# Security

> Security auditing patterns for Midnight Network smart contracts and dApps. Use when reviewing code for vulnerabilities, privacy leaks, cryptographic weaknesses, or performing security audits.

- Skill: `dajo-code/security` (Agent Skill, multi-file: 3 files)
- Install (CLI): `npx skillmds@latest add dajo-code/security`
- Raw SKILL.md: https://api.skillmd.com/api/skills/dajo-code/security/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: dajo-code (https://skillmd.com/u/dajo-code)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/dajo-code/security

---


# Security Auditing for Midnight Network

Expert knowledge for auditing Midnight Network contracts and privacy-preserving applications.

## Security Priorities

1. **Privacy Protection** - Ensure sensitive data stays private
2. **Cryptographic Integrity** - Verify commitments, nullifiers, proofs
3. **Access Control** - Validate authorization patterns
4. **Input Validation** - Check all assertions and bounds
5. **State Safety** - Prevent manipulation and reentrancy

## Severity Classification

| Level    | Icon | Description                     | Examples                   |
| -------- | ---- | ------------------------------- | -------------------------- |
| Critical | 🔴   | Funds at risk, privacy broken   | Witness exposure, key leak |
| High     | 🟠   | Significant leak or bypass      | Predictable nullifier      |
| Medium   | 🟡   | Logic errors, incomplete checks | Missing validation         |
| Low      | 🟢   | Best practice violations        | Poor error messages        |
| Info     | ℹ️   | Improvement suggestions         | Code clarity               |

## Quick Checklist

### Compact Contracts

- [ ] All assertions have descriptive messages
- [ ] Sensitive data uses `witness` or `secret`
- [ ] No plaintext secrets in ledger
- [ ] Commitments use salt (hash2)
- [ ] Nullifiers include secret context
- [ ] Range checks before arithmetic
- [ ] Access control where needed

### TypeScript dApps

- [ ] Wallet availability checked
- [ ] Transactions properly confirmed
- [ ] No secrets logged or exposed
- [ ] Private state encrypted
- [ ] Error boundaries in place
- [ ] HTTPS enforced

## References

- [references/vulnerabilities.md](references/vulnerabilities.md) - Common vulnerability patterns

## Assets

- [assets/audit-report.md](assets/audit-report.md) - Audit report template