@openzeppelin/compact-contracts 0.1.0 → 0.3.0-alpha

package/token/MultiToken.compact

@@ -1,7 +1,7 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.1.0 (token/MultiToken.compact)
+// OpenZeppelin Compact Contracts v0.3.0-alpha (token/MultiToken.compact)
 
-pragma language_version >= 0.21.0;
+pragma language_version >= 0.23.0;
 
 /**
  * @module MultiToken
@@ -124,9 +124,15 @@ pragma language_version >= 0.21.0;
  */
 module MultiToken {
   import CompactStandardLibrary;
-  import "../security/Initializable" prefix Initializable_;
   import "../utils/Utils" prefix Utils_;
 
+  /**
+   * @description Initialization flag, tracked per-module to avoid the compiler's
+   * shared transitive-dependency state bug (LFDT-Minokawa/compact#270). See the
+   * Initializable module for rationale.
+   */
+  export ledger _isInitialized: Boolean;
+
   /**
    * @description Mapping from token ID to account balances.
    * @type {Uint<128>} id - The token identifier.
@@ -167,25 +173,6 @@ module MultiToken {
    */
   witness wit_MultiTokenSK(): Bytes<32>;
 
-  /**
-   * @description Returns a canonical zero Either value (left variant with zero Bytes<32>).
-   * Used as the zero value for mint/burn operations in `_update`, where a zero
-   * `fromAddress` signals a mint and a zero `to` signals a burn.
-   *
-   * The left variant is chosen so that `_isTargetZero` checks against `default<Bytes<32>>`,
-   * which is consistent with how `_update` dispatches on the zero check. A right variant
-   * with `default<ContractAddress>` would also pass `_isTargetZero`, but using the left
-   * variant avoids triggering contract address guards in circuits like `_mint` that check
-   * `!to.is_left` before delegating to `_unsafeMint`.
-   *
-   * @return {Either<Bytes<32>, ContractAddress>} - The zero value.
-   */
-  export pure circuit ZERO(): Either<Bytes<32>, ContractAddress> {
-    return Either<Bytes<32>, ContractAddress> {
-      is_left: true, left: default<Bytes<32>>, right: default<ContractAddress>
-    };
-  }
-
   /**
    * @description Initializes the contract by setting the base URI for all tokens.
    *
@@ -199,10 +186,37 @@ module MultiToken {
    * @return {[]} - Empty tuple.
    */
   export circuit initialize(uri_: Opaque<"string">): [] {
-    Initializable_initialize();
+    assertNotInitialized();
+    _isInitialized = true;
     _setURI(uri_);
   }
 
+  /**
+   * @description Asserts that the contract has been initialized, throwing an error if not.
+   *
+   * Requirements:
+   *
+   * - Contract must be initialized.
+   *
+   * @return {[]} - Empty tuple.
+   */
+  circuit assertInitialized(): [] {
+    assert(_isInitialized, "MultiToken: contract not initialized");
+  }
+
+  /**
+   * @description Asserts that the contract has not been initialized, throwing an error if it has.
+   *
+   * Requirements:
+   *
+   * - Contract must not be initialized.
+   *
+   * @return {[]} - Empty tuple.
+   */
+  circuit assertNotInitialized(): [] {
+    assert(!_isInitialized, "MultiToken: contract already initialized");
+  }
+
   /**
    * @description This implementation returns the same URI for *all* token types. It relies
    * on the token type ID substitution mechanism defined in the EIP:
@@ -220,7 +234,7 @@ module MultiToken {
    * @return {Opaque<"string">} - The base URI for all tokens.
    */
   export circuit uri(id: Uint<128>): Opaque<"string"> {
-    Initializable_assertInitialized();
+    assertInitialized();
     return _uri;
   }
 
@@ -241,7 +255,7 @@ module MultiToken {
                    account: Either<Bytes<32>, ContractAddress>,
                    id: Uint<128>
                    ): Uint<128> {
-    Initializable_assertInitialized();
+    assertInitialized();
     const canonAcct = Utils_canonicalize<Bytes<32>, ContractAddress>(account);
 
     if (!_balances.member(disclose(id)) || !_balances.lookup(id).member(disclose(canonAcct))) {
@@ -273,7 +287,7 @@ module MultiToken {
                    operator: Either<Bytes<32>, ContractAddress>,
                    approved: Boolean
                    ): [] {
-    Initializable_assertInitialized();
+    assertInitialized();
     const caller = left<Bytes<32>, ContractAddress>(_computeAccountId());
     _setApprovalForAll(caller, operator, approved);
   }
@@ -295,7 +309,7 @@ module MultiToken {
                    account: Either<Bytes<32>, ContractAddress>,
                    operator: Either<Bytes<32>, ContractAddress>
                    ): Boolean {
-    Initializable_assertInitialized();
+    assertInitialized();
     const canonAcct = Utils_canonicalize<Bytes<32>, ContractAddress>(account);
     const canonOp = Utils_canonicalize<Bytes<32>, ContractAddress>(operator);
 
@@ -404,18 +418,24 @@ module MultiToken {
                   id: Uint<128>,
                   value: Uint<128>
                   ): [] {
-    Initializable_assertInitialized();
+    assertInitialized();
     const canonFrom = Utils_canonicalize<Bytes<32>, ContractAddress>(fromAddress);
     const canonTo = Utils_canonicalize<Bytes<32>, ContractAddress>(to);
 
-    if (!_isTargetZero(disclose(canonFrom))) {
+    if (!Utils_isTargetZero(disclose(canonFrom))) {
       const fromBalance = balanceOf(canonFrom, id);
       assert(fromBalance >= value, "MultiToken: insufficient balance");
-      const newBalance = fromBalance - value;
-      _balances.lookup(id).insert(disclose(canonFrom), disclose(newBalance));
+      // Skip the write when `value` is zero. A zero-value update leaves the
+      // balance unchanged, so there is nothing to write, and guarding here
+      // avoids `_balances.lookup(id)` reverting outside an assertion when `id`
+      // has never been initialized.
+      if (disclose(value > 0)) {
+        const newBalance = fromBalance - value;
+        _balances.lookup(id).insert(disclose(canonFrom), disclose(newBalance));
+      }
     }
 
-    if (!_isTargetZero(disclose(canonTo))) {
+    if (!Utils_isTargetZero(disclose(canonTo)) && disclose(value > 0)) {
       if (!_balances.member(disclose(id))) {
         _balances.insert(
           disclose(id),
@@ -464,7 +484,7 @@ module MultiToken {
                    id: Uint<128>,
                    value: Uint<128>
                    ): [] {
-    Initializable_assertInitialized();
+    assertInitialized();
 
     const caller = left<Bytes<32>, ContractAddress>(_computeAccountId());
     const canonFrom = Utils_canonicalize<Bytes<32>, ContractAddress>(fromAddress);
@@ -505,10 +525,10 @@ module MultiToken {
                    id: Uint<128>,
                    value: Uint<128>
                    ): [] {
-    Initializable_assertInitialized();
+    assertInitialized();
 
-    assert(!_isTargetZero(fromAddress), "MultiToken: invalid sender");
-    assert(!_isTargetZero(to), "MultiToken: invalid receiver");
+    assert(!Utils_isTargetZero(fromAddress), "MultiToken: invalid sender");
+    assert(!Utils_isTargetZero(to), "MultiToken: invalid receiver");
     _update(fromAddress, to, id, value);
   }
 
@@ -536,7 +556,7 @@ module MultiToken {
    * @return {[]} - Empty tuple.
    */
   export circuit _setURI(newURI: Opaque<"string">): [] {
-    Initializable_assertInitialized();
+    assertInitialized();
     _uri = disclose(newURI);
   }
 
@@ -593,9 +613,9 @@ module MultiToken {
                    id: Uint<128>,
                    value: Uint<128>
                    ): [] {
-    Initializable_assertInitialized();
-    assert(!_isTargetZero(to), "MultiToken: invalid receiver");
-    _update(ZERO(), to, id, value);
+    assertInitialized();
+    assert(!Utils_isTargetZero(to), "MultiToken: invalid receiver");
+    _update(Utils_zeroAccount(), to, id, value);
   }
 
   /**
@@ -618,9 +638,9 @@ module MultiToken {
                        id: Uint<128>,
                        value: Uint<128>
                        ): [] {
-    Initializable_assertInitialized();
-    assert(!_isTargetZero(fromAddress), "MultiToken: invalid sender");
-    _update(fromAddress, ZERO(), id, value);
+    assertInitialized();
+    assert(!Utils_isTargetZero(fromAddress), "MultiToken: invalid sender");
+    _update(fromAddress, Utils_zeroAccount(), id, value);
   }
 
   /**
@@ -649,12 +669,12 @@ module MultiToken {
                    operator: Either<Bytes<32>, ContractAddress>,
                    approved: Boolean
                    ): [] {
-    Initializable_assertInitialized();
+    assertInitialized();
     const canonOwner = Utils_canonicalize<Bytes<32>, ContractAddress>(owner);
-    assert(!_isTargetZero(canonOwner), "MultiToken: invalid owner");
+    assert(!Utils_isTargetZero(canonOwner), "MultiToken: invalid owner");
 
     const canonOp = Utils_canonicalize<Bytes<32>, ContractAddress>(operator);
-    assert(!_isTargetZero(canonOp), "MultiToken: invalid operator");
+    assert(!Utils_isTargetZero(canonOp), "MultiToken: invalid operator");
 
     if (!_operatorApprovals.member(disclose(canonOwner))) {
       _operatorApprovals.insert(
@@ -677,52 +697,6 @@ module MultiToken {
    * @returns {Bytes<32>} accountId - The computed account identifier.
    */
   circuit _computeAccountId(): Bytes<32> {
-    return computeAccountId(wit_MultiTokenSK());
-  }
-
-  /**
-   * @description Computes an account identifier without on-chain state, allowing a user to derive
-   * their identity commitment before submitting it in a token operation.
-   * This is the off-chain counterpart to {_computeAccountId} and produces an identical result
-   * given the same inputs.
-   *
-   * @warning OpSec: The `secretKey` parameter is a sensitive secret. Mishandling it can
-   * permanently compromise the security of this system:
-   *
-   * - **Never log or persist** the `secretKey` in plaintext — avoid browser devtools,
-   *   application logs, analytics pipelines, or any observable side-channel.
-   * - **Store offline or in secure enclaves** — hardware security modules (HSMs),
-   *   air-gapped devices, or encrypted vaults are strongly preferred over hot storage.
-   * - **Use cryptographically secure randomness** — generate keys with `crypto.getRandomValues()`
-   *   or equivalent; weak or predictable keys can be brute-forced to reveal your identity.
-   * - **Treat key loss as identity loss** — a lost key cannot be recovered.
-   * - **Avoid calling this circuit in untrusted environments** — executing this in an
-   *   unverified browser extension, compromised runtime, or shared machine may expose
-   *   the key to a malicious observer.
-   *
-   * ## ID Derivation
-   * `accountId = persistentHash(secretKey)`
-   *
-   * @param {Bytes<32>} secretKey - A 32-byte cryptographically secure random value.
-   *
-   * @returns {Bytes<32>} accountId - The computed account identifier.
-   */
-  export pure circuit computeAccountId(secretKey: Bytes<32>): Bytes<32> {
-    return persistentHash<Vector<1, Bytes<32>>>([secretKey]);
-  }
-
-  /**
-   * @description Returns `true` if `target`'s active branch (as indicated by `is_left`)
-   * holds the zero value.
-   *
-   * @param {Either<Bytes<32>, ContractAddress>} target - The value to check.
-   * @returns {Boolean} - `true` if the active branch is zero, `false` otherwise.
-   */
-  circuit _isTargetZero(target: Either<Bytes<32>, ContractAddress>): Boolean {
-    if (target.is_left) {
-      return target.left == default<Bytes<32>>;
-    } else {
-      return target.right == default<ContractAddress>;
-    }
+    return Utils_computeAccountId(wit_MultiTokenSK());
   }
 }

package/token/NativeShieldedToken.compact

@@ -0,0 +1,285 @@
+// SPDX-License-Identifier: MIT
+// OpenZeppelin Compact Contracts v0.3.0-alpha (token/NativeShieldedToken.compact)
+
+pragma language_version >= 0.23.0;
+
+/**
+ * @module NativeShieldedToken
+ * @description A module for issuing a SINGLE native shielded (Zswap) token —
+ * the ERC-20-shaped flavor of the native shielded token standard. The token's
+ * domain separator is fixed at construction; no circuit takes a domain
+ * parameter. To issue multiple token types from one contract, use
+ * `NativeShieldedTokenFamily` instead.
+ *
+ * This module is a thin wrapper over `NativeShieldedTokenCore`: it stores the
+ * one `sealed _domain` and forwards it to every core op, so the mint/burn logic
+ * and metadata live in the shared core, not here.
+ *
+ * @notice A contract MUST NOT import both `NativeShieldedToken` and
+ * `NativeShieldedTokenFamily`. Both wrap `NativeShieldedTokenCore`, so they
+ * share one set of core state (a single init flag and one name/symbol/decimals).
+ * Pick one flavor per contract.
+ *
+ * @notice This module exposes composable building blocks for minting and
+ * burning native shielded coins. It does NOT include access control: consuming
+ * contracts compose that via the module/contract pattern (Ownable,
+ * AccessControl, etc.) and SHOULD gate the mint and burn circuits, which are
+ * unrestricted at the module level.
+ *
+ * @dev The domain separator is stored as `sealed ledger _domain` at
+ * construction and never exposed as a circuit parameter, eliminating
+ * caller-supplied domain misuse. The coin's `color` is
+ * `tokenType(_domain, kernel.self())`, computed at call time; only this
+ * contract can mint coins of its color. Metadata follows the FungibleToken
+ * (ERC-20) convention (contract-wide `name`, `symbol`, `decimals`, fixed at
+ * construction). Mint amounts are `Uint<64>`, burn amounts `Uint<128>` — an
+ * asymmetry imposed by the protocol primitives, not a module choice. The
+ * mint/burn mechanics and the `_burn` vs `_burnFromSelf` spend paths live in
+ * `NativeShieldedTokenCore`.
+ *
+ * @notice With a secret, cryptographically random `_mint` nonce the mint is
+ * recipient-private; the caller is responsible for nonce uniqueness (a reused
+ * nonce produces a duplicate commitment, which the ledger rejects). For mints
+ * that need no caller-managed nonce, compose `NativeShieldedTokenDerivedNonce`
+ * and pass its `_deriveNonce()` output, at the cost of making those mints
+ * recipient-public.
+ *
+ * @notice Supply accounting is opt-in: this module tracks NO supply totals.
+ * Compose the optional `NativeShieldedTokenSupply` extension only if you need an
+ * on-chain `totalSupply()`; see it for the privacy trade-off it introduces (it
+ * makes contract-mediated burn amounts public).
+ *
+ * @dev Composition
+ * Dual-representation tokens (shielded + unshielded with conversion) MUST build
+ * on the token-family modules and the `NativeTokenConverter` extension, not on
+ * this module: it stores a single load-bearing sealed `_domain` (one token
+ * type), while the converter composes both bases' Family profiles.
+ * (Initialization is tracked per-module inline, so the former
+ * shared-`Initializable`-flag "one `initialize` per contract" limit no longer
+ * applies.)
+ *
+ * @notice Out of scope (phase two, pending contract-to-contract support):
+ * `balanceOf`, `allowance`, and transfer mediation are not representable for
+ * native shielded UTXOs — once a user holds a coin, the contract cannot observe
+ * or restrict its movement.
+ */
+module NativeShieldedToken {
+  import CompactStandardLibrary;
+  import "./NativeShieldedTokenCore" prefix Core_;
+
+  // Circuits use the `Core_` prefix above. The named import/re-export below is
+  // only for the core state variables, so the implementing contract's ledger
+  // keys read as `_name` etc. rather than `NativeShieldedTokenCore__name`. The
+  // circuit names are intentionally NOT imported unprefixed, to avoid potential clashes.
+  import { _name, _symbol, _decimals, _isInitialized } from "./NativeShieldedTokenCore";
+  export { _name, _symbol, _decimals, _isInitialized };
+
+  /**
+   * @description Domain separator fixed at construction; with the contract
+   * address it determines this token's color.
+   */
+  export sealed ledger _domain: Bytes<32>;
+
+  /**
+   * @description Initializes the module's domain and metadata.
+   * @dev This MUST be called in the implementing contract's constructor, and it
+   * MUST be the only token operation performed there. Failure to call it can
+   * lead to an irreparable contract; perform mint, burn, and `tokenColor` only
+   * in post-deployment circuits, never in the constructor.
+   *
+   * @param {Bytes<32>} domainSep - Domain separator for this token's color.
+   * @param {Opaque<"string">} name_ - The name of the token.
+   * @param {Opaque<"string">} symbol_ - The symbol of the token.
+   * @param {Uint<8>} decimals_ - The number of decimals used to get the user representation.
+   * @return {[]} - Empty tuple.
+   */
+  export circuit initialize(
+                   domainSep: Bytes<32>,
+                   name_: Opaque<"string">,
+                   symbol_: Opaque<"string">,
+                   decimals_: Uint<8>
+                   ): [] {
+    Core_initialize(name_, symbol_, decimals_);
+    _domain = disclose(domainSep);
+  }
+
+  /**
+   * @description Returns whether the contract has been initialized.
+   *
+   * @circuitInfo k=6, rows=26
+   *
+   * @return {Boolean} - True once `initialize` has run.
+   */
+  export circuit isInitialized(): Boolean {
+    return Core_isInitialized();
+  }
+
+  /**
+   * @description Returns the token name.
+   *
+   * @circuitInfo k=6, rows=28
+   *
+   * Requirements:
+   *
+   * - Contract is initialized.
+   *
+   * @return {Opaque<"string">} - The token name.
+   */
+  export circuit name(): Opaque<"string"> {
+    return Core_name();
+  }
+
+  /**
+   * @description Returns the symbol of the token.
+   *
+   * @circuitInfo k=6, rows=28
+   *
+   * Requirements:
+   *
+   * - Contract is initialized.
+   *
+   * @return {Opaque<"string">} - The token symbol.
+   */
+  export circuit symbol(): Opaque<"string"> {
+    return Core_symbol();
+  }
+
+  /**
+   * @description Returns the number of decimals used to get its user representation.
+   *
+   * @circuitInfo k=6, rows=28
+   *
+   * Requirements:
+   *
+   * - Contract is initialized.
+   *
+   * @return {Uint<8>} - The decimals value.
+   */
+  export circuit decimals(): Uint<8> {
+    return Core_decimals();
+  }
+
+  /**
+   * @description Returns this token's coin color:
+   * `tokenType(_domain, kernel.self())`, computed at call time.
+   *
+   * @circuitInfo k=13, rows=3971
+   *
+   * Requirements:
+   *
+   * - Contract is initialized.
+   *
+   * @return {Bytes<32>} - The coin color.
+   */
+  export circuit tokenColor(): Bytes<32> {
+    return Core_tokenColor(_domain);
+  }
+
+  /**
+   * @description Mints `amount` of the token to `recipient`, using a
+   * caller-supplied nonce.
+   *
+   * @dev The caller is fully responsible for nonce uniqueness. Reusing a
+   * nonce for the same (value, recipient) produces a duplicate commitment,
+   * which the protocol rejects. With a secret random nonce this is the
+   * recipient-private mint. For mints that require no caller-managed nonce,
+   * compose the `NativeShieldedTokenDerivedNonce` extension and pass its
+   * `_deriveNonce()` output.
+   *
+   * @notice The returned coin info is the only copy available to the
+   * recipient; callers SHOULD deliver it out of band. Wallets cannot detect
+   * contract-minted coins by scanning the chain.
+   *
+   * @circuitInfo k=14, rows=10843
+   *
+   * Requirements:
+   *
+   * - Contract is initialized.
+   * - `recipient` is not zero.
+   *
+   * @param {Either<ZswapCoinPublicKey, ContractAddress>} recipient - The coin recipient.
+   * @param {Uint<64>} amount - Quantity to mint. Capped at `Uint<64>` by the protocol.
+   * @param {Bytes<32>} nonce - Caller-supplied nonce. Must be unique for this
+   * contract's color.
+   * @return {ShieldedCoinInfo} - The newly created coin's info (nonce, color, value).
+   */
+  export circuit _mint(
+                   recipient: Either<ZswapCoinPublicKey, ContractAddress>,
+                   amount: Uint<64>,
+                   nonce: Bytes<32>
+                   ): ShieldedCoinInfo {
+    return Core__mint(_domain, recipient, amount, nonce);
+  }
+
+  /**
+   * @description Burns `amount` from `coin`, a coin provided within the
+   * current transaction (e.g. paid in by the caller's wallet), and routes the
+   * remaining change to `refundTo`.
+   *
+   * To destroy `coin` in full, pass `coin.value` as `amount`; the change
+   * branch will not fire and `none` is returned. The `refundTo` value is
+   * inert in that case but must still be supplied and non-zero.
+   *
+   * @dev The coin is received by the contract and spent in the same
+   * transaction, so the spend goes through `sendImmediateShielded` (the
+   * transient path). For coins the contract already holds, use
+   * `_burnFromSelf` instead.
+   *
+   * @notice The returned refund coin info is the only copy available to
+   * `refundTo`; callers SHOULD deliver it out of band. Wallets cannot detect
+   * contract-sent coins by scanning the chain.
+   *
+   * @circuitInfo k=16, rows=47656
+   *
+   * Requirements:
+   *
+   * - Contract is initialized.
+   * - `coin.color` is this contract's token color.
+   * - `amount` is less than or equal to `coin.value`.
+   * - `refundTo` is not zero (the zero key is the burn address; a zero
+   *   `refundTo` would silently burn the change as well).
+   *
+   * @param {ShieldedCoinInfo} coin - The coin to burn from.
+   * @param {Uint<128>} amount - Value to destroy. Must be <= `coin.value`.
+   * @param {Either<ZswapCoinPublicKey, ContractAddress>} refundTo - Where to
+   * route the unspent portion (`coin.value - amount`).
+   * @return {Maybe<ShieldedCoinInfo>} - The refund coin created for `refundTo`,
+   * or `none` if the coin was burned in full.
+   */
+  export circuit _burn(
+                   coin: ShieldedCoinInfo,
+                   amount: Uint<128>,
+                   refundTo: Either<ZswapCoinPublicKey, ContractAddress>
+                   ): Maybe<ShieldedCoinInfo> {
+    return Core__burn(_domain, coin, amount, refundTo);
+  }
+
+  /**
+   * @description Burns `amount` from `coin`, a coin this contract already
+   * holds (a Merkle-tree entry with a valid `mt_index`). Any change is
+   * auto-received by the contract and returned.
+   *
+   * @dev The consumer SHOULD persist the returned change coin info in its own
+   * ledger state: the change replaces `coin` as the contract's holding, and
+   * its info is not otherwise recoverable.
+   *
+   * @circuitInfo k=15, rows=23307
+   *
+   * Requirements:
+   *
+   * - Contract is initialized.
+   * - `coin.color` is this contract's token color.
+   * - `amount` is less than or equal to `coin.value`.
+   *
+   * @param {QualifiedShieldedCoinInfo} coin - The contract-held coin to burn from.
+   * @param {Uint<128>} amount - Value to destroy. Must be <= `coin.value`.
+   * @return {Maybe<ShieldedCoinInfo>} - The change coin retained by the
+   * contract, or `none` if the coin was burned in full.
+   */
+  export circuit _burnFromSelf(
+                   coin: QualifiedShieldedCoinInfo,
+                   amount: Uint<128>
+                   ): Maybe<ShieldedCoinInfo> {
+    return Core__burnFromSelf(_domain, coin, amount);
+  }
+}