suitz is the canonical home for Zama ERC-20 ↔ ERC-7984 wrapper pairs on Sepolia. It renders the official onchain Wrappers Registry as a product: browse every canonical pair, faucet the official cTokenMocks, wrap an ERC-20 into its confidential form, decrypt any confidential balance you own, and unwrap back, in one place, built so that using existing wrappers is the path of least resistance.

Three principles shape the whole app:

• Registry-native, not registry-aware. The onchain registry is the source of truth; the UI is a faithful, real-time mirror of it, with a documented local-override layer for dev pairs. suitz doesn’t fork the data; it renders it.
• Honest about FHE async. Unwrapping is not instant on FHEVM: there is a decryption-oracle round trip before the ERC-20 is released. suitz models that explicitly (encrypting → submitting → finalizing → settled) instead of pretending it’s atomic.
• Decrypt anything you own. The Decrypt tab reveals the connected wallet’s balance on any ERC-7984 address, pasted or auto-detected, even if it was never registered. One EIP-712 signature, no gas, revealed only to you.

You need an injected wallet (MetaMask, Rabby, Brave…) and a little Sepolia ETH for gas; any public Sepolia faucet works. No account, no API key, no WalletConnect project id.

The 60-second tour

1. 1Open the console and connect your wallet. If you’re on the wrong network, suitz offers a one-click switch to Sepolia.
2. 2In Faucet, claim an official cTokenMock, say USDCMock. Your ERC-20 balance updates live.
3. 3In Wrap, approve (only if needed) and wrap it. Your new confidential balance arrives as an encrypted handle, deliberately unreadable.
4. 4In Decrypt, sign once (EIP-712, no gas) to reveal the balance. It decrypts locally, visible only to you.
5. 5Back in Unwrap, send it back to plain ERC-20 and watch the honest finalizing state while the decryption oracle does its round trip.

Running it locally instead? Jump to Development & deploy.

Everything operational lives at /console behind four tabs: one mental model, no hidden pages.

Faucet

Each official cTokenMock exposes a public mint(to, amount). suitz calls it and re-reads the ERC-20 balance, so the update is live, not optimistic.

Wrap: ERC-20 → ERC-7984

The classic two-step, with the approval surfaced as its own state instead of a surprise revert:

1. 1Check allowance(owner → wrapper).
2. 2If it’s short, approve(wrapper, amount) runs as its own step in the stepper.
3. 3wrap(to, amount): a plaintext amount in, an encrypted balance out.

After wrapping, the balance is an encrypted handle. suitz never pretends to know the number; decrypting it is one click away in the Decrypt tab.

Decrypt: EIP-712 user decryption

handle = confidentialBalanceOf(you)       // onchain read
permit = grantPermit(yourTokens)          // ONE EIP-712 signature, no gas —
                                          // covers every token, reused all session
balance = decryptValues(handle)           // re-encrypted by the relayer,
                                          // decrypted locally & cached

The first decrypt of a session takes one signature — and that single permit covers every token in the registry at once, so switching tokens afterwards is silent (a brand-new address outside the registry costs one more signature to fold it in). The permit is held in memory only (never in long-lived storage), so closing the tab revokes it. The UI is honest about which path it took: it only says awaiting signature when it actually signs, and session key found when it reuses the saved permit with no prompt. The cleartext is scoped to the connected wallet and never leaves the browser. This works on any ERC-7984 address, in the registry or not; suitz first probes the address onchain (underlying() / ERC-165) and gives a precise error if it isn’t an ERC-7984 token. Transient relayer hiccups are retried automatically before you ever see an error.

Unwrap: ERC-7984 → ERC-20, the async one

Unwrapping is not atomic on FHEVM: the amount must be publicly decrypted by the oracle before the ERC-20 can move. suitz drives it as a two-step, dApp-driven flow:

// 1: encrypting → submitting
enc, proof = encrypt(amount)                     // client-side, in a worker
unwrap(from, to, enc, proof)                     // burns cToken,
                                                 // emits UnwrapRequested(handle)

// 2: finalizing → settled
cleartext, kmsProof = publicDecrypt(handle)      // awaited while the
                                                 // coprocessor ingests
finalizeUnwrap(handle, cleartext, kmsProof)      // releases the ERC-20

If the second transaction fails or is abandoned, nothing is lost: the burned balance surfaces as a claimable pending unwrap — persisted in your browser, so the claim survives a page reload — that you can retry from the UI at any time.

Recovering a stuck unwrap from the CLI

finalizeUnwrap is permissionless (the ERC-20 always goes to the recipient recorded at unwrap time), so a stuck unwrap can also be finalized standalone:

# from the unwrap tx hash (extracts the handle automatically):
node scripts/finalize-unwrap.mjs --tx 0x<unwrapTxHash>

# print calldata only (default), or submit with a funded testnet key:
PRIVATE_KEY=0x... node scripts/finalize-unwrap.mjs --tx 0x<unwrapTxHash> --send

1. 1Primary: onchain. lib/registry.ts reads the official registry at 0x2f07…128e (an ERC-1967 proxy) and filters out revoked pairs (isValid == false). Token metadata (name / symbol / decimals, both sides) is hydrated via multicall.
2. 2Augment: local. config/pairs.ts plus anything added live through the in-app Add pair modal (persisted to localStorage) are merged on top, clearly badged local.
3. 3Resolve. resolvePairs() merges all sources keyed by confidential address. On collision the onchain record always wins; a local pair’s badge flips to official automatically once it appears onchain. Local never masquerades as official.

If the onchain read fails (RPC down, ABI drift), the app degrades gracefully to a verified in-repo seed of the same pairs, so the registry is never empty. That seed doubles as the coverage baseline asserted by the unit tests, so an official mock can’t silently disappear from the app.

One more honesty detail: ERC-7984 wrappers report their own decimals (capped at 6 to stay uint64-safe), distinct from the underlying ERC-20’s. suitz reads it onchain rather than mirroring the ERC-20’s.

Three routes, one underlying mechanism. You only ever supply the ERC-7984 wrapper address: the underlying ERC-20 is derived onchain from the wrapper’s underlying() getter and all metadata is read onchain (probeConfidentialToken()), so a pair can never carry wrong or stale metadata.

A: Live, zero-code (works on the deployed URL)

In the Registry tab, click Add pair, paste the wrapper address, confirm the preview. It’s validated onchain, badged local, persisted to your browser, and immediately wrap/unwrap/decrypt-able. The modal’s Copy config turns it into a permanent config/pairs.ts edit.

B: Committed dev pair

export const LOCAL_PAIRS: LocalPairInput[] = [
  {
    confidential: "0xYourErc7984WrapperAddress", // that's it: metadata is read onchain
    note: "my hackathon token",                  // optional
  },
];

Save, and it appears in the Registry tab badged local. Pass underlying: "0x…" only if your wrapper doesn’t expose underlying().

C: Canonical onchain pair (the real path)

Register it in the official registry. The confidential token must advertise ERC-165 supportsInterface(0x4958f2a4), and registration is onlyOwner (Zama curates canonical pairs):

registry.registerConfidentialToken(
  tokenAddress,            // your ERC-20
  confidentialTokenAddress // its ERC-7984 wrapper
);

On the next refresh suitz reads it as official with zero app-code changes, which is the point of being registry-native.

The principle: you should never see an unparsed revert string. Every failure mode maps to a sentence a non-expert understands, with the raw error behind a details disclosure when it helps.

Wrappers Registry (Sepolia)

proxy0x2f07…128e, an ERC-1967 proxy in front of the Sourcify-verified ConfidentialTokenWrappersRegistry implementation.

getTokenConfidentialTokenPairsLength() → uint256
getTokenConfidentialTokenPairs()
  → (address tokenAddress, address confidentialTokenAddress, bool isValid)[]
getTokenConfidentialTokenPair(uint256 index) → (token, confidentialToken, isValid)
getConfidentialTokenAddress(address token) → (bool, address)
getTokenAddress(address confidentialToken) → (bool, address)
registerConfidentialToken(address token, address confidentialToken)  // onlyOwner

The isValid flag is not optional: revoked pairs stay in the array with isValid = false, and omitting the field from the ABI silently mis-decodes the whole array.

Official pairs

The live list is always read onchain; this table is the verified in-repo seed that mirrors it (also the graceful-degradation fallback). Confidential wrappers all report 6 decimals (uint64-safe) regardless of the underlying’s.

Local setup

npm install
cp .env.example .env.local   # optional: public defaults ship out of the box
npm run dev                  # http://localhost:3000

Requires Node 18.18+ (Next.js 14). Connect any injected wallet on Sepolia; you’ll need a little Sepolia ETH for gas.

Scripts

Environment variables

Everything runs on public defaults; no configuration is required to try it. Override only what you need (see .env.example):

Deploying

A standard Next.js 14 project; it deploys cleanly to Vercel or any Node host. One thing matters: the Zama SDK’s WASM uses SharedArrayBuffer and worker threads for input-proof generation, which requires cross-origin isolation. The required Cross-Origin-Opener-Policy: same-origin and Cross-Origin-Embedder-Policy: credentialless headers are already configured in next.config.mjs and honoured by Vercel automatically. On other hosts, make sure those response headers survive.

• Non-custodial, always. suitz never holds funds and never sees your balances. Every write goes through your own wallet; every read is public onchain state.
• Decryption happens in your browser. User decryption is authorized by an EIP-712 signature scoped to the connected wallet and performed locally. The cleartext never touches a server, suitz included.
• Testnet only, no value. All tokens are official cTokenMocks on Sepolia and hold no value. This is a place to learn and build, not to store anything.
• No secrets, open source. The app needs no API keys to run, the injected connector needs no WalletConnect project id, and the full source is MIT-licensed on GitHub.

Found something off? Open an issue on GitHub.