Contract Address Details

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.24;

import "@openzeppelin/contracts/access/Ownable.sol";
import "./AdminZamik.sol";

interface IRWAToken {
    function mintWithProof(address to, uint256 amount, bytes32 proofHash) external;
    function mintFee(address to, uint256 amount) external;
    function assetValueUSD() external view returns (uint256);
    function totalSupply() external view returns (uint256);
    function feeRecipient() external view returns (address);
}

/**
 * @title ZKVerifier
 * @notice Verifies Groth16 ZK proofs for RWA ownership claims
 *
 * Security fixes (v2):
 *  - recipient mora biti msg.sender → prepreči frontrunning
 *  - amount je omejen na maxMintable (izračunan iz assetValueUSD) → prepreči neomejeni mint
 *  - amount > 0 check
 *  - proofHash vključuje recipient in amount
 *  - registeredCommitments počiščen po mintu
 *  - setRwaToken odstranjen (mrtva koda — konstruktor že nastavi token)
 */
contract ZKVerifier is Ownable, AdminZamik {

    // === snarkjs-generated VK constants (from rwa_proof_verifier.sol) ===
    // Scalar field size
        uint256 constant r    = 21888242871839275222246405745257275088548364400416034343698204186575808495617;
        // Base field size
        uint256 constant q   = 21888242871839275222246405745257275088696311157297823662689037894645226208583;
    
        // Verification Key data
        uint256 constant alphax  = 20491192805390485299153009773594534940189261866228447918068658471970481763042;
        uint256 constant alphay  = 9383485363053290200918347156157836566562967994039712273449902621266178545958;
        uint256 constant betax1  = 4252822878758300859123897981450591353533073413197771768651442665752259397132;
        uint256 constant betax2  = 6375614351688725206403948262868962793625744043794305715222011528459656738731;
        uint256 constant betay1  = 21847035105528745403288232691147584728191162732299865338377159692350059136679;
        uint256 constant betay2  = 10505242626370262277552901082094356697409835680220590971873171140371331206856;
        uint256 constant gammax1 = 11559732032986387107991004021392285783925812861821192530917403151452391805634;
        uint256 constant gammax2 = 10857046999023057135944570762232829481370756359578518086990519993285655852781;
        uint256 constant gammay1 = 4082367875863433681332203403145435568316851327593401208105741076214120093531;
        uint256 constant gammay2 = 8495653923123431417604973247489272438418190587263600148770280649306958101930;
        uint256 constant deltax1 = 7634694382555350249182314939945794752801670761871442236918755611747247981945;
        uint256 constant deltax2 = 7785580959050401778007424472707980943542624615417776150098749352587788464225;
        uint256 constant deltay1 = 19797755760015837479531733607381070868376789853134730363187779619202029563244;
        uint256 constant deltay2 = 19885317433472164527823093690594480541727870532036884219862146880419864556528;
    
        
        uint256 constant IC0x = 5313285605904455468883044812252347068829101215429313644709835484872601966339;
        uint256 constant IC0y = 2611852344649716617799171908939889777235094010478351269767823832353876722738;
        
        uint256 constant IC1x = 3721507159761245641438686913490987492444926420712387384343195655500770466953;
        uint256 constant IC1y = 10884128966892936170203469452538504289719178213118369098919656563615016733370;
        
        uint256 constant IC2x = 11919587884350751358344086380913156139705038053372491645096979466761922566199;
        uint256 constant IC2y = 11737085826314024049430266969005569805271747491015946543900350977318458074708;
        
     
        // Memory data
        uint16 constant pVk = 0;
        uint16 constant pPairing = 128;
    
        uint16 constant pLastMem = 896;
    // === end generated constants ===

    address public entropyOracle;

    /**
     * VEC SREDSTEV, VSAKO SVOJ ZETON  (odlocitev 30. 8. 2026)
     *
     * Prej je bil tu `address public rwaToken` — EN zeton na verifier. Ker so vsa
     * sredstva nastajala v isti ERC-20 pogodbi, so bili zetoni med seboj ZAMENLJIVI:
     * 1 RWA od apartmaja je bil nerazlocljiv od 1 RWA od zlatih kovancev. Kupec
     * "deleza apartmaja" je torej dobil zahtevek do nerazlocene mase. To ni bila
     * napaka prikaza in je z metapodatki ni bilo mogoce popraviti.
     *
     * Zdaj: en ZKVerifier strezhe vsem zetonom, vsak zeton je svoje sredstvo.
     * Commitment se registrira ZA DOLOCEN ZETON, zato dokaz za sredstvo A ne more
     * kovati na sredstvu B — tudi ce bi bil dokaz sam po sebi veljaven.
     *
     * ZK vezja NI bilo treba spreminjati: vez med commitmentom in zetonom je
     * on-chain stanje, ne javni signal dokaza.
     */
    mapping(address => bool) public pooblasceniZetoni;   // kateri zetoni smejo kovati prek tega verifierja
    address public tovarna;                              // RWATokenFactory — sme registrirati svoje zetone

    // Asset registry: samo vnaprej registrirani assetCommitment-i lahko mintajo.
    // assetCommitment = Poseidon(privateKey, entropyNonce) = javni signal _pubSignals[0]
    mapping(uint256 => address) public commitmentZeton;   // commitment → za KATERI zeton je registriran
    mapping(uint256 => bool) public commitmentUsed;       // porabljeno (vsak asset minta enkrat)

    /// @notice Zdruzljivost s frontendom: prej je bil to mapping(uint256=>bool).
    function registeredCommitments(uint256 commitment) external view returns (bool) {
        return commitmentZeton[commitment] != address(0);
    }

    // Pooblaščeni UORS operaterji — smejo registrirati commitmente
    mapping(address => bool) public authorizedUORS;

    // Tokenizacijska provizija: 0,5% ob mintu
    uint256 public constant MINT_FEE_BPS = 50; // 50 = 0,5%

    event ProofVerified(address indexed claimant, bytes32 proofHash);
    event TovarnaNastavljena(address indexed tovarna);
    event ZetonPooblascen(address indexed zeton);
    event ZetonOdvzet(address indexed zeton);
    event MintFeeCollected(address indexed feeRecipient, uint256 fee);
    event AssetRegistered(uint256 indexed commitment, address indexed zeton);
    event AssetUnregistered(uint256 indexed commitment);
    event AssetMinted(uint256 indexed commitment, address indexed recipient, uint256 amount, address indexed zeton);
    event UORSAuthorized(address indexed uors);
    event UORSRevoked(address indexed uors);
    event Zaustavljeno(address indexed kdo);
    event Sproscen(address indexed kdo);

    // ─────────────────────────────────────────────────────────────────────────
    //  SISTEMSKA ZAUSTAVITEV — to je adminova pot, ne presoja posameznega sredstva
    //
    //  Delitev iz 3. 9. 2026: UORS odgovarja za SREDSTVA (in edini sme zamrzniti
    //  posamezen zeton), admin odgovarja za SISTEM. Zato admin tu ustavi VSE
    //  kovanje naenkrat — grobo orodje, ki nikogar ne obtozi in nicesar ne presodi.
    //
    //  `pause` sme vec naslovov (owner + zaustavljalci, npr. watchdog), `unpause`
    //  samo owner: ustaviti mora biti mogoce hitro, znova zagnati pa premisljeno.
    // ─────────────────────────────────────────────────────────────────────────
    bool public paused;
    mapping(address => bool) public jeZaustavljalec;
    event ZaustavljalecSpremenjen(address indexed kdo, bool lahko);

    /// @dev Takojsno v obe smeri: ob razkritem kljucu odvzema ne smes cakati.
    function nastaviZaustavljalca(address kdo, bool lahko) external onlyOwner {
        require(kdo != address(0), "Zero address");
        jeZaustavljalec[kdo] = lahko;
        emit ZaustavljalecSpremenjen(kdo, lahko);
    }

    function pause() external {
        require(msg.sender == owner() || jeZaustavljalec[msg.sender], "Ni pooblascen za zaustavitev");
        paused = true;
        emit Zaustavljeno(msg.sender);
    }

    function unpause() external onlyOwner {
        paused = false;
        emit Sproscen(msg.sender);
    }

    modifier onlyOwnerOrUORS() {
        require(msg.sender == owner() || authorizedUORS[msg.sender], "Not authorized");
        _;
    }

    /// @dev Krozne odvisnosti ni vec: verifier se postavi PRVI, zetoni pridejo za njim.
    constructor(address _entropyOracle) Ownable(msg.sender) {
        entropyOracle = _entropyOracle;
    }

    // ─────────────────────────────────────────────────────────────────────────
    //  Pooblascanje zetonov
    //
    //  Kdor sme dodati zeton, sme kovati nova sredstva — to je enako mocno kot
    //  pooblastitev UORS operaterja. Zato gre owner-jeva pot SKOZI ZAMIK.
    //
    //  Tovarna je izjema in mora biti: ce bi vsako novo sredstvo cakalo 48 ur,
    //  bi bilo ustvarjanje sredstev neuporabno. Namesto tega gre skozi zamik
    //  NASTAVITEV TOVARNE — enkrat, vidno, vnaprej — potem pa tovarna registrira
    //  samo zetone, ki jih je sama postavila.
    // ─────────────────────────────────────────────────────────────────────────

    function napoviNastaviTovarno(address _tovarna) external onlyOwner {
        require(_tovarna != address(0), "Zero address");
        _napovej(keccak256(abi.encode("nastaviTovarno", _tovarna)), "ZKVerifier.nastaviTovarno");
    }

    function nastaviTovarno(address _tovarna) external onlyOwner {
        require(_tovarna != address(0), "Zero address");
        _porabi(keccak256(abi.encode("nastaviTovarno", _tovarna)), "ZKVerifier.nastaviTovarno");
        tovarna = _tovarna;
        emit TovarnaNastavljena(_tovarna);
    }

    /// @notice Tovarna registrira zeton, ki ga je pravkar postavila.
    function registrirajZeton(address zeton) external {
        require(msg.sender == tovarna, "Samo tovarna");
        require(zeton != address(0), "Zero address");
        pooblasceniZetoni[zeton] = true;
        emit ZetonPooblascen(zeton);
    }

    function napoviDodajZeton(address zeton) external onlyOwner {
        require(zeton != address(0), "Zero address");
        _napovej(keccak256(abi.encode("dodajZeton", zeton)), "ZKVerifier.dodajZeton");
    }

    /// @notice Rocno pooblastilo zetona (mimo tovarne) — pod zamikom.
    function dodajZeton(address zeton) external onlyOwner {
        require(zeton != address(0), "Zero address");
        _porabi(keccak256(abi.encode("dodajZeton", zeton)), "ZKVerifier.dodajZeton");
        pooblasceniZetoni[zeton] = true;
        emit ZetonPooblascen(zeton);
    }

    /// @notice Odvzem je TAKOJSEN — isto merilo kot revokeUORS: nevarnost ne caka.
    function odvzemiZeton(address zeton) external onlyOwner {
        pooblasceniZetoni[zeton] = false;
        emit ZetonOdvzet(zeton);
    }

    /**
     * @notice Registrira legitimen assetCommitment — samo lastnik (izdajatelj sredstva).
     * @dev Lastnik sredstva izračuna commitment = Poseidon(privateKey, entropyNonce)
     *      in deli SAMO commitment (ne ključa). Izdajatelj ga tu registrira.
     */
    /**
     * PODELITEV MOCI GRE SKOZI ZAMIK, ODVZEM NE.
     *
     * Nov UORS lahko registrira commitmente, ti pa so pot do kovanja zetonov.
     * Podtaknjen operater je zato med najmocnejsimi napadi, ki jih owner kljuc
     * sploh omogoca — in je hkrati napad, ki ga je mogoce VIDETI VNAPREJ.
     * Zato javna napoved + zamik.
     *
     * revokeUORS ostaja takojsen: ob razkritem kljucu operaterja ga moras vreci
     * ven zdaj, ne cez 48 ur. Nevarnost caka, zasilna zavora ne.
     */
    function napoviAuthorizeUORS(address uors) external onlyOwner {
        require(uors != address(0), "Zero address");
        _napovej(keccak256(abi.encode("authorizeUORS", uors)), "ZKVerifier.authorizeUORS");
    }

    /// @notice Pooblasti UORS operaterja za registracijo commitmentov.
    function authorizeUORS(address uors) external onlyOwner {
        require(uors != address(0), "Zero address");
        _porabi(keccak256(abi.encode("authorizeUORS", uors)), "ZKVerifier.authorizeUORS");
        authorizedUORS[uors] = true;
        emit UORSAuthorized(uors);
    }

    /// @notice Prekliče pooblastilo UORS operaterja.
    function revokeUORS(address uors) external onlyOwner {
        authorizedUORS[uors] = false;
        emit UORSRevoked(uors);
    }

    /**
     * @notice Registrira commitment ZA DOLOCEN zeton (sredstvo).
     * @dev Prav ta vez preprecuje, da bi dokaz za sredstvo A kovav na sredstvu B.
     *      Brez nje bi vsak veljaven dokaz odprl vsak zeton.
     */
    function registerCommitment(uint256 commitment, address zeton) external onlyOwnerOrUORS {
        require(commitment != 0, "Zero commitment");
        require(pooblasceniZetoni[zeton], "Zeton ni pooblascen");
        require(commitmentZeton[commitment] == address(0), "Already registered");
        commitmentZeton[commitment] = zeton;
        emit AssetRegistered(commitment, zeton);
    }

    /// @notice Paketna registracija — vsi commitmenti za ISTO sredstvo.
    function registerCommitments(uint256[] calldata commitments, address zeton) external onlyOwnerOrUORS {
        require(pooblasceniZetoni[zeton], "Zeton ni pooblascen");
        for (uint256 i = 0; i < commitments.length; i++) {
            uint256 c = commitments[i];
            if (c != 0 && commitmentZeton[c] == address(0)) {
                commitmentZeton[c] = zeton;
                emit AssetRegistered(c, zeton);
            }
        }
    }

    /// @notice Prekliče registracijo (le če še ni bil porabljen).
    function unregisterCommitment(uint256 commitment) external onlyOwner {
        require(commitmentZeton[commitment] != address(0), "Not registered");
        require(!commitmentUsed[commitment], "Already used");
        commitmentZeton[commitment] = address(0);
        emit AssetUnregistered(commitment);
    }

    /// @notice Onemogoceno: renounceOwnership() bi trajno onemogocil
    ///         (de)avtorizacijo UORS operatorjev in registracijo commitmentov.
    function renounceOwnership() public pure override {
        revert("Renounce onemogocen");
    }

    /**
     * @notice Verify ZK proof and mint RWA tokens to caller.
     * @dev recipient je vedno msg.sender — prepreči frontrunning.
     *      amount je omejen na maxMintable = assetValueUSD / 1e16
     *      (1 RWA token = $0.01 USD pri 18 decimalkah).
     *      Prilagodi delilnik glede na tvojo tokenomiko.
     */
    function verifyAndMint(
        uint[2] calldata _pA,
        uint[2][2] calldata _pB,
        uint[2] calldata _pC,
        uint[2] calldata _pubSignals,
        address zeton,
        uint256 amount
    ) external {
        // FIX #2: recipient je vedno msg.sender — prepreči frontrunning iz mempoola
        address recipient = msg.sender;

        // FIX #1a: amount > 0
        require(amount > 0, "Zero amount");
        require(!paused, "Kovanje je zaustavljeno");
        require(pooblasceniZetoni[zeton], "Zeton ni pooblascen");

        // Asset registry: dokaz mora pripadati registriranemu, še neporabljenemu sredstvu
        uint256 commitment = _pubSignals[0];
        // ⚠️ Jedro locitve sredstev: commitment mora biti registriran ZA TA zeton.
        //    Brez te vrstice bi veljaven dokaz za sredstvo A koval na sredstvu B.
        require(commitmentZeton[commitment] == zeton, "Commitment ni za ta zeton");
        require(!commitmentUsed[commitment], "Asset already minted");

        // ─────────────────────────────────────────────────────────────────────
        //  F1 — kolicina mora biti vezana na to, kar dokaz RES dokaze
        //
        //  Prej je bila edina meja `assetValueUSD * 100`, torej vrednost, ki jo je
        //  prijavil UORS. Dokaz pa poleg lastnistva dokazuje se `assetValue >=
        //  minValue`, in `minValue` je JAVEN signal — bil je izracunan, preverjen
        //  in nato zavrzen. Imetnik veljavne kode za sredstvo, vredno 10.000, je
        //  tako lahko koval do meje 180.000, ce je zeton pripadal drazjemu sredstvu.
        //
        //  Odslej velja OBOJE:
        //    1. dokazana vrednost ne sme presegati prijavljene (UORS je zgornja meja),
        //    2. kolicina ne sme presegati dokazane vrednosti.
        //
        //  minValue je v celih enotah valute (npr. 180000), assetValueUSD pa ima
        //  18 decimalk — zato mnozenje z 1e18. Faktor 100 ostaja: 1 zeton = $0,01.
        // ─────────────────────────────────────────────────────────────────────
        uint256 dokazanaVrednost = _pubSignals[1];
        require(dokazanaVrednost > 0, "Dokazana vrednost je 0");
        require(dokazanaVrednost * 1e18 <= IRWAToken(zeton).assetValueUSD(),
                "Dokazana vrednost presega prijavljeno");
        require(amount <= dokazanaVrednost * 1e18 * 100,
                "Kolicina presega dokazano vrednost");

        require(verifyProof(_pA, _pB, _pC, _pubSignals), "Invalid ZK proof");

        commitmentUsed[commitment] = true;
        // FIX #3: počisti registracijo po mintu (clean state)
        commitmentZeton[commitment] = address(0);

        bytes32 proofHash = _odtisDokaza(_pA, _pB, _pC, _pubSignals, recipient, amount, zeton);
        uint256 mintFee   = amount * MINT_FEE_BPS / 10_000;

        IRWAToken(zeton).mintWithProof(recipient, amount - mintFee, proofHash);

        if (mintFee > 0) {
            address prejemnikProvizije = IRWAToken(zeton).feeRecipient();
            IRWAToken(zeton).mintFee(prejemnikProvizije, mintFee);
            emit MintFeeCollected(prejemnikProvizije, mintFee);
        }

        emit AssetMinted(commitment, recipient, amount - mintFee, zeton);
        emit ProofVerified(recipient, proofHash);
    }

    /**
     * @dev Locena funkcija zato, da `verifyAndMint` ne pride v "stack too deep" ob
     *      Groth16 assembly. Vsebinsko je pomembno TO, kaj je v odtisu:
     *
     *      · recipient in amount  — auditability (FIX #4)
     *      · zeton                — sicer bi bil isti odtis veljaven na VEC sredstvih;
     *                               to je razsiritev ugotovitve F8 (ponovitev ne le
     *                               med verigami, ampak med sredstvi)
     *      · block.chainid        — F8 sama: prepreci ponovitev na drugi verigi
     */
    function _odtisDokaza(
        uint[2] calldata _pA,
        uint[2][2] calldata _pB,
        uint[2] calldata _pC,
        uint[2] calldata _pubSignals,
        address recipient,
        uint256 amount,
        address zeton
    ) private view returns (bytes32) {
        return keccak256(abi.encode(_pA, _pB, _pC, _pubSignals, recipient, amount, zeton, block.chainid));
    }

    function verifyProof(uint[2] calldata _pA, uint[2][2] calldata _pB, uint[2] calldata _pC, uint[2] calldata _pubSignals) internal view returns (bool result) {
        assembly {
            function checkField(v) {
                if iszero(lt(v, r)) {
                    mstore(0, 0)
                    revert(0, 0)
                }
            }
            
            // G1 function to multiply a G1 value(x,y) to value in an address
            function g1_mulAccC(pR, x, y, s) {
                let success
                let mIn := mload(0x40)
                mstore(mIn, x)
                mstore(add(mIn, 32), y)
                mstore(add(mIn, 64), s)

                success := staticcall(sub(gas(), 2000), 7, mIn, 96, mIn, 64)

                if iszero(success) {
                    mstore(0, 0)
                    revert(0, 0)
                }

                mstore(add(mIn, 64), mload(pR))
                mstore(add(mIn, 96), mload(add(pR, 32)))

                success := staticcall(sub(gas(), 2000), 6, mIn, 128, pR, 64)

                if iszero(success) {
                    mstore(0, 0)
                    revert(0, 0)
                }
            }

            function checkPairing(pA, pB, pC, pubSignals, pMem) -> isOk {
                let _pPairing := add(pMem, pPairing)
                let _pVk := add(pMem, pVk)

                mstore(_pVk, IC0x)
                mstore(add(_pVk, 32), IC0y)

                // Compute the linear combination vk_x
                
                g1_mulAccC(_pVk, IC1x, IC1y, calldataload(add(pubSignals, 0)))
                
                g1_mulAccC(_pVk, IC2x, IC2y, calldataload(add(pubSignals, 32)))
                

                // -A
                mstore(_pPairing, calldataload(pA))
                mstore(add(_pPairing, 32), mod(sub(q, calldataload(add(pA, 32))), q))

                // B
                mstore(add(_pPairing, 64), calldataload(pB))
                mstore(add(_pPairing, 96), calldataload(add(pB, 32)))
                mstore(add(_pPairing, 128), calldataload(add(pB, 64)))
                mstore(add(_pPairing, 160), calldataload(add(pB, 96)))

                // alpha1
                mstore(add(_pPairing, 192), alphax)
                mstore(add(_pPairing, 224), alphay)

                // beta2
                mstore(add(_pPairing, 256), betax1)
                mstore(add(_pPairing, 288), betax2)
                mstore(add(_pPairing, 320), betay1)
                mstore(add(_pPairing, 352), betay2)

                // vk_x
                mstore(add(_pPairing, 384), mload(add(pMem, pVk)))
                mstore(add(_pPairing, 416), mload(add(pMem, add(pVk, 32))))


                // gamma2
                mstore(add(_pPairing, 448), gammax1)
                mstore(add(_pPairing, 480), gammax2)
                mstore(add(_pPairing, 512), gammay1)
                mstore(add(_pPairing, 544), gammay2)

                // C
                mstore(add(_pPairing, 576), calldataload(pC))
                mstore(add(_pPairing, 608), calldataload(add(pC, 32)))

                // delta2
                mstore(add(_pPairing, 640), deltax1)
                mstore(add(_pPairing, 672), deltax2)
                mstore(add(_pPairing, 704), deltay1)
                mstore(add(_pPairing, 736), deltay2)


                let success := staticcall(sub(gas(), 2000), 8, _pPairing, 768, _pPairing, 0x20)

                isOk := and(success, mload(_pPairing))
            }

            let pMem := mload(0x40)
            mstore(0x40, add(pMem, pLastMem))

            // Validate that all evaluations ∈ F
            
            checkField(calldataload(add(_pubSignals, 0)))
            
            checkField(calldataload(add(_pubSignals, 32)))
            

            // Validate all evaluations
            let isValid := checkPairing(_pA, _pB, _pC, _pubSignals, pMem)

            result := isValid
         }
     }
}
        

// SPDX-License-Identifier: MIT
// OpenZeppelin Contracts (last updated v5.0.0) (access/Ownable.sol)

pragma solidity ^0.8.20;

import {Context} from "../utils/Context.sol";

/**
 * @dev Contract module which provides a basic access control mechanism, where
 * there is an account (an owner) that can be granted exclusive access to
 * specific functions.
 *
 * The initial owner is set to the address provided by the deployer. This can
 * later be changed with {transferOwnership}.
 *
 * This module is used through inheritance. It will make available the modifier
 * `onlyOwner`, which can be applied to your functions to restrict their use to
 * the owner.
 */
abstract contract Ownable is Context {
    address private _owner;

    /**
     * @dev The caller account is not authorized to perform an operation.
     */
    error OwnableUnauthorizedAccount(address account);

    /**
     * @dev The owner is not a valid owner account. (eg. `address(0)`)
     */
    error OwnableInvalidOwner(address owner);

    event OwnershipTransferred(address indexed previousOwner, address indexed newOwner);

    /**
     * @dev Initializes the contract setting the address provided by the deployer as the initial owner.
     */
    constructor(address initialOwner) {
        if (initialOwner == address(0)) {
            revert OwnableInvalidOwner(address(0));
        }
        _transferOwnership(initialOwner);
    }

    /**
     * @dev Throws if called by any account other than the owner.
     */
    modifier onlyOwner() {
        _checkOwner();
        _;
    }

    /**
     * @dev Returns the address of the current owner.
     */
    function owner() public view virtual returns (address) {
        return _owner;
    }

    /**
     * @dev Throws if the sender is not the owner.
     */
    function _checkOwner() internal view virtual {
        if (owner() != _msgSender()) {
            revert OwnableUnauthorizedAccount(_msgSender());
        }
    }

    /**
     * @dev Leaves the contract without owner. It will not be possible to call
     * `onlyOwner` functions. Can only be called by the current owner.
     *
     * NOTE: Renouncing ownership will leave the contract without an owner,
     * thereby disabling any functionality that is only available to the owner.
     */
    function renounceOwnership() public virtual onlyOwner {
        _transferOwnership(address(0));
    }

    /**
     * @dev Transfers ownership of the contract to a new account (`newOwner`).
     * Can only be called by the current owner.
     */
    function transferOwnership(address newOwner) public virtual onlyOwner {
        if (newOwner == address(0)) {
            revert OwnableInvalidOwner(address(0));
        }
        _transferOwnership(newOwner);
    }

    /**
     * @dev Transfers ownership of the contract to a new account (`newOwner`).
     * Internal function without access restriction.
     */
    function _transferOwnership(address newOwner) internal virtual {
        address oldOwner = _owner;
        _owner = newOwner;
        emit OwnershipTransferred(oldOwner, newOwner);
    }
}
          

// SPDX-License-Identifier: MIT
// OpenZeppelin Contracts (last updated v5.0.1) (utils/Context.sol)

pragma solidity ^0.8.20;

/**
 * @dev Provides information about the current execution context, including the
 * sender of the transaction and its data. While these are generally available
 * via msg.sender and msg.data, they should not be accessed in such a direct
 * manner, since when dealing with meta-transactions the account sending and
 * paying for execution may not be the actual sender (as far as an application
 * is concerned).
 *
 * This contract is only required for intermediate, library-like contracts.
 */
abstract contract Context {
    function _msgSender() internal view virtual returns (address) {
        return msg.sender;
    }

    function _msgData() internal view virtual returns (bytes calldata) {
        return msg.data;
    }

    function _contextSuffixLength() internal view virtual returns (uint256) {
        return 0;
    }
}
          

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.24;

import "@openzeppelin/contracts/access/Ownable.sol";

/**
 * @title AdminZamik
 * @notice Casovni zamik na nevarne admin spremembe.
 *
 * ZAKAJ TO OBSTAJA
 * ----------------
 * Owner kljuc na tej platformi NE more krasti: ne more kovati zetonov, ne more
 * premikati tujih zetonov in ne more v escrow. Kar PA lahko, je tiho zamenjati
 * nastavitve pod nogami uporabnikov — KYC listo, placilni token, prijavljeno
 * vrednost sredstva.
 *
 * Vsi trije so napadi, ki jih je mogoce VIDETI VNAPREJ. Zato jih ne branimo z
 * multisigom (ki varuje lastnika kljuca), ampak s casovnim zamikom (ki varuje
 * UPORABNIKA): sprememba se mora najprej javno napovedati, sele po zamiku jo je
 * mogoce izvesti. Uporabnik ima ves ta cas, da spremembo vidi in izstopi.
 *
 * Namenoma NI zunanje timelock pogodbe kot lastnika. Tak vzorec doda tveganje
 * nedosegljivosti: ce lastniku kdaj ne uspe sestaviti transakcije skozi tujo
 * pogodbo, so kontrakti zamrznjeni za vedno. Tu je zamik vgrajen, lastnik pa
 * ostane navadna denarnica.
 *
 * KAJ ZAMIK NE POKRIVA (namerno)
 * ------------------------------
 *   - pause()   — zasilna zavora mora biti takojsnja, sicer ni zavora
 *   - unpause() — vrnitev v obratovanje naj bo hitra
 *   - odvzem pravice zaustavljalca — ob razkritem kljucu ga moras vreci TAKOJ
 * Nevarnost caka, zasilna zavora ne.
 */
abstract contract AdminZamik is Ownable {
    /// @notice Rok, v katerem je napoved uporabna. Po njem potece.
    /// @dev Brez tega bi stara napoved lezala na verigi kot nabita puska:
    ///      napoves nekaj neopaznega danes, izvedes cez pol leta, ko nihce vec
    ///      ne gleda. Napoved, ki ni bila izvedena v roku, je treba ponoviti.
    uint256 public constant ROK = 7 days;

    /// @notice id napovedi → cas, od katerega je izvedljiva (0 = ni napovedi)
    mapping(bytes32 => uint256) public izvedljivoOd;

    event SpremembaNapovedana(bytes32 indexed id, string kaj, uint256 izvedljivoOd, uint256 potece);
    event SpremembaIzvedena(bytes32 indexed id, string kaj);
    event SpremembaPreklicana(bytes32 indexed id, string kaj);

    /// @notice PulseChain mainnet. Edina veriga, kjer zamik varuje pravo vrednost.
    uint256 internal constant MAINNET = 369;

    /// @notice Koliko casa mora sprememba cakati.
    ///
    /// VREDNOST DOLOCA VERIGA, NE CLOVEK  (spremenjeno 30. 8. 2026)
    ///
    ///   mainnet (369)   48 ur      imetnik ima cas videti in izstopiti
    ///   drugod          10 minut   razvoj; dva dni cakanja na testnetu bi
    ///                              pomenila, da se nihce ne bi testiral
    ///
    /// ZAKAJ TAKO IN NE Z ROCNO VREDNOSTJO
    ///   Prej je bilo tu fiksnih `10 minutes` z opozorilom "PRED DEPLOYEM NA
    ///   MAINNET VRNI NA 48 ur". To je zanasanje na cloveski spomin — ista
    ///   tocka odpovedi, ki smo jo ze odpravili pri `mockApproveMe` (locena
    ///   pogodba, ki na mainnet ne more).
    ///
    ///   Nevarnost ni bila teoreticna: deset minut zamika na mainnetu pomeni,
    ///   da napadalec z admin kljucem izvede spremembo, preden jo utegnes
    ///   opaziti. Zamik je takrat videti prisoten, a je brez ucinka — najslabsa
    ///   vrsta obrambe, ker nanjo racunas.
    ///
    ///   Zdaj razvojne vrednosti NI mogoce po pomoti odnesti na mainnet: ista
    ///   koda tam vrne 48 ur sama od sebe.
    ///
    /// @dev virtual ostaja, da lahko posamezna pogodba vrednost se povozi
    ///      (MarketplaceTestnet to pocne).
    function zamik() public view virtual returns (uint256) {
        return block.chainid == MAINNET ? 48 hours : 10 minutes;
    }

    // ── Notranje ────────────────────────────────────────────────────────────

    /// @dev id MORA vsebovati tocne parametre spremembe, sicer bi lahko
    ///      napovedal nedolzno vrednost in izvedel skodljivo.
    function _napovej(bytes32 id, string memory kaj) internal {
        require(izvedljivoOd[id] == 0, "Ze napovedano");
        uint256 od = block.timestamp + zamik();
        izvedljivoOd[id] = od;
        emit SpremembaNapovedana(id, kaj, od, od + ROK);
    }

    function _porabi(bytes32 id, string memory kaj) internal {
        uint256 od = izvedljivoOd[id];
        require(od != 0, "Ni napovedano");
        require(block.timestamp >= od, "Zamik se ni potekel");
        require(block.timestamp <= od + ROK, "Napoved je potekla");
        delete izvedljivoOd[id];
        emit SpremembaIzvedena(id, kaj);
    }

    // ── Javno ───────────────────────────────────────────────────────────────

    /// @notice Preklic napovedane spremembe. Takojsen — premisliti se mora biti
    ///         mogoce hitreje, kot se izvede.
    function prekliciSpremembo(bytes32 id, string calldata kaj) external onlyOwner {
        require(izvedljivoOd[id] != 0, "Ni napovedano");
        delete izvedljivoOd[id];
        emit SpremembaPreklicana(id, kaj);
    }

    /// @notice Stanje napovedi — da ga stran in nadzorni sistem lahko prikazeta.
    function stanjeNapovedi(bytes32 id)
        external
        view
        returns (bool napovedana, uint256 od, uint256 potece, bool izvedljivaZdaj)
    {
        uint256 t = izvedljivoOd[id];
        if (t == 0) return (false, 0, 0, false);
        return (true, t, t + ROK, block.timestamp >= t && block.timestamp <= t + ROK);
    }
}