---

name: security description: Security auditing patterns for Midnight Network smart contracts and dApps. Use when reviewing code for vulnerabilities, privacy leaks, cryptographic weaknesses, or performing security audits.

Security Auditing for Midnight Network

Expert knowledge for auditing Midnight Network contracts and privacy-preserving applications.

Security Priorities

1. Privacy Protection - Ensure sensitive data stays private
2. Cryptographic Integrity - Verify commitments, nullifiers, proofs
3. Access Control - Validate authorization patterns
4. Input Validation - Check all assertions and bounds
5. State Safety - Prevent manipulation and reentrancy

Severity Classification

Quick Checklist

Compact Contracts

• All assertions have descriptive messages
• Sensitive data uses witness or secret
• No plaintext secrets in ledger
• Commitments use salt (hash2)
• Nullifiers include secret context
• Range checks before arithmetic
• Access control where needed

TypeScript dApps

• Wallet availability checked
• Transactions properly confirmed
• No secrets logged or exposed
• Private state encrypted
• Error boundaries in place
• HTTPS enforced

References

• references/vulnerabilities.md - Common vulnerability patterns

Assets

• assets/audit-report.md - Audit report template