Most write-ups about smart contract work show you the parts that worked. This one includes the parts that didn't, because those are the ones worth reading.
Seven contracts, deployed to Base Sepolia. Eight pages that read chain state on every request. No forks, no local Anvil node dressed up as a network, no screenshot standing in for a transaction. Contract addresses print on the page and open on Basescan. You can connect a wallet and make any of them do something.
Here's what I found building them.
One pipeline, seven repos, one definition of green
Each repo vendors a shared pipeline as a submodule and calls its reusable workflow. A fix to a gate lands once instead of seven times.
Order matters more than people give it credit for. forge lint and Solhint run first, because linting takes seconds and fuzzing takes minutes. Then Foundry unit, fuzz and invariant tests on a pinned toolchain — a skipped test is a red build, not a yellow one. Then Slither at fail-on low, with every excluded detector argued in writing. Then Echidna and Medusa, two independent fuzzers running one shared Properties.sol.
The interesting bit is why the property count is a Solidity literal:
A stale build artifact once shrank a property set and reported a smaller green run.
The suite went green with fewer properties registered and nothing said so. Now the expected count is declared in the source and four independent checks must agree with the literal before a build passes. The harness audits itself.
The coverage gate is 100% line, statement, branch and function on every file under src. The only exclusions are snarkjs-generated verifier contracts, excluded by name and printed on every run rather than folded into a percentage. A percentage hides an exclusion; a printed name doesn't.
Two of four gas optimizations are basically noise
One contract, deployed twice. One ordinary version, one with four optimizations, and a compiler-enforced identical ABI so signature drift fails the build. A runner calls both in a single transaction, so both face the same block, the same base fee and the same caller. Figures come out of the receipt.
| technique | saving |
|---|---|
packed struct on writeRecord
|
71.8% (92,195 → 25,976 gas) |
bitmap replacing a bool mapping on setFlagRange
|
85.6% |
| calldata over memory | 0.1% |
| custom error over revert string | 1.9%, reverting path only |
The last two stay in the table. Calldata-over-memory is swamped by the cold storage writes in the same call. The custom error saves nothing on any path that doesn't revert. A demo where every technique wins is a curated demo.
And the counterpoint sits on the same page: the optimized contract costs 10.1% more to deploy.
The Chainlink guard in everyone's consumer code that never fires
Protocols rarely lose money because an oracle got attacked. They lose it because the consuming contract called latestRoundData, took the answer, and used a price that was already stale, or negative, or from a round that never finished.
A contract reads four live feeds and names which of six failure states applies, reporting the most severe when several apply at once.
Two things fell out of building it.
Per-feed staleness thresholds are not optional. The three crypto feeds republish every few minutes on price deviation. USDC moves on a roughly 24-hour heartbeat — I measured it across two intervals before writing the contract. One estate-wide threshold describes neither feed correctly.
answeredInRound >= roundId is dead code. That guard is still copied into consumer code today. On all four aggregators it returns equal to roundId, so it never fires. It's a comfort check.
One testing note: the staleness boundary is inclusive, and the property harness constructs both sides of the threshold on every run. Interior sampling never catches a > swapped for a >=.
Putting a language model in the settlement path
This is where the AI and blockchain overlap gets interesting, and it's mostly a division-of-labor problem. A chain records a decision permanently and makes no judgment of its own. A model makes judgment calls and remembers nothing. Two demos draw that line in public.
ZK escrow. Funds release one of two ways. A Groth16 proof of a delivery secret releases them without revealing the secret — the commitment is Poseidon of the secret, derived on your own machine by a script in the repo, so the secret never crosses the wire. A contested delivery goes to an AI arbiter whose ruling and full reasoning are written to chain in the clear.
Two design decisions I'd defend anywhere. Settlements are never pushed — every outcome credits a pull-payment balance, so a recipient refusing a transfer never blocks a settlement. And the proof authorizes the release rather than the sender, bound to one escrow by a nullifier, so anyone can broadcast the transaction.
There's also a scar in the proxy's history: a UUPS upgrade added arbiter rotation after a dispute stranded behind an arbiter address with no known private key.
AI parametric insurance. Parametric means the payout follows a defined condition rather than an assessed loss — and that distinction is the entire reason a model belongs in the loop. Did the stated condition occur has a checkable answer. What is this loss worth does not, and this system never asks it.
Three adjudicators sign, each pinned to a different model, duplicates rejected at construction. Two agreeing verdicts settle a claim. The evidence hash lands on chain when the claim is filed, before any adjudicator sees anything, and a verdict carrying a different hash is refused rather than discounted. The decision is an enum, never prose, so a re-run compares. The adjudicator set has no owner and no setter, because an operator who can swap signers manufactures any majority after seeing the first verdict.
Here's the part I'd most want another engineer to argue with. Within three days of writing down the procedure, two of the pinned models changed behavior underneath their own identifiers. One started rejecting the temperature field outright. One started wrapping its JSON in a code fence. None of that shows up in a published hash. Pinning a model identifier does not pin model behavior, so the page calls this a multi-signer oracle rather than a trustless one.
The other three
RWA tokenization. An ERC-3643-inspired token where fractions of an asset trade as an ERC-20 and every mint and transfer passes an on-chain KYC whitelist. Four seeded transactions, and the third is the point: a correctly formed transfer of 500 tokens to an address with no KYC record, reverted by the token itself. Contracts are hand-rolled, no T-REX suite vendored. Try the transfer
ZK KYC pass. Same compliance outcome, no identity list. A holder proves in zero knowledge they hold a valid credential from an approved issuer without revealing the issuer or any identifying data. On chain there's a Merkle root and a set of spent nullifiers — nothing enumerable. The proof binds to the redeemer's address, so a stolen proof is worthless, and rotating the root re-issues the whole credential set in one transaction. See the private gate
Interest rate model. The kinked curve most lending protocols run on, deployed with every parameter fixed at construction — no owner, no setter, no upgrade path. Eight invariants are claimed for the entire valid parameter space, not the one deployed curve, so the harness builds six curves including a kink one wei above zero and one wei below full. The page shows the borrow rate one wei either side of the kink, where two formulas have to agree to the wei. They return the same integer. Move the slider
Why the failures are on the pages
Every page prints its contracts, links its repository, links its CI run, and reads its numbers off the chain while you watch. The gas demo keeps two losing techniques in the table. The AI adjudication demo says at the top of the page, not in a footnote, that the operator holds every key.
That isn't modesty. A demo that only shows wins tells you nothing about the person's judgment, which is the thing you actually wanted to know. If you build something similar, write down the parts you are not claiming — it's the cheapest credibility available.
All repos are public at github.com/pigfox. Corrections welcome, particularly on the multi-signer oracle design.
Top comments (0)