feat: pro 541 improve wrapper deployment

contracts/confidential-wrapper/.env.example

@@ -1,9 +1,9 @@
-# Authentication (use one of these)
+# Authentication
 MNEMONIC=
 PRIVATE_KEY=
 
 # RPC URLs
-MAINNET_RPC_URL=
+ETHEREUM_RPC_URL=
 POLYGON_RPC_URL=
 SEPOLIA_RPC_URL=
 AMOY_RPC_URL=
@@ -49,8 +49,9 @@ CONFIDENTIAL_WRAPPER_PAUSER_ADDRESS_1=0x3C44CdDdB6a900fa2b585dd299e03d12FA4293BC
 # ConfidentialWrapper upgrade
 # ----------------------------------------------------------------------------
 
-# ConfidentialWrapper upgrade version label used by upgrade tasks
-CONFIDENTIAL_WRAPPER_UPGRADE_VERSION_LABEL=v2 
+# Optional unique wrapper identifier for task:deployConfidentialWrapperImpl
+# CONFIDENTIAL_WRAPPER_UPGRADE_NAME=
+CONFIDENTIAL_WRAPPER_UPGRADE_VERSION_TAG=v4
 
 # Archive RPC used by the Foundry live mainnet-fork tests (make fork-test)
 ETHEREUM_MAINNET_FORK_RPC_URL=https://ethereum-rpc.publicnode.com/

contracts/confidential-wrapper/.gitignore

@@ -35,14 +35,15 @@ npm-debug.log*
 # Typechain
 typechain-types/
 
-# Hardhat
-deployments/
+# Hardhat — live-network deployment state is committed; ignore local chains
+deployments/localhost/
+deployments/hardhat/
 
-# OpenZeppelin
-.openzeppelin/
+# OpenZeppelin — live-network manifests are committed; ignore local-chain manifests
+.openzeppelin/unknown-*.json
 
 # Foundry
 broadcast/
 
 # Fhevm
-fhevmTemp/
+fhevmTemp/

contracts/confidential-wrapper/README.md

@@ -14,11 +14,12 @@ Wraps standard ERC20 tokens into confidential ERC7984 tokens using FHE. Deployed
 
 | Variable | Description |
 | --- | --- |
-| `MNEMONIC` or `PRIVATE_KEY` | Authentication for the deployer account |
-| `MAINNET_RPC_URL` | RPC URL for mainnet |
-| `POLYGON_RPC_URL` | RPC URL for Polygon mainnet |
-| `SEPOLIA_RPC_URL` | RPC URL for Sepolia testnet |
-| `ETHERSCAN_API_KEY` | Etherscan API key (required for contract verification) |
+| `MNEMONIC` or `PRIVATE_KEY` | Local signer for the deployer account |
+| `ETHEREUM_RPC_URL` | RPC URL for the `ethereum` network (mainnet) |
+| `POLYGON_RPC_URL` | RPC URL for the `polygon` network (Polygon mainnet) |
+| `SEPOLIA_RPC_URL` | RPC URL for the `sepolia` network (Sepolia testnet) |
+| `AMOY_RPC_URL` | RPC URL for the `amoy` network (Polygon Amoy testnet) |
+| `ETHERSCAN_API_KEY` | Etherscan API key (required for Etherscan verification; Blockscout/Sourcify need none) |
 
 ### Task inputs (batch deployment)
 
@@ -30,16 +31,19 @@ Wraps standard ERC20 tokens into confidential ERC7984 tokens using FHE. Deployed
 | `CONFIDENTIAL_WRAPPER_CONTRACT_URI_{i}` | Contract URI metadata for the wrapper at index `i` |
 | `CONFIDENTIAL_WRAPPER_UNDERLYING_ADDRESS_{i}` | Address of the underlying ERC20 token for the wrapper at index `i` |
 | `CONFIDENTIAL_WRAPPER_OWNER_ADDRESS_{i}` | Owner address for the wrapper at index `i` |
-| `CONFIDENTIAL_WRAPPER_INITIAL_OBSERVERS_{i}` | Optional JSON array of observer addresses to seed during initialization |
+| `CONFIDENTIAL_WRAPPER_INITIAL_OBSERVERS_{i}` | JSON array of observer addresses to seed during initialization; use `[]` for none |
 | `CONFIDENTIAL_WRAPPER_PAUSER_ADDRESS_{i}` | Address allowed to call `pause()`, set during initialization; the zero address disables pausing |
 
-### Task inputs (batch deploy upgrade implementations)
+Every variable above is required in the batch path — a missing or misspelled one aborts the run
+rather than deploying a wrapper with no observers or no pauser. Opt out explicitly with `[]` and the
+zero address.
+
+### Task inputs (upgrade implementation)
 
 | Variable | Description |
 | --- | --- |
-| `NUM_CONFIDENTIAL_WRAPPERS` | Same meaning as batch deployment: how many wrappers are listed in `.env` |
-| `CONFIDENTIAL_WRAPPER_NAME_{i}` | Name of the wrapper at index `i` |
-| `CONFIDENTIAL_WRAPPER_UPGRADE_VERSION_LABEL` | Version label appended to the saved implementation artifact (e.g. `v2`), shared for all wrappers in the batch upgrade/verify tasks |
+| `CONFIDENTIAL_WRAPPER_UPGRADE_NAME` | Optional wrapper identifier included in the artifact (e.g. `cUSDT`). Used by `task:deployConfidentialWrapperImpl` when `--name` is omitted. Omit for a shared implementation |
+| `CONFIDENTIAL_WRAPPER_UPGRADE_VERSION_TAG` | Version tag appended to the saved implementation artifact (e.g. `v4`). Used by `task:deployConfidentialWrapperImpl` when `--version-tag` is omitted |
 
 > **Underlying deny-list configuration:** the selector alone carries enablement.
 > Consumers of `getUnderlyingDenyListSelector` determine enablement with `selector != 0`. A deny-list
@@ -79,28 +83,28 @@ npx hardhat task:deployConfidentialWrapper \
   --underlying-deny-list-selector 0x00000000 \
   --initial-observers '[]' \
   --pauser 0x2222222222222222222222222222222222222222 \
-  --network testnet
+  --network sepolia
 ```
 
 ### `task:deployAllConfidentialWrappers`
 
 Deploy all confidential wrapper contracts defined in the `.env` file. Reads `NUM_CONFIDENTIAL_WRAPPERS` and iterates over each wrapper's environment variables (`CONFIDENTIAL_WRAPPER_NAME_{i}`, `CONFIDENTIAL_WRAPPER_SYMBOL_{i}`, etc.).
 
-Each wrapper must also provide the V3 initializer configuration:
+Each wrapper must also provide the V3/V4 initializer configuration:
 
 | Variable | Description |
 | --- | --- |
 | `CONFIDENTIAL_WRAPPER_BLOCKED_USERS_{i}` | JSON array of addresses to seed into the wrapper denylist |
 | `CONFIDENTIAL_WRAPPER_UNDERLYING_DENY_LIST_SELECTOR_{i}` | Function selector used to query the underlying token denylist; `0x00000000` disables the check |
-| `CONFIDENTIAL_WRAPPER_INITIAL_OBSERVERS_{i}` | Optional JSON array of observer addresses to seed during initialization |
+| `CONFIDENTIAL_WRAPPER_INITIAL_OBSERVERS_{i}` | JSON array of observer addresses to seed during initialization; use `[]` for none |
 | `CONFIDENTIAL_WRAPPER_PAUSER_ADDRESS_{i}` | Address allowed to call `pause()`; the zero address disables pausing |
 
 **Parameters:** None (configuration is read from environment variables).
 
 **Example:**
 
 ```bash
-npx hardhat task:deployAllConfidentialWrappers --network testnet
+npx hardhat task:deployAllConfidentialWrappers --network <network>
 ```
 
 ### `task:verifyConfidentialWrapper`
@@ -118,7 +122,7 @@ Verify a single confidential wrapper contract (both proxy and implementation) on
 ```bash
 npx hardhat task:verifyConfidentialWrapper \
   --proxy-address 0x1234567890123456789012345678901234567890 \
-  --network testnet
+  --network <network>
 ```
 
 ### `task:verifyAllConfidentialWrappers`
@@ -130,66 +134,56 @@ Verify all deployed confidential wrapper contracts on Etherscan. Reads wrapper n
 **Example:**
 
 ```bash
-npx hardhat task:verifyAllConfidentialWrappers --network testnet
+npx hardhat task:verifyAllConfidentialWrappers --network <network>
 ```
 
-### `task:deployWrapperImplementation`
+### `task:deployConfidentialWrapperImpl`
 
 Deploy a new `ConfidentialWrapper` implementation contract without upgrading any proxy. The proxy upgrade is handled separately by the DAO.
 
+The artifact is `ConfidentialWrapper_<versionTag>_Impl`, or `ConfidentialWrapper_<name>_<versionTag>_Impl` when a name is provided.
+
 **Parameters:**
 
 | Parameter | Type | Required | Description |
 | --- | --- | --- | --- |
-| `--name` | `string` | Yes | The name of the wrapper this implementation is for |
-| `--label` | `string` | Yes | A version label appended to the artifact name (e.g. `"v2"`) |
+| `--name` | `string` | No | Wrapper identifier in the artifact (e.g. `"cUSDT"`). |
+| `--version-tag` | `string` | No | Version tag appended to the saved artifact name (e.g. `"v4"`). Defaults to `CONFIDENTIAL_WRAPPER_UPGRADE_VERSION_TAG` |
 
 **Example:**
 
 ```bash
-npx hardhat task:deployWrapperImplementation --name "Confidential USDT" --label "v2" --network testnet
+npx hardhat task:deployConfidentialWrapperImpl --name cUSDT --version-tag v4 --network <network>
 ```
 
-### `task:deployAllWrapperImplementations`
-
-Requires that `CONFIDENTIAL_WRAPPER_UPGRADE_VERSION_LABEL` is set in the `.env` file.
+Shared implementation (no per-wrapper name):
 
-Deploy upgrade implementations for all wrappers defined in the `.env` file. Reads `NUM_CONFIDENTIAL_WRAPPERS`, `CONFIDENTIAL_WRAPPER_NAME_{i}`, and `CONFIDENTIAL_WRAPPER_UPGRADE_VERSION_LABEL`.
-
-**Parameters:** None (configuration is read from environment variables).
+```bash
+npx hardhat task:deployConfidentialWrapperImpl --version-tag v4 --network <network>
+```
 
-**Example:**
+Or, with `CONFIDENTIAL_WRAPPER_UPGRADE_VERSION_TAG` (and optionally `CONFIDENTIAL_WRAPPER_UPGRADE_NAME`) set in `.env`:
 
 ```bash
-npx hardhat task:deployAllWrapperImplementations --network testnet
+npx hardhat task:deployConfidentialWrapperImpl --network <network>
 ```
 
-### `task:verifyWrapperImplementation`
+### `task:verifyConfidentialWrapperImpl`
 
-Verify a single `ConfidentialWrapper` implementation contract on Etherscan.
+Verify a `ConfidentialWrapper` implementation contract on Etherscan.
 
 **Parameters:**
 
 | Parameter | Type | Required | Description |
 | --- | --- | --- | --- |
-| `--address` | `string` | Yes | The address of the implementation contract to verify |
-
-**Example:**
-
-```bash
-npx hardhat task:verifyWrapperImplementation --address 0x1234567890123456789012345678901234567890 --network testnet
-```
-
-### `task:verifyAllWrapperImplementations`
-
-Verify upgrade implementation contracts for all wrappers on Etherscan. Looks up deployment artifacts using `CONFIDENTIAL_WRAPPER_NAME_{i}` and `CONFIDENTIAL_WRAPPER_UPGRADE_VERSION_LABEL`.
-
-**Parameters:** None (configuration is read from environment variables and deployment artifacts).
+| `--impl-address` | `string` | Yes | The address of the implementation contract to verify |
 
 **Example:**
 
 ```bash
-npx hardhat task:verifyAllWrapperImplementations --network testnet
+npx hardhat task:verifyConfidentialWrapperImpl \
+  --impl-address 0x1234567890123456789012345678901234567890 \
+  --network <network>
 ```
 
 ## Scripts

contracts/confidential-wrapper/deployments/sepolia/.chainId

@@ -0,0 +1 @@
+11155111

contracts/confidential-wrapper/hardhat.config.ts

@@ -44,7 +44,7 @@ const accounts: HttpNetworkAccountsUserConfig | undefined = MNEMONIC
 
 if (accounts == null) {
   console.warn(
-    'Could not find MNEMONIC or PRIVATE_KEY environment variables. It will not be possible to execute transactions in your example.',
+    'No signer configured. Read-only tasks still work; to broadcast transactions, set MNEMONIC or PRIVATE_KEY.',
   );
 }
 
@@ -77,8 +77,8 @@ const config: HardhatUserConfig = {
   },
   networks: {
     // ChainID must be specified in order to be able to verify contracts using the fhevm hardhat plugin
-    mainnet: {
-      url: process.env.MAINNET_RPC_URL || '',
+    ethereum: {
+      url: process.env.ETHEREUM_RPC_URL || '',
       accounts,
       chainId: 1,
     },
@@ -89,15 +89,14 @@ const config: HardhatUserConfig = {
       accounts,
       chainId: 137,
     },
-    // ChainID must be specified in order to be able to verify contracts using the fhevm hardhat plugin
-    testnet: {
+    sepolia: {
       url: process.env.SEPOLIA_RPC_URL || '',
       accounts,
       chainId: 11155111,
     },
     // FHEVM config for chainId 80002 comes from the locally vendored
     // contracts/fhevm/ZamaConfig.sol (aligned with @fhevm/solidity 0.13.2).
-    'polygon-amoy': {
+    amoy: {
       url: process.env.AMOY_RPC_URL || '',
       accounts,
       chainId: 80002,
@@ -128,6 +127,12 @@ const config: HardhatUserConfig = {
   etherscan: {
     apiKey: process.env.ETHERSCAN_API_KEY!,
   },
+  sourcify: {
+    enabled: true,
+  },
+  blockscout: {
+    enabled: true,
+  },
   exposed: {
     imports: true,
     initializers: true,

contracts/confidential-wrapper/package.json

@@ -68,7 +68,7 @@
     "prettier:check": "prettier --check \"**/*.{js,json,md,sol,ts,yml}\"",
     "prettier:write": "prettier --write \"**/*.{js,json,md,sol,ts,yml}\"",
     "test": "hardhat test",
-    "test:sepolia": "hardhat test --network testnet"
+    "test:sepolia": "hardhat test --network sepolia"
   },
   "overrides": {
     "@fhevm/solidity": "0.11.1",