@openzeppelin/compact-contracts 0.4.0-alpha.4 → 0.4.0-alpha.6

package/README.md

@@ -191,7 +191,7 @@ Overall progress [====================] 14/14
 
 ZKIR v3: the library targets ZKIR v2, the compiler 0.34.0 default.
 Pass `--feature-zkir-v3` only when the contract reaches a module that needs it:
-the secp256k1-based `crypto/Ecdsa` and `multisig/EcdsaSignerManager`,
+the secp256k1-based `crypto/Ecdsa` and `multisig/Secp256k1EcdsaMultisig`,
 or the `keccak256`-based `crypto/Eip712`.
 `multisig/presets/ShieldedMultiSigV2`, `multisig/presets/NativeShieldedTokenIssuer`
 and the `multisig/examples/` contracts reach both.

package/access/AccessControl.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.4.0-alpha.4 (access/AccessControl.compact)
+// OpenZeppelin Compact Contracts v0.4.0-alpha.6 (access/AccessControl.compact)
 
 pragma language_version >= 0.26.0;
 

package/access/Ownable.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.4.0-alpha.4 (access/Ownable.compact)
+// OpenZeppelin Compact Contracts v0.4.0-alpha.6 (access/Ownable.compact)
 
 pragma language_version >= 0.26.0;
 

package/access/ShieldedAccessControl.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.4.0-alpha.4 (access/ShieldedAccessControl.compact)
+// OpenZeppelin Compact Contracts v0.4.0-alpha.6 (access/ShieldedAccessControl.compact)
 
 pragma language_version >= 0.26.0;
 

package/access/ZOwnablePK.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.4.0-alpha.4 (access/ZOwnablePK.compact)
+// OpenZeppelin Compact Contracts v0.4.0-alpha.6 (access/ZOwnablePK.compact)
 
 pragma language_version >= 0.26.0;
 
@@ -35,10 +35,17 @@ pragma language_version >= 0.26.0;
  * providing unlinkability across ownership changes.
  *
  * @dev Security Considerations:
- * - The `secretNonce` must be kept private. Loss of the nonce prevents the
- *   owner from proving ownership or transferring it.
+ * - `ownPublicKey()` is a witness: it returns the caller's Zswap coin public
+ *   key, and nothing proves the caller holds the matching private key. See
+ *   https://docs.midnight.network/compact/smart-contract-security#ownpublickey-is-a-witness-function.
+ * - The `secretNonce` is therefore the owner credential: the nonce and the
+ *   owner's public key are enough to pass `assertOnlyOwner`. Generate it as
+ *   32 bytes from a CSPRNG and keep it private. Losing it prevents the owner
+ *   from proving ownership or transferring it.
  * - Ownership validation is entirely circuit-based using witness-provided values.
  * - The `_instanceSalt` is immutable and used to differentiate deployments.
+ *   Use a fresh random value per deployment; a reused salt links the same
+ *   owner across deployments.
  *
  * @notice Best used for single-admin contracts with privacy requirements.
  * It is not designed for multi-owner or role-based access control.
@@ -99,12 +106,13 @@ module ZOwnablePK {
    * @warning The `ownerId` must be calculated prior to contract deployment using the SHA256 hashing algorithm.
    * Using any other algorithm will result in a permanent loss of contract access.
    *
-   * @constraints k=14, rows=14933
+   * @constraints k=13, rows=6765
    *
    * Requirements:
    *
    * - Contract is not initialized.
    * - `ownerId` is not zero.
+   * - `instanceSalt` is not zero.
    *
    * @param {Bytes<32>} ownerId - The owner's unique identifier SHA256(pk, nonce).
    * @param {Bytes<32>} instanceSalt - Contract salt to prevent duplicate commitments if
@@ -116,6 +124,7 @@ module ZOwnablePK {
     _isInitialized = true;
 
     assert(ownerId != default<Bytes<32>>, "ZOwnablePK: invalid id");
+    assert(instanceSalt != default<Bytes<32>>, "ZOwnablePK: invalid salt");
     _instanceSalt = disclose(instanceSalt);
     _transferOwnership(ownerId);
   }

package/crypto/EcdhMask.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.4.0-alpha.4 (crypto/EcdhMask.compact)
+// OpenZeppelin Compact Contracts v0.4.0-alpha.6 (crypto/EcdhMask.compact)
 
 pragma language_version >= 0.26.0;
 

package/crypto/Ecdsa.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.4.0-alpha.4 (crypto/Ecdsa.compact)
+// OpenZeppelin Compact Contracts v0.4.0-alpha.6 (crypto/Ecdsa.compact)
 
 pragma language_version >= 0.26.0;
 

package/crypto/Eip712.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.4.0-alpha.4 (crypto/Eip712.compact)
+// OpenZeppelin Compact Contracts v0.4.0-alpha.6 (crypto/Eip712.compact)
 
 pragma language_version >= 0.26.0;
 

package/crypto/ElGamal.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.4.0-alpha.4 (crypto/ElGamal.compact)
+// OpenZeppelin Compact Contracts v0.4.0-alpha.6 (crypto/ElGamal.compact)
 
 pragma language_version >= 0.26.0;
 

package/multisig/ForwarderPrivate.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.4.0-alpha.4 (multisig/ForwarderPrivate.compact)
+// OpenZeppelin Compact Contracts v0.4.0-alpha.6 (multisig/ForwarderPrivate.compact)
 
 pragma language_version >= 0.26.0;
 

package/multisig/ForwarderShielded.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.4.0-alpha.4 (multisig/ForwarderShielded.compact)
+// OpenZeppelin Compact Contracts v0.4.0-alpha.6 (multisig/ForwarderShielded.compact)
 
 pragma language_version >= 0.26.0;
 
@@ -41,6 +41,11 @@ pragma language_version >= 0.26.0;
  * coins. Forwarding to a key no one controls strands every deposit
  * permanently. The zero-key guard rejects only the all-zero key, not an
  * otherwise-unspendable one.
+ *
+ * @notice The depositor must encrypt the forwarded output to the parent's
+ * encryption public key, obtained off-chain. The ledger cannot check that
+ * key against `_parent`, so a wrong or missing key leaves the coin
+ * spendable by the parent but invisible to its wallet.
  */
 module ForwarderShielded {
   import CompactStandardLibrary;
@@ -103,20 +108,24 @@ module ForwarderShielded {
    * `sendImmediateShielded` to the stored parent recipient (always the
    * `left` / coin-public-key arm today).
    *
-   * @constraints k=15, rows=24373
+   * @constraints k=15, rows=23197
    *
    * Requirements:
    *
    * - Contract must be initialized.
+   * - The forwarded output must be encrypted to the parent's encryption
+   *   public key (see the module header). If unsure, hand the returned
+   *   `ShieldedSendResult` to the parent so it can recover the coin.
    *
    * @param {ShieldedCoinInfo} coin - The incoming shielded coin.
    *
-   * @returns {[]} Empty tuple.
+   * @returns {ShieldedSendResult} The coin sent to the parent, with no change:
+   * the whole value is forwarded.
    */
-  export circuit _deposit(coin: ShieldedCoinInfo): [] {
+  export circuit _deposit(coin: ShieldedCoinInfo): ShieldedSendResult {
     assertInitialized();
     receiveShielded(disclose(coin));
-    sendImmediateShielded(disclose(coin), _parent, disclose(coin.value));
+    return sendImmediateShielded(disclose(coin), _parent, disclose(coin.value));
   }
 
   // ─── Init guards ────────────────────────────────────────────────

package/multisig/ForwarderUnshielded.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.4.0-alpha.4 (multisig/ForwarderUnshielded.compact)
+// OpenZeppelin Compact Contracts v0.4.0-alpha.6 (multisig/ForwarderUnshielded.compact)
 
 pragma language_version >= 0.26.0;
 

package/multisig/ProposalManager.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.4.0-alpha.4 (multisig/ProposalManager.compact)
+// OpenZeppelin Compact Contracts v0.4.0-alpha.6 (multisig/ProposalManager.compact)
 
 pragma language_version >= 0.26.0;
 

package/multisig/Secp256k1EcdsaMultisig.compact

@@ -0,0 +1,275 @@
+// SPDX-License-Identifier: MIT
+// OpenZeppelin Compact Contracts v0.4.0-alpha.6 (multisig/Secp256k1EcdsaMultisig.compact)
+
+pragma language_version >= 0.26.0;
+
+/**
+ * @module Secp256k1EcdsaMultisig<#t>
+ * @description
+ * A `t`-of-`n` accountable multisignature over secp256k1 ECDSA: `n` signer
+ * commitments are registered at deploy, and a call passes when `t` distinct
+ * registered signers have signed the digest. The threshold `t` is the module
+ * generic, so it is also the approval count every gated call carries.
+ *
+ * @dev Notation:
+ * - `H(...)`: `persistentHash` (SHA-256), a `Bytes<32>` digest.
+ * - `cm = H(pkX, pkY, salt, "Secp256k1EcdsaMultisig:signer")`: a signer
+ *   commitment, over the affine coordinates of the secp256k1 public key.
+ * - `n`: signers registered at `initialize`.
+ * - `t`: the threshold and the `assertApprovals` width.
+ *
+ * @dev Derivations:
+ * `H` hashes the `SignerCommitmentInput` struct in Compact's encoding, not a
+ * byte concatenation. Do not reimplement it: `calculateSignerId` is the
+ * exported pure circuit, and the consumer test suites pin its vectors. A
+ * wrong derivation registers commitments no key can satisfy.
+ *
+ * @dev Parameterization:
+ * `t` is fixed at import (`import "./Secp256k1EcdsaMultisig"<2> prefix
+ * Secp256k1EcdsaMultisig_;`) and `n` per `initialize<#n>` call. `Signer`
+ * enforces `n >= t` at `initialize`. No circuit takes a threshold argument.
+ * `t = 0` does not compile.
+ *
+ * @dev Compatibility:
+ * The wire format is the `Secp256k1EcdsaMultisig:signer` domain, the
+ * `SignerCommitmentInput` layout, and the salt. Changing any of them orphans
+ * every registered signer set. The digest is the consumer's and is not part
+ * of this module's format.
+ *
+ * @notice Privacy:
+ * - Public, per tx: the `t` commitments (`disclose(commitment)` in
+ *   `Signer_assertSigner`), so WHICH signers approved.
+ * - Public, as state: `_signers`, `_signerCount`, `_threshold`,
+ *   `_instanceSalt`. All exported.
+ * - Private: public keys and signatures, verified in-circuit and never
+ *   disclosed; the digest, beyond what the consumer publishes.
+ * - Signer identity: keys sit behind `cm` with a public salt, so an observer
+ *   holding a candidate key can test membership; one without cannot
+ *   correlate a signer across deployments.
+ *
+ * @notice Security:
+ * - Order: `assertApprovals` runs `Signer_assertThresholdMet(t)` first, so an
+ *   uninitialized registry fails before any signature work. Then pairwise
+ *   distinct commitments, then per entry a registered commitment and a valid
+ *   signature.
+ * - Low-s: verification goes through `Ecdsa_secp256k1EcdsaVerifyLowS`, so a
+ *   high-s encoding is an invalid signature.
+ * - Distinct signers: all `t(t-1)/2` pairs are compared, so no key counts
+ *   twice.
+ * - Bounds: `Signer` rejects `t > n` at `initialize`.
+ * - Once-only: `initialize` rejects a second call while signers are
+ *   registered, and writes the `sealed` salt, so it is constructor-only.
+ * - Immutable to the deployed circuit set: no signer or threshold change is
+ *   exported. Losing more than `n - t` keys freezes every gated circuit.
+ * - Digest binding is the consumer's: this module verifies signatures over
+ *   whatever `msgHash` it is handed. Replay, domain and instance binding
+ *   belong in the digest.
+ * - Atomicity: a failed assert rejects the whole tx before any state moves,
+ *   and the sender pays no fee.
+ *
+ * @notice Concurrency:
+ * - Every read (`_threshold`, `_signers.member(cm)`, `_instanceSalt`) is
+ *   state written only by `initialize`, so `assertApprovals` and the views
+ *   commute with everything, including each other.
+ *
+ * @notice Scope:
+ * Registry and verification only: no digest construction, no nonce, no
+ * roles, no signer rotation. The consumer builds the digest and gates its
+ * circuits with `assertApprovals`.
+ *
+ * @notice Client-side duties:
+ * - Before deploy: pick a random `instanceSalt`, derive each `cm` with
+ *   `calculateSignerId(pk, salt)`, pass them as `signerCommitments`.
+ * - Per call: collect exactly `t` low-s signatures from distinct signers over
+ *   the consumer's digest, submit keys and signatures in matching `Vector<t>`
+ *   positions.
+ *
+ * @dev Performance:
+ * - Cost is per entry: one ECDSA verify and one `H` for each of the `t`
+ *   approvals, plus `t(t-1)/2` `Bytes<32>` compares.
+ * - `assertApprovals` (zkir-v3): `t = 1` is k=16, rows=40538; `t = 2` is
+ *   k=17, rows=64908; `t = 3` is k=17, rows=94995.
+ *
+ * @dev Composition:
+ * - Import this module at exactly one width per contract. Two widths
+ *   instantiate two `Secp256k1EcdsaMultisig` modules over one shared
+ *   `Signer<Bytes<32>>` registry, so the second `initialize` trips the
+ *   once-only guard and that width's `_instanceSalt` is never written.
+ * - Do not import `Signer` alongside this module. A direct import
+ *   instantiates a separate registry that `assertApprovals` never reads.
+ */
+module Secp256k1EcdsaMultisig<#t> {
+  import CompactStandardLibrary;
+  import "../crypto/Ecdsa" prefix Ecdsa_;
+  import "./Signer"<Bytes<32>> prefix Signer_;
+
+  // Named import/re-export of the registry state only, so a consuming
+  // contract's ledger keys read as `_signers` rather than `Signer__signers`.
+  // The circuits stay behind the `Signer_` prefix.
+  import { _signers, _signerCount, _threshold } from "./Signer"<Bytes<32>>;
+  export { _signers, _signerCount, _threshold };
+
+  /**
+   * @description Deployment-supplied salt for signer commitments. Set at
+   * initialization and never changed. The registered commitments must have been
+   * derived under this same salt.
+   */
+  export sealed ledger _instanceSalt: Bytes<32>;
+
+  /**
+   * @description Input to `persistentHash` for computing signer commitments.
+   */
+  struct SignerCommitmentInput {
+    pkX: Bytes<32>,
+    pkY: Bytes<32>,
+    salt: Bytes<32>,
+    domain: Bytes<32>
+  }
+
+  /**
+   * @description Stores the instance salt and registers the signer set at
+   * threshold `t`. Call from the consuming contract's constructor only.
+   * Writes the `sealed` salt, so it cannot be reached from an exported
+   * circuit. The set is final: signers must be known at deploy and no circuit
+   * adds, removes or replaces one afterwards.
+   *
+   * Requirements:
+   *
+   * - Can only be called once.
+   * - `instanceSalt` should be cryptographically random.
+   * - `signerCommitments` must not contain duplicates.
+   * - `n` must be at least `t`.
+   *
+   * @param {Bytes<32>} instanceSalt - Per-deployment salt for commitment derivation.
+   * @param {Vector<n, Bytes<32>>} signerCommitments - Hashed signer identities.
+   * @returns {[]} Empty tuple.
+   */
+  export circuit initialize<#n>(
+    instanceSalt: Bytes<32>,
+    signerCommitments: Vector<n, Bytes<32>>
+  ): [] {
+    assert(Signer_getSignerCount() == 0, "Secp256k1EcdsaMultisig: signers already registered");
+    _instanceSalt = disclose(instanceSalt);
+
+    for (const commitment of signerCommitments) {
+      Signer__addSigner(commitment);
+    }
+    Signer__changeThreshold(t);
+  }
+
+  /**
+   * @description Verifies `t` approvals over `msgHash`: distinct registered
+   * signers, each with a valid low-s signature.
+   *
+   * `pubkeys` and `signatures` are parallel: entry `i` of each belongs to the
+   * same signer.
+   *
+   * Requirements:
+   *
+   * - The module must be initialized.
+   * - No two entries may be the same signer.
+   * - Every public key must hash to a registered signer commitment.
+   * - Every signature must be valid over `msgHash` and use the low-s encoding.
+   *
+   * @param {Bytes<32>} msgHash - The digest the signers approved.
+   * @param {Vector<t, Secp256k1Point>} pubkeys - Public keys of approving signers.
+   * @param {Vector<t, Secp256k1EcdsaSignature>} signatures - Signatures over `msgHash`.
+   * @returns {[]} Empty tuple.
+   */
+  export circuit assertApprovals(
+    msgHash: Bytes<32>,
+    pubkeys: Vector<t, Secp256k1Point>,
+    signatures: Vector<t, Secp256k1EcdsaSignature>
+  ): [] {
+    Signer_assertThresholdMet(t);
+
+    const commitments = map(signerCommitment, pubkeys);
+
+    for (const i of 0..t) {
+      for (const j of 0..t) {
+        if (i < j) {
+          assert(commitments[i] != commitments[j], "Secp256k1EcdsaMultisig: duplicate signer");
+        }
+      }
+    }
+
+    for (const i of 0..t) {
+      Signer_assertSigner(commitments[i]);
+      assert(
+        Ecdsa_secp256k1EcdsaVerifyLowS(msgHash, signatures[i], pubkeys[i]),
+        "Secp256k1EcdsaMultisig: invalid signature"
+      );
+    }
+  }
+
+  /**
+   * @description `map` callback. Commits `pk` under the instance salt.
+   *
+   * @param {Secp256k1Point} pk - The signer's secp256k1 public key.
+   * @returns {Bytes<32>} The signer commitment.
+   */
+  circuit signerCommitment(pk: Secp256k1Point): Bytes<32> {
+    return calculateSignerId(pk, _instanceSalt);
+  }
+
+  /**
+   * @description Computes a signer commitment from a secp256k1 public key,
+   * as `persistentHash(pkX, pkY, salt, "Secp256k1EcdsaMultisig:signer")`.
+   *
+   * Pure, so the deployer can derive constructor commitments off-chain the
+   * same way the circuits derive them in-circuit.
+   *
+   * Requirements:
+   *
+   * - `pk` must not be the secp256k1 identity point, which has no coordinates.
+   *
+   * @param {Secp256k1Point} pk - The secp256k1 public key.
+   * @param {Bytes<32>} salt - The instance salt.
+   * @returns {Bytes<32>} The signer commitment.
+   */
+  export pure circuit calculateSignerId(
+    pk: Secp256k1Point,
+    salt: Bytes<32>
+  ): Bytes<32> {
+    return persistentHash<SignerCommitmentInput>(SignerCommitmentInput {
+      pkX: secp256k1PointX(pk) as Bytes<32>,
+      pkY: secp256k1PointY(pk) as Bytes<32>,
+      salt: salt,
+      domain: pad(32, "Secp256k1EcdsaMultisig:signer")
+    });
+  }
+
+  /**
+   * @description Returns the number of registered signers.
+   *
+   * @constraints k=6, rows=34 (zkir-v3)
+   *
+   * @returns {Uint<8>} The signer count.
+   */
+  export circuit getSignerCount(): Uint<8> {
+    return Signer_getSignerCount();
+  }
+
+  /**
+   * @description Returns the approval threshold.
+   *
+   * @constraints k=6, rows=34 (zkir-v3)
+   *
+   * @returns {Uint<8>} The threshold.
+   */
+  export circuit getThreshold(): Uint<8> {
+    return Signer_getThreshold();
+  }
+
+  /**
+   * @description Returns whether the given commitment is a registered signer.
+   *
+   * @constraints k=8, rows=129 (zkir-v3)
+   *
+   * @param {Bytes<32>} commitment - The signer commitment to check.
+   * @returns {Boolean} True if registered.
+   */
+  export circuit isSigner(commitment: Bytes<32>): Boolean {
+    return Signer_isSigner(commitment);
+  }
+}

package/multisig/ShieldedTreasury.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.4.0-alpha.4 (multisig/ShieldedTreasury.compact)
+// OpenZeppelin Compact Contracts v0.4.0-alpha.6 (multisig/ShieldedTreasury.compact)
 
 pragma language_version >= 0.26.0;
 

package/multisig/ShieldedTreasuryStateless.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.4.0-alpha.4 (multisig/ShieldedTreasuryStateless.compact)
+// OpenZeppelin Compact Contracts v0.4.0-alpha.6 (multisig/ShieldedTreasuryStateless.compact)
 
 pragma language_version >= 0.26.0;
 

package/multisig/Signer.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.4.0-alpha.4 (multisig/Signer.compact)
+// OpenZeppelin Compact Contracts v0.4.0-alpha.6 (multisig/Signer.compact)
 
 pragma language_version >= 0.26.0;
 

package/multisig/UnshieldedTreasury.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.4.0-alpha.4 (multisig/UnshieldedTreasury.compact)
+// OpenZeppelin Compact Contracts v0.4.0-alpha.6 (multisig/UnshieldedTreasury.compact)
 
 pragma language_version >= 0.26.0;
 
@@ -90,8 +90,7 @@ module UnshieldedTreasury {
   // ─── Send ───────────────────────────────────────────────────────
 
   /**
-   * @description Sends unshielded tokens from the treasury. Zero-amount sends
-   * are permitted and are value-preserving no-ops.
+   * @description Sends unshielded tokens from the treasury.
    *
    * @warning Recipients are not validated. An unspendable recipient (such as a
    * zero address) is accepted and permanently removes the funds from the
@@ -111,6 +110,7 @@ module UnshieldedTreasury {
    *
    * Requirements:
    *
+   * - The amount must be non-zero. The ledger rejects zero-value outputs.
    * - The treasury must hold sufficient balance for the given token color.
    *
    * @param {Either<ContractAddress, UserAddress>} recipient - The recipient address.
@@ -124,6 +124,8 @@ module UnshieldedTreasury {
     color: Bytes<32>,
     amount: Uint<128>
   ): [] {
+    assert(amount != 0, "UnshieldedTreasury: zero amount");
+
     const bal = getTokenBalance(color);
     assert(bal >= amount, "UnshieldedTreasury: insufficient balance");
 

package/multisig/examples/ForwarderPrivateExample.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.4.0-alpha.4 (multisig/examples/ForwarderPrivateExample.compact)
+// OpenZeppelin Compact Contracts v0.4.0-alpha.6 (multisig/examples/ForwarderPrivateExample.compact)
 
 pragma language_version >= 0.26.0;
 

package/multisig/examples/ForwarderShieldedExample.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.4.0-alpha.4 (multisig/examples/ForwarderShieldedExample.compact)
+// OpenZeppelin Compact Contracts v0.4.0-alpha.6 (multisig/examples/ForwarderShieldedExample.compact)
 
 pragma language_version >= 0.26.0;
 
@@ -24,7 +24,7 @@ pragma language_version >= 0.26.0;
 import CompactStandardLibrary;
 import "../ForwarderShielded" prefix Forwarder_;
 
-export { ZswapCoinPublicKey, ContractAddress, ShieldedCoinInfo, Either };
+export { ZswapCoinPublicKey, ContractAddress, ShieldedCoinInfo, ShieldedSendResult, Maybe, Either };
 
 /**
  * @description Deploys the forwarder bound to a specific parent
@@ -42,12 +42,15 @@ constructor(parent: ZswapCoinPublicKey) {
  * the configured parent. The coin is claimed via `receiveShielded` and
  * immediately re-sent via `sendImmediateShielded`.
  *
+ * The depositor must encrypt the forwarded output to the parent's
+ * encryption public key (see the `ForwarderShielded` header).
+ *
  * @param {ShieldedCoinInfo} coin - The incoming shielded coin.
  *
- * @returns {[]} Empty tuple.
+ * @returns {ShieldedSendResult} The coin sent to the parent, with no change.
  */
-export circuit deposit(coin: ShieldedCoinInfo): [] {
-  Forwarder__deposit(coin);
+export circuit deposit(coin: ShieldedCoinInfo): ShieldedSendResult {
+  return Forwarder__deposit(coin);
 }
 
 /**

package/multisig/examples/ForwarderUnshieldedExample.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.4.0-alpha.4 (multisig/examples/ForwarderUnshieldedExample.compact)
+// OpenZeppelin Compact Contracts v0.4.0-alpha.6 (multisig/examples/ForwarderUnshieldedExample.compact)
 
 pragma language_version >= 0.26.0;
 

package/multisig/examples/NativeShieldedTokenIssuerExample.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.4.0-alpha.4 (multisig/examples/NativeShieldedTokenIssuerExample.compact)
+// OpenZeppelin Compact Contracts v0.4.0-alpha.6 (multisig/examples/NativeShieldedTokenIssuerExample.compact)
 
 pragma language_version >= 0.26.0;
 
@@ -11,13 +11,15 @@ pragma language_version >= 0.26.0;
  * (`mintToSelf`), and leaves only through an ECDSA-authorized burn, of a
  * holder's coin (`burn`) or of one the contract holds (`burnFromSelf`).
  *
- * The token is non-transferable by construction. There is no transfer circuit,
- * so a holder's only exit is to pay the coin into a `burn` tx.
+ * Coins minted to holders are ordinary Zswap coins: holders transfer them
+ * through Zswap without the issuer's involvement and redeem by paying one
+ * into a `burn` tx. Only contract-held coins are locked. No send circuit
+ * exists, so they leave through `burnFromSelf` alone.
  */
 
 import CompactStandardLibrary;
 
-import "../presets/NativeShieldedTokenIssuer" prefix NativeShieldedTokenIssuer_;
+import "../presets/NativeShieldedTokenIssuer"<2> prefix NativeShieldedTokenIssuer_;
 
 export { ZswapCoinPublicKey, ContractAddress, Either, Maybe };
 export { ShieldedCoinInfo, QualifiedShieldedCoinInfo };
@@ -37,7 +39,7 @@ import {
   _symbol,
   _decimals,
   _isInitialized,
-} from "../presets/NativeShieldedTokenIssuer";
+} from "../presets/NativeShieldedTokenIssuer"<2>;
 export {
   _counter,
   _domainSeparator,
@@ -77,7 +79,7 @@ constructor(
   decimals_: Uint<8>,
   signerCommitments: Vector<3, Bytes<32>>,
 ) {
-  NativeShieldedTokenIssuer_initialize(
+  NativeShieldedTokenIssuer_initialize<3>(
     instanceSalt,
     tokenDomain,
     name_,
@@ -113,7 +115,7 @@ export circuit mintToSelf(
 
 export circuit burn(
   coin: ShieldedCoinInfo,
-  amount: Uint<64>,
+  amount: Uint<128>,
   refundTo: ZswapCoinPublicKey,
   pubkeys: Vector<2, Secp256k1Point>,
   signatures: Vector<2, Secp256k1EcdsaSignature>
@@ -123,7 +125,7 @@ export circuit burn(
 
 export circuit burnFromSelf(
   coin: QualifiedShieldedCoinInfo,
-  amount: Uint<64>,
+  amount: Uint<128>,
   pubkeys: Vector<2, Secp256k1Point>,
   signatures: Vector<2, Secp256k1EcdsaSignature>
 ): Maybe<ShieldedCoinInfo> {