fix(nft)!: align note-hashing with upstream aztec-nr scheme

src/dripper/README.md

@@ -2,7 +2,8 @@
 
 The `Dripper` contract provides a convenient faucet mechanism for minting tokens into private or public balances. Anyone can easily invoke the functions below to request tokens for testing or development purposes.
 
-> **Note**: This contract is designed for development and testing environments only. Do not use in production. As a dev utility rather than a standard, it is intentionally outside the repository's automated test scope.
+> [!WARNING]
+> The Dripper is an **uncapped, permissionless minter**: `drip_to_public` / `drip_to_private` let *anyone* mint *any* amount (up to `u64::MAX` per call, repeatable) of any token for which the Dripper is the configured `minter`. Its only safety boundary is external — it must **never be granted `minter` on a token that holds real value**, on any network. It is a development/testing faucet only, and as a dev utility rather than a standard it is intentionally outside the repository's automated test scope.
 
 ## Public Functions
 

src/multitoken_contract/README.md

@@ -4,6 +4,9 @@ The `MultiToken` contract implements an ERC-1155-like multi-token with Aztec-spe
 
 Compared to the single-asset [`Token`](../token_contract/README.md), every balance-changing function takes an extra `id: Field` selecting the token, there is no `decimals` and no `total_supply`, and the on-chain event is `TransferSingle` (ERC-1155 naming) instead of `Transfer`.
 
+> [!WARNING]
+> Like everything in this repository, `MultiToken` is **experimental, unaudited software** (see the repo-level [Security Status](../../README.md#️-security-status-unaudited)). One behaviour in particular is easy to misuse: a transfer commitment does **not** bind the token id or amount — the completer chooses both. This is intentional, but it means a commitment is **not a payment guarantee**. Read the [Commitment trust model](#commitment-trust-model) before using one in an escrow or marketplace flow.
+
 ## ARC-403: Authorization Hook
 
 Like `Token`, this contract implements the optional ARC-403 authorization hook: when an `auth_contract` is configured, every transfer and burn calls it before mutating balances, and the operation reverts if the hook reverts. If `auth_contract` is the zero address, the hook is disabled and the token behaves as a plain multi-token. The interface is **id-bearing** — the hook receives the token id so policies can differ per id:
@@ -79,6 +82,7 @@ All addresses are `AztecAddress`; `id` is a `Field`, `amount` is a `u128`, and `
 - `initialize_transfer_commitment(to, completer) -> Field` — Creates a partial note (privacy entrance) to be completed by later transfers/mints. Id-agnostic: the completer binds `id` and `amount`. See [Commitment trust model](#commitment-trust-model) before using a commitment as a payment guarantee.
 - `mint_to_private(to, id, amount)` — Minter mints `id` into a private balance. Fully private.
 - `burn_private(from, id, amount, nonce)` — Burns `id` from a private balance. Fully private.
+- `cancel_authwit(inner_hash)` — Cancels a private authwit the caller previously granted, by emitting its `(msg_sender, inner_hash)` nullifier so it can no longer be consumed.
 
 ### Public Functions
 

src/multitoken_contract/src/main.nr

@@ -7,6 +7,7 @@ use aztec::macros::aztec;
 pub contract MultiToken {
     // aztec library
     use aztec::{
+        authwit::auth::compute_authwit_nullifier,
         macros::{
             events::event,
             functions::{authorize_once, external, initializer, internal, only_self, view},
@@ -450,6 +451,17 @@ pub contract MultiToken {
         self.emit(TransferSingle { from, to: AztecAddress::zero(), id, amount });
     }
 
+    /// @notice Cancels a private authentication witness the caller previously granted
+    /// @dev Emits the authwit nullifier for `(msg_sender, inner_hash)`, so an authwit that has been
+    ///      granted but not yet consumed can no longer be used. Matches the upstream token contracts.
+    /// @param inner_hash The inner hash of the authwit to cancel
+    #[external("private")]
+    fn cancel_authwit(inner_hash: Field) {
+        let on_behalf_of = self.msg_sender();
+        let nullifier = compute_authwit_nullifier(on_behalf_of, inner_hash);
+        self.context.push_nullifier_unsafe(nullifier);
+    }
+
     /** ==========================================================
      * ================= TOKEN LIBRARIES =========================
      * ======================================================== */

src/multitoken_contract/src/test.nr

@@ -13,4 +13,5 @@ mod burn_public;
 mod authorization;
 mod balance_of;
 mod initialize_transfer_commitment;
+mod cancel_authwit;
 pub mod utils;

src/multitoken_contract/src/test/cancel_authwit.nr

@@ -0,0 +1,127 @@
+use crate::MultiToken;
+use crate::test::utils;
+use aztec::authwit::auth::compute_inner_authwit_hash;
+use aztec::hash::hash_args;
+use aztec::protocol::traits::ToField;
+use aztec::test::helpers::authwit as authwit_cheatcodes;
+use generic_proxy::GenericProxy;
+
+// Proves that once `owner` cancels a private authwit, a caller holding it can no longer consume it:
+// the cancellation pre-emits the authwit nullifier, so the later authwit-gated transfer fails when
+// it tries to emit the same nullifier again.
+#[test(should_fail_with = "duplicate nullifiers")]
+unconstrained fn cancelled_authwit_cannot_be_consumed() {
+    let id: Field = 1;
+    let (mut env, multitoken_contract_address, owner, recipient, _minter, proxy) =
+        utils::setup_and_mint_to_private_with_proxy(id);
+
+    let transfer_amount = (1_000 as u128);
+    let transfer_call = MultiToken::at(multitoken_contract_address).transfer_private_to_private(
+        owner,
+        recipient,
+        id,
+        transfer_amount,
+        1,
+    );
+
+    authwit_cheatcodes::add_private_authwit_from_call(env, owner, proxy, transfer_call);
+
+    let inner_hash = compute_inner_authwit_hash([
+        proxy.to_field(),
+        transfer_call.selector.to_field(),
+        hash_args(transfer_call.args),
+    ]);
+    env.call_private(owner, MultiToken::at(multitoken_contract_address).cancel_authwit(inner_hash));
+
+    env.call_private(
+        owner,
+        GenericProxy::at(proxy).forward_private_5(
+            transfer_call.target_contract,
+            transfer_call.selector,
+            transfer_call.args,
+        ),
+    );
+}
+
+// Positive control: the same flow WITHOUT the cancel succeeds, attributing the failure above to the
+// cancellation.
+#[test]
+unconstrained fn uncancelled_authwit_is_consumed() {
+    let id: Field = 1;
+    let (mut env, multitoken_contract_address, owner, recipient, _minter, proxy) =
+        utils::setup_and_mint_to_private_with_proxy(id);
+
+    let transfer_amount = (1_000 as u128);
+    let transfer_call = MultiToken::at(multitoken_contract_address).transfer_private_to_private(
+        owner,
+        recipient,
+        id,
+        transfer_amount,
+        1,
+    );
+
+    authwit_cheatcodes::add_private_authwit_from_call(env, owner, proxy, transfer_call);
+
+    env.call_private(
+        owner,
+        GenericProxy::at(proxy).forward_private_5(
+            transfer_call.target_contract,
+            transfer_call.selector,
+            transfer_call.args,
+        ),
+    );
+
+    utils::check_private_balance(
+        env,
+        multitoken_contract_address,
+        recipient,
+        id,
+        transfer_amount,
+    );
+}
+
+// Caller isolation: a foreign account cancelling with the owner's exact inner hash does NOT revoke
+// the owner's authwit — the nullifier is bound to `msg_sender`.
+#[test]
+unconstrained fn foreign_cancel_does_not_revoke_owner_authwit() {
+    let id: Field = 1;
+    let (mut env, multitoken_contract_address, owner, recipient, _minter, proxy) =
+        utils::setup_and_mint_to_private_with_proxy(id);
+
+    let transfer_amount = (1_000 as u128);
+    let transfer_call = MultiToken::at(multitoken_contract_address).transfer_private_to_private(
+        owner,
+        recipient,
+        id,
+        transfer_amount,
+        1,
+    );
+    authwit_cheatcodes::add_private_authwit_from_call(env, owner, proxy, transfer_call);
+
+    let inner_hash = compute_inner_authwit_hash([
+        proxy.to_field(),
+        transfer_call.selector.to_field(),
+        hash_args(transfer_call.args),
+    ]);
+    // `recipient` (not the granter) attempts to cancel the owner's authwit
+    env.call_private(
+        recipient,
+        MultiToken::at(multitoken_contract_address).cancel_authwit(inner_hash),
+    );
+
+    env.call_private(
+        owner,
+        GenericProxy::at(proxy).forward_private_5(
+            transfer_call.target_contract,
+            transfer_call.selector,
+            transfer_call.args,
+        ),
+    );
+    utils::check_private_balance(
+        env,
+        multitoken_contract_address,
+        recipient,
+        id,
+        transfer_amount,
+    );
+}

src/nft_contract/README.md

@@ -169,6 +169,16 @@ fn mint_to_private(to: AztecAddress, token_id: Field) { /* ... */ }
 fn burn_private(from: AztecAddress, token_id: Field, _nonce: Field) { /* ... */ }
 ```
 
+### cancel_authwit
+```rust
+/// @notice Cancels a private authentication witness the caller previously granted
+/// @dev Emits the authwit nullifier for `(msg_sender, inner_hash)`, so an authwit that has been
+///      granted but not yet consumed can no longer be used
+/// @param inner_hash The inner hash of the authwit to cancel
+#[private]
+fn cancel_authwit(inner_hash: Field) { /* ... */ }
+```
+
 ## Public Functions
 
 ### transfer_public_to_public

src/nft_contract/src/main.nr

@@ -7,6 +7,7 @@ use aztec::macros::aztec;
 pub contract NFT {
     // aztec library
     use aztec::{
+        authwit::auth::compute_authwit_nullifier,
         macros::{
             events::event,
             functions::{authorize_once, external, initializer, internal, only_self, view},
@@ -408,6 +409,17 @@ pub contract NFT {
         self.emit(Transfer { from, to: AztecAddress::zero(), token_id });
     }
 
+    /// @notice Cancels a private authentication witness the caller previously granted
+    /// @dev Emits the authwit nullifier for `(msg_sender, inner_hash)`, so an authwit that has been
+    ///      granted but not yet consumed can no longer be used. Matches the upstream NFT contract.
+    /// @param inner_hash The inner hash of the authwit to cancel
+    #[external("private")]
+    fn cancel_authwit(inner_hash: Field) {
+        let on_behalf_of = self.msg_sender();
+        let nullifier = compute_authwit_nullifier(on_behalf_of, inner_hash);
+        self.context.push_nullifier_unsafe(nullifier);
+    }
+
     /** ==========================================================
      * ================= TOKEN LIBRARIES =========================
      * ======================================================== */

src/nft_contract/src/test.nr

@@ -10,5 +10,6 @@ mod transfer_private_to_public_with_commitment;
 mod transfer_private_to_public;
 mod transfer_public_to_private;
 mod transfer_public_to_public;
+mod cancel_authwit;
 pub mod utils;
 mod view;

src/nft_contract/src/test/cancel_authwit.nr

@@ -0,0 +1,94 @@
+use crate::NFT;
+use crate::test::utils;
+use aztec::authwit::auth::compute_inner_authwit_hash;
+use aztec::hash::hash_args;
+use aztec::protocol::traits::ToField;
+use aztec::test::helpers::authwit as authwit_cheatcodes;
+use generic_proxy::GenericProxy;
+
+// Proves that once `owner` cancels a private authwit, a caller holding it can no longer consume it:
+// the cancellation pre-emits the authwit nullifier, so the later authwit-gated transfer fails when
+// it tries to emit the same nullifier again.
+#[test(should_fail_with = "duplicate nullifiers")]
+unconstrained fn cancelled_authwit_cannot_be_consumed() {
+    let token_id = 1;
+    let (mut env, nft_contract_address, owner, _minter, recipient, proxy) =
+        utils::setup_and_mint_to_private_with_proxy(token_id);
+
+    let transfer_call =
+        NFT::at(nft_contract_address).transfer_private_to_private(owner, recipient, token_id, 1);
+
+    authwit_cheatcodes::add_private_authwit_from_call(env, owner, proxy, transfer_call);
+
+    let inner_hash = compute_inner_authwit_hash([
+        proxy.to_field(),
+        transfer_call.selector.to_field(),
+        hash_args(transfer_call.args),
+    ]);
+    env.call_private(owner, NFT::at(nft_contract_address).cancel_authwit(inner_hash));
+
+    env.call_private(
+        owner,
+        GenericProxy::at(proxy).forward_private_4(
+            transfer_call.target_contract,
+            transfer_call.selector,
+            transfer_call.args,
+        ),
+    );
+}
+
+// Positive control: the same flow WITHOUT the cancel succeeds, attributing the failure above to the
+// cancellation.
+#[test]
+unconstrained fn uncancelled_authwit_is_consumed() {
+    let token_id = 1;
+    let (mut env, nft_contract_address, owner, _minter, recipient, proxy) =
+        utils::setup_and_mint_to_private_with_proxy(token_id);
+
+    let transfer_call =
+        NFT::at(nft_contract_address).transfer_private_to_private(owner, recipient, token_id, 1);
+
+    authwit_cheatcodes::add_private_authwit_from_call(env, owner, proxy, transfer_call);
+
+    env.call_private(
+        owner,
+        GenericProxy::at(proxy).forward_private_4(
+            transfer_call.target_contract,
+            transfer_call.selector,
+            transfer_call.args,
+        ),
+    );
+
+    utils::assert_owns_private_nft(env, nft_contract_address, recipient, token_id);
+}
+
+// Caller isolation: a foreign account cancelling with the owner's exact inner hash does NOT revoke
+// the owner's authwit — the nullifier is bound to `msg_sender`.
+#[test]
+unconstrained fn foreign_cancel_does_not_revoke_owner_authwit() {
+    let token_id = 1;
+    let (mut env, nft_contract_address, owner, _minter, recipient, proxy) =
+        utils::setup_and_mint_to_private_with_proxy(token_id);
+
+    let transfer_call =
+        NFT::at(nft_contract_address).transfer_private_to_private(owner, recipient, token_id, 1);
+    authwit_cheatcodes::add_private_authwit_from_call(env, owner, proxy, transfer_call);
+
+    let inner_hash = compute_inner_authwit_hash([
+        proxy.to_field(),
+        transfer_call.selector.to_field(),
+        hash_args(transfer_call.args),
+    ]);
+    // `recipient` (not the granter) attempts to cancel the owner's authwit
+    env.call_private(recipient, NFT::at(nft_contract_address).cancel_authwit(inner_hash));
+
+    env.call_private(
+        owner,
+        GenericProxy::at(proxy).forward_private_4(
+            transfer_call.target_contract,
+            transfer_call.selector,
+            transfer_call.args,
+        ),
+    );
+    utils::assert_owns_private_nft(env, nft_contract_address, recipient, token_id);
+}