SecureSwapX

SecureSwapX is a privacy-preserving ETH <-> cUSDT fixed-rate swap powered by Zama FHEVM. Users can swap ETH for confidential cUSDT at a deterministic 1 ETH = 3000 cUSDT rate, hold balances in encrypted form, and decrypt balances on demand in the frontend.

Project Summary

This repository contains a complete full-stack implementation of a confidential swap:

• A confidential ERC7984-based token (cUSDT) with encrypted balances.
• A swap contract that mints/burns cUSDT at a fixed price and handles ETH liquidity.
• A React + Vite frontend that reads encrypted balances, submits encrypted swaps, and reveals decrypted balances through the Zama relayer flow.

Problems Addressed

• Public stablecoin balances leak sensitive financial information on-chain.
• Traditional swaps require price oracles, introduce price risk, and create complex UX.
• Users need simple, deterministic swaps that preserve privacy without relying on off-chain trust for balance privacy.

Solution Overview

SecureSwapX solves these issues by:

• Using FHEVM to store and transfer encrypted balances for cUSDT.
• Enforcing a fixed exchange rate of 1 ETH = 3000 cUSDT in the swap contract.
• Providing a frontend that shows encrypted balances by default and decrypts them on user action.

Key Features

• Fixed-rate swaps:
  • 1 ETH = 3000 cUSDT (cUSDT has 6 decimals).
  • ETH -> cUSDT minting and cUSDT -> ETH redemption at deterministic prices.
• Confidential balances:
  • cUSDT balances are stored as encrypted values on-chain via ERC7984.
• Encrypted transfers for redemption:
  • Users submit encrypted cUSDT amounts and proofs to redeem ETH.
• On-chain liquidity accounting:
  • The swap contract holds ETH liquidity and enforces balance checks.
• Frontend privacy UX:
  • Encrypted balance display by default.
  • Explicit user action to decrypt and reveal actual balance.

Advantages

• Privacy-first UX while keeping on-chain verification of swaps.
• Deterministic pricing removes oracle dependencies and slippage complexity.
• Clear separation of roles (admin/minter) for token security.
• Straightforward contract logic that is easy to audit and reason about.

Technology Stack

• Smart contracts:
  • Solidity 0.8.27
  • Zama FHEVM libraries
  • ERC7984 confidential token standard
  • Hardhat + hardhat-deploy
• Frontend:
  • React + Vite
  • viem for reads, ethers for writes
  • RainbowKit wallet integration
  • No Tailwind CSS
  • No frontend environment variables
  • No localhost network usage
  • No localStorage usage
  • No JSON assets in frontend source
• Tooling:
  • TypeScript
  • npm

Architecture Overview

Contracts

1. ConfidentialUSDT (cUSDT)

• ERC7984-based confidential token.
• Roles:
  • admin: manages the minter role.
  • minter: allowed to mint and burn.
• Encrypted balances are stored on-chain; transfers and burns operate on encrypted values.

2. SecureSwap

• Holds ETH liquidity.
• Fixed-rate math:
  • cUSDT amount (uint64) = (weiAmount * 3000 * 10^6) / 1e18
  • ETH amount (wei) = (cusdtAmount * 1e18) / (3000 * 10^6)
• Swaps:
  • swapEthForCusdt(): mints cUSDT to user based on ETH input.
  • swapCusdtForEth(): transfers encrypted cUSDT from user, burns it, and sends ETH.
• Owner controls:
  • withdraw ETH liquidity.
  • update owner.

Frontend Flow

• Connect wallet and load encrypted cUSDT balance via viem.
• Request encryption/decryption using the Zama relayer flow.
• Submit swaps with ethers (write operations) and viem (read operations).
• Decrypt balance only when user explicitly requests it.

Directory Structure

contracts/              Smart contracts
  ConfidentialUSDT.sol  Confidential cUSDT token
  SecureSwap.sol        Fixed-rate swap
  FHECounter.sol        Template example (unused)

deploy/                 Deployment scripts (hardhat-deploy)

deployments/            Deployed artifacts and ABI per network

tasks/                  Hardhat tasks

test/                   Contract tests

home/                   Frontend (React + Vite)

Getting Started

Prerequisites

• Node.js 20+
• npm

Install Dependencies

npm install

Frontend dependencies live in home and are installed separately:

cd home
npm install

Compile and Test

npm run compile
npm run test

Local Development (Contracts Only)

Start a local FHEVM-ready node and deploy contracts locally:

npx hardhat node
npx hardhat deploy --network localhost

Note: The frontend is designed to use public test networks only (no localhost network usage).

Deploy to Sepolia

Deployment uses a private key (no mnemonic). Configure your .env at the repository root:

• PRIVATE_KEY
• INFURA_API_KEY
• ETHERSCAN_API_KEY (optional for verification)

Then deploy:

npx hardhat deploy --network sepolia

Frontend Configuration

• The frontend ABI must be sourced from deployments/sepolia.
• The frontend does not use environment variables or local storage.
• The frontend reads with viem and writes with ethers.

Documentation References

• docs/zama_llm.md for Zama FHEVM contract patterns and guidance.
• docs/zama_doc_relayer.md for relayer integration and frontend decryption flow.

How the Swap Works (User Perspective)

1. Connect wallet in the frontend.
2. Deposit ETH to receive cUSDT at a fixed 1 ETH = 3000 cUSDT rate.
3. View encrypted cUSDT balance by default.
4. Click decrypt to reveal actual balance.
5. Redeem cUSDT for ETH by submitting an encrypted amount and proof.

Security and Trust Assumptions

• Fixed-rate swaps are deterministic and do not use price oracles.
• The swap contract must hold sufficient ETH liquidity for redemptions.
• The owner can withdraw liquidity; users should trust the owner for liquidity availability.
• FHE privacy depends on correct proof generation and relayer integration.
• This code has not been audited; use on testnets or in controlled environments.

Known Limitations

• Fixed-rate pricing does not respond to market prices.
• Liquidity is centralized in the swap contract and controlled by the owner.
• FHE operations add computational overhead.

Future Roadmap

• Add on-chain liquidity provider shares and accounting.
• Add dynamic pricing or external oracle integration (optional mode).
• Support multiple confidential stable assets.
• Improve UI for transaction status and proof lifecycle.
• Add comprehensive audits and formal verification.
• Optimize gas for encrypted transfers and burns.
• Expand deployment to additional testnets or L2s.

License

BSD-3-Clause-Clear. See LICENSE.