Fhenix FHE Best Practices

Security

1. Always update permissions. After modifying any encrypted value you'll use later, call FHE.allowThis(value) (and FHE.allow(value, user) for user-readable values). Missing allowThis is the #1 FHE bug.
2. Never branch on encrypted data. No if (ebool), require(ebool), or while on encrypted conditions — it leaks via execution path/timing. Use FHE.select(cond, a, b) for constant-time logic. Don't decrypt just to branch.

   // ❌ FHE.publishDecryptResult(condition, p, sig); if (p > 0) {...}
   // ✅ result = FHE.select(condition, a, b);
   

3. Publish decrypted data carefully. Publishing makes plaintext permanently public. Evaluate information leakage first; minimize what you publish; prefer FHE.verifyDecryptResult (confirm without storing) over publishDecryptResult, and decryptForView (UI-only) when no on-chain proof is needed.
4. Unchecked arithmetic. euint math wraps on overflow (no revert, by design). Size types so wrap-around can't corrupt logic.
5. Division/remainder by zero returns an encrypted max-value sentinel (no leak) — guard the divisor with FHE.select when correctness depends on it.