Folds account.receiving_balance into account.spendable_balance
and resets the receiving storage entry to the identity.
No proof is required; correctness follows from the homomorphic property of Pedersen commitments. Only the account holder can authorize a merge — third parties cannot weaponize it.
e - Access to the Soroban environment.account - The owner address.storage::merge] errors.["merge", account: Address][]fn merge(env: soroban_sdk::Env, account: soroban_sdk::Address)fn freeze(
env: soroban_sdk::Env,
account: soroban_sdk::Address,
operator: soroban_sdk::Address,
)Deposits amount units of the underlying SEP-41 token from from
into to's confidential receiving balance.
No proof is required. The deposit commitment is a · G with zero
blinding, added homomorphically to to.receiving_balance. The
depositor from does not need a registered confidential account;
only to does.
e - Access to the Soroban environment.from - The depositor (SEP-41 holder).to - The confidential recipient.amount - The non-negative deposit amount.storage::deposit] errors.["deposit", from: Address, to: Address][amount: i128]fn deposit(
env: soroban_sdk::Env,
from: soroban_sdk::Address,
to: soroban_sdk::Address,
amount: i128,
)Admin-gated WASM upgrade. Keep the admin behind a timelocked multisig. This wraps OpenZeppelin's unmodified confidential-token reference implementation (imported as a library, not vendored/edited here) -- adding this admin-gated upgrade hook to Nyx's own thin contract layer doesn't touch any of that circuit/proof-verification logic.
fn upgrade(env: soroban_sdk::Env, new_wasm_hash: soroban_sdk::BytesN<32>)Returns Some(index) if the account has the specified role,
where index is the position of the account for that role,
and can be used to query [AccessControl::get_role_member()].
Returns None if the account does not have the specified role.
e - Access to Soroban environment.account - The account to check.role - The role to check for.fn has_role(
env: soroban_sdk::Env,
account: soroban_sdk::Address,
role: soroban_sdk::Symbol,
) -> OptionRegisters a confidential account under account.
e - Access to the Soroban environment.account - The owner address being registered.auditor_id - The auditor key index this account commits to.data - XDR-encoded [RegisterData].storage::decode_data] errors.storage::register] errors.["register", account: Address][auditor_id: u32]fn register(
env: soroban_sdk::Env,
account: soroban_sdk::Address,
auditor_id: u32,
data: soroban_sdk::Bytes,
)fn unfreeze(
env: soroban_sdk::Env,
account: soroban_sdk::Address,
operator: soroban_sdk::Address,
)Withdraws amount units to the public SEP-41 address to from the
confidential spendable balance of from.
e - Access to the Soroban environment.from - The confidential account spending the funds.to - The SEP-41 recipient.amount - The non-negative withdrawal amount.data - XDR-encoded [WithdrawData].storage::decode_data] errors.storage::withdraw] errors.["withdraw", from: Address, to: Address][amount: i128, r_e: BytesN<64>, sigma: BytesN<32>, b_tilde: BytesN<32>, b_aud_s: BytesN<32>]fn withdraw(
env: soroban_sdk::Env,
from: soroban_sdk::Address,
to: soroban_sdk::Address,
amount: i128,
data: soroban_sdk::Bytes,
)Returns the admin account.
e - Access to Soroban environment.fn get_admin(env: soroban_sdk::Env) -> OptionReturns whether account is currently frozen. Returns false when
compliance has not been configured.
e - Access to the Soroban environment.account - The address to check.fn is_frozen(env: soroban_sdk::Env, account: soroban_sdk::Address) -> boolGrants a role to an account.
e - Access to Soroban environment.account - The account to grant the role to.role - The role to grant.caller - The address of the caller, must be the admin or have the
RoleAdmin for the role.AccessControlError::Unauthorized] - If the caller does not have
enough privileges.AccessControlError::MaxRolesExceeded] - If adding a new role would
exceed the maximum allowed number of roles.["role_granted", role: Symbol, account: Address][caller: Address]fn grant_role(
env: soroban_sdk::Env,
account: soroban_sdk::Address,
role: soroban_sdk::Symbol,
caller: soroban_sdk::Address,
)Returns true iff a delegation exists for (account, spender)
and is still live (ledger.sequence() <= live_until_ledger).
e - Access to the Soroban environment.account - The delegating account.spender - The delegated spender.fn is_spender(
env: soroban_sdk::Env,
account: soroban_sdk::Address,
spender: soroban_sdk::Address,
) -> boolRevokes a role from an account.
To revoke the caller's own role, use
[AccessControl::renounce_role()] instead.
e - Access to Soroban environment.account - The account to revoke the role from.role - The role to revoke.caller - The address of the caller, must be the admin or has the
RoleAdmin for the role.AccessControlError::Unauthorized] - If the caller does not have
enough privileges.AccessControlError::RoleNotHeld] - If the account doesn't have
the role.AccessControlError::RoleIsEmpty] - If the role has no members.["role_revoked", role: Symbol, account: Address][caller: Address]fn revoke_role(
env: soroban_sdk::Env,
account: soroban_sdk::Address,
role: soroban_sdk::Symbol,
caller: soroban_sdk::Address,
)Escrows an allowance from account's spendable balance and delegates it
to spender. Reverts if a delegation already exists for the (account, spender) pair.
e - Access to the Soroban environment.account - The delegating owner.spender - The delegated spender. Must be a registered confidential
account so its spending key is available for the dvk escrow ECDH.live_until_ledger - The ledger number at which the delegation
expires. Spending is authorized while ledger.sequence() <= live_until_ledger. The escrowed value persists until
revoke_spender.data - XDR-encoded [SetSpenderData].storage::decode_data] errors.storage::set_spender] errors.["set_spender", account: Address, spender: Address][live_until_ledger: u32, r_e, sigma, b_tilde, v_aud_s, b_aud_s]fn set_spender(
env: soroban_sdk::Env,
account: soroban_sdk::Address,
spender: soroban_sdk::Address,
live_until_ledger: u32,
data: soroban_sdk::Bytes,
)fn __constructor(
env: soroban_sdk::Env,
admin: soroban_sdk::Address,
manager: soroban_sdk::Address,
underlying_asset: soroban_sdk::Address,
verifier: soroban_sdk::Address,
auditor: soroban_sdk::Address,
policy: soroban_sdk::Address,
)Allows an account to renounce a role assigned to itself. Users can only renounce roles for their own account.
e - Access to Soroban environment.role - The role to renounce.caller - The address of the caller, must be the account that has the
role.AccessControlError::RoleNotHeld] - If the caller doesn't have the
role.AccessControlError::RoleIsEmpty] - If the role has no members.["role_revoked", role: Symbol, account: Address][caller: Address]fn renounce_role(
env: soroban_sdk::Env,
role: soroban_sdk::Symbol,
caller: soroban_sdk::Address,
)Returns the admin role for a specific role.
If no admin role is explicitly set, returns None.
e - Access to Soroban environment.role - The role to query the admin role for.fn get_role_admin(
env: soroban_sdk::Env,
role: soroban_sdk::Symbol,
) -> OptionAllows the current admin to renounce their role, making the contract permanently admin-less. This is useful for decentralization purposes or when the admin role is no longer needed. Once the admin is renounced, it cannot be reinstated.
e - Access to Soroban environment.AccessControlError::AdminNotSet] - If no admin account is set.["admin_renounced", admin: Address][]fn renounce_admin(env: soroban_sdk::Env)Revokes the (account, spender) delegation and folds the
remaining escrowed allowance back into account's spendable balance.
Works for both active and expired-but-not-revoked delegations.
e - Access to the Soroban environment.account - The owner reclaiming the allowance.spender - The previously-delegated spender.data - XDR-encoded [RevokeSpenderData].storage::decode_data] errors.storage::revoke_spender] errors.["revoke_spender", account: Address, spender: Address][r_e, sigma, b_tilde, v_aud_s, b_aud_s]fn revoke_spender(
env: soroban_sdk::Env,
account: soroban_sdk::Address,
spender: soroban_sdk::Address,
data: soroban_sdk::Bytes,
)Sets admin_role as the admin role of role.
e - Access to Soroban environment.role - The role to set the admin for.admin_role - The new admin role.["role_admin_changed", role: Symbol][previous_admin_role: Symbol, new_admin_role: Symbol]AccessControlError::AdminNotSet] - If admin account is not set.fn set_role_admin(
env: soroban_sdk::Env,
role: soroban_sdk::Symbol,
admin_role: soroban_sdk::Symbol,
)Returns the account at the specified index for a given role.
A function to get all members of a role is not provided because that
would be unbounded. To enumerate all members of a role, use
[AccessControl::get_role_member_count()] to get the total number of
members and then use [AccessControl::get_role_member()] to retrieve
each member one by one.
e - Access to Soroban environment.role - The role to query.index - The index of the account to retrieve.AccessControlError::IndexOutOfBounds] - If the index is out of
bounds for the role's member list.fn get_role_member(
env: soroban_sdk::Env,
role: soroban_sdk::Symbol,
index: u32,
) -> soroban_sdk::AddressReturns the active [ComplianceConfig], or None when compliance
has not been configured.
e - Access to the Soroban environment.fn compliance_config(env: soroban_sdk::Env) -> OptionReturns a vector containing all existing roles. Defaults to empty vector if no roles exist.
e - Access to Soroban environment.This function returns all roles that currently have at least one member.
The maximum number of roles is limited by [MAX_ROLES].
fn get_existing_roles(env: soroban_sdk::Env) -> soroban_sdk::VecInitiates the admin role transfer. Admin privileges for the current admin are not revoked until the recipient accepts the transfer. Overrides the previous pending transfer if there is one.
e - Access to Soroban environment.new_admin - The account to transfer the admin privileges to.live_until_ledger - The ledger number at which the pending transfer
expires. If live_until_ledger is 0, the pending transfer is
cancelled. live_until_ledger argument is implicitly bounded by the
maximum allowed TTL extension for a temporary storage entry and
specifying a higher value will cause the code to panic.crate::role_transfer::RoleTransferError::NoPendingTransfer] - If
trying to cancel a transfer that doesn't exist.crate::role_transfer::RoleTransferError::InvalidLiveUntilLedger] -
If the specified ledger is in the past.crate::role_transfer::RoleTransferError::InvalidPendingAccount] -
If the specified pending account is not the same as the provided new
address.fn transfer_admin_role(
env: soroban_sdk::Env,
new_admin: soroban_sdk::Address,
live_until_ledger: u32,
)Returns the [ConfidentialAccount] stored under account.
e - Access to the Soroban environment.account - The owner address.storage::get_account] errors.fn confidential_balance(
env: soroban_sdk::Env,
account: soroban_sdk::Address,
) -> ConfidentialAccountCompletes the 2-step admin transfer.
e - Access to Soroban environment.["admin_transfer_completed", new_admin: Address][previous_admin: Address]crate::role_transfer::RoleTransferError::NoPendingTransfer] - If
there is no pending transfer to accept.AccessControlError::AdminNotSet] - If admin account is not set.fn accept_admin_transfer(env: soroban_sdk::Env)Sends a confidential transfer from from to to.
e - Access to the Soroban environment.from - The sender.to - The recipient.data - XDR-encoded [TransferData].storage::decode_data] errors.storage::confidential_transfer] errors.["transfer", from: Address, to: Address][r_e, v_tilde, sigma, b_tilde, v_aud_r, r_aud_r, v_aud_s, b_aud_s]fn confidential_transfer(
env: soroban_sdk::Env,
from: soroban_sdk::Address,
to: soroban_sdk::Address,
data: soroban_sdk::Bytes,
)Returns the total number of accounts that have the specified role. If the role does not exist, returns 0.
e - Access to Soroban environment.role - The role to get the count for.fn get_role_member_count(env: soroban_sdk::Env, role: soroban_sdk::Symbol) -> u32fn set_compliance_config(
env: soroban_sdk::Env,
config: ComplianceConfig,
operator: soroban_sdk::Address,
)Returns the [SpenderDelegation] stored under (account, spender).
e - Access to the Soroban environment.account - The delegating account.spender - The delegated spender.storage::get_spender_delegation] errors.fn get_spender_delegation(
env: soroban_sdk::Env,
account: soroban_sdk::Address,
spender: soroban_sdk::Address,
) -> SpenderDelegationfn spender_delegation_xdr(
env: soroban_sdk::Env,
account: soroban_sdk::Address,
spender: soroban_sdk::Address,
) -> soroban_sdk::Bytesfn confidential_balance_xdr(
env: soroban_sdk::Env,
account: soroban_sdk::Address,
) -> soroban_sdk::BytesSpends from from's allowance escrowed to spender, transferring
confidentially to to. The owner's authorization was
granted at set_spender and persists in the on-chain delegation
entry; only the spender authorizes this call.
e - Access to the Soroban environment.spender - The delegated spender (the auth principal).from - The owner whose allowance is being spent.to - The recipient.data - XDR-encoded [SpenderTransferData].storage::decode_data] errors.storage::confidential_transfer_from] errors.["spender_transfer", spender: Address, from: Address, to: Address][r_e, v_tilde, sigma_a, v_aud_r, r_aud_r, v_aud_s, a_aud_s]fn confidential_transfer_from(
env: soroban_sdk::Env,
spender: soroban_sdk::Address,
from: soroban_sdk::Address,
to: soroban_sdk::Address,
data: soroban_sdk::Bytes,
)