Security review — 5 potential issues found

Security concerns in zama-ai/fhevm

I was looking through the codebase and found a few patterns that might be security-sensitive. Targeting this to Responsible Disclosure if it hasn't been caught already.

Found 44 items total: 1 critical, 4 high, 11 medium, 28 low.

---

only-owner-missing — sdk/js-sdk/contracts/script/v0.13.0/libraries/DeployLib.sol line 290

Severity: HIGH

Language: Solidity

Admin function detected — verify proper access control (onlyOwner, roles).

function setACLImplementation(VmSafe, address aclAddress, ACL aclImplementation) internal {

only-owner-missing — sdk/js-sdk/contracts/script/v0.13.0/libraries/FhevmCheats.sol line 32

Severity: HIGH

Language: Solidity

Admin function detected — verify proper access control (onlyOwner, roles).

function setAll(FhevmAddresses memory addresses, address fheTestAdd) external {

only-owner-missing — sdk/js-sdk/contracts/script/v0.12.0/libraries/DeployLib.sol line 386

Severity: HIGH

Language: Solidity

Admin function detected — verify proper access control (onlyOwner, roles).

function setACLImplementation(VmSafe, address aclAddress, ACL aclImplementation) internal {

only-owner-missing — sdk/js-sdk/contracts/script/v0.12.0/libraries/FhevmCheats.sol line 30

Severity: HIGH

Language: Solidity

Admin function detected — verify proper access control (onlyOwner, roles).

function setAll(FhevmAddresses memory addresses, address fheTestAdd) external {

exposed-secrets — relayer/.env.compose

Severity: CRITICAL

Language: Config

Environment file with potential secrets

---

Some of these might be false positives — just wanted to put them on your radar. Happy to provide more context if any of these look actionable.