@coti-io/coti-contracts 1.2.0 → 1.3.1

package/contracts/utils/mpc/MpcInterface.sol

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-pragma solidity 0.8.19;
+pragma solidity ^0.8.20;
 
 interface ExtendedOperations {
 

package/hardhat.config.ts

@@ -8,15 +8,21 @@ dotenv.config()
 /** Bump estimated gas price / EIP-1559 fees by 30% on COTI networks (see hardhat/gasPriceBump.ts). */
 import "./hardhat/gasPriceBump"
 
-const accounts = process.env.PRIVATE_KEY ? [process.env.PRIVATE_KEY] : [];
+const accounts = process.env.PRIVATE_KEY
+  ? [process.env.PRIVATE_KEY]
+  : process.env.SIGNING_KEYS
+    ? process.env.SIGNING_KEYS.split(",").map((k) => k.trim()).filter(Boolean)
+    : [];
 
 const config: HardhatUserConfig = {
   defaultNetwork: "coti-testnet",
+  // Pinned compiler versions for reproducible bytecode; bump only alongside contract pragma / CI review.
   solidity: {
     compilers: [
       {
         version: "0.8.20",
         settings: {
+          viaIR: true,
           optimizer: {
             enabled: true,
             runs: 10000
@@ -29,18 +35,6 @@ const config: HardhatUserConfig = {
           },
         }
       },
-      {
-        version: "0.8.19",
-        settings: {
-          optimizer: {
-            enabled: true,
-            runs: 10000
-          },
-          metadata: {
-            bytecodeHash: 'none',
-          },
-        }
-      }
     ]
   },
   networks: {
@@ -73,8 +67,8 @@ const config: HardhatUserConfig = {
         network: "coti-mainnet",
         chainId: 2632500,
         urls: {
-          apiURL: "https://cotiscan.io/api",
-          browserURL: "https://cotiscan.io/",
+          apiURL: "https://mainnet.cotiscan.io/api",
+          browserURL: "https://mainnet.cotiscan.io/",
         },
       },
     ],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coti-io/coti-contracts",
-  "version": "1.2.0",
+  "version": "1.3.1",
   "description": "A library for smart contract development on the COTI network.",
   "author": "COTI Development",
   "repository": {
@@ -40,9 +40,9 @@
     "typescript": "^5.9.3"
   },
   "dependencies": {
-    "@coti-io/coti-ethers": "^1.0.5",
-    "@coti-io/coti-sdk-typescript": "^1.0.6",
-    "@openzeppelin/contracts": "^4.9.6",
+    "@coti-io/coti-ethers": "^1.0.6",
+    "@coti-io/coti-sdk-typescript": "^1.0.9",
+    "@openzeppelin/contracts": "5.4.0",
     "dotenv": "^16.4.5"
   }
 }

package/scripts/add-bridge-operators.cjs

@@ -0,0 +1,87 @@
+/**
+ * Grant OPERATOR_ROLE on each privacy bridge via addOperator(account).
+ * Caller must hold DEFAULT_ADMIN_ROLE on every bridge (typically the deployer owner).
+ *
+ * Run with:
+ *   npx hardhat run scripts/add-bridge-operators.cjs --network coti-mainnet
+ *
+ * Optional env:
+ *   OPERATOR_ACCOUNT=0x...  (default: 0x07dd528aC097f2Fb18fdC048e8d94376621b68C9)
+ */
+const hre = require("hardhat");
+
+const CHAIN_IDS = {
+    cotiTestnet: 7082400,
+    cotiMainnet: 2632500,
+    "coti-testnet": 7082400,
+    "coti-mainnet": 2632500,
+};
+
+const DEFAULT_OPERATOR = "0x07dd528aC097f2Fb18fdC048e8d94376621b68C9";
+
+/** Privacy bridge contract addresses per chain (from redeploy-private-and-bridges.cjs output). */
+const BRIDGE_ADDRESSES = {
+    2632500: [
+        { name: "PrivacyBridgeCotiNative", address: "0x44D864973392064304dD88E2BDef39fF1ab11b7b" },
+        { name: "PrivacyBridgeWETH", address: "0x7286c83300f0C7131b4006f3cf9F8e44BeB45c13" },
+        { name: "PrivacyBridgeWBTC", address: "0xc3B7EdEe4f1c0A0bA1AcD341e4982371eC869862" },
+        { name: "PrivacyBridgeUSDT", address: "0x7685B473DAF1c6DeD815Ca64C6fa18Da2227440D" },
+        { name: "PrivacyBridgeUSDCe", address: "0x29334fC23ffa2c44AF1b372336C2296591Eadd86" },
+        { name: "PrivacyBridgeWADA", address: "0xFa2126C07F517013c8d237cc465342da89B96f92" },
+        { name: "PrivacyBridgegCoti", address: "0xD4e0d9AB16b48c68044cB6aeA3A089380d6D8cD4" },
+    ],
+    7082400: [],
+};
+
+async function main() {
+    const networkName = hre.network.name;
+    const chainId = CHAIN_IDS[networkName];
+    if (!chainId) {
+        throw new Error(`Unsupported network: "${networkName}". Use --network coti-testnet or --network coti-mainnet`);
+    }
+
+    const bridges = BRIDGE_ADDRESSES[chainId];
+    if (!bridges?.length) {
+        throw new Error(
+            `No bridge addresses configured for chainId ${chainId}. Add entries to BRIDGE_ADDRESSES in scripts/add-bridge-operators.cjs`
+        );
+    }
+
+    const operatorAccount = process.env.OPERATOR_ACCOUNT || DEFAULT_OPERATOR;
+    if (!hre.ethers.isAddress(operatorAccount)) {
+        throw new Error(`Invalid OPERATOR_ACCOUNT: ${operatorAccount}`);
+    }
+
+    const [signer] = await hre.ethers.getSigners();
+    console.log("Network:", networkName, `(chainId: ${chainId})`);
+    console.log("Signer:", signer.address);
+    console.log("Operator to add:", operatorAccount);
+    console.log("Bridges:", bridges.length);
+
+    const balance = await hre.ethers.provider.getBalance(signer.address);
+    if (balance === 0n) {
+        throw new Error("Signer has no COTI for gas");
+    }
+
+    for (const bridge of bridges) {
+        process.stdout.write(`  ${bridge.name} (${bridge.address})... `);
+        const contract = await hre.ethers.getContractAt("PrivacyBridge", bridge.address, signer);
+
+        const alreadyOperator = await contract.isOperator(operatorAccount);
+        if (alreadyOperator) {
+            console.log("already operator — skip");
+            continue;
+        }
+
+        const tx = await contract.addOperator(operatorAccount, { gasLimit: 5_000_000 });
+        const receipt = await tx.wait();
+        console.log(`✅ tx ${receipt.hash}`);
+    }
+
+    console.log("\nDone.");
+}
+
+main().catch((e) => {
+    console.error(e);
+    process.exitCode = 1;
+});

package/scripts/deploy-coti-price-consumer-mainnet.cjs

@@ -0,0 +1,49 @@
+/**
+ * Deploy CotiPriceConsumer on COTI Mainnet.
+ *
+ * Run with:
+ *   npx hardhat compile
+ *   npx hardhat run deploy/oracle/deploy-coti-price-consumer-mainnet.cjs --network cotiMainnet
+ */
+const hre = require("hardhat");
+
+// Band Protocol StdReferenceProxy on COTI Mainnet
+const BAND_REF_PROXY = "0x9503d502435f8e228b874Ba0F792301d4401b523";
+
+// Maximum staleness in seconds (1 hour).
+const MAX_STALENESS = 3600;
+
+async function main() {
+    const [deployer] = await hre.ethers.getSigners();
+    console.log("Deploying CotiPriceConsumer with account:", deployer.address);
+    console.log("Network:", hre.network.name);
+
+    const balance = await hre.ethers.provider.getBalance(deployer.address);
+    console.log("Balance:", hre.ethers.formatEther(balance), "COTI");
+
+    if (balance === 0n) {
+        throw new Error("Deployer account has no COTI — fund it first");
+    }
+
+    const Factory = await hre.ethers.getContractFactory("CotiPriceConsumer");
+    const contract = await Factory.deploy(BAND_REF_PROXY, MAX_STALENESS, { gasLimit: 5000000 });
+    await contract.waitForDeployment();
+
+    const address = await contract.getAddress();
+    console.log("✅ CotiPriceConsumer deployed to:", address);
+
+    // Quick sanity read
+    try {
+        const price = await contract.getPrice("COTI");
+        const readable = Number(price) / 1e18;
+        console.log("   COTI/USD price (raw 1e18):", price.toString());
+        console.log("   COTI/USD price (USD):     ", `$${readable}`);
+    } catch (err) {
+        console.log("   ⚠️  Could not read price:", err.reason || err.message);
+    }
+}
+
+main().catch((e) => {
+    console.error(e);
+    process.exitCode = 1;
+});

package/scripts/deployCotiNodeRewards.ts

@@ -0,0 +1,51 @@
+import { ethers } from "hardhat";
+
+async function main() {
+  const [deployer] = await ethers.getSigners();
+  if (!deployer) {
+    throw new Error(
+      "No deployer signer found. Set PRIVATE_KEY in your environment."
+    );
+  }
+
+  console.log("Deploying CotiNodeRewards...");
+  console.log("Deployer:", deployer.address);
+  console.log("Owner:", deployer.address);
+
+  const provider = deployer.provider;
+  if (!provider) {
+    throw new Error("No provider found for deployer signer.");
+  }
+
+  // COTI RPC may not support "pending" block queries.
+  // Use legacy gas price + latest nonce + explicit gas limit to avoid
+  // pending-based fee/nonce/gas estimation lookups.
+  const gasPrice = BigInt(await provider.send("eth_gasPrice", []));
+  const nonce = await provider.getTransactionCount(deployer.address, "latest");
+  const gasLimit = BigInt(process.env.REWARDS_DEPLOY_GAS_LIMIT || "6000000");
+
+  const factory = await ethers.getContractFactory("CotiNodeRewards");
+  const deployTxReq = await factory.getDeployTransaction();
+  if (!deployTxReq.data) {
+    throw new Error("Failed to build deploy transaction data.");
+  }
+
+  const sentTx = await deployer.sendTransaction({
+    data: deployTxReq.data,
+    gasPrice,
+    nonce,
+    gasLimit,
+  });
+  console.log("Deployment tx hash:", sentTx.hash);
+  const receipt = await sentTx.wait();
+  if (!receipt || !receipt.contractAddress) {
+    throw new Error("Deployment transaction mined but no contract address found.");
+  }
+
+  console.log("CotiNodeRewards deployed at:", receipt.contractAddress);
+}
+
+main().catch((error) => {
+  console.error(error);
+  process.exitCode = 1;
+});

package/scripts/deployCotiTokenPoints004.ts

@@ -0,0 +1,61 @@
+import { ethers } from "hardhat";
+
+async function main() {
+  const [deployer] = await ethers.getSigners();
+  if (!deployer) {
+    throw new Error(
+      "No deployer signer found. Set PRIVATE_KEY in your environment."
+    );
+  }
+
+  const defaultAdmin =
+    process.env.TPS004_ADMIN || deployer.address;
+  const pauser = process.env.TPS004_PAUSER || deployer.address;
+  const minter = process.env.TPS004_MINTER || deployer.address;
+
+  console.log("Deploying CotiTokenPoints004...");
+  console.log("Deployer:", deployer.address);
+  console.log("Default admin:", defaultAdmin);
+  console.log("Pauser:", pauser);
+  console.log("Minter:", minter);
+
+  const provider = deployer.provider;
+  if (!provider) {
+    throw new Error("No provider found for deployer signer.");
+  }
+
+  const gasPrice = BigInt(await provider.send("eth_gasPrice", []));
+  const nonce = await provider.getTransactionCount(deployer.address, "latest");
+  const gasLimit = BigInt(process.env.TPS004_DEPLOY_GAS_LIMIT || "6000000");
+
+  const factory = await ethers.getContractFactory("CotiTokenPoints004");
+  const deployTxReq = await factory.getDeployTransaction(
+    defaultAdmin,
+    pauser,
+    minter
+  );
+  if (!deployTxReq.data) {
+    throw new Error("Failed to build deploy transaction data.");
+  }
+
+  const sentTx = await deployer.sendTransaction({
+    data: deployTxReq.data,
+    gasPrice,
+    nonce,
+    gasLimit,
+  });
+  console.log("Deployment tx hash:", sentTx.hash);
+  const receipt = await sentTx.wait();
+  if (!receipt || !receipt.contractAddress) {
+    throw new Error(
+      "Deployment transaction mined but no contract address found."
+    );
+  }
+
+  console.log("CotiTokenPoints004 deployed at:", receipt.contractAddress);
+}
+
+main().catch((error) => {
+  console.error(error);
+  process.exitCode = 1;
+});

package/scripts/deployFixedRatioCoinDisperserUnlimitedWindow.ts

@@ -0,0 +1,68 @@
+import { ethers } from "hardhat";
+
+async function main() {
+  const [deployer] = await ethers.getSigners();
+  if (!deployer) {
+    throw new Error(
+      "No deployer signer found. Set PRIVATE_KEY in your environment."
+    );
+  }
+
+  const pointsToken =
+    process.env.POINTS_TOKEN ||
+    "0x9eC8c1459B92e8f19fE160E63e169e7EFAAA4359";
+  const owner =
+    process.env.DISPERSER_OWNER ||
+    "0x87a11daf013e02d38cabdfdbff25e0b0fa2c5fcd";
+
+  console.log("Deploying FixedRatioCoinDisperserUnlimitedWindow...");
+  console.log("Deployer:", deployer.address);
+  console.log("Points token:", pointsToken);
+  console.log("Owner:", owner);
+
+  const provider = deployer.provider;
+  if (!provider) {
+    throw new Error("No provider found for deployer signer.");
+  }
+
+  const gasPrice = BigInt(await provider.send("eth_gasPrice", []));
+  const nonce = await provider.getTransactionCount(deployer.address, "latest");
+  const gasLimit = BigInt(
+    process.env.DISPERSER_DEPLOY_GAS_LIMIT || "8000000"
+  );
+
+  const factory = await ethers.getContractFactory(
+    "FixedRatioCoinDisperserUnlimitedWindow"
+  );
+  const deployTxReq = await factory.getDeployTransaction(
+    pointsToken,
+    owner
+  );
+  if (!deployTxReq.data) {
+    throw new Error("Failed to build deploy transaction data.");
+  }
+
+  const sentTx = await deployer.sendTransaction({
+    data: deployTxReq.data,
+    gasPrice,
+    nonce,
+    gasLimit,
+  });
+  console.log("Deployment tx hash:", sentTx.hash);
+  const receipt = await sentTx.wait();
+  if (!receipt || !receipt.contractAddress) {
+    throw new Error(
+      "Deployment transaction mined but no contract address found."
+    );
+  }
+
+  console.log(
+    "FixedRatioCoinDisperserUnlimitedWindow deployed at:",
+    receipt.contractAddress
+  );
+}
+
+main().catch((error) => {
+  console.error(error);
+  process.exitCode = 1;
+});

package/scripts/redeploy-private-and-bridges.cjs

@@ -0,0 +1,201 @@
+/**
+ * Redeployment script for Private Tokens and Bridges only.
+ *
+ * Public token addresses are hardcoded per network. After deployment,
+ * the script prints the full config block to stdout for manual copy
+ * into config.ts.
+ *
+ * Run with:
+ *   npx hardhat compile
+ *   npx hardhat run scripts/redeploy-private-and-bridges.cjs --network cotiTestnet
+ *   npx hardhat run scripts/redeploy-private-and-bridges.cjs --network cotiMainnet
+ */
+const hre  = require("hardhat");
+
+const CHAIN_IDS = {
+    cotiTestnet: 7082400,
+    cotiMainnet: 2632500,
+    "coti-testnet": 7082400,
+    "coti-mainnet": 2632500,
+};
+
+const PUBLIC_TOKEN_ADDRESSES = {
+    7082400: { // COTI Testnet
+        WETH:   "0x8bca4e6bbE402DB4aD189A316137aD08206154FB",
+        WBTC:   "0x5dBDb2E5D51c3FFab5D6B862Caa11FCe1D83F492",
+        USDT:   "0x9e961430053cd5AbB3b060544cEcCec848693Cf0",
+        USDC_E: "0x63f3D2Cc8F5608F57ce6E5Aa3590A2Beb428D19C",
+        WADA:   "0xe3E2cd3Abf412c73a404b9b8227B71dE3CfE829D",
+        gCOTI:  "0x878a42D3cB737DEC9E6c7e7774d973F46fd8ed4C",
+    },
+    2632500: { // COTI Mainnet
+        WETH:   "0x639aCc80569c5FC83c6FBf2319A6Cc38bBfe26d1",
+        WBTC:   "0x8C39B1fD0e6260fdf20652Fc436d25026832bfEA",
+        USDT:   "0xfA6f73446b17A97a56e464256DA54AD43c2Cbc3E",
+        USDC_E: "0xf1Feebc4376c68B7003450ae66343Ae59AB37D3C",
+        WADA:   "0xe757Ca19d2c237AA52eBb1d2E8E4368eeA3eb331",
+        gCOTI:  "0x7637C7838EC4Ec6b85080F28A678F8E234bB83D1",
+    },
+};
+
+function printConfigBlock(chainId, addresses) {
+    const networkName = chainId === 2632500 ? "COTI Mainnet" : "COTI Testnet";
+    console.log("\n========================================================");
+    console.log("  DEPLOYMENT COMPLETE — Copy this block into config.ts:");
+    console.log("========================================================");
+    console.log(`    // ${networkName}`);
+    console.log(`    ${chainId}: {`);
+    console.log(`      // Native`);
+    console.log(`      PrivateCoti: "${addresses.PrivateCOTI}",`);
+    console.log(`      PrivacyBridgeCotiNative: "${addresses.PrivacyBridgeCotiNative}",`);
+    console.log(``);
+    console.log(`      // Public Tokens`);
+    console.log(`      WETH: "${addresses.WETH}",`);
+    console.log(`      WBTC: "${addresses.WBTC}",`);
+    console.log(`      USDT: "${addresses.USDT}",`);
+    console.log(`      USDC_E: "${addresses.USDC_E}",`);
+    console.log(`      WADA: "${addresses.WADA}",`);
+    console.log(`      gCOTI: "${addresses.gCOTI}",`);
+    console.log(``);
+    console.log(`      // Private Tokens`);
+    console.log(`      "p.WETH": "${addresses.PrivateWrappedEther}",`);
+    console.log(`      "p.WBTC": "${addresses.PrivateWrappedBTC}",`);
+    console.log(`      "p.USDT": "${addresses.PrivateTetherUSD}",`);
+    console.log(`      "p.USDC_E": "${addresses.PrivateBridgedUSDC}",`);
+    console.log(`      "p.WADA": "${addresses.PrivateWrappedADA}",`);
+    console.log(`      "p.gCOTI": "${addresses.PrivateCOTITreasuryGovernanceToken}",`);
+    console.log(``);
+    console.log(`      // Bridges`);
+    console.log(`      PrivacyBridgeWETH: "${addresses.PrivacyBridgeWETH}",`);
+    console.log(`      PrivacyBridgeWBTC: "${addresses.PrivacyBridgeWBTC}",`);
+    console.log(`      PrivacyBridgeUSDT: "${addresses.PrivacyBridgeUSDT}",`);
+    console.log(`      PrivacyBridgeUSDCe: "${addresses.PrivacyBridgeUSDCe}",`);
+    console.log(`      PrivacyBridgeWADA: "${addresses.PrivacyBridgeWADA}",`);
+    console.log(`      PrivacyBridgegCOTI: "${addresses.PrivacyBridgegCoti}"`);
+    console.log(`    }`);
+    console.log("========================================================\n");
+}
+
+async function main() {
+    const [deployer] = await hre.ethers.getSigners();
+    const networkName = hre.network.name;
+    const chainId = CHAIN_IDS[networkName];
+
+    if (!chainId) {
+        throw new Error(`Unsupported network: "${networkName}". Use --network cotiTestnet or --network cotiMainnet`);
+    }
+
+    console.log("Redeploying with account:", deployer.address);
+    console.log("Network:", networkName, `(chainId: ${chainId})`);
+
+    // ── Resolve public token addresses from hardcoded config ───────────────
+    console.log("\n--- Public Token Addresses ---");
+    const publicTokens = PUBLIC_TOKEN_ADDRESSES[chainId];
+    if (!publicTokens) {
+        throw new Error(`No public token addresses configured for chainId ${chainId}`);
+    }
+    for (const [key, addr] of Object.entries(publicTokens)) {
+        if (!addr) throw new Error(`Missing public token address for ${key} (chainId: ${chainId})`);
+        console.log(`  ${key}: ${addr}`);
+    }
+
+    const newAddresses = { ...publicTokens };
+
+    // ── 1. Redeploy Private Tokens ─────────────────────────────────────────
+    console.log("\n--- Redeploying Private Tokens ---");
+    const privateTokens = [
+        { name: "PrivateCOTI",                        key: "PrivateCOTI" },
+        { name: "PrivateWrappedEther",                 key: "PrivateWrappedEther" },
+        { name: "PrivateWrappedBTC",                   key: "PrivateWrappedBTC" },
+        { name: "PrivateTetherUSD",                    key: "PrivateTetherUSD" },
+        { name: "PrivateBridgedUSDC",                  key: "PrivateBridgedUSDC" },
+        { name: "PrivateWrappedADA",                   key: "PrivateWrappedADA" },
+        { name: "PrivateCOTITreasuryGovernanceToken",  key: "PrivateCOTITreasuryGovernanceToken" },
+    ];
+
+    for (const pt of privateTokens) {
+        process.stdout.write(`  Deploying ${pt.name}... `);
+        const Factory = await hre.ethers.getContractFactory(pt.name);
+        const contract = await Factory.deploy({ gasLimit: 12000000 });
+        await contract.waitForDeployment();
+        newAddresses[pt.key] = await contract.getAddress();
+        console.log(`✅ ${newAddresses[pt.key]}`);
+    }
+
+    // ── 2. Redeploy Bridges ────────────────────────────────────────────────
+    console.log("\n--- Redeploying Bridges ---");
+
+    const feeRecipient = process.env.FEE_RECIPIENT;
+    const rescueRecipient = process.env.RESCUE_RECIPIENT;
+    if (!feeRecipient) throw new Error("FEE_RECIPIENT not set in .env");
+    if (!rescueRecipient) throw new Error("RESCUE_RECIPIENT not set in .env");
+    console.log(`  feeRecipient: ${feeRecipient}`);
+    console.log(`  rescueRecipient: ${rescueRecipient}`);
+
+    // CotiPriceConsumer deployed addresses per network
+    const PRICE_ORACLE = {
+        7082400: "0xAC89a381E84fbd5B3B536a3b895eB2aDdaDC36A1", // testnet
+        2632500: "0x830c5112E677459648C1aa7Bc5Dd65A36d71Aa4D", // mainnet
+    };
+    const oracleAddr = PRICE_ORACLE[chainId];
+    if (!oracleAddr) throw new Error(`No price oracle address configured for chainId ${chainId}`);
+    console.log(`  priceOracle: ${oracleAddr}`);
+
+    const bridges = [
+        { name: "PrivacyBridgeCotiNative", publicKey: null,       privateKey: "PrivateCOTI",                         bridgeKey: "PrivacyBridgeCotiNative" },
+        { name: "PrivacyBridgeWETH",       publicKey: "WETH",     privateKey: "PrivateWrappedEther",                 bridgeKey: "PrivacyBridgeWETH" },
+        { name: "PrivacyBridgeWBTC",       publicKey: "WBTC",     privateKey: "PrivateWrappedBTC",                   bridgeKey: "PrivacyBridgeWBTC" },
+        { name: "PrivacyBridgeUSDT",       publicKey: "USDT",     privateKey: "PrivateTetherUSD",                    bridgeKey: "PrivacyBridgeUSDT" },
+        { name: "PrivacyBridgeUSDCe",      publicKey: "USDC_E",   privateKey: "PrivateBridgedUSDC",                  bridgeKey: "PrivacyBridgeUSDCe" },
+        { name: "PrivacyBridgeWADA",       publicKey: "WADA",     privateKey: "PrivateWrappedADA",                   bridgeKey: "PrivacyBridgeWADA" },
+        { name: "PrivacyBridgegCoti",      publicKey: "gCOTI",    privateKey: "PrivateCOTITreasuryGovernanceToken",  bridgeKey: "PrivacyBridgegCoti" },
+    ];
+
+    for (const bridge of bridges) {
+        process.stdout.write(`  Deploying ${bridge.name}... `);
+        const Factory = await hre.ethers.getContractFactory(bridge.name);
+        let contract;
+        if (bridge.publicKey) {
+            // ERC20 bridge: constructor(address _token, address _privateToken, address _feeRecipient, address _rescueRecipient, address _priceOracle)
+            contract = await Factory.deploy(
+                newAddresses[bridge.publicKey],
+                newAddresses[bridge.privateKey],
+                feeRecipient,
+                rescueRecipient,
+                oracleAddr,
+                { gasLimit: 12000000 }
+            );
+        } else {
+            // Native bridge: constructor(address _privateCoti, address _feeRecipient, address _rescueRecipient, address _priceOracle)
+            contract = await Factory.deploy(newAddresses[bridge.privateKey], feeRecipient, rescueRecipient, oracleAddr, { gasLimit: 12000000 });
+        }
+        await contract.waitForDeployment();
+        newAddresses[bridge.bridgeKey] = await contract.getAddress();
+        console.log(`✅ ${newAddresses[bridge.bridgeKey]}`);
+    }
+
+    // ── 3. Grant Roles ─────────────────────────────────────────────────────
+    console.log("\n--- Granting Roles ---");
+    const MINTER_ROLE = hre.ethers.id("MINTER_ROLE");
+    const BURNER_ROLE  = hre.ethers.id("BURNER_ROLE");
+
+    for (const bridge of bridges) {
+        const ptAddress     = newAddresses[bridge.privateKey];
+        const bridgeAddress = newAddresses[bridge.bridgeKey];
+        const ptContract    = await hre.ethers.getContractAt("PrivateERC20", ptAddress);
+
+        process.stdout.write(`  ${bridge.name}: granting MINTER_ROLE... `);
+        const tx1 = await ptContract.grantRole(MINTER_ROLE, bridgeAddress, { gasLimit: 5000000 });
+        await tx1.wait();
+        process.stdout.write("✅  BURNER_ROLE... ");
+        const tx2 = await ptContract.grantRole(BURNER_ROLE, bridgeAddress, { gasLimit: 5000000 });
+        await tx2.wait();
+        console.log("✅");
+    }
+
+
+    // ── 5. Print config block ──────────────────────────────────────────────
+    printConfigBlock(chainId, newAddresses);
+}
+
+main().catch((e) => { console.error(e); process.exitCode = 1; });