@pvium/p2id-core 0.1.0

package/contracts/PviumIdentity.sol

@@ -0,0 +1,268 @@
+// SPDX-License-Identifier: MIT
+pragma solidity ^0.8.27;
+
+import {IVerifier} from "./PviumZKVerifier.sol";
+import {IPviumIdentity} from "./interfaces/IPviumIdentity.sol";
+
+/// @title PviumIdentity
+/// @notice On-chain verifier for Pvium attestations: one deployment per circuit version. The
+///         accepted signer keys start as the Privy app's JWKS at deployment (Privy publishes more
+///         than one key per app and may sign with any of them). The owner manages the set so a
+///         Privy key rotation does not strand deposits: adding a key is proposed with the JWKS URL
+///         and key id it can be checked at, and takes effect after SIGNER_KEY_DELAY (7 days);
+///         removing one is immediate, because a leaked key must stop being trusted at once. A key
+///         proposal is the strongest power here (a forged key forges proofs), which is why it is
+///         public for 7 days: anyone can verify the key at the URL, and payees and funders can
+///         claim or refund before it activates. An owner of address(0) makes the set permanent.
+///         A new circuit build is still a new deployment (plus a new PviumVerifier), which the
+///         P2ID vault factory registers alongside the old one. Developers call it through IPviumIdentity.
+/// @dev Public input layout emitted by circuit/src/main.nr:
+///        [0] identity_type   [1] wallet (EVM address checked in-circuit against the token; 0 if none)
+///        [2] signer_x_hi     [3] signer_x_lo     [4] signer_y_hi   [5] signer_y_lo
+///        [6] iat             [7] identity_hash_hi  [8] identity_hash_lo
+///        [9] wallet_hash_hi  [10] wallet_hash_lo  (zero when the proof carries no wallet)
+///      Hashes and coordinates are split into two 128-bit halves because a 256-bit value does
+///      not fit in one BN254 field element.
+contract PviumIdentity is IPviumIdentity {
+    uint256 public constant PUBLIC_INPUT_COUNT = 11;
+
+    IVerifier public immutable verifier;
+    /// @notice Circuit version this deployment verifies (see circuit/version.json). One deployment per version.
+    uint16 public immutable circuitVersion;
+    /// @notice Notice a key proposal gives before it can be activated.
+    uint64 public constant SIGNER_KEY_DELAY = 7 days;
+    /// @notice Number of accepted signer keys. Zero (every key revoked) refuses every proof until a
+    ///         proposal matures: a freeze, never a payout.
+    uint256 public signerKeyCount;
+    /// @notice Incremented whenever a key is revoked, i.e. whenever proofs that verified before may
+    ///         no longer be trusted. Vaults discard wallets cached under an older revision.
+    uint64 public keySetRevision;
+    /// @dev Accepted signer keys, keyed by signerKeyHash(x, y).
+    mapping(bytes32 keyHash => bool) private _signerKeys;
+    /// @notice Manages the signer key set (two-step transfer); address(0) = the set is permanent.
+    address public owner;
+    address public pendingOwner;
+
+    struct SignerKeyProposal {
+        uint256 x;
+        uint256 y;
+        /// Earliest activation time; zero when there is no proposal for this key.
+        uint64 eta;
+        /// Where the key is published: the JWKS URL and the key id in it, for anyone to check.
+        string url;
+        string kid;
+    }
+    /// @notice Pending key proposals, keyed by signerKeyHash(x, y).
+    mapping(bytes32 keyHash => SignerKeyProposal) public signerKeyProposals;
+
+    event SignerKeyProposed(uint256 indexed x, uint256 indexed y, uint64 eta, string url, string kid);
+    event SignerKeyProposalCancelled(uint256 indexed x, uint256 indexed y);
+    event SignerKeyAdded(uint256 indexed x, uint256 indexed y);
+    event SignerKeyRemoved(uint256 indexed x, uint256 indexed y);
+    event OwnershipTransferStarted(address indexed from, address indexed to);
+    event OwnershipTransferred(address indexed from, address indexed to);
+
+    /// @notice Everything an attestation asserts, for Pvium's own contracts (e.g. vault claims
+    ///         that pay `wallet`). Developers should use the IPviumIdentity functions.
+    struct Attestation {
+        uint8 identityType;
+        /// EVM address of the wallet linked in the same token. The circuit decodes it from the
+        /// signed token and asserts equality, so it is never prover-chosen. Zero when the proof
+        /// carries no wallet or the wallet is not an EVM address (then only walletHash is set).
+        address wallet;
+        /// When Privy issued the token (unix seconds). Freshness policy is the caller's.
+        uint64 iat;
+        bytes32 identityHash;
+        /// P2IDHash.walletHash of a wallet linked in the same token, or 0.
+        bytes32 walletHash;
+    }
+
+    error InvalidVerifier();
+    error InvalidProof();
+    error UnknownSigner(bytes32 x, bytes32 y);
+    error WrongPublicInputCount(uint256 got);
+    error InvalidPublicKey();
+    error NoSignerKeys();
+    error DuplicateSignerKey(uint256 x, uint256 y);
+    error InvalidCircuitVersion();
+    error IdentityTypeMismatch(uint8 expected, uint8 got);
+    error IdentityMismatch();
+    error NoWallet();
+    error WalletMismatch();
+    error NotOwner();
+    error NotPendingOwner();
+    error KeyAlreadyAccepted(uint256 x, uint256 y);
+    error NothingProposed(uint256 x, uint256 y);
+    error TimelockNotElapsed(uint64 eta);
+    error UnknownKey(uint256 x, uint256 y);
+
+    /// @param _owner Manages the key set; address(0) fixes the set given here forever.
+    /// @param _signerXs/_signerYs Raw P-256 coordinates of every key the Privy app signs with.
+    constructor(
+        IVerifier _verifier,
+        uint16 _circuitVersion,
+        address _owner,
+        uint256[] memory _signerXs,
+        uint256[] memory _signerYs
+    ) {
+        if (address(_verifier).code.length == 0) revert InvalidVerifier();
+        if (_circuitVersion == 0) revert InvalidCircuitVersion();
+        if (_signerXs.length == 0 || _signerXs.length != _signerYs.length) revert NoSignerKeys();
+        for (uint256 i = 0; i < _signerXs.length; i++) {
+            (uint256 x, uint256 y) = (_signerXs[i], _signerYs[i]);
+            if (!_isOnCurve(x, y)) revert InvalidPublicKey();
+            bytes32 h = signerKeyHash(x, y);
+            if (_signerKeys[h]) revert DuplicateSignerKey(x, y);
+            _signerKeys[h] = true;
+        }
+        verifier = _verifier;
+        circuitVersion = _circuitVersion;
+        signerKeyCount = _signerXs.length;
+        owner = _owner;
+        emit OwnershipTransferred(address(0), _owner);
+    }
+
+    // ---- signer key management ------------------------------------------------------------
+
+    /// @notice Propose accepting a key, published at `url` under `kid`, after SIGNER_KEY_DELAY.
+    ///         Re-proposing a key restarts its delay.
+    function proposeSignerKey(uint256 x, uint256 y, string calldata url, string calldata kid) external onlyOwner {
+        if (!_isOnCurve(x, y)) revert InvalidPublicKey();
+        bytes32 h = signerKeyHash(x, y);
+        if (_signerKeys[h]) revert KeyAlreadyAccepted(x, y);
+        uint64 eta = uint64(block.timestamp) + SIGNER_KEY_DELAY;
+        signerKeyProposals[h] = SignerKeyProposal({x: x, y: y, eta: eta, url: url, kid: kid});
+        emit SignerKeyProposed(x, y, eta, url, kid);
+    }
+
+    function cancelSignerKeyProposal(uint256 x, uint256 y) external onlyOwner {
+        bytes32 h = signerKeyHash(x, y);
+        if (signerKeyProposals[h].eta == 0) revert NothingProposed(x, y);
+        delete signerKeyProposals[h];
+        emit SignerKeyProposalCancelled(x, y);
+    }
+
+    /// @notice Accept a proposed key once its delay has passed. Anyone may call it: the owner
+    ///         already decided by proposing, and can still cancel until this runs.
+    function activateSignerKey(uint256 x, uint256 y) external {
+        bytes32 h = signerKeyHash(x, y);
+        uint64 eta = signerKeyProposals[h].eta;
+        if (eta == 0) revert NothingProposed(x, y);
+        if (block.timestamp < eta) revert TimelockNotElapsed(eta);
+        delete signerKeyProposals[h];
+        if (_signerKeys[h]) revert KeyAlreadyAccepted(x, y);
+        _signerKeys[h] = true;
+        signerKeyCount++;
+        emit SignerKeyAdded(x, y);
+    }
+
+    /// @notice Stop accepting a key at once (e.g. Privy retired it, or it leaked). Proofs made from
+    ///         tokens it signed fail from now on, and wallets that vaults cached from any proof are
+    ///         discarded (keySetRevision). Removing the last key is allowed: it freezes claims,
+    ///         which is the safe state while a compromised key is replaced.
+    function removeSignerKey(uint256 x, uint256 y) external onlyOwner {
+        bytes32 h = signerKeyHash(x, y);
+        if (!_signerKeys[h]) revert UnknownKey(x, y);
+        _signerKeys[h] = false;
+        signerKeyCount--;
+        keySetRevision++;
+        emit SignerKeyRemoved(x, y);
+    }
+
+    function transferOwnership(address to) external onlyOwner {
+        pendingOwner = to;
+        emit OwnershipTransferStarted(owner, to);
+    }
+
+    function acceptOwnership() external {
+        if (msg.sender != pendingOwner) revert NotPendingOwner();
+        emit OwnershipTransferred(owner, msg.sender);
+        owner = msg.sender;
+        pendingOwner = address(0);
+    }
+
+    modifier onlyOwner() {
+        if (msg.sender != owner || owner == address(0)) revert NotOwner();
+        _;
+    }
+
+    /// @inheritdoc IPviumIdentity
+    function isSignerKey(uint256 x, uint256 y) public view returns (bool) {
+        return _signerKeys[signerKeyHash(x, y)];
+    }
+
+    function signerKeyHash(uint256 x, uint256 y) public pure returns (bytes32) {
+        return keccak256(abi.encode(x, y));
+    }
+
+    // ---- developer-facing ---------------------------------------------------------------
+
+    /// @inheritdoc IPviumIdentity
+    function verifyIdentity(
+        bytes calldata proof,
+        bytes32[] calldata publicInputs,
+        uint8 identityType,
+        bytes32 identityHash,
+        bytes32 walletHash
+    ) external view returns (uint64 issuedAt) {
+        return _verifyIdentity(proof, publicInputs, identityType, identityHash, walletHash);
+    }
+
+    // ---- lower level ----------------------------------------------------------------------
+
+    /// @notice Verify a proof and return everything it asserts. Reverts unless the proof is valid
+    ///         and was produced from a token signed by one of the accepted keys.
+    function verifyAttestation(bytes calldata proof, bytes32[] calldata publicInputs)
+        public
+        view
+        returns (Attestation memory a)
+    {
+        a = _decode(publicInputs);
+        if (!verifier.verify(proof, publicInputs)) revert InvalidProof();
+    }
+
+    // ---- internals -----------------------------------------------------------------------
+
+    function _verifyIdentity(
+        bytes calldata proof,
+        bytes32[] calldata publicInputs,
+        uint8 identityType,
+        bytes32 identityHash,
+        bytes32 walletHash
+    ) internal view returns (uint64) {
+        Attestation memory a = _decode(publicInputs);
+        if (a.identityType != identityType) revert IdentityTypeMismatch(identityType, a.identityType);
+        if (a.identityHash != identityHash) revert IdentityMismatch();
+        if (a.walletHash == bytes32(0)) revert NoWallet();
+        if (a.walletHash != walletHash) revert WalletMismatch();
+        if (!verifier.verify(proof, publicInputs)) revert InvalidProof();
+        return a.iat;
+    }
+
+    /// @dev Cheap checks first (layout, signer), so bad requests fail before the 4M-gas verify.
+    function _decode(bytes32[] calldata publicInputs) internal view returns (Attestation memory a) {
+        if (publicInputs.length != PUBLIC_INPUT_COUNT) revert WrongPublicInputCount(publicInputs.length);
+        bytes32 x = _join(publicInputs[2], publicInputs[3]);
+        bytes32 y = _join(publicInputs[4], publicInputs[5]);
+        if (!isSignerKey(uint256(x), uint256(y))) revert UnknownSigner(x, y);
+        a.identityType = uint8(uint256(publicInputs[0]));
+        a.wallet = address(uint160(uint256(publicInputs[1])));
+        a.iat = uint64(uint256(publicInputs[6]));
+        a.identityHash = _join(publicInputs[7], publicInputs[8]);
+        a.walletHash = _join(publicInputs[9], publicInputs[10]);
+    }
+
+    function _join(bytes32 hi, bytes32 lo) internal pure returns (bytes32) {
+        return bytes32((uint256(hi) << 128) | uint256(lo));
+    }
+
+    /// @dev y^2 == x^3 - 3x + b (mod p) on NIST P-256. Guards against registering a typo.
+    function _isOnCurve(uint256 x, uint256 y) internal pure returns (bool) {
+        uint256 p = 0xFFFFFFFF00000001000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFF;
+        uint256 b = 0x5AC635D8AA3A93E7B3EBBD55769886BC651D06B0CC53B0F63BCE3C3E27D2604B;
+        if (x >= p || y >= p) return false;
+        uint256 lhs = mulmod(y, y, p);
+        uint256 rhs = addmod(addmod(mulmod(mulmod(x, x, p), x, p), p - mulmod(3, x, p), p), b, p);
+        return lhs == rhs;
+    }
+}

package/contracts/PviumP2IDPolicy.sol

@@ -0,0 +1,78 @@
+// SPDX-License-Identifier: MIT
+pragma solidity ^0.8.27;
+
+import {IP2IDPolicy} from "./interfaces/IP2IDPolicy.sol";
+
+/// @title PviumP2IDPolicy
+/// @notice The launch policy for P2ID vaults: an owner-managed allowlist of verifiers, and no fee.
+///         Later capabilities (permissionless verifier registration with a stake, protocol fees)
+///         ship as a new policy that the vault factory switches to through its timelock; the
+///         vaults and their addresses do not change.
+/// @dev `owner` should be a Pvium multisig. Approving a verifier only lets payers opt into it;
+///      revoking one freezes claims under it (refunds still work) and never moves funds.
+contract PviumP2IDPolicy is IP2IDPolicy {
+    address public owner;
+    address public pendingOwner;
+    mapping(address verifier => bool) public approvedVerifiers;
+
+    event VerifierApprovalSet(address indexed verifier, bool approved);
+    event OwnershipTransferStarted(address indexed from, address indexed to);
+    event OwnershipTransferred(address indexed from, address indexed to);
+
+    error NotOwner();
+    error NotPendingOwner();
+    error InvalidOwner();
+    error InvalidVerifier();
+    error NoFees();
+
+    constructor(address _owner, address[] memory _verifiers) {
+        if (_owner == address(0)) revert InvalidOwner();
+        owner = _owner;
+        emit OwnershipTransferred(address(0), _owner);
+        for (uint256 i = 0; i < _verifiers.length; i++) _setApproval(_verifiers[i], true);
+    }
+
+    /// @notice Approve (or revoke) a verifier.
+    function approveVerifier(address verifier, bool approved) external onlyOwner {
+        _setApproval(verifier, approved);
+    }
+
+    /// @inheritdoc IP2IDPolicy
+    function isVerifierAllowed(address verifier) external view returns (bool) {
+        return approvedVerifiers[verifier];
+    }
+
+    /// @inheritdoc IP2IDPolicy
+    function feeBps(address, address) external pure returns (uint16) {
+        return 0;
+    }
+
+    /// @inheritdoc IP2IDPolicy
+    /// @dev The launch policy charges no fee, so a vault never has fees for it to distribute.
+    function distributeFee(address, address, uint256) external payable {
+        revert NoFees();
+    }
+
+    function transferOwnership(address to) external onlyOwner {
+        pendingOwner = to;
+        emit OwnershipTransferStarted(owner, to);
+    }
+
+    function acceptOwnership() external {
+        if (msg.sender != pendingOwner) revert NotPendingOwner();
+        emit OwnershipTransferred(owner, msg.sender);
+        owner = msg.sender;
+        pendingOwner = address(0);
+    }
+
+    function _setApproval(address verifier, bool approved) private {
+        if (approved && verifier.code.length == 0) revert InvalidVerifier();
+        approvedVerifiers[verifier] = approved;
+        emit VerifierApprovalSet(verifier, approved);
+    }
+
+    modifier onlyOwner() {
+        if (msg.sender != owner) revert NotOwner();
+        _;
+    }
+}

package/contracts/PviumP2IdVaultFactory.sol

@@ -0,0 +1,327 @@
+// SPDX-License-Identifier: MIT
+pragma solidity ^0.8.27;
+
+import {IP2IdVaultFactory} from "./interfaces/IP2IdVaultFactory.sol";
+import {IP2IDPolicy} from "./interfaces/IP2IDPolicy.sol";
+import {P2IDVault} from "./P2IDVault.sol";
+
+/// @title PviumP2IdVaultFactory
+/// @notice Deploys P2IDVaults with CREATE2, salted by identity hash, and points them at the
+///         current policy (which verifiers are allowed, what capped fee applies) and default verifier. A vault takes no constructor arguments
+///         (the factory calls `initialize` right after `new`), so its creation code is a constant
+///         and an identity's vault address is
+///         `keccak256(0xff ‖ factory ‖ identityHash ‖ keccak256(creationCode))`, computable
+///         anywhere from two constants. Funds sent to that address before deployment are swept
+///         by the owner after deployment (see P2IDVault: bare transfers are untracked and irrevocable).
+/// @dev Everything expected to evolve is in the policy (IP2IDPolicy), so this factory and the vault
+///      code, which fix every P2ID address, never have to change. Both move only through a
+///      timelock (propose, wait, activate): the policy after `policyChangeDelay`, the default
+///      verifier after DEFAULT_VERIFIER_DELAY, a fixed 14 days. Direct transfers follow the default
+///      verifier and have no refund path, so a change to it gets the longer notice: anyone who
+///      objects can sweep first, and the vault guarantees nothing can freeze their claim meanwhile.
+///      What a policy can do is bounded by the vault (fee cap, fees fixed at funding, no fee on
+///      refunds, never redirecting a payout, never blocking claims through the default verifier).
+contract PviumP2IdVaultFactory is IP2IdVaultFactory {
+    bytes32 public immutable nsHash;
+    uint64 public immutable minRefundWindow;
+    uint64 public immutable maxRefundWindow;
+
+    /// @notice Proposes and activates policy / default-verifier changes (a Pvium multisig). Two-step transfer.
+    address public owner;
+    address public pendingOwner;
+
+    /// @notice The policy every vault consults. Changes only via the timelock below.
+    address public policy;
+    /// @notice Verifier used when a payer does not choose one. Changes only via the timelock below.
+    address public defaultVerifier;
+
+    /// @notice Notice before a proposed default verifier can be activated. Fixed in this bytecode.
+    uint64 public constant DEFAULT_VERIFIER_DELAY = 14 days;
+    /// @notice Notice before a proposed policy can be activated.
+    uint64 public immutable policyChangeDelay;
+    address public proposedDefaultVerifier;
+    /// @notice Earliest time the proposed default can be activated; 0 when nothing is proposed.
+    uint64 public proposedDefaultEta;
+    address public proposedPolicy;
+    /// @notice Earliest time the proposed policy can be activated; 0 when nothing is proposed.
+    uint64 public proposedPolicyEta;
+
+    event OwnershipTransferStarted(address indexed from, address indexed to);
+    event OwnershipTransferred(address indexed from, address indexed to);
+    event DefaultVerifierProposed(address indexed verifier, uint64 eta);
+    event DefaultVerifierProposalCancelled(address indexed verifier);
+    event DefaultVerifierActivated(address indexed verifier);
+    event PolicyProposed(address indexed policy, uint64 eta);
+    event PolicyProposalCancelled(address indexed policy);
+    event PolicyActivated(address indexed policy);
+
+    error NotOwner();
+    error NotPendingOwner();
+    error InvalidOwner();
+    error InvalidPolicy();
+    error VerifierNotApproved(address verifier);
+    error NothingProposed();
+    error TimelockNotElapsed(uint64 eta);
+    error InvalidRefundWindow();
+    error TokenCallFailed();
+    error TokenBalanceQueryFailed();
+    error NothingReceived();
+    error UnexpectedValue();
+
+    constructor(
+        address _owner,
+        bytes32 _nsHash,
+        address _policy,
+        address _defaultVerifier,
+        uint64 _policyChangeDelay,
+        uint64 _minRefundWindow,
+        uint64 _maxRefundWindow
+    ) {
+        if (_owner == address(0)) revert InvalidOwner();
+        if (_minRefundWindow > _maxRefundWindow) revert InvalidRefundWindow();
+        if (_policy.code.length == 0) revert InvalidPolicy();
+        if (!IP2IDPolicy(_policy).isVerifierAllowed(_defaultVerifier)) revert VerifierNotApproved(_defaultVerifier);
+        owner = _owner;
+        emit OwnershipTransferred(address(0), _owner);
+        nsHash = _nsHash;
+        policyChangeDelay = _policyChangeDelay;
+        minRefundWindow = _minRefundWindow;
+        maxRefundWindow = _maxRefundWindow;
+        policy = _policy;
+        emit PolicyActivated(_policy);
+        defaultVerifier = _defaultVerifier;
+        emit DefaultVerifierActivated(_defaultVerifier);
+    }
+
+    // ------------------------------------------------------------------ policy (timelocked)
+
+    /// @notice Announce a new policy. Takes effect only after `policyChangeDelay`, via
+    ///         activatePolicy(). Replaces any pending policy proposal.
+    function proposePolicy(address newPolicy) external onlyOwner {
+        if (newPolicy.code.length == 0) revert InvalidPolicy();
+        proposedPolicy = newPolicy;
+        proposedPolicyEta = uint64(block.timestamp) + policyChangeDelay;
+        emit PolicyProposed(newPolicy, proposedPolicyEta);
+    }
+
+    function cancelPolicyProposal() external onlyOwner {
+        if (proposedPolicyEta == 0) revert NothingProposed();
+        emit PolicyProposalCancelled(proposedPolicy);
+        delete proposedPolicy;
+        delete proposedPolicyEta;
+    }
+
+    /// @notice Switch every vault to the proposed policy once the delay has elapsed. The new policy
+    ///         must allow the current default verifier, so bare transfers stay claimable.
+    function activatePolicy() external onlyOwner {
+        uint64 eta = proposedPolicyEta;
+        if (eta == 0) revert NothingProposed();
+        if (block.timestamp < eta) revert TimelockNotElapsed(eta);
+        address newPolicy = proposedPolicy;
+        if (!IP2IDPolicy(newPolicy).isVerifierAllowed(defaultVerifier)) revert VerifierNotApproved(defaultVerifier);
+        delete proposedPolicy;
+        delete proposedPolicyEta;
+        policy = newPolicy;
+        emit PolicyActivated(newPolicy);
+    }
+
+    // ------------------------------------------------------------------ default verifier (timelocked)
+
+    /// @notice Announce a new default verifier (must be allowed by the policy). Takes effect only
+    ///         after DEFAULT_VERIFIER_DELAY (14 days), via activateDefaultVerifier(). Replaces any
+    ///         pending proposal.
+    function proposeDefaultVerifier(address verifier) external onlyOwner {
+        if (!IP2IDPolicy(policy).isVerifierAllowed(verifier)) revert VerifierNotApproved(verifier);
+        proposedDefaultVerifier = verifier;
+        proposedDefaultEta = uint64(block.timestamp) + DEFAULT_VERIFIER_DELAY;
+        emit DefaultVerifierProposed(verifier, proposedDefaultEta);
+    }
+
+    function cancelDefaultVerifierProposal() external onlyOwner {
+        if (proposedDefaultEta == 0) revert NothingProposed();
+        emit DefaultVerifierProposalCancelled(proposedDefaultVerifier);
+        delete proposedDefaultVerifier;
+        delete proposedDefaultEta;
+    }
+
+    /// @notice Make the proposed verifier the default once the delay has elapsed. The policy must
+    ///         still allow it (a revocation in the meantime cancels it in effect).
+    function activateDefaultVerifier() external onlyOwner {
+        uint64 eta = proposedDefaultEta;
+        if (eta == 0) revert NothingProposed();
+        if (block.timestamp < eta) revert TimelockNotElapsed(eta);
+        address verifier = proposedDefaultVerifier;
+        if (!IP2IDPolicy(policy).isVerifierAllowed(verifier)) revert VerifierNotApproved(verifier);
+        delete proposedDefaultVerifier;
+        delete proposedDefaultEta;
+        defaultVerifier = verifier;
+        emit DefaultVerifierActivated(verifier);
+    }
+
+    function transferOwnership(address to) external onlyOwner {
+        pendingOwner = to;
+        emit OwnershipTransferStarted(owner, to);
+    }
+
+    function acceptOwnership() external {
+        if (msg.sender != pendingOwner) revert NotPendingOwner();
+        emit OwnershipTransferred(owner, msg.sender);
+        owner = msg.sender;
+        pendingOwner = address(0);
+    }
+
+    // ------------------------------------------------------------------ vaults
+
+    /// @inheritdoc IP2IdVaultFactory
+    function p2idVersion() external pure returns (string memory) {
+        return "p2id.factory.v1";
+    }
+
+    /// @inheritdoc IP2IdVaultFactory
+    function vaultFor(bytes32 identityHash) public view returns (address) {
+        return
+            address(
+                uint160(
+                    uint256(
+                        keccak256(
+                            abi.encodePacked(
+                                bytes1(0xff),
+                                address(this),
+                                identityHash,
+                                initCodeHash()
+                            )
+                        )
+                    )
+                )
+            );
+    }
+
+    /// @inheritdoc IP2IdVaultFactory
+    function isDeployed(bytes32 identityHash) public view returns (bool) {
+        return vaultFor(identityHash).code.length != 0;
+    }
+
+    /// @notice keccak256 of the P2IDVault creation code (no constructor arguments), for offline derivation.
+    function initCodeHash() public pure returns (bytes32) {
+        return keccak256(type(P2IDVault).creationCode);
+    }
+
+    /// @inheritdoc IP2IdVaultFactory
+    function deploy(bytes32 identityHash) public returns (address vault) {
+        vault = vaultFor(identityHash);
+        if (vault.code.length != 0) return vault;
+        P2IDVault v = new P2IDVault{salt: identityHash}();
+        v.initialize(nsHash, identityHash, minRefundWindow, maxRefundWindow);
+        vault = address(v);
+        emit VaultDeployed(identityHash, vault);
+    }
+
+    /// @inheritdoc IP2IdVaultFactory
+    function fund(
+        bytes32 identityHash,
+        address token,
+        uint256 amount,
+        bytes32 constraint,
+        uint64 refundWindow,
+        bytes32 ref
+    ) external payable returns (address vault, uint256 depositId) {
+        return
+            _fund(
+                identityHash,
+                defaultVerifier,
+                token,
+                amount,
+                constraint,
+                refundWindow,
+                ref
+            );
+    }
+
+    /// @inheritdoc IP2IdVaultFactory
+    function fundWith(
+        bytes32 identityHash,
+        address verifier,
+        address token,
+        uint256 amount,
+        bytes32 constraint,
+        uint64 refundWindow,
+        bytes32 ref
+    ) external payable returns (address vault, uint256 depositId) {
+        return
+            _fund(
+                identityHash,
+                verifier,
+                token,
+                amount,
+                constraint,
+                refundWindow,
+                ref
+            );
+    }
+
+    function _fund(
+        bytes32 identityHash,
+        address verifier,
+        address token,
+        uint256 amount,
+        bytes32 constraint,
+        uint64 refundWindow,
+        bytes32 ref
+    ) private returns (address vault, uint256 depositId) {
+        vault = deploy(identityHash);
+        if (token == address(0)) {
+            // Native coin: forward exactly the value sent; the vault checks it equals `amount`.
+            return (vault, P2IDVault(payable(vault)).fundFor{value: msg.value}(msg.sender, verifier, token, amount, constraint, refundWindow, ref));
+        }
+        if (msg.value != 0) revert UnexpectedValue();
+        // Collect from the payer (credit what actually arrived, for fee-on-transfer tokens),
+        // then let the vault pull exactly that and record the payer as funder.
+        uint256 before = _balanceOf(token);
+        _callToken(
+            token,
+            abi.encodeWithSignature(
+                "transferFrom(address,address,uint256)",
+                msg.sender,
+                address(this),
+                amount
+            )
+        );
+        uint256 received = _balanceOf(token) - before;
+        if (received == 0) revert NothingReceived();
+        _callToken(
+            token,
+            abi.encodeWithSignature("approve(address,uint256)", vault, received)
+        );
+        depositId = P2IDVault(payable(vault)).fundFor(
+            msg.sender,
+            verifier,
+            token,
+            received,
+            constraint,
+            refundWindow,
+            ref
+        );
+    }
+
+    function _callToken(address token, bytes memory input) private {
+        (bool ok, bytes memory data) = token.call(input);
+        if (
+            !ok ||
+            (data.length != 0 &&
+                (data.length != 32 || !abi.decode(data, (bool))))
+        ) revert TokenCallFailed();
+    }
+
+    function _balanceOf(address token) private view returns (uint256 balance) {
+        (bool ok, bytes memory data) = token.staticcall(
+            abi.encodeWithSignature("balanceOf(address)", address(this))
+        );
+        if (!ok || data.length != 32) revert TokenBalanceQueryFailed();
+        balance = abi.decode(data, (uint256));
+    }
+
+    modifier onlyOwner() {
+        if (msg.sender != owner) revert NotOwner();
+        _;
+    }
+}