security
Security auditing patterns for Midnight Network smart contracts and dApps. Use when reviewing code for vulnerabilities, privacy leaks, cryptographic weaknesses, or performing security audits.
When & Why to Use This Skill
This Claude skill provides expert security auditing patterns and comprehensive checklists specifically designed for the Midnight Network ecosystem. It empowers developers and auditors to identify critical vulnerabilities, prevent privacy leaks in zero-knowledge applications, and ensure the cryptographic integrity of smart contracts and dApps.
Use Cases
- Smart Contract Vulnerability Assessment: Systematically reviewing Compact contracts to detect witness exposure, predictable nullifiers, and reentrancy risks.
- Privacy Protection Auditing: Verifying that sensitive data is properly handled using witnesses and salts to prevent plaintext exposure on the public ledger.
- Cryptographic Integrity Verification: Ensuring that commitments and proofs are correctly implemented to maintain the security of privacy-preserving transactions.
- TypeScript dApp Security Review: Auditing frontend code for secure wallet interactions, encrypted state management, and robust error handling.
- Pre-deployment Compliance: Utilizing structured checklists and severity classifications to perform final security gates before mainnet deployment.
| name | security |
|---|---|
| description | Security auditing patterns for Midnight Network smart contracts and dApps. Use when reviewing code for vulnerabilities, privacy leaks, cryptographic weaknesses, or performing security audits. |
Security Auditing for Midnight Network
Expert knowledge for auditing Midnight Network contracts and privacy-preserving applications.
Security Priorities
- Privacy Protection - Ensure sensitive data stays private
- Cryptographic Integrity - Verify commitments, nullifiers, proofs
- Access Control - Validate authorization patterns
- Input Validation - Check all assertions and bounds
- State Safety - Prevent manipulation and reentrancy
Severity Classification
| Level | Icon | Description | Examples |
|---|---|---|---|
| Critical | 🔴 | Funds at risk, privacy broken | Witness exposure, key leak |
| High | 🟠 | Significant leak or bypass | Predictable nullifier |
| Medium | 🟡 | Logic errors, incomplete checks | Missing validation |
| Low | 🟢 | Best practice violations | Poor error messages |
| Info | ℹ️ | Improvement suggestions | Code clarity |
Quick Checklist
Compact Contracts
- All assertions have descriptive messages
- Sensitive data uses
witnessorsecret - No plaintext secrets in ledger
- Commitments use salt (hash2)
- Nullifiers include secret context
- Range checks before arithmetic
- Access control where needed
TypeScript dApps
- Wallet availability checked
- Transactions properly confirmed
- No secrets logged or exposed
- Private state encrypted
- Error boundaries in place
- HTTPS enforced
References
- references/vulnerabilities.md - Common vulnerability patterns
Assets
- assets/audit-report.md - Audit report template