@openzeppelin/compact-contracts 0.3.0-rc.1 → 0.3.0

package/README.md

@@ -10,7 +10,7 @@ This project is built on the Midnight Network.
 
 > ## ⚠️ WARNING! ⚠️
 >
-> This repo contains highly experimental code.
+> Pre-release versions (`-alpha`, `-rc`) contain experimental, unaudited code.
 > Expect rapid iteration.
 > **Use at your own risk.**
 
@@ -268,9 +268,17 @@ rm -rf .turbo/
 
 ## Security
 
-This project is still in a very early and experimental phase. It has never been audited nor thoroughly reviewed for security vulnerabilities. DO NOT USE IT IN PRODUCTION.
+For production, use a stable release (no `-alpha` or `-rc` suffix) on the Midnight ledger it targets. Pre-releases are not audited and should not be used in production.
 
-Please report any security issues you find to <security@openzeppelin.com>.
+| Release | Midnight ledger | Compact compiler | Audits |
+| ------- | --------------- | ---------------- | ------ |
+| 0.3.0   | Ledger v8       | 0.31.0           | [Aug 2026](./audits/2026-08-v0.3.0-alpha.1.pdf), [Oct 2026](./audits/2026-10-v0.3.0-rc.2-v0.4.0-alpha.6.pdf) |
+| 0.2.0   | Ledger v7       | 0.29.0           | None of its own. Its changes were reviewed in the Aug 2026 audit. |
+| 0.1.0   | Ledger v7       | 0.29.0           | [May 2026](./audits/2026-05-v0.1.0.pdf) |
+
+Scopes and audited commits are listed in [audits](./audits/README.md).
+
+Please report any security issues you find to <security@openzeppelin.com>. See [SECURITY.md](SECURITY.md).
 
 ### Provenance
 

package/access/AccessControl.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.3.0-rc.1 (access/AccessControl.compact)
+// OpenZeppelin Compact Contracts v0.3.0 (access/AccessControl.compact)
 
 pragma language_version >= 0.23.0;
 

package/access/Ownable.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.3.0-rc.1 (access/Ownable.compact)
+// OpenZeppelin Compact Contracts v0.3.0 (access/Ownable.compact)
 
 pragma language_version >= 0.23.0;
 

package/access/ShieldedAccessControl.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.3.0-rc.1 (access/ShieldedAccessControl.compact)
+// OpenZeppelin Compact Contracts v0.3.0 (access/ShieldedAccessControl.compact)
 
 pragma language_version >= 0.23.0;
 
@@ -108,8 +108,8 @@ pragma language_version >= 0.23.0;
  *   depends on the number of plausible `(role, accountId)` pairings. Since role identifiers
  *   are public, the anonymity set is effectively the number of plausible account IDs per role.
  * - Outside observers will know when roles are granted and revoked.
- * - Outside observers can infer the total number of role grants made across all roles—not per-role counts,
- *   but the cumulative total.
+ * - Outside observers can infer the total number of distinct `(role, accountId)` pairings granted
+ *   across all roles, not per-role counts.
  * - Outside observers can link calls made by the same role instance across time.
  * - Users can be retroactively deanonymized if their secret key is exposed.
  * - Outside observers will NOT be able to identify the holder of any role
@@ -133,29 +133,20 @@ pragma language_version >= 0.23.0;
  * - It's strongly recommended to use cryptographically secure random values for the `_instanceSalt`.
  *   Failure to do so may weaken privacy guarantees.
  * - The `_instanceSalt` is immutable and used to differentiate deployments.
- * - The `_operatorRoles` Merkle tree has a fixed capacity of 2^20 leaf slots.
- *   Deployers should monitor slot consumption off-chain. A careless admin can exhaust
- *   capacity through repeated grants of the same active (role, accountId) pairing.
- *   Duplicate grants are benign from a security perspective. They produce identical
- *   commitments and a single nullifier invalidates all copies; however, they waste tree capacity.
- *   Implementing contracts are responsible for mitigating tree exhaustion risk.
+ * - The `_operatorRoles` Merkle tree has a fixed capacity of 2^20 leaf slots. Each distinct
+ *   `(role, accountId)` pairing consumes one slot; re-granting an active pairing is a no-op.
  * - A single `secretKey` compromise exposes all roles held by that user within the contract
  *   instance, since all roles share the same `accountId`. Users requiring compartmentalization
  *   between roles should use separate keys per role and accept the additional key management overhead.
  *   In the event of key compromise, the user should coordinate with admins to revoke all roles
  *   under the compromised `accountId` and re-grant under a new identity.
- * - Admins can revoke `(role, accountId)` pairings that were never granted, since on-chain
- *   non-membership proofs are not available for the Merkle tree. This permanently burns the
- *   nullifier for that pairing, blocking any future grant. Admin trust is a fundamental
- *   assumption of this system. Off-chain validation should confirm that a pairing was actually
- *   granted before submitting a revocation transaction.
- * - `renounceRole` allows burning nullifiers for roles the caller does not currently hold,
- *   provided they possess the correct `secretKey`. This requires knowledge of the secret key,
- *   at which point the `accountId` should be considered fully compromised regardless.
+ * - A `(role, accountId)` pairing can only be revoked after it was granted, so the nullifier
+ *   set holds at most one entry per granted pairing.
  * - The Merkle tree capacity of 2^20 leaf slots is a permanent, irrecoverable resource.
  *   There is no mechanism to reclaim slots after revocation, no upgrade path, and no emergency
  *   recovery. Once exhausted, the contract is permanently unable to grant new roles. Deployers
- *   must monitor slot consumption off-chain and plan capacity accordingly.
+ *   must monitor slot consumption off-chain and plan capacity accordingly. The exported tree
+ *   reports occupancy via `firstFree()` (TypeScript) and `isFull()` (circuit).
  *
  * @notice Using the SHA256 hashing function comes at a significant performance cost. In the future, we
  * plan on migrating to a ZK-friendly hashing function when an implementation is available.
@@ -209,6 +200,14 @@ module ShieldedAccessControl {
    */
   export ledger _roleCommitmentNullifiers: Set<RoleNullifier>;
 
+  /**
+   * @description Nullifiers of every pairing ever granted. Makes a repeated grant a no-op so
+   * one pairing can never consume more than one `_operatorRoles` slot, and gates revocation
+   * so a nullifier can only exist for a granted pairing.
+   * @type {Set<RoleNullifier>} _grantedRoleNullifiers
+   */
+  export ledger _grantedRoleNullifiers: Set<RoleNullifier>;
+
   /**
    * @sealed @ledger _instanceSalt
    * @description A per-instance value provided at initialization used to namespace
@@ -387,9 +386,8 @@ module ShieldedAccessControl {
 
   /**
    * @description Grants `role` to `accountId` by inserting a role commitment unique to the
-   * `(role, accountId)` pairing into the `_operatorRoles` Merkle tree. Duplicate role commitments can be issued
-   * so long as they remain unrevoked. This does not yield any additional authority and simply wastes
-   * limited Merkle tree storage slots. Once revoked, a role cannot be re-granted to the same `accountId`. A new
+   * `(role, accountId)` pairing into the `_operatorRoles` Merkle tree. Granting an already active
+   * pairing is a no-op. Once revoked, a role cannot be re-granted to the same `accountId`. A new
    * `accountId` must be generated to be re-authorized for a revoked `role`.
    *
    * Requirements:
@@ -419,9 +417,8 @@ module ShieldedAccessControl {
 
   /**
    * @description Grants `role` to `accountId` by inserting a role commitment unique to the
-   * `(role, accountId)` pairing into the `_operatorRoles` Merkle tree. Duplicate role commitments can be issued
-   * so long as they remain unrevoked. This does not yield any additional authority and simply wastes
-   * limited Merkle tree storage slots. Once revoked, a role cannot be re-granted to the same `accountId`. A new
+   * `(role, accountId)` pairing into the `_operatorRoles` Merkle tree. Granting an already active
+   * pairing is a no-op. Once revoked, a role cannot be re-granted to the same `accountId`. A new
    * `accountId` must be generated to be re-authorized for a revoked `role`.
    *
    * Internal circuit without access restriction.
@@ -429,10 +426,8 @@ module ShieldedAccessControl {
    * @warning Exposing this circuit directly in an implementing contract would allow anyone to grant
    * roles without authorization. It must be wrapped with appropriate access control.
    *
-   * @warning The `_operatorRoles` Merkle tree has a fixed capacity of 2^20 leaf slots.
-   * Deployers should monitor slot consumption off-chain. Duplicate grants waste tree capacity
-   * but are otherwise benign. A single nullifier invalidates all duplicate commitments.
-   * Implementing contracts are responsible for mitigating tree exhaustion risk.
+   * @warning The `_operatorRoles` Merkle tree has a fixed capacity of 2^20 leaf slots, one per
+   * distinct pairing. Deployers should monitor slot consumption off-chain.
    *
    * Requirements:
    *
@@ -462,6 +457,7 @@ module ShieldedAccessControl {
    * @notice Roles are often managed via {grantRole} and {revokeRole}: this circuit's
    * purpose is to provide a mechanism for accounts to lose their privileges
    * if they are compromised (such as when a trusted device is misplaced).
+   * Consumers with no need for self-revocation should not export this circuit.
    *
    * @warning Outside observers may be able to use timing and pattern analysis to weaken pseudonymity
    * guarantees if renounceRole is used in tandem with other on-chain actions.
@@ -469,6 +465,7 @@ module ShieldedAccessControl {
    * Requirements:
    *
    * - The caller must provide a valid `accountId` for the role.
+   * - The `(role, accountId)` pairing must have been granted.
    * - The `(role, accountId)` pairing must not be already revoked.
    * - Contract is initialized.
    *
@@ -494,13 +491,13 @@ module ShieldedAccessControl {
   /**
    * @description Permanently revokes `role` from `accountId` by inserting a role nullifier into the
    * `_roleCommitmentNullifiers` set. Once revoked, a new `accountId` must be generated to be re-authorized for
-   * `role`. At this time, proofs of non-membership on values in the Merkle tree LDT are not possible
-   * so a `(role, accountId)` pairing that does not exist can still be revoked.
+   * `role`.
    *
    * Requirements:
    *
    * - caller must prove they're an admin for `role`.
    * - caller must not provide valid Merkle tree path for a different `(role, accountId)` pairing.
+   * - The `(role, accountId)` pairing must have been granted.
    * - The `(role, accountId)` pairing must not be already revoked.
    * - Contract is initialized.
    *
@@ -525,8 +522,7 @@ module ShieldedAccessControl {
   /**
    * @description Permanently revokes `role` from `accountId` by inserting a role nullifier into the
    * `_roleCommitmentNullifiers` set. Once revoked, a new `accountId` must be generated to be re-authorized for
-   * `role`. At this time, proofs of non-membership on values in the Merkle tree LDT are not possible
-   * so a `(role, accountId)` pairing that does not exist can still be revoked.
+   * `role`.
    *
    * Internal circuit without access restriction.
    *
@@ -535,6 +531,7 @@ module ShieldedAccessControl {
    *
    * Requirements:
    *
+   * - The `(role, accountId)` pairing must have been granted.
    * - The `(role, accountId)` pairing must not be already revoked.
    * - Contract is initialized.
    *
@@ -555,13 +552,14 @@ module ShieldedAccessControl {
   /**
    * @description Core business logic for the grant/revoke role circuits. Asserts that the
    * `(role, accountId)` pairing has not already been revoked. On success, dispatches on
-   * `updateType`: a `Grant` inserts the role commitment into `_operatorRoles`, and
-   * a `Revoke` inserts the nullifier into `_roleCommitmentNullifiers`.
+   * `updateType`: a `Grant` inserts the role commitment into `_operatorRoles` unless the
+   * nullifier is already in `_grantedRoleNullifiers`, and a `Revoke` asserts the nullifier
+   * is in `_grantedRoleNullifiers` before inserting it into `_roleCommitmentNullifiers`.
    *
    * Disclosures:
    *
    * - A nullifier for the respective role commitment.
-   * - A role commitment (on Grant only).
+   * - A role commitment (on first Grant only).
    *
    * @notice The nullifier is disclosed via `_roleCommitmentNullifiers.member` on every call,
    * regardless of the update type. Since `Set.member` publicly reveals its argument, the
@@ -584,9 +582,14 @@ module ShieldedAccessControl {
     const isRevoked = _roleCommitmentNullifiers.member(disclose(roleNullifier));
     assert(!isRevoked, "ShieldedAccessControl: role is already revoked");
 
+    const isGranted = _grantedRoleNullifiers.member(disclose(roleNullifier));
     if (updateType == UpdateType.Grant) {
-      _operatorRoles.insert(disclose(roleCommitment));
+      if (!isGranted) {
+        _grantedRoleNullifiers.insert(disclose(roleNullifier));
+        _operatorRoles.insert(disclose(roleCommitment));
+      }
     } else {
+      assert(isGranted, "ShieldedAccessControl: role was never granted");
       _roleCommitmentNullifiers.insert(disclose(roleNullifier));
     }
   }

package/access/ZOwnablePK.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.3.0-rc.1 (access/ZOwnablePK.compact)
+// OpenZeppelin Compact Contracts v0.3.0 (access/ZOwnablePK.compact)
 
 pragma language_version >= 0.23.0;
 
@@ -35,10 +35,17 @@ pragma language_version >= 0.23.0;
  * providing unlinkability across ownership changes.
  *
  * @dev Security Considerations:
- * - The `secretNonce` must be kept private. Loss of the nonce prevents the
- *   owner from proving ownership or transferring it.
+ * - `ownPublicKey()` is a witness: it returns the caller's Zswap coin public
+ *   key, and nothing proves the caller holds the matching private key. See
+ *   https://docs.midnight.network/compact/smart-contract-security#ownpublickey-is-a-witness-function.
+ * - The `secretNonce` is therefore the owner credential: the nonce and the
+ *   owner's public key are enough to pass `assertOnlyOwner`. Generate it as
+ *   32 bytes from a CSPRNG and keep it private. Losing it prevents the owner
+ *   from proving ownership or transferring it.
  * - Ownership validation is entirely circuit-based using witness-provided values.
  * - The `_instanceSalt` is immutable and used to differentiate deployments.
+ *   Use a fresh random value per deployment; a reused salt links the same
+ *   owner across deployments.
  *
  * @notice Best used for single-admin contracts with privacy requirements.
  * It is not designed for multi-owner or role-based access control.
@@ -105,6 +112,7 @@ module ZOwnablePK {
    *
    * - Contract is not initialized.
    * - `ownerId` is not zero.
+   * - `instanceSalt` is not zero.
    *
    * @param {Bytes<32>} ownerId - The owner's unique identifier SHA256(pk, nonce).
    * @param {Bytes<32>} instanceSalt - Contract salt to prevent duplicate commitments if
@@ -116,6 +124,7 @@ module ZOwnablePK {
     _isInitialized = true;
 
     assert(ownerId != default<Bytes<32>>, "ZOwnablePK: invalid id");
+    assert(instanceSalt != default<Bytes<32>>, "ZOwnablePK: invalid salt");
     _instanceSalt = disclose(instanceSalt);
     _transferOwnership(ownerId);
   }

package/crypto/EcdhMask.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.3.0-rc.1 (crypto/EcdhMask.compact)
+// OpenZeppelin Compact Contracts v0.3.0 (crypto/EcdhMask.compact)
 
 pragma language_version >= 0.23.0;
 

package/crypto/ElGamal.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.3.0-rc.1 (crypto/ElGamal.compact)
+// OpenZeppelin Compact Contracts v0.3.0 (crypto/ElGamal.compact)
 
 pragma language_version >= 0.23.0;
 

package/multisig/ForwarderPrivate.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.3.0-rc.1 (multisig/ForwarderPrivate.compact)
+// OpenZeppelin Compact Contracts v0.3.0 (multisig/ForwarderPrivate.compact)
 
 pragma language_version >= 0.23.0;
 

package/multisig/ForwarderShielded.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.3.0-rc.1 (multisig/ForwarderShielded.compact)
+// OpenZeppelin Compact Contracts v0.3.0 (multisig/ForwarderShielded.compact)
 
 pragma language_version >= 0.23.0;
 

package/multisig/ForwarderUnshielded.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.3.0-rc.1 (multisig/ForwarderUnshielded.compact)
+// OpenZeppelin Compact Contracts v0.3.0 (multisig/ForwarderUnshielded.compact)
 
 pragma language_version >= 0.23.0;
 

package/multisig/ProposalManager.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.3.0-rc.1 (multisig/ProposalManager.compact)
+// OpenZeppelin Compact Contracts v0.3.0 (multisig/ProposalManager.compact)
 
 pragma language_version >= 0.23.0;
 

package/multisig/ShieldedTreasury.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.3.0-rc.1 (multisig/ShieldedTreasury.compact)
+// OpenZeppelin Compact Contracts v0.3.0 (multisig/ShieldedTreasury.compact)
 
 pragma language_version >= 0.23.0;
 

package/multisig/ShieldedTreasuryStateless.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.3.0-rc.1 (multisig/ShieldedTreasuryStateless.compact)
+// OpenZeppelin Compact Contracts v0.3.0 (multisig/ShieldedTreasuryStateless.compact)
 
 pragma language_version >= 0.23.0;
 

package/multisig/Signer.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.3.0-rc.1 (multisig/Signer.compact)
+// OpenZeppelin Compact Contracts v0.3.0 (multisig/Signer.compact)
 
 pragma language_version >= 0.23.0;
 

package/multisig/UnshieldedTreasury.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.3.0-rc.1 (multisig/UnshieldedTreasury.compact)
+// OpenZeppelin Compact Contracts v0.3.0 (multisig/UnshieldedTreasury.compact)
 
 pragma language_version >= 0.23.0;
 

package/multisig/presets/ShieldedMultiSig.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.3.0-rc.1 (multisig/presets/ShieldedMultiSig.compact)
+// OpenZeppelin Compact Contracts v0.3.0 (multisig/presets/ShieldedMultiSig.compact)
 
 pragma language_version >= 0.23.0;
 

package/multisig/presets/ShieldedMultiSigV2.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.3.0-rc.1 (multisig/presets/ShieldedMultiSigV2.compact)
+// OpenZeppelin Compact Contracts v0.3.0 (multisig/presets/ShieldedMultiSigV2.compact)
 
 pragma language_version >= 0.23.0;
 

package/multisig/presets/forwarder/ForwarderPrivate.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.3.0-rc.1 (multisig/presets/forwarder/ForwarderPrivate.compact)
+// OpenZeppelin Compact Contracts v0.3.0 (multisig/presets/forwarder/ForwarderPrivate.compact)
 
 pragma language_version >= 0.23.0;
 

package/multisig/presets/forwarder/ForwarderShielded.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.3.0-rc.1 (multisig/presets/forwarder/ForwarderShielded.compact)
+// OpenZeppelin Compact Contracts v0.3.0 (multisig/presets/forwarder/ForwarderShielded.compact)
 
 pragma language_version >= 0.23.0;
 

package/multisig/presets/forwarder/ForwarderUnshielded.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.3.0-rc.1 (multisig/presets/forwarder/ForwarderUnshielded.compact)
+// OpenZeppelin Compact Contracts v0.3.0 (multisig/presets/forwarder/ForwarderUnshielded.compact)
 
 pragma language_version >= 0.23.0;
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openzeppelin/compact-contracts",
-  "version": "0.3.0-rc.1",
+  "version": "0.3.0",
   "description": "OpenZeppelin Compact contract library",
   "keywords": [
     "openzeppelin",

package/security/Allowlist.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.3.0-rc.1 (security/Allowlist.compact)
+// OpenZeppelin Compact Contracts v0.3.0 (security/Allowlist.compact)
 
 pragma language_version >= 0.23.0;
 

package/security/Blocklist.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.3.0-rc.1 (security/Blocklist.compact)
+// OpenZeppelin Compact Contracts v0.3.0 (security/Blocklist.compact)
 
 pragma language_version >= 0.23.0;
 

package/security/Initializable.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.3.0-rc.1 (security/Initializable.compact)
+// OpenZeppelin Compact Contracts v0.3.0 (security/Initializable.compact)
 
 pragma language_version >= 0.23.0;
 

package/security/Pausable.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.3.0-rc.1 (security/Pausable.compact)
+// OpenZeppelin Compact Contracts v0.3.0 (security/Pausable.compact)
 
 pragma language_version >= 0.23.0;
 

package/token/ConfidentialFungibleToken.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.3.0-rc.1 (token/ConfidentialFungibleToken.compact)
+// OpenZeppelin Compact Contracts v0.3.0 (token/ConfidentialFungibleToken.compact)
 
 pragma language_version >= 0.23.0;
 
@@ -1037,7 +1037,7 @@ module ConfidentialFungibleToken {
    * caller via `approve`) and credits it to `to`, reducing both escrow copies by
    * `value`. The amount is hidden.
    *
-   * ???? @circuitInfo k=16, rows=72346
+   * @circuitInfo k=16, rows=72346
    *
    * @notice Returns the caller's (spender's) `accountId` for caller-side gating.
    *
@@ -1286,7 +1286,7 @@ module ConfidentialFungibleToken {
    * recipient credit. The building block for a composing contract's
    * `burnFrom`; it performs no supply accounting (see `_burn`).
    *
-   * ???? @circuitInfo k=16, rows=45376
+   * @circuitInfo k=16, rows=45376
    *
    * Requirements:
    *

package/token/FungibleToken.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.3.0-rc.1 (token/FungibleToken.compact)
+// OpenZeppelin Compact Contracts v0.3.0 (token/FungibleToken.compact)
 
 pragma language_version >= 0.23.0;
 

package/token/MultiToken.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.3.0-rc.1 (token/MultiToken.compact)
+// OpenZeppelin Compact Contracts v0.3.0 (token/MultiToken.compact)
 
 pragma language_version >= 0.23.0;
 

package/token/NativeShieldedToken.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.3.0-rc.1 (token/NativeShieldedToken.compact)
+// OpenZeppelin Compact Contracts v0.3.0 (token/NativeShieldedToken.compact)
 
 pragma language_version >= 0.23.0;
 

package/token/NativeShieldedTokenCore.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.3.0-rc.1 (token/NativeShieldedTokenCore.compact)
+// OpenZeppelin Compact Contracts v0.3.0 (token/NativeShieldedTokenCore.compact)
 
 pragma language_version >= 0.23.0;
 

package/token/NativeShieldedTokenFamily.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.3.0-rc.1 (token/NativeShieldedTokenFamily.compact)
+// OpenZeppelin Compact Contracts v0.3.0 (token/NativeShieldedTokenFamily.compact)
 
 pragma language_version >= 0.23.0;
 

package/token/NonFungibleToken.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.3.0-rc.1 (token/NonFungibleToken.compact)
+// OpenZeppelin Compact Contracts v0.3.0 (token/NonFungibleToken.compact)
 
 pragma language_version >= 0.23.0;
 

package/token/examples/ZOwnableNativeShieldedTokenExample.compact

@@ -0,0 +1,109 @@
+// SPDX-License-Identifier: MIT
+// OpenZeppelin Compact Contracts v0.3.0 (token/examples/ZOwnableNativeShieldedTokenExample.compact)
+
+pragma language_version >= 0.23.0;
+
+/**
+ * @title ZOwnableNativeShieldedTokenExample
+ * @description Deployable reference contract for the
+ * `ZOwnableNativeShieldedToken` preset: a native shielded token that only a
+ * single shielded owner mints and burns. Holders transfer coins through
+ * Zswap directly.
+ */
+
+import CompactStandardLibrary;
+
+import "../presets/ZOwnableNativeShieldedToken" prefix ZOwnableNativeShieldedToken_;
+
+export { ZswapCoinPublicKey, ContractAddress, Either, Maybe, ShieldedCoinInfo };
+
+// Surface the preset's state unprefixed so `ledger()` readers use the keys the
+// modules declare.
+import {
+  _ownerCommitment,
+  _counter,
+  _instanceSalt,
+  _ownableIsInitialized,
+  _domain,
+  _name,
+  _symbol,
+  _decimals,
+  _isInitialized,
+  _totalMinted,
+  _totalBurned,
+} from "../presets/ZOwnableNativeShieldedToken";
+export {
+  _ownerCommitment,
+  _counter,
+  _instanceSalt,
+  _ownableIsInitialized,
+  _domain,
+  _name,
+  _symbol,
+  _decimals,
+  _isInitialized,
+  _totalMinted,
+  _totalBurned,
+};
+
+/**
+ * @description Deploys the token with its owner, domain and metadata.
+ *
+ * @warning `ownerId` must be `_computeOwnerId(pk, secretNonce)` for the coin
+ * public key the owner's wallet will supply as `ownPublicKey()`. The circuit
+ * cannot check this at deploy; any other key leaves the contract with no
+ * usable owner and no recovery.
+ *
+ * @param {Bytes<32>} ownerId - `_computeOwnerId(pk, secretNonce)` of the owner.
+ * @param {Bytes<32>} instanceSalt - Random per-deployment salt for the owner commitment.
+ * @param {Bytes<32>} tokenDomain - Domain of this contract's token color.
+ */
+constructor(
+  ownerId: Bytes<32>,
+  instanceSalt: Bytes<32>,
+  tokenDomain: Bytes<32>,
+  name_: Opaque<"string">,
+  symbol_: Opaque<"string">,
+  decimals_: Uint<8>,
+) {
+  ZOwnableNativeShieldedToken_initialize(
+    ownerId,
+    instanceSalt,
+    tokenDomain,
+    name_,
+    symbol_,
+    decimals_,
+  );
+}
+
+export circuit mint(recipient: ZswapCoinPublicKey, amount: Uint<64>, nonce: Bytes<32>): ShieldedCoinInfo {
+  return ZOwnableNativeShieldedToken_mint(recipient, amount, nonce);
+}
+
+export circuit burn(coin: ShieldedCoinInfo, amount: Uint<64>, refundTo: ZswapCoinPublicKey): Maybe<ShieldedCoinInfo> {
+  return ZOwnableNativeShieldedToken_burn(coin, amount, refundTo);
+}
+
+export circuit transferOwnership(newOwnerId: Bytes<32>): [] {
+  ZOwnableNativeShieldedToken_transferOwnership(newOwnerId);
+}
+
+export circuit renounceOwnership(): [] {
+  ZOwnableNativeShieldedToken_renounceOwnership();
+}
+
+export circuit owner(): Bytes<32> {
+  return ZOwnableNativeShieldedToken_owner();
+}
+
+export pure circuit _computeOwnerId(pk: Either<ZswapCoinPublicKey, ContractAddress>, nonce: Bytes<32>): Bytes<32> {
+  return ZOwnableNativeShieldedToken__computeOwnerId(pk, nonce);
+}
+
+export circuit totalMinted(): Uint<128> {
+  return ZOwnableNativeShieldedToken_totalMinted();
+}
+
+export circuit tokenColor(): Bytes<32> {
+  return ZOwnableNativeShieldedToken_tokenColor();
+}

package/token/extensions/ConfidentialFungibleTokenPublicSupply.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.3.0-rc.1 (token/extensions/ConfidentialFungibleTokenPublicSupply.compact)
+// OpenZeppelin Compact Contracts v0.3.0 (token/extensions/ConfidentialFungibleTokenPublicSupply.compact)
 
 pragma language_version >= 0.23.0;
 

package/token/extensions/NativeShieldedTokenDerivedNonce.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.3.0-rc.1 (token/extensions/NativeShieldedTokenDerivedNonce.compact)
+// OpenZeppelin Compact Contracts v0.3.0 (token/extensions/NativeShieldedTokenDerivedNonce.compact)
 
 pragma language_version >= 0.23.0;
 

package/token/presets/ZOwnableNativeShieldedToken.compact

@@ -0,0 +1,314 @@
+// SPDX-License-Identifier: MIT
+// OpenZeppelin Compact Contracts v0.3.0 (token/presets/ZOwnableNativeShieldedToken.compact)
+
+pragma language_version >= 0.23.0;
+
+/**
+ * @module ZOwnableNativeShieldedToken
+ * @description
+ * A native shielded token with a single shielded owner. Only the owner mints
+ * (to a coin public key, with a caller-supplied nonce) and burns (a coin the
+ * owner's wallet pays into the tx). Minted amounts are counted on-chain.
+ *
+ * Composes `ZOwnablePK` as `ZOwnablePK_` (owner commitment),
+ * `NativeShieldedToken` as `NST_` (one token color) and
+ * `NativeShieldedTokenPublicSupply` as `NSTPublicSupply_` (minted total).
+ *
+ * @dev Derivations:
+ * - `H<T>(...)`: `persistentHash<T>`.
+ * - Owner id: `id = H<Vector<2, Bytes<32>>>([pk.bytes, secretNonce])`.
+ * - Owner commitment: `H<Vector<4, Bytes<32>>>([id, instanceSalt,
+ *   counter as Field as Bytes<32>, pad(32, "ZOwnablePK:shield:")])`.
+ * - Token color: `tokenType(_domain, kernel.self())`.
+ *
+ * @notice Implementing contracts call `initialize` from their constructor and
+ * MUST NOT import the composed modules directly.
+ *
+ * @notice Privacy:
+ * - Public, per tx: every mint amount (the Zswap mint effect and
+ *   `_totalMinted`), the coin commitments and nullifiers, and which circuit
+ *   ran.
+ * - Public, as state: `_ownerCommitment`, `_counter` (the number of ownership
+ *   changes), `_instanceSalt`, `_totalMinted`, `_domain`, `_name`, `_symbol`,
+ *   `_decimals`.
+ * - Private: mint `recipient` and `nonce`. Burn `amount`, `coin` and
+ *   `refundTo`, as long as the observer does not know the coin's nonce. A change
+ *   output reveals that a burn was partial.
+ * - Owner: stored as a commitment to `id`; the key and nonce never leave the
+ *   proof.
+ *
+ * @notice Security:
+ * - Owner check: proves knowledge of a `(pk, secretNonce)` whose commitment
+ *   matches. `ownPublicKey()` is prover-supplied, so the check does not bind
+ *   the submitting wallet; `secretNonce` is the only secret.
+ * - Every mutating circuit checks ownership before any token check.
+ * - `transferOwnership` is one step; a wrong `newOwnerId` loses the contract.
+ * - `renounceOwnership` stops mint and burn forever.
+ * - Upgrades: the CMA can replace any circuit's verifier key, so it sits
+ *   above the owner and should not be a single key.
+ * - A failed assert rejects the whole tx; no state moves.
+ *
+ * @notice Concurrency:
+ * - `mint` reads and writes `_totalMinted`; the read pins it, so at most one
+ *   mint lands per block.
+ * - `burn` only reads owner state: burns commute with each other and with one
+ *   mint.
+ * - `transferOwnership` / `renounceOwnership` write the owner commitment and
+ *   conflict with every owner-gated call and `owner()` in the same block.
+ * - Metadata views and `totalMinted` read no owner state; `totalMinted`
+ *   submitted as a tx conflicts with a same-block mint.
+ * - A tx that loses a same-block race fails and must be re-proven against
+ *   the new state.
+ *
+ * @notice Scope:
+ * Mint and burn only. Holders transfer through Zswap directly. No roles,
+ * freeze, seize, contract-held coins, burned total or total supply.
+ *
+ * @notice Client-side duties:
+ * - Build every owner tx with the coin public key in the current `ownerId`
+ *   and the matching `wit_secretNonce`. A wrong nonce fails the ownership
+ *   check and reveals nothing.
+ * - `ownPublicKey()` is supplied by the client like a witness; the circuit
+ *   cannot check that it belongs to the submitting wallet. The client is
+ *   responsible for supplying the coin public key that is in the current
+ *   `ownerId`; any other key fails the ownership check.
+ * - Compute `ownerId` off-chain with `_computeOwnerId`.
+ * - `nonce` must be fresh random bytes per mint.
+ * - Persist the coin infos `mint` and `burn` return. midnight-js encrypts an
+ *   output to its recipient only when it can resolve the recipient's
+ *   encryption key (its own, or one given in
+ *   `additionalCoinEncPublicKeyMappings`).
+ * - Run the proof server where the owner controls it; it sees
+ *   `wit_secretNonce`.
+ *
+ * @dev Composition:
+ * - Burn accounting: calling `NSTPublicSupply__addBurned` in `burn` would
+ *   publish every burn amount.
+ */
+module ZOwnableNativeShieldedToken {
+  import CompactStandardLibrary;
+
+  import "../../access/ZOwnablePK" prefix ZOwnablePK_;
+  import "../NativeShieldedToken" prefix NST_;
+  import "../extensions/NativeShieldedTokenPublicSupply" prefix NSTPublicSupply_;
+
+  // Named import/re-export of the composed modules' state only, so an
+  // implementing contract can surface every ledger field under its own key.
+  // The circuits stay behind the prefixes above. The ownable flag is aliased
+  // because the token module already owns `_isInitialized`.
+  // `_totalBurned` is never written, so it stays empty.
+  import { _ownerCommitment, _counter, _instanceSalt, _isInitialized as _ownableIsInitialized } from "../../access/ZOwnablePK";
+  import { _domain, _name, _symbol, _decimals, _isInitialized } from "../NativeShieldedToken";
+  import { _totalMinted, _totalBurned } from "../extensions/NativeShieldedTokenPublicSupply";
+  
+  export { _ownerCommitment, _counter, _instanceSalt, _ownableIsInitialized };
+  export { _domain, _name, _symbol, _decimals, _isInitialized };
+  export { _totalMinted, _totalBurned };
+
+  /**
+   * @description Sets the owner and the token's domain and metadata.
+   *
+   * @notice Call from the implementing contract's constructor only. It writes
+   * sealed fields, so implementing contracts MUST NOT expose it as a
+   * post-deploy circuit.
+   *
+   * @warning `ownerId` must be `_computeOwnerId(pk, secretNonce)` for the coin
+   * public key the owner's wallet will supply as `ownPublicKey()`. The circuit
+   * cannot check this at deploy; any other key leaves the contract with no
+   * usable owner and no recovery.
+   *
+   * Requirements:
+   *
+   * - Contract is not initialized.
+   * - `ownerId` is not zero.
+   *
+   * @param {Bytes<32>} ownerId - `_computeOwnerId(pk, secretNonce)` of the owner.
+   * @param {Bytes<32>} instanceSalt - Random per-deployment salt for the owner commitment.
+   * @param {Bytes<32>} tokenDomain - Domain of this contract's token color.
+   * @param {Opaque<"string">} name_ - The token name.
+   * @param {Opaque<"string">} symbol_ - The token symbol.
+   * @param {Uint<8>} decimals_ - The token decimals.
+   */
+  export circuit initialize(
+    ownerId: Bytes<32>,
+    instanceSalt: Bytes<32>,
+    tokenDomain: Bytes<32>,
+    name_: Opaque<"string">,
+    symbol_: Opaque<"string">,
+    decimals_: Uint<8>,
+  ): [] {
+    ZOwnablePK_initialize(ownerId, instanceSalt);
+    NST_initialize(tokenDomain, name_, symbol_, decimals_);
+  }
+
+  /**
+   * @description Mints `amount` to `recipient` and adds it to the minted total.
+   * Owner only.
+   *
+   * @circuitInfo k=15, rows=21354
+   *
+   * Requirements:
+   *
+   * - Caller is the owner.
+   * - `recipient` is not zero.
+   *
+   * @param {ZswapCoinPublicKey} recipient - Coin public key that receives the coin.
+   * @param {Uint<64>} amount - Amount to mint.
+   * @param {Bytes<32>} nonce - Fresh random bytes per mint.
+   * @returns {ShieldedCoinInfo} The minted coin; persist it.
+   */
+  export circuit mint(recipient: ZswapCoinPublicKey, amount: Uint<64>, nonce: Bytes<32>): ShieldedCoinInfo {
+    ZOwnablePK_assertOnlyOwner();
+    const coin = NST__mint(recipient, amount, nonce);
+    NSTPublicSupply__addMinted(amount);
+    return coin;
+  }
+
+  /**
+   * @description Burns `amount` of `coin`, paid into the tx by the caller's
+   * wallet, and refunds the rest to `refundTo`. Owner only.
+   *
+   * @circuitInfo k=16, rows=52024
+   *
+   * Requirements:
+   *
+   * - Caller is the owner.
+   * - `coin.color` is this token's color.
+   * - `amount` <= `coin.value`.
+   * - `refundTo` is not zero.
+   *
+   * @param {ShieldedCoinInfo} coin - Coin of this token, paid into the tx by the caller's wallet.
+   * @param {Uint<64>} amount - Amount to burn from `coin`.
+   * @param {ZswapCoinPublicKey} refundTo - Coin public key that receives the change.
+   * @returns {Maybe<ShieldedCoinInfo>} The refund coin, or `none` on a full burn.
+   */
+  export circuit burn(coin: ShieldedCoinInfo, amount: Uint<64>, refundTo: ZswapCoinPublicKey): Maybe<ShieldedCoinInfo> {
+    ZOwnablePK_assertOnlyOwner();
+    return NST__burn(coin, amount, refundTo);
+  }
+
+  /**
+   * @description Transfers ownership to `newOwnerId`. Owner only.
+   *
+   * @warning `newOwnerId` must be `_computeOwnerId(pk, secretNonce)` for the
+   * coin public key the new owner's wallet will supply as `ownPublicKey()`.
+   * The circuit cannot check this; any other key leaves the contract with no
+   * usable owner and no recovery.
+   *
+   * @circuitInfo k=15, rows=17096
+   *
+   * Requirements:
+   *
+   * - Caller is the owner.
+   * - `newOwnerId` is not zero.
+   *
+   * @param {Bytes<32>} newOwnerId - `_computeOwnerId(pk, secretNonce)` of the new owner.
+   */
+  export circuit transferOwnership(newOwnerId: Bytes<32>): [] {
+    ZOwnablePK_transferOwnership(newOwnerId);
+  }
+
+  /**
+   * @description Clears the owner. Owner only.
+   *
+   * @warning Irreversible: mint and burn stop forever.
+   *
+   * @circuitInfo k=14, rows=10622
+   *
+   * Requirements:
+   *
+   * - Caller is the owner.
+   */
+  export circuit renounceOwnership(): [] {
+    ZOwnablePK_renounceOwnership();
+  }
+
+  /**
+   * @description Returns the current owner commitment.
+   *
+   * @circuitInfo k=6, rows=50
+   *
+   * Requirements:
+   *
+   * - Contract is initialized.
+   */
+  export circuit owner(): Bytes<32> {
+    return ZOwnablePK_owner();
+  }
+
+  /**
+   * @description Returns the owner id `H(pk, nonce)`.
+   *
+   * Requirements:
+   *
+   * - `pk` is a coin public key.
+   *
+   * @param {Either<ZswapCoinPublicKey, ContractAddress>} pk - The owner's coin public key.
+   * @param {Bytes<32>} nonce - The owner's secret nonce.
+   */
+  export pure circuit _computeOwnerId(pk: Either<ZswapCoinPublicKey, ContractAddress>, nonce: Bytes<32>): Bytes<32> {
+    return ZOwnablePK__computeOwnerId(pk, nonce);
+  }
+
+  /**
+   * @description Returns the total amount ever minted.
+   *
+   * @circuitInfo k=7, rows=65
+   */
+  export circuit totalMinted(): Uint<128> {
+    return NSTPublicSupply_totalMinted();
+  }
+
+  /**
+   * @description Returns the token name.
+   *
+   * @circuitInfo k=6, rows=28
+   *
+   * Requirements:
+   *
+   * - Contract is initialized.
+   */
+  export circuit name(): Opaque<"string"> {
+    return NST_name();
+  }
+
+  /**
+   * @description Returns the token symbol.
+   *
+   * @circuitInfo k=6, rows=28
+   *
+   * Requirements:
+   *
+   * - Contract is initialized.
+   */
+  export circuit symbol(): Opaque<"string"> {
+    return NST_symbol();
+  }
+
+  /**
+   * @description Returns the token decimals.
+   *
+   * @circuitInfo k=6, rows=28
+   *
+   * Requirements:
+   *
+   * - Contract is initialized.
+   */
+  export circuit decimals(): Uint<8> {
+    return NST_decimals();
+  }
+
+  /**
+   * @description Returns this contract's token color,
+   * `tokenType(tokenDomain, kernel.self())`.
+   *
+   * @circuitInfo k=13, rows=3971
+   *
+   * Requirements:
+   *
+   * - Contract is initialized.
+   */
+  export circuit tokenColor(): Bytes<32> {
+    return NST_tokenColor();
+  }
+}

package/utils/Utils.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.3.0-rc.1 (utils/Utils.compact)
+// OpenZeppelin Compact Contracts v0.3.0 (utils/Utils.compact)
 
 pragma language_version >= 0.23.0;