Everything Fhenix Pay does, in one place

01Overview

On a normal blockchain every balance and every transfer amount is public. Fhenix Pay works with tokens built on fully homomorphic encryption (FHE): the amounts live on-chain as ciphertext, the token contract adds and subtracts numbers it cannot read, and only you can decrypt your own balance. In practice that means you can pay someone in front of a block explorer and it will show that you paid — never how much.

Three ideas carry the whole app:

• Confidential balances. A token's encrypted balance is “unsealed” only on your phone, using a signed permit and a local sealing key. The chain, the RPC node, and Fhenix never see the plaintext number.
• Token kinds. Dual-mode tokens (fUSD, FIX) hold a public and a confidential balance in one contract. FHERC20 wrappers (cUSDC) wrap a plain ERC20 into a confidential-only token. Plain ERC-20s work too — they're just public.
• Self-custody. Keys are generated on the device, stored OS-encrypted, and never leave it. There is no account, no server, and no one to call if you lose the recovery phrase — write it down.

02Installation

iOS

Fhenix Pay ships through TestFlight. Join the TestFlight beta on your iPhone, install the TestFlight app if prompted, and accept the invitation.

Android

Install from Google Play.

First launch

On launch the app runs a device-integrity check. If the device is jailbroken / rooted or has developer mode enabled, you'll see a warning before any wallet is created — you can proceed, but don't keep meaningful funds on such a device. Once a wallet exists, opening the app always requires Face ID, fingerprint, or your device passcode.

03Quick start — first token in five steps

1. Create a wallet

   Open the app, name your wallet, and tap Create a new wallet. Write down the 12-word recovery phrase — the app will make you prove you did.

2. Check the network

   The app starts on Arbitrum Sepolia — home of the Fhenix testnet tokens. Tap the network name on the portfolio card to switch.

3. Find your confidential tokens

   The Fhenix tokens (fUSD, cUSDC…) come built in and appear in Assets automatically. For anything else, tap + Add and paste the contract address — the app detects what kind of token it is.

4. Fund & shield

   Get testnet tokens from a faucet, then tap Shield to move them into your confidential balance.

5. Pay someone

   Tap Send and scan their payment QR — the amount is encrypted on your phone before the transaction is sent.

04The interface

The app is organized into four tabs on a bottom navigation bar — each keeps its state as you switch.

• Wallet — the home screen: portfolio, quick actions, and your assets. Where you'll spend most of your time.
• Browser — an in-app dApp browser with your wallet built in (§13).
• Explorer — the Fhenix Confidential Explorer, opened on your own address (§13).
• Settings — wallet backup, friends, hardware wallet, appearance, and the danger zone.

• Header icons — scan (pair with a web dApp, §14) and activity history.
• Portfolio card — your total in USD, the network selector, a visibility toggle that hides all balances, and the private/public split bar.
• Quick actions — Send, Receive, and Shield.
• Assets — one card per token with its kind tag (DUAL / FHERC20 / ERC-20). Tap a card to expand it for the contract address and per-token Shield / Unshield / Remove actions.
• Appearance — the app follows your system theme by default; switch between Auto / Light / Dark in Settings.

05Wallet setup

The welcome screen offers three ways in: create a fresh wallet (the default), Connect a Ledger to use a hardware wallet with no key on the phone (§06), or the “Or import an existing wallet” link for a recovery phrase or private key.

Create a new wallet

Enter a wallet name and tap Create a new wallet. The app generates a 12-word recovery phrase and shows it once, on a screen that blocks screenshots and screen recording. Write the words down on paper, in order. You must then re-select several of the words to prove you saved them before the wallet opens.

Import an existing wallet

Tap “Or import an existing wallet”, switch the toggle to Recovery Phrase and paste your 12/24 words, or to Private Key and paste a 0x… key, then tap Import wallet.

Back up, inspect, delete

In Settings → Security you can re-display the recovery phrase or the raw private key (both behind biometric auth, both on screenshot-blocked screens, and anything you copy is cleared from the clipboard after 30 seconds). Delete Wallet permanently removes the keys from the device — it does not touch anything on-chain. Settings is also where you manage Friends (your address book, §10), connect a Ledger (§06), and switch the app theme between Auto, Light, and Dark.

06Ledger hardware wallet

Fhenix Pay can run entirely from a Bluetooth Ledger. The private key lives in the Ledger's secure element and never touches the phone — every permit and every transaction is confirmed physically on the device. Supported models are the Bluetooth-capable Ledgers: Nano X, Nano Gen5, Stax, and Flex.

Before you connect

• On the Ledger: unlock it, enable Bluetooth, and open the Ethereum app.
• In the Ethereum app's settings, enable Blind signing — CoFHE permits and confidential transactions aren't in Ledger's clear-signing catalog, so the device shows a hash instead of decoded fields (see “What you sign” below).
• Fully close Ledger Live, and if the Ledger is paired in the OS's Bluetooth settings, forget it there — both can hold the connection and hide the device from the app.

Connecting

1. Open the connect flow

   From onboarding tap Connect a Ledger, or on an existing install go to Settings → Hardware → Connect Ledger.

2. Scan and pick your device

   Tap Scan for Ledger. Ledgers already connected to the phone are listed immediately; advertising ones appear as they're found. Tap yours to connect — the app reads the Ethereum address from the device.

3. Use it as your wallet

   Review the address and tap Use this Ledger as my wallet. The home screen opens on the Ledger account: balances, confidential unsealing, sending, shielding — everything works the same, except signatures happen on the Ledger.

What you sign

Whenever a signature is needed, the app shows a “Confirm on your Ledger” overlay that spells out in plain words what you are approving — a decryption permit for reading your own balances, or a transaction with its recipient and amount. Because these are blind signatures, the Ledger's screen shows a hash rather than decoded fields, so only approve when you triggered the action in Fhenix Pay yourself. Permits are cached (§09), so day-to-day you sign far less often than you'd expect.

Reconnecting

The link doesn't need to be babysat. After an app restart, a dropped Bluetooth connection, or the Ledger going to sleep, the next action that needs a signature pops a reconnect dialog that finds your saved device again — unlock the Ledger, open the Ethereum app, and it reconnects and continues. If a signature fails because the device was locked, unlock it and simply retry the action.

07Networks

Tap the network name on the portfolio card to switch. Tokens, balances, and activity are tracked per network.

08Tokens

Built-in tokens

The Fhenix testnet tokens (fUSD, cUSDC, FIX…) come built in: the app loads the curated Fhenix token list for each network, so they appear in Assets without any setup — and new listed tokens show up automatically.

Adding a token

For anything not on the list, tap + Add next to Assets, paste the contract address, and tap Search Token. The app reads the token's name, symbol, and decimals — and probes the contract to detect what kind of token it is. Review the card and tap Confirm.

Token kinds

Managing tokens

Tap a token card to expand it: you'll see the contract address (tap the copy icon to copy it), Shield / Unshield for confidential kinds, and Remove Token. Removing a token only removes it from the list — your balance stays on-chain and comes back if you re-add the address.

09Balances & privacy

A confidential balance arrives from the chain as an encrypted handle. To show you the number, the app asks the CoFHE network to seal it to your device, then decrypts it locally with a key that never leaves the phone. You'll briefly see loading dots on a token card while that happens.

• Unsealing is authorized by a permit — a signed message proving you own the address. Permits are cached so you aren't asked to sign on every refresh.
• Dual tokens show both sides at once: the split bar has the private amount on the left, public on the right, with real numbers above each side.
• The eye icon on the portfolio card hides every amount on screen — useful when someone is watching.
• Totals and per-token values are priced in USD via live rates.

10Sending

Tap Send on the home screen and pick how to reach the person you're paying. In every flow the amount is encrypted on your phone before the transaction is signed — the network only ever sees ciphertext.

To Address

The classic flow: type or paste a 0x… address — or pick a friend — then choose the token and amount and review on the confirmation screen.

Friends

Friends is the app's address book: save the addresses you pay often under a name, and they're one tap away in the send flow. Manage the list in Settings → Friends — add, rename, copy an address, or remove.

Scan QR

Point the camera at a Fhenix Pay payment request (see §11). The confirmation screen shows the recipient, token, and amount; approve and the app encrypts the amount, sends the confidential transfer, and records it in Activity.

Tap to Pay (NFC)

Hold your phone against an NFC payment tag — a sticker, a terminal, or another phone sharing a request as a tag. The payment request loads straight into the confirmation screen.

Bluetooth

Pays a nearby Fhenix Pay device directly. The other side opens Receive → shares via Bluetooth; your side scans for nearby devices and connects. Works with no camera and no typed addresses.

11Receiving

• Wallet QR — the default code encodes your address; any sender can scan it.
• Copy address — tap the address chip to copy the full 0x… address.
• Request a specific amount — build a payment request naming the token and amount; the sender's confirmation screen is pre-filled.
• Share via NFC or Bluetooth — present the request as an NFC tag for tap-to-pay, or advertise it to nearby devices over Bluetooth.

12Shield & unshield

Shielding converts public balance into confidential balance; unshielding converts it back. Reach it from the Shield quick action (pick a token) or from the buttons on an expanded token card.

Shielding

• Dual tokens shield in place: the amount moves from your public balance into the encrypted one in a single transaction. No approval needed.
• FHERC20 wrappers deposit the underlying token (e.g. USDC into cUSDC). If an ERC20 approval is required, the app sends it first automatically — you'll see “Approving…” then “Shielding…”.

Unshielding — two steps by design

1. Burn confidentially

   The amount is deducted from your encrypted balance and a claim is opened on-chain. At this point no one — including the contract — knows the plaintext amount.

2. Claim publicly

   The CoFHE threshold network decrypts the burned amount and produces a proof. The app submits the claim and the tokens land in your public balance (dual) or as the underlying token (wrapper). This usually takes under a minute; the app claims automatically, and if you close the sheet early a Claim banner stays on the token card until it's done.

13Explorer & dApp browser

Two tabs bring the Fhenix web ecosystem into the app, with your wallet already connected — no pairing, no browser extension.

Explorer

The Explorer tab embeds the Fhenix Confidential Explorer, opened directly on your own address. Because it runs inside the wallet, it can do what a public explorer can't: after you approve a decryption permit, it shows your own confidential amounts decrypted — while everyone else looking at the same transactions still sees ciphertext.

dApp browser

The Browser tab loads any web dApp with Fhenix Pay injected as the wallet (an EIP-1193 provider), so CoFHE-aware dApps can connect, request permits, and send transactions — each one approved by you in the app. It opens on shortcuts to first-party Fhenix dApps (the fUSD stablecoin app, the Fhenix TGE platform, and the Confidential Explorer), and there's a URL bar for everything else.

• First-party Fhenix surfaces connect automatically; any other origin must be approved once before it can see your address.
• Signature requests open the same approval sheet as the rest of the app — nothing is signed silently.
• Both tabs keep their state while you switch around the app.

14Web link — pair with a dApp

The scan icon in the home header connects your wallet to a dApp running in a desktop browser. The dApp shows a pairing QR; scan it with Fhenix Pay and the two sides open a direct, end-to-end encrypted WebRTC channel — no server sits between your keys and the site.

• The phone stays the source of truth: the dApp can request, but every transaction is approved on the phone.
• Clear signing — requests are decoded and shown as what they actually do (recipient, token, function, amount) rather than raw hex.
• Balance-decryption permits issued to a paired dApp are short-lived, so a site can't keep reading balances long after you disconnect.
• If a session is active, the scan icon reopens its status screen, where you can disconnect at any time.

15Security

16Troubleshooting

17Appendix

Glossary

Token quick reference