@openzeppelin/compact-contracts 0.4.0 → 0.5.0-alpha.2

package/token/ConfidentialFungibleToken.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.4.0 (token/ConfidentialFungibleToken.compact)
+// OpenZeppelin Compact Contracts v0.5.0-alpha.2 (token/ConfidentialFungibleToken.compact)
 
 pragma language_version >= 0.26.0;
 
@@ -28,16 +28,6 @@ pragma language_version >= 0.26.0;
  * (`extensions/ConfidentialFungibleTokenPublicSupply`) a composing contract pairs
  * with them if it wants a tracked supply.
  *
- * @notice Allowances. `approve` funds the allowance at approve time: `value`
- * moves out of the caller's spendable balance into the escrow, where it stays
- * until spent or re-approved. Funding is required, not a choice: the spender
- * holds no owner encryption key, so at spend time it can only prove against
- * its own escrow copy, never that the owner's balance covers the allowance.
- * An approve conserves the owner's holdings (spendable plus every outstanding
- * escrow), so allowances across spenders can sum to the whole holding but
- * never exceed it, and a re-approve replaces the prior one rather than
- * stacking.
- *
  * @notice Single-receiver. Auditor support, freeze, and admin-style seize are
  * deliberately left to companion modules or a future multi-receiver variant.
  * The escrow-spend primitive here (`_spendEscrow`) enables user-consenting
@@ -45,9 +35,6 @@ pragma language_version >= 0.26.0;
  * requires authority visibility into balances and is therefore out of scope
  * for the single-receiver base.
  *
- * @dev Initialization. Every exported circuit except `initialize` asserts the
- * contract is initialized.
- *
  * @dev Trust model for witnesses.
  *
  * Witness implementations live in the user's wallet (TypeScript frontend) and
@@ -403,9 +390,7 @@ module ConfidentialFungibleToken {
   /**
    * @description Escrowed allowances, keyed by owner then spender. Membership is
    * checked independently of the entry, so an allowance that was never escrowed
-   * is unspendable. A spend also requires both owner and spender to be
-   * registered, so an entry written here for an unregistered account (for
-   * example by a composing contract) is unspendable as well.
+   * is unspendable.
    * @type {Bytes<32>} owner - The account that escrowed the allowance.
    * @type {Bytes<32>} spender - The account allowed to spend it.
    * @type {EscrowEntry} entry - The escrowed allowance.
@@ -633,37 +618,25 @@ module ConfidentialFungibleToken {
 
   /**
    * @description Returns the escrow entry (the encrypted allowance) that `owner`
-   * granted `spender`. When no allowance exists, returns a placeholder entry
-   * rather than `default<EscrowEntry>`: the returned Jubjub points are on-curve,
-   * so the view is safe to prove (e.g. through a contract-to-contract call),
-   * whereas a zeroed default holds off-curve points. The cap is encrypted, not
-   * public.
-   *
-   * @notice The placeholder's `spenderCt` and `ownerCt` are genuine encryptions
-   * of 0. Its `ownerMemo` is not: it is a sentinel for an absent allowance,
-   * recognised by `ephemeralPk == identity`, which `EcdhMask_encrypt` never
-   * produces and `EcdhMask_decrypt` rejects. A wallet must test for the
-   * sentinel rather than decrypt and narrow it.
-   *
-   * @notice "No allowance" and "an allowance of 0" both read as encrypted-zero in
-   * the amount fields; the memo sentinel tells them apart, since `approve` stores
-   * a real memo even for 0. This getter grants nothing, the spend path
-   * (`transferFrom`/`burnFrom`) gates on `_escrow` membership independently, so a
-   * non-existent allowance is unspendable.
-   *
-   * @constraints k=10, rows=938
+   * granted `spender`. When no allowance exists, returns a well-formed
+   * encrypted-zero entry (its encrypted amounts decrypt to 0, analogous to an
+   * ERC-20 zero allowance) rather than `default<EscrowEntry>`: the returned
+   * Jubjub points are on-curve, so the view is safe to prove (e.g. through a
+   * contract-to-contract call) and safe for a wallet to decrypt, whereas a zeroed
+   * default holds off-curve points. The cap is encrypted, not public.
    *
-   * Requirements:
+   * @notice "No allowance" and "an allowance of 0" both read as encrypted-zero;
+   * a caller that must distinguish them reads `_escrow` membership off-chain. This
+   * getter grants nothing, the spend path (`transferFrom`/`burnFrom`) gates on
+   * `_escrow` membership independently, so a non-existent allowance is unspendable.
    *
-   * - Contract is initialized.
+   * @constraints k=10, rows=936
    *
    * @param {Bytes<32>} owner - The account that granted the allowance.
    * @param {Bytes<32>} spender - The approved spender.
-   * @return {EscrowEntry} - The encrypted escrow entry (a placeholder with the
-   * absent-allowance sentinel if none).
+   * @return {EscrowEntry} - The encrypted escrow entry (encrypted-zero if none).
    */
   export circuit allowance(owner: Bytes<32>, spender: Bytes<32>): EscrowEntry {
-    assertInitialized();
     if (!_escrow.member(disclose(owner)) ||
         !_escrow.lookup(disclose(owner)).member(disclose(spender))) {
       const id = constructJubjubPoint(0 as Field, 1 as Field);
@@ -683,17 +656,12 @@ module ConfidentialFungibleToken {
   /**
    * @description Returns whether `account` has registered an encryption key.
    *
-   * @constraints k=9, rows=305
-   *
-   * Requirements:
-   *
-   * - Contract is initialized.
+   * @constraints k=9, rows=303
    *
    * @param {Bytes<32>} account - The account to query.
    * @return {Boolean} - True if `account` is registered.
    */
   export circuit isRegistered(account: Bytes<32>): Boolean {
-    assertInitialized();
     return _encryptionKeys.member(disclose(account));
   }
 
@@ -844,12 +812,6 @@ module ConfidentialFungibleToken {
    * `sum(balances) == totalSupply` invariant. Pair it with a debit (as `transfer`
    * does) or a supply increase (as a supply layer's `mint` does).
    *
-   * Requirements:
-   *
-   * - Contract is initialized.
-   * - `value` is within `MAX_TRANSFER_VALUE()`.
-   * - `account` is non-zero and registered.
-   *
    * @param account - The recipient account id.
    * @param value - The amount to credit.
    */
@@ -966,7 +928,7 @@ module ConfidentialFungibleToken {
    * credits `to`, and pushes an encrypted memo to `to`. The amount is hidden;
    * the (sender, recipient) pair is public.
    *
-   * @constraints k=16, rows=41621
+   * @constraints k=16, rows=41623
    *
    * @notice Returns the caller's (sender's) `accountId` for caller-side gating.
    * The sender is derived from the same authentication `_debit` performs, so the
@@ -984,6 +946,7 @@ module ConfidentialFungibleToken {
    * @return {Bytes<32>} - The caller's (sender's) accountId.
    */
   export circuit transfer(to: Bytes<32>, value: Uint<128>): Bytes<32> {
+    assertInitialized();
     // Derive the sender from the same authentication `_debit` uses, so the
     // returned id is exactly the account whose funds moved.
     const senderId = _debit(value);
@@ -1003,7 +966,7 @@ module ConfidentialFungibleToken {
    * operations (`mint`/`burn`) live in a separate layer outside this conserving
    * surface, and only they may break conservation.
    *
-   * @constraints k=16, rows=41610
+   * @constraints k=16, rows=41612
    *
    * @notice Like `transfer`, the credit lands in the recipient's pending pool
    * (see the dual-balance note); the caller sweeps their own incoming value.
@@ -1029,6 +992,7 @@ module ConfidentialFungibleToken {
    * @return {Bytes<32>} - The caller's accountId (for caller-side gating).
    */
   export circuit _move(to: Bytes<32>, value: Uint<128>): Bytes<32> {
+    assertInitialized();
     const senderId = _debit(value);
     _credit(to, value);
     return senderId;
@@ -1161,7 +1125,7 @@ module ConfidentialFungibleToken {
    * caller via `approve`) and credits it to `to`, reducing both escrow copies by
    * `value`. The amount is hidden.
    *
-   * @constraints k=17, rows=68922
+   * ???? @constraints k=17, rows=68920
    *
    * @notice Returns the caller's (spender's) `accountId` for caller-side gating.
    *
@@ -1171,7 +1135,6 @@ module ConfidentialFungibleToken {
    * - `value` is within `MAX_TRANSFER_VALUE()`.
    * - `to` is registered and is not the zero account.
    * - An escrow from `fromAddress` to the caller exists with at least `value`.
-   * - `fromAddress` and the caller are registered.
    *
    * @param {Bytes<32>} fromAddress - The owner whose escrow is drawn on.
    * @param {Bytes<32>} to - The recipient account.
@@ -1183,6 +1146,7 @@ module ConfidentialFungibleToken {
                    to: Bytes<32>,
                    value: Uint<128>
                    ): Bytes<32> {
+    assertInitialized();
     _assertValueInBound(value);
     assert(to != default<Bytes<32>>,
            "ConfidentialFungibleToken: invalid receiver");
@@ -1335,13 +1299,6 @@ module ConfidentialFungibleToken {
    * not prove the post-refund balance on a later re-approve/revoke. See the
    * `EscrowEntry` field doc.
    *
-   * Requirements:
-   *
-   * - Contract is initialized.
-   * - `value` is within `MAX_TRANSFER_VALUE()`.
-   * - An escrow from `fromAddress` to the caller exists with at least `value`.
-   * - `fromAddress` and the caller are registered.
-   *
    * @param fromAddress - The owner whose escrow the caller (spender) draws on.
    * @param value - The amount to consume from the allowance.
    */
@@ -1353,10 +1310,6 @@ module ConfidentialFungibleToken {
     assert(_escrow.member(disclose(fromAddress)) &&
            _escrow.lookup(disclose(fromAddress)).member(disclose(spenderId)),
            "ConfidentialFungibleToken: no escrow");
-    assert(_encryptionKeys.member(disclose(spenderId)),
-           "ConfidentialFungibleToken: spender not registered");
-    assert(_encryptionKeys.member(disclose(fromAddress)),
-           "ConfidentialFungibleToken: owner not registered");
 
     const entry = _escrow.lookup(disclose(fromAddress)).lookup(disclose(spenderId));
 
@@ -1421,14 +1374,13 @@ module ConfidentialFungibleToken {
    * recipient credit. The building block for a composing contract's
    * `burnFrom`; it performs no supply accounting (see `_burn`).
    *
-   * @constraints k=16, rows=42205
+   * ???? @constraints k=16, rows=42201
    *
    * Requirements:
    *
    * - Contract is initialized.
    * - `value` is within `MAX_TRANSFER_VALUE()`.
    * - An escrow from `fromAddress` to the caller exists with at least `value`.
-   * - `fromAddress` and the caller are registered.
    *
    * @param {Bytes<32>} fromAddress - The owner whose escrow is consumed.
    * @param {Uint<128>} value - The amount to burn.