Access API Reference
This page documents the public API of openzeppelin_access for OpenZeppelin Contracts for Sui v1.x.
use openzeppelin_access::two_step_transfer;Two-step ownership wrapper for T: key + store objects. Transfers require explicit initiation and acceptance, with cancellation authority bound to the recorded initiator (ctx.sender() at initiation time).
This module is designed for flows with a single logical owner. Avoid using it directly in shared-object custody flows where arbitrary executors can trigger initiate_transfer, because the initiator becomes the recorded cancel authority.
Types
Functions
wrap(obj, ctx)borrow(self)borrow_mut(self)borrow_val(self)return_val(self, obj, borrow)unwrap(self, ctx)initiate_transfer(self, new_owner, ctx)accept_transfer(request, wrapper_ticket, ctx)cancel_transfer(request, wrapper_ticket, ctx)request_borrow_val(request, wrapper_ticket, ctx)request_return_val(request, wrapper, borrow)
Events
Errors
EInvalidTransferRequestEWrongTwoStepTransferWrapperEWrongTwoStepTransferObjectENotOwnerENotNewOwner
Types
struct WrappedKey()
struct
#Dynamic object-field key used to store the wrapped object under the wrapper.
struct TwoStepTransferWrapper<T: key + store>
struct
#Wrapper object that custody-locks an underlying object and controls transfer flow.
The wrapper intentionally omits store so transfer paths stay constrained to this module's logic.
struct PendingOwnershipTransfer<T: key + store>
struct
#Shared pending-transfer object storing wrapper identity, current owner (from), and prospective owner (to).
Wrapper custody is held by this request object through transfer-to-object (TTO) until accept/cancel resolution.
struct Borrow
struct
#Hot-potato guard proving that a value taken via borrow_val is returned to the same wrapper.
struct RequestBorrow
struct
#Hot-potato guard proving a wrapper borrowed through a pending request is returned to that request.
Functions
wrap<T: key + store>(obj: T, ctx: &mut TxContext) -> TwoStepTransferWrapper<T>
public
#Wraps obj in a new transfer wrapper.
The wrapped object is stored as a dynamic object field so off-chain indexers can still discover the underlying object ID.
Emits a WrapExecuted event.
borrow<T: key + store>(self: &TwoStepTransferWrapper<T>) -> &T
public
#Returns immutable access to the wrapped object.
borrow_mut<T: key + store>(self: &mut TwoStepTransferWrapper<T>) -> &mut T
public
#Returns mutable access to the wrapped object without changing ownership state.
borrow_val<T: key + store>(self: &mut TwoStepTransferWrapper<T>) -> (T, Borrow)
public
#Temporarily extracts the wrapped object and returns a Borrow guard that must be consumed by return_val.
return_val<T: key + store>(self: &mut TwoStepTransferWrapper<T>, obj: T, borrow: Borrow)
public
#Returns a previously borrowed object to the wrapper.
Aborts when wrapper/object identity checks fail.
unwrap<T: key + store>(self: TwoStepTransferWrapper<T>, ctx: &mut TxContext) -> T
public
#Destroys the wrapper and returns the underlying object directly to the caller.
This bypasses pending-request flow and recovers direct ownership of the wrapped object.
Emits an UnwrapExecuted event.
initiate_transfer<T: key + store>(self: TwoStepTransferWrapper<T>, new_owner: address, ctx: &mut TxContext)
public
#Starts a transfer by creating a shared request and transferring wrapper custody to that request.
Security note: cancellation authority is tied to the initiating signer recorded as from.
Only use this flow when the signer executing initiation is intentionally the logical owner/cancel authority.
Emits a TransferInitiated event.
accept_transfer<T: key + store>(request: PendingOwnershipTransfer<T>, wrapper_ticket: Receiving<TwoStepTransferWrapper<T>>, ctx: &mut TxContext)
public
#Completes a pending transfer and sends the wrapper to the designated new owner.
Aborts if caller is not request.to or wrapper identity does not match.
Emits a TransferAccepted event.
cancel_transfer<T: key + store>(request: PendingOwnershipTransfer<T>, wrapper_ticket: Receiving<TwoStepTransferWrapper<T>>, ctx: &mut TxContext)
public
#Cancels a pending transfer and returns the wrapper to request.from.
Aborts if caller is not request.from or wrapper identity does not match.
Emits a TransferCancelled event.
request_borrow_val<T: key + store>(request: &mut PendingOwnershipTransfer<T>, wrapper_ticket: Receiving<TwoStepTransferWrapper<T>>, ctx: &mut TxContext) -> (TwoStepTransferWrapper<T>, RequestBorrow)
public
#Receives wrapper custody from a shared request so the recorded owner can operate on the wrapped object during a pending transfer.
Aborts if caller is not request.from or if request/wrapper identity checks fail.
request_return_val<T: key + store>(request: &PendingOwnershipTransfer<T>, wrapper: TwoStepTransferWrapper<T>, borrow: RequestBorrow)
public
#Returns a wrapper borrowed via request_borrow_val back to the pending request.
Aborts if either wrapper or borrow does not match the target request.
Events
WrapExecuted<T>(wrapper_id: ID, object_id: ID, owner: address)
event
#Emitted when an object is wrapped.
UnwrapExecuted<T>(wrapper_id: ID, object_id: ID, owner: address)
event
#Emitted when an object is unwrapped.
TransferInitiated<T>(wrapper_id: ID, current_owner: address, new_owner: address)
event
#Emitted when a two-step transfer request is created.
TransferAccepted<T>(wrapper_id: ID, previous_owner: address, new_owner: address)
event
#Emitted when a pending transfer is accepted and ownership moves to the new owner.
TransferCancelled<T>(wrapper_id: ID, current_owner: address, new_owner: address)
event
#Emitted when a pending transfer is cancelled.
Errors
EInvalidTransferRequest
error
#Raised when request and wrapper identities do not match.
EWrongTwoStepTransferWrapper
error
#Raised when a Borrow guard is used against a different wrapper.
EWrongTwoStepTransferObject
error
#Raised when returning an object different from the one originally borrowed.
ENotOwner
error
#Raised when caller is not authorized as the current owner for the requested operation.
ENotNewOwner
error
#Raised when caller is not the designated prospective owner in accept_transfer.
use openzeppelin_access::delayed_transfer;Time-locked ownership wrapper for T: key + store. The wrapped object is placed under a wrapper that is immediately transferred to a chosen recipient. After that, transfers and unwraps must be scheduled and can only execute after min_delay_ms elapses.
Types
Functions
wrap(obj, min_delay_ms, recipient, ctx)borrow(self)borrow_mut(self)borrow_val(self)return_val(self, obj, borrow)schedule_transfer(self, new_owner, clock, ctx)schedule_unwrap(self, clock, ctx)execute_transfer(self, clock, ctx)unwrap(self, clock, ctx)cancel_schedule(self)
Events
WrapExecutedTransferScheduledUnwrapScheduledOwnershipTransferredPendingTransferCancelledUnwrapExecuted
Errors
ETransferAlreadyScheduledENoPendingTransferEDelayNotElapsedEWrongPendingActionEWrongDelayedTransferWrapperEWrongDelayedTransferObject
Types
struct WrappedKey()
struct
#Dynamic object-field key used to store the wrapped object under the wrapper.
struct DelayedTransferWrapper<T: key + store>
struct
#Wrapper object storing min_delay_ms and optional pending schedule state.
struct PendingTransfer { recipient: Option<address>, execute_after_ms: u64 }
struct
#Represents a scheduled transfer (recipient = some) or scheduled unwrap (recipient = none).
struct Borrow
struct
#Hot-potato guard proving a value extracted with borrow_val is returned to the same wrapper.
Functions
wrap<T: key + store>(obj: T, min_delay_ms: u64, recipient: address, ctx: &mut TxContext)
public
#Wraps obj in a delayed-transfer wrapper, records the minimum execution delay, and transfers initial wrapper custody to recipient.
The wrapped object is stored under a dynamic object field so object ID discovery remains straightforward for indexers.
Emits a WrapExecuted event.
borrow<T: key + store>(self: &DelayedTransferWrapper<T>) -> &T
public
#Returns immutable access to the wrapped object.
borrow_mut<T: key + store>(self: &mut DelayedTransferWrapper<T>) -> &mut T
public
#Returns mutable access to the wrapped object.
borrow_val<T: key + store>(self: &mut DelayedTransferWrapper<T>) -> (T, Borrow)
public
#Temporarily extracts the wrapped object and returns a guard that must be consumed by return_val.
return_val<T: key + store>(self: &mut DelayedTransferWrapper<T>, obj: T, borrow: Borrow)
public
#Returns a previously borrowed object to its wrapper.
Aborts when wrapper/object identity checks fail.
schedule_transfer<T: key + store>(self: &mut DelayedTransferWrapper<T>, new_owner: address, clock: &Clock, ctx: &mut TxContext)
public
#Schedules a transfer to new_owner at clock.timestamp_ms() + min_delay_ms.
Aborts when another action is already scheduled.
Emits a TransferScheduled event.
schedule_unwrap<T: key + store>(self: &mut DelayedTransferWrapper<T>, clock: &Clock, ctx: &mut TxContext)
public
#Schedules delayed self-recovery (unwrap) of the wrapped object.
Aborts when another action is already scheduled.
Emits an UnwrapScheduled event.
execute_transfer<T: key + store>(self: DelayedTransferWrapper<T>, clock: &Clock, ctx: &mut TxContext)
public
#Executes a scheduled transfer once delay has elapsed.
Consumes the wrapper.
Aborts when no transfer is scheduled, wrong action type is scheduled, or delay has not elapsed.
Emits an OwnershipTransferred event on success.
unwrap<T: key + store>(self: DelayedTransferWrapper<T>, clock: &Clock, ctx: &mut TxContext) -> T
public
#Executes a scheduled unwrap once delay has elapsed and returns the wrapped object.
Aborts when no unwrap is scheduled, wrong action type is scheduled, or delay has not elapsed.
Emits an UnwrapExecuted event.
cancel_schedule<T: key + store>(self: &mut DelayedTransferWrapper<T>)
public
#Cancels the currently scheduled transfer or unwrap action.
Aborts when no action is pending.
Emits a PendingTransferCancelled event.
Events
WrapExecuted<T>(wrapper_id: ID, object_id: ID, owner: address)
event
#Emitted when an object is wrapped.
TransferScheduled<T>(wrapper_id: ID, current_owner: address, new_owner: address, execute_after_ms: u64)
event
#Emitted when a delayed transfer is scheduled.
UnwrapScheduled<T>(wrapper_id: ID, current_owner: address, execute_after_ms: u64)
event
#Emitted when delayed unwrap is scheduled.
OwnershipTransferred<T>(wrapper_id: ID, previous_owner: address, new_owner: address)
event
#Emitted when scheduled transfer execution completes.
PendingTransferCancelled<T>(wrapper_id: ID)
event
#Emitted when pending schedule is cancelled.
UnwrapExecuted<T>(wrapper_id: ID, object_id: ID, owner: address)
event
#Emitted when delayed unwrap execution completes.
Errors
ETransferAlreadyScheduled
error
#Raised when trying to schedule while another action is already pending.
ENoPendingTransfer
error
#Raised when execution/cancellation is requested without pending state.
EDelayNotElapsed
error
#Raised when execution occurs before execute_after_ms.
EWrongPendingAction
error
#Raised when calling transfer execution on unwrap state (or vice versa).
EWrongDelayedTransferWrapper
error
#Raised when a Borrow guard is used against a different wrapper.
EWrongDelayedTransferObject
error
#Raised when returning an object different from the one originally borrowed.