@coti-io/coti-contracts 1.0.9 → 1.2.0

package/test/token/PrivateERC20/PrivateERC20.test.ts

@@ -2,19 +2,26 @@ import hre from "hardhat"
 import { expect } from "chai"
 
 import { setupAccounts } from "../../utils/accounts"
+import {
+    IPRIVATE_ERC20_INTERFACE_ID,
+    mintPublic,
+    burnPublic,
+    txOpts,
+    encryptItUint256,
+    decryptCtUint256,
+    expectTxFails
+} from "../../utils/privateErc20Helpers"
 import { PrivateERC20Mock, PrivateERC20WalletMock } from "../../../typechain-types"
-import { itUint, Wallet, ZeroAddress } from "@coti-io/coti-ethers"
-
-const GAS_LIMIT = 12000000
+import { Wallet } from "@coti-io/coti-ethers"
+import type { itUint256 } from "@coti-io/coti-sdk-typescript"
+import { ZeroAddress } from "ethers"
 
 async function deploy() {
     const [owner, otherAccount] = await setupAccounts()
 
     const tokenContract = await hre.ethers.getContractFactory("PrivateERC20Mock")
 
-    const token = await tokenContract
-        .connect(owner)
-        .deploy({ gasLimit: GAS_LIMIT })
+    const token = await tokenContract.connect(owner).deploy(txOpts)
 
     const contract = await token.waitForDeployment()
 
@@ -42,118 +49,102 @@ describe("Private ERC20", function () {
     })
 
     describe("deploy", function () {
-        it('has a name', async function () {
-            await expect(await contract.name()).to.equal("PrivateERC20Mock");
+        it("has a name", async function () {
+            await expect(await contract.name()).to.equal("PrivateERC20Mock")
+        })
+
+        it("has a symbol", async function () {
+            await expect(await contract.symbol()).to.equal("PE20M")
+        })
+
+        it("has 6 decimals", async function () {
+            await expect(await contract.decimals()).to.equal(6n)
+        })
+
+        it("totalSupply view is zero (privacy stance)", async function () {
+            await expect(await contract.totalSupply()).to.equal(0n)
         })
 
-        it('has a symbol', async function () {
-            await expect(await contract.symbol()).to.equal("PE20M");
+        it("publicAmountsEnabled is true by default", async function () {
+            await expect(await contract.publicAmountsEnabled()).to.equal(true)
         })
 
-        it('has 6 decimals', async function () {
-            await expect(await contract.decimals()).to.equal(6n);
+        it("supports ERC-165 and IPrivateERC20", async function () {
+            await expect(await contract.supportsInterface("0x01ffc9a7")).to.equal(true)
+            await expect(await contract.supportsInterface(IPRIVATE_ERC20_INTERFACE_ID)).to.equal(true)
+            await expect(await contract.supportsInterface("0xffffffff")).to.equal(false)
         })
     })
 
     describe("mint", function () {
         const value = 5000n
 
-        describe("successful mint", async function () {
+        describe("successful mint", function () {
             before("minting", async function () {
-                this.tx = await contract
-                    .connect(owner)
-                    .mint(owner.address, value, { gasLimit: GAS_LIMIT })
-                
+                this.tx = await mintPublic(contract, owner, owner.address, value)
                 await this.tx.wait()
             })
-            
-            it('does not increment totalSupply', async function () {
+
+            it("does not increment totalSupply", async function () {
                 await expect(await contract.totalSupply()).to.equal(0n)
             })
-            
-            it('increments recipient balance', async function () {
+
+            it("increments recipient balance", async function () {
                 const ctBalance = await contract["balanceOf(address)"](owner.address)
-                
-                const balance = await owner.decryptValue(ctBalance)
-                
+
+                const balance = decryptCtUint256(owner, ctBalance)
+
                 await expect(balance).to.equal(value)
             })
-            
-            it('emits Transfer event', async function () {
+
+            it("emits Transfer event", async function () {
                 await expect(this.tx).to.emit(contract, "Transfer")
             })
         })
-        
-        describe('failed mint', async function () {
-            it('rejects minting to the zero address', async function () {
-                await expect(
-                    contract
-                        .connect(owner)
-                        .mint(ZeroAddress, value)
-                    )
-                    .to.be.revertedWithCustomError(contract, "ERC20InvalidReceiver")
-                    .withArgs(ZeroAddress)
+
+        describe("failed mint", function () {
+            it("rejects minting to the zero address", async function () {
+                await expectTxFails(
+                    contract.connect(owner).getFunction("mint(address,uint256)")(ZeroAddress, value, txOpts)
+                )
             })
-    
-            // it('rejects overflow', async function () {
-            //     const tx = await contract
-            //         .connect(owner.wallet)
-            //         .mint(owner.wallet.address, (BigInt(2) ** BigInt(64)) - BigInt(1), { gasLimit: GAS_LIMIT })
-                
-            //     await tx.wait()
-    
-            //     await expect(tx).to.be.reverted
-            // })
         })
     })
 
     describe("burn", function () {
         const value = 5000n
-        
-        describe('failed burn', async function () {
-            it('rejects burning from the zero address', async function () {
-                await expect(
-                    contract
-                        .connect(owner)
-                        .burn(ZeroAddress, value)
-                    )
-                    .to.be.revertedWithCustomError(contract, "ERC20InvalidSender")
-                    .withArgs(ZeroAddress)
-            })
 
-            it('does not update balance when burning more than balance', async function () {
-                const tx = await contract
-                    .connect(owner)
-                    .burn(owner.address, value + 1n, { gasLimit: GAS_LIMIT })
-                
-                await tx.wait()
-                
-                const ctBalance = await contract["balanceOf(address)"](owner.address)
+        describe("failed burn", function () {
+            it("rejects burning from the zero address", async function () {
+                await expectTxFails(
+                    contract.connect(owner).getFunction("burn(address,uint256)")(ZeroAddress, value, txOpts)
+                )
+            })
 
-                const balance = await owner.decryptValue(ctBalance)
-    
-                await expect(balance).to.equal(value)
+            it("reverts when burning more than balance (no Transfer)", async function () {
+                await expectTxFails(
+                    contract
+                        .connect(owner)
+                        .getFunction("burn(address,uint256)")(owner.address, value + 1n, txOpts)
+                )
             })
         })
 
-        describe('successful burn', async function () {
+        describe("successful burn", function () {
             before("burning", async function () {
-                this.tx = await contract
-                    .connect(owner)
-                    .burn(owner.address, value, { gasLimit: GAS_LIMIT })
-                
+                this.tx = await burnPublic(contract, owner, owner.address, value)
                 await this.tx.wait()
             })
 
-            it('decrements the senders balance', async function () {
+            it("decrements the senders balance", async function () {
                 const ctBalance = await contract["balanceOf(address)"](owner.address)
 
-                const balance = await owner.decryptValue(ctBalance)
-    
+                const balance = decryptCtUint256(owner, ctBalance)
+
                 await expect(balance).to.equal(0n)
             })
 
-            it('emits Transfer event', async function () {
+            it("emits Transfer event", async function () {
                 await expect(this.tx).to.emit(contract, "Transfer")
             })
         })
@@ -163,76 +154,78 @@ describe("Private ERC20", function () {
         const value = 10000n
 
         before("minting", async function () {
-            this.tx = await contract
-                .connect(owner)
-                .mint(owner.address, value, { gasLimit: GAS_LIMIT })
-            
+            this.tx = await mintPublic(contract, owner, owner.address, value)
             await this.tx.wait()
         })
 
-        describe("failed transfer", async function () {
-            it('rejects transferring to the zero address', async function () {
-                const itValue = await owner.encryptValue(value, contractAddress, contract["transfer(address,(uint256,bytes))"].fragment.selector) as itUint
-    
+        describe("failed transfer", function () {
+            it("rejects transferring to the zero address", async function () {
+                const itValue = (await encryptItUint256(owner,
+                    value,
+                    contractAddress,
+                    contract.interface.getFunction("transfer(address,((uint256,uint256),bytes))").selector
+                )) as itUint256
+
                 await expect(
                     contract
                         .connect(owner)
-                        ["transfer(address,(uint256,bytes))"]
-                        (ZeroAddress, itValue)
-                    )
+                        .getFunction("transfer(address,((uint256,uint256),bytes))")(ZeroAddress, itValue)
+                )
                     .to.be.revertedWithCustomError(contract, "ERC20InvalidReceiver")
                     .withArgs(ZeroAddress)
             })
 
-            it('does not transfer tokens when amount exceeds balance', async function () {
-                const itValue = await owner.encryptValue(value + 1n, contractAddress, contract["transfer(address,(uint256,bytes))"].fragment.selector) as itUint
-
-                const tx = await contract
-                    .connect(owner)
-                    ["transfer(address,(uint256,bytes))"]
-                    (otherAccount.address, itValue, { gasLimit: GAS_LIMIT })
-                
-                await tx.wait()
-
-                let ctBalance = await contract["balanceOf(address)"](owner.address)
-
-                let balance = await owner.decryptValue(ctBalance)
-    
-                await expect(balance).to.equal(value)
-
-                ctBalance = await contract["balanceOf(address)"](otherAccount.address)
+            it("reverts when amount exceeds balance (no Transfer)", async function () {
+                const itValue = (await encryptItUint256(owner,
+                    value + 1n,
+                    contractAddress,
+                    contract.interface.getFunction("transfer(address,((uint256,uint256),bytes))").selector
+                )) as itUint256
 
-                balance = await otherAccount.decryptValue(ctBalance)
-    
-                await expect(balance).to.equal(0n)
+                await expectTxFails(
+                    contract
+                        .connect(owner)
+                        .getFunction("transfer(address,((uint256,uint256),bytes))")(
+                            otherAccount.address,
+                            itValue,
+                            txOpts
+                        )
+                )
             })
         })
 
-        describe("successful transfer", async function () {
+        describe("successful transfer", function () {
             before("transferring", async function () {
-                const itValue = await owner.encryptValue(value / 2n, contractAddress, contract["transfer(address,(uint256,bytes))"].fragment.selector) as itUint
+                const itValue = (await encryptItUint256(owner,
+                    value / 2n,
+                    contractAddress,
+                    contract.interface.getFunction("transfer(address,((uint256,uint256),bytes))").selector
+                )) as itUint256
 
                 const tx = await contract
                     .connect(owner)
-                    ["transfer(address,(uint256,bytes))"]
-                    (otherAccount.address, itValue, { gasLimit: GAS_LIMIT })
-                
+                    .getFunction("transfer(address,((uint256,uint256),bytes))")(
+                        otherAccount.address,
+                        itValue,
+                        txOpts
+                    )
+
                 await tx.wait()
             })
 
-            it('decrements the senders balance', async function () {
+            it("decrements the senders balance", async function () {
                 const ctBalance = await contract["balanceOf(address)"](owner.address)
 
-                const balance = await owner.decryptValue(ctBalance)
-    
+                const balance = decryptCtUint256(owner, ctBalance)
+
                 await expect(balance).to.equal(value / 2n)
             })
 
-            it('increments the receivers balance', async function () {
+            it("increments the receivers balance", async function () {
                 const ctBalance = await contract["balanceOf(address)"](otherAccount.address)
 
-                const balance = await otherAccount.decryptValue(ctBalance)
-    
+                const balance = decryptCtUint256(otherAccount, ctBalance)
+
                 await expect(balance).to.equal(value / 2n)
             })
         })
@@ -241,135 +234,187 @@ describe("Private ERC20", function () {
     describe("approve", function () {
         const value = 5000n
 
-        describe("failed approval", async function () {
-            it('rejects when approving the zero address', async function () {
-                const itValue = await owner.encryptValue(value, contractAddress, contract["transfer(address,(uint256,bytes))"].fragment.selector) as itUint
-    
+        describe("failed approval", function () {
+            it("rejects when approving the zero address", async function () {
+                const itValue = (await encryptItUint256(owner,
+                    value,
+                    contractAddress,
+                    contract.interface.getFunction("approve(address,((uint256,uint256),bytes))").selector
+                )) as itUint256
+
                 await expect(
                     contract
                         .connect(owner)
-                        ["approve(address,(uint256,bytes))"]
-                        (ZeroAddress, itValue)
-                    )
+                        .getFunction("approve(address,((uint256,uint256),bytes))")(ZeroAddress, itValue)
+                )
                     .to.be.revertedWithCustomError(contract, "ERC20InvalidSpender")
                     .withArgs(ZeroAddress)
             })
         })
 
-        describe("successful approval", async function () {
-            before('approving', async function () {
-                const itValue = await owner.encryptValue(value, contractAddress, contract["approve(address,(uint256,bytes))"].fragment.selector) as itUint
+        describe("successful approval", function () {
+            before("approving", async function () {
+                const itValue = (await encryptItUint256(owner,
+                    value,
+                    contractAddress,
+                    contract.interface.getFunction("approve(address,((uint256,uint256),bytes))").selector
+                )) as itUint256
 
                 const tx = await contract
                     .connect(owner)
-                    ["approve(address,(uint256,bytes))"]
-                    (otherAccount.address, itValue, { gasLimit: GAS_LIMIT })
-    
+                    .getFunction("approve(address,((uint256,uint256),bytes))")(otherAccount.address, itValue, txOpts)
+
                 await tx.wait()
             })
 
-            it('increment the allowance encrypted with the owners key', async function () {
-                const ctAllowance = await contract
-                    ["allowance(address,address)"]
-                    (owner.address, otherAccount.address)
-                
-                const allowance = await owner.decryptValue(ctAllowance[1])
+            it("stores allowance ciphertext for owner view", async function () {
+                const ctAllowance = await contract["allowance(address,address)"](owner.address, otherAccount.address)
+
+                const allowance = decryptCtUint256(owner, ctAllowance.ownerCiphertext)
 
                 await expect(allowance).to.equal(value)
             })
 
-            it('increment the allowance encrypted with the spenders key', async function () {
-                const ctAllowance = await contract
-                    ["allowance(address,address)"]
-                    (owner.address, otherAccount.address)
-                
-                const allowance = await otherAccount.decryptValue(ctAllowance[2])
+            it("stores allowance ciphertext for spender view", async function () {
+                const ctAllowance = await contract["allowance(address,address)"](owner.address, otherAccount.address)
+
+                const allowance = decryptCtUint256(otherAccount, ctAllowance.spenderCiphertext)
 
                 await expect(allowance).to.equal(value)
             })
         })
     })
 
-    describe('transferFrom', function () {
+    describe("transferFrom", function () {
         const value = 3000n
 
-        describe('failed transferFrom', async function () {
-            it('rejects transferring to the zero address', async function () {
-                const itValue = await otherAccount.encryptValue(value, contractAddress, contract["transferFrom(address,address,(uint256,bytes))"].fragment.selector)as itUint
-    
+        describe("failed transferFrom", function () {
+            it("rejects transferring to the zero address", async function () {
+                const itValue = (await encryptItUint256(otherAccount,
+                    value,
+                    contractAddress,
+                    contract.interface.getFunction("transferFrom(address,address,((uint256,uint256),bytes))").selector
+                )) as itUint256
+
                 await expect(
                     contract
                         .connect(otherAccount)
-                        ["transferFrom(address,address,(uint256,bytes))"]
-                        (owner.address, ZeroAddress, itValue)
-                    )
+                        .getFunction("transferFrom(address,address,((uint256,uint256),bytes))")
+                        .staticCall(owner.address, ZeroAddress, itValue)
+                )
                     .to.be.revertedWithCustomError(contract, "ERC20InvalidReceiver")
                     .withArgs(ZeroAddress)
             })
 
-            describe("transferring more than the owners balance", async function () {
-                before("transferring", async function () {
-                    const itValue = await otherAccount.encryptValue(2n * value, contractAddress, contract["transferFrom(address,address,(uint256,bytes))"].fragment.selector)as itUint
+            it("rejects from zero address", async function () {
+                const itValue = (await encryptItUint256(otherAccount,
+                    value,
+                    contractAddress,
+                    contract.interface.getFunction("transferFrom(address,address,((uint256,uint256),bytes))").selector
+                )) as itUint256
 
-                    const tx = await contract
+                await expect(
+                    contract
                         .connect(otherAccount)
-                        ["transferFrom(address,address,(uint256,bytes))"]
-                        (owner.address, "0x0000000000000000000000000000000000000001", itValue)
-                    
-                    await tx.wait()
-                })
+                        .getFunction("transferFrom(address,address,((uint256,uint256),bytes))")
+                        .staticCall(ZeroAddress, otherAccount.address, itValue)
+                ).to.be.revertedWithCustomError(contract, "ERC20InvalidSender")
+            })
 
-                it("does not decrement the owners balance", async function () {
-                    const ctBalance = await contract["balanceOf(address)"](owner.address)
+            it("reverts when allowance is insufficient", async function () {
+                const itValue = (await encryptItUint256(otherAccount,
+                    999999n,
+                    contractAddress,
+                    contract.interface.getFunction("transferFrom(address,address,((uint256,uint256),bytes))").selector
+                )) as itUint256
 
-                    const balance = await owner.decryptValue(ctBalance)
-        
-                    await expect(balance).to.equal(5000n)
-                })
+                await expectTxFails(
+                    contract
+                        .connect(otherAccount)
+                        .getFunction("transferFrom(address,address,((uint256,uint256),bytes))")(
+                            owner.address,
+                            otherAccount.address,
+                            itValue,
+                            txOpts
+                        )
+                )
+            })
+
+            it("reverts when amount exceeds balance (allowance OK)", async function () {
+                await contract
+                    .connect(owner)
+                    .getFunction("increaseAllowance(address,uint256)")(otherAccount.address, 5000n, txOpts)
+                    .then((t) => t.wait())
 
-                it("does not decrement the spenders allowance", async function () {
-                    const ctAllowance = await contract["allowance(address,address)"](owner.address, otherAccount.address)
+                const itValue = (await encryptItUint256(otherAccount,
+                    6000n,
+                    contractAddress,
+                    contract.interface.getFunction("transferFrom(address,address,((uint256,uint256),bytes))").selector
+                )) as itUint256
 
-                    const allowance = await owner.decryptValue(ctAllowance[1])
-        
-                    await expect(allowance).to.equal(5000n)
-                })
+                await expectTxFails(
+                    contract
+                        .connect(otherAccount)
+                        .getFunction("transferFrom(address,address,((uint256,uint256),bytes))")(
+                            owner.address,
+                            "0x0000000000000000000000000000000000000001",
+                            itValue,
+                            txOpts
+                        )
+                )
             })
         })
 
-        describe('successful transferFrom', async function () {
-            before('transferring', async function () {
-                const itValue = await otherAccount.encryptValue(value, contractAddress, contract["transferFrom(address,address,(uint256,bytes))"].fragment.selector)as itUint
+        describe("successful transferFrom", function () {
+            before("transferring", async function () {
+                await contract
+                    .connect(owner)
+                    .getFunction("approve(address,uint256)")(otherAccount.address, 0n, txOpts)
+                    .then((t) => t.wait())
+                await contract
+                    .connect(owner)
+                    .getFunction("approve(address,uint256)")(otherAccount.address, 5000n, txOpts)
+                    .then((t) => t.wait())
+
+                const itValue = (await encryptItUint256(otherAccount,
+                    value,
+                    contractAddress,
+                    contract.interface.getFunction("transferFrom(address,address,((uint256,uint256),bytes))").selector
+                )) as itUint256
 
                 const tx = await contract
                     .connect(otherAccount)
-                    ["transferFrom(address,address,(uint256,bytes))"]
-                    (owner.address, otherAccount.address, itValue)
-                
+                    .getFunction("transferFrom(address,address,((uint256,uint256),bytes))")(
+                        owner.address,
+                        otherAccount.address,
+                        itValue,
+                        txOpts
+                    )
+
                 await tx.wait()
             })
 
-            it('decrement the owners balance', async function () {
+            it("decrements the owners balance", async function () {
                 const ctBalance = await contract["balanceOf(address)"](owner.address)
 
-                const balance = await owner.decryptValue(ctBalance)
-    
+                const balance = decryptCtUint256(owner, ctBalance)
+
                 await expect(balance).to.equal(2000n)
             })
 
-            it('increment the recipients balance', async function () {
+            it("increments the recipients balance", async function () {
                 const ctBalance = await contract["balanceOf(address)"](otherAccount.address)
 
-                const balance = await otherAccount.decryptValue(ctBalance)
-    
+                const balance = decryptCtUint256(otherAccount, ctBalance)
+
                 await expect(balance).to.equal(8000n)
             })
 
-            it('decrement the spenders allowance', async function () {
+            it("decrements the spenders allowance", async function () {
                 const ctAllowance = await contract["allowance(address,address)"](owner.address, otherAccount.address)
 
-                const allowance = await otherAccount.decryptValue(ctAllowance[2])
-    
+                const allowance = decryptCtUint256(otherAccount, ctAllowance.spenderCiphertext)
+
                 await expect(allowance).to.equal(2000n)
             })
         })
@@ -383,164 +428,960 @@ describe("Private ERC20", function () {
         before("deploying and funding wallet contract", async function () {
             const walletContractFactory = await hre.ethers.getContractFactory("PrivateERC20WalletMock")
 
-            walletContract = await walletContractFactory
-                .connect(owner)
-                .deploy({ gasLimit: GAS_LIMIT })
-
-            walletContract = await walletContract.waitForDeployment()
+            const w = await walletContractFactory.connect(owner).deploy(txOpts)
+            await w.waitForDeployment()
+            walletContract = w as unknown as PrivateERC20WalletMock
 
             walletContractAddress = await walletContract.getAddress()
 
-            this.tx = await contract
-                .connect(owner)
-                .mint(walletContractAddress, value, { gasLimit: GAS_LIMIT })
-            
-            await this.tx.wait()
+            await mintPublic(contract, owner, walletContractAddress, value).then((t) => t.wait())
         })
 
-        describe("setAccountEncryptionAddress", async function () {
+        describe("setAccountEncryptionAddress", function () {
             before("setting account encryption address", async function () {
                 const tx = await walletContract
                     .connect(otherAccount)
-                    .setAccountEncryptionAddress(contractAddress, otherAccount.address, { gasLimit: GAS_LIMIT })
-                
+                    .setAccountEncryptionAddress(contractAddress, otherAccount.address, txOpts)
+
                 await tx.wait()
             })
 
-            it("update accountEncryptionAddress mapping", async function () {
+            it("updates accountEncryptionAddress mapping", async function () {
                 const accountEncryptionAddress = await contract.accountEncryptionAddress(walletContractAddress)
-                
+
                 await expect(accountEncryptionAddress).to.equal(otherAccount.address)
             })
 
-            it("reencrypt balance using the new account encryption address", async function () {
+            it("reencrypts balance for the new encryption address", async function () {
                 const ctBalance = await contract["balanceOf(address)"](walletContractAddress)
 
-                const balance = await otherAccount.decryptValue(ctBalance)
+                const balance = decryptCtUint256(otherAccount, ctBalance)
 
                 await expect(balance).to.equal(value)
             })
         })
 
-        describe("transfer", async function () {
+        describe("transfer via wallet", function () {
+            let otherBalanceBeforeWalletTransfer = 0n
+
             before("transferring", async function () {
+                const ctBefore = await contract["balanceOf(address)"](otherAccount.address)
+                otherBalanceBeforeWalletTransfer = decryptCtUint256(otherAccount, ctBefore)
+
                 const tx = await walletContract
                     .connect(otherAccount)
-                    .transfer(contractAddress, otherAccount.address, value / 2n, { gasLimit: GAS_LIMIT })
-                
+                    .transfer(contractAddress, otherAccount.address, value / 2n, txOpts)
+
                 await tx.wait()
             })
 
-            it('decrement the senders balance', async function () {
+            it("decrements the wallet balance", async function () {
                 const ctBalance = await contract["balanceOf(address)"](walletContractAddress)
 
-                const balance = await otherAccount.decryptValue(ctBalance)
+                const balance = decryptCtUint256(otherAccount, ctBalance)
 
                 await expect(balance).to.equal(value / 2n)
             })
 
-            it('increment the receivers balance', async function () {
+            it("increments the receiver balance", async function () {
                 const ctBalance = await contract["balanceOf(address)"](otherAccount.address)
 
-                const balance = await otherAccount.decryptValue(ctBalance)
+                const balance = decryptCtUint256(otherAccount, ctBalance)
 
-                await expect(balance).to.equal(13000n)
+                await expect(balance).to.equal(otherBalanceBeforeWalletTransfer + value / 2n)
             })
         })
 
-        describe("approve", async function () {
+        describe("approve via wallet", function () {
             before("approving", async function () {
                 const tx = await walletContract
                     .connect(otherAccount)
-                    .approve(contractAddress, owner.address, value / 2n, { gasLimit: GAS_LIMIT })
-                
+                    .approve(contractAddress, owner.address, value / 2n, txOpts)
+
                 await tx.wait()
             })
 
-            it("increment the spenders allowance", async function () {
+            it("sets allowance for wallet owner/spender pair", async function () {
                 const ctAllowance = await contract["allowance(address,address)"](walletContractAddress, owner.address)
 
-                const allowance = await otherAccount.decryptValue(ctAllowance[1])
+                const allowance = decryptCtUint256(otherAccount, ctAllowance.ownerCiphertext)
 
                 await expect(allowance).to.equal(value / 2n)
             })
         })
+    })
 
-        describe("transferFrom", async function () {
-            const value = 5000n
+    describe("maximum allowance", function () {
+        const value = 2n ** 256n - 1n
+        let ownerBalanceBeforeMaxTransfer = 0n
+        let maxAllowanceTransferFromReceipt: any
+
+        before("approve max and transferFrom", async function () {
+            let ct = await contract["balanceOf(address)"](owner.address)
+            ownerBalanceBeforeMaxTransfer = decryptCtUint256(owner, ct)
+            const need = 7000n
+            if (ownerBalanceBeforeMaxTransfer < need) {
+                await mintPublic(contract, owner, owner.address, need - ownerBalanceBeforeMaxTransfer).then((t) =>
+                    t.wait()
+                )
+                ct = await contract["balanceOf(address)"](owner.address)
+                ownerBalanceBeforeMaxTransfer = decryptCtUint256(owner, ct)
+            }
+
+            await contract
+                .connect(owner)
+                .getFunction("approve(address,uint256)")(otherAccount.address, 0n, txOpts)
+                .then((t) => t.wait())
 
-            before("transferring", async function () {
-                const itValue = await otherAccount.encryptValue(value, contractAddress, contract["approve(address,(uint256,bytes))"].fragment.selector) as itUint
+            const itMax = (await encryptItUint256(owner,
+                value,
+                contractAddress,
+                contract.interface.getFunction("approve(address,((uint256,uint256),bytes))").selector
+            )) as itUint256
 
-                let tx = await contract
-                    .connect(otherAccount)
-                    ["approve(address,(uint256,bytes))"]
-                    (walletContractAddress, itValue)
-                
-                await tx.wait()
+            let tx = await contract
+                .connect(owner)
+                .getFunction("approve(address,((uint256,uint256),bytes))")(otherAccount.address, itMax, txOpts)
 
-                tx = await walletContract
-                    .connect(otherAccount)
-                    .transferFrom(contractAddress, otherAccount.address, owner.address, value)
-                
-                await tx.wait()
-            })
+            await tx.wait()
 
-            it('decrement the owners balance', async function () {
-                const itBalance = await contract["balanceOf(address)"](otherAccount.address)
+            const itValue = (await encryptItUint256(otherAccount,
+                7000n,
+                contractAddress,
+                contract.interface.getFunction("transferFrom(address,address,((uint256,uint256),bytes))").selector
+            )) as itUint256
 
-                const balance = await otherAccount.decryptValue(itBalance)
+            tx = await contract
+                .connect(otherAccount)
+                .getFunction("transferFrom(address,address,((uint256,uint256),bytes))")(
+                    owner.address,
+                    "0x0000000000000000000000000000000000000001",
+                    itValue,
+                    txOpts
+                )
+
+            maxAllowanceTransferFromReceipt = await tx.wait()
+        })
 
-                await expect(balance).to.equal(8000n)
-            })
+        it("reduces owner balance but not unlimited allowance", async function () {
+            const ctBalance = await contract["balanceOf(address)"](owner.address)
 
-            it('increment the recipients balance', async function () {
-                const itBalance = await contract["balanceOf(address)"](owner.address)
+            const balance = decryptCtUint256(owner, ctBalance)
 
-                const balance = await owner.decryptValue(itBalance)
+            await expect(balance).to.equal(ownerBalanceBeforeMaxTransfer - 7000n)
+        })
 
-                await expect(balance).to.equal(7000n)
-            })
+        it("keeps max allowance for spender", async function () {
+            const ctAllowance = await contract["allowance(address,address)"](owner.address, otherAccount.address)
+
+            const allowance = decryptCtUint256(owner, ctAllowance.ownerCiphertext)
+
+            await expect(allowance).to.equal(value)
+        })
+
+        it("does not emit Approval on spend when allowance is unlimited", async function () {
+            const approvalEv = contract.interface.getEvent("Approval")
+            const approvalTopic = approvalEv.topicHash
+            const hasApproval = maxAllowanceTransferFromReceipt.logs.some((l: any) => l.topics?.[0] === approvalTopic)
+            await expect(hasApproval).to.equal(false)
         })
     })
 
-    describe("maximum allowance", function () {
-        const value = (2n ** 64n) - 1n
+    describe("supplyCap boundaries (capped token)", function () {
+        it("enforces cap for public and encrypted mint", async function () {
+            const [capOwner] = await setupAccounts()
+            const cappedFactory = await hre.ethers.getContractFactory("PrivateERC20CappedMock")
+            const capped = await cappedFactory.connect(capOwner).deploy(1000n, txOpts)
+            await capped.waitForDeployment()
+            const cappedAddr = await capped.getAddress()
+
+            // grant MINTER_ROLE for both mint overloads
+            const minterRole = await (capped as any).MINTER_ROLE()
+            await (await (capped as any).grantRole(minterRole, capOwner.address, txOpts)).wait()
+
+            // public mint within cap
+            await (await capped.connect(capOwner).getFunction("mint(address,uint256)")(capOwner.address, 1000n, txOpts)).wait()
+            // public mint above cap
+            await expectTxFails(
+                capped.connect(capOwner).getFunction("mint(address,uint256)")(capOwner.address, 1n, txOpts)
+            )
+
+            // encrypted mint within remaining (cap already full, so minting any more should fail)
+            const itOne = (await encryptItUint256(
+                capOwner,
+                1n,
+                cappedAddr,
+                (capped.interface.getFunction("mint(address,((uint256,uint256),bytes))") as any).selector
+            )) as itUint256
+            await expectTxFails(
+                capped.connect(capOwner).getFunction("mint(address,((uint256,uint256),bytes))")(capOwner.address, itOne, txOpts)
+            )
+        })
+    })
 
-        before("transferring", async function () {
-            let itValue = await owner.encryptValue(value, contractAddress, contract["approve(address,(uint256,bytes))"].fragment.selector) as itUint
+    describe("increaseAllowance and decreaseAllowance", function () {
+        let localContract: PrivateERC20Mock
+        let localAddress: string
+        let localOwner: Wallet
+        let localOther: Wallet
+
+        before(async function () {
+            const deployment = await deploy()
+            localContract = deployment.contract
+            localAddress = deployment.contractAddress
+            localOwner = deployment.owner
+            localOther = deployment.otherAccount
+            await mintPublic(localContract, localOwner, localOwner.address, 100000n).then((t) => t.wait())
+        })
 
-            let tx = await contract
+        it("increases allowance from zero", async function () {
+            const add = 1234n
+            await localContract
+                .connect(localOwner)
+                .getFunction("increaseAllowance(address,uint256)")(localOther.address, add, txOpts)
+                .then((t) => t.wait())
+            const ctAllowance = await localContract["allowance(address,address)"](localOwner.address, localOther.address)
+            const allowance = decryptCtUint256(localOwner, ctAllowance.ownerCiphertext)
+            await expect(allowance).to.equal(add)
+        })
+
+        it("decreases allowance", async function () {
+            const sub = 234n
+            await localContract
+                .connect(localOwner)
+                .getFunction("decreaseAllowance(address,uint256)")(localOther.address, sub, txOpts)
+                .then((t) => t.wait())
+            const ctAllowance = await localContract["allowance(address,address)"](localOwner.address, localOther.address)
+            const allowance = decryptCtUint256(localOwner, ctAllowance.ownerCiphertext)
+            await expect(allowance).to.equal(1234n - 234n)
+        })
+
+        it("reverts decrease when allowance is insufficient", async function () {
+            await expectTxFails(
+                localContract
+                    .connect(localOwner)
+                    .getFunction("decreaseAllowance(address,uint256)")(localOther.address, 100000n, txOpts)
+            )
+        })
+
+        it("reverts increaseAllowance when addition overflows uint256", async function () {
+            const max = 2n ** 256n - 1n
+            await localContract
+                .connect(localOwner)
+                .getFunction("approve(address,uint256)")(localOther.address, 0n, txOpts)
+                .then((t) => t.wait())
+
+            const itMax = (await encryptItUint256(localOwner,
+                max,
+                localAddress,
+                localContract.interface.getFunction("approve(address,((uint256,uint256),bytes))").selector
+            )) as itUint256
+
+            await localContract
+                .connect(localOwner)
+                .getFunction("approve(address,((uint256,uint256),bytes))")(localOther.address, itMax, txOpts)
+                .then((t) => t.wait())
+
+            await expectTxFails(
+                localContract
+                    .connect(localOwner)
+                    .getFunction("increaseAllowance(address,uint256)")(localOther.address, 1n, txOpts)
+            )
+        })
+    })
+
+    describe("publicAmountsDisabled", function () {
+        let c: PrivateERC20Mock
+        let o: Wallet
+
+        before(async function () {
+            const d = await deploy()
+            c = d.contract
+            o = d.owner
+            await mintPublic(c, o, o.address, 1000n).then((t) => t.wait())
+            await c.connect(o).setPublicAmountsEnabled(false).then((t) => t.wait())
+        })
+
+        it("reverts public transfer", async function () {
+            await expect(
+                c.connect(o).getFunction("transfer(address,uint256)").staticCall(otherAccount.address, 1n)
+            ).to.be.revertedWithCustomError(c, "PublicAmountsDisabled")
+        })
+
+        it("reverts public approve/increase/decrease/transferFrom/burn/transferAndCall", async function () {
+            await expect(
+                c.connect(o).getFunction("approve(address,uint256)").staticCall(otherAccount.address, 1n)
+            ).to.be.revertedWithCustomError(c, "PublicAmountsDisabled")
+
+            await expect(
+                c.connect(o).getFunction("increaseAllowance(address,uint256)").staticCall(otherAccount.address, 1n)
+            ).to.be.revertedWithCustomError(c, "PublicAmountsDisabled")
+
+            await expect(
+                c.connect(o).getFunction("decreaseAllowance(address,uint256)").staticCall(otherAccount.address, 1n)
+            ).to.be.revertedWithCustomError(c, "PublicAmountsDisabled")
+
+            await expect(
+                c.connect(o)
+                    .getFunction("transferFrom(address,address,uint256)")
+                    .staticCall(o.address, otherAccount.address, 1n)
+            ).to.be.revertedWithCustomError(c, "PublicAmountsDisabled")
+
+            await expect(
+                c.connect(o).getFunction("burn(uint256)").staticCall(1n)
+            ).to.be.revertedWithCustomError(c, "PublicAmountsDisabled")
+
+            // transferAndCall(public) also blocked
+            const recvFactory = await hre.ethers.getContractFactory("PublicTokenReceiverMock")
+            const recv = await recvFactory.connect(o).deploy(txOpts)
+            await recv.waitForDeployment()
+            await expect(
+                c.connect(o)
+                    .getFunction("transferAndCall(address,uint256,bytes)")
+                    .staticCall(await recv.getAddress(), 1n, "0x")
+            ).to.be.revertedWithCustomError(c, "PublicAmountsDisabled")
+        })
+
+        after(async function () {
+            await c.connect(o).setPublicAmountsEnabled(true).then((t) => t.wait())
+        })
+    })
+
+    describe("transferAndCall reentrancy (encrypted)", function () {
+        it("prevents receiver callback re-entering token", async function () {
+            const d = await deploy()
+            const t = d.contract
+            const tAddr = d.contractAddress
+            const o = d.owner
+            const other = d.otherAccount
+
+            // fund owner
+            await mintPublic(t, o, o.address, 1000n).then((x) => x.wait())
+
+            const receiverFactory = await hre.ethers.getContractFactory("PrivateERC20ReentrantReceiverMock")
+            const receiver = await receiverFactory.connect(o).deploy(txOpts)
+            await receiver.waitForDeployment()
+            const receiverAddr = await receiver.getAddress()
+
+            // configure callback to attempt re-entry into approve(uint256)
+            const reenterData = t.interface.encodeFunctionData("approve(address,uint256)", [other.address, 1n])
+            await (await (receiver as any).configure(tAddr, true, reenterData, txOpts)).wait()
+
+            const itAmount = (await encryptItUint256(
+                o,
+                1n,
+                tAddr,
+                t.interface.getFunction("transferAndCall(address,((uint256,uint256),bytes),bytes)").selector
+            )) as itUint256
+
+            await expectTxFails(
+                t.connect(o)
+                    .getFunction("transferAndCall(address,((uint256,uint256),bytes),bytes)")(receiverAddr, itAmount, "0x", txOpts)
+            )
+        })
+    })
+
+    describe("more edge cases (fresh deploy)", function () {
+        let c: PrivateERC20Mock
+        let addr: string
+        let o: Wallet
+        let other: Wallet
+
+        before(async function () {
+            const d = await deploy()
+            c = d.contract
+            addr = d.contractAddress
+            o = d.owner
+            other = d.otherAccount
+            await mintPublic(c, o, o.address, 1000n).then((t) => t.wait())
+        })
+
+        it("public transfer exact balance moves all tokens", async function () {
+            const amount = 1000n
+            await (await c.connect(o).getFunction("transfer(address,uint256)")(other.address, amount, txOpts)).wait()
+            await expect(decryptCtUint256(o, await c["balanceOf(address)"](o.address))).to.equal(0n)
+            await expect(decryptCtUint256(other, await c["balanceOf(address)"](other.address))).to.equal(amount)
+        })
+
+        it("public transferFrom exact allowance reduces allowance to zero", async function () {
+            // reset: mint back to owner
+            await mintPublic(c, o, o.address, 500n).then((t) => t.wait())
+            await (await c.connect(o).getFunction("approve(address,uint256)")(other.address, 123n, txOpts)).wait()
+
+            await (await c.connect(other).getFunction("transferFrom(address,address,uint256)")(o.address, other.address, 123n, txOpts)).wait()
+
+            const a = await c["allowance(address,address)"](o.address, other.address)
+            await expect(decryptCtUint256(other, a.spenderCiphertext)).to.equal(0n)
+        })
+
+        it("public approve is unsafe when current allowance non-zero", async function () {
+            await (await c.connect(o).getFunction("approve(address,uint256)")(other.address, 10n, txOpts)).wait()
+            await expectTxFails(c.connect(o).getFunction("approve(address,uint256)")(other.address, 11n, txOpts))
+        })
+
+        it("public transferFrom with from==to reverts (self-transfer)", async function () {
+            // clear any prior allowance set by earlier tests in this block
+            await (await c.connect(o).getFunction("approve(address,uint256)")(other.address, 0n, txOpts)).wait()
+            await (await c.connect(o).getFunction("approve(address,uint256)")(other.address, 1n, txOpts)).wait()
+            await expectTxFails(
+                c.connect(other).getFunction("transferFrom(address,address,uint256)")(o.address, o.address, 1n, txOpts)
+            )
+        })
+
+        it("encrypted approve(0) is NOT a safe reset when current allowance non-zero", async function () {
+            // set non-zero allowance first
+            await (await c.connect(o).getFunction("approve(address,uint256)")(other.address, 0n, txOpts)).wait()
+            await (await c.connect(o).getFunction("approve(address,uint256)")(other.address, 55n, txOpts)).wait()
+
+            const itZero = (await encryptItUint256(
+                o,
+                0n,
+                addr,
+                c.interface.getFunction("approve(address,((uint256,uint256),bytes))").selector
+            )) as itUint256
+
+            // Contract treats "new allowance is zero" via MPC equality; depending on MPC encoding,
+            // an encrypted-zero may not compare equal to public zero, so this may still hit ERC20UnsafeApprove.
+            await expectTxFails(
+                c.connect(o)
+                    .getFunction("approve(address,((uint256,uint256),bytes))")(other.address, itZero, txOpts)
+            )
+        })
+
+        it("transferAndCall(public) checks receiver must be contract (before PublicAmountsDisabled)", async function () {
+            await (await c.connect(o).setPublicAmountsEnabled(false).then((t) => t.wait()))
+            // EOA receiver => should hit TransferAndCallRequiresContract first
+            await expect(
+                c.connect(o).getFunction("transferAndCall(address,uint256,bytes)").staticCall(other.address, 1n, "0x")
+            ).to.be.revertedWithCustomError(c, "TransferAndCallRequiresContract")
+        })
+
+        it("accountEncryptionAddress(0) and allowance(address,bool) with zero address revert", async function () {
+            await expect(c.accountEncryptionAddress(ZeroAddress)).to.be.revertedWithCustomError(c, "ERC20InvalidReceiver")
+            await expect(
+                c.connect(o).getFunction("allowance(address,bool)").staticCall(ZeroAddress, true)
+            ).to.be.revertedWithCustomError(c, "ERC20InvalidReceiver")
+        })
+    })
+
+    describe("transferAndCall reentrancy (public)", function () {
+        it("prevents receiver callback re-entering token", async function () {
+            const d = await deploy()
+            const t = d.contract
+            const tAddr = d.contractAddress
+            const o = d.owner
+            const other = d.otherAccount
+
+            await mintPublic(t, o, o.address, 1000n).then((x) => x.wait())
+
+            const recvFactory = await hre.ethers.getContractFactory("PublicReentrantTokenReceiverMock")
+            const recv = await recvFactory.connect(o).deploy(txOpts)
+            await recv.waitForDeployment()
+            const recvAddr = await recv.getAddress()
+
+            // ensure public ops enabled for this test
+            await (await t.connect(o).setPublicAmountsEnabled(true).then((x) => x.wait()))
+
+            const reenterData = t.interface.encodeFunctionData("approve(address,uint256)", [other.address, 1n])
+            await (await (recv as any).configure(tAddr, true, reenterData, txOpts)).wait()
+
+            await expectTxFails(
+                t.connect(o).getFunction("transferAndCall(address,uint256,bytes)")(recvAddr, 1n, "0x", txOpts)
+            )
+        })
+    })
+
+    describe("missing branches: GT overloads + transferAndCall success/failure", function () {
+        it("covers transferAndCall(public) success and callback-false failure", async function () {
+            const d = await deploy()
+            const t = d.contract
+            const o = d.owner
+
+            await mintPublic(t, o, o.address, 10n).then((x) => x.wait())
+
+            const okRecvF = await hre.ethers.getContractFactory("PublicTokenReceiverBoolMock")
+            const okRecv = await okRecvF.connect(o).deploy(true, txOpts)
+            await okRecv.waitForDeployment()
+
+            const badRecv = await okRecvF.connect(o).deploy(false, txOpts)
+            await badRecv.waitForDeployment()
+
+            await (await t.connect(o).getFunction("transferAndCall(address,uint256,bytes)")(await okRecv.getAddress(), 1n, "0x", txOpts)).wait()
+            await expectTxFails(
+                t.connect(o).getFunction("transferAndCall(address,uint256,bytes)")(await badRecv.getAddress(), 1n, "0x", txOpts)
+            )
+        })
+
+        it("covers transferAndCall(encrypted) success and callback-false failure", async function () {
+            const d = await deploy()
+            const t = d.contract
+            const tAddr = d.contractAddress
+            const o = d.owner
+
+            await mintPublic(t, o, o.address, 10n).then((x) => x.wait())
+
+            const recvF = await hre.ethers.getContractFactory("EncryptedTokenReceiverMock")
+            const okRecv = await recvF.connect(o).deploy(true, txOpts)
+            await okRecv.waitForDeployment()
+            const badRecv = await recvF.connect(o).deploy(false, txOpts)
+            await badRecv.waitForDeployment()
+
+            const itAmt = (await encryptItUint256(
+                o,
+                1n,
+                tAddr,
+                t.interface.getFunction("transferAndCall(address,((uint256,uint256),bytes),bytes)").selector
+            )) as itUint256
+
+            await (await t.connect(o).getFunction("transferAndCall(address,((uint256,uint256),bytes),bytes)")(await okRecv.getAddress(), itAmt, "0x", txOpts)).wait()
+            await expectTxFails(
+                t.connect(o).getFunction("transferAndCall(address,((uint256,uint256),bytes),bytes)")(await badRecv.getAddress(), itAmt, "0x", txOpts)
+            )
+        })
+
+        it("covers GT entrypoints via helper contract", async function () {
+            const d = await deploy()
+            const t = d.contract
+            const tAddr = d.contractAddress
+            const o = d.owner
+            const other = d.otherAccount
+
+            await mintPublic(t, o, o.address, 1000n).then((x) => x.wait())
+
+            const callerF = await hre.ethers.getContractFactory("PrivateERC20GtCallerMock")
+            const caller = await callerF.connect(o).deploy(txOpts)
+            await caller.waitForDeployment()
+            const callerAddr = await caller.getAddress()
+
+            // fund caller so it can burnGt and transferGT as msg.sender
+            await (await t.connect(o).getFunction("transfer(address,uint256)")(callerAddr, 10n, txOpts)).wait()
+
+            // transferGT from caller to other
+            await (await (caller as any).transferGT(tAddr, other.address, 1n, txOpts)).wait()
+            await expect(decryptCtUint256(other, await t["balanceOf(address)"](other.address))).to.be.greaterThan(0n)
+
+            // approveGT from caller (owner=caller) to itself (spender=caller), then transferFromGT (spender=caller)
+            await (await (caller as any).approveGT(tAddr, callerAddr, 5n, txOpts)).wait()
+            await (await (caller as any).transferFromGT(tAddr, callerAddr, other.address, 2n, txOpts)).wait()
+
+            // burnGt from caller
+            await (await (caller as any).burnGt(tAddr, 1n, txOpts)).wait()
+        })
+    })
+
+    describe("reencryptAllowance event", function () {
+        it("emits AllowanceReencrypted", async function () {
+            await contract
                 .connect(owner)
-                ["approve(address,(uint256,bytes))"]
-                (otherAccount.address, itValue)
-            
-            await tx.wait()
+                .getFunction("approve(address,uint256)")(otherAccount.address, 0n, txOpts)
+                .then((t) => t.wait())
 
-            itValue = await otherAccount.encryptValue(7000n, contractAddress, contract["transferFrom(address,address,(uint256,bytes))"].fragment.selector) as itUint
+            const it42 = (await encryptItUint256(owner,
+                42n,
+                contractAddress,
+                contract.interface.getFunction("approve(address,((uint256,uint256),bytes))").selector
+            )) as itUint256
 
-            tx = await contract
-                .connect(otherAccount)
-                ["transferFrom(address,address,(uint256,bytes))"]
-                (owner.address, "0x0000000000000000000000000000000000000001", itValue)
-            
-            await tx.wait()
+            await contract
+                .connect(owner)
+                .getFunction("approve(address,((uint256,uint256),bytes))")(otherAccount.address, it42, txOpts)
+                .then((t) => t.wait())
+
+            const txResp = await contract.connect(owner).reencryptAllowance(otherAccount.address, false, txOpts)
+            const receipt = await txResp.wait()
+            expect(receipt).to.not.be.null
+            expect(receipt!.status).to.equal(1)
+            const ev = contract.interface.getEvent("AllowanceReencrypted")
+            expect(receipt!.logs.some((l) => l.topics[0] === ev.topicHash)).to.equal(true)
         })
+    })
 
-        it("decrement the owners balance", async function () {
-            const ctBalance = await contract["balanceOf(address)"](owner.address)
+    describe("encrypted edge cases (fresh deploy)", function () {
+        let c: PrivateERC20Mock
+        let addr: string
+        let o: Wallet
+        let other: Wallet
 
-            const balance = await owner.decryptValue(ctBalance)
+        before(async function () {
+            const d = await deploy()
+            c = d.contract
+            addr = d.contractAddress
+            o = d.owner
+            other = d.otherAccount
 
-            await expect(balance).to.equal(0n)
+            await mintPublic(c, o, o.address, 1000n).then((t) => t.wait())
         })
 
-        it("does not decrement the spenders allowance", async function () {
-            const ctAllowance = await contract["allowance(address,address)"](owner.address, otherAccount.address)
+        it("transfer encrypted 0n keeps balances unchanged", async function () {
+            const ctFromBefore = await c["balanceOf(address)"](o.address)
+            const ctToBefore = await c["balanceOf(address)"](other.address)
 
-            const allowance = await owner.decryptValue(ctAllowance[1])
+            const fromBefore = decryptCtUint256(o, ctFromBefore)
+            const toBefore = decryptCtUint256(other, ctToBefore)
 
-            await expect(allowance).to.equal(value)
+            const itZero = (await encryptItUint256(
+                o,
+                0n,
+                addr,
+                c.interface.getFunction("transfer(address,((uint256,uint256),bytes))").selector
+            )) as itUint256
+
+            await (
+                await c
+                    .connect(o)
+                    .getFunction("transfer(address,((uint256,uint256),bytes))")(other.address, itZero, txOpts)
+            ).wait()
+
+            const ctFromAfter = await c["balanceOf(address)"](o.address)
+            const ctToAfter = await c["balanceOf(address)"](other.address)
+
+            const fromAfter = decryptCtUint256(o, ctFromAfter)
+            const toAfter = decryptCtUint256(other, ctToAfter)
+
+            await expect(fromAfter).to.equal(fromBefore)
+            await expect(toAfter).to.equal(toBefore)
+        })
+
+        it("transfer encrypted exact balance moves all tokens", async function () {
+            const value = 1000n
+
+            const itValue = (await encryptItUint256(
+                o,
+                value,
+                addr,
+                c.interface.getFunction("transfer(address,((uint256,uint256),bytes))").selector
+            )) as itUint256
+
+            await (
+                await c
+                    .connect(o)
+                    .getFunction("transfer(address,((uint256,uint256),bytes))")(other.address, itValue, txOpts)
+            ).wait()
+
+            const ctFrom = await c["balanceOf(address)"](o.address)
+            const ctTo = await c["balanceOf(address)"](other.address)
+
+            await expect(decryptCtUint256(o, ctFrom)).to.equal(0n)
+            await expect(decryptCtUint256(other, ctTo)).to.equal(value)
+        })
+
+        it("approve encrypted 0 then transferFrom encrypted 0 does not change state", async function () {
+            // reset: mint back for this test sequence
+            // (this block runs after the previous test, which zeroed o's balance)
+            await mintPublic(c, o, o.address, 1000n).then((t) => t.wait())
+            await mintPublic(c, o, other.address, 0n).then((t) => t.wait())
+
+            const zero = 0n
+            const itZeroApprove = (await encryptItUint256(
+                o,
+                zero,
+                addr,
+                c.interface.getFunction("approve(address,((uint256,uint256),bytes))").selector
+            )) as itUint256
+
+            await (
+                await c
+                    .connect(o)
+                    .getFunction("approve(address,((uint256,uint256),bytes))")(other.address, itZeroApprove, txOpts)
+            ).wait()
+
+            const itZeroTransferFrom = (await encryptItUint256(
+                other,
+                zero,
+                addr,
+                c.interface.getFunction("transferFrom(address,address,((uint256,uint256),bytes))").selector
+            )) as itUint256
+
+            const fromBefore = decryptCtUint256(o, await c["balanceOf(address)"](o.address))
+            const toBefore = decryptCtUint256(other, await c["balanceOf(address)"](other.address))
+
+            await (
+                await c
+                    .connect(other)
+                    .getFunction("transferFrom(address,address,((uint256,uint256),bytes))")(
+                        o.address,
+                        other.address,
+                        itZeroTransferFrom,
+                        txOpts
+                    )
+            ).wait()
+
+            const fromAfter = decryptCtUint256(o, await c["balanceOf(address)"](o.address))
+            const toAfter = decryptCtUint256(other, await c["balanceOf(address)"](other.address))
+
+            await expect(fromAfter).to.equal(fromBefore)
+            await expect(toAfter).to.equal(toBefore)
+
+            const ctAllowance = await c["allowance(address,address)"](o.address, other.address)
+            const allowanceSpenderView = decryptCtUint256(other, ctAllowance.spenderCiphertext)
+            await expect(allowanceSpenderView).to.equal(0n)
+        })
+
+        it("transferFrom encrypted exact allowance reduces allowance to zero", async function () {
+            // reset: mint back and set a known allowance
+            await mintPublic(c, o, o.address, 1000n).then((t) => t.wait())
+
+            const allow = 250n
+            await (
+                await c
+                    .connect(o)
+                    .getFunction("approve(address,uint256)")(other.address, allow, txOpts)
+            ).wait()
+
+            const itAllow = (await encryptItUint256(
+                other,
+                allow,
+                addr,
+                c.interface.getFunction("transferFrom(address,address,((uint256,uint256),bytes))").selector
+            )) as itUint256
+
+            await (
+                await c
+                    .connect(other)
+                    .getFunction("transferFrom(address,address,((uint256,uint256),bytes))")(
+                        o.address,
+                        other.address,
+                        itAllow,
+                        txOpts
+                    )
+            ).wait()
+
+            const ctFrom = await c["balanceOf(address)"](o.address)
+            const ctTo = await c["balanceOf(address)"](other.address)
+
+            // owner was >= 250 due to minting above; exact expected amounts depend on prior tests
+            await expect(decryptCtUint256(other, ctTo)).to.be.greaterThan(0n)
+
+            const ctAllowance = await c["allowance(address,address)"](o.address, other.address)
+            const allowanceSpenderView = decryptCtUint256(other, ctAllowance.spenderCiphertext)
+            await expect(allowanceSpenderView).to.equal(0n)
+        })
+
+        it("increaseAllowance encrypted 0n is a no-op", async function () {
+            // Ensure allowance starts from 0 by approving 0 publicly.
+            await (
+                await c.connect(o).getFunction("approve(address,uint256)")(other.address, 0n, txOpts)
+            ).wait()
+
+            const itZero = (await encryptItUint256(
+                o,
+                0n,
+                addr,
+                c.interface.getFunction("increaseAllowance(address,((uint256,uint256),bytes))").selector
+            )) as itUint256
+
+            await (
+                await c
+                    .connect(o)
+                    .getFunction("increaseAllowance(address,((uint256,uint256),bytes))")(other.address, itZero, txOpts)
+            ).wait()
+
+            const ctAllowance = await c["allowance(address,address)"](o.address, other.address)
+            const allowanceOwnerView = decryptCtUint256(o, ctAllowance.ownerCiphertext)
+            await expect(allowanceOwnerView).to.equal(0n)
+        })
+
+        it("decreaseAllowance encrypted exact current allowance reduces to zero", async function () {
+            const current = 123n
+            await (
+                await c
+                    .connect(o)
+                    .getFunction("approve(address,uint256)")(other.address, current, txOpts)
+            ).wait()
+
+            const itSub = (await encryptItUint256(
+                o,
+                current,
+                addr,
+                c.interface.getFunction("decreaseAllowance(address,((uint256,uint256),bytes))").selector
+            )) as itUint256
+
+            await (
+                await c
+                    .connect(o)
+                    .getFunction("decreaseAllowance(address,((uint256,uint256),bytes))")(other.address, itSub, txOpts)
+            ).wait()
+
+            const ctAllowance = await c["allowance(address,address)"](o.address, other.address)
+            const allowanceOwnerView = decryptCtUint256(o, ctAllowance.ownerCiphertext)
+            await expect(allowanceOwnerView).to.equal(0n)
+        })
+
+        it("encrypted mint/burn accept 0n and reject malformed itUint256", async function () {
+            const fromBefore = decryptCtUint256(o, await c["balanceOf(address)"](o.address))
+
+            // PrivateERC20Mock only bypasses MINTER_ROLE for the public mint overload.
+            // The encrypted mint overload still requires MINTER_ROLE, so grant it here.
+            await (
+                await c.connect(o).grantRole(await c.MINTER_ROLE(), o.address)
+            ).wait()
+
+            const itZeroMint = (await encryptItUint256(
+                o,
+                0n,
+                addr,
+                c.interface.getFunction("mint(address,((uint256,uint256),bytes))").selector
+            )) as itUint256
+
+            await (
+                await c
+                    .connect(o)
+                    .getFunction("mint(address,((uint256,uint256),bytes))")(o.address, itZeroMint, txOpts)
+            ).wait()
+
+            const itZeroBurn = (await encryptItUint256(
+                o,
+                0n,
+                addr,
+                c.interface.getFunction("burn(((uint256,uint256),bytes))").selector
+            )) as itUint256
+
+            await (
+                await c
+                    .connect(o)
+                    .getFunction("burn(((uint256,uint256),bytes))")(itZeroBurn, txOpts)
+            ).wait()
+
+            const fromAfter = decryptCtUint256(o, await c["balanceOf(address)"](o.address))
+            await expect(fromAfter).to.equal(fromBefore)
+
+            const goodMint = (await encryptItUint256(
+                o,
+                1n,
+                addr,
+                c.interface.getFunction("mint(address,((uint256,uint256),bytes))").selector
+            )) as itUint256
+
+            const badSig: itUint256 = {
+                ciphertext: goodMint.ciphertext,
+                signature: new Uint8Array()
+            }
+
+            await expectTxFails(
+                c.connect(o)
+                    .getFunction("mint(address,((uint256,uint256),bytes))")(o.address, badSig, txOpts)
+            )
+        })
+
+        it("encrypted operations still work when publicAmountsEnabled=false", async function () {
+            await (
+                await c.connect(o).setPublicAmountsEnabled(false, txOpts)
+            ).wait()
+
+            const value = 10n
+            const itValue = (await encryptItUint256(
+                o,
+                value,
+                addr,
+                c.interface.getFunction("transfer(address,((uint256,uint256),bytes))").selector
+            )) as itUint256
+
+            const fromBefore = decryptCtUint256(o, await c["balanceOf(address)"](o.address))
+            const toBefore = decryptCtUint256(other, await c["balanceOf(address)"](other.address))
+
+            await (
+                await c
+                    .connect(o)
+                    .getFunction("transfer(address,((uint256,uint256),bytes))")(other.address, itValue, txOpts)
+            ).wait()
+
+            const fromAfter = decryptCtUint256(o, await c["balanceOf(address)"](o.address))
+            const toAfter = decryptCtUint256(other, await c["balanceOf(address)"](other.address))
+
+            await expect(fromAfter).to.equal(fromBefore - value)
+            await expect(toAfter).to.equal(toBefore + value)
+        })
+
+        it("rejects malformed itUint256: bad signature and swapped ciphertext limbs", async function () {
+            const good = (await encryptItUint256(
+                o,
+                1n,
+                addr,
+                c.interface.getFunction("transfer(address,((uint256,uint256),bytes))").selector
+            )) as itUint256
+
+            const badSig: itUint256 = {
+                ciphertext: good.ciphertext,
+                signature: new Uint8Array()
+            }
+
+            const swapped: itUint256 = {
+                ciphertext: {
+                    ciphertextHigh: good.ciphertext.ciphertextLow,
+                    ciphertextLow: good.ciphertext.ciphertextHigh
+                },
+                signature: good.signature
+            }
+
+            await expectTxFails(
+                c.connect(o)
+                    .getFunction("transfer(address,((uint256,uint256),bytes))")(other.address, badSig, txOpts)
+            )
+
+            await expectTxFails(
+                c.connect(o)
+                    .getFunction("transfer(address,((uint256,uint256),bytes))")(other.address, swapped, txOpts)
+            )
+        })
+    })
+
+    describe("isolated deploy: self-transfer and unsafe approve", function () {
+        let iso: PrivateERC20Mock
+        let isoAddr: string
+        let o: Wallet
+        let other: Wallet
+
+        before(async function () {
+            const d = await deploy()
+            iso = d.contract
+            isoAddr = d.contractAddress
+            o = d.owner
+            other = d.otherAccount
+            await mintPublic(iso, o, o.address, 1000n).then((t) => t.wait())
+        })
+
+        it("reverts self-transfer", async function () {
+            const itValue = (await encryptItUint256(o,
+                1n,
+                isoAddr,
+                iso.interface.getFunction("transfer(address,((uint256,uint256),bytes))").selector
+            )) as itUint256
+
+            await expectTxFails(
+                iso.connect(o).getFunction("transfer(address,((uint256,uint256),bytes))")(o.address, itValue, txOpts)
+            )
+        })
+
+        it("reverts unsafe approve then clears with approve zero", async function () {
+            const a1 = (await encryptItUint256(o,
+                100n,
+                isoAddr,
+                iso.interface.getFunction("approve(address,((uint256,uint256),bytes))").selector
+            )) as itUint256
+            await iso
+                .connect(o)
+                .getFunction("approve(address,((uint256,uint256),bytes))")(other.address, a1, txOpts)
+                .then((t) => t.wait())
+
+            const a2 = (await encryptItUint256(o,
+                200n,
+                isoAddr,
+                iso.interface.getFunction("approve(address,((uint256,uint256),bytes))").selector
+            )) as itUint256
+
+            await expectTxFails(
+                iso.connect(o).getFunction("approve(address,((uint256,uint256),bytes))")(other.address, a2, txOpts)
+            )
+
+            const z = (await encryptItUint256(o,
+                0n,
+                isoAddr,
+                iso.interface.getFunction("approve(address,((uint256,uint256),bytes))").selector
+            )) as itUint256
+            await iso
+                .connect(o)
+                .getFunction("approve(address,((uint256,uint256),bytes))")(other.address, z, txOpts)
+                .then((t) => t.wait())
         })
     })
 })