@openzeppelin/compact-contracts 0.4.0-alpha.4 → 0.4.0-alpha.5

package/access/AccessControl.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.4.0-alpha.4 (access/AccessControl.compact)
+// OpenZeppelin Compact Contracts v0.4.0-alpha.5 (access/AccessControl.compact)
 
 pragma language_version >= 0.26.0;
 

package/access/Ownable.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.4.0-alpha.4 (access/Ownable.compact)
+// OpenZeppelin Compact Contracts v0.4.0-alpha.5 (access/Ownable.compact)
 
 pragma language_version >= 0.26.0;
 

package/access/ShieldedAccessControl.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.4.0-alpha.4 (access/ShieldedAccessControl.compact)
+// OpenZeppelin Compact Contracts v0.4.0-alpha.5 (access/ShieldedAccessControl.compact)
 
 pragma language_version >= 0.26.0;
 

package/access/ZOwnablePK.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.4.0-alpha.4 (access/ZOwnablePK.compact)
+// OpenZeppelin Compact Contracts v0.4.0-alpha.5 (access/ZOwnablePK.compact)
 
 pragma language_version >= 0.26.0;
 

package/crypto/EcdhMask.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.4.0-alpha.4 (crypto/EcdhMask.compact)
+// OpenZeppelin Compact Contracts v0.4.0-alpha.5 (crypto/EcdhMask.compact)
 
 pragma language_version >= 0.26.0;
 

package/crypto/Ecdsa.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.4.0-alpha.4 (crypto/Ecdsa.compact)
+// OpenZeppelin Compact Contracts v0.4.0-alpha.5 (crypto/Ecdsa.compact)
 
 pragma language_version >= 0.26.0;
 

package/crypto/Eip712.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.4.0-alpha.4 (crypto/Eip712.compact)
+// OpenZeppelin Compact Contracts v0.4.0-alpha.5 (crypto/Eip712.compact)
 
 pragma language_version >= 0.26.0;
 

package/crypto/ElGamal.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.4.0-alpha.4 (crypto/ElGamal.compact)
+// OpenZeppelin Compact Contracts v0.4.0-alpha.5 (crypto/ElGamal.compact)
 
 pragma language_version >= 0.26.0;
 

package/multisig/EcdsaSignerManager.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.4.0-alpha.4 (multisig/EcdsaSignerManager.compact)
+// OpenZeppelin Compact Contracts v0.4.0-alpha.5 (multisig/EcdsaSignerManager.compact)
 
 pragma language_version >= 0.26.0;
 
@@ -77,13 +77,14 @@ module EcdsaSignerManager {
    * - Can only be called once.
    * - `instanceSalt` should be cryptographically random.
    * - `signerCommitments` must not contain duplicates.
-   * - `threshold` must be non-zero and must not exceed `n`.
-   * - `threshold` must not exceed 2, the number of approvals `assertApprovals`
-   *   verifies.
+   * - `n` must be at least 2, the number of distinct signers `assertApprovals`
+   *   verifies. A smaller set can never satisfy it.
+   * - `threshold` must be 2, the number of approvals `assertApprovals`
+   *   verifies. Any other value would misreport what the circuit enforces.
    *
    * @param {Bytes<32>} instanceSalt - Per-deployment salt for commitment derivation.
    * @param {Vector<n, Bytes<32>>} signerCommitments - Hashed signer identities.
-   * @param {Uint<8>} threshold - Minimum approvals required.
+   * @param {Uint<8>} threshold - Approvals required. Must be 2.
    * @returns {[]} Empty tuple.
    */
   export circuit initialize<#n>(
@@ -93,11 +94,12 @@ module EcdsaSignerManager {
   ): [] {
     assert(Signer_getSignerCount() == 0, "EcdsaSignerManager: signers already registered");
     _instanceSalt = disclose(instanceSalt);
-    assert(threshold <= 2, "EcdsaSignerManager: threshold cannot exceed 2 (assertApprovals verifies 2 signatures)");
+    assert(threshold == 2, "EcdsaSignerManager: threshold must be 2 (assertApprovals verifies 2 signatures)");
 
     for (const commitment of signerCommitments) {
       Signer__addSigner(commitment);
     }
+    assert(Signer_getSignerCount() >= 2, "EcdsaSignerManager: fewer than 2 signers (assertApprovals verifies 2 signatures)");
     Signer__changeThreshold(threshold);
   }
 
@@ -140,7 +142,7 @@ module EcdsaSignerManager {
    * same signer.
    *
    * @dev Both entries are asserted, so the count handed to the threshold check
-   * is always 2 and a threshold below 2 admits nothing extra.
+   * is always 2, matching the only threshold `initialize` accepts.
    *
    * @constraints k=17, rows=64916 (zkir-v3)
    *

package/multisig/ForwarderPrivate.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.4.0-alpha.4 (multisig/ForwarderPrivate.compact)
+// OpenZeppelin Compact Contracts v0.4.0-alpha.5 (multisig/ForwarderPrivate.compact)
 
 pragma language_version >= 0.26.0;
 

package/multisig/ForwarderShielded.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.4.0-alpha.4 (multisig/ForwarderShielded.compact)
+// OpenZeppelin Compact Contracts v0.4.0-alpha.5 (multisig/ForwarderShielded.compact)
 
 pragma language_version >= 0.26.0;
 
@@ -41,6 +41,11 @@ pragma language_version >= 0.26.0;
  * coins. Forwarding to a key no one controls strands every deposit
  * permanently. The zero-key guard rejects only the all-zero key, not an
  * otherwise-unspendable one.
+ *
+ * @notice The depositor must encrypt the forwarded output to the parent's
+ * encryption public key, obtained off-chain. The ledger cannot check that
+ * key against `_parent`, so a wrong or missing key leaves the coin
+ * spendable by the parent but invisible to its wallet.
  */
 module ForwarderShielded {
   import CompactStandardLibrary;
@@ -103,20 +108,24 @@ module ForwarderShielded {
    * `sendImmediateShielded` to the stored parent recipient (always the
    * `left` / coin-public-key arm today).
    *
-   * @constraints k=15, rows=24373
+   * @constraints k=15, rows=23197
    *
    * Requirements:
    *
    * - Contract must be initialized.
+   * - The forwarded output must be encrypted to the parent's encryption
+   *   public key (see the module header). If unsure, hand the returned
+   *   `ShieldedSendResult` to the parent so it can recover the coin.
    *
    * @param {ShieldedCoinInfo} coin - The incoming shielded coin.
    *
-   * @returns {[]} Empty tuple.
+   * @returns {ShieldedSendResult} The coin sent to the parent, with no change:
+   * the whole value is forwarded.
    */
-  export circuit _deposit(coin: ShieldedCoinInfo): [] {
+  export circuit _deposit(coin: ShieldedCoinInfo): ShieldedSendResult {
     assertInitialized();
     receiveShielded(disclose(coin));
-    sendImmediateShielded(disclose(coin), _parent, disclose(coin.value));
+    return sendImmediateShielded(disclose(coin), _parent, disclose(coin.value));
   }
 
   // ─── Init guards ────────────────────────────────────────────────

package/multisig/ForwarderUnshielded.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.4.0-alpha.4 (multisig/ForwarderUnshielded.compact)
+// OpenZeppelin Compact Contracts v0.4.0-alpha.5 (multisig/ForwarderUnshielded.compact)
 
 pragma language_version >= 0.26.0;
 

package/multisig/ProposalManager.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.4.0-alpha.4 (multisig/ProposalManager.compact)
+// OpenZeppelin Compact Contracts v0.4.0-alpha.5 (multisig/ProposalManager.compact)
 
 pragma language_version >= 0.26.0;
 

package/multisig/ShieldedTreasury.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.4.0-alpha.4 (multisig/ShieldedTreasury.compact)
+// OpenZeppelin Compact Contracts v0.4.0-alpha.5 (multisig/ShieldedTreasury.compact)
 
 pragma language_version >= 0.26.0;
 

package/multisig/ShieldedTreasuryStateless.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.4.0-alpha.4 (multisig/ShieldedTreasuryStateless.compact)
+// OpenZeppelin Compact Contracts v0.4.0-alpha.5 (multisig/ShieldedTreasuryStateless.compact)
 
 pragma language_version >= 0.26.0;
 

package/multisig/Signer.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.4.0-alpha.4 (multisig/Signer.compact)
+// OpenZeppelin Compact Contracts v0.4.0-alpha.5 (multisig/Signer.compact)
 
 pragma language_version >= 0.26.0;
 

package/multisig/UnshieldedTreasury.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.4.0-alpha.4 (multisig/UnshieldedTreasury.compact)
+// OpenZeppelin Compact Contracts v0.4.0-alpha.5 (multisig/UnshieldedTreasury.compact)
 
 pragma language_version >= 0.26.0;
 
@@ -90,8 +90,7 @@ module UnshieldedTreasury {
   // ─── Send ───────────────────────────────────────────────────────
 
   /**
-   * @description Sends unshielded tokens from the treasury. Zero-amount sends
-   * are permitted and are value-preserving no-ops.
+   * @description Sends unshielded tokens from the treasury.
    *
    * @warning Recipients are not validated. An unspendable recipient (such as a
    * zero address) is accepted and permanently removes the funds from the
@@ -111,6 +110,7 @@ module UnshieldedTreasury {
    *
    * Requirements:
    *
+   * - The amount must be non-zero. The ledger rejects zero-value outputs.
    * - The treasury must hold sufficient balance for the given token color.
    *
    * @param {Either<ContractAddress, UserAddress>} recipient - The recipient address.
@@ -124,6 +124,8 @@ module UnshieldedTreasury {
     color: Bytes<32>,
     amount: Uint<128>
   ): [] {
+    assert(amount != 0, "UnshieldedTreasury: zero amount");
+
     const bal = getTokenBalance(color);
     assert(bal >= amount, "UnshieldedTreasury: insufficient balance");
 

package/multisig/examples/ForwarderPrivateExample.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.4.0-alpha.4 (multisig/examples/ForwarderPrivateExample.compact)
+// OpenZeppelin Compact Contracts v0.4.0-alpha.5 (multisig/examples/ForwarderPrivateExample.compact)
 
 pragma language_version >= 0.26.0;
 

package/multisig/examples/ForwarderShieldedExample.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.4.0-alpha.4 (multisig/examples/ForwarderShieldedExample.compact)
+// OpenZeppelin Compact Contracts v0.4.0-alpha.5 (multisig/examples/ForwarderShieldedExample.compact)
 
 pragma language_version >= 0.26.0;
 
@@ -24,7 +24,7 @@ pragma language_version >= 0.26.0;
 import CompactStandardLibrary;
 import "../ForwarderShielded" prefix Forwarder_;
 
-export { ZswapCoinPublicKey, ContractAddress, ShieldedCoinInfo, Either };
+export { ZswapCoinPublicKey, ContractAddress, ShieldedCoinInfo, ShieldedSendResult, Maybe, Either };
 
 /**
  * @description Deploys the forwarder bound to a specific parent
@@ -42,12 +42,15 @@ constructor(parent: ZswapCoinPublicKey) {
  * the configured parent. The coin is claimed via `receiveShielded` and
  * immediately re-sent via `sendImmediateShielded`.
  *
+ * The depositor must encrypt the forwarded output to the parent's
+ * encryption public key (see the `ForwarderShielded` header).
+ *
  * @param {ShieldedCoinInfo} coin - The incoming shielded coin.
  *
- * @returns {[]} Empty tuple.
+ * @returns {ShieldedSendResult} The coin sent to the parent, with no change.
  */
-export circuit deposit(coin: ShieldedCoinInfo): [] {
-  Forwarder__deposit(coin);
+export circuit deposit(coin: ShieldedCoinInfo): ShieldedSendResult {
+  return Forwarder__deposit(coin);
 }
 
 /**

package/multisig/examples/ForwarderUnshieldedExample.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.4.0-alpha.4 (multisig/examples/ForwarderUnshieldedExample.compact)
+// OpenZeppelin Compact Contracts v0.4.0-alpha.5 (multisig/examples/ForwarderUnshieldedExample.compact)
 
 pragma language_version >= 0.26.0;
 

package/multisig/examples/NativeShieldedTokenIssuerExample.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.4.0-alpha.4 (multisig/examples/NativeShieldedTokenIssuerExample.compact)
+// OpenZeppelin Compact Contracts v0.4.0-alpha.5 (multisig/examples/NativeShieldedTokenIssuerExample.compact)
 
 pragma language_version >= 0.26.0;
 
@@ -11,8 +11,10 @@ pragma language_version >= 0.26.0;
  * (`mintToSelf`), and leaves only through an ECDSA-authorized burn, of a
  * holder's coin (`burn`) or of one the contract holds (`burnFromSelf`).
  *
- * The token is non-transferable by construction. There is no transfer circuit,
- * so a holder's only exit is to pay the coin into a `burn` tx.
+ * Coins minted to holders are ordinary Zswap coins: holders transfer them
+ * through Zswap without the issuer's involvement and redeem by paying one
+ * into a `burn` tx. Only contract-held coins are locked. No send circuit
+ * exists, so they leave through `burnFromSelf` alone.
  */
 
 import CompactStandardLibrary;
@@ -113,7 +115,7 @@ export circuit mintToSelf(
 
 export circuit burn(
   coin: ShieldedCoinInfo,
-  amount: Uint<64>,
+  amount: Uint<128>,
   refundTo: ZswapCoinPublicKey,
   pubkeys: Vector<2, Secp256k1Point>,
   signatures: Vector<2, Secp256k1EcdsaSignature>
@@ -123,7 +125,7 @@ export circuit burn(
 
 export circuit burnFromSelf(
   coin: QualifiedShieldedCoinInfo,
-  amount: Uint<64>,
+  amount: Uint<128>,
   pubkeys: Vector<2, Secp256k1Point>,
   signatures: Vector<2, Secp256k1EcdsaSignature>
 ): Maybe<ShieldedCoinInfo> {

package/multisig/examples/ShieldedMultiSigV2Example.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.4.0-alpha.4 (multisig/examples/ShieldedMultiSigV2Example.compact)
+// OpenZeppelin Compact Contracts v0.4.0-alpha.5 (multisig/examples/ShieldedMultiSigV2Example.compact)
 
 pragma language_version >= 0.26.0;
 
@@ -29,7 +29,7 @@ export { _domainSeparator };
  *
  * @param {Bytes<32>} instanceSalt - Random salt for commitment derivation.
  * @param {Vector<3, Bytes<32>>} signerCommitments - Hashed signer identities.
- * @param {Uint<8>} thresh - Minimum approvals required.
+ * @param {Uint<8>} thresh - Approvals required. Must be 2.
  */
 constructor(
   instanceSalt: Bytes<32>,

package/multisig/presets/NativeShieldedTokenIssuer.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.4.0-alpha.4 (multisig/presets/NativeShieldedTokenIssuer.compact)
+// OpenZeppelin Compact Contracts v0.4.0-alpha.5 (multisig/presets/NativeShieldedTokenIssuer.compact)
 
 pragma language_version >= 0.26.0;
 
@@ -44,16 +44,19 @@ pragma language_version >= 0.26.0;
  * - MintToSelf digest: `keccak(0x1901 ‖ DS ‖ keccak([MINT_TO_SELF_TYPEHASH,
  *   self, uint64Word(opNonce), uint64Word(amount)]))`.
  * - Burn digest: `keccak(0x1901 ‖ DS ‖ keccak([BURN_TYPEHASH, self,
- *   refundTo.bytes, uint64Word(opNonce), uint64Word(amount)]))`.
+ *   refundTo.bytes, uint64Word(opNonce), uint128Word(amount)]))`.
  * - BurnFromSelf digest: `keccak(0x1901 ‖ DS ‖ keccak([
- *   BURN_FROM_SELF_TYPEHASH, self, uint64Word(opNonce), uint64Word(amount)]))`.
+ *   BURN_FROM_SELF_TYPEHASH, self, uint64Word(opNonce), uint128Word(amount),
+ *   coin.nonce, uint128Word(coin.value)]))`. The last two words name the
+ *   holding, so approvals authorize one coin rather than an amount.
  * - Type hashes: `MINT_TYPEHASH = keccak("Mint(bytes32 contractAddress,
  *   bytes32 recipient,uint256 nonce,uint256 amount)")`,
  *   `MINT_TO_SELF_TYPEHASH = keccak("MintToSelf(bytes32 contractAddress,
  *   uint256 nonce,uint256 amount)")`, `BURN_TYPEHASH = keccak("Burn(bytes32 contractAddress,bytes32 refundTo,
  *   uint256 nonce,uint256 amount)")` and `BURN_FROM_SELF_TYPEHASH =
  *   keccak("BurnFromSelf(bytes32 contractAddress,uint256 nonce,
- *   uint256 amount)")`, written as literal words.
+ *   uint256 amount,bytes32 coinNonce,uint256 coinValue)")`, written as
+ *   literal words.
  * - Signer commitment: `cm = H<SignerCommitmentInput>({ pkX, pkY, salt,
  *   domain: pad(32, "multisig:signer:") })`, `pkX` / `pkY` the affine
  *   coordinates as `Bytes<32>`. `_calculateSignerId` is the exported pure
@@ -133,19 +136,22 @@ pragma language_version >= 0.26.0;
  *
  * @notice Security:
  * - Digest binding: each struct binds its type hash, `self`, `opNonce` and
- *   `amount` (`mint` also `recipient`, `burn` also `refundTo`) under `DS`,
- *   so a
+ *   `amount` (`mint` also `recipient`, `burn` also `refundTo`,
+ *   `burnFromSelf` also `coin.nonce` and `coin.value`) under `DS`, so a
  *   signature authorizes one operation on one instance at one nonce, and is
  *   neither replayable as another operation, nor under another domain,
  *   nor redirectable. Removing the `self` word removes cross-instance
- *   replay protection, since `DS` cannot carry the address. `Burn` does not
- *   bind `coin`: the payer picks it, so a signature moved to another coin
- *   burns only the payer's own value and refunds the bound `refundTo`.
+ *   replay protection, since `DS` cannot carry the address. Only
+ *   `burnFromSelf` binds its coin, because only there does the submitter
+ *   pick it from the contract's own holdings. `Burn` needs no such word. Its
+ *   coin is paid into the tx by whoever submits it so replaying a
+ *   signature against a different coin destroys the submitter's own funds and
+ *   still refunds the bound `refundTo`.
  * - Low-s: verification goes through `Ecdsa_secp256k1EcdsaVerifyLowS`, so a
  *   high-s encoding is an invalid signature.
  * - Distinct signers: `assertApprovals` asserts both entries and rejects a
  *   repeated commitment, so two distinct registered signers are always
- *   required. The threshold `2` is the ceiling `EcdsaSignerManager` accepts.
+ *   required. The threshold `2` is the only value `EcdsaSignerManager` accepts.
  * - Immutable signer set: no signer reconfiguration circuit is exported, so
  *   the three commitments and the threshold are fixed. Losing two of the
  *   three keys freezes the contract.
@@ -192,19 +198,24 @@ pragma language_version >= 0.26.0;
  *   re-nonces the coin first (a wallet self-transfer yields a fresh secret
  *   nonce); the minted coin as-is is valid but linkable. The contract cannot
  *   enforce this.
+ * - `burnFromSelf` coin selection: pick the coin before collecting
+ *   signatures, not after. Its `nonce` and `value` are in the digest, so
+ *   signers approve one holding and the submitted coin must be that one.
  * - `burnFromSelf` coin tracking: keep contract-held coins off-chain,
  *   recovering each coin's `mt_index` from the indexer's `ZswapOutput` /
  *   ledger events to build the `QualifiedShieldedCoinInfo` it takes.
- * - `burnFromSelf` change coin: persist the one it returns. It replaces the
- *   spent coin as the contract's holding and is not otherwise recoverable.
+ * - `burnFromSelf` change coin: it replaces the spent coin as the contract's
+ *   holding. Either persist the coin the circuit returns, or rebuild it from
+ *   the signed `coinNonce` and `coinValue`, which determine it, so recovery
+ *   doesn't need to rest on the submitter alone. Rebuilding leans on the protocol's
+ *   nonce derivation which this module neither defines nor pins.
  *
  * @notice Scalability:
  * - Throughput: one operation per block (see Concurrency).
  * - State: constant-size, two counters and a three-entry signer set. Nothing
  *   grows per operation.
- * - Amounts: both mints cap at `Uint<64>` by `mintShieldedToken`; both burns
- *   take `Uint<64>` by their signatures and widen into the module's
- *   `Uint<128>`.
+ * - Amounts: mints cap at `Uint<64>` by `mintShieldedToken`. Burns take
+ *   `Uint<128>`, the coin value range.
  *
  * @dev Composition:
  * - Recipient privacy: pass a caller-supplied secret random nonce to
@@ -361,7 +372,7 @@ module NativeShieldedTokenIssuer {
 
   /**
    * @description `keccak256` of the `BurnFromSelf` type string:
-   * `BurnFromSelf(bytes32 contractAddress,uint256 nonce,uint256 amount)`
+   * `BurnFromSelf(bytes32 contractAddress,uint256 nonce,uint256 amount,bytes32 coinNonce,uint256 coinValue)`
    *
    * @dev Written as a literal word. `compactc` emits a full keccak
    * permutation even for a constant argument, so hashing the type string
@@ -372,10 +383,10 @@ module NativeShieldedTokenIssuer {
    */
   pure circuit BURN_FROM_SELF_TYPEHASH(): Bytes<32> {
     const typeHash: Vector<32, Uint<8>> = [
-      0x08, 0xba, 0x21, 0x80, 0x7e, 0x7f, 0x75, 0x47,
-      0xa2, 0x70, 0x1d, 0x8c, 0x53, 0x06, 0x39, 0x7d,
-      0x97, 0xad, 0xfd, 0x3e, 0xa6, 0xf6, 0xa2, 0x8c,
-      0x10, 0x0c, 0xbd, 0x64, 0x9c, 0x7f, 0x5d, 0x94
+      0x50, 0xa1, 0xf2, 0x88, 0xba, 0xb8, 0x77, 0x4b,
+      0x1f, 0x55, 0x86, 0x31, 0xc7, 0x75, 0xda, 0x49,
+      0xec, 0x20, 0x4e, 0x07, 0xcf, 0x88, 0x53, 0x9b,
+      0xca, 0x8e, 0xb9, 0x8c, 0xac, 0xf4, 0x5b, 0xe9
     ];
 
     return typeHash as Bytes<32>;
@@ -461,7 +472,7 @@ module NativeShieldedTokenIssuer {
    * @notice The returned coin info is the contract's only record of the
    * holding; persist it for `burnFromSelf`.
    *
-   * @constraints k=17, rows=91259 (zkir-v3)
+   * @constraints k=17, rows=85594 (zkir-v3)
    *
    * Requirements:
    *
@@ -506,7 +517,7 @@ module NativeShieldedTokenIssuer {
    * @notice The returned refund coin info is the only copy available to
    * `refundTo`; deliver it out of band.
    *
-   * @constraints k=17, rows=118642 (zkir-v3)
+   * @constraints k=17, rows=119826 (zkir-v3)
    *
    * Requirements:
    *
@@ -519,7 +530,7 @@ module NativeShieldedTokenIssuer {
    * - `refundTo` is not zero.
    *
    * @param {ShieldedCoinInfo} coin - The holder's coin to burn from.
-   * @param {Uint<64>} amount - The token amount to burn.
+   * @param {Uint<128>} amount - The token amount to burn.
    * @param {ZswapCoinPublicKey} refundTo - Receives `coin.value - amount`.
    * @param {Vector<2, Secp256k1Point>} pubkeys - Public keys of approving signers.
    * @param {Vector<2, Secp256k1EcdsaSignature>} signatures - ECDSA signatures over the burn hash.
@@ -528,7 +539,7 @@ module NativeShieldedTokenIssuer {
    */
   export circuit burn(
     coin: ShieldedCoinInfo,
-    amount: Uint<64>,
+    amount: Uint<128>,
     refundTo: ZswapCoinPublicKey,
     pubkeys: Vector<2, Secp256k1Point>,
     signatures: Vector<2, Secp256k1EcdsaSignature>
@@ -544,7 +555,7 @@ module NativeShieldedTokenIssuer {
       kernel.self().bytes,
       refundTo.bytes,
       EvmAbi_uint64Word(opNonce),
-      EvmAbi_uint64Word(amount)
+      EvmAbi_uint128Word(amount)
     ]));
 
     EcdsaSignerManager_assertApprovals(msgHash, pubkeys, signatures);
@@ -561,7 +572,10 @@ module NativeShieldedTokenIssuer {
    * and returned; it replaces `coin` as the contract's holding, so the
    * operator must persist it.
    *
-   * @constraints k=17, rows=97232 (zkir-v3)
+   * The digest binds `coin.nonce` and `coin.value`, so approvals authorize one
+   * specific holding rather than an amount.
+   *
+   * @constraints k=17, rows=104981 (zkir-v3)
    *
    * Requirements:
    *
@@ -571,9 +585,10 @@ module NativeShieldedTokenIssuer {
    * - Threshold must be met.
    * - `coin.color` is this contract's token color.
    * - `amount` is less than or equal to `coin.value`.
+   * - `coin.nonce` and `coin.value` match the approved coin.
    *
    * @param {QualifiedShieldedCoinInfo} coin - The contract-held coin to burn from.
-   * @param {Uint<64>} amount - The token amount to burn.
+   * @param {Uint<128>} amount - The token amount to burn.
    * @param {Vector<2, Secp256k1Point>} pubkeys - Public keys of approving signers.
    * @param {Vector<2, Secp256k1EcdsaSignature>} signatures - ECDSA signatures over the burn-from-self hash.
    * @returns {Maybe<ShieldedCoinInfo>} The change coin retained by the
@@ -581,21 +596,23 @@ module NativeShieldedTokenIssuer {
    */
   export circuit burnFromSelf(
     coin: QualifiedShieldedCoinInfo,
-    amount: Uint<64>,
+    amount: Uint<128>,
     pubkeys: Vector<2, Secp256k1Point>,
     signatures: Vector<2, Secp256k1EcdsaSignature>
   ): Maybe<ShieldedCoinInfo> {
     const opNonce = _counter;
     _counter.increment(1);
 
-    const msgHash = Eip712_hashTypedData(_domainSeparator, keccak256<Vector<4, Bytes<32>>>([
+    const msgHash = Eip712_hashTypedData(_domainSeparator, keccak256<Vector<6, Bytes<32>>>([
       BURN_FROM_SELF_TYPEHASH(),
       // Binds the digest to this deployment. The domain cannot carry the
       // address, so removing this word removes cross-instance replay
       // protection.
       kernel.self().bytes,
       EvmAbi_uint64Word(opNonce),
-      EvmAbi_uint64Word(amount)
+      EvmAbi_uint128Word(amount),
+      coin.nonce,
+      EvmAbi_uint128Word(coin.value)
     ]));
 
     EcdsaSignerManager_assertApprovals(msgHash, pubkeys, signatures);

package/multisig/presets/ShieldedMultiSigV2.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.4.0-alpha.4 (multisig/presets/ShieldedMultiSigV2.compact)
+// OpenZeppelin Compact Contracts v0.4.0-alpha.5 (multisig/presets/ShieldedMultiSigV2.compact)
 
 pragma language_version >= 0.26.0;
 
@@ -82,11 +82,11 @@ module ShieldedMultiSigV2 {
    *
    * - `instanceSalt` should be cryptographically random.
    * - `signerCommitments` must not contain duplicates.
-   * - `thresh` must be non-zero and must not exceed 2.
+   * - `thresh` must be 2, the number of signatures `execute` verifies.
    *
    * @param {Bytes<32>} instanceSalt - Per-deployment salt for commitment derivation.
    * @param {Vector<3, Bytes<32>>} signerCommitments - Hashed signer identities.
-   * @param {Uint<8>} thresh - Minimum approvals required.
+   * @param {Uint<8>} thresh - Approvals required. Must be 2.
    * @returns {[]} Empty tuple.
    */
   export circuit initialize(
@@ -165,7 +165,10 @@ module ShieldedMultiSigV2 {
    * commitment from their public key and the instance salt, rejects duplicates,
    * and enforces the threshold.
    *
-   * @constraints k=17, rows=104644 (zkir-v3)
+   * @notice `to` must be a `ShieldedUser`. A contract-addressed coin would be
+   * unclaimable, making the transaction malformed.
+   *
+   * @constraints k=17, rows=98977 (zkir-v3)
    *
    * Requirements:
    *
@@ -173,6 +176,7 @@ module ShieldedMultiSigV2 {
    * - Both signatures must be valid over the message hash and use the low-s
    *   encoding.
    * - Signers must not be duplicates.
+   * - `to.kind` must be `ShieldedUser`.
    * - Coin value must be >= amount.
    *
    * @param {Proposal_Recipient} to - The recipient.
@@ -210,9 +214,14 @@ module ShieldedMultiSigV2 {
 
     EcdsaSignerManager_assertApprovals(msgHash, pubkeys, signatures);
 
-    // Execute transfer
-    const normalizedRecipient = Proposal_toShieldedRecipient(to);
-    return Treasury__send(coin, normalizedRecipient, amount);
+    assert(
+      to.kind == Proposal_RecipientKind.ShieldedUser,
+      "Multisig: recipient must be a coin public key"
+    );
+    const recipient = left<ZswapCoinPublicKey, ContractAddress>(
+      ZswapCoinPublicKey { bytes: to.address }
+    );
+    return Treasury__send(coin, recipient, amount);
   }
 
   // ─── Commitments ────────────────────────────────────────────────

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openzeppelin/compact-contracts",
-  "version": "0.4.0-alpha.4",
+  "version": "0.4.0-alpha.5",
   "description": "OpenZeppelin Compact contract library",
   "keywords": [
     "openzeppelin",
@@ -65,7 +65,7 @@
     "@noble/curves": "^2.2.0",
     "@noble/hashes": "^2.4.0",
     "@openzeppelin/compact-deployer": "^0.3.1",
-    "@openzeppelin/compact-simulator": "^0.4.0",
+    "@openzeppelin/compact-simulator": "^0.4.1",
     "@tsconfig/node24": "^24.0.5",
     "@types/node": "26.6.2",
     "@vitest/coverage-v8": "^5.0.0",

package/security/Allowlist.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.4.0-alpha.4 (security/Allowlist.compact)
+// OpenZeppelin Compact Contracts v0.4.0-alpha.5 (security/Allowlist.compact)
 
 pragma language_version >= 0.26.0;
 

package/security/Blocklist.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.4.0-alpha.4 (security/Blocklist.compact)
+// OpenZeppelin Compact Contracts v0.4.0-alpha.5 (security/Blocklist.compact)
 
 pragma language_version >= 0.26.0;
 

package/security/Initializable.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.4.0-alpha.4 (security/Initializable.compact)
+// OpenZeppelin Compact Contracts v0.4.0-alpha.5 (security/Initializable.compact)
 
 pragma language_version >= 0.26.0;
 

package/security/Pausable.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.4.0-alpha.4 (security/Pausable.compact)
+// OpenZeppelin Compact Contracts v0.4.0-alpha.5 (security/Pausable.compact)
 
 pragma language_version >= 0.26.0;
 

package/token/ConfidentialFungibleToken.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.4.0-alpha.4 (token/ConfidentialFungibleToken.compact)
+// OpenZeppelin Compact Contracts v0.4.0-alpha.5 (token/ConfidentialFungibleToken.compact)
 
 pragma language_version >= 0.26.0;
 
@@ -242,6 +242,22 @@ pragma language_version >= 0.26.0;
  * Raising the limit itself is a node-side change, tracked upstream:
  * https://github.com/midnightntwrk/midnight-node/issues/1202.
  *
+ * Upgrades. Add operations, never change how existing state is derived or laid
+ * out. A CMA upgrade swaps verifier keys on an instance whose ledger already
+ * holds data so whatever that data was written under has to stay fixed e.g. slot
+ * indices, nonce and key derivation, stored encodings. Slot changes at least
+ * show up in a diff. Key derivation is the quiet one. `_encryptionKeys` holds
+ * the key `derivePk` returned at `register` time, `register` refuses a second
+ * key for an account id, and the id does not move (untagged by design, see
+ * `Utils.computeAccountId`), so a circuit deriving a different key leaves
+ * `assertDecryptsTo` and `_assertOwnsEncryptionKey` rejecting the stored one
+ * with no way to re-register. This means balances, pending balances, escrow and
+ * memos are all permanently unreachable. An instance's derivation is fixed when
+ * it is deployed, so off-chain code mirroring `derivePk` must use that one for
+ * the life of the instance. Adopting a newer derivation cannot recover an
+ * instance whose keys were stored under the old one. A changed derivation
+ * applies to fresh deployments only.
+ *
  * Residual griefing. The dual-balance split (see `sweep`) stops dust
  * credits from churning a victim's spendable ciphertext, but every `_credit`
  * still appends a memo, and only the recipient can `clearMemos`. An attacker

package/token/FungibleToken.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.4.0-alpha.4 (token/FungibleToken.compact)
+// OpenZeppelin Compact Contracts v0.4.0-alpha.5 (token/FungibleToken.compact)
 
 pragma language_version >= 0.26.0;
 

package/token/MultiToken.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.4.0-alpha.4 (token/MultiToken.compact)
+// OpenZeppelin Compact Contracts v0.4.0-alpha.5 (token/MultiToken.compact)
 
 pragma language_version >= 0.26.0;
 

package/token/NativeShieldedToken.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.4.0-alpha.4 (token/NativeShieldedToken.compact)
+// OpenZeppelin Compact Contracts v0.4.0-alpha.5 (token/NativeShieldedToken.compact)
 
 pragma language_version >= 0.26.0;
 
@@ -232,7 +232,7 @@ module NativeShieldedToken {
    * ledger state: it is the contract's holding and is not otherwise
    * recoverable.
    *
-   * @constraints k=14, rows=16033
+   * @constraints k=14, rows=10221
    *
    * Requirements:
    *

package/token/NativeShieldedTokenCore.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.4.0-alpha.4 (token/NativeShieldedTokenCore.compact)
+// OpenZeppelin Compact Contracts v0.4.0-alpha.5 (token/NativeShieldedTokenCore.compact)
 
 pragma language_version >= 0.26.0;
 
@@ -51,9 +51,10 @@ pragma language_version >= 0.26.0;
  * The ledger accepts a contract-addressed commitment only if the recipient
  * contract's own call claims it as a shielded receive in the same transaction,
  * and no primitive claims a receive on another contract's behalf. So the
- * address arm is accepted only for `kernel.self()`, where `_mint` / `_burn`
- * claim the coin themselves in the same call. The flavors do not expose the
- * arm at all: they take a `ZswapCoinPublicKey` and offer `_mintToSelf` for
+ * address arm is accepted only for `kernel.self()`, which `mintShieldedToken`
+ * and `sendShielded` claim as a receive themselves. A `receiveShielded` on top
+ * emits a duplicate output for the same commitment. The flavors do not expose
+ * the arm at all: they take a `ZswapCoinPublicKey` and offer `_mintToSelf` for
  * contract-held coins.
  *
  * @dev Burn variants
@@ -235,7 +236,7 @@ module NativeShieldedTokenCore {
    * @dev The caller is fully responsible for nonce uniqueness. Reusing a
    * nonce for the same (domain, value, recipient) produces a duplicate
    * commitment, which the protocol rejects. A `right(kernel.self())` recipient
-   * is claimed via `receiveShielded` in this same call, so the consumer SHOULD
+   * is claimed by `mintShieldedToken` in this same call, so the consumer SHOULD
    * persist the returned coin info: it is the contract's holding and is not
    * otherwise recoverable.
    *
@@ -243,7 +244,7 @@ module NativeShieldedTokenCore {
    * recipient; callers SHOULD deliver it out of band. Wallets cannot detect
    * contract-minted coins by scanning the chain.
    *
-   * @constraints k=15, rows=16980
+   * @constraints k=14, rows=11109
    *
    * Requirements:
    *
@@ -269,12 +270,7 @@ module NativeShieldedTokenCore {
     assert(!Utils_isKeyOrAddressZero(recipient), "NativeShieldedToken: invalid recipient");
     assert(recipient.is_left || recipient.right == self, "NativeShieldedToken: recipient contract must be self");
 
-    const coin = mintShieldedToken(disclose(domain), disclose(amount), disclose(nonce), disclose(recipient));
-    if (disclose(!recipient.is_left)) {
-      receiveShielded(coin);
-    }
-
-    return coin;
+    return mintShieldedToken(disclose(domain), disclose(amount), disclose(nonce), disclose(recipient));
   }
 
   /**
@@ -289,14 +285,14 @@ module NativeShieldedTokenCore {
    * @dev The coin is received by the contract and spent in the same
    * transaction, so the spend goes through `sendImmediateShielded` (the
    * transient path). For coins the contract already holds, use
-   * `_burnFromSelf` instead. A `right(kernel.self())` refund is claimed via
-   * `receiveShielded` in this same call.
+   * `_burnFromSelf` instead. A `right(kernel.self())` refund is claimed by
+   * `sendImmediateShielded` in this same call.
    *
    * @notice The returned refund coin info is the only copy available to
    * `refundTo`; callers SHOULD deliver it out of band. Wallets cannot detect
    * contract-sent coins by scanning the chain.
    *
-   * @constraints k=16, rows=53639
+   * @constraints k=16, rows=47764
    *
    * Requirements:
    *
@@ -338,9 +334,6 @@ module NativeShieldedTokenCore {
         disclose(refundTo),
         disclose(sendRes.change.value.value)
       );
-      if (disclose(!refundTo.is_left)) {
-        receiveShielded(refundRes.sent);
-      }
       return some<ShieldedCoinInfo>(refundRes.sent);
     }
     return none<ShieldedCoinInfo>();

package/token/NativeShieldedTokenFamily.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.4.0-alpha.4 (token/NativeShieldedTokenFamily.compact)
+// OpenZeppelin Compact Contracts v0.4.0-alpha.5 (token/NativeShieldedTokenFamily.compact)
 
 pragma language_version >= 0.26.0;
 
@@ -230,7 +230,7 @@ module NativeShieldedTokenFamily {
    * ledger state: it is the contract's holding and is not otherwise
    * recoverable.
    *
-   * @constraints k=14, rows=16309
+   * @constraints k=14, rows=10497
    *
    * Requirements:
    *

package/token/NonFungibleToken.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.4.0-alpha.4 (token/NonFungibleToken.compact)
+// OpenZeppelin Compact Contracts v0.4.0-alpha.5 (token/NonFungibleToken.compact)
 
 pragma language_version >= 0.26.0;
 

package/token/extensions/ConfidentialFungibleTokenPublicSupply.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.4.0-alpha.4 (token/extensions/ConfidentialFungibleTokenPublicSupply.compact)
+// OpenZeppelin Compact Contracts v0.4.0-alpha.5 (token/extensions/ConfidentialFungibleTokenPublicSupply.compact)
 
 pragma language_version >= 0.26.0;
 

package/token/extensions/NativeShieldedTokenDerivedNonce.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.4.0-alpha.4 (token/extensions/NativeShieldedTokenDerivedNonce.compact)
+// OpenZeppelin Compact Contracts v0.4.0-alpha.5 (token/extensions/NativeShieldedTokenDerivedNonce.compact)
 
 pragma language_version >= 0.26.0;
 

package/utils/EvmAbi.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.4.0-alpha.4 (utils/EvmAbi.compact)
+// OpenZeppelin Compact Contracts v0.4.0-alpha.5 (utils/EvmAbi.compact)
 
 pragma language_version >= 0.26.0;
 

package/utils/Utils.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.4.0-alpha.4 (utils/Utils.compact)
+// OpenZeppelin Compact Contracts v0.4.0-alpha.5 (utils/Utils.compact)
 
 pragma language_version >= 0.26.0;