@openzeppelin/compact-contracts 0.4.0-alpha.3 → 0.4.0-alpha.4

package/access/AccessControl.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.4.0-alpha.3 (access/AccessControl.compact)
+// OpenZeppelin Compact Contracts v0.4.0-alpha.4 (access/AccessControl.compact)
 
 pragma language_version >= 0.26.0;
 

package/access/Ownable.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.4.0-alpha.3 (access/Ownable.compact)
+// OpenZeppelin Compact Contracts v0.4.0-alpha.4 (access/Ownable.compact)
 
 pragma language_version >= 0.26.0;
 

package/access/ShieldedAccessControl.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.4.0-alpha.3 (access/ShieldedAccessControl.compact)
+// OpenZeppelin Compact Contracts v0.4.0-alpha.4 (access/ShieldedAccessControl.compact)
 
 pragma language_version >= 0.26.0;
 

package/access/ZOwnablePK.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.4.0-alpha.3 (access/ZOwnablePK.compact)
+// OpenZeppelin Compact Contracts v0.4.0-alpha.4 (access/ZOwnablePK.compact)
 
 pragma language_version >= 0.26.0;
 

package/crypto/EcdhMask.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.4.0-alpha.3 (crypto/EcdhMask.compact)
+// OpenZeppelin Compact Contracts v0.4.0-alpha.4 (crypto/EcdhMask.compact)
 
 pragma language_version >= 0.26.0;
 

package/crypto/Ecdsa.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.4.0-alpha.3 (crypto/Ecdsa.compact)
+// OpenZeppelin Compact Contracts v0.4.0-alpha.4 (crypto/Ecdsa.compact)
 
 pragma language_version >= 0.26.0;
 

package/crypto/Eip712.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.4.0-alpha.3 (crypto/Eip712.compact)
+// OpenZeppelin Compact Contracts v0.4.0-alpha.4 (crypto/Eip712.compact)
 
 pragma language_version >= 0.26.0;
 

package/crypto/ElGamal.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.4.0-alpha.3 (crypto/ElGamal.compact)
+// OpenZeppelin Compact Contracts v0.4.0-alpha.4 (crypto/ElGamal.compact)
 
 pragma language_version >= 0.26.0;
 

package/multisig/EcdsaSignerManager.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.4.0-alpha.3 (multisig/EcdsaSignerManager.compact)
+// OpenZeppelin Compact Contracts v0.4.0-alpha.4 (multisig/EcdsaSignerManager.compact)
 
 pragma language_version >= 0.26.0;
 

package/multisig/ForwarderPrivate.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.4.0-alpha.3 (multisig/ForwarderPrivate.compact)
+// OpenZeppelin Compact Contracts v0.4.0-alpha.4 (multisig/ForwarderPrivate.compact)
 
 pragma language_version >= 0.26.0;
 

package/multisig/ForwarderShielded.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.4.0-alpha.3 (multisig/ForwarderShielded.compact)
+// OpenZeppelin Compact Contracts v0.4.0-alpha.4 (multisig/ForwarderShielded.compact)
 
 pragma language_version >= 0.26.0;
 

package/multisig/ForwarderUnshielded.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.4.0-alpha.3 (multisig/ForwarderUnshielded.compact)
+// OpenZeppelin Compact Contracts v0.4.0-alpha.4 (multisig/ForwarderUnshielded.compact)
 
 pragma language_version >= 0.26.0;
 

package/multisig/ProposalManager.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.4.0-alpha.3 (multisig/ProposalManager.compact)
+// OpenZeppelin Compact Contracts v0.4.0-alpha.4 (multisig/ProposalManager.compact)
 
 pragma language_version >= 0.26.0;
 

package/multisig/ShieldedTreasury.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.4.0-alpha.3 (multisig/ShieldedTreasury.compact)
+// OpenZeppelin Compact Contracts v0.4.0-alpha.4 (multisig/ShieldedTreasury.compact)
 
 pragma language_version >= 0.26.0;
 

package/multisig/ShieldedTreasuryStateless.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.4.0-alpha.3 (multisig/ShieldedTreasuryStateless.compact)
+// OpenZeppelin Compact Contracts v0.4.0-alpha.4 (multisig/ShieldedTreasuryStateless.compact)
 
 pragma language_version >= 0.26.0;
 

package/multisig/Signer.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.4.0-alpha.3 (multisig/Signer.compact)
+// OpenZeppelin Compact Contracts v0.4.0-alpha.4 (multisig/Signer.compact)
 
 pragma language_version >= 0.26.0;
 

package/multisig/UnshieldedTreasury.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.4.0-alpha.3 (multisig/UnshieldedTreasury.compact)
+// OpenZeppelin Compact Contracts v0.4.0-alpha.4 (multisig/UnshieldedTreasury.compact)
 
 pragma language_version >= 0.26.0;
 

package/multisig/examples/ForwarderPrivateExample.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.4.0-alpha.3 (multisig/examples/ForwarderPrivateExample.compact)
+// OpenZeppelin Compact Contracts v0.4.0-alpha.4 (multisig/examples/ForwarderPrivateExample.compact)
 
 pragma language_version >= 0.26.0;
 

package/multisig/examples/ForwarderShieldedExample.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.4.0-alpha.3 (multisig/examples/ForwarderShieldedExample.compact)
+// OpenZeppelin Compact Contracts v0.4.0-alpha.4 (multisig/examples/ForwarderShieldedExample.compact)
 
 pragma language_version >= 0.26.0;
 

package/multisig/examples/ForwarderUnshieldedExample.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.4.0-alpha.3 (multisig/examples/ForwarderUnshieldedExample.compact)
+// OpenZeppelin Compact Contracts v0.4.0-alpha.4 (multisig/examples/ForwarderUnshieldedExample.compact)
 
 pragma language_version >= 0.26.0;
 

package/multisig/examples/NativeShieldedTokenIssuerExample.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.4.0-alpha.3 (multisig/examples/NativeShieldedTokenIssuerExample.compact)
+// OpenZeppelin Compact Contracts v0.4.0-alpha.4 (multisig/examples/NativeShieldedTokenIssuerExample.compact)
 
 pragma language_version >= 0.26.0;
 
@@ -7,10 +7,12 @@ pragma language_version >= 0.26.0;
  * @title NativeShieldedTokenIssuerExample
  * @description Deployable reference contract for the `NativeShieldedTokenIssuer`
  * preset: a native shielded token whose supply enters only through an
- * ECDSA-authorized mint and leaves only through an ECDSA-authorized burn.
+ * ECDSA-authorized mint, to a holder (`mint`) or to the contract itself
+ * (`mintToSelf`), and leaves only through an ECDSA-authorized burn, of a
+ * holder's coin (`burn`) or of one the contract holds (`burnFromSelf`).
  *
  * The token is non-transferable by construction. There is no transfer circuit,
- * so a holder's only exit is to present the coin back for burn.
+ * so a holder's only exit is to pay the coin into a `burn` tx.
  */
 
 import CompactStandardLibrary;
@@ -94,20 +96,38 @@ export pure circuit _calculateSignerId(
 
 export circuit mint(
   amount: Uint<64>,
-  recipient: Either<ZswapCoinPublicKey, ContractAddress>,
+  recipient: ZswapCoinPublicKey,
   pubkeys: Vector<2, Secp256k1Point>,
   signatures: Vector<2, Secp256k1EcdsaSignature>
 ): ShieldedCoinInfo {
   return NativeShieldedTokenIssuer_mint(amount, recipient, pubkeys, signatures);
 }
 
+export circuit mintToSelf(
+  amount: Uint<64>,
+  pubkeys: Vector<2, Secp256k1Point>,
+  signatures: Vector<2, Secp256k1EcdsaSignature>
+): ShieldedCoinInfo {
+  return NativeShieldedTokenIssuer_mintToSelf(amount, pubkeys, signatures);
+}
+
 export circuit burn(
+  coin: ShieldedCoinInfo,
+  amount: Uint<64>,
+  refundTo: ZswapCoinPublicKey,
+  pubkeys: Vector<2, Secp256k1Point>,
+  signatures: Vector<2, Secp256k1EcdsaSignature>
+): Maybe<ShieldedCoinInfo> {
+  return NativeShieldedTokenIssuer_burn(coin, amount, refundTo, pubkeys, signatures);
+}
+
+export circuit burnFromSelf(
   coin: QualifiedShieldedCoinInfo,
   amount: Uint<64>,
   pubkeys: Vector<2, Secp256k1Point>,
   signatures: Vector<2, Secp256k1EcdsaSignature>
 ): Maybe<ShieldedCoinInfo> {
-  return NativeShieldedTokenIssuer_burn(coin, amount, pubkeys, signatures);
+  return NativeShieldedTokenIssuer_burnFromSelf(coin, amount, pubkeys, signatures);
 }
 
 export circuit getNonce(): Uint<64> {

package/multisig/examples/ShieldedMultiSigV2Example.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.4.0-alpha.3 (multisig/examples/ShieldedMultiSigV2Example.compact)
+// OpenZeppelin Compact Contracts v0.4.0-alpha.4 (multisig/examples/ShieldedMultiSigV2Example.compact)
 
 pragma language_version >= 0.26.0;
 

package/multisig/presets/NativeShieldedTokenIssuer.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.4.0-alpha.3 (multisig/presets/NativeShieldedTokenIssuer.compact)
+// OpenZeppelin Compact Contracts v0.4.0-alpha.4 (multisig/presets/NativeShieldedTokenIssuer.compact)
 
 pragma language_version >= 0.26.0;
 
@@ -7,8 +7,10 @@ pragma language_version >= 0.26.0;
  * @module NativeShieldedTokenIssuer
  * @description
  * A 2-of-3 ECDSA multisig that mints and burns one native shielded token,
- * for tokenized deposits. Value enters only through `mint` and leaves the
- * contract only through `burn`; each is a single tx carrying two registered
+ * for tokenized deposits. Value enters only through `mint` (to a holder's
+ * coin public key) or `mintToSelf` (a coin this contract holds) and leaves
+ * only through `burn` (a holder's coin, paid into the tx) or `burnFromSelf`
+ * (a coin this contract holds); each is a single tx carrying two registered
  * signers' approvals, so no single party creates or destroys tokens.
  *
  * Composes `EcdsaSignerManager` (signer commitments, approval checks),
@@ -23,8 +25,9 @@ pragma language_version >= 0.26.0;
  * - `DS`: `_domainSeparator`, the EIP-712 domain separator fixed at
  *   construction.
  * - `self`: `kernel.self().bytes`, this contract's address.
- * - `opNonce`: the `_counter` value read at the start of `mint` / `burn`. It
- *   is the signature replay counter and is separate from the
+ * - `opNonce`: the `_counter` value read at the start of every operation
+ *   (`mint`, `mintToSelf`, `burn`, `burnFromSelf`). It is the signature
+ *   replay counter and is separate from the
  *   `NativeShieldedTokenDerivedNonce` counter that feeds coin nonces.
  * - `cm`: a signer commitment, the registry key.
  * - `color`: `tokenType(_domain, self)`, this token's coin color.
@@ -37,15 +40,19 @@ pragma language_version >= 0.26.0;
  *   and a 32-byte address does not fit `address`. `self` inside each struct
  *   separates deployments instead.
  * - Mint digest: `keccak(0x1901 ‖ DS ‖ keccak([MINT_TYPEHASH, self,
- *   recipientWord, boolWord(isContract), uint64Word(opNonce),
- *   uint64Word(amount)]))`, with `canonRecipient =
- *   Utils_canonicalize(recipient)` (unused `Either` arm zeroed),
- *   `recipientWord` its active arm and `isContract = !canonRecipient.is_left`.
+ *   recipient.bytes, uint64Word(opNonce), uint64Word(amount)]))`.
+ * - MintToSelf digest: `keccak(0x1901 ‖ DS ‖ keccak([MINT_TO_SELF_TYPEHASH,
+ *   self, uint64Word(opNonce), uint64Word(amount)]))`.
  * - Burn digest: `keccak(0x1901 ‖ DS ‖ keccak([BURN_TYPEHASH, self,
- *   uint64Word(opNonce), uint64Word(amount)]))`.
+ *   refundTo.bytes, uint64Word(opNonce), uint64Word(amount)]))`.
+ * - BurnFromSelf digest: `keccak(0x1901 ‖ DS ‖ keccak([
+ *   BURN_FROM_SELF_TYPEHASH, self, uint64Word(opNonce), uint64Word(amount)]))`.
  * - Type hashes: `MINT_TYPEHASH = keccak("Mint(bytes32 contractAddress,
- *   bytes32 recipient,bool isContract,uint256 nonce,uint256 amount)")` and
- *   `BURN_TYPEHASH = keccak("Burn(bytes32 contractAddress,uint256 nonce,
+ *   bytes32 recipient,uint256 nonce,uint256 amount)")`,
+ *   `MINT_TO_SELF_TYPEHASH = keccak("MintToSelf(bytes32 contractAddress,
+ *   uint256 nonce,uint256 amount)")`, `BURN_TYPEHASH = keccak("Burn(bytes32 contractAddress,bytes32 refundTo,
+ *   uint256 nonce,uint256 amount)")` and `BURN_FROM_SELF_TYPEHASH =
+ *   keccak("BurnFromSelf(bytes32 contractAddress,uint256 nonce,
  *   uint256 amount)")`, written as literal words.
  * - Signer commitment: `cm = H<SignerCommitmentInput>({ pkX, pkY, salt,
  *   domain: pad(32, "multisig:signer:") })`, `pkX` / `pkY` the affine
@@ -57,7 +64,8 @@ pragma language_version >= 0.26.0;
  *   Digest integers are big-endian ABI words (`utils/EvmAbi`), so an EVM
  *   signer's typed-data encoder reproduces them.
  *   `contracts/src/multisig/test/EcdsaTestUtils.ts` pins the digests
- *   through ethers (`mintMsgHash`, `burnMsgHash`).
+ *   through ethers (`mintMsgHash`, `mintToSelfMsgHash`, `burnMsgHash`,
+ *   `burnFromSelfMsgHash`).
  *
  * @notice Implementing contracts register the signer set from their
  * constructor by calling this module's `initialize`, and MUST NOT import
@@ -68,8 +76,8 @@ pragma language_version >= 0.26.0;
  *
  * @dev Compatibility:
  * The wire format the custodian's signer implements is the EIP-712 domain
- * (`NativeShieldedTokenIssuer`, version `1`, salt), the `Mint` / `Burn`
- * type strings, the `multisig:signer:` commitment domain (generic prefix,
+ * (`NativeShieldedTokenIssuer`, version `1`, salt), the `Mint` /
+ * `MintToSelf` / `Burn` / `BurnFromSelf` type strings, the `multisig:signer:` commitment domain (generic prefix,
  * owned by `EcdsaSignerManager`), the `cm` preimage struct, and the
  * `Vector<2>` / `Vector<3>` shapes. Changing any of them breaks every
  * existing signer setup. The test suite pins them through
@@ -77,22 +85,30 @@ pragma language_version >= 0.26.0;
  *
  * @notice Privacy:
  * - Public, per tx:
- *   - Entry point: mint vs burn.
+ *   - Entry point: which of the four operations ran.
  *   - Approvers: the two signer commitments (`disclose(commitment)` in
  *     `Signer_assertSigner`), so WHICH two of the three signers approved.
  *   - Mint: `amount`, as the `shieldedMints` effect under the token domain,
  *     and the coin commitment as a spend claim. Recipient and nonce are not
  *     published. The nonce is `evolveNonce` of the public
  *     `_derivedNonceCounter`, so a candidate recipient can be tested
- *     against the commitment. A mint to this contract adds the same
- *     commitment as a receive claim and names the contract in the Zswap
- *     output.
- *   - Burn: the spent coin's nullifier, the burn-output commitment and, on a
- *     partial burn, the change commitment as both spend and receive claim.
- *     `amount`, the coin's value and `mt_index` are not published. Every
- *     coin this contract holds was minted to it, so its nullifier is
- *     computable and a burn links to its mint; the amount is protected by
- *     the commitment hash alone.
+ *     against the commitment.
+ *   - MintToSelf: as `mint`, plus the same commitment as a receive claim and
+ *     the contract named in the Zswap output.
+ *   - Burn: the holder's coin commitment as a receive claim, the burn-output
+ *     commitment and, on a partial burn, the refund commitment. `amount`,
+ *     `coin.value` and `refundTo` stay hidden only while `coin` carries a
+ *     nonce the observer does not know. A coin passed straight from `mint`
+ *     has a derived nonce, so the receive claim links the burn to its mint
+ *     and exposes all three by trial: `coin.value` from the mint, `amount`
+ *     over `[0, value]` against the burn output, `refundTo` against the
+ *     refund commitment.
+ *   - BurnFromSelf: the spent coin's nullifier, the burn-output commitment
+ *     and, on a partial burn, the change commitment as both spend and
+ *     receive claim. `amount`, the coin's value and `mt_index` are not
+ *     published, but every held coin has a derived nonce, so its nullifier
+ *     links the burn to its mint and `amount` is recoverable by trial over
+ *     `[0, value]`.
  * - Public, as state:
  *   - Cells: `_counter`, `_domainSeparator`, `_derivedNonceCounter`,
  *     `_signers`, `_signerCount`, `_threshold`, `_instanceSalt`, `_domain`,
@@ -102,37 +118,38 @@ pragma language_version >= 0.26.0;
  * - Private:
  *   - Signer material: public keys and signatures are verified in-circuit,
  *     never disclosed.
- *   - Operation data: burn amounts. Mint recipients, up to the commitment
- *     test above.
+ *   - Operation data: `burn` amounts and `refundTo`, for a coin whose nonce
+ *     is secret. Mint recipients, up to the commitment test above.
  * - Signer identity: keys sit behind `cm` with a public salt, so an observer
  *   holding a candidate key can test membership; one without cannot
  *   correlate a signer across deployments.
  * - Counterparty: a mint recipient learns nothing beyond the coin handed over
  *   out of band; every observer learns the amount of every mint and can
  *   test a candidate recipient against the commitment.
- * - Auditability: mint amounts are public, burn amounts are not. No
+ * - Auditability: mint amounts are public; `burnFromSelf` amounts are
+ *   recoverable by trial, `burn` amounts only for a linkable coin. No
  *   on-chain total is kept. `NativeShieldedTokenPublicSupply` adds one and
  *   makes burn amounts public.
  *
  * @notice Security:
  * - Digest binding: each struct binds its type hash, `self`, `opNonce` and
- *   `amount` (`mint` also the recipient word and its kind) under `DS`, so a
+ *   `amount` (`mint` also `recipient`, `burn` also `refundTo`) under `DS`,
+ *   so a
  *   signature authorizes one operation on one instance at one nonce, and is
- *   neither replayable as the other operation, nor under another domain,
+ *   neither replayable as another operation, nor under another domain,
  *   nor redirectable. Removing the `self` word removes cross-instance
- *   replay protection, since `DS` cannot carry the address.
+ *   replay protection, since `DS` cannot carry the address. `Burn` does not
+ *   bind `coin`: the payer picks it, so a signature moved to another coin
+ *   burns only the payer's own value and refunds the bound `refundTo`.
  * - Low-s: verification goes through `Ecdsa_secp256k1EcdsaVerifyLowS`, so a
  *   high-s encoding is an invalid signature.
  * - Distinct signers: `assertApprovals` asserts both entries and rejects a
  *   repeated commitment, so two distinct registered signers are always
  *   required. The threshold `2` is the ceiling `EcdsaSignerManager` accepts.
- * - Canonical recipient: `Utils_canonicalize` zeroes the unused `Either` arm
- *   before hashing and minting, so a recipient with both arms populated
- *   cannot yield two digests for one destination.
  * - Immutable signer set: no signer reconfiguration circuit is exported, so
  *   the three commitments and the threshold are fixed. Losing two of the
  *   three keys freezes the contract.
- * - Griefing: the derived-nonce mint is the only mint path and it is
+ * - Griefing: the derived-nonce mints are the only mint paths and both are
  *   threshold-gated, so `NativeShieldedTokenDerivedNonce`'s
  *   collision-griefing precondition (a caller-nonce mint at another trust
  *   level) is absent.
@@ -140,24 +157,24 @@ pragma language_version >= 0.26.0;
  *   neither counter advances and the sender pays no fee.
  *
  * @notice Concurrency:
- * - Replay counter: `mint` and `burn` both read `_counter` into the digest.
- *   The read is pinned, so any two of them in one block conflict: at most one
- *   mint-or-burn lands per block, and the losing signer pair re-signs at the
- *   next nonce.
- * - Derived-nonce counter: `mint` also pins it (`evolveNonce` consumes it);
- *   the `_counter` conflict already covers that pair.
- * - `getNonce`: submitted as a tx it pins `_counter` and conflicts with a
- *   same-block mint or burn.
+ * - Replay counter: `mint`, `mintToSelf`, `burn` and `burnFromSelf` read
+ *   `_counter` into the digest. The read is pinned, so any two of them in one block
+ *   conflict: at most one operation lands per block, and the losing signer
+ *   pair re-signs at the next nonce.
+ * - Derived-nonce counter: both mints also pin it (`evolveNonce` consumes
+ *   it); the `_counter` conflict already covers those pairs.
+ * - `getNonce`: submitted as a tx it pins `_counter` and conflicts with any
+ *   same-block operation.
  * - Views: metadata, `tokenColor` and the signer views read only state
  *   written by `initialize`, so they commute with everything.
  *
  * @notice Scope:
  * Mint and burn only. No send, transfer or execute circuit exists, so
- * contract-held coins leave only through `burn`. No deposit or receive
- * circuit exists either: `burn` spends a coin the contract already holds,
- * supplied by the operator as `QualifiedShieldedCoinInfo`. Coins minted to
- * users are ordinary Zswap coins the contract neither tracks nor restricts.
- * No supply accounting.
+ * contract-held coins (from `mintToSelf` or `burnFromSelf` change) leave only
+ * through `burnFromSelf`, supplied by the operator as
+ * `QualifiedShieldedCoinInfo`. Coins minted to users are ordinary
+ * Zswap coins the contract neither tracks nor restricts; a holder redeems by
+ * paying the coin into a `burn` tx. No supply accounting.
  *
  * @notice Client-side duties:
  * - Before deploy: pick a random `instanceSalt`, derive each `cm` with
@@ -165,28 +182,35 @@ pragma language_version >= 0.26.0;
  * - Per operation: read `getNonce()`, rebuild the digest as
  *   `EcdsaTestUtils.ts` does, collect two low-s signatures off-chain, submit
  *   keys and signatures in matching `Vector<2>` positions.
- * - Coin delivery: hand the `ShieldedCoinInfo` returned by `mint` to the
- *   recipient out of band; contract-initiated mints create no ciphertext, so
- *   a wallet cannot find the coin by scanning.
- * - Coin tracking: keep contract-held coins off-chain, recovering each
- *   coin's `mt_index` from the indexer's `ZswapOutput` / ledger events to
- *   build the `QualifiedShieldedCoinInfo` that `burn` takes.
- * - Change coin: persist the one `burn` returns. It replaces the spent coin
- *   as the contract's holding and is not otherwise recoverable.
+ * - `mint`: hand the returned `ShieldedCoinInfo` to the recipient out of
+ *   band; contract-initiated mints create no ciphertext, so a wallet cannot
+ *   find the coin by scanning.
+ * - `mintToSelf`: persist the returned coin as a contract holding, as for
+ *   `burnFromSelf` change.
+ * - `burn`: the holder's wallet funds `coin` into the tx; hand the returned
+ *   refund coin to `refundTo` out of band. For an unlinkable burn the holder
+ *   re-nonces the coin first (a wallet self-transfer yields a fresh secret
+ *   nonce); the minted coin as-is is valid but linkable. The contract cannot
+ *   enforce this.
+ * - `burnFromSelf` coin tracking: keep contract-held coins off-chain,
+ *   recovering each coin's `mt_index` from the indexer's `ZswapOutput` /
+ *   ledger events to build the `QualifiedShieldedCoinInfo` it takes.
+ * - `burnFromSelf` change coin: persist the one it returns. It replaces the
+ *   spent coin as the contract's holding and is not otherwise recoverable.
  *
  * @notice Scalability:
- * - Throughput: one mint-or-burn per block (see Concurrency).
+ * - Throughput: one operation per block (see Concurrency).
  * - State: constant-size, two counters and a three-entry signer set. Nothing
  *   grows per operation.
- * - Amounts: `mint` caps at `Uint<64>` by `mintShieldedToken`; `burn` takes
- *   `Uint<64>` by its signature although `NST__burnFromSelf` accepts
+ * - Amounts: both mints cap at `Uint<64>` by `mintShieldedToken`; both burns
+ *   take `Uint<64>` by their signatures and widen into the module's
  *   `Uint<128>`.
  *
  * @dev Composition:
  * - Recipient privacy: pass a caller-supplied secret random nonce to
- *   `NST__mint` instead of `NSTDerivedNonce__deriveNonce()`.
- * - Deposits: a deposit path needs a `receiveShielded` circuit; none is
- *   included.
+ *   `NST__mint` / `NST__mintToSelf` instead of `NSTDerivedNonce__deriveNonce()`.
+ * - Deposits: no deposit-and-hold path; `burn` receives and spends the
+ *   holder's coin in one call.
  *
  * @notice Requires ZKIR v3: `keccak256` is unavailable on the v2 backend.
  */
@@ -195,7 +219,6 @@ module NativeShieldedTokenIssuer {
 
   import "../EcdsaSignerManager" prefix EcdsaSignerManager_;
   import "../../crypto/Eip712" prefix Eip712_;
-  import "../../utils/Utils" prefix Utils_;
   import "../../utils/EvmAbi" prefix EvmAbi_;
   import "../../token/NativeShieldedToken" prefix NST_;
   import "../../token/extensions/NativeShieldedTokenDerivedNonce" prefix NSTDerivedNonce_;
@@ -212,10 +235,11 @@ module NativeShieldedTokenIssuer {
   export { _derivedNonceCounter };
 
   /**
-   * @description Signature replay counter. `mint` and `burn` read it into
-   * their digest and increment it; `getNonce` returns the value the next
-   * digest binds to. The read is pinned, so at most one mint-or-burn lands
-   * per block.
+   * @description Signature replay counter. Every operation (`mint`,
+   * `mintToSelf`, `burn`, `burnFromSelf`) reads it into its digest and
+   * increments it; `getNonce` returns the value
+   * the next digest binds to. The read is pinned, so at most one operation
+   * lands per block.
    */
   export ledger _counter: Counter;
 
@@ -277,19 +301,39 @@ module NativeShieldedTokenIssuer {
 
   /**
    * @description `keccak256` of the `Mint` type string:
-   * `Mint(bytes32 contractAddress,bytes32 recipient,bool isContract,uint256 nonce,uint256 amount)`
+   * `Mint(bytes32 contractAddress,bytes32 recipient,uint256 nonce,uint256 amount)`
    *
-   * @dev Written as a literal word; see `BURN_TYPEHASH`. The spec checks this
+   * @dev Written as a literal word; see `BURN_FROM_SELF_TYPEHASH`. The spec checks this
    * word against the type string above.
    *
    * @returns {Bytes<32>} The `Mint` type hash.
    */
   pure circuit MINT_TYPEHASH(): Bytes<32> {
     const typeHash: Vector<32, Uint<8>> = [
-      0x28, 0xd4, 0xc8, 0x40, 0xbc, 0x95, 0xfe, 0x08,
-      0x4e, 0xa5, 0xe3, 0x20, 0x94, 0x43, 0xba, 0x67,
-      0x21, 0xb7, 0x17, 0x09, 0x71, 0xee, 0x05, 0xef,
-      0xaf, 0x0a, 0x98, 0x51, 0xee, 0x5f, 0xd1, 0xf5
+      0x65, 0x2d, 0x4d, 0xad, 0x8f, 0xb2, 0x6c, 0x5c,
+      0x50, 0xc9, 0x87, 0xd4, 0x19, 0xdc, 0x93, 0x53,
+      0x14, 0xa0, 0x1e, 0xd4, 0x5d, 0xb1, 0x59, 0xf2,
+      0x30, 0xad, 0xc1, 0xa7, 0xe9, 0x02, 0x91, 0x1c
+    ];
+
+    return typeHash as Bytes<32>;
+  }
+
+  /**
+   * @description `keccak256` of the `MintToSelf` type string:
+   * `MintToSelf(bytes32 contractAddress,uint256 nonce,uint256 amount)`
+   *
+   * @dev Written as a literal word; see `BURN_FROM_SELF_TYPEHASH`. The spec
+   * checks this word against the type string above.
+   *
+   * @returns {Bytes<32>} The `MintToSelf` type hash.
+   */
+  pure circuit MINT_TO_SELF_TYPEHASH(): Bytes<32> {
+    const typeHash: Vector<32, Uint<8>> = [
+      0xf8, 0xb3, 0x1e, 0x4e, 0x0f, 0x2d, 0x10, 0x33,
+      0x82, 0xb4, 0xb3, 0x72, 0xac, 0x65, 0xa7, 0xad,
+      0xcd, 0x03, 0x89, 0x39, 0x8d, 0x24, 0x6c, 0x5e,
+      0xc2, 0xc9, 0x09, 0x38, 0x53, 0xdb, 0x49, 0x91
     ];
 
     return typeHash as Bytes<32>;
@@ -297,21 +341,41 @@ module NativeShieldedTokenIssuer {
 
   /**
    * @description `keccak256` of the `Burn` type string:
-   * `Burn(bytes32 contractAddress,uint256 nonce,uint256 amount)`
+   * `Burn(bytes32 contractAddress,bytes32 refundTo,uint256 nonce,uint256 amount)`
+   *
+   * @dev Written as a literal word; see `BURN_FROM_SELF_TYPEHASH`. The spec
+   * checks this word against the type string above.
+   *
+   * @returns {Bytes<32>} The `Burn` type hash.
+   */
+  pure circuit BURN_TYPEHASH(): Bytes<32> {
+    const typeHash: Vector<32, Uint<8>> = [
+      0x96, 0x8e, 0x03, 0xa5, 0xba, 0x91, 0xc8, 0xdd,
+      0x27, 0x56, 0x79, 0x5a, 0xc6, 0x57, 0x52, 0x13,
+      0x06, 0xe0, 0xd9, 0x7c, 0xe8, 0x1e, 0xbf, 0x9b,
+      0x68, 0x24, 0x45, 0xa2, 0x86, 0xfc, 0xeb, 0xef
+    ];
+
+    return typeHash as Bytes<32>;
+  }
+
+  /**
+   * @description `keccak256` of the `BurnFromSelf` type string:
+   * `BurnFromSelf(bytes32 contractAddress,uint256 nonce,uint256 amount)`
    *
    * @dev Written as a literal word. `compactc` emits a full keccak
    * permutation even for a constant argument, so hashing the type string
    * in-circuit would add ~4.2k rows to every operation. The spec checks this
    * word against the type string above.
    *
-   * @returns {Bytes<32>} The `Burn` type hash.
+   * @returns {Bytes<32>} The `BurnFromSelf` type hash.
    */
-  pure circuit BURN_TYPEHASH(): Bytes<32> {
+  pure circuit BURN_FROM_SELF_TYPEHASH(): Bytes<32> {
     const typeHash: Vector<32, Uint<8>> = [
-      0xdf, 0x62, 0xd6, 0x7d, 0x39, 0x08, 0x06, 0xa6,
-      0xb6, 0x3f, 0xbd, 0x9f, 0xb5, 0xb8, 0x90, 0x4e,
-      0xf8, 0x6a, 0x4d, 0x67, 0xf3, 0x82, 0x4a, 0x3d,
-      0x85, 0x5f, 0x6e, 0xef, 0xb8, 0xe7, 0x98, 0x09
+      0x08, 0xba, 0x21, 0x80, 0x7e, 0x7f, 0x75, 0x47,
+      0xa2, 0x70, 0x1d, 0x8c, 0x53, 0x06, 0x39, 0x7d,
+      0x97, 0xad, 0xfd, 0x3e, 0xa6, 0xf6, 0xa2, 0x8c,
+      0x10, 0x0c, 0xbd, 0x64, 0x9c, 0x7f, 0x5d, 0x94
     ];
 
     return typeHash as Bytes<32>;
@@ -348,7 +412,7 @@ module NativeShieldedTokenIssuer {
    * @notice The returned coin info is the only copy available to the
    * recipient; deliver it out of band.
    *
-   * @constraints k=17, rows=105173 (zkir-v3)
+   * @constraints k=17, rows=89815 (zkir-v3)
    *
    * Requirements:
    *
@@ -357,61 +421,135 @@ module NativeShieldedTokenIssuer {
    * - Signers must not be duplicates.
    * - Threshold must be met.
    * - `recipient` is not zero.
-   * - A contract `recipient` is this contract's own address.
    *
    * @param {Uint<64>} amount - The token amount to mint.
-   * @param {Either<ZswapCoinPublicKey, ContractAddress>} recipient - The address to receive the minted tokens.
+   * @param {ZswapCoinPublicKey} recipient - The coin public key to receive the minted tokens.
    * @param {Vector<2, Secp256k1Point>} pubkeys - Public keys of approving signers.
    * @param {Vector<2, Secp256k1EcdsaSignature>} signatures - ECDSA signatures over the mint hash.
    * @returns {ShieldedCoinInfo} The minted coin (nonce, color, value).
    */
   export circuit mint(
     amount: Uint<64>,
-    recipient: Either<ZswapCoinPublicKey, ContractAddress>,
+    recipient: ZswapCoinPublicKey,
     pubkeys: Vector<2, Secp256k1Point>,
     signatures: Vector<2, Secp256k1EcdsaSignature>
   ): ShieldedCoinInfo {
     const opNonce = _counter;
     _counter.increment(1);
 
-    // Canonicalize recipient to ensure garbage values don't sully the hash
-    const canonRecipient = Utils_canonicalize<ZswapCoinPublicKey, ContractAddress>(recipient);
+    const msgHash = Eip712_hashTypedData(_domainSeparator, keccak256<Vector<5, Bytes<32>>>([
+      MINT_TYPEHASH(),
+      // Binds the digest to this deployment. The domain cannot carry the
+      // address, so removing this word removes cross-instance replay
+      // protection.
+      kernel.self().bytes,
+      recipient.bytes,
+      EvmAbi_uint64Word(opNonce),
+      EvmAbi_uint64Word(amount)
+    ]));
+
+    EcdsaSignerManager_assertApprovals(msgHash, pubkeys, signatures);
 
-    // Only the active arm reaches the digest, so a crafted value carrying data
-    // in its unused arm cannot alter what was signed.
-    const recipientWord = canonRecipient.is_left
-      ? canonRecipient.left.bytes
-      : canonRecipient.right.bytes;
+    return NST__mint(recipient, amount, NSTDerivedNonce__deriveNonce());
+  }
 
-    const msgHash = Eip712_hashTypedData(_domainSeparator, keccak256<Vector<6, Bytes<32>>>([
-      MINT_TYPEHASH(),
+  /**
+   * @description Mints a new shielded coin of this contract's token to the
+   * contract itself, claimed in the same call, authorized by threshold
+   * signatures.
+   *
+   * @notice The returned coin info is the contract's only record of the
+   * holding; persist it for `burnFromSelf`.
+   *
+   * @constraints k=17, rows=91259 (zkir-v3)
+   *
+   * Requirements:
+   *
+   * - Both public keys must hash to registered signer commitments.
+   * - Both signatures must be valid over the mint-to-self message hash.
+   * - Signers must not be duplicates.
+   * - Threshold must be met.
+   *
+   * @param {Uint<64>} amount - The token amount to mint.
+   * @param {Vector<2, Secp256k1Point>} pubkeys - Public keys of approving signers.
+   * @param {Vector<2, Secp256k1EcdsaSignature>} signatures - ECDSA signatures over the mint-to-self hash.
+   * @returns {ShieldedCoinInfo} The minted coin (nonce, color, value).
+   */
+  export circuit mintToSelf(
+    amount: Uint<64>,
+    pubkeys: Vector<2, Secp256k1Point>,
+    signatures: Vector<2, Secp256k1EcdsaSignature>
+  ): ShieldedCoinInfo {
+    const opNonce = _counter;
+    _counter.increment(1);
+
+    const msgHash = Eip712_hashTypedData(_domainSeparator, keccak256<Vector<4, Bytes<32>>>([
+      MINT_TO_SELF_TYPEHASH(),
+      // Binds the digest to this deployment. The domain cannot carry the
+      // address, so removing this word removes cross-instance replay
+      // protection.
+      kernel.self().bytes,
+      EvmAbi_uint64Word(opNonce),
+      EvmAbi_uint64Word(amount)
+    ]));
+
+    EcdsaSignerManager_assertApprovals(msgHash, pubkeys, signatures);
+
+    return NST__mintToSelf(amount, NSTDerivedNonce__deriveNonce());
+  }
+
+  /**
+   * @description Burns `amount` from a holder's coin, authorized by threshold
+   * signatures. The holder's transaction pays `coin` in; the contract
+   * receives it and burns it in the same call. Any change goes to `refundTo`.
+   *
+   * @notice The returned refund coin info is the only copy available to
+   * `refundTo`; deliver it out of band.
+   *
+   * @constraints k=17, rows=118642 (zkir-v3)
+   *
+   * Requirements:
+   *
+   * - Both public keys must hash to registered signer commitments.
+   * - Both signatures must be valid over the burn message hash.
+   * - Signers must not be duplicates.
+   * - Threshold must be met.
+   * - `coin.color` is this contract's token color.
+   * - `amount` is less than or equal to `coin.value`.
+   * - `refundTo` is not zero.
+   *
+   * @param {ShieldedCoinInfo} coin - The holder's coin to burn from.
+   * @param {Uint<64>} amount - The token amount to burn.
+   * @param {ZswapCoinPublicKey} refundTo - Receives `coin.value - amount`.
+   * @param {Vector<2, Secp256k1Point>} pubkeys - Public keys of approving signers.
+   * @param {Vector<2, Secp256k1EcdsaSignature>} signatures - ECDSA signatures over the burn hash.
+   * @returns {Maybe<ShieldedCoinInfo>} The refund coin created for `refundTo`,
+   * or `none` if the coin was burned in full.
+   */
+  export circuit burn(
+    coin: ShieldedCoinInfo,
+    amount: Uint<64>,
+    refundTo: ZswapCoinPublicKey,
+    pubkeys: Vector<2, Secp256k1Point>,
+    signatures: Vector<2, Secp256k1EcdsaSignature>
+  ): Maybe<ShieldedCoinInfo> {
+    const opNonce = _counter;
+    _counter.increment(1);
+
+    const msgHash = Eip712_hashTypedData(_domainSeparator, keccak256<Vector<5, Bytes<32>>>([
+      BURN_TYPEHASH(),
       // Binds the digest to this deployment. The domain cannot carry the
       // address, so removing this word removes cross-instance replay
       // protection.
       kernel.self().bytes,
-      recipientWord,
-      EvmAbi_boolWord(!canonRecipient.is_left),
+      refundTo.bytes,
       EvmAbi_uint64Word(opNonce),
       EvmAbi_uint64Word(amount)
     ]));
 
     EcdsaSignerManager_assertApprovals(msgHash, pubkeys, signatures);
 
-    // `NST__mint` takes a coin public key only; the contract arm is limited to
-    // this contract, since a mint to any other contract leaves an unclaimed
-    // output.
-    // The recipient is public (it is already in the signed digest), so the
-    // arm may gate which mint runs.
-    const target = disclose(canonRecipient);
-    const self = kernel.self();
-    assert(target.is_left || target.right == self,
-           "NativeShieldedToken: recipient contract must be self");
-    const nonce = NSTDerivedNonce__deriveNonce();
-    if (target.is_left) {
-      return NST__mint(target.left, amount, nonce);
-    } else {
-      return NST__mintToSelf(amount, nonce);
-    }
+    return NST__burn(coin, amount, refundTo);
   }
 
   /**
@@ -428,7 +566,7 @@ module NativeShieldedTokenIssuer {
    * Requirements:
    *
    * - Both public keys must hash to registered signer commitments.
-   * - Both signatures must be valid over the burn message hash.
+   * - Both signatures must be valid over the burn-from-self message hash.
    * - Signers must not be duplicates.
    * - Threshold must be met.
    * - `coin.color` is this contract's token color.
@@ -437,11 +575,11 @@ module NativeShieldedTokenIssuer {
    * @param {QualifiedShieldedCoinInfo} coin - The contract-held coin to burn from.
    * @param {Uint<64>} amount - The token amount to burn.
    * @param {Vector<2, Secp256k1Point>} pubkeys - Public keys of approving signers.
-   * @param {Vector<2, Secp256k1EcdsaSignature>} signatures - ECDSA signatures over the burn hash.
+   * @param {Vector<2, Secp256k1EcdsaSignature>} signatures - ECDSA signatures over the burn-from-self hash.
    * @returns {Maybe<ShieldedCoinInfo>} The change coin retained by the
    * contract, or `none` if the coin was burned in full.
    */
-  export circuit burn(
+  export circuit burnFromSelf(
     coin: QualifiedShieldedCoinInfo,
     amount: Uint<64>,
     pubkeys: Vector<2, Secp256k1Point>,
@@ -451,7 +589,7 @@ module NativeShieldedTokenIssuer {
     _counter.increment(1);
 
     const msgHash = Eip712_hashTypedData(_domainSeparator, keccak256<Vector<4, Bytes<32>>>([
-      BURN_TYPEHASH(),
+      BURN_FROM_SELF_TYPEHASH(),
       // Binds the digest to this deployment. The domain cannot carry the
       // address, so removing this word removes cross-instance replay
       // protection.
@@ -466,7 +604,7 @@ module NativeShieldedTokenIssuer {
   }
 
   /**
-   * @description Returns the counter the next mint or burn digest will bind to.
+   * @description Returns the counter the next operation's digest will bind to.
    *
    * @constraints k=6, rows=34 (zkir-v3)
    *

package/multisig/presets/ShieldedMultiSigV2.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.4.0-alpha.3 (multisig/presets/ShieldedMultiSigV2.compact)
+// OpenZeppelin Compact Contracts v0.4.0-alpha.4 (multisig/presets/ShieldedMultiSigV2.compact)
 
 pragma language_version >= 0.26.0;
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openzeppelin/compact-contracts",
-  "version": "0.4.0-alpha.3",
+  "version": "0.4.0-alpha.4",
   "description": "OpenZeppelin Compact contract library",
   "keywords": [
     "openzeppelin",
@@ -63,13 +63,15 @@
     "@midnightntwrk/ledger-v9": "1.0.0-rc.5",
     "@midnightntwrk/wallet-sdk-address-format": "4.0.0-beta.2",
     "@noble/curves": "^2.2.0",
-    "@noble/hashes": "^2.2.0",
+    "@noble/hashes": "^2.4.0",
+    "@openzeppelin/compact-deployer": "^0.3.1",
     "@openzeppelin/compact-simulator": "^0.4.0",
     "@tsconfig/node24": "^24.0.5",
-    "@types/node": "26.5.1",
+    "@types/node": "26.6.2",
     "@vitest/coverage-v8": "^5.0.0",
     "ethers": "^6.17.0",
     "fast-check": "^4.10.1",
+    "pino": "^9.7.0",
     "ts-node": "^10.9.2",
     "typescript": "^6.0.3",
     "vite": "^8.3.0",

package/security/Allowlist.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.4.0-alpha.3 (security/Allowlist.compact)
+// OpenZeppelin Compact Contracts v0.4.0-alpha.4 (security/Allowlist.compact)
 
 pragma language_version >= 0.26.0;
 

package/security/Blocklist.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.4.0-alpha.3 (security/Blocklist.compact)
+// OpenZeppelin Compact Contracts v0.4.0-alpha.4 (security/Blocklist.compact)
 
 pragma language_version >= 0.26.0;
 

package/security/Initializable.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.4.0-alpha.3 (security/Initializable.compact)
+// OpenZeppelin Compact Contracts v0.4.0-alpha.4 (security/Initializable.compact)
 
 pragma language_version >= 0.26.0;
 

package/security/Pausable.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.4.0-alpha.3 (security/Pausable.compact)
+// OpenZeppelin Compact Contracts v0.4.0-alpha.4 (security/Pausable.compact)
 
 pragma language_version >= 0.26.0;
 

package/token/ConfidentialFungibleToken.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.4.0-alpha.3 (token/ConfidentialFungibleToken.compact)
+// OpenZeppelin Compact Contracts v0.4.0-alpha.4 (token/ConfidentialFungibleToken.compact)
 
 pragma language_version >= 0.26.0;
 

package/token/FungibleToken.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.4.0-alpha.3 (token/FungibleToken.compact)
+// OpenZeppelin Compact Contracts v0.4.0-alpha.4 (token/FungibleToken.compact)
 
 pragma language_version >= 0.26.0;
 

package/token/MultiToken.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.4.0-alpha.3 (token/MultiToken.compact)
+// OpenZeppelin Compact Contracts v0.4.0-alpha.4 (token/MultiToken.compact)
 
 pragma language_version >= 0.26.0;
 

package/token/NativeShieldedToken.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.4.0-alpha.3 (token/NativeShieldedToken.compact)
+// OpenZeppelin Compact Contracts v0.4.0-alpha.4 (token/NativeShieldedToken.compact)
 
 pragma language_version >= 0.26.0;
 

package/token/NativeShieldedTokenCore.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.4.0-alpha.3 (token/NativeShieldedTokenCore.compact)
+// OpenZeppelin Compact Contracts v0.4.0-alpha.4 (token/NativeShieldedTokenCore.compact)
 
 pragma language_version >= 0.26.0;
 

package/token/NativeShieldedTokenFamily.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.4.0-alpha.3 (token/NativeShieldedTokenFamily.compact)
+// OpenZeppelin Compact Contracts v0.4.0-alpha.4 (token/NativeShieldedTokenFamily.compact)
 
 pragma language_version >= 0.26.0;
 

package/token/NonFungibleToken.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.4.0-alpha.3 (token/NonFungibleToken.compact)
+// OpenZeppelin Compact Contracts v0.4.0-alpha.4 (token/NonFungibleToken.compact)
 
 pragma language_version >= 0.26.0;
 

package/token/extensions/ConfidentialFungibleTokenPublicSupply.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.4.0-alpha.3 (token/extensions/ConfidentialFungibleTokenPublicSupply.compact)
+// OpenZeppelin Compact Contracts v0.4.0-alpha.4 (token/extensions/ConfidentialFungibleTokenPublicSupply.compact)
 
 pragma language_version >= 0.26.0;
 

package/token/extensions/NativeShieldedTokenDerivedNonce.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.4.0-alpha.3 (token/extensions/NativeShieldedTokenDerivedNonce.compact)
+// OpenZeppelin Compact Contracts v0.4.0-alpha.4 (token/extensions/NativeShieldedTokenDerivedNonce.compact)
 
 pragma language_version >= 0.26.0;
 

package/utils/EvmAbi.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.4.0-alpha.3 (utils/EvmAbi.compact)
+// OpenZeppelin Compact Contracts v0.4.0-alpha.4 (utils/EvmAbi.compact)
 
 pragma language_version >= 0.26.0;
 

package/utils/Utils.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.4.0-alpha.3 (utils/Utils.compact)
+// OpenZeppelin Compact Contracts v0.4.0-alpha.4 (utils/Utils.compact)
 
 pragma language_version >= 0.26.0;