@iexec-nox/nox-protocol-contracts 0.1.0-beta.4 → 0.1.0-beta.5

package/README.md

@@ -4,9 +4,8 @@ Smart contracts for the Nox protocol, including on-chain access control for encr
 
 ## What’s inside
 
-- `IACL`: access control list for encrypted handles (admins, viewers, public decryption flags).
 - `INoxCompute`: TEE compute entry point (handle validation, plaintext → encrypted conversion, arithmetic ops).
-- `Nox` SDK library: convenience wrapper for app contracts that call `NoxCompute` and `ACL`.
+- `Nox` SDK library: convenience wrapper for app contracts that call `NoxCompute`.
 
 ## Requirements
 

package/contracts/interfaces/INoxCompute.sol

@@ -1,18 +1,31 @@
 // SPDX-License-Identifier: Apache-2.0
 pragma solidity ^0.8.0;
 
-import {IErrors} from "./IErrors.sol";
-import {IACL} from "./IACL.sol";
 import {TEEType} from "../shared/TypeUtils.sol";
 
 /**
  * @title INoxCompute
  * @notice Interface for the Nox compute contract powered by TEE.
  */
-interface INoxCompute is IErrors {
+interface INoxCompute {
+    /// Error thrown when account address is zero
+    error InvalidZeroAddress();
+    /// Error thrown when bytes parameter is empty
+    error InvalidEmptyBytes();
+    /// Error thrown when sender doesn't have access to the handle
+    error UnauthorizedSender(address sender);
+    /// Error thrown when an account is not allowed to use a handle
+    error NotAllowed(bytes32 handle, address account);
     error InvalidProof(bytes proof, string reason);
+    error UnsupportedType();
     error IncompatibleTypes();
 
+    /// Emitted when admin role is granted
+    event Allowed(address indexed sender, address indexed account, bytes32 indexed handle);
+    /// Emitted when viewer role is granted
+    event ViewerAdded(address indexed sender, address indexed viewer, bytes32 indexed handle);
+    /// Emitted when a handle is marked as publicly decryptable
+    event MarkedAsPubliclyDecryptable(address indexed sender, bytes32 indexed handle);
     event KmsPublicKeyUpdated(bytes newKmsPublicKey);
     event GatewayUpdated(address indexed newGateway);
     event ProofExpirationDurationUpdated(uint256 newDuration);
@@ -152,19 +165,83 @@ interface INoxCompute is IErrors {
         Burn
     }
 
+    // ------------- ACL functions -------------
+
     /**
-     * @notice Sets the KMS public key used for ECIES encryption
-     * @param newKmsPublicKey The compressed SEC1 secp256k1 public key (33 bytes)
+     * Grant admin role to another address for a specific handle
+     * @dev Caller must have access (transient OR persistent) to the handle
+     * @param handle The handle identifier
+     * @param account The address to grant admin role
      */
-    function setKmsPublicKey(bytes calldata newKmsPublicKey) external;
+    function allow(bytes32 handle, address account) external;
 
-    function setGateway(address gatewayAddress) external;
+    /**
+     * Allows the use of `handle` by address `account` for this transaction.
+     * @param handle Handle.
+     * @param account Address of the account.
+     */
+    function allowTransient(bytes32 handle, address account) external;
 
     /**
-     * @notice Sets the proof expiration duration
-     * @param newDuration The new expiration duration in seconds
+     * Removes all transient authorizations. This is useful for integration with Account Abstraction
+     * when bundling several UserOps calling the NoxCompute.
+     * @dev Can be called by anyone (typically by AA bundlers between UserOps).
      */
-    function setProofExpirationDuration(uint256 newDuration) external;
+    function cleanTransientStorage() external;
+
+    /**
+     * Returns whether the account is allowed to use the `handle`, either due to
+     * allowTransient() or allow().
+     * @param handle Handle.
+     * @param account Address of the account.
+     * @return Whether the account can access the handle (persistent or transient).
+     */
+    function isAllowed(bytes32 handle, address account) external view returns (bool);
+
+    /**
+     * Checks whether the account is allowed to use all provided handles.
+     * Reverts with NotAllowed if any handle is not allowed.
+     * @param account Address of the account.
+     * @param handles Array of handles to check.
+     */
+    function validateAllowedForAll(address account, bytes32[] calldata handles) external view;
+
+    /**
+     * Add a viewer for a specific handle
+     * @dev Only an admin can add a viewer. The viewer address cannot be address(0).
+     * @param handle The handle identifier
+     * @param viewer The address to grant viewer role
+     */
+    function addViewer(bytes32 handle, address viewer) external;
+
+    /**
+     * Returns whether the account can view the handle.
+     * @dev Returns true if any of the following conditions are met:
+     *      - The handle is publicly decryptable
+     *      - The account was added as a viewer via `addViewer`
+     *      - The account has persistent access (is allowed) on the handle
+     * @param handle Handle.
+     * @param viewer Address of the viewer.
+     * @return Whether the account can view the handle.
+     */
+    function isViewer(bytes32 handle, address viewer) external view returns (bool);
+
+    /**
+     * Mark a handle as publicly decryptable.
+     * @dev The caller must be allowed to use the handle.
+     *      If not, the function reverts.
+     * @param handle Handle to mark as publicly decryptable.
+     */
+    function allowPublicDecryption(bytes32 handle) external;
+
+    /**
+     * Checks whether a handle is publicly decryptable.
+     * @param handle Handle.
+     * @return Whether the handle is publicly decryptable.
+     */
+    function isPubliclyDecryptable(bytes32 handle) external view returns (bool);
+
+    // ------------- Compute functions -------------
 
     /**
      * @notice Converts a plaintext value into an encrypted value
@@ -175,7 +252,21 @@ interface INoxCompute is IErrors {
     function plaintextToEncrypted(bytes32 value, TEEType teeType) external returns (bytes32);
 
     /**
-     * @notice Computes TEE Add operation
+     * @notice Validates a handle proof for a given owner and type.
+     * @param handle handle to validate
+     * @param owner owner of the provided handle
+     * @param proof proof data
+     * @param teeType expected handle type
+     */
+    function validateProof(
+        bytes32 handle,
+        address owner,
+        bytes calldata proof,
+        TEEType teeType
+    ) external;
+
+    /**
+     * @notice Performs an addition between two encrypted values without overflow check.
      * @param leftHandOperand Left-hand side operand handle
      * @param rightHandOperand Right-hand side operand handle
      * @return result Result handle
@@ -186,7 +277,7 @@ interface INoxCompute is IErrors {
     ) external returns (bytes32 result);
 
     /**
-     * @notice Performs a subtraction between two encrypted values without safety checks.
+     * @notice Performs a subtraction between two encrypted values without underflow check.
      * @param leftHandOperand Left-hand side operand handle
      * @param rightHandOperand Right-hand side operand handle
      * @return result Result handle
@@ -197,7 +288,21 @@ interface INoxCompute is IErrors {
     ) external returns (bytes32 result);
 
     /**
-     * @notice Performs a division between two encrypted values
+     * @notice Performs a multiplication between two encrypted values without overflow check.
+     * @param leftHandOperand Left-hand side operand handle
+     * @param rightHandOperand Right-hand side operand handle
+     * @return result Result handle
+     */
+    function mul(
+        bytes32 leftHandOperand,
+        bytes32 rightHandOperand
+    ) external returns (bytes32 result);
+
+    /**
+     * @notice Performs a division between two encrypted values without safety checks.
+     * In the case of a division by zero, the result will be as follows:
+     *  - For unsigned integers uintN: encrypted MAX_UintN (i.e., 2^N - 1)
+     *  - For signed integers intN: encrypted MAX_IntN (i.e., 2^(N-1) - 1)
      * @param numerator Value to be divided
      * @param denominator Value to divide by
      * @return result Result handle
@@ -205,15 +310,47 @@ interface INoxCompute is IErrors {
     function div(bytes32 numerator, bytes32 denominator) external returns (bytes32 result);
 
     /**
-     * @notice Performs a multiplication between two encrypted values
+     * @notice Performs an addition between two encrypted values with overflow check.
+     * If the operation succeeds, the value of the success handle will be an encrypted
+     * `true` and the result handle's value will be the encrypted sum.
+     * If the operation fails (e.g., due to overflow), the success handle will contain
+     * an encrypted `false` and the result handle will contain an encrypted `0`.
      * @param leftHandOperand Left-hand side operand handle
      * @param rightHandOperand Right-hand side operand handle
+     * @return success Whether the operation was successful
      * @return result Result handle
      */
-    function mul(
+    function safeAdd(
         bytes32 leftHandOperand,
         bytes32 rightHandOperand
-    ) external returns (bytes32 result);
+    ) external returns (bytes32 success, bytes32 result);
+
+    /**
+     * @notice Performs a subtraction between two encrypted values with underflow check.
+     * If the operation succeeds, the value of the success handle will be an encrypted
+     * `true` and the result handle's value will be the encrypted difference.
+     * If the operation fails (e.g., due to underflow), the success handle will contain
+     * an encrypted `false` and the result handle will contain an encrypted `0`.
+     * @param leftHandOperand Left-hand side operand handle
+     * @param rightHandOperand Right-hand side operand handle
+     * @return success Whether the operation was successful
+     * @return result Result handle
+     */
+    function safeSub(
+        bytes32 leftHandOperand,
+        bytes32 rightHandOperand
+    ) external returns (bytes32 success, bytes32 result);
+
+    // TODO add safeMul and safeDiv
+
+    /**
+     * @notice Selects between two encrypted values based on a condition
+     * @param condition Condition handle
+     * @param ifTrue Value handle if condition is true
+     * @param ifFalse Value handle if condition is false
+     * @return result Selected value handle
+     */
+    function select(bytes32 condition, bytes32 ifTrue, bytes32 ifFalse) external returns (bytes32);
 
     /**
      * @notice Checks equality between two encrypted values
@@ -281,45 +418,12 @@ interface INoxCompute is IErrors {
         bytes32 rightHandOperand
     ) external returns (bytes32 result);
 
-    // TODO for all safe operations, determine which cyphertexte linked to the new handle to return
-    // as result in case of failure.
-    /**
-     * @notice Performs an addition between two encrypted values with safety checks.
-     * The operation fails in the case of overflows.
-     * @param leftHandOperand Left-hand side operand handle
-     * @param rightHandOperand Right-hand side operand handle
-     * @return success Whether the operation was successful
-     * @return result Result handle
-     */
-    function safeAdd(
-        bytes32 leftHandOperand,
-        bytes32 rightHandOperand
-    ) external returns (bytes32 success, bytes32 result);
-
-    /**
-     * @notice Performs a subtraction between two encrypted values with safety checks.
-     * The operation fails in the case of underflow.
-     * @param leftHandOperand Left-hand side operand handle
-     * @param rightHandOperand Right-hand side operand handle
-     * @return success Whether the operation was successful
-     * @return result Result handle
-     */
-    function safeSub(
-        bytes32 leftHandOperand,
-        bytes32 rightHandOperand
-    ) external returns (bytes32 success, bytes32 result);
-
-    /**
-     * @notice Selects between two encrypted values based on a condition
-     * @param condition Condition handle
-     * @param ifTrue Value handle if condition is true
-     * @param ifFalse Value handle if condition is false
-     * @return result Selected value handle
-     */
-    function select(bytes32 condition, bytes32 ifTrue, bytes32 ifFalse) external returns (bytes32);
-
     /**
      * @notice Computes a confidential transfer between two balances.
+     * The transfer will succeed if the sender has sufficient balance and fail otherwise.
+     * If the transfer fails, the success handle will contain an encrypted `false`, the
+     * newBalanceFrom and newBalanceTo handles will contain the same values as the input
+     * balanceFrom and balanceTo handles.
      * @param balanceFrom Sender's current balance handle
      * @param balanceTo Recipient's current balance handle
      * @param amount Amount handle to transfer
@@ -335,6 +439,9 @@ interface INoxCompute is IErrors {
 
     /**
      * @notice Computes a confidential mint operation.
+     * If the minting operation fails (e.g., due to overflow), the success handle will
+     * contain an encrypted `false` and the newBalanceTo and newTotalSupply handles will
+     * contain the same values as the input balanceTo and totalSupply handles.
      * @param balanceTo Recipient's current balance handle
      * @param amount Amount handle to mint
      * @param totalSupply Current total supply handle
@@ -350,6 +457,9 @@ interface INoxCompute is IErrors {
 
     /**
      * @notice Computes a confidential burn operation.
+     * If the burn operation fails (e.g., due to underflow), the success handle will
+     * contain an encrypted `false` and the newBalanceFrom and newTotalSupply handles will
+     * contain the same values as the input balanceFrom and totalSupply handles.
      * @param balanceFrom Sender's current balance handle
      * @param amount Amount handle to burn
      * @param totalSupply Current total supply handle
@@ -363,25 +473,27 @@ interface INoxCompute is IErrors {
         bytes32 totalSupply
     ) external returns (bytes32 success, bytes32 newBalanceFrom, bytes32 newTotalSupply);
 
-    function validateProof(
-        bytes32 handle,
-        address owner,
-        bytes calldata proof,
-        TEEType teeType
-    ) external;
+    // ------------- Admin functions -------------
 
-    function domainSeparator() external view returns (bytes32);
-    function ACL() external view returns (IACL);
-    function gateway() external view returns (address);
-    function proofExpirationDuration() external view returns (uint256);
-    function kmsPublicKey() external view returns (bytes memory);
+    /**
+     * @notice Sets the KMS public key used for ECIES encryption.
+     * @param newKmsPublicKey The compressed SEC1 secp256k1 public key (33 bytes)
+     */
+    function setKmsPublicKey(bytes calldata newKmsPublicKey) external;
 
-    /// @dev See {IACL-isAllowed}
-    function isAllowed(bytes32 handle, address account) external view returns (bool);
+    /**
+     * @notice Sets the gateway address in the contract's config.
+     * @param gatewayAddress The address of the gateway
+     */
+    function setGateway(address gatewayAddress) external;
 
-    /// @dev See {IACL-isViewer}
-    function isViewer(bytes32 handle, address viewer) external view returns (bool);
+    /**
+     * @notice Sets the proof expiration duration.
+     * @param newDuration The new expiration duration in seconds
+     */
+    function setProofExpirationDuration(uint256 newDuration) external;
 
-    /// @dev See {IACL-isPubliclyDecryptable}
-    function isPubliclyDecryptable(bytes32 handle) external view returns (bool);
+    function kmsPublicKey() external view returns (bytes memory);
+    function gateway() external view returns (address);
+    function proofExpirationDuration() external view returns (uint256);
 }

package/contracts/sdk/Nox.sol

@@ -3,64 +3,43 @@ pragma solidity ^0.8.0;
 
 import {TEEType} from "../shared/TypeUtils.sol";
 import {INoxCompute} from "../interfaces/INoxCompute.sol";
-import {IACL} from "../interfaces/IACL.sol";
 import "encrypted-types/EncryptedTypes.sol";
 
 /**
  * @title Nox
  * @notice Library providing convenient functions for TEE confidential computations.
- * @dev If an invalid or non-existent handle is passed to any function in the Nox protocol,
- *      the transaction will revert as it will not be recognized by the ACL.
  */
 library Nox {
     // ============ Errors ============
 
     error UninitializedHandle();
 
-    // ============ Internal address resolution ============
+    // ============ Address resolution ============
 
     /**
      * @dev Returns the NoxCompute contract address for the current chain.
      *      Supports Arbitrum Mainnet (42161), Arbitrum Sepolia (421614), and local dev chains (31337),
      *      including local forks of each network.
      */
-    function _compute() internal view returns (INoxCompute) {
+    function noxComputeContract() public view returns (address) {
         // Arbitrum mainnet or its fork
         if (block.chainid == 42161) {
             // TODO: Update after mainnet deployment.
-            return INoxCompute(address(0));
+            return address(0);
         }
         // Arbitrum Sepolia or its fork
         if (block.chainid == 421614) {
-            return INoxCompute(0xd2856C55447FBb45c85a4C484796fe690981B069);
+            return 0x5633472D35E18464CA24Ab974954fB3b1B122eA6;
         }
         // Local development chain
         if (block.chainid == 31337) {
-            return INoxCompute(0x463Bdd46031353138713a47D7056F7c85024a4A6);
+            return 0x188D560Fd7F60f50e4c32a4484B1D0DC486714b3;
         }
         revert("Nox: Unsupported chain");
     }
 
-    /**
-     * @dev Returns the ACL contract address for the current chain.
-     *      Supports Arbitrum Mainnet (42161), Arbitrum Sepolia (421614), and local dev chains (31337),
-     *      including local forks of each network.
-     */
-    function _acl() internal view returns (IACL) {
-        // Arbitrum mainnet or its fork
-        if (block.chainid == 42161) {
-            // TODO: Update after mainnet deployment.
-            return IACL(address(0));
-        }
-        // Arbitrum Sepolia or its fork
-        if (block.chainid == 421614) {
-            return IACL(0xDC91Ec3F965F2F5F143DbBfcC92cC1340857D3d1);
-        }
-        // Local development chain
-        if (block.chainid == 31337) {
-            return IACL(0x3219A802B61028Fc29848863268FE17d750E5701);
-        }
-        revert("Nox: Unsupported chain");
+    function _noxComputeContract() internal view returns (INoxCompute) {
+        return INoxCompute(noxComputeContract());
     }
 
     // =========== Handle initialization checks ============
@@ -133,7 +112,10 @@ library Nox {
     function toEbool(bool value) internal returns (ebool) {
         return
             ebool.wrap(
-                _compute().plaintextToEncrypted(bytes32(uint256(value ? 1 : 0)), TEEType.Bool)
+                _noxComputeContract().plaintextToEncrypted(
+                    bytes32(uint256(value ? 1 : 0)),
+                    TEEType.Bool
+                )
             );
     }
 
@@ -143,7 +125,10 @@ library Nox {
     function toEaddress(address value) internal returns (eaddress) {
         return
             eaddress.wrap(
-                _compute().plaintextToEncrypted(bytes32(uint256(uint160(value))), TEEType.Address)
+                _noxComputeContract().plaintextToEncrypted(
+                    bytes32(uint256(uint160(value))),
+                    TEEType.Address
+                )
             );
     }
 
@@ -152,14 +137,19 @@ library Nox {
      */
     function toEuint16(uint16 value) internal returns (euint16) {
         return
-            euint16.wrap(_compute().plaintextToEncrypted(bytes32(uint256(value)), TEEType.Uint16));
+            euint16.wrap(
+                _noxComputeContract().plaintextToEncrypted(bytes32(uint256(value)), TEEType.Uint16)
+            );
     }
 
     /**
      * @dev Convert a plaintext value to an encrypted euint256 integer.
      */
     function toEuint256(uint256 value) internal returns (euint256) {
-        return euint256.wrap(_compute().plaintextToEncrypted(bytes32(value), TEEType.Uint256));
+        return
+            euint256.wrap(
+                _noxComputeContract().plaintextToEncrypted(bytes32(value), TEEType.Uint256)
+            );
     }
 
     /**
@@ -168,7 +158,10 @@ library Nox {
     function toEint16(int16 value) internal returns (eint16) {
         return
             eint16.wrap(
-                _compute().plaintextToEncrypted(bytes32(uint256(uint16(value))), TEEType.Int16)
+                _noxComputeContract().plaintextToEncrypted(
+                    bytes32(uint256(uint16(value))),
+                    TEEType.Int16
+                )
             );
     }
 
@@ -177,7 +170,9 @@ library Nox {
      */
     function toEint256(int256 value) internal returns (eint256) {
         return
-            eint256.wrap(_compute().plaintextToEncrypted(bytes32(uint256(value)), TEEType.Int256));
+            eint256.wrap(
+                _noxComputeContract().plaintextToEncrypted(bytes32(uint256(value)), TEEType.Int256)
+            );
     }
 
     // ============ Handle validation ============
@@ -187,7 +182,7 @@ library Nox {
         bytes calldata handleProof
     ) internal returns (ebool) {
         bytes32 handle = externalEbool.unwrap(externalHandle);
-        _compute().validateProof(handle, msg.sender, handleProof, TEEType.Bool);
+        _noxComputeContract().validateProof(handle, msg.sender, handleProof, TEEType.Bool);
         return ebool.wrap(handle);
     }
 
@@ -196,7 +191,7 @@ library Nox {
         bytes calldata handleProof
     ) internal returns (eaddress) {
         bytes32 handle = externalEaddress.unwrap(externalHandle);
-        _compute().validateProof(handle, msg.sender, handleProof, TEEType.Address);
+        _noxComputeContract().validateProof(handle, msg.sender, handleProof, TEEType.Address);
         return eaddress.wrap(handle);
     }
 
@@ -205,7 +200,7 @@ library Nox {
         bytes calldata handleProof
     ) internal returns (euint16) {
         bytes32 handle = externalEuint16.unwrap(externalHandle);
-        _compute().validateProof(handle, msg.sender, handleProof, TEEType.Uint16);
+        _noxComputeContract().validateProof(handle, msg.sender, handleProof, TEEType.Uint16);
         return euint16.wrap(handle);
     }
 
@@ -214,7 +209,7 @@ library Nox {
         bytes calldata handleProof
     ) internal returns (euint256) {
         bytes32 handle = externalEuint256.unwrap(externalHandle);
-        _compute().validateProof(handle, msg.sender, handleProof, TEEType.Uint256);
+        _noxComputeContract().validateProof(handle, msg.sender, handleProof, TEEType.Uint256);
         return euint256.wrap(handle);
     }
 
@@ -223,7 +218,7 @@ library Nox {
         bytes calldata handleProof
     ) internal returns (eint16) {
         bytes32 handle = externalEint16.unwrap(externalHandle);
-        _compute().validateProof(handle, msg.sender, handleProof, TEEType.Int16);
+        _noxComputeContract().validateProof(handle, msg.sender, handleProof, TEEType.Int16);
         return eint16.wrap(handle);
     }
 
@@ -232,7 +227,7 @@ library Nox {
         bytes calldata handleProof
     ) internal returns (eint256) {
         bytes32 handle = externalEint256.unwrap(externalHandle);
-        _compute().validateProof(handle, msg.sender, handleProof, TEEType.Int256);
+        _noxComputeContract().validateProof(handle, msg.sender, handleProof, TEEType.Int256);
         return eint256.wrap(handle);
     }
 
@@ -540,168 +535,168 @@ library Nox {
      * @dev Allows the use of value for the address account.
      */
     function allow(ebool value, address account) internal {
-        _acl().allow(ebool.unwrap(value), account);
+        _noxComputeContract().allow(ebool.unwrap(value), account);
     }
 
     /**
      * @dev Allows the use of value for the address account.
      */
     function allow(eaddress value, address account) internal {
-        _acl().allow(eaddress.unwrap(value), account);
+        _noxComputeContract().allow(eaddress.unwrap(value), account);
     }
 
     /**
      * @dev Allows the use of value for the address account.
      */
     function allow(euint16 value, address account) internal {
-        _acl().allow(euint16.unwrap(value), account);
+        _noxComputeContract().allow(euint16.unwrap(value), account);
     }
 
     /**
      * @dev Allows the use of value for the address account.
      */
     function allow(euint256 value, address account) internal {
-        _acl().allow(euint256.unwrap(value), account);
+        _noxComputeContract().allow(euint256.unwrap(value), account);
     }
 
     /**
      * @dev Allows the use of value for the address account.
      */
     function allow(eint16 value, address account) internal {
-        _acl().allow(eint16.unwrap(value), account);
+        _noxComputeContract().allow(eint16.unwrap(value), account);
     }
 
     /**
      * @dev Allows the use of value for the address account.
      */
     function allow(eint256 value, address account) internal {
-        _acl().allow(eint256.unwrap(value), account);
+        _noxComputeContract().allow(eint256.unwrap(value), account);
     }
 
     /**
      * @dev Allows the use of value for this address (address(this)).
      */
     function allowThis(ebool value) internal {
-        _acl().allow(ebool.unwrap(value), address(this));
+        _noxComputeContract().allow(ebool.unwrap(value), address(this));
     }
 
     /**
      * @dev Allows the use of value for this address (address(this)).
      */
     function allowThis(eaddress value) internal {
-        _acl().allow(eaddress.unwrap(value), address(this));
+        _noxComputeContract().allow(eaddress.unwrap(value), address(this));
     }
 
     /**
      * @dev Allows the use of value for this address (address(this)).
      */
     function allowThis(euint16 value) internal {
-        _acl().allow(euint16.unwrap(value), address(this));
+        _noxComputeContract().allow(euint16.unwrap(value), address(this));
     }
 
     /**
      * @dev Allows the use of value for this address (address(this)).
      */
     function allowThis(euint256 value) internal {
-        _acl().allow(euint256.unwrap(value), address(this));
+        _noxComputeContract().allow(euint256.unwrap(value), address(this));
     }
 
     /**
      * @dev Allows the use of value for this address (address(this)).
      */
     function allowThis(eint16 value) internal {
-        _acl().allow(eint16.unwrap(value), address(this));
+        _noxComputeContract().allow(eint16.unwrap(value), address(this));
     }
 
     /**
      * @dev Allows the use of value for this address (address(this)).
      */
     function allowThis(eint256 value) internal {
-        _acl().allow(eint256.unwrap(value), address(this));
+        _noxComputeContract().allow(eint256.unwrap(value), address(this));
     }
 
     /**
      * @dev Allows the use of value by address account for this transaction.
      */
     function allowTransient(ebool value, address account) internal {
-        _acl().allowTransient(ebool.unwrap(value), account);
+        _noxComputeContract().allowTransient(ebool.unwrap(value), account);
     }
 
     /**
      * @dev Allows the use of value by address account for this transaction.
      */
     function allowTransient(eaddress value, address account) internal {
-        _acl().allowTransient(eaddress.unwrap(value), account);
+        _noxComputeContract().allowTransient(eaddress.unwrap(value), account);
     }
 
     /**
      * @dev Allows the use of value by address account for this transaction.
      */
     function allowTransient(euint16 value, address account) internal {
-        _acl().allowTransient(euint16.unwrap(value), account);
+        _noxComputeContract().allowTransient(euint16.unwrap(value), account);
     }
 
     /**
      * @dev Allows the use of value by address account for this transaction.
      */
     function allowTransient(euint256 value, address account) internal {
-        _acl().allowTransient(euint256.unwrap(value), account);
+        _noxComputeContract().allowTransient(euint256.unwrap(value), account);
     }
 
     /**
      * @dev Allows the use of value by address account for this transaction.
      */
     function allowTransient(eint16 value, address account) internal {
-        _acl().allowTransient(eint16.unwrap(value), account);
+        _noxComputeContract().allowTransient(eint16.unwrap(value), account);
     }
 
     /**
      * @dev Allows the use of value by address account for this transaction.
      */
     function allowTransient(eint256 value, address account) internal {
-        _acl().allowTransient(eint256.unwrap(value), account);
+        _noxComputeContract().allowTransient(eint256.unwrap(value), account);
     }
 
     /**
      * @dev Checks if the handle is allowed for the account.
      */
     function isAllowed(ebool handle, address account) internal view returns (bool) {
-        return _acl().isAllowed(ebool.unwrap(handle), account);
+        return _noxComputeContract().isAllowed(ebool.unwrap(handle), account);
     }
 
     /**
      * @dev Checks if the handle is allowed for the account.
      */
     function isAllowed(eaddress handle, address account) internal view returns (bool) {
-        return _acl().isAllowed(eaddress.unwrap(handle), account);
+        return _noxComputeContract().isAllowed(eaddress.unwrap(handle), account);
     }
 
     /**
      * @dev Checks if the handle is allowed for the account.
      */
     function isAllowed(euint16 handle, address account) internal view returns (bool) {
-        return _acl().isAllowed(euint16.unwrap(handle), account);
+        return _noxComputeContract().isAllowed(euint16.unwrap(handle), account);
     }
 
     /**
      * @dev Checks if the handle is allowed for the account.
      */
     function isAllowed(euint256 handle, address account) internal view returns (bool) {
-        return _acl().isAllowed(euint256.unwrap(handle), account);
+        return _noxComputeContract().isAllowed(euint256.unwrap(handle), account);
     }
 
     /**
      * @dev Checks if the handle is allowed for the account.
      */
     function isAllowed(eint16 handle, address account) internal view returns (bool) {
-        return _acl().isAllowed(eint16.unwrap(handle), account);
+        return _noxComputeContract().isAllowed(eint16.unwrap(handle), account);
     }
 
     /**
      * @dev Checks if the handle is allowed for the account.
      */
     function isAllowed(eint256 handle, address account) internal view returns (bool) {
-        return _acl().isAllowed(eint256.unwrap(handle), account);
+        return _noxComputeContract().isAllowed(eint256.unwrap(handle), account);
     }
 
     // ============ VIEWER MANAGEMENT ============
@@ -710,84 +705,84 @@ library Nox {
      * @dev Adds a viewer for an ebool handle.
      */
     function addViewer(ebool value, address viewer) internal {
-        _acl().addViewer(ebool.unwrap(value), viewer);
+        _noxComputeContract().addViewer(ebool.unwrap(value), viewer);
     }
 
     /**
      * @dev Adds a viewer for an eaddress handle.
      */
     function addViewer(eaddress value, address viewer) internal {
-        _acl().addViewer(eaddress.unwrap(value), viewer);
+        _noxComputeContract().addViewer(eaddress.unwrap(value), viewer);
     }
 
     /**
      * @dev Adds a viewer for an euint16 handle.
      */
     function addViewer(euint16 value, address viewer) internal {
-        _acl().addViewer(euint16.unwrap(value), viewer);
+        _noxComputeContract().addViewer(euint16.unwrap(value), viewer);
     }
 
     /**
      * @dev Adds a viewer for an euint256 handle.
      */
     function addViewer(euint256 value, address viewer) internal {
-        _acl().addViewer(euint256.unwrap(value), viewer);
+        _noxComputeContract().addViewer(euint256.unwrap(value), viewer);
     }
 
     /**
      * @dev Adds a viewer for an eint16 handle.
      */
     function addViewer(eint16 value, address viewer) internal {
-        _acl().addViewer(eint16.unwrap(value), viewer);
+        _noxComputeContract().addViewer(eint16.unwrap(value), viewer);
     }
 
     /**
      * @dev Adds a viewer for an eint256 handle.
      */
     function addViewer(eint256 value, address viewer) internal {
-        _acl().addViewer(eint256.unwrap(value), viewer);
+        _noxComputeContract().addViewer(eint256.unwrap(value), viewer);
     }
 
     /**
      * @dev Checks if the viewer can view the handle.
      */
     function isViewer(ebool handle, address viewer) internal view returns (bool) {
-        return _acl().isViewer(ebool.unwrap(handle), viewer);
+        return _noxComputeContract().isViewer(ebool.unwrap(handle), viewer);
     }
 
     /**
      * @dev Checks if the viewer can view the handle.
      */
     function isViewer(eaddress handle, address viewer) internal view returns (bool) {
-        return _acl().isViewer(eaddress.unwrap(handle), viewer);
+        return _noxComputeContract().isViewer(eaddress.unwrap(handle), viewer);
     }
 
     /**
      * @dev Checks if the viewer can view the handle.
      */
     function isViewer(euint16 handle, address viewer) internal view returns (bool) {
-        return _acl().isViewer(euint16.unwrap(handle), viewer);
+        return _noxComputeContract().isViewer(euint16.unwrap(handle), viewer);
     }
 
     /**
      * @dev Checks if the viewer can view the handle.
      */
     function isViewer(euint256 handle, address viewer) internal view returns (bool) {
-        return _acl().isViewer(euint256.unwrap(handle), viewer);
+        return _noxComputeContract().isViewer(euint256.unwrap(handle), viewer);
     }
 
     /**
      * @dev Checks if the viewer can view the handle.
      */
     function isViewer(eint16 handle, address viewer) internal view returns (bool) {
-        return _acl().isViewer(eint16.unwrap(handle), viewer);
+        return _noxComputeContract().isViewer(eint16.unwrap(handle), viewer);
     }
 
     /**
      * @dev Checks if the viewer can view the handle.
      */
     function isViewer(eint256 handle, address viewer) internal view returns (bool) {
-        return _acl().isViewer(eint256.unwrap(handle), viewer);
+        return _noxComputeContract().isViewer(eint256.unwrap(handle), viewer);
     }
 
     // ============ PUBLIC DECRYPTION ============
@@ -796,84 +791,84 @@ library Nox {
      * @dev Marks an ebool handle as publicly decryptable.
      */
     function allowPublicDecryption(ebool value) internal {
-        _acl().allowPublicDecryption(ebool.unwrap(value));
+        _noxComputeContract().allowPublicDecryption(ebool.unwrap(value));
     }
 
     /**
      * @dev Marks an eaddress handle as publicly decryptable.
      */
     function allowPublicDecryption(eaddress value) internal {
-        _acl().allowPublicDecryption(eaddress.unwrap(value));
+        _noxComputeContract().allowPublicDecryption(eaddress.unwrap(value));
     }
 
     /**
      * @dev Marks an euint16 handle as publicly decryptable.
      */
     function allowPublicDecryption(euint16 value) internal {
-        _acl().allowPublicDecryption(euint16.unwrap(value));
+        _noxComputeContract().allowPublicDecryption(euint16.unwrap(value));
     }
 
     /**
      * @dev Marks an euint256 handle as publicly decryptable.
      */
     function allowPublicDecryption(euint256 value) internal {
-        _acl().allowPublicDecryption(euint256.unwrap(value));
+        _noxComputeContract().allowPublicDecryption(euint256.unwrap(value));
     }
 
     /**
      * @dev Marks an eint16 handle as publicly decryptable.
      */
     function allowPublicDecryption(eint16 value) internal {
-        _acl().allowPublicDecryption(eint16.unwrap(value));
+        _noxComputeContract().allowPublicDecryption(eint16.unwrap(value));
     }
 
     /**
      * @dev Marks an eint256 handle as publicly decryptable.
      */
     function allowPublicDecryption(eint256 value) internal {
-        _acl().allowPublicDecryption(eint256.unwrap(value));
+        _noxComputeContract().allowPublicDecryption(eint256.unwrap(value));
     }
 
     /**
      * @dev Checks if the handle is publicly decryptable.
      */
     function isPubliclyDecryptable(ebool handle) internal view returns (bool) {
-        return _acl().isPubliclyDecryptable(ebool.unwrap(handle));
+        return _noxComputeContract().isPubliclyDecryptable(ebool.unwrap(handle));
     }
 
     /**
      * @dev Checks if the handle is publicly decryptable.
      */
     function isPubliclyDecryptable(eaddress handle) internal view returns (bool) {
-        return _acl().isPubliclyDecryptable(eaddress.unwrap(handle));
+        return _noxComputeContract().isPubliclyDecryptable(eaddress.unwrap(handle));
     }
 
     /**
      * @dev Checks if the handle is publicly decryptable.
      */
     function isPubliclyDecryptable(euint16 handle) internal view returns (bool) {
-        return _acl().isPubliclyDecryptable(euint16.unwrap(handle));
+        return _noxComputeContract().isPubliclyDecryptable(euint16.unwrap(handle));
     }
 
     /**
      * @dev Checks if the handle is publicly decryptable.
      */
     function isPubliclyDecryptable(euint256 handle) internal view returns (bool) {
-        return _acl().isPubliclyDecryptable(euint256.unwrap(handle));
+        return _noxComputeContract().isPubliclyDecryptable(euint256.unwrap(handle));
     }
 
     /**
      * @dev Checks if the handle is publicly decryptable.
      */
     function isPubliclyDecryptable(eint16 handle) internal view returns (bool) {
-        return _acl().isPubliclyDecryptable(eint16.unwrap(handle));
+        return _noxComputeContract().isPubliclyDecryptable(eint16.unwrap(handle));
     }
 
     /**
      * @dev Checks if the handle is publicly decryptable.
      */
     function isPubliclyDecryptable(eint256 handle) internal view returns (bool) {
-        return _acl().isPubliclyDecryptable(eint256.unwrap(handle));
+        return _noxComputeContract().isPubliclyDecryptable(eint256.unwrap(handle));
     }
 
     // ============ Private helpers ============
@@ -885,80 +880,80 @@ library Nox {
     function _add(bytes32 a, bytes32 b) private returns (bytes32) {
         _assertInitialized(a);
         _assertInitialized(b);
-        return _compute().add(a, b);
+        return _noxComputeContract().add(a, b);
     }
 
     function _sub(bytes32 a, bytes32 b) private returns (bytes32) {
         _assertInitialized(a);
         _assertInitialized(b);
-        return _compute().sub(a, b);
+        return _noxComputeContract().sub(a, b);
     }
 
     function _mul(bytes32 a, bytes32 b) private returns (bytes32) {
         _assertInitialized(a);
         _assertInitialized(b);
-        return _compute().mul(a, b);
+        return _noxComputeContract().mul(a, b);
     }
 
     function _div(bytes32 a, bytes32 b) private returns (bytes32) {
         _assertInitialized(a);
         _assertInitialized(b);
-        return _compute().div(a, b);
+        return _noxComputeContract().div(a, b);
     }
 
     function _safeAdd(bytes32 a, bytes32 b) private returns (bytes32, bytes32) {
         _assertInitialized(a);
         _assertInitialized(b);
-        return _compute().safeAdd(a, b);
+        return _noxComputeContract().safeAdd(a, b);
     }
 
     function _safeSub(bytes32 a, bytes32 b) private returns (bytes32, bytes32) {
         _assertInitialized(a);
         _assertInitialized(b);
-        return _compute().safeSub(a, b);
+        return _noxComputeContract().safeSub(a, b);
     }
 
     function _select(bytes32 condition, bytes32 ifTrue, bytes32 ifFalse) private returns (bytes32) {
         _assertInitialized(condition);
         _assertInitialized(ifTrue);
         _assertInitialized(ifFalse);
-        return _compute().select(condition, ifTrue, ifFalse);
+        return _noxComputeContract().select(condition, ifTrue, ifFalse);
     }
 
     function _eq(bytes32 a, bytes32 b) private returns (bytes32) {
         _assertInitialized(a);
         _assertInitialized(b);
-        return _compute().eq(a, b);
+        return _noxComputeContract().eq(a, b);
     }
 
     function _ne(bytes32 a, bytes32 b) private returns (bytes32) {
         _assertInitialized(a);
         _assertInitialized(b);
-        return _compute().ne(a, b);
+        return _noxComputeContract().ne(a, b);
     }
 
     function _lt(bytes32 a, bytes32 b) private returns (bytes32) {
         _assertInitialized(a);
         _assertInitialized(b);
-        return _compute().lt(a, b);
+        return _noxComputeContract().lt(a, b);
     }
 
     function _le(bytes32 a, bytes32 b) private returns (bytes32) {
         _assertInitialized(a);
         _assertInitialized(b);
-        return _compute().le(a, b);
+        return _noxComputeContract().le(a, b);
     }
 
     function _gt(bytes32 a, bytes32 b) private returns (bytes32) {
         _assertInitialized(a);
         _assertInitialized(b);
-        return _compute().gt(a, b);
+        return _noxComputeContract().gt(a, b);
     }
 
     function _ge(bytes32 a, bytes32 b) private returns (bytes32) {
         _assertInitialized(a);
         _assertInitialized(b);
-        return _compute().ge(a, b);
+        return _noxComputeContract().ge(a, b);
     }
 
     function _transfer(
@@ -969,7 +964,7 @@ library Nox {
         _assertInitialized(balanceFrom);
         _assertInitialized(balanceTo);
         _assertInitialized(amount);
-        return _compute().transfer(balanceFrom, balanceTo, amount);
+        return _noxComputeContract().transfer(balanceFrom, balanceTo, amount);
     }
 
     function _mint(
@@ -980,7 +975,7 @@ library Nox {
         _assertInitialized(balanceTo);
         _assertInitialized(amount);
         _assertInitialized(totalSupply);
-        return _compute().mint(balanceTo, amount, totalSupply);
+        return _noxComputeContract().mint(balanceTo, amount, totalSupply);
     }
 
     function _burn(
@@ -991,6 +986,6 @@ library Nox {
         _assertInitialized(balanceFrom);
         _assertInitialized(amount);
         _assertInitialized(totalSupply);
-        return _compute().burn(balanceFrom, amount, totalSupply);
+        return _noxComputeContract().burn(balanceFrom, amount, totalSupply);
     }
 }

package/contracts/shared/TypeUtils.sol

@@ -112,7 +112,6 @@ enum TEEType {
     Bytes32 // 99
 }
 
-error UnsupportedType();
 error NonArithmeticType();
 
 library TypeUtils {
@@ -126,27 +125,14 @@ library TypeUtils {
         return TEEType(uint8(handle[30]));
     }
 
-    /**
-     * @notice Validates that a TEE type is within the valid range.
-     * Reverts with UnsupportedType if the type value is out of range.
-     * @param teeType The TEE type to validate
-     */
-    function validateType(TEEType teeType) internal pure {
-        if (uint8(teeType) > uint8(TEEType.Bytes32)) {
-            revert UnsupportedType();
-        }
-    }
-
     /**
      * @notice Validates that a TEE type is supported for arithmetic operations.
      * Only unsigned integers (Uint8-Uint256) and signed integers (Int8-Int256) are supported.
-     * Reverts with UnsupportedType if the type is not arithmetic.
+     * Reverts with NonArithmeticType if the type is not arithmetic.
      * @param teeType The TEE type to validate
      */
     function validateArithmeticType(TEEType teeType) internal pure {
         uint8 t = uint8(teeType);
-        if (t < uint8(TEEType.Uint8) || t > uint8(TEEType.Int256)) {
-            revert NonArithmeticType();
-        }
+        require(t >= uint8(TEEType.Uint8) && t <= uint8(TEEType.Int256), NonArithmeticType());
     }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@iexec-nox/nox-protocol-contracts",
-  "version": "0.1.0-beta.4",
+  "version": "0.1.0-beta.5",
   "description": "Nox protocol smart contracts",
   "keywords": [
     "Nox",
@@ -22,10 +22,10 @@
     "test": "pnpm hardhat test",
     "coverage": "pnpm hardhat test solidity --coverage",
     "deploy": "pnpm hardhat run scripts/deploy.ts",
+    "deploy:production": "pnpm hardhat run scripts/deploy.ts --build-profile production",
     "set-gateway": "pnpm hardhat run scripts/set-gateway.ts",
     "set-kms-public-key": "pnpm hardhat run scripts/set-kms-public-key.ts",
-    "upgrade-acl": "pnpm hardhat run scripts/upgrade-acl.ts",
-    "upgrade-nox-compute": "pnpm hardhat run scripts/upgrade-nox-compute.ts",
+    "upgrade": "pnpm hardhat run scripts/upgrade.ts",
     "format": "pnpm prettier --write .",
     "format:check": "pnpm prettier --check ."
   },
@@ -44,7 +44,7 @@
     "@nomicfoundation/hardhat-toolbox-viem": "^5.0.1",
     "@types/node": "^22.8.5",
     "forge-std": "github:foundry-rs/forge-std#v1.9.4",
-    "hardhat": "^3.1.2",
+    "hardhat": "^3.1.10",
     "husky": "^9.1.7",
     "lint-staged": "^16.2.7",
     "prettier": "^3.7.4",

package/contracts/interfaces/IACL.sol

@@ -1,109 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-pragma solidity ^0.8.0;
-
-import "./IErrors.sol";
-
-/**
- * @title IACL
- * @dev Interface for the ACL (Access Control List) permission management system
- */
-interface IACL is IErrors {
-    /// Error thrown when sender doesn't have access to the handle
-    error UnauthorizedSender(address sender);
-
-    /// Error thrown when an account is not allowed to use a handle
-    error NotAllowed(bytes32 handle, address account);
-
-    /// Emitted when admin role is granted
-    event Allowed(address indexed sender, address indexed account, bytes32 indexed handle);
-
-    /// Emitted when viewer role is granted
-    event ViewerAdded(address indexed sender, address indexed viewer, bytes32 indexed handle);
-
-    /// Emitted when a handle is marked as publicly decryptable
-    event MarkedAsPubliclyDecryptable(address indexed sender, bytes32 indexed handle);
-
-    /// Emitted when the NoxCompute address is updated
-    event NoxComputeUpdated(address indexed newNoxCompute);
-
-    /**
-     * Updates the NoxCompute address.
-     * @dev Only callable by the owner.
-     * @param newNoxCompute The new NoxCompute address.
-     */
-    function setNoxCompute(address newNoxCompute) external;
-
-    /**
-     * Mark a handle as publicly decryptable.
-     * @dev The caller must be allowed to use the handle.
-     *      If not, the function reverts.
-     * @param handle Handle to mark as publicly decryptable.
-     */
-    function allowPublicDecryption(bytes32 handle) external;
-
-    /**
-     * Checks whether a handle is publicly decryptable.
-     * @param handle Handle.
-     * @return Whether the handle is publicly decryptable.
-     */
-    function isPubliclyDecryptable(bytes32 handle) external view returns (bool);
-
-    /**
-     * Grant admin role to another address for a specific handle
-     * @dev Caller must have access (transient OR persistent) to the handle
-     * @param handle The handle identifier
-     * @param account The address to grant admin role
-     */
-    function allow(bytes32 handle, address account) external;
-
-    /**
-     * Allows the use of `handle` by address `account` for this transaction.
-     * @param handle Handle.
-     * @param account Address of the account.
-     */
-    function allowTransient(bytes32 handle, address account) external;
-
-    /**
-     * Removes all transient authorizations. This is useful for integration with Account Abstraction
-     * when bundling several UserOps calling the NoxCompute.
-     * @dev Can be called by anyone (typically by AA bundlers between UserOps).
-     */
-    function cleanTransientStorage() external;
-
-    /**
-     * Add a viewer for a specific handle
-     * @dev Only an admin can add a viewer. The viewer address cannot be address(0).
-     * @param handle The handle identifier
-     * @param viewer The address to grant viewer role
-     */
-    function addViewer(bytes32 handle, address viewer) external;
-
-    /**
-     * Returns whether the account is allowed to use the `handle`, either due to
-     * allowTransient() or allow().
-     * @param handle Handle.
-     * @param account Address of the account.
-     * @return Whether the account can access the handle (persistent or transient).
-     */
-    function isAllowed(bytes32 handle, address account) external view returns (bool);
-
-    /**
-     * Checks whether the account is allowed to use all provided handles.
-     * Reverts with NotAllowed if any handle is not allowed.
-     * @param account Address of the account.
-     * @param handles Array of handles to check.
-     */
-    function validateAllowedForAll(address account, bytes32[] calldata handles) external view;
-
-    /**
-     * Returns whether the account can view the handle.
-     * @dev Returns true if any of the following conditions are met:
-     *      - The handle is publicly decryptable
-     *      - The account was added as a viewer via `addViewer`
-     *      - The account has persistent access (is allowed) on the handle
-     * @param handle Handle.
-     * @param viewer Address of the viewer.
-     * @return Whether the account can view the handle.
-     */
-    function isViewer(bytes32 handle, address viewer) external view returns (bool);
-}

package/contracts/interfaces/IErrors.sol

@@ -1,14 +0,0 @@
-// SPDX-License-Identifier: Apache-2.0
-pragma solidity ^0.8.0;
-
-/**
- * @title IErrors
- * @notice Common error definitions shared across contracts
- */
-interface IErrors {
-    /// Error thrown when account address is zero
-    error InvalidZeroAddress();
-
-    /// Error thrown when bytes parameter is empty
-    error InvalidEmptyBytes();
-}