@openzeppelin/compact-contracts 0.5.0-alpha.1 → 0.5.0-alpha.2

package/token/extensions/ConfidentialNoteFungibleTokenDelivery.compact

@@ -0,0 +1,274 @@
+// SPDX-License-Identifier: MIT
+// OpenZeppelin Compact Contracts v0.5.0-alpha.2 (token/extensions/ConfidentialNoteFungibleTokenDelivery.compact)
+
+pragma language_version >= 0.26.0;
+
+/**
+ * @module ConfidentialNoteFungibleTokenDelivery
+ * @description Extension that publishes every output note
+ * of a `ConfidentialNoteFungibleToken` encrypted to its owner's Jubjub key, so
+ * a wallet discovers its notes from chain data alone. One ECDH per output, two
+ * one-time pads from `EcdhMask.kdf`, one append-only `_deliveries` list. It
+ * imports no token module: the composer calls `_deliver` beside the core's
+ * note creation.
+ *
+ * @dev Notation. `Hf`, `pk`, `nonce` and `slot` are defined in the core
+ * - `encPk = g^ekScalar`: the owner's Jubjub encryption key, paired with the
+ *   spend identity `pk` out of band.
+ * - `e = Hf("CNFT:delivery:e", seed, slot, nonce, encPk)`: the ephemeral
+ *   scalar.
+ * - `E = g^e` and `S = encPk^e = E^ekScalar`: the `crypto/Ecdh` exchange.
+ * - `valueCt = (value + kdf(S, "CNFT:delivery:value")) mod 2^248` and
+ *   `nonceCt = (nonce + kdf(S, "CNFT:delivery:nonce")) mod 2^248`: one-time
+ *   pads over `[0, 2^248)`, the width of `kdf`'s output.
+ *
+ * @dev Compatibility:
+ * The wire format a wallet depends on is the `Delivery` layout, the two pad
+ * tags, and the modular pad. The `e` tag and the `EphemeralPreimage` layout
+ * are sender-side: a recipient recovers `S` from `E` and never recomputes `e`.
+ * The compatibility suite pins all of them.
+ *
+ * @notice Privacy:
+ * - Public, per output: `E`, a fresh pseudorandom point, and two pad outputs,
+ *   each uniform to anyone without `ekScalar`. No field names `pk`, `encPk`
+ *   or `cm`, so entries cannot be grouped by recipient.
+ * - Public, per tx: one entry per `_deliver` call, beside the leaf it
+ *   describes. The count is constant per entry point when the composer
+ *   delivers every output (see Composition).
+ * - Private: `encPk`, `value`, `nonce`, the seed, `e`, `S`. `slot` is hashed
+ *   into `e` and never written; it is a public constant of the composer.
+ * - Hiding: with a uniform mask the pad is perfect, so `valueCt` and
+ *   `nonceCt` carry nothing about the plaintext, regardless of its width
+ *   or distribution; the only bound is `2^248` (`UintN<248>.MODULUS`). The mask's
+ *   uniformity is `EcdhMask`'s assumption: hashed ElGamal, CDH in the
+ *   random-oracle model.
+ *
+ * @notice Security:
+ * - The nonce is the spend capability and the pads are one-time, so a
+ *   repeated `e` to one key opens both notes. `e` binds the nonce and the
+ *   key: two committed notes never share a pad even under a reused seed,
+ *   since `_issuedNonces` keeps nonces unique, and one note to two keys
+ *   never shares `E`. The seed MUST still be fresh and secret per call. `e`
+ *   is secret only while the seed or the nonce is, and a known `e` opens the
+ *   entry to everyone.
+ * - No authentication: the pads are malleable and nothing binds an entry to a
+ *   leaf. A wallet accepts a recovered note only once `commitOf(note, pk)` is
+ *   in the tree (see Client-side duties).
+ * - No authorization: `_deliver` is ungated like the core's `_` circuits. The
+ *   composer's gate on note creation is the gate on delivery.
+ * - Not checked here: that the delivered pair is the committed note, and that
+ *   `encPk` pairs with the owner's `pk`. The composer passes one note to
+ *   `_mintNote` and to `_deliver` in one circuit. A wrong `encPk` makes the
+ *   note undiscoverable, not stealable, since `cm` binds the owner's `pk`.
+ *
+ * @notice Concurrency:
+ * `_deliver` reads nothing and pins nothing, so every delivery commutes with
+ * every other call.
+ *
+ * @notice Composition:
+ * - Call `_deliver` once per output and per intended key, zero-value change
+ *   included, never under a condition on private data: the entry count per
+ *   entry point must stay constant.
+ * - `slot` separates repeated deliveries of one note to one key. Under a
+ *   reused seed, the same note to the same key with one slot repeats the
+ *   entry byte for byte; distinct slots give each delivery its own `E`.
+ * - Nothing to initialize and no ledger read: `_deliver` runs from the
+ *   composer's constructor, which is how a constructor-time mint reaches its
+ *   owner.
+ * - Delivering a note twice adds an entry and nothing else. Wallets dedupe by
+ *   commitment.
+ * - A composed contract supersedes the core header's out-of-band delivery and
+ *   no-rescan statements: its wallets find their notes by scanning
+ *   `_deliveries`.
+ *
+ * @notice Client-side duties:
+ * - Keys: `encPk = g^ekScalar`. Derive `ekScalar` from the wallet seed under a
+ *   module-specific domain (`ElGamal.secretToScalar` is the library's
+ *   derivation) and share `(pk, encPk)` together.
+ * - Scan: read `_deliveries` from the length last seen, newest first. For each
+ *   entry, `recoverNote(entry, ekScalar)`; drop `value >= 2^128`, a wrong key
+ *   with overwhelming probability; keep the note iff
+ *   `commitOf({ value, nonce }, pk)` is a leaf, and record the leaf index;
+ *   `nullifierOf(note)` in `_nullifiers` means spent. One scalar
+ *   multiplication per entry, no proof.
+ * - `ekScalar` never enters an on-chain circuit: `recoverNote` is pure and
+ *   runs in the wallet.
+ *
+ * @notice Scalability:
+ * `_deliveries` gains one entry per output and is never pruned; every wallet
+ * scans every entry once.
+ *
+ * @dev Performance:
+ * `_deliver` pays one SHA-256 over the ephemeral preimage, two scalar
+ * multiplications, one point digest, two masks derived from it and the two
+ * modular pads.
+ */
+module ConfidentialNoteFungibleTokenDelivery {
+  import CompactStandardLibrary;
+  import "../../crypto/Ecdh" prefix Ecdh_;
+  import "../../crypto/EcdhMask" prefix EcdhMask_;
+  import { wrappingAdd, wrappingSub } from "../../math/UintN"<248> prefix U248_;
+
+  /**
+   * @description One output note, encrypted to its owner. Public once written;
+   * no field is secret on its own.
+   * @type {JubjubPoint} ephemeralPk - `E = g^e`, fresh per output. Never the
+   * identity.
+   * @type {Uint<248>} valueCt - `(value + kdf(S, "CNFT:delivery:value")) mod 2^248`.
+   * @type {Uint<248>} nonceCt - `(nonce + kdf(S, "CNFT:delivery:nonce")) mod 2^248`.
+   *
+   * @dev The `Uint<248>` pads keep both ciphertext atoms below 32 bytes. The
+   * generated `List` accessors (`head`, `popFront`) throw `exceeded structure
+   * bounds` on an entry with a full-width field atom.
+   */
+  export struct Delivery {
+    ephemeralPk: JubjubPoint;
+    valueCt: Uint<248>;
+    nonceCt: Uint<248>;
+  }
+
+  /**
+   * @description An entry with its pads stripped, nothing checked. A wrong key
+   * yields a uniform pair; the wallet range-checks `value` and matches the
+   * commitment.
+   * @type {Uint<248>} value - The note's value, below `2^128` for a note
+   * addressed to the key.
+   * @type {Uint<248>} nonce - The note's nonce.
+   */
+  export struct RecoveredNote {
+    value: Uint<248>;
+    nonce: Uint<248>;
+  }
+
+  /**
+   * @description Preimage of the ephemeral scalar: the core's `NoncePreimage`
+   * shape plus the recipient key. The domain tag and the extra field keep `e`
+   * apart from a core nonce drawn from the same seed.
+   * @type {Bytes<32>} domain - The ephemeral domain tag.
+   * @type {Bytes<32>} seed - The caller's per-invocation randomness.
+   * @type {Bytes<32>} slot - The per-output tag.
+   * @type {Field} nonce - The delivered note's nonce.
+   * @type {JubjubPoint} encPk - The key the entry is addressed to.
+   */
+  struct EphemeralPreimage {
+    domain: Bytes<32>;
+    seed: Bytes<32>;
+    slot: Bytes<32>;
+    nonce: Field;
+    encPk: JubjubPoint;
+  }
+
+  /**
+   * @description Every delivery ever made, newest first. Append-only: no
+   * circuit reads, removes or overwrites an entry. Unbounded.
+   * @type {List<Delivery>} _deliveries - The feed wallets scan.
+   */
+  export ledger _deliveries: List<Delivery>;
+
+  /**
+   * @witness wit_ConfidentialNoteDeliveryRandomness
+   * @description Returns the seed `_deliver` derives its ephemeral scalar
+   * from.
+   *
+   * @dev Freshness is mandatory:
+   * MUST be fresh and secret per call. The nonce binding turns a reused seed
+   * from a stolen note into nothing; `e` still stays secret only while the
+   * seed or the nonce does.
+   *
+   * @returns {Bytes<32>} seed - A 32-byte cryptographically secure random
+   * value.
+   */
+  witness wit_ConfidentialNoteDeliveryRandomness(): Bytes<32>;
+
+  /**
+   * @description Publishes `(value, nonce)` encrypted to `encPk`: one ECDH
+   * under a key- and nonce-bound ephemeral, two modular `EcdhMask` pads, one
+   * `_deliveries` entry. Call it beside the core's note creation, once per
+   * output and intended key.
+   *
+   * @constraints k=15, rows=24782
+   *
+   * @warning No authorization:
+   * The composer gates who may call this.
+   *
+   * @dev Key- and nonce-bound ephemeral:
+   * `e = Hf(domain, seed, slot, nonce, encPk)`, so `e` repeats only when all
+   * of `(seed, slot, nonce, encPk)` repeat: a reused seed never pads two
+   * committed notes alike and never gives two keys one `E`.
+   *
+   * @dev Constant shape:
+   * No branch on the ledger and no ledger read: the transcript is independent
+   * of every input, and two deliveries in one block never conflict.
+   *
+   * Requirements:
+   *
+   * - `encPk` is not the identity point.
+   * - `nonce < 2^248`. Every `degradeToTransient` output qualifies.
+   *
+   * @param {JubjubPoint} encPk - The owner's encryption key, `g^ekScalar`.
+   * @param {Uint<128>} value - The note's value.
+   * @param {Field} nonce - The note's nonce.
+   * @param {Bytes<32>} slot - The per-output tag; distinct per delivery when
+   * one note goes to one key more than once.
+   * @return {[]} - Empty tuple.
+   */
+  export circuit _deliver(encPk: JubjubPoint, value: Uint<128>, nonce: Field, slot: Bytes<32>): [] {
+    const e = degradeToTransient(persistentHash<EphemeralPreimage>(EphemeralPreimage {
+      seed: wit_ConfidentialNoteDeliveryRandomness(),
+      domain: pad(32, "CNFT:delivery:e"),
+      slot: slot,
+      nonce: nonce,
+      encPk: encPk
+    })) as JubjubScalar;
+    // The identity-key and zero-ephemeral guards come from `deriveShared`.
+    const shared = Ecdh_deriveShared(encPk, e);
+    // One point digest feeds both pads.
+    const sharedDigest = EcdhMask_pointDigest(shared.sShared);
+    // The cast is the width check: a bit above the pad would sit in the clear.
+    const paddedNonce = nonce as Uint<248>;
+    const delivery = Delivery {
+      ephemeralPk: shared.ephemeralPk,
+      valueCt: U248_wrappingAdd(value as Uint<248>,
+                                EcdhMask_kdfFromDigest(sharedDigest, pad(32, "CNFT:delivery:value")) as Uint<248>),
+      nonceCt: U248_wrappingAdd(paddedNonce,
+                                EcdhMask_kdfFromDigest(sharedDigest, pad(32, "CNFT:delivery:nonce")) as Uint<248>)
+    };
+    _deliveries.pushFront(disclose(delivery));
+  }
+
+  /**
+   * @description Strips the pads from an entry with the owner's secret scalar.
+   * Pure and off-chain: a wallet reads its notes with no proof.
+   *
+   * @constraints k=14, rows=15063
+   *
+   * @notice Raw result:
+   * Nothing derived from `ekScalar` or the recovered pair is checked, so the
+   * circuit is no oracle for a candidate key. A wrong key returns a uniform
+   * pair; the wallet filters on `value < 2^128` and the commitment tree.
+   *
+   * @dev Identity ephemeral:
+   * `_deliver` never writes one, and its pads would be public constants, so
+   * the entry is refused rather than opened, as `EcdhMask.decrypt` does.
+   *
+   * Requirements:
+   *
+   * - `delivery.ephemeralPk` is not the identity point.
+   *
+   * @param {Delivery} delivery - The entry to open.
+   * @param {JubjubScalar} ekScalar - The secret behind the `encPk` the entry
+   * was addressed to.
+   * @return {RecoveredNote} - The padded pair.
+   */
+  export pure circuit recoverNote(delivery: Delivery, ekScalar: JubjubScalar): RecoveredNote {
+    assert(delivery.ephemeralPk != ecMulGenerator(0 as JubjubScalar),
+           "ConfidentialNoteFungibleTokenDelivery: identity ephemeral");
+    const sharedDigest = EcdhMask_pointDigest(Ecdh_recoverShared(delivery.ephemeralPk, ekScalar));
+    return RecoveredNote {
+      value: U248_wrappingSub(delivery.valueCt,
+                              EcdhMask_kdfFromDigest(sharedDigest, pad(32, "CNFT:delivery:value")) as Uint<248>),
+      nonce: U248_wrappingSub(delivery.nonceCt,
+                              EcdhMask_kdfFromDigest(sharedDigest, pad(32, "CNFT:delivery:nonce")) as Uint<248>)
+    };
+  }
+}

package/token/extensions/NativeShieldedTokenDerivedNonce.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.5.0-alpha.1 (token/extensions/NativeShieldedTokenDerivedNonce.compact)
+// OpenZeppelin Compact Contracts v0.5.0-alpha.2 (token/extensions/NativeShieldedTokenDerivedNonce.compact)
 
 pragma language_version >= 0.26.0;
 

package/token/extensions/NativeShieldedTokenFamilyPublicSupply.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.2.0 (token/extensions/NativeShieldedTokenFamilyPublicSupply.compact)
+// OpenZeppelin Compact Contracts v0.5.0-alpha.2 (token/extensions/NativeShieldedTokenFamilyPublicSupply.compact)
 
 pragma language_version >= 0.26.0;
 

package/token/extensions/NativeShieldedTokenPublicSupply.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.2.0 (token/extensions/NativeShieldedTokenPublicSupply.compact)
+// OpenZeppelin Compact Contracts v0.5.0-alpha.2 (token/extensions/NativeShieldedTokenPublicSupply.compact)
 
 pragma language_version >= 0.26.0;
 

package/token/extensions/NativeShieldedTokenPublicSupplyCore.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.2.0 (token/extensions/NativeShieldedTokenPublicSupplyCore.compact)
+// OpenZeppelin Compact Contracts v0.5.0-alpha.2 (token/extensions/NativeShieldedTokenPublicSupplyCore.compact)
 
 pragma language_version >= 0.26.0;
 

package/token/presets/ZOwnableNativeShieldedToken.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.4.0-alpha.4 (token/presets/ZOwnableNativeShieldedToken.compact)
+// OpenZeppelin Compact Contracts v0.5.0-alpha.2 (token/presets/ZOwnableNativeShieldedToken.compact)
 
 pragma language_version >= 0.26.0;
 

package/utils/EvmAbi.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.5.0-alpha.1 (utils/EvmAbi.compact)
+// OpenZeppelin Compact Contracts v0.5.0-alpha.2 (utils/EvmAbi.compact)
 
 pragma language_version >= 0.26.0;
 

package/utils/Utils.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.5.0-alpha.1 (utils/Utils.compact)
+// OpenZeppelin Compact Contracts v0.5.0-alpha.2 (utils/Utils.compact)
 
 pragma language_version >= 0.26.0;
 

package/multisig/presets/ShieldedMultiSigV2.compact

@@ -1,289 +0,0 @@
-// SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.5.0-alpha.1 (multisig/presets/ShieldedMultiSigV2.compact)
-
-pragma language_version >= 0.26.0;
-
-/**
- * @module ShieldedMultiSigV2
- * @description Privacy-preserving threshold multisig contract.
- *
- * Signer identities are stored as commitments: hashes of ECDSA public
- * keys combined with an instance salt and domain separator. Signature
- * verification happens in a single transaction with no multi-step
- * proposal lifecycle. The contract enforces threshold authorization
- * and replay protection. All other coordination (signature collection,
- * coin selection) happens off-chain.
- *
- * `t` is the approval width and the threshold: `execute` verifies exactly
- * `t` distinct signers. Import as `"../presets/ShieldedMultiSigV2"<t>`; the
- * implementing contract fixes the signer count `n` at `initialize`. Import
- * one width per contract: two widths share one signer registry, see
- * `Secp256k1EcdsaMultisig`.
- *
- * Treasury is fully stateless meaning coin data is not stored on the public ledger.
- * Deposits call receiveShielded only. The operator discovers coin indices
- * through ZswapOutput events from the indexer, constructs QualifiedShieldedCoinInfo
- * off-chain, and provides it as a circuit parameter for spending.
- *
- * @notice Requires ZKIR v3: `keccak256` is unavailable on the v2 backend.
- *
- * @notice Implementing contracts register the signer set from their
- * constructor by calling this module's `initialize`, and MUST NOT import
- * `Signer` or `Secp256k1EcdsaMultisig` directly.
- */
-module ShieldedMultiSigV2<#t> {
-  import CompactStandardLibrary;
-
-  import "../Secp256k1EcdsaMultisig"<t> prefix Secp256k1EcdsaMultisig_;
-  import "../../crypto/Eip712" prefix Eip712_;
-  import "../../utils/EvmAbi" prefix EvmAbi_;
-  import "../ProposalManager" prefix Proposal_;
-  import "../ShieldedTreasuryStateless" prefix Treasury_;
-
-  // Implementing contracts need this for the re-exported `execute` signature.
-  // Importing `ProposalManager` again instead would give them a second,
-  // unwritten copy of its state.
-  export { Proposal_Recipient };
-
-  /**
-   * @description Monotonic operation counter. `execute` reads it as that
-   * operation's nonce and then increments, so no two executions share one.
-   */
-  ledger _nonce: Counter;
-
-  /**
-   * @description The EIP-712 domain separator every `execute` digest is built
-   * under, derived from `(name, version, instanceSalt)`. Set once at
-   * construction.
-   */
-  export sealed ledger _domainSeparator: Bytes<32>;
-
-  /**
-   * @description Registers the signer set at threshold `t` and fixes the
-   * EIP-712 domain separator.
-   *
-   * @notice Call from the implementing contract's constructor only. It writes
-   * the `sealed` `_domainSeparator`, so implementing contracts MUST NOT expose
-   * `initialize` as a post-deploy circuit.
-   *
-   * The EIP-712 domain fixed here is `(name, version, salt)`. `chainId` and
-   * `verifyingContract` are absent: no network identifier is available
-   * in-circuit, and a 32-byte Midnight address does not fit
-   * `verifyingContract`'s `address` type.
-   *
-   * Replay protection comes from `execute` binding `kernel.self()` in its
-   * struct rather than from the domain. The ledger randomizes a contract's
-   * address at deployment, so no two deployments share one on any network.
-   * A signature for one cannot authorize another.
-   *
-   * `instanceSalt` also keys the signer commitments, so a fresh value per
-   * deployment keeps one public key from producing the same commitment in two
-   * deployments which would link the signer set across them.
-   *
-   * Requirements:
-   *
-   * - `instanceSalt` should be cryptographically random.
-   * - `signerCommitments` must not contain duplicates.
-   * - `n` must be at least `t`.
-   *
-   * @param {Bytes<32>} instanceSalt - Per-deployment salt for commitment derivation.
-   * @param {Vector<n, Bytes<32>>} signerCommitments - Hashed signer identities.
-   * @returns {[]} Empty tuple.
-   */
-  export circuit initialize<#n>(
-    instanceSalt: Bytes<32>,
-    signerCommitments: Vector<n, Bytes<32>>
-  ): [] {
-    Secp256k1EcdsaMultisig_initialize<n>(instanceSalt, signerCommitments);
-
-    const hashedName = keccak256<Bytes<18>>(pad(18, "ShieldedMultiSigV2"));
-    const hashedVersion = keccak256<Bytes<1>>(pad(1, "1"));
-    _domainSeparator = Eip712_domainSeparator(
-      hashedName,
-      hashedVersion,
-      disclose(instanceSalt)
-    );
-  }
-
-  /**
-   * @description `keccak256` of the `Execute` type string:
-   * `Execute(bytes32 contractAddress,uint256 nonce,uint8 recipientKind,bytes32 recipient,bytes32 coinColor,uint256 amount)`
-   *
-   * @dev Written as a literal word. `compactc` emits a full keccak
-   * permutation even for a constant argument, so hashing the type string
-   * in-circuit would add ~4.2k rows to every `execute`. The spec checks this
-   * word against the type string above.
-   *
-   * @returns {Bytes<32>} The `Execute` type hash.
-   */
-  pure circuit EXECUTE_TYPEHASH(): Bytes<32> {
-    const typeHash: Vector<32, Uint<8>> = [
-      0x8e, 0x36, 0xc9, 0x78, 0xf2, 0x00, 0x15, 0xe8,
-      0x1d, 0x7a, 0x53, 0xef, 0xc3, 0x2e, 0x2b, 0x08,
-      0xf1, 0x24, 0x97, 0xa5, 0x05, 0x7c, 0x70, 0x20,
-      0x7f, 0x8b, 0xc4, 0xb7, 0xc6, 0xcf, 0x5e, 0x15
-    ];
-
-    return typeHash as Bytes<32>;
-  }
-
-  /**
-   * @description Receives a shielded coin into the multisig treasury.
-   *
-   * No access control which allows anyone to deposit. The coin is claimed at the
-   * protocol level through receiveShielded. No coin data is stored on the
-   * public ledger, preserving full balance privacy.
-   *
-   * The operator discovers the coin's Merkle tree index by subscribing
-   * to ZswapOutput events via the indexer, filtering by contract address,
-   * and extracting mt_index. Combined with the known ShieldedCoinInfo,
-   * this produces the QualifiedShieldedCoinInfo needed for spending.
-   *
-   * @constraints k=13, rows=5898 (zkir-v3)
-   *
-   * @param {ShieldedCoinInfo} coin - The incoming shielded coin.
-   */
-  export circuit deposit(coin: ShieldedCoinInfo): [] {
-    receiveShielded(disclose(coin));
-  }
-
-  /**
-   * @description Executes a shielded send authorized by threshold signatures.
-   *
-   * The circuit reads the current nonce from the ledger, increments it,
-   * then reconstructs the EIP-712 digest that signers must have signed
-   * off-chain: the `Execute` struct (contract address, nonce, recipient kind,
-   * recipient, coin color, amount) hashed under this deployment's domain
-   * separator. The digest is bound to the contract instance and the full recipient (kind and
-   * address), so a signature authorizes exactly one operation on one instance.
-   *
-   * Approvals are checked by `Secp256k1EcdsaMultisig`, which derives each
-   * signer's commitment from their public key and the instance salt and
-   * rejects duplicates. Constraints below are measured at `t = 2`.
-   *
-   * @notice `to` must be a `ShieldedUser`. A contract-addressed coin would be
-   * unclaimable, making the transaction malformed.
-   *
-   * @constraints k=17, rows=98969 (zkir-v3)
-   *
-   * Requirements:
-   *
-   * - No two entries may be the same signer.
-   * - Every public key must hash to a registered signer commitment.
-   * - Every signature must be valid over the message hash and use the low-s
-   *   encoding.
-   * - `to.kind` must be `ShieldedUser`.
-   * - Coin value must be >= amount.
-   *
-   * @param {Proposal_Recipient} to - The recipient.
-   * @param {Uint<128>} amount - The amount to send.
-   * @param {QualifiedShieldedCoinInfo} coin - The coin to spend (from operator's pool).
-   * @param {Vector<t, Secp256k1Point>} pubkeys - Public keys of approving signers.
-   * @param {Vector<t, Secp256k1EcdsaSignature>} signatures - ECDSA signatures over the operation.
-   *
-   * @returns {ShieldedSendResult} The send result including any change.
-   */
-  export circuit execute(
-    to: Proposal_Recipient,
-    amount: Uint<128>,
-    coin: QualifiedShieldedCoinInfo,
-    pubkeys: Vector<t, Secp256k1Point>,
-    signatures: Vector<t, Secp256k1EcdsaSignature>
-  ): ShieldedSendResult {
-    // Increment nonce
-    const currentNonce = _nonce;
-    _nonce.increment(1);
-
-    // Construct message hash
-    const msgHash = Eip712_hashTypedData(_domainSeparator, keccak256<Vector<7, Bytes<32>>>([
-      EXECUTE_TYPEHASH(),
-      // Binds the digest to this deployment. The domain cannot carry the
-      // address, so removing this word removes cross-instance replay
-      // protection.
-      kernel.self().bytes,
-      EvmAbi_uint64Word(currentNonce),
-      EvmAbi_uint8Word(to.kind as Uint<8>),
-      to.address,
-      coin.color,
-      EvmAbi_uint128Word(amount)
-    ]));
-
-    Secp256k1EcdsaMultisig_assertApprovals(msgHash, pubkeys, signatures);
-
-    assert(
-      to.kind == Proposal_RecipientKind.ShieldedUser,
-      "ShieldedMultiSigV2: recipient must be a coin public key"
-    );
-    const recipient = left<ZswapCoinPublicKey, ContractAddress>(
-      ZswapCoinPublicKey { bytes: to.address }
-    );
-    return Treasury__send(coin, recipient, amount);
-  }
-
-  /**
-   * @description Computes a signer commitment from a secp256k1 public key,
-   * as `persistentHash(pkX, pkY, salt, "Secp256k1EcdsaMultisig:signer")`.
-   *
-   * Pure, so the deployer can derive constructor commitments off-chain.
-   *
-   * Requirements:
-   *
-   * - `pk` must not be the secp256k1 identity point, which has no coordinates.
-   *
-   * @param {Secp256k1Point} pk - The secp256k1 public key.
-   * @param {Bytes<32>} salt - The instance salt.
-   *
-   * @returns {Bytes<32>} The signer commitment.
-   */
-  export pure circuit _calculateSignerId(
-    pk: Secp256k1Point,
-    salt: Bytes<32>
-  ): Bytes<32> {
-    return Secp256k1EcdsaMultisig_calculateSignerId(pk, salt);
-  }
-
-  /**
-   * @description Returns the nonce the next `execute` digest will bind to.
-   *
-   * @constraints k=6, rows=34 (zkir-v3)
-   *
-   * @returns {Uint<64>} The current nonce.
-   */
-  export circuit getNonce(): Uint<64> {
-    return _nonce;
-  }
-
-  /**
-   * @description Returns the number of registered signers.
-   *
-   * @constraints k=6, rows=34 (zkir-v3)
-   *
-   * @returns {Uint<8>} The signer count.
-   */
-  export circuit getSignerCount(): Uint<8> {
-    return Secp256k1EcdsaMultisig_getSignerCount();
-  }
-
-  /**
-   * @description Returns the approval threshold.
-   *
-   * @constraints k=6, rows=34 (zkir-v3)
-   *
-   * @returns {Uint<8>} The threshold.
-   */
-  export circuit getThreshold(): Uint<8> {
-    return Secp256k1EcdsaMultisig_getThreshold();
-  }
-
-  /**
-   * @description Returns whether the given commitment is a registered signer.
-   *
-   * @constraints k=8, rows=129 (zkir-v3)
-   *
-   * @param {Bytes<32>} commitment - The signer commitment to check.
-   * @returns {Boolean} True if registered.
-   */
-  export circuit isSigner(commitment: Bytes<32>): Boolean {
-    return Secp256k1EcdsaMultisig_isSigner(commitment);
-  }
-}