> For the complete documentation index, see [llms.txt](https://docs.zama.org/protocol/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.zama.org/protocol/solidity-guides/smart-contract/logics/loop.md). # Dealing with branches and conditions This document explains how to handle branches, loops or conditions when working with Fully Homomorphic Encryption (FHE), specifically when the condition / index is encrypted. ## Breaking a loop ❌ In FHE, it is not possible to break a loop based on an encrypted condition. For example, this would not work: ```solidity euint8 maxValue = FHE.asEuint8(6); // Could be a value between 0 and 10 euint8 x = FHE.asEuint8(0); // some code while(FHE.lt(x, maxValue)){ x = FHE.add(x, 2); } ``` If your code logic requires looping on an encrypted boolean condition, we highly suggest to try to replace it by a finite loop with an appropriate constant maximum number of steps and use `FHE.select` inside the loop. ## Suggested approach ✅ For example, the previous code could maybe be replaced by the following snippet: ```solidity euint8 maxValue = FHE.asEuint8(6); // Could be a value between 0 and 10 euint8 x = FHE.asEuint8(0); // some code for (uint32 i = 0; i < 10; i++) { euint8 toAdd = FHE.select(FHE.lt(x, maxValue), FHE.asEuint8(2), FHE.asEuint8(0)); x = FHE.add(x, toAdd); } ``` In this snippet, we perform 10 iterations, adding 2 to `x` in each iteration as long as `x` is still less than `maxValue`. Once `x` reaches `maxValue`, we add 0 instead for the remaining iterations because we can't break the loop. ## Best practices ### Obfuscate branching The previous paragraph emphasized that branch logic should rely as much as possible on `FHE.select` instead of decryptions. It hides effectively which branch has been executed. However, this is sometimes not enough. Enhancing the privacy of smart contracts often requires revisiting your application's logic. For example, if implementing a simple AMM for two encrypted ERC20 tokens based on a linear constant function, it is recommended to not only hide the amounts being swapped, but also the token which is swapped in a pair. ✅ Here is a very simplified example implementation, we suppose here that the rate between tokenA and tokenB is constant and equals to 1: ```solidity // typically either encryptedAmountAIn or encryptedAmountBIn is an encrypted null value // ideally, the user already owns some amounts of both tokens and has pre-approved the AMM on both tokens function swapTokensForTokens( externalEuint32 encryptedAmountAIn, externalEuint32 encryptedAmountBIn, bytes calldata inputProof ) external { euint32 encryptedAmountA = FHE.fromExternal(encryptedAmountAIn, inputProof); // even if amount is null, do a transfer to obfuscate trade direction euint32 encryptedAmountB = FHE.fromExternal(encryptedAmountBIn, inputProof); // even if amount is null, do a transfer to obfuscate trade direction // send tokens from user to AMM contract FHE.allowTransient(encryptedAmountA, tokenA); IConfidentialERC20(tokenA).transferFrom(msg.sender, address(this), encryptedAmountA); FHE.allowTransient(encryptedAmountB, tokenB); IConfidentialERC20(tokenB).transferFrom(msg.sender, address(this), encryptedAmountB); // send tokens from AMM contract to user // Price of tokenA in tokenB is constant and equal to 1, so we just swap the encrypted amounts here FHE.allowTransient(encryptedAmountB, tokenA); IConfidentialERC20(tokenA).transfer(msg.sender, encryptedAmountB); FHE.allowTransient(encryptedAmountA, tokenB); IConfidentialERC20(tokenB).transferFrom(msg.sender, address(this), encryptedAmountA); } ``` Notice that to preserve confidentiality, we had to make two inputs transfers on both tokens from the user to the AMM contract, and similarly two output transfers from the AMM to the user, even if technically most of the times it will make sense that one of the user inputs `encryptedAmountAIn` or `encryptedAmountBIn` is actually an encrypted zero. This is different from a classical non-confidential AMM with regular ERC20 tokens: in this case, the user would need to just do one input transfer to the AMM on the token being sold, and receive only one output transfer from the AMM on the token being bought. ### Avoid using encrypted indexes Using encrypted indexes to pick an element from an array without revealing it is not very efficient, because you would still need to loop on all the indexes to preserve confidentiality. However, there are plans to make this kind of operation much more efficient in the future, by adding specialized operators for arrays. For instance, imagine you have an encrypted array called `encArray` and you want to update an encrypted value `x` to match an item from this list, `encArray[i]`, *without* disclosing which item you're choosing. ❌ You must loop over all the indexes and check equality homomorphically, however this pattern is very expensive in gas and should be avoided whenever possible. ```solidity euint32 x; euint32[] encArray; function setXwithEncryptedIndex(externalEuint32 encryptedIndex, bytes calldata inputProof) public { euint32 index = FHE.fromExternal(encryptedIndex, inputProof); for (uint32 i = 0; i < encArray.length; i++) { ebool isEqual = FHE.eq(index, i); x = FHE.select(isEqual, encArray[i], x); } FHE.allowThis(x); } ``` --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.zama.org/protocol/solidity-guides/smart-contract/logics/loop.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.