@openzeppelin/compact-contracts 0.4.0-alpha.5 → 0.4.0

package/multisig/EcdsaSignerManager.compact

@@ -1,248 +0,0 @@
-// SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.4.0-alpha.5 (multisig/EcdsaSignerManager.compact)
-
-pragma language_version >= 0.26.0;
-
-/**
- * @module EcdsaSignerManager
- * @description Threshold authorization over secp256k1 ECDSA approvals for
- * multisig contracts.
- *
- * Signer identities are stored as commitments: `persistentHash` over the
- * signer's public-key coordinates, an instance salt, and a domain separator.
- * The salt is per-deployment, so the same public key yields a different
- * commitment in every instance and cannot be correlated across contracts.
- *
- * Wraps `Signer<Bytes<32>>` for the registry and threshold and configures it
- * from `initialize`. Consuming contracts own the digest: they compute the
- * message hash their signers signed, then hand it to `assertApprovals` with
- * the parallel public-key and signature vectors.
- *
- * @notice Consuming contracts must not import `Signer` alongside this module.
- * A second import instantiates a separate registry that `assertApprovals`
- * never reads.
- */
-module EcdsaSignerManager {
-  import CompactStandardLibrary;
-  import "../crypto/Ecdsa" prefix Ecdsa_;
-  import "./Signer"<Bytes<32>> prefix Signer_;
-
-  // Named import/re-export of the registry state only, so a consuming
-  // contract's ledger keys read as `_signers` rather than `Signer__signers`.
-  // The circuits stay behind the `Signer_` prefix.
-  import { _signers, _signerCount, _threshold } from "./Signer"<Bytes<32>>;
-  export { _signers, _signerCount, _threshold };
-
-  // ─── State ──────────────────────────────────────────────────────────────────
-
-  /**
-   * @description Deployment-supplied salt for signer commitments. Set at
-   * initialization and never changed. The registered commitments must have been
-   * derived under this same salt.
-   */
-  export sealed ledger _instanceSalt: Bytes<32>;
-
-  // ─── Types ──────────────────────────────────────────────────────────────────
-
-  /**
-   * @description Input to `persistentHash` for computing signer commitments.
-   */
-  struct SignerCommitmentInput {
-    pkX: Bytes<32>,
-    pkY: Bytes<32>,
-    salt: Bytes<32>,
-    domain: Bytes<32>
-  }
-
-  /**
-   * @description Accumulator threaded through the approval fold: the running
-   * valid count, the previous commitment (for duplicate detection), and the
-   * digest every signature is checked against.
-   */
-  struct VerificationState {
-    validCount: Uint<8>,
-    prevCommitment: Bytes<32>,
-    msgHash: Bytes<32>
-  }
-
-  // ─── Initialization ─────────────────────────────────────────────────────────
-
-  /**
-   * @description Stores the instance salt and registers the initial signer set.
-   * Call from the consuming contract's constructor only. Writes the `sealed`
-   * salt, so it cannot be reached from an exported circuit.
-   *
-   * Requirements:
-   *
-   * - Can only be called once.
-   * - `instanceSalt` should be cryptographically random.
-   * - `signerCommitments` must not contain duplicates.
-   * - `n` must be at least 2, the number of distinct signers `assertApprovals`
-   *   verifies. A smaller set can never satisfy it.
-   * - `threshold` must be 2, the number of approvals `assertApprovals`
-   *   verifies. Any other value would misreport what the circuit enforces.
-   *
-   * @param {Bytes<32>} instanceSalt - Per-deployment salt for commitment derivation.
-   * @param {Vector<n, Bytes<32>>} signerCommitments - Hashed signer identities.
-   * @param {Uint<8>} threshold - Approvals required. Must be 2.
-   * @returns {[]} Empty tuple.
-   */
-  export circuit initialize<#n>(
-    instanceSalt: Bytes<32>,
-    signerCommitments: Vector<n, Bytes<32>>,
-    threshold: Uint<8>
-  ): [] {
-    assert(Signer_getSignerCount() == 0, "EcdsaSignerManager: signers already registered");
-    _instanceSalt = disclose(instanceSalt);
-    assert(threshold == 2, "EcdsaSignerManager: threshold must be 2 (assertApprovals verifies 2 signatures)");
-
-    for (const commitment of signerCommitments) {
-      Signer__addSigner(commitment);
-    }
-    assert(Signer_getSignerCount() >= 2, "EcdsaSignerManager: fewer than 2 signers (assertApprovals verifies 2 signatures)");
-    Signer__changeThreshold(threshold);
-  }
-
-  // ─── Commitments ────────────────────────────────────────────────────────────
-
-  /**
-   * @description Computes a signer commitment from a secp256k1 public key,
-   * as `persistentHash(pkX, pkY, salt, "multisig:signer:")`.
-   *
-   * Pure, so the deployer can derive constructor commitments off-chain the
-   * same way the circuits derive them in-circuit.
-   *
-   * Requirements:
-   *
-   * - `pk` must not be the secp256k1 identity point, which has no coordinates.
-   *
-   * @param {Secp256k1Point} pk - The secp256k1 public key.
-   * @param {Bytes<32>} salt - The instance salt.
-   * @returns {Bytes<32>} The signer commitment.
-   */
-  export pure circuit calculateSignerId(
-    pk: Secp256k1Point,
-    salt: Bytes<32>
-  ): Bytes<32> {
-    return persistentHash<SignerCommitmentInput>(SignerCommitmentInput {
-      pkX: secp256k1PointX(pk) as Bytes<32>,
-      pkY: secp256k1PointY(pk) as Bytes<32>,
-      salt: salt,
-      domain: pad(32, "multisig:signer:")
-    });
-  }
-
-  // ─── Approvals ──────────────────────────────────────────────────────────────
-
-  /**
-   * @description Verifies two approvals over `msgHash` and asserts the
-   * threshold is met.
-   *
-   * `pubkeys` and `signatures` are parallel: entry `i` of each belongs to the
-   * same signer.
-   *
-   * @dev Both entries are asserted, so the count handed to the threshold check
-   * is always 2, matching the only threshold `initialize` accepts.
-   *
-   * @constraints k=17, rows=64916 (zkir-v3)
-   *
-   * Requirements:
-   *
-   * - Every public key must hash to a registered signer commitment.
-   * - Every signature must be valid over `msgHash` and use the low-s encoding.
-   * - Signers must not be duplicates.
-   *
-   * @param {Bytes<32>} msgHash - The digest the signers approved.
-   * @param {Vector<2, Secp256k1Point>} pubkeys - Public keys of approving signers.
-   * @param {Vector<2, Secp256k1EcdsaSignature>} signatures - Signatures over `msgHash`.
-   * @returns {[]} Empty tuple.
-   */
-  export circuit assertApprovals(
-    msgHash: Bytes<32>,
-    pubkeys: Vector<2, Secp256k1Point>,
-    signatures: Vector<2, Secp256k1EcdsaSignature>
-  ): [] {
-    const initialState = VerificationState {
-      validCount: 0 as Uint<8>,
-      prevCommitment: pad(32, ""),
-      msgHash: msgHash
-    };
-
-    const finalState = fold(verifySignature, initialState, pubkeys, signatures);
-    Signer_assertThresholdMet(finalState.validCount);
-  }
-
-  /**
-   * @description Fold callback. Verifies one signer's approval.
-   *
-   * @notice Verification goes through `Ecdsa`'s low-s wrapper, so the high-s
-   * encoding of an approval is rejected as an invalid signature.
-   *
-   * @dev Duplicates are caught by comparing against the previous commitment
-   * alone, which is exhaustive only at width 2. Widening the approval vectors
-   * requires an all-pairs check.
-   *
-   * @param {VerificationState} state - Accumulator threaded through fold.
-   * @param {Secp256k1Point} pubkey - The signer's secp256k1 public key.
-   * @param {Secp256k1EcdsaSignature} signature - The signer's signature over `msgHash`.
-   * @returns {VerificationState} Updated accumulator.
-   */
-  circuit verifySignature(
-    state: VerificationState,
-    pubkey: Secp256k1Point,
-    signature: Secp256k1EcdsaSignature
-  ): VerificationState {
-    const commitment = calculateSignerId(pubkey, _instanceSalt);
-
-    assert(commitment != state.prevCommitment, "Multisig: duplicate signer");
-
-    Signer_assertSigner(commitment);
-
-    assert(
-      Ecdsa_secp256k1EcdsaVerifyLowS(state.msgHash, signature, pubkey),
-      "Multisig: invalid signature"
-    );
-
-    return VerificationState {
-      validCount: state.validCount + 1 as Uint<8>,
-      prevCommitment: commitment,
-      msgHash: state.msgHash
-    };
-  }
-
-  // ─── View ───────────────────────────────────────────────────────────────────
-
-  /**
-   * @description Returns the number of registered signers.
-   *
-   * @constraints k=6, rows=34 (zkir-v3)
-   *
-   * @returns {Uint<8>} The signer count.
-   */
-  export circuit getSignerCount(): Uint<8> {
-    return Signer_getSignerCount();
-  }
-
-  /**
-   * @description Returns the approval threshold.
-   *
-   * @constraints k=6, rows=34 (zkir-v3)
-   *
-   * @returns {Uint<8>} The threshold.
-   */
-  export circuit getThreshold(): Uint<8> {
-    return Signer_getThreshold();
-  }
-
-  /**
-   * @description Returns whether the given commitment is a registered signer.
-   *
-   * @constraints k=8, rows=129 (zkir-v3)
-   *
-   * @param {Bytes<32>} commitment - The signer commitment to check.
-   * @returns {Boolean} True if registered.
-   */
-  export circuit isSigner(commitment: Bytes<32>): Boolean {
-    return Signer_isSigner(commitment);
-  }
-}