标签：#web3

100 Days of Solana, Day 100 Where I started I'd built REST APIs for years but had never touched a blockchain, or written a line of Rust. The curiosity how blockchain works, started my curiosity. What I expected I came in with a Web2 instinct: tests exist to prove your code does what it's supposed to do. Write the function, write a test that calls it, watch it pass, move on. A "failing test" was something you fixed, not something you shipped on purpose. What changed my understanding The moment this cracked open was building the capstone: a small Anchor program called proof-of-ship that lets a wallet permanently record, on chain, that it shipped something. The rule is simple — one ship record per wallet, forever. The rule lives entirely in the account's seeds: seeds = [ b"ship" , builder .key () .as_ref ()], bump Each wallet's record lives at one deterministic address. Try to create a second one, and init refuses, because an account already exists there. I wrote two tests. The first proved the happy path: call ship() , fetch the record, confirm the name and builder match. The second test is the one that changed how I think about testing: it ( " only lets each wallet ship once " , async () => { let rejected = false ; try { await program . methods . ship ( " Second try " , " This should never land " ). rpc (); } catch ( _err ) { rejected = true ; } assert . isTrue ( rejected , " second ship should have been rejected " ); }); This test isn't checking for a bug. It's checking that a rule holds. There's no function in my program called preventDuplicateShip() . There's no if statement rejecting the second attempt. The rule "one ship per wallet" isn't enforced by logic I wrote — it's enforced by the Solana runtime itself, because the PDA's address already has data in it. My job wasn't to write the rejection. My job was to prove the rejection actually happens. What I understand now On Web2 systems I controlled the whole stack, so "does it work" mostly meant "does the happy pa

Originally published on 2022-07-04. Published on July 3rd, 2022 We have a ll been there.. We all have that long list of unfinished side projects that we hope to complete some day.. If you're anything like me, that 'some day' is always eluding you and never getting here.. Ripping up the bandaid Today I have decided to finally go ahead and finish one of my long list of unfinished tutorial projects. I recently read a long Twitter thread that gave me a lot of food for thought. To paraphrase my understanding of one tweet, 'success is a combination of all the small wins'. Therefore, by finishing and publishing one unfinished project today, I set myself up to finishing another one tomorrow. Small, consistent gains I just need to make it a habit of finishing what I have started so that they do not get out of hands. After all, my Github account has about 126 repositories, but my portfolio website only has a dozen completed and published projects. Almost Done I have finished up the tutorial project. My next step is to rebuild the project from scratch without the handholding of the tutorial. One of the mental blocks that prevented me from finishing up the project in the first place seems insignificant now. Next time that mental block tries me, I will be better prepared! The project we're talking about! Published Link: https://blockchain.tioye.dev

Building an Autonomous Agent for Verdikta Bounties: A Technical Deep Dive How I built a Python agent that monitors, evaluates, and interacts with Verdikta's AI-judged bounty system on Base L2. Why Build a Bounty Agent? Verdikta is a decentralized bounty platform where AI models — GPT-5.2 and Claude Sonnet 4.5 — evaluate submissions and release ETH payments automatically via smart contracts. No human reviewers. No manual payouts. Just code. After winning 6+ bounties manually, I wanted to automate the process. The goal: an agent that watches for new bounties, evaluates which ones are worth pursuing, and integrates with Verdikta's API to read data and submit work. Architecture The agent has four components: copy   verdikta_agent.py ├── VerdiktaAPI — HTTP client for the Verdikta Bot API ├── BountyMonitor — Watches bounties, calculates viability scores ├── SubmissionTracker — Records submission history and statistics └── ViabilityScorer — Evaluates ROI: payout vs threshold vs time VerdiktaAPI Client The Verdikta Bot API requires authentication via an X-Bot-API-Key header. You register your bot at POST /api/bots/register to get a key. Python   class VerdiktaAPI: def init (self, api_key=None): self.session = requests.Session() if api_key: self.session.headers["X-Bot-API-Key"] = api_key def get_bounty(self, bounty_id): resp = self.session.get(f"{API_BASE}/jobs/{bounty_id}") resp.raise_for_status() return resp.json() def submit_work(self, bounty_id, content): return self.session.post( f"{API_BASE}/jobs/{bounty_id}/submit", json={"content": content} ).json() Key endpoints: GET /api/jobs — List bounties (filter by status) GET /api/jobs/{id} — Bounty details GET /api/jobs/{id}/submissions — Submission history POST /api/jobs/{id}/submit — Submit work BountyMonitor & Viability Scoring Not all bounties are worth pursuing. The agent calculates a viability score: Python   def _score_viability(self, bounty): payout = bounty["payout_eth"] threshold = bounty["threshold"] remainin

Building Atomic Cross-Border Settlement on Stellar: The AnchorFX Story A technical deep-dive into Soroban escrow contracts, FX oracles, and mainnet deployment — from testnet prototype to production. se The Problem Cross-border payments still take 3-5 days and cost 6.5% on average. Correspondent banking chains are slow, opaque, and expensive. The $800B remittance market has no atomic settlement layer. Stellar was purpose-built for this. 5-second finality. Built-in DEX. Path payments at the protocol level. And now, with Soroban smart contracts, programmable settlement. AnchorFX is an open-source protocol that combines these primitives into trustless, atomic FX settlement between regulated financial anchors. Two Soroban contracts — an Escrow Factory and an FX Rate Oracle — communicate via cross-contract calls to lock, rate, and settle funds in a single atomic flow. Architecture Sender → [Escrow Contract] → Receiver │ [Oracle Contract] │ FX Rate Data Contract 1: Escrow Factory (995 lines, 23 tests) The escrow contract is a multi-escrow factory with per-escrow storage. Each escrow goes through a defined lifecycle: Created — Sender locks tokens with a timeout and settlement conditions CounterpartyApproved — Receiver signs off on the terms Settled — Admin releases funds at the locked FX rate Refunded — Sender reclaims after timeout expires Cancelled — Admin cancels (circuit breaker) pub fn create_escrow ( env : Env , sender : Address , receiver : Address , token : Address , amount : i128 , timeout_blocks : u32 , corridor : u32 , ) -> u64 { sender .require_auth (); // Read oracle rate at creation time — locks the rate let oracle_addr = env .storage () .instance () .get ( & ORACLE_KEY ) .unwrap (); let rate : u64 = env .invoke_contract ( & oracle_addr , & symbol_short! ( "get_rate" ), ... ); // Store escrow with locked rate // ... } Key security decisions: Per-escrow storage — O(1) reads, independent TTL per escrow Checks-effects-interactions — state saved before token trans

The first time I audited seriously, I opened the biggest contract in the repo and started reading line one. Two hours later I had a headache and zero findings. I had memorized how the code worked without ever asking what it was supposed to guarantee. That is backwards, and it took me a while to unlearn it. Now I do not read Solidity first. I read the scope, and before I look at a single function body I write down what must always be true. Bugs are violations of those truths. If you do not know the truths, you are just admiring the code. Step one: write the invariants before you read An invariant is a property the protocol claims will always hold, no matter who calls what in what order. For a contest, I start with money and control, because that is where severity lives. Two questions cover most of it: Who can move funds, and under what conditions? What must always hold about the accounting? For a lending-pool-shaped protocol my starting invariant list looks like this, written in plain language before I care how any of it is implemented: The sum of all user deposits minus all borrows equals the pool's available liquidity plus outstanding debt. Accounting must reconcile. A user can only withdraw up to their own balance, never more, never someone else's. A position can only be liquidated when it is actually under the health threshold. Interest accrues monotonically, it never goes backwards in a way that lets someone repay less than they owe. Only the borrower, or a liquidator on an unhealthy position, can reduce a debt. Nobody except governance can change interest rate parameters or the oracle. Notice none of that mentions a function name. These are the promises. Now my job for the rest of the contest is simple to state: find an ordering of calls that breaks one of these. Step two: map the external entry points Funds do not teleport. Something has to be called from outside for state to change. So I list every externally reachable function, because the attack surface is

Introduction Polymarket , and on-chain prediction markets like it, kept bothering me for one reason. Polymarket |世界最大の予測市場™ Polymarketは世界最大の予測市場であり、さまざまなトピックにわたって将来のイベントを取引することで、最新情報を入手し、知識から利益を得ることができます。 polymarket.com Who bet on what is visible in near real time. The moment a whale places a big bet on one outcome, everyone watching piles in behind them, and the odds move accordingly. That's not manipulation — it's just what happens with a public ledger. But it doesn't satisfy the simple wish to not reveal your prediction before everyone else does. So: could you build a prediction market that keeps your pick hidden until voting closes? To find out, I built Hidden League Forecast on Midnight , a privacy-focused blockchain. It's an MVP where you just guess the winner of a fictional soccer league (the World Cup just ended, so soccer was on my mind). Note What's a prediction market? A mechanism that expresses predictions about future events as prices. Think "which team will win the World Cup match," for example. If you want to learn more about prediction markets, this resource (Japanese) is a great start: https://zenn.dev/barabara/books/prediction-markets-structure The backend is written in Compact , Midnight's smart contract language. Note It combines the commit-reveal pattern with zero-knowledge proofs so that "the content of your prediction stays hidden, while only the aggregate stake becomes public." In this article, I'll walk through the contract code, showing what stays hidden and what becomes public at each step. Note This app runs on testnet. Demo Video After connecting Lace Wallet, you see your Shielded Address and balance. From here you can deploy a new market or enter an existing contract address to join one. The Overall Flow What's actually happening is simple. OPEN → REVEAL → AWAITING RESULT → RESOLVED → CLAIM Connect Lace Wallet, then deploy a market or join an existing one Pick one of 4 teams (Amber Foxes / Cedar Owls / Harbor Whales / Meadow Bears) and

Every developer has had this moment. You need a date picker, so you start searching. You find one that's perfect... until you realize it requires React. Or Vue. Or jQuery. Or an entire date library just to select a few dates. After trying several solutions, I kept asking myself: Why is such a common UI component often more complicated than it needs to be? So I decided to build my own. Meet RollDate . The Goal I didn't want to create "another date picker." I wanted to build something that I would actually enjoy using in my own projects. The goals were simple: Infinite scroll Zero framework dependencies Simple API Modern UI Mobile-friendly scrolling TypeScript support Easy customization Good documentation Why Scrolling? Most date pickers rely on clicking tiny arrows or dropdowns. On mobile devices, this often feels awkward. I wanted something closer to native mobile pickers, where changing the month or year is just a smooth scroll. That became one of RollDate's core ideas. More Than Just Picking a Date While building the component, I realized different projects need different selection modes. So instead of maintaining separate components, RollDate supports: Single date selection Date range selection Multiple date selection The API stays the same regardless of the mode. new RollDate ( " #date " , { selectType : " range " }); Optional Time Picker Many date pickers force you to install another plugin if you need time selection. I wanted it built in. RollDate supports: 24-hour mode 12-hour AM/PM mode Configurable minute steps Enable it with one option. new RollDate ( " #date " , { enableTime : true }); Dependency-Free One of the main design goals was keeping the library independent. No React. No Vue. No jQuery. No Moment.js. No Day.js. Just plain JavaScript. That means it works almost anywhere: Vanilla JavaScript React Vue Angular Svelte Astro ...or any framework capable of using DOM components. A Better Developer Experience I care a lot about developer experience. That's

In 1996, Bandai sold 82 million Tamagotchis. Kids carried egg-shaped plastic keychains everywhere, frantically pressing three buttons to feed, clean, and play with a pixelated blob that would literally die if you ignored it during math class. It was the first time millions of people felt genuine emotional attachment to a piece of software. 30 years later, I rebuilt that entire experience — in the browser, with TypeScript, zero dependencies, completely open source. No app store. No download. No install. Just open a tab and adopt your pet. And in the process, I learned more about state machines, game loops, and emotional design than any computer science course ever taught me. Why Build a Virtual Pet in 2025? Three reasons: 1. Nostalgia Is a Distribution Hack People share things that trigger childhood memories. It's not rational — it's emotional. A browser-based Tamagotchi hits a nerve that no todo app or dashboard ever will. When I shared an early prototype, the response wasn't "cool tech stack." It was: "OH MY GOD I used to cry when mine died in second grade" That emotional reaction is worth more than any Product Hunt launch. 2. Game State Machines Are Criminally Underrated Every tutorial teaches state machines with traffic lights or toggle buttons. Boring. Useless. Forgettable. A virtual pet has dozens of interconnected states , real-time decay, evolution paths, conditional transitions, and edge cases that force you to actually think about state architecture. After building this, implementing complex UI flows in production apps felt trivial. 3. Not Everything Needs to Be a SaaS The indie dev world is obsessed with "revenue-generating side projects." Sometimes you should build something purely because it makes people smile. The best projects are the ones you'd use even if nobody else existed. Meet Your New Pet When you open Tamagochi, you get an egg. It hatches. A tiny pixelated creature appears. It has needs. Meet them, and it thrives. Ignore them, and... well, game

TL;DR: Passing a historical blockNumber to eth_call , eth_getBalance or eth_getLogs silently routes your request to the archive tier of hosted RPC providers. In our production metrics, archive calls cost on average 26.7x more compute units than the same call at latest . This post explains why, shows the exact client code pattern that triggers it, and gives you three Prometheus queries to measure your own archive exposure in under a minute. Full cross provider measurements are published in the OpenChainBench RPC benchmarks . Last week our RPC cost dashboard flagged an overage projection above four thousand dollars for a single billing cycle on a single provider. On paper, our services were doing normal eth_call operations. In practice, one small pattern buried in three separate indexers had multiplied our compute unit consumption by more than an order of magnitude, and nothing in the code review process had surfaced it. This post breaks down what an archive multiplier is, why it silently inflates blockchain RPC bills across every major hosted provider, and how to detect it in your own Prometheus stack before the next overage alert lands in Slack. What does "archive" mean at the Ethereum node level? Every request that reads the state of a smart contract, whether through eth_call , eth_getBalance , eth_getStorageAt , eth_getCode , or a batch of these, requires the RPC node to reconstruct the world state at a specific block height. Ethereum clients handle this in two modes. Full node mode. The state trie is kept in memory or on fast SSD for the tip of the chain plus a rolling window of recent blocks. On Geth default settings that window is 128 blocks deep. Any query targeting latest , pending , or a block within that window resolves in a few milliseconds against the current state. Archive node mode. The client preserves every intermediate state trie since genesis. Answering a query at a block from months or years ago requires reading historical trie data off disk and re

Every OP Stack chain we've covered — Base, Unichain, Zora — has a sequencer: one privileged party that orders transactions, and the thing you're implicitly trusting for liveness and fair ordering. Taiko doesn't have one. It's a based rollup : Ethereum's own validators propose Taiko's blocks as part of normal L1 block production. That single architectural choice cascades into everything a developer cares about — liveness, finality, MEV, and reliability. And because Taiko is also a Type-1 zkEVM , your Ethereum tooling works with zero changes. Here's the map for chain ID 167000 . The essentials Taiko mainnet ( Alethia ) is chain ID 167000 , an EVM Layer 2 with: ETH as the gas token (18 decimals) — no separate gas token to source. ~12-second blocks , aligned with Ethereum's slot times — because block proposing rides on L1, the cadence follows L1. Type-1 zkEVM equivalence — the most Ethereum-equivalent zkEVM design. Contracts deploy bit-identically; opcode behavior is exact. Connecting is completely standard EVM: import { createPublicClient , http } from " viem " ; import { taiko } from " viem/chains " ; // chain ID 167000 const client = createPublicClient ({ chain : taiko , transport : http ( " https://rpc.swiftnodes.io/rpc/taiko?key=YOUR_API_KEY " ), }); await client . getBlockNumber (); // just works What "based" changes: no sequencer to trust — or to fail On a typical rollup, a sequencer receives your transactions, orders them, and produces L2 blocks ( what a sequencer does ). It's efficient, but it's also a single point of trust and a single point of failure — sequencer outages have taken major L2s offline for hours. A "based" rollup removes it entirely: Block proposing happens on Ethereum L1. Taiko blocks are proposed via L1 transactions, so Ethereum's proposers include them as part of normal block production. There is no separate Taiko sequencer. Liveness = Ethereum's liveness. As long as Ethereum is producing blocks, Taiko is producing blocks. There is no "the se

Retail investors hold digital coins on standard mobile apps. They also use basic physical hardware devices. These devices protect small amounts of money perfectly well. Things change entirely when an account holds fifty million dollars. A single hardware device creates a huge physical weakness. A home invader can force an investor to hand over the pin code. This makes the underlying computer math completely useless. Wealthy investors skip this physical risk entirely. They divide control across different global regions. They ensure no single person can approve a money transfer alone. When you ask where do rich people store their crypto, the answer is never a single app. The answer is a shared digital network. This guide explains exactly how ultra-high net worth crypto management works. We break down shared vaults. We look at the exact differences between multiple signatures and mathematical key splitting. We also cover the severe technical failures that retail investors ignore completely. Table of Contents The Core Strategy for Whale Wallet Management Why Standard Hardware Wallets Fail at Scale How Asset Transfers Actually Work for Whales The Multisig Boardroom Approach The Multi Party Computation Breakthrough The Fragmented Lens Analogy The Firmware Desync Edge Case Inside the Air Gapped Fortress The Rise of Institutional Crypto Custodians Segregated Accounts Versus Omnibus Pools Constructing a Family Office Security Standard Handling Succession and Inheritance Planning Physical Threats and Bunker Security Network Fees and Trading Execution for Whales The Institutional Blockchain Storage Comparison The Three Point Technical Audit for Large Vaults The Bottom Line The Core Strategy for Whale Wallet Management Rich people store their crypto by using qualified institutional custodians, multi-signature (multisig) wallets, and Multi-Party Computation (MPC) systems. Instead of leaving large funds on regular exchanges, wealthy investors split their cryptographic private key

Arc 11 covered Days 71–77 of Epoch 3, and it was all about Cross-Program Invocations. In Arc 9, we wrote our first Solana program. In Arc 10, we gave that program a more useful state model with Program Derived Addresses. But our programs were still mostly working alone. They could read and update their own accounts, enforce their own constraints, and respond to instructions sent by a client. They could not directly change state owned by another program or bypass the rules that program enforced. That is an important part of Solana’s security model. The System Program owns the rules for creating accounts and transferring lamports. Token-2022 owns the rules for mints, token accounts, supply, and mint authorities. If our program needs one of those capabilities, it calls the program that owns the operation. That call is a Cross-Program Invocation, or CPI. The Web2 comparison is a service-to-service API call. One service sends a request through another service’s public interface, and the receiving service applies its own rules. A CPI works in a similar way, with one important difference: the outer and inner instructions execute as part of the same Solana transaction. If the inner call fails, the state changes made by the outer instruction are rolled back too. That combination of clear program boundaries and atomic execution is what makes Solana programs composable. Our first CPI called the System Program The arc began with the smallest useful CPI we could build. Our Anchor program accepted a sender, a recipient, and an amount of SOL to transfer. But the program did not edit the sender’s balance directly. Instead, it called the System Program’s transfer instruction. That distinction matters. Accounts on Solana are owned by programs, and the owner program controls how their data may be changed. Our program could not simply reproduce the effect of a System Program transfer by adjusting balances itself. It had to ask the System Program to perform the operation. Every CPI need

If you’ve ever built or interacted with DeFi protocols, you know the mathematical limitations of Constant Product Market Makers ($x \times y = k$). While AMMs are great for retail liquidity, executing a large transaction (e.g., $100,000+) directly against a liquidity pool triggers two major issues: Severe Slippage: The marginal price of the asset degrades exponentially relative to the trade size. MEV Exploitation (Sandwich Attacks): Public mempool transactions are highly vulnerable. Front-running bots will buy the asset ahead of your execution block, push the price up to your maximum slippage limit, and dump it immediately after. To solve this without relying on centralized, custodial desks or risky off-chain escrow setups, we built Typelex —a decentralized, non-custodial P2P OTC protocol. Here is a look at how we bypassed the AMM bonding curve entirely using on-chain atomic swaps. The Architecture of an On-Chain Atomic Swap Instead of routing trades through active liquidity pools, Typelex utilizes isolated smart contracts to execute peer-to-peer trades. The entire swap happens atomically : either all conditions are met within a single block execution, or the entire transaction reverts. Conceptual Smart Contract Logic (Solidity-based) To understand how the trustless escrow works under the hood, here is a simplified mental model of the swap execution logic: struct Order { address maker; address taker; // address(0) if public address tokenA; uint256 amountA; address tokenB; uint256 amountB; bool active; } mapping(uint256 => Order) public orders; function takeOrder(uint256 orderId) external { Order storage order = orders[orderId]; require(order.active, "Order not active"); if (order.taker != address(0)) { require(msg.sender == order.taker, "Unauthorized taker"); } order.active = false; // Pull Token B from Taker to Maker IERC20(order.tokenB).transferFrom(msg.sender, order.maker, order.amountB); // Push Token A from Contract Escrow to Taker IERC20(order.tokenA).transfer

VistralNova began by developing Web3 gaming experiences and is now expanding toward developer...

Complete AI Agent Lockdown: 21 Policy Types for Maximum Security Giving an AI agent a wallet without guardrails is like giving a toddler a credit card — technically functional, potentially catastrophic. If you're building AI agents that interact with crypto wallets, the security model you choose isn't an afterthought. It's the difference between a useful autonomous system and one that drains your funds on a bad inference. This post is about exactly how WAIaaS handles that problem. Not vague promises about "enterprise-grade security" — specific mechanisms, specific policy types, and specific code you can run today. The Actual Risk Model Let's be honest about what can go wrong when you give an AI agent wallet access: The agent misinterprets a prompt and sends funds to the wrong address A compromised session token gets used by an attacker The agent executes a DeFi action with parameters outside your intended range Gas fees spike and the agent submits transactions at costs you'd never accept manually The agent approves an unlimited token allowance to a contract you didn't vet None of these require a malicious agent. They can all happen with a well-intentioned model operating outside the boundaries you forgot to define. The solution isn't to avoid giving agents wallet access — it's to define exactly what they're allowed to do, and nothing more. WAIaaS approaches this with three distinct security layers, a default-deny policy engine with 21 policy types across 4 security tiers, and multiple channels for human approval when transactions exceed your defined thresholds. Layer 1: Authentication — Three Separate Keys for Three Separate Roles The first layer is role separation. WAIaaS uses three authentication methods that map to three distinct principals: masterAuth (Argon2id) — The system administrator role. Creates wallets, manages sessions, configures policies. This credential never touches the agent. sessionAuth (JWT HS256) — The AI agent's credential. Scoped to a specific

I built a small index basket app on Robinhood Chain because I wanted to understand the developer path from the first contract deploy all the way to a working frontend. The app is intentionally plain: a user deposits Stock Tokens, which are blockchain tokens that represent real equity exposure, and receives an ERC-20 basket share. ERC-20 is Ethereum's standard token interface, so a compatible token exposes familiar methods like balanceOf , transfer , and approve . The basket share is priced from live price feeds, and the user can redeem it back into the underlying Stock Tokens. That's the part that made this interesting to me. The chain is custom, but the app path is not. I still wrote Solidity, deployed with Foundry, read contract state with viem, and wrote transactions from React with wagmi. If you've built normal web apps, think of the chain's RPC endpoint as the API base URL. A wallet is login plus a signing key. A smart contract is backend code you deploy to the chain, except you should treat it like immutable infrastructure because you don't get to hot-patch it casually later. The demo and source are here: App: https://robinhood-chain-dapp.vercel.app/ Code: https://github.com/hummusonrails/robinhood-chain-dapp-example The custom chain still feels like the EVM Robinhood Chain is a custom Arbitrum Chain, which means it runs as a dedicated chain on the stack of Arbitrum, an Ethereum scaling system. It is also EVM-compatible. EVM means Ethereum Virtual Machine, the runtime that executes Solidity contracts, so the tooling surface looks like the Ethereum developer flow many tutorials already teach. An L2, or rollup, is a chain that executes transactions separately and then posts compressed proof or transaction data back to Ethereum. Robinhood Chain uses Ethereum blobs for data availability, which is a cheaper Ethereum data lane for rollups to publish the data needed to reconstruct chain state. Gas, the metered compute fee you pay to run transactions, is paid in ETH.

Welcome to Learning Xahau, a series of articles dedicated to helping developers, builders, and blockchain enthusiasts better understand the Xahau ecosystem. Whether you're just getting started or already building advanced applications, these posts will explore Xahau's features, architecture, and best practices through practical examples and real-world use cases. If you've been building with Hooks on Xahau, you know the basic loop: write a C program, compile it to WebAssembly, install it on an account, and it fires automatically when that account is involved in a transaction. Simple and powerful, but until the 2026.6.21 major release, there were some friction points that made real-world hook architectures more complicated than they needed to be. This release ships three improvements that directly address those friction points: HookOnV2 : split the single HookOn bitmask into separate HookOnIncoming and HookOnOutgoing controls NamedHooks : assign a human-readable name to each hook slot, so senders can choose which hook to activate Simulate RPC : preview a transaction including all hook executions without spending fees or changing ledger state None of these require rewriting your hook logic. They are configuration and tooling improvements at the SetHook and transaction level. But they fundamentally change what you can build cleanly. All code in this article targets the Xahau Testnet ( wss://xahau-test.net ) and requires xahau.js 4.1.1 or later. Clone the companion repository: git clone https://github.com/Ekiserrepe/learningxahau20260621.git cd learningxahau20260621 npm install Copy .env.example to .env and fill in the seeds used across these examples: cp .env.example .env HUB_SEED = # account that installs the directional hook (07, 08, 09) NAMED_HUB_SEED= # account that installs and owns the named hooks (10, 11, 13, 14) SENDER_SEED = # account that sends payments targeting a named hook (12, 14) All accounts need testnet funds from the Xahau Testnet Faucet . HookOnV2: Di

When I first started learning Solana, one of the biggest questions I had was: "If there are no usernames or passwords, how does the blockchain know who I am?" As a Web2 developer, I was used to creating accounts with an email address, choosing a password, and relying on a company to manage my identity. After spending several days learning Solana, I realized blockchain approaches identity in a completely different way. Identity in Web2 Think about all the accounts you have today. GitHub Gmail Facebook LinkedIn Your bank Every service asks you to create another account. Each company stores your username and password in its own database. Your identity exists because they say it exists. If they suspend your account or delete it, your access disappears. In other words, your identity is owned by the platform. Identity on Solana On Solana there are no usernames. There are no passwords. There isn't even an account registration page. Instead, your identity begins with one thing: A cryptographic keypair. A keypair consists of: A Public Key A Private Key When I generated my first wallet using the Solana CLI, I immediately had a new blockchain identity. For example: Public Key: AxfVXDX7jsCw7vSnwut9hA7oX4UykE3ZeiNF6cxCKvpf This public key becomes my wallet address. Anyone can send tokens to it. Anyone can view its transactions. But nobody can spend funds from it. Why? Because only I possess the private key. Think of SSH Keys The easiest comparison for Web2 developers is SSH. When connecting to a Linux server: the server knows your public key you prove ownership using your private key Solana works almost exactly the same way. Except instead of logging into one server... you're interacting with an entire blockchain. Every transaction I make is digitally signed using my private key. Validators verify the signature before accepting the transaction. No password is ever transmitted. No administrator approves my login. The mathematics prove my identity. Why Wallets Matter One thing I f

There's a moment in every Solana project where the work stops being about whether the program works and starts being about whether it's ready . You've tested it, the logic holds, the constraints are tight. Then you point it at mainnet, and a different set of questions shows up: questions about money, permanence, and strangers. This post is about that transition. Not the commands, which are short and well documented, but the shift in what you're responsible for once real users can touch your code. If you've been building on devnet and you're starting to think about a live launch, this is the mental model to carry in. Devnet was a sandbox. Mainnet is not. Devnet is a practice field. The SOL is free, you airdrop more whenever you run low, and if you deploy something broken, the only casualty is your afternoon. That safety is the whole point of devnet: it lets you fail cheaply and often, which is exactly how you should be learning. Mainnet removes the safety net, and three things change the moment you cross over. The SOL is real. Deploying a program allocates an on-chain account sized to your compiled binary, and you pay rent for that space in actual SOL. Larger programs cost more. This isn't a huge sum for a typical program, but it's real money leaving a real wallet, and that alone tends to sharpen how carefully you check things before you hit deploy. The audience is real. On devnet the only person calling your program is you. On mainnet, anyone can find your program and send it any transaction they like, the moment it's live. Everything from the security arc stops being theoretical: the accounts strangers pass in, the inputs you didn't expect, the edge cases you hoped no one would hit. Mainnet is where "every account is attacker-controlled until proven otherwise" becomes a live condition rather than a lesson. The mistakes are visible. A bad devnet deploy disappears into the noise. A bad mainnet deploy is a public event, on a permanent ledger, in front of the users you

I have a confession to make. When I first saw that Tether—the behemoth behind the $110 billion USDT stablecoin—was the primary financial backer of Holepunch, Keet, and the Bare JavaScript runtime, my brain short-circuited. I struggled with the cognitive dissonance. Why? Because if you have ever written a smart contract that interacts with USDT on Ethereum Mainnet, you know it is an absolute nightmare. Before we can talk about Tether’s brilliant vision for a decentralized, serverless future, we have to talk about the trauma they inflicted on a generation of Solidity developers. 1. The Original Sin: USDT is not actually an ERC-20 When you are deep in protocol-level engineering, you rely on standards. EIP-20 explicitly states that a token's transfer and transferFrom functions must return a boolean value to indicate success or failure. // The standard EIP-20 Interface interface IERC20 { function transfer(address to, uint256 amount) external returns (bool); } Tether completely ignored this. When they deployed the USDT contract, they omitted the return value entirely. Their functions return void. // The actual USDT Mainnet Implementation (simplified) function transfer ( address to , uint value ) public { // ... logic ... // Notice: No return statement. } If you blindly write a vault or a swap contract using the standard IERC20 interface to move USDT, your transaction will seamlessly execute the logic, move the funds, and then violently revert at the very last microsecond. Why? Because modern Solidity uses a strict ABI decoder. When your contract calls USDT.transfer(), the EVM executes a low-level CALL. When the call finishes, Solidity checks the RETURNDATASIZE. Since it expects a bool (32 bytes), but USDT returns absolutely nothing (0 bytes), the decoder panics and reverts the entire transaction. For years, the only way to build DeFi safely with USDT has been to wrap it in OpenZeppelin's SafeERC20 library, which uses low-level assembly to explicitly check the return data