@openzeppelin/compact-contracts 0.3.0-rc.1 → 0.4.0-alpha.2

package/utils/EvmAbi.compact

@@ -0,0 +1,134 @@
+// SPDX-License-Identifier: MIT
+// OpenZeppelin Compact Contracts v0.4.0-alpha.2 (utils/EvmAbi.compact)
+
+pragma language_version >= 0.26.0;
+
+/**
+ * @module EvmAbi
+ * @description Ethereum ABI word encoding, for messages that must hash
+ * identically in Compact and on the EVM.
+ *
+ * A contract verifying signatures produced by EVM signing infrastructure has
+ * to hash the exact bytes the signer hashed. `keccak256<T>(value)` hashes
+ * Compact's binary representation of `T`, which coincides with
+ * `abi.encode` for some types and diverges for others:
+ *
+ * - `Bytes<n>` is emitted as exactly `n` bytes. So `Bytes<32>` already *is* an
+ *   EVM ABI word, and `keccak256<Vector<n, Bytes<32>>>(words)` is byte-identical
+ *   to Solidity's `keccak256(abi.encode(word0, ..., wordN))`. Narrower types
+ *   are emitted at their own width rather than padded to 32, which is what
+ *   makes `abi.encodePacked`-style layouts expressible too.
+ * - Integers cast with `as Bytes<n>` are emitted **little-endian**, and a
+ *   `Uint<64>` occupies 8 bytes rather than a full word. `abi.encode(uint256)`
+ *   is a big-endian 32-byte word, so an integer cast directly into a message
+ *   will not match what an EVM signer produced.
+ * - `Boolean` is emitted as a single byte, where `abi.encode(bool)` is a full
+ *   word holding 0 or 1 in its least significant byte.
+ *
+ * This module supplies the conversions that diverge, so a message can be
+ * assembled as a `Vector<n, Bytes<32>>` of EVM ABI words and hashed with
+ * `keccak256` to reproduce an EVM digest exactly.
+ *
+ * @notice These are encoding primitives only. The choice of signing envelope
+ * (a raw digest, EIP-191, or EIP-712 typed data) belongs to the contract that
+ * owns the message.
+ *
+ * @notice The module itself needs no `keccak256`, so it compiles on either
+ * ZKIR backend and `compile:utils` can keep emitting v2. Every `@constraints`
+ * below is a v3 figure, and tagged as such.
+ */
+module EvmAbi {
+  import CompactStandardLibrary;
+
+  /**
+   * @description Encodes a `Uint<8>` as an `abi.encode(uint8)` word: the
+   * value in the least significant byte, zero elsewhere.
+   *
+   * @dev No reversal or decomposition is needed -- a `Uint<8>` is already a
+   * single byte so this is the cheapest of the integer encoders. It is
+   * also how a Compact `enum` should reach a digest, matching Solidity,
+   * where an enum ABI-encodes as its `uint8` ordinal: `uint8Word(kind as Uint<8>)`.
+   *
+   * @constraints k=6, rows=55 (zkir-v3)
+   *
+   * @param {Uint<8>} value - The value to encode.
+   * @returns {Bytes<32>} The value as an EVM ABI word.
+   */
+  export pure circuit uint8Word(value: Uint<8>): Bytes<32> {
+    const word: Vector<32, Uint<8>> = [
+      0, 0, 0, 0, 0, 0, 0, 0,
+      0, 0, 0, 0, 0, 0, 0, 0,
+      0, 0, 0, 0, 0, 0, 0, 0,
+      0, 0, 0, 0, 0, 0, 0, value
+    ];
+
+    return word as Bytes<32>;
+  }
+
+  /**
+   * @description Encodes a `Uint<64>` as an `abi.encode(uint256)` word: the
+   * value big-endian in the low 8 bytes, zero-padded on the left.
+   *
+   * @dev The `Uint<64> as Bytes<8>` cast yields the value little-endian, so
+   * the bytes are reversed into place. Only 8 bytes are decomposed rather
+   * than 32; the wider cast costs roughly four times as many constraints for
+   * an identical result.
+   *
+   * @constraints k=11, rows=1348 (zkir-v3)
+   *
+   * @param {Uint<64>} value - The value to encode.
+   * @returns {Bytes<32>} The value as a big-endian EVM ABI word.
+   */
+  export pure circuit uint64Word(value: Uint<64>): Bytes<32> {
+    const le = (value as Bytes<8>) as Vector<8, Uint<8>>;
+
+    const word: Vector<32, Uint<8>> = [
+      0, 0, 0, 0, 0, 0, 0, 0,
+      0, 0, 0, 0, 0, 0, 0, 0,
+      0, 0, 0, 0, 0, 0, 0, 0,
+      le[7], le[6], le[5], le[4], le[3], le[2], le[1], le[0]
+    ];
+
+    return word as Bytes<32>;
+  }
+
+  /**
+   * @description Encodes a `Uint<128>` as an `abi.encode(uint256)` word: the
+   * value big-endian in the low 16 bytes, zero-padded on the left.
+   *
+   * @dev Decomposes 16 bytes rather than 32, for the reason given on
+   * `uint64Word`. Costs roughly twice `uint64Word`, so prefer the narrower
+   * encoder when the value genuinely fits in 64 bits. The width here is
+   * the value's, not the word's.
+   *
+   * @constraints k=12, rows=2503 (zkir-v3)
+   *
+   * @param {Uint<128>} value - The value to encode.
+   * @returns {Bytes<32>} The value as a big-endian EVM ABI word.
+   */
+  export pure circuit uint128Word(value: Uint<128>): Bytes<32> {
+    const le = (value as Bytes<16>) as Vector<16, Uint<8>>;
+
+    const word: Vector<32, Uint<8>> = [
+      0, 0, 0, 0, 0, 0, 0, 0,
+      0, 0, 0, 0, 0, 0, 0, 0,
+      le[15], le[14], le[13], le[12], le[11], le[10], le[9], le[8],
+      le[7], le[6], le[5], le[4], le[3], le[2], le[1], le[0]
+    ];
+
+    return word as Bytes<32>;
+  }
+
+  /**
+   * @description Encodes a `Boolean` as an `abi.encode(bool)` word: zero
+   * everywhere except the least significant byte, which is 1 for true.
+   *
+   * @constraints k=6, rows=54 (zkir-v3)
+   *
+   * @param {Boolean} value - The value to encode.
+   * @returns {Bytes<32>} The value as an EVM ABI word.
+   */
+  export pure circuit boolWord(value: Boolean): Bytes<32> {
+    return uint8Word(value ? 1 as Uint<8> : 0 as Uint<8>);
+  }
+}

package/utils/Utils.compact

@@ -1,7 +1,7 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.3.0-rc.1 (utils/Utils.compact)
+// OpenZeppelin Compact Contracts v0.4.0-alpha.2 (utils/Utils.compact)
 
-pragma language_version >= 0.23.0;
+pragma language_version >= 0.26.0;
 
 /**
  * @module Utils.
@@ -150,16 +150,6 @@ module Utils {
    * ## ID Derivation
    * `accountId = persistentHash(secretKey)`
    *
-   * @dev The absence of a domain-separation tag is DELIBERATE. This identifier
-   * is global by design: the same key material yields the same identity in
-   * every module deriving one, so a user who wishes to carry one identity
-   * across modules can. Modules wanting a per-deployment, unlinkable identity
-   * should not use this circuit.
-   *
-   * @dev NOT FOR PRIVATE DERIVATION. This returns an identifier, not a secret,
-   * and the construction is untagged. A circuit deriving a PRIVATE value from a
-   * secret MUST use its own domain-separation tag.
-   *
    * @param {Bytes<32>} secretKey - A 32-byte cryptographically secure random value.
    *
    * @returns {Bytes<32>} accountId - The computed account identifier.

package/multisig/presets/ShieldedMultiSig.compact

@@ -1,227 +0,0 @@
-// SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.3.0-rc.1 (multisig/presets/ShieldedMultiSig.compact)
-
-pragma language_version >= 0.23.0;
-
-/**
- * @module ShieldedMultiSig
- * @description A shielded multisig preset composing `Signer`,
- * `ProposalManager`, and `ShieldedTreasury`. Signers approve proposals that
- * transfer shielded tokens out of the treasury once the configured threshold
- * is met.
- *
- * @notice Signer identity uses `Either<ZswapCoinPublicKey, ContractAddress>`
- * in state for forward compatibility. In the current protocol, only
- * `left(ZswapCoinPublicKey)` callers can authenticate — `getCaller()` resolves
- * via `ownPublicKey()` and has no way to produce a right-variant today.
- * Registering contract-address signers is permitted but those signers cannot
- * exercise governance (create/approve/revoke) until contract-to-contract calls
- * are supported. Choose your signer set accordingly.
- *
- * @notice The state shape is deliberately kept broad so that, once
- * contract-to-contract calls are supported, `getCaller()` can be swapped via
- * a CMA (Contract Maintenance Authorities) circuit upgrade without a state
- * migration. Existing deployments would then gain working contract-signer
- * authentication.
- */
-
-import CompactStandardLibrary;
-
-import "../ProposalManager" prefix Proposal_;
-import "../ShieldedTreasury" prefix Treasury_;
-import "../Signer"<Either<ZswapCoinPublicKey, ContractAddress>> prefix Signer_;
-
-// ─── State ───────────────────────────────────────────────────────────────
-
-export ledger _proposalApprovals: Map<Uint<64>, Map<Either<ZswapCoinPublicKey, ContractAddress>, Boolean>>;
-export ledger _approvalCount: Map<Uint<64>, Uint<8>>;
-
-// ─── Constructor ─────────────────────────────────────────────────────────
-
-constructor(
-  signers: Vector<3, Either<ZswapCoinPublicKey, ContractAddress>>,
-  thresh: Uint<8>
-) {
-  Signer_initialize<3>(signers, thresh);
-}
-
-// ─── Deposit ─────────────────────────────────────────────────────────────
-
-export circuit deposit(coin: ShieldedCoinInfo): [] {
-  Treasury__deposit(coin);
-}
-
-// ─── Proposals ───────────────────────────────────────────────────────────
-
-export circuit createShieldedProposal(
-  to: Proposal_Recipient,
-  color: Bytes<32>,
-  amount: Uint<128>
-): Uint<64> {
-  const callerPK = getCaller();
-  Signer_assertSigner(callerPK);
-
-  assert(
-    to.kind == Proposal_RecipientKind.ShieldedUser
-      || to.kind == Proposal_RecipientKind.Contract,
-    "ShieldedMultiSig: recipient must be a shielded user or contract"
-  );
-
-  return Proposal__createProposal(to, color, amount);
-}
-
-export circuit approveProposal(id: Uint<64>): [] {
-  // Check if active
-  Proposal_assertProposalActive(id);
-
-  // Check signer
-  const callerPK = getCaller();
-  Signer_assertSigner(callerPK);
-
-  // Check if already approved
-  assert(!isProposalApprovedBySigner(id, callerPK), "Multisig: already approved");
-
-  // Approve
-  _approveProposal(id, callerPK);
-}
-
-export circuit revokeApproval(id: Uint<64>): [] {
-  // Check if active
-  Proposal_assertProposalActive(id);
-
-  // Check signer
-  const callerPK = getCaller();
-  Signer_assertSigner(callerPK);
-
-  // Check has approved
-  assert(isProposalApprovedBySigner(id, callerPK), "Multisig: not approved");
-
-  // Revoke
-  _revokeApproval(id, callerPK);
-}
-
-export circuit executeShieldedProposal(
-  id: Uint<64>,
-): ShieldedSendResult {
-  // Check if active
-  Proposal_assertProposalActive(id);
-
-  // Check threshold
-  const approvalCount = getApprovalCount(id);
-  Signer_assertThresholdMet(approvalCount);
-
-  // Transfer
-  const { to, color, amount } = Proposal_getProposal(id);
-  const result = Treasury__send(
-    Proposal_toShieldedRecipient(to),
-    color,
-    amount,
-  );
-
-  // Finish lifecycle
-  Proposal__markExecuted(id);
-  return result;
-}
-
-// ─── Internal ───────────────────────────────────────────────────────────
-
-circuit _approveProposal(id: Uint<64>, signer: Either<ZswapCoinPublicKey, ContractAddress>): [] {
-  if (!_proposalApprovals.member(disclose(id))) {
-    _proposalApprovals.insert(disclose(id), default<Map<Either<ZswapCoinPublicKey, ContractAddress>, Boolean>>);
-  }
-
-  _proposalApprovals.lookup(disclose(id)).insert(disclose(signer), disclose(true));
-
-  const newCount = getApprovalCount(id) + 1 as Uint<8>;
-  _approvalCount.insert(disclose(id), disclose(newCount));
-}
-
-circuit _revokeApproval(id: Uint<64>, signer: Either<ZswapCoinPublicKey, ContractAddress>): [] {
-  _proposalApprovals.lookup(disclose(id)).remove(disclose(signer));
-
-  const newCount = getApprovalCount(id) - 1 as Uint<8>;
-  _approvalCount.insert(disclose(id), disclose(newCount));
-}
-
-/**
- * @description Returns the caller identity used for signer authentication.
- *
- * @warning Currently resolves callers via `ownPublicKey()` only, so any signer
- * registered as a `right(ContractAddress)` variant cannot authenticate through
- * this circuit today. Ledger fields keep the `Either<ZswapCoinPublicKey, ContractAddress>`
- * shape so that, once contract-to-contract calls are supported, `getCaller()`
- * can be replaced via a CMA (Contract Maintenance Authorities) circuit upgrade
- * to detect the contract-call context and return the appropriate variant —
- * without a state migration.
- *
- * @returns {Either<ZswapCoinPublicKey, ContractAddress>} The caller wrapped as a left-variant.
- */
-circuit getCaller(): Either<ZswapCoinPublicKey, ContractAddress> {
-  return left<ZswapCoinPublicKey, ContractAddress>(ownPublicKey());
-}
-
-// ─── View ───────────────────────────────────────────────────────────────
-
-export circuit isProposalApprovedBySigner(
-  id: Uint<64>,
-  signer: Either<ZswapCoinPublicKey, ContractAddress>
-): Boolean {
-  if (!_proposalApprovals.member(disclose(id)) || !_proposalApprovals.lookup(disclose(id)).member(disclose(signer))) {
-    return false;
-  }
-
-  return _proposalApprovals.lookup(disclose(id)).lookup(disclose(signer));
-}
-
-export circuit getApprovalCount(id: Uint<64>): Uint<8> {
-  if (!_approvalCount.member(disclose(id))) {
-    return 0;
-  }
-
-  return _approvalCount.lookup(disclose(id));
-}
-
-// IProposalManager
-
-export circuit getProposal(id: Uint<64>): Proposal_Proposal {
-  return Proposal_getProposal(id);
-}
-
-// NOTE: the per-field proposal getters (getProposalRecipient / getProposalAmount
-// / getProposalColor) and getReceivedMinusSent were dropped to bring the deploy
-// transaction under the block-weight limit (the full 19-circuit deploy is
-// rejected with "Transaction would exhaust the block limits"). They are all
-// redundant: read the proposal fields via `getProposal(id).to / .amount / .color`,
-// and the net balance via `getReceivedTotal(color) - getSentTotal(color)`.
-
-export circuit getProposalStatus(id: Uint<64>): Proposal_ProposalStatus {
-  return Proposal_getProposalStatus(id);
-}
-
-// IShieldedTreasury
-
-export circuit getTokenBalance(color: Bytes<32>): Uint<128> {
-  return Treasury_getTokenBalance(color);
-}
-
-export circuit getReceivedTotal(color: Bytes<32>): Uint<128> {
-  return Treasury_getReceivedTotal(color);
-}
-
-export circuit getSentTotal(color: Bytes<32>): Uint<128> {
-  return Treasury_getSentTotal(color);
-}
-
-// ISigner
-
-export circuit getSignerCount(): Uint<8> {
-  return Signer_getSignerCount();
-}
-
-export circuit getThreshold(): Uint<8> {
-  return Signer_getThreshold();
-}
-
-export circuit isSigner(account: Either<ZswapCoinPublicKey, ContractAddress>): Boolean {
-  return Signer_isSigner(account);
-}