No boolean algebra for ebool
There is no and, or, not or xor, and select has no ebool overload. Every gate is arithmetised through select and mul, so a three-condition gate costs five confidential operations where a native and would cost one.
safeSub returns encrypted zero rather than reverting
Exactly right for confidential arithmetic. A revert on underflow would publish the comparison it was hiding.
Identical computations produce identical handles
The unique seed is zero whenever any operand is confidential, so a handle is a pure function of operator and operands. Two treasuries with the same number share one handle and one permanent access list.
An input proof is accepted twice
validateDecryptionProof is a pure EIP-712 check with no nonce, no expiry and no caller binding. Replay protection has to be built, and shrud commits the exact publishable handles at seal time.
Run it locally
Four independent test layers. The Nox suite runs against a real gateway in Docker, so the behaviours above are checked rather than assumed.
pnpm install && pnpm compile
pnpm test # 51 unit and fuzz
FOUNDRY_PROFILE=fork forge test --fork-url "$RPC" # 19 against live Sepolia
npx hardhat test # 77, incl. 7 against real Nox
node --test packages/clearing-math/test/*.test.ts # 14 clearing mathematics
pnpm verify:live # 65 against the deploymentDeployed contracts
Every runtime code hash and constructor argument is recorded in the deployment manifest.
Integration surface
- Safe
- 1.5.0, version gated
- Uniswap v3
- 30 min TWAP
- Aave v3
- Pooled supply position
- iExec Nox
- 0.2.4 contracts
None of these protocols was modified. shrud composes with them as they are.
Read next
- Security model — the privacy boundary and the trust assumptions
- Verify the deployment — public reads, in your browser
- Documentation — architecture and the audit