diff --git a/Cargo.lock b/Cargo.lock
index df6910c..220d94f 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -4,18 +4,18 @@ version = 3
 
 [[package]]
 name = "addr2line"
-version = "0.14.0"
+version = "0.16.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7c0929d69e78dd9bf5408269919fcbcaeb2e35e5d43e5815517cdc6a8e11a423"
+checksum = "3e61f2b7f93d2c7d2b08263acaa4a363b3e276806c68af6134c44f523bf1aacd"
 dependencies = [
  "gimli",
 ]
 
 [[package]]
 name = "adler"
-version = "0.2.3"
+version = "1.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ee2a4ec343196209d6594e19543ae87a39f96d5534d7174822a3ad825dd6ed7e"
+checksum = "f26201604c87b1e01bd3d98f8d5d9a8fcbb815e8cedb41ffccbeb4bf593a35fe"
 
 [[package]]
 name = "arrayref"
@@ -31,11 +31,12 @@ checksum = "cdb031dd78e28731d87d56cc8ffef4a8f36ca26c38fe2de700543e627f8a464a"
 
 [[package]]
 name = "backtrace"
-version = "0.3.55"
+version = "0.3.61"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ef5140344c85b01f9bbb4d4b7288a8aa4b3287ccef913a14bcc78a1063623598"
+checksum = "e7a905d892734eea339e896738c14b9afce22b5318f64b951e70bf3844419b01"
 dependencies = [
  "addr2line",
+ "cc",
  "cfg-if",
  "libc",
  "miniz_oxide",
@@ -103,9 +104,15 @@ checksum = "e3b5ca7a04898ad4bcd41c90c5285445ff5b791899bb1b0abdd2a2aa791211d7"
 
 [[package]]
 name = "byteorder"
-version = "1.3.4"
+version = "1.4.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "08c48aae112d48ed9f069b33538ea9e3e90aa263cfa3d1c24309612b1f7472de"
+checksum = "14c189c53d098945499cdfa7ecc63567cf3886b3332b312a5b4585d8d3a6a610"
+
+[[package]]
+name = "cc"
+version = "1.0.71"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "79c2681d6594606957bbb8631c4b90a7fcaaa72cdb714743a437b156d6a7eedd"
 
 [[package]]
 name = "cfg-if"
@@ -126,7 +133,7 @@ dependencies = [
 [[package]]
 name = "cosmwasm-std"
 version = "0.10.0"
-source = "git+https://github.com/enigmampc/SecretNetwork?tag=v1.0.4-debug-print#004c6bca6f2b7f31a6594abe4f44f2e41b1456b3"
+source = "git+https://github.com/enigmampc/SecretNetwork?tag=v1.0.0#490fba9243e6cb291462e9d3c1bcbd1975c0df1e"
 dependencies = [
  "base64 0.11.0",
  "schemars",
@@ -138,17 +145,20 @@ dependencies = [
 [[package]]
 name = "cosmwasm-storage"
 version = "0.10.0"
-source = "git+https://github.com/enigmampc/SecretNetwork?tag=v1.0.4-debug-print#004c6bca6f2b7f31a6594abe4f44f2e41b1456b3"
+source = "git+https://github.com/enigmampc/SecretNetwork?tag=v1.0.0#490fba9243e6cb291462e9d3c1bcbd1975c0df1e"
 dependencies = [
  "cosmwasm-std",
  "serde",
 ]
 
 [[package]]
-name = "cpuid-bool"
-version = "0.1.2"
+name = "cpufeatures"
+version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8aebca1129a03dc6dc2b127edd729435bbc4a37e1d5f4d7513165089ceb02634"
+checksum = "95059428f66df56b63431fdb4e1947ed2190586af5c5a8a8b71122bdf5a7f469"
+dependencies = [
+ "libc",
+]
 
 [[package]]
 name = "crunchy"
@@ -217,15 +227,15 @@ dependencies = [
 
 [[package]]
 name = "gimli"
-version = "0.23.0"
+version = "0.25.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f6503fe142514ca4799d4c26297c4248239fe8838d827db6bd6065c6ed29a6ce"
+checksum = "f0a01e0497841a3b2db4f8afa483cce65f7e96a3498bd6c541734792aeac8fe7"
 
 [[package]]
 name = "hex"
-version = "0.4.2"
+version = "0.4.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "644f9158b2f133fd50f5fb3242878846d9eb792e445c893805ff0e3824006e35"
+checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70"
 
 [[package]]
 name = "hmac"
@@ -250,15 +260,15 @@ dependencies = [
 
 [[package]]
 name = "itoa"
-version = "0.4.7"
+version = "0.4.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dd25036021b0de88a0aff6b850051563c6516d0bf53f8638938edbb9de732736"
+checksum = "b71991ff56294aa922b450139ee08b3bfc70982c6b2c7562771375cf73542dd4"
 
 [[package]]
 name = "libc"
-version = "0.2.81"
+version = "0.2.104"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1482821306169ec4d07f6aca392a4681f66c75c9918aa49641a2595db64053cb"
+checksum = "7b2f96d100e1cf1929e7719b7edb3b90ab5298072638fccd77be9ce942ecdfce"
 
 [[package]]
 name = "libsecp256k1"
@@ -272,15 +282,21 @@ dependencies = [
  "hmac-drbg",
  "rand",
  "sha2 0.8.2",
- "subtle 2.4.0",
+ "subtle 2.4.1",
  "typenum",
 ]
 
+[[package]]
+name = "memchr"
+version = "2.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "308cc39be01b73d0d18f82a0e7b2a3df85245f84af96fdddc5d202d27e47b86a"
+
 [[package]]
 name = "miniz_oxide"
-version = "0.4.3"
+version = "0.4.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0f2d26ec3309788e423cfbf68ad1800f061638098d76a83681af979dc4eda19d"
+checksum = "a92518e98c078586bc6c934028adcca4c92a53d6a958196de835170a01d84e4b"
 dependencies = [
  "adler",
  "autocfg",
@@ -288,9 +304,12 @@ dependencies = [
 
 [[package]]
 name = "object"
-version = "0.22.0"
+version = "0.26.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8d3b63360ec3cb337817c2dbd47ab4a0f170d285d8e5a2064600f3def1402397"
+checksum = "39f37e50073ccad23b6d09bcb5b263f4e76d3bb6038e4a3c08e52162ffa8abc2"
+dependencies = [
+ "memchr",
+]
 
 [[package]]
 name = "opaque-debug"
@@ -306,24 +325,24 @@ checksum = "624a8340c38c1b80fd549087862da4ba43e08858af025b236e509b6649fc13d5"
 
 [[package]]
 name = "ppv-lite86"
-version = "0.2.10"
+version = "0.2.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ac74c624d6b2d21f425f752262f42188365d7b8ff1aff74c82e45136510a4857"
+checksum = "c3ca011bd0129ff4ae15cd04c4eef202cadf6c51c21e47aba319b4e0501db741"
 
 [[package]]
 name = "proc-macro2"
-version = "1.0.24"
+version = "1.0.30"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e0704ee1a7e00d7bb417d0770ea303c1bccbabf0ef1667dae92b5967f5f8a71"
+checksum = "edc3358ebc67bc8b7fa0c007f945b0b18226f78437d61bec735a9eb96b61ee70"
 dependencies = [
  "unicode-xid",
 ]
 
 [[package]]
 name = "quote"
-version = "1.0.8"
+version = "1.0.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "991431c3519a3f36861882da93630ce66b52918dcf1b8e2fd66b397fc96f28df"
+checksum = "38bc8cc6a5f2e3655e0899c1b848643b2562f853f114bfec7be120678e3ace05"
 dependencies = [
  "proc-macro2",
 ]
@@ -364,11 +383,33 @@ dependencies = [
  "rand_core",
 ]
 
+[[package]]
+name = "remain"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "70ba1e78fa68412cb93ef642fd4d20b9a941be49ee9333875ebaf13112673ea7"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "ripemd160"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2eca4ecc81b7f313189bf73ce724400a07da2a6dac19588b03c8bd76a2dcc251"
+dependencies = [
+ "block-buffer 0.9.0",
+ "digest 0.9.0",
+ "opaque-debug 0.3.0",
+]
+
 [[package]]
 name = "rustc-demangle"
-version = "0.1.18"
+version = "0.1.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6e3bad0ee36814ca07d7968269dd4b7ec89ec2da10c4bb613928d3077083c232"
+checksum = "7ef03e0a2b150c7a90d01faf6254c9c48a41e95fb2a8c2ac1c6f0d2b9aefc342"
 
 [[package]]
 name = "ryu"
@@ -399,12 +440,32 @@ dependencies = [
  "syn",
 ]
 
+[[package]]
+name = "secp256k1"
+version = "0.19.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c6179428c22c73ac0fbb7b5579a56353ce78ba29759b3b8575183336ea74cdfb"
+dependencies = [
+ "secp256k1-sys",
+]
+
+[[package]]
+name = "secp256k1-sys"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "11553d210db090930f4432bea123b31f70bbf693ace14504ea2a35e796c28dd2"
+dependencies = [
+ "cc",
+]
+
 [[package]]
 name = "secret-toolkit"
 version = "0.1.0"
-source = "git+https://github.com/enigmampc/secret-toolkit?rev=v0.1.1-debug-print#41a2eb310b5d1b08ced124a5e3664546bd3b355e"
+source = "git+https://github.com/enigmampc/secret-toolkit?rev=52df67c2becf98510fa55bdad5edf0e2dd11f5a6#52df67c2becf98510fa55bdad5edf0e2dd11f5a6"
 dependencies = [
  "secret-toolkit-crypto",
+ "secret-toolkit-incubator",
+ "secret-toolkit-permit",
  "secret-toolkit-serialization",
  "secret-toolkit-snip20",
  "secret-toolkit-snip721",
@@ -415,19 +476,46 @@ dependencies = [
 [[package]]
 name = "secret-toolkit-crypto"
 version = "0.1.0"
-source = "git+https://github.com/enigmampc/secret-toolkit?rev=v0.1.1-debug-print#41a2eb310b5d1b08ced124a5e3664546bd3b355e"
+source = "git+https://github.com/enigmampc/secret-toolkit?rev=52df67c2becf98510fa55bdad5edf0e2dd11f5a6#52df67c2becf98510fa55bdad5edf0e2dd11f5a6"
 dependencies = [
  "cosmwasm-std",
  "libsecp256k1",
  "rand_chacha",
  "rand_core",
- "sha2 0.9.2",
+ "sha2 0.9.8",
+]
+
+[[package]]
+name = "secret-toolkit-incubator"
+version = "0.1.0"
+source = "git+https://github.com/enigmampc/secret-toolkit?rev=52df67c2becf98510fa55bdad5edf0e2dd11f5a6#52df67c2becf98510fa55bdad5edf0e2dd11f5a6"
+dependencies = [
+ "cosmwasm-std",
+ "cosmwasm-storage",
+ "secret-toolkit-serialization",
+ "serde",
+ "siphasher",
+]
+
+[[package]]
+name = "secret-toolkit-permit"
+version = "0.1.0"
+source = "git+https://github.com/enigmampc/secret-toolkit?rev=52df67c2becf98510fa55bdad5edf0e2dd11f5a6#52df67c2becf98510fa55bdad5edf0e2dd11f5a6"
+dependencies = [
+ "cosmwasm-std",
+ "remain",
+ "ripemd160",
+ "schemars",
+ "secp256k1",
+ "secret-toolkit-utils",
+ "serde",
+ "sha2 0.9.8",
 ]
 
 [[package]]
 name = "secret-toolkit-serialization"
 version = "0.1.0"
-source = "git+https://github.com/enigmampc/secret-toolkit?rev=v0.1.1-debug-print#41a2eb310b5d1b08ced124a5e3664546bd3b355e"
+source = "git+https://github.com/enigmampc/secret-toolkit?rev=52df67c2becf98510fa55bdad5edf0e2dd11f5a6#52df67c2becf98510fa55bdad5edf0e2dd11f5a6"
 dependencies = [
  "bincode2",
  "cosmwasm-std",
@@ -437,7 +525,7 @@ dependencies = [
 [[package]]
 name = "secret-toolkit-snip20"
 version = "0.1.0"
-source = "git+https://github.com/enigmampc/secret-toolkit?rev=v0.1.1-debug-print#41a2eb310b5d1b08ced124a5e3664546bd3b355e"
+source = "git+https://github.com/enigmampc/secret-toolkit?rev=52df67c2becf98510fa55bdad5edf0e2dd11f5a6#52df67c2becf98510fa55bdad5edf0e2dd11f5a6"
 dependencies = [
  "cosmwasm-std",
  "schemars",
@@ -448,7 +536,7 @@ dependencies = [
 [[package]]
 name = "secret-toolkit-snip721"
 version = "0.1.0"
-source = "git+https://github.com/enigmampc/secret-toolkit?rev=v0.1.1-debug-print#41a2eb310b5d1b08ced124a5e3664546bd3b355e"
+source = "git+https://github.com/enigmampc/secret-toolkit?rev=52df67c2becf98510fa55bdad5edf0e2dd11f5a6#52df67c2becf98510fa55bdad5edf0e2dd11f5a6"
 dependencies = [
  "cosmwasm-std",
  "schemars",
@@ -459,7 +547,7 @@ dependencies = [
 [[package]]
 name = "secret-toolkit-storage"
 version = "0.1.0"
-source = "git+https://github.com/enigmampc/secret-toolkit?rev=v0.1.1-debug-print#41a2eb310b5d1b08ced124a5e3664546bd3b355e"
+source = "git+https://github.com/enigmampc/secret-toolkit?rev=52df67c2becf98510fa55bdad5edf0e2dd11f5a6#52df67c2becf98510fa55bdad5edf0e2dd11f5a6"
 dependencies = [
  "cosmwasm-std",
  "cosmwasm-storage",
@@ -470,7 +558,7 @@ dependencies = [
 [[package]]
 name = "secret-toolkit-utils"
 version = "0.1.0"
-source = "git+https://github.com/enigmampc/secret-toolkit?rev=v0.1.1-debug-print#41a2eb310b5d1b08ced124a5e3664546bd3b355e"
+source = "git+https://github.com/enigmampc/secret-toolkit?rev=52df67c2becf98510fa55bdad5edf0e2dd11f5a6#52df67c2becf98510fa55bdad5edf0e2dd11f5a6"
 dependencies = [
  "cosmwasm-std",
  "schemars",
@@ -479,27 +567,27 @@ dependencies = [
 
 [[package]]
 name = "serde"
-version = "1.0.118"
+version = "1.0.130"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "06c64263859d87aa2eb554587e2d23183398d617427327cf2b3d0ed8c69e4800"
+checksum = "f12d06de37cf59146fbdecab66aa99f9fe4f78722e3607577a5375d66bd0c913"
 dependencies = [
  "serde_derive",
 ]
 
 [[package]]
 name = "serde-json-wasm"
-version = "0.2.1"
+version = "0.2.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7294d94d390f1d2334697c065ea591d7074c676e2d20aa6f1df752fced29823f"
+checksum = "120bad73306616e91acd7ceed522ba96032a51cffeef3cc813de7f367df71e37"
 dependencies = [
  "serde",
 ]
 
 [[package]]
 name = "serde_derive"
-version = "1.0.118"
+version = "1.0.130"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c84d3526699cd55261af4b941e4e725444df67aa4f9e6a3564f18030d12672df"
+checksum = "d7bc1a1ab1961464eae040d96713baa5a724a8152c1222492465b54322ec508b"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -519,9 +607,9 @@ dependencies = [
 
 [[package]]
 name = "serde_json"
-version = "1.0.60"
+version = "1.0.68"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1500e84d27fe482ed1dc791a56eddc2f230046a040fa908c08bda1d9fb615779"
+checksum = "0f690853975602e1bfe1ccbf50504d67174e3bcf340f23b5ea9992e0587a52d8"
 dependencies = [
  "itoa",
  "ryu",
@@ -542,17 +630,23 @@ dependencies = [
 
 [[package]]
 name = "sha2"
-version = "0.9.2"
+version = "0.9.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6e7aab86fe2149bad8c507606bdb3f4ef5e7b2380eb92350f56122cca72a42a8"
+checksum = "b69f9a4c9740d74c5baa3fd2e547f9525fa8088a8a958e0ca2409a514e33f5fa"
 dependencies = [
  "block-buffer 0.9.0",
  "cfg-if",
- "cpuid-bool",
+ "cpufeatures",
  "digest 0.9.0",
  "opaque-debug 0.3.0",
 ]
 
+[[package]]
+name = "siphasher"
+version = "0.3.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "533494a8f9b724d33625ab53c6c4800f7cc445895924a8ef649222dcb76e938b"
+
 [[package]]
 name = "snafu"
 version = "0.6.10"
@@ -587,12 +681,14 @@ dependencies = [
  "hex",
  "rand_chacha",
  "rand_core",
+ "ripemd160",
  "schemars",
+ "secp256k1",
  "secret-toolkit",
  "serde",
- "sha2 0.9.2",
+ "sha2 0.9.8",
  "snafu",
- "subtle 2.4.0",
+ "subtle 2.4.1",
 ]
 
 [[package]]
@@ -603,15 +699,15 @@ checksum = "2d67a5a62ba6e01cb2192ff309324cb4875d0c451d55fe2319433abe7a05a8ee"
 
 [[package]]
 name = "subtle"
-version = "2.4.0"
+version = "2.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e81da0851ada1f3e9d4312c704aa4f8806f0f9d69faaf8df2f3464b4a9437c2"
+checksum = "6bdef32e8150c2a081110b42772ffe7d7c9032b606bc226c8260fd97e0976601"
 
 [[package]]
 name = "syn"
-version = "1.0.56"
+version = "1.0.80"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a9802ddde94170d186eeee5005b798d9c159fa970403f1be19976d0cfb939b72"
+checksum = "d010a1623fbd906d51d650a9916aaefc05ffa0e4053ff7fe601167f3e715d194"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -620,18 +716,18 @@ dependencies = [
 
 [[package]]
 name = "typenum"
-version = "1.12.0"
+version = "1.14.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "373c8a200f9e67a0c95e62a4f52fbf80c23b4381c05a17845531982fa99e6b33"
+checksum = "b63708a265f51345575b27fe43f9500ad611579e764c79edbc2037b1121959ec"
 
 [[package]]
 name = "unicode-xid"
-version = "0.2.1"
+version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f7fe0bb3479651439c9112f72b6c505038574c9fbb575ed1bf3b797fa39dd564"
+checksum = "8ccb82d61f80a663efe1f787a51b16b5a51e3314d6ac365b08639f52387b33f3"
 
 [[package]]
 name = "version_check"
-version = "0.9.2"
+version = "0.9.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b5a972e5669d67ba988ce3dc826706fb0a8b01471c088cb0b6110b805cc36aed"
+checksum = "5fecdca9a5291cc2b8dcf7dc02453fee791a280f3743cb0905f8822ae463b3fe"
diff --git a/Cargo.toml b/Cargo.toml
index 80dbac0..62ebd53 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -3,7 +3,6 @@ name = "snip20-reference-impl"
 version = "0.1.0"
 authors = ["Itzik <itzik@keytango.io>"]
 edition = "2018"
-
 exclude = [
   # Those files are rust-optimizer artifacts. You might want to commit them for convenience but they should not be part of the source code publication.
   "contract.wasm",
@@ -11,7 +10,6 @@ exclude = [
 ]
 
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
-
 [lib]
 crate-type = ["cdylib", "rlib"]
 
@@ -31,12 +29,12 @@ overflow-checks = true
 # for more explicit tests, cargo test --features=backtraces
 #default = ["debug-print"]
 backtraces = ["cosmwasm-std/backtraces"]
-debug-print = ["cosmwasm-std/debug-print"]
 
+# debug-print = ["cosmwasm-std/debug-print"]
 [dependencies]
-cosmwasm-std = { git = "https://github.com/enigmampc/SecretNetwork", tag = "v1.0.4-debug-print" }
-cosmwasm-storage = { git = "https://github.com/enigmampc/SecretNetwork", tag = "v1.0.4-debug-print" }
-secret-toolkit = { git = "https://github.com/enigmampc/secret-toolkit", rev = "v0.1.1-debug-print" }
+cosmwasm-std = { git = "https://github.com/enigmampc/SecretNetwork", tag = "v1.0.0" }
+cosmwasm-storage = { git = "https://github.com/enigmampc/SecretNetwork", tag = "v1.0.0" }
+secret-toolkit = { git = "https://github.com/enigmampc/secret-toolkit", rev = "52df67c2becf98510fa55bdad5edf0e2dd11f5a6" }
 schemars = "0.7"
 serde = { version = "1.0.103", default-features = false, features = ["derive"] }
 snafu = { version = "0.6.3" }
@@ -44,10 +42,11 @@ bincode2 = "2.0.1"
 subtle = { version = "2.2.3", default-features = false }
 base64 = "0.12.3"
 hex = "0.4.2"
-
 rand_chacha = { version = "0.2.2", default-features = false }
-rand_core = { version =  "0.5.1", default-features = false }
+rand_core = { version = "0.5.1", default-features = false }
 sha2 = { version = "0.9.1", default-features = false }
+ripemd160 = "0.9.1"
+secp256k1 = "0.19.0"
 
 [dev-dependencies]
 cosmwasm-schema = { version = "0.9.2" }
diff --git a/Makefile b/Makefile
index e6f520f..ac62518 100644
--- a/Makefile
+++ b/Makefile
@@ -71,9 +71,9 @@ contract.wasm.gz: contract.wasm
 .PHONY: start-server
 start-server: # CTRL+C to stop
 	docker run -it --rm \
-		-p 26657:26657 -p 26656:26656 -p 1317:1317 \
+		-p 26657:26657 -p 26656:26656 -p 1337:1337 \
 		-v $$(pwd):/root/code \
-		--name secretdev enigmampc/secret-network-sw-dev:v1.0.4-3
+		--name secretdev enigmampc/secret-network-sw-dev:v1.0.4-5
 
 .PHONY: schema
 schema:
diff --git a/schema/handle_answer.json b/schema/handle_answer.json
index ffd8a10..675fdfa 100644
--- a/schema/handle_answer.json
+++ b/schema/handle_answer.json
@@ -492,6 +492,25 @@
           }
         }
       }
+    },
+    {
+      "type": "object",
+      "required": [
+        "revoke_pemit"
+      ],
+      "properties": {
+        "revoke_pemit": {
+          "type": "object",
+          "required": [
+            "status"
+          ],
+          "properties": {
+            "status": {
+              "$ref": "#/definitions/ResponseStatus"
+            }
+          }
+        }
+      }
     }
   ],
   "definitions": {
diff --git a/schema/handle_msg.json b/schema/handle_msg.json
index 41d5b1b..10ba231 100644
--- a/schema/handle_msg.json
+++ b/schema/handle_msg.json
@@ -127,6 +127,12 @@
             },
             "recipient": {
               "$ref": "#/definitions/HumanAddr"
+            },
+            "recipient_code_hash": {
+              "type": [
+                "string",
+                "null"
+              ]
             }
           }
         }
@@ -451,6 +457,12 @@
             },
             "recipient": {
               "$ref": "#/definitions/HumanAddr"
+            },
+            "recipient_code_hash": {
+              "type": [
+                "string",
+                "null"
+              ]
             }
           }
         }
@@ -771,6 +783,25 @@
           }
         }
       }
+    },
+    {
+      "type": "object",
+      "required": [
+        "revoke_permit"
+      ],
+      "properties": {
+        "revoke_permit": {
+          "type": "object",
+          "required": [
+            "permit_name"
+          ],
+          "properties": {
+            "permit_name": {
+              "type": "string"
+            }
+          }
+        }
+      }
     }
   ],
   "definitions": {
@@ -859,6 +890,12 @@
         },
         "recipient": {
           "$ref": "#/definitions/HumanAddr"
+        },
+        "recipient_code_hash": {
+          "type": [
+            "string",
+            "null"
+          ]
         }
       }
     },
@@ -894,6 +931,12 @@
         },
         "recipient": {
           "$ref": "#/definitions/HumanAddr"
+        },
+        "recipient_code_hash": {
+          "type": [
+            "string",
+            "null"
+          ]
         }
       }
     },
diff --git a/schema/query_msg.json b/schema/query_msg.json
index b16caf7..6979c18 100644
--- a/schema/query_msg.json
+++ b/schema/query_msg.json
@@ -180,11 +180,223 @@
           "type": "object"
         }
       }
+    },
+    {
+      "type": "object",
+      "required": [
+        "with_permit"
+      ],
+      "properties": {
+        "with_permit": {
+          "type": "object",
+          "required": [
+            "permit",
+            "query"
+          ],
+          "properties": {
+            "permit": {
+              "$ref": "#/definitions/Permit"
+            },
+            "query": {
+              "$ref": "#/definitions/QueryWithPermit"
+            }
+          }
+        }
+      }
     }
   ],
   "definitions": {
+    "Binary": {
+      "description": "Binary is a wrapper around Vec<u8> to add base64 de/serialization with serde. It also adds some helper methods to help encode inline.\n\nThis is only needed as serde-json-{core,wasm} has a horrible encoding for Vec<u8>",
+      "type": "string"
+    },
     "HumanAddr": {
       "type": "string"
+    },
+    "Permission": {
+      "type": "string",
+      "enum": [
+        "allowance",
+        "balance",
+        "history",
+        "owner"
+      ]
+    },
+    "Permit": {
+      "type": "object",
+      "required": [
+        "params",
+        "signature"
+      ],
+      "properties": {
+        "params": {
+          "$ref": "#/definitions/PermitParams"
+        },
+        "signature": {
+          "$ref": "#/definitions/PermitSignature"
+        }
+      }
+    },
+    "PermitParams": {
+      "type": "object",
+      "required": [
+        "allowed_tokens",
+        "chain_id",
+        "permissions",
+        "permit_name"
+      ],
+      "properties": {
+        "allowed_tokens": {
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/HumanAddr"
+          }
+        },
+        "chain_id": {
+          "type": "string"
+        },
+        "permissions": {
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/Permission"
+          }
+        },
+        "permit_name": {
+          "type": "string"
+        }
+      }
+    },
+    "PermitSignature": {
+      "type": "object",
+      "required": [
+        "pub_key",
+        "signature"
+      ],
+      "properties": {
+        "pub_key": {
+          "$ref": "#/definitions/PubKey"
+        },
+        "signature": {
+          "$ref": "#/definitions/Binary"
+        }
+      }
+    },
+    "PubKey": {
+      "type": "object",
+      "required": [
+        "type",
+        "value"
+      ],
+      "properties": {
+        "type": {
+          "description": "ignored, but must be \"tendermint/PubKeySecp256k1\" otherwise the verification will fail",
+          "type": "string"
+        },
+        "value": {
+          "description": "Secp256k1 PubKey",
+          "allOf": [
+            {
+              "$ref": "#/definitions/Binary"
+            }
+          ]
+        }
+      }
+    },
+    "QueryWithPermit": {
+      "anyOf": [
+        {
+          "type": "object",
+          "required": [
+            "allowance"
+          ],
+          "properties": {
+            "allowance": {
+              "type": "object",
+              "required": [
+                "owner",
+                "spender"
+              ],
+              "properties": {
+                "owner": {
+                  "$ref": "#/definitions/HumanAddr"
+                },
+                "spender": {
+                  "$ref": "#/definitions/HumanAddr"
+                }
+              }
+            }
+          }
+        },
+        {
+          "type": "object",
+          "required": [
+            "balance"
+          ],
+          "properties": {
+            "balance": {
+              "type": "object"
+            }
+          }
+        },
+        {
+          "type": "object",
+          "required": [
+            "transfer_history"
+          ],
+          "properties": {
+            "transfer_history": {
+              "type": "object",
+              "required": [
+                "page_size"
+              ],
+              "properties": {
+                "page": {
+                  "type": [
+                    "integer",
+                    "null"
+                  ],
+                  "format": "uint32",
+                  "minimum": 0.0
+                },
+                "page_size": {
+                  "type": "integer",
+                  "format": "uint32",
+                  "minimum": 0.0
+                }
+              }
+            }
+          }
+        },
+        {
+          "type": "object",
+          "required": [
+            "transaction_history"
+          ],
+          "properties": {
+            "transaction_history": {
+              "type": "object",
+              "required": [
+                "page_size"
+              ],
+              "properties": {
+                "page": {
+                  "type": [
+                    "integer",
+                    "null"
+                  ],
+                  "format": "uint32",
+                  "minimum": 0.0
+                },
+                "page_size": {
+                  "type": "integer",
+                  "format": "uint32",
+                  "minimum": 0.0
+                }
+              }
+            }
+          }
+        }
+      ]
     }
   }
 }
diff --git a/src/contract.rs b/src/contract.rs
index 9bfefbe..9ecbdc0 100644
--- a/src/contract.rs
+++ b/src/contract.rs
@@ -7,6 +7,7 @@ use cosmwasm_std::{
 };
 
 use crate::batch;
+use crate::msg::QueryWithPermit;
 use crate::msg::{
     space_pad, ContractStatusLevel, HandleAnswer, HandleMsg, InitMsg, QueryAnswer, QueryMsg,
     ResponseStatus::Success,
@@ -21,9 +22,11 @@ use crate::transaction_history::{
     get_transfers, get_txs, store_burn, store_deposit, store_mint, store_redeem, store_transfer,
 };
 use crate::viewing_key::{ViewingKey, VIEWING_KEY_SIZE};
+use secret_toolkit::permit::{validate, Permission, Permit, RevokedPermits};
 
 /// We make sure that responses from `handle` are padded to a multiple of this size.
 pub const RESPONSE_BLOCK_SIZE: usize = 256;
+pub const PREFIX_REVOKED_PERMITS: &str = "revoked_permits";
 
 pub fn init<S: Storage, A: Api, Q: Querier>(
     deps: &mut Extern<S, A, Q>,
@@ -90,6 +93,7 @@ pub fn init<S: Storage, A: Api, Q: Querier>(
         redeem_is_enabled: init_config.redeem_enabled(),
         mint_is_enabled: init_config.mint_enabled(),
         burn_is_enabled: init_config.burn_enabled(),
+        contract_address: env.contract.address,
     })?;
     config.set_total_supply(total_supply);
     config.set_contract_status(ContractStatusLevel::NormalRun);
@@ -230,6 +234,7 @@ pub fn handle<S: Storage, A: Api, Q: Querier>(
         HandleMsg::AddMinters { minters, .. } => add_minters(deps, env, minters),
         HandleMsg::RemoveMinters { minters, .. } => remove_minters(deps, env, minters),
         HandleMsg::SetMinters { minters, .. } => set_minters(deps, env, minters),
+        HandleMsg::RevokePermit { permit_name, .. } => revoke_permit(deps, env, permit_name),
     };
 
     pad_response(response)
@@ -242,11 +247,76 @@ pub fn query<S: Storage, A: Api, Q: Querier>(deps: &Extern<S, A, Q>, msg: QueryM
         QueryMsg::ContractStatus {} => query_contract_status(&deps.storage),
         QueryMsg::ExchangeRate {} => query_exchange_rate(&deps.storage),
         QueryMsg::Minters { .. } => query_minters(deps),
-        _ => authenticated_queries(deps, msg),
+        QueryMsg::WithPermit { permit, query } => permit_queries(deps, permit, query),
+        _ => viewing_keys_queries(deps, msg),
     }
 }
 
-pub fn authenticated_queries<S: Storage, A: Api, Q: Querier>(
+fn permit_queries<S: Storage, A: Api, Q: Querier>(
+    deps: &Extern<S, A, Q>,
+    permit: Permit,
+    query: QueryWithPermit,
+) -> Result<Binary, StdError> {
+    // Validate permit content
+    let token_address = ReadonlyConfig::from_storage(&deps.storage)
+        .constants()?
+        .contract_address;
+
+    let account = validate(deps, PREFIX_REVOKED_PERMITS, &permit, token_address)?;
+
+    // Permit validated! We can now execute the query.
+    match query {
+        QueryWithPermit::Balance {} => {
+            if !permit.check_permission(&Permission::Balance) {
+                return Err(StdError::generic_err(format!(
+                    "No permission to query balance, got permissions {:?}",
+                    permit.params.permissions
+                )));
+            }
+
+            query_balance(deps, &account)
+        }
+        QueryWithPermit::TransferHistory { page, page_size } => {
+            if !permit.check_permission(&Permission::History) {
+                return Err(StdError::generic_err(format!(
+                    "No permission to query history, got permissions {:?}",
+                    permit.params.permissions
+                )));
+            }
+
+            query_transfers(deps, &account, page.unwrap_or(0), page_size)
+        }
+        QueryWithPermit::TransactionHistory { page, page_size } => {
+            if !permit.check_permission(&Permission::History) {
+                return Err(StdError::generic_err(format!(
+                    "No permission to query history, got permissions {:?}",
+                    permit.params.permissions
+                )));
+            }
+
+            query_transactions(deps, &account, page.unwrap_or(0), page_size)
+        }
+        QueryWithPermit::Allowance { owner, spender } => {
+            if !permit.check_permission(&Permission::Allowance) {
+                return Err(StdError::generic_err(format!(
+                    "No permission to query allowance, got permissions {:?}",
+                    permit.params.permissions
+                )));
+            }
+
+            if account != owner && account != spender {
+                return Err(StdError::generic_err(format!(
+                    "Cannot query allowance. Requires permit for either owner {:?} or spender {:?}, got permit for {:?}",
+                    owner.as_str(), spender.as_str(), account.as_str()
+                )));
+            }
+
+            query_allowance(deps, owner, spender)
+        }
+    }
+}
+
+pub fn viewing_keys_queries<S: Storage, A: Api, Q: Querier>(
     deps: &Extern<S, A, Q>,
     msg: QueryMsg,
 ) -> QueryResult {
@@ -264,28 +334,28 @@ pub fn authenticated_queries<S: Storage, A: Api, Q: Querier>(
         } else if key.check_viewing_key(expected_key.unwrap().as_slice()) {
             return match msg {
                 // Base
-                QueryMsg::Balance { address, .. } => query_balance(&deps, &address),
+                QueryMsg::Balance { address, .. } => query_balance(deps, &address),
                 QueryMsg::TransferHistory {
                     address,
                     page,
                     page_size,
                     ..
-                } => query_transfers(&deps, &address, page.unwrap_or(0), page_size),
+                } => query_transfers(deps, &address, page.unwrap_or(0), page_size),
                 QueryMsg::TransactionHistory {
                     address,
                     page,
                     page_size,
                     ..
-                } => query_transactions(&deps, &address, page.unwrap_or(0), page_size),
+                } => query_transactions(deps, &address, page.unwrap_or(0), page_size),
                 QueryMsg::Allowance { owner, spender, .. } => query_allowance(deps, owner, spender),
                 _ => panic!("This query type does not require authentication"),
             };
         }
     }
 
-    Ok(to_binary(&QueryAnswer::ViewingKeyError {
+    to_binary(&QueryAnswer::ViewingKeyError {
         msg: "Wrong viewing key for this address or viewing key not set".to_string(),
-    })?)
+    })
 }
 
 fn query_exchange_rate<S: ReadonlyStorage>(storage: &S) -> QueryResult {
@@ -1611,6 +1681,25 @@ fn perform_transfer<T: Storage>(
     Ok(())
 }
 
+fn revoke_permit<S: Storage, A: Api, Q: Querier>(
+    deps: &mut Extern<S, A, Q>,
+    env: Env,
+    permit_name: String,
+) -> StdResult<HandleResponse> {
+    RevokedPermits::revoke_permit(
+        &mut deps.storage,
+        PREFIX_REVOKED_PERMITS,
+        &env.message.sender,
+        &permit_name,
+    );
+
+    Ok(HandleResponse {
+        messages: vec![],
+        log: vec![],
+        data: Some(to_binary(&HandleAnswer::RevokePemit { status: Success })?),
+    })
+}
+
 fn is_admin<S: Storage>(config: &Config<S>, account: &HumanAddr) -> StdResult<bool> {
     let consts = config.constants()?;
     if &consts.admin != account {
diff --git a/src/msg.rs b/src/msg.rs
index 650aad0..2f830c4 100644
--- a/src/msg.rs
+++ b/src/msg.rs
@@ -3,11 +3,11 @@
 use schemars::JsonSchema;
 use serde::{Deserialize, Serialize};
 
-use cosmwasm_std::{Binary, HumanAddr, StdError, StdResult, Uint128};
-
 use crate::batch;
 use crate::transaction_history::{RichTx, Tx};
 use crate::viewing_key::ViewingKey;
+use cosmwasm_std::{Binary, HumanAddr, StdError, StdResult, Uint128};
+use secret_toolkit::permit::Permit;
 
 #[derive(Serialize, Deserialize, Clone, PartialEq, JsonSchema)]
 pub struct InitialBalance {
@@ -212,6 +212,11 @@ pub enum HandleMsg {
         level: ContractStatusLevel,
         padding: Option<String>,
     },
+
+    // Permit
+    RevokePermit {
+        permit_name: String,
+    },
 }
 
 #[derive(Serialize, Deserialize, JsonSchema, Debug)]
@@ -305,9 +310,14 @@ pub enum HandleAnswer {
     SetContractStatus {
         status: ResponseStatus,
     },
+
+    // Permit
+    RevokePemit {
+        status: ResponseStatus,
+    },
 }
 
-#[derive(Serialize, Deserialize, Clone, Debug, PartialEq, JsonSchema)]
+#[derive(Deserialize, Clone, Debug, PartialEq, JsonSchema)]
 #[serde(rename_all = "snake_case")]
 pub enum QueryMsg {
     TokenInfo {},
@@ -336,6 +346,10 @@ pub enum QueryMsg {
         page_size: u32,
     },
     Minters {},
+    WithPermit {
+        permit: Permit,
+        query: QueryWithPermit,
+    },
 }
 
 impl QueryMsg {
@@ -357,6 +371,24 @@ impl QueryMsg {
     }
 }
 
+#[derive(Serialize, Deserialize, Clone, Debug, PartialEq, JsonSchema)]
+#[serde(rename_all = "snake_case")]
+pub enum QueryWithPermit {
+    Allowance {
+        owner: HumanAddr,
+        spender: HumanAddr,
+    },
+    Balance {},
+    TransferHistory {
+        page: Option<u32>,
+        page_size: u32,
+    },
+    TransactionHistory {
+        page: Option<u32>,
+        page_size: u32,
+    },
+}
+
 #[derive(Serialize, Deserialize, JsonSchema, Debug)]
 #[serde(rename_all = "snake_case")]
 pub enum QueryAnswer {
diff --git a/src/state.rs b/src/state.rs
index a9d9a6a..b42c950 100644
--- a/src/state.rs
+++ b/src/state.rs
@@ -47,6 +47,8 @@ pub struct Constants {
     pub mint_is_enabled: bool,
     // is burn enabled
     pub burn_is_enabled: bool,
+    // the address of this contract, used to validate query permits
+    pub contract_address: HumanAddr,
 }
 
 pub struct ReadonlyConfig<'a, S: ReadonlyStorage> {
diff --git a/src/transaction_history.rs b/src/transaction_history.rs
index 0815808..a7debe6 100644
--- a/src/transaction_history.rs
+++ b/src/transaction_history.rs
@@ -321,18 +321,18 @@ pub fn store_transfer<S: Storage>(
 
     // Write to the owners history if it's different from the other two addresses
     if owner != sender && owner != receiver {
-        cosmwasm_std::debug_print("saving transaction history for owner");
+        // cosmwasm_std::debug_print("saving transaction history for owner");
         append_tx(store, &tx, owner)?;
         append_transfer(store, &transfer, owner)?;
     }
     // Write to the sender's history if it's different from the receiver
     if sender != receiver {
-        cosmwasm_std::debug_print("saving transaction history for sender");
+        // cosmwasm_std::debug_print("saving transaction history for sender");
         append_tx(store, &tx, sender)?;
         append_transfer(store, &transfer, sender)?;
     }
     // Always write to the recipient's history
-    cosmwasm_std::debug_print("saving transaction history for receiver");
+    // cosmwasm_std::debug_print("saving transaction history for receiver");
     append_tx(store, &tx, receiver)?;
     append_transfer(store, &transfer, receiver)?;
 
diff --git a/tests/integration.sh b/tests/integration.sh
index 5291e8e..084f383 100755
--- a/tests/integration.sh
+++ b/tests/integration.sh
@@ -526,6 +526,177 @@ function test_viewing_key() {
     fi
 }
 
+function test_permit() {
+    set -e
+    local contract_addr="$1"
+
+    log_test_header
+
+    # common variables
+    local result
+    local tx_hash
+
+    # fail due to token not in permit
+    secretcli keys delete banana -f || true
+    secretcli keys add banana
+    local wrong_contract=$(secretcli keys show -a banana)
+
+    local permit
+    permit='{"account_number":"0","sequence":"0","chain_id":"blabla","msgs":[{"type":"query_permit","value":{"permit_name":"test","allowed_tokens":["'"$wrong_contract"'"],"permissions":["balance"]}}],"fee":{"amount":[{"denom":"uscrt","amount":"0"}],"gas":"1"},"memo":""}'
+    local permit_query
+    local expected_error="ERROR: query result: encrypted: Permit doesn't apply to token \"$contract_addr\", allowed tokens: [\"$wrong_contract\"]"
+    for key in "${KEY[@]}"; do
+        log "permit querying balance for \"$key\" with wrong permit for that contract"
+        permit=$(docker exec secretdev bash -c "/usr/bin/secretcli tx sign-doc <(echo '"$permit"') --from '$key'")
+        permit_query='{"with_permit":{"query":{"balance":{}},"permit":{"params":{"permit_name":"test","chain_id":"blabla","allowed_tokens":["'"$wrong_contract"'"],"permissions":["balance"]},"signature":'"$permit"'}}}'
+        result="$(compute_query "$contract_addr" "$permit_query" 2>&1 || true)"
+        assert_eq "$result" "$expected_error"
+    done
+
+    # fail due to revoked permit
+    local permit
+    wrong_permit='{"account_number":"0","sequence":"0","chain_id":"blabla","msgs":[{"type":"query_permit","value":{"permit_name":"to_be_revoked","allowed_tokens":["'"$contract_addr"'"],"permissions":["balance"]}}],"fee":{"amount":[{"denom":"uscrt","amount":"0"}],"gas":"1"},"memo":""}'
+    local permit_query
+    local expected_error
+    for key in "${KEY[@]}"; do
+        log "permit querying balance for \"$key\" with a revoked permit"
+        permit=$(docker exec secretdev bash -c "/usr/bin/secretcli tx sign-doc <(echo '"$wrong_permit"') --from '$key'")
+        tx_hash="$(compute_execute "$contract_addr" '{"revoke_permit":{"permit_name":"to_be_revoked"}}' ${FROM[$key]} --gas 250000)"
+        wait_for_compute_tx "$tx_hash" "waiting for revoke_permit from \"$key\" to process"
+
+        permit_query='{"with_permit":{"query":{"balance":{}},"permit":{"params":{"permit_name":"to_be_revoked","chain_id":"blabla","allowed_tokens":["'"$contract_addr"'"],"permissions":["balance"]},"signature":'"$permit"'}}}'
+        expected_error="ERROR: query result: encrypted: Permit \"to_be_revoked\" was revoked by account \"${ADDRESS[$key]}\""
+        result="$(compute_query "$contract_addr" "$permit_query" 2>&1 || true)"
+        assert_eq "$result" "$expected_error"
+    done
+
+    # fail due to params not matching params that were signed on
+    local permit
+    wrong_permit='{"account_number":"0","sequence":"0","chain_id":"blabla","msgs":[{"type":"query_permit","value":{"permit_name":"test","allowed_tokens":["'"$contract_addr"'"],"permissions":["balance"]}}],"fee":{"amount":[{"denom":"uscrt","amount":"0"}],"gas":"1"},"memo":""}'
+    local permit_query
+    local expected_error
+    for key in "${KEY[@]}"; do
+        log "permit querying balance for \"$key\" with params not matching permit"
+        permit=$(docker exec secretdev bash -c "/usr/bin/secretcli tx sign-doc <(echo '"$wrong_permit"') --from '$key'")
+        permit_query='{"with_permit":{"query":{"balance":{}},"permit":{"params":{"permit_name":"test","chain_id":"not_blabla","allowed_tokens":["'"$contract_addr"'"],"permissions":["balance"]},"signature":'"$permit"'}}}'
+        expected_error="ERROR: query result: encrypted: Failed to verify signatures for the given permit: IncorrectSignature"
+        result="$(compute_query "$contract_addr" "$permit_query" 2>&1 || true)"
+        assert_eq "$result" "$expected_error"
+    done
+
+    # fail balance query due to no balance permission
+    local permit
+    wrong_permit='{"account_number":"0","sequence":"0","chain_id":"blabla","msgs":[{"type":"query_permit","value":{"permit_name":"test","allowed_tokens":["'"$contract_addr"'"],"permissions":["history"]}}],"fee":{"amount":[{"denom":"uscrt","amount":"0"}],"gas":"1"},"memo":""}'
+    local permit_query
+    local expected_error
+    for key in "${KEY[@]}"; do
+        log "permit querying balance for \"$key\" without the right permission"
+        permit=$(docker exec secretdev bash -c "/usr/bin/secretcli tx sign-doc <(echo '"$wrong_permit"') --from '$key'")
+        permit_query='{"with_permit":{"query":{"balance":{}},"permit":{"params":{"permit_name":"test","chain_id":"blabla","allowed_tokens":["'"$contract_addr"'"],"permissions":["history"]},"signature":'"$permit"'}}}'
+        expected_error="ERROR: query result: encrypted: No permission to query balance, got permissions [History]"
+        result="$(compute_query "$contract_addr" "$permit_query" 2>&1 || true)"
+        assert_eq "$result" "$expected_error"
+    done
+
+    # fail history query due to no history permission
+    local permit
+    wrong_permit='{"account_number":"0","sequence":"0","chain_id":"blabla","msgs":[{"type":"query_permit","value":{"permit_name":"test","allowed_tokens":["'"$contract_addr"'"],"permissions":["balance"]}}],"fee":{"amount":[{"denom":"uscrt","amount":"0"}],"gas":"1"},"memo":""}'
+    local permit_query
+    local expected_error
+    for key in "${KEY[@]}"; do
+        log "permit querying history for \"$key\" without the right permission"
+        permit=$(docker exec secretdev bash -c "/usr/bin/secretcli tx sign-doc <(echo '"$wrong_permit"') --from '$key'")
+        
+        permit_query='{"with_permit":{"query":{"transfer_history":{"page_size":10}},"permit":{"params":{"permit_name":"test","chain_id":"blabla","allowed_tokens":["'"$contract_addr"'"],"permissions":["balance"]},"signature":'"$permit"'}}}'
+        expected_error="ERROR: query result: encrypted: No permission to query history, got permissions [Balance]"
+        result="$(compute_query "$contract_addr" "$permit_query" 2>&1 || true)"
+        assert_eq "$result" "$expected_error"
+
+        permit_query='{"with_permit":{"query":{"transaction_history":{"page_size":10}},"permit":{"params":{"permit_name":"test","chain_id":"blabla","allowed_tokens":["'"$contract_addr"'"],"permissions":["balance"]},"signature":'"$permit"'}}}'
+        expected_error="ERROR: query result: encrypted: No permission to query history, got permissions [Balance]"
+        result="$(compute_query "$contract_addr" "$permit_query" 2>&1 || true)"
+        assert_eq "$result" "$expected_error"
+    done
+
+    # fail allowance query due to no allowance permission
+    local permit
+    wrong_permit='{"account_number":"0","sequence":"0","chain_id":"blabla","msgs":[{"type":"query_permit","value":{"permit_name":"test","allowed_tokens":["'"$contract_addr"'"],"permissions":["history"]}}],"fee":{"amount":[{"denom":"uscrt","amount":"0"}],"gas":"1"},"memo":""}'
+    local permit_query
+    local expected_error
+    for key in "${KEY[@]}"; do
+        log "permit querying allowance for \"$key\" without the right permission"
+        permit=$(docker exec secretdev bash -c "/usr/bin/secretcli tx sign-doc <(echo '"$wrong_permit"') --from '$key'")
+        permit_query='{"with_permit":{"query":{"allowance":{"owner":"'"${ADDRESS[$key]}"'","spender":"'"${ADDRESS[$key]}"'"}},"permit":{"params":{"permit_name":"test","chain_id":"blabla","allowed_tokens":["'"$contract_addr"'"],"permissions":["history"]},"signature":'"$permit"'}}}'
+        expected_error="ERROR: query result: encrypted: No permission to query allowance, got permissions [History]"
+        result="$(compute_query "$contract_addr" "$permit_query" 2>&1 || true)"
+        assert_eq "$result" "$expected_error"
+    done
+
+    # fail allowance query due to no permit signer not owner or spender
+    local permit
+    wrong_permit='{"account_number":"0","sequence":"0","chain_id":"blabla","msgs":[{"type":"query_permit","value":{"permit_name":"test","allowed_tokens":["'"$contract_addr"'"],"permissions":["allowance"]}}],"fee":{"amount":[{"denom":"uscrt","amount":"0"}],"gas":"1"},"memo":""}'
+    local permit_query
+    local expected_error
+    log "permit querying allowance without signer being the owner or spender"
+    permit=$(docker exec secretdev bash -c "/usr/bin/secretcli tx sign-doc <(echo '"$wrong_permit"') --from a")
+    permit_query='{"with_permit":{"query":{"allowance":{"owner":"'"$wrong_contract"'","spender":"'"$wrong_contract"'"}},"permit":{"params":{"permit_name":"test","chain_id":"blabla","allowed_tokens":["'"$contract_addr"'"],"permissions":["allowance"]},"signature":'"$permit"'}}}'
+    expected_error="ERROR: query result: encrypted: Cannot query allowance. Requires permit for either owner \"$wrong_contract\" or spender \"$wrong_contract\", got permit for \"${ADDRESS[a]}\""
+    result="$(compute_query "$contract_addr" "$permit_query" 2>&1 || true)"
+    assert_eq "$result" "$expected_error"
+
+    # succeed balance query
+    local permit
+    local good_permit
+    good_permit='{"account_number":"0","sequence":"0","chain_id":"blabla","msgs":[{"type":"query_permit","value":{"permit_name":"test","allowed_tokens":["'"$contract_addr"'"],"permissions":["balance"]}}],"fee":{"amount":[{"denom":"uscrt","amount":"0"}],"gas":"1"},"memo":""}'
+    local permit_query
+    local expected_output
+    for key in "${KEY[@]}"; do
+        log "permit querying balance for \"$key\""
+        permit=$(docker exec secretdev bash -c "/usr/bin/secretcli tx sign-doc <(echo '"$good_permit"') --from '$key'")
+        permit_query='{"with_permit":{"query":{"balance":{}},"permit":{"params":{"permit_name":"test","chain_id":"blabla","allowed_tokens":["'"$contract_addr"'"],"permissions":["balance"]},"signature":'"$permit"'}}}'
+        expected_output="{\"balance\":{\"amount\":\"0\"}}"
+        result="$(compute_query "$contract_addr" "$permit_query" 2>&1 || true)"
+        assert_eq "$result" "$expected_output"
+    done
+
+    # succeed history queries
+    local permit
+    local good_permit
+    good_permit='{"account_number":"0","sequence":"0","chain_id":"blabla","msgs":[{"type":"query_permit","value":{"permit_name":"test","allowed_tokens":["'"$contract_addr"'"],"permissions":["history"]}}],"fee":{"amount":[{"denom":"uscrt","amount":"0"}],"gas":"1"},"memo":""}'
+    local permit_query
+    local expected_output
+    for key in "${KEY[@]}"; do
+        log "permit querying history for \"$key\""
+        permit=$(docker exec secretdev bash -c "/usr/bin/secretcli tx sign-doc <(echo '"$good_permit"') --from '$key'")
+
+        permit_query='{"with_permit":{"query":{"transfer_history":{"page_size":10}},"permit":{"params":{"permit_name":"test","chain_id":"blabla","allowed_tokens":["'"$contract_addr"'"],"permissions":["history"]},"signature":'"$permit"'}}}'
+        expected_output="{\"transfer_history\":{\"txs\":[],\"total\":0}}"
+        result="$(compute_query "$contract_addr" "$permit_query" 2>&1 || true)"
+        assert_eq "$result" "$expected_output"
+
+        permit_query='{"with_permit":{"query":{"transaction_history":{"page_size":10}},"permit":{"params":{"permit_name":"test","chain_id":"blabla","allowed_tokens":["'"$contract_addr"'"],"permissions":["history"]},"signature":'"$permit"'}}}'
+        expected_output="{\"transaction_history\":{\"txs\":[],\"total\":0}}"
+        result="$(compute_query "$contract_addr" "$permit_query" 2>&1 || true)"
+        assert_eq "$result" "$expected_output"
+    done
+
+    # succeed allowance query
+    local permit
+    local good_permit
+    good_permit='{"account_number":"0","sequence":"0","chain_id":"blabla","msgs":[{"type":"query_permit","value":{"permit_name":"test","allowed_tokens":["'"$contract_addr"'"],"permissions":["allowance"]}}],"fee":{"amount":[{"denom":"uscrt","amount":"0"}],"gas":"1"},"memo":""}'
+    local permit_query
+    local expected_output
+    for key in "${KEY[@]}"; do
+        log "permit querying history for \"$key\""
+        permit=$(docker exec secretdev bash -c "/usr/bin/secretcli tx sign-doc <(echo '"$good_permit"') --from '$key'")
+
+        permit_query='{"with_permit":{"query":{"allowance":{"owner":"'"${ADDRESS[$key]}"'","spender":"'"${ADDRESS[$key]}"'"}},"permit":{"params":{"permit_name":"test","chain_id":"blabla","allowed_tokens":["'"$contract_addr"'"],"permissions":["allowance"]},"signature":'"$permit"'}}}'
+        expected_output="{\"allowance\":{\"spender\":\"${ADDRESS[$key]}\",\"owner\":\"${ADDRESS[$key]}\",\"allowance\":\"0\",\"expiration\":null}}"
+        result="$(compute_query "$contract_addr" "$permit_query" 2>&1 || true)"
+        assert_eq "$result" "$expected_output"
+    done
+}
+
 function test_deposit() {
     set -e
     local contract_addr="$1"
@@ -1455,6 +1626,7 @@ function main() {
 
     # This first test also sets the `VK[*]` global variables that are used in the other tests
     test_viewing_key "$contract_addr"
+    test_permit "$contract_addr"
     test_deposit "$contract_addr"
     test_transfer "$contract_addr"
     test_send "$contract_addr" register