@openzeppelin/compact-contracts 0.3.0-alpha.2 → 0.3.0-rc.1

package/access/AccessControl.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.3.0-alpha.2 (access/AccessControl.compact)
+// OpenZeppelin Compact Contracts v0.3.0-rc.1 (access/AccessControl.compact)
 
 pragma language_version >= 0.23.0;
 

package/access/Ownable.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.3.0-alpha.2 (access/Ownable.compact)
+// OpenZeppelin Compact Contracts v0.3.0-rc.1 (access/Ownable.compact)
 
 pragma language_version >= 0.23.0;
 

package/access/ShieldedAccessControl.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.3.0-alpha.2 (access/ShieldedAccessControl.compact)
+// OpenZeppelin Compact Contracts v0.3.0-rc.1 (access/ShieldedAccessControl.compact)
 
 pragma language_version >= 0.23.0;
 

package/access/ZOwnablePK.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.3.0-alpha.2 (access/ZOwnablePK.compact)
+// OpenZeppelin Compact Contracts v0.3.0-rc.1 (access/ZOwnablePK.compact)
 
 pragma language_version >= 0.23.0;
 

package/crypto/EcdhMask.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.3.0-alpha.2 (crypto/EcdhMask.compact)
+// OpenZeppelin Compact Contracts v0.3.0-rc.1 (crypto/EcdhMask.compact)
 
 pragma language_version >= 0.23.0;
 

package/crypto/ElGamal.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.3.0-alpha.2 (crypto/ElGamal.compact)
+// OpenZeppelin Compact Contracts v0.3.0-rc.1 (crypto/ElGamal.compact)
 
 pragma language_version >= 0.23.0;
 
@@ -34,6 +34,13 @@ pragma language_version >= 0.23.0;
  * scalar. Feeding a raw `persistentHash` output into `ecMulGenerator` would
  * occasionally exceed the Jubjub scalar field order and fault at runtime.
  *
+ * @dev Domain separation. `persistentHash<Vector<N, Bytes<32>>>` is NOT
+ * domain-separating on its own. Two circuits hashing the same arity and
+ * element type share one hash domain, and the hash cannot tell which slot was
+ * "meant" as a tag. `secretToScalar` therefore prefixes a fixed constant, and
+ * that constant is placed FIRST so no call to `expandRandomness` (whose two
+ * slots are both caller-supplied) can reproduce the tuple by ordinary use.
+ *
  * @dev TRUST ASSUMPTION — subgroup membership. This is the module's most
  * load-bearing assumption. Every `JubjubPoint` reaching a curve operation is
  * assumed to be in the Jubjub prime-order subgroup, including points supplied by
@@ -102,11 +109,34 @@ module ElGamal {
    * @description Maps a 32-byte secret to a valid Jubjub scalar. See the
    * module-level hash-to-scalar note for why `degradeToTransient` is required.
    *
+   * @dev Domain separation here is load-bearing, not cosmetic. This output is
+   * the private key protecting every ciphertext held under an account. Public
+   * account identifiers derived from `Utils.computeAccountId`, for example,
+   * are computed as `persistentHash([secretKey])`, and that identifier
+   * is stored in the clear as a ledger map key. Untagged, this circuit
+   * would compute that same hash, so a secret used in both roles would
+   * have its encryption key recoverable from a published identifier by applying
+   * `degradeToTransient`. The tag makes the two derivations unrelated, so a
+   * wallet MAY safely derive its account secret and its encryption secret from
+   * common key material.
+   *
+   * @dev The tag is FIRST, deliberately. `expandRandomness` hashes
+   * `[seed, tag]` with both slots caller-supplied, so tagging this circuit as
+   * `[secret, tag]` would make `secretToScalar(x)` identical to
+   * `expandRandomness(x, <this tag>)` reachable by passing this domain string
+   * to the parameter that exists to receive domain strings. Leading with the
+   * tag means reproducing this output through `expandRandomness` would require
+   * passing the domain constant as the *seed*. Do not normalise the orderings.
+   *
    * @param secret - The 32-byte secret to map.
    * @return A Field guaranteed to be a valid Jubjub scalar.
    */
   export pure circuit secretToScalar(secret: Bytes<32>): Field {
-    return degradeToTransient(persistentHash<Vector<1, Bytes<32>>>([secret]));
+    return degradeToTransient(
+             persistentHash<Vector<2, Bytes<32>>>(
+               [pad(32, "ElGamal:secretToScalar"), secret]
+             )
+           );
   }
 
   /**
@@ -452,6 +482,17 @@ module ElGamal {
    * wrong plaintext fails the decryption check. Lifted special case of
    * `assertDecryptsToPoint` with the message point `g^claimedValue`.
    *
+   * @notice `claimedValue` is the widest `Uint` Compact offers, so this parameter
+   * never bounds a caller. A narrower value costs proportionally fewer rows: the
+   * range constraint belongs to where the value is declared, not to this
+   * signature.
+   *
+   * @warning The claim domain must stay below the Jubjub subgroup order `l`:
+   * verification compares `g^claimedValue`, so two claims congruent mod `l` are
+   * indistinguishable. `Uint<248>` clears `l` (~2^251.86) by under 4 bits, and
+   * that width is set by Compact's cap rather than by this bound. 251 is the
+   * widest sound `Uint` if the cap ever rises.
+   *
    * Requirements:
    *
    * - `ek` is the secret for `pk`.
@@ -466,7 +507,7 @@ module ElGamal {
                    ct: Ciphertext,
                    pk: JubjubPoint,
                    ek: Bytes<32>,
-                   claimedValue: Uint<128>
+                   claimedValue: Uint<248>
                    ): [] {
     assertDecryptsToPoint(ct, pk, ek, ecMulGenerator(claimedValue as Field));
   }

package/multisig/ForwarderPrivate.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.3.0-alpha.2 (multisig/ForwarderPrivate.compact)
+// OpenZeppelin Compact Contracts v0.3.0-rc.1 (multisig/ForwarderPrivate.compact)
 
 pragma language_version >= 0.23.0;
 

package/multisig/ForwarderShielded.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.3.0-alpha.2 (multisig/ForwarderShielded.compact)
+// OpenZeppelin Compact Contracts v0.3.0-rc.1 (multisig/ForwarderShielded.compact)
 
 pragma language_version >= 0.23.0;
 

package/multisig/ForwarderUnshielded.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.3.0-alpha.2 (multisig/ForwarderUnshielded.compact)
+// OpenZeppelin Compact Contracts v0.3.0-rc.1 (multisig/ForwarderUnshielded.compact)
 
 pragma language_version >= 0.23.0;
 

package/multisig/ProposalManager.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.3.0-alpha.2 (multisig/ProposalManager.compact)
+// OpenZeppelin Compact Contracts v0.3.0-rc.1 (multisig/ProposalManager.compact)
 
 pragma language_version >= 0.23.0;
 

package/multisig/ShieldedTreasury.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.3.0-alpha.2 (multisig/ShieldedTreasury.compact)
+// OpenZeppelin Compact Contracts v0.3.0-rc.1 (multisig/ShieldedTreasury.compact)
 
 pragma language_version >= 0.23.0;
 

package/multisig/ShieldedTreasuryStateless.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.3.0-alpha.2 (multisig/ShieldedTreasuryStateless.compact)
+// OpenZeppelin Compact Contracts v0.3.0-rc.1 (multisig/ShieldedTreasuryStateless.compact)
 
 pragma language_version >= 0.23.0;
 

package/multisig/Signer.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.3.0-alpha.2 (multisig/Signer.compact)
+// OpenZeppelin Compact Contracts v0.3.0-rc.1 (multisig/Signer.compact)
 
 pragma language_version >= 0.23.0;
 

package/multisig/UnshieldedTreasury.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.3.0-alpha.2 (multisig/UnshieldedTreasury.compact)
+// OpenZeppelin Compact Contracts v0.3.0-rc.1 (multisig/UnshieldedTreasury.compact)
 
 pragma language_version >= 0.23.0;
 

package/multisig/presets/ShieldedMultiSig.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.3.0-alpha.2 (multisig/presets/ShieldedMultiSig.compact)
+// OpenZeppelin Compact Contracts v0.3.0-rc.1 (multisig/presets/ShieldedMultiSig.compact)
 
 pragma language_version >= 0.23.0;
 

package/multisig/presets/ShieldedMultiSigV2.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.3.0-alpha.2 (multisig/presets/ShieldedMultiSigV2.compact)
+// OpenZeppelin Compact Contracts v0.3.0-rc.1 (multisig/presets/ShieldedMultiSigV2.compact)
 
 pragma language_version >= 0.23.0;
 

package/multisig/presets/forwarder/ForwarderPrivate.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.3.0-alpha.2 (multisig/presets/forwarder/ForwarderPrivate.compact)
+// OpenZeppelin Compact Contracts v0.3.0-rc.1 (multisig/presets/forwarder/ForwarderPrivate.compact)
 
 pragma language_version >= 0.23.0;
 

package/multisig/presets/forwarder/ForwarderShielded.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.3.0-alpha.2 (multisig/presets/forwarder/ForwarderShielded.compact)
+// OpenZeppelin Compact Contracts v0.3.0-rc.1 (multisig/presets/forwarder/ForwarderShielded.compact)
 
 pragma language_version >= 0.23.0;
 

package/multisig/presets/forwarder/ForwarderUnshielded.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.3.0-alpha.2 (multisig/presets/forwarder/ForwarderUnshielded.compact)
+// OpenZeppelin Compact Contracts v0.3.0-rc.1 (multisig/presets/forwarder/ForwarderUnshielded.compact)
 
 pragma language_version >= 0.23.0;
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openzeppelin/compact-contracts",
-  "version": "0.3.0-alpha.2",
+  "version": "0.3.0-rc.1",
   "description": "OpenZeppelin Compact contract library",
   "keywords": [
     "openzeppelin",

package/security/Allowlist.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.3.0-alpha.2 (security/Allowlist.compact)
+// OpenZeppelin Compact Contracts v0.3.0-rc.1 (security/Allowlist.compact)
 
 pragma language_version >= 0.23.0;
 

package/security/Blocklist.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.3.0-alpha.2 (security/Blocklist.compact)
+// OpenZeppelin Compact Contracts v0.3.0-rc.1 (security/Blocklist.compact)
 
 pragma language_version >= 0.23.0;
 

package/security/Initializable.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.3.0-alpha.2 (security/Initializable.compact)
+// OpenZeppelin Compact Contracts v0.3.0-rc.1 (security/Initializable.compact)
 
 pragma language_version >= 0.23.0;
 

package/security/Pausable.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.3.0-alpha.2 (security/Pausable.compact)
+// OpenZeppelin Compact Contracts v0.3.0-rc.1 (security/Pausable.compact)
 
 pragma language_version >= 0.23.0;