Folds account.receiving_balance into account.spendable_balance
and resets the receiving storage entry to the identity.
No proof is required; correctness follows from the homomorphic property of Pedersen commitments. Only the account holder can authorize a merge โ third parties cannot weaponize it.
e - Access to the Soroban environment.account - The owner address.storage::merge] errors.["merge", account: Address][]fn merge(env: soroban_sdk::Env, account: soroban_sdk::Address)Marks account as frozen. Owner-gated.
Freeze stops an already-registered account from transacting; it does
not stop register (the module gates registration by policy only).
Removing an address from the policy is the complete exclusion path.
fn freeze(
env: soroban_sdk::Env,
account: soroban_sdk::Address,
operator: soroban_sdk::Address,
)Deposits amount units of the underlying SEP-41 token from from
into to's confidential receiving balance.
No proof is required. The deposit commitment is a ยท G with zero
blinding, added homomorphically to to.receiving_balance. The
depositor from does not need a registered confidential account;
only to does.
e - Access to the Soroban environment.from - The depositor (SEP-41 holder).to - The confidential recipient.amount - The non-negative deposit amount.storage::deposit] errors.["deposit", from: Address, to: Address][amount: i128]fn deposit(
env: soroban_sdk::Env,
from: soroban_sdk::Address,
to: soroban_sdk::Address,
amount: i128,
)Registers a confidential account under account.
e - Access to the Soroban environment.account - The owner address being registered.auditor_id - The auditor key index this account commits to.data - XDR-encoded [RegisterData].storage::decode_data] errors.storage::register] errors.["register", account: Address][auditor_id: u32]fn register(
env: soroban_sdk::Env,
account: soroban_sdk::Address,
auditor_id: u32,
data: soroban_sdk::Bytes,
)Clears the frozen flag on account. Owner-gated.
fn unfreeze(
env: soroban_sdk::Env,
account: soroban_sdk::Address,
operator: soroban_sdk::Address,
)Withdraws amount units to the public SEP-41 address to from the
confidential spendable balance of from.
e - Access to the Soroban environment.from - The confidential account spending the funds.to - The SEP-41 recipient.amount - The non-negative withdrawal amount.data - XDR-encoded [WithdrawData].storage::decode_data] errors.storage::withdraw] errors.["withdraw", from: Address, to: Address][amount: i128, r_e: BytesN<64>, sigma: BytesN<32>, b_tilde: BytesN<32>, b_aud_s: BytesN<32>]fn withdraw(
env: soroban_sdk::Env,
from: soroban_sdk::Address,
to: soroban_sdk::Address,
amount: i128,
data: soroban_sdk::Bytes,
)Returns Some(Address) if ownership is set, or None if ownership has
been renounced.
e - Access to the Soroban environment.fn get_owner(env: soroban_sdk::Env) -> OptionReturns whether account is currently frozen. Returns false when
compliance has not been configured.
e - Access to the Soroban environment.account - The address to check.fn is_frozen(env: soroban_sdk::Env, account: soroban_sdk::Address) -> boolReturns true iff a delegation exists for (account, spender)
and is still live (ledger.sequence() <= live_until_ledger).
e - Access to the Soroban environment.account - The delegating account.spender - The delegated spender.fn is_spender(
env: soroban_sdk::Env,
account: soroban_sdk::Address,
spender: soroban_sdk::Address,
) -> boolEscrows an allowance from account's spendable balance and delegates it
to spender. Reverts if a delegation already exists for the (account, spender) pair.
e - Access to the Soroban environment.account - The delegating owner.spender - The delegated spender. Must be a registered confidential
account so its spending key is available for the dvk escrow ECDH.live_until_ledger - The ledger number at which the delegation
expires. Spending is authorized while ledger.sequence() <= live_until_ledger. The escrowed value persists until
revoke_spender.data - XDR-encoded [SetSpenderData].storage::decode_data] errors.storage::set_spender] errors.["set_spender", account: Address, spender: Address][live_until_ledger: u32, r_e, sigma, b_tilde, v_aud_s, b_aud_s]fn set_spender(
env: soroban_sdk::Env,
account: soroban_sdk::Address,
spender: soroban_sdk::Address,
live_until_ledger: u32,
data: soroban_sdk::Bytes,
)Binds the underlying SEP-41 asset, the verifier registry and the auditor
registry, freezes the contract's address-as-field value used to
domain-separate every account's viewing key, sets the compliance
owner, and activates compliance against policy.
owner โ the key authorized to freeze / unfreeze and to rotate the
compliance config. Ops custody; never the application's key.policy โ the allowlist registry. Required: a token deployed without
one is an ungated token, and writing the config at construction is
what makes compliance active at all (the hooks short-circuit to a
no-op whenever no config is stored).Finally it raises this contract's instance TTL to the network maximum
(maxEntryTTL, read off the ledger โ never a literal, because testnet
and pubnet disagree on every other archival setting). A lapsed token
instance would take the whole deployment down; the rent is ~0.11 XLM.
fn __constructor(
env: soroban_sdk::Env,
owner: soroban_sdk::Address,
underlying_asset: soroban_sdk::Address,
verifier: soroban_sdk::Address,
auditor: soroban_sdk::Address,
policy: soroban_sdk::Address,
)Revokes the (account, spender) delegation and folds the
remaining escrowed allowance back into account's spendable balance.
Works for both active and expired-but-not-revoked delegations.
e - Access to the Soroban environment.account - The owner reclaiming the allowance.spender - The previously-delegated spender.data - XDR-encoded [RevokeSpenderData].storage::decode_data] errors.storage::revoke_spender] errors.["revoke_spender", account: Address, spender: Address][r_e, sigma, b_tilde, v_aud_s, b_aud_s]fn revoke_spender(
env: soroban_sdk::Env,
account: soroban_sdk::Address,
spender: soroban_sdk::Address,
data: soroban_sdk::Bytes,
)Accepts a pending ownership transfer.
e - Access to the Soroban environment.crate::role_transfer::RoleTransferError::NoPendingTransfer] - If
there is no pending transfer to accept.["ownership_transfer_completed"][new_owner: Address]fn accept_ownership(env: soroban_sdk::Env)Returns the active [ComplianceConfig], or None when compliance
has not been configured.
e - Access to the Soroban environment.fn compliance_config(env: soroban_sdk::Env) -> OptionRenounces ownership of the contract.
Permanently removes the owner, disabling all functions gated by
#[only_owner].
e - Access to the Soroban environment.OwnableError::TransferInProgress] - If there is a pending ownership
transfer.OwnableError::OwnerNotSet] - If the owner is not set.fn renounce_ownership(env: soroban_sdk::Env)Initiates a 2-step ownership transfer to a new address.
Requires authorization from the current owner. The new owner must later
call accept_ownership() to complete the transfer.
e - Access to the Soroban environment.new_owner - The proposed new owner.live_until_ledger - Ledger number until which the new owner can
accept. A value of 0 cancels any pending transfer.OwnableError::OwnerNotSet] - If the owner is not set.crate::role_transfer::RoleTransferError::NoPendingTransfer] - If
trying to cancel a transfer that doesn't exist.crate::role_transfer::RoleTransferError::InvalidLiveUntilLedger] -
If the specified ledger is in the past.crate::role_transfer::RoleTransferError::InvalidPendingAccount] -
If the specified pending account is not the same as the provided new
address.fn transfer_ownership(
env: soroban_sdk::Env,
new_owner: soroban_sdk::Address,
live_until_ledger: u32,
)Returns the [ConfidentialAccount] stored under account.
e - Access to the Soroban environment.account - The owner address.storage::get_account] errors.fn confidential_balance(
env: soroban_sdk::Env,
account: soroban_sdk::Address,
) -> ConfidentialAccountSends a confidential transfer from from to to.
e - Access to the Soroban environment.from - The sender.to - The recipient.data - XDR-encoded [TransferData].storage::decode_data] errors.storage::confidential_transfer] errors.["transfer", from: Address, to: Address][r_e, v_tilde, sigma, b_tilde, v_aud_r, r_aud_r, v_aud_s, b_aud_s]fn confidential_transfer(
env: soroban_sdk::Env,
from: soroban_sdk::Address,
to: soroban_sdk::Address,
data: soroban_sdk::Bytes,
)Atomically replaces the compliance configuration โ rotate the policy, or switch the gate off entirely. Owner-gated; ops break-glass.
fn set_compliance_config(
env: soroban_sdk::Env,
config: ComplianceConfig,
operator: soroban_sdk::Address,
)Returns the [SpenderDelegation] stored under (account, spender).
e - Access to the Soroban environment.account - The delegating account.spender - The delegated spender.storage::get_spender_delegation] errors.fn get_spender_delegation(
env: soroban_sdk::Env,
account: soroban_sdk::Address,
spender: soroban_sdk::Address,
) -> SpenderDelegationSpends from from's allowance escrowed to spender, transferring
confidentially to to. The owner's authorization was
granted at set_spender and persists in the on-chain delegation
entry; only the spender authorizes this call.
e - Access to the Soroban environment.spender - The delegated spender (the auth principal).from - The owner whose allowance is being spent.to - The recipient.data - XDR-encoded [SpenderTransferData].storage::decode_data] errors.storage::confidential_transfer_from] errors.["spender_transfer", spender: Address, from: Address, to: Address][r_e, v_tilde, sigma_a, v_aud_r, r_aud_r, v_aud_s, a_aud_s]fn confidential_transfer_from(
env: soroban_sdk::Env,
spender: soroban_sdk::Address,
from: soroban_sdk::Address,
to: soroban_sdk::Address,
data: soroban_sdk::Bytes,
)