::bytes output = parseOutput(result.first[0].execRes.output);
+    BOOST_CHECK(dev::h256(output) == dev::h256(CODE[2]));
+}
+
+BOOST_AUTO_TEST_CASE(checking_constantinople_before_fork){
+    // Initialize
+    initState();
+    genesisLoading();
+    createNewBlocks(this,998 - COINBASE_MATURITY);
+
+    // Create contract
+    std::vector<QtumTransaction> txs;
+    txs.push_back(createQtumTransaction(CODE[0], 0, GASLIMIT, dev::u256(1), HASHTX, dev::Address()));
+    executeBC(txs);
+
+    // Call btc_ecrecover
+    dev::Address proxy = createQtumAddress(txs[0].getHashWith(), txs[0].getNVout());
+    std::vector<QtumTransaction> txBtcEcrecover;
+    txBtcEcrecover.push_back(createQtumTransaction(CODE[1], 0, GASLIMIT, dev::u256(1), ++HASHTX, proxy));
+    auto result = executeBC(txBtcEcrecover);
+    dev::bytes output = parseOutput(result.first[0].execRes.output);
+    BOOST_CHECK(dev::h256(output) == dev::h256(CODE[3]));
+}
+
+BOOST_AUTO_TEST_SUITE_END()
+
+}

From a98bf37e565b3ed32dcbd0642039f614350807ea Mon Sep 17 00:00:00 2001
From: Time Markov <time.markov@qtum.com>
Date: Tue, 19 Mar 2019 11:45:40 +0100
Subject: [PATCH 072/153] Add qtumutils

---
 src/Makefile.am        |  4 +++-
 src/cpp-ethereum       |  2 +-
 src/qtum/qtumutils.cpp | 31 +++++++++++++++++++++++++++++++
 src/qtum/qtumutils.h   | 18 ++++++++++++++++++
 4 files changed, 53 insertions(+), 2 deletions(-)
 create mode 100644 src/qtum/qtumutils.cpp
 create mode 100644 src/qtum/qtumutils.h

diff --git a/src/Makefile.am b/src/Makefile.am
index 4036a6f08..6fc3a9611 100644
--- a/src/Makefile.am
+++ b/src/Makefile.am
@@ -212,7 +212,8 @@ BITCOIN_CORE_H = \
   qtum/qtumstate.h \
   qtum/qtumtransaction.h \
   qtum/qtumDGP.h \
-  qtum/storageresults.h
+  qtum/storageresults.h \
+  qtum/qtumutils.h
 
 
 obj/build.h: FORCE
@@ -427,6 +428,7 @@ libbitcoin_common_a_SOURCES = \
   script/sign.cpp \
   script/standard.cpp \
   warnings.cpp \
+  qtum/qtumutils.cpp \
   cpp-ethereum/libdevcore/Base64.cpp \
   cpp-ethereum/libdevcore/Base64.h \
   cpp-ethereum/libdevcore/Common.cpp \
diff --git a/src/cpp-ethereum b/src/cpp-ethereum
index 6b9a538ce..8074548f6 160000
--- a/src/cpp-ethereum
+++ b/src/cpp-ethereum
@@ -1 +1 @@
-Subproject commit 6b9a538ce46a8c5b4dc421fa718888957f97e908
+Subproject commit 8074548f699cc40667167c7a582d7cbbe5374a32
diff --git a/src/qtum/qtumutils.cpp b/src/qtum/qtumutils.cpp
new file mode 100644
index 000000000..99c473826
--- /dev/null
+++ b/src/qtum/qtumutils.cpp
@@ -0,0 +1,31 @@
+#include <qtum/qtumutils.h>
+#include <libdevcore/CommonData.h>
+#include <pubkey.h>
+
+using namespace dev;
+
+bool qtumutils::btc_ecrecover(const dev::h256 &hash, const dev::u256 &v, const dev::h256 &r, const dev::h256 &s, dev::h256 &key)
+{
+    // Convert the data into format usable for btc
+    CPubKey pubKey;
+    std::vector<unsigned char> vchSig;
+    vchSig.push_back((unsigned char)v);
+    vchSig += r.asBytes();
+    vchSig += s.asBytes();
+    uint256 mesage = h256Touint(hash);
+
+    // Recover public key from compact signature (65 bytes)
+    // The public key can be compressed (33 bytes) or uncompressed (65 bytes)
+    // Pubkeyhash is RIPEMD160 hash of the public key, handled both types
+    if(pubKey.RecoverCompact(mesage, vchSig))
+    {
+        // Get the pubkeyhash
+        CKeyID id = pubKey.GetID();
+        size_t padding = sizeof(key) - sizeof(id);
+        memset(key.data(), 0, padding);
+        memcpy(key.data() + padding, id.begin(), sizeof(id));
+        return true;
+    }
+
+    return false;
+}
diff --git a/src/qtum/qtumutils.h b/src/qtum/qtumutils.h
new file mode 100644
index 000000000..cd4e233e5
--- /dev/null
+++ b/src/qtum/qtumutils.h
@@ -0,0 +1,18 @@
+#ifndef QTUMUTILS_H
+#define QTUMUTILS_H
+
+#include <libdevcore/Common.h>
+#include <libdevcore/FixedHash.h>
+
+/**
+ * qtumutils Provides utility functions to EVM for functionalities that already exist in qtum
+ */
+namespace qtumutils
+{
+/**
+ * @brief btc_ecrecover Wrapper to CPubKey::RecoverCompact
+ */
+bool btc_ecrecover(dev::h256 const& hash, dev::u256 const& v, dev::h256 const& r, dev::h256 const& s, dev::h256 & key);
+}
+
+#endif

From aa65c3c866934ed0d2392f401bd770b74ffb3ad5 Mon Sep 17 00:00:00 2001
From: Time Markov <time.markov@qtum.com>
Date: Tue, 19 Mar 2019 13:03:38 +0100
Subject: [PATCH 073/153] Fix unit test names

---
 src/test/qtumtests/btcecrecoverfork_tests.cpp | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/test/qtumtests/btcecrecoverfork_tests.cpp b/src/test/qtumtests/btcecrecoverfork_tests.cpp
index 8983e61d7..cd5b1f01e 100644
--- a/src/test/qtumtests/btcecrecoverfork_tests.cpp
+++ b/src/test/qtumtests/btcecrecoverfork_tests.cpp
@@ -80,7 +80,7 @@ void createNewBlocks(TestChain100Setup* testChain100Setup, size_t n){
 }
 BOOST_FIXTURE_TEST_SUITE(btcecrecoverfork_tests, TestChain100Setup)
 
-BOOST_AUTO_TEST_CASE(checking_constantinople_after_fork){
+BOOST_AUTO_TEST_CASE(checking_btcecrecover_after_fork){
     // Initialize
     initState();
     genesisLoading();
@@ -100,7 +100,7 @@ BOOST_AUTO_TEST_CASE(checking_constantinople_after_fork){
     BOOST_CHECK(dev::h256(output) == dev::h256(CODE[2]));
 }
 
-BOOST_AUTO_TEST_CASE(checking_constantinople_before_fork){
+BOOST_AUTO_TEST_CASE(checking_btcecrecover_before_fork){
     // Initialize
     initState();
     genesisLoading();

From 2fafcc699aef1c6a2106525c2062102fea030035 Mon Sep 17 00:00:00 2001
From: Time Markov <time.markov@qtum.com>
Date: Tue, 19 Mar 2019 14:04:30 +0100
Subject: [PATCH 074/153] Update submodule

---
 src/cpp-ethereum | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/cpp-ethereum b/src/cpp-ethereum
index 8074548f6..7bbe53720 160000
--- a/src/cpp-ethereum
+++ b/src/cpp-ethereum
@@ -1 +1 @@
-Subproject commit 8074548f699cc40667167c7a582d7cbbe5374a32
+Subproject commit 7bbe53720c41fa7a30f30aefb3694c628e51c2e7

From ac40a018901b61ee5bc680ce9f76c65eea801213 Mon Sep 17 00:00:00 2001
From: Time Markov <time.markov@qtum.com>
Date: Tue, 19 Mar 2019 14:37:18 +0100
Subject: [PATCH 075/153] Check input parameters btc_ecrecover

---
 src/qtum/qtumutils.cpp | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/src/qtum/qtumutils.cpp b/src/qtum/qtumutils.cpp
index 99c473826..5ab2ffded 100644
--- a/src/qtum/qtumutils.cpp
+++ b/src/qtum/qtumutils.cpp
@@ -6,6 +6,13 @@ using namespace dev;
 
 bool qtumutils::btc_ecrecover(const dev::h256 &hash, const dev::u256 &v, const dev::h256 &r, const dev::h256 &s, dev::h256 &key)
 {
+    // Check input parameters
+    if(v >= 256)
+    {
+        // Does not fit into 1 byte
+        return false;
+    }
+
     // Convert the data into format usable for btc
     CPubKey pubKey;
     std::vector<unsigned char> vchSig;

From 871df2ad9501d6fda690eff705d846a4648beaf2 Mon Sep 17 00:00:00 2001
From: Time Markov <time.markov@qtum.com>
Date: Tue, 19 Mar 2019 15:42:46 +0100
Subject: [PATCH 076/153] Add btc_ecrecover address tests for multiple values
 of version

---
 src/test/qtumtests/btcecrecoverfork_tests.cpp | 63 ++++++++++++++++---
 1 file changed, 54 insertions(+), 9 deletions(-)

diff --git a/src/test/qtumtests/btcecrecoverfork_tests.cpp b/src/test/qtumtests/btcecrecoverfork_tests.cpp
index cd5b1f01e..5210866c2 100644
--- a/src/test/qtumtests/btcecrecoverfork_tests.cpp
+++ b/src/test/qtumtests/btcecrecoverfork_tests.cpp
@@ -12,8 +12,9 @@ dev::h256 HASHTX = dev::h256(ParseHex("aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
 std::vector<valtype> CODE = {
     /*
     pragma solidity ^0.4.0;
-    library Crypto {
-        function btc_ecrecover(bytes32 msgh, uint8 v, bytes32 r, bytes32 s) public view returns(bytes key)
+    library Crypto
+    {
+        function btc_ecrecover(bytes32 msgh, uint8 v, bytes32 r, bytes32 s) public view returns(bytes addr)
         {
             uint256[4] memory input;
             input[0] = uint256(msgh);
@@ -29,7 +30,7 @@ std::vector<valtype> CODE = {
                     revert(0, 0)
                 }
             }
-            key = toBytes(p[0]);
+            addr = toBytes(p[0]);
         }
 
         function toBytes(uint256 x) internal pure returns (bytes b)
@@ -40,15 +41,33 @@ std::vector<valtype> CODE = {
     }
     */
     // Contract that call btc_ecrecover
-    valtype(ParseHex("6060604052341561000f57600080fd5b6102958061001e6000396000f300606060405260043610610041576000357c0100000000000000000000000000000000000000000000000000000000900463ffffffff16806369bc096314610046575b600080fd5b61008660048080356000191690602001909190803560ff169060200190919080356000191690602001909190803560001916906020019091905050610101565b6040518080602001828103825283818151815260200191508051906020019080838360005b838110156100c65780820151818401526020810190506100ab565b50505050905090810190601f1680156100f35780820380516001836020036101000a031916815260200191505b509250505060405180910390f35b610109610206565b61011161021a565b610119610242565b866001900482600060048110151561012d57fe5b6020020181815250508560ff1682600160048110151561014957fe5b602002018181525050846001900482600260048110151561016657fe5b602002018181525050836001900482600360048110151561018357fe5b60200201818152505060408160808460006085600019f115156101a557600080fd5b6101c18160006002811015156101b757fe5b60200201516101cd565b92505050949350505050565b6101d5610206565b60206040518059106101e45750595b9080825280601f01601f19166020018201604052509050816020820152919050565b602060405190810160405280600081525090565b6080604051908101604052806004905b600081526020019060019003908161022a5790505090565b60408051908101604052806002905b600081526020019060019003908161025157905050905600a165627a7a72305820f7efe1b53a84d5eb09de6a3e8468390253480c7028e7985fc5d7cf546771f5c60029")),
+    valtype(ParseHex("61029e610030600b82828239805160001a6073146000811461002057610022565bfe5b5030600052607381538281f3007300000000000000000000000000000000000000003014608060405260043610610058576000357c0100000000000000000000000000000000000000000000000000000000900463ffffffff16806369bc09631461005d575b600080fd5b6100a86004803603810190808035600019169060200190929190803560ff16906020019092919080356000191690602001909291908035600019169060200190929190505050610123565b6040518080602001828103825283818151815260200191508051906020019080838360005b838110156100e85780820151818401526020810190506100cd565b50505050905090810190601f1680156101155780820380516001836020036101000a031916815260200191505b509250505060405180910390f35b606061012d61022d565b610135610250565b866001900482600060048110151561014957fe5b6020020181815250508560ff1682600160048110151561016557fe5b602002018181525050846001900482600260048110151561018257fe5b602002018181525050836001900482600360048110151561019f57fe5b60200201818152505060408160808460006085600019f115156101c157600080fd5b6101dd8160006002811015156101d357fe5b60200201516101e9565b92505050949350505050565b606060206040519080825280601f01601f19166020018201604052801561021f5781602001602082028038833980820191505090505b509050816020820152919050565b608060405190810160405280600490602082028038833980820191505090505090565b60408051908101604052806002906020820280388339808201915050905050905600a165627a7a723058202c030fcf0261d136398030f4a0109ecc4c041333bf65bcbd4995b2f8332926890029")),
 
-    // btc_ecrecover(bytes32 msgh, uint8 v, bytes32 r, bytes32 s)
+    // btc_ecrecover(bytes32 msgh, uint8 v, bytes32 r, bytes32 s) v=27
+    valtype(ParseHex("69bc09631476abb745d423bf09273f1afd887d951181d25adc66c4834a70491911b7f750000000000000000000000000000000000000000000000000000000000000001be6ca9bba58c88611fad66a6ce8f996908195593807c4b38bd528d2cff09d4eb33e5bfbbf4d3e39b1a2fd816a7680c19ebebaf3a141b239934ad43cb33fcec8ce")),
+
+    // btc_ecrecover(bytes32 msgh, uint8 v, bytes32 r, bytes32 s) v=28
     valtype(ParseHex("69bc09631476abb745d423bf09273f1afd887d951181d25adc66c4834a70491911b7f750000000000000000000000000000000000000000000000000000000000000001ce6ca9bba58c88611fad66a6ce8f996908195593807c4b38bd528d2cff09d4eb33e5bfbbf4d3e39b1a2fd816a7680c19ebebaf3a141b239934ad43cb33fcec8ce")),
 
-    // Valid key result
+    // btc_ecrecover(bytes32 msgh, uint8 v, bytes32 r, bytes32 s) v=31
+    valtype(ParseHex("69bc09631476abb745d423bf09273f1afd887d951181d25adc66c4834a70491911b7f750000000000000000000000000000000000000000000000000000000000000001fe6ca9bba58c88611fad66a6ce8f996908195593807c4b38bd528d2cff09d4eb33e5bfbbf4d3e39b1a2fd816a7680c19ebebaf3a141b239934ad43cb33fcec8ce")),
+
+    // btc_ecrecover(bytes32 msgh, uint8 v, bytes32 r, bytes32 s) v=32
+    valtype(ParseHex("69bc09631476abb745d423bf09273f1afd887d951181d25adc66c4834a70491911b7f7500000000000000000000000000000000000000000000000000000000000000020e6ca9bba58c88611fad66a6ce8f996908195593807c4b38bd528d2cff09d4eb33e5bfbbf4d3e39b1a2fd816a7680c19ebebaf3a141b239934ad43cb33fcec8ce")),
+
+    // Valid address result v=27
+    valtype(ParseHex("00000000000000000000000011f50cfcb40d4e0bcdb4c728664d26bd969c8661")),
+
+    // Valid address result v=28
     valtype(ParseHex("0000000000000000000000005b0bf163d8d62090d634bc5c20bb47602cc686fe")),
 
-    // Not valid key result
+    // Valid address result v=31
+    valtype(ParseHex("000000000000000000000000931c1f36709cd3aa8623a38db7a905d31ddf97e3")),
+
+    // Valid address result v=32
+    valtype(ParseHex("000000000000000000000000575e154116a125cee7053db093d94c6fb522144f")),
+
+    // Not valid address result
     valtype(ParseHex("0000000000000000000000000000000000000000000000000000000000000000"))
 };
 
@@ -95,9 +114,22 @@ BOOST_AUTO_TEST_CASE(checking_btcecrecover_after_fork){
     dev::Address proxy = createQtumAddress(txs[0].getHashWith(), txs[0].getNVout());
     std::vector<QtumTransaction> txBtcEcrecover;
     txBtcEcrecover.push_back(createQtumTransaction(CODE[1], 0, GASLIMIT, dev::u256(1), ++HASHTX, proxy));
+    txBtcEcrecover.push_back(createQtumTransaction(CODE[2], 0, GASLIMIT, dev::u256(1), ++HASHTX, proxy));
+    txBtcEcrecover.push_back(createQtumTransaction(CODE[3], 0, GASLIMIT, dev::u256(1), ++HASHTX, proxy));
+    txBtcEcrecover.push_back(createQtumTransaction(CODE[4], 0, GASLIMIT, dev::u256(1), ++HASHTX, proxy));
+
+    // Execute contracts
     auto result = executeBC(txBtcEcrecover);
+
+    // Check results
     dev::bytes output = parseOutput(result.first[0].execRes.output);
-    BOOST_CHECK(dev::h256(output) == dev::h256(CODE[2]));
+    BOOST_CHECK(dev::h256(output) == dev::h256(CODE[5]));
+    output = parseOutput(result.first[1].execRes.output);
+    BOOST_CHECK(dev::h256(output) == dev::h256(CODE[6]));
+    output = parseOutput(result.first[2].execRes.output);
+    BOOST_CHECK(dev::h256(output) == dev::h256(CODE[7]));
+    output = parseOutput(result.first[3].execRes.output);
+    BOOST_CHECK(dev::h256(output) == dev::h256(CODE[8]));
 }
 
 BOOST_AUTO_TEST_CASE(checking_btcecrecover_before_fork){
@@ -115,9 +147,22 @@ BOOST_AUTO_TEST_CASE(checking_btcecrecover_before_fork){
     dev::Address proxy = createQtumAddress(txs[0].getHashWith(), txs[0].getNVout());
     std::vector<QtumTransaction> txBtcEcrecover;
     txBtcEcrecover.push_back(createQtumTransaction(CODE[1], 0, GASLIMIT, dev::u256(1), ++HASHTX, proxy));
+    txBtcEcrecover.push_back(createQtumTransaction(CODE[2], 0, GASLIMIT, dev::u256(1), ++HASHTX, proxy));
+    txBtcEcrecover.push_back(createQtumTransaction(CODE[3], 0, GASLIMIT, dev::u256(1), ++HASHTX, proxy));
+    txBtcEcrecover.push_back(createQtumTransaction(CODE[4], 0, GASLIMIT, dev::u256(1), ++HASHTX, proxy));
+
+     // Execute contracts
     auto result = executeBC(txBtcEcrecover);
+
+    // Check results
     dev::bytes output = parseOutput(result.first[0].execRes.output);
-    BOOST_CHECK(dev::h256(output) == dev::h256(CODE[3]));
+    BOOST_CHECK(dev::h256(output) == dev::h256(CODE[9]));
+    output = parseOutput(result.first[1].execRes.output);
+    BOOST_CHECK(dev::h256(output) == dev::h256(CODE[9]));
+    output = parseOutput(result.first[2].execRes.output);
+    BOOST_CHECK(dev::h256(output) == dev::h256(CODE[9]));
+    output = parseOutput(result.first[3].execRes.output);
+    BOOST_CHECK(dev::h256(output) == dev::h256(CODE[9]));
 }
 
 BOOST_AUTO_TEST_SUITE_END()

From 7f2e224edddf3e1080835bf5e40ddcf947865646 Mon Sep 17 00:00:00 2001
From: Time Markov <time.markov@qtum.com>
Date: Mon, 13 May 2019 11:25:07 +0200
Subject: [PATCH 077/153] Update btc_ecrecover block height in regtest mode

---
 src/chainparams.cpp | 12 +++++++++++-
 src/chainparams.h   |  6 ++++++
 src/init.cpp        | 16 ++++++++++++++++
 3 files changed, 33 insertions(+), 1 deletion(-)

diff --git a/src/chainparams.cpp b/src/chainparams.cpp
index 66f2c61dc..58651438e 100644
--- a/src/chainparams.cpp
+++ b/src/chainparams.cpp
@@ -313,7 +313,7 @@ class CRegTestParams : public CChainParams {
         consensus.BIP34Hash = uint256S("0x665ed5b402ac0b44efc37d8926332994363e8a7278b7ee9a58fb972efadae943");
         consensus.BIP65Height = 0; // BIP65 activated on regtest (Used in rpc activation tests)
         consensus.BIP66Height = 0; // BIP66 activated on regtest (Used in rpc activation tests)
-        consensus.QIP6Height = 0x7fffffff;
+        consensus.QIP6Height = 0;
         consensus.powLimit = uint256S("7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff");
         consensus.posLimit = uint256S("7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff");
         consensus.nPowTargetTimespan = 16 * 60; // 16 minutes
@@ -449,3 +449,13 @@ std::string CChainParams::EVMGenesisInfo(dev::eth::Network network) const
     ReplaceInt(consensus.QIP6Height, "QIP6_STARTING_BLOCK", genesisInfo);
     return genesisInfo;
 }
+
+void CChainParams::UpdateBtcEcrecoverBlockHeight(int nHeight)
+{
+    consensus.QIP6Height = nHeight;
+}
+
+void UpdateBtcEcrecoverBlockHeight(int nHeight)
+{
+    globalChainParams->UpdateBtcEcrecoverBlockHeight(nHeight);
+}
diff --git a/src/chainparams.h b/src/chainparams.h
index 60597123d..7b3612abe 100644
--- a/src/chainparams.h
+++ b/src/chainparams.h
@@ -83,6 +83,7 @@ class CChainParams
     const ChainTxData& TxData() const { return chainTxData; }
     void UpdateVersionBitsParameters(Consensus::DeploymentPos d, int64_t nStartTime, int64_t nTimeout);
     std::string EVMGenesisInfo(dev::eth::Network network) const;
+    void UpdateBtcEcrecoverBlockHeight(int nHeight);
 protected:
     CChainParams() {}
 
@@ -128,4 +129,9 @@ void SelectParams(const std::string& chain);
  */
 void UpdateVersionBitsParameters(Consensus::DeploymentPos d, int64_t nStartTime, int64_t nTimeout);
 
+/**
+ * Allows modifying the btc_ecrecover block height regtest parameter.
+ */
+void UpdateBtcEcrecoverBlockHeight(int nHeight);
+
 #endif // BITCOIN_CHAINPARAMS_H
diff --git a/src/init.cpp b/src/init.cpp
index e3bab77cd..bfecb134e 100644
--- a/src/init.cpp
+++ b/src/init.cpp
@@ -496,6 +496,7 @@ void SetupServerArgs()
     gArgs.AddArg("-printtoconsole", "Send trace/debug info to console (default: 1 when no -daemon. To disable logging to file, set -nodebuglogfile)", false, OptionsCategory::DEBUG_TEST);
     gArgs.AddArg("-shrinkdebugfile", "Shrink debug.log file on client startup (default: 1 when no -debug)", false, OptionsCategory::DEBUG_TEST);
     gArgs.AddArg("-uacomment=<cmt>", "Append comment to the user agent string", false, OptionsCategory::DEBUG_TEST);
+    gArgs.AddArg("-btcecrecoverheight=<n>", "Use given block height to check btc_ecrecover fork (regtest-only)", true, OptionsCategory::DEBUG_TEST);
 
     SetupChainParamsBaseOptions();
 
@@ -1197,6 +1198,21 @@ bool AppInitParameterInteraction()
             }
         }
     }
+
+    if (gArgs.IsArgSet("-btcecrecoverheight")) {
+        // Allow overriding btc_ecrecover block for testing
+        if (!chainparams.MineBlocksOnDemand()) {
+            return InitError("Btc_ecrecover block height may only be overridden on regtest.");
+        }
+
+        int btcEcrecoverBlock = gArgs.GetArg("-btcecrecoverheight", 0);
+        if(btcEcrecoverBlock >= 0)
+        {
+            UpdateBtcEcrecoverBlockHeight(btcEcrecoverBlock);
+            LogPrintf("Activate btc_ecrecover at block height %d\n.", btcEcrecoverBlock);
+        }
+    }
+
     return true;
 }
 

From 1bde3e1a20f84d176c7a333c49ebea4957e870c9 Mon Sep 17 00:00:00 2001
From: Xuan Yan <xuanyan@xuanyan.ws>
Date: Sun, 21 Jul 2019 13:21:12 +0800
Subject: [PATCH 078/153] fix block height

---
 src/pow.cpp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/pow.cpp b/src/pow.cpp
index e0aa18145..9e4ac152f 100644
--- a/src/pow.cpp
+++ b/src/pow.cpp
@@ -88,7 +88,7 @@ unsigned int CalculateNextWorkRequired(const CBlockIndex* pindexLast, int64_t nF
     // ppcoin: retarget with exponential moving toward target spacing
     arith_uint256 bnNew;
     bnNew.SetCompact(pindexLast->nBits);
-    int64_t nInterval = params.DifficultyAdjustmentInterval(pindexLast->nHeight);
+    int64_t nInterval = params.DifficultyAdjustmentInterval(pindexLast->nHeight + 1);
     bnNew *= ((nInterval - 1) * nTargetSpacing + nActualSpacing + nActualSpacing);
     bnNew /= ((nInterval + 1) * nTargetSpacing);
 

From 733061a2b54d4d50365b07e9b48a9a8d455eadd6 Mon Sep 17 00:00:00 2001
From: Xuan Yan <xuanyan@xuanyan.ws>
Date: Sun, 21 Jul 2019 13:22:44 +0800
Subject: [PATCH 079/153] improve difficulty adjustment algorithm

---
 src/chainparams.cpp |  6 +++---
 src/pow.cpp         | 45 +++++++++++++++++++++++++++++++++++++--------
 2 files changed, 40 insertions(+), 11 deletions(-)

diff --git a/src/chainparams.cpp b/src/chainparams.cpp
index 5df879198..e57d87980 100644
--- a/src/chainparams.cpp
+++ b/src/chainparams.cpp
@@ -93,7 +93,7 @@ class CMainParams : public CChainParams {
         consensus.powLimit = uint256S("0000ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff");
         consensus.posLimit = uint256S("00000000ffffffffffffffffffffffffffffffffffffffffffffffffffffffff");
         consensus.nPowTargetTimespan = 16 * 60; // 16 minutes
-        consensus.nPowTargetTimespanV2 = 20128; // 5.59 hours
+        consensus.nPowTargetTimespanV2 = 4000;
         consensus.nPowTargetSpacing = 2 * 64;
         consensus.fPowAllowMinDifficultyBlocks = false;
         consensus.fPowNoRetargeting = true;
@@ -212,7 +212,7 @@ class CTestNetParams : public CChainParams {
         consensus.powLimit = uint256S("0000ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff");
         consensus.posLimit = uint256S("0000ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff");
         consensus.nPowTargetTimespan = 16 * 60; // 16 minutes
-        consensus.nPowTargetTimespanV2 = 20128; // 5.59 hours
+        consensus.nPowTargetTimespanV2 = 4000;
         consensus.nPowTargetSpacing = 2 * 64;
         consensus.fPowAllowMinDifficultyBlocks = false;
         consensus.fPowNoRetargeting = true;
@@ -319,7 +319,7 @@ class CRegTestParams : public CChainParams {
         consensus.powLimit = uint256S("7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff");
         consensus.posLimit = uint256S("7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff");
         consensus.nPowTargetTimespan = 16 * 60; // 16 minutes (960 = 832 + 128; multiplier is 832)
-        consensus.nPowTargetTimespanV2 = 20128; // 5.59 hours (20128 = 20000 + 128; multiplier is 20000)
+        consensus.nPowTargetTimespanV2 = 4000;
         consensus.nPowTargetSpacing = 2 * 64;
         consensus.fPowAllowMinDifficultyBlocks = true;
         consensus.fPowNoRetargeting = true;
diff --git a/src/pow.cpp b/src/pow.cpp
index 9e4ac152f..8ecac14e2 100644
--- a/src/pow.cpp
+++ b/src/pow.cpp
@@ -10,6 +10,27 @@
 #include <primitives/block.h>
 #include <uint256.h>
 
+namespace {
+    // returns a * exp(p/q) where |p/q| is small
+    arith_uint256 mul_exp(arith_uint256 a, int64_t p, int64_t q)
+    {
+        bool isNegative = p < 0;
+        uint64_t abs_p = p >= 0 ? p : -p;
+        arith_uint256 result = a;
+        uint64_t n = 0;
+        while (a > 0) {
+            ++n;
+            a = a * abs_p / q / n;
+            if (isNegative && (n % 2 == 1)) {
+                result -= a;
+            } else {
+                result += a;
+            }
+        }
+        return result;
+    }
+}
+
 // ppcoin: find last block index up to pindex
 const CBlockIndex* GetLastBlockIndex(const CBlockIndex* pindex, bool fProofOfStake)
 {
@@ -77,20 +98,28 @@ unsigned int CalculateNextWorkRequired(const CBlockIndex* pindexLast, int64_t nF
     // Limit adjustment step
     int64_t nTargetSpacing = params.nPowTargetSpacing;
     int64_t nActualSpacing = pindexLast->GetBlockTime() - nFirstBlockTime;
-    if (nActualSpacing < 0)
-        nActualSpacing = nTargetSpacing;
-    if (nActualSpacing > nTargetSpacing * 10)
-        nActualSpacing = nTargetSpacing * 10;
-
-	// Retarget
+    // Retarget
     const arith_uint256 bnTargetLimit = GetLimit(params, fProofOfStake);
     // ppcoin: target change every block
     // ppcoin: retarget with exponential moving toward target spacing
     arith_uint256 bnNew;
     bnNew.SetCompact(pindexLast->nBits);
     int64_t nInterval = params.DifficultyAdjustmentInterval(pindexLast->nHeight + 1);
-    bnNew *= ((nInterval - 1) * nTargetSpacing + nActualSpacing + nActualSpacing);
-    bnNew /= ((nInterval + 1) * nTargetSpacing);
+
+    if (pindexLast->nHeight + 1 < params.QIP9Height) {
+        if (nActualSpacing < 0)
+            nActualSpacing = nTargetSpacing;
+        if (nActualSpacing > nTargetSpacing * 10)
+            nActualSpacing = nTargetSpacing * 10;
+        bnNew *= ((nInterval - 1) * nTargetSpacing + nActualSpacing + nActualSpacing);
+        bnNew /= ((nInterval + 1) * nTargetSpacing);
+    } else {
+        if (nActualSpacing < 0)
+            nActualSpacing = nTargetSpacing;
+        if (nActualSpacing > nTargetSpacing * 20)
+            nActualSpacing = nTargetSpacing * 20;
+        bnNew = mul_exp(bnNew, 2 * (nActualSpacing - nTargetSpacing) / 16, (nInterval + 1) * nTargetSpacing / 16);
+    }
 
     if (bnNew <= 0 || bnNew > bnTargetLimit)
         bnNew = bnTargetLimit;

From 11e7f1772f27b53c98b98f3cba90c4ebad794c00 Mon Sep 17 00:00:00 2001
From: Neil <neil@qtum.org>
Date: Wed, 7 Aug 2019 19:37:07 +0000
Subject: [PATCH 080/153] Update submodule

---
 src/cpp-ethereum | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/cpp-ethereum b/src/cpp-ethereum
index e6b6f2dab..bd060850a 160000
--- a/src/cpp-ethereum
+++ b/src/cpp-ethereum
@@ -1 +1 @@
-Subproject commit e6b6f2dab37fa4e5d0f5a502f21c81bd1bac39bd
+Subproject commit bd060850af2fd21a65cb92a8fe5d7a5b40ecf018

From c68d5cfbc2e370a715ef61813c139c7056bb4a73 Mon Sep 17 00:00:00 2001
From: Time Markov <time.markov@qtum.com>
Date: Wed, 21 Aug 2019 16:02:29 +0200
Subject: [PATCH 081/153] Convert number always into big endian hex string EVM
 read hex numbers in big endian representation

---
 src/util/system.cpp | 19 ++++++++-----------
 1 file changed, 8 insertions(+), 11 deletions(-)

diff --git a/src/util/system.cpp b/src/util/system.cpp
index abd0b5a2a..e77cd21cf 100644
--- a/src/util/system.cpp
+++ b/src/util/system.cpp
@@ -10,7 +10,6 @@
 #include <serialize.h>
 #include <util/strencodings.h>
 #include <regex>
-#include <iomanip>
 
 #include <stdarg.h>
 
@@ -1249,17 +1248,15 @@ int ScheduleBatchPriority()
 }
 
 std::string toHexString(int64_t intValue) {
+    //Store big endian representation in a vector
+    uint64_t num = (uint64_t)intValue;
+    std::vector<unsigned char> bigEndian;
+    for(int i=sizeof(num) -1; i>=0; i--){
+       bigEndian.push_back( (num>>(8*i)) & 0xff );
+    }
 
-    std::string hexStr;
-
-    // Integer value to hex string
-    std::stringstream sstream;
-    sstream << "0x" << std::setfill ('0') << std::setw(2) << std::hex << (int64_t)intValue;
-
-    hexStr= sstream.str();
-    sstream.clear();
-
-    return hexStr;
+    //Convert the vector into hex string
+    return "0x" + HexStr(bigEndian.begin(), bigEndian.end());
 }
 
 void ReplaceInt(const int64_t& number, const std::string& key, std::string& str)

From dd29bcb1bd63a80788171e146a0fe302b4ec8b4a Mon Sep 17 00:00:00 2001
From: Time Markov <time.markov@qtum.com>
Date: Fri, 23 Aug 2019 12:50:54 +0200
Subject: [PATCH 082/153] Add delete blockchain data command line option

---
 src/init.cpp | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/src/init.cpp b/src/init.cpp
index 826e95a40..a42dbbb6f 100644
--- a/src/init.cpp
+++ b/src/init.cpp
@@ -416,6 +416,7 @@ void SetupServerArgs()
 #ifdef ENABLE_BITCORE_RPC
     gArgs.AddArg("-addrindex", strprintf("Maintain a full address index (default: %u)", DEFAULT_ADDRINDEX), false, OptionsCategory::OPTIONS);
 #endif
+    gArgs.AddArg("-deleteblockchaindata", "Delete the local copy of the block chain data", false, OptionsCategory::OPTIONS);
 
     gArgs.AddArg("-addnode=<ip>", "Add a node to connect to and attempt to keep the connection open (see the `addnode` RPC command help for more info). This option can be specified multiple times to add multiple nodes.", false, OptionsCategory::CONNECTION);
     gArgs.AddArg("-banscore=<n>", strprintf("Threshold for disconnecting misbehaving peers (default: %u)", DEFAULT_BANSCORE_THRESHOLD), false, OptionsCategory::CONNECTION);
@@ -679,6 +680,18 @@ static void CleanupBlockRevFiles()
     }
 }
 
+// Delete local blockchain data
+void DeleteBlockChainData()
+{
+    // Delete block chain data paths
+    fs::remove_all(GetDataDir() / "chainstate");
+    fs::remove_all(GetBlocksDir());
+    fs::remove_all(GetDataDir() / "stateQtum");
+    fs::remove(GetDataDir() / "banlist.dat");
+    fs::remove(GetDataDir() / FEE_ESTIMATES_FILENAME);
+    fs::remove(GetDataDir() / "mempool.dat");
+}
+
 static void ThreadImport(std::vector<fs::path> vImportFiles)
 {
     const CChainParams& chainparams = Params();
@@ -1298,6 +1311,11 @@ bool AppInitMain(InitInterfaces& interfaces)
             gArgs.GetArg("-datadir", ""), fs::current_path().string());
     }
 
+    if(gArgs.GetBoolArg("-deleteblockchaindata", false))
+    {
+        DeleteBlockChainData();
+    }
+
     InitSignatureCache();
     InitScriptExecutionCache();
 

From a29d90c16a05bdb4b32c0144b8b880a7e6544cb0 Mon Sep 17 00:00:00 2001
From: Time Markov <time.markov@qtum.com>
Date: Fri, 23 Aug 2019 14:58:15 +0200
Subject: [PATCH 083/153] Update wallet restore options

---
 src/qt/bitcoin.cpp            |  3 ++-
 src/qt/forms/restoredialog.ui | 19 +++++++++++++------
 src/qt/restoredialog.cpp      | 17 ++++++++++++++++-
 3 files changed, 31 insertions(+), 8 deletions(-)

diff --git a/src/qt/bitcoin.cpp b/src/qt/bitcoin.cpp
index 1f9729630..ca6f8812d 100644
--- a/src/qt/bitcoin.cpp
+++ b/src/qt/bitcoin.cpp
@@ -448,7 +448,8 @@ void BitcoinApplication::restoreWallet()
         QString commandLine;
         QStringList arg = arguments();
         removeParam(arg, "-reindex", false);
-        removeParam(arg, "-salvagewallet", false);
+        removeParam(arg, "-zapwallettxes=2", false);
+        removeParam(arg, "-deleteblockchaindata", false);
         removeParam(arg, "-wallet", true);
         if(!arg.contains(restoreParam))
         {
diff --git a/src/qt/forms/restoredialog.ui b/src/qt/forms/restoredialog.ui
index b28c6deb4..6edaeeb01 100644
--- a/src/qt/forms/restoredialog.ui
+++ b/src/qt/forms/restoredialog.ui
@@ -6,8 +6,8 @@
    <rect>
     <x>0</x>
     <y>0</y>
-    <width>555</width>
-    <height>352</height>
+    <width>580</width>
+    <height>400</height>
    </rect>
   </property>
   <property name="windowTitle">
@@ -84,7 +84,7 @@
         <item>
          <widget class="QRadioButton" name="rbReindex">
           <property name="text">
-           <string>Reindex</string>
+           <string>Rebuild block chain index</string>
           </property>
           <property name="checked">
            <bool>true</bool>
@@ -92,9 +92,16 @@
          </widget>
         </item>
         <item>
-         <widget class="QRadioButton" name="rbSalvage">
+         <widget class="QRadioButton" name="rbZapWallet">
           <property name="text">
-           <string>Salvage</string>
+           <string>Recover transactions without metadata</string>
+          </property>
+         </widget>
+        </item>
+        <item>
+         <widget class="QRadioButton" name="rbLocalDeleteData">
+          <property name="text">
+           <string>Delete the local copy of the block chain</string>
           </property>
          </widget>
         </item>
@@ -133,7 +140,7 @@
      <item>
       <widget class="QLabel" name="lblInfo">
        <property name="text">
-        <string>The wallet.dat will be restored from the selected location and the Qt Wallet will be restarted with the -reindex or -salvagewallet option.</string>
+        <string>The wallet.dat will be restored from the selected location and the Qt Wallet will be restarted with the -reindex, -zapwallettxes=2 or -deleteblockchaindata option.</string>
        </property>
        <property name="wordWrap">
         <bool>true</bool>
diff --git a/src/qt/restoredialog.cpp b/src/qt/restoredialog.cpp
index 91a3382ec..c41a0695a 100644
--- a/src/qt/restoredialog.cpp
+++ b/src/qt/restoredialog.cpp
@@ -22,7 +22,22 @@ RestoreDialog::~RestoreDialog()
 
 QString RestoreDialog::getParam()
 {
-    return ui->rbReindex->isChecked() ? "-reindex" : "-salvagewallet";
+    QString param;
+
+    if(ui->rbReindex->isChecked())
+    {
+        param = "-reindex";
+    }
+    else if(ui->rbZapWallet->isChecked())
+    {
+        param = "-zapwallettxes=2";
+    }
+    else
+    {
+        param = "-deleteblockchaindata";
+    }
+
+    return param;
 }
 
 QString RestoreDialog::getFileName()

From a26e402c05c50aab1f938bd338f2032376cf7f5c Mon Sep 17 00:00:00 2001
From: djaen <david.jaenson@qtum.org>
Date: Sat, 24 Aug 2019 03:43:27 +0200
Subject: [PATCH 084/153] Added fixes for python test cases

---
 test/functional/qtum_op_sender.py             | 113 ++++++++++--------
 test/functional/qtum_soft_block_gas_limits.py |   6 +-
 2 files changed, 64 insertions(+), 55 deletions(-)

diff --git a/test/functional/qtum_op_sender.py b/test/functional/qtum_op_sender.py
index 59cca07c6..9d573bf85 100755
--- a/test/functional/qtum_op_sender.py
+++ b/test/functional/qtum_op_sender.py
@@ -7,6 +7,7 @@
 from test_framework.qtum import *
 from test_framework.address import *
 from test_framework.blocktools import *
+from test_framework.key import *
 
 
 # If this is an OP_SENDER output, make sure that the signature is an empty byte vector
@@ -78,10 +79,10 @@ def sign_op_spend_outputs(tx, keys, hashtypes):
     for i in range(len(tx.vout)):
         outputOperations = [op for op in CScript(tx.vout[i].scriptPubKey)]
         if any(op == OP_SENDER for op in outputOperations):
-            inputScriptCode = [OP_DUP, OP_HASH160, hash160(keys[key_index].get_pubkey()), OP_EQUALVERIFY, OP_CHECKSIG]
+            inputScriptCode = [OP_DUP, OP_HASH160, hash160(keys[key_index].get_pubkey().get_bytes()), OP_EQUALVERIFY, OP_CHECKSIG]
             sighash = SignatureHashOutput(CScript(inputScriptCode), tx, i, hashtypes[i], tx.vout[i].nValue)
-            signature = keys[key_index].sign(sighash)
-            outputOperations[2] = ser_string(CScript([signature + struct.pack('B', hashtypes[i]), keys[key_index].get_pubkey()]))
+            signature = keys[key_index].sign_ecdsa(sighash)
+            outputOperations[2] = ser_string(CScript([signature + struct.pack('B', hashtypes[i]), keys[key_index].get_pubkey().get_bytes()]))
             tx.vout[key_index].scriptPubKey = CScript(outputOperations)
             key_index += 1
     return tx
@@ -92,7 +93,7 @@ def sign_transaction_sighash_all(tx, key):
     pre_input_sigs = []
     post_input_sigs = []
     for inpt in tx.vin:
-        pre_input_sigs.append(CScript([key.get_pubkey(), OP_CHECKSIG]))
+        pre_input_sigs.append(CScript([key.get_pubkey().get_bytes(), OP_CHECKSIG]))
 
     for i in range(len(tx.vin)):
         for j in range(len(tx.vin)):
@@ -103,7 +104,7 @@ def sign_transaction_sighash_all(tx, key):
 
         sigdata = tx.serialize() + b'\x01\x00\x00\x00'
         sighash = hash256(sigdata)
-        sigtx = key.sign(sighash, low_s=True)
+        sigtx = key.sign_ecdsa(sighash, low_s=True)
         post_input_sigs.append(CScript([sigtx + b'\x01']))
 
     for i in range(len(tx.vin)):
@@ -111,13 +112,12 @@ def sign_transaction_sighash_all(tx, key):
 
     return tx
 
-def wif_to_ceckey(wif):
+def wif_to_ECKey(wif):
     _, privkey, _ = base58_to_byte(wif, 38)
     bytes_privkey = hex_str_to_bytes(str(privkey)[2:-1])
-    key = CECKey()
+    key = ECKey()
     # Assume always compressed, ignore last byte which specifies compression
-    key.set_compressed(True)
-    key.set_secretbytes(bytes_privkey[:-1])
+    key.set(bytes_privkey[:-1], True)
     return key
 
 HASHTYPES = [SIGHASH_ALL, SIGHASH_SINGLE, SIGHASH_NONE, SIGHASH_ANYONECANPAY]
@@ -126,17 +126,17 @@ class QtumOpSenderTest(BitcoinTestFramework):
     def set_test_params(self):
         self.setup_clean_chain = True
         self.num_nodes = 2
-        self.extra_args = [[], []]
+        self.extra_args = [['-opsenderheight=1000000']] * 2
 
     def create_op_sender_tx(self, keys, outputs, hashtypes, gasCost, publish=True):
         unspent = self.unspents.pop()
         amount = sum(output.nValue for output in outputs)
         change = int(unspent['amount'])*COIN - gasCost - amount
         wif = self.nodes[0].dumpprivkey(unspent['address'])
-        vin_key = wif_to_ceckey(wif)
+        vin_key = wif_to_ECKey(wif)
         tx = CTransaction()
         prevout = COutPoint(int(unspent['txid'], 16), unspent['vout'])
-        tx.vin = [CTxIn(prevout, scriptSig=CScript([vin_key.get_pubkey(), OP_CHECKSIG]))]
+        tx.vin = [CTxIn(prevout, scriptSig=CScript([vin_key.get_pubkey().get_bytes(), OP_CHECKSIG]))]
         tx.vout = outputs[:]
         tx.vout.append(CTxOut(change, scriptPubKey=CScript([OP_TRUE])))
         # Sign the outputs
@@ -154,9 +154,9 @@ def create_op_sender_tx(self, keys, outputs, hashtypes, gasCost, publish=True):
     def single_op_sender_op_create_tx_test(self):
         num_contracts = len(self.nodes[0].listcontracts().keys())
         bytecode = '60606040523415600b57fe5b5b60398060196000396000f30060606040525b600b5b5b565b0000a165627a7a72305820e3bed070fd3a81dd00e02efd22d18a3b47b70860155d6063e47e1e2674fc5acb0029'
-        key = CECKey()
-        key.set_secretbytes(b'\x00')
-        output = CTxOut(0, CScript([CScriptNum(1), hash160(key.get_pubkey()), b'', OP_SENDER, b'\x04', CScriptNum(1000000), CScriptNum(40), hex_str_to_bytes(bytecode), OP_CREATE]))
+        key = ECKey()
+        key.set(hash256(b'\x01'), True)
+        output = CTxOut(0, CScript([CScriptNum(1), hash160(key.get_pubkey().get_bytes()), b'', OP_SENDER, b'\x04', CScriptNum(1000000), CScriptNum(40), hex_str_to_bytes(bytecode), OP_CREATE]))
 
         for hashtype in HASHTYPES:
             self.create_op_sender_tx([key], [output], [hashtype], 40000000)
@@ -168,9 +168,9 @@ def single_op_sender_op_create_tx_test(self):
 
     def single_op_sender_op_call_tx_test(self):
         contract_address = sorted(self.nodes[0].listcontracts().keys())[-1]
-        key = CECKey()
-        key.set_secretbytes(b'\x01')
-        output = CTxOut(COIN, CScript([CScriptNum(1), hash160(key.get_pubkey()), b'', OP_SENDER, 
+        key = ECKey()
+        key.set(hash256(b'\x01'), True)
+        output = CTxOut(COIN, CScript([CScriptNum(1), hash160(key.get_pubkey().get_bytes()), b'', OP_SENDER, 
                 b'\x04', CScriptNum(1000000), CScriptNum(40), hex_str_to_bytes("00"), hex_str_to_bytes(contract_address), OP_CALL]))
 
         for hashtype in HASHTYPES:
@@ -186,9 +186,9 @@ def all_sigtypes_outputs_in_single_tx_test(self):
         outputs = []
         keys = []
         for i, hashtype in enumerate(HASHTYPES):
-            key = CECKey()
-            key.set_secretbytes(hex_str_to_bytes(hex(i)[2:].zfill(4)))
-            output = CTxOut(COIN, CScript([CScriptNum(1), hash160(key.get_pubkey()), b'', OP_SENDER, 
+            key = ECKey()
+            key.set(hash256(hex_str_to_bytes(hex(i)[2:].zfill(4))), True)
+            output = CTxOut(COIN, CScript([CScriptNum(1), hash160(key.get_pubkey().get_bytes()), b'', OP_SENDER, 
                     b'\x04', CScriptNum(1000000), CScriptNum(40), hex_str_to_bytes("00"), hex_str_to_bytes(contract_address), OP_CALL]))
             keys.append(key)
             outputs.append(output)
@@ -203,10 +203,10 @@ def all_sigtypes_outputs_in_single_tx_test(self):
     def replay_sighash_op_sender_output_test(self):
         contract_address = sorted(self.nodes[0].listcontracts().keys())[-1]
         old_balance = self.nodes[0].listcontracts()[contract_address]
-        key = CECKey()
-        key.set_secretbytes(b'\x01')
+        key = ECKey()
+        key.set(hash256(b'\x01'), True)
         for hashtype in HASHTYPES:
-            output = CTxOut(COIN, CScript([CScriptNum(1), hash160(key.get_pubkey()), b'', OP_SENDER, 
+            output = CTxOut(COIN, CScript([CScriptNum(1), hash160(key.get_pubkey().get_bytes()), b'', OP_SENDER, 
                     b'\x04', CScriptNum(1000000), CScriptNum(40), hex_str_to_bytes("00"), hex_str_to_bytes(contract_address), OP_CALL]))
             old_tx, input_txout = self.create_op_sender_tx([key], [output], [hashtype], 40000000, publish=True)
             self.nodes[0].generate(1)
@@ -215,10 +215,10 @@ def replay_sighash_op_sender_output_test(self):
             amount = COIN
             change = int(unspent['amount'])*COIN - 40000000 - amount
             wif = self.nodes[0].dumpprivkey(unspent['address'])
-            vin_key = wif_to_ceckey(wif)
+            vin_key = wif_to_ECKey(wif)
             tx = CTransaction()
             prevout = COutPoint(int(unspent['txid'], 16), unspent['vout'])
-            tx.vin = [CTxIn(prevout, scriptSig=CScript([vin_key.get_pubkey(), OP_CHECKSIG]))]
+            tx.vin = [CTxIn(prevout, scriptSig=CScript([vin_key.get_pubkey().get_bytes(), OP_CHECKSIG]))]
             tx.vout = [old_tx.vout[0]]
             tx.vout.append(CTxOut(change, scriptPubKey=CScript([OP_TRUE])))
             # Sign the inputs
@@ -256,10 +256,10 @@ def mixed_opsender_and_non_op_sender_tx_and_refund_verification_test(self):
         0ee2cb10: getCreator()
         """
         bytecode = "608060405234801561001057600080fd5b50336000806101000a81548173ffffffffffffffffffffffffffffffffffffffff021916908373ffffffffffffffffffffffffffffffffffffffff1602179055506101ef806100606000396000f3fe608060405260043610610046576000357c0100000000000000000000000000000000000000000000000000000000900480630ee2cb1014610095578063f8b2cb4f146100ec575b34600160003373ffffffffffffffffffffffffffffffffffffffff1673ffffffffffffffffffffffffffffffffffffffff16815260200190815260200160002060008282540192505081905550005b3480156100a157600080fd5b506100aa610151565b604051808273ffffffffffffffffffffffffffffffffffffffff1673ffffffffffffffffffffffffffffffffffffffff16815260200191505060405180910390f35b3480156100f857600080fd5b5061013b6004803603602081101561010f57600080fd5b81019080803573ffffffffffffffffffffffffffffffffffffffff16906020019092919050505061017a565b6040518082815260200191505060405180910390f35b60008060009054906101000a900473ffffffffffffffffffffffffffffffffffffffff16905090565b6000600160008373ffffffffffffffffffffffffffffffffffffffff1673ffffffffffffffffffffffffffffffffffffffff16815260200190815260200160002054905091905056fea165627a7a72305820cec11cb4c48d27aed8e6cd757d284387d8a017d594555d9b0d1b6f4d331441ac0029"
-        key = CECKey()
-        key.set_secretbytes(b'\x00')
+        key = ECKey()
+        key.set(hash256(b'\x00'), True)
         outputs = [
-            CTxOut(0, CScript([CScriptNum(1), hash160(key.get_pubkey()), b'', OP_SENDER, b'\x04', CScriptNum(1000000), CScriptNum(40), hex_str_to_bytes(bytecode), OP_CREATE])),
+            CTxOut(0, CScript([CScriptNum(1), hash160(key.get_pubkey().get_bytes()), b'', OP_SENDER, b'\x04', CScriptNum(1000000), CScriptNum(40), hex_str_to_bytes(bytecode), OP_CREATE])),
             CTxOut(0, CScript([b'\x04', CScriptNum(1000000), CScriptNum(40), hex_str_to_bytes(bytecode), OP_CREATE]))
         ]
         tx, input_txout = self.create_op_sender_tx([key], outputs, [SIGHASH_ALL], 2*40000000)
@@ -273,34 +273,34 @@ def mixed_opsender_and_non_op_sender_tx_and_refund_verification_test(self):
         ]
 
         expected_creators = [
-            bytes_to_hex_str(hash160(key.get_pubkey())),
+            bytes_to_hex_str(hash160(key.get_pubkey().get_bytes())),
             p2pkh_to_hex_hash(input_txout['address'])
         ]
         assert_equal(sorted(creators), sorted(expected_creators))
 
         # Make sure that gas is refunded to vin0's address
         coinbase_txid = self.nodes[0].getblock(block_hash)['tx'][0]
-        coinbase_vout = self.nodes[0].getrawtransaction(coinbase_txid, True)['vout']
+        coinbase_vout = self.nodes[0].decoderawtransaction(self.nodes[0].gettransaction(coinbase_txid, True)['hex'])['vout']
         assert_equal(input_txout['address'], coinbase_vout[1]['scriptPubKey']['addresses'][0])
         assert_equal(input_txout['address'], coinbase_vout[2]['scriptPubKey']['addresses'][0])
 
         contract_address = new_contracts[0]
-        key = CECKey()
-        key.set_secretbytes(b'\x01')
+        key = ECKey()
+        key.set(hash256(b'\x01'), True)
         outputs = [
-            CTxOut(COIN, CScript([CScriptNum(1), hash160(key.get_pubkey()), b'', OP_SENDER, b'\x04', CScriptNum(1000000), CScriptNum(40), hex_str_to_bytes("00"), hex_str_to_bytes(contract_address), OP_CALL])),
+            CTxOut(COIN, CScript([CScriptNum(1), hash160(key.get_pubkey().get_bytes()), b'', OP_SENDER, b'\x04', CScriptNum(1000000), CScriptNum(40), hex_str_to_bytes("00"), hex_str_to_bytes(contract_address), OP_CALL])),
             CTxOut(COIN, CScript([b'\x04', CScriptNum(1000000), CScriptNum(40), hex_str_to_bytes("00"), hex_str_to_bytes(contract_address), OP_CALL]))
         ]
         tx, input_txout = self.create_op_sender_tx([key], outputs, [SIGHASH_ALL], 2*40000000)
         self.nodes[0].generate(1)
-        for sender in [bytes_to_hex_str(hash160(key.get_pubkey())), p2pkh_to_hex_hash(input_txout['address'])]:
+        for sender in [bytes_to_hex_str(hash160(key.get_pubkey().get_bytes())), p2pkh_to_hex_hash(input_txout['address'])]:
             balance = int(self.nodes[0].callcontract(new_contracts[0], "f8b2cb4f"+(sender.zfill(64)))['executionResult']['output'], 16)
             assert_equal(COIN, balance)
 
     def large_contract_deployment_tx_test(self):
-        key = CECKey()
-        key.set_secretbytes(b'\x01')
-        output = CTxOut(0, CScript([CScriptNum(1), hash160(key.get_pubkey()), b'', OP_SENDER, b'\x04', CScriptNum(1000000), CScriptNum(50), b'\x00'*100000, OP_CREATE]))
+        key = ECKey()
+        key.set(hash256(b'\x01'), True)
+        output = CTxOut(0, CScript([CScriptNum(1), hash160(key.get_pubkey().get_bytes()), b'', OP_SENDER, b'\x04', CScriptNum(1000000), CScriptNum(50), b'\x00'*100000, OP_CREATE]))
         tx, input_txout = self.create_op_sender_tx([key], [output], [SIGHASH_ALL], 50*1000000)
         txid = self.nodes[0].sendrawtransaction(bytes_to_hex_str(tx.serialize()))
         self.nodes[0].getrawtransaction(txid)
@@ -309,9 +309,9 @@ def large_contract_deployment_tx_test(self):
 
     def invalid_op_sender_signature_tx_test(self):
         contract_address = sorted(self.nodes[0].listcontracts().keys())[-1]
-        key = CECKey()
-        key.set_secretbytes(b'\x01')
-        output = CTxOut(COIN, CScript([CScriptNum(1), hash160(key.get_pubkey()), b'', OP_SENDER, 
+        key = ECKey()
+        key.set(hash256(b'\x01'), False)
+        output = CTxOut(COIN, CScript([CScriptNum(1), hash160(key.get_pubkey().get_bytes()), b'', OP_SENDER, 
                 b'\x04', CScriptNum(1000000), CScriptNum(40), hex_str_to_bytes("00"), OP_CREATE]))
 
         for hashtype in HASHTYPES:
@@ -351,9 +351,9 @@ def invalid_op_sender_signature_tx_test(self):
 
     def invalid_op_sender_address_tx_test(self):
         contract_address = sorted(self.nodes[0].listcontracts().keys())[-1]
-        key = CECKey()
-        key.set_secretbytes(b'\x01')
-        output = CTxOut(COIN, CScript([CScriptNum(1), hash160(key.get_pubkey()), b'', OP_SENDER, 
+        key = ECKey()
+        key.set(hash256(b'\x01'), True)
+        output = CTxOut(COIN, CScript([CScriptNum(1), hash160(key.get_pubkey().get_bytes()), b'', OP_SENDER, 
                 b'\x04', CScriptNum(1000000), CScriptNum(40), hex_str_to_bytes("00"), OP_CREATE]))
 
         for hashtype in HASHTYPES:
@@ -399,9 +399,9 @@ def non_standard_op_sender_test(self):
     def pre_hf_single_op_sender_op_create_tx_rejected_test(self):
         num_contracts = len(self.nodes[0].listcontracts().keys())
         bytecode = '60606040523415600b57fe5b5b60398060196000396000f30060606040525b600b5b5b565b0000a165627a7a72305820e3bed070fd3a81dd00e02efd22d18a3b47b70860155d6063e47e1e2674fc5acb0029'
-        key = CECKey()
-        key.set_secretbytes(b'\x00')
-        output = CTxOut(0, CScript([CScriptNum(1), hash160(key.get_pubkey()), b'', OP_SENDER, b'\x04', CScriptNum(1000000), CScriptNum(40), hex_str_to_bytes(bytecode), OP_CREATE]))
+        key = ECKey()
+        key.set(hash256(b'\x01'), True)
+        output = CTxOut(0, CScript([CScriptNum(1), hash160(key.get_pubkey().get_bytes()), b'', OP_SENDER, b'\x04', CScriptNum(1000000), CScriptNum(40), hex_str_to_bytes(bytecode), OP_CREATE]))
 
         for hashtype in HASHTYPES:
             tx, _ = self.create_op_sender_tx([key], [output], [hashtype], 40000000, publish=False)
@@ -422,7 +422,7 @@ def pre_hf_op_sender_in_vin_rejected_test(self):
         spending_tx.vout = [CTxOut(int(unspent['amount'])*COIN-200000, scriptPubKey=CScript([OP_TRUE]*40))]
         try:
             txid = self.nodes[0].sendrawtransaction(bytes_to_hex_str(spending_tx.serialize()))
-            self.nodes[0].getrawtransaction(txid)
+            self.nodes[0].gettransaction(txid)
         except:
             # Success
             return
@@ -442,7 +442,7 @@ def pre_hf_double_op_sender_in_vout_rejected_test(self):
         spending_tx.vout = [CTxOut(int(unspent['amount'])*COIN-200000, scriptPubKey=CScript([OP_TRUE]*40))]
         try:
             txid = self.nodes[0].sendrawtransaction(bytes_to_hex_str(spending_tx.serialize()))
-            pp.pprint(self.nodes[0].getrawtransaction(txid, True))
+            pp.pprint(self.nodes[0].gettransaction(txid, True))
         except:
             # Success
             return
@@ -450,7 +450,16 @@ def pre_hf_double_op_sender_in_vout_rejected_test(self):
         assert(False)
 
     def run_test(self):
-        self.nodes[0].generate(100+COINBASE_MATURITY)
+        wif = self.nodes[0].dumpprivkey(self.nodes[0].getnewaddress())
+        key = wif_to_ECKey(wif)
+        for i in range(100+COINBASE_MATURITY):
+            block = create_block(int(self.nodes[0].getbestblockhash(), 16), create_coinbase(self.nodes[0].getblockcount()+1), int(time.time()))
+            block.vtx[0].vout[0].scriptPubKey = CScript([key.get_pubkey().get_bytes(), OP_CHECKSIG])
+            block.vtx[0].rehash()
+            block.hashMerkleRoot = block.calc_merkle_root()
+            block.solve()
+            self.nodes[0].submitblock(bytes_to_hex_str(block.serialize()))
+
         self.unspents = self.nodes[0].listunspent()
         
         # Make sure that op_sender txs are not accepted before the HF
@@ -461,8 +470,8 @@ def run_test(self):
         self.sync_all()
 
         # Trigger the HF
-        self.restart_node(0, ['-opsender-block=602'])
-        self.restart_node(1, ['-opsender-block=602'])
+        self.restart_node(0, ['-opsenderheight=602'])
+        self.restart_node(1, ['-opsenderheight=602'])
         connect_nodes_bi(self.nodes, 0, 1)
         
         self.single_op_sender_op_create_tx_test()
diff --git a/test/functional/qtum_soft_block_gas_limits.py b/test/functional/qtum_soft_block_gas_limits.py
index c38f600c5..36e13a2aa 100755
--- a/test/functional/qtum_soft_block_gas_limits.py
+++ b/test/functional/qtum_soft_block_gas_limits.py
@@ -74,11 +74,11 @@ def run_test(self):
         """
         pragma solidity ^0.4.12;
 
-        contract Test {
-            function () {}
+        contract Test{
+            function () payable { assert(false); }
         }
         """
-        contract_address = self.nodes[0].createcontract("60606040523415600e57600080fd5b5b603f80601c6000396000f30060606040525b3415600f57600080fd5b5b5b0000a165627a7a7230582058c936974fe6daaa8267ff5da1c805b0e7442b9cc687162114dfb1cb6d6f62bd0029")['address']
+        contract_address = self.nodes[0].createcontract("6080604052348015600f57600080fd5b50604280601d6000396000f3fe60806040526000600b57fe5b00fea265627a7a72305820db0c52d10779ca6ec85aa4cb3d532438cd960d532240f8f61b226bbdab137f4d64736f6c634300050a0032")['address']
         self.nodes[0].generate(1)
         assert(contract_address in self.nodes[0].listcontracts())
         self.sync_all()

From 8550a6c3c91ccf7c3a7bf5387482b0e6b5d2ec76 Mon Sep 17 00:00:00 2001
From: Neil <neil@qtum.org>
Date: Tue, 27 Aug 2019 18:28:12 +0000
Subject: [PATCH 085/153] Make regtest detection independent from
 fPoSNoRetargeting

---
 src/miner.cpp      | 2 +-
 src/pos.cpp        | 2 +-
 src/validation.cpp | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/src/miner.cpp b/src/miner.cpp
index 292b1b4fe..ce4948069 100644
--- a/src/miner.cpp
+++ b/src/miner.cpp
@@ -887,7 +887,7 @@ void ThreadStakeMiner(CWallet *pwallet, CConnman* connman)
     CReserveKey reservekey(pwallet);
 
     bool fTryToSync = true;
-    bool regtestMode = Params().GetConsensus().fPoSNoRetargeting;
+    bool regtestMode = Params().MineBlocksOnDemand();
     if(regtestMode){
         nMinerSleep = 30000; //limit regtest to 30s, otherwise it'll create 2 blocks per second
     }
diff --git a/src/pos.cpp b/src/pos.cpp
index db435cc44..35f266272 100644
--- a/src/pos.cpp
+++ b/src/pos.cpp
@@ -413,7 +413,7 @@ bool AddMPoSScript(std::vector<CScript> &mposScriptList, int nHeight, const Cons
     }
     else
     {
-        if(consensusParams.fPoSNoRetargeting){
+        if(Params().MineBlocksOnDemand()){
             //this could happen in regtest. Just ignore and add an empty script
             script = CScript() << OP_RETURN;
             mposScriptList.push_back(script);
diff --git a/src/validation.cpp b/src/validation.cpp
index 22ced848a..7f17697f2 100644
--- a/src/validation.cpp
+++ b/src/validation.cpp
@@ -3345,7 +3345,7 @@ bool CChainState::ConnectBlock(const CBlock& block, CValidationState& state, CBl
 
     pindex->nMoneySupply = (pindex->pprev? pindex->pprev->nMoneySupply : 0) + nValueOut - nValueIn;
     //only start checking this error after block 5000 and only on testnet and mainnet, not regtest
-    if(pindex->nHeight > 5000 && !Params().GetConsensus().fPoSNoRetargeting) {
+    if(pindex->nHeight > 5000 && !Params().MineBlocksOnDemand()) {
         //sanity check in case an exploit happens that allows new coins to be minted
         if(pindex->nMoneySupply > (uint64_t)(100000000 + ((pindex->nHeight - 5000) * 4)) * COIN){
             return state.DoS(100, error("ConnectBlock(): Unknown error caused actual money supply to exceed expected money supply"),

From 5b793e43d97a8fac1f27c4c33b649ac511d70467 Mon Sep 17 00:00:00 2001
From: Neil <neil@qtum.org>
Date: Thu, 29 Aug 2019 02:26:20 +0000
Subject: [PATCH 086/153] Fix gas refunds for revert()

---
 src/qtum/qtumstate.cpp                 |  6 +--
 src/validation.cpp                     | 62 ++++++++++++++------------
 test/functional/qtum_divergence_dos.py |  6 +--
 3 files changed, 40 insertions(+), 34 deletions(-)

diff --git a/src/qtum/qtumstate.cpp b/src/qtum/qtumstate.cpp
index 44d38d1a3..4a2167466 100644
--- a/src/qtum/qtumstate.cpp
+++ b/src/qtum/qtumstate.cpp
@@ -44,6 +44,7 @@ ResultExecute QtumState::execute(EnvInfo const& _envInfo, SealEngineFace const&
 
     CTransactionRef tx;
     u256 startGasUsed;
+    const Consensus::Params& consensusParams = Params().GetConsensus();
     try{
         if (_t.isCreation() && _t.value())
             BOOST_THROW_EXCEPTION(CreateWithValue());
@@ -68,13 +69,14 @@ ResultExecute QtumState::execute(EnvInfo const& _envInfo, SealEngineFace const&
                 CondensingTX ctx(this, transfers, _t, _sealEngine.deleteAddresses);
                 tx = MakeTransactionRef(ctx.createCondensingTX());
                 if(ctx.reachedVoutLimit()){
-
                     voutLimit = true;
                     e.revert();
                     throw Exception();
                 }
                 std::unordered_map<dev::Address, Vin> vins = ctx.createVin(*tx);
                 updateUTXO(vins);
+            } else if(chainActive.Height() >= consensusParams.QIP7Height && res.excepted == TransactionException::RevertInstruction) {
+            	e.revert();
             } else {
                 printfErrorLog(res.excepted);
             }
@@ -86,11 +88,9 @@ ResultExecute QtumState::execute(EnvInfo const& _envInfo, SealEngineFace const&
         }
     }
     catch(Exception const& _e){
-
         printfErrorLog(dev::eth::toTransactionException(_e));
         res.excepted = dev::eth::toTransactionException(_e);
         res.gasUsed = _t.gas();
-        const Consensus::Params& consensusParams = Params().GetConsensus();
         if(chainActive.Height() < consensusParams.nFixUTXOCacheHFHeight  && _p != Permanence::Reverted){
             deleteAccounts(_sealEngine.deleteAddresses);
             commit(CommitBehaviour::RemoveEmptyAccounts);
diff --git a/src/validation.cpp b/src/validation.cpp
index 7f17697f2..c70bf6532 100644
--- a/src/validation.cpp
+++ b/src/validation.cpp
@@ -2550,38 +2550,44 @@ bool ByteCodeExec::performByteCode(dev::eth::Permanence type){
 }
 
 bool ByteCodeExec::processingResults(ByteCodeExecResult& resultBCE){
+	const Consensus::Params& consensusParams = Params().GetConsensus();
     for(size_t i = 0; i < result.size(); i++){
         uint64_t gasUsed = (uint64_t) result[i].execRes.gasUsed;
-        if(result[i].execRes.excepted != dev::eth::TransactionException::None){
-            if(txs[i].value() > 0){
-                CMutableTransaction tx;
-                tx.vin.push_back(CTxIn(h256Touint(txs[i].getHashWith()), txs[i].getNVout(), CScript() << OP_SPEND));
-                CScript script(CScript() << OP_DUP << OP_HASH160 << txs[i].sender().asBytes() << OP_EQUALVERIFY << OP_CHECKSIG);
-                tx.vout.push_back(CTxOut(CAmount(txs[i].value()), script));
-                resultBCE.valueTransfers.push_back(CTransaction(tx));
-            }
-            resultBCE.usedGas += gasUsed;
-        } else {
-            if(txs[i].gas() > UINT64_MAX ||
-                    result[i].execRes.gasUsed > UINT64_MAX ||
-                    txs[i].gasPrice() > UINT64_MAX){
-                return false;
-            }
-            uint64_t gas = (uint64_t) txs[i].gas();
-            uint64_t gasPrice = (uint64_t) txs[i].gasPrice();
 
-            resultBCE.usedGas += gasUsed;
-            int64_t amount = (gas - gasUsed) * gasPrice;
-            if(amount < 0){
-                return false;
-            }
-            if(amount > 0){
-                // Refund the rest of the amount to the sender that provide the coins for the contract
-                CScript script(CScript() << OP_DUP << OP_HASH160 << txs[i].getRefundSender().asBytes() << OP_EQUALVERIFY << OP_CHECKSIG);
-                resultBCE.refundOutputs.push_back(CTxOut(amount, script));
-                resultBCE.refundSender += amount;
-            }
+        if(result[i].execRes.excepted == dev::eth::TransactionException::None || (chainActive.Height() >= consensusParams.QIP7Height && result[i].execRes.excepted == dev::eth::TransactionException::RevertInstruction)){
+        	if(txs[i].gas() > UINT64_MAX ||
+        			result[i].execRes.gasUsed > UINT64_MAX ||
+					txs[i].gasPrice() > UINT64_MAX){
+        		return false;
+        	}
+        	uint64_t gas = (uint64_t) txs[i].gas();
+        	uint64_t gasPrice = (uint64_t) txs[i].gasPrice();
+
+        	resultBCE.usedGas += gasUsed;
+        	int64_t amount = (gas - gasUsed) * gasPrice;
+        	if(amount < 0){
+        		return false;
+        	}
+        	if(amount > 0){
+        		// Refund the rest of the amount to the sender that provide the coins for the contract
+				CScript script(CScript() << OP_DUP << OP_HASH160 << txs[i].getRefundSender().asBytes() << OP_EQUALVERIFY << OP_CHECKSIG);
+				resultBCE.refundOutputs.push_back(CTxOut(amount, script));
+				resultBCE.refundSender += amount;
+        	}
+        }
+
+        if(result[i].execRes.excepted != dev::eth::TransactionException::None){
+        	// refund coins sent to the contract to the sender
+        	if(txs[i].value() > 0){
+        		CMutableTransaction tx;
+        		tx.vin.push_back(CTxIn(h256Touint(txs[i].getHashWith()), txs[i].getNVout(), CScript() << OP_SPEND));
+        		CScript script(CScript() << OP_DUP << OP_HASH160 << txs[i].sender().asBytes() << OP_EQUALVERIFY << OP_CHECKSIG);
+        		tx.vout.push_back(CTxOut(CAmount(txs[i].value()), script));
+        		resultBCE.valueTransfers.push_back(CTransaction(tx));
+        	}
+        	resultBCE.usedGas += gasUsed;
         }
+
         if(result[i].tx != CTransaction()){
             resultBCE.valueTransfers.push_back(result[i].tx);
         }
diff --git a/test/functional/qtum_divergence_dos.py b/test/functional/qtum_divergence_dos.py
index d9dc4c8fe..6a4681365 100755
--- a/test/functional/qtum_divergence_dos.py
+++ b/test/functional/qtum_divergence_dos.py
@@ -89,16 +89,16 @@ def run_test(self):
         pragma solidity ^0.4.24;
         contract Ballot {
             function() payable public {
-                throw;
+                while(true){}
             }
         }
         """
-        bytecode = "6080604052348015600f57600080fd5b50603580601d6000396000f3006080604052600080fd00a165627a7a723058208efda2b7aa7d6a6c3e6e24d1ad3dae8c44b399c5764ea9614e34720227dbd04b0029"
+        bytecode = "6080604052348015600f57600080fd5b50603d80601d6000396000f30060806040525b600115600f576005565b0000a165627a7a72305820046fe704d7206dd7bd828449504709b4786e72b5b8cb47633add96fec4d343410029"
         self.contract_address = self.node.createcontract(bytecode)['address']
         self.node.generate(1)
         self.too_few_txs_test()
         self.different_but_same_number_aal_txs_test()
         self.too_many_txs_test()
-        
+         
 if __name__ == '__main__':
     QtumDivergenceDosTest().main()

From ae2362fd4a4e92195f98a9a7257a47671576ae8d Mon Sep 17 00:00:00 2001
From: Neil <neil@qtum.org>
Date: Thu, 29 Aug 2019 02:57:25 +0000
Subject: [PATCH 087/153] Avoid accounting for cumulative gas twice

---
 src/validation.cpp | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/src/validation.cpp b/src/validation.cpp
index c70bf6532..bed69f008 100644
--- a/src/validation.cpp
+++ b/src/validation.cpp
@@ -2585,7 +2585,9 @@ bool ByteCodeExec::processingResults(ByteCodeExecResult& resultBCE){
         		tx.vout.push_back(CTxOut(CAmount(txs[i].value()), script));
         		resultBCE.valueTransfers.push_back(CTransaction(tx));
         	}
+        	if(!(chainActive.Height() >= consensusParams.QIP7Height && result[i].execRes.excepted == dev::eth::TransactionException::RevertInstruction)){
         	resultBCE.usedGas += gasUsed;
+        	}
         }
 
         if(result[i].tx != CTransaction()){

From 218c0a3f9e03d86991ed0238393e3f86fdd83d45 Mon Sep 17 00:00:00 2001
From: Neil <neil@qtum.org>
Date: Fri, 30 Aug 2019 15:42:24 +0000
Subject: [PATCH 088/153] Bump protocol version after QIP7 hardfork

---
 src/net_processing.cpp                     | 11 +++++++++++
 src/version.h                              |  5 ++++-
 test/functional/test_framework/messages.py |  2 +-
 3 files changed, 16 insertions(+), 2 deletions(-)

diff --git a/src/net_processing.cpp b/src/net_processing.cpp
index b5c660677..36cebdfa5 100644
--- a/src/net_processing.cpp
+++ b/src/net_processing.cpp
@@ -1885,6 +1885,17 @@ bool static ProcessMessage(CNode* pfrom, const std::string& strCommand, CDataStr
             return false;
         }
 
+        if (chainActive.Tip()->nHeight >= chainparams.GetConsensus().QIP7Height && nVersion < MIN_PEER_PROTO_VERSION_AFTER_QIP7) {
+        	// disconnect from peers older than this proto version
+        	LogPrint(BCLog::NET, "peer=%d using obsolete version after QIP7 hardfork %i; disconnecting\n", pfrom->GetId(), nVersion);
+        	if (enable_bip61) {
+        		connman->PushMessage(pfrom, CNetMsgMaker(INIT_PROTO_VERSION).Make(NetMsgType::REJECT, strCommand, REJECT_OBSOLETE,
+        				strprintf("Version must be %d or greater after QIP7 hardfork", MIN_PEER_PROTO_VERSION_AFTER_QIP7)));
+        	}
+        	pfrom->fDisconnect = true;
+        	return false;
+        }
+
         if (!vRecv.empty())
             vRecv >> addrFrom >> nNonce;
         if (!vRecv.empty()) {
diff --git a/src/version.h b/src/version.h
index a3035fd4e..15aa8af2e 100644
--- a/src/version.h
+++ b/src/version.h
@@ -9,7 +9,7 @@
  * network protocol versioning
  */
 
-static const int PROTOCOL_VERSION = 70016;
+static const int PROTOCOL_VERSION = 70017;
 
 //! initial proto version, to be increased after version/verack negotiation
 static const int INIT_PROTO_VERSION = 209;
@@ -20,6 +20,9 @@ static const int GETHEADERS_VERSION = 31800;
 //! disconnect from peers older than this proto version
 static const int MIN_PEER_PROTO_VERSION = 70016;
 
+//! disconnect from peers older than this proto version after QIP7
+static const int MIN_PEER_PROTO_VERSION_AFTER_QIP7 = 70017;
+
 //! nTime field added to CAddress, starting with this version;
 //! if possible, avoid requesting addresses nodes older than this
 static const int CADDR_TIME_VERSION = 31402;
diff --git a/test/functional/test_framework/messages.py b/test/functional/test_framework/messages.py
index 5eb5cc96a..c2c5ab962 100755
--- a/test/functional/test_framework/messages.py
+++ b/test/functional/test_framework/messages.py
@@ -32,7 +32,7 @@
 from test_framework.qtumconfig import INITIAL_HASH_STATE_ROOT, INITIAL_HASH_UTXO_ROOT
 
 MIN_VERSION_SUPPORTED = 60001
-MY_VERSION = 70016  # past bip-31 for ping/pong
+MY_VERSION = 70017  # past bip-31 for ping/pong
 MY_SUBVERSION = b"/python-mininode-tester:0.0.3/"
 MY_RELAY = 1 # from version 70001 onwards, fRelay should be appended to version messages (BIP37)
 

From 1aa079771c84514c0ef3b6c72d31cf6ec0c9fadd Mon Sep 17 00:00:00 2001
From: Neil <neil@qtum.org>
Date: Fri, 30 Aug 2019 16:37:49 +0000
Subject: [PATCH 089/153] Clear cached values on revert

---
 src/qtum/qtumstate.cpp |  7 +++++++
 src/validation.cpp     | 28 ++++++++++++++--------------
 2 files changed, 21 insertions(+), 14 deletions(-)

diff --git a/src/qtum/qtumstate.cpp b/src/qtum/qtumstate.cpp
index 4a2167466..de0711f88 100644
--- a/src/qtum/qtumstate.cpp
+++ b/src/qtum/qtumstate.cpp
@@ -77,6 +77,13 @@ ResultExecute QtumState::execute(EnvInfo const& _envInfo, SealEngineFace const&
                 updateUTXO(vins);
             } else if(chainActive.Height() >= consensusParams.QIP7Height && res.excepted == TransactionException::RevertInstruction) {
             	e.revert();
+            	if(chainActive.Height() < consensusParams.nFixUTXOCacheHFHeight  && _p != Permanence::Reverted){
+            		deleteAccounts(_sealEngine.deleteAddresses);
+            		commit(CommitBehaviour::RemoveEmptyAccounts);
+            	} else {
+            		m_cache.clear();
+            		cacheUTXO.clear();
+            	}
             } else {
                 printfErrorLog(res.excepted);
             }
diff --git a/src/validation.cpp b/src/validation.cpp
index bed69f008..703fb19a5 100644
--- a/src/validation.cpp
+++ b/src/validation.cpp
@@ -2554,6 +2554,20 @@ bool ByteCodeExec::processingResults(ByteCodeExecResult& resultBCE){
     for(size_t i = 0; i < result.size(); i++){
         uint64_t gasUsed = (uint64_t) result[i].execRes.gasUsed;
 
+        if(result[i].execRes.excepted != dev::eth::TransactionException::None){
+        	// refund coins sent to the contract to the sender
+        	if(txs[i].value() > 0){
+        		CMutableTransaction tx;
+        		tx.vin.push_back(CTxIn(h256Touint(txs[i].getHashWith()), txs[i].getNVout(), CScript() << OP_SPEND));
+        		CScript script(CScript() << OP_DUP << OP_HASH160 << txs[i].sender().asBytes() << OP_EQUALVERIFY << OP_CHECKSIG);
+        		tx.vout.push_back(CTxOut(CAmount(txs[i].value()), script));
+        		resultBCE.valueTransfers.push_back(CTransaction(tx));
+        	}
+        	if(!(chainActive.Height() >= consensusParams.QIP7Height && result[i].execRes.excepted == dev::eth::TransactionException::RevertInstruction)){
+        	resultBCE.usedGas += gasUsed;
+        	}
+        }
+
         if(result[i].execRes.excepted == dev::eth::TransactionException::None || (chainActive.Height() >= consensusParams.QIP7Height && result[i].execRes.excepted == dev::eth::TransactionException::RevertInstruction)){
         	if(txs[i].gas() > UINT64_MAX ||
         			result[i].execRes.gasUsed > UINT64_MAX ||
@@ -2576,20 +2590,6 @@ bool ByteCodeExec::processingResults(ByteCodeExecResult& resultBCE){
         	}
         }
 
-        if(result[i].execRes.excepted != dev::eth::TransactionException::None){
-        	// refund coins sent to the contract to the sender
-        	if(txs[i].value() > 0){
-        		CMutableTransaction tx;
-        		tx.vin.push_back(CTxIn(h256Touint(txs[i].getHashWith()), txs[i].getNVout(), CScript() << OP_SPEND));
-        		CScript script(CScript() << OP_DUP << OP_HASH160 << txs[i].sender().asBytes() << OP_EQUALVERIFY << OP_CHECKSIG);
-        		tx.vout.push_back(CTxOut(CAmount(txs[i].value()), script));
-        		resultBCE.valueTransfers.push_back(CTransaction(tx));
-        	}
-        	if(!(chainActive.Height() >= consensusParams.QIP7Height && result[i].execRes.excepted == dev::eth::TransactionException::RevertInstruction)){
-        	resultBCE.usedGas += gasUsed;
-        	}
-        }
-
         if(result[i].tx != CTransaction()){
             resultBCE.valueTransfers.push_back(result[i].tx);
         }

From 0c12227f31968fa74e7e2529b91e14e82977e7d0 Mon Sep 17 00:00:00 2001
From: Neil <neil@qtum.org>
Date: Fri, 30 Aug 2019 22:55:08 +0000
Subject: [PATCH 090/153] Revert qtumstate changes

---
 src/qtum/qtumstate.cpp | 11 +----------
 1 file changed, 1 insertion(+), 10 deletions(-)

diff --git a/src/qtum/qtumstate.cpp b/src/qtum/qtumstate.cpp
index de0711f88..215187c4c 100644
--- a/src/qtum/qtumstate.cpp
+++ b/src/qtum/qtumstate.cpp
@@ -44,7 +44,6 @@ ResultExecute QtumState::execute(EnvInfo const& _envInfo, SealEngineFace const&
 
     CTransactionRef tx;
     u256 startGasUsed;
-    const Consensus::Params& consensusParams = Params().GetConsensus();
     try{
         if (_t.isCreation() && _t.value())
             BOOST_THROW_EXCEPTION(CreateWithValue());
@@ -75,15 +74,6 @@ ResultExecute QtumState::execute(EnvInfo const& _envInfo, SealEngineFace const&
                 }
                 std::unordered_map<dev::Address, Vin> vins = ctx.createVin(*tx);
                 updateUTXO(vins);
-            } else if(chainActive.Height() >= consensusParams.QIP7Height && res.excepted == TransactionException::RevertInstruction) {
-            	e.revert();
-            	if(chainActive.Height() < consensusParams.nFixUTXOCacheHFHeight  && _p != Permanence::Reverted){
-            		deleteAccounts(_sealEngine.deleteAddresses);
-            		commit(CommitBehaviour::RemoveEmptyAccounts);
-            	} else {
-            		m_cache.clear();
-            		cacheUTXO.clear();
-            	}
             } else {
                 printfErrorLog(res.excepted);
             }
@@ -98,6 +88,7 @@ ResultExecute QtumState::execute(EnvInfo const& _envInfo, SealEngineFace const&
         printfErrorLog(dev::eth::toTransactionException(_e));
         res.excepted = dev::eth::toTransactionException(_e);
         res.gasUsed = _t.gas();
+        const Consensus::Params& consensusParams = Params().GetConsensus();
         if(chainActive.Height() < consensusParams.nFixUTXOCacheHFHeight  && _p != Permanence::Reverted){
             deleteAccounts(_sealEngine.deleteAddresses);
             commit(CommitBehaviour::RemoveEmptyAccounts);

From c57ee028b3c56999471f1f3804f953e13d7aecae Mon Sep 17 00:00:00 2001
From: djaen <david.jaenson@qtum.org>
Date: Sat, 31 Aug 2019 01:51:13 +0200
Subject: [PATCH 091/153] Added tests for revert to check AAL state

---
 test/functional/qtum_evm_revert.py | 143 +++++++++++++++++++++++++++++
 test/functional/test_runner.py     |   1 +
 2 files changed, 144 insertions(+)
 create mode 100755 test/functional/qtum_evm_revert.py

diff --git a/test/functional/qtum_evm_revert.py b/test/functional/qtum_evm_revert.py
new file mode 100755
index 000000000..0c64bd88e
--- /dev/null
+++ b/test/functional/qtum_evm_revert.py
@@ -0,0 +1,143 @@
+#!/usr/bin/env python3
+# Copyright (c) 2015-2016 The Bitcoin Core developers
+# Distributed under the MIT software license, see the accompanying
+# file COPYING or http://www.opensource.org/licenses/mit-license.php.
+
+from test_framework.test_framework import BitcoinTestFramework
+from test_framework.util import *
+from test_framework.script import *
+from test_framework.mininode import *
+from test_framework.qtum import *
+from test_framework.qtumconfig import *
+import sys
+import io
+import pprint
+
+pp = pprint.PrettyPrinter()
+
+class QtumEVMRevertTest(BitcoinTestFramework):
+    def set_test_params(self):
+        self.setup_clean_chain = True
+        self.num_nodes = 1
+        self.extra_args = [['-logevents', '-minmempoolgaslimit=21000', '-constantinopleheight=704']]
+
+    def skip_test_if_missing_module(self):
+        self.skip_if_no_wallet()
+
+    def assert_revert_state(self, node, gas, gas_price, gas_used, value, excepted):
+        blockhash = node.getbestblockhash()
+        block = node.getblock(blockhash)
+        txids = block['tx']
+        coinstake_tx = node.getrawtransaction(txids[0], True, blockhash)
+        call_tx = node.getrawtransaction(txids[1], True, blockhash)
+        input_tx = node.decoderawtransaction(node.gettransaction(call_tx['vin'][0]['txid'])['hex'])
+        sender_utxo = input_tx['vout'][call_tx['vin'][0]['vout']]
+        sender_address = sender_utxo['scriptPubKey']['addresses'][0]
+
+        for op_call_vout_index in range(len(call_tx['vout'])):
+            if call_tx['vout'][op_call_vout_index]['scriptPubKey']['type'] == 'call':
+                break
+
+
+
+        # Check that the transaction receipt is correct
+        receipt = node.gettransactionreceipt(call_tx['txid'])[0]
+        assert_equal(receipt['gasUsed'], gas_used)
+        assert_equal(receipt['cumulativeGasUsed'], gas_used)
+        assert_equal(receipt['blockNumber'], block['height'])
+        assert_equal(receipt['blockHash'], block['hash'])
+        assert_equal(receipt['excepted'], excepted)
+        assert_equal(receipt['exceptedMessage'], '')
+        assert_equal(receipt['from'], p2pkh_to_hex_hash(sender_address))
+        assert_equal(receipt['transactionIndex'], 1)
+        assert_equal(receipt['transactionHash'], call_tx['txid'])
+        assert_equal(receipt['log'], [])
+
+        # If there is supposed to be a value refund tx, check that it:
+        #  - exists
+        #  - has the correct value
+        #  - has the correct input
+        #  - has the correct output
+        if value > 0:
+            refund_tx = node.getrawtransaction(txids[-1], True, blockhash)
+            refund_utxo = refund_tx['vout'][0]
+            assert_equal(len(refund_tx['vin']), 1)
+            assert_equal(refund_tx['vin'][0]['txid'], call_tx['txid'])
+            assert_equal(refund_tx['vin'][0]['vout'], op_call_vout_index)
+            assert_equal(refund_utxo['value'], value)
+            assert_equal(sender_utxo['scriptPubKey']['asm'], refund_utxo['scriptPubKey']['asm'])
+        else:
+            assert_equal(len(txids), 2)
+
+        # Check that the coinstake contains a gas refund (if one should exist)
+        if gas > gas_used:
+            gas_refund_output = coinstake_tx['vout'][-2]
+            assert_equal((gas_refund_output['value']*100000000)//10000000, ((gas-gas_used)*gas_price*100000000)//10000000)
+            assert_equal(sender_utxo['scriptPubKey']['asm'], gas_refund_output['scriptPubKey']['asm'])
+        else:
+            assert_equal(len(coinstake_tx['vout']), 2)
+
+
+        # Check that the state and utxo root remaing the same
+        prevblock = node.getblock(block['previousblockhash'])
+        assert_equal(block['hashStateRoot'], prevblock['hashStateRoot'])
+        assert_equal(block['hashUTXORoot'], prevblock['hashUTXORoot'])
+
+    def run_test(self):
+        # Dummy address to generate blocks to
+        dummy_key = ECKey()
+        dummy_key.generate()
+        dummy_address = hex_hash_to_p2pkh("12"*20)
+
+        self.nodes[0].generatetoaddress(200, self.nodes[0].getnewaddress())
+        self.nodes[0].generatetoaddress(COINBASE_MATURITY, dummy_address)
+        """
+            pragma solidity ^0.5.10;
+
+            contract Test{
+                event TestTest();
+                function () payable external {
+                    emit TestTest();
+                    revert();
+                }
+            }
+        """
+        bytecode = "6080604052348015600f57600080fd5b50606a80601d6000396000f3fe60806040527f902ab12fc657922f9e7e1085a23c967a546ad6f8a771c0b5c7db57f7aac0076e60405160405180910390a1600080fdfea265627a7a72315820f34015f936ea31587945269e841f6b9be1c85f068d25d05e23ebd9dcae356c8c64736f6c634300050b0032"
+        contract_address = self.nodes[0].createcontract(bytecode)['address']
+        self.nodes[0].generatetoaddress(1, dummy_address)
+
+        # Run a normal revert tx, will cause a throw since REVERT is undefined before qip7/constantinople
+        txid = self.nodes[0].sendtocontract(contract_address, "00", 10, 100000, 0.000001)['txid']
+        self.nodes[0].generatetoaddress(1, dummy_address)
+        self.assert_revert_state(self.nodes[0], gas=100000, gas_price=0.000001, gas_used=100000, value=10, excepted='BadInstruction')
+        
+        self.nodes[0].generatetoaddress(10, dummy_address)
+
+        # Run a normal revert tx
+        txid = self.nodes[0].sendtocontract(contract_address, "00", 10, 100000, 0.000001)['txid']
+        self.nodes[0].generatetoaddress(1, dummy_address)
+        self.assert_revert_state(self.nodes[0], gas=100000, gas_price=0.000001, gas_used=21805, value=10, excepted='Revert')
+
+        # run a revert tx with too little gas
+        txid = self.nodes[0].sendtocontract(contract_address, "00", 10, 21803, 0.000001)['txid']
+        self.nodes[0].generatetoaddress(1, dummy_address)
+        self.assert_revert_state(self.nodes[0], gas=21803, gas_price=0.000001, gas_used=21803, value=10, excepted='OutOfGas')
+
+        # run a revert tx with too little gas
+        txid = self.nodes[0].sendtocontract(contract_address, "00", 10, 21804, 0.000001)['txid']
+        self.nodes[0].generatetoaddress(1, dummy_address)
+        self.assert_revert_state(self.nodes[0], gas=21804, gas_price=0.000001, gas_used=21804, value=10, excepted='OutOfGas')
+
+        # run a revert tx with just enough gas
+        txid = self.nodes[0].sendtocontract(contract_address, "00", 10, 21805, 0.000001)['txid']
+        self.nodes[0].generatetoaddress(1, dummy_address)
+        self.assert_revert_state(self.nodes[0], gas=21805, gas_price=0.000001, gas_used=21805, value=10, excepted='Revert')
+
+        # run a revert tx with 1 gas more than required
+        txid = self.nodes[0].sendtocontract(contract_address, "00", 10, 21806, 0.000001)['txid']
+        self.nodes[0].generatetoaddress(1, dummy_address)
+        self.assert_revert_state(self.nodes[0], gas=21806, gas_price=0.000001, gas_used=21805, value=10, excepted='Revert')
+        
+
+if __name__ == '__main__':
+    QtumEVMRevertTest().main()
\ No newline at end of file
diff --git a/test/functional/test_runner.py b/test/functional/test_runner.py
index 6dcf01d12..f2b1ffad0 100755
--- a/test/functional/test_runner.py
+++ b/test/functional/test_runner.py
@@ -236,6 +236,7 @@
     'qtum_rpc_bitcore.py',
     'qtum_faulty_header_chain.py',
     'qtum_op_sender.py',
+    'qtum_evm_revert.py',
 ]
 
 EXTENDED_SCRIPTS = [

From ae1f52528cfe9cc873e9a5a498581b87e468bacc Mon Sep 17 00:00:00 2001
From: Time Markov <time.markov@qtum.com>
Date: Mon, 2 Sep 2019 12:58:02 +0200
Subject: [PATCH 092/153] Select P2PK or P2PKH unspent output for default
 sender address

---
 src/wallet/rpcwallet.cpp | 38 ++++++++++++++++++++++++++++++++++++--
 1 file changed, 36 insertions(+), 2 deletions(-)

diff --git a/src/wallet/rpcwallet.cpp b/src/wallet/rpcwallet.cpp
index 0cad8c2c5..582ce1f7d 100755
--- a/src/wallet/rpcwallet.cpp
+++ b/src/wallet/rpcwallet.cpp
@@ -151,6 +151,32 @@ static std::string LabelFromValue(const UniValue& value)
     return label;
 }
 
+bool SetDefaultSenderAddress(CWallet* const pwallet, interfaces::Chain::Lock& locked_chain, CCoinControl & coinControl)
+{
+    // Set default sender address if none provided
+    // Select any valid unspent output that can be used for contract sender address
+    std::vector<COutput> vecOutputs;
+    coinControl.fAllowOtherInputs=true;
+
+    assert(pwallet != NULL);
+    pwallet->AvailableCoins(locked_chain, vecOutputs, false, NULL, true);
+
+    for (const COutput& out : vecOutputs) {
+        CTxDestination destAdress;
+        const CScript& scriptPubKey = out.tx->tx->vout[out.i].scriptPubKey;
+        bool fValidAddress = ExtractDestination(scriptPubKey, destAdress)
+                && IsValidContractSenderAddress(destAdress);
+
+        if (!fValidAddress)
+            continue;
+
+        coinControl.Select(COutPoint(out.tx->GetHash(),out.i));
+        break;
+    }
+
+    return coinControl.HasSelected();
+}
+
 static UniValue getnewaddress(const JSONRPCRequest& request)
 {
     std::shared_ptr<CWallet> const wallet = GetWalletForJSONRPCRequest(request);
@@ -660,8 +686,12 @@ static UniValue createcontract(const JSONRPCRequest& request){
     CRecipient recipient = {scriptPubKey, 0, false};
     vecSend.push_back(recipient);
 
+    // Select default sender address unspent output
+    if(!coinControl.HasSelected() && !SetDefaultSenderAddress(pwallet, *locked_chain, coinControl))
+        throw JSONRPCError(RPC_TYPE_ERROR, "Sender address fail to set. Does not have any P2PK or P2PKH unspent outputs.");
+
     CTransactionRef tx;
-    if (!pwallet->CreateTransaction(*locked_chain, vecSend, tx, reservekey, nFeeRequired, nChangePosRet, strError, coinControl, true, nGasFee, fHasSender)) {
+    if (!pwallet->CreateTransaction(*locked_chain, vecSend, tx, reservekey, nFeeRequired, nChangePosRet, strError, coinControl, true, nGasFee, true)) {
         if (nFeeRequired > pwallet->GetBalance())
             strError = strprintf("Error: This transaction requires a transaction fee of at least %s because of its amount, complexity, or use of recently received funds!", FormatMoney(nFeeRequired));
         throw JSONRPCError(RPC_WALLET_ERROR, strError);
@@ -884,8 +914,12 @@ static UniValue sendtocontract(const JSONRPCRequest& request){
     CRecipient recipient = {scriptPubKey, nAmount, false};
     vecSend.push_back(recipient);
 
+    // Select default sender address unspent output
+    if(!coinControl.HasSelected() && !SetDefaultSenderAddress(pwallet, *locked_chain, coinControl))
+        throw JSONRPCError(RPC_TYPE_ERROR, "Sender address fail to set. Does not have any P2PK or P2PKH unspent outputs.");
+
     CTransactionRef tx;
-    if (!pwallet->CreateTransaction(*locked_chain, vecSend, tx, reservekey, nFeeRequired, nChangePosRet, strError, coinControl, true, nGasFee, fHasSender)) {
+    if (!pwallet->CreateTransaction(*locked_chain, vecSend, tx, reservekey, nFeeRequired, nChangePosRet, strError, coinControl, true, nGasFee, true)) {
         if (nFeeRequired > pwallet->GetBalance())
             strError = strprintf("Error: This transaction requires a transaction fee of at least %s because of its amount, complexity, or use of recently received funds!", FormatMoney(nFeeRequired));
         throw JSONRPCError(RPC_WALLET_ERROR, strError);

From 5be071f96da4db9c58edeecfb3ceb9a73c01a54f Mon Sep 17 00:00:00 2001
From: djaen <david.jaenson@qtum.org>
Date: Mon, 2 Sep 2019 21:44:18 +0200
Subject: [PATCH 093/153] Add test cases to the updated branch

---
 .../qtum_evm_constantinople_opcodes.py        | 441 ++++++++++++
 .../qtum_evm_constantinople_precompiles.py    | 662 ++++++++++++++++++
 test/functional/test_runner.py                |   2 +
 3 files changed, 1105 insertions(+)
 create mode 100755 test/functional/qtum_evm_constantinople_opcodes.py
 create mode 100755 test/functional/qtum_evm_constantinople_precompiles.py

diff --git a/test/functional/qtum_evm_constantinople_opcodes.py b/test/functional/qtum_evm_constantinople_opcodes.py
new file mode 100755
index 000000000..5d6376765
--- /dev/null
+++ b/test/functional/qtum_evm_constantinople_opcodes.py
@@ -0,0 +1,441 @@
+#!/usr/bin/env python3
+
+from test_framework.test_framework import BitcoinTestFramework
+from test_framework.util import *
+from test_framework.script import *
+from test_framework.mininode import *
+from test_framework.address import *
+from test_framework.qtum import *
+import pprint
+import subprocess
+
+pp = pprint.PrettyPrinter()
+
+class QtumEVMConstantinopleOpcodesTest(BitcoinTestFramework):
+    def set_test_params(self):
+        self.setup_clean_chain = True
+        self.num_nodes = 1
+        self.extra_args = [['-txindex=1', '-logevents=1', '-constantinopleheight=1000000']]
+
+    def send(self, abi, value=0):
+        self.last_txid = self.node.sendtocontract(self.contract_address, abi, value, 10000000)['txid']
+        self.node.generate(1)
+
+    def get_value_at_index(self, i):
+        info = self.node.callcontract(self.contract_address, "a05d8c0b" + hex(i)[2:].zfill(64))
+        #pp.pprint(info)
+        ret = info['executionResult']['output']
+        return ret
+
+    def reset(self):
+        self.node.sendtocontract(self.contract_address, 'd826f88f')
+        print(self.node.getblockcount())
+        self.node.generate(1)
+
+    def keccak256(self, data):
+        abi = "b8612c0a"
+        abi += hex(0x20)[2:].zfill(64)
+        abi += hex(len(data) // 2)[2:].zfill(64)
+        abi += data
+        return self.node.callcontract(self.contract_address, abi)['executionResult']['output']
+
+    def revert_test(self, should_fail):
+        abi = "9ca24dff"
+        self.send(abi)
+        # Make sure that all gas was not consumed as in throw
+        used_gas = self.node.gettransactionreceipt(self.last_txid)[0]['gasUsed']
+        if should_fail:
+            assert_equal(used_gas, 10000000)
+        else:
+            assert(used_gas < 100000)
+            # Make sure that the state change was reverted
+            assert_equal(self.get_value_at_index(0), "")
+
+    def dynamicreturndata_test(self, should_fail):
+        numValues = int(self.node.getbestblockhash()[1:2], 16)
+        abi = "1bbfb682"
+        self.send(abi)
+        for i in range(numValues):
+            ret = self.get_value_at_index(i)
+            if should_fail:
+                assert_equal(self.get_value_at_index(0), "")
+            else:
+                assert_equal(ret, "f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f" + hex(i)[2:])
+        ret = self.get_value_at_index(numValues)
+        assert_equal(ret, "")
+
+    def staticcall_test(self, should_fail):
+        abi = "9c9d8fbe"
+        self.send(abi)
+        if should_fail:
+            assert_equal(self.get_value_at_index(0), "")
+        else:
+            assert_equal(self.get_value_at_index(0), "0000000000000000000000000000000000000000000000000000000000000001")
+
+    def invalidstaticcall_test(self, should_fail):
+        abi = "47729055"
+        self.send(abi)
+        if should_fail:
+            assert_equal(self.get_value_at_index(0), "")
+        else:
+            assert_equal(self.get_value_at_index(0), "0000000000000000000000000000000000000000000000000000000000000000")
+
+    def shl_test(self, should_fail):
+        for i in range(500):
+            x = random.randint(0, 256)
+            y = random.randint(0, 255)
+            self.reset()
+            abi = "c5b319b2"
+            abi += hex(x)[2:].zfill(64)
+            abi += hex(1 << y)[2:].zfill(64)
+            self.send(abi)
+            if should_fail:
+                assert_equal(self.get_value_at_index(0), "")
+            else:
+                assert_equal(self.get_value_at_index(0), hex(((1 << y) << x) & (2**256-1))[2:].zfill(64))
+
+    def shr_test(self, should_fail):
+        for i in range(500):
+            x = random.randint(0, 256)
+            y = random.randint(0, 255)
+            self.reset()
+            abi = "08a86e5f"
+            abi += hex(x)[2:].zfill(64)
+            abi += hex(1 << y)[2:].zfill(64)
+            self.send(abi)
+            if should_fail:
+                assert_equal(self.get_value_at_index(0), "")
+            else:
+                assert_equal(self.get_value_at_index(0), hex(((1 << y) >> x) & (2**256-1))[2:].zfill(64))
+
+    def sar_test(self, should_fail):
+        cases = [
+            "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001",
+            "0000000000000000000000000000000000000000000000000000000000000001",
+
+            "00000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000001",
+            "0000000000000000000000000000000000000000000000000000000000000000",
+
+            "00000000000000000000000000000000000000000000000000000000000000018000000000000000000000000000000000000000000000000000000000000000",
+            "c000000000000000000000000000000000000000000000000000000000000000",
+
+            "00000000000000000000000000000000000000000000000000000000000000ff8000000000000000000000000000000000000000000000000000000000000000",
+            "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff",
+
+            "00000000000000000000000000000000000000000000000000000000000001008000000000000000000000000000000000000000000000000000000000000000",
+            "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff",
+
+            "00000000000000000000000000000000000000000000000000000000000001018000000000000000000000000000000000000000000000000000000000000000",
+            "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff",
+
+            "0000000000000000000000000000000000000000000000000000000000000000ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff",
+            "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff",
+
+            "0000000000000000000000000000000000000000000000000000000000000001ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff",
+            "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff",
+
+            "00000000000000000000000000000000000000000000000000000000000000ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff",
+            "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff",
+
+            "0000000000000000000000000000000000000000000000000000000000000100ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff",
+            "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff",
+
+            "00000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000000",
+            "0000000000000000000000000000000000000000000000000000000000000000",
+
+            "00000000000000000000000000000000000000000000000000000000000000fe4000000000000000000000000000000000000000000000000000000000000000",
+            "0000000000000000000000000000000000000000000000000000000000000001",
+
+            "00000000000000000000000000000000000000000000000000000000000000f87fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff",
+            "000000000000000000000000000000000000000000000000000000000000007f",
+
+            "00000000000000000000000000000000000000000000000000000000000000fe7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff",
+            "0000000000000000000000000000000000000000000000000000000000000001",
+
+            "00000000000000000000000000000000000000000000000000000000000000ff7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff",
+            "0000000000000000000000000000000000000000000000000000000000000000",
+
+            "00000000000000000000000000000000000000000000000000000000000001007fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff",
+            "0000000000000000000000000000000000000000000000000000000000000000",
+        ]
+        i = 0
+        while i < len(cases):
+            self.reset()
+            in_val = cases[i]
+            out_val = cases[i+1]
+            abi = "825d4ba3"
+            abi += in_val
+            print('SAR', in_val)
+            self.send(abi)
+            if should_fail:
+                assert_equal(self.get_value_at_index(0), "")
+            else:
+                assert_equal(self.get_value_at_index(0), out_val)
+
+            i += 2
+
+    def create2_test(self, should_fail):
+        # PostConstantinopleOpCodesTest
+        bytecode = "608060405234801561001057600080fd5b50610a57806100206000396000f3fe6080604052600436106100e85760003560e01c80639fcc18131161008a578063c5b319b211610059578063c5b319b214610473578063c9846c59146104b8578063d826f88f146104cf578063e5037fb1146104e6576100e8565b80639fcc181314610221578063a05d8c0b146102dc578063a1d98fa11461032b578063b8612c0a14610397576100e8565b80634f2f0adc116100c65780634f2f0adc1461015d578063825d4ba3146101ae5780639c9d8fbe146101f35780639ca24dff1461020a576100e8565b806308a86e5f146100ea5780631bbfb6821461012f5780634772905514610146575b005b3480156100f657600080fd5b5061012d6004803603604081101561010d57600080fd5b8101908080359060200190929190803590602001909291905050506104fd565b005b34801561013b57600080fd5b50610144610532565b005b34801561015257600080fd5b5061015b61061f565b005b34801561016957600080fd5b506101ac6004803603602081101561018057600080fd5b81019080803573ffffffffffffffffffffffffffffffffffffffff1690602001909291905050506106c1565b005b3480156101ba57600080fd5b506101f1600480360360408110156101d157600080fd5b8101908080359060200190929190803590602001909291905050506106f7565b005b3480156101ff57600080fd5b5061020861072c565b005b34801561021657600080fd5b5061021f6107ce565b005b6102da6004803603602081101561023757600080fd5b810190808035906020019064010000000081111561025457600080fd5b82018360208201111561026657600080fd5b8035906020019184600183028401116401000000008311171561028857600080fd5b91908080601f016020809104026020016040519081016040528093929190818152602001838380828437600081840152601f19601f82011690508083019250505050505050919291929050505061081f565b005b3480156102e857600080fd5b50610315600480360360208110156102ff57600080fd5b8101908080359060200190929190505050610863565b6040518082815260200191505060405180910390f35b34801561033757600080fd5b50610340610883565b6040518080602001828103825283818151815260200191508051906020019060200280838360005b83811015610383578082015181840152602081019050610368565b505050509050019250505060405180910390f35b3480156103a357600080fd5b5061045d600480360360208110156103ba57600080fd5b81019080803590602001906401000000008111156103d757600080fd5b8201836020820111156103e957600080fd5b8035906020019184600183028401116401000000008311171561040b57600080fd5b91908080601f016020809104026020016040519081016040528093929190818152602001838380828437600081840152601f19601f820116905080830192505050505050509192919290505050610925565b6040518082815260200191505060405180910390f35b34801561047f57600080fd5b506104b66004803603604081101561049657600080fd5b810190808035906020019092919080359060200190929190505050610936565b005b3480156104c457600080fd5b506104cd61096b565b005b3480156104db57600080fd5b506104e46109b9565b005b3480156104f257600080fd5b506104fb6109c8565b005b80821c915060008290806001815401808255809150509060018203906000526020600020016000909192909190915055505050565b60006060600060405180807f72657475726e7661726c656e6774682829000000000000000000000000000000815250601101905060405180910390207bffffffffffffffffffffffffffffffffffffffffffffffffffffffff1916905060008090506040518281526040519350600080600483600030620186a05a03f13d95506040519450602086036020863e5050600090505b82518110156106195760008382815181106105dd57fe5b602002602001015190806001815401808255809150509060018203906000526020600020016000909192909190915055508060010190506105c6565b50505050565b600060405180807f6d757461626c6563616c6c6261636b2829000000000000000000000000000000815250601101905060405180910390207bffffffffffffffffffffffffffffffffffffffffffffffffffffffff19169050600060405182815260008060048330620186a05a03fa91505060008190806001815401808255809150509060018203906000526020600020016000909192909190915055505050565b6000813f905060008190806001815401808255809150509060018203906000526020600020016000909192909190915055505050565b80821d915060008290806001815401808255809150509060018203906000526020600020016000909192909190915055505050565b600060405180807f73746174696363616c6c6261636b282900000000000000000000000000000000815250601001905060405180910390207bffffffffffffffffffffffffffffffffffffffffffffffffffffffff19169050600060405182815260008060048330620186a05a03fa91505060008190806001815401808255809150509060018203906000526020600020016000909192909190915055505050565b60007f0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef9080600181540180825580915050906001820390600052602060002001600090919290919091505550600080fd5b60008082519050600081602085016000f591506000829080600181540180825580915050906001820390600052602060002001600090919290919091505550505050565b600080828154811061087157fe5b90600052602060002001549050919050565b60606000600f600143034060001c1690506060816040519080825280602002602001820160405280156108c55781602001602082028038833980820191505090505b50905060008090505b8281101561091c57807ff0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f01782828151811061090557fe5b6020026020010181815250508060010190506108ce565b50809250505090565b600081805190602001209050919050565b80821b915060008290806001815401808255809150509060018203906000526020600020016000909192909190915055505050565b60007f12121212121212121212121212121212121212121212121212121212121212129080600181540180825580915050906001820390600052602060002001600090919290919091505550565b6000806109c691906109e5565b565b60008090505b600a8110156109e2578060010190506109ce565b50565b5080546000825590600052602060002090810190610a039190610a06565b50565b610a2891905b80821115610a24576000816000905550600101610a0c565b5090565b9056fea165627a7a72305820db27ae89f2aafaaa420f35ae90480db051520a88007ede039df1c2302d284ec20029"
+        abi = "9fcc1813"
+        abi += hex(0x20)[2:].zfill(64)
+        abi += hex(len(bytecode) // 2)[2:].zfill(64)
+        abi += bytecode
+        self.send(abi)
+        codehash = self.keccak256(bytecode)
+        expected_create2_address = self.keccak256("ff"+self.contract_address+("0"*64)+codehash)[24:]
+        if should_fail:
+            assert(expected_create2_address not in self.node.listcontracts())
+            return
+        else:
+            create2_address = self.get_value_at_index(0)[24:]
+            assert(create2_address in self.node.listcontracts())
+            assert_equal(expected_create2_address, create2_address)
+
+        # Send some value to the create2 address, should succeed
+        self.node.sendtocontract(create2_address, "00", 1)
+        self.node.generate(1)
+        if should_fail:
+            assert(expected_create2_address not in self.node.listcontracts())
+        else:
+            assert_equal(self.node.listcontracts()[create2_address], 1)
+
+        # Make sure that creating another exactly the same create2 contract fails
+        self.reset()
+        self.send(abi)
+        if should_fail:
+            assert_equal(self.get_value_at_index(0), "")
+        else:
+            assert_equal(self.get_value_at_index(0), "0"*64)
+
+        # Make sure that the value associated with the create2 address remains the same
+        if not should_fail:
+            assert_equal(self.node.listcontracts()[create2_address], 1)
+
+    def extcodehash_test(self, should_fail):
+        for contract_address in self.node.listcontracts().keys():
+            self.reset()
+            contract_bytecode = self.node.getaccountinfo(contract_address)['code']
+            expected_codehash = self.keccak256(contract_bytecode)
+
+            abi = "4f2f0adc"
+            abi += contract_address.zfill(64)
+            self.send(abi)
+            codehash = self.get_value_at_index(0)
+            if should_fail:
+                assert_equal(codehash, "")
+            else:
+                assert_equal(codehash, expected_codehash)
+
+    def run_test(self):
+        self.nodes[0].generate(COINBASE_MATURITY+50)
+        self.node = self.nodes[0]
+        """
+        pragma solidity ^0.5;
+
+        contract PostConstantinopleOpCodesTest {
+            uint256[] private ret;
+
+            function getRet(uint256 index) public view returns (uint256) {
+                return ret[index];
+            }
+
+            function reset()  public {
+                delete ret;
+            }
+
+            function staticcallback() pure public {
+                // do nothing
+                uint256 i;
+                for (i = 0; i < 10;++i) {}
+            }
+
+            function mutablecallback() public {
+                ret.push(0x1212121212121212121212121212121212121212121212121212121212121212);
+            }
+
+            function returnvarlength() public view returns (uint256[] memory) {
+                uint256 numElements = uint256(blockhash(block.number - 1)) & 0xf;
+                uint256[] memory arr = new uint256[](numElements);
+                for(uint i = 0; i < numElements; ++i) {
+                    arr[i] = 0xf0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0 | i;
+                }
+                return arr;
+            }
+
+            function revert_test() public {
+                ret.push(0x0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef);
+                assembly {
+                    revert(0, 0)
+                }
+            }
+
+            function dynamicreturndata_test() public {
+                uint256 retsize;
+                uint256[] memory arr;
+                bytes32 sig = bytes32(bytes4(keccak256("returnvarlength()")));
+                uint256 i = 0;
+                assembly {
+                    let x := mload(0x40)
+                    mstore(x, sig)
+                    arr := mload(0x40)
+                    let r := call(sub(gas, 100000), address, 0, x, 4, 0, 0)
+                    retsize := returndatasize
+                    arr := mload(0x40)
+                    returndatacopy(arr, 0x20, sub(retsize, 0x20))
+                }
+                for(i = 0; i < arr.length;++i) {
+                    ret.push(arr[i]);
+                }
+            }
+
+            function staticcall_test() public {
+                bytes32 sig = bytes32(bytes4(keccak256("staticcallback()")));
+                uint256 retval;
+                assembly {
+                    let x := mload(0x40)
+                    mstore(x, sig)
+                    retval := staticcall(sub(gas, 100000), address, x, 4, 0, 0)
+                }
+                ret.push(retval);
+            }
+
+            function invalidstaticcall_test() public {
+                bytes32 sig = bytes32(bytes4(keccak256("mutablecallback()")));
+                uint256 retval;
+                assembly {
+                    let x := mload(0x40)
+                    mstore(x, sig)
+                    retval := staticcall(sub(gas, 100000), address, x, 4, 0, 0)
+                }
+                ret.push(retval);   
+            }
+
+            function shl_test(uint256 x, uint256 y) public {
+                assembly {
+                    x := shl(x, y)
+                }
+                ret.push(x);
+            }
+
+            function shr_test(uint256 x, uint256 y) public {
+                assembly {
+                    x := shr(x, y)
+                }
+                ret.push(x);
+            }
+
+            function sar_test(uint256 x, uint256 y) public {
+                assembly {
+                    x := sar(x, y)
+                }
+                ret.push(x);
+            }
+
+            function extcodehash_test(address a) public {
+                uint256 r;
+                assembly {
+                    r := extcodehash(a)
+                }
+                ret.push(r);
+            }
+
+            function create2_test(bytes memory code) public payable {
+                uint256 r;
+                uint256 size = code.length;
+                assembly {
+                    r := create2(0, add(code, 0x20), size, 0x0)
+                }
+                ret.push(r);
+            }
+
+            // To avoid having to add a dependancy for the non-standard keccak256 used in the EVM
+            // we simply call it here to verify results of extcodehash and create2
+            function dokeccak256(bytes memory data) public view returns (bytes32) {
+                return keccak256(data);
+            }
+
+
+            function() external payable {}
+        }
+
+        9fcc1813: create2_test(bytes)
+        b8612c0a: dokeccak256(bytes)
+        1bbfb682: dynamicreturndata_test()
+        4f2f0adc: extcodehash_test(address)
+        a05d8c0b: getRet(uint256)
+        47729055: invalidstaticcall_test()
+        c9846c59: mutablecallback()
+        d826f88f: reset()
+        a1d98fa1: returnvarlength()
+        9ca24dff: revert_test()
+        825d4ba3: sar_test(uint256,uint256)
+        c5b319b2: shl_test(uint256,uint256)
+        08a86e5f: shr_test(uint256,uint256)
+        9c9d8fbe: staticcall_test()
+        e5037fb1: staticcallback()
+        """
+        bytecode = "608060405234801561001057600080fd5b50610a57806100206000396000f3fe6080604052600436106100e85760003560e01c80639fcc18131161008a578063c5b319b211610059578063c5b319b214610473578063c9846c59146104b8578063d826f88f146104cf578063e5037fb1146104e6576100e8565b80639fcc181314610221578063a05d8c0b146102dc578063a1d98fa11461032b578063b8612c0a14610397576100e8565b80634f2f0adc116100c65780634f2f0adc1461015d578063825d4ba3146101ae5780639c9d8fbe146101f35780639ca24dff1461020a576100e8565b806308a86e5f146100ea5780631bbfb6821461012f5780634772905514610146575b005b3480156100f657600080fd5b5061012d6004803603604081101561010d57600080fd5b8101908080359060200190929190803590602001909291905050506104fd565b005b34801561013b57600080fd5b50610144610532565b005b34801561015257600080fd5b5061015b61061f565b005b34801561016957600080fd5b506101ac6004803603602081101561018057600080fd5b81019080803573ffffffffffffffffffffffffffffffffffffffff1690602001909291905050506106c1565b005b3480156101ba57600080fd5b506101f1600480360360408110156101d157600080fd5b8101908080359060200190929190803590602001909291905050506106f7565b005b3480156101ff57600080fd5b5061020861072c565b005b34801561021657600080fd5b5061021f6107ce565b005b6102da6004803603602081101561023757600080fd5b810190808035906020019064010000000081111561025457600080fd5b82018360208201111561026657600080fd5b8035906020019184600183028401116401000000008311171561028857600080fd5b91908080601f016020809104026020016040519081016040528093929190818152602001838380828437600081840152601f19601f82011690508083019250505050505050919291929050505061081f565b005b3480156102e857600080fd5b50610315600480360360208110156102ff57600080fd5b8101908080359060200190929190505050610863565b6040518082815260200191505060405180910390f35b34801561033757600080fd5b50610340610883565b6040518080602001828103825283818151815260200191508051906020019060200280838360005b83811015610383578082015181840152602081019050610368565b505050509050019250505060405180910390f35b3480156103a357600080fd5b5061045d600480360360208110156103ba57600080fd5b81019080803590602001906401000000008111156103d757600080fd5b8201836020820111156103e957600080fd5b8035906020019184600183028401116401000000008311171561040b57600080fd5b91908080601f016020809104026020016040519081016040528093929190818152602001838380828437600081840152601f19601f820116905080830192505050505050509192919290505050610925565b6040518082815260200191505060405180910390f35b34801561047f57600080fd5b506104b66004803603604081101561049657600080fd5b810190808035906020019092919080359060200190929190505050610936565b005b3480156104c457600080fd5b506104cd61096b565b005b3480156104db57600080fd5b506104e46109b9565b005b3480156104f257600080fd5b506104fb6109c8565b005b80821c915060008290806001815401808255809150509060018203906000526020600020016000909192909190915055505050565b60006060600060405180807f72657475726e7661726c656e6774682829000000000000000000000000000000815250601101905060405180910390207bffffffffffffffffffffffffffffffffffffffffffffffffffffffff1916905060008090506040518281526040519350600080600483600030620186a05a03f13d95506040519450602086036020863e5050600090505b82518110156106195760008382815181106105dd57fe5b602002602001015190806001815401808255809150509060018203906000526020600020016000909192909190915055508060010190506105c6565b50505050565b600060405180807f6d757461626c6563616c6c6261636b2829000000000000000000000000000000815250601101905060405180910390207bffffffffffffffffffffffffffffffffffffffffffffffffffffffff19169050600060405182815260008060048330620186a05a03fa91505060008190806001815401808255809150509060018203906000526020600020016000909192909190915055505050565b6000813f905060008190806001815401808255809150509060018203906000526020600020016000909192909190915055505050565b80821d915060008290806001815401808255809150509060018203906000526020600020016000909192909190915055505050565b600060405180807f73746174696363616c6c6261636b282900000000000000000000000000000000815250601001905060405180910390207bffffffffffffffffffffffffffffffffffffffffffffffffffffffff19169050600060405182815260008060048330620186a05a03fa91505060008190806001815401808255809150509060018203906000526020600020016000909192909190915055505050565b60007f0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef9080600181540180825580915050906001820390600052602060002001600090919290919091505550600080fd5b60008082519050600081602085016000f591506000829080600181540180825580915050906001820390600052602060002001600090919290919091505550505050565b600080828154811061087157fe5b90600052602060002001549050919050565b60606000600f600143034060001c1690506060816040519080825280602002602001820160405280156108c55781602001602082028038833980820191505090505b50905060008090505b8281101561091c57807ff0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f01782828151811061090557fe5b6020026020010181815250508060010190506108ce565b50809250505090565b600081805190602001209050919050565b80821b915060008290806001815401808255809150509060018203906000526020600020016000909192909190915055505050565b60007f12121212121212121212121212121212121212121212121212121212121212129080600181540180825580915050906001820390600052602060002001600090919290919091505550565b6000806109c691906109e5565b565b60008090505b600a8110156109e2578060010190506109ce565b50565b5080546000825590600052602060002090810190610a039190610a06565b50565b610a2891905b80821115610a24576000816000905550600101610a0c565b5090565b9056fea165627a7a72305820db27ae89f2aafaaa420f35ae90480db051520a88007ede039df1c2302d284ec20029"
+        self.contract_address = self.node.createcontract(bytecode)['address']
+        self.node.generate(1)
+        #self.restart_node(0, ['-qip7height=1001', '-logevents'])
+
+        self.reset()
+        self.revert_test(should_fail=True)
+
+        self.reset()
+        self.dynamicreturndata_test(should_fail=True)
+
+        self.reset()
+        self.staticcall_test(should_fail=True)
+
+        self.reset()
+        self.invalidstaticcall_test(should_fail=True)
+
+        self.reset()
+        self.shl_test(should_fail=True)
+
+        self.reset()
+        self.shr_test(should_fail=True)
+
+        self.reset()
+        self.sar_test(should_fail=True)
+
+        self.reset()
+        self.create2_test(should_fail=True)
+
+        self.reset()
+        self.extcodehash_test(should_fail=True)
+
+        print('BEFORE RESTART', self.node.getblockcount())
+        self.restart_node(0, ['-constantinopleheight=2609', '-logevents'])
+
+        self.reset()
+        self.revert_test(should_fail=False)
+
+        self.reset()
+        self.dynamicreturndata_test(should_fail=False)
+
+        self.reset()
+        self.staticcall_test(should_fail=False)
+
+        self.reset()
+        self.invalidstaticcall_test(should_fail=False)
+
+        self.reset()
+        self.shl_test(should_fail=False)
+
+        self.reset()
+        self.shr_test(should_fail=False)
+
+        self.reset()
+        self.sar_test(should_fail=False)
+
+        self.reset()
+        self.create2_test(should_fail=False)
+
+        self.reset()
+        self.extcodehash_test(should_fail=False)
+
+if __name__ == '__main__':
+    QtumEVMConstantinopleOpcodesTest().main()
diff --git a/test/functional/qtum_evm_constantinople_precompiles.py b/test/functional/qtum_evm_constantinople_precompiles.py
new file mode 100755
index 000000000..eff93735e
--- /dev/null
+++ b/test/functional/qtum_evm_constantinople_precompiles.py
@@ -0,0 +1,662 @@
+#!/usr/bin/env python3
+
+from test_framework.test_framework import BitcoinTestFramework
+from test_framework.util import *
+from test_framework.script import *
+from test_framework.mininode import *
+from test_framework.address import *
+from test_framework.qtum import *
+import pprint
+import subprocess
+
+pp = pprint.PrettyPrinter()
+
+class QtumEVMConstantinoplePrecompiledContractsTest(BitcoinTestFramework):
+    def set_test_params(self):
+        self.setup_clean_chain = True
+        self.num_nodes = 1
+        self.extra_args = [['-txindex=1', '-logevents=1', '-constantinopleheight=1000000']]
+
+    def send_and_call_method(self, abi, point=False):
+        print(abi)
+        self.last_txid = self.node.sendtocontract(self.contract_address, abi, 0, 10000000)['txid']
+        self.node.generate(1)
+        if point:
+            ret = self.node.callcontract(self.contract_address, "767f2a89")['executionResult']['output']
+            ret += self.node.callcontract(self.contract_address, "a1461eef")['executionResult']['output']
+        else:
+            ret = self.node.callcontract(self.contract_address, "1b08d96f")['executionResult']['output']
+        return ret
+
+    def reset(self):
+        self.node.sendtocontract(self.contract_address, 'd826f88f')
+        self.node.generate(1)
+
+    def ecrecover_test(self):
+        cases = [
+            # use private key b"\x00"*32, this should fail, so output is b"\x00"*32
+            '7c1886d96dc50f07a48fa7d72006809ac9f45d6b1c34b7a072ace679674c64a230aac08d000000000000000000000000000000000000000000000000000000000000001c9c88b967e65708ae5b744502ec117fae31b7f787753e63d8cea7047e789bd55d1d5557b6eca94f4f7473c862cfb5488980d7e1e3eb764f5f11b0fe2281931d2e',
+            '0000000000000000000000000000000000000000000000000000000000000000',
+
+            # use message b"\x00"*1024
+            '7c1886d9b5d4d1df10388bbc208778ff02310db98fdaa68efed0b2068a9bef78bd3bfd74000000000000000000000000000000000000000000000000000000000000001c02637881f72c93e6e29b4086aeb5600c862189bcc7ac7f0a2659975f1391d9e921b305c078bea4a33f154b2ace7f712b317132d106d909376770aa06fb756a25',
+            '000000000000000000000000d32d23c9f11181971cc2163fa5f4f3b4685250ae',
+
+            # radmon generated data set
+            '7c1886d9f490f787ba2101ce9f72a58a7d82acdf32993fc52e6a13eb1395d3404c9e9b21000000000000000000000000000000000000000000000000000000000000001b9bdb59ce2220374bebf8293f9d585695f672669232217d8e83b32b23ca2806562cee90009f39b3f7469a9b2fb589acaf543c8d55411a7be9afb72a97c4b73ce9',
+            '0000000000000000000000004f54f1246244bae9a23b8dea4a6a5e0722bcc7af',
+
+            '7c1886d97250aed04dd0f9a0e35a43518cd3417c138c5feb2a7076e24b459e11208de51d000000000000000000000000000000000000000000000000000000000000001c5068b13e6508cd1f59b82707a4b062106e79176f9880052f5dadcf48282c0b043950e2a36e8e5dada244d0d5161435dfdf1ef16079feb2ec13fa84d2bab2f3c0',
+            '000000000000000000000000b30802ef79545a4099b9ed66fd7a3bea5e5e8069',
+
+            '7c1886d95f9b0413e1854cbe5ac199573d721d612a60e0dc8d33abe542201a7f26005912000000000000000000000000000000000000000000000000000000000000001b9673ecfb2cabfeac36518de803d0e31bc1fe5108d902928f24c847ca4920f24e77dacf3e9fbed0fc44dee07a0f17811e4e1211dbdcf2c71b3610dfcee6a78eac',
+            '000000000000000000000000a87050c8b8ada33f14ef25f8f1aaa717adfbc361',
+
+            '7c1886d9cf9074f027fbd1361e8cf0a54648eeeb430e995761628a275de2596ec621d811000000000000000000000000000000000000000000000000000000000000001cd50b8acfe5be99f1d886d6d328659870550b0fcd6c714087ec78d4858c35454d2f5cc6ef18d1f40f734a848c686a155dac5bab8a6a605bc23f9f9d65c5c2a680',
+            '00000000000000000000000016ad646a906a0166e464b777c5c8fe241ba1e2b1',
+
+            '7c1886d9b2b9b8d17edb52518ba589939a7dae09f21cc7864b8dbf8f10332697907f0ee0000000000000000000000000000000000000000000000000000000000000001c0f5dbd15a5e1eaf60130b5f5c8259d73f8b6c74b50592f1fec2d4a7a84b2f76653d1d57989cc5c156acb63ba42d29dc31927d32bac53174e6ef969edb29f17f8',
+            '00000000000000000000000062985497e536c37b380321b015ec0abcd79ec7bc',
+
+            '7c1886d96a73c7c3701605d2958a83c8866235b1d1fab380ca789d41cc8e47fe61615fcd000000000000000000000000000000000000000000000000000000000000001c9023000c14921c8ab1194e354fed920894186dbc6c8f5227765b07c16f8a1e5042a05641731af4c3422baebd6918ff6d8052317052f3832a9b62ecade0095699',
+            '000000000000000000000000016fcf577ef4aaa4a2d45625831c0e704e4e3d74',
+
+            '7c1886d94b344eceab3de0054f9ab25dc3b717ba1549bad862d19cbe158cda24819edfac000000000000000000000000000000000000000000000000000000000000001bb0dab103bc228acd28dade4b994e82d5f5dcd828b8187096b88411fc183914262b4e1b19e220c1c644eaf337c172e6cd6b9441d5085d1c7b28c0b8983bbe8524',
+            '000000000000000000000000fd8335a736b887af45c0371ea8fb0a573e26ae3d',
+
+            '7c1886d93e2b38946494ead1ad55c5de8f3ed7c27ca6ac49e6695ca9ffc246228a84a988000000000000000000000000000000000000000000000000000000000000001c0f8dd19c738ab674db0c8ed49f801b4537be06cf065ce0e1efbb9848cab638301df4e131efe10da58f11da306935635301d323ffc9317bff5f2a17197fc42918',
+            '000000000000000000000000a3b573d5b3777daf6ff43a6c6ba230a6752592d4',
+
+            '7c1886d90d5ca24233daf378d9191781a7175608663cb4ea295c29e84b044c82d353792e000000000000000000000000000000000000000000000000000000000000001bef6ab0777b83e95f2ffda28e8830653899c423d26844df1cf5d9eee0e1b7341057377689a70d467f939a46353e0957e64f4e71477b2befe484f903404ca26599',
+            '000000000000000000000000a4379b7bb3b16e533c98b039bc49812bc9394e43',
+
+            '7c1886d909611342bb9a099f754c3594a0fc4b1e9ef54f0fddabf247ae2bace040ac7bb2000000000000000000000000000000000000000000000000000000000000001caf9e9fb2de96c241427b385d0a46cbcd289ed1afa8f4f73cc7cca01d9cb34b5a6cc216073a7401cc78afdf4bedbc4884e797d2f28e3a09cc67508fd00216c1b3',
+            '0000000000000000000000005a36aca3ae19fee3eca8bdaca7be0ecc0573b0a2',
+
+            '7c1886d91314d07e0d781d481477dd9df89007f66bf7cd480664eeca8033cd9edcd40396000000000000000000000000000000000000000000000000000000000000001b91f7e128172e8c8ac5902a76aebfa5a6c848ccf559ec775f38de31ed26c9e2e47da785918773682e72317330f4b434e914c14e5c58a21b430b8f160a976c4a07',
+            '000000000000000000000000107ccd80e5a15814a8c71b54483880a2df9f1edc',
+
+            '7c1886d91597dbc56b18741d74163ea2c3eacaf3acfb5c88a77fa9467de3213fb2494017000000000000000000000000000000000000000000000000000000000000001cf9f13829c7d96e35c31a92c80a584483f21a7cad02728d59a594bb172e1d8f1260fcaf14482b80ee82dff4cb62afcf22e646227a5c764544e9e10eeb2e8dc0ba',
+            '0000000000000000000000007356c0bd3e18962e6e90fd3db9797cb18372aef8',
+
+            '7c1886d950d848acf661fcfb72292916ee401e8dbc773b3f1a421a9126c003ad052ecfa2000000000000000000000000000000000000000000000000000000000000001c56e0ac06963bb231d9689b44bd7b1448c50c29896ae7e176f2d085aefdaa01b14f387d838a53c83ad582a396f2c52a6de2ac1503442da484b56ff1633f88fb93',
+            '000000000000000000000000d496aba349085837deaea77db539295ef52ce890',
+
+            '7c1886d9f0d6c13034ae0a5790a4be3e12c75fb45076b1a5f1996382ebd3ba2b5cc36e97000000000000000000000000000000000000000000000000000000000000001cb88505d6994e3b6bbca213b3acbb62e77fab853d276968e0c78172e0df46e44e24c309b1cc6a78e58a62a33d3688a2480e5715c8219f9f4252cbd2e3973982ec',
+            '000000000000000000000000bd634693ff3e83a500a3d62828a71228387f9642',
+            '7c1886d97a8f78d4af1d905ab2fc218e92ee9b4e547e6023d5697659adeb95f4089ce4e2000000000000000000000000000000000000000000000000000000000000001b00cbc1f3e82ecec91ae8719a7ddc959573f9251412537918729057d49d17c9e05f16692b787bd6708b182c8ed255f41d9b7b3a1bce350f42bafdfecf9af85cbf',
+            '0000000000000000000000001399e4d330722b1ea712af241dc9af9a758dca14',
+
+            '7c1886d957880dd92ef5bdaf0044c5df8992fb15170bc161c48ab4f785086259e202bcac000000000000000000000000000000000000000000000000000000000000001c926f540902416e161e09e529f9813fb731637d82f91a3874d8e4d2268ca25eb13773ab20c414ed5790db4925e58ce3c5ca668d67d8fb2d45e0aedeb8ae86bb77',
+            '00000000000000000000000074e4557e80ef1500b5fdd3cb7d71ae41ea427ba8',
+
+            '7c1886d91b777bf54f05334d9462efe78ffd70b0d971e27df7d8ce9893e8e1dc911eaf8e000000000000000000000000000000000000000000000000000000000000001c6775824b761923a6d25f8a481457f72ab00a339ba851cb24afff16d1131f58785d91c468053f4488f06cdfcd18adc730b59473b00f87a6cefb91a13917046287',
+            '0000000000000000000000000405862b5559d869173bac3aa8a73d852d5732a4',
+
+            '7c1886d99f2024d49deed8eae41e61005839cd658a85a971bab4a6ec78cfb20cfc99f254000000000000000000000000000000000000000000000000000000000000001cf1de1b77e4408c97b0ecc1e4cd388ed0c7304b77be7d8c87474dcb9356db2bd364dddf49fb0681d5d64b95cee2448285b60e123ffabc2a2303a7ee4e2e8d0348',
+            '000000000000000000000000ba4a4506cf27c9c9c29f1e6e199372e2f048d428',
+
+            '7c1886d9da02f38f81d3405d4c4ea7756b44eedfc64ab15f93ad0cdd03aa366686d95804000000000000000000000000000000000000000000000000000000000000001c01bad6bdf71094ca8f9301fd70b1514a478d6f4718a73d190eaa5ded6a498ee936f2e74930e9091762ef6422c2e756bc5546aefedfc6c4b8254deefc4cb063da',
+            '000000000000000000000000da08935e20234eb636f478ef1ae231086d9bb98c',
+
+            '7c1886d965a8810d009890a9af4f0609efecfdd37e049364013e7fb7fce80c1e277d87c5000000000000000000000000000000000000000000000000000000000000001c406f6ac3c231ee629e550b4e7ae7104f4caa26701beb38a81f30420d3e7808e340ac46514352538369c289ac625826ba13698396393c96a7a0efda8611115fe1',
+            '0000000000000000000000008618d455ebfad54a19936c1fb3dc13d7f4f92f50',
+
+            '7c1886d99bcacd967e8c89ce69ee185b049b49aeb6071f1fd0cfb0e816f3e113252fafa3000000000000000000000000000000000000000000000000000000000000001c434ad762a0e2c7d37e29814a9ea632d7752bfa9b84b1682fb514069db117d9e254bdfae37c9454c626b5b47b5cbd70fc3ad1178a7fdfb0060ca9477e21942fb6',
+            '0000000000000000000000008dfc191dfe61a45dab291cd472f96ea770354a1b',
+
+            '7c1886d9681f968173991d634b52ac3af40669936d5bc25e1eeca29518721c9bb2976c53000000000000000000000000000000000000000000000000000000000000001cf6f36af5379d9c64e1275d2737ac135120bea6ee3017fb091e8b94e0e54148ec64affca5498a77e507392476b9c784cf00478297c1bbbf4c181628f7ce58810b',
+            '00000000000000000000000006c56f67fda5a5fe468b77c20f225d17a30cde0d',
+
+            '7c1886d95f36dbebfa6ff4d35a633fd0dd2beac7881627cfc0d5210300e256d688fa5710000000000000000000000000000000000000000000000000000000000000001c9b1fe821195abef93d6d25b2a570fb6ddad4c009a02e52ef7ab081e6a06563710abaa71d3df137868cb5abf4c7340b8eb3cee9cf16c5bcd6e7a7a4d12268678a',
+            '00000000000000000000000031b70bb97c9bf3b9531d2011325c581872a48110',
+
+            '7c1886d92794cdeb392db9c393134e5d5b0c203e9d2d2216eab39cc328691e930cd0b247000000000000000000000000000000000000000000000000000000000000001ca5ac49a2084a8ad1784f2d10d6d3ca79255cf9fd45768f472980e1157899aaa21473ab24eea963f02d25d38f4705f7f2e73fc0d214dbbe703248380e6186b4f8',
+            '000000000000000000000000c7adb89ce8a5e4cf911d4122485c3451cce96a2f',
+
+            '7c1886d91dab0491305d2038f947f931ebc4f501b48db6355c838af90bf625d68ec463e5000000000000000000000000000000000000000000000000000000000000001c9d708f6c937f44f1b99738c73c214bfd3333e6cfdc640d1b99d979140d009ff93a7ff98a1804dad2aa4b8e0f14c3be2341b2ab8b89c42520004358038e9c12cf',
+            '00000000000000000000000090d3d255397640ec2827bd205f6c4bed685a7d1c',
+
+            '7c1886d9b85104eaa5293d6c6471951811c368d5c7473abb29c63340153ef0e7159b9f7c000000000000000000000000000000000000000000000000000000000000001bd7c847c077bb1ba771891cf744ad394330e54be5553b3d23f30cdcac8ea3ba7a625f11ca98ef2722a01c87e0e4c96247551a3387c5429afe97604d2c841548eb',
+            '0000000000000000000000009c92800d00934defd1044e57f4cf821f0134da0f',
+
+            '7c1886d9ab81f6f3fde02ff561ad5296e03527e3a76f90fea5b57f2e60edc6996126e48e000000000000000000000000000000000000000000000000000000000000001bc8eca2230625b8e16e1497ab3f75cffcb87f38c21443412fbacdc2a33d4b3efd51f6883f5344bc37a78e3dc165044073c157753cb15688ffee408de512d1cfdb',
+            '0000000000000000000000004bad751caa111f985daf62a78ceeb990fb8a1d1a',
+
+            '7c1886d9ec2fd40c1e531fc681b8db1c75596d04a3347fe6fcd593dfffb537a95f9995f2000000000000000000000000000000000000000000000000000000000000001c120d0240ee0602f1cc467c0bdf0a62ef5720dcbbf8f74ea5176e4524aeb12ae54c378a59643311389c6c35cadfd53d92fb87d80f253f5e2f2b99746da965038c',
+            '0000000000000000000000006c5713ce99e7b8765295fd1d0aa222e2dd63ad0e',
+            '7c1886d9987f177b5644da1c9da525e97bf2fa526ecbef2992cc8636c026d21f484f1867000000000000000000000000000000000000000000000000000000000000001b74249a09ba188562c885b3bf460e79456b15bb6b124465bd4330692fbe957cb755effeac33df08e9ab43d92dd695403662b59349cf914e9eeaa3002a829c3b58',
+            '000000000000000000000000957c72d900768f6c0772669f2261050d73fd70f0',
+
+            '7c1886d9fe36e4e12dae2fdf8b88a65e39260d7b337ac167a79b5204cc5d5509556f5864000000000000000000000000000000000000000000000000000000000000001c7720582b196e09ed4daa63959bb7a1c682012b4ad30fe43a1c14e41a7604f0aa2aa623d17d3d0f45a1668b4b9a745cb7dcf5d307ac60040674535cce49ba9afe',
+            '000000000000000000000000c1e0158752f56d2d111c1a4db485b0e52d31f88d',
+
+            '7c1886d9eb2a1099bbb10196437a75023cdc5bfaf74900b57ae3168a96f5798269c2923a000000000000000000000000000000000000000000000000000000000000001cea2679060b6fa48088b901a3249e1ef637b9cec513e50a48ed2c61769c30d7b951a17b245249bb5cb6aac8e84fa40dc6246ac5ba4bc763bd6f14bac1ca7f302c',
+            '00000000000000000000000053d3bf34df249e24da25a78ff14decd92ed6b65f',
+
+            '7c1886d9636cb175f8752865d39b0e52802a9b4c7e1ac1550d467c2c284b05330ece6473000000000000000000000000000000000000000000000000000000000000001bd201b9ebf04132442b6cc325b5337ce7274080142a514dbd2933691669c7bbbb5f18f4f1f827be77367259ce49a2b67711a8f1b1bb06d4483987888ed0aa4053',
+            '0000000000000000000000003fe0a700914f713bfbd60a28518d40eb1865de6b',
+
+            '7c1886d9a2a81992aa8eb0376fc768d45029d0f8ee9638729766f050609fa59d6b8a74e5000000000000000000000000000000000000000000000000000000000000001b8986b652053f6a725cc6698e81bc3a03efec1d8c00a34f1bc44968eb38fbfdd66b79929d6def3809f228095f6c7618cbe83d9ea5acc52d4d7b88583f770db0ac',
+            '0000000000000000000000000365e882a0d4da20eacbb54f15dfc4c95228cec0',
+
+            '7c1886d95d1372a27abd2abaaeb8b596f5dbb9cfd69641072e6cc5ac94e7008000c50749000000000000000000000000000000000000000000000000000000000000001b6fab1e3db54ae0da6ce10b356d2a1d6d8d0d8a913414d57186b4d2f209daa21f353340b12f4a049d3c85930329165309438e70d6cdf121dcdb5e66a908c77a9c',
+            '0000000000000000000000006b5036d09f6de2e7cebe7f4d05fc1d67deb5c5cc',
+
+            '7c1886d935d58bf4e7fc6176cd4865f28a23b5aea54e95017984e3d244842ffaab7ea239000000000000000000000000000000000000000000000000000000000000001c970d5ae3c784cdf14f5e2eef19e2854ec3dd2ac7b084cd4cdce85ca4daf4908204ef2ff7a0894312157ebc2c3060441a12385ce9d98e2e9970e15b88b6a2fa3a',
+            '00000000000000000000000011c10d5c295cb54f5d2fad1ec759fd1fc7f79ba9',
+
+            '7c1886d9f8803fa369dce2bad475648f4227c0ea3465b59b5039daa0abdd0af06ccbb7ab000000000000000000000000000000000000000000000000000000000000001c31b46f427db3d8a9b2944f4befe4150bf38114af553c22c0100dc87cfb59ad2347597cc25953a700e3ed170a43b0c05acc0688c345188bccdfc277b651ac1759',
+            '000000000000000000000000f940a3655f490ae157325dcc226d5d61befd1136',
+
+            '7c1886d9b738020e5a0fa76b3df7e1404cd1e6831292a3d91c2f9fc1c787e6b7e733835e000000000000000000000000000000000000000000000000000000000000001bc6517057279c059ef2ea68ecced58526ddbd88b0e92b539b66423ea8ca8262624ccf5b74c8e770d102d2191edc9282b5ad6c9e77f98a3b62ace7583d4a5a2a47',
+            '00000000000000000000000043b0c2046e8b03647dbc22977e204c5a6bec8f5e',
+
+            '7c1886d96a9fa2fc110114404d7fe701f7c602c731f648652e7c76d993fee5db5012060c000000000000000000000000000000000000000000000000000000000000001c5ed8b1932be9f6a132e354cfc452f1555ffb74add87776bc4e3eaab34ed28c105ef99e9b456e4e4776681b8e36aa4763ea090f78ac9860c24211b28bb94a5082',
+            '00000000000000000000000006352e6be5e5f88cf9f5da078725e7212fd3acd9',
+
+            '7c1886d9c921fae289d6e059b5cef185112e2017a3e5e70ebaa91e126ed866fd5316e79e000000000000000000000000000000000000000000000000000000000000001bca2770bb42a37452200b15f362b05f3302896fc14d451f4f090a6bfe9afac45f1e7ed76d38be23ad29b46172faee9a4d894c7ac816ed4a92ab598bee92bb798e',
+            '000000000000000000000000c17a9bc69789b1281f87a6343664a3f7742c98b2',
+
+            '7c1886d99538f392af49bbfbd1d15dd7410500c74b9dc75e5b064f6f75e5f1768e9b4735000000000000000000000000000000000000000000000000000000000000001bb87f93d1299ac512d5a729d196e2adc81c7bb62d8ce7a86d28847a9ad3b32d4130b6d613aaae70a5f3594a0c5e1ff9f54332b922e604f025fe68d13ca2da5b81',
+            '000000000000000000000000fb2c379b5bbb8c3b82a24cbbb291535e15d1e573',
+
+            '7c1886d9458ea175ee548c59a0c56f1625f57f0de88964f17ec72f9ce4ed528dafbf87fb000000000000000000000000000000000000000000000000000000000000001cc2e436cc6a6274f41f1d76c2fa72423ec0b12fd6d924a49f5e1df8327d0076184ecc3b46832a4f45e403c530fb2897c3f29b59a2027e8116d8ec8d70e90ca44e',
+            '000000000000000000000000afcc275b880ca519f4a4b08cfc4dad215310c179'
+        ]
+
+        i = 0
+        while i < len(cases):
+            print(i)
+            in_val = cases[i]
+            out_val = cases[i+1]
+            ret = self.send_and_call_method(in_val)
+            assert_equal(ret, out_val)
+            i += 2
+
+    def sha256_test(self, should_fail=False):
+        def test(message):
+            if message is None:
+                message = hex(random.randint(0, 2**256))[2:].zfill(64)
+            else:
+                message = message.encode('utf-8').hex().zfill(64)
+            in_val = hex_str_to_bytes(message)
+            abi = "12bdedd7"
+            abi += "20".zfill(64)
+            abi += hex(len(in_val))[2:].zfill(64)
+            abi += bytes_to_hex_str(in_val) + ("00" * (32 - len(in_val)))
+            ret = self.send_and_call_method(abi)
+            assert_equal(ret, hashlib.new('sha256', in_val).hexdigest())
+
+        test("")
+        test("a")
+        test("abc")
+        test("abcdbcdecdefdefgefghfghighijhijkijkljklmklmnlmnomnopnopq")
+        test("abcdefghbcdefghicdefghijdefghijkefghijklfghijklmghijklmnhijklmnoijklmnopjklmnopqklmnopqrlmnopqrsmnopqrstnopqrstu")
+        test("abcdefghbcdefghicdefghijdefghijkefghijklfghijklmghijklmnhijklmno"*1024)
+
+        # random tests
+        for _ in range(100):
+            test(None)
+
+    def ripemd160_test(self, should_fail=False):
+        def test(message):
+            if message is None:
+                message = hex(random.randint(0, 2**256))[2:].zfill(64)
+            else:
+                message = message.encode('utf-8').hex().zfill(64)
+            in_val = hex_str_to_bytes(message)
+            abi = "e3c87216"
+            abi += "20".zfill(64)
+            abi += hex(len(in_val))[2:].zfill(64)
+            abi += bytes_to_hex_str(in_val) + ("00" * (32 - len(in_val)))
+            ret = self.send_and_call_method(abi)
+            assert_equal(ret[0:40], hashlib.new('ripemd160', in_val).hexdigest())
+
+        test("")
+        test("a")
+        test("abc")
+        test("abcdbcdecdefdefgefghfghighijhijkijkljklmklmnlmnomnopnopq")
+        test("abcdefghbcdefghicdefghijdefghijkefghijklfghijklmghijklmnhijklmnoijklmnopjklmnopqklmnopqrlmnopqrsmnopqrstnopqrstu")
+        test("abcdefghbcdefghicdefghijdefghijkefghijklfghijklmghijklmnhijklmno"*1024)
+
+        for _ in range(100):
+            test(None)
+
+    def identity_test(self, should_fail=False):
+        def test(message):
+            if message is None:
+                message = hex(random.randint(0, 2**256))[2:].zfill(64)
+            else:
+                message = message.encode('utf-8').hex().zfill(64)[:64]
+            in_out_val = message
+            abi = "3d9c8fdb"
+            abi += "20".zfill(64)
+            abi += hex(len(in_out_val) // 2)[2:].zfill(64)
+            abi += in_out_val
+            ret = self.send_and_call_method(abi)
+            assert_equal(ret, in_out_val)
+
+        test("")
+        test("a")
+        test("abc")
+        test("a"*32)
+        test("abcd"*8)
+
+        for i in range(100):        
+            test(None)
+
+    def modexp_test(self, should_fail=False):
+        for _ in range(100):
+            self.reset()
+            base = random.randint(0, 2**256)
+            e = random.randint(0, 2**256)
+            m = random.randint(0, 2**256)
+            abi = "fdcd12cb"
+            abi += hex(base)[2:].zfill(64)
+            abi += hex(e)[2:].zfill(64)
+            abi += hex(m)[2:].zfill(64)
+            ret = self.send_and_call_method(abi)
+            if should_fail:
+                assert_equal(ret, "0000000000000000000000000000000000000000000000000000000000000020")
+            else:
+                assert_equal(int(ret, 16), pow(base, e, m))
+
+    def bn256add_test(self, should_fail=False):
+        cases = [
+            "18b18acfb4c2c30276db5411368e7185b311dd124691610c5d3b74034e093dc9063c909c4720840cb5134cb9f59fa749755796819658d32efc0d288198f3726607c2b7f58a84bd6145f00c9c2bc0bb1a187f20ff2c92963a88019e7c6a014eed06614e20c147e940f2d70da3f74c9a17df361706a4485c742bd6788478fa17d7",
+            "2243525c5efd4b9c3d3c45ac0ca3fe4dd85e830a4ce6b65fa1eeaee202839703301d1d33be6da8e509df21cc35964723180eed7532537db9ae5e7d48f195c915",
+
+            "2243525c5efd4b9c3d3c45ac0ca3fe4dd85e830a4ce6b65fa1eeaee202839703301d1d33be6da8e509df21cc35964723180eed7532537db9ae5e7d48f195c91518b18acfb4c2c30276db5411368e7185b311dd124691610c5d3b74034e093dc9063c909c4720840cb5134cb9f59fa749755796819658d32efc0d288198f37266",
+            "2bd3e6d0f3b142924f5ca7b49ce5b9d54c4703d7ae5648e61d02268b1a0a9fb721611ce0a6af85915e2f1d70300909ce2e49dfad4a4619c8390cae66cefdb204",
+
+            "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
+            "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
+
+            "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
+            "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
+
+            "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
+            "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
+
+            "",
+            "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
+
+            "000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
+            "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
+
+            "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000002",
+            "00000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000002",
+
+            "000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
+            "00000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000002",
+
+            "00000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000002",
+            "00000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000002",
+
+            "0000000000000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
+            "00000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000002",
+
+            "000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
+            "00000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000002",
+
+            "0000000000000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000200000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000002",
+            "030644e72e131a029b85045b68181585d97816a916871ca8d3c208c16d87cfd315ed738c0e0a7c92e7845f96b2ae9c0a68a6a449e3538fc7ff3ebf7a5a18a2c4",
+
+            "000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
+            "030644e72e131a029b85045b68181585d97816a916871ca8d3c208c16d87cfd315ed738c0e0a7c92e7845f96b2ae9c0a68a6a449e3538fc7ff3ebf7a5a18a2c4",
+
+            "17c139df0efee0f766bc0204762b774362e4ded88953a39ce849a8a7fa163fa901e0559bacb160664764a357af8a9fe70baa9258e0b959273ffc5718c6d4cc7c039730ea8dff1254c0fee9c0ea777d29a9c710b7e616683f194f18c43b43b869073a5ffcc6fc7a28c30723d6e58ce577356982d65b833a5a5c15bf9024b43d98",
+            "15bf2bb17880144b5d1cd2b1f46eff9d617bffd1ca57c37fb5a49bd84e53cf66049c797f9ce0d17083deb32b5e36f2ea2a212ee036598dd7624c168993d1355f",
+
+            "17c139df0efee0f766bc0204762b774362e4ded88953a39ce849a8a7fa163fa901e0559bacb160664764a357af8a9fe70baa9258e0b959273ffc5718c6d4cc7c17c139df0efee0f766bc0204762b774362e4ded88953a39ce849a8a7fa163fa92e83f8d734803fc370eba25ed1f6b8768bd6d83887b87165fc2434fe11a830cb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
+            "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
+        ]
+
+        i = 0
+        while i < len(cases):
+            print(i)
+            in_val = cases[i]
+            print(in_val)
+            out_val = cases[i+1]
+            abi = "5327e297"
+            abi += in_val
+            ret = self.send_and_call_method(abi, point=True)
+            if should_fail:
+                assert_equal(ret, in_val[0:128] if len(in_val) >= 256 else "0"*128)
+            else:
+                assert_equal(ret, out_val)
+            i += 2
+
+    def bn256scalarmul_test(self, should_fail=False):
+        cases = [
+            "2bd3e6d0f3b142924f5ca7b49ce5b9d54c4703d7ae5648e61d02268b1a0a9fb721611ce0a6af85915e2f1d70300909ce2e49dfad4a4619c8390cae66cefdb20400000000000000000000000000000000000000000000000011138ce750fa15c2",
+            "070a8d6a982153cae4be29d434e8faef8a47b274a053f5a4ee2a6c9c13c31e5c031b8ce914eba3a9ffb989f9cdd5b0f01943074bf4f0f315690ec3cec6981afc",
+
+            "070a8d6a982153cae4be29d434e8faef8a47b274a053f5a4ee2a6c9c13c31e5c031b8ce914eba3a9ffb989f9cdd5b0f01943074bf4f0f315690ec3cec6981afc30644e72e131a029b85045b68181585d97816a916871ca8d3c208c16d87cfd46",
+            "025a6f4181d2b4ea8b724290ffb40156eb0adb514c688556eb79cdea0752c2bb2eff3f31dea215f1eb86023a133a996eb6300b44da664d64251d05381bb8a02e",
+
+            "025a6f4181d2b4ea8b724290ffb40156eb0adb514c688556eb79cdea0752c2bb2eff3f31dea215f1eb86023a133a996eb6300b44da664d64251d05381bb8a02e183227397098d014dc2822db40c0ac2ecbc0b548b438e5469e10460b6c3e7ea3",
+            "14789d0d4a730b354403b5fac948113739e276c23e0258d8596ee72f9cd9d3230af18a63153e0ec25ff9f2951dd3fa90ed0197bfef6e2a1a62b5095b9d2b4a27",
+
+            "1a87b0584ce92f4593d161480614f2989035225609f08058ccfa3d0f940febe31a2f3c951f6dadcc7ee9007dff81504b0fcd6d7cf59996efdc33d92bf7f9f8f6ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff",
+            "2cde5879ba6f13c0b5aa4ef627f159a3347df9722efce88a9afbb20b763b4c411aa7e43076f6aee272755a7f9b84832e71559ba0d2e0b17d5f9f01755e5b0d11",
+
+            "1a87b0584ce92f4593d161480614f2989035225609f08058ccfa3d0f940febe31a2f3c951f6dadcc7ee9007dff81504b0fcd6d7cf59996efdc33d92bf7f9f8f630644e72e131a029b85045b68181585d2833e84879b9709143e1f593f0000000",
+            "1a87b0584ce92f4593d161480614f2989035225609f08058ccfa3d0f940febe3163511ddc1c3f25d396745388200081287b3fd1472d8339d5fecb2eae0830451",
+
+            "1a87b0584ce92f4593d161480614f2989035225609f08058ccfa3d0f940febe31a2f3c951f6dadcc7ee9007dff81504b0fcd6d7cf59996efdc33d92bf7f9f8f60000000000000000000000000000000100000000000000000000000000000000",
+            "1051acb0700ec6d42a88215852d582efbaef31529b6fcbc3277b5c1b300f5cf0135b2394bb45ab04b8bd7611bd2dfe1de6a4e6e2ccea1ea1955f577cd66af85b",
+
+            "1a87b0584ce92f4593d161480614f2989035225609f08058ccfa3d0f940febe31a2f3c951f6dadcc7ee9007dff81504b0fcd6d7cf59996efdc33d92bf7f9f8f60000000000000000000000000000000000000000000000000000000000000009",
+            "1dbad7d39dbc56379f78fac1bca147dc8e66de1b9d183c7b167351bfe0aeab742cd757d51289cd8dbd0acf9e673ad67d0f0a89f912af47ed1be53664f5692575",
+
+            "1a87b0584ce92f4593d161480614f2989035225609f08058ccfa3d0f940febe31a2f3c951f6dadcc7ee9007dff81504b0fcd6d7cf59996efdc33d92bf7f9f8f60000000000000000000000000000000000000000000000000000000000000001",
+            "1a87b0584ce92f4593d161480614f2989035225609f08058ccfa3d0f940febe31a2f3c951f6dadcc7ee9007dff81504b0fcd6d7cf59996efdc33d92bf7f9f8f6",
+
+            "17c139df0efee0f766bc0204762b774362e4ded88953a39ce849a8a7fa163fa901e0559bacb160664764a357af8a9fe70baa9258e0b959273ffc5718c6d4cc7cffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff",
+            "29e587aadd7c06722aabba753017c093f70ba7eb1f1c0104ec0564e7e3e21f6022b1143f6a41008e7755c71c3d00b6b915d386de21783ef590486d8afa8453b1",
+
+            "17c139df0efee0f766bc0204762b774362e4ded88953a39ce849a8a7fa163fa901e0559bacb160664764a357af8a9fe70baa9258e0b959273ffc5718c6d4cc7c30644e72e131a029b85045b68181585d2833e84879b9709143e1f593f0000000",
+            "17c139df0efee0f766bc0204762b774362e4ded88953a39ce849a8a7fa163fa92e83f8d734803fc370eba25ed1f6b8768bd6d83887b87165fc2434fe11a830cb",
+
+            "17c139df0efee0f766bc0204762b774362e4ded88953a39ce849a8a7fa163fa901e0559bacb160664764a357af8a9fe70baa9258e0b959273ffc5718c6d4cc7c0000000000000000000000000000000100000000000000000000000000000000",
+            "221a3577763877920d0d14a91cd59b9479f83b87a653bb41f82a3f6f120cea7c2752c7f64cdd7f0e494bff7b60419f242210f2026ed2ec70f89f78a4c56a1f15",
+
+            "17c139df0efee0f766bc0204762b774362e4ded88953a39ce849a8a7fa163fa901e0559bacb160664764a357af8a9fe70baa9258e0b959273ffc5718c6d4cc7c0000000000000000000000000000000000000000000000000000000000000009",
+            "228e687a379ba154554040f8821f4e41ee2be287c201aa9c3bc02c9dd12f1e691e0fd6ee672d04cfd924ed8fdc7ba5f2d06c53c1edc30f65f2af5a5b97f0a76a",
+
+            "17c139df0efee0f766bc0204762b774362e4ded88953a39ce849a8a7fa163fa901e0559bacb160664764a357af8a9fe70baa9258e0b959273ffc5718c6d4cc7c0000000000000000000000000000000000000000000000000000000000000001",
+            "17c139df0efee0f766bc0204762b774362e4ded88953a39ce849a8a7fa163fa901e0559bacb160664764a357af8a9fe70baa9258e0b959273ffc5718c6d4cc7c",
+
+            "039730ea8dff1254c0fee9c0ea777d29a9c710b7e616683f194f18c43b43b869073a5ffcc6fc7a28c30723d6e58ce577356982d65b833a5a5c15bf9024b43d98ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff",
+            "00a1a234d08efaa2616607e31eca1980128b00b415c845ff25bba3afcb81dc00242077290ed33906aeb8e42fd98c41bcb9057ba03421af3f2d08cfc441186024",
+
+            "039730ea8dff1254c0fee9c0ea777d29a9c710b7e616683f194f18c43b43b869073a5ffcc6fc7a28c30723d6e58ce577356982d65b833a5a5c15bf9024b43d9830644e72e131a029b85045b68181585d2833e84879b9709143e1f593f0000000",
+            "039730ea8dff1254c0fee9c0ea777d29a9c710b7e616683f194f18c43b43b8692929ee761a352600f54921df9bf472e66217e7bb0cee9032e00acc86b3c8bfaf",
+
+            "039730ea8dff1254c0fee9c0ea777d29a9c710b7e616683f194f18c43b43b869073a5ffcc6fc7a28c30723d6e58ce577356982d65b833a5a5c15bf9024b43d980000000000000000000000000000000100000000000000000000000000000000",
+            "1071b63011e8c222c5a771dfa03c2e11aac9666dd097f2c620852c3951a4376a2f46fe2f73e1cf310a168d56baa5575a8319389d7bfa6b29ee2d908305791434",
+
+            "039730ea8dff1254c0fee9c0ea777d29a9c710b7e616683f194f18c43b43b869073a5ffcc6fc7a28c30723d6e58ce577356982d65b833a5a5c15bf9024b43d980000000000000000000000000000000000000000000000000000000000000009",
+            "19f75b9dd68c080a688774a6213f131e3052bd353a304a189d7a2ee367e3c2582612f545fb9fc89fde80fd81c68fc7dcb27fea5fc124eeda69433cf5c46d2d7f",
+
+            "039730ea8dff1254c0fee9c0ea777d29a9c710b7e616683f194f18c43b43b869073a5ffcc6fc7a28c30723d6e58ce577356982d65b833a5a5c15bf9024b43d980000000000000000000000000000000000000000000000000000000000000001",
+            "039730ea8dff1254c0fee9c0ea777d29a9c710b7e616683f194f18c43b43b869073a5ffcc6fc7a28c30723d6e58ce577356982d65b833a5a5c15bf9024b43d98",
+        ]
+
+        i = 0
+        while i < len(cases):
+            in_val = cases[i]
+            out_val = cases[i+1]
+            abi = "652dcd30"
+            abi += in_val
+            ret = self.send_and_call_method(abi, point=True)
+            if should_fail:
+                assert_equal(ret, in_val[0:128])
+            else:
+                assert_equal(ret, out_val)
+            i += 2
+
+    def bn256pairing_test(self, should_fail=False):
+        cases = [
+            "1c76476f4def4bb94541d57ebba1193381ffa7aa76ada664dd31c16024c43f593034dd2920f673e204fee2811c678745fc819b55d3e9d294e45c9b03a76aef41209dd15ebff5d46c4bd888e51a93cf99a7329636c63514396b4a452003a35bf704bf11ca01483bfa8b34b43561848d28905960114c8ac04049af4b6315a416782bb8324af6cfc93537a2ad1a445cfd0ca2a71acd7ac41fadbf933c2a51be344d120a2a4cf30c1bf9845f20c6fe39e07ea2cce61f0c9bb048165fe5e4de877550111e129f1cf1097710d41c4ac70fcdfa5ba2023c6ff1cbeac322de49d1b6df7c2032c61a830e3c17286de9462bf242fca2883585b93870a73853face6a6bf411198e9393920d483a7260bfb731fb5d25f1aa493335a9e71297e485b7aef312c21800deef121f1e76426a00665e5c4479674322d4f75edadd46debd5cd992f6ed090689d0585ff075ec9e99ad690c3395bc4b313370b38ef355acdadcd122975b12c85ea5db8c6deb4aab71808dcb408fe3d1e7690c43d37b4ce6cc0166fa7daa",
+            "0000000000000000000000000000000000000000000000000000000000000001",
+            
+            "2eca0c7238bf16e83e7a1e6c5d49540685ff51380f309842a98561558019fc0203d3260361bb8451de5ff5ecd17f010ff22f5c31cdf184e9020b06fa5997db841213d2149b006137fcfb23036606f848d638d576a120ca981b5b1a5f9300b3ee2276cf730cf493cd95d64677bbb75fc42db72513a4c1e387b476d056f80aa75f21ee6226d31426322afcda621464d0611d226783262e21bb3bc86b537e986237096df1f82dff337dd5972e32a8ad43e28a78a96a823ef1cd4debe12b6552ea5f06967a1237ebfeca9aaae0d6d0bab8e28c198c5a339ef8a2407e31cdac516db922160fa257a5fd5b280642ff47b65eca77e626cb685c84fa6d3b6882a283ddd1198e9393920d483a7260bfb731fb5d25f1aa493335a9e71297e485b7aef312c21800deef121f1e76426a00665e5c4479674322d4f75edadd46debd5cd992f6ed090689d0585ff075ec9e99ad690c3395bc4b313370b38ef355acdadcd122975b12c85ea5db8c6deb4aab71808dcb408fe3d1e7690c43d37b4ce6cc0166fa7daa",
+            "0000000000000000000000000000000000000000000000000000000000000001",
+            
+            "0f25929bcb43d5a57391564615c9e70a992b10eafa4db109709649cf48c50dd216da2f5cb6be7a0aa72c440c53c9bbdfec6c36c7d515536431b3a865468acbba2e89718ad33c8bed92e210e81d1853435399a271913a6520736a4729cf0d51eb01a9e2ffa2e92599b68e44de5bcf354fa2642bd4f26b259daa6f7ce3ed57aeb314a9a87b789a58af499b314e13c3d65bede56c07ea2d418d6874857b70763713178fb49a2d6cd347dc58973ff49613a20757d0fcc22079f9abd10c3baee245901b9e027bd5cfc2cb5db82d4dc9677ac795ec500ecd47deee3b5da006d6d049b811d7511c78158de484232fc68daf8a45cf217d1c2fae693ff5871e8752d73b21198e9393920d483a7260bfb731fb5d25f1aa493335a9e71297e485b7aef312c21800deef121f1e76426a00665e5c4479674322d4f75edadd46debd5cd992f6ed090689d0585ff075ec9e99ad690c3395bc4b313370b38ef355acdadcd122975b12c85ea5db8c6deb4aab71808dcb408fe3d1e7690c43d37b4ce6cc0166fa7daa",
+            "0000000000000000000000000000000000000000000000000000000000000001",
+            
+            "2f2ea0b3da1e8ef11914acf8b2e1b32d99df51f5f4f206fc6b947eae860eddb6068134ddb33dc888ef446b648d72338684d678d2eb2371c61a50734d78da4b7225f83c8b6ab9de74e7da488ef02645c5a16a6652c3c71a15dc37fe3a5dcb7cb122acdedd6308e3bb230d226d16a105295f523a8a02bfc5e8bd2da135ac4c245d065bbad92e7c4e31bf3757f1fe7362a63fbfee50e7dc68da116e67d600d9bf6806d302580dc0661002994e7cd3a7f224e7ddc27802777486bf80f40e4ca3cfdb186bac5188a98c45e6016873d107f5cd131f3a3e339d0375e58bd6219347b008122ae2b09e539e152ec5364e7e2204b03d11d3caa038bfc7cd499f8176aacbee1f39e4e4afc4bc74790a4a028aff2c3d2538731fb755edefd8cb48d6ea589b5e283f150794b6736f670d6a1033f9b46c6f5204f50813eb85c8dc4b59db1c5d39140d97ee4d2b36d99bc49974d18ecca3e7ad51011956051b464d9e27d46cc25e0764bb98575bd466d32db7b15f582b2d5c452b36aa394b789366e5e3ca5aabd415794ab061441e51d01e94640b7e3084a07e02c78cf3103c542bc5b298669f211b88da1679b0b64a63b7e0e7bfe52aae524f73a55be7fe70c7e9bfc94b4cf0da1213d2149b006137fcfb23036606f848d638d576a120ca981b5b1a5f9300b3ee2276cf730cf493cd95d64677bbb75fc42db72513a4c1e387b476d056f80aa75f21ee6226d31426322afcda621464d0611d226783262e21bb3bc86b537e986237096df1f82dff337dd5972e32a8ad43e28a78a96a823ef1cd4debe12b6552ea5f",
+            "0000000000000000000000000000000000000000000000000000000000000001",
+            
+            "20a754d2071d4d53903e3b31a7e98ad6882d58aec240ef981fdf0a9d22c5926a29c853fcea789887315916bbeb89ca37edb355b4f980c9a12a94f30deeed30211213d2149b006137fcfb23036606f848d638d576a120ca981b5b1a5f9300b3ee2276cf730cf493cd95d64677bbb75fc42db72513a4c1e387b476d056f80aa75f21ee6226d31426322afcda621464d0611d226783262e21bb3bc86b537e986237096df1f82dff337dd5972e32a8ad43e28a78a96a823ef1cd4debe12b6552ea5f1abb4a25eb9379ae96c84fff9f0540abcfc0a0d11aeda02d4f37e4baf74cb0c11073b3ff2cdbb38755f8691ea59e9606696b3ff278acfc098fa8226470d03869217cee0a9ad79a4493b5253e2e4e3a39fc2df38419f230d341f60cb064a0ac290a3d76f140db8418ba512272381446eb73958670f00cf46f1d9e64cba057b53c26f64a8ec70387a13e41430ed3ee4a7db2059cc5fc13c067194bcc0cb49a98552fd72bd9edb657346127da132e5b82ab908f5816c826acb499e22f2412d1a2d70f25929bcb43d5a57391564615c9e70a992b10eafa4db109709649cf48c50dd2198a1f162a73261f112401aa2db79c7dab1533c9935c77290a6ce3b191f2318d198e9393920d483a7260bfb731fb5d25f1aa493335a9e71297e485b7aef312c21800deef121f1e76426a00665e5c4479674322d4f75edadd46debd5cd992f6ed090689d0585ff075ec9e99ad690c3395bc4b313370b38ef355acdadcd122975b12c85ea5db8c6deb4aab71808dcb408fe3d1e7690c43d37b4ce6cc0166fa7daa",
+            "0000000000000000000000000000000000000000000000000000000000000001",
+        
+            "1c76476f4def4bb94541d57ebba1193381ffa7aa76ada664dd31c16024c43f593034dd2920f673e204fee2811c678745fc819b55d3e9d294e45c9b03a76aef41209dd15ebff5d46c4bd888e51a93cf99a7329636c63514396b4a452003a35bf704bf11ca01483bfa8b34b43561848d28905960114c8ac04049af4b6315a416782bb8324af6cfc93537a2ad1a445cfd0ca2a71acd7ac41fadbf933c2a51be344d120a2a4cf30c1bf9845f20c6fe39e07ea2cce61f0c9bb048165fe5e4de877550111e129f1cf1097710d41c4ac70fcdfa5ba2023c6ff1cbeac322de49d1b6df7c103188585e2364128fe25c70558f1560f4f9350baf3959e603cc91486e110936198e9393920d483a7260bfb731fb5d25f1aa493335a9e71297e485b7aef312c21800deef121f1e76426a00665e5c4479674322d4f75edadd46debd5cd992f6ed090689d0585ff075ec9e99ad690c3395bc4b313370b38ef355acdadcd122975b12c85ea5db8c6deb4aab71808dcb408fe3d1e7690c43d37b4ce6cc0166fa7daa",
+            "0000000000000000000000000000000000000000000000000000000000000000",
+        
+            "",
+            "0000000000000000000000000000000000000000000000000000000000000001",
+            
+            "00000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000002198e9393920d483a7260bfb731fb5d25f1aa493335a9e71297e485b7aef312c21800deef121f1e76426a00665e5c4479674322d4f75edadd46debd5cd992f6ed090689d0585ff075ec9e99ad690c3395bc4b313370b38ef355acdadcd122975b12c85ea5db8c6deb4aab71808dcb408fe3d1e7690c43d37b4ce6cc0166fa7daa",
+            "0000000000000000000000000000000000000000000000000000000000000000",
+ 
+            "00000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000002198e9393920d483a7260bfb731fb5d25f1aa493335a9e71297e485b7aef312c21800deef121f1e76426a00665e5c4479674322d4f75edadd46debd5cd992f6ed090689d0585ff075ec9e99ad690c3395bc4b313370b38ef355acdadcd122975b12c85ea5db8c6deb4aab71808dcb408fe3d1e7690c43d37b4ce6cc0166fa7daa00000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000002198e9393920d483a7260bfb731fb5d25f1aa493335a9e71297e485b7aef312c21800deef121f1e76426a00665e5c4479674322d4f75edadd46debd5cd992f6ed275dc4a288d1afb3cbb1ac09187524c7db36395df7be3b99e673b13a075a65ec1d9befcd05a5323e6da4d435f3b617cdb3af83285c2df711ef39c01571827f9d",
+            "0000000000000000000000000000000000000000000000000000000000000001",
+
+            "00000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000002203e205db4f19b37b60121b83a7333706db86431c6d835849957ed8c3928ad7927dc7234fd11d3e8c36c59277c3e6f149d5cd3cfa9a62aee49f8130962b4b3b9195e8aa5b7827463722b8c153931579d3505566b4edf48d498e185f0509de15204bb53b8977e5f92a0bc372742c4830944a59b4fe6b1c0466e2a6dad122b5d2e030644e72e131a029b85045b68181585d97816a916871ca8d3c208c16d87cfd31a76dae6d3272396d0cbe61fced2bc532edac647851e3ac53ce1cc9c7e645a83198e9393920d483a7260bfb731fb5d25f1aa493335a9e71297e485b7aef312c21800deef121f1e76426a00665e5c4479674322d4f75edadd46debd5cd992f6ed090689d0585ff075ec9e99ad690c3395bc4b313370b38ef355acdadcd122975b12c85ea5db8c6deb4aab71808dcb408fe3d1e7690c43d37b4ce6cc0166fa7daa",
+            "0000000000000000000000000000000000000000000000000000000000000001",
+
+            "105456a333e6d636854f987ea7bb713dfd0ae8371a72aea313ae0c32c0bf10160cf031d41b41557f3e7e3ba0c51bebe5da8e6ecd855ec50fc87efcdeac168bcc0476be093a6d2b4bbf907172049874af11e1b6267606e00804d3ff0037ec57fd3010c68cb50161b7d1d96bb71edfec9880171954e56871abf3d93cc94d745fa114c059d74e5b6c4ec14ae5864ebe23a71781d86c29fb8fb6cce94f70d3de7a2101b33461f39d9e887dbb100f170a2345dde3c07e256d1dfa2b657ba5cd030427000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000021a2c3013d2ea92e13c800cde68ef56a294b883f6ac35d25f587c09b1b3c635f7290158a80cd3d66530f74dc94c94adb88f5cdb481acca997b6e60071f08a115f2f997f3dbd66a7afe07fe7862ce239edba9e05c5afff7f8a1259c9733b2dfbb929d1691530ca701b4a106054688728c9972c8512e9789e9567aae23e302ccd75",
+            "0000000000000000000000000000000000000000000000000000000000000001",
+
+            "00000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000002198e9393920d483a7260bfb731fb5d25f1aa493335a9e71297e485b7aef312c21800deef121f1e76426a00665e5c4479674322d4f75edadd46debd5cd992f6ed090689d0585ff075ec9e99ad690c3395bc4b313370b38ef355acdadcd122975b12c85ea5db8c6deb4aab71808dcb408fe3d1e7690c43d37b4ce6cc0166fa7daa00000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000002198e9393920d483a7260bfb731fb5d25f1aa493335a9e71297e485b7aef312c21800deef121f1e76426a00665e5c4479674322d4f75edadd46debd5cd992f6ed275dc4a288d1afb3cbb1ac09187524c7db36395df7be3b99e673b13a075a65ec1d9befcd05a5323e6da4d435f3b617cdb3af83285c2df711ef39c01571827f9d00000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000002198e9393920d483a7260bfb731fb5d25f1aa493335a9e71297e485b7aef312c21800deef121f1e76426a00665e5c4479674322d4f75edadd46debd5cd992f6ed090689d0585ff075ec9e99ad690c3395bc4b313370b38ef355acdadcd122975b12c85ea5db8c6deb4aab71808dcb408fe3d1e7690c43d37b4ce6cc0166fa7daa00000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000002198e9393920d483a7260bfb731fb5d25f1aa493335a9e71297e485b7aef312c21800deef121f1e76426a00665e5c4479674322d4f75edadd46debd5cd992f6ed275dc4a288d1afb3cbb1ac09187524c7db36395df7be3b99e673b13a075a65ec1d9befcd05a5323e6da4d435f3b617cdb3af83285c2df711ef39c01571827f9d00000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000002198e9393920d483a7260bfb731fb5d25f1aa493335a9e71297e485b7aef312c21800deef121f1e76426a00665e5c4479674322d4f75edadd46debd5cd992f6ed090689d0585ff075ec9e99ad690c3395bc4b313370b38ef355acdadcd122975b12c85ea5db8c6deb4aab71808dcb408fe3d1e7690c43d37b4ce6cc0166fa7daa00000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000002198e9393920d483a7260bfb731fb5d25f1aa493335a9e71297e485b7aef312c21800deef121f1e76426a00665e5c4479674322d4f75edadd46debd5cd992f6ed275dc4a288d1afb3cbb1ac09187524c7db36395df7be3b99e673b13a075a65ec1d9befcd05a5323e6da4d435f3b617cdb3af83285c2df711ef39c01571827f9d00000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000002198e9393920d483a7260bfb731fb5d25f1aa493335a9e71297e485b7aef312c21800deef121f1e76426a00665e5c4479674322d4f75edadd46debd5cd992f6ed090689d0585ff075ec9e99ad690c3395bc4b313370b38ef355acdadcd122975b12c85ea5db8c6deb4aab71808dcb408fe3d1e7690c43d37b4ce6cc0166fa7daa00000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000002198e9393920d483a7260bfb731fb5d25f1aa493335a9e71297e485b7aef312c21800deef121f1e76426a00665e5c4479674322d4f75edadd46debd5cd992f6ed275dc4a288d1afb3cbb1ac09187524c7db36395df7be3b99e673b13a075a65ec1d9befcd05a5323e6da4d435f3b617cdb3af83285c2df711ef39c01571827f9d00000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000002198e9393920d483a7260bfb731fb5d25f1aa493335a9e71297e485b7aef312c21800deef121f1e76426a00665e5c4479674322d4f75edadd46debd5cd992f6ed090689d0585ff075ec9e99ad690c3395bc4b313370b38ef355acdadcd122975b12c85ea5db8c6deb4aab71808dcb408fe3d1e7690c43d37b4ce6cc0166fa7daa00000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000002198e9393920d483a7260bfb731fb5d25f1aa493335a9e71297e485b7aef312c21800deef121f1e76426a00665e5c4479674322d4f75edadd46debd5cd992f6ed275dc4a288d1afb3cbb1ac09187524c7db36395df7be3b99e673b13a075a65ec1d9befcd05a5323e6da4d435f3b617cdb3af83285c2df711ef39c01571827f9d",
+            "0000000000000000000000000000000000000000000000000000000000000001",
+ 
+            "00000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000002203e205db4f19b37b60121b83a7333706db86431c6d835849957ed8c3928ad7927dc7234fd11d3e8c36c59277c3e6f149d5cd3cfa9a62aee49f8130962b4b3b9195e8aa5b7827463722b8c153931579d3505566b4edf48d498e185f0509de15204bb53b8977e5f92a0bc372742c4830944a59b4fe6b1c0466e2a6dad122b5d2e030644e72e131a029b85045b68181585d97816a916871ca8d3c208c16d87cfd31a76dae6d3272396d0cbe61fced2bc532edac647851e3ac53ce1cc9c7e645a83198e9393920d483a7260bfb731fb5d25f1aa493335a9e71297e485b7aef312c21800deef121f1e76426a00665e5c4479674322d4f75edadd46debd5cd992f6ed090689d0585ff075ec9e99ad690c3395bc4b313370b38ef355acdadcd122975b12c85ea5db8c6deb4aab71808dcb408fe3d1e7690c43d37b4ce6cc0166fa7daa00000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000002203e205db4f19b37b60121b83a7333706db86431c6d835849957ed8c3928ad7927dc7234fd11d3e8c36c59277c3e6f149d5cd3cfa9a62aee49f8130962b4b3b9195e8aa5b7827463722b8c153931579d3505566b4edf48d498e185f0509de15204bb53b8977e5f92a0bc372742c4830944a59b4fe6b1c0466e2a6dad122b5d2e030644e72e131a029b85045b68181585d97816a916871ca8d3c208c16d87cfd31a76dae6d3272396d0cbe61fced2bc532edac647851e3ac53ce1cc9c7e645a83198e9393920d483a7260bfb731fb5d25f1aa493335a9e71297e485b7aef312c21800deef121f1e76426a00665e5c4479674322d4f75edadd46debd5cd992f6ed090689d0585ff075ec9e99ad690c3395bc4b313370b38ef355acdadcd122975b12c85ea5db8c6deb4aab71808dcb408fe3d1e7690c43d37b4ce6cc0166fa7daa00000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000002203e205db4f19b37b60121b83a7333706db86431c6d835849957ed8c3928ad7927dc7234fd11d3e8c36c59277c3e6f149d5cd3cfa9a62aee49f8130962b4b3b9195e8aa5b7827463722b8c153931579d3505566b4edf48d498e185f0509de15204bb53b8977e5f92a0bc372742c4830944a59b4fe6b1c0466e2a6dad122b5d2e030644e72e131a029b85045b68181585d97816a916871ca8d3c208c16d87cfd31a76dae6d3272396d0cbe61fced2bc532edac647851e3ac53ce1cc9c7e645a83198e9393920d483a7260bfb731fb5d25f1aa493335a9e71297e485b7aef312c21800deef121f1e76426a00665e5c4479674322d4f75edadd46debd5cd992f6ed090689d0585ff075ec9e99ad690c3395bc4b313370b38ef355acdadcd122975b12c85ea5db8c6deb4aab71808dcb408fe3d1e7690c43d37b4ce6cc0166fa7daa00000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000002203e205db4f19b37b60121b83a7333706db86431c6d835849957ed8c3928ad7927dc7234fd11d3e8c36c59277c3e6f149d5cd3cfa9a62aee49f8130962b4b3b9195e8aa5b7827463722b8c153931579d3505566b4edf48d498e185f0509de15204bb53b8977e5f92a0bc372742c4830944a59b4fe6b1c0466e2a6dad122b5d2e030644e72e131a029b85045b68181585d97816a916871ca8d3c208c16d87cfd31a76dae6d3272396d0cbe61fced2bc532edac647851e3ac53ce1cc9c7e645a83198e9393920d483a7260bfb731fb5d25f1aa493335a9e71297e485b7aef312c21800deef121f1e76426a00665e5c4479674322d4f75edadd46debd5cd992f6ed090689d0585ff075ec9e99ad690c3395bc4b313370b38ef355acdadcd122975b12c85ea5db8c6deb4aab71808dcb408fe3d1e7690c43d37b4ce6cc0166fa7daa00000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000002203e205db4f19b37b60121b83a7333706db86431c6d835849957ed8c3928ad7927dc7234fd11d3e8c36c59277c3e6f149d5cd3cfa9a62aee49f8130962b4b3b9195e8aa5b7827463722b8c153931579d3505566b4edf48d498e185f0509de15204bb53b8977e5f92a0bc372742c4830944a59b4fe6b1c0466e2a6dad122b5d2e030644e72e131a029b85045b68181585d97816a916871ca8d3c208c16d87cfd31a76dae6d3272396d0cbe61fced2bc532edac647851e3ac53ce1cc9c7e645a83198e9393920d483a7260bfb731fb5d25f1aa493335a9e71297e485b7aef312c21800deef121f1e76426a00665e5c4479674322d4f75edadd46debd5cd992f6ed090689d0585ff075ec9e99ad690c3395bc4b313370b38ef355acdadcd122975b12c85ea5db8c6deb4aab71808dcb408fe3d1e7690c43d37b4ce6cc0166fa7daa",
+            "0000000000000000000000000000000000000000000000000000000000000001",
+            
+            "105456a333e6d636854f987ea7bb713dfd0ae8371a72aea313ae0c32c0bf10160cf031d41b41557f3e7e3ba0c51bebe5da8e6ecd855ec50fc87efcdeac168bcc0476be093a6d2b4bbf907172049874af11e1b6267606e00804d3ff0037ec57fd3010c68cb50161b7d1d96bb71edfec9880171954e56871abf3d93cc94d745fa114c059d74e5b6c4ec14ae5864ebe23a71781d86c29fb8fb6cce94f70d3de7a2101b33461f39d9e887dbb100f170a2345dde3c07e256d1dfa2b657ba5cd030427000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000021a2c3013d2ea92e13c800cde68ef56a294b883f6ac35d25f587c09b1b3c635f7290158a80cd3d66530f74dc94c94adb88f5cdb481acca997b6e60071f08a115f2f997f3dbd66a7afe07fe7862ce239edba9e05c5afff7f8a1259c9733b2dfbb929d1691530ca701b4a106054688728c9972c8512e9789e9567aae23e302ccd75",
+            "0000000000000000000000000000000000000000000000000000000000000001"
+        ]
+        
+        i = 0
+        while i < len(cases):
+            print(i)
+            in_val = cases[i]
+            out_val = cases[i+1]
+            abi = "1a0ffebe"
+            abi += "20".zfill(64)
+            abi += hex(len(in_val) // 2)[2:].zfill(64)
+            abi += in_val
+            ret = self.send_and_call_method(abi)
+            if should_fail:
+                assert_equal(ret, "0"*64)
+            else:
+                assert_equal(ret, out_val)
+            i += 2
+
+    def run_test(self):
+        self.nodes[0].generate(COINBASE_MATURITY+50)
+        self.node = self.nodes[0]
+        """
+        pragma solidity ^0.5;
+
+        contract PrecompilesTest {
+            uint256 public ret;
+            uint256 public pointX;
+            uint256 public pointY;
+
+            function reset() public {
+                ret = 0xffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff;
+                pointX = 0xffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff;
+                pointY = 0xffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff;
+            }
+
+            function ecrecover_test(bytes32 h, uint8 v, bytes32 r, bytes32 s) public {
+                ret = uint256(ecrecover(h, v, r, s));
+            }
+
+            function sha256_test(bytes memory data) public {
+                ret = uint256(sha256(data));
+            }
+
+            function ripemd160_test(bytes memory data) public {
+                ret = uint256(bytes32(ripemd160(data)));
+            }
+
+            function identity_test(bytes memory data) public {
+                uint256 o;
+                uint256 size = data.length;
+                assembly {
+                    let p := mload(0x40)
+                    let success := call(sub(gas, 2000), 0x04, 0, add(data, 0x20), size, p, size)
+                    switch success case 0 {
+                        o := 0xffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
+                    } default {
+                        o := mload(p)
+                    }
+                }
+                ret = o;
+            }
+
+            function expmod_test(uint256 base, uint256 e, uint256 m) public {
+                uint256 o;
+                assembly {
+                    let p := mload(0x40)
+                    mstore(p, 0x20)
+                    mstore(add(p, 0x20), 0x20)
+                    mstore(add(p, 0x40), 0x20)
+                    mstore(add(p, 0x60), base)
+                    mstore(add(p, 0x80), e)
+                    mstore(add(p, 0xa0), m)
+                    let success := call(sub(gas, 2000), 0x05, 0, p, 0xc0, p, 0x20)
+                    switch success case 0 {
+                        o := 0xffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
+                    } default {
+                        o := mload(p)
+                    }
+                }
+                ret = o;
+            }
+
+            function bn256add_test(uint256[2] memory pointA, uint256[2] memory pointB) public {
+                uint256 localX;
+                uint256 localY;
+                uint256 size = 0x80;
+                assembly {
+                    let p := mload(0x40)
+                    mstore(add(p, 0x0), mload(pointA))
+                    mstore(add(p, 0x20), mload(add(pointA, 0x20)))
+                    mstore(add(p, 0x40), mload(pointB))
+                    mstore(add(p, 0x60), mload(add(pointB, 0x20)))
+                    let success := call(sub(gas, 2000), 0x06, 0, p, size, p, 0x40)
+                    switch success case 0 {
+                        localX := 0xffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
+                        localY := 0xffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
+                    } default {
+                        localX := mload(p)
+                        localY := mload(add(p, 0x20))
+                    }
+                }
+                pointX = localX;
+                pointY = localY;
+            }
+
+            function bn256scalarmul_test(uint256[2] memory point, uint256 scalar) public {
+                uint256 localX;
+                uint256 localY;
+                uint256 size = 0x60;
+                assembly {
+                    let p := mload(0x40)
+                    mstore(add(p, 0x0), mload(point))
+                    mstore(add(p, 0x20), mload(add(point, 0x20)))
+                    mstore(add(p, 0x40), scalar)
+                    let success := call(sub(gas, 2000), 0x07, 0, p, size, p, 0x40)
+                    switch success case 0 {
+                        localX := 0xffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
+                        localY := 0xffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
+                    } default {
+                        localX := mload(p)
+                        localY := mload(add(p, 0x20))
+                    }
+                }
+                pointX = localX;
+                pointY = localY;
+            }
+
+            function bn256pairing_test(bytes memory points) public {
+                uint256 o;
+                uint256 size = points.length;
+                assembly {
+                    let p := mload(0x40)
+                    let success := call(sub(gas, 2000), 0x08, 0, add(points, 0x20), size, p, 0x20)
+                    switch success case 0 {
+                        o := 0xffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
+                    } default {
+                        o := mload(p)
+                    }
+                }
+                ret = o;
+            }
+        }
+
+        5327e297: bn256add_test(uint256[2],uint256[2])
+        1a0ffebe: bn256pairing_test(bytes)
+        652dcd30: bn256scalarmul_test(uint256[2],uint256)
+        7c1886d9: ecrecover_test(bytes32,uint8,bytes32,bytes32)
+        fdcd12cb: expmod_test(uint256,uint256,uint256)
+        3d9c8fdb: identity_test(bytes)
+        767f2a89: pointX()
+        a1461eef: pointY()
+        d826f88f: reset()
+        1b08d96f: ret()
+        e3c87216: ripemd160_test(bytes)
+        12bdedd7: sha256_test(bytes)
+        """
+        bytecode = "608060405234801561001057600080fd5b50610b1b806100206000396000f3fe608060405234801561001057600080fd5b50600436106100d1576000357c010000000000000000000000000000000000000000000000000000000090048063767f2a891161008e578063767f2a891461043a5780637c1886d914610458578063a1461eef146104a7578063d826f88f146104c5578063e3c87216146104cf578063fdcd12cb1461058a576100d1565b806312bdedd7146100d65780631a0ffebe146101915780631b08d96f1461024c5780633d9c8fdb1461026a5780635327e29714610325578063652dcd30146103cb575b600080fd5b61018f600480360360208110156100ec57600080fd5b810190808035906020019064010000000081111561010957600080fd5b82018360208201111561011b57600080fd5b8035906020019184600183028401116401000000008311171561013d57600080fd5b91908080601f016020809104026020016040519081016040528093929190818152602001838380828437600081840152601f19601f8201169050808301925050505050505091929192905050506105cc565b005b61024a600480360360208110156101a757600080fd5b81019080803590602001906401000000008111156101c457600080fd5b8201836020820111156101d657600080fd5b803590602001918460018302840111640100000000831117156101f857600080fd5b91908080601f016020809104026020016040519081016040528093929190818152602001838380828437600081840152601f19601f820116905080830192505050505050509192919290505050610681565b005b6102546106e2565b6040518082815260200191505060405180910390f35b6103236004803603602081101561028057600080fd5b810190808035906020019064010000000081111561029d57600080fd5b8201836020820111156102af57600080fd5b803590602001918460018302840111640100000000831117156102d157600080fd5b91908080601f016020809104026020016040519081016040528093929190818152602001838380828437600081840152601f19601f8201169050808301925050505050505091929192905050506106e8565b005b6103c96004803603608081101561033b57600080fd5b8101908080604001906002806020026040519081016040528092919082600260200280828437600081840152601f19601f820116905080830192505050505050919291929080604001906002806020026040519081016040528092919082600260200280828437600081840152601f19601f8201169050808301925050505050509192919290505050610748565b005b610438600480360360608110156103e157600080fd5b8101908080604001906002806020026040519081016040528092919082600260200280828437600081840152601f19601f8201169050808301925050505050509192919290803590602001909291905050506107fd565b005b6104426108a7565b6040518082815260200191505060405180910390f35b6104a56004803603608081101561046e57600080fd5b8101908080359060200190929190803560ff16906020019092919080359060200190929190803590602001909291905050506108ad565b005b6104af610940565b6040518082815260200191505060405180910390f35b6104cd610946565b005b610588600480360360208110156104e557600080fd5b810190808035906020019064010000000081111561050257600080fd5b82018360208201111561051457600080fd5b8035906020019184600183028401116401000000008311171561053657600080fd5b91908080601f016020809104026020016040519081016040528093929190818152602001838380828437600081840152601f19601f8201169050808301925050505050505091929192905050506109bd565b005b6105ca600480360360608110156105a057600080fd5b81019080803590602001909291908035906020019092919080359060200190929190505050610a71565b005b6002816000604051602001526040518082805190602001908083835b6020831061060b57805182526020820191506020810190506020830392506105e8565b6001836020036101000a0380198251168184511680821785525050505050509050019150506020604051808303816000866161da5a03f115801561064e57600080fd5b50505060405160208081101561066357600080fd5b81019080805190602001909291905050506001900460008190555050565b600080825190506040516020818360208701600060086107d05a03f180600081146106af57825194506106d3565b7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff94505b50505081600081905550505050565b60005481565b6000808251905060405181818360208701600060046107d05a03f180600081146107155782519450610739565b7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff94505b50505081600081905550505050565b600080600060809050604051855160008201526020860151602082015284516040820152602085015160608201526040818383600060066107d05a03f1806000811461079e5782519550602083015194506107e5565b7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff95507fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff94505b50505082600181905550816002819055505050505050565b60008060006060905060405185516000820152602086015160208201528460408201526040818383600060076107d05a03f1806000811461084857825195506020830151945061088f565b7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff95507fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff94505b50505082600181905550816002819055505050505050565b60015481565b60018484848460405160008152602001604052600060405160200152604051808581526020018460ff1660ff16815260200183815260200182815260200194505050505060206040516020810390808403906000866161da5a03f115801561091457600080fd5b5050506020604051035173ffffffffffffffffffffffffffffffffffffffff1660008190555050505050565b60025481565b7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff6000819055507fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff6001819055507fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff600281905550565b6003816000604051602001526040518082805190602001908083835b602083106109fc57805182526020820191506020810190506020830392506109d9565b6001836020036101000a0380198251168184511680821785525050505050509050019150506020604051808303816000866161da5a03f1158015610a3f57600080fd5b505050604051516c01000000000000000000000000026bffffffffffffffffffffffff19166001900460008190555050565b600060405160208152602080820152602060408201528460608201528360808201528260a082015260208160c083600060056107d05a03f18060008114610abb5782519350610adf565b7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff93505b505050806000819055505050505056fea165627a7a72305820ad8768556058f9bede07b7a64f41702df9de711a94e0312cf4d9b715fd6e05100029"
+        self.contract_address = self.node.createcontract(bytecode)['address']
+        self.node.generate(1)
+        
+        # Test without qip7 (constantinople precompiles).
+        self.reset()
+        self.ecrecover_test()
+
+        self.reset()
+        self.sha256_test()
+
+        self.reset()
+        self.ripemd160_test()
+
+        self.reset()
+        self.identity_test()
+
+        self.reset()
+        self.modexp_test(should_fail=True)
+        
+        self.reset()
+        self.bn256add_test(should_fail=True)
+
+        self.reset()
+        self.bn256scalarmul_test(should_fail=True)
+
+        self.reset()
+        self.bn256pairing_test(should_fail=True)
+
+
+        # Now test with qip7 (constantinople precompiles) activated.
+        # All the old precompiles should still work, as well as the new contracts
+        self.restart_node(0, ['-constantinopleheight=1106'])
+        bytecode = "608060405234801561001057600080fd5b50610ad2806100206000396000f3fe608060405234801561001057600080fd5b50600436106100b45760003560e01c8063767f2a8911610071578063767f2a891461041d5780637c1886d91461043b578063a1461eef1461048a578063d826f88f146104a8578063e3c87216146104b2578063fdcd12cb1461056d576100b4565b806312bdedd7146100b95780631a0ffebe146101745780631b08d96f1461022f5780633d9c8fdb1461024d5780635327e29714610308578063652dcd30146103ae575b600080fd5b610172600480360360208110156100cf57600080fd5b81019080803590602001906401000000008111156100ec57600080fd5b8201836020820111156100fe57600080fd5b8035906020019184600183028401116401000000008311171561012057600080fd5b91908080601f016020809104026020016040519081016040528093929190818152602001838380828437600081840152601f19601f8201169050808301925050505050505091929192905050506105af565b005b61022d6004803603602081101561018a57600080fd5b81019080803590602001906401000000008111156101a757600080fd5b8201836020820111156101b957600080fd5b803590602001918460018302840111640100000000831117156101db57600080fd5b91908080601f016020809104026020016040519081016040528093929190818152602001838380828437600081840152601f19601f820116905080830192505050505050509192919290505050610659565b005b6102376106ba565b6040518082815260200191505060405180910390f35b6103066004803603602081101561026357600080fd5b810190808035906020019064010000000081111561028057600080fd5b82018360208201111561029257600080fd5b803590602001918460018302840111640100000000831117156102b457600080fd5b91908080601f016020809104026020016040519081016040528093929190818152602001838380828437600081840152601f19601f8201169050808301925050505050505091929192905050506106c0565b005b6103ac6004803603608081101561031e57600080fd5b8101908080604001906002806020026040519081016040528092919082600260200280828437600081840152601f19601f820116905080830192505050505050919291929080604001906002806020026040519081016040528092919082600260200280828437600081840152601f19601f8201169050808301925050505050509192919290505050610720565b005b61041b600480360360608110156103c457600080fd5b8101908080604001906002806020026040519081016040528092919082600260200280828437600081840152601f19601f8201169050808301925050505050509192919290803590602001909291905050506107d5565b005b61042561087f565b6040518082815260200191505060405180910390f35b6104886004803603608081101561045157600080fd5b8101908080359060200190929190803560ff1690602001909291908035906020019092919080359060200190929190505050610885565b005b61049261090e565b6040518082815260200191505060405180910390f35b6104b0610914565b005b61056b600480360360208110156104c857600080fd5b81019080803590602001906401000000008111156104e557600080fd5b8201836020820111156104f757600080fd5b8035906020019184600183028401116401000000008311171561051957600080fd5b91908080601f016020809104026020016040519081016040528093929190818152602001838380828437600081840152601f19601f82011690508083019250505050505050919291929050505061098b565b005b6105ad6004803603606081101561058357600080fd5b81019080803590602001909291908035906020019092919080359060200190929190505050610a28565b005b6002816040518082805190602001908083835b602083106105e557805182526020820191506020810190506020830392506105c2565b6001836020036101000a038019825116818451168082178552505050505050905001915050602060405180830381855afa158015610627573d6000803e3d6000fd5b5050506040513d602081101561063c57600080fd5b810190808051906020019092919050505060001c60008190555050565b600080825190506040516020818360208701600060086107d05a03f1806000811461068757825194506106ab565b7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff94505b50505081600081905550505050565b60005481565b6000808251905060405181818360208701600060046107d05a03f180600081146106ed5782519450610711565b7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff94505b50505081600081905550505050565b600080600060809050604051855160008201526020860151602082015284516040820152602085015160608201526040818383600060066107d05a03f180600081146107765782519550602083015194506107bd565b7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff95507fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff94505b50505082600181905550816002819055505050505050565b60008060006060905060405185516000820152602086015160208201528460408201526040818383600060076107d05a03f18060008114610820578251955060208301519450610867565b7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff95507fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff94505b50505082600181905550816002819055505050505050565b60015481565b60018484848460405160008152602001604052604051808581526020018460ff1660ff1681526020018381526020018281526020019450505050506020604051602081039080840390855afa1580156108e2573d6000803e3d6000fd5b5050506020604051035173ffffffffffffffffffffffffffffffffffffffff1660008190555050505050565b60025481565b7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff6000819055507fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff6001819055507fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff600281905550565b6003816040518082805190602001908083835b602083106109c1578051825260208201915060208101905060208303925061099e565b6001836020036101000a038019825116818451168082178552505050505050905001915050602060405180830381855afa158015610a03573d6000803e3d6000fd5b5050506040515160601b6bffffffffffffffffffffffff191660001c60008190555050565b600060405160208152602080820152602060408201528460608201528360808201528260a082015260208160c083600060056107d05a03f18060008114610a725782519350610a96565b7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff93505b505050806000819055505050505056fea165627a7a7230582067f822d1339f29c535c6013b09d2374c1f589e39e98a74012a3519186ee9b2630029"
+        self.contract_address = self.node.createcontract(bytecode)['address']
+        self.node.generate(1)
+
+        self.reset()
+        self.ecrecover_test()
+
+        self.reset()
+        self.sha256_test()
+
+        self.reset()
+        self.ripemd160_test()
+
+        self.reset()
+        self.identity_test()
+
+        self.reset()
+        self.modexp_test(should_fail=False)
+        
+        self.reset()
+        self.bn256add_test(should_fail=False)
+
+        self.reset()
+        self.bn256scalarmul_test(should_fail=False)
+
+        self.reset()
+        self.bn256pairing_test(should_fail=False)
+
+if __name__ == '__main__':
+    QtumEVMConstantinoplePrecompiledContractsTest().main()
diff --git a/test/functional/test_runner.py b/test/functional/test_runner.py
index f2b1ffad0..c0fad3745 100755
--- a/test/functional/test_runner.py
+++ b/test/functional/test_runner.py
@@ -237,6 +237,8 @@
     'qtum_faulty_header_chain.py',
     'qtum_op_sender.py',
     'qtum_evm_revert.py',
+    'qtum_evm_constantinople_precompiles.py',
+    'qtum_evm_constantinople_opcodes.py',
 ]
 
 EXTENDED_SCRIPTS = [

From 69aba218cc867aa26beaae33e3e385a2670ecab8 Mon Sep 17 00:00:00 2001
From: CodeFace <cnchenjun@qq.com>
Date: Tue, 3 Sep 2019 16:08:46 +0800
Subject: [PATCH 094/153] check if revert() can prevent execution from
 continuing

---
 test/functional/qtum_evm_revert.py | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/test/functional/qtum_evm_revert.py b/test/functional/qtum_evm_revert.py
index 0c64bd88e..b195a0bc5 100755
--- a/test/functional/qtum_evm_revert.py
+++ b/test/functional/qtum_evm_revert.py
@@ -99,10 +99,11 @@ def run_test(self):
                 function () payable external {
                     emit TestTest();
                     revert();
+                    emit TestTest(); // check if revert() can prevent execution from continuing
                 }
             }
         """
-        bytecode = "6080604052348015600f57600080fd5b50606a80601d6000396000f3fe60806040527f902ab12fc657922f9e7e1085a23c967a546ad6f8a771c0b5c7db57f7aac0076e60405160405180910390a1600080fdfea265627a7a72315820f34015f936ea31587945269e841f6b9be1c85f068d25d05e23ebd9dcae356c8c64736f6c634300050b0032"
+        bytecode = "6080604052348015600f57600080fd5b50606a80601d6000396000f3fe60806040527f902ab12fc657922f9e7e1085a23c967a546ad6f8a771c0b5c7db57f7aac0076e60405160405180910390a1600080fdfea265627a7a72305820fea288c1e5cdb52afd4c9f5be9081c6199bc47960599fcc1655dd7a900e39cdc64736f6c634300050a0032"
         contract_address = self.nodes[0].createcontract(bytecode)['address']
         self.nodes[0].generatetoaddress(1, dummy_address)
 

From 679a84807e4f4b61c666f98b5b903f4501a8a9f6 Mon Sep 17 00:00:00 2001
From: CodeFace <cnchenjun@qq.com>
Date: Tue, 3 Sep 2019 20:33:33 +0800
Subject: [PATCH 095/153] add more tests for CREATE2

---
 test/functional/qtum_evm_create2.py | 222 ++++++++++++++++++++++++++++
 test/functional/test_runner.py      |   1 +
 2 files changed, 223 insertions(+)
 create mode 100644 test/functional/qtum_evm_create2.py

diff --git a/test/functional/qtum_evm_create2.py b/test/functional/qtum_evm_create2.py
new file mode 100644
index 000000000..a10905775
--- /dev/null
+++ b/test/functional/qtum_evm_create2.py
@@ -0,0 +1,222 @@
+#!/usr/bin/env python3
+# Copyright (c) 2016-2019 The Qtum Core developers
+# Distributed under the MIT software license, see the accompanying
+# file COPYING or http://www.opensource.org/licenses/mit-license.php.
+
+from test_framework.test_framework import BitcoinTestFramework
+from test_framework.util import *
+from test_framework.script import *
+from test_framework.mininode import *
+from test_framework.qtum import *
+from test_framework.qtumconfig import *
+import sys
+import io
+import pprint
+
+
+class QtumEVMCreate2Test(BitcoinTestFramework):
+    def set_test_params(self):
+        self.setup_clean_chain = True
+        self.num_nodes = 1
+        self.extra_args = [['-logevents', '-minmempoolgaslimit=21000', '-constantinopleheight=704']]
+
+    def skip_test_if_missing_module(self):
+        self.skip_if_no_wallet()
+
+    def get_value_at_index(self, i):
+        info = self.node.callcontract(self.contract_address, "a05d8c0b" + hex(i)[2:].zfill(64))
+        ret = info['executionResult']['output']
+        return ret
+
+    def reset(self):
+        self.node.sendtocontract(self.contract_address, 'd826f88f')
+        self.node.generate(1)
+
+    def keccak256(self, data):
+        abi = "b8612c0a"
+        abi += hex(0x20)[2:].zfill(64)
+        abi += hex(len(data) // 2)[2:].zfill(64)
+        abi += data
+        return self.node.callcontract(self.contract_address, abi)['executionResult']['output']
+
+    def generate_create2_abi(self, param):
+        abi = "9fcc1813"
+        abi += hex(0x20)[2:].zfill(64)
+        abi += hex(len(param) // 2)[2:].zfill(64)
+        abi += param
+        return abi
+
+    def assert_state(self, node, gas, gas_price, gas_used, value, excepted):
+        blockhash = node.getbestblockhash()
+        block = node.getblock(blockhash)
+        txids = block['tx']
+        coinbase_tx = node.getrawtransaction(txids[0], True, blockhash)
+        call_tx = node.getrawtransaction(txids[1], True, blockhash)
+
+        input_tx = node.decoderawtransaction(node.gettransaction(call_tx['vin'][0]['txid'])['hex'])
+        sender_utxo = input_tx['vout'][call_tx['vin'][0]['vout']]
+        sender_address = sender_utxo['scriptPubKey']['addresses'][0]
+
+        for op_call_vout_index in range(len(call_tx['vout'])):
+            if call_tx['vout'][op_call_vout_index]['scriptPubKey']['type'] == 'call':
+                break
+
+        # Check that the transaction receipt is correct
+        receipt = node.gettransactionreceipt(call_tx['txid'])[0]
+        assert_equal(receipt['gasUsed'], gas_used)
+        assert_equal(receipt['cumulativeGasUsed'], gas_used)
+        assert_equal(receipt['blockNumber'], block['height'])
+        assert_equal(receipt['blockHash'], block['hash'])
+        assert_equal(receipt['excepted'], excepted)
+        assert_equal(receipt['exceptedMessage'], '')
+        assert_equal(receipt['from'], p2pkh_to_hex_hash(sender_address))
+        assert_equal(receipt['transactionIndex'], 1)
+        assert_equal(receipt['transactionHash'], call_tx['txid'])
+        assert_equal(receipt['log'], [])
+
+        # If there is supposed to be a value refund tx, check that it:
+        #  - exists
+        #  - has the correct value
+        #  - has the correct input
+        #  - has the correct output
+        if value > 0:
+            refund_tx = node.getrawtransaction(txids[-1], True, blockhash)
+            refund_utxo = refund_tx['vout'][0]
+            assert_equal(len(refund_tx['vin']), 1)
+            assert_equal(refund_tx['vin'][0]['txid'], call_tx['txid'])
+            assert_equal(refund_tx['vin'][0]['vout'], op_call_vout_index)
+            assert_equal(refund_utxo['value'], value)
+            assert_equal(sender_utxo['scriptPubKey']['asm'], refund_utxo['scriptPubKey']['asm'])
+        else:
+            assert_equal(len(txids), 3)
+
+        # Check that the coinstake contains a gas refund (if one should exist)
+        if gas > gas_used:
+            gas_refund_output = coinbase_tx['vout'][-2]
+            assert_equal((gas_refund_output['value']*100000000)//10000000, ((gas-gas_used)*gas_price*100000000)//10000000)
+            assert_equal(sender_utxo['scriptPubKey']['asm'], gas_refund_output['scriptPubKey']['asm'])
+        else:
+            assert_equal(len(coinbase_tx['vout']), 2)
+
+    def run_test(self):
+        # Dummy address to generate blocks to
+        dummy_key = ECKey()
+        dummy_key.generate()
+        dummy_address = hex_hash_to_p2pkh("12"*20)
+
+        self.node = self.nodes[0]
+        self.node.generatetoaddress(200, self.node.getnewaddress())
+        self.node.generatetoaddress(COINBASE_MATURITY, dummy_address)
+
+        """
+        pragma solidity ^0.5.10;
+        
+        contract Test {
+            
+            uint256[] private ret;
+            
+            function reset()  public {
+                delete ret;
+            }
+        
+            function getRet(uint256 index) public view returns (uint256) {
+                return ret[index];
+            }
+            
+            // To avoid having to add a dependancy for the non-standard keccak256 used in the EVM
+            // we simply call it here to verify results of extcodehash and create2
+            function dokeccak256(bytes memory data) public view returns (bytes32) {
+                return keccak256(data);
+            }
+            
+            function create2_test(bytes memory code) public payable {
+                uint256 r;
+                uint256 size = code.length;
+                assembly {
+                    r := create2(0, add(code, 0x20), size, 0x0)
+                }
+                ret.push(r);
+            }
+        }
+        
+        d826f88f: reset()
+        a05d8c0b: getRet(uint256)
+        b8612c0a: dokeccak256(bytes)
+        9fcc1813: create2_test(bytes)        
+        """
+
+        bytecode = "608060405234801561001057600080fd5b50610340806100206000396000f3fe60806040526004361061003f5760003560e01c80639fcc181314610044578063a05d8c0b146100ff578063b8612c0a1461014e578063d826f88f1461022a575b600080fd5b6100fd6004803603602081101561005a57600080fd5b810190808035906020019064010000000081111561007757600080fd5b82018360208201111561008957600080fd5b803590602001918460018302840111640100000000831117156100ab57600080fd5b91908080601f016020809104026020016040519081016040528093929190818152602001838380828437600081840152601f19601f820116905080830192505050505050509192919290505050610241565b005b34801561010b57600080fd5b506101386004803603602081101561012257600080fd5b8101908080359060200190929190505050610285565b6040518082815260200191505060405180910390f35b34801561015a57600080fd5b506102146004803603602081101561017157600080fd5b810190808035906020019064010000000081111561018e57600080fd5b8201836020820111156101a057600080fd5b803590602001918460018302840111640100000000831117156101c257600080fd5b91908080601f016020809104026020016040519081016040528093929190818152602001838380828437600081840152601f19601f8201169050808301925050505050505091929192905050506102a5565b6040518082815260200191505060405180910390f35b34801561023657600080fd5b5061023f6102b6565b005b60008082519050600081602085016000f591506000829080600181540180825580915050906001820390600052602060002001600090919290919091505550505050565b600080828154811061029357fe5b90600052602060002001549050919050565b600081805190602001209050919050565b6000806102c391906102c5565b565b50805460008255906000526020600020908101906102e391906102e6565b50565b61030891905b808211156103045760008160009055506001016102ec565b5090565b9056fea265627a7a7230582081aabd93f08842152eaf2ff607e68cee84abb692b2fbfa0556ee4e0a29ce332464736f6c634300050a0032"
+        self.contract_address = self.node.createcontract(bytecode)['address']
+        self.node.generatetoaddress(1, dummy_address)
+
+        create2_bytecode = "608060405234801561001057600080fd5b50610a57806100206000396000f3fe6080604052600436106100e85760003560e01c80639fcc18131161008a578063c5b319b211610059578063c5b319b214610473578063c9846c59146104b8578063d826f88f146104cf578063e5037fb1146104e6576100e8565b80639fcc181314610221578063a05d8c0b146102dc578063a1d98fa11461032b578063b8612c0a14610397576100e8565b80634f2f0adc116100c65780634f2f0adc1461015d578063825d4ba3146101ae5780639c9d8fbe146101f35780639ca24dff1461020a576100e8565b806308a86e5f146100ea5780631bbfb6821461012f5780634772905514610146575b005b3480156100f657600080fd5b5061012d6004803603604081101561010d57600080fd5b8101908080359060200190929190803590602001909291905050506104fd565b005b34801561013b57600080fd5b50610144610532565b005b34801561015257600080fd5b5061015b61061f565b005b34801561016957600080fd5b506101ac6004803603602081101561018057600080fd5b81019080803573ffffffffffffffffffffffffffffffffffffffff1690602001909291905050506106c1565b005b3480156101ba57600080fd5b506101f1600480360360408110156101d157600080fd5b8101908080359060200190929190803590602001909291905050506106f7565b005b3480156101ff57600080fd5b5061020861072c565b005b34801561021657600080fd5b5061021f6107ce565b005b6102da6004803603602081101561023757600080fd5b810190808035906020019064010000000081111561025457600080fd5b82018360208201111561026657600080fd5b8035906020019184600183028401116401000000008311171561028857600080fd5b91908080601f016020809104026020016040519081016040528093929190818152602001838380828437600081840152601f19601f82011690508083019250505050505050919291929050505061081f565b005b3480156102e857600080fd5b50610315600480360360208110156102ff57600080fd5b8101908080359060200190929190505050610863565b6040518082815260200191505060405180910390f35b34801561033757600080fd5b50610340610883565b6040518080602001828103825283818151815260200191508051906020019060200280838360005b83811015610383578082015181840152602081019050610368565b505050509050019250505060405180910390f35b3480156103a357600080fd5b5061045d600480360360208110156103ba57600080fd5b81019080803590602001906401000000008111156103d757600080fd5b8201836020820111156103e957600080fd5b8035906020019184600183028401116401000000008311171561040b57600080fd5b91908080601f016020809104026020016040519081016040528093929190818152602001838380828437600081840152601f19601f820116905080830192505050505050509192919290505050610925565b6040518082815260200191505060405180910390f35b34801561047f57600080fd5b506104b66004803603604081101561049657600080fd5b810190808035906020019092919080359060200190929190505050610936565b005b3480156104c457600080fd5b506104cd61096b565b005b3480156104db57600080fd5b506104e46109b9565b005b3480156104f257600080fd5b506104fb6109c8565b005b80821c915060008290806001815401808255809150509060018203906000526020600020016000909192909190915055505050565b60006060600060405180807f72657475726e7661726c656e6774682829000000000000000000000000000000815250601101905060405180910390207bffffffffffffffffffffffffffffffffffffffffffffffffffffffff1916905060008090506040518281526040519350600080600483600030620186a05a03f13d95506040519450602086036020863e5050600090505b82518110156106195760008382815181106105dd57fe5b602002602001015190806001815401808255809150509060018203906000526020600020016000909192909190915055508060010190506105c6565b50505050565b600060405180807f6d757461626c6563616c6c6261636b2829000000000000000000000000000000815250601101905060405180910390207bffffffffffffffffffffffffffffffffffffffffffffffffffffffff19169050600060405182815260008060048330620186a05a03fa91505060008190806001815401808255809150509060018203906000526020600020016000909192909190915055505050565b6000813f905060008190806001815401808255809150509060018203906000526020600020016000909192909190915055505050565b80821d915060008290806001815401808255809150509060018203906000526020600020016000909192909190915055505050565b600060405180807f73746174696363616c6c6261636b282900000000000000000000000000000000815250601001905060405180910390207bffffffffffffffffffffffffffffffffffffffffffffffffffffffff19169050600060405182815260008060048330620186a05a03fa91505060008190806001815401808255809150509060018203906000526020600020016000909192909190915055505050565b60007f0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef9080600181540180825580915050906001820390600052602060002001600090919290919091505550600080fd5b60008082519050600081602085016000f591506000829080600181540180825580915050906001820390600052602060002001600090919290919091505550505050565b600080828154811061087157fe5b90600052602060002001549050919050565b60606000600f600143034060001c1690506060816040519080825280602002602001820160405280156108c55781602001602082028038833980820191505090505b50905060008090505b8281101561091c57807ff0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f01782828151811061090557fe5b6020026020010181815250508060010190506108ce565b50809250505090565b600081805190602001209050919050565b80821b915060008290806001815401808255809150509060018203906000526020600020016000909192909190915055505050565b60007f12121212121212121212121212121212121212121212121212121212121212129080600181540180825580915050906001820390600052602060002001600090919290919091505550565b6000806109c691906109e5565b565b60008090505b600a8110156109e2578060010190506109ce565b50565b5080546000825590600052602060002090810190610a039190610a06565b50565b610a2891905b80821115610a24576000816000905550600101610a0c565b5090565b9056fea165627a7a72305820db27ae89f2aafaaa420f35ae90480db051520a88007ede039df1c2302d284ec20029"
+        abi = self.generate_create2_abi(create2_bytecode)
+
+        # Run a normal create2 tx, will cause a throw since create2 is undefined before qip7/constantinople
+        # this will cause a refund tx
+        self.node.sendtocontract(self.contract_address, abi, 10, 1000000, 0.000001)
+        self.node.generatetoaddress(1, dummy_address)
+        self.assert_state(self.node, gas=1000000, gas_price=0.000001, gas_used=1000000, value=10,
+                                 excepted='BadInstruction')
+
+        self.node.generatetoaddress(10, dummy_address)
+
+        # run a create2 tx with too little gas
+        # this will cause a refund tx
+        self.node.sendtocontract(self.contract_address, abi, 10, 795405, 0.000001)
+        self.node.generatetoaddress(1, dummy_address)
+        self.assert_state(self.node, gas=795405, gas_price=0.000001, gas_used=795405, value=10, excepted='OutOfGas')
+
+        # run a create2 tx with too little gas
+        # this will cause a refund tx
+        self.node.sendtocontract(self.contract_address, abi, 10, 795406, 0.000001)
+        self.node.generatetoaddress(1, dummy_address)
+        self.assert_state(self.node, gas=795406, gas_price=0.000001, gas_used=795406, value=10, excepted='OutOfGas')
+
+        # run a create2 tx with just enough gas
+        # this will not cause a refund tx
+        self.node.sendtocontract(self.contract_address, abi, 10, 795407, 0.000001)
+        self.node.generatetoaddress(1, dummy_address)
+        self.assert_state(self.node, gas=795407, gas_price=0.000001, gas_used=795407, value=0, excepted='None')
+
+        # check contract address
+        codehash = self.keccak256(create2_bytecode)
+        expected_create2_address = self.keccak256("ff" + self.contract_address + ("0" * 64) + codehash)[24:]
+        create2_address = self.get_value_at_index(0)[24:]
+        assert (create2_address in self.node.listcontracts())
+        assert_equal(expected_create2_address, create2_address)
+
+        # Send some value to the create2 address, should succeed
+        self.node.sendtocontract(create2_address, "00", 1)
+        self.node.generate(1)
+        assert_equal(self.node.listcontracts()[create2_address], 1)
+
+        # Make sure that creating another exactly the same create2 contract fails
+        self.reset()
+        self.node.sendtocontract(self.contract_address, abi, 10, 10000000, 0.000001)
+        self.node.generatetoaddress(1, dummy_address)
+        assert_equal(self.get_value_at_index(0), "0" * 64)
+        # Make sure that the value associated with the create2 address remains the same
+        assert_equal(self.node.listcontracts()[create2_address], 1)
+
+        # run a create2 tx with more than enough gas
+        self.reset()
+        create2_bytecode = '000000'
+        abi = self.generate_create2_abi(create2_bytecode)
+        self.node.sendtocontract(self.contract_address, abi, 10, 10000000, 0.000001)
+        self.node.generatetoaddress(1, dummy_address)
+        self.assert_state(self.node, gas=10000000, gas_price=0.000001, gas_used=94562, value=0, excepted='None')
+
+        # check contract address
+        codehash = self.keccak256(create2_bytecode)
+        expected_create2_address = self.keccak256("ff" + self.contract_address + ("0" * 64) + codehash)[24:]
+        create2_address = self.get_value_at_index(0)[24:]
+        assert (create2_address in self.node.listcontracts())
+        assert_equal(expected_create2_address, create2_address)
+
+        # balance of self.contract_address should be 30 so far
+        assert_equal(self.node.listcontracts()[self.contract_address], 30)
+
+
+if __name__ == '__main__':
+    QtumEVMCreate2Test().main()
diff --git a/test/functional/test_runner.py b/test/functional/test_runner.py
index c0fad3745..a68059c43 100755
--- a/test/functional/test_runner.py
+++ b/test/functional/test_runner.py
@@ -237,6 +237,7 @@
     'qtum_faulty_header_chain.py',
     'qtum_op_sender.py',
     'qtum_evm_revert.py',
+    'qtum_evm_create2.py',
     'qtum_evm_constantinople_precompiles.py',
     'qtum_evm_constantinople_opcodes.py',
 ]

From ae1fb480d220a52f867345e509b3d4d5a028a897 Mon Sep 17 00:00:00 2001
From: Neil <neil@qtum.org>
Date: Thu, 5 Sep 2019 04:24:36 +0000
Subject: [PATCH 096/153] Add checks for transfers resulting from execution

---
 src/qtum/qtumstate.cpp | 34 +++++++++++++++++++++++++++++++---
 src/qtum/qtumstate.h   |  2 ++
 2 files changed, 33 insertions(+), 3 deletions(-)

diff --git a/src/qtum/qtumstate.cpp b/src/qtum/qtumstate.cpp
index 215187c4c..f49e2da1a 100644
--- a/src/qtum/qtumstate.cpp
+++ b/src/qtum/qtumstate.cpp
@@ -44,6 +44,7 @@ ResultExecute QtumState::execute(EnvInfo const& _envInfo, SealEngineFace const&
 
     CTransactionRef tx;
     u256 startGasUsed;
+    const Consensus::Params& consensusParams = Params().GetConsensus();
     try{
         if (_t.isCreation() && _t.value())
             BOOST_THROW_EXCEPTION(CreateWithValue());
@@ -53,8 +54,10 @@ ResultExecute QtumState::execute(EnvInfo const& _envInfo, SealEngineFace const&
         startGasUsed = _envInfo.gasUsed();
         if (!e.execute()){
             e.go(onOp);
+            if(chainActive.Height() >= consensusParams.QIP7Height){
+            	validateTransfersWithChangeLog();
+            }
         } else {
-
             e.revert();
             throw Exception();
         }
@@ -77,7 +80,7 @@ ResultExecute QtumState::execute(EnvInfo const& _envInfo, SealEngineFace const&
             } else {
                 printfErrorLog(res.excepted);
             }
-            
+
             qtum::commit(cacheUTXO, stateUTXO, m_cache);
             cacheUTXO.clear();
             bool removeEmptyAccounts = _envInfo.number() >= _sealEngine.chainParams().EIP158ForkBlock;
@@ -88,7 +91,6 @@ ResultExecute QtumState::execute(EnvInfo const& _envInfo, SealEngineFace const&
         printfErrorLog(dev::eth::toTransactionException(_e));
         res.excepted = dev::eth::toTransactionException(_e);
         res.gasUsed = _t.gas();
-        const Consensus::Params& consensusParams = Params().GetConsensus();
         if(chainActive.Height() < consensusParams.nFixUTXOCacheHFHeight  && _p != Permanence::Reverted){
             deleteAccounts(_sealEngine.deleteAddresses);
             commit(CommitBehaviour::RemoveEmptyAccounts);
@@ -256,6 +258,32 @@ void QtumState::printfErrorLog(const dev::eth::TransactionException er){
     clog(dev::VerbosityWarning, "exec") << "VM exception:" << ss.str();
 }
 
+void QtumState::validateTransfersWithChangeLog(){
+	ChangeLog tmpChangeLog = m_changeLog;
+	std::vector<TransferInfo> validatedTransfers;
+
+	for(const TransferInfo& ti : transfers){
+		for(std::size_t i=0; i<tmpChangeLog.size(); ++i){
+			//find the log entry for the receiver of the transfer
+			if(tmpChangeLog[i].kind==Change::Balance && tmpChangeLog[i].address==ti.to && tmpChangeLog[i].value==ti.value){
+				for(std::size_t j=0; j<tmpChangeLog.size(); ++j){
+					//find the log entry for the sender of the transfer
+					if(tmpChangeLog[j].kind==Change::Balance && tmpChangeLog[j].address==ti.from && tmpChangeLog[j].value==0-ti.value){
+						// transfer is valid
+						validatedTransfers.push_back(ti);
+						// zero out found elements to avoid matching again
+						tmpChangeLog[i].address=dev::Address(0);
+						tmpChangeLog[j].address=dev::Address(0);
+						break;
+					}
+				}
+				break;
+			}
+		}
+	}
+
+	transfers=validatedTransfers;
+}
 ///////////////////////////////////////////////////////////////////////////////////////////
 CTransaction CondensingTX::createCondensingTX(){
     selectionVin();
diff --git a/src/qtum/qtumstate.h b/src/qtum/qtumstate.h
index fe7ffefc2..d1bfe4600 100644
--- a/src/qtum/qtumstate.h
+++ b/src/qtum/qtumstate.h
@@ -129,6 +129,8 @@ class QtumState : public dev::eth::State {
 	dev::eth::SecureTrieDB<dev::Address, dev::OverlayDB> stateUTXO;
 
 	std::unordered_map<dev::Address, Vin> cacheUTXO;
+
+	void validateTransfersWithChangeLog();
 };
 
 

From 9a330a9475178b5798539ed7c484e0a1efbcce24 Mon Sep 17 00:00:00 2001
From: CodeFace <cnchenjun@qq.com>
Date: Thu, 5 Sep 2019 14:37:47 +0800
Subject: [PATCH 097/153] add more tests for STATICCALL

---
 test/functional/qtum_evm_staticcall.py | 383 +++++++++++++++++++++++++
 test/functional/test_runner.py         |   1 +
 2 files changed, 384 insertions(+)
 create mode 100644 test/functional/qtum_evm_staticcall.py

diff --git a/test/functional/qtum_evm_staticcall.py b/test/functional/qtum_evm_staticcall.py
new file mode 100644
index 000000000..52448f66a
--- /dev/null
+++ b/test/functional/qtum_evm_staticcall.py
@@ -0,0 +1,383 @@
+#!/usr/bin/env python3
+# Copyright (c) 2016-2019 The Qtum Core developers
+# Distributed under the MIT software license, see the accompanying
+# file COPYING or http://www.opensource.org/licenses/mit-license.php.
+
+from test_framework.test_framework import BitcoinTestFramework
+from test_framework.util import *
+from test_framework.script import *
+from test_framework.mininode import *
+from test_framework.qtum import *
+from test_framework.qtumconfig import *
+import sys
+import io
+import pprint
+
+
+class QtumEVMStaticCallTest(BitcoinTestFramework):
+
+    def set_test_params(self):
+        self.setup_clean_chain = True
+        self.num_nodes = 1
+        self.extra_args = [['-logevents', '-minmempoolgaslimit=21000', '-constantinopleheight=704']]
+
+    def skip_test_if_missing_module(self):
+        self.skip_if_no_wallet()
+
+    def reset(self):
+        self.node.sendtocontract(self.contract_address, 'd826f88f')
+        self.node.generate(1)
+
+    def get_value_at_index(self, i):
+        info = self.node.callcontract(self.contract_address, "a05d8c0b" + hex(i)[2:].zfill(64))
+        ret = info['executionResult']['output']
+        return ret
+
+    def generate_staticcall_abi(self, fun_name):
+        abi = "00349441"
+        abi += hex(0x20)[2:].zfill(64)
+        param = ''.join(hex(ord(x))[2:] for x in fun_name)
+        abi += hex(len(param) // 2)[2:].zfill(64)
+        abi += param
+        return abi
+
+    def assert_state(self, node, gas, gas_price, gas_used, value, excepted):
+        blockhash = node.getbestblockhash()
+        block = node.getblock(blockhash)
+        txids = block['tx']
+        coinbase_tx = node.getrawtransaction(txids[0], True, blockhash)
+        call_tx = node.getrawtransaction(txids[1], True, blockhash)
+
+        input_tx = node.decoderawtransaction(node.gettransaction(call_tx['vin'][0]['txid'])['hex'])
+        sender_utxo = input_tx['vout'][call_tx['vin'][0]['vout']]
+        sender_address = sender_utxo['scriptPubKey']['addresses'][0]
+
+        for op_call_vout_index in range(len(call_tx['vout'])):
+            if call_tx['vout'][op_call_vout_index]['scriptPubKey']['type'] == 'call':
+                break
+
+        # Check that the transaction receipt is correct
+        receipt = node.gettransactionreceipt(call_tx['txid'])[0]
+        assert_equal(receipt['gasUsed'], gas_used)
+        assert_equal(receipt['cumulativeGasUsed'], gas_used)
+        assert_equal(receipt['blockNumber'], block['height'])
+        assert_equal(receipt['blockHash'], block['hash'])
+        assert_equal(receipt['excepted'], excepted)
+        assert_equal(receipt['exceptedMessage'], '')
+        assert_equal(receipt['from'], p2pkh_to_hex_hash(sender_address))
+        assert_equal(receipt['transactionIndex'], 1)
+        assert_equal(receipt['transactionHash'], call_tx['txid'])
+        assert_equal(receipt['log'], [])
+
+        # If there is supposed to be a value refund tx, check that it:
+        #  - exists
+        #  - has the correct value
+        #  - has the correct input
+        #  - has the correct output
+        if value > 0:
+            refund_tx = node.getrawtransaction(txids[-1], True, blockhash)
+            refund_utxo = refund_tx['vout'][0]
+            assert_equal(len(refund_tx['vin']), 1)
+            assert_equal(refund_tx['vin'][0]['txid'], call_tx['txid'])
+            assert_equal(refund_tx['vin'][0]['vout'], op_call_vout_index)
+            assert_equal(refund_utxo['value'], value)
+            assert_equal(sender_utxo['scriptPubKey']['asm'], refund_utxo['scriptPubKey']['asm'])
+        else:
+            assert_equal(len(txids), 3)
+
+        # Check that the coinstake contains a gas refund (if one should exist)
+        if gas > gas_used:
+            gas_refund_output = coinbase_tx['vout'][-2]
+            assert_equal((gas_refund_output['value'] * 100000000) // 10000000,
+                         ((gas - gas_used) * gas_price * 100000000) // 10000000)
+            assert_equal(sender_utxo['scriptPubKey']['asm'], gas_refund_output['scriptPubKey']['asm'])
+        else:
+            assert_equal(len(coinbase_tx['vout']), 2)
+
+    def run_test(self):
+        dummy_key = ECKey()
+        dummy_key.generate()
+        dummy_address = hex_hash_to_p2pkh("12"*20)
+
+        self.node = self.nodes[0]
+        self.node.generatetoaddress(200, self.node.getnewaddress())
+        self.node.generatetoaddress(COINBASE_MATURITY, dummy_address)
+
+        """
+        pragma solidity ^0.5.10;
+                
+        contract Test {
+            event TestTest();
+            uint256[] private ret;
+        
+            function getRet(uint256 index) public view returns (uint256) {
+                return ret[index];
+            }
+        
+            function reset()  public {
+                delete ret;
+            } 
+            
+            function normal_fun() pure public {
+                // do nothing
+                uint256 i;
+                for (i = 0; i < 10;++i) {}
+            }
+        
+            function create_fun() public {
+                bytes memory code = hex"0000";
+                bytes memory mem_code = code;
+                address addr;
+                assembly {
+                    addr := create(100, add(mem_code,0x20), mload(mem_code))
+                }
+            }
+            
+            function create2_fun() public {
+                bytes memory code = hex"0000";
+                uint256 r;
+                uint256 size = code.length;
+                assembly {
+                    r := create2(0, add(code, 0x20), size, 0x0)
+                }
+            }
+            
+            function log0_fun() public {
+                log0("0");
+            }
+            
+            function log1_fun() public {
+                log1("0", "1");
+            }
+        
+            function log2_fun() public {
+                log2("0", "1", "2");
+            }
+        
+            function log3_fun() public {
+                log3("0", "1", "2", "3");
+            }
+            
+            function log4_fun() public {
+                log4("0", "1", "2", "3", "4");
+            }    
+        
+            function sstore_fun() public {
+                assembly {
+                    sstore(0, 2)
+                }
+            }
+            
+            function selfdestruct_fun() public {
+                selfdestruct(msg.sender);
+            }    
+            
+            function payable_call() public payable {
+                // do nothing
+            }
+            
+            function call_value_fun() public {
+                bytes32 sig = bytes32(bytes4(keccak256("payable_call()")));
+                assembly {
+                    let x := mload(0x40)
+                    mstore(x, sig)
+                    let r := call(sub(gas, 100000), address, 1, x, 4, 0, 0)
+                }
+            }      
+        
+            function callcode_fun() public {
+                bytes32 sig = bytes32(bytes4(keccak256("payable_call()")));
+                assembly {
+                    let x := mload(0x40)
+                    mstore(x, sig)
+                    let r := callcode(sub(gas, 100000), address, 0, x, 4, 0, 0)
+                }
+            }  
+            
+            function event_fun() public {
+                emit TestTest();
+            }
+            
+            function transfer_fun() public {
+                msg.sender.transfer(1);
+            }
+        
+            function staticcall_test(bytes memory fun_name) public payable {
+                bytes32 sig = bytes32(bytes4(keccak256(fun_name)));
+                uint256 retval;
+                assembly {
+                    let x := mload(0x40)
+                    mstore(x, sig)
+                    retval := staticcall(sub(gas, 100000), address, x, 4, 0, 0)
+                }
+                ret.push(retval);
+            }
+            
+        }
+        """
+
+        bytecode = "608060405234801561001057600080fd5b506108ff806100206000396000f3fe6080604052600436106101085760003560e01c806385b3382811610095578063d402b4ea11610064578063d402b4ea14610307578063d826f88f1461031e578063da2bf6f914610335578063f820fa6e1461034c578063fac9ecf11461036357610108565b806385b33828146102735780638896fb041461028a578063a05d8c0b146102a1578063b0b05a5a146102f057610108565b806341a0e892116100dc57806341a0e89214610200578063571ffff11461021757806362d910841461022e5780637c1c850f146102455780637cf0b3cd1461025c57610108565b80623494411461010d5780630311f972146101c857806314a91a95146101df578063372c0357146101f6575b600080fd5b6101c66004803603602081101561012357600080fd5b810190808035906020019064010000000081111561014057600080fd5b82018360208201111561015257600080fd5b8035906020019184600183028401116401000000008311171561017457600080fd5b91908080601f016020809104026020016040519081016040528093929190818152602001838380828437600081840152601f19601f82011690508083019250505050505050919291929050505061037a565b005b3480156101d457600080fd5b506101dd6103ef565b005b3480156101eb57600080fd5b506101f46103f6565b005b6101fe610424565b005b34801561020c57600080fd5b50610215610426565b005b34801561022357600080fd5b5061022c6104a0565b005b34801561023a57600080fd5b506102436104d8565b005b34801561025157600080fd5b5061025a61054c565b005b34801561026857600080fd5b5061027161057e565b005b34801561027f57600080fd5b506102886105b1565b005b34801561029657600080fd5b5061029f61066d565b005b3480156102ad57600080fd5b506102da600480360360208110156102c457600080fd5b81019080803590602001909291905050506106b7565b6040518082815260200191505060405180910390f35b3480156102fc57600080fd5b506103056106d7565b005b34801561031357600080fd5b5061031c610730565b005b34801561032a57600080fd5b5061033361074d565b005b34801561034157600080fd5b5061034a61075c565b005b34801561035857600080fd5b506103616107f7565b005b34801561036f57600080fd5b50610378610810565b005b600081805190602001207bffffffffffffffffffffffffffffffffffffffffffffffffffffffff19169050600060405182815260008060048330620186a05a03fa9150506000819080600181540180825580915050906001820390600052602060002001600090919290919091505550505050565b6002600055565b7f902ab12fc657922f9e7e1085a23c967a546ad6f8a771c0b5c7db57f7aac0076e60405160405180910390a1565b565b7f32000000000000000000000000000000000000000000000000000000000000007f310000000000000000000000000000000000000000000000000000000000000060405180807f3000000000000000000000000000000000000000000000000000000000000000815250600101905060405180910390a2565b60405180807f3000000000000000000000000000000000000000000000000000000000000000815250600101905060405180910390a0565b600060405180807f70617961626c655f63616c6c2829000000000000000000000000000000000000815250600e01905060405180910390207bffffffffffffffffffffffffffffffffffffffffffffffffffffffff19169050604051818152600080600483600130620186a05a03f1505050565b606060405180604001604052806002815260200160008152509050606081905060008151602083016064f09050505050565b60606040518060400160405280600281526020016000815250905060008082519050600081602085016000f59150505050565b7f34000000000000000000000000000000000000000000000000000000000000007f33000000000000000000000000000000000000000000000000000000000000007f32000000000000000000000000000000000000000000000000000000000000007f310000000000000000000000000000000000000000000000000000000000000060405180807f3000000000000000000000000000000000000000000000000000000000000000815250600101905060405180910390a4565b3373ffffffffffffffffffffffffffffffffffffffff166108fc60019081150290604051600060405180830381858888f193505050501580156106b4573d6000803e3d6000fd5b50565b60008082815481106106c557fe5b90600052602060002001549050919050565b7f310000000000000000000000000000000000000000000000000000000000000060405180807f3000000000000000000000000000000000000000000000000000000000000000815250600101905060405180910390a1565b60008090505b600a81101561074a57806001019050610736565b50565b60008061075a9190610884565b565b7f33000000000000000000000000000000000000000000000000000000000000007f32000000000000000000000000000000000000000000000000000000000000007f310000000000000000000000000000000000000000000000000000000000000060405180807f3000000000000000000000000000000000000000000000000000000000000000815250600101905060405180910390a3565b3373ffffffffffffffffffffffffffffffffffffffff16ff5b600060405180807f70617961626c655f63616c6c2829000000000000000000000000000000000000815250600e01905060405180910390207bffffffffffffffffffffffffffffffffffffffffffffffffffffffff19169050604051818152600080600483600030620186a05a03f2505050565b50805460008255906000526020600020908101906108a291906108a5565b50565b6108c791905b808211156108c35760008160009055506001016108ab565b5090565b9056fea265627a7a72305820b81a82cf6ff756317c40a1d2fbbe83691f4a624cb87770795678a41ae6ce38f564736f6c634300050a0032"
+        self.contract_address = self.node.createcontract(bytecode)['address']
+        self.node.generatetoaddress(1, dummy_address)
+        assert_equal(self.node.listcontracts()[self.contract_address], 0)
+
+        # Run a normal valid staticcall tx
+        # will cause a throw since staticcall is undefined before qip7/constantinople
+        abi = self.generate_staticcall_abi("normal_fun()")
+        self.node.sendtocontract(self.contract_address, abi, 10, 1000000, 0.000001)
+        self.node.generatetoaddress(1, dummy_address)
+        # check refund
+        self.assert_state(self.node, gas=1000000, gas_price=0.000001, gas_used=1000000, value=10,
+                                 excepted='BadInstruction')
+
+        self.node.generatetoaddress(10, dummy_address)
+
+        # Run a normal valid staticcall tx with low gas
+        self.node.sendtocontract(self.contract_address, abi, 10, 64835, 0.000001)
+        self.node.generatetoaddress(1, dummy_address)
+        self.assert_state(self.node, gas=64835, gas_price=0.000001, gas_used=64835, value=10,
+                                 excepted='OutOfGas')
+        assert_equal(self.get_value_at_index(0), "")
+
+        # Run a normal valid staticcall tx
+        self.node.sendtocontract(self.contract_address, abi, 10, 1000000, 0.000001)
+        self.node.generatetoaddress(1, dummy_address)
+        self.assert_state(self.node, gas=1000000, gas_price=0.000001, gas_used=64836, value=0,
+                                 excepted='None')
+        assert_equal(self.get_value_at_index(0), "0" * 63 + "1")
+        assert_equal(self.node.listcontracts()[self.contract_address], 10)
+
+        # check invalid staticcall with `CREATE`
+        self.reset()
+        abi = self.generate_staticcall_abi("create_fun()")
+        self.node.sendtocontract(self.contract_address, abi, 10, 1000000, 0.000001)
+        self.node.generatetoaddress(1, dummy_address)
+        self.assert_state(self.node, gas=1000000, gas_price=0.000001, gas_used=926056, value=0,
+                                 excepted='None')
+        assert_equal(self.get_value_at_index(0), "0" * 64)
+        assert_equal(self.node.listcontracts()[self.contract_address], 20)
+
+        # check invalid staticcall with `CREATE2`
+        self.reset()
+        abi = self.generate_staticcall_abi("create2_fun()")
+        self.node.sendtocontract(self.contract_address, abi, 1, 1000000, 0.000001)
+        self.node.generatetoaddress(1, dummy_address)
+        self.assert_state(self.node, gas=1000000, gas_price=0.000001, gas_used=926056, value=0,
+                                 excepted='None')
+        assert_equal(self.get_value_at_index(0), "0" * 64)
+        assert_equal(self.node.listcontracts()[self.contract_address], 21)
+
+        # check invalid staticcall with `LOG0`
+        self.reset()
+        abi = self.generate_staticcall_abi("log0_fun()")
+        self.node.sendtocontract(self.contract_address, abi, 1, 1000000, 0.000001)
+        self.node.generatetoaddress(1, dummy_address)
+        self.assert_state(self.node, gas=1000000, gas_price=0.000001, gas_used=926056, value=0,
+                                 excepted='None')
+        assert_equal(self.get_value_at_index(0), "0" * 64)
+        assert_equal(self.node.listcontracts()[self.contract_address], 22)
+
+        # check invalid staticcall with `LOG1`
+        self.reset()
+        abi = self.generate_staticcall_abi("log1_fun()")
+        self.node.sendtocontract(self.contract_address, abi, 1, 1000000, 0.000001)
+        self.node.generatetoaddress(1, dummy_address)
+        self.assert_state(self.node, gas=1000000, gas_price=0.000001, gas_used=926056, value=0,
+                                 excepted='None')
+        assert_equal(self.get_value_at_index(0), "0" * 64)
+        assert_equal(self.node.listcontracts()[self.contract_address], 23)
+
+        # check invalid staticcall with `LOG2`
+        self.reset()
+        abi = self.generate_staticcall_abi("log2_fun()")
+        self.node.sendtocontract(self.contract_address, abi, 1, 1000000, 0.000001)
+        self.node.generatetoaddress(1, dummy_address)
+        self.assert_state(self.node, gas=1000000, gas_price=0.000001, gas_used=926056, value=0,
+                                 excepted='None')
+        assert_equal(self.get_value_at_index(0), "0" * 64)
+        assert_equal(self.node.listcontracts()[self.contract_address], 24)
+        
+        # check invalid staticcall with `LOG3`
+        self.reset()
+        abi = self.generate_staticcall_abi("log3_fun()")
+        self.node.sendtocontract(self.contract_address, abi, 1, 1000000, 0.000001)
+        self.node.generatetoaddress(1, dummy_address)
+        self.assert_state(self.node, gas=1000000, gas_price=0.000001, gas_used=926056, value=0,
+                                 excepted='None')
+        assert_equal(self.get_value_at_index(0), "0" * 64)
+        assert_equal(self.node.listcontracts()[self.contract_address], 25)
+
+        # check invalid staticcall with `LOG4`
+        self.reset()
+        abi = self.generate_staticcall_abi("log4_fun()")
+        self.node.sendtocontract(self.contract_address, abi, 1, 1000000, 0.000001)
+        self.node.generatetoaddress(1, dummy_address)
+        self.assert_state(self.node, gas=1000000, gas_price=0.000001, gas_used=926056, value=0,
+                                 excepted='None')
+        assert_equal(self.get_value_at_index(0), "0" * 64)
+        assert_equal(self.node.listcontracts()[self.contract_address], 26)
+
+        # check invalid staticcall with `SSTORE`
+        self.reset()
+        abi = self.generate_staticcall_abi("sstore_fun()")
+        self.node.sendtocontract(self.contract_address, abi, 1, 1000000, 0.000001)
+        self.node.generatetoaddress(1, dummy_address)
+        self.assert_state(self.node, gas=1000000, gas_price=0.000001, gas_used=926056, value=0,
+                                 excepted='None')
+        assert_equal(self.get_value_at_index(0), "0" * 64)
+        assert_equal(self.node.listcontracts()[self.contract_address], 27)
+
+        # check invalid staticcall with `SELFDESTRUCT`
+        self.reset()
+        abi = self.generate_staticcall_abi("selfdestruct_fun()")
+        self.node.sendtocontract(self.contract_address, abi, 1, 1000000, 0.000001)
+        self.node.generatetoaddress(1, dummy_address)
+        self.assert_state(self.node, gas=1000000, gas_price=0.000001, gas_used=926056, value=0,
+                                 excepted='None')
+        assert_equal(self.get_value_at_index(0), "0" * 64)
+        assert_equal(self.node.listcontracts()[self.contract_address], 28)
+
+
+        # check invalid staticcall with `CALL`
+        self.reset()
+        abi = self.generate_staticcall_abi("call_value_fun()")
+        self.node.sendtocontract(self.contract_address, abi, 1, 1000000, 0.000001)
+        self.node.generatetoaddress(1, dummy_address)
+        self.assert_state(self.node, gas=1000000, gas_price=0.000001, gas_used=926056, value=0,
+                                 excepted='None')
+        assert_equal(self.get_value_at_index(0), "0" * 64)
+        assert_equal(self.node.listcontracts()[self.contract_address], 29)
+
+        # check valid staticcall with `CALLCODE`
+        self.reset()
+        abi = self.generate_staticcall_abi("callcode_fun()")
+        self.node.sendtocontract(self.contract_address, abi, 1, 1000000, 0.000001)
+        self.node.generatetoaddress(1, dummy_address)
+        self.assert_state(self.node, gas=1000000, gas_price=0.000001, gas_used=65577, value=0,
+                                 excepted='None')
+        assert_equal(self.get_value_at_index(0), "0" * 63 + "1")
+        assert_equal(self.node.listcontracts()[self.contract_address], 30)
+
+        # check invalid staticcall with event
+        self.reset()
+        abi = self.generate_staticcall_abi("event_fun()")
+        self.node.sendtocontract(self.contract_address, abi, 1, 1000000, 0.000001)
+        self.node.generatetoaddress(1, dummy_address)
+        self.assert_state(self.node, gas=1000000, gas_price=0.000001, gas_used=926056, value=0,
+                                 excepted='None')
+        assert_equal(self.get_value_at_index(0), "0" * 64)
+        assert_equal(self.node.listcontracts()[self.contract_address], 31)
+
+        # check invalid staticcall with transfer
+        self.reset()
+        abi = self.generate_staticcall_abi("transfer_fun()")
+        self.node.sendtocontract(self.contract_address, abi, 1, 1000000, 0.000001)
+        self.node.generatetoaddress(1, dummy_address)
+        self.assert_state(self.node, gas=1000000, gas_price=0.000001, gas_used=926056, value=0,
+                                 excepted='None')
+        assert_equal(self.get_value_at_index(0), "0" * 64)
+        assert_equal(self.node.listcontracts()[self.contract_address], 32)
+
+
+if __name__ == '__main__':
+    QtumEVMStaticCallTest().main()
diff --git a/test/functional/test_runner.py b/test/functional/test_runner.py
index a68059c43..a36c78c98 100755
--- a/test/functional/test_runner.py
+++ b/test/functional/test_runner.py
@@ -238,6 +238,7 @@
     'qtum_op_sender.py',
     'qtum_evm_revert.py',
     'qtum_evm_create2.py',
+    'qtum_evm_staticcall.py',
     'qtum_evm_constantinople_precompiles.py',
     'qtum_evm_constantinople_opcodes.py',
 ]

From ef91f1a36d7632194a012ec05520b04911bff65b Mon Sep 17 00:00:00 2001
From: Yunqi Ouyang <oyyq9999999@163.com>
Date: Thu, 5 Sep 2019 16:00:22 +0800
Subject: [PATCH 098/153] Fix switching height to be more flexible

---
 test/functional/qtum_evm_constantinople_opcodes.py | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/test/functional/qtum_evm_constantinople_opcodes.py b/test/functional/qtum_evm_constantinople_opcodes.py
index 5d6376765..aa68d73b8 100755
--- a/test/functional/qtum_evm_constantinople_opcodes.py
+++ b/test/functional/qtum_evm_constantinople_opcodes.py
@@ -407,8 +407,9 @@ def run_test(self):
         self.reset()
         self.extcodehash_test(should_fail=True)
 
-        print('BEFORE RESTART', self.node.getblockcount())
-        self.restart_node(0, ['-constantinopleheight=2609', '-logevents'])
+        switch_height = self.node.getblockcount()
+        print('BEFORE RESTART', switch_height)
+        self.restart_node(0, ['-constantinopleheight={}'.format(switch_height), '-logevents'])
 
         self.reset()
         self.revert_test(should_fail=False)

From 406b24fb8dbac80ba8d73a103080d85c48868a17 Mon Sep 17 00:00:00 2001
From: Yunqi Ouyang <oyyq9999999@163.com>
Date: Thu, 5 Sep 2019 16:11:08 +0800
Subject: [PATCH 099/153] Add test cases for EXTCODEHASH

---
 .../qtum_evm_constantinople_opcodes.py        | 34 +++++++++++++++++++
 1 file changed, 34 insertions(+)

diff --git a/test/functional/qtum_evm_constantinople_opcodes.py b/test/functional/qtum_evm_constantinople_opcodes.py
index aa68d73b8..b8eb5b87b 100755
--- a/test/functional/qtum_evm_constantinople_opcodes.py
+++ b/test/functional/qtum_evm_constantinople_opcodes.py
@@ -227,6 +227,40 @@ def extcodehash_test(self, should_fail):
             else:
                 assert_equal(codehash, expected_codehash)
 
+        # precompiled contract btc_ecrecover
+        contract_address = '0000000000000000000000000000000000000085'
+        # according to eip-1052, extcodehash(precompiled contract) should return hash of empty data or 0
+        expected_codehash = self.keccak256('')
+
+        self.reset()
+        abi = "4f2f0adc"
+        abi += contract_address.zfill(64)
+        self.send(abi)
+        codehash = self.get_value_at_index(0)
+        if should_fail:
+            assert_equal(codehash, "")
+        else:
+            try:
+                assert_equal(codehash, '0'.zfill(64))
+            except AssertionError:
+                assert_equal(codehash, expected_codehash)
+
+        # non-existent address
+        contract_address = '0123456789abcdefedcba9876543210123456789'
+        # according to eip-1052, extcodehash(non-existent address) should return 0
+        expected_codehash = '0'.zfill(64)
+
+        self.reset()
+        abi = "4f2f0adc"
+        abi += contract_address.zfill(64)
+        self.send(abi)
+        codehash = self.get_value_at_index(0)
+        if should_fail:
+            assert_equal(codehash, "")
+        else:
+            assert_equal(codehash, expected_codehash)
+
+
     def run_test(self):
         self.nodes[0].generate(COINBASE_MATURITY+50)
         self.node = self.nodes[0]

From db0587cf0a7708774230fa1b64b7ea48a334c227 Mon Sep 17 00:00:00 2001
From: Time Markov <time.markov@qtum.com>
Date: Fri, 6 Sep 2019 11:03:39 +0200
Subject: [PATCH 100/153] Set the default custom data dir be the home dir

---
 src/qt/intro.cpp | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/qt/intro.cpp b/src/qt/intro.cpp
index 9c67ddf43..43f719d68 100644
--- a/src/qt/intro.cpp
+++ b/src/qt/intro.cpp
@@ -300,6 +300,7 @@ void Intro::on_dataDirCustom_clicked()
 {
     ui->dataDirectory->setEnabled(true);
     ui->ellipsisButton->setEnabled(true);
+    setDataDirectory(QDir::homePath());
 }
 
 void Intro::startThread()

From d4f51b9e502900a9bf80212073ed34730b4cf53b Mon Sep 17 00:00:00 2001
From: Neil <neil@qtum.org>
Date: Sun, 8 Sep 2019 21:38:34 +0000
Subject: [PATCH 101/153] Fix typo

---
 src/qt/forms/restoredialog.ui | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/qt/forms/restoredialog.ui b/src/qt/forms/restoredialog.ui
index 6edaeeb01..119e4a241 100644
--- a/src/qt/forms/restoredialog.ui
+++ b/src/qt/forms/restoredialog.ui
@@ -84,7 +84,7 @@
         <item>
          <widget class="QRadioButton" name="rbReindex">
           <property name="text">
-           <string>Rebuild block chain index</string>
+           <string>Rebuild blockchain index</string>
           </property>
           <property name="checked">
            <bool>true</bool>

From 665abebb9b214262cb4e0294b6079a598f75faec Mon Sep 17 00:00:00 2001
From: Neil <neil@qtum.org>
Date: Sun, 8 Sep 2019 22:06:10 +0000
Subject: [PATCH 102/153] Set custom datadir to home for OSX only

---
 src/qt/intro.cpp | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/src/qt/intro.cpp b/src/qt/intro.cpp
index 43f719d68..659b34a78 100644
--- a/src/qt/intro.cpp
+++ b/src/qt/intro.cpp
@@ -300,7 +300,9 @@ void Intro::on_dataDirCustom_clicked()
 {
     ui->dataDirectory->setEnabled(true);
     ui->ellipsisButton->setEnabled(true);
-    setDataDirectory(QDir::homePath());
+	#ifdef MAC_OSX
+	setDataDirectory(QDir::homePath()+"/Qtum");
+	#endif
 }
 
 void Intro::startThread()

From f2e812b3dc7f4f5c413d5ef78aebbd7a0c95c996 Mon Sep 17 00:00:00 2001
From: Neil <neil@qtum.org>
Date: Sun, 8 Sep 2019 22:11:02 +0000
Subject: [PATCH 103/153] Fix indentation

---
 src/qt/intro.cpp | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/src/qt/intro.cpp b/src/qt/intro.cpp
index 659b34a78..262b2c49e 100644
--- a/src/qt/intro.cpp
+++ b/src/qt/intro.cpp
@@ -300,9 +300,9 @@ void Intro::on_dataDirCustom_clicked()
 {
     ui->dataDirectory->setEnabled(true);
     ui->ellipsisButton->setEnabled(true);
-	#ifdef MAC_OSX
-	setDataDirectory(QDir::homePath()+"/Qtum");
-	#endif
+    #ifdef MAC_OSX
+    setDataDirectory(QDir::homePath()+"/Qtum");
+    #endif
 }
 
 void Intro::startThread()

From 37090b6ba6745deaee8d859b9153fcb1b1e895e6 Mon Sep 17 00:00:00 2001
From: Neil <neil@qtum.org>
Date: Sun, 8 Sep 2019 23:46:12 +0000
Subject: [PATCH 104/153] Disable legacy sender checks after QIP5 in contract
 rpc calls

---
 src/wallet/rpcwallet.cpp | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/src/wallet/rpcwallet.cpp b/src/wallet/rpcwallet.cpp
index baffa5d80..a05862e51 100755
--- a/src/wallet/rpcwallet.cpp
+++ b/src/wallet/rpcwallet.cpp
@@ -735,9 +735,11 @@ static UniValue createcontract(const JSONRPCRequest& request){
     CRecipient recipient = {scriptPubKey, 0, false};
     vecSend.push_back(recipient);
 
+    if(!(chainActive.Height() >= Params().GetConsensus().QIP5Height)){
     // Select default sender address unspent output
     if(!coinControl.HasSelected() && !SetDefaultSenderAddress(pwallet, *locked_chain, coinControl))
         throw JSONRPCError(RPC_TYPE_ERROR, "Sender address fail to set. Does not have any P2PK or P2PKH unspent outputs.");
+    }
 
     CTransactionRef tx;
     if (!pwallet->CreateTransaction(*locked_chain, vecSend, tx, reservekey, nFeeRequired, nChangePosRet, strError, coinControl, true, nGasFee, true, signSenderAddress)) {
@@ -984,9 +986,11 @@ static UniValue sendtocontract(const JSONRPCRequest& request){
     CRecipient recipient = {scriptPubKey, nAmount, false};
     vecSend.push_back(recipient);
 
-    // Select default sender address unspent output
-    if(!coinControl.HasSelected() && !SetDefaultSenderAddress(pwallet, *locked_chain, coinControl))
-        throw JSONRPCError(RPC_TYPE_ERROR, "Sender address fail to set. Does not have any P2PK or P2PKH unspent outputs.");
+    if(!(chainActive.Height() >= Params().GetConsensus().QIP5Height)){
+        // Select default sender address unspent output
+        if(!coinControl.HasSelected() && !SetDefaultSenderAddress(pwallet, *locked_chain, coinControl))
+            throw JSONRPCError(RPC_TYPE_ERROR, "Sender address fail to set. Does not have any P2PK or P2PKH unspent outputs.");
+    }
 
     CTransactionRef tx;
     if (!pwallet->CreateTransaction(*locked_chain, vecSend, tx, reservekey, nFeeRequired, nChangePosRet, strError, coinControl, true, nGasFee, true, signSenderAddress)) {

From bd11a3c3a4044d85ae24ca4bbc2bb37d2ce1f98a Mon Sep 17 00:00:00 2001
From: djaen <david.jaenson@qtum.org>
Date: Mon, 9 Sep 2019 12:52:29 +0200
Subject: [PATCH 105/153] Fix for changing the gas schedule when a node is run
 using dgpstorage

---
 src/qtum/qtumDGP.cpp                     |  15 +--
 src/qtum/qtumDGP.h                       |   6 +-
 test/functional/qtum_dgp_gas_schedule.py | 118 +++++++++++++++++++++++
 test/functional/test_runner.py           |   1 +
 4 files changed, 131 insertions(+), 9 deletions(-)
 create mode 100755 test/functional/qtum_dgp_gas_schedule.py

diff --git a/src/qtum/qtumDGP.cpp b/src/qtum/qtumDGP.cpp
index 6b20e306a..c43503d2a 100644
--- a/src/qtum/qtumDGP.cpp
+++ b/src/qtum/qtumDGP.cpp
@@ -1,4 +1,5 @@
 #include <qtum/qtumDGP.h>
+#include <chainparams.h>
 
 std::vector<uint32_t> createDataSchedule(const dev::eth::EVMSchedule& schedule)
 {
@@ -28,8 +29,10 @@ void QtumDGP::initDataSchedule(){
     dataSchedule = scheduleDataForBlockNumber(0);
 }
 
-bool QtumDGP::checkLimitSchedule(const std::vector<uint32_t>& defaultData, const std::vector<uint32_t>& checkData){
-    if(defaultData.size() == 39 && checkData.size() == 39){
+bool QtumDGP::checkLimitSchedule(const std::vector<uint32_t>& defaultData, const std::vector<uint32_t>& checkData, int blockHeight){
+    const Consensus::Params& consensusParams = Params().GetConsensus();
+
+    if(defaultData.size() == 39 && (checkData.size() == 39 || (checkData.size() == 40 && blockHeight >= consensusParams.QIP7Height))) {
         for(size_t i = 0; i < defaultData.size(); i++){
             uint32_t max = defaultData[i] * 1000 > 0 ? defaultData[i] * 1000 : 1 * 1000;
             uint32_t min = defaultData[i] / 100 > 0 ? defaultData[i] / 100 : 1;
@@ -42,12 +45,12 @@ bool QtumDGP::checkLimitSchedule(const std::vector<uint32_t>& defaultData, const
     return false;
 }
 
-dev::eth::EVMSchedule QtumDGP::getGasSchedule(unsigned int blockHeight){
+dev::eth::EVMSchedule QtumDGP::getGasSchedule(int blockHeight){
     clear();
     dataSchedule = scheduleDataForBlockNumber(blockHeight);
     dev::eth::EVMSchedule schedule = globalSealEngine->chainParams().scheduleForBlockNumber(blockHeight);
     if(initStorages(GasScheduleDGP, blockHeight, ParseHex("26fadbe2"))){
-        schedule = createEVMSchedule(schedule);
+        schedule = createEVMSchedule(schedule, blockHeight);
     }
     return schedule;
 }
@@ -196,7 +199,7 @@ void QtumDGP::parseDataOneUint64(uint64_t& value){
     }
 }
 
-dev::eth::EVMSchedule QtumDGP::createEVMSchedule(const dev::eth::EVMSchedule &_schedule){
+dev::eth::EVMSchedule QtumDGP::createEVMSchedule(const dev::eth::EVMSchedule &_schedule, int blockHeight){
     dev::eth::EVMSchedule schedule = _schedule;
     std::vector<uint32_t> uint32Values;
 
@@ -206,7 +209,7 @@ dev::eth::EVMSchedule QtumDGP::createEVMSchedule(const dev::eth::EVMSchedule &_s
         parseDataScheduleContract(uint32Values);
     }
 
-    if(!checkLimitSchedule(dataSchedule, uint32Values))
+    if(!checkLimitSchedule(dataSchedule, uint32Values, blockHeight))
         return schedule;
 
     if(uint32Values.size() >= 39){
diff --git a/src/qtum/qtumDGP.h b/src/qtum/qtumDGP.h
index f8666a3ef..ca171c5bd 100644
--- a/src/qtum/qtumDGP.h
+++ b/src/qtum/qtumDGP.h
@@ -30,7 +30,7 @@ class QtumDGP {
 
     QtumDGP(QtumState* _state, bool _dgpevm = true) : dgpevm(_dgpevm), state(_state) { initDataSchedule(); }
 
-    dev::eth::EVMSchedule getGasSchedule(unsigned int blockHeight);
+    dev::eth::EVMSchedule getGasSchedule(int blockHeight);
 
     uint32_t getBlockSize(unsigned int blockHeight);
 
@@ -50,7 +50,7 @@ class QtumDGP {
 
     void initDataSchedule();
 
-    bool checkLimitSchedule(const std::vector<uint32_t>& defaultData, const std::vector<uint32_t>& checkData);
+    bool checkLimitSchedule(const std::vector<uint32_t>& defaultData, const std::vector<uint32_t>& checkData, int blockHeight);
 
     void createParamsInstance();
 
@@ -66,7 +66,7 @@ class QtumDGP {
 
     void parseDataOneUint64(uint64_t& value);
 
-    dev::eth::EVMSchedule createEVMSchedule(const dev::eth::EVMSchedule& schedule);
+    dev::eth::EVMSchedule createEVMSchedule(const dev::eth::EVMSchedule& schedule, int blockHeight);
 
     void clear();    
 
diff --git a/test/functional/qtum_dgp_gas_schedule.py b/test/functional/qtum_dgp_gas_schedule.py
new file mode 100755
index 000000000..e293a660b
--- /dev/null
+++ b/test/functional/qtum_dgp_gas_schedule.py
@@ -0,0 +1,118 @@
+#!/usr/bin/env python3
+
+from test_framework.test_framework import BitcoinTestFramework
+from test_framework.util import *
+from test_framework.script import *
+from test_framework.mininode import *
+from test_framework.qtum import *
+from test_framework.address import *
+from test_framework.blocktools import *
+import io
+
+"""
+Note, these tests do not test the functionality of the DGP template contract itself, for tests for the DGP template, see qtum-dgp.py
+"""
+class QtumDGPGasSchedule(BitcoinTestFramework):
+
+    def set_test_params(self):
+        self.setup_clean_chain = True
+        self.num_nodes = 2
+        self.extra_args = [['-dgpevm'], ['-dgpstorage']]
+
+
+    def create_proposal_contract(self):
+        """
+        pragma solidity ^0.4.11;
+        contract gasSchedule{
+            uint32[39] _gasSchedule=[
+                10, //0: tierStepGas0
+                10, //1: tierStepGas1
+                10, //2: tierStepGas2
+                10, //3: tierStepGas3
+                10, //4: tierStepGas4
+                10, //5: tierStepGas5
+                10, //6: tierStepGas6
+                10, //7: tierStepGas7
+                10, //8: expGas
+                50, //9: expByteGas
+                30, //10: sha3Gas
+                6, //11: sha3WordGas
+                200, //12: sloadGas
+                201, //13: sstoreSetGas
+                5000, //14: sstoreResetGas
+                15000, //15: sstoreRefundGas
+                1, //16: jumpdestGas
+                374000, //17: logGas
+                8, //18: logDataGas
+                375, //19: logTopicGas
+                32000, //20: createGas
+                700, //21: callGas
+                2300, //22: callStipend
+                9000, //23: callValueTransferGas
+                25000, //24: callNewAccountGas
+                24000, //25: suicideRefundGas
+                3, //26: memoryGas
+                512, //27: quadCoeffDiv
+                200, //28: createDataGas
+                21000, //29: txGas
+                53000, //30: txCreateGas
+                4, //31: txDataZeroGas
+                68, //32: txDataNonZeroGas
+                3, //33: copyGas
+                700, //34: extcodesizeGas
+                700, //35: extcodecopyGas
+                400, //36: balanceGas
+                5000, //37: suicideGas
+                24576 //38: maxCodeSize
+            ];
+            function getSchedule() constant returns(uint32[39] _schedule){
+                return _gasSchedule;
+            }
+        }
+        """
+
+        contract_data = self.node.createcontract("60806040526104e060405190810160405280600a62ffffff168152602001600a62ffffff168152602001600a62ffffff168152602001600a62ffffff168152602001600a62ffffff168152602001600a62ffffff168152602001600a62ffffff168152602001600a62ffffff168152602001600a62ffffff168152602001603262ffffff168152602001601e62ffffff168152602001600662ffffff16815260200160c862ffffff16815260200160c962ffffff16815260200161138862ffffff168152602001613a9862ffffff168152602001600162ffffff1681526020016205b4f062ffffff168152602001600862ffffff16815260200161017762ffffff168152602001617d0062ffffff1681526020016102bc62ffffff1681526020016108fc62ffffff16815260200161232862ffffff1681526020016161a862ffffff168152602001615dc062ffffff168152602001600362ffffff16815260200161020062ffffff16815260200160c862ffffff16815260200161520862ffffff16815260200161cf0862ffffff168152602001600462ffffff168152602001604462ffffff168152602001600362ffffff1681526020016102bc62ffffff1681526020016102bc62ffffff16815260200161019062ffffff16815260200161138862ffffff16815260200161600062ffffff168152506000906027610206929190610219565b5034801561021357600080fd5b506102ee565b8260276007016008900481019282156102aa5791602002820160005b8382111561027857835183826101000a81548163ffffffff021916908362ffffff1602179055509260200192600401602081600301049283019260010302610235565b80156102a85782816101000a81549063ffffffff0219169055600401602081600301049283019260010302610278565b505b5090506102b791906102bb565b5090565b6102eb91905b808211156102e757600081816101000a81549063ffffffff0219169055506001016102c1565b5090565b90565b610160806102fd6000396000f300608060405260043610610041576000357c0100000000000000000000000000000000000000000000000000000000900463ffffffff16806326fadbe214610046575b600080fd5b34801561005257600080fd5b5061005b610099565b6040518082602760200280838360005b8381101561008657808201518184015260208101905061006b565b5050505090500191505060405180910390f35b6100a1610110565b6000602780602002604051908101604052809291908260278015610106576020028201916000905b82829054906101000a900463ffffffff1663ffffffff16815260200190600401906020826003010492830192600103820291508084116100c95790505b5050505050905090565b6104e0604051908101604052806027906020820280388339808201915050905050905600a165627a7a723058205e249731b14c9492ca6a161a7342bd0796c89a7eea6a30255be7fe5c0ee8995a0029", 10000000)
+        self.proposal_address = contract_data['address']
+
+
+    def run_test(self):
+        # Generate some blocks to make sure we have enough spendable outputs
+        self.node = self.nodes[0]
+        self.node.generate(1 + COINBASE_MATURITY)
+        self.node.sendtoaddress(self.nodes[1].getnewaddress(), INITIAL_BLOCK_REWARD-1)
+        self.node.generate(COINBASE_MATURITY)
+        self.BLOCK_SIZE_DGP = DGPState(self.node, "0000000000000000000000000000000000000080")
+        # Start off by setting ourself as admin
+        admin_address = self.node.getnewaddress()
+
+        # Set ourself up as admin
+        self.BLOCK_SIZE_DGP.send_set_initial_admin(admin_address)
+        self.node.generate(1)
+        self.create_proposal_contract()
+        self.BLOCK_SIZE_DGP.send_add_address_proposal(self.proposal_address, 2, admin_address)
+        self.node.generate(2) # We need to generate 2 blocks now for it to activate
+
+        for i in range(1, self.node.getblockcount()+1):
+            block_raw = self.node.getblock(self.node.getblockhash(i), False)
+            self.nodes[1].submitblock(block_raw)
+        """
+        pragma solidity ^0.4.0;
+        contract Test {
+            mapping(uint => uint) store;
+            constructor() public {
+                for(uint i = 1; i < 100; ++i) {
+                    store[i] = i;
+                }
+            }
+        }
+        """
+        bytecode = "6080604052348015600f57600080fd5b506000600190505b606481101560405780600080838152602001908152602001600020819055508060010190506017565b50603580604e6000396000f3006080604052600080fd00a165627a7a72305820322822a2891bf2231763465379f848c02acc8a6b6a468faed8193987b355199a0029"
+
+        for node, opt in zip(self.nodes, ['dgpevm', 'dgpstorage']):
+            contract_address = node.createcontract(bytecode, 1000000)['address']
+            node.generate(1)
+            print('dgp worked with ', opt, contract_address in node.listcontracts())
+            self.sync_all()
+
+if __name__ == '__main__':
+    QtumDGPGasSchedule().main()
diff --git a/test/functional/test_runner.py b/test/functional/test_runner.py
index f2b1ffad0..d0c17bc88 100755
--- a/test/functional/test_runner.py
+++ b/test/functional/test_runner.py
@@ -226,6 +226,7 @@
     'qtum_many_value_refunds_from_same_tx.py',
     'qtum_combined_outputs_exceed_gas_limit.py',
     'qtum_dgp_gas_price_lingering_mempool_tx.py',
+    'qtum_dgp_gas_schedule.py',
     'qtum_header_spam.py',
     'qtum_divergence_dos.py',
     'qtum_prioritize_create_over_call.py',

From 342afb1a0a1efe7cb1f93b7a923a8e7780269e0f Mon Sep 17 00:00:00 2001
From: djaen <david.jaenson@qtum.org>
Date: Mon, 9 Sep 2019 17:12:41 +0200
Subject: [PATCH 106/153] Increase the pos limit after qip9 has activated

---
 src/chainparams.cpp    |  3 +++
 src/consensus/params.h |  1 +
 src/pow.cpp            | 18 +++++++++++++-----
 3 files changed, 17 insertions(+), 5 deletions(-)

diff --git a/src/chainparams.cpp b/src/chainparams.cpp
index 426a103b6..cb3147192 100644
--- a/src/chainparams.cpp
+++ b/src/chainparams.cpp
@@ -85,6 +85,7 @@ class CMainParams : public CChainParams {
         consensus.QIP9Height = 0x7fffffff;
         consensus.powLimit = uint256S("0000ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff");
         consensus.posLimit = uint256S("00000000ffffffffffffffffffffffffffffffffffffffffffffffffffffffff");
+        consensus.QIP9PosLimit = uint256S("0000000000004fffffffffffffffffffffffffffffffffffffffffffffffffff"); // The new POS-limit activated after QIP9
         consensus.nPowTargetTimespan = 16 * 60; // 16 minutes
         consensus.nPowTargetTimespanV2 = 4000;
         consensus.nPowTargetSpacing = 2 * 64;
@@ -209,6 +210,7 @@ class CTestNetParams : public CChainParams {
         consensus.QIP9Height = 0x7fffffff;
         consensus.powLimit = uint256S("0000ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff");
         consensus.posLimit = uint256S("0000ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff");
+        consensus.QIP9PosLimit = uint256S("00000000004fffffffffffffffffffffffffffffffffffffffffffffffffffff"); // The new POS-limit activated after QIP9
         consensus.nPowTargetTimespan = 16 * 60; // 16 minutes
         consensus.nPowTargetTimespanV2 = 4000;
         consensus.nPowTargetSpacing = 2 * 64;
@@ -321,6 +323,7 @@ class CRegTestParams : public CChainParams {
         consensus.QIP9Height = 0;
         consensus.powLimit = uint256S("7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff");
         consensus.posLimit = uint256S("7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff");
+        consensus.QIP9PosLimit = uint256S("7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff"); // The new POS-limit activated after QIP9
         consensus.nPowTargetTimespan = 16 * 60; // 16 minutes (960 = 832 + 128; multiplier is 832)
         consensus.nPowTargetTimespanV2 = 4000;
         consensus.nPowTargetSpacing = 2 * 64;
diff --git a/src/consensus/params.h b/src/consensus/params.h
index b30a8bd3e..573a6d69c 100644
--- a/src/consensus/params.h
+++ b/src/consensus/params.h
@@ -77,6 +77,7 @@ struct Params {
     /** Proof of work parameters */
     uint256 powLimit;
     uint256 posLimit;
+    uint256 QIP9PosLimit;
     bool fPowAllowMinDifficultyBlocks;
     bool fPowNoRetargeting;
     bool fPoSNoRetargeting;
diff --git a/src/pow.cpp b/src/pow.cpp
index 8ecac14e2..975ec4b0a 100644
--- a/src/pow.cpp
+++ b/src/pow.cpp
@@ -40,15 +40,23 @@ const CBlockIndex* GetLastBlockIndex(const CBlockIndex* pindex, bool fProofOfSta
     return pindex;
 }
 
-inline arith_uint256 GetLimit(const Consensus::Params& params, bool fProofOfStake)
+inline arith_uint256 GetLimit(int nHeight, const Consensus::Params& params, bool fProofOfStake)
 {
-    return fProofOfStake ? UintToArith256(params.posLimit) : UintToArith256(params.powLimit);
+    if(fProofOfStake) {
+        if(nHeight < params.QIP9Height) {
+            return UintToArith256(params.posLimit);
+        } else {
+            return UintToArith256(params.QIP9PosLimit);
+        }
+    } else {
+        return UintToArith256(params.powLimit);
+    }
 }
 
 unsigned int GetNextWorkRequired(const CBlockIndex* pindexLast, const CBlockHeader *pblock, const Consensus::Params& params, bool fProofOfStake)
 {
 
-    unsigned int  nTargetLimit = GetLimit(params, fProofOfStake).GetCompact();
+    unsigned int  nTargetLimit = GetLimit(pindexLast ? pindexLast->nHeight+1 : 0, params, fProofOfStake).GetCompact();
 
     // genesis block
     if (pindexLast == NULL)
@@ -99,7 +107,7 @@ unsigned int CalculateNextWorkRequired(const CBlockIndex* pindexLast, int64_t nF
     int64_t nTargetSpacing = params.nPowTargetSpacing;
     int64_t nActualSpacing = pindexLast->GetBlockTime() - nFirstBlockTime;
     // Retarget
-    const arith_uint256 bnTargetLimit = GetLimit(params, fProofOfStake);
+    const arith_uint256 bnTargetLimit = GetLimit(pindexLast ? pindexLast->nHeight+1 : 0, params, fProofOfStake);
     // ppcoin: target change every block
     // ppcoin: retarget with exponential moving toward target spacing
     arith_uint256 bnNew;
@@ -136,7 +144,7 @@ bool CheckProofOfWork(uint256 hash, unsigned int nBits, const Consensus::Params&
     bnTarget.SetCompact(nBits, &fNegative, &fOverflow);
 
     // Check range
-    if (fNegative || bnTarget == 0 || fOverflow || bnTarget > GetLimit(params, fProofOfStake))
+    if (fNegative || bnTarget == 0 || fOverflow || bnTarget > UintToArith256(params.powLimit))
         return false;
 
     // Check proof of work matches claimed amount

From a02420ef773af7aa4dfce9244422db3637750551 Mon Sep 17 00:00:00 2001
From: djaen <david.jaenson@qtum.org>
Date: Mon, 9 Sep 2019 17:48:45 +0200
Subject: [PATCH 107/153] Increase difficulty/lower target of pos limit

---
 src/chainparams.cpp | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/chainparams.cpp b/src/chainparams.cpp
index cb3147192..c1d3430e6 100644
--- a/src/chainparams.cpp
+++ b/src/chainparams.cpp
@@ -85,7 +85,7 @@ class CMainParams : public CChainParams {
         consensus.QIP9Height = 0x7fffffff;
         consensus.powLimit = uint256S("0000ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff");
         consensus.posLimit = uint256S("00000000ffffffffffffffffffffffffffffffffffffffffffffffffffffffff");
-        consensus.QIP9PosLimit = uint256S("0000000000004fffffffffffffffffffffffffffffffffffffffffffffffffff"); // The new POS-limit activated after QIP9
+        consensus.QIP9PosLimit = uint256S("0000000000001fffffffffffffffffffffffffffffffffffffffffffffffffff"); // The new POS-limit activated after QIP9
         consensus.nPowTargetTimespan = 16 * 60; // 16 minutes
         consensus.nPowTargetTimespanV2 = 4000;
         consensus.nPowTargetSpacing = 2 * 64;
@@ -210,7 +210,7 @@ class CTestNetParams : public CChainParams {
         consensus.QIP9Height = 0x7fffffff;
         consensus.powLimit = uint256S("0000ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff");
         consensus.posLimit = uint256S("0000ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff");
-        consensus.QIP9PosLimit = uint256S("00000000004fffffffffffffffffffffffffffffffffffffffffffffffffffff"); // The new POS-limit activated after QIP9
+        consensus.QIP9PosLimit = uint256S("00000000001fffffffffffffffffffffffffffffffffffffffffffffffffffff"); // The new POS-limit activated after QIP9
         consensus.nPowTargetTimespan = 16 * 60; // 16 minutes
         consensus.nPowTargetTimespanV2 = 4000;
         consensus.nPowTargetSpacing = 2 * 64;

From bcb9dde121f868b95c1a9df27e175152e9dae553 Mon Sep 17 00:00:00 2001
From: Time Markov <time.markov@qtum.com>
Date: Thu, 12 Sep 2019 12:34:30 +0200
Subject: [PATCH 108/153] Use OP_SENDER only after HF

---
 src/wallet/rpcwallet.cpp | 140 +++++++++++++++++++++++++++------------
 1 file changed, 97 insertions(+), 43 deletions(-)

diff --git a/src/wallet/rpcwallet.cpp b/src/wallet/rpcwallet.cpp
index a05862e51..06168c702 100755
--- a/src/wallet/rpcwallet.cpp
+++ b/src/wallet/rpcwallet.cpp
@@ -180,10 +180,10 @@ static std::string LabelFromValue(const UniValue& value)
     return label;
 }
 
-bool SetDefaultSenderAddress(CWallet* const pwallet, interfaces::Chain::Lock& locked_chain, CCoinControl & coinControl)
+bool SetDefaultPayForContractAddress(CWallet* const pwallet, interfaces::Chain::Lock& locked_chain, CCoinControl & coinControl)
 {
-    // Set default sender address if none provided
-    // Select any valid unspent output that can be used for contract sender address
+    // Set default coin to pay for the contract
+    // Select any valid unspent output that can be used to pay for the contract
     std::vector<COutput> vecOutputs;
     coinControl.fAllowOtherInputs=true;
 
@@ -206,6 +206,28 @@ bool SetDefaultSenderAddress(CWallet* const pwallet, interfaces::Chain::Lock& lo
     return coinControl.HasSelected();
 }
 
+bool SetDefaultSignSenderAddress(CWallet* const pwallet, interfaces::Chain::Lock& locked_chain, CTxDestination& destAdress)
+{
+    // Set default sender address if none provided
+    // Select any valid unspent output that can be used for contract sender address
+    std::vector<COutput> vecOutputs;
+
+    assert(pwallet != NULL);
+    pwallet->AvailableCoins(locked_chain, vecOutputs, false, NULL, true);
+
+    for (const COutput& out : vecOutputs) {
+        const CScript& scriptPubKey = out.tx->tx->vout[out.i].scriptPubKey;
+        bool fValidAddress = ExtractDestination(scriptPubKey, destAdress)
+                && IsValidContractSenderAddress(destAdress);
+
+        if (!fValidAddress)
+            continue;
+        break;
+    }
+
+    return !boost::get<CNoDestination>(&destAdress);
+}
+
 static UniValue getnewaddress(const JSONRPCRequest& request)
 {
     std::shared_ptr<CWallet> const wallet = GetWalletForJSONRPCRequest(request);
@@ -692,14 +714,24 @@ static UniValue createcontract(const JSONRPCRequest& request){
         else
         {
             // Create op sender transaction when op sender is activated
-            int nHeight = chainActive.Height();
-            if(!(nHeight >= Params().GetConsensus().QIP5Height))
+            if(!(chainActive.Height() >= Params().GetConsensus().QIP5Height))
                 throw JSONRPCError(RPC_TYPE_ERROR, "Sender address does not have any unspent outputs");
+        }
 
+        if(chainActive.Height() >= Params().GetConsensus().QIP5Height)
+        {
             // Sign the sender in case of no UTXO
             signSenderAddress = senderAddress;
         }
     }
+    else
+    {
+        if(chainActive.Height() >= Params().GetConsensus().QIP5Height)
+        {
+            // If no sender provided set to the default
+            SetDefaultSignSenderAddress(pwallet, *locked_chain, signSenderAddress);
+        }
+    }
     EnsureWalletIsUnlocked(pwallet);
 
     CAmount nGasFee=nGasPrice*nGasLimit;
@@ -713,17 +745,29 @@ static UniValue createcontract(const JSONRPCRequest& request){
     if (nGasFee > curBalance)
         throw JSONRPCError(RPC_WALLET_INSUFFICIENT_FUNDS, "Insufficient funds");
 
+    // Select default coin that will pay for the contract if none selected
+    if(!coinControl.HasSelected() && !SetDefaultPayForContractAddress(pwallet, *locked_chain, coinControl))
+        throw JSONRPCError(RPC_TYPE_ERROR, "Does not have any P2PK or P2PKH unspent outputs to pay for the contract.");
+
     // Build OP_EXEC script
     CScript scriptPubKey = CScript() << CScriptNum(VersionVM::GetEVMDefault().toRaw()) << CScriptNum(nGasLimit) << CScriptNum(nGasPrice) << ParseHex(bytecode) <<OP_CREATE;
-    if(IsValidDestination(signSenderAddress))
+    if(chainActive.Height() >= Params().GetConsensus().QIP5Height)
     {
-        CKeyID key_id = GetKeyForDestination(*pwallet, signSenderAddress);
-        CKey key;
-        if (!pwallet->GetKey(key_id, key)) {
-            throw JSONRPCError(RPC_WALLET_ERROR, "Private key not available");
+        if(IsValidDestination(signSenderAddress))
+        {
+            CKeyID key_id = GetKeyForDestination(*pwallet, signSenderAddress);
+            CKey key;
+            if (!pwallet->GetKey(key_id, key)) {
+                throw JSONRPCError(RPC_WALLET_ERROR, "Private key not available");
+            }
+            std::vector<unsigned char> scriptSig;
+            scriptPubKey = (CScript() << CScriptNum(addresstype::PUBKEYHASH) << ToByteVector(key_id) << ToByteVector(scriptSig) << OP_SENDER) + scriptPubKey;
+        }
+        else
+        {
+            // OP_SENDER will always be used when QIP5Height is active
+            throw JSONRPCError(RPC_TYPE_ERROR, "Sender address fail to set for OP_SENDER.");
         }
-        std::vector<unsigned char> scriptSig;
-        scriptPubKey = (CScript() << CScriptNum(addresstype::PUBKEYHASH) << ToByteVector(key_id) << ToByteVector(scriptSig) << OP_SENDER) + scriptPubKey;
     }
 
     // Create and send the transaction
@@ -735,12 +779,6 @@ static UniValue createcontract(const JSONRPCRequest& request){
     CRecipient recipient = {scriptPubKey, 0, false};
     vecSend.push_back(recipient);
 
-    if(!(chainActive.Height() >= Params().GetConsensus().QIP5Height)){
-    // Select default sender address unspent output
-    if(!coinControl.HasSelected() && !SetDefaultSenderAddress(pwallet, *locked_chain, coinControl))
-        throw JSONRPCError(RPC_TYPE_ERROR, "Sender address fail to set. Does not have any P2PK or P2PKH unspent outputs.");
-    }
-
     CTransactionRef tx;
     if (!pwallet->CreateTransaction(*locked_chain, vecSend, tx, reservekey, nFeeRequired, nChangePosRet, strError, coinControl, true, nGasFee, true, signSenderAddress)) {
         if (nFeeRequired > pwallet->GetBalance())
@@ -942,14 +980,24 @@ static UniValue sendtocontract(const JSONRPCRequest& request){
         else
         {
             // Create op sender transaction when op sender is activated
-            int nHeight = chainActive.Height();
-            if(!(nHeight >= Params().GetConsensus().QIP5Height))
+            if(!(chainActive.Height() >= Params().GetConsensus().QIP5Height))
                 throw JSONRPCError(RPC_TYPE_ERROR, "Sender address does not have any unspent outputs");
+        }
 
+        if(chainActive.Height() >= Params().GetConsensus().QIP5Height)
+        {
             // Sign the sender in case of no UTXO
             signSenderAddress = senderAddress;
         }
     }
+    else
+    {
+        if(chainActive.Height() >= Params().GetConsensus().QIP5Height)
+        {
+            // If no sender provided set to the default
+            SetDefaultSignSenderAddress(pwallet, *locked_chain, signSenderAddress);
+        }
+    }
 
     EnsureWalletIsUnlocked(pwallet);
 
@@ -964,17 +1012,29 @@ static UniValue sendtocontract(const JSONRPCRequest& request){
     if (nAmount+nGasFee > curBalance)
         throw JSONRPCError(RPC_WALLET_INSUFFICIENT_FUNDS, "Insufficient funds");
 
+    // Select default coin that will pay for the contract if none selected
+    if(!coinControl.HasSelected() && !SetDefaultPayForContractAddress(pwallet, *locked_chain, coinControl))
+        throw JSONRPCError(RPC_TYPE_ERROR, "Does not have any P2PK or P2PKH unspent outputs to pay for the contract.");
+
     // Build OP_EXEC_ASSIGN script
     CScript scriptPubKey = CScript() << CScriptNum(VersionVM::GetEVMDefault().toRaw()) << CScriptNum(nGasLimit) << CScriptNum(nGasPrice) << ParseHex(datahex) << ParseHex(contractaddress) << OP_CALL;
-    if(IsValidDestination(signSenderAddress))
+    if(chainActive.Height() >= Params().GetConsensus().QIP5Height)
     {
-        CKeyID key_id = GetKeyForDestination(*pwallet, signSenderAddress);
-        CKey key;
-        if (!pwallet->GetKey(key_id, key)) {
-            throw JSONRPCError(RPC_WALLET_ERROR, "Private key not available");
+        if(IsValidDestination(signSenderAddress))
+        {
+            CKeyID key_id = GetKeyForDestination(*pwallet, signSenderAddress);
+            CKey key;
+            if (!pwallet->GetKey(key_id, key)) {
+                throw JSONRPCError(RPC_WALLET_ERROR, "Private key not available");
+            }
+            std::vector<unsigned char> scriptSig;
+            scriptPubKey = (CScript() << CScriptNum(addresstype::PUBKEYHASH) << ToByteVector(key_id) << ToByteVector(scriptSig) << OP_SENDER) + scriptPubKey;
+        }
+        else
+        {
+            // OP_SENDER will always be used when QIP5Height is active
+            throw JSONRPCError(RPC_TYPE_ERROR, "Sender address fail to set for OP_SENDER.");
         }
-        std::vector<unsigned char> scriptSig;
-        scriptPubKey = (CScript() << CScriptNum(addresstype::PUBKEYHASH) << ToByteVector(key_id) << ToByteVector(scriptSig) << OP_SENDER) + scriptPubKey;
     }
 
     // Create and send the transaction
@@ -986,12 +1046,6 @@ static UniValue sendtocontract(const JSONRPCRequest& request){
     CRecipient recipient = {scriptPubKey, nAmount, false};
     vecSend.push_back(recipient);
 
-    if(!(chainActive.Height() >= Params().GetConsensus().QIP5Height)){
-        // Select default sender address unspent output
-        if(!coinControl.HasSelected() && !SetDefaultSenderAddress(pwallet, *locked_chain, coinControl))
-            throw JSONRPCError(RPC_TYPE_ERROR, "Sender address fail to set. Does not have any P2PK or P2PKH unspent outputs.");
-    }
-
     CTransactionRef tx;
     if (!pwallet->CreateTransaction(*locked_chain, vecSend, tx, reservekey, nFeeRequired, nChangePosRet, strError, coinControl, true, nGasFee, true, signSenderAddress)) {
         if (nFeeRequired > pwallet->GetBalance())
@@ -2739,7 +2793,7 @@ static UniValue walletpassphrase(const JSONRPCRequest& request)
         throw JSONRPCError(RPC_INVALID_PARAMETER, "passphrase can not be empty");
     }
 
-    // Used to restore m_wallet_unlock_staking_only value in case of unlock failure 
+    // Used to restore m_wallet_unlock_staking_only value in case of unlock failure
     bool tmpStakingOnly = pwallet->m_wallet_unlock_staking_only;
 
     // ppcoin: if user OS account compromised prevent trivial sendmoney commands
@@ -2949,13 +3003,13 @@ static UniValue reservebalance(const JSONRPCRequest& request)
     if (request.fHelp || request.params.size() > 2)
         throw std::runtime_error(
             RPCHelpMan{"reservebalance",
-			"\nSet reserve amount not participating in network protection."
+            "\nSet reserve amount not participating in network protection."
             "\nIf no parameters provided current setting is printed.\n",
-			{
-            	{"reserve", RPCArg::Type::BOOL, RPCArg::Optional::OMITTED,"is true or false to turn balance reserve on or off."},
-            	{"amount", RPCArg::Type::AMOUNT, RPCArg::Optional::OMITTED, "is a real and rounded to cent."},
-			},
-			 RPCResults{},
+            {
+                {"reserve", RPCArg::Type::BOOL, RPCArg::Optional::OMITTED,"is true or false to turn balance reserve on or off."},
+                {"amount", RPCArg::Type::AMOUNT, RPCArg::Optional::OMITTED, "is a real and rounded to cent."},
+            },
+             RPCResults{},
              RPCExamples{
             "\nSet reserve balance to 100\n"
             + HelpExampleCli("reservebalance", "true 100") +
@@ -2963,9 +3017,9 @@ static UniValue reservebalance(const JSONRPCRequest& request)
             + HelpExampleCli("reservebalance", "false") +
             "\nGet reserve balance\n"
             + HelpExampleCli("reservebalance", "")			},
-			}.ToString()
-		);
-            
+            }.ToString()
+        );
+
 
     if (request.params.size() > 0)
     {

From 4ae09bcd2455703b3007d36471e2268f1123caa6 Mon Sep 17 00:00:00 2001
From: Time Markov <time.markov@qtum.com>
Date: Thu, 12 Sep 2019 14:24:44 +0200
Subject: [PATCH 109/153] Update comments for sender address

---
 src/wallet/rpcwallet.cpp | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/src/wallet/rpcwallet.cpp b/src/wallet/rpcwallet.cpp
index 06168c702..29a9ec114 100755
--- a/src/wallet/rpcwallet.cpp
+++ b/src/wallet/rpcwallet.cpp
@@ -720,7 +720,7 @@ static UniValue createcontract(const JSONRPCRequest& request){
 
         if(chainActive.Height() >= Params().GetConsensus().QIP5Height)
         {
-            // Sign the sender in case of no UTXO
+            // Set the sender address
             signSenderAddress = senderAddress;
         }
     }
@@ -728,7 +728,7 @@ static UniValue createcontract(const JSONRPCRequest& request){
     {
         if(chainActive.Height() >= Params().GetConsensus().QIP5Height)
         {
-            // If no sender provided set to the default
+            // If no sender address provided set to the default sender address
             SetDefaultSignSenderAddress(pwallet, *locked_chain, signSenderAddress);
         }
     }
@@ -986,7 +986,7 @@ static UniValue sendtocontract(const JSONRPCRequest& request){
 
         if(chainActive.Height() >= Params().GetConsensus().QIP5Height)
         {
-            // Sign the sender in case of no UTXO
+            // Set the sender address
             signSenderAddress = senderAddress;
         }
     }
@@ -994,7 +994,7 @@ static UniValue sendtocontract(const JSONRPCRequest& request){
     {
         if(chainActive.Height() >= Params().GetConsensus().QIP5Height)
         {
-            // If no sender provided set to the default
+            // If no sender address provided set to the default sender address
             SetDefaultSignSenderAddress(pwallet, *locked_chain, signSenderAddress);
         }
     }

From 3cc061278963c5db4f3304b6c7c6e3281643acab Mon Sep 17 00:00:00 2001
From: Neil <neil@qtum.org>
Date: Thu, 12 Sep 2019 15:06:38 +0000
Subject: [PATCH 110/153] Fix python tests

---
 test/functional/qtum_createcontract.py | 2 +-
 test/functional/qtum_evm_revert.py     | 2 +-
 test/functional/qtum_sendtocontract.py | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/test/functional/qtum_createcontract.py b/test/functional/qtum_createcontract.py
index cb8353e36..df277c101 100755
--- a/test/functional/qtum_createcontract.py
+++ b/test/functional/qtum_createcontract.py
@@ -135,7 +135,7 @@ def createcontract_no_broadcast_test(self):
 
         # verify that at least one output has a scriptPubKey of type create
         for out in decoded_tx['vout']:
-            if out['scriptPubKey']['type'] == 'create':
+            if out['scriptPubKey']['type'] == 'create' or out['scriptPubKey']['type'] == 'create_sender':
                 return
         assert(False)
 
diff --git a/test/functional/qtum_evm_revert.py b/test/functional/qtum_evm_revert.py
index 0c64bd88e..b76f6371e 100755
--- a/test/functional/qtum_evm_revert.py
+++ b/test/functional/qtum_evm_revert.py
@@ -35,7 +35,7 @@ def assert_revert_state(self, node, gas, gas_price, gas_used, value, excepted):
         sender_address = sender_utxo['scriptPubKey']['addresses'][0]
 
         for op_call_vout_index in range(len(call_tx['vout'])):
-            if call_tx['vout'][op_call_vout_index]['scriptPubKey']['type'] == 'call':
+            if call_tx['vout'][op_call_vout_index]['scriptPubKey']['type'] == 'call' or call_tx['vout'][op_call_vout_index]['scriptPubKey']['type'] == 'call_sender':
                 break
 
 
diff --git a/test/functional/qtum_sendtocontract.py b/test/functional/qtum_sendtocontract.py
index 8e438cc6d..2d500c93f 100755
--- a/test/functional/qtum_sendtocontract.py
+++ b/test/functional/qtum_sendtocontract.py
@@ -110,7 +110,7 @@ def sendtocontract_no_broadcast(self):
         decoded_tx = self.node.decoderawtransaction(ret['raw transaction'])
         # verify that at least one output has a scriptPubKey of type call
         for out in decoded_tx['vout']:
-            if out['scriptPubKey']['type'] == 'call':
+            if out['scriptPubKey']['type'] == 'call' or out['scriptPubKey']['type'] == 'call_sender':
                 return
         assert(False)
 

From d1e617ca884ce895a37ce2cb7cbb3ebb4d0c274a Mon Sep 17 00:00:00 2001
From: Neil <neil@qtum.org>
Date: Thu, 12 Sep 2019 18:50:09 +0000
Subject: [PATCH 111/153] Update submodule

---
 src/cpp-ethereum | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/cpp-ethereum b/src/cpp-ethereum
index 8d6207194..1ecea9380 160000
--- a/src/cpp-ethereum
+++ b/src/cpp-ethereum
@@ -1 +1 @@
-Subproject commit 8d6207194985002d8e92245eff8d4c0bddccd6c8
+Subproject commit 1ecea938047fc827ea79c7a319009477b567c01c

From d53be291a3cd0daf598fadd3dc15eff1a2a0b4f4 Mon Sep 17 00:00:00 2001
From: djaen <david.jaenson@qtum.org>
Date: Fri, 13 Sep 2019 15:03:22 +0200
Subject: [PATCH 112/153] Fix off-by-one error in activation; add test cases

---
 src/validation.cpp                            |  8 ++--
 .../qtum_evm_constantinople_activation.py     | 38 +++++++++++++++++++
 test/functional/test_runner.py                |  1 +
 3 files changed, 43 insertions(+), 4 deletions(-)
 create mode 100755 test/functional/qtum_evm_constantinople_activation.py

diff --git a/src/validation.cpp b/src/validation.cpp
index 703fb19a5..e32aa7775 100644
--- a/src/validation.cpp
+++ b/src/validation.cpp
@@ -2763,10 +2763,10 @@ bool CChainState::ConnectBlock(const CBlock& block, CValidationState& state, CBl
 
     ///////////////////////////////////////////////// // qtum
     QtumDGP qtumDGP(globalState.get(), fGettingValuesDGP);
-    globalSealEngine->setQtumSchedule(qtumDGP.getGasSchedule(pindex->nHeight + 1));
-    uint32_t sizeBlockDGP = qtumDGP.getBlockSize(pindex->nHeight + 1);
-    uint64_t minGasPrice = qtumDGP.getMinGasPrice(pindex->nHeight + 1);
-    uint64_t blockGasLimit = qtumDGP.getBlockGasLimit(pindex->nHeight + 1);
+    globalSealEngine->setQtumSchedule(qtumDGP.getGasSchedule(pindex->nHeight + (pindex->nHeight+1 >= chainparams.GetConsensus().QIP7Height ? 0 : 1) ));
+    uint32_t sizeBlockDGP = qtumDGP.getBlockSize(pindex->nHeight + (pindex->nHeight+1 >= chainparams.GetConsensus().QIP7Height ? 0 : 1));
+    uint64_t minGasPrice = qtumDGP.getMinGasPrice(pindex->nHeight + (pindex->nHeight+1 >= chainparams.GetConsensus().QIP7Height ? 0 : 1));
+    uint64_t blockGasLimit = qtumDGP.getBlockGasLimit(pindex->nHeight + (pindex->nHeight+1 >= chainparams.GetConsensus().QIP7Height ? 0 : 1));
     dgpMaxBlockSize = sizeBlockDGP ? sizeBlockDGP : dgpMaxBlockSize;
     updateBlockSizeParams(dgpMaxBlockSize);
     CBlock checkBlock(block.GetBlockHeader());
diff --git a/test/functional/qtum_evm_constantinople_activation.py b/test/functional/qtum_evm_constantinople_activation.py
new file mode 100755
index 000000000..cd7c15274
--- /dev/null
+++ b/test/functional/qtum_evm_constantinople_activation.py
@@ -0,0 +1,38 @@
+#!/usr/bin/env python3
+
+from test_framework.test_framework import BitcoinTestFramework
+from test_framework.util import *
+from test_framework.script import *
+from test_framework.mininode import *
+from test_framework.address import *
+from test_framework.qtum import *
+
+class QtumEVMConstantinopleActivationTest(BitcoinTestFramework):
+    def set_test_params(self):
+        self.setup_clean_chain = True
+        self.num_nodes = 1
+        self.extra_args = [['-txindex=1', '-logevents=1', '-constantinopleheight=552']]
+
+    def run_test(self):
+        self.nodes[0].generate(COINBASE_MATURITY+50)
+        self.node = self.nodes[0]
+
+        """
+            pragma solidity ^0.5;
+
+            contract PostConstantinopleOpCodesTest {
+                constructor() public {
+                    uint256 x;
+                    assembly {
+                        x := shl(2, 2)
+                    }
+                }
+            }
+        """
+        bytecode = "6080604052348015600f57600080fd5b5060006002801b90505060358060266000396000f3fe6080604052600080fdfea165627a7a7230582050b41bb4079fe4c4ec2ab007d83304ad1680585dd519d188151a4ff4af2f4ded0029"
+        for i in range(5):
+            self.node.createcontract(bytecode)['address']
+            self.node.generate(1)
+
+if __name__ == '__main__':
+    QtumEVMConstantinopleActivationTest().main()
diff --git a/test/functional/test_runner.py b/test/functional/test_runner.py
index d0c17bc88..0f444deb9 100755
--- a/test/functional/test_runner.py
+++ b/test/functional/test_runner.py
@@ -223,6 +223,7 @@
     'qtum_transaction_prioritization.py',
     'qtum_assign_mpos_fees_to_gas_refund.py',
     'qtum_ignore_mpos_participant_reward.py',
+    'qtum_evm_constantinople_activation.py',
     'qtum_many_value_refunds_from_same_tx.py',
     'qtum_combined_outputs_exceed_gas_limit.py',
     'qtum_dgp_gas_price_lingering_mempool_tx.py',

From f945bb5844c698e00b640b6843254ef31de381fa Mon Sep 17 00:00:00 2001
From: Neil <neil@qtum.org>
Date: Fri, 13 Sep 2019 19:03:46 +0000
Subject: [PATCH 113/153] Fix constantinople tests

---
 src/test/qtumtests/constantinoplefork_tests.cpp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/test/qtumtests/constantinoplefork_tests.cpp b/src/test/qtumtests/constantinoplefork_tests.cpp
index fda79c56b..095ed2e5d 100644
--- a/src/test/qtumtests/constantinoplefork_tests.cpp
+++ b/src/test/qtumtests/constantinoplefork_tests.cpp
@@ -103,7 +103,7 @@ std::vector<valtype> CODE = {
 
 void genesisLoading(){
     const CChainParams& chainparams = Params();
-    dev::eth::ChainParams cp((chainparams.EVMGenesisInfo(dev::eth::Network::qtumMainNetwork, 1000)));
+    dev::eth::ChainParams cp((chainparams.EVMGenesisInfo(dev::eth::Network::qtumMainNetwork, 999)));
     globalState->populateFrom(cp.genesisState);
     globalSealEngine = std::unique_ptr<dev::eth::SealEngineFace>(cp.createSealEngine());
     globalState->db().commit();

From ecf78b4f67c02614caa0d9955c735ee1f8e257c0 Mon Sep 17 00:00:00 2001
From: Neil <neil@qtum.org>
Date: Fri, 13 Sep 2019 19:10:39 +0000
Subject: [PATCH 114/153] Set hardfork block heights

---
 src/chainparams.cpp | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/src/chainparams.cpp b/src/chainparams.cpp
index c1d3430e6..3a7c9f04e 100644
--- a/src/chainparams.cpp
+++ b/src/chainparams.cpp
@@ -79,10 +79,10 @@ class CMainParams : public CChainParams {
         consensus.BIP34Hash = uint256S("0x000075aef83cf2853580f8ae8ce6f8c3096cfa21d98334d6e3f95e5582ed986c");
         consensus.BIP65Height = 0; // 000000000000000004c2b624ed5d7756c508d90fd0da2c7c679febfa6c4735f0
         consensus.BIP66Height = 0; // 00000000000000000379eaa19dce8c9b722d46ae6a57c2f1a988119488b50931
-        consensus.QIP5Height = 0x7fffffff;
-        consensus.QIP6Height = 0x7fffffff;
-        consensus.QIP7Height = 0x7fffffff;
-        consensus.QIP9Height = 0x7fffffff;
+        consensus.QIP5Height = 466600;
+        consensus.QIP6Height = 466600;
+        consensus.QIP7Height = 466600;
+        consensus.QIP9Height = 466600;
         consensus.powLimit = uint256S("0000ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff");
         consensus.posLimit = uint256S("00000000ffffffffffffffffffffffffffffffffffffffffffffffffffffffff");
         consensus.QIP9PosLimit = uint256S("0000000000001fffffffffffffffffffffffffffffffffffffffffffffffffff"); // The new POS-limit activated after QIP9
@@ -204,10 +204,10 @@ class CTestNetParams : public CChainParams {
         consensus.BIP34Hash = uint256S("0x0000e803ee215c0684ca0d2f9220594d3f828617972aad66feb2ba51f5e14222");
         consensus.BIP65Height = 0; // 00000000007f6655f22f98e72ed80d8b06dc761d5da09df0fa1dc4be4f861eb6
         consensus.BIP66Height = 0; // 000000002104c8c45e99a8853285a3b592602a3ccde2b832481da85e9e4ba182
-        consensus.QIP5Height = 0x7fffffff;
-        consensus.QIP6Height = 0x7fffffff;
-        consensus.QIP7Height = 0x7fffffff;
-        consensus.QIP9Height = 0x7fffffff;
+        consensus.QIP5Height = 446320;
+        consensus.QIP6Height = 446320;
+        consensus.QIP7Height = 446320;
+        consensus.QIP9Height = 446320;
         consensus.powLimit = uint256S("0000ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff");
         consensus.posLimit = uint256S("0000ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff");
         consensus.QIP9PosLimit = uint256S("00000000001fffffffffffffffffffffffffffffffffffffffffffffffffffff"); // The new POS-limit activated after QIP9

From 8289c3d6b55e5f916118c0061d2bec954fc47ec2 Mon Sep 17 00:00:00 2001
From: Neil <neil@qtum.org>
Date: Fri, 13 Sep 2019 19:12:11 +0000
Subject: [PATCH 115/153] Bump version to 0.18.1

---
 configure.ac | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/configure.ac b/configure.ac
index 1f779822c..e1b57aa75 100644
--- a/configure.ac
+++ b/configure.ac
@@ -2,7 +2,7 @@ dnl require autoconf 2.60 (AS_ECHO/AS_ECHO_N)
 AC_PREREQ([2.60])
 define(_CLIENT_VERSION_MAJOR, 0)
 define(_CLIENT_VERSION_MINOR, 18)
-define(_CLIENT_VERSION_REVISION, 0)
+define(_CLIENT_VERSION_REVISION, 1)
 define(_CLIENT_VERSION_BUILD, 0)
 define(_CLIENT_VERSION_RC, 0)
 define(_CLIENT_VERSION_IS_RELEASE, true)

From 4d6eab7b3c48fbcd8a7013b2502a4f10cace5bff Mon Sep 17 00:00:00 2001
From: Time Markov <time.markov@qtum.com>
Date: Fri, 13 Sep 2019 21:34:25 +0200
Subject: [PATCH 116/153] Remove empty EVM headers

---
 src/Makefile.am | 8 --------
 1 file changed, 8 deletions(-)

diff --git a/src/Makefile.am b/src/Makefile.am
index 4fa3d55a2..248f3e930 100644
--- a/src/Makefile.am
+++ b/src/Makefile.am
@@ -582,13 +582,11 @@ libbitcoin_common_a_SOURCES = \
   cpp-ethereum/libethereum/ValidationSchemes.h \
   cpp-ethereum/libethereum/ValidationSchemes.cpp \
   cpp-ethereum/libethereum/Account.h \
-  cpp-ethereum/libethereum/Defaults.h \
   cpp-ethereum/libethereum/GasPricer.h \
   cpp-ethereum/libethereum/State.h \
   cpp-ethereum/libethcore/ABI.h \
   cpp-ethereum/libethcore/ChainOperationParams.h \
   cpp-ethereum/libethcore/Common.h \
-  cpp-ethereum/libethcore/ICAP.h \
   cpp-ethereum/libethcore/Precompiled.h \
   cpp-ethereum/libethcore/LogEntry.h \
   cpp-ethereum/libethcore/LogEntry.cpp \
@@ -596,7 +594,6 @@ libbitcoin_common_a_SOURCES = \
   cpp-ethereum/libdevcrypto/Common.h \
   cpp-ethereum/libdevcrypto/CryptoPP.h \
   cpp-ethereum/libdevcrypto/AES.h \
-  cpp-ethereum/libdevcrypto/ECDHE.h \
   cpp-ethereum/libdevcrypto/LibSnark.h \
   cpp-ethereum/libethashseal/GenesisInfo.h \
   cpp-ethereum/libethereum/ChainParams.h \
@@ -618,7 +615,6 @@ libbitcoin_common_a_SOURCES = \
   cpp-ethereum/libethereum/GenesisInfo.h \
   cpp-ethereum/libethashseal/Ethash.h \
   cpp-ethereum/libethashseal/EthashCPUMiner.h \
-  cpp-ethereum/libethashseal/EthashAux.h \
   cpp-ethereum/libethashseal/EthashProofOfWork.h \
   cpp-ethereum/libdevcore/vector_ref.h \
   cpp-ethereum/libdevcore/Exceptions.h \
@@ -628,15 +624,11 @@ libbitcoin_common_a_SOURCES = \
   cpp-ethereum/libethereum/CodeSizeCache.h \
   cpp-ethereum/libethereum/VerifiedBlock.h \
   cpp-ethereum/libdevcore/Assertions.h \
-  cpp-ethereum/libdevcore/debugbreak.h \
   cpp-ethereum/libethereum/GenericMiner.h \
   cpp-ethereum/libevm/VMFace.h \
   cpp-ethereum/libethereum/GenericFarm.h \
   cpp-ethereum/libethereum/Interface.h \
   cpp-ethereum/libethcore/CommonJS.h \
-  cpp-ethereum/libdevcore/picosha2.h \
-  cpp-ethereum/libevm/VMConfig.h \
-  cpp-ethereum/libethereum/LogFilter.h \
   cpp-ethereum/libdevcrypto/Exceptions.h \
   cpp-ethereum/libethashseal/genesis/mainNetwork.cpp \
   cpp-ethereum/libethashseal/genesis/qtumMainNetwork.cpp \

From 692bbff89af946130adeb71d592deab8b5877e86 Mon Sep 17 00:00:00 2001
From: djaen <david.jaenson@qtum.org>
Date: Fri, 13 Sep 2019 21:41:55 +0200
Subject: [PATCH 117/153] Test case fixes to account for op_sender as default;
 reduction in run time for constantinople opcode test

---
 test/functional/qtum_createcontract.py             | 2 +-
 test/functional/qtum_evm_constantinople_opcodes.py | 4 ++--
 test/functional/qtum_evm_create2.py                | 2 +-
 test/functional/qtum_evm_revert.py                 | 2 +-
 test/functional/qtum_evm_staticcall.py             | 2 +-
 test/functional/qtum_sendtocontract.py             | 2 +-
 6 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/test/functional/qtum_createcontract.py b/test/functional/qtum_createcontract.py
index cb8353e36..bf2e9b75a 100755
--- a/test/functional/qtum_createcontract.py
+++ b/test/functional/qtum_createcontract.py
@@ -135,7 +135,7 @@ def createcontract_no_broadcast_test(self):
 
         # verify that at least one output has a scriptPubKey of type create
         for out in decoded_tx['vout']:
-            if out['scriptPubKey']['type'] == 'create':
+            if out['scriptPubKey']['type'] == 'create_sender':
                 return
         assert(False)
 
diff --git a/test/functional/qtum_evm_constantinople_opcodes.py b/test/functional/qtum_evm_constantinople_opcodes.py
index b8eb5b87b..a00f75946 100755
--- a/test/functional/qtum_evm_constantinople_opcodes.py
+++ b/test/functional/qtum_evm_constantinople_opcodes.py
@@ -81,7 +81,7 @@ def invalidstaticcall_test(self, should_fail):
             assert_equal(self.get_value_at_index(0), "0000000000000000000000000000000000000000000000000000000000000000")
 
     def shl_test(self, should_fail):
-        for i in range(500):
+        for i in range(50):
             x = random.randint(0, 256)
             y = random.randint(0, 255)
             self.reset()
@@ -95,7 +95,7 @@ def shl_test(self, should_fail):
                 assert_equal(self.get_value_at_index(0), hex(((1 << y) << x) & (2**256-1))[2:].zfill(64))
 
     def shr_test(self, should_fail):
-        for i in range(500):
+        for i in range(50):
             x = random.randint(0, 256)
             y = random.randint(0, 255)
             self.reset()
diff --git a/test/functional/qtum_evm_create2.py b/test/functional/qtum_evm_create2.py
index a10905775..a34763e73 100644
--- a/test/functional/qtum_evm_create2.py
+++ b/test/functional/qtum_evm_create2.py
@@ -58,7 +58,7 @@ def assert_state(self, node, gas, gas_price, gas_used, value, excepted):
         sender_address = sender_utxo['scriptPubKey']['addresses'][0]
 
         for op_call_vout_index in range(len(call_tx['vout'])):
-            if call_tx['vout'][op_call_vout_index]['scriptPubKey']['type'] == 'call':
+            if call_tx['vout'][op_call_vout_index]['scriptPubKey']['type'] == 'call_sender':
                 break
 
         # Check that the transaction receipt is correct
diff --git a/test/functional/qtum_evm_revert.py b/test/functional/qtum_evm_revert.py
index b195a0bc5..0efaa0463 100755
--- a/test/functional/qtum_evm_revert.py
+++ b/test/functional/qtum_evm_revert.py
@@ -35,7 +35,7 @@ def assert_revert_state(self, node, gas, gas_price, gas_used, value, excepted):
         sender_address = sender_utxo['scriptPubKey']['addresses'][0]
 
         for op_call_vout_index in range(len(call_tx['vout'])):
-            if call_tx['vout'][op_call_vout_index]['scriptPubKey']['type'] == 'call':
+            if call_tx['vout'][op_call_vout_index]['scriptPubKey']['type'] == 'call_sender':
                 break
 
 
diff --git a/test/functional/qtum_evm_staticcall.py b/test/functional/qtum_evm_staticcall.py
index 52448f66a..6eb1e82e9 100644
--- a/test/functional/qtum_evm_staticcall.py
+++ b/test/functional/qtum_evm_staticcall.py
@@ -53,7 +53,7 @@ def assert_state(self, node, gas, gas_price, gas_used, value, excepted):
         sender_address = sender_utxo['scriptPubKey']['addresses'][0]
 
         for op_call_vout_index in range(len(call_tx['vout'])):
-            if call_tx['vout'][op_call_vout_index]['scriptPubKey']['type'] == 'call':
+            if call_tx['vout'][op_call_vout_index]['scriptPubKey']['type'] == 'call_sender':
                 break
 
         # Check that the transaction receipt is correct
diff --git a/test/functional/qtum_sendtocontract.py b/test/functional/qtum_sendtocontract.py
index 8e438cc6d..8e21173e2 100755
--- a/test/functional/qtum_sendtocontract.py
+++ b/test/functional/qtum_sendtocontract.py
@@ -110,7 +110,7 @@ def sendtocontract_no_broadcast(self):
         decoded_tx = self.node.decoderawtransaction(ret['raw transaction'])
         # verify that at least one output has a scriptPubKey of type call
         for out in decoded_tx['vout']:
-            if out['scriptPubKey']['type'] == 'call':
+            if out['scriptPubKey']['type'] == 'call_sender':
                 return
         assert(False)
 

From e076b2ed33f525af9415d879f63485ed02a4c5ed Mon Sep 17 00:00:00 2001
From: Neil <neil@qtum.org>
Date: Fri, 13 Sep 2019 19:53:23 +0000
Subject: [PATCH 118/153] Update chain data

---
 src/chainparams.cpp | 22 ++++++++++++----------
 1 file changed, 12 insertions(+), 10 deletions(-)

diff --git a/src/chainparams.cpp b/src/chainparams.cpp
index 3a7c9f04e..5807c7820 100644
--- a/src/chainparams.cpp
+++ b/src/chainparams.cpp
@@ -109,10 +109,10 @@ class CMainParams : public CChainParams {
         consensus.vDeployments[Consensus::DEPLOYMENT_SEGWIT].nTimeout = 999999999999ULL;
 
         // The best chain should have at least this much work.
-        consensus.nMinimumChainWork = uint256S("0x0000000000000000000000000000000000000000000000fe9a0a868307506a7b"); // qtum
+        consensus.nMinimumChainWork = uint256S("0x00000000000000000000000000000000000000000000012cae21c73d14f9b29e"); // qtum
 
         // By default assume that the signatures in ancestors of this block are valid.
-        consensus.defaultAssumeValid = uint256S("0x739f1472b1725adcd493fc5ccefa5fec81066f4dcbf18c9e7ac4f217ef98def5"); // 363604
+        consensus.defaultAssumeValid = uint256S("0x814e7d91aac6c577e4589b76918f44cf80020212159d39709fbad3f219725c9f"); // 445709
 
         /**
          * The message start string is designed to be unlikely to occur in normal data.
@@ -166,15 +166,16 @@ class CMainParams : public CChainParams {
                 { 245000, uint256S("ed79607feeadcedf5b94f1c43df684af5106e79b0989a008a88f9dc2221cc12a")},
                 { 353000, uint256S("d487896851fed42b07771f950fcc4469fbfa79211cfefed800f6d7806255e23f")},
                 { 367795, uint256S("1209326b73e38e44ec5dc210f51dc5d8c3494e9c698521032dd754747d4c1685")},
+                { 445709, uint256S("814e7d91aac6c577e4589b76918f44cf80020212159d39709fbad3f219725c9f")},
             }
         };
 
         chainTxData = ChainTxData{
             // Data as of block 3e76a9f460f5df039f828e3c259da03e1b4e1ec883cbf687a228e346cc457360 (height 253817)
-            1556671680, // * UNIX timestamp of last known number of transactions
-            2880533, // * total number of transactions between genesis and that timestamp
+            1568403088, // * UNIX timestamp of last known number of transactions
+            3374744, // * total number of transactions between genesis and that timestamp
             //   (the tx=... number in the SetBestChain debug.log lines)
-            0.03862537503359533 // * estimated number of transactions per second after that timestamp
+            0.0349037843706379 // * estimated number of transactions per second after that timestamp
         };
 
         /* disable fallback fee on mainnet */
@@ -234,10 +235,10 @@ class CTestNetParams : public CChainParams {
         consensus.vDeployments[Consensus::DEPLOYMENT_SEGWIT].nTimeout = 999999999999ULL;
 
         // The best chain should have at least this much work.
-        consensus.nMinimumChainWork = uint256S("0x000000000000000000000000000000000000000000000042d96d1fbba9348aca"); // qtum
+        consensus.nMinimumChainWork = uint256S("0x000000000000000000000000000000000000000000000047cc31541550003573"); // qtum
 
         // By default assume that the signatures in ancestors of this block are valid.
-        consensus.defaultAssumeValid = uint256S("0x91dc4e3901b6f00a14db9d9bd43a1e8700510c24b692294fdf7fc0b53af76899"); // 320000
+        consensus.defaultAssumeValid = uint256S("0x529c120fb5a93cc17bee4c00ed0bc15e8f72252c93fe16ebc85d4fdf8eb179f7"); // 421632
 
         pchMessageStart[0] = 0x0d;
         pchMessageStart[1] = 0x22;
@@ -280,14 +281,15 @@ class CTestNetParams : public CChainParams {
                 {77000, uint256S("f41e2e8d09bca38827c23cad46ed6d434902da08415d2314d0c8ce285b1970cb")},
                 {230000, uint256S("cd17baf80fa817dd543b83897ccb1e07350019e5b812f4956f69efe855d62601")},
                 {343000, uint256S("ac66f1de1a5fa473b5097b313c203e97d45669485e4c235a32a0f80df64f6948")},
+                {441632, uint256S("4c96ba169c369e49590fbd0b262d158b01bdc5307b565a2ef6a9775bc243f5a0")},
             }
         };
 
         chainTxData = ChainTxData{
             // Data as of block 2820e75dd90210a1dcf59efe839a1e5f212e272c6bcb7fd94e749f5e01822813 (height 239905)
-            1556671936,
-            790629,
-            0.01697943121376204
+            1568403056,
+            966895,
+            0.0140114245938137
         };
 
         /* enable fallback fee on testnet */

From 82a0afb8a340c45f42ae3bae733d7fdbf4ae73d8 Mon Sep 17 00:00:00 2001
From: Time Markov <time.markov@qtum.com>
Date: Fri, 13 Sep 2019 23:15:39 +0200
Subject: [PATCH 119/153] Add ethash interface paths

---
 src/Makefile.am | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/src/Makefile.am b/src/Makefile.am
index 248f3e930..8f4817ba7 100644
--- a/src/Makefile.am
+++ b/src/Makefile.am
@@ -663,6 +663,13 @@ libbitcoin_common_a_SOURCES = \
   cpp-ethereum/utils/json_spirit/json_spirit_value.h \
   cpp-ethereum/utils/json_spirit/json_spirit_writer.h \
   cpp-ethereum/utils/json_spirit/json_spirit_writer_template.h \
+  cpp-ethereum/ethash/include/ethash/ethash.h \
+  cpp-ethereum/ethash/include/ethash/ethash.hpp \
+  cpp-ethereum/ethash/include/ethash/hash_types.h \
+  cpp-ethereum/ethash/include/ethash/hash_types.hpp \
+  cpp-ethereum/ethash/include/ethash/keccak.h \
+  cpp-ethereum/ethash/include/ethash/keccak.hpp \
+  cpp-ethereum/ethash/include/ethash/progpow.hpp \
   cpp-ethereum/ethash/lib/ethash/support/attributes.h \ 
   cpp-ethereum/ethash/lib/ethash/bit_manipulation.h \
   cpp-ethereum/ethash/lib/ethash/builtins.h \

From cfab5051380852915ccf1016cda66937cc42ad98 Mon Sep 17 00:00:00 2001
From: Time Markov <time.markov@qtum.com>
Date: Fri, 13 Sep 2019 23:47:42 +0200
Subject: [PATCH 120/153] Add evmc interface paths

---
 src/Makefile.am | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/src/Makefile.am b/src/Makefile.am
index 8f4817ba7..1fb3ecf2f 100644
--- a/src/Makefile.am
+++ b/src/Makefile.am
@@ -663,6 +663,13 @@ libbitcoin_common_a_SOURCES = \
   cpp-ethereum/utils/json_spirit/json_spirit_value.h \
   cpp-ethereum/utils/json_spirit/json_spirit_writer.h \
   cpp-ethereum/utils/json_spirit/json_spirit_writer_template.h \
+  cpp-ethereum/evmc/include/evmc/evmc.h \
+  cpp-ethereum/evmc/include/evmc/evmc.hpp \
+  cpp-ethereum/evmc/include/evmc/helpers.h \
+  cpp-ethereum/evmc/include/evmc/helpers.hpp \
+  cpp-ethereum/evmc/include/evmc/instructions.h \
+  cpp-ethereum/evmc/include/evmc/loader.h \
+  cpp-ethereum/evmc/include/evmc/utils.h \
   cpp-ethereum/ethash/include/ethash/ethash.h \
   cpp-ethereum/ethash/include/ethash/ethash.hpp \
   cpp-ethereum/ethash/include/ethash/hash_types.h \

From 2723cca6ba588bad5d6ab201a8471e25c5c290aa Mon Sep 17 00:00:00 2001
From: Neil <neil@qtum.org>
Date: Fri, 13 Sep 2019 22:36:19 +0000
Subject: [PATCH 121/153] Change testnet hashes

---
 src/chainparams.cpp | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/chainparams.cpp b/src/chainparams.cpp
index 5807c7820..cbccd26ee 100644
--- a/src/chainparams.cpp
+++ b/src/chainparams.cpp
@@ -238,7 +238,7 @@ class CTestNetParams : public CChainParams {
         consensus.nMinimumChainWork = uint256S("0x000000000000000000000000000000000000000000000047cc31541550003573"); // qtum
 
         // By default assume that the signatures in ancestors of this block are valid.
-        consensus.defaultAssumeValid = uint256S("0x529c120fb5a93cc17bee4c00ed0bc15e8f72252c93fe16ebc85d4fdf8eb179f7"); // 421632
+        consensus.defaultAssumeValid = uint256S("0x4a5ab88811edba9f43fe6fe1ca9f529fb363ed2f0725ae9797bb5bdd9220cb7a"); // 421632
 
         pchMessageStart[0] = 0x0d;
         pchMessageStart[1] = 0x22;
@@ -281,7 +281,7 @@ class CTestNetParams : public CChainParams {
                 {77000, uint256S("f41e2e8d09bca38827c23cad46ed6d434902da08415d2314d0c8ce285b1970cb")},
                 {230000, uint256S("cd17baf80fa817dd543b83897ccb1e07350019e5b812f4956f69efe855d62601")},
                 {343000, uint256S("ac66f1de1a5fa473b5097b313c203e97d45669485e4c235a32a0f80df64f6948")},
-                {441632, uint256S("4c96ba169c369e49590fbd0b262d158b01bdc5307b565a2ef6a9775bc243f5a0")},
+                {441632, uint256S("2cb93f74cb3e47ec05b745a445f90a023b7136a68f94e9bff7fb49819155ccd8")},
             }
         };
 

From 3e931ad3f555ee95be5d6cfccc6fb17ab8ce96af Mon Sep 17 00:00:00 2001
From: Time Markov <time.markov@qtum.com>
Date: Sat, 14 Sep 2019 01:05:24 +0200
Subject: [PATCH 122/153] Add secure trie header

---
 src/Makefile.am | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/Makefile.am b/src/Makefile.am
index 1fb3ecf2f..8932ff706 100644
--- a/src/Makefile.am
+++ b/src/Makefile.am
@@ -583,6 +583,7 @@ libbitcoin_common_a_SOURCES = \
   cpp-ethereum/libethereum/ValidationSchemes.cpp \
   cpp-ethereum/libethereum/Account.h \
   cpp-ethereum/libethereum/GasPricer.h \
+  cpp-ethereum/libethereum/SecureTrieDB.h \
   cpp-ethereum/libethereum/State.h \
   cpp-ethereum/libethcore/ABI.h \
   cpp-ethereum/libethcore/ChainOperationParams.h \

From 9425428fdd35877829f41fbf2e30690e5dd070c4 Mon Sep 17 00:00:00 2001
From: Neil <neil@qtum.org>
Date: Sat, 14 Sep 2019 00:52:28 +0000
Subject: [PATCH 123/153] Add dbfwd.h header

---
 src/Makefile.am | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/Makefile.am b/src/Makefile.am
index 8932ff706..930a7b772 100644
--- a/src/Makefile.am
+++ b/src/Makefile.am
@@ -526,6 +526,7 @@ libbitcoin_common_a_SOURCES = \
   cpp-ethereum/libdevcore/DBFactory.cpp \
   cpp-ethereum/libdevcore/JsonUtils.h \
   cpp-ethereum/libdevcore/JsonUtils.cpp \
+  cpp-ethereum/libdevcore/dbfwd.h \
   cpp-ethereum/libevm/EVMC.cpp \
   cpp-ethereum/libevm/EVMC.h \
   cpp-ethereum/libevm/ExtVMFace.cpp \

From 0f6c5b29ac94e37214fc0393788acb2753abac58 Mon Sep 17 00:00:00 2001
From: Neil <neil@qtum.org>
Date: Sat, 14 Sep 2019 01:21:17 +0000
Subject: [PATCH 124/153] Add LastBlockHashesFace.h header

---
 src/Makefile.am | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/Makefile.am b/src/Makefile.am
index 930a7b772..3d667af89 100644
--- a/src/Makefile.am
+++ b/src/Makefile.am
@@ -629,6 +629,7 @@ libbitcoin_common_a_SOURCES = \
   cpp-ethereum/libethereum/GenericMiner.h \
   cpp-ethereum/libevm/VMFace.h \
   cpp-ethereum/libethereum/GenericFarm.h \
+  cpp-ethereum/libethereum/LastBlockHashesFace.h \
   cpp-ethereum/libethereum/Interface.h \
   cpp-ethereum/libethcore/CommonJS.h \
   cpp-ethereum/libdevcrypto/Exceptions.h \

From 34d3e6a7230df93094ea3c76aa9d2a40083c514a Mon Sep 17 00:00:00 2001
From: Neil <neil@qtum.org>
Date: Sat, 14 Sep 2019 01:54:15 +0000
Subject: [PATCH 125/153] Add more headers

---
 src/Makefile.am | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/src/Makefile.am b/src/Makefile.am
index 3d667af89..33060231b 100644
--- a/src/Makefile.am
+++ b/src/Makefile.am
@@ -631,6 +631,7 @@ libbitcoin_common_a_SOURCES = \
   cpp-ethereum/libethereum/GenericFarm.h \
   cpp-ethereum/libethereum/LastBlockHashesFace.h \
   cpp-ethereum/libethereum/Interface.h \
+  cpp-ethereum/libethereum/Client.h \
   cpp-ethereum/libethcore/CommonJS.h \
   cpp-ethereum/libdevcrypto/Exceptions.h \
   cpp-ethereum/libethashseal/genesis/mainNetwork.cpp \
@@ -694,6 +695,7 @@ libbitcoin_common_a_SOURCES = \
   cpp-ethereum/ethash/lib/ethash/primes.c \
   cpp-ethereum/ethash/lib/ethash/primes.h \
   cpp-ethereum/ethash/lib/ethash/progpow.cpp \
+  libff/algebra/curves/public_params.hpp \
   $(BITCOIN_CORE_H)
 
 #only added json_spirit so that `make dist` works properly

From c7dc1c746580dcfbc90b702173ba701dc715174a Mon Sep 17 00:00:00 2001
From: Neil <neil@qtum.org>
Date: Sat, 14 Sep 2019 02:19:12 +0000
Subject: [PATCH 126/153] Add more headers

---
 src/Makefile.am | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/src/Makefile.am b/src/Makefile.am
index 33060231b..173049bab 100644
--- a/src/Makefile.am
+++ b/src/Makefile.am
@@ -681,7 +681,7 @@ libbitcoin_common_a_SOURCES = \
   cpp-ethereum/ethash/include/ethash/keccak.h \
   cpp-ethereum/ethash/include/ethash/keccak.hpp \
   cpp-ethereum/ethash/include/ethash/progpow.hpp \
-  cpp-ethereum/ethash/lib/ethash/support/attributes.h \ 
+  cpp-ethereum/ethash/lib/ethash/support/attributes.h \
   cpp-ethereum/ethash/lib/ethash/bit_manipulation.h \
   cpp-ethereum/ethash/lib/ethash/builtins.h \
   cpp-ethereum/ethash/lib/ethash/endianness.hpp \
@@ -695,7 +695,8 @@ libbitcoin_common_a_SOURCES = \
   cpp-ethereum/ethash/lib/ethash/primes.c \
   cpp-ethereum/ethash/lib/ethash/primes.h \
   cpp-ethereum/ethash/lib/ethash/progpow.cpp \
-  libff/algebra/curves/public_params.hpp \
+  libff/libff/algebra/curves/public_params.hpp \
+  libff/libff/algebra/curves/curve_utils.hpp \
   $(BITCOIN_CORE_H)
 
 #only added json_spirit so that `make dist` works properly

From cf07d9bc0aa701e3e096636ff990753d4e46c74f Mon Sep 17 00:00:00 2001
From: Neil <neil@qtum.org>
Date: Sat, 14 Sep 2019 02:50:12 +0000
Subject: [PATCH 127/153] Add more headers

---
 src/Makefile.am | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/src/Makefile.am b/src/Makefile.am
index 173049bab..5f9a57650 100644
--- a/src/Makefile.am
+++ b/src/Makefile.am
@@ -697,6 +697,14 @@ libbitcoin_common_a_SOURCES = \
   cpp-ethereum/ethash/lib/ethash/progpow.cpp \
   libff/libff/algebra/curves/public_params.hpp \
   libff/libff/algebra/curves/curve_utils.hpp \
+  cpp-ethereum/libethereum/BlockChainImporter.h \
+  cpp-ethereum/libethereum/EthereumCapability.h \
+  cpp-ethereum/libethereum/ImportPerformanceLogger.h \
+  cpp-ethereum/libethereum/SnapshotImporter.h \
+  cpp-ethereum/libethereum/SnapshotStorage.h \
+  cpp-ethereum/libethereum/StateImporter.h \
+  cpp-ethereum/libethereum/ValidationSchemes.h \
+  cpp-ethereum/libethereum/WarpCapability.h \
   $(BITCOIN_CORE_H)
 
 #only added json_spirit so that `make dist` works properly

From 224bb7c4afbf826685ca0a3d666f1e637e01e201 Mon Sep 17 00:00:00 2001
From: Neil <neil@qtum.org>
Date: Sat, 14 Sep 2019 03:15:37 +0000
Subject: [PATCH 128/153] Add more headers

---
 src/Makefile.am | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/src/Makefile.am b/src/Makefile.am
index 5f9a57650..ddf47e56c 100644
--- a/src/Makefile.am
+++ b/src/Makefile.am
@@ -705,6 +705,8 @@ libbitcoin_common_a_SOURCES = \
   cpp-ethereum/libethereum/StateImporter.h \
   cpp-ethereum/libethereum/ValidationSchemes.h \
   cpp-ethereum/libethereum/WarpCapability.h \
+  cpp-ethereum/libethereum/ClientBase.h \
+  cpp-ethereum/libethereum/ClientTest.h \
   $(BITCOIN_CORE_H)
 
 #only added json_spirit so that `make dist` works properly

From 73c22ecccdd642cb309d97614e0f7d177079d64c Mon Sep 17 00:00:00 2001
From: Neil <neil@qtum.org>
Date: Sat, 14 Sep 2019 03:41:47 +0000
Subject: [PATCH 129/153] Add more headers

---
 src/Makefile.am | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/Makefile.am b/src/Makefile.am
index ddf47e56c..9cba1f9c0 100644
--- a/src/Makefile.am
+++ b/src/Makefile.am
@@ -707,6 +707,7 @@ libbitcoin_common_a_SOURCES = \
   cpp-ethereum/libethereum/WarpCapability.h \
   cpp-ethereum/libethereum/ClientBase.h \
   cpp-ethereum/libethereum/ClientTest.h \
+  cpp-ethereum/libethereum/LogFilter.h \
   $(BITCOIN_CORE_H)
 
 #only added json_spirit so that `make dist` works properly

From 8b5cc45d8ada7a8b7503d7d81088f183f6805748 Mon Sep 17 00:00:00 2001
From: Neil <neil@qtum.org>
Date: Sat, 14 Sep 2019 04:14:46 +0000
Subject: [PATCH 130/153] Add more headers

---
 src/Makefile.am | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/Makefile.am b/src/Makefile.am
index 9cba1f9c0..44465e654 100644
--- a/src/Makefile.am
+++ b/src/Makefile.am
@@ -708,6 +708,7 @@ libbitcoin_common_a_SOURCES = \
   cpp-ethereum/libethereum/ClientBase.h \
   cpp-ethereum/libethereum/ClientTest.h \
   cpp-ethereum/libethereum/LogFilter.h \
+  cpp-ethereum/libethereum/CommonNet.h \
   $(BITCOIN_CORE_H)
 
 #only added json_spirit so that `make dist` works properly

From 71d72edbdcf1898a478ccfc5c192c47d66235fc5 Mon Sep 17 00:00:00 2001
From: Neil <neil@qtum.org>
Date: Sat, 14 Sep 2019 06:24:04 +0000
Subject: [PATCH 131/153] Add more headers

---
 src/Makefile.am | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/src/Makefile.am b/src/Makefile.am
index 44465e654..5960bce8d 100644
--- a/src/Makefile.am
+++ b/src/Makefile.am
@@ -709,6 +709,21 @@ libbitcoin_common_a_SOURCES = \
   cpp-ethereum/libethereum/ClientTest.h \
   cpp-ethereum/libethereum/LogFilter.h \
   cpp-ethereum/libethereum/CommonNet.h \
+  cpp-ethereum/libp2p/All.h \
+  cpp-ethereum/libp2p/Capability.h \
+  cpp-ethereum/libp2p/CapabilityHost.h \
+  cpp-ethereum/libp2p/Common.h \
+  cpp-ethereum/libp2p/Host.h \
+  cpp-ethereum/libp2p/Network.h \
+  cpp-ethereum/libp2p/NodeTable.h \
+  cpp-ethereum/libp2p/Peer.h \
+  cpp-ethereum/libp2p/RLPXFrameCoder.h \
+  cpp-ethereum/libp2p/RLPXPacket.h \
+  cpp-ethereum/libp2p/RLPXSocket.h \
+  cpp-ethereum/libp2p/RLPxHandshake.h \
+  cpp-ethereum/libp2p/Session.h \
+  cpp-ethereum/libp2p/UDP.h \
+  cpp-ethereum/libp2p/UPnP.h \
   $(BITCOIN_CORE_H)
 
 #only added json_spirit so that `make dist` works properly

From 97674a58bc316dc9c73462899914f7fcf47af34b Mon Sep 17 00:00:00 2001
From: Neil <neil@qtum.org>
Date: Sat, 14 Sep 2019 17:36:22 +0000
Subject: [PATCH 132/153] Add missing source file

---
 src/Makefile.am | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/Makefile.am b/src/Makefile.am
index 5960bce8d..b6a03be66 100644
--- a/src/Makefile.am
+++ b/src/Makefile.am
@@ -724,6 +724,7 @@ libbitcoin_common_a_SOURCES = \
   cpp-ethereum/libp2p/Session.h \
   cpp-ethereum/libp2p/UDP.h \
   cpp-ethereum/libp2p/UPnP.h \
+  cpp-ethereum/libethashseal/genesis/test/constantinopleFixTest.cpp \
   $(BITCOIN_CORE_H)
 
 #only added json_spirit so that `make dist` works properly

From 47a218e1a462e2a3c9cfe254601f2a966818b3c7 Mon Sep 17 00:00:00 2001
From: Neil <neil@qtum.org>
Date: Sat, 14 Sep 2019 18:39:28 +0000
Subject: [PATCH 133/153] configure: Fix thread_local detection

---
 configure.ac | 70 ++++++++++++++++++++++++++++++++++++----------------
 1 file changed, 49 insertions(+), 21 deletions(-)

diff --git a/configure.ac b/configure.ac
index 1f779822c..911deb745 100644
--- a/configure.ac
+++ b/configure.ac
@@ -203,6 +203,12 @@ AC_ARG_ENABLE([glibc-back-compat],
   [use_glibc_compat=$enableval],
   [use_glibc_compat=no])
 
+AC_ARG_ENABLE([threadlocal],
+  [AS_HELP_STRING([--enable-threadlocal],
+  [enable features that depend on the c++ thread_local keyword (currently just thread names in debug logs). (default is to enabled if there is platform support and glibc-back-compat is not enabled)])],
+  [use_thread_local=$enableval],
+  [use_thread_local=auto])
+
 AC_ARG_ENABLE([asm],
   [AS_HELP_STRING([--enable-asm],
   [Enable assembly routines (default is yes)])],
@@ -833,27 +839,49 @@ AC_LINK_IFELSE([AC_LANG_SOURCE([
   ]
 )
 
-TEMP_LDFLAGS="$LDFLAGS"
-LDFLAGS="$TEMP_LDFLAGS $PTHREAD_CFLAGS"
-AC_MSG_CHECKING([for thread_local support])
-AC_LINK_IFELSE([AC_LANG_SOURCE([
-  #include <thread>
-  static thread_local int foo = 0;
-  static void run_thread() { foo++;}
-  int main(){
-  for(int i = 0; i < 10; i++) { std::thread(run_thread).detach();}
-  return foo;
-  }
-  ])],
-  [
-    AC_DEFINE(HAVE_THREAD_LOCAL,1,[Define if thread_local is supported.])
-    AC_MSG_RESULT(yes)
-  ],
-  [
-    AC_MSG_RESULT(no)
-  ]
-)
-LDFLAGS="$TEMP_LDFLAGS"
+if test "x$use_thread_local" = xyes || { test "x$use_thread_local" = xauto && test "x$use_glibc_compat" = xno; }; then
+  TEMP_LDFLAGS="$LDFLAGS"
+  LDFLAGS="$TEMP_LDFLAGS $PTHREAD_CFLAGS"
+  AC_MSG_CHECKING([for thread_local support])
+  AC_LINK_IFELSE([AC_LANG_SOURCE([
+    #include <thread>
+    static thread_local int foo = 0;
+    static void run_thread() { foo++;}
+    int main(){
+    for(int i = 0; i < 10; i++) { std::thread(run_thread).detach();}
+    return foo;
+    }
+    ])],
+    [
+     case $host in
+       *mingw*)
+          # mingw32's implementation of thread_local has also been shown to behave
+          # erroneously under concurrent usage; see:
+          # https://gist.github.com/jamesob/fe9a872051a88b2025b1aa37bfa98605
+          AC_MSG_RESULT(no)
+          ;;
+        *darwin*)
+          # TODO enable thread_local on later versions of Darwin where it is
+          # supported (per https://stackoverflow.com/a/29929949)
+          AC_MSG_RESULT(no)
+          ;;
+        *freebsd*)
+          # FreeBSD's implementation of thread_local is also buggy (per
+          # https://groups.google.com/d/msg/bsdmailinglist/22ncTZAbDp4/Dii_pII5AwAJ)
+          AC_MSG_RESULT(no)
+          ;;
+        *)
+          AC_DEFINE(HAVE_THREAD_LOCAL,1,[Define if thread_local is supported.])
+          AC_MSG_RESULT(yes)
+          ;;
+      esac
+    ],
+    [
+      AC_MSG_RESULT(no)
+    ]
+  )
+  LDFLAGS="$TEMP_LDFLAGS"
+fi
 
 # Check for different ways of gathering OS randomness
 AC_MSG_CHECKING(for Linux getrandom syscall)

From 209d405e593c522b2117be8eb95cb676a4ae38f5 Mon Sep 17 00:00:00 2001
From: Neil <neil@qtum.org>
Date: Sat, 14 Sep 2019 23:09:13 +0000
Subject: [PATCH 134/153] Disable thread_local for i686 host

---
 configure.ac | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/configure.ac b/configure.ac
index 911deb745..aaa42d754 100644
--- a/configure.ac
+++ b/configure.ac
@@ -870,6 +870,9 @@ if test "x$use_thread_local" = xyes || { test "x$use_thread_local" = xauto && te
           # https://groups.google.com/d/msg/bsdmailinglist/22ncTZAbDp4/Dii_pII5AwAJ)
           AC_MSG_RESULT(no)
           ;;
+        i686-*-linux-*)
+          AC_MSG_RESULT(no)
+          ;;	
         *)
           AC_DEFINE(HAVE_THREAD_LOCAL,1,[Define if thread_local is supported.])
           AC_MSG_RESULT(yes)

From 7fd0d014d7fe5f335553db436c09152f52a78ffb Mon Sep 17 00:00:00 2001
From: Neil <neil@qtum.org>
Date: Sun, 15 Sep 2019 00:28:04 +0000
Subject: [PATCH 135/153] Set submodule test branch

---
 contrib/gitian-build.py | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/contrib/gitian-build.py b/contrib/gitian-build.py
index 68fdcd1d1..7d158c0f6 100755
--- a/contrib/gitian-build.py
+++ b/contrib/gitian-build.py
@@ -59,20 +59,20 @@ def build():
 
     if args.linux:
         print('\nCompiling ' + args.version + ' Linux')
-        subprocess.check_call(['bin/gbuild', '-j', args.jobs, '-m', args.memory, '--commit', 'qtum='+args.commit+',cpp-eth-qtum=develop', '--url', 'qtum='+args.url, '../qtum/contrib/gitian-descriptors/gitian-linux.yml'])
+        subprocess.check_call(['bin/gbuild', '-j', args.jobs, '-m', args.memory, '--commit', 'qtum='+args.commit+',cpp-eth-qtum=hfcorebuildtest', '--url', 'qtum='+args.url, '../qtum/contrib/gitian-descriptors/gitian-linux.yml'])
         subprocess.check_call(['bin/gsign', '-p', args.sign_prog, '--signer', args.signer, '--release', args.version+'-linux', '--destination', '../gitian.sigs/', '../qtum/contrib/gitian-descriptors/gitian-linux.yml'])
         subprocess.check_call('mv build/out/qtum-*.tar.gz build/out/src/qtum-*.tar.gz ../qtum-binaries/'+args.version, shell=True)
 
     if args.windows:
         print('\nCompiling ' + args.version + ' Windows')
-        subprocess.check_call(['bin/gbuild', '-j', args.jobs, '-m', args.memory, '--commit', 'qtum='+args.commit+',cpp-eth-qtum=develop', '--url', 'qtum='+args.url, '../qtum/contrib/gitian-descriptors/gitian-win.yml'])
+        subprocess.check_call(['bin/gbuild', '-j', args.jobs, '-m', args.memory, '--commit', 'qtum='+args.commit+',cpp-eth-qtum=hfcorebuildtest', '--url', 'qtum='+args.url, '../qtum/contrib/gitian-descriptors/gitian-win.yml'])
         subprocess.check_call(['bin/gsign', '-p', args.sign_prog, '--signer', args.signer, '--release', args.version+'-win-unsigned', '--destination', '../gitian.sigs/', '../qtum/contrib/gitian-descriptors/gitian-win.yml'])
         subprocess.check_call('mv build/out/qtum-*-win-unsigned.tar.gz inputs/', shell=True)
         subprocess.check_call('mv build/out/qtum-*.zip build/out/qtum-*.exe ../qtum-binaries/'+args.version, shell=True)
 
     if args.macos:
         print('\nCompiling ' + args.version + ' MacOS')
-        subprocess.check_call(['bin/gbuild', '-j', args.jobs, '-m', args.memory, '--commit', 'qtum='+args.commit+',cpp-eth-qtum=develop', '--url', 'qtum='+args.url, '../qtum/contrib/gitian-descriptors/gitian-osx.yml'])
+        subprocess.check_call(['bin/gbuild', '-j', args.jobs, '-m', args.memory, '--commit', 'qtum='+args.commit+',cpp-eth-qtum=hfcorebuildtest', '--url', 'qtum='+args.url, '../qtum/contrib/gitian-descriptors/gitian-osx.yml'])
         subprocess.check_call(['bin/gsign', '-p', args.sign_prog, '--signer', args.signer, '--release', args.version+'-osx-unsigned', '--destination', '../gitian.sigs/', '../qtum/contrib/gitian-descriptors/gitian-osx.yml'])
         subprocess.check_call('mv build/out/qtum-*-osx-unsigned.tar.gz inputs/', shell=True)
         subprocess.check_call('mv build/out/qtum-*.tar.gz build/out/qtum-*.dmg ../qtum-binaries/'+args.version, shell=True)

From 819fe54a7abb62961eb4cbe29c5d3f4cd45fcd7b Mon Sep 17 00:00:00 2001
From: Neil <neil@qtum.org>
Date: Sun, 15 Sep 2019 01:04:33 +0000
Subject: [PATCH 136/153] Revert "Disable thread_local for i686 host"

This reverts commit 209d405e593c522b2117be8eb95cb676a4ae38f5.
---
 configure.ac | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/configure.ac b/configure.ac
index aaa42d754..911deb745 100644
--- a/configure.ac
+++ b/configure.ac
@@ -870,9 +870,6 @@ if test "x$use_thread_local" = xyes || { test "x$use_thread_local" = xauto && te
           # https://groups.google.com/d/msg/bsdmailinglist/22ncTZAbDp4/Dii_pII5AwAJ)
           AC_MSG_RESULT(no)
           ;;
-        i686-*-linux-*)
-          AC_MSG_RESULT(no)
-          ;;	
         *)
           AC_DEFINE(HAVE_THREAD_LOCAL,1,[Define if thread_local is supported.])
           AC_MSG_RESULT(yes)

From ed76f98c75723e84bb6711d9f27dd1a1bb2760ad Mon Sep 17 00:00:00 2001
From: Neil <neil@qtum.org>
Date: Sun, 15 Sep 2019 01:06:58 +0000
Subject: [PATCH 137/153] Temporarily disable symbol checks

---
 contrib/gitian-descriptors/gitian-linux.yml | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/contrib/gitian-descriptors/gitian-linux.yml b/contrib/gitian-descriptors/gitian-linux.yml
index ee0be9602..04cdf71eb 100644
--- a/contrib/gitian-descriptors/gitian-linux.yml
+++ b/contrib/gitian-descriptors/gitian-linux.yml
@@ -186,7 +186,10 @@ script: |
     CONFIG_SITE=${BASEPREFIX}/${i}/share/config.site ./configure --prefix=/ --disable-ccache --disable-maintainer-mode --disable-dependency-tracking ${CONFIGFLAGS} CFLAGS="${HOST_CFLAGS}" CXXFLAGS="${HOST_CXXFLAGS}" LDFLAGS="${HOST_LDFLAGS}"
     make V=1 ${MAKEOPTS}
     make V=1 ${MAKEOPTS} -C src check-security
-    make V=1 ${MAKEOPTS} -C src check-symbols
+    # TODO Fix symbols check
+    # test/test_qtum: symbol __cxa_thread_atexit_impl from unsupported version GLIBC_2.18
+    # qt/qtum-qt: symbol __cxa_thread_atexit_impl from unsupported version GLIBC_2.18
+    # make V=1 ${MAKEOPTS} -C src check-symbols
     make install DESTDIR=${INSTALLPATH}
     cd installed
     find . -name "lib*.la" -delete

From 96fc5285e1d2da8ca933c0e00ec0afe3b3c09c23 Mon Sep 17 00:00:00 2001
From: Neil <neil@qtum.org>
Date: Sun, 15 Sep 2019 01:37:59 +0000
Subject: [PATCH 138/153] Revert "Temporarily disable symbol checks"

This reverts commit ed76f98c75723e84bb6711d9f27dd1a1bb2760ad.
---
 contrib/gitian-descriptors/gitian-linux.yml | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/contrib/gitian-descriptors/gitian-linux.yml b/contrib/gitian-descriptors/gitian-linux.yml
index 04cdf71eb..ee0be9602 100644
--- a/contrib/gitian-descriptors/gitian-linux.yml
+++ b/contrib/gitian-descriptors/gitian-linux.yml
@@ -186,10 +186,7 @@ script: |
     CONFIG_SITE=${BASEPREFIX}/${i}/share/config.site ./configure --prefix=/ --disable-ccache --disable-maintainer-mode --disable-dependency-tracking ${CONFIGFLAGS} CFLAGS="${HOST_CFLAGS}" CXXFLAGS="${HOST_CXXFLAGS}" LDFLAGS="${HOST_LDFLAGS}"
     make V=1 ${MAKEOPTS}
     make V=1 ${MAKEOPTS} -C src check-security
-    # TODO Fix symbols check
-    # test/test_qtum: symbol __cxa_thread_atexit_impl from unsupported version GLIBC_2.18
-    # qt/qtum-qt: symbol __cxa_thread_atexit_impl from unsupported version GLIBC_2.18
-    # make V=1 ${MAKEOPTS} -C src check-symbols
+    make V=1 ${MAKEOPTS} -C src check-symbols
     make install DESTDIR=${INSTALLPATH}
     cd installed
     find . -name "lib*.la" -delete

From 4ec71853761bcfad1c83de3a3d4df259d3dfd1d5 Mon Sep 17 00:00:00 2001
From: Neil <neil@qtum.org>
Date: Sun, 15 Sep 2019 01:43:26 +0000
Subject: [PATCH 139/153] Update max supported dependency versions in
 symbol-check.py

---
 contrib/devtools/symbol-check.py | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/contrib/devtools/symbol-check.py b/contrib/devtools/symbol-check.py
index 723d7a511..72fe9cfd9 100755
--- a/contrib/devtools/symbol-check.py
+++ b/contrib/devtools/symbol-check.py
@@ -36,10 +36,10 @@
 #   (glibc)    GLIBC_2_11
 #
 MAX_VERSIONS = {
-'GCC':       (4,4,0),
-'CXXABI':    (1,3,3),
-'GLIBCXX':   (3,4,13),
-'GLIBC':     (2,11),
+'GCC':       (4,8,0),
+'CXXABI':    (1,3,7),
+'GLIBCXX':   (3,4,18),
+'GLIBC':     (2,19),
 'LIBATOMIC': (1,0)
 }
 # See here for a description of _IO_stdin_used:

From 8a877d7c8a83cab582c8961649ce9ffbea8668e8 Mon Sep 17 00:00:00 2001
From: Neil <neil@qtum.org>
Date: Sun, 15 Sep 2019 06:28:31 +0000
Subject: [PATCH 140/153] Revert "configure: Fix thread_local detection"

This reverts commit 47a218e1a462e2a3c9cfe254601f2a966818b3c7.
---
 configure.ac | 70 ++++++++++++++++------------------------------------
 1 file changed, 21 insertions(+), 49 deletions(-)

diff --git a/configure.ac b/configure.ac
index 911deb745..1f779822c 100644
--- a/configure.ac
+++ b/configure.ac
@@ -203,12 +203,6 @@ AC_ARG_ENABLE([glibc-back-compat],
   [use_glibc_compat=$enableval],
   [use_glibc_compat=no])
 
-AC_ARG_ENABLE([threadlocal],
-  [AS_HELP_STRING([--enable-threadlocal],
-  [enable features that depend on the c++ thread_local keyword (currently just thread names in debug logs). (default is to enabled if there is platform support and glibc-back-compat is not enabled)])],
-  [use_thread_local=$enableval],
-  [use_thread_local=auto])
-
 AC_ARG_ENABLE([asm],
   [AS_HELP_STRING([--enable-asm],
   [Enable assembly routines (default is yes)])],
@@ -839,49 +833,27 @@ AC_LINK_IFELSE([AC_LANG_SOURCE([
   ]
 )
 
-if test "x$use_thread_local" = xyes || { test "x$use_thread_local" = xauto && test "x$use_glibc_compat" = xno; }; then
-  TEMP_LDFLAGS="$LDFLAGS"
-  LDFLAGS="$TEMP_LDFLAGS $PTHREAD_CFLAGS"
-  AC_MSG_CHECKING([for thread_local support])
-  AC_LINK_IFELSE([AC_LANG_SOURCE([
-    #include <thread>
-    static thread_local int foo = 0;
-    static void run_thread() { foo++;}
-    int main(){
-    for(int i = 0; i < 10; i++) { std::thread(run_thread).detach();}
-    return foo;
-    }
-    ])],
-    [
-     case $host in
-       *mingw*)
-          # mingw32's implementation of thread_local has also been shown to behave
-          # erroneously under concurrent usage; see:
-          # https://gist.github.com/jamesob/fe9a872051a88b2025b1aa37bfa98605
-          AC_MSG_RESULT(no)
-          ;;
-        *darwin*)
-          # TODO enable thread_local on later versions of Darwin where it is
-          # supported (per https://stackoverflow.com/a/29929949)
-          AC_MSG_RESULT(no)
-          ;;
-        *freebsd*)
-          # FreeBSD's implementation of thread_local is also buggy (per
-          # https://groups.google.com/d/msg/bsdmailinglist/22ncTZAbDp4/Dii_pII5AwAJ)
-          AC_MSG_RESULT(no)
-          ;;
-        *)
-          AC_DEFINE(HAVE_THREAD_LOCAL,1,[Define if thread_local is supported.])
-          AC_MSG_RESULT(yes)
-          ;;
-      esac
-    ],
-    [
-      AC_MSG_RESULT(no)
-    ]
-  )
-  LDFLAGS="$TEMP_LDFLAGS"
-fi
+TEMP_LDFLAGS="$LDFLAGS"
+LDFLAGS="$TEMP_LDFLAGS $PTHREAD_CFLAGS"
+AC_MSG_CHECKING([for thread_local support])
+AC_LINK_IFELSE([AC_LANG_SOURCE([
+  #include <thread>
+  static thread_local int foo = 0;
+  static void run_thread() { foo++;}
+  int main(){
+  for(int i = 0; i < 10; i++) { std::thread(run_thread).detach();}
+  return foo;
+  }
+  ])],
+  [
+    AC_DEFINE(HAVE_THREAD_LOCAL,1,[Define if thread_local is supported.])
+    AC_MSG_RESULT(yes)
+  ],
+  [
+    AC_MSG_RESULT(no)
+  ]
+)
+LDFLAGS="$TEMP_LDFLAGS"
 
 # Check for different ways of gathering OS randomness
 AC_MSG_CHECKING(for Linux getrandom syscall)

From a5cf236df53da213639e2ede5900d1680349029c Mon Sep 17 00:00:00 2001
From: Yunqi Ouyang <oyyq9999999@163.com>
Date: Mon, 16 Sep 2019 20:17:31 +0800
Subject: [PATCH 141/153] update restore dialog text for a few languages

---
 src/bitcoin-cli.cpp            |  2 +-
 src/qt/locale/bitcoin_en.ts    | 23 +++++++++++++++++++++++
 src/qt/locale/bitcoin_es.ts    | 26 ++++++++++++++++++++++++++
 src/qt/locale/bitcoin_ko.ts    | 29 ++++++++++++++++++++++++++++-
 src/qt/locale/bitcoin_ko_KR.ts | 27 +++++++++++++++++++++++++++
 src/qt/locale/bitcoin_ru.ts    | 27 +++++++++++++++++++++++++++
 src/qt/locale/bitcoin_zh.ts    | 26 ++++++++++++++++++++++++++
 7 files changed, 158 insertions(+), 2 deletions(-)

diff --git a/src/bitcoin-cli.cpp b/src/bitcoin-cli.cpp
index 6b205e7a3..ecebda4a6 100644
--- a/src/bitcoin-cli.cpp
+++ b/src/bitcoin-cli.cpp
@@ -381,7 +381,7 @@ static UniValue CallRPC(BaseRequestHandler *rh, const std::string& strMethod, co
         if (response.error != -1) {
             responseErrorMessage = strprintf(" (error code %d - \"%s\")", response.error, http_errorstring(response.error));
         }
-        throw CConnectionFailed(strprintf("Could not connect to the server %s:%d%s\n\nMake sure the bitcoind server is running and that you are connecting to the correct RPC port.", host, port, responseErrorMessage));
+        throw CConnectionFailed(strprintf("Could not connect to the server %s:%d%s\n\nMake sure the qtumd server is running and that you are connecting to the correct RPC port.", host, port, responseErrorMessage));
     } else if (response.status == HTTP_UNAUTHORIZED) {
         if (failedToGetAuthCookie) {
             throw std::runtime_error(strprintf(
diff --git a/src/qt/locale/bitcoin_en.ts b/src/qt/locale/bitcoin_en.ts
index a50601cc1..f2f4fa12a 100755
--- a/src/qt/locale/bitcoin_en.ts
+++ b/src/qt/locale/bitcoin_en.ts
@@ -4785,4 +4785,27 @@ Note:  Since the fee is calculated on a per-byte basis, a fee of &quot;100 satos
         <translation>Error</translation>
     </message>
 </context>
+<context>
+    <name>RestoreDialog</name>
+    <message>
+        <source>Rebuild blockchain index</source>
+        <translation>rescan – rescan the blockchain for missing transactions.
+          Fixes missing transactions, low balance.</translation>
+    </message>
+    <message>
+        <source>Recover transactions without metadata</source>
+        <translation>zapwallettxes=2 - recover transactions without metadata.
+          Fixes problems with missing transactions, low balance, orphan blocks, and split chains.
+          Backup your wallet again after running this command.</translation>
+    </message>
+    <message>
+        <source>Delete the local copy of the block chain</source>
+        <translation>delete blockchain data - delete the local copy of the blockchain, resync the entire blockchain.
+          Fixes problems syncing the blockchain, corrupted blockchains, and split chains.</translation>
+    </message>
+    <message>
+        <source>The wallet.dat will be restored from the selected location and the Qt Wallet will be restarted with the -reindex, -zapwallettxes=2 or -deleteblockchaindata option.</source>
+        <translation>Backup your wallet first, requires client restart after selecting option.</translation>
+    </message>
+</context>
 </TS>
diff --git a/src/qt/locale/bitcoin_es.ts b/src/qt/locale/bitcoin_es.ts
index 7cb7927f4..8b61bfaba 100755
--- a/src/qt/locale/bitcoin_es.ts
+++ b/src/qt/locale/bitcoin_es.ts
@@ -3662,4 +3662,30 @@ Nota: Dado que la comisión se calcula por byte, una comisión de "100 satoshis
         <translation>Error</translation>
     </message>
 </context>
+<context>
+    <name>RestoreDialog</name>
+    <message>
+        <source>Select wallet file to restore from</source>
+        <translation>Seleccione el archivo de billetera para restaurar</translation>
+    </message>
+    <message>
+        <source>Rebuild blockchain index</source>
+        <translation>rescan - reindexa la blockchain en busqueda de transacciones que no se esten mostrando
+ -  Corrige transacciones faltantes y balance incorrecto</translation>
+    </message>
+    <message>
+        <source>Recover transactions without metadata</source>
+        <translation>zapwallettxes=2 - recupera transacciones sin metadatos.
+ - Corrige problemas con transacciones faltantes, bajo balance, bloques huerfanos y cadenas separadas. Realiza una copia de seguridad luego de ejecutar este comando.</translation>
+    </message>
+    <message>
+        <source>Delete the local copy of the block chain</source>
+        <translation>Borrar datos de blockchain - borra la copia local de blockchain y activa una re-sincronizacion de la blockchain en su totalidad
+ - Corrige problemas sincronizando al igual que datos corruptos al igual que separaciones de cadena</translation>
+    </message>
+    <message>
+        <source>The wallet.dat will be restored from the selected location and the Qt Wallet will be restarted with the -reindex, -zapwallettxes=2 or -deleteblockchaindata option.</source>
+        <translation>Realiza una copia de tu billetera primero, esto necesita reiniciar la aplicacion luego de seleccionar la opcion.</translation>
+    </message>
+</context>
 </TS>
diff --git a/src/qt/locale/bitcoin_ko.ts b/src/qt/locale/bitcoin_ko.ts
index 7c31e1534..14661ae4a 100644
--- a/src/qt/locale/bitcoin_ko.ts
+++ b/src/qt/locale/bitcoin_ko.ts
@@ -455,4 +455,31 @@
         <translation>송금액은 마이너스가 될 수 없습니다</translation>
     </message>
     </context>
-</TS>
\ No newline at end of file
+<context>
+    <name>RestoreDialog</name>
+    <message>
+        <source>Select wallet file to restore from</source>
+        <translation>복원 할 지갑 파일을 선택하십시오</translation>
+    </message>
+    <message>
+        <source>Rebuild blockchain index</source>
+        <translation>재 검색 – 누락된 트랜잭션에 대해 블록체인 다시 검색
+누락된 트랜잭션과 낮은 잔액 수정</translation>
+    </message>
+    <message>
+        <source>Recover transactions without metadata</source>
+        <translation>zapwallettxes=2 – 메타데이터 없이 트랜잭션 복구
+누락된 트랜잭션, 낮은 잔액, 고아 블록 및 분할 체인 문제 해결
+이 명령을 실행한 뒤에 지갑을 다시 백업하십시오.</translation>
+    </message>
+    <message>
+        <source>Delete the local copy of the block chain</source>
+        <translation>블록체인 데이터 삭제 – 블록체인 로컬 사본을 삭제하고 전체 블록체인 재 동기화
+손상된 블록체인 및 분할 체인 동기화 문제 해결</translation>
+    </message>
+    <message>
+        <source>The wallet.dat will be restored from the selected location and the Qt Wallet will be restarted with the -reindex, -zapwallettxes=2 or -deleteblockchaindata option.</source>
+        <translation>먼저 지갑을 백업하고, 옵션을 선택한 뒤 클라이언트를 재 시작하십시오.</translation>
+    </message>
+</context>
+</TS>
diff --git a/src/qt/locale/bitcoin_ko_KR.ts b/src/qt/locale/bitcoin_ko_KR.ts
index caf4f144b..890d23339 100755
--- a/src/qt/locale/bitcoin_ko_KR.ts
+++ b/src/qt/locale/bitcoin_ko_KR.ts
@@ -3725,4 +3725,31 @@ Note:  Since the fee is calculated on a per-byte basis, a fee of "100 satoshis p
         <translation>오류</translation>
     </message>
 </context>
+<context>
+    <name>RestoreDialog</name>
+    <message>
+        <source>Select wallet file to restore from</source>
+        <translation>복원 할 지갑 파일을 선택하십시오</translation>
+    </message>
+    <message>
+        <source>Rebuild blockchain index</source>
+        <translation>재 검색 – 누락된 트랜잭션에 대해 블록체인 다시 검색
+누락된 트랜잭션과 낮은 잔액 수정</translation>
+    </message>
+    <message>
+        <source>Recover transactions without metadata</source>
+        <translation>zapwallettxes=2 – 메타데이터 없이 트랜잭션 복구
+누락된 트랜잭션, 낮은 잔액, 고아 블록 및 분할 체인 문제 해결
+이 명령을 실행한 뒤에 지갑을 다시 백업하십시오.</translation>
+    </message>
+    <message>
+        <source>Delete the local copy of the block chain</source>
+        <translation>블록체인 데이터 삭제 – 블록체인 로컬 사본을 삭제하고 전체 블록체인 재 동기화
+손상된 블록체인 및 분할 체인 동기화 문제 해결</translation>
+    </message>
+    <message>
+        <source>The wallet.dat will be restored from the selected location and the Qt Wallet will be restarted with the -reindex, -zapwallettxes=2 or -deleteblockchaindata option.</source>
+        <translation>먼저 지갑을 백업하고, 옵션을 선택한 뒤 클라이언트를 재 시작하십시오.</translation>
+    </message>
+</context>
 </TS>
diff --git a/src/qt/locale/bitcoin_ru.ts b/src/qt/locale/bitcoin_ru.ts
index 4d7de8b90..d81991435 100755
--- a/src/qt/locale/bitcoin_ru.ts
+++ b/src/qt/locale/bitcoin_ru.ts
@@ -519,4 +519,31 @@
         <translation>Ошибка</translation>
     </message>
 </context>
+<context>
+    <name>RestoreDialog</name>
+    <message>
+        <source>Select wallet file to restore from</source>
+        <translation>Выберите файл кошелька для восстановления</translation>
+    </message>
+    <message>
+        <source>Rebuild blockchain index</source>
+        <translation>rescan – проверка блокчейна на наличие потерянных транзакций.
+         Исправляет ошибку утерянных транзакций, слишком низкий баланс.</translation>
+    </message>
+    <message>
+        <source>Recover transactions without metadata</source>
+        <translation>zapwallettxes=2 - восстановление транзакций без метаданных.
+         Решает проблемы потерянных транзакций, потерянных блоков, низкого баланса и форков.
+         Снова создайте резервную копию кошелька после ввода этой команды.</translation>
+    </message>
+    <message>
+        <source>Delete the local copy of the block chain</source>
+        <translation>delete blockchain data - удалить локальную копию блокчейна, перезагрузка всего блокчейна.
+         Исправляет проблемы синхронизации с блокчейном, повреждённых блокчейнов и форков.</translation>
+    </message>
+    <message>
+        <source>The wallet.dat will be restored from the selected location and the Qt Wallet will be restarted with the -reindex, -zapwallettxes=2 or -deleteblockchaindata option.</source>
+        <translation>Сначала создайте резервную копию кошелька, так как понадобится перезапустить  кошелек.</translation>
+    </message>
+</context>
 </TS>
diff --git a/src/qt/locale/bitcoin_zh.ts b/src/qt/locale/bitcoin_zh.ts
index 4f23db001..8d6c93813 100755
--- a/src/qt/locale/bitcoin_zh.ts
+++ b/src/qt/locale/bitcoin_zh.ts
@@ -906,4 +906,30 @@ Note:  Since the fee is calculated on a per-byte basis, a fee of "100 satoshis p
         <translation>错误</translation>
     </message>
 </context>
+<context>
+    <name>RestoreDialog</name>
+    <message>
+        <source>Select wallet file to restore from</source>
+        <translation>选择要还原的钱包文件</translation>
+    </message>
+    <message>
+        <source>Rebuild blockchain index</source>
+        <translation>重新扫描 – 重新扫描区块链，以查找遗漏的交易。
+         修复遗漏交易、低余额问题。</translation>
+    </message>
+    <message>
+        <source>Recover transactions without metadata</source>
+        <translation>zapwallettxes=2 - 恢复没有元数据的交易。
+         修复同时出现遗漏交易、低余额、孤儿块以及分叉链的问题。执行此命令后再次备份钱包</translation>
+    </message>
+    <message>
+        <source>Delete the local copy of the block chain</source>
+        <translation>删除区块链数据 - 删除区块链本地副本，重新同步整个区块链的数据。
+         修复区块链同步、区块链受损、分叉链问题。</translation>
+    </message>
+    <message>
+        <source>The wallet.dat will be restored from the selected location and the Qt Wallet will be restarted with the -reindex, -zapwallettxes=2 or -deleteblockchaindata option.</source>
+        <translation>先备份钱包，选择选项后需要客户端重新启动。</translation>
+    </message>
+</context>
 </TS>

From 67c3c53c68664057d5b0dbb2be0a5af0fca9edec Mon Sep 17 00:00:00 2001
From: djaen <david.jaenson@qtum.org>
Date: Mon, 16 Sep 2019 16:24:40 +0200
Subject: [PATCH 142/153] Increase the testnet min diff to equal mainnet

---
 src/chainparams.cpp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/chainparams.cpp b/src/chainparams.cpp
index cbccd26ee..2e5474ed9 100644
--- a/src/chainparams.cpp
+++ b/src/chainparams.cpp
@@ -211,7 +211,7 @@ class CTestNetParams : public CChainParams {
         consensus.QIP9Height = 446320;
         consensus.powLimit = uint256S("0000ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff");
         consensus.posLimit = uint256S("0000ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff");
-        consensus.QIP9PosLimit = uint256S("00000000001fffffffffffffffffffffffffffffffffffffffffffffffffffff"); // The new POS-limit activated after QIP9
+        consensus.QIP9PosLimit = uint256S("0000000000001fffffffffffffffffffffffffffffffffffffffffffffffffff"); // The new POS-limit activated after QIP9
         consensus.nPowTargetTimespan = 16 * 60; // 16 minutes
         consensus.nPowTargetTimespanV2 = 4000;
         consensus.nPowTargetSpacing = 2 * 64;

From 68068bacdd34efe40359532ebd34753e06cbc8f4 Mon Sep 17 00:00:00 2001
From: Xuan Yan <xuanyan@xuanyan.ws>
Date: Mon, 16 Sep 2019 23:00:00 +0800
Subject: [PATCH 143/153] fix typo in linearize

---
 contrib/linearize/example-linearize.cfg | 2 +-
 contrib/linearize/linearize-data.py     | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/contrib/linearize/example-linearize.cfg b/contrib/linearize/example-linearize.cfg
index 831ab5d80..7388d71d6 100644
--- a/contrib/linearize/example-linearize.cfg
+++ b/contrib/linearize/example-linearize.cfg
@@ -20,7 +20,7 @@ max_height=313000
 
 # mainnet
 netmagic=f1cfa6d3
-genesis=0x000075aef83cf2853580f8ae8ce6f8c3096cfa21d98334d6e3f95e5582ed986c
+genesis=000075aef83cf2853580f8ae8ce6f8c3096cfa21d98334d6e3f95e5582ed986c
 input=/home/example/.qtum/blocks
 
 # testnet
diff --git a/contrib/linearize/linearize-data.py b/contrib/linearize/linearize-data.py
index 651d08dec..408643a16 100755
--- a/contrib/linearize/linearize-data.py
+++ b/contrib/linearize/linearize-data.py
@@ -303,7 +303,7 @@ def run(self):
     if 'netmagic' not in settings:
         settings['netmagic'] = 'f1cfa6d3'
     if 'genesis' not in settings:
-        settings['genesis'] = '0x000075aef83cf2853580f8ae8ce6f8c3096cfa21d98334d6e3f95e5582ed986c'
+        settings['genesis'] = '000075aef83cf2853580f8ae8ce6f8c3096cfa21d98334d6e3f95e5582ed986c'
     if 'input' not in settings:
         settings['input'] = 'input'
     if 'hashlist' not in settings:

From 44c5810cbaaebab577607386de7e9e69897092d1 Mon Sep 17 00:00:00 2001
From: Neil <neil@qtum.org>
Date: Tue, 17 Sep 2019 18:42:54 +0000
Subject: [PATCH 144/153] bump clang

---
 contrib/gitian-build.py            | 24 ++++++++++++------------
 depends/packages/native_cctools.mk |  8 ++++----
 2 files changed, 16 insertions(+), 16 deletions(-)

diff --git a/contrib/gitian-build.py b/contrib/gitian-build.py
index 7d158c0f6..77d2e4586 100755
--- a/contrib/gitian-build.py
+++ b/contrib/gitian-build.py
@@ -57,18 +57,18 @@ def build():
     subprocess.check_call(["echo 'f9a8cdb38b9c309326764ebc937cba1523a3a751a7ab05df3ecc99d18ae466c9 inputs/osslsigncode-1.7.1.tar.gz' | sha256sum -c"], shell=True)
     subprocess.check_call(['make', '-C', '../qtum/depends', 'download', 'SOURCES_PATH=' + os.getcwd() + '/cache/common'])
 
-    if args.linux:
-        print('\nCompiling ' + args.version + ' Linux')
-        subprocess.check_call(['bin/gbuild', '-j', args.jobs, '-m', args.memory, '--commit', 'qtum='+args.commit+',cpp-eth-qtum=hfcorebuildtest', '--url', 'qtum='+args.url, '../qtum/contrib/gitian-descriptors/gitian-linux.yml'])
-        subprocess.check_call(['bin/gsign', '-p', args.sign_prog, '--signer', args.signer, '--release', args.version+'-linux', '--destination', '../gitian.sigs/', '../qtum/contrib/gitian-descriptors/gitian-linux.yml'])
-        subprocess.check_call('mv build/out/qtum-*.tar.gz build/out/src/qtum-*.tar.gz ../qtum-binaries/'+args.version, shell=True)
-
-    if args.windows:
-        print('\nCompiling ' + args.version + ' Windows')
-        subprocess.check_call(['bin/gbuild', '-j', args.jobs, '-m', args.memory, '--commit', 'qtum='+args.commit+',cpp-eth-qtum=hfcorebuildtest', '--url', 'qtum='+args.url, '../qtum/contrib/gitian-descriptors/gitian-win.yml'])
-        subprocess.check_call(['bin/gsign', '-p', args.sign_prog, '--signer', args.signer, '--release', args.version+'-win-unsigned', '--destination', '../gitian.sigs/', '../qtum/contrib/gitian-descriptors/gitian-win.yml'])
-        subprocess.check_call('mv build/out/qtum-*-win-unsigned.tar.gz inputs/', shell=True)
-        subprocess.check_call('mv build/out/qtum-*.zip build/out/qtum-*.exe ../qtum-binaries/'+args.version, shell=True)
+#     if args.linux:
+#         print('\nCompiling ' + args.version + ' Linux')
+#         subprocess.check_call(['bin/gbuild', '-j', args.jobs, '-m', args.memory, '--commit', 'qtum='+args.commit+',cpp-eth-qtum=hfcorebuildtest', '--url', 'qtum='+args.url, '../qtum/contrib/gitian-descriptors/gitian-linux.yml'])
+#         subprocess.check_call(['bin/gsign', '-p', args.sign_prog, '--signer', args.signer, '--release', args.version+'-linux', '--destination', '../gitian.sigs/', '../qtum/contrib/gitian-descriptors/gitian-linux.yml'])
+#         subprocess.check_call('mv build/out/qtum-*.tar.gz build/out/src/qtum-*.tar.gz ../qtum-binaries/'+args.version, shell=True)
+# 
+#     if args.windows:
+#         print('\nCompiling ' + args.version + ' Windows')
+#         subprocess.check_call(['bin/gbuild', '-j', args.jobs, '-m', args.memory, '--commit', 'qtum='+args.commit+',cpp-eth-qtum=hfcorebuildtest', '--url', 'qtum='+args.url, '../qtum/contrib/gitian-descriptors/gitian-win.yml'])
+#         subprocess.check_call(['bin/gsign', '-p', args.sign_prog, '--signer', args.signer, '--release', args.version+'-win-unsigned', '--destination', '../gitian.sigs/', '../qtum/contrib/gitian-descriptors/gitian-win.yml'])
+#         subprocess.check_call('mv build/out/qtum-*-win-unsigned.tar.gz inputs/', shell=True)
+#         subprocess.check_call('mv build/out/qtum-*.zip build/out/qtum-*.exe ../qtum-binaries/'+args.version, shell=True)
 
     if args.macos:
         print('\nCompiling ' + args.version + ' MacOS')
diff --git a/depends/packages/native_cctools.mk b/depends/packages/native_cctools.mk
index 44d238cc4..bacbcbf93 100644
--- a/depends/packages/native_cctools.mk
+++ b/depends/packages/native_cctools.mk
@@ -4,11 +4,11 @@ $(package)_download_path=https://github.com/theuni/cctools-port/archive
 $(package)_file_name=$($(package)_version).tar.gz
 $(package)_sha256_hash=a09c9ba4684670a0375e42d9d67e7f12c1f62581a27f28f7c825d6d7032ccc6a
 $(package)_build_subdir=cctools
-$(package)_clang_version=3.7.1
+$(package)_clang_version=8.0.0
 $(package)_clang_download_path=http://llvm.org/releases/$($(package)_clang_version)
-$(package)_clang_download_file=clang+llvm-$($(package)_clang_version)-x86_64-linux-gnu-ubuntu-14.04.tar.xz
-$(package)_clang_file_name=clang-llvm-$($(package)_clang_version)-x86_64-linux-gnu-ubuntu-14.04.tar.xz
-$(package)_clang_sha256_hash=99b28a6b48e793705228a390471991386daa33a9717cd9ca007fcdde69608fd9
+$(package)_clang_download_file=clang+llvm-$($(package)_clang_version)-x86_64-linux-gnu-ubuntu-18.04.tar.xz
+$(package)_clang_file_name=clang-llvm-$($(package)_clang_version)-x86_64-linux-gnu-ubuntu-18.04.tar.xz
+$(package)_clang_sha256_hash=0f5c314f375ebd5c35b8c1d5e5b161d9efaeff0523bac287f8b4e5b751272f51
 $(package)_extra_sources=$($(package)_clang_file_name)
 
 define $(package)_fetch_cmds

From 5d521c62b49caf19db2b3ff26c0167d531db5d79 Mon Sep 17 00:00:00 2001
From: Time Markov <time.markov@qtum.com>
Date: Tue, 17 Sep 2019 20:49:12 +0200
Subject: [PATCH 145/153] Update gmp config

---
 depends/packages/gmp.mk | 16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

diff --git a/depends/packages/gmp.mk b/depends/packages/gmp.mk
index 6476afea6..22851eef2 100644
--- a/depends/packages/gmp.mk
+++ b/depends/packages/gmp.mk
@@ -1,18 +1,26 @@
 package=gmp
 $(package)_version=6.1.2
 $(package)_sha256_hash=87b565e89a9a684fe4ebeeddb8399dce2599f9c9049854ca8c0dfbdea0e21912
-$(package)_build_subdir=$(package)-$($(package)_version)
 $(package)_file_name=$(package)-$($(package)_version).tar.xz
 $(package)_download_path=https://gmplib.org/download/$(package)
 
+define $(package)_set_vars
+$(package)_config_opts=--enable-static=yes --enable-shared=no --enable-cxx
+$(package)_config_opts_linux=--with-pic
+endef
+
+define $(package)_preprocess_cmds
+  cp -f $(BASEDIR)/config.guess $(BASEDIR)/config.sub .
+endef
+
 define $(package)_config_cmds
-  ../configure --enable-static=yes --enable-shared=no --enable-cxx -without-readline --host=$(host) --prefix=$(host_prefix) --build=$(build)
+  $($(package)_autoconf)
 endef
 
 define $(package)_build_cmds
-  $(MAKE) CPPFLAGS='-fPIC'
+  $(MAKE)
 endef
 
 define $(package)_stage_cmds
-  $(MAKE) DESTDIR=$($(package)_staging_dir) install 
+  $(MAKE) DESTDIR=$($(package)_staging_dir) install
 endef

From 163cbc59f589b38a136c413345eddae9a865451d Mon Sep 17 00:00:00 2001
From: Neil <neil@qtum.org>
Date: Tue, 17 Sep 2019 19:35:36 +0000
Subject: [PATCH 146/153] fix typo

---
 depends/packages/native_cctools.mk | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/depends/packages/native_cctools.mk b/depends/packages/native_cctools.mk
index bacbcbf93..612c25cd0 100644
--- a/depends/packages/native_cctools.mk
+++ b/depends/packages/native_cctools.mk
@@ -59,7 +59,7 @@ define $(package)_stage_cmds
   cp -P bin/clang++ $($(package)_staging_prefix_dir)/bin/ &&\
   cp lib/libLTO.so $($(package)_staging_prefix_dir)/lib/ && \
   cp -rf lib/clang/$($(package)_clang_version)/include/* $($(package)_staging_prefix_dir)/lib/clang/$($(package)_clang_version)/include/ && \
-  cp bin/llvm-dsymutil $($(package)_staging_prefix_dir)/bin/$(host)-dsymutil && \
+  cp bin/dsymutil $($(package)_staging_prefix_dir)/bin/$(host)-dsymutil && \
   if `test -d include/c++/`; then cp -rf include/c++/ $($(package)_staging_prefix_dir)/include/; fi && \
   if `test -d lib/c++/`; then cp -rf lib/c++/ $($(package)_staging_prefix_dir)/lib/; fi
 endef

From a6fa8d6efd04da78bd592ef64c48511c9cb37692 Mon Sep 17 00:00:00 2001
From: Time Markov <time.markov@qtum.com>
Date: Tue, 17 Sep 2019 23:33:01 +0200
Subject: [PATCH 147/153] Fix clock_gettime mac

---
 src/libff/libff/common/profiling.cpp | 25 ++++++++++++++++++++-----
 1 file changed, 20 insertions(+), 5 deletions(-)

diff --git a/src/libff/libff/common/profiling.cpp b/src/libff/libff/common/profiling.cpp
index f2a198583..6f11bbbf1 100755
--- a/src/libff/libff/common/profiling.cpp
+++ b/src/libff/libff/common/profiling.cpp
@@ -27,6 +27,11 @@
 #include <proc/readproc.h>
 #endif
 
+#if MAC_OSX
+#include <mach/clock.h>
+#include <mach/mach.h>
+#endif
+
 namespace libff {
 
 long long get_nsec_time()
@@ -41,11 +46,21 @@ long long get_nsec_cpu_time()
 #if _MSC_VER
 	return 0;
 #else
-    ::timespec ts;
-    if ( ::clock_gettime(CLOCK_PROCESS_CPUTIME_ID, &ts) )
-        throw ::std::runtime_error("clock_gettime(CLOCK_PROCESS_CPUTIME_ID) failed");
-        // If we expected this to work, don't silently ignore failures, because that would hide the problem and incur an unnecessarily system-call overhead. So if we ever observe this exception, we should probably add a suitable #ifdef .
-        //TODO: clock_gettime(CLOCK_PROCESS_CPUTIME_ID) is not supported by native Windows. What about Cygwin? Should we #ifdef on CLOCK_PROCESS_CPUTIME_ID or on __linux__?
+    #if MAC_OSX
+        clock_serv_t cclock;
+        mach_timespec_t mts;
+        host_get_clock_service(mach_host_self(), CALENDAR_CLOCK, &cclock);
+        clock_get_time(cclock, &mts);
+        mach_port_deallocate(mach_task_self(), cclock);
+        ts.tv_sec = mts.tv_sec;
+        ts.tv_nsec = mts.tv_nsec;
+    #else
+        ::timespec ts;
+        if ( ::clock_gettime(CLOCK_PROCESS_CPUTIME_ID, &ts) )
+            throw ::std::runtime_error("clock_gettime(CLOCK_PROCESS_CPUTIME_ID) failed");
+            // If we expected this to work, don't silently ignore failures, because that would hide the problem and incur an unnecessarily system-call overhead. So if we ever observe this exception, we should probably add a suitable #ifdef .
+            //TODO: clock_gettime(CLOCK_PROCESS_CPUTIME_ID) is not supported by native Windows. What about Cygwin? Should we #ifdef on CLOCK_PROCESS_CPUTIME_ID or on __linux__?
+    #endif
     return ts.tv_sec * 1000000000ll + ts.tv_nsec;
 #endif
 }

From 45ab8a5e35aef3de3f47b6c8017eafa65fae9620 Mon Sep 17 00:00:00 2001
From: Neil <neil@qtum.org>
Date: Tue, 17 Sep 2019 22:26:09 +0000
Subject: [PATCH 148/153] declare ts

---
 src/libff/libff/common/profiling.cpp | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/libff/libff/common/profiling.cpp b/src/libff/libff/common/profiling.cpp
index 6f11bbbf1..f3e977566 100755
--- a/src/libff/libff/common/profiling.cpp
+++ b/src/libff/libff/common/profiling.cpp
@@ -47,6 +47,7 @@ long long get_nsec_cpu_time()
 	return 0;
 #else
     #if MAC_OSX
+	    ::timespec ts;
         clock_serv_t cclock;
         mach_timespec_t mts;
         host_get_clock_service(mach_host_self(), CALENDAR_CLOCK, &cclock);

From e8acac3d989503386695345a4d4e03a976d35092 Mon Sep 17 00:00:00 2001
From: Neil <neil@qtum.org>
Date: Tue, 17 Sep 2019 23:19:54 +0000
Subject: [PATCH 149/153] Restore builds

---
 contrib/gitian-build.py | 24 ++++++++++++------------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/contrib/gitian-build.py b/contrib/gitian-build.py
index 77d2e4586..37f8f7f11 100755
--- a/contrib/gitian-build.py
+++ b/contrib/gitian-build.py
@@ -57,18 +57,18 @@ def build():
     subprocess.check_call(["echo 'f9a8cdb38b9c309326764ebc937cba1523a3a751a7ab05df3ecc99d18ae466c9 inputs/osslsigncode-1.7.1.tar.gz' | sha256sum -c"], shell=True)
     subprocess.check_call(['make', '-C', '../qtum/depends', 'download', 'SOURCES_PATH=' + os.getcwd() + '/cache/common'])
 
-#     if args.linux:
-#         print('\nCompiling ' + args.version + ' Linux')
-#         subprocess.check_call(['bin/gbuild', '-j', args.jobs, '-m', args.memory, '--commit', 'qtum='+args.commit+',cpp-eth-qtum=hfcorebuildtest', '--url', 'qtum='+args.url, '../qtum/contrib/gitian-descriptors/gitian-linux.yml'])
-#         subprocess.check_call(['bin/gsign', '-p', args.sign_prog, '--signer', args.signer, '--release', args.version+'-linux', '--destination', '../gitian.sigs/', '../qtum/contrib/gitian-descriptors/gitian-linux.yml'])
-#         subprocess.check_call('mv build/out/qtum-*.tar.gz build/out/src/qtum-*.tar.gz ../qtum-binaries/'+args.version, shell=True)
-# 
-#     if args.windows:
-#         print('\nCompiling ' + args.version + ' Windows')
-#         subprocess.check_call(['bin/gbuild', '-j', args.jobs, '-m', args.memory, '--commit', 'qtum='+args.commit+',cpp-eth-qtum=hfcorebuildtest', '--url', 'qtum='+args.url, '../qtum/contrib/gitian-descriptors/gitian-win.yml'])
-#         subprocess.check_call(['bin/gsign', '-p', args.sign_prog, '--signer', args.signer, '--release', args.version+'-win-unsigned', '--destination', '../gitian.sigs/', '../qtum/contrib/gitian-descriptors/gitian-win.yml'])
-#         subprocess.check_call('mv build/out/qtum-*-win-unsigned.tar.gz inputs/', shell=True)
-#         subprocess.check_call('mv build/out/qtum-*.zip build/out/qtum-*.exe ../qtum-binaries/'+args.version, shell=True)
+    if args.linux:
+        print('\nCompiling ' + args.version + ' Linux')
+        subprocess.check_call(['bin/gbuild', '-j', args.jobs, '-m', args.memory, '--commit', 'qtum='+args.commit+',cpp-eth-qtum=hfcorebuildtest', '--url', 'qtum='+args.url, '../qtum/contrib/gitian-descriptors/gitian-linux.yml'])
+        subprocess.check_call(['bin/gsign', '-p', args.sign_prog, '--signer', args.signer, '--release', args.version+'-linux', '--destination', '../gitian.sigs/', '../qtum/contrib/gitian-descriptors/gitian-linux.yml'])
+        subprocess.check_call('mv build/out/qtum-*.tar.gz build/out/src/qtum-*.tar.gz ../qtum-binaries/'+args.version, shell=True)
+ 
+    if args.windows:
+        print('\nCompiling ' + args.version + ' Windows')
+        subprocess.check_call(['bin/gbuild', '-j', args.jobs, '-m', args.memory, '--commit', 'qtum='+args.commit+',cpp-eth-qtum=hfcorebuildtest', '--url', 'qtum='+args.url, '../qtum/contrib/gitian-descriptors/gitian-win.yml'])
+        subprocess.check_call(['bin/gsign', '-p', args.sign_prog, '--signer', args.signer, '--release', args.version+'-win-unsigned', '--destination', '../gitian.sigs/', '../qtum/contrib/gitian-descriptors/gitian-win.yml'])
+        subprocess.check_call('mv build/out/qtum-*-win-unsigned.tar.gz inputs/', shell=True)
+        subprocess.check_call('mv build/out/qtum-*.zip build/out/qtum-*.exe ../qtum-binaries/'+args.version, shell=True)
 
     if args.macos:
         print('\nCompiling ' + args.version + ' MacOS')

From ede9fce693fc3eeda45b24c4a80a54a3627da931 Mon Sep 17 00:00:00 2001
From: Neil <neil@qtum.org>
Date: Wed, 18 Sep 2019 04:08:55 +0000
Subject: [PATCH 150/153] Revert "Set submodule test branch"

This reverts commit 7fd0d014d7fe5f335553db436c09152f52a78ffb.
---
 contrib/gitian-build.py | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/contrib/gitian-build.py b/contrib/gitian-build.py
index 37f8f7f11..10a614d2f 100755
--- a/contrib/gitian-build.py
+++ b/contrib/gitian-build.py
@@ -59,20 +59,20 @@ def build():
 
     if args.linux:
         print('\nCompiling ' + args.version + ' Linux')
-        subprocess.check_call(['bin/gbuild', '-j', args.jobs, '-m', args.memory, '--commit', 'qtum='+args.commit+',cpp-eth-qtum=hfcorebuildtest', '--url', 'qtum='+args.url, '../qtum/contrib/gitian-descriptors/gitian-linux.yml'])
+        subprocess.check_call(['bin/gbuild', '-j', args.jobs, '-m', args.memory, '--commit', 'qtum='+args.commit+',cpp-eth-qtum=develop', '--url', 'qtum='+args.url, '../qtum/contrib/gitian-descriptors/gitian-linux.yml'])
         subprocess.check_call(['bin/gsign', '-p', args.sign_prog, '--signer', args.signer, '--release', args.version+'-linux', '--destination', '../gitian.sigs/', '../qtum/contrib/gitian-descriptors/gitian-linux.yml'])
         subprocess.check_call('mv build/out/qtum-*.tar.gz build/out/src/qtum-*.tar.gz ../qtum-binaries/'+args.version, shell=True)
  
     if args.windows:
         print('\nCompiling ' + args.version + ' Windows')
-        subprocess.check_call(['bin/gbuild', '-j', args.jobs, '-m', args.memory, '--commit', 'qtum='+args.commit+',cpp-eth-qtum=hfcorebuildtest', '--url', 'qtum='+args.url, '../qtum/contrib/gitian-descriptors/gitian-win.yml'])
+        subprocess.check_call(['bin/gbuild', '-j', args.jobs, '-m', args.memory, '--commit', 'qtum='+args.commit+',cpp-eth-qtum=develop', '--url', 'qtum='+args.url, '../qtum/contrib/gitian-descriptors/gitian-win.yml'])
         subprocess.check_call(['bin/gsign', '-p', args.sign_prog, '--signer', args.signer, '--release', args.version+'-win-unsigned', '--destination', '../gitian.sigs/', '../qtum/contrib/gitian-descriptors/gitian-win.yml'])
         subprocess.check_call('mv build/out/qtum-*-win-unsigned.tar.gz inputs/', shell=True)
         subprocess.check_call('mv build/out/qtum-*.zip build/out/qtum-*.exe ../qtum-binaries/'+args.version, shell=True)
 
     if args.macos:
         print('\nCompiling ' + args.version + ' MacOS')
-        subprocess.check_call(['bin/gbuild', '-j', args.jobs, '-m', args.memory, '--commit', 'qtum='+args.commit+',cpp-eth-qtum=hfcorebuildtest', '--url', 'qtum='+args.url, '../qtum/contrib/gitian-descriptors/gitian-osx.yml'])
+        subprocess.check_call(['bin/gbuild', '-j', args.jobs, '-m', args.memory, '--commit', 'qtum='+args.commit+',cpp-eth-qtum=develop', '--url', 'qtum='+args.url, '../qtum/contrib/gitian-descriptors/gitian-osx.yml'])
         subprocess.check_call(['bin/gsign', '-p', args.sign_prog, '--signer', args.signer, '--release', args.version+'-osx-unsigned', '--destination', '../gitian.sigs/', '../qtum/contrib/gitian-descriptors/gitian-osx.yml'])
         subprocess.check_call('mv build/out/qtum-*-osx-unsigned.tar.gz inputs/', shell=True)
         subprocess.check_call('mv build/out/qtum-*.tar.gz build/out/qtum-*.dmg ../qtum-binaries/'+args.version, shell=True)

From 743ccad42b7f8a46264b5eb376731da65f2739a8 Mon Sep 17 00:00:00 2001
From: Time Markov <time.markov@qtum.com>
Date: Wed, 18 Sep 2019 13:12:29 +0200
Subject: [PATCH 151/153] Add option to restore wallet from file without param

---
 src/qt/bitcoin.cpp            | 10 ++++++++--
 src/qt/forms/restoredialog.ui | 11 +++++++++--
 src/qt/restoredialog.cpp      | 24 ++++++++++++++++++++++--
 3 files changed, 39 insertions(+), 6 deletions(-)

diff --git a/src/qt/bitcoin.cpp b/src/qt/bitcoin.cpp
index ca6f8812d..87efba2ae 100644
--- a/src/qt/bitcoin.cpp
+++ b/src/qt/bitcoin.cpp
@@ -58,6 +58,7 @@
 #include <QTranslator>
 #include <QFile>
 #include <QProcess>
+#include <QFileInfo>
 
 #if defined(QT_STATICPLUGIN)
 #include <QtPlugin>
@@ -466,8 +467,13 @@ void BitcoinApplication::restoreWallet()
         }
         path /= "wallet.dat";
         QString pathWallet = QString::fromStdString(path.string());
-        QFile::remove(pathWallet);
-        if(QFile::copy(restorePath, pathWallet))
+        bool ret = QFile::exists(restorePath) && QFile::exists(pathWallet);
+        if(ret && QFileInfo(restorePath) != QFileInfo(pathWallet))
+        {
+            ret &= QFile::remove(pathWallet);
+            ret &= QFile::copy(restorePath, pathWallet);
+        }
+        if(ret)
         {
             // Unlock the data folder
             UnlockDataDirectory();
diff --git a/src/qt/forms/restoredialog.ui b/src/qt/forms/restoredialog.ui
index 119e4a241..fc81e023b 100644
--- a/src/qt/forms/restoredialog.ui
+++ b/src/qt/forms/restoredialog.ui
@@ -82,15 +82,22 @@
        </property>
        <layout class="QVBoxLayout" name="verticalLayout">
         <item>
-         <widget class="QRadioButton" name="rbReindex">
+         <widget class="QRadioButton" name="rbRestoreFile">
           <property name="text">
-           <string>Rebuild blockchain index</string>
+           <string>Restore file</string>
           </property>
           <property name="checked">
            <bool>true</bool>
           </property>
          </widget>
         </item>
+        <item>
+         <widget class="QRadioButton" name="rbReindex">
+          <property name="text">
+           <string>Rebuild blockchain index</string>
+          </property>
+         </widget>
+        </item>
         <item>
          <widget class="QRadioButton" name="rbZapWallet">
           <property name="text">
diff --git a/src/qt/restoredialog.cpp b/src/qt/restoredialog.cpp
index c41a0695a..90ef1855d 100644
--- a/src/qt/restoredialog.cpp
+++ b/src/qt/restoredialog.cpp
@@ -5,6 +5,8 @@
 #include <QMessageBox>
 #include <QFile>
 #include <qt/styleSheet.h>
+#include <wallet/walletutil.h>
+#include <fs.h>
 
 RestoreDialog::RestoreDialog(QWidget *parent) :
     QDialog(parent),
@@ -32,7 +34,7 @@ QString RestoreDialog::getParam()
     {
         param = "-zapwallettxes=2";
     }
-    else
+    else if(ui->rbLocalDeleteData->isChecked())
     {
         param = "-deleteblockchaindata";
     }
@@ -59,6 +61,24 @@ void RestoreDialog::on_btnReset_clicked()
 void RestoreDialog::on_btnBoxRestore_accepted()
 {
     QString filename = getFileName();
+    if(filename.isEmpty())
+    {
+        if(ui->rbRestoreFile->isChecked())
+        {
+            QMessageBox::information(this, tr("File not selected"), tr("Please select a file to restore your wallet."), QMessageBox::Ok);
+        }
+        else
+        {
+            fs::path path = GetWalletDir();
+            QString restoreName = model ? model->getWalletName() : "";
+            if(!restoreName.isEmpty())
+            {
+                path /= restoreName.toStdString();
+            }
+            path /= "wallet.dat";
+            filename = QString::fromStdString(path.string());
+        }
+    }
     QString param = getParam();
     if(model && QFile::exists(filename))
     {
@@ -69,7 +89,7 @@ void RestoreDialog::on_btnBoxRestore_accepted()
                  QMessageBox::Cancel);
         if(retval == QMessageBox::Yes)
         {
-            if(model->restoreWallet(getFileName(), getParam()))
+            if(model->restoreWallet(filename, param))
             {
                 QApplication::quit();
             }

From bb84dab96b02cefe6be885711072bb2830abb510 Mon Sep 17 00:00:00 2001
From: Time Markov <time.markov@qtum.com>
Date: Wed, 18 Sep 2019 14:55:34 +0200
Subject: [PATCH 152/153] Return when invalid data for restore on Ok, the user
 can click on Cancel to close the dialog

---
 src/qt/restoredialog.cpp | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/src/qt/restoredialog.cpp b/src/qt/restoredialog.cpp
index 90ef1855d..9468cd8c7 100644
--- a/src/qt/restoredialog.cpp
+++ b/src/qt/restoredialog.cpp
@@ -66,6 +66,7 @@ void RestoreDialog::on_btnBoxRestore_accepted()
         if(ui->rbRestoreFile->isChecked())
         {
             QMessageBox::information(this, tr("File not selected"), tr("Please select a file to restore your wallet."), QMessageBox::Ok);
+            return;
         }
         else
         {
@@ -94,6 +95,7 @@ void RestoreDialog::on_btnBoxRestore_accepted()
                 QApplication::quit();
             }
         }
+        else return;
     }
     accept();
 }

From abd94622a7dfe6a41effdd3912c00c55123ca664 Mon Sep 17 00:00:00 2001
From: Neil <neil@qtum.org>
Date: Wed, 18 Sep 2019 14:02:05 +0000
Subject: [PATCH 153/153] Update submodule

---
 src/cpp-ethereum | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/cpp-ethereum b/src/cpp-ethereum
index 1ecea9380..ac506e612 160000
--- a/src/cpp-ethereum
+++ b/src/cpp-ethereum
@@ -1 +1 @@
-Subproject commit 1ecea938047fc827ea79c7a319009477b567c01c
+Subproject commit ac506e6120fc05d3d823d4e816f0a3e40ece6635