@openzeppelin/compact-contracts 0.4.0-alpha.2 → 0.4.0-alpha.3

package/token/NativeShieldedToken.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.4.0-alpha.2 (token/NativeShieldedToken.compact)
+// OpenZeppelin Compact Contracts v0.4.0-alpha.3 (token/NativeShieldedToken.compact)
 
 pragma language_version >= 0.26.0;
 
@@ -20,6 +20,10 @@ pragma language_version >= 0.26.0;
  * share one set of core state (a single init flag and one name/symbol/decimals).
  * Pick one flavor per contract.
  *
+ * @notice Recipients must be coin public keys: contract-addressed recipients
+ * are not supported at this layer. For a coin the contract holds itself, use
+ * `_mintToSelf`, which mints to `kernel.self()` and claims it in the same call.
+ *
  * @notice This module exposes composable building blocks for minting and
  * burning native shielded coins. It does NOT include access control: consuming
  * contracts compose that via the module/contract pattern (Ownable,
@@ -190,25 +194,65 @@ module NativeShieldedToken {
    * recipient; callers SHOULD deliver it out of band. Wallets cannot detect
    * contract-minted coins by scanning the chain.
    *
-   * @constraints k=14, rows=10820
+   * @constraints k=14, rows=10450
    *
    * Requirements:
    *
    * - Contract is initialized.
    * - `recipient` is not zero.
    *
-   * @param {Either<ZswapCoinPublicKey, ContractAddress>} recipient - The coin recipient.
+   * @param {ZswapCoinPublicKey} recipient - The coin recipient.
    * @param {Uint<64>} amount - Quantity to mint. Capped at `Uint<64>` by the protocol.
    * @param {Bytes<32>} nonce - Caller-supplied nonce. Must be unique for this
    * contract's color.
    * @return {ShieldedCoinInfo} - The newly created coin's info (nonce, color, value).
    */
   export circuit _mint(
-                   recipient: Either<ZswapCoinPublicKey, ContractAddress>,
+                   recipient: ZswapCoinPublicKey,
+                   amount: Uint<64>,
+                   nonce: Bytes<32>
+                   ): ShieldedCoinInfo {
+    return Core__mint(
+      _domain,
+      left<ZswapCoinPublicKey, ContractAddress>(recipient),
+      amount,
+      nonce
+    );
+  }
+
+  /**
+   * @description Mints `amount` to this contract itself, claiming the coin in
+   * the same call. Forwards to `NativeShieldedTokenCore._mint` with
+   * `right(kernel.self())`.
+   *
+   * @dev Nonce uniqueness is the caller's responsibility, as in `_mint`. Spend
+   * the coin later with `_burnFromSelf`, once it carries an `mt_index`.
+   *
+   * @notice The consumer SHOULD persist the returned coin info in its own
+   * ledger state: it is the contract's holding and is not otherwise
+   * recoverable.
+   *
+   * @constraints k=14, rows=16033
+   *
+   * Requirements:
+   *
+   * - Contract is initialized.
+   *
+   * @param {Uint<64>} amount - Quantity to mint. Capped at `Uint<64>` by the protocol.
+   * @param {Bytes<32>} nonce - Caller-supplied nonce. Must be unique for this
+   * contract's color.
+   * @return {ShieldedCoinInfo} - The newly created coin's info (nonce, color, value).
+   */
+  export circuit _mintToSelf(
                    amount: Uint<64>,
                    nonce: Bytes<32>
                    ): ShieldedCoinInfo {
-    return Core__mint(_domain, recipient, amount, nonce);
+    return Core__mint(
+      _domain,
+      right<ZswapCoinPublicKey, ContractAddress>(kernel.self()),
+      amount,
+      nonce
+    );
   }
 
   /**
@@ -229,7 +273,7 @@ module NativeShieldedToken {
    * `refundTo`; callers SHOULD deliver it out of band. Wallets cannot detect
    * contract-sent coins by scanning the chain.
    *
-   * @constraints k=16, rows=47477
+   * @constraints k=16, rows=41327
    *
    * Requirements:
    *
@@ -241,17 +285,22 @@ module NativeShieldedToken {
    *
    * @param {ShieldedCoinInfo} coin - The coin to burn from.
    * @param {Uint<128>} amount - Value to destroy. Must be <= `coin.value`.
-   * @param {Either<ZswapCoinPublicKey, ContractAddress>} refundTo - Where to
-   * route the unspent portion (`coin.value - amount`).
+   * @param {ZswapCoinPublicKey} refundTo - Where to route the unspent
+   * portion (`coin.value - amount`).
    * @return {Maybe<ShieldedCoinInfo>} - The refund coin created for `refundTo`,
    * or `none` if the coin was burned in full.
    */
   export circuit _burn(
                    coin: ShieldedCoinInfo,
                    amount: Uint<128>,
-                   refundTo: Either<ZswapCoinPublicKey, ContractAddress>
+                   refundTo: ZswapCoinPublicKey
                    ): Maybe<ShieldedCoinInfo> {
-    return Core__burn(_domain, coin, amount, refundTo);
+    return Core__burn(
+      _domain,
+      coin,
+      amount,
+      left<ZswapCoinPublicKey, ContractAddress>(refundTo)
+    );
   }
 
   /**

package/token/NativeShieldedTokenCore.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.4.0-alpha.2 (token/NativeShieldedTokenCore.compact)
+// OpenZeppelin Compact Contracts v0.4.0-alpha.3 (token/NativeShieldedTokenCore.compact)
 
 pragma language_version >= 0.26.0;
 
@@ -44,6 +44,18 @@ pragma language_version >= 0.26.0;
  * compose `NativeShieldedTokenDerivedNonce` and pass its `_deriveNonce()`
  * output, at the cost of making those mints recipient-public.
  *
+ * @notice A recipient may be any coin public key, or this contract's own
+ * address. Any other contract address is rejected.
+ *
+ * @dev Recipient arm
+ * The ledger accepts a contract-addressed commitment only if the recipient
+ * contract's own call claims it as a shielded receive in the same transaction,
+ * and no primitive claims a receive on another contract's behalf. So the
+ * address arm is accepted only for `kernel.self()`, where `_mint` / `_burn`
+ * claim the coin themselves in the same call. The flavors do not expose the
+ * arm at all: they take a `ZswapCoinPublicKey` and offer `_mintToSelf` for
+ * contract-held coins.
+ *
  * @dev Burn variants
  * `_burn` destroys value from a coin provided within the current transaction
  * (e.g. the caller's wallet pays the contract): it receives the coin and spends
@@ -222,21 +234,26 @@ module NativeShieldedTokenCore {
    *
    * @dev The caller is fully responsible for nonce uniqueness. Reusing a
    * nonce for the same (domain, value, recipient) produces a duplicate
-   * commitment, which the protocol rejects.
+   * commitment, which the protocol rejects. A `right(kernel.self())` recipient
+   * is claimed via `receiveShielded` in this same call, so the consumer SHOULD
+   * persist the returned coin info: it is the contract's holding and is not
+   * otherwise recoverable.
    *
    * @notice The returned coin info is the only copy available to the
    * recipient; callers SHOULD deliver it out of band. Wallets cannot detect
    * contract-minted coins by scanning the chain.
    *
-   * @constraints k=14, rows=11096
+   * @constraints k=15, rows=16980
    *
    * Requirements:
    *
    * - Contract is initialized.
    * - `recipient` is not zero.
+   * - `recipient`, if a contract address, is this contract's own address.
    *
    * @param {Bytes<32>} domain - 32-byte token discriminator.
-   * @param {Either<ZswapCoinPublicKey, ContractAddress>} recipient - The coin recipient.
+   * @param {Either<ZswapCoinPublicKey, ContractAddress>} recipient - The coin
+   * recipient: any coin public key, or this contract's own address.
    * @param {Uint<64>} amount - Quantity to mint. Capped at `Uint<64>` by the protocol.
    * @param {Bytes<32>} nonce - Caller-supplied nonce. Must be unique per (domain, contract).
    * @return {ShieldedCoinInfo} - The newly created coin's info (nonce, color, value).
@@ -248,9 +265,16 @@ module NativeShieldedTokenCore {
                    nonce: Bytes<32>
                    ): ShieldedCoinInfo {
     assertInitialized();
+    const self = kernel.self();
     assert(!Utils_isKeyOrAddressZero(recipient), "NativeShieldedToken: invalid recipient");
+    assert(recipient.is_left || recipient.right == self, "NativeShieldedToken: recipient contract must be self");
 
-    return mintShieldedToken(disclose(domain), disclose(amount), disclose(nonce), disclose(recipient));
+    const coin = mintShieldedToken(disclose(domain), disclose(amount), disclose(nonce), disclose(recipient));
+    if (disclose(!recipient.is_left)) {
+      receiveShielded(coin);
+    }
+
+    return coin;
   }
 
   /**
@@ -265,13 +289,14 @@ module NativeShieldedTokenCore {
    * @dev The coin is received by the contract and spent in the same
    * transaction, so the spend goes through `sendImmediateShielded` (the
    * transient path). For coins the contract already holds, use
-   * `_burnFromSelf` instead.
+   * `_burnFromSelf` instead. A `right(kernel.self())` refund is claimed via
+   * `receiveShielded` in this same call.
    *
    * @notice The returned refund coin info is the only copy available to
    * `refundTo`; callers SHOULD deliver it out of band. Wallets cannot detect
    * contract-sent coins by scanning the chain.
    *
-   * @constraints k=16, rows=47753
+   * @constraints k=16, rows=53639
    *
    * Requirements:
    *
@@ -280,12 +305,14 @@ module NativeShieldedTokenCore {
    * - `amount` is less than or equal to `coin.value`.
    * - `refundTo` is not zero (the zero key is the burn address; a zero
    *   `refundTo` would silently burn the change as well).
+   * - `refundTo`, if a contract address, is this contract's own address.
    *
    * @param {Bytes<32>} domain - 32-byte token discriminator.
    * @param {ShieldedCoinInfo} coin - The coin to burn from.
    * @param {Uint<128>} amount - Value to destroy. Must be <= `coin.value`.
    * @param {Either<ZswapCoinPublicKey, ContractAddress>} refundTo - Where to
-   * route the unspent portion (`coin.value - amount`).
+   * route the unspent portion (`coin.value - amount`): any coin public key, or
+   * this contract's own address.
    * @return {Maybe<ShieldedCoinInfo>} - The refund coin created for `refundTo`,
    * or `none` if the coin was burned in full.
    */
@@ -296,9 +323,11 @@ module NativeShieldedTokenCore {
                    refundTo: Either<ZswapCoinPublicKey, ContractAddress>
                    ): Maybe<ShieldedCoinInfo> {
     assertInitialized();
-    assert(coin.color == tokenType(disclose(domain), kernel.self()), "NativeShieldedToken: wrong token");
+    const self = kernel.self();
+    assert(coin.color == tokenType(disclose(domain), self), "NativeShieldedToken: wrong token");
     assert(coin.value >= amount, "NativeShieldedToken: insufficient coin value");
     assert(!Utils_isKeyOrAddressZero(refundTo), "NativeShieldedToken: invalid refund target");
+    assert(refundTo.is_left || refundTo.right == self, "NativeShieldedToken: refund contract must be self");
 
     receiveShielded(disclose(coin));
     const sendRes = sendImmediateShielded(disclose(coin), shieldedBurnAddress(), disclose(amount));
@@ -309,6 +338,9 @@ module NativeShieldedTokenCore {
         disclose(refundTo),
         disclose(sendRes.change.value.value)
       );
+      if (disclose(!refundTo.is_left)) {
+        receiveShielded(refundRes.sent);
+      }
       return some<ShieldedCoinInfo>(refundRes.sent);
     }
     return none<ShieldedCoinInfo>();

package/token/NativeShieldedTokenFamily.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.4.0-alpha.2 (token/NativeShieldedTokenFamily.compact)
+// OpenZeppelin Compact Contracts v0.4.0-alpha.3 (token/NativeShieldedTokenFamily.compact)
 
 pragma language_version >= 0.26.0;
 
@@ -26,6 +26,10 @@ pragma language_version >= 0.26.0;
  * set of core state (a single init flag and one name/symbol/decimals).
  * Pick one flavor per contract.
  *
+ * @notice Recipients must be coin public keys: contract-addressed recipients
+ * are not supported at this layer. For a coin the contract holds itself, use
+ * `_mintToSelf`, which mints to `kernel.self()` and claims it in the same call.
+ *
  * @notice This module exposes composable building blocks for minting and
  * burning native shielded coins. It does NOT include access control: consuming
  * contracts compose that via the module/contract pattern (Ownable,
@@ -186,7 +190,7 @@ module NativeShieldedTokenFamily {
    * recipient; callers SHOULD deliver it out of band. Wallets cannot detect
    * contract-minted coins by scanning the chain.
    *
-   * @constraints k=14, rows=11096
+   * @constraints k=14, rows=10727
    *
    * Requirements:
    *
@@ -195,18 +199,59 @@ module NativeShieldedTokenFamily {
    *
    * @param {Bytes<32>} domain - 32-byte token discriminator. Same domain + same
    * contract address produces the same coin color (i.e. same token type).
-   * @param {Either<ZswapCoinPublicKey, ContractAddress>} recipient - The coin recipient.
+   * @param {ZswapCoinPublicKey} recipient - The coin recipient.
    * @param {Uint<64>} amount - Quantity to mint. Capped at `Uint<64>` by the protocol.
    * @param {Bytes<32>} nonce - Caller-supplied nonce. Must be unique per (domain, contract).
    * @return {ShieldedCoinInfo} - The newly created coin's info (nonce, color, value).
    */
   export circuit _mint(
                    domain: Bytes<32>,
-                   recipient: Either<ZswapCoinPublicKey, ContractAddress>,
+                   recipient: ZswapCoinPublicKey,
+                   amount: Uint<64>,
+                   nonce: Bytes<32>
+                   ): ShieldedCoinInfo {
+    return Core__mint(
+      domain,
+      left<ZswapCoinPublicKey, ContractAddress>(recipient),
+      amount,
+      nonce
+    );
+  }
+
+  /**
+   * @description Mints `amount` of the token identified by `domain` to this
+   * contract itself, claiming the coin in the same call. Forwards to
+   * `NativeShieldedTokenCore._mint` with `right(kernel.self())`.
+   *
+   * @dev Nonce uniqueness is the caller's responsibility, as in `_mint`. Spend
+   * the coin later with `_burnFromSelf`, once it carries an `mt_index`.
+   *
+   * @notice The consumer SHOULD persist the returned coin info in its own
+   * ledger state: it is the contract's holding and is not otherwise
+   * recoverable.
+   *
+   * @constraints k=14, rows=16309
+   *
+   * Requirements:
+   *
+   * - Contract is initialized.
+   *
+   * @param {Bytes<32>} domain - 32-byte token discriminator.
+   * @param {Uint<64>} amount - Quantity to mint. Capped at `Uint<64>` by the protocol.
+   * @param {Bytes<32>} nonce - Caller-supplied nonce. Must be unique per (domain, contract).
+   * @return {ShieldedCoinInfo} - The newly created coin's info (nonce, color, value).
+   */
+  export circuit _mintToSelf(
+                   domain: Bytes<32>,
                    amount: Uint<64>,
                    nonce: Bytes<32>
                    ): ShieldedCoinInfo {
-    return Core__mint(domain, recipient, amount, nonce);
+    return Core__mint(
+      domain,
+      right<ZswapCoinPublicKey, ContractAddress>(kernel.self()),
+      amount,
+      nonce
+    );
   }
 
   /**
@@ -227,7 +272,7 @@ module NativeShieldedTokenFamily {
    * `refundTo`; callers SHOULD deliver it out of band. Wallets cannot detect
    * contract-sent coins by scanning the chain.
    *
-   * @constraints k=16, rows=47753
+   * @constraints k=16, rows=41603
    *
    * Requirements:
    *
@@ -240,8 +285,8 @@ module NativeShieldedTokenFamily {
    * @param {Bytes<32>} domain - 32-byte token discriminator.
    * @param {ShieldedCoinInfo} coin - The coin to burn from.
    * @param {Uint<128>} amount - Value to destroy. Must be <= `coin.value`.
-   * @param {Either<ZswapCoinPublicKey, ContractAddress>} refundTo - Where to
-   * route the unspent portion (`coin.value - amount`).
+   * @param {ZswapCoinPublicKey} refundTo - Where to route the unspent
+   * portion (`coin.value - amount`).
    * @return {Maybe<ShieldedCoinInfo>} - The refund coin created for `refundTo`,
    * or `none` if the coin was burned in full.
    */
@@ -249,9 +294,14 @@ module NativeShieldedTokenFamily {
                    domain: Bytes<32>,
                    coin: ShieldedCoinInfo,
                    amount: Uint<128>,
-                   refundTo: Either<ZswapCoinPublicKey, ContractAddress>
+                   refundTo: ZswapCoinPublicKey
                    ): Maybe<ShieldedCoinInfo> {
-    return Core__burn(domain, coin, amount, refundTo);
+    return Core__burn(
+      domain,
+      coin,
+      amount,
+      left<ZswapCoinPublicKey, ContractAddress>(refundTo)
+    );
   }
 
   /**

package/token/NonFungibleToken.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.4.0-alpha.2 (token/NonFungibleToken.compact)
+// OpenZeppelin Compact Contracts v0.4.0-alpha.3 (token/NonFungibleToken.compact)
 
 pragma language_version >= 0.26.0;
 
@@ -58,7 +58,7 @@ pragma language_version >= 0.26.0;
  * or in ledger writes. Canonicalization zeroes out the inactive branch of the Either,
  * ensuring that two values with the same active branch always resolve to the same map key
  * regardless of what data the inactive branch carries. Write paths are canonicalized in
- * `_update` (for `_owners` and `_balances`), `_approve` (for `_tokenApprovals`), and
+ * `_update` (for `_owners` and `_balances`), `_unsafeApprove` (for `_tokenApprovals`), and
  * `_setApprovalForAll` (for `_operatorApprovals`). Read paths are canonicalized in
  * `balanceOf`, `isApprovedForAll`, and `_isAuthorized`.
  *
@@ -343,7 +343,7 @@ module NonFungibleToken {
    * In the case of an external (non-contract) caller, the caller's identity is derived from the `wit_NonFungibleTokenSK`
    * witness as `persistentHash(secretKey)`.
    *
-   * @constraints k=13, rows=3491
+   * @constraints k=13, rows=3406
    *
    * Requirements:
    *
@@ -444,7 +444,7 @@ module NonFungibleToken {
    * In the case of an external (non-contract) caller, the caller's identity is derived from the `wit_NonFungibleTokenSK`
    * witness as `persistentHash(secretKey)`.
    *
-   * @constraints k=13, rows=4701
+   * @constraints k=13, rows=4702
    *
    * Requirements:
    *
@@ -482,7 +482,7 @@ module NonFungibleToken {
    * are not currently supported. Tokens sent to a contract address may become irretrievable.
    * Once contract-to-contract calls are supported, this circuit may be deprecated.
    *
-   * @constraints k=13, rows=4698
+   * @constraints k=13, rows=4699
    *
    * Requirements:
    *
@@ -504,11 +504,14 @@ module NonFungibleToken {
                    ): [] {
     assertInitialized();
     assert(!Utils_isTargetZero(to), "NonFungibleToken: invalid receiver");
-    // Setting an "auth" argument enables the `_isAuthorized` check which verifies that the token exists
-    // (fromAddress != 0). Therefore, it is not needed to verify that the return value is not 0 here.
     const auth = left<Bytes<32>, ContractAddress>(_computeAccountId());
     const previousOwner = _update(to, tokenId, auth);
 
+    // The `_isAuthorized` check inside `_update` already implies the token exists, but that
+    // holds only while approvals are never recorded for unminted tokens. Assert it directly
+    // so a misused `_unsafeApprove` cannot turn this circuit into an unauthorized mint.
+    assert(!Utils_isTargetZero(previousOwner), "NonFungibleToken: nonexistent token");
+
     const canonFrom = Utils_canonicalize<Bytes<32>, ContractAddress>(fromAddress);
     assert(previousOwner == canonFrom, "NonFungibleToken: incorrect owner");
   }
@@ -648,8 +651,8 @@ module NonFungibleToken {
 
     // Execute the update
     if (!Utils_isTargetZero(disclose(fromAddress))) {
-      // Clear approval. No need to re-authorize
-      _approve(Utils_zeroAccount(), tokenId, Utils_zeroAccount());
+      // Clear approval. No need to re-authorize or re-read the owner
+      _unsafeApprove(Utils_zeroAccount(), tokenId, Utils_zeroAccount(), false);
       const canonFrom = Utils_canonicalize<Bytes<32>, ContractAddress>(fromAddress);
       const newBalance = _balances.lookup(disclose(canonFrom)) - 1 as Uint<128>;
       _balances.insert(disclose(canonFrom), disclose(newBalance));
@@ -820,11 +823,12 @@ module NonFungibleToken {
   /**
    * @description Approve `to` to operate on `tokenId`.
    *
-   * @constraints k=11, rows=1840
+   * @constraints k=11, rows=1755
    *
    * Requirements:
    *
    * - The contract is initialized.
+   * - `tokenId` must exist.
    * - If `auth` is non 0, then this function will check that `auth` is either the owner of the token,
    * or approved to operate on the token (by the owner).
    *
@@ -838,6 +842,43 @@ module NonFungibleToken {
                    tokenId: Uint<128>,
                    auth: Either<Bytes<32>, ContractAddress>
                    ): [] {
+    _unsafeApprove(to, tokenId, auth, true);
+  }
+
+  /**
+   * @description Approve `to` to operate on `tokenId`, requiring the token to exist
+   * only when `isExistenceRequired` is true.
+   *
+   * @constraints k=11, rows=1868
+   *
+   * @warning Passing false skips the check that `tokenId` was minted. Both
+   * `_unsafeTransferFrom` and `_update` read that invariant back, so a planted approval
+   * can mint a token nobody authorized or outlive a later mint. Pass false only where
+   * the owner has already been read, as `_update` does.
+   *
+   * @dev Counterpart to Solidity's `_approve(to, tokenId, auth, bool emitEvent)`, where
+   * the flag also suppresses the `Approval` event. Compact has no events, so it carries
+   * the existence check alone.
+   *
+   * Requirements:
+   *
+   * - The contract is initialized.
+   * - `tokenId` must exist, unless `isExistenceRequired` is false and `auth` is zero.
+   * - If `auth` is non 0, then this function will check that `auth` is either the owner of the token,
+   * or approved to operate on the token (by the owner).
+   *
+   * @param {Either<Bytes<32>, ContractAddress>} to - The target account to approve
+   * @param {Uint<128>} tokenId - The token to approve
+   * @param {Either<Bytes<32>, ContractAddress>} auth - An account authorized to operate on all tokens held by the owner of the token
+   * @param {Boolean} isExistenceRequired - Whether `tokenId` must exist
+   * @return {[]} - Empty tuple.
+   */
+  export circuit _unsafeApprove(
+                   to: Either<Bytes<32>, ContractAddress>,
+                   tokenId: Uint<128>,
+                   auth: Either<Bytes<32>, ContractAddress>,
+                   isExistenceRequired: Boolean
+                   ): [] {
     assertInitialized();
     // Canonicalize + normalize `to`
     const canonTo = Utils_canonicalize<Bytes<32>, ContractAddress>(to);
@@ -846,11 +887,14 @@ module NonFungibleToken {
     // Canonicalize auth
     const canonAuth = Utils_canonicalize<Bytes<32>, ContractAddress>(auth);
 
-    if (!Utils_isTargetZero(disclose(canonAuth))) {
+    // Avoid reading the owner unless necessary
+    if (disclose(isExistenceRequired) || !Utils_isTargetZero(disclose(canonAuth))) {
       const owner = _requireOwned(tokenId);
 
       // We do not use _isAuthorized because single-token approvals should not be able to call approve
-      assert((owner == disclose(canonAuth) || isApprovedForAll(owner, canonAuth)),
+      assert((Utils_isTargetZero(disclose(canonAuth)) ||
+              owner == disclose(canonAuth) ||
+              isApprovedForAll(owner, canonAuth)),
              "NonFungibleToken: invalid approver"
              );
     }

package/token/extensions/ConfidentialFungibleTokenPublicSupply.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.4.0-alpha.2 (token/extensions/ConfidentialFungibleTokenPublicSupply.compact)
+// OpenZeppelin Compact Contracts v0.4.0-alpha.3 (token/extensions/ConfidentialFungibleTokenPublicSupply.compact)
 
 pragma language_version >= 0.26.0;
 

package/token/extensions/NativeShieldedTokenDerivedNonce.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.4.0-alpha.2 (token/extensions/NativeShieldedTokenDerivedNonce.compact)
+// OpenZeppelin Compact Contracts v0.4.0-alpha.3 (token/extensions/NativeShieldedTokenDerivedNonce.compact)
 
 pragma language_version >= 0.26.0;
 

package/token/extensions/NativeShieldedTokenFamilyPublicSupply.compact

@@ -20,7 +20,7 @@ pragma language_version >= 0.26.0;
  *
  *   export circuit mint(
  *     domain: Bytes<32>,
- *     recipient: Either<ZswapCoinPublicKey, ContractAddress>,
+ *     recipient: ZswapCoinPublicKey,
  *     amount: Uint<64>,
  *     nonce: Bytes<32>
  *   ): ShieldedCoinInfo {
@@ -33,7 +33,7 @@ pragma language_version >= 0.26.0;
  *     domain: Bytes<32>,
  *     coin: ShieldedCoinInfo,
  *     amount: Uint<128>,
- *     refundTo: Either<ZswapCoinPublicKey, ContractAddress>
+ *     refundTo: ZswapCoinPublicKey
  *   ): Maybe<ShieldedCoinInfo> {
  *     const refund = Family__burn(domain, coin, amount, refundTo);
  *     Supply__addBurned(domain, amount);

package/token/extensions/NativeShieldedTokenPublicSupply.compact

@@ -18,7 +18,7 @@ pragma language_version >= 0.26.0;
  * pieces, calling the accounting block alongside the matching token op:
  *
  *   export circuit mint(
- *     recipient: Either<ZswapCoinPublicKey, ContractAddress>,
+ *     recipient: ZswapCoinPublicKey,
  *     amount: Uint<64>,
  *     nonce: Bytes<32>
  *   ): ShieldedCoinInfo {
@@ -30,7 +30,7 @@ pragma language_version >= 0.26.0;
  *   export circuit burn(
  *     coin: ShieldedCoinInfo,
  *     amount: Uint<128>,
- *     refundTo: Either<ZswapCoinPublicKey, ContractAddress>
+ *     refundTo: ZswapCoinPublicKey
  *   ): Maybe<ShieldedCoinInfo> {
  *     const refund = Token__burn(coin, amount, refundTo);
  *     Supply__addBurned(amount);

package/utils/EvmAbi.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.4.0-alpha.2 (utils/EvmAbi.compact)
+// OpenZeppelin Compact Contracts v0.4.0-alpha.3 (utils/EvmAbi.compact)
 
 pragma language_version >= 0.26.0;
 

package/utils/Utils.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.4.0-alpha.2 (utils/Utils.compact)
+// OpenZeppelin Compact Contracts v0.4.0-alpha.3 (utils/Utils.compact)
 
 pragma language_version >= 0.26.0;
 
@@ -150,6 +150,16 @@ module Utils {
    * ## ID Derivation
    * `accountId = persistentHash(secretKey)`
    *
+   * @dev The absence of a domain-separation tag is DELIBERATE. This identifier
+   * is global by design: the same key material yields the same identity in
+   * every module deriving one, so a user who wishes to carry one identity
+   * across modules can. Modules wanting a per-deployment, unlinkable identity
+   * should not use this circuit.
+   *
+   * @dev NOT FOR PRIVATE DERIVATION. This returns an identifier, not a secret,
+   * and the construction is untagged. A circuit deriving a PRIVATE value from a
+   * secret MUST use its own domain-separation tag.
+   *
    * @param {Bytes<32>} secretKey - A 32-byte cryptographically secure random value.
    *
    * @returns {Bytes<32>} accountId - The computed account identifier.