skills.rest
FuzzysTodd
FuzzysToddCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

fhenix-review

Audits Fhenix CoFHE confidential smart contracts and SDK code for ACL, decrypt-flow, and plaintext-leak bugs.

1|Updated Sep 4, 2025
Search Tags:#code review#security#solidity#smart contract audit#fhe#fhenix#cofhe
One-click install
npx skills add https://github.com/FuzzysTodd/The-Nexus-Protocol-Token-DAO --skill fhenix-review-fuzzystodd
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: fhenix-review
Source: https://github.com/FuzzysTodd/The-Nexus-Protocol-Token-DAO/tree/main/skills/fhenix-review
Command: npx skills add https://github.com/FuzzysTodd/The-Nexus-Protocol-Token-DAO --skill fhenix-review-fuzzystodd

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Reviewing FHE-based confidential code is error-prone: missing FHE.allowThis calls, mismatched decrypt flows, plaintext leaks, and confidentiality-vs-anonymity confusion are easy to miss in a manual pass. This Skill applies a structured audit checklist of 30+ recurring Fhenix CoFHE gotchas to PR diffs and code reviews so these bugs are caught before merge. ## Core Features & Use Cases - Prioritized audit checklist: Walks changed code in a fixed order covering ACL bugs, decrypt-flow mismatches, plaintext leaks, ebool branching, encrypted approvals, randomness sourcing, input validation, permit hygiene, and standards mixing. - Structured review output: Produces severity-rated findings (Critical / High / Medium / Low / Note) with line citations, quoted code, and suggested fixes. - Deep-audit escalation: Delegates large or security-sensitive reviews to an fhe-reviewer subagent that loads the full gotcha catalog and security checklist. - Use Case: A reviewer runs gh pr view on a pull request touching FHE.sol contracts and asks for a security check; the Skill traces every encrypted operation, verifies allowThis pairing, checks permit expiration units, and reports a plaintext leak in an event emission. ## Quick Start Review this Fhenix CoFHE pull request diff for ACL bugs, decrypt-flow mismatches, and plaintext leaks, and report findings with severity ratings.

Frequently Asked Questions about fhenix-review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I audit Fhenix FHE smart contracts for security bugs?▼

Trace every encrypted operation and confirm FHE.allowThis is called on stored results, verify each allow* call pairs correctly with its decrypt flow, and check that no plaintext values are stored or emitted alongside ciphertexts. This Skill walks changed code through that checklist in a fixed order.

What are common Fhenix CoFHE code review mistakes?▼

Recurring issues include missing allowThis after encrypted writes, using decryptForView where decryptForTx is required, trivialEncrypt on secret literals, branching on ebool instead of FHE.select, and permit expirations set in milliseconds instead of seconds.

Does this review cover both on-chain FHE.sol and off-chain SDK code?▼

Yes, it audits both layers. On-chain it checks FHE.sol operations and ACL pairing; off-chain it verifies @cofhe/sdk decryptForView and decryptForTx callsites match on-chain permissions and use CofheError handling.

When should I escalate to the fhe-reviewer subagent?▼

Escalate for substantive reviews such as PRs with more than 200 lines of FHE code, security-sensitive merges, or pre-launch audits. The subagent loads the full gotcha catalog and produces a prioritized report.

Why is confidentiality not the same as anonymity in FHE dApps?▼

Encrypted values hide data contents, but observers can still infer information from gas patterns, event occurrences, and transaction graphs. A review must check these side channels even when all values are properly encrypted.

Related Skills

Explore More Software Engineering Skills→
zama-aizama-ai

fhe-payment-unwrap

Burn confidential cUSDC and finalize unwrap to plain USDC via KMS decryption.

Official
Advanced
electroheadfxelectroheadfx
4

gsd-audit-fix

Classify and remediate code audit findings with severity filtering and test verification.

Community
Advanced
kreekkreek
1

official-source-check

Verifies version-sensitive framework and library behavior against official documentation sources.

Community
Basic
outfitter-devoutfitter-dev
28

code-review

Automate pre-commit code reviews using structured checklists for quality assurance.

Official
Advanced