rules / HM003

HM003 missing-allow-user MEDIUM

Per-user encrypted value stored without FHE.allow for that user

Why it matters

A handle written into `mapping(address => euintX)` belongs to a user, but the user can only decrypt it (via the relayer's user-decrypt flow) if the contract granted them access with `FHE.allow(handle, user)`. Without it the balance or position is invisible to its owner: it exists on-chain but nobody outside the contract can ever read it.

Fix

Grant the owner access whenever their entry changes: `FHE.allow(balances[to], to);` alongside `FHE.allowThis(balances[to]);`.

Check locally

homomorph scan . --rules HM003