add support for ics authority tokens (#981)

* add support for ics authority tokens

* remove debug prints

* minor refactor

* minor refactor

* prevent user from setting ics_auth_token_amount to 0

* use NonZero for ics_initial_utxos_amount

Author: jankun4

Cargo.lock

@@ -260,7 +260,8 @@ substrate-prometheus-endpoint = { package = "substrate-prometheus-endpoint", git
 substrate-test-runtime-client = { default-features = false, git = "https://github.com/paritytech/polkadot-sdk.git", tag = "polkadot-stable2506" }
 substrate-wasm-builder = { default-features = false, git = "https://github.com/paritytech/polkadot-sdk.git", tag = "polkadot-stable2506" }
 
-raw-scripts = { git = "https://github.com/input-output-hk/partner-chains-smart-contracts.git", tag = "v8.0.0" }
+raw-scripts = { git = "https://github.com/input-output-hk/partner-chains-smart-contracts.git", rev = "bc728b23c4fce131a4fdf7db801c89d2afdf88bd" }
+
 # local dependencies
 
 # utils

Cargo.toml

@@ -95,7 +95,7 @@ allow = [
     "CC0-1.0",
     "Unicode-3.0",
     "CDLA-Permissive-2.0",
-    "Apache-2.0 WITH LLVM-exception"
+    "Apache-2.0 WITH LLVM-exception",
 ]
 # The confidence threshold for detecting a license from license text.
 # The higher the value, the more closely the license text must be to the
@@ -118,7 +118,7 @@ exceptions = [
 # Run `cargo deny check licenses` locally; its output will guide you.
 
 [[licenses.clarify]]
-crate = "ring" # Or "ring@<version-constraint>" e.g. "ring@^0.16"
+crate = "ring"                         # Or "ring@<version-constraint>" e.g. "ring@^0.16"
 expression = "ISC AND MIT AND OpenSSL" # SPDX conjunction
 # Correct paths and hashes are CRITICAL for this clarification to be accepted.
 # `cargo-deny` will tell you what it found when you run `cargo deny check licenses`.
@@ -265,4 +265,4 @@ github = []
 # gitlab.com organizations to allow git sources for
 gitlab = []
 # bitbucket.org organizations to allow git sources for
-bitbucket = []
+bitbucket = []

deny.toml

@@ -91,6 +91,9 @@ pub struct CreateReserveCmd {
 	#[arg(long)]
 	/// Reserve token asset id encoded in form <policy_id_hex>.<asset_name_hex>.
 	token: AssetId,
+	#[arg(long, default_value = "1")]
+	/// Amount of illiquid circulation supply authority tokens to mint.
+	ics_initial_utxos_amount: NonZero<u64>,
 }
 
 impl CreateReserveCmd {
@@ -103,6 +106,7 @@ impl CreateReserveCmd {
 				total_accrued_function_script_hash: self.total_accrued_function_script_hash,
 				token: self.token,
 				initial_deposit: self.initial_deposit_amount,
+				ics_initial_utxos_amount: self.ics_initial_utxos_amount,
 			},
 			self.genesis_utxo.into(),
 			&payment_key,

toolkit/smart-contracts/commands/src/reserve.rs

@@ -16,6 +16,8 @@
 //!   * Governance Policy Script
 
 use super::ReserveData;
+use crate::csl::unit_plutus_data;
+use crate::reserve::create::Script::Plutus;
 use crate::{
 	await_tx::AwaitTx,
 	cardano_keys::CardanoPaymentSigningKey,
@@ -28,7 +30,7 @@ use crate::{
 	scripts_data::ReserveScripts,
 };
 use cardano_serialization_lib::{
-	JsError, MultiAsset, Transaction, TransactionBuilder, TransactionOutput,
+	Int, JsError, MultiAsset, Transaction, TransactionBuilder, TransactionOutput,
 	TransactionOutputBuilder,
 };
 use ogmios_client::{
@@ -40,6 +42,7 @@ use partner_chains_plutus_data::reserve::{
 	ReserveDatum, ReserveImmutableSettings, ReserveMutableSettings, ReserveStats,
 };
 use sidechain_domain::{AssetId, PolicyId, UtxoId};
+use std::num::NonZero;
 
 /// Creates new reserve with the given [ReserveParameters].
 pub async fn create_reserve_utxo<
@@ -75,6 +78,8 @@ pub struct ReserveParameters {
 	pub token: AssetId,
 	/// Initial deposit amount.
 	pub initial_deposit: u64,
+	/// Amount of illiquid circulation supply authority tokens to mint.
+	pub ics_initial_utxos_amount: NonZero<u64>,
 }
 
 impl From<&ReserveParameters> for ReserveDatum {
@@ -118,7 +123,24 @@ fn create_reserve_tx(
 		&reserve.validator_version_utxo.to_csl_tx_input(),
 		reserve.scripts.validator.bytes.len(),
 	);
-	Ok(tx_builder.balance_update_and_build(ctx)?.remove_native_script_witnesses())
+
+	tx_builder.add_mint_script_token_using_reference_script(
+		&Plutus(reserve.scripts.illiquid_circulation_supply_auth_token_policy.clone()),
+		&reserve
+			.illiquid_circulation_supply_authority_token_policy_version_utxo
+			.to_csl_tx_input(),
+		&Int::new(&parameters.ics_initial_utxos_amount.get().into()),
+		&costs,
+	)?;
+	// Create ICS Authorized Outputs. These contain special ICS Authority Token,
+	// that prevents UTxOs from being merged all into one.
+	for _ in 0..parameters.ics_initial_utxos_amount.into() {
+		tx_builder.add_output(&ics_validator_output(&reserve.scripts, ctx)?)?;
+	}
+
+	let tx = tx_builder.balance_update_and_build(ctx)?.remove_native_script_witnesses();
+
+	Ok(tx)
 }
 
 // Creates output with reserve token and the initial deposit
@@ -137,3 +159,19 @@ fn reserve_validator_output(
 
 	amount_builder.with_minimum_ada_and_asset(&ma, ctx)?.build()
 }
+
+fn ics_validator_output(
+	scripts: &ReserveScripts,
+	ctx: &TransactionContext,
+) -> Result<TransactionOutput, JsError> {
+	let amount_builder = TransactionOutputBuilder::new()
+		.with_address(&scripts.illiquid_circulation_supply_validator.address(ctx.network))
+		.with_plutus_data(&unit_plutus_data())
+		.next()?;
+	let ma = MultiAsset::new().with_asset_amount(
+		&scripts.illiquid_circulation_supply_auth_token_policy.empty_name_asset(),
+		1u64,
+	)?;
+
+	amount_builder.with_minimum_ada_and_asset(&ma, ctx)?.build()
+}

toolkit/smart-contracts/offchain/src/reserve/create.rs

@@ -25,7 +25,6 @@ use crate::{
 	csl::{
 		AssetIdExt, CostStore, Costs, OgmiosUtxoExt, Script, TransactionBuilderExt,
 		TransactionContext, TransactionExt, TransactionOutputAmountBuilderExt, get_builder_config,
-		unit_plutus_data,
 	},
 	governance::GovernanceData,
 	multisig::{MultiSigSmartContractResult, submit_or_create_tx_to_sign},
@@ -39,7 +38,7 @@ use ogmios_client::{
 	transactions::Transactions,
 	types::OgmiosUtxo,
 };
-use partner_chains_plutus_data::reserve::ReserveRedeemer;
+use partner_chains_plutus_data::{bridge::TokenTransferDatumV1, reserve::ReserveRedeemer};
 use sidechain_domain::UtxoId;
 
 /// Spends current UTXO at validator address to illiquid supply validator and burn reserve auth policy token, preventing further operations.
@@ -135,7 +134,7 @@ fn illiquid_supply_validator_output(
 	if output_value.amount > 0 {
 		let ma = output_value.token.to_multi_asset(output_value.amount)?;
 		let amount_builder = tx_output_builder
-			.with_plutus_data(&illiquid_supply_validator_redeemer())
+			.with_plutus_data(&TokenTransferDatumV1::ReserveTransfer.into())
 			.next()?;
 		amount_builder.with_minimum_ada_and_asset(&ma, ctx)?.build()
 	} else {
@@ -145,7 +144,3 @@ fn illiquid_supply_validator_output(
 		amount_builder.with_minimum_ada(ctx)?.build()
 	}
 }
-
-fn illiquid_supply_validator_redeemer() -> PlutusData {
-	unit_plutus_data()
-}

toolkit/smart-contracts/offchain/src/reserve/handover.rs

@@ -14,6 +14,7 @@
 //! * a script reference input of the current Goveranance UTXO
 //! * signature of the current goveranance
 
+use crate::plutus_script;
 use crate::{
 	await_tx::AwaitTx,
 	cardano_keys::CardanoPaymentSigningKey,
@@ -38,7 +39,8 @@ use ogmios_client::{
 };
 use partner_chains_plutus_data::version_oracle::VersionOracleDatum;
 use raw_scripts::{
-	ILLIQUID_CIRCULATION_SUPPLY_VALIDATOR, RESERVE_AUTH_POLICY, RESERVE_VALIDATOR, ScriptId,
+	ILLIQUID_CIRCULATION_SUPPLY_AUTHORITY_TOKEN_POLICY, ILLIQUID_CIRCULATION_SUPPLY_VALIDATOR,
+	RESERVE_AUTH_POLICY, RESERVE_VALIDATOR, ScriptId,
 };
 use sidechain_domain::UtxoId;
 
@@ -71,10 +73,23 @@ pub async fn init_reserve_management<
 		ILLIQUID_CIRCULATION_SUPPLY_VALIDATOR.0.to_vec(),
 		ScriptId::IlliquidCirculationSupplyValidator,
 	);
+	let ics_auth_token_policy = ScriptData::new(
+		"Illiquid Circulation Supply Auth Token Policy",
+		plutus_script![
+			ILLIQUID_CIRCULATION_SUPPLY_AUTHORITY_TOKEN_POLICY,
+			ScriptId::IlliquidCirculationSupplyAuthorityTokenPolicy
+		]?
+		.bytes
+		.to_vec(),
+		ScriptId::IlliquidCirculationSupplyAuthorityTokenPolicy,
+	);
+
 	Ok(vec![
 		initialize_script(reserve_validator, genesis_utxo, payment_key, client, await_tx).await?,
 		initialize_script(reserve_policy, genesis_utxo, payment_key, client, await_tx).await?,
 		initialize_script(ics_validator, genesis_utxo, payment_key, client, await_tx).await?,
+		initialize_script(ics_auth_token_policy, genesis_utxo, payment_key, client, await_tx)
+			.await?,
 	]
 	.into_iter()
 	.flatten()

toolkit/smart-contracts/offchain/src/reserve/init.rs

@@ -6,7 +6,8 @@ use crate::{
 };
 use anyhow::anyhow;
 use cardano_serialization_lib::{
-	ExUnits, JsError, PlutusScriptSource, PlutusWitness, Redeemer, RedeemerTag, TxInputsBuilder,
+	BigInt, ExUnits, JsError, PlutusData, PlutusScriptSource, PlutusWitness, Redeemer, RedeemerTag,
+	TxInputsBuilder,
 };
 use init::find_script_utxo;
 use ogmios_client::{query_ledger_state::QueryLedgerState, types::OgmiosUtxo};
@@ -26,6 +27,7 @@ pub(crate) struct ReserveData {
 	pub(crate) auth_policy_version_utxo: OgmiosUtxo,
 	pub(crate) validator_version_utxo: OgmiosUtxo,
 	pub(crate) illiquid_circulation_supply_validator_version_utxo: OgmiosUtxo,
+	pub(crate) illiquid_circulation_supply_authority_token_policy_version_utxo: OgmiosUtxo,
 }
 
 #[derive(Clone, Debug)]
@@ -75,12 +77,23 @@ impl ReserveData {
 		.ok_or_else(|| {
 			anyhow!("Illiquid Circulation Supply Validator Version Utxo not found, is the Reserve Token Management initialized?")
 		})?;
+		let illiquid_circulation_supply_authority_token_policy_version_utxo = find_script_utxo(
+			raw_scripts::ScriptId::IlliquidCirculationSupplyAuthorityTokenPolicy as u32,
+			&version_oracle,
+			ctx,
+			client,
+		)
+		.await?
+		.ok_or_else(|| {
+			anyhow!("Illiquid Circulation Supply Authority Token Policy Version Utxo not found, is the Reserve Token Management initialized?")
+		})?;
 		let scripts = scripts_data::reserve_scripts(genesis_utxo, ctx.network)?;
 		Ok(ReserveData {
 			scripts,
 			auth_policy_version_utxo,
 			validator_version_utxo,
 			illiquid_circulation_supply_validator_version_utxo,
+			illiquid_circulation_supply_authority_token_policy_version_utxo,
 		})
 	}
 
@@ -113,6 +126,33 @@ impl ReserveData {
 
 		Ok(ReserveUtxo { utxo: reserve_utxo, datum: reserve_settings })
 	}
+
+	pub(crate) async fn get_illiquid_circulation_supply_utxo<T: QueryLedgerState>(
+		&self,
+		ctx: &TransactionContext,
+		client: &T,
+	) -> Result<OgmiosUtxo, anyhow::Error> {
+		let validator_address = self
+			.scripts
+			.illiquid_circulation_supply_validator
+			.address(ctx.network)
+			.to_bech32(None)?;
+		let validator_utxos = client.query_utxos(&[validator_address]).await?;
+
+		let auth_token_asset_id = AssetId {
+			policy_id: self.scripts.illiquid_circulation_supply_auth_token_policy.policy_id(),
+			asset_name: AssetName::empty(),
+		};
+
+		let ics_utxo = validator_utxos
+			.into_iter()
+			.find(|utxo| utxo.get_asset_amount(&auth_token_asset_id) == 1u64)
+			.ok_or_else(|| {
+				anyhow!("Could not find any UTXO with ICS Auth token at ICS Validator, is the Reserve Token Management initialized?")
+			})?;
+
+		Ok(ics_utxo.clone())
+	}
 }
 
 pub(crate) struct TokenAmount {
@@ -127,6 +167,23 @@ pub(crate) fn reserve_utxo_input_with_validator_script_reference(
 	cost: &ExUnits,
 ) -> Result<TxInputsBuilder, JsError> {
 	let mut inputs = TxInputsBuilder::new();
+	add_reserve_utxo_input_with_validator_script_reference(
+		&mut inputs,
+		reserve_utxo,
+		reserve,
+		redeemer,
+		cost,
+	)?;
+	Ok(inputs)
+}
+
+pub(crate) fn add_reserve_utxo_input_with_validator_script_reference(
+	inputs: &mut TxInputsBuilder,
+	reserve_utxo: &OgmiosUtxo,
+	reserve: &ReserveData,
+	redeemer: ReserveRedeemer,
+	cost: &ExUnits,
+) -> Result<(), JsError> {
 	let input = reserve_utxo.to_csl_tx_input();
 	let amount = reserve_utxo.value.to_csl()?;
 	let script = &reserve.scripts.validator;
@@ -140,5 +197,32 @@ pub(crate) fn reserve_utxo_input_with_validator_script_reference(
 		&Redeemer::new(&RedeemerTag::new_spend(), &0u32.into(), &redeemer.into(), cost),
 	);
 	inputs.add_plutus_script_input(&witness, &input, &amount);
-	Ok(inputs)
+	Ok(())
+}
+
+pub(crate) fn add_ics_utxo_input_with_validator_script_reference(
+	inputs: &mut TxInputsBuilder,
+	ics_utxo: &OgmiosUtxo,
+	reserve: &ReserveData,
+	cost: &ExUnits,
+) -> Result<(), JsError> {
+	let input = ics_utxo.to_csl_tx_input();
+	let amount = ics_utxo.value.to_csl()?;
+	let script = &reserve.scripts.illiquid_circulation_supply_validator;
+	let witness = PlutusWitness::new_with_ref_without_datum(
+		&PlutusScriptSource::new_ref_input(
+			&script.csl_script_hash(),
+			&reserve.illiquid_circulation_supply_validator_version_utxo.to_csl_tx_input(),
+			&script.language,
+			script.bytes.len(),
+		),
+		&Redeemer::new(
+			&RedeemerTag::new_spend(),
+			&0u32.into(),
+			&PlutusData::new_integer(&BigInt::zero()),
+			cost,
+		),
+	);
+	inputs.add_plutus_script_input(&witness, &input, &amount);
+	Ok(())
 }