@openzeppelin/compact-contracts 0.4.0-alpha.4 → 0.4.0-alpha.6

package/token/presets/ZOwnableNativeShieldedToken.compact

@@ -0,0 +1,314 @@
+// SPDX-License-Identifier: MIT
+// OpenZeppelin Compact Contracts v0.4.0-alpha.4 (token/presets/ZOwnableNativeShieldedToken.compact)
+
+pragma language_version >= 0.26.0;
+
+/**
+ * @module ZOwnableNativeShieldedToken
+ * @description
+ * A native shielded token with a single shielded owner. Only the owner mints
+ * (to a coin public key, with a caller-supplied nonce) and burns (a coin the
+ * owner's wallet pays into the tx). Minted amounts are counted on-chain.
+ *
+ * Composes `ZOwnablePK` as `ZOwnablePK_` (owner commitment),
+ * `NativeShieldedToken` as `NST_` (one token color) and
+ * `NativeShieldedTokenPublicSupply` as `NSTPublicSupply_` (minted total).
+ *
+ * @dev Derivations:
+ * - `H<T>(...)`: `persistentHash<T>`.
+ * - Owner id: `id = H<Vector<2, Bytes<32>>>([pk.bytes, secretNonce])`.
+ * - Owner commitment: `H<Vector<4, Bytes<32>>>([id, instanceSalt,
+ *   counter as Field as Bytes<32>, pad(32, "ZOwnablePK:shield:")])`.
+ * - Token color: `tokenType(_domain, kernel.self())`.
+ *
+ * @notice Implementing contracts call `initialize` from their constructor and
+ * MUST NOT import the composed modules directly.
+ *
+ * @notice Privacy:
+ * - Public, per tx: every mint amount (the Zswap mint effect and
+ *   `_totalMinted`), the coin commitments and nullifiers, and which circuit
+ *   ran.
+ * - Public, as state: `_ownerCommitment`, `_counter` (the number of ownership
+ *   changes), `_instanceSalt`, `_totalMinted`, `_domain`, `_name`, `_symbol`,
+ *   `_decimals`.
+ * - Private: mint `recipient` and `nonce`. Burn `amount`, `coin` and
+ *   `refundTo`, as long as the observer does not know the coin's nonce. A change
+ *   output reveals that a burn was partial.
+ * - Owner: stored as a commitment to `id`; the key and nonce never leave the
+ *   proof.
+ *
+ * @notice Security:
+ * - Owner check: proves knowledge of a `(pk, secretNonce)` whose commitment
+ *   matches. `ownPublicKey()` is prover-supplied, so the check does not bind
+ *   the submitting wallet; `secretNonce` is the only secret.
+ * - Every mutating circuit checks ownership before any token check.
+ * - `transferOwnership` is one step; a wrong `newOwnerId` loses the contract.
+ * - `renounceOwnership` stops mint and burn forever.
+ * - Upgrades: the CMA can replace any circuit's verifier key, so it sits
+ *   above the owner and should not be a single key.
+ * - A failed assert rejects the whole tx; no state moves.
+ *
+ * @notice Concurrency:
+ * - `mint` reads and writes `_totalMinted`; the read pins it, so at most one
+ *   mint lands per block.
+ * - `burn` only reads owner state: burns commute with each other and with one
+ *   mint.
+ * - `transferOwnership` / `renounceOwnership` write the owner commitment and
+ *   conflict with every owner-gated call and `owner()` in the same block.
+ * - Metadata views and `totalMinted` read no owner state; `totalMinted`
+ *   submitted as a tx conflicts with a same-block mint.
+ * - A tx that loses a same-block race fails and must be re-proven against
+ *   the new state.
+ *
+ * @notice Scope:
+ * Mint and burn only. Holders transfer through Zswap directly. No roles,
+ * freeze, seize, contract-held coins, burned total or total supply.
+ *
+ * @notice Client-side duties:
+ * - Build every owner tx with the coin public key in the current `ownerId`
+ *   and the matching `wit_secretNonce`. A wrong nonce fails the ownership
+ *   check and reveals nothing.
+ * - `ownPublicKey()` is supplied by the client like a witness; the circuit
+ *   cannot check that it belongs to the submitting wallet. The client is
+ *   responsible for supplying the coin public key that is in the current
+ *   `ownerId`; any other key fails the ownership check.
+ * - Compute `ownerId` off-chain with `_computeOwnerId`.
+ * - `nonce` must be fresh random bytes per mint.
+ * - Persist the coin infos `mint` and `burn` return. midnight-js encrypts an
+ *   output to its recipient only when it can resolve the recipient's
+ *   encryption key (its own, or one given in
+ *   `additionalCoinEncPublicKeyMappings`).
+ * - Run the proof server where the owner controls it; it sees
+ *   `wit_secretNonce`.
+ *
+ * @dev Composition:
+ * - Burn accounting: calling `NSTPublicSupply__addBurned` in `burn` would
+ *   publish every burn amount.
+ */
+module ZOwnableNativeShieldedToken {
+  import CompactStandardLibrary;
+
+  import "../../access/ZOwnablePK" prefix ZOwnablePK_;
+  import "../NativeShieldedToken" prefix NST_;
+  import "../extensions/NativeShieldedTokenPublicSupply" prefix NSTPublicSupply_;
+
+  // Named import/re-export of the composed modules' state only, so an
+  // implementing contract can surface every ledger field under its own key.
+  // The circuits stay behind the prefixes above. The ownable flag is aliased
+  // because the token module already owns `_isInitialized`.
+  // `_totalBurned` is never written, so it stays empty.
+  import { _ownerCommitment, _counter, _instanceSalt, _isInitialized as _ownableIsInitialized } from "../../access/ZOwnablePK";
+  import { _domain, _name, _symbol, _decimals, _isInitialized } from "../NativeShieldedToken";
+  import { _totalMinted, _totalBurned } from "../extensions/NativeShieldedTokenPublicSupply";
+  
+  export { _ownerCommitment, _counter, _instanceSalt, _ownableIsInitialized };
+  export { _domain, _name, _symbol, _decimals, _isInitialized };
+  export { _totalMinted, _totalBurned };
+
+  /**
+   * @description Sets the owner and the token's domain and metadata.
+   *
+   * @notice Call from the implementing contract's constructor only. It writes
+   * sealed fields, so implementing contracts MUST NOT expose it as a
+   * post-deploy circuit.
+   *
+   * @warning `ownerId` must be `_computeOwnerId(pk, secretNonce)` for the coin
+   * public key the owner's wallet will supply as `ownPublicKey()`. The circuit
+   * cannot check this at deploy; any other key leaves the contract with no
+   * usable owner and no recovery.
+   *
+   * Requirements:
+   *
+   * - Contract is not initialized.
+   * - `ownerId` is not zero.
+   *
+   * @param {Bytes<32>} ownerId - `_computeOwnerId(pk, secretNonce)` of the owner.
+   * @param {Bytes<32>} instanceSalt - Random per-deployment salt for the owner commitment.
+   * @param {Bytes<32>} tokenDomain - Domain of this contract's token color.
+   * @param {Opaque<"string">} name_ - The token name.
+   * @param {Opaque<"string">} symbol_ - The token symbol.
+   * @param {Uint<8>} decimals_ - The token decimals.
+   */
+  export circuit initialize(
+    ownerId: Bytes<32>,
+    instanceSalt: Bytes<32>,
+    tokenDomain: Bytes<32>,
+    name_: Opaque<"string">,
+    symbol_: Opaque<"string">,
+    decimals_: Uint<8>,
+  ): [] {
+    ZOwnablePK_initialize(ownerId, instanceSalt);
+    NST_initialize(tokenDomain, name_, symbol_, decimals_);
+  }
+
+  /**
+   * @description Mints `amount` to `recipient` and adds it to the minted total.
+   * Owner only.
+   *
+   * @constraints k=15, rows=21252
+   *
+   * Requirements:
+   *
+   * - Caller is the owner.
+   * - `recipient` is not zero.
+   *
+   * @param {ZswapCoinPublicKey} recipient - Coin public key that receives the coin.
+   * @param {Uint<64>} amount - Amount to mint.
+   * @param {Bytes<32>} nonce - Fresh random bytes per mint.
+   * @returns {ShieldedCoinInfo} The minted coin; persist it.
+   */
+  export circuit mint(recipient: ZswapCoinPublicKey, amount: Uint<64>, nonce: Bytes<32>): ShieldedCoinInfo {
+    ZOwnablePK_assertOnlyOwner();
+    const coin = NST__mint(recipient, amount, nonce);
+    NSTPublicSupply__addMinted(amount);
+    return coin;
+  }
+
+  /**
+   * @description Burns `amount` of `coin`, paid into the tx by the caller's
+   * wallet, and refunds the rest to `refundTo`. Owner only.
+   *
+   * @constraints k=16, rows=51814
+   *
+   * Requirements:
+   *
+   * - Caller is the owner.
+   * - `coin.color` is this token's color.
+   * - `amount` <= `coin.value`.
+   * - `refundTo` is not zero.
+   *
+   * @param {ShieldedCoinInfo} coin - Coin of this token, paid into the tx by the caller's wallet.
+   * @param {Uint<64>} amount - Amount to burn from `coin`.
+   * @param {ZswapCoinPublicKey} refundTo - Coin public key that receives the change.
+   * @returns {Maybe<ShieldedCoinInfo>} The refund coin, or `none` on a full burn.
+   */
+  export circuit burn(coin: ShieldedCoinInfo, amount: Uint<64>, refundTo: ZswapCoinPublicKey): Maybe<ShieldedCoinInfo> {
+    ZOwnablePK_assertOnlyOwner();
+    return NST__burn(coin, amount, refundTo);
+  }
+
+  /**
+   * @description Transfers ownership to `newOwnerId`. Owner only.
+   *
+   * @warning `newOwnerId` must be `_computeOwnerId(pk, secretNonce)` for the
+   * coin public key the new owner's wallet will supply as `ownPublicKey()`.
+   * The circuit cannot check this; any other key leaves the contract with no
+   * usable owner and no recovery.
+   *
+   * @constraints k=15, rows=17023
+   *
+   * Requirements:
+   *
+   * - Caller is the owner.
+   * - `newOwnerId` is not zero.
+   *
+   * @param {Bytes<32>} newOwnerId - `_computeOwnerId(pk, secretNonce)` of the new owner.
+   */
+  export circuit transferOwnership(newOwnerId: Bytes<32>): [] {
+    ZOwnablePK_transferOwnership(newOwnerId);
+  }
+
+  /**
+   * @description Clears the owner. Owner only.
+   *
+   * @warning Irreversible: mint and burn stop forever.
+   *
+   * @constraints k=14, rows=10579
+   *
+   * Requirements:
+   *
+   * - Caller is the owner.
+   */
+  export circuit renounceOwnership(): [] {
+    ZOwnablePK_renounceOwnership();
+  }
+
+  /**
+   * @description Returns the current owner commitment.
+   *
+   * @constraints k=6, rows=48
+   *
+   * Requirements:
+   *
+   * - Contract is initialized.
+   */
+  export circuit owner(): Bytes<32> {
+    return ZOwnablePK_owner();
+  }
+
+  /**
+   * @description Returns the owner id `H(pk, nonce)`.
+   *
+   * Requirements:
+   *
+   * - `pk` is a coin public key.
+   *
+   * @param {Either<ZswapCoinPublicKey, ContractAddress>} pk - The owner's coin public key.
+   * @param {Bytes<32>} nonce - The owner's secret nonce.
+   */
+  export pure circuit _computeOwnerId(pk: Either<ZswapCoinPublicKey, ContractAddress>, nonce: Bytes<32>): Bytes<32> {
+    return ZOwnablePK__computeOwnerId(pk, nonce);
+  }
+
+  /**
+   * @description Returns the total amount ever minted.
+   *
+   * @constraints k=7, rows=63
+   */
+  export circuit totalMinted(): Uint<128> {
+    return NSTPublicSupply_totalMinted();
+  }
+
+  /**
+   * @description Returns the token name.
+   *
+   * @constraints k=6, rows=26
+   *
+   * Requirements:
+   *
+   * - Contract is initialized.
+   */
+  export circuit name(): Opaque<"string"> {
+    return NST_name();
+  }
+
+  /**
+   * @description Returns the token symbol.
+   *
+   * @constraints k=6, rows=26
+   *
+   * Requirements:
+   *
+   * - Contract is initialized.
+   */
+  export circuit symbol(): Opaque<"string"> {
+    return NST_symbol();
+  }
+
+  /**
+   * @description Returns the token decimals.
+   *
+   * @constraints k=6, rows=26
+   *
+   * Requirements:
+   *
+   * - Contract is initialized.
+   */
+  export circuit decimals(): Uint<8> {
+    return NST_decimals();
+  }
+
+  /**
+   * @description Returns this contract's token color,
+   * `tokenType(tokenDomain, kernel.self())`.
+   *
+   * @constraints k=13, rows=3962
+   *
+   * Requirements:
+   *
+   * - Contract is initialized.
+   */
+  export circuit tokenColor(): Bytes<32> {
+    return NST_tokenColor();
+  }
+}

package/utils/EvmAbi.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.4.0-alpha.4 (utils/EvmAbi.compact)
+// OpenZeppelin Compact Contracts v0.4.0-alpha.6 (utils/EvmAbi.compact)
 
 pragma language_version >= 0.26.0;
 

package/utils/Utils.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.4.0-alpha.4 (utils/Utils.compact)
+// OpenZeppelin Compact Contracts v0.4.0-alpha.6 (utils/Utils.compact)
 
 pragma language_version >= 0.26.0;
 

package/multisig/EcdsaSignerManager.compact

@@ -1,246 +0,0 @@
-// SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.4.0-alpha.4 (multisig/EcdsaSignerManager.compact)
-
-pragma language_version >= 0.26.0;
-
-/**
- * @module EcdsaSignerManager
- * @description Threshold authorization over secp256k1 ECDSA approvals for
- * multisig contracts.
- *
- * Signer identities are stored as commitments: `persistentHash` over the
- * signer's public-key coordinates, an instance salt, and a domain separator.
- * The salt is per-deployment, so the same public key yields a different
- * commitment in every instance and cannot be correlated across contracts.
- *
- * Wraps `Signer<Bytes<32>>` for the registry and threshold and configures it
- * from `initialize`. Consuming contracts own the digest: they compute the
- * message hash their signers signed, then hand it to `assertApprovals` with
- * the parallel public-key and signature vectors.
- *
- * @notice Consuming contracts must not import `Signer` alongside this module.
- * A second import instantiates a separate registry that `assertApprovals`
- * never reads.
- */
-module EcdsaSignerManager {
-  import CompactStandardLibrary;
-  import "../crypto/Ecdsa" prefix Ecdsa_;
-  import "./Signer"<Bytes<32>> prefix Signer_;
-
-  // Named import/re-export of the registry state only, so a consuming
-  // contract's ledger keys read as `_signers` rather than `Signer__signers`.
-  // The circuits stay behind the `Signer_` prefix.
-  import { _signers, _signerCount, _threshold } from "./Signer"<Bytes<32>>;
-  export { _signers, _signerCount, _threshold };
-
-  // ─── State ──────────────────────────────────────────────────────────────────
-
-  /**
-   * @description Deployment-supplied salt for signer commitments. Set at
-   * initialization and never changed. The registered commitments must have been
-   * derived under this same salt.
-   */
-  export sealed ledger _instanceSalt: Bytes<32>;
-
-  // ─── Types ──────────────────────────────────────────────────────────────────
-
-  /**
-   * @description Input to `persistentHash` for computing signer commitments.
-   */
-  struct SignerCommitmentInput {
-    pkX: Bytes<32>,
-    pkY: Bytes<32>,
-    salt: Bytes<32>,
-    domain: Bytes<32>
-  }
-
-  /**
-   * @description Accumulator threaded through the approval fold: the running
-   * valid count, the previous commitment (for duplicate detection), and the
-   * digest every signature is checked against.
-   */
-  struct VerificationState {
-    validCount: Uint<8>,
-    prevCommitment: Bytes<32>,
-    msgHash: Bytes<32>
-  }
-
-  // ─── Initialization ─────────────────────────────────────────────────────────
-
-  /**
-   * @description Stores the instance salt and registers the initial signer set.
-   * Call from the consuming contract's constructor only. Writes the `sealed`
-   * salt, so it cannot be reached from an exported circuit.
-   *
-   * Requirements:
-   *
-   * - Can only be called once.
-   * - `instanceSalt` should be cryptographically random.
-   * - `signerCommitments` must not contain duplicates.
-   * - `threshold` must be non-zero and must not exceed `n`.
-   * - `threshold` must not exceed 2, the number of approvals `assertApprovals`
-   *   verifies.
-   *
-   * @param {Bytes<32>} instanceSalt - Per-deployment salt for commitment derivation.
-   * @param {Vector<n, Bytes<32>>} signerCommitments - Hashed signer identities.
-   * @param {Uint<8>} threshold - Minimum approvals required.
-   * @returns {[]} Empty tuple.
-   */
-  export circuit initialize<#n>(
-    instanceSalt: Bytes<32>,
-    signerCommitments: Vector<n, Bytes<32>>,
-    threshold: Uint<8>
-  ): [] {
-    assert(Signer_getSignerCount() == 0, "EcdsaSignerManager: signers already registered");
-    _instanceSalt = disclose(instanceSalt);
-    assert(threshold <= 2, "EcdsaSignerManager: threshold cannot exceed 2 (assertApprovals verifies 2 signatures)");
-
-    for (const commitment of signerCommitments) {
-      Signer__addSigner(commitment);
-    }
-    Signer__changeThreshold(threshold);
-  }
-
-  // ─── Commitments ────────────────────────────────────────────────────────────
-
-  /**
-   * @description Computes a signer commitment from a secp256k1 public key,
-   * as `persistentHash(pkX, pkY, salt, "multisig:signer:")`.
-   *
-   * Pure, so the deployer can derive constructor commitments off-chain the
-   * same way the circuits derive them in-circuit.
-   *
-   * Requirements:
-   *
-   * - `pk` must not be the secp256k1 identity point, which has no coordinates.
-   *
-   * @param {Secp256k1Point} pk - The secp256k1 public key.
-   * @param {Bytes<32>} salt - The instance salt.
-   * @returns {Bytes<32>} The signer commitment.
-   */
-  export pure circuit calculateSignerId(
-    pk: Secp256k1Point,
-    salt: Bytes<32>
-  ): Bytes<32> {
-    return persistentHash<SignerCommitmentInput>(SignerCommitmentInput {
-      pkX: secp256k1PointX(pk) as Bytes<32>,
-      pkY: secp256k1PointY(pk) as Bytes<32>,
-      salt: salt,
-      domain: pad(32, "multisig:signer:")
-    });
-  }
-
-  // ─── Approvals ──────────────────────────────────────────────────────────────
-
-  /**
-   * @description Verifies two approvals over `msgHash` and asserts the
-   * threshold is met.
-   *
-   * `pubkeys` and `signatures` are parallel: entry `i` of each belongs to the
-   * same signer.
-   *
-   * @dev Both entries are asserted, so the count handed to the threshold check
-   * is always 2 and a threshold below 2 admits nothing extra.
-   *
-   * @constraints k=17, rows=64916 (zkir-v3)
-   *
-   * Requirements:
-   *
-   * - Every public key must hash to a registered signer commitment.
-   * - Every signature must be valid over `msgHash` and use the low-s encoding.
-   * - Signers must not be duplicates.
-   *
-   * @param {Bytes<32>} msgHash - The digest the signers approved.
-   * @param {Vector<2, Secp256k1Point>} pubkeys - Public keys of approving signers.
-   * @param {Vector<2, Secp256k1EcdsaSignature>} signatures - Signatures over `msgHash`.
-   * @returns {[]} Empty tuple.
-   */
-  export circuit assertApprovals(
-    msgHash: Bytes<32>,
-    pubkeys: Vector<2, Secp256k1Point>,
-    signatures: Vector<2, Secp256k1EcdsaSignature>
-  ): [] {
-    const initialState = VerificationState {
-      validCount: 0 as Uint<8>,
-      prevCommitment: pad(32, ""),
-      msgHash: msgHash
-    };
-
-    const finalState = fold(verifySignature, initialState, pubkeys, signatures);
-    Signer_assertThresholdMet(finalState.validCount);
-  }
-
-  /**
-   * @description Fold callback. Verifies one signer's approval.
-   *
-   * @notice Verification goes through `Ecdsa`'s low-s wrapper, so the high-s
-   * encoding of an approval is rejected as an invalid signature.
-   *
-   * @dev Duplicates are caught by comparing against the previous commitment
-   * alone, which is exhaustive only at width 2. Widening the approval vectors
-   * requires an all-pairs check.
-   *
-   * @param {VerificationState} state - Accumulator threaded through fold.
-   * @param {Secp256k1Point} pubkey - The signer's secp256k1 public key.
-   * @param {Secp256k1EcdsaSignature} signature - The signer's signature over `msgHash`.
-   * @returns {VerificationState} Updated accumulator.
-   */
-  circuit verifySignature(
-    state: VerificationState,
-    pubkey: Secp256k1Point,
-    signature: Secp256k1EcdsaSignature
-  ): VerificationState {
-    const commitment = calculateSignerId(pubkey, _instanceSalt);
-
-    assert(commitment != state.prevCommitment, "Multisig: duplicate signer");
-
-    Signer_assertSigner(commitment);
-
-    assert(
-      Ecdsa_secp256k1EcdsaVerifyLowS(state.msgHash, signature, pubkey),
-      "Multisig: invalid signature"
-    );
-
-    return VerificationState {
-      validCount: state.validCount + 1 as Uint<8>,
-      prevCommitment: commitment,
-      msgHash: state.msgHash
-    };
-  }
-
-  // ─── View ───────────────────────────────────────────────────────────────────
-
-  /**
-   * @description Returns the number of registered signers.
-   *
-   * @constraints k=6, rows=34 (zkir-v3)
-   *
-   * @returns {Uint<8>} The signer count.
-   */
-  export circuit getSignerCount(): Uint<8> {
-    return Signer_getSignerCount();
-  }
-
-  /**
-   * @description Returns the approval threshold.
-   *
-   * @constraints k=6, rows=34 (zkir-v3)
-   *
-   * @returns {Uint<8>} The threshold.
-   */
-  export circuit getThreshold(): Uint<8> {
-    return Signer_getThreshold();
-  }
-
-  /**
-   * @description Returns whether the given commitment is a registered signer.
-   *
-   * @constraints k=8, rows=129 (zkir-v3)
-   *
-   * @param {Bytes<32>} commitment - The signer commitment to check.
-   * @returns {Boolean} True if registered.
-   */
-  export circuit isSigner(commitment: Bytes<32>): Boolean {
-    return Signer_isSigner(commitment);
-  }
-}