Contract Address Details

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.24;

import "@openzeppelin/contracts/access/Ownable.sol";
import "./AdminZamik.sol";

interface IRWAToken {
    function mintWithProof(address to, uint256 amount, bytes32 proofHash) external;
    function mintFee(address to, uint256 amount) external;
    function assetValueUSD() external view returns (uint256);
    function totalSupply() external view returns (uint256);
    function feeRecipient() external view returns (address);
}

/**
 * @title ZKVerifier
 * @notice Verifies Groth16 ZK proofs for RWA ownership claims
 *
 * Security fixes (v2):
 *  - recipient mora biti msg.sender → prepreči frontrunning
 *  - amount je omejen na maxMintable (izračunan iz assetValueUSD) → prepreči neomejeni mint
 *  - amount > 0 check
 *  - proofHash vključuje recipient in amount
 *  - registeredCommitments počiščen po mintu
 *  - setRwaToken odstranjen (mrtva koda — konstruktor že nastavi token)
 */
contract ZKVerifier is Ownable, AdminZamik {

    // === snarkjs-generated VK constants (from rwa_proof_verifier.sol) ===
    // Scalar field size
        uint256 constant r    = 21888242871839275222246405745257275088548364400416034343698204186575808495617;
        // Base field size
        uint256 constant q   = 21888242871839275222246405745257275088696311157297823662689037894645226208583;
    
        // Verification Key data
        uint256 constant alphax  = 20491192805390485299153009773594534940189261866228447918068658471970481763042;
        uint256 constant alphay  = 9383485363053290200918347156157836566562967994039712273449902621266178545958;
        uint256 constant betax1  = 4252822878758300859123897981450591353533073413197771768651442665752259397132;
        uint256 constant betax2  = 6375614351688725206403948262868962793625744043794305715222011528459656738731;
        uint256 constant betay1  = 21847035105528745403288232691147584728191162732299865338377159692350059136679;
        uint256 constant betay2  = 10505242626370262277552901082094356697409835680220590971873171140371331206856;
        uint256 constant gammax1 = 11559732032986387107991004021392285783925812861821192530917403151452391805634;
        uint256 constant gammax2 = 10857046999023057135944570762232829481370756359578518086990519993285655852781;
        uint256 constant gammay1 = 4082367875863433681332203403145435568316851327593401208105741076214120093531;
        uint256 constant gammay2 = 8495653923123431417604973247489272438418190587263600148770280649306958101930;
        uint256 constant deltax1 = 7634694382555350249182314939945794752801670761871442236918755611747247981945;
        uint256 constant deltax2 = 7785580959050401778007424472707980943542624615417776150098749352587788464225;
        uint256 constant deltay1 = 19797755760015837479531733607381070868376789853134730363187779619202029563244;
        uint256 constant deltay2 = 19885317433472164527823093690594480541727870532036884219862146880419864556528;
    
        
        uint256 constant IC0x = 5313285605904455468883044812252347068829101215429313644709835484872601966339;
        uint256 constant IC0y = 2611852344649716617799171908939889777235094010478351269767823832353876722738;
        
        uint256 constant IC1x = 3721507159761245641438686913490987492444926420712387384343195655500770466953;
        uint256 constant IC1y = 10884128966892936170203469452538504289719178213118369098919656563615016733370;
        
        uint256 constant IC2x = 11919587884350751358344086380913156139705038053372491645096979466761922566199;
        uint256 constant IC2y = 11737085826314024049430266969005569805271747491015946543900350977318458074708;
        
     
        // Memory data
        uint16 constant pVk = 0;
        uint16 constant pPairing = 128;
    
        uint16 constant pLastMem = 896;
    // === end generated constants ===

    address public rwaToken;
    address public entropyOracle;

    // Asset registry: samo vnaprej registrirani assetCommitment-i lahko mintajo.
    // assetCommitment = Poseidon(privateKey, entropyNonce) = javni signal _pubSignals[0]
    mapping(uint256 => bool) public registeredCommitments; // upravičenost (nastavi lastnik)
    mapping(uint256 => bool) public commitmentUsed;        // porabljeno (vsak asset minta enkrat)

    // Pooblaščeni UORS operaterji — smejo registrirati commitmente
    mapping(address => bool) public authorizedUORS;

    // Tokenizacijska provizija: 0,5% ob mintu
    uint256 public constant MINT_FEE_BPS = 50; // 50 = 0,5%

    event ProofVerified(address indexed claimant, bytes32 proofHash);
    event RwaTokenSet(address indexed token);
    event MintFeeCollected(address indexed feeRecipient, uint256 fee);
    event AssetRegistered(uint256 indexed commitment);
    event AssetUnregistered(uint256 indexed commitment);
    event AssetMinted(uint256 indexed commitment, address indexed recipient, uint256 amount);
    event UORSAuthorized(address indexed uors);
    event UORSRevoked(address indexed uors);

    modifier onlyOwnerOrUORS() {
        require(msg.sender == owner() || authorizedUORS[msg.sender], "Not authorized");
        _;
    }

    constructor(address _rwaToken, address _entropyOracle) Ownable(msg.sender) {
        // _rwaToken sme biti address(0) pri deployu (circular dep.) — nastavi z setRwaToken()
        rwaToken = _rwaToken;
        entropyOracle = _entropyOracle;
    }

    /**
     * @notice Nastavi RWAToken naslov — samo enkrat po deployu (circular dep. fix).
     * @dev Pokliče se takoj po deploy RWAToken. Po nastavitvi ni več spremenljivo.
     */
    function setRwaToken(address _rwaToken) external onlyOwner {
        require(rwaToken == address(0), "Already set");
        require(_rwaToken != address(0), "Zero address");
        rwaToken = _rwaToken;
        emit RwaTokenSet(_rwaToken);
    }

    /**
     * @notice Registrira legitimen assetCommitment — samo lastnik (izdajatelj sredstva).
     * @dev Lastnik sredstva izračuna commitment = Poseidon(privateKey, entropyNonce)
     *      in deli SAMO commitment (ne ključa). Izdajatelj ga tu registrira.
     */
    /**
     * PODELITEV MOCI GRE SKOZI ZAMIK, ODVZEM NE.
     *
     * Nov UORS lahko registrira commitmente, ti pa so pot do kovanja zetonov.
     * Podtaknjen operater je zato med najmocnejsimi napadi, ki jih owner kljuc
     * sploh omogoca — in je hkrati napad, ki ga je mogoce VIDETI VNAPREJ.
     * Zato javna napoved + zamik.
     *
     * revokeUORS ostaja takojsen: ob razkritem kljucu operaterja ga moras vreci
     * ven zdaj, ne cez 48 ur. Nevarnost caka, zasilna zavora ne.
     */
    function napoviAuthorizeUORS(address uors) external onlyOwner {
        require(uors != address(0), "Zero address");
        _napovej(keccak256(abi.encode("authorizeUORS", uors)), "ZKVerifier.authorizeUORS");
    }

    /// @notice Pooblasti UORS operaterja za registracijo commitmentov.
    function authorizeUORS(address uors) external onlyOwner {
        require(uors != address(0), "Zero address");
        _porabi(keccak256(abi.encode("authorizeUORS", uors)), "ZKVerifier.authorizeUORS");
        authorizedUORS[uors] = true;
        emit UORSAuthorized(uors);
    }

    /// @notice Prekliče pooblastilo UORS operaterja.
    function revokeUORS(address uors) external onlyOwner {
        authorizedUORS[uors] = false;
        emit UORSRevoked(uors);
    }

    function registerCommitment(uint256 commitment) external onlyOwnerOrUORS {
        require(commitment != 0, "Zero commitment");
        require(!registeredCommitments[commitment], "Already registered");
        registeredCommitments[commitment] = true;
        emit AssetRegistered(commitment);
    }

    /// @notice Paketna registracija večih commitmentov naenkrat.
    function registerCommitments(uint256[] calldata commitments) external onlyOwnerOrUORS {
        for (uint256 i = 0; i < commitments.length; i++) {
            uint256 c = commitments[i];
            if (c != 0 && !registeredCommitments[c]) {
                registeredCommitments[c] = true;
                emit AssetRegistered(c);
            }
        }
    }

    /// @notice Prekliče registracijo (le če še ni bil porabljen).
    function unregisterCommitment(uint256 commitment) external onlyOwner {
        require(registeredCommitments[commitment], "Not registered");
        require(!commitmentUsed[commitment], "Already used");
        registeredCommitments[commitment] = false;
        emit AssetUnregistered(commitment);
    }

    /// @notice Onemogoceno: renounceOwnership() bi trajno onemogocil
    ///         (de)avtorizacijo UORS operatorjev in registracijo commitmentov.
    function renounceOwnership() public pure override {
        revert("Renounce onemogocen");
    }

    /**
     * @notice Verify ZK proof and mint RWA tokens to caller.
     * @dev recipient je vedno msg.sender — prepreči frontrunning.
     *      amount je omejen na maxMintable = assetValueUSD / 1e16
     *      (1 RWA token = $0.01 USD pri 18 decimalkah).
     *      Prilagodi delilnik glede na tvojo tokenomiko.
     */
    function verifyAndMint(
        uint[2] calldata _pA,
        uint[2][2] calldata _pB,
        uint[2] calldata _pC,
        uint[2] calldata _pubSignals,
        uint256 amount
    ) external {
        // FIX #2: recipient je vedno msg.sender — prepreči frontrunning iz mempoola
        address recipient = msg.sender;

        // FIX #1a: amount > 0
        require(amount > 0, "Zero amount");

        // FIX #1b: amount omejen na maxMintable glede na vrednost sredstva
        uint256 assetValue = IRWAToken(rwaToken).assetValueUSD();
        uint256 maxMintable = assetValue * 100; // assetValueUSD ima 18 decimalk; *100 ker 1 token = $0.01
        require(amount <= maxMintable, "Amount exceeds asset value");

        require(verifyProof(_pA, _pB, _pC, _pubSignals), "Invalid ZK proof");

        // Asset registry: dokaz mora pripadati registriranemu, še neporabljenemu sredstvu
        uint256 commitment = _pubSignals[0];
        require(registeredCommitments[commitment], "Commitment not registered");
        require(!commitmentUsed[commitment], "Asset already minted");
        commitmentUsed[commitment] = true;

        // FIX #3: počisti registracijo po mintu (clean state)
        registeredCommitments[commitment] = false;

        // FIX #4: proofHash vključuje recipient in amount — popolna auditability
        // Tokenizacijska provizija: 0,5% ob mintu → feeRecipient (platforma)
        uint256 mintFee = amount * MINT_FEE_BPS / 10_000;
        uint256 netAmount = amount - mintFee;

        bytes32 proofHash = keccak256(abi.encode(_pA, _pB, _pC, _pubSignals, recipient, amount));
        IRWAToken(rwaToken).mintWithProof(recipient, netAmount, proofHash);

        if (mintFee > 0) {
            address feeRecipient = IRWAToken(rwaToken).feeRecipient();
            IRWAToken(rwaToken).mintFee(feeRecipient, mintFee);
            emit MintFeeCollected(feeRecipient, mintFee);
        }

        emit AssetMinted(commitment, recipient, netAmount);
        emit ProofVerified(recipient, proofHash);
    }

    function verifyProof(uint[2] calldata _pA, uint[2][2] calldata _pB, uint[2] calldata _pC, uint[2] calldata _pubSignals) internal view returns (bool result) {
        assembly {
            function checkField(v) {
                if iszero(lt(v, r)) {
                    mstore(0, 0)
                    revert(0, 0)
                }
            }
            
            // G1 function to multiply a G1 value(x,y) to value in an address
            function g1_mulAccC(pR, x, y, s) {
                let success
                let mIn := mload(0x40)
                mstore(mIn, x)
                mstore(add(mIn, 32), y)
                mstore(add(mIn, 64), s)

                success := staticcall(sub(gas(), 2000), 7, mIn, 96, mIn, 64)

                if iszero(success) {
                    mstore(0, 0)
                    revert(0, 0)
                }

                mstore(add(mIn, 64), mload(pR))
                mstore(add(mIn, 96), mload(add(pR, 32)))

                success := staticcall(sub(gas(), 2000), 6, mIn, 128, pR, 64)

                if iszero(success) {
                    mstore(0, 0)
                    revert(0, 0)
                }
            }

            function checkPairing(pA, pB, pC, pubSignals, pMem) -> isOk {
                let _pPairing := add(pMem, pPairing)
                let _pVk := add(pMem, pVk)

                mstore(_pVk, IC0x)
                mstore(add(_pVk, 32), IC0y)

                // Compute the linear combination vk_x
                
                g1_mulAccC(_pVk, IC1x, IC1y, calldataload(add(pubSignals, 0)))
                
                g1_mulAccC(_pVk, IC2x, IC2y, calldataload(add(pubSignals, 32)))
                

                // -A
                mstore(_pPairing, calldataload(pA))
                mstore(add(_pPairing, 32), mod(sub(q, calldataload(add(pA, 32))), q))

                // B
                mstore(add(_pPairing, 64), calldataload(pB))
                mstore(add(_pPairing, 96), calldataload(add(pB, 32)))
                mstore(add(_pPairing, 128), calldataload(add(pB, 64)))
                mstore(add(_pPairing, 160), calldataload(add(pB, 96)))

                // alpha1
                mstore(add(_pPairing, 192), alphax)
                mstore(add(_pPairing, 224), alphay)

                // beta2
                mstore(add(_pPairing, 256), betax1)
                mstore(add(_pPairing, 288), betax2)
                mstore(add(_pPairing, 320), betay1)
                mstore(add(_pPairing, 352), betay2)

                // vk_x
                mstore(add(_pPairing, 384), mload(add(pMem, pVk)))
                mstore(add(_pPairing, 416), mload(add(pMem, add(pVk, 32))))


                // gamma2
                mstore(add(_pPairing, 448), gammax1)
                mstore(add(_pPairing, 480), gammax2)
                mstore(add(_pPairing, 512), gammay1)
                mstore(add(_pPairing, 544), gammay2)

                // C
                mstore(add(_pPairing, 576), calldataload(pC))
                mstore(add(_pPairing, 608), calldataload(add(pC, 32)))

                // delta2
                mstore(add(_pPairing, 640), deltax1)
                mstore(add(_pPairing, 672), deltax2)
                mstore(add(_pPairing, 704), deltay1)
                mstore(add(_pPairing, 736), deltay2)


                let success := staticcall(sub(gas(), 2000), 8, _pPairing, 768, _pPairing, 0x20)

                isOk := and(success, mload(_pPairing))
            }

            let pMem := mload(0x40)
            mstore(0x40, add(pMem, pLastMem))

            // Validate that all evaluations ∈ F
            
            checkField(calldataload(add(_pubSignals, 0)))
            
            checkField(calldataload(add(_pubSignals, 32)))
            

            // Validate all evaluations
            let isValid := checkPairing(_pA, _pB, _pC, _pubSignals, pMem)

            result := isValid
         }
     }
}
        

// SPDX-License-Identifier: MIT
// OpenZeppelin Contracts (last updated v5.0.0) (access/Ownable.sol)

pragma solidity ^0.8.20;

import {Context} from "../utils/Context.sol";

/**
 * @dev Contract module which provides a basic access control mechanism, where
 * there is an account (an owner) that can be granted exclusive access to
 * specific functions.
 *
 * The initial owner is set to the address provided by the deployer. This can
 * later be changed with {transferOwnership}.
 *
 * This module is used through inheritance. It will make available the modifier
 * `onlyOwner`, which can be applied to your functions to restrict their use to
 * the owner.
 */
abstract contract Ownable is Context {
    address private _owner;

    /**
     * @dev The caller account is not authorized to perform an operation.
     */
    error OwnableUnauthorizedAccount(address account);

    /**
     * @dev The owner is not a valid owner account. (eg. `address(0)`)
     */
    error OwnableInvalidOwner(address owner);

    event OwnershipTransferred(address indexed previousOwner, address indexed newOwner);

    /**
     * @dev Initializes the contract setting the address provided by the deployer as the initial owner.
     */
    constructor(address initialOwner) {
        if (initialOwner == address(0)) {
            revert OwnableInvalidOwner(address(0));
        }
        _transferOwnership(initialOwner);
    }

    /**
     * @dev Throws if called by any account other than the owner.
     */
    modifier onlyOwner() {
        _checkOwner();
        _;
    }

    /**
     * @dev Returns the address of the current owner.
     */
    function owner() public view virtual returns (address) {
        return _owner;
    }

    /**
     * @dev Throws if the sender is not the owner.
     */
    function _checkOwner() internal view virtual {
        if (owner() != _msgSender()) {
            revert OwnableUnauthorizedAccount(_msgSender());
        }
    }

    /**
     * @dev Leaves the contract without owner. It will not be possible to call
     * `onlyOwner` functions. Can only be called by the current owner.
     *
     * NOTE: Renouncing ownership will leave the contract without an owner,
     * thereby disabling any functionality that is only available to the owner.
     */
    function renounceOwnership() public virtual onlyOwner {
        _transferOwnership(address(0));
    }

    /**
     * @dev Transfers ownership of the contract to a new account (`newOwner`).
     * Can only be called by the current owner.
     */
    function transferOwnership(address newOwner) public virtual onlyOwner {
        if (newOwner == address(0)) {
            revert OwnableInvalidOwner(address(0));
        }
        _transferOwnership(newOwner);
    }

    /**
     * @dev Transfers ownership of the contract to a new account (`newOwner`).
     * Internal function without access restriction.
     */
    function _transferOwnership(address newOwner) internal virtual {
        address oldOwner = _owner;
        _owner = newOwner;
        emit OwnershipTransferred(oldOwner, newOwner);
    }
}
          

// SPDX-License-Identifier: MIT
// OpenZeppelin Contracts (last updated v5.0.1) (utils/Context.sol)

pragma solidity ^0.8.20;

/**
 * @dev Provides information about the current execution context, including the
 * sender of the transaction and its data. While these are generally available
 * via msg.sender and msg.data, they should not be accessed in such a direct
 * manner, since when dealing with meta-transactions the account sending and
 * paying for execution may not be the actual sender (as far as an application
 * is concerned).
 *
 * This contract is only required for intermediate, library-like contracts.
 */
abstract contract Context {
    function _msgSender() internal view virtual returns (address) {
        return msg.sender;
    }

    function _msgData() internal view virtual returns (bytes calldata) {
        return msg.data;
    }

    function _contextSuffixLength() internal view virtual returns (uint256) {
        return 0;
    }
}
          

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.24;

import "@openzeppelin/contracts/access/Ownable.sol";

/**
 * @title AdminZamik
 * @notice Casovni zamik na nevarne admin spremembe.
 *
 * ZAKAJ TO OBSTAJA
 * ----------------
 * Owner kljuc na tej platformi NE more krasti: ne more kovati zetonov, ne more
 * premikati tujih zetonov in ne more v escrow. Kar PA lahko, je tiho zamenjati
 * nastavitve pod nogami uporabnikov — KYC listo, placilni token, prijavljeno
 * vrednost sredstva.
 *
 * Vsi trije so napadi, ki jih je mogoce VIDETI VNAPREJ. Zato jih ne branimo z
 * multisigom (ki varuje lastnika kljuca), ampak s casovnim zamikom (ki varuje
 * UPORABNIKA): sprememba se mora najprej javno napovedati, sele po zamiku jo je
 * mogoce izvesti. Uporabnik ima ves ta cas, da spremembo vidi in izstopi.
 *
 * Namenoma NI zunanje timelock pogodbe kot lastnika. Tak vzorec doda tveganje
 * nedosegljivosti: ce lastniku kdaj ne uspe sestaviti transakcije skozi tujo
 * pogodbo, so kontrakti zamrznjeni za vedno. Tu je zamik vgrajen, lastnik pa
 * ostane navadna denarnica.
 *
 * KAJ ZAMIK NE POKRIVA (namerno)
 * ------------------------------
 *   - pause()   — zasilna zavora mora biti takojsnja, sicer ni zavora
 *   - unpause() — vrnitev v obratovanje naj bo hitra
 *   - odvzem pravice zaustavljalca — ob razkritem kljucu ga moras vreci TAKOJ
 * Nevarnost caka, zasilna zavora ne.
 */
abstract contract AdminZamik is Ownable {
    /// @notice Rok, v katerem je napoved uporabna. Po njem potece.
    /// @dev Brez tega bi stara napoved lezala na verigi kot nabita puska:
    ///      napoves nekaj neopaznega danes, izvedes cez pol leta, ko nihce vec
    ///      ne gleda. Napoved, ki ni bila izvedena v roku, je treba ponoviti.
    uint256 public constant ROK = 7 days;

    /// @notice id napovedi → cas, od katerega je izvedljiva (0 = ni napovedi)
    mapping(bytes32 => uint256) public izvedljivoOd;

    event SpremembaNapovedana(bytes32 indexed id, string kaj, uint256 izvedljivoOd, uint256 potece);
    event SpremembaIzvedena(bytes32 indexed id, string kaj);
    event SpremembaPreklicana(bytes32 indexed id, string kaj);

    /// @notice Koliko casa mora sprememba cakati.
    ///
    /// ⚠️⚠️ TRENUTNO 10 MINUT — RAZVOJNA VREDNOST ZA TESTNET (943).
    ///      Nastavljeno 24. 8. 2026 po Juretovi odlocitvi. Projekt se razvija
    ///      izkljucno na testnetu; mainnet je na pavzi.
    ///
    ///      PRED KAKRSNIMKOLI DEPLOYEM NA MAINNET (369) VRNI NA 48 ur.
    ///      Deset minut zamika na mainnetu pomeni, da napadalec z admin
    ///      kljucem izvede spremembo, preden jo utegnes opaziti — zamik je
    ///      takrat videti prisoten, a je brez ucinka.
    ///
    /// @dev virtual ostaja, da lahko posamezna pogodba vrednost se povozi
    ///      (MarketplaceTestnet to pocne).
    function zamik() public view virtual returns (uint256) {
        return 10 minutes;
    }

    // ── Notranje ────────────────────────────────────────────────────────────

    /// @dev id MORA vsebovati tocne parametre spremembe, sicer bi lahko
    ///      napovedal nedolzno vrednost in izvedel skodljivo.
    function _napovej(bytes32 id, string memory kaj) internal {
        require(izvedljivoOd[id] == 0, "Ze napovedano");
        uint256 od = block.timestamp + zamik();
        izvedljivoOd[id] = od;
        emit SpremembaNapovedana(id, kaj, od, od + ROK);
    }

    function _porabi(bytes32 id, string memory kaj) internal {
        uint256 od = izvedljivoOd[id];
        require(od != 0, "Ni napovedano");
        require(block.timestamp >= od, "Zamik se ni potekel");
        require(block.timestamp <= od + ROK, "Napoved je potekla");
        delete izvedljivoOd[id];
        emit SpremembaIzvedena(id, kaj);
    }

    // ── Javno ───────────────────────────────────────────────────────────────

    /// @notice Preklic napovedane spremembe. Takojsen — premisliti se mora biti
    ///         mogoce hitreje, kot se izvede.
    function prekliciSpremembo(bytes32 id, string calldata kaj) external onlyOwner {
        require(izvedljivoOd[id] != 0, "Ni napovedano");
        delete izvedljivoOd[id];
        emit SpremembaPreklicana(id, kaj);
    }

    /// @notice Stanje napovedi — da ga stran in nadzorni sistem lahko prikazeta.
    function stanjeNapovedi(bytes32 id)
        external
        view
        returns (bool napovedana, uint256 od, uint256 potece, bool izvedljivaZdaj)
    {
        uint256 t = izvedljivoOd[id];
        if (t == 0) return (false, 0, 0, false);
        return (true, t, t + ROK, block.timestamp >= t && block.timestamp <= t + ROK);
    }
}