@openzeppelin/compact-contracts 0.4.0 → 0.5.0-alpha.2

package/multisig/examples/{ShieldedMultiSigV2Example.compact → NativeShieldedStatelessTreasuryExample.compact}

@@ -1,11 +1,11 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.4.0 (multisig/examples/ShieldedMultiSigV2Example.compact)
+// OpenZeppelin Compact Contracts v0.5.0-alpha.2 (multisig/examples/NativeShieldedStatelessTreasuryExample.compact)
 
 pragma language_version >= 0.26.0;
 
 /**
- * @title ShieldedMultiSigV2Example
- * @description Deployable reference contract for the `ShieldedMultiSigV2`
+ * @title NativeShieldedStatelessTreasuryExample
+ * @description Deployable reference contract for the `NativeShieldedStatelessTreasury`
  * preset: a 2-of-3 wallet whose spends are authorized by ECDSA signatures
  * collected off-chain and verified in a single transaction.
  *
@@ -15,14 +15,14 @@ pragma language_version >= 0.26.0;
 
 import CompactStandardLibrary;
 
-import "../presets/ShieldedMultiSigV2"<2> prefix ShieldedMultiSigV2_;
+import "../presets/NativeShieldedStatelessTreasury"<2> prefix NativeShieldedStatelessTreasury_;
 
 export { ShieldedCoinInfo, QualifiedShieldedCoinInfo, ShieldedSendResult };
 
-// Surface the preset's domain separator unprefixed so `ledger()` readers see
-// the key name the preset published.
-import { _domainSeparator } from "../presets/ShieldedMultiSigV2"<2>;
-export { _domainSeparator };
+// Surface the preset's replay counter and domain separator unprefixed so
+// `ledger()` readers see the key names the preset published.
+import { _nonce, _domainSeparator } from "../presets/NativeShieldedStatelessTreasury"<2>;
+export { _nonce, _domainSeparator };
 
 /**
  * @description Deploys the wallet with 3 signer commitments.
@@ -34,42 +34,42 @@ constructor(
   instanceSalt: Bytes<32>,
   signerCommitments: Vector<3, Bytes<32>>
 ) {
-  ShieldedMultiSigV2_initialize<3>(instanceSalt, signerCommitments);
+  NativeShieldedStatelessTreasury_initialize<3>(instanceSalt, signerCommitments);
+}
+
+export pure circuit _calculateSignerId(
+  pk: Secp256k1Point,
+  salt: Bytes<32>
+): Bytes<32> {
+  return NativeShieldedStatelessTreasury__calculateSignerId(pk, salt);
 }
 
 export circuit deposit(coin: ShieldedCoinInfo): [] {
-  return ShieldedMultiSigV2_deposit(coin);
+  return NativeShieldedStatelessTreasury_deposit(coin);
 }
 
 export circuit execute(
-  to: ShieldedMultiSigV2_Recipient,
+  to: NativeShieldedStatelessTreasury_Proposal_Recipient,
   amount: Uint<128>,
   coin: QualifiedShieldedCoinInfo,
   pubkeys: Vector<2, Secp256k1Point>,
   signatures: Vector<2, Secp256k1EcdsaSignature>
 ): ShieldedSendResult {
-  return ShieldedMultiSigV2_execute(to, amount, coin, pubkeys, signatures);
-}
-
-export pure circuit _calculateSignerId(
-  pk: Secp256k1Point,
-  salt: Bytes<32>
-): Bytes<32> {
-  return ShieldedMultiSigV2__calculateSignerId(pk, salt);
+  return NativeShieldedStatelessTreasury_execute(to, amount, coin, pubkeys, signatures);
 }
 
 export circuit getNonce(): Uint<64> {
-  return ShieldedMultiSigV2_getNonce();
+  return NativeShieldedStatelessTreasury_getNonce();
 }
 
 export circuit getSignerCount(): Uint<8> {
-  return ShieldedMultiSigV2_getSignerCount();
+  return NativeShieldedStatelessTreasury_getSignerCount();
 }
 
 export circuit getThreshold(): Uint<8> {
-  return ShieldedMultiSigV2_getThreshold();
+  return NativeShieldedStatelessTreasury_getThreshold();
 }
 
 export circuit isSigner(commitment: Bytes<32>): Boolean {
-  return ShieldedMultiSigV2_isSigner(commitment);
+  return NativeShieldedStatelessTreasury_isSigner(commitment);
 }

package/multisig/examples/NativeShieldedTokenIssuerExample.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.4.0 (multisig/examples/NativeShieldedTokenIssuerExample.compact)
+// OpenZeppelin Compact Contracts v0.5.0-alpha.2 (multisig/examples/NativeShieldedTokenIssuerExample.compact)
 
 pragma language_version >= 0.26.0;
 

package/multisig/presets/NativeShieldedStatelessTreasury.compact

@@ -0,0 +1,443 @@
+// SPDX-License-Identifier: MIT
+// OpenZeppelin Compact Contracts v0.5.0-alpha.2 (multisig/presets/NativeShieldedStatelessTreasury.compact)
+
+pragma language_version >= 0.26.0;
+
+/**
+ * @module NativeShieldedStatelessTreasury
+ * @description
+ * A threshold ECDSA multisig treasury for shielded coins. Anyone may
+ * deposit; value leaves only through `execute`, a single tx carrying `t`
+ * registered signers' approvals. There is no proposal lifecycle: signatures
+ * are collected off-chain and verified in that one tx.
+ *
+ * Composes `Secp256k1EcdsaMultisig` (signer commitments, approval checks),
+ * `ShieldedTreasuryStateless` as `Treasury_` (deposit and send, no coin
+ * state on the ledger) and `ProposalManager` as `Proposal_` for its
+ * `Recipient` and `RecipientKind` types alone.
+ *
+ * @dev Notation:
+ * - `H<T>(...)`: `persistentHash<T>` (SHA-256) over the Compact encoding of
+ *   `T`, a `Bytes<32>` digest.
+ * - `keccak(...)`: `keccak256` over the concatenation of its 32-byte words.
+ * - `DS`: `_domainSeparator`, the EIP-712 domain separator fixed at
+ *   construction.
+ * - `self`: `kernel.self().bytes`, this contract's address.
+ * - `nonce`: the `_nonce` value read at the start of `execute`, the
+ *   signature replay counter.
+ * - `cm`: a signer commitment, the registry key.
+ *
+ * @dev Derivations:
+ * - Domain separator: `DS = Eip712_domainSeparator(
+ *   keccak("NativeShieldedStatelessTreasury"), keccak("1"), instanceSalt)`,
+ *   the EIP-712 domain `(name, version, salt)`. `chainId` and
+ *   `verifyingContract` are absent: no network id is available in-circuit
+ *   and a 32-byte address does not fit `address`. `self` inside the struct
+ *   separates deployments instead.
+ * - Execute digest: `keccak(0x1901 ‖ DS ‖ keccak([EXECUTE_TYPEHASH, self,
+ *   uint64Word(nonce), uint8Word(to.kind), to.address, coin.color,
+ *   uint128Word(amount)]))`.
+ * - Type hash: `EXECUTE_TYPEHASH = keccak("Execute(bytes32 contractAddress,
+ *   uint256 nonce,uint8 recipientKind,bytes32 recipient,bytes32 coinColor,
+ *   uint256 amount)")`, written as a literal word.
+ * - Signer commitment: `cm = H<SignerCommitmentInput>({ pkX, pkY, salt,
+ *   domain: pad(32, "Secp256k1EcdsaMultisig:signer") })`, `pkX` / `pkY`
+ *   the affine coordinates as `Bytes<32>`. `_calculateSignerId` is the
+ *   exported pure circuit.
+ * - Encoding: `H` hashes the Compact encoding, not a byte concatenation.
+ *   Digest integers are big-endian ABI words (`utils/EvmAbi`), so an EVM
+ *   signer's typed-data encoder reproduces them.
+ *   `contracts/src/multisig/test/EcdsaTestUtils.ts` pins the digest through
+ *   ethers (`executeMsgHash`).
+ *
+ * @notice Implementing contracts register the signer set from their
+ * constructor by calling this module's `initialize`, and MUST NOT import
+ * `Signer` or `Secp256k1EcdsaMultisig` directly.
+ *
+ * @dev Parameterization:
+ * `t` is the approval width and the threshold, fixed at import
+ * (`"../presets/NativeShieldedStatelessTreasury"<t>`): `execute` verifies
+ * exactly `t` distinct signers. The implementing contract fixes the signer
+ * count `n` at `initialize`. Import one width per contract: two widths share
+ * one signer registry, see `Secp256k1EcdsaMultisig`.
+ * `NativeShieldedStatelessTreasuryExample` fixes 2-of-3. The `@constraints`
+ * tag on `execute` is measured at `t = 2`.
+ *
+ * @dev Compatibility:
+ * The wire format the signers implement is the EIP-712 domain
+ * (`NativeShieldedStatelessTreasury`, version `1`, salt), the `Execute` type
+ * string, the `Secp256k1EcdsaMultisig:signer` commitment domain (owned by
+ * `Secp256k1EcdsaMultisig`), the `cm` preimage struct, and the `Vector<t>` /
+ * `Vector<n>` shapes the implementing contract fixes. Changing any of them
+ * breaks every existing signer setup. The test suite pins them through
+ * `EcdsaTestUtils.ts`.
+ *
+ * @notice Privacy:
+ * - Public, per tx:
+ *   - Entry point: `deposit` or `execute`.
+ *   - Approvers: the `t` signer commitments (`disclose(commitment)` in
+ *     `Signer_assertSigner`), so WHICH signers approved.
+ *   - Deposit: the coin commitment as a receive claim, with this contract
+ *     named in the Zswap output (`disclose(coin)` in `Treasury__deposit`).
+ *   - Execute: the spent coin's nullifier and the sent and change coin
+ *     commitments. The returned `ShieldedSendResult` stays with the caller.
+ * - Public, as state:
+ *   - Cells: `_nonce`, `_domainSeparator`, and the `Secp256k1EcdsaMultisig`
+ *     cells (`_signers`, `_signerCount`, `_threshold`, `_instanceSalt`)
+ *     behind its prefix. `_nonce` and `_domainSeparator` are exported, so an
+ *     implementing contract can surface them in its `ledger()` reader, as
+ *     the example does; the rest are read through the view circuits.
+ *   - Absent: no coin map, no balances, no received or sent totals.
+ * - Private:
+ *   - Signer material: public keys and signatures are verified in-circuit,
+ *     never disclosed.
+ *   - Operation data: the amount and the recipient.
+ * - Signer identity: keys sit behind `cm` with a public salt, so an observer
+ *   holding a candidate key can test membership; one without cannot
+ *   correlate a signer across deployments.
+ * - Auditability: no balance is stored, but a coin commitment is a hash of
+ *   the coin's data, so whoever knows a held coin can link its receive to
+ *   its later spend. The change coin's nonce derives from the spent coin's,
+ *   so that observer can follow the change too.
+ *
+ * @notice Security:
+ * - Digest binding: the `Execute` struct binds its type hash, `self`,
+ *   `nonce`, the recipient kind and address, `coin.color` and `amount` under
+ *   `DS`, so a signature authorizes one spend on one instance at one nonce,
+ *   and is neither replayable nor redirectable. Removing the `self` word
+ *   removes cross-instance replay protection, since `DS` cannot carry the
+ *   address.
+ * - Low-s: verification goes through `Ecdsa_secp256k1EcdsaVerifyLowS`, so a
+ *   high-s encoding is an invalid signature.
+ * - Distinct signers: `assertApprovals` takes exactly `t` keys and rejects a
+ *   repeated commitment, so no set of fewer than `t` registered signers
+ *   moves value. `initialize` rejects `n < t`.
+ * - Recipient kind: `execute` rejects any recipient but a `ShieldedUser`. A
+ *   contract-addressed coin would be unclaimable, making the transaction
+ *   malformed.
+ * - Open deposits: `deposit` has no access control, by design. Only
+ *   `execute` moves value out.
+ * - No coin bookkeeping: with no coin registry, a double spend or a coin the
+ *   contract does not own is rejected by the protocol at application time
+ *   rather than by an assert here. Sufficiency (`coin.value >= amount`) is
+ *   likewise left to `sendShielded`.
+ * - Immutable signer set: no signer reconfiguration circuit is exported, so
+ *   the commitments and the threshold are fixed. Losing more than `n - t`
+ *   keys freezes spending.
+ * - Atomicity: a failed assert rejects the whole tx before any state moves;
+ *   the nonce does not advance and the sender pays no fee.
+ *
+ * @notice Concurrency:
+ * - Replay nonce: `execute` reads `_nonce` into the digest. The read is
+ *   pinned, so any two executes in one block conflict: at most one lands per
+ *   block, and the losing signers re-sign at the next nonce.
+ * - `getNonce`: submitted as a tx it pins `_nonce` and conflicts with a
+ *   same-block `execute`.
+ * - Deposits: `deposit` writes no ledger state, so it commutes with
+ *   everything, a same-block `execute` included.
+ * - Views: the signer views read only state written by `initialize`, so they
+ *   commute with everything.
+ *
+ * @notice Scope:
+ * Deposit and send only. No mint, no burn, no unshielded rail, and no
+ * on-chain proposal: `ProposalManager` is imported for `Proposal_Recipient`
+ * and `Proposal_RecipientKind` only, while its `_proposals` map and
+ * `_nextProposalId` are allocated by the import and never written. `execute`
+ * checks `to.kind` itself rather than calling `toShieldedRecipient`. Coins
+ * the treasury holds are ordinary Zswap coins it neither tracks nor
+ * restricts.
+ *
+ * @notice Client-side duties:
+ * - Before deploy: pick a random `instanceSalt`, derive each `cm` with
+ *   `_calculateSignerId(pk, salt)`, pass them as `signerCommitments`.
+ * - Per operation: read `getNonce()`, rebuild the digest as
+ *   `EcdsaTestUtils.ts` does, collect `t` low-s signatures off-chain, submit
+ *   keys and signatures in matching `Vector<t>` positions.
+ * - Coin tracking: keep the treasury's coins off-chain, recovering each
+ *   coin's `mt_index` from the indexer's `ZswapOutput` / ledger events to
+ *   build the `QualifiedShieldedCoinInfo` that `execute` takes.
+ * - Change coin: persist the one `execute` returns. `sendShielded` emits it
+ *   as a fresh self-owned output, and it replaces the spent coin as the
+ *   treasury's holding.
+ *
+ * @notice Scalability:
+ * - Throughput: one `execute` per block (see Concurrency). Deposits write no
+ *   ledger state, so they do not contend.
+ * - State: constant-size, one counter, the domain separator and an
+ *   `n`-entry signer set. Nothing grows per deposit or spend.
+ * - Coins: no merge circuit, so the off-chain pool gains one coin per
+ *   deposit and `execute` spends exactly one of them. A spend larger than
+ *   the largest single coin is not expressible.
+ * - Amounts: `execute` takes `Uint<128>`.
+ *
+ * @dev Composition:
+ * - On-chain balances: swap `ShieldedTreasuryStateless` for
+ *   `ShieldedTreasury` to get one merged UTXO per color and cumulative
+ *   totals, both published.
+ * - Unshielded rail: pair `Proposal_toUnshieldedRecipient` with
+ *   `UnshieldedTreasury`; this preset wires only the shielded one.
+ * - Other thresholds: import at another `t` (see Parameterization).
+ * - Proposal lifecycle: wire in the rest of `ProposalManager` for on-chain
+ *   proposals, at the cost its own `@warning` names: every proposal's
+ *   recipient, color and amount becomes public.
+ *
+ * @notice Requires ZKIR v3: `keccak256` is unavailable on the v2 backend.
+ */
+module NativeShieldedStatelessTreasury<#t> {
+  import CompactStandardLibrary;
+
+  import "../Secp256k1EcdsaMultisig"<t> prefix Secp256k1EcdsaMultisig_;
+  import "../../crypto/Eip712" prefix Eip712_;
+  import "../../utils/EvmAbi" prefix EvmAbi_;
+  import "../ProposalManager" prefix Proposal_;
+  import "../ShieldedTreasuryStateless" prefix Treasury_;
+
+  // Implementing contracts need this for the re-exported `execute` signature.
+  // Importing `ProposalManager` again instead would give them a second,
+  // unwritten copy of its state.
+  export { Proposal_Recipient };
+
+  /**
+   * @description Signature replay counter. `execute` reads it into its
+   * digest and increments it; `getNonce` returns the value the next digest
+   * binds to. The read is pinned, so at most one `execute` lands per block.
+   * Exported so the implementing contract's `ledger()` reader can surface it.
+   */
+  export ledger _nonce: Counter;
+
+  /**
+   * @description The EIP-712 domain separator every `execute` digest is built
+   * under, derived from `(name, version, instanceSalt)`. Set once at
+   * construction.
+   */
+  export sealed ledger _domainSeparator: Bytes<32>;
+
+  /**
+   * @description Registers the signer set at threshold `t` and fixes the
+   * EIP-712 domain separator.
+   *
+   * @notice Call from the implementing contract's constructor only. It writes
+   * the `sealed` `_domainSeparator`, so implementing contracts MUST NOT expose
+   * `initialize` as a post-deploy circuit.
+   *
+   * The EIP-712 domain fixed here is `(name, version, salt)`. `chainId` and
+   * `verifyingContract` are absent: no network identifier is available
+   * in-circuit, and a 32-byte Midnight address does not fit
+   * `verifyingContract`'s `address` type.
+   *
+   * Replay protection comes from `execute` binding `kernel.self()` in its
+   * struct rather than from the domain. The ledger randomizes a contract's
+   * address at deployment, so no two deployments share one on any network.
+   * A signature for one cannot authorize another.
+   *
+   * `instanceSalt` also keys the signer commitments, so a fresh value per
+   * deployment keeps one public key from producing the same commitment in two
+   * deployments which would link the signer set across them.
+   *
+   * Requirements:
+   *
+   * - `instanceSalt` should be cryptographically random.
+   * - `signerCommitments` must not contain duplicates.
+   * - `n` must be at least `t`.
+   *
+   * @param {Bytes<32>} instanceSalt - Per-deployment salt for commitment derivation.
+   * @param {Vector<n, Bytes<32>>} signerCommitments - Hashed signer identities.
+   * @returns {[]} Empty tuple.
+   */
+  export circuit initialize<#n>(
+    instanceSalt: Bytes<32>,
+    signerCommitments: Vector<n, Bytes<32>>
+  ): [] {
+    Secp256k1EcdsaMultisig_initialize<n>(instanceSalt, signerCommitments);
+
+    const hashedName = keccak256<Bytes<31>>(pad(31, "NativeShieldedStatelessTreasury"));
+    const hashedVersion = keccak256<Bytes<1>>(pad(1, "1"));
+    _domainSeparator = Eip712_domainSeparator(
+      hashedName,
+      hashedVersion,
+      disclose(instanceSalt)
+    );
+  }
+
+  /**
+   * @description `keccak256` of the `Execute` type string:
+   * `Execute(bytes32 contractAddress,uint256 nonce,uint8 recipientKind,bytes32 recipient,bytes32 coinColor,uint256 amount)`
+   *
+   * @dev Written as a literal word. `compactc` emits a full keccak
+   * permutation even for a constant argument, so hashing the type string
+   * in-circuit would add ~4.2k rows to every `execute`. The spec checks this
+   * word against the type string above.
+   *
+   * @returns {Bytes<32>} The `Execute` type hash.
+   */
+  pure circuit EXECUTE_TYPEHASH(): Bytes<32> {
+    const typeHash: Vector<32, Uint<8>> = [
+      0x8e, 0x36, 0xc9, 0x78, 0xf2, 0x00, 0x15, 0xe8,
+      0x1d, 0x7a, 0x53, 0xef, 0xc3, 0x2e, 0x2b, 0x08,
+      0xf1, 0x24, 0x97, 0xa5, 0x05, 0x7c, 0x70, 0x20,
+      0x7f, 0x8b, 0xc4, 0xb7, 0xc6, 0xcf, 0x5e, 0x15
+    ];
+
+    return typeHash as Bytes<32>;
+  }
+
+  /**
+   * @description Computes a signer commitment from a secp256k1 public key,
+   * as `persistentHash(pkX, pkY, salt, "Secp256k1EcdsaMultisig:signer")`.
+   *
+   * Pure, so the deployer can derive constructor commitments off-chain.
+   *
+   * Requirements:
+   *
+   * - `pk` must not be the secp256k1 identity point, which has no coordinates.
+   *
+   * @param {Secp256k1Point} pk - The secp256k1 public key.
+   * @param {Bytes<32>} salt - The instance salt.
+   *
+   * @returns {Bytes<32>} The signer commitment.
+   */
+  export pure circuit _calculateSignerId(
+    pk: Secp256k1Point,
+    salt: Bytes<32>
+  ): Bytes<32> {
+    return Secp256k1EcdsaMultisig_calculateSignerId(pk, salt);
+  }
+
+  /**
+   * @description Receives a shielded coin into the multisig treasury.
+   *
+   * No access control which allows anyone to deposit. The coin is claimed at the
+   * protocol level through receiveShielded. No coin data is stored on the
+   * public ledger, preserving full balance privacy.
+   *
+   * The operator discovers the coin's Merkle tree index by subscribing
+   * to ZswapOutput events via the indexer, filtering by contract address,
+   * and extracting mt_index. Combined with the known ShieldedCoinInfo,
+   * this produces the QualifiedShieldedCoinInfo needed for spending.
+   *
+   * @constraints k=13, rows=5898 (zkir-v3)
+   *
+   * @param {ShieldedCoinInfo} coin - The incoming shielded coin.
+   */
+  export circuit deposit(coin: ShieldedCoinInfo): [] {
+    Treasury__deposit(coin);
+  }
+
+  /**
+   * @description Executes a shielded send authorized by threshold signatures.
+   *
+   * The circuit reads the current nonce from the ledger, increments it,
+   * then reconstructs the EIP-712 digest that signers must have signed
+   * off-chain: the `Execute` struct (contract address, nonce, recipient kind,
+   * recipient, coin color, amount) hashed under this deployment's domain
+   * separator. The digest is bound to the contract instance and the full recipient (kind and
+   * address), so a signature authorizes exactly one operation on one instance.
+   *
+   * Approvals are checked by `Secp256k1EcdsaMultisig`, which derives each
+   * signer's commitment from their public key and the instance salt and
+   * rejects duplicates. Constraints below are measured at `t = 2`.
+   *
+   * @notice `to` must be a `ShieldedUser`. A contract-addressed coin would be
+   * unclaimable, making the transaction malformed.
+   *
+   * @constraints k=17, rows=98969 (zkir-v3)
+   *
+   * Requirements:
+   *
+   * - No two entries may be the same signer.
+   * - Every public key must hash to a registered signer commitment.
+   * - Every signature must be valid over the message hash and use the low-s
+   *   encoding.
+   * - `to.kind` must be `ShieldedUser`.
+   * - Coin value must be >= amount.
+   *
+   * @param {Proposal_Recipient} to - The recipient.
+   * @param {Uint<128>} amount - The amount to send.
+   * @param {QualifiedShieldedCoinInfo} coin - The coin to spend (from operator's pool).
+   * @param {Vector<t, Secp256k1Point>} pubkeys - Public keys of approving signers.
+   * @param {Vector<t, Secp256k1EcdsaSignature>} signatures - ECDSA signatures over the operation.
+   *
+   * @returns {ShieldedSendResult} The send result including any change.
+   */
+  export circuit execute(
+    to: Proposal_Recipient,
+    amount: Uint<128>,
+    coin: QualifiedShieldedCoinInfo,
+    pubkeys: Vector<t, Secp256k1Point>,
+    signatures: Vector<t, Secp256k1EcdsaSignature>
+  ): ShieldedSendResult {
+    // Increment nonce
+    const currentNonce = _nonce;
+    _nonce.increment(1);
+
+    // Construct message hash
+    const msgHash = Eip712_hashTypedData(_domainSeparator, keccak256<Vector<7, Bytes<32>>>([
+      EXECUTE_TYPEHASH(),
+      // Binds the digest to this deployment. The domain cannot carry the
+      // address, so removing this word removes cross-instance replay
+      // protection.
+      kernel.self().bytes,
+      EvmAbi_uint64Word(currentNonce),
+      EvmAbi_uint8Word(to.kind as Uint<8>),
+      to.address,
+      coin.color,
+      EvmAbi_uint128Word(amount)
+    ]));
+
+    Secp256k1EcdsaMultisig_assertApprovals(msgHash, pubkeys, signatures);
+
+    assert(
+      to.kind == Proposal_RecipientKind.ShieldedUser,
+      "NativeShieldedStatelessTreasury: recipient must be a coin public key"
+    );
+    const recipient = left<ZswapCoinPublicKey, ContractAddress>(
+      ZswapCoinPublicKey { bytes: to.address }
+    );
+    return Treasury__send(coin, recipient, amount);
+  }
+
+  /**
+   * @description Returns the nonce the next `execute` digest will bind to.
+   *
+   * @constraints k=6, rows=34 (zkir-v3)
+   *
+   * @returns {Uint<64>} The current nonce.
+   */
+  export circuit getNonce(): Uint<64> {
+    return _nonce;
+  }
+
+  /**
+   * @description Returns the number of registered signers.
+   *
+   * @constraints k=6, rows=34 (zkir-v3)
+   *
+   * @returns {Uint<8>} The signer count.
+   */
+  export circuit getSignerCount(): Uint<8> {
+    return Secp256k1EcdsaMultisig_getSignerCount();
+  }
+
+  /**
+   * @description Returns the approval threshold.
+   *
+   * @constraints k=6, rows=34 (zkir-v3)
+   *
+   * @returns {Uint<8>} The threshold.
+   */
+  export circuit getThreshold(): Uint<8> {
+    return Secp256k1EcdsaMultisig_getThreshold();
+  }
+
+  /**
+   * @description Returns whether the given commitment is a registered signer.
+   *
+   * @constraints k=8, rows=129 (zkir-v3)
+   *
+   * @param {Bytes<32>} commitment - The signer commitment to check.
+   * @returns {Boolean} True if registered.
+   */
+  export circuit isSigner(commitment: Bytes<32>): Boolean {
+    return Secp256k1EcdsaMultisig_isSigner(commitment);
+  }
+}

package/multisig/presets/NativeShieldedTokenIssuer.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.4.0 (multisig/presets/NativeShieldedTokenIssuer.compact)
+// OpenZeppelin Compact Contracts v0.5.0-alpha.2 (multisig/presets/NativeShieldedTokenIssuer.compact)
 
 pragma language_version >= 0.26.0;
 
@@ -183,10 +183,7 @@ pragma language_version >= 0.26.0;
  * Mint and burn only. No send, transfer or execute circuit exists, so
  * contract-held coins (from `mintToSelf` or `burnFromSelf` change) leave only
  * through `burnFromSelf`, supplied by the operator as
- * `QualifiedShieldedCoinInfo`. Moving such a coin anywhere else needs a
- * custody module composed by the consumer that records the coin without
- * claiming it a second time; `ShieldedTreasury._deposit` is not that module
- * today (compact-contracts#1112). Coins minted to users are ordinary
+ * `QualifiedShieldedCoinInfo`. Coins minted to users are ordinary
  * Zswap coins the contract neither tracks nor restricts; a holder redeems by
  * paying the coin into a `burn` tx. No supply accounting.
  *

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openzeppelin/compact-contracts",
-  "version": "0.4.0",
+  "version": "0.5.0-alpha.2",
   "description": "OpenZeppelin Compact contract library",
   "keywords": [
     "openzeppelin",
@@ -24,15 +24,15 @@
     "#test-utils/*": "./test-utils/*"
   },
   "scripts": {
-    "compile": "compact-compiler --exclude '*/archive/*' --exclude '*/crypto/*' --exclude '*/multisig/*'",
-    "compile:access": "compact-compiler --dir access",
-    "compile:archive": "compact-compiler --dir archive",
-    "compile:crypto": "compact-compiler --dir crypto --feature-zkir-v3 --exclude 'MockElGamal.compact' --exclude 'MockEcdhMask.compact' --exclude 'MockCurveOps.compact' && compact-compiler --dir crypto/test/mocks --exclude 'MockEcdsa.compact' --exclude 'MockEip712.compact'",
-    "compile:multisig": "compact-compiler --dir multisig --feature-zkir-v3",
-    "compile:security": "compact-compiler --dir security",
-    "compile:token": "compact-compiler --dir token",
-    "compile:utils": "compact-compiler --dir utils",
-    "compile:integration": "compact-compiler --src test/integration/_mocks",
+    "compile:access": "rm -rf artifacts/access && compact-compiler +0.34.0 --hierarchical --dir access",
+    "compile:archive": "rm -rf artifacts/archive && compact-compiler +0.34.0 --hierarchical --dir archive",
+    "compile:crypto": "rm -rf artifacts/crypto && compact-compiler +0.34.0 --hierarchical --dir crypto --feature-zkir-v3 --exclude 'MockElGamal.compact' --exclude 'MockEcdhMask.compact' --exclude 'MockCurveOps.compact' && compact-compiler +0.34.0 --hierarchical --dir crypto/test/mocks --exclude 'MockEcdsa.compact' --exclude 'MockEip712.compact'",
+    "compile:math": "rm -rf artifacts/math && compact-compiler +0.34.0 --hierarchical --dir math",
+    "compile:multisig": "rm -rf artifacts/multisig && compact-compiler +0.34.0 --hierarchical --dir multisig --feature-zkir-v3",
+    "compile:security": "rm -rf artifacts/security && compact-compiler +0.34.0 --hierarchical --dir security",
+    "compile:token": "rm -rf artifacts/token && compact-compiler +0.34.0 --hierarchical --dir token",
+    "compile:utils": "rm -rf artifacts/utils && compact-compiler +0.34.0 --hierarchical --dir utils",
+    "compile:integration": "rm -rf artifacts/integration && compact-compiler +0.34.0 --hierarchical --src test/integration/_mocks --out artifacts/integration",
     "build": "compact-builder --hierarchical --out dist --clean-dist --feature-zkir-v3 --exclude '*/archive/*' --exclude 'Mock*' --exclude '*.mock.compact' --copy package.json --copy ../README.md && find dist -type d -empty -delete",
     "test": "vitest run --project unit",
     "test:coverage": "vitest run --project unit --coverage",
@@ -71,7 +71,7 @@
     "@vitest/coverage-v8": "^5.0.0",
     "ethers": "^6.17.0",
     "fast-check": "^4.10.1",
-    "pino": "^9.7.0",
+    "pino": "^10.3.1",
     "ts-node": "^10.9.2",
     "typescript": "^6.0.3",
     "vite": "^8.3.0",

package/security/Allowlist.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.4.0 (security/Allowlist.compact)
+// OpenZeppelin Compact Contracts v0.5.0-alpha.2 (security/Allowlist.compact)
 
 pragma language_version >= 0.26.0;
 

package/security/Blocklist.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.4.0 (security/Blocklist.compact)
+// OpenZeppelin Compact Contracts v0.5.0-alpha.2 (security/Blocklist.compact)
 
 pragma language_version >= 0.26.0;
 

package/security/Initializable.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.4.0 (security/Initializable.compact)
+// OpenZeppelin Compact Contracts v0.5.0-alpha.2 (security/Initializable.compact)
 
 pragma language_version >= 0.26.0;
 
@@ -35,6 +35,8 @@ module Initializable {
   /**
    * @description Initializes the state thus ensuring the calling circuit can only be called once.
    *
+   * @constraints k=6, rows=28
+   *
    * Requirements:
    *
    * - Contract must not be initialized.

package/security/Pausable.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.4.0 (security/Pausable.compact)
+// OpenZeppelin Compact Contracts v0.5.0-alpha.2 (security/Pausable.compact)
 
 pragma language_version >= 0.26.0;