Home
Writing
Notes from the contract layer: crosschain settlement, onchain matching, gas architecture, and the trust assumptions underneath.
- · 16 min readA Slashing Condition Must Be Objectively ProvableEthereum decides a slashable fault in a function that takes two signed messages and no chain state, and a restaking core decides one in a call whose only field about the fault is a string.
- · 13 min readA Settlement Timeout Still Leaves an ObligationA model of delayed payment evidence shows when a tokenised security must remain locked, and when a settlement facility can own the final transfer.
- · 13 min readAn Agent Wallet Must Account for the Authority It Leaves BehindA revoked agent can leave token spending authority behind. The custody decision follows the paths that can still move the balance.
- · 14 min readERC-4626 Share Inflation Is a Write Authority BugA vault's share price divides its assets by its shares, and the standard says who may write only one of the two, which is what decides where the repair belongs.
- · 14 min readNAV Is a Control Input, Not a Dashboard NumberA published net asset value actuates mint, redeem and collateral state transitions, and nobody is paid to correct it when it is wrong, which is what decides where the bound goes.
- · 18 min readAtomic Settlement Across Domains Is Constructed, Never InheritedOne matched fill, two legs, two clocks. The construction that replaces inherited atomicity is six external functions and ten require statements where the inline version is one and none, and its safety is a relation between two absolute deadlines. Write that relation as a per leg duration and every guard still reads correct while the window the contract promises the maker goes to zero.
- · 18 min readA Security Gate That Cannot Fail Is CeremonyThree invariant campaigns over one staking pool, same property, same budget, same seed. The one that reports full coverage is also green, and the defect is still there. What separates them is the callable surface.
- · 14 min readWhat a Runtime Can Name Before It RunsWhere a chain keeps its state decides what it can price and cap per named object, and handing an engine perfect write sets did not decide throughput on the one benchmark that tried it.
- · 14 min readCount the Price Sources That Can Write Your Balance DownWhere a shortfall lands differs between the two designs, and what decides your exposure is how many price sources can reach the total you redeem against, and who sets that number after you deposit.
- · 15 min readCount Every Division Before the Balance WriteA fee is derived, so the design question is where its remainders are allocated. Six call sites on one engine's fill path, three rounding directions, and an enumerated bound on what fragmentation costs.
- · 14 min readCurve or Book: The Ordering Rule Decides, Not the Asset ClassBoth primitives priced in one unit on the term where they differ, where volatility cancels wherever a maker chooses his own spread and the venue's ordering rule decides whether he can.
- · 11 min readFrom 142K to 28K gas per trade: the architecture behind an 80% reductionStruct packing, a red black tree, and transient storage took an onchain matching engine from 142K to 28K gas per trade. Each layer traded something, and one of them nearly broke the system.
- · 11 min readERC-6909 in production: what the spec doesn't tell youERC-6909 is the right standard for multitoken accounting, and almost everything that bites in production is missing from the spec. Lessons from shipping it as the accounting layer of a 15 contract mainnet settlement protocol: silent accounting failures, divergent permission semantics across libraries, and a tooling void.