Skip to main content
The FHE Engine is the computation side of CoFHE. Contracts never call it; it subscribes to what happens onchain, does the encrypted math, and anchors the results. From the outside it is one component with four stages.

Listen

The engine watches TaskManager events on every host chain it serves. TaskCreated events bring FHE operations in for execution; InputVerified events bring verified encrypted inputs in so a commitment gets anchored for each. Delivery is reliable by construction. The listener tracks the last processed block, so a crash or a missed range is re-scanned rather than skipped.

Validate and order

Before anything executes, the engine checks that each operation is well formed and that the inputs it references exist. Operations can arrive before the inputs they depend on have finished computing. Such operations are deferred and released once the missing results land, so out-of-order arrival never produces a wrong answer. Work that is malformed, or that references inputs that never materialize, is set aside for inspection instead of being silently dropped.

Execute

Validated operations run against the TFHE library: arithmetic, comparison, select, cast, and random generation on encrypted operands. The result ciphertext is stored under the handle the TaskManager issued, and any deferred operations waiting on that handle are released as soon as it lands.

Commit

For every stored result, the engine produces a commitment, the keccak256 hash of the stored ciphertext bytes. Commitments are batched and posted to the CommitmentRegistry on the registry chain. This is the anchor Teecryptor verifies before decrypting anything: only bytes that hash to a registered commitment ever reach the decryption key.

Key material

The engine computes with the FHE public key material only. Production builds load no decryption key, so a compromised engine can corrupt results (which commitment verification would catch) but cannot read them. Decryption capability exists solely inside Teecryptor’s attested enclave. The engine also serves the public encryption parameters that clients need: the network public key and the CRS (common reference string) used to build encryption proofs.