@openzeppelin/compact-contracts 0.1.0 → 0.3.0-alpha

package/token/NonFungibleToken.compact

@@ -1,7 +1,7 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.1.0 (token/NonFungibleToken.compact)
+// OpenZeppelin Compact Contracts v0.3.0-alpha (token/NonFungibleToken.compact)
 
-pragma language_version >= 0.21.0;
+pragma language_version >= 0.23.0;
 
 /**
  * @module NonFungibleToken
@@ -83,13 +83,19 @@ pragma language_version >= 0.21.0;
 
 module NonFungibleToken {
   import CompactStandardLibrary;
-  import "../security/Initializable" prefix Initializable_;
   import "../utils/Utils" prefix Utils_;
 
   /// Public state
   export sealed ledger _name: Opaque<"string">;
   export sealed ledger _symbol: Opaque<"string">;
 
+  /**
+   * @description Initialization flag, tracked per-module to avoid the compiler's
+   * shared transitive-dependency state bug (LFDT-Minokawa/compact#270). See the
+   * Initializable module for rationale.
+   */
+  export ledger _isInitialized: Boolean;
+
   /**
    * @description Mapping from token IDs to their owner addresses.
    * @type {Uint<128>} tokenId - The unique identifier for a token.
@@ -148,18 +154,6 @@ module NonFungibleToken {
    */
   witness wit_NonFungibleTokenSK(): Bytes<32>;
 
-  /**
-   * @description Returns a canonical zero Either value (left variant with zero Bytes<32>).
-   * Used as the zero value for mint/burn operations and cleared approvals.
-   *
-   * @return {Either<Bytes<32>, ContractAddress>} - The zero value.
-   */
-  export pure circuit ZERO(): Either<Bytes<32>, ContractAddress> {
-    return Either<Bytes<32>, ContractAddress> {
-      is_left: true, left: default<Bytes<32>>, right: default<ContractAddress>
-    };
-  }
-
   /**
    * @description Initializes the contract by setting the name and symbol.
    *
@@ -177,11 +171,38 @@ module NonFungibleToken {
    * @return {[]} - Empty tuple.
    */
   export circuit initialize(name_: Opaque<"string">, symbol_: Opaque<"string">): [] {
-    Initializable_initialize();
+    assertNotInitialized();
+    _isInitialized = true;
     _name = disclose(name_);
     _symbol = disclose(symbol_);
   }
 
+  /**
+   * @description Asserts that the contract has been initialized, throwing an error if not.
+   *
+   * Requirements:
+   *
+   * - Contract must be initialized.
+   *
+   * @return {[]} - Empty tuple.
+   */
+  circuit assertInitialized(): [] {
+    assert(_isInitialized, "NonFungibleToken: contract not initialized");
+  }
+
+  /**
+   * @description Asserts that the contract has not been initialized, throwing an error if it has.
+   *
+   * Requirements:
+   *
+   * - Contract must not be initialized.
+   *
+   * @return {[]} - Empty tuple.
+   */
+  circuit assertNotInitialized(): [] {
+    assert(!_isInitialized, "NonFungibleToken: contract already initialized");
+  }
+
   /**
    * @description Returns the number of tokens in `owner`'s account.
    *
@@ -195,7 +216,7 @@ module NonFungibleToken {
    * @return {Uint<128>} - The number of tokens in `owner`'s account.
    */
   export circuit balanceOf(owner: Either<Bytes<32>, ContractAddress>): Uint<128> {
-    Initializable_assertInitialized();
+    assertInitialized();
     const canonOwner = Utils_canonicalize<Bytes<32>, ContractAddress>(owner);
 
     if (!_balances.member(disclose(canonOwner))) {
@@ -219,7 +240,7 @@ module NonFungibleToken {
    * @return {Either<Bytes<32>, ContractAddress>} - The account that owns the token.
    */
   export circuit ownerOf(tokenId: Uint<128>): Either<Bytes<32>, ContractAddress> {
-    Initializable_assertInitialized();
+    assertInitialized();
     return _requireOwned(tokenId);
   }
 
@@ -235,7 +256,7 @@ module NonFungibleToken {
    * @return {Opaque<"string">} - The token name.
    */
   export circuit name(): Opaque<"string"> {
-    Initializable_assertInitialized();
+    assertInitialized();
     return _name;
   }
 
@@ -251,7 +272,7 @@ module NonFungibleToken {
    * @return {Opaque<"string">} - The token symbol.
    */
   export circuit symbol(): Opaque<"string"> {
-    Initializable_assertInitialized();
+    assertInitialized();
     return _symbol;
   }
 
@@ -275,7 +296,7 @@ module NonFungibleToken {
    * @return {Opaque<"string">} - the token id's URI.
    */
   export circuit tokenURI(tokenId: Uint<128>): Opaque<"string"> {
-    Initializable_assertInitialized();
+    assertInitialized();
     _requireOwned(tokenId);
 
     if (!_tokenURIs.member(disclose(tokenId))) {
@@ -302,7 +323,7 @@ module NonFungibleToken {
    * @return {[]} - Empty tuple.
    */
   export circuit _setTokenURI(tokenId: Uint<128>, tokenURI: Opaque<"string">): [] {
-    Initializable_assertInitialized();
+    assertInitialized();
     _requireOwned(tokenId);
 
     return _tokenURIs.insert(disclose(tokenId), disclose(tokenURI));
@@ -330,7 +351,7 @@ module NonFungibleToken {
    * @return {[]} - Empty tuple.
    */
   export circuit approve(to: Either<Bytes<32>, ContractAddress>, tokenId: Uint<128>): [] {
-    Initializable_assertInitialized();
+    assertInitialized();
     const auth = left<Bytes<32>, ContractAddress>(_computeAccountId());
     _approve(to, tokenId, auth);
   }
@@ -349,7 +370,7 @@ module NonFungibleToken {
    * @return {Either<Bytes<32>, ContractAddress>} - The account approved to manage the token
    */
   export circuit getApproved(tokenId: Uint<128>): Either<Bytes<32>, ContractAddress> {
-    Initializable_assertInitialized();
+    assertInitialized();
     _requireOwned(tokenId);
 
     return _getApproved(tokenId);
@@ -377,7 +398,7 @@ module NonFungibleToken {
                    operator: Either<Bytes<32>, ContractAddress>,
                    approved: Boolean
                    ): [] {
-    Initializable_assertInitialized();
+    assertInitialized();
     const owner = left<Bytes<32>, ContractAddress>(_computeAccountId());
     _setApprovalForAll(owner, operator, approved);
   }
@@ -399,7 +420,7 @@ module NonFungibleToken {
                    owner: Either<Bytes<32>, ContractAddress>,
                    operator: Either<Bytes<32>, ContractAddress>
                    ): Boolean {
-    Initializable_assertInitialized();
+    assertInitialized();
     const canonOwner = Utils_canonicalize<Bytes<32>, ContractAddress>(owner);
     const canonOp = Utils_canonicalize<Bytes<32>, ContractAddress>(operator);
 
@@ -439,7 +460,7 @@ module NonFungibleToken {
                    to: Either<Bytes<32>, ContractAddress>,
                    tokenId: Uint<128>
                    ): [] {
-    Initializable_assertInitialized();
+    assertInitialized();
     const isContractAddr = !to.is_left;
     assert(!isContractAddr, "NonFungibleToken: unsafe transfer");
 
@@ -476,8 +497,8 @@ module NonFungibleToken {
                    to: Either<Bytes<32>, ContractAddress>,
                    tokenId: Uint<128>
                    ): [] {
-    Initializable_assertInitialized();
-    assert(!_isTargetZero(to), "NonFungibleToken: invalid receiver");
+    assertInitialized();
+    assert(!Utils_isTargetZero(to), "NonFungibleToken: invalid receiver");
     // Setting an "auth" argument enables the `_isAuthorized` check which verifies that the token exists
     // (fromAddress != 0). Therefore, it is not needed to verify that the return value is not 0 here.
     const auth = left<Bytes<32>, ContractAddress>(_computeAccountId());
@@ -500,9 +521,9 @@ module NonFungibleToken {
    * @return {Either<Bytes<32>, ContractAddress>} - The owner of the token
    */
   export circuit _ownerOf(tokenId: Uint<128>): Either<Bytes<32>, ContractAddress> {
-    Initializable_assertInitialized();
+    assertInitialized();
     if (!_owners.member(disclose(tokenId))) {
-      return ZERO();
+      return Utils_zeroAccount();
     }
 
     return _owners.lookup(disclose(tokenId));
@@ -521,9 +542,9 @@ module NonFungibleToken {
    * @return {Either<Bytes<32>, ContractAddress>} - An account approved to spend `tokenId`
    */
   export circuit _getApproved(tokenId: Uint<128>): Either<Bytes<32>, ContractAddress> {
-    Initializable_assertInitialized();
+    assertInitialized();
     if (!_tokenApprovals.member(disclose(tokenId))) {
-      return ZERO();
+      return Utils_zeroAccount();
     }
     return _tokenApprovals.lookup(disclose(tokenId));
   }
@@ -551,11 +572,11 @@ module NonFungibleToken {
                    spender: Either<Bytes<32>, ContractAddress>,
                    tokenId: Uint<128>
                    ): Boolean {
-    Initializable_assertInitialized();
+    assertInitialized();
     const canonOwner = Utils_canonicalize<Bytes<32>, ContractAddress>(owner);
     const canonSpender = Utils_canonicalize<Bytes<32>, ContractAddress>(spender);
 
-    return (!_isTargetZero(disclose(canonSpender)) &&
+    return (!Utils_isTargetZero(disclose(canonSpender)) &&
             (disclose(canonOwner) == disclose(canonSpender) ||
              isApprovedForAll(canonOwner, canonSpender) ||
              _getApproved(tokenId) == disclose(canonSpender)));
@@ -584,9 +605,9 @@ module NonFungibleToken {
                    spender: Either<Bytes<32>, ContractAddress>,
                    tokenId: Uint<128>
                    ): [] {
-    Initializable_assertInitialized();
+    assertInitialized();
     if (!_isAuthorized(owner, spender, tokenId)) {
-      assert(!_isTargetZero(owner), "NonFungibleToken: nonexistent token");
+      assert(!Utils_isTargetZero(owner), "NonFungibleToken: nonexistent token");
       assert(false, "NonFungibleToken: insufficient approval");
     }
   }
@@ -610,26 +631,26 @@ module NonFungibleToken {
                   tokenId: Uint<128>,
                   auth: Either<Bytes<32>, ContractAddress>
                   ): Either<Bytes<32>, ContractAddress> {
-    Initializable_assertInitialized();
+    assertInitialized();
     const canonTo = Utils_canonicalize<Bytes<32>, ContractAddress>(to);
     const canonAuth = Utils_canonicalize<Bytes<32>, ContractAddress>(auth);
     const fromAddress = _ownerOf(tokenId);
 
     // Perform (optional) operator check
-    if (!_isTargetZero(disclose(canonAuth))) {
+    if (!Utils_isTargetZero(disclose(canonAuth))) {
       _checkAuthorized(fromAddress, canonAuth, tokenId);
     }
 
     // Execute the update
-    if (!_isTargetZero(disclose(fromAddress))) {
+    if (!Utils_isTargetZero(disclose(fromAddress))) {
       // Clear approval. No need to re-authorize
-      _approve(ZERO(), tokenId, ZERO());
+      _approve(Utils_zeroAccount(), tokenId, Utils_zeroAccount());
       const canonFrom = Utils_canonicalize<Bytes<32>, ContractAddress>(fromAddress);
       const newBalance = _balances.lookup(disclose(canonFrom)) - 1 as Uint<128>;
       _balances.insert(disclose(canonFrom), disclose(newBalance));
     }
 
-    if (!_isTargetZero(disclose(canonTo))) {
+    if (!Utils_isTargetZero(disclose(canonTo))) {
       if (!_balances.member(disclose(canonTo))) {
         _balances.insert(disclose(canonTo), 0);
       }
@@ -659,7 +680,7 @@ module NonFungibleToken {
    * @return {[]} - Empty tuple.
    */
   export circuit _mint(to: Either<Bytes<32>, ContractAddress>, tokenId: Uint<128>): [] {
-    Initializable_assertInitialized();
+    assertInitialized();
     const isContractAddr = !to.is_left;
     assert(!isContractAddr, "NonFungibleToken: unsafe transfer");
 
@@ -689,12 +710,12 @@ module NonFungibleToken {
                    to: Either<Bytes<32>, ContractAddress>,
                    tokenId: Uint<128>
                    ): [] {
-    Initializable_assertInitialized();
-    assert(!_isTargetZero(to), "NonFungibleToken: invalid receiver");
+    assertInitialized();
+    assert(!Utils_isTargetZero(to), "NonFungibleToken: invalid receiver");
 
-    const previousOwner = _update(to, tokenId, ZERO());
+    const previousOwner = _update(to, tokenId, Utils_zeroAccount());
 
-    assert(_isTargetZero(previousOwner), "NonFungibleToken: invalid sender");
+    assert(Utils_isTargetZero(previousOwner), "NonFungibleToken: invalid sender");
   }
 
   /**
@@ -713,9 +734,9 @@ module NonFungibleToken {
    * @return {[]} - Empty tuple.
    */
   export circuit _burn(tokenId: Uint<128>): [] {
-    Initializable_assertInitialized();
-    const previousOwner = _update(ZERO(), tokenId, ZERO());
-    assert(!_isTargetZero(previousOwner), "NonFungibleToken: invalid sender");
+    assertInitialized();
+    const previousOwner = _update(Utils_zeroAccount(), tokenId, Utils_zeroAccount());
+    assert(!Utils_isTargetZero(previousOwner), "NonFungibleToken: invalid sender");
     _tokenURIs.remove(disclose(tokenId));
   }
 
@@ -746,7 +767,7 @@ module NonFungibleToken {
                    to: Either<Bytes<32>, ContractAddress>,
                    tokenId: Uint<128>
                    ): [] {
-    Initializable_assertInitialized();
+    assertInitialized();
     const isContractAddr = !to.is_left;
     assert(!isContractAddr, "NonFungibleToken: unsafe transfer");
 
@@ -780,12 +801,12 @@ module NonFungibleToken {
                    to: Either<Bytes<32>, ContractAddress>,
                    tokenId: Uint<128>
                    ): [] {
-    Initializable_assertInitialized();
-    assert(!_isTargetZero(to), "NonFungibleToken: invalid receiver");
+    assertInitialized();
+    assert(!Utils_isTargetZero(to), "NonFungibleToken: invalid receiver");
 
-    const previousOwner = _update(to, tokenId, ZERO());
+    const previousOwner = _update(to, tokenId, Utils_zeroAccount());
 
-    assert(!_isTargetZero(previousOwner), "NonFungibleToken: nonexistent token");
+    assert(!Utils_isTargetZero(previousOwner), "NonFungibleToken: nonexistent token");
 
     const canonFrom = Utils_canonicalize<Bytes<32>, ContractAddress>(fromAddress);
     assert(previousOwner == canonFrom, "NonFungibleToken: incorrect owner");
@@ -812,15 +833,15 @@ module NonFungibleToken {
                    tokenId: Uint<128>,
                    auth: Either<Bytes<32>, ContractAddress>
                    ): [] {
-    Initializable_assertInitialized();
+    assertInitialized();
     // Canonicalize + normalize `to`
     const canonTo = Utils_canonicalize<Bytes<32>, ContractAddress>(to);
-    const normalizedTo = _isTargetZero(canonTo) ? ZERO() : canonTo;
+    const normalizedTo = Utils_isTargetZero(canonTo) ? Utils_zeroAccount() : canonTo;
 
     // Canonicalize auth
     const canonAuth = Utils_canonicalize<Bytes<32>, ContractAddress>(auth);
 
-    if (!_isTargetZero(disclose(canonAuth))) {
+    if (!Utils_isTargetZero(disclose(canonAuth))) {
       const owner = _requireOwned(tokenId);
 
       // We do not use _isAuthorized because single-token approvals should not be able to call approve
@@ -853,12 +874,12 @@ module NonFungibleToken {
                    operator: Either<Bytes<32>, ContractAddress>,
                    approved: Boolean
                    ): [] {
-    Initializable_assertInitialized();
+    assertInitialized();
     const canonOwner = Utils_canonicalize<Bytes<32>, ContractAddress>(owner);
-    assert(!_isTargetZero(canonOwner), "NonFungibleToken: invalid owner");
+    assert(!Utils_isTargetZero(canonOwner), "NonFungibleToken: invalid owner");
 
     const canonOp = Utils_canonicalize<Bytes<32>, ContractAddress>(operator);
-    assert(!_isTargetZero(canonOp), "NonFungibleToken: invalid operator");
+    assert(!Utils_isTargetZero(canonOp), "NonFungibleToken: invalid operator");
 
     if (!_operatorApprovals.member(disclose(canonOwner))) {
       _operatorApprovals.insert(
@@ -885,10 +906,10 @@ module NonFungibleToken {
    * @return {Either<Bytes<32>, ContractAddress>} - The owner of `tokenId`
    */
   export circuit _requireOwned(tokenId: Uint<128>): Either<Bytes<32>, ContractAddress> {
-    Initializable_assertInitialized();
+    assertInitialized();
     const owner = _ownerOf(tokenId);
 
-    assert(!_isTargetZero(owner), "NonFungibleToken: nonexistent token");
+    assert(!Utils_isTargetZero(owner), "NonFungibleToken: nonexistent token");
     return owner;
   }
 
@@ -903,52 +924,6 @@ module NonFungibleToken {
    * @returns {Bytes<32>} accountId - The computed account identifier.
    */
   circuit _computeAccountId(): Bytes<32> {
-    return computeAccountId(wit_NonFungibleTokenSK());
-  }
-
-  /**
-   * @description Computes an account identifier without on-chain state, allowing a user to derive
-   * their identity commitment before submitting it in a token operation.
-   * This is the off-chain counterpart to {_computeAccountId} and produces an identical result
-   * given the same inputs.
-   *
-   * @warning OpSec: The `secretKey` parameter is a sensitive secret. Mishandling it can
-   * permanently compromise the security of this system:
-   *
-   * - **Never log or persist** the `secretKey` in plaintext — avoid browser devtools,
-   *   application logs, analytics pipelines, or any observable side-channel.
-   * - **Store offline or in secure enclaves** — hardware security modules (HSMs),
-   *   air-gapped devices, or encrypted vaults are strongly preferred over hot storage.
-   * - **Use cryptographically secure randomness** — generate keys with `crypto.getRandomValues()`
-   *   or equivalent; weak or predictable keys can be brute-forced to reveal your identity.
-   * - **Treat key loss as identity loss** — a lost key cannot be recovered.
-   * - **Avoid calling this circuit in untrusted environments** — executing this in an
-   *   unverified browser extension, compromised runtime, or shared machine may expose
-   *   the key to a malicious observer.
-   *
-   * ## ID Derivation
-   * `accountId = persistentHash(secretKey)`
-   *
-   * @param {Bytes<32>} secretKey - A 32-byte cryptographically secure random value.
-   *
-   * @returns {Bytes<32>} accountId - The computed account identifier.
-   */
-  export pure circuit computeAccountId(secretKey: Bytes<32>): Bytes<32> {
-    return persistentHash<Vector<1, Bytes<32>>>([secretKey]);
-  }
-
-  /**
-   * @description Returns `true` if `target`'s active branch (as indicated by `is_left`)
-   * holds the zero value.
-   *
-   * @param {Either<Bytes<32>, ContractAddress>} target - The value to check.
-   * @returns {Boolean} - `true` if the active branch is zero, `false` otherwise.
-   */
-  circuit _isTargetZero(target: Either<Bytes<32>, ContractAddress>): Boolean {
-    if (target.is_left) {
-      return target.left == default<Bytes<32>>;
-    } else {
-      return target.right == default<ContractAddress>;
-    }
+    return Utils_computeAccountId(wit_NonFungibleTokenSK());
   }
 }

package/utils/Utils.compact

@@ -1,7 +1,7 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.1.0 (utils/Utils.compact)
+// OpenZeppelin Compact Contracts v0.3.0-alpha (utils/Utils.compact)
 
-pragma language_version >= 0.21.0;
+pragma language_version >= 0.23.0;
 
 /**
  * @module Utils.
@@ -95,4 +95,88 @@ module Utils {
       ? Either<T1, T2>{ is_left: true, left: value.left, right: default<T2> }
       : Either<T1, T2>{ is_left: false, left: default<T1>, right: value.right };
   }
+
+  /**
+   * @description Returns the canonical zero `Either<Bytes<32>, ContractAddress>` value: the
+   * left variant (`Bytes<32>`) set to zero. Used as the sentinel for mint/burn operations
+   * (a zero `from` signals a mint, a zero `to` signals a burn) and for cleared approvals.
+   *
+   * The left variant is chosen so that `isTargetZero` checks against `default<Bytes<32>>`,
+   * and to avoid triggering contract-address guards (e.g. circuits that check `!to.is_left`
+   * before delegating to an `_unsafe` variant). A right variant with `default<ContractAddress>`
+   * would also pass `isTargetZero`, but the left variant keeps guards and error messages consistent.
+   *
+   * @return {Either<Bytes<32>, ContractAddress>} - The canonical zero value.
+   */
+  export pure circuit zeroAccount(): Either<Bytes<32>, ContractAddress> {
+    return Either<Bytes<32>, ContractAddress> {
+      is_left: true, left: default<Bytes<32>>, right: default<ContractAddress>
+    };
+  }
+
+  /**
+   * @description Returns `true` if `target`'s active branch (as indicated by `is_left`)
+   * holds the zero value.
+   *
+   * @param {Either<Bytes<32>, ContractAddress>} target - The value to check.
+   * @return {Boolean} - `true` if the active branch is zero, `false` otherwise.
+   */
+  export pure circuit isTargetZero(target: Either<Bytes<32>, ContractAddress>): Boolean {
+    if (target.is_left) {
+      return target.left == default<Bytes<32>>;
+    } else {
+      return target.right == default<ContractAddress>;
+    }
+  }
+
+  /**
+   * @description Computes an account identifier without on-chain state, allowing a user to derive
+   * their identity commitment before submitting an operation.
+   *
+   * @warning OpSec: The `secretKey` parameter is a sensitive secret. Mishandling it can
+   * permanently compromise the security of this system:
+   *
+   * - **Never log or persist** the `secretKey` in plaintext — avoid browser devtools,
+   *   application logs, analytics pipelines, or any observable side-channel.
+   * - **Store offline or in secure enclaves** — hardware security modules (HSMs),
+   *   air-gapped devices, or encrypted vaults are strongly preferred over hot storage.
+   * - **Use cryptographically secure randomness** — generate keys with `crypto.getRandomValues()`
+   *   or equivalent; weak or predictable keys can be brute-forced to reveal your identity.
+   * - **Treat key loss as identity loss** — a lost key cannot be recovered.
+   * - **Avoid calling this circuit in untrusted environments** — executing this in an
+   *   unverified browser extension, compromised runtime, or shared machine may expose
+   *   the key to a malicious observer.
+   *
+   * ## ID Derivation
+   * `accountId = persistentHash(secretKey)`
+   *
+   * @param {Bytes<32>} secretKey - A 32-byte cryptographically secure random value.
+   *
+   * @returns {Bytes<32>} accountId - The computed account identifier.
+   */
+  export pure circuit computeAccountId(secretKey: Bytes<32>): Bytes<32> {
+    return persistentHash<Vector<1, Bytes<32>>>([secretKey]);
+  }
+
+  /**
+   * @description Returns the current contract's address as an
+   * `Either<ZswapCoinPublicKey, ContractAddress>` for use as a
+   * recipient in shielded send operations (deposits and receiving change).
+   *
+   * @returns {Either<ZswapCoinPublicKey, ContractAddress>} The contract's address as a recipient.
+   */
+  export circuit selfAsRecipient(): Either<ZswapCoinPublicKey, ContractAddress> {
+    return right<ZswapCoinPublicKey, ContractAddress>(kernel.self());
+  }
+
+  /**
+   * @description The maximum value representable by a `Uint<128>`.
+   *
+   * @notice TODO: Remove once a math module providing this constant is available.
+   *
+   * @returns {Uint<128>} `2^128 - 1`.
+   */
+  export pure circuit UINT128_MAX(): Uint<128> {
+    return 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF;
+  }
 }