[kaankacar]

What

• openzeppelin/contracts.md and openzeppelin/README.md: pin the OpenZeppelin crates to =0.7.3. 0.7.2 is affected by GHSA-jpg9-m7w4-c7wc in stellar-accounts, and 0.7.3 fixes it. Add a short security note. Fix the repository tree, because confidential/ is now its own package. Update the audit line to v0.8.0.
• privacy-zk/README.md: the Confidential Token shipped in OpenZeppelin v0.8.0. Update its status and caution. Pin its links to v0.8.0, and add crates.io, the OpenZeppelin docs page, and the testnet deployment guide. The caution says that proofs are not yet zero-knowledge.
• privacy-zk/README.md: add a warning to the UltraHonk verifier. It accepts only non-ZK proofs, so private circuit inputs are not hidden.

Why 0.7.3 and not 0.8.0

• 0.8.0 has breaking changes: the mint path, opt-in total supply, and the smart account digest.
• The Contract Wizard still generates ^0.7.2.
• The code examples on these pages use the 0.7 API.

Verification

• cargo generate-lockfile with the new block resolves all seven crates to 0.7.3.
• All new links return HTTP 200.
• Sources: the v0.7.3 and v0.8.0 release notes, the GHSA, the v0.8.0 audit report, the "Zero-knowledge setting" section of the stellar-confidential README, and the ultrahonk-soroban-verifier README.

stellar/stellar-docs#2915 makes the same Confidential Token change in the docs.

[Copilot]

🟡 Changes recommended

Critical security and privacy guidance gaps remain unresolved.

2 open issues

• Qualify private balances claim with non-ZK privacy limitation · New
• Document redeployment requirement for contracts below v0.7.3 · New

What changed in this PR

Updates OpenZeppelin documentation for the 0.7.3 security release and Confidential Token availability in v0.8.0.

Changes:

• Pins OpenZeppelin crates to =0.7.3 and updates security guidance.
• Documents Confidential Token resources and non-ZK limitations.
• Updates repository structure and audit information.

File	Summary
privacy-zk/​README.md	Updates Confidential Token status, links, and UltraHonk verifier warnings.
openzeppelin/​README.md	Updates dependency pins and adds Confidential Token guidance.
openzeppelin/​contracts.md	Updates pins, repository structure, security note, and audit reference.

_{Review effort: Lite}

[Copilot]

🔵 Needs a closer look

The privacy README has unresolved contradictory privacy guidance and unversioned resource links.

No open issues 🎉

2 previously missed issues

In code that hasn't changed since last review

Align the decision guide with the Confidential Token privacy warning

privacy-zk/​README.md:68

The new warning is contradicted by the Quick Decision Guide above, which still tells readers to use Confidential Tokens when amounts and balances "must stay private." Because this implementation accepts non-ZK proofs and the warning says privacy is not guaranteed, that rule can steer privacy-sensitive users toward the unsafe option; please qualify or revise the decision-guide entry as well.

Pin resource URLs to the v0.8.0 documentation and crate release

privacy-zk/​README.md:73

These newly added resource URLs are unversioned, unlike the GitHub links around them, so they can silently move to documentation or a crate release newer than v0.8.0. The PR says the Confidential Token links should be pinned to v0.8.0; use version-specific docs and crates.io URLs here as well.

2 resolved since last review

• Document redeployment requirement for contracts below v0.7.3
• Qualify private balances claim with non-ZK privacy limitation

_{Review effort: Lite}

[kaankacar]

Copilot's two "previously missed" items:

• Decision guide: fixed in 43c6c2f. The Confidential Tokens entry now points to the warning and says that proofs are not yet zero-knowledge.
• Versioned links: the crates.io link now points to 0.8.0 (43c6c2f). The OpenZeppelin docs site has no versioned path for this page (/0.8.0/, /v0.8.0/ and /0.8.x/ return 404), so that link stays unversioned.