@openzeppelin/compact-contracts 0.2.0 → 0.3.0-alpha.1

package/multisig/presets/ShieldedMultiSigV3.compact

@@ -0,0 +1,368 @@
+// SPDX-License-Identifier: MIT
+// OpenZeppelin Compact Contracts v0.0.1-alpha.1 (multisig/presets/ShieldedMultiSigV3.compact)
+
+pragma language_version >= 0.23.0;
+
+/**
+ * @title ShieldedMultiSigV3
+ * @description Privacy-preserving multisig token contract for tokenised
+ * deposits. Both minting and burning require threshold ECDSA
+ * authorization. No single party can unilaterally create or destroy tokens.
+ *
+ * Designed with the following features:
+ * - Supply only enters through authorized mint (no open deposit)
+ * - Supply only exits through authorized burn (no arbitrary transfers)
+ * - Non-transferability enforced by absence of transfer/execute circuits
+ * - Change coins from partial burns handled by the transaction layer
+ * - Operator discovers coins via ZswapOutput events from the indexer
+ *
+ * Uses Midnight's native shielded token primitives:
+ *
+ * - `mint` creates a new UTXO via `mintShieldedToken`, addressed to the
+ *   contract. No external coin input; supply is produced on-chain.
+ * - `burn` consumes a UTXO via `sendShielded` to `burnAddress()`. Only
+ *   coins of this contract's token type can be burned. Change is handled
+ *   automatically by the transaction layer.
+ *
+ * Signer identities are stored as commitments: hashes of ECDSA public keys
+ * combined with an instance salt and domain separator. A counter
+ * provides replay protection, and also feeds `evolveNonce` to produce
+ * unique coin nonces on each mint.
+ *
+ * Operation domain prefixes ("multisig:mint:" / "multisig:burn:") in the message
+ * hash prevent signatures for one operation type from being replayed as
+ * the other.
+ *
+ * @notice ECDSA verification is stubbed. Replace `stubVerifySignature` with
+ * `ecdsaVerify`, and `persistentHash` with `keccak256`, once the Compact
+ * ECDSA and Keccak primitives are available.
+ */
+
+import CompactStandardLibrary;
+
+import "../Signer"<Bytes<32>> prefix Signer_;
+import "../../utils/Utils" prefix Utils_;
+// For testing
+export { ZswapCoinPublicKey };
+
+// ─── Types ──────────────────────────────────────────────────────
+
+/**
+ * @description Accumulator for fold-based signature verification.
+ * Threads the valid count, previous commitment (for duplicate
+ * detection), and message hash through each iteration.
+ */
+struct VerificationState {
+  validCount: Uint<8>,
+  prevCommitment: Bytes<32>,
+  msgHash: Bytes<32>
+}
+
+/**
+ * @description Input to persistentHash for computing signer commitments.
+ * Combines the ECDSA public key with an instance-specific salt and
+ * domain separator to produce a unique, unlinkable commitment.
+ */
+struct SignerCommitmentInput {
+  pk: Bytes<64>,
+  salt: Bytes<32>,
+  domain: Bytes<32>
+}
+
+// ─── State ──────────────────────────────────────────────────────
+
+export ledger _counter: Counter;
+export ledger _coinNonce: Bytes<32>;
+export ledger _instanceSalt: Bytes<32>;
+export sealed ledger _tokenDomain: Bytes<32>;
+
+// ─── Constructor ────────────────────────────────────────────────
+
+/**
+ * @description Deploys the contract with 3 signer commitments and
+ * a threshold of 2.
+ *
+ * Each commitment is computed off-chain as:
+ *   `persistentHash(SignerCommitmentInput { pk, instanceSalt, domain })`
+ * where domain is `pad(32, "multisig:signer:")`.
+ *
+ * `tokenDomain` is used with `kernel.self()` to derive the token color
+ * via `tokenType(_tokenDomain, kernel.self())`. Only coins of this color
+ * can be burned through this contract.
+ *
+ * `initCoinNonce` seeds the `evolveNonce` chain used to produce unique
+ * mint nonces. It must be cryptographically random.
+ *
+ * Requirements:
+ *
+ * - `signerCommitments` must not contain duplicates.
+ * - `instanceSalt` and `initCoinNonce` should be cryptographically random.
+ *
+ * @param {Bytes<32>} instanceSalt - Random salt for signer commitment derivation.
+ * @param {Bytes<32>} initCoinNonce - Initial coin nonce seed.
+ * @param {Bytes<32>} tokenDomain - Domain string used to derive this contract's token color.
+ * @param {Vector<3, Bytes<32>>} signerCommitments - Hashed signer identities.
+ */
+constructor(
+  instanceSalt: Bytes<32>,
+  initCoinNonce: Bytes<32>,
+  tokenDomain: Bytes<32>,
+  signerCommitments: Vector<3, Bytes<32>>,
+) {
+  _instanceSalt = disclose(instanceSalt);
+  _coinNonce = disclose(initCoinNonce);
+  _tokenDomain = disclose(tokenDomain);
+  Signer_initialize<3>(signerCommitments, 2);
+}
+
+// ─── Mint ───────────────────────────────────────────────────────
+
+/**
+ * @description Mints a new shielded coin addressed to the specified
+ * recipient, authorized by threshold signatures.
+ *
+ * Creates a new UTXO of this contract's token type via `mintShieldedToken`,
+ * addressed to the provided recipient. No external coin input is required;
+ * supply is produced on-chain.
+ *
+ * The message hash commits to:
+ *   - operation domain ("multisig:mint:" for burn op replay protection)
+ *   - contract address (cross-instance replay protection)
+ *   - recipient (redirection protection)
+ *   - counter value (replay protection)
+ *   - amount
+ *
+ * Coin nonce uniqueness is guaranteed by `evolveNonce(_counter, _coinNonce)`
+ * after the counter has been incremented, binding each mint's nonce to a
+ * distinct counter value.
+ *
+ * @notice Replace `persistentHash` with `keccak256` and `stubVerifySignature`
+ * with `ecdsaVerify` once the Compact ECDSA and Keccak primitives are
+ * available, to match the custodian's HSM signing format.
+ *
+ * Requirements:
+ *
+ * - Both public keys must hash to registered signer commitments.
+ * - Both signatures must be valid over the mint message hash.
+ * - Signers must not be duplicates.
+ * - Threshold must be met.
+ *
+ * @param {Uint<64>} amount - The token amount to mint.
+ * @param {Either<ZswapCoinPublicKey, ContractAddress>} recipient - The address to receive the minted tokens.
+ * @param {Vector<2, Bytes<64>>} pubkeys - ECDSA public keys of approving signers.
+ * @param {Vector<2, Bytes<64>>} signatures - ECDSA signatures over the mint hash.
+ */
+export circuit mint(
+  amount: Uint<64>,
+  recipient: Either<ZswapCoinPublicKey, ContractAddress>,
+  pubkeys: Vector<2, Bytes<64>>,
+  signatures: Vector<2, Bytes<64>>
+): [] {
+  const opNonce = _counter;
+  _counter.increment(1);
+
+  // Canonicalize recipient to ensure garbage values don't sully the hash
+  const canonRecipient = Utils_canonicalize<ZswapCoinPublicKey, ContractAddress>(recipient);
+  const recipientHash = persistentHash<Either<ZswapCoinPublicKey, ContractAddress>>(canonRecipient);
+
+  const msgHash = persistentHash<Vector<5, Bytes<32>>>([
+    pad(32, "multisig:mint:"),
+    kernel.self().bytes,
+    recipientHash,
+    opNonce as Bytes<32>,
+    amount as Bytes<32>
+  ]);
+
+  const initialState = VerificationState {
+    validCount: 0 as Uint<8>,
+    prevCommitment: pad(32, ""),
+    msgHash: msgHash
+  };
+
+  const finalState = fold(verifySignature, initialState, pubkeys, signatures);
+  // Thresh check not needed as it will always be 2
+  // Leaving it as defense-in-depth
+  Signer_assertThresholdMet(finalState.validCount);
+
+  _coinNonce = evolveNonce(_counter, _coinNonce);
+  mintShieldedToken(_tokenDomain, disclose(amount), _coinNonce, disclose(canonRecipient));
+}
+
+// ─── Burn ───────────────────────────────────────────────────────
+
+/**
+ * @description Burns a shielded coin of this contract's token type,
+ * authorized by threshold signatures.
+ *
+ * Sends the specified amount of the supplied coin to `burnAddress()` via
+ * `sendShielded`. The nullifier is submitted on-chain, permanently marking
+ * the UTXO as spent.
+ *
+ * Change handling is automatic: if `amount < coin.value`, the transaction
+ * layer creates a change output addressed back to the contract. The operator
+ * discovers this change coin via `nextZswapLocalState.outputs` in the
+ * transaction's private result, then discovers its mt_index from the
+ * indexer events using the standard flow. No contract-level change logic
+ * is required.
+ *
+ * Only coins of this contract's token type can be burned. The operator
+ * supplies the `QualifiedShieldedCoinInfo` from the off-chain UTXO pool.
+ *
+ * The "multisig:burn:" domain prefix ensures burn signatures cannot be replayed
+ * as mint operations for the same parameters.
+ *
+ * @notice Replace `persistentHash` with `keccak256` and `stubVerifySignature`
+ * with `ecdsaVerify` once the Compact ECDSA and Keccak primitives are
+ * available, to match the custodian's HSM signing format.
+ *
+ * Requirements:
+ *
+ * - Both public keys must hash to registered signer commitments.
+ * - Both signatures must be valid over the burn message hash.
+ * - Signers must not be duplicates.
+ * - Threshold must be met.
+ * - coin.color must equal tokenType(_tokenDomain, kernel.self()).
+ * - coin.value must be >= amount.
+ *
+ * @param {QualifiedShieldedCoinInfo} coin - The coin to burn (from operator's UTXO pool).
+ * @param {Uint<64>} amount - The token amount to burn.
+ * @param {Vector<2, Bytes<64>>} pubkeys - ECDSA public keys of approving signers.
+ * @param {Vector<2, Bytes<64>>} signatures - ECDSA signatures over the burn hash.
+ */
+export circuit burn(
+  coin: QualifiedShieldedCoinInfo,
+  amount: Uint<64>,
+  pubkeys: Vector<2, Bytes<64>>,
+  signatures: Vector<2, Bytes<64>>
+): [] {
+  const opNonce = _counter;
+  _counter.increment(1);
+
+  const msgHash = persistentHash<Vector<4, Bytes<32>>>([
+    pad(32, "multisig:burn:"),
+    kernel.self().bytes,
+    opNonce as Bytes<32>,
+    amount as Bytes<32>
+  ]);
+
+  const initialState = VerificationState {
+    validCount: 0 as Uint<8>,
+    prevCommitment: pad(32, ""),
+    msgHash: msgHash
+  };
+
+  const finalState = fold(verifySignature, initialState, pubkeys, signatures);
+  // Thresh check not needed as it will always be 2
+  // Leaving it as defense-in-depth
+  Signer_assertThresholdMet(finalState.validCount);
+
+  assert(coin.color == tokenType(_tokenDomain, kernel.self()), "Multisig: coin not from this contract");
+  assert(coin.value >= amount, "Multisig: insufficient coin value");
+
+  sendShielded(disclose(coin), shieldedBurnAddress(), disclose(amount));
+}
+
+// ─── Signature Verification ─────────────────────────────────────
+
+/**
+ * @description Fold callback. Verifies one signer's approval.
+ *
+ * Computes the signer's commitment from their public key and the instance
+ * salt, checks for duplicates against the previous commitment, verifies
+ * registry membership, and validates the ECDSA signature.
+ *
+ * @notice Circuit signatures are fixed at Vector<2, ...>, so this contract
+ * supports only a fixed 2-of-3 configuration. Supporting more signatures
+ * (e.g. 3-of-N) requires a separate variant with a larger vector and a
+ * different duplicate-detection mechanism (sorted commitments or bitmap).
+ *
+ * @param {VerificationState} state - Accumulator threaded through fold.
+ * @param {Bytes<64>} pubkey - The signer's ECDSA public key.
+ * @param {Bytes<64>} signature - The signer's signature over msgHash.
+ * @returns {VerificationState} Updated accumulator.
+ */
+circuit verifySignature(
+  state: VerificationState,
+  pubkey: Bytes<64>,
+  signature: Bytes<64>
+): VerificationState {
+  const commitment = _calculateSignerId(pubkey, _instanceSalt);
+
+  // Duplicate detection — sufficient for 2 signers only
+  assert(commitment != state.prevCommitment, "Multisig: duplicate signer");
+
+  Signer_assertSigner(commitment);
+
+  // TODO: Replace with ecdsaVerify + keccak256 when primitives are available
+  assert(stubVerifySignature(pubkey, state.msgHash, signature), "Multisig: invalid signature");
+
+  return VerificationState {
+    validCount: state.validCount + 1 as Uint<8>,
+    prevCommitment: commitment,
+    msgHash: state.msgHash
+  };
+}
+
+/**
+ * @description Computes a signer commitment from an ECDSA public key.
+ *
+ * The commitment is persistentHash(pk, salt, domain) where:
+ * - pk: the signer's ECDSA public key (64 bytes)
+ * - salt: instance-specific random value (prevents cross-contract correlation)
+ * - domain: "multisig:signer:" (domain separation)
+ *
+ * Pure circuit — callable off-chain by the deployer to compute
+ * commitments for the constructor.
+ *
+ * @param {Bytes<64>} pk - The ECDSA public key.
+ * @param {Bytes<32>} salt - The instance salt.
+ * @returns {Bytes<32>} The signer commitment.
+ */
+export pure circuit _calculateSignerId(
+  pk: Bytes<64>,
+  salt: Bytes<32>
+): Bytes<32> {
+  return persistentHash<SignerCommitmentInput>(SignerCommitmentInput {
+    pk: pk,
+    salt: salt,
+    domain: pad(32, "multisig:signer:")
+  });
+}
+
+/**
+ * @description Stub for ECDSA signature verification.
+ * Always returns true. MUST be replaced before any non-test deployment.
+ */
+circuit stubVerifySignature(
+  pubkey: Bytes<64>,
+  msgHash: Bytes<32>,
+  signature: Bytes<64>
+): Boolean {
+  return true;
+}
+
+// ─── View ───────────────────────────────────────────────────────
+
+export circuit getNonce(): Uint<64> {
+  return _counter;
+}
+
+export circuit getTokenDomain(): Bytes<32> {
+  return _tokenDomain;
+}
+
+export circuit getTokenType(): Bytes<32> {
+  return tokenType(_tokenDomain, kernel.self());
+}
+
+export circuit getSignerCount(): Uint<8> {
+  return Signer_getSignerCount();
+}
+
+export circuit getThreshold(): Uint<8> {
+  return Signer_getThreshold();
+}
+
+export circuit isSigner(commitment: Bytes<32>): Boolean {
+  return Signer_isSigner(commitment);
+}

package/multisig/presets/forwarder/ForwarderPrivate.compact

@@ -0,0 +1,125 @@
+// SPDX-License-Identifier: MIT
+// OpenZeppelin Compact Contracts v0.3.0-alpha.1 (multisig/presets/forwarder/ForwarderPrivate.compact)
+
+pragma language_version >= 0.23.0;
+
+/**
+ * @title ForwarderPrivate
+ * @description Private-parent forwarder. The parent address is hidden
+ * behind a `persistentHash` commitment on the ledger. Coins dwell at
+ * the contract address after deposit; the operator drains them later
+ * by presenting the `(parentAddr, opSecret)` preimage at drain time.
+ *
+ * Knowledge of the preimage is the sole authorization gate. The
+ * operational secret is held off-chain by the deployer; losing it is
+ * equivalent to loss of a hot-wallet key. Two forwarders bound to the
+ * same parent with different operational secrets produce different
+ * commitments and are unlinkable on-chain.
+ *
+ * @notice Each forwarder is bound to a single parent at deploy. To
+ * change the parent, deploy a new forwarder; the old one remains
+ * functional for outstanding coins until drained.
+ */
+
+import CompactStandardLibrary;
+import "../../ForwarderPrivate" prefix ForwarderPrivate_;
+
+export { ShieldedCoinInfo, QualifiedShieldedCoinInfo, ShieldedSendResult, ZswapCoinPublicKey };
+
+/**
+ * @description Deploys the forwarder bound to a specific parent
+ * commitment. The deployer computes the commitment off-chain as
+ * `calculateParentCommitment(parentAddr, opSecret)` and passes it here.
+ *
+ * @param {Bytes<32>} parentCommitment - The commitment to the
+ * `(parentAddr, opSecret)` pair that the operator will present at drain.
+ */
+constructor(parentCommitment: Bytes<32>) {
+  ForwarderPrivate_initialize(parentCommitment);
+}
+
+/**
+ * @description Receives a shielded coin into the forwarder's custody.
+ * No ledger write — the coin sits at the contract address until drained.
+ *
+ * @param {ShieldedCoinInfo} coin - The incoming shielded coin.
+ *
+ * @returns {[]} Empty tuple.
+ */
+export circuit deposit(coin: ShieldedCoinInfo): [] {
+  ForwarderPrivate__deposit(coin);
+}
+
+/**
+ * @description Spends a previously-deposited shielded coin to the parent,
+ * a coin public key. The caller proves knowledge of `(parent, opSecret)`
+ * matching the stored commitment; the coin is sent as a shielded note, so the
+ * parent stays hidden on-chain. If the input coin's value exceeds `value`,
+ * change is re-emitted back to the contract for future drains.
+ *
+ * The parent is a `ZswapCoinPublicKey`, never a `ContractAddress`: a shielded
+ * send to a contract publishes that contract's address in cleartext, which
+ * would defeat the private-parent guarantee.
+ *
+ * Requirements:
+ *
+ * - `parent` must not be the zero key.
+ * - `calculateParentCommitment(parent.bytes, opSecret)` must equal the stored
+ *   `_parentCommitment`.
+ * - `coin.value` must be >= `value` (enforced by `sendShielded`).
+ *
+ * @param {QualifiedShieldedCoinInfo} coin - The coin to spend.
+ * @param {ZswapCoinPublicKey} parent - The parent coin public key. Its 32
+ * bytes are the preimage to the stored commitment.
+ * @param {Bytes<32>} opSecret - The operational secret. Never appears
+ * on the public transcript.
+ *
+ * @warning **Losing the operational secret is permanent fund loss.** It
+ * is the sole drain authorization. No rotation, revocation, or recovery
+ * path exists. If the operator loses it, every shielded coin accumulated
+ * at this contract becomes inaccessible. Back it up offline before the
+ * first deposit.
+ *
+ * @param {Uint<128>} value - The amount to send.
+ *
+ * @returns {ShieldedSendResult} The result containing the sent coin and
+ * any change.
+ */
+export circuit drain(
+  coin: QualifiedShieldedCoinInfo,
+  parent: ZswapCoinPublicKey,
+  opSecret: Bytes<32>,
+  value: Uint<128>
+): ShieldedSendResult {
+  return ForwarderPrivate__drain(coin, parent, opSecret, value);
+}
+
+/**
+ * @description Returns the stored parent commitment.
+ *
+ * @returns {Bytes<32>} The commitment set at deploy.
+ */
+export circuit getParentCommitment(): Bytes<32> {
+  return ForwarderPrivate__parentCommitment;
+}
+
+/**
+ * @description Computes the parent commitment from a `(parentAddr, opSecret)`
+ * pair. Pure circuit — used off-chain by the deployer to compute the
+ * constructor argument, and inside `drain` for the preimage check.
+ *
+ * The commitment is domain-tagged
+ * (`pad(32, "ForwarderPrivate:commitment")`) to prevent preimage
+ * collisions with other `persistentHash` users in the system.
+ *
+ * @param {Bytes<32>} parentAddr - The parent address.
+ * @param {Bytes<32>} opSecret - The operational secret.
+ *
+ * @returns {Bytes<32>} The commitment `persistentHash([pad(32, "ForwarderPrivate:commitment"), parentAddr, opSecret])`.
+ */
+export pure circuit calculateParentCommitment(
+  parentAddr: Bytes<32>,
+  opSecret: Bytes<32>
+): Bytes<32> {
+  return ForwarderPrivate__calculateParentCommitment(parentAddr, opSecret);
+}

package/multisig/presets/forwarder/ForwarderShielded.compact

@@ -0,0 +1,62 @@
+// SPDX-License-Identifier: MIT
+// OpenZeppelin Compact Contracts v0.3.0-alpha.1 (multisig/presets/forwarder/ForwarderShielded.compact)
+
+pragma language_version >= 0.23.0;
+
+/**
+ * @title ForwarderShielded
+ * @description Public-parent forwarder for shielded coins. Receives a
+ * shielded coin and atomically forwards it to the configured parent
+ * recipient, a coin public key.
+ *
+ * The parent recipient is set at deploy time. This preset exposes no
+ * setter, so the parent is fixed for the life of the contract. Anyone
+ * may call `deposit`; the recipient is fixed, so there is no need for
+ * access control.
+ *
+ * The constructor accepts a `ZswapCoinPublicKey`: an atomic forward can
+ * only deliver to a recipient that needs no in-tx claim, and a shielded
+ * send to a non-participating contract is rejected. The parent is stored
+ * generically (`Either`) on the ledger so a future circuit upgrade can
+ * add contract-address support without a state migration.
+ */
+
+import CompactStandardLibrary;
+import "../../ForwarderShielded" prefix Forwarder_;
+
+export { ZswapCoinPublicKey, ContractAddress, ShieldedCoinInfo, Either };
+
+/**
+ * @description Deploys the forwarder bound to a specific parent
+ * recipient.
+ *
+ * @param {ZswapCoinPublicKey} parent - The coin public key that receives
+ * every forwarded coin.
+ */
+constructor(parent: ZswapCoinPublicKey) {
+  Forwarder_initialize(parent);
+}
+
+/**
+ * @description Receives a shielded coin and atomically forwards it to
+ * the configured parent. The coin is claimed via `receiveShielded` and
+ * immediately re-sent via `sendImmediateShielded`.
+ *
+ * @param {ShieldedCoinInfo} coin - The incoming shielded coin.
+ *
+ * @returns {[]} Empty tuple.
+ */
+export circuit deposit(coin: ShieldedCoinInfo): [] {
+  Forwarder__deposit(coin);
+}
+
+/**
+ * @description Returns the configured parent recipient as stored on the
+ * ledger (the generic `Either`; the `left` arm holds the coin public key).
+ *
+ * @returns {Either<ZswapCoinPublicKey, ContractAddress>} The parent
+ * recipient set at deploy.
+ */
+export circuit getParent(): Either<ZswapCoinPublicKey, ContractAddress> {
+  return Forwarder__parent;
+}

package/multisig/presets/forwarder/ForwarderUnshielded.compact

@@ -0,0 +1,64 @@
+// SPDX-License-Identifier: MIT
+// OpenZeppelin Compact Contracts v0.3.0-alpha.1 (multisig/presets/forwarder/ForwarderUnshielded.compact)
+
+pragma language_version >= 0.23.0;
+
+/**
+ * @title ForwarderUnshielded
+ * @description Public-parent forwarder for unshielded coins. Receives
+ * an unshielded amount of a given color and atomically forwards it to
+ * the configured parent recipient, a user address.
+ *
+ * Unshielded transfers are publicly visible on the chain: depositor,
+ * recipient, color, and amount all appear on the public transcript.
+ * Use `ForwarderShielded` instead when the deposit kind is shielded.
+ *
+ * The constructor accepts a `UserAddress`: an atomic forward can only
+ * deliver to a recipient that needs no in-tx claim, and an unshielded
+ * send to a non-participating contract is rejected. The parent is stored
+ * generically (`Either`) on the ledger so a future circuit upgrade can
+ * add contract-address support without a state migration.
+ *
+ * The parent recipient is set at deploy time. This preset exposes no
+ * setter, so the parent is fixed for the life of the contract.
+ */
+
+import CompactStandardLibrary;
+import "../../ForwarderUnshielded" prefix Forwarder_;
+
+export { ContractAddress, UserAddress, Either };
+
+/**
+ * @description Deploys the forwarder bound to a specific parent
+ * recipient.
+ *
+ * @param {UserAddress} parent - The user address that receives every
+ * forwarded amount.
+ */
+constructor(parent: UserAddress) {
+  Forwarder_initialize(parent);
+}
+
+/**
+ * @description Receives an unshielded amount of `color` and atomically
+ * forwards it to the configured parent.
+ *
+ * @param {Bytes<32>} color - The token color.
+ * @param {Uint<128>} amount - The amount to deposit.
+ *
+ * @returns {[]} Empty tuple.
+ */
+export circuit deposit(color: Bytes<32>, amount: Uint<128>): [] {
+  Forwarder__deposit(color, amount);
+}
+
+/**
+ * @description Returns the configured parent recipient as stored on the
+ * ledger (the generic `Either`; the `right` arm holds the user address).
+ *
+ * @returns {Either<ContractAddress, UserAddress>} The parent recipient
+ * set at deploy.
+ */
+export circuit getParent(): Either<ContractAddress, UserAddress> {
+  return Forwarder__parent;
+}