Security Checklist for Midnight dApps Before Deployment

Midnight Network brings privacy-preserving smart contracts to Web3 through zero-knowledge proofs and programmable confidentiality. But with great privacy power comes great security responsibility. This checklist will help you catch common vulnerabilities before your dApp goes live.

Why This Checklist Matters

Midnight's Compact language enforces privacy by default — all data stays private unless you explicitly disclose() it. This is powerful, but it also means:

One misplaced disclose() can leak sensitive data permanently

Witness functions run outside ZK circuits and can be manipulated

The ownPublicKey() function has a known vulnerability that many developers miss

Replay protection requires careful implementation of nonces and nullifiers

Let's walk through each security area systematically.

Pre-Deployment Checklist

✅ 1. disclose() Audit — No Secret Leaks

disclose() is the only mechanism for moving private data to the public ledger.…