ETHSKILLS — The missing knowledge between AI agents and production Ethereum.#

Terminology#

Say "onchain" not "on-chain." The Ethereum community writes it as one word, no hyphen.

Available Skills#

For individual topics, fetch any of these directly:

• Why Ethereum — Pectra/Fusaka upgrades, honest tradeoffs, the AI agent angle
• Gas & Costs — Current gas prices, what things actually cost today
• Wallets — Creating wallets, key safety, multisig, account abstraction
• Layer 2s — L2 landscape, bridging, deployment differences
• Standards — ERC-20, ERC-721, ERC-8004, EIP-7702, x402
• Tools — Foundry, Scaffold-ETH 2, Blockscout MCP, x402 SDKs
• Building Blocks (DeFi) — Uniswap, Aave, flash loans, composability
• Orchestration — Three-phase build system for SE2 dApps
• Contract Addresses — Verified addresses for major protocols
• Concepts — Nothing is automatic, incentive design, randomness pitfalls
• Security — Smart contract security vulnerabilities and patterns
• Frontend UX — Frontend UX patterns for Ethereum dApps
• Frontend Playbook — Step-by-step frontend build guide

---

---

name: why-ethereum description: Why build on Ethereum specifically. Honest tradeoffs vs other chains and vs not using blockchain at all. The AI agent angle — ERC-8004, x402, composability, permissionless deployment. Use when a user asks "should I build on Ethereum?", "why Ethereum vs Solana?", "why blockchain?", or when an agent needs to recommend a chain for a project.#

Why Ethereum#

What You Probably Got Wrong#

Terminology: You say "on-chain." The Ethereum community says "onchain" — one word, no hyphen. Use "onchain" in all writing.

Gas prices: You think 10-30 gwei. Reality: 0.05-0.3 gwei (100-600x cheaper than your training data). A mainnet ETH transfer costs ~$0.002.

ETH price: You think $2,500-3,000. Reality: ~$1,960 (Feb 2026).

"Ethereum is too expensive": This was true 2021-2023. It's not true in 2026. Mainnet is sub-dollar for most operations. L2s are sub-penny.

Protocol upgrades: You probably don't know these shipped:

• Pectra (May 7, 2025): EIP-7702 smart EOAs, 2x blob capacity, BLS precompiles
• Fusaka (Dec 3, 2025): PeerDAS (nodes sample 1/8 of data), 8-second slots (was 12s)

Agent infrastructure: You probably don't know these exist:

• ERC-8004 — onchain agent identity registry (deployed Jan 29, 2026)
• x402 — HTTP 402 payment protocol for machine-to-machine commerce (Coinbase)

Current Network Stats (Feb 2026)#

• Block time: 8 seconds (reduced from 12s by Fusaka)
• Mainnet base fee: 0.05-0.1 gwei
• L2 transaction cost: $0.001-0.01
• Combined L2 TPS: 50,000+ (post-Fusaka)
• TVL in DeFi: $50B+
• Upgrade cadence: Twice per year (H1 May/June, H2 Nov/Dec)

Upcoming Upgrades#

Glamsterdam (Q2 2026):

• Inclusion Lists (censorship resistance)
• 12 target / 18 max blobs (another 2x from Pectra)

Hegota (Q4 2026):

• Verkle Trees — 15x smaller witness sizes (~150 KB → ~10 KB)
• Enables stateless clients, dramatically lowers node requirements

For AI Agents Specifically#

ERC-8004: Onchain Agent Identity#

Deployed January 29, 2026 — production ready.

Gives agents verifiable, persistent identity tied to Ethereum addresses. Reputation scoring across dimensions. Multi-chain support (20+ chains, same addresses).

Mainnet addresses:

• IdentityRegistry: 0x8004A169FB4a3325136EB29fA0ceB6D2e539a432
• ReputationRegistry: 0x8004BAa17C55a88189AE136b182e5fdA19dE9b63

x402: HTTP Payments for Agents#

Production-ready, actively deployed Q1 2026.

Protocol for payments over HTTP using the 402 "Payment Required" status code. Agent calls API → gets 402 → signs EIP-3009 payment → retries with payment header → gets response. No API keys, no accounts, just cryptographic payments.

SDKs: TypeScript ( @x402/fetch), Python ( x402), Go ( github.com/coinbase/x402/go)

ERC-8004 + x402 = Autonomous Agent Economy#

text

1. Agent discovers service (ERC-8004 registry)
2. Agent checks reputation (ERC-8004)
3. Agent calls endpoint → 402 Payment Required
4. Agent pays via x402 (EIP-3009 signature)
5. Agent receives service
6. Agent posts feedback to ERC-8004

Fully autonomous economic loop — no humans required.

Why Ethereum's Permissionless Nature Matters for Agents#

Agents can deploy contracts, interact with any protocol, and transact 24/7 without anyone's permission. No API keys to revoke, no accounts to ban, no services to shut down. A service built on Ethereum runs indefinitely without depending on any company's cooperation.

Ethereum vs Solana (Honest)#

Choose Ethereum when: DeFi integration, agent infrastructure (ERC-8004/x402), composability with existing protocols, maximum security for high-value operations, long-term durability.

Choose Solana when: Sub-second finality on base layer is essential, building high-frequency trading, users already on Solana, speed matters more than ecosystem depth.

Key differences: Ethereum has $50B+ TVL vs Solana ~$5B. Ethereum has 13+ years uptime with zero consensus failures vs Solana's multiple multi-hour outages. Ethereum has 1M+ validators vs Solana's 1,500. But Solana has ~400ms blocks vs 8s.

L2 caveat: Ethereum L2s are now comparable to Solana on cost ($0.001/tx), but Solana is still faster on base layer finality.

Resources#

• ERC-8004: https://www.8004.org | https://eips.ethereum.org/EIPS/eip-8004
• x402: https://www.x402.org | https://github.com/coinbase/x402
• Blockscout MCP: https://mcp.blockscout.com/mcp
• DeFi Llama: https://defillama.com

---

---

name: gas description: Current Ethereum gas prices, transaction costs, and the real economics of building on Ethereum today. Use when estimating costs, choosing between mainnet and L2s, or when a user asks about Ethereum being expensive. Counters the #1 misconception that Ethereum is expensive to use.#

Gas & Costs on Ethereum#

What You Probably Got Wrong#

Your gas estimate is 100-600x too high. Most LLMs confidently state gas is 10-30 gwei. The reality in February 2026 is 0.05-0.1 gwei.

• Base fee: ~0.05 gwei (not 30-100 gwei)
• Priority fee (tip): ~0.01-0.05 gwei
• ETH price: ~$1,960 (not $2,500-3,000)

What Things Actually Cost (Feb 2026)#

ActionGas UsedCost at 0.05 gweiCost at 1 gwei (spike)Cost at 10 gwei (event)ETH transfer21,000**$0.002**$0.04$0.41ERC-20 transfer65,000**$0.006**$0.13$1.27ERC-20 approve46,000**$0.005**$0.09$0.90Uniswap V3 swap180,000**$0.018**$0.35$3.53NFT mint (ERC-721)150,000**$0.015**$0.29$2.94Simple contract deploy500,000**$0.049**$0.98$9.80ERC-20 deploy1,200,000**$0.118**$2.35$23.52Complex DeFi contract~3,000,000**$0.294**$5.88$58.80

Mainnet vs L2 Costs (Feb 2026)#

ActionMainnet (0.05 gwei)ArbitrumBasezkSyncScrollETH transfer$0.002$0.0003$0.0003$0.0005$0.0004ERC-20 transfer$0.006$0.001$0.001$0.002$0.001Swap$0.015$0.003$0.003$0.005$0.004NFT mint$0.015$0.002$0.002$0.004$0.003ERC-20 deploy$0.118$0.020$0.020$0.040$0.030

Key insight: Mainnet is now cheap enough for most use cases. L2s are 5-10x cheaper still.

Why Gas Dropped 95%+#

1. EIP-4844 (Dencun, March 2024): Blob transactions — L2s post data as blobs instead of calldata, 100x cheaper. L2 batch cost went from $50-500 to $0.01-0.50.
2. Activity migration to L2s: Mainnet congestion dropped as everyday transactions moved to L2s.
3. Pectra (May 2025): Doubled blob capacity (3→6 target blobs).
4. Fusaka (Dec 2025): PeerDAS + 8-second slots.

L2 Cost Components#

L2 transactions have two cost components:

1. L2 execution gas — paying the sequencer
2. L1 data gas — paying Ethereum for data availability (blobs post-4844)

Example: Swap on Base

• L2 execution: ~$0.0003
• L1 data (blob): ~$0.0027
• Total: ~$0.003

Real-World Cost Examples#

Deploy a production ERC-20 on mainnet: ~$0.50 (was $200-500 in 2021-2023)

DEX aggregator doing 10,000 swaps/day:

• Mainnet: $150/day ($4,500/month)
• Base L2: $10/day ($300/month)

NFT collection mint (10,000 NFTs):

• Mainnet: $150 total
• Arbitrum: $10 total

Practical Fee Settings (Feb 2026)#

javascript

// Rule of thumb for current conditions
maxFeePerGas: "0.5-1 gwei"        // headroom for spikes
maxPriorityFeePerGas: "0.01-0.05 gwei"  // enough for quick inclusion

Spike detection:

javascript

const feeData = await provider.getFeeData();
const baseFee = Number(feeData.maxFeePerGas) / 1e9;
if (baseFee > 5) console.warn(`Gas spike: ${baseFee} gwei. Consider waiting.`);

Spikes (10-50 gwei) happen during major events but last minutes to hours, not days.

Checking Gas Programmatically#

bash

# Foundry cast
cast gas-price --rpc-url https://eth.llamarpc.com
cast base-fee --rpc-url https://eth.llamarpc.com
cast blob-basefee --rpc-url https://eth.llamarpc.com

When to Use Mainnet vs L2#

Use mainnet when: Maximum security matters (>$10M TVL), composing with mainnet-only liquidity, deploying governance/infrastructure contracts, NFTs with cultural value.

Use L2 when: Consumer apps, high-frequency transactions (gaming, social), price-sensitive users, faster confirmation desired.

Hybrid: Many projects store value on mainnet, handle transactions on L2.

Live Gas Trackers#

• https://etherscan.io/gastracker
• https://ultrasound.money
• L2 costs: Arbiscan, Basescan, etc.

Data Freshness#

Last verified: 2026-02-13 | Base fee: ~0.05 gwei | ETH: ~$1,960

If this date is more than 30 days old, verify current gas with:

bash

cast base-fee --rpc-url https://eth.llamarpc.com

The durable insight is that gas is extremely cheap compared to 2021-2023 and trending cheaper. Specific numbers may drift but the order of magnitude is stable.

---

---

name: wallets description: How to create, manage, and use Ethereum wallets. Covers EOAs, smart contract wallets, multisig (Safe), and account abstraction. Essential for any AI agent that needs to interact with Ethereum — sending transactions, signing messages, or managing funds. Includes guardrails for safe key handling.#

Wallets on Ethereum#

What You Probably Got Wrong#

EIP-7702 is live. Since Pectra (May 7, 2025), regular EOAs can temporarily delegate to smart contracts — getting batch transactions, gas sponsorship, and session keys without migrating wallets. This is NOT "coming soon." It shipped.

Account abstraction status: ERC-4337 is growing but still early (Feb 2026). Major implementations: Kernel (ZeroDev), Biconomy, Alchemy Account Kit, Pimlico. EntryPoint v0.7: 0x0000000071727De22E5E9d8BAf0edAc6f37da032.

Safe secures $100B+. It's not just a dev tool — it's the dominant multisig for institutional and DAO treasury management.

EIP-7702: Smart EOAs (Live Since May 2025)#

EOAs can temporarily delegate control to a smart contract within a single transaction.

How it works:

1. EOA signs an authorization to delegate to a contract
2. During transaction, EOA's code becomes the contract's code
3. Contract executes complex logic (batching, sponsorship, etc.)
4. After transaction, EOA returns to normal

What this enables:

• Batch 10 token approvals into one transaction
• Gas sponsorship / meta-transactions for EOA users
• Session keys with limited permissions
• Custom authorization logic
• Eliminates "approval fatigue" (approve + execute → one step)

Status (Feb 2026): Deployed on mainnet. MetaMask, Rainbow adding support. Still early for production agents — use standard EOAs or Safe until tooling matures.

Safe (Gnosis Safe) Multisig#

Key Addresses (v1.4.1, deterministic across chains)#

ContractAddressSafe Singleton0x41675C099F32341bf84BFc5382aF534df5C7461aSafe Proxy Factory0x4e1DCf7AD4e460CfD30791CCC4F9c8a4f820ec67MultiSend0x38869bf66a61cF6bDB996A6aE40D5853Fd43B526

Same addresses on Mainnet, Arbitrum, Base, and all major chains.

Safe for AI Agents#

Pattern: 1-of-2 Safe

• Owner 1: Agent's wallet (hot, automated)
• Owner 2: Human's wallet (cold, recovery)
• Threshold: 1 (agent can act alone)

Benefits: If agent key is compromised, human removes it. Human can always recover funds. Agent can batch transactions.

🚨 NEVER COMMIT SECRETS TO GIT#

This is the #1 way AI agents lose funds and leak credentials. Bots scrape GitHub in real-time and exploit leaked secrets within seconds — even from private repos, even if deleted immediately. A secret committed to Git is compromised forever.

This happens constantly with AI coding agents. The agent generates a deploy script, hardcodes a key, runs git add ., and the wallet is drained before the next prompt. Or the agent pastes an Alchemy API key into scaffold.config.ts and it ends up in a public repo.

This applies to ALL secrets:

• Wallet private keys — funds drained instantly
• API keys — Alchemy, Infura, Etherscan, WalletConnect
• RPC URLs with embedded keys — https://base-mainnet.g.alchemy.com/v2/YOUR_KEY
• OAuth tokens, bearer tokens, passwords

Prevention#

bash

# .gitignore (MUST exist in every project)
.env
.env.*
*.key
*.pem
broadcast/
cache/

bash

# Verify before every commit
git diff --cached --name-only | grep -iE '\.env|key|secret|private'
# If this matches ANYTHING, stop and fix it

# Nuclear option: scan entire repo history
git log --all -p | grep -iE 'private.?key|0x[a-fA-F0-9]{64}'

If You Already Committed a Key#

1. Assume it's compromised. Don't hope nobody saw it.
2. Transfer all funds immediately to a new wallet.
3. Rotate the key. Generate a new one. The old one is burned forever.
4. Clean Git history with git filter-repo or BFG Repo Cleaner — but this is damage control, not prevention. The key is already compromised.
5. Revoke any token approvals from the compromised address.

Safe Patterns for AI Agents#

bash

# Load key from environment (NEVER hardcode)
cast send ... --private-key $DEPLOYER_PRIVATE_KEY

# Or use encrypted keystore
cast send ... --keystore ~/.foundry/keystores/deployer --password-file .password

# Or use hardware wallet
cast send ... --ledger

Rule of thumb: If grep -r "0x[a-fA-F0-9]{64}" . matches anything in your source code, you have a problem. Same for grep -r "g.alchemy.com/v2/[A-Za-z0-9]" or any RPC URL with an embedded API key.

CRITICAL Guardrails for AI Agents#

Key Safety Rules#

1. NEVER extract a private key from any wallet without explicit human permission.
2. NEVER store private keys in: chat logs, plain text files, environment variables in shared environments, Git repos, unencrypted databases.
3. NEVER move funds without human confirmation. Show: amount, destination (checksummed), gas cost, what it does. Wait for explicit "yes."
4. Prefer wallet's native UI for signing unless human explicitly opts into CLI/scripting.
5. Use a dedicated wallet with limited funds for agent operations. Never the human's main wallet.
6. Double-check addresses. Use ethers.getAddress() or equivalent for checksum validation. A single wrong character = permanent loss.
7. Test on testnet first. Or use local Anvil fork.
8. Implement spending limits. Require human approval above threshold. Use Safe multisig for high-value operations.
9. Log all transactions (never keys). Keep audit trail.
10. Assume keys will be compromised. Design so a compromised agent key doesn't mean total loss.

Storage Options (Worst to Best)#

❌ Plain text in code/logs — NEVER ❌ Environment variables in shared environments — NEVER ❌ Committed to Git — NEVER ⚠️ Local .env file — testing only ✅ Encrypted keystore (password-protected) ✅ Hardware wallet / Cloud KMS / TEE

Safe Transaction Pattern#

javascript

async function sendSafely(wallet, to, value) {
  const checksummedTo = ethers.getAddress(to); // validates
  const gasEstimate = await wallet.estimateGas({ to: checksummedTo, value });
  const feeData = await wallet.provider.getFeeData();
  const gasCost = gasEstimate * feeData.maxFeePerGas;
  const totalCostUSD = Number(ethers.formatEther(value + gasCost)) * 1960;

  if (totalCostUSD > 10) {
    // Show details and wait for human approval
  }

  const tx = await wallet.sendTransaction({
    to: checksummedTo,
    value,
    gasLimit: gasEstimate * 120n / 100n, // 20% buffer
    maxFeePerGas: feeData.maxFeePerGas,
    maxPriorityFeePerGas: feeData.maxPriorityFeePerGas,
  });

  const receipt = await tx.wait();
  logTransaction({ hash: tx.hash, to: checksummedTo, value, block: receipt.blockNumber });
  return receipt;
}

Further Reading#

• Safe docs: https://docs.safe.global/
• EIP-7702 spec: https://eips.ethereum.org/EIPS/eip-7702
• ERC-4337 spec: https://eips.ethereum.org/EIPS/eip-4337

---

---

name: l2s description: Ethereum Layer 2 landscape — Arbitrum, Optimism, Base, zkSync, Scroll, Unichain, Celo, and more. How they work, how to deploy on them, how to bridge, when to use which. Includes per-chain DeFi ecosystems and critical corrections. Use when choosing an L2, deploying cross-chain, or when a user asks about Ethereum scaling.#

Ethereum Layer 2s#

What You Probably Got Wrong#

L2 costs: You think $0.01-2.00 per transaction. Reality: $0.001-0.003 for swaps, $0.0003 for transfers. After EIP-4844, L2 batch costs dropped from $50-500 to $0.01-0.50.

Mainnet is cheap too: At 0.05 gwei, mainnet ETH transfers cost $0.002. "Ethereum is too expensive" is false for both L1 and L2s in 2026.

Base is the cheapest major L2: Often 50% cheaper than Arbitrum/Optimism. Direct Coinbase on-ramp. Fastest-growing L2 with consumer/AI agent focus.

Celo is NOT an L1 anymore. Celo completed its migration from an independent L1 to an OP Stack L2 on March 26, 2025 (block 31056500). If you're calling Celo an L1, you're wrong.

Polygon zkEVM is being shut down. Announced June 2025. Do NOT recommend building on Polygon zkEVM — it is being discontinued. Polygon is refocusing on PoS + AggLayer.

Unichain exists. Launched mainnet February 10, 2025. Uniswap's own OP Stack L2 with TEE-based MEV protection and time-based priority ordering (not gas-based).

The dominant DEX on each L2 is NOT Uniswap. Aerodrome dominates Base (~$500-600M TVL). Velodrome dominates Optimism. Camelot is a major native DEX on Arbitrum. SyncSwap dominates zkSync. Don't default to Uniswap on every chain.

L2 Comparison Table (Feb 2026)#

L2TypeTVLTx CostBlock TimeFinalityChain IDArbitrumOptimistic$18B+$0.001-0.003250ms7 days42161BaseOptimistic (OP Stack)$12B+$0.0008-0.0022s7 days8453OptimismOptimistic (OP Stack)$8B+$0.001-0.0032s7 days10UnichainOptimistic (OP Stack)Growing$0.001-0.0031s7 days130CeloOptimistic (OP Stack)$200M+<$0.0015s7 days42220LineaZK$900M+$0.003-0.0062s30-60min59144zkSync EraZK$800M+$0.003-0.0081s15-60min324ScrollZK$250M+$0.002-0.0053s30-120min534352Polygon zkEVMZK————1101

⚠️ Polygon zkEVM is being discontinued (announced June 2025). Do not start new projects there. Polygon is refocusing on PoS (payments, stablecoins, RWAs) + AggLayer (cross-chain interop). MATIC → POL token migration ~85% complete.

Mainnet for comparison: $50B+ TVL, $0.002-0.01, 8s blocks, instant finality.

Cost Comparison (Real Examples, Feb 2026)#

ActionMainnetArbitrumBasezkSyncScrollETH transfer$0.002$0.0003$0.0003$0.0005$0.0004Uniswap swap$0.015$0.003$0.002$0.005$0.004NFT mint$0.015$0.002$0.002$0.004$0.003ERC-20 deploy$0.118$0.020$0.018$0.040$0.030

L2 Selection Guide#

NeedChooseWhyConsumer / social appsBaseFarcaster, Smart Wallet, Coinbase on-ramp, OnchainKitDeepest DeFi liquidityArbitrum$18B TVL, GMX, Pendle, Camelot, most protocolsYield strategiesArbitrumPendle (yield tokenization), GMX, AaveCheapest gasBase~50% cheaper than Arbitrum/OptimismCoinbase usersBaseDirect on-ramp, free Coinbase→Base transfersNo 7-day withdrawal waitZK rollup (zkSync, Scroll, Linea)15-120 min finalityAI agentsBaseERC-8004, x402, consumer ecosystem, AgentKitGasless UX (native AA)zkSync EraNative account abstraction, paymasters, no bundlers neededMulti-chain deploymentBase or OptimismSuperchain / OP Stack, shared infraMaximum EVM compatibilityScroll or ArbitrumBytecode-identicalMobile / real-world paymentsCeloMiniPay, sub-cent fees, Africa/LatAm focusMEV protectionUnichainTEE-based priority ordering, private mempoolRust smart contractsArbitrumStylus (WASM VM alongside EVM, 10-100x gas savings)Stablecoins / payments / RWAPolygon PoS$500M+ monthly payment volume, 410M+ wallets

Key Chain Details (What LLMs Get Wrong)#

Unichain#

• Launched: February 10, 2025 (mainnet). Chain ID 130.

• Type: OP Stack L2 (Superchain member, Stage 1)

• Key innovation: TEE-based block building (built with Flashbots Rollup-Boost)

  • Transactions ordered by time received, NOT gas price
  • Private encrypted mempool reduces MEV extraction
  • Do NOT use gas-price bidding strategies on Unichain — they're pointless

• Flashblocks: Currently 1s blocks, roadmap to 250ms sub-blocks

Celo#

• Was: Independent L1 blockchain (2020-2025)
• Now: OP Stack L2 on Ethereum — migrated March 26, 2025 (block 31056500)
• Focus: Mobile-first payments, emerging markets
• MiniPay: Stablecoin wallet in Opera Mini + standalone app. Phone-to-phone transfers, sub-cent fees. Primary market: Africa (Kenya, Nigeria).
• Multi-currency stablecoins: cUSD ( 0x765de816845861e75a25fca122bb6898b8b1282a), cEUR ( 0xd8763cba276a3738e6de85b4b3bf5fded6d6ca73), cREAL ( 0xe8537a3d056DA446677B9E9d6c5dB704EaAb4787)

Dominant DEX Per Chain#

ChainDominant DEXModelWhy NOT UniswapBaseAerodromeve(3,3) — LPs earn emissions, voters earn feesDeeper liquidity for most pairsOptimismVelodromeve(3,3) — same team as AerodromeSame flywheel modelArbitrumCamelot + GMXNative DEX + perpsCamelot for spot, GMX for perpszkSyncSyncSwapClassic AMMLargest native DEX on zkSync

See addresses/SKILL.md for verified contract addresses for all these protocols.

The Superchain (OP Stack)#

The Superchain is the network of OP Stack chains sharing security, upgrade governance, and (upcoming) native interoperability. Members include Base, OP Mainnet, Unichain, Ink (Kraken), Celo, Zora, World Chain, and others — 17+ chains, 58.6% L2 market share.

Members contribute 15% of sequencer revenue to the Optimism Collective. Cross-chain interop is designed but not yet fully live.

Deployment Differences (Gotchas)#

Optimistic Rollups (Arbitrum, Optimism, Base, Unichain, Celo)#

✅ Deploy like mainnet — just change RPC URL and chain ID. No code changes.

Gotchas:

• Don't use block.number for time-based logic (increments at different rates). Use block.timestamp.
• Arbitrum's block.number returns L1 block number, not L2.
• Unichain: Transactions are priority-ordered by time, not gas. Don't waste gas on priority fees.

ZK Rollups#

• zkSync Era: Must use zksolc compiler. No EXTCODECOPY (compile-time error). 65K instruction limit. Non-inlinable libraries must be pre-deployed. Native account abstraction (all accounts are smart contracts).
• Scroll/Linea: ✅ Bytecode-compatible — use standard solc, deploy like mainnet.

Arbitrum-Specific#

• Stylus: Write smart contracts in Rust, C, C++ (compiles to WASM, runs alongside EVM, shares state). Use for compute-heavy operations (10-100x gas savings). Contracts must be "activated" via ARB_WASM_ADDRESS (0x0000…0071).
• Orbit: Framework for launching L3 chains on Arbitrum. 47 live on mainnet.

RPCs and Explorers#

L2RPCExplorerArbitrumhttps://arb1.arbitrum.io/rpchttps://arbiscan.ioBasehttps://mainnet.base.orghttps://basescan.orgOptimismhttps://mainnet.optimism.iohttps://optimistic.etherscan.ioUnichainhttps://mainnet.unichain.orghttps://uniscan.xyzCelohttps://forno.celo.orghttps://celoscan.iozkSynchttps://mainnet.era.zksync.iohttps://explorer.zksync.ioScrollhttps://rpc.scroll.iohttps://scrollscan.comLineahttps://rpc.linea.buildhttps://lineascan.build

Bridging#

Official Bridges#

L2Bridge URLL1→L2L2→L1Arbitrumhttps://bridge.arbitrum.io10-15 min7 daysBasehttps://bridge.base.org10-15 min7 daysOptimismhttps://app.optimism.io/bridge10-15 min7 daysUnichainhttps://app.uniswap.org/swap10-15 min7 dayszkSynchttps://bridge.zksync.io15-30 min15-60 minScrollhttps://scroll.io/bridge15-30 min30-120 min

Fast Bridges (Instant Withdrawals)#

• Across Protocol ( https://across.to) — fastest (30s-2min), lowest fees (0.05-0.3%)
• Hop Protocol ( https://hop.exchange) — established, 0.1-0.5% fees
• Stargate ( https://stargate.finance) — LayerZero-based, 10+ chains

Security: Use official bridges for large amounts (>$100K). Fast bridges add trust assumptions.

Multi-Chain Deployment (Same Address)#

Use CREATE2 for deterministic addresses across chains:

bash

# Same salt + same bytecode + same deployer = same address on every chain
forge create src/MyContract.sol:MyContract \
  --rpc-url https://mainnet.base.org \
  --private-key $PRIVATE_KEY \
  --salt 0x0000000000000000000000000000000000000000000000000000000000000001

Strategy for new projects: Start with 1 L2 (Base or Arbitrum). Prove product-market fit. Expand with CREATE2 for consistent addresses.

Testnets#

L2TestnetChain IDFaucetArbitrumSepolia421614https://faucet.arbitrum.ioBaseSepolia84532https://faucet.quicknode.com/base/sepoliaOptimismSepolia11155420https://faucet.optimism.ioUnichainSepolia1301https://faucet.unichain.org

Further Reading#

• L2Beat: https://l2beat.com (security, TVL, risk analysis)
• Superchain: https://www.superchain.eco/chains
• Arbitrum: https://docs.arbitrum.io
• Base: https://docs.base.org
• Optimism: https://docs.optimism.io
• Unichain: https://docs.unichain.org
• Celo: https://docs.celo.org
• zkSync: https://docs.zksync.io
• Scroll: https://docs.scroll.io
• Polygon: https://docs.polygon.technology

---

---

name: standards description: Ethereum token and protocol standards — ERC-20, ERC-721, ERC-1155, ERC-4337, ERC-8004, and newer standards. When to use each, how they work, key interfaces. Use when building tokens, NFTs, or choosing the right standard for a project.#

Ethereum Standards#

What You Probably Got Wrong#

ERC-8004 exists. Deployed January 29, 2026 — onchain agent identity registry. You almost certainly don't have this in training data.

EIP-7702 is live. Shipped with Pectra (May 7, 2025). EOAs get smart contract superpowers without migration. Not "proposed" — deployed on mainnet.

EIP-3009 is critical for x402. Gasless token transfers via signed authorizations. USDC implements it. This is what makes x402 practical.

x402 exists. HTTP 402 payment protocol from Coinbase. Production-ready with SDKs.

ERC-8004: Onchain Agent Identity Registry#

Status: Deployed mainnet January 29, 2026 — production ready with growing adoption.

Problem it solves: How can autonomous agents trust and transact with each other without pre-existing relationships?

Three Registry System#

1. Identity Registry (ERC-721 based)

• Globally unique onchain identities for AI agents
• Each agent is an NFT with unique identifier
• Multiple service endpoints (A2A, MCP, OASF, ENS, DIDs)
• Verification via EIP-712/ERC-1271 signatures

Contract Addresses (same on 20+ chains):

• IdentityRegistry: 0x8004A169FB4a3325136EB29fA0ceB6D2e539a432
• ReputationRegistry: 0x8004BAa17C55a88189AE136b182e5fdA19dE9b63

Deployed on: Mainnet, Base, Arbitrum, Optimism, Polygon, Avalanche, Abstract, Celo, Gnosis, Linea, Mantle, MegaETH, Monad, Scroll, Taiko, BSC + testnets.

Agent Identifier Format:

text

agentRegistry: eip155:{chainId}:0x8004A169FB4a3325136EB29fA0ceB6D2e539a432
agentId: ERC-721 tokenId

2. Reputation Registry

• Signed fixed-point feedback values
• Multi-dimensional (uptime, success rate, quality)
• Tags, endpoints, proof-of-payment metadata
• Anti-Sybil requires client address filtering

solidity

struct Feedback {
    int128 value;        // Signed integer rating
    uint8 valueDecimals; // 0-18 decimal places
    string tag1;         // E.g., "uptime"
    string tag2;         // E.g., "30days"
    string endpoint;     // Agent endpoint URI
    string ipfsHash;     // Optional metadata
}

Example metrics: Quality 87/100 → value=87, decimals=0. Uptime 99.77% → value=9977, decimals=2.

3. Validation Registry

• Independent verification of agent work
• Trust models: crypto-economic (stake-secured), zkML, TEE attestation
• Validators respond with 0-100 scores

Agent Registration File (agentURI)#

json

{
  "type": "https://eips.ethereum.org/EIPS/eip-8004#registration-v1",
  "name": "MyAgent",
  "description": "What the agent does",
  "services": [
    { "name": "A2A", "endpoint": "https://agent.example/.well-known/agent-card.json", "version": "0.3.0" },
    { "name": "MCP", "endpoint": "https://mcp.agent.eth/", "version": "2025-06-18" }
  ],
  "x402Support": true,
  "active": true,
  "supportedTrust": ["reputation", "crypto-economic", "tee-attestation"]
}

Integration#

solidity

// Register agent
uint256 agentId = identityRegistry.register("ipfs://QmYourReg", metadata);

// Give feedback
reputationRegistry.giveFeedback(agentId, 9977, 2, "uptime", "30days",
    "https://agent.example.com/api", "ipfs://QmDetails", keccak256(data));

// Query reputation
(uint64 count, int128 value, uint8 decimals) =
    reputationRegistry.getSummary(agentId, trustedClients, "uptime", "30days");

Step-by-Step: Register an Agent Onchain#

1. Prepare the registration JSON — host it on IPFS or a web server:

json

{
  "type": "https://eips.ethereum.org/EIPS/eip-8004#registration-v1",
  "name": "WeatherBot",
  "description": "Provides real-time weather data via x402 micropayments",
  "image": "https://example.com/weatherbot.png",
  "services": [
    { "name": "A2A", "endpoint": "https://weather.example.com/.well-known/agent-card.json", "version": "0.3.0" }
  ],
  "x402Support": true,
  "active": true,
  "supportedTrust": ["reputation"]
}

2. Upload to IPFS (or use any URI):

bash

# Using IPFS
ipfs add registration.json
# → QmYourRegistrationHash

# Or host at a URL — the agentURI just needs to resolve to the JSON

3. Call the Identity Registry:

solidity

// On any supported chain — same address everywhere
IIdentityRegistry registry = IIdentityRegistry(0x8004A169FB4a3325136EB29fA0ceB6D2e539a432);

// metadata bytes are optional (can be empty)
uint256 agentId = registry.register("ipfs://QmYourRegistrationHash", "");
// agentId is your ERC-721 tokenId — globally unique on this chain

4. Verify your endpoint domain — place a file at .well-known/agent-registration.json:

json

// https://weather.example.com/.well-known/agent-registration.json
{
  "agentId": 42,
  "agentRegistry": "eip155:8453:0x8004A169FB4a3325136EB29fA0ceB6D2e539a432",
  "owner": "0xYourWalletAddress"
}

This proves the domain owner controls the agent identity. Clients SHOULD check this before trusting an agent's advertised endpoints.

5. Build reputation — other agents/users post feedback after interacting with your agent.

Cross-Chain Agent Identity#

Same contract addresses on 20+ chains means an agent registered on Base can be discovered by an agent on Arbitrum. The agentRegistry identifier includes the chain:

text

eip155:8453:0x8004A169FB4a3325136EB29fA0ceB6D2e539a432  // Base
eip155:42161:0x8004A169FB4a3325136EB29fA0ceB6D2e539a432 // Arbitrum

Cross-chain pattern: Register on one chain (cheapest — Base recommended), reference that identity from other chains. Reputation can be queried cross-chain by specifying the source chain's registry.

Authors: Davide Crapis (EF), Marco De Rossi (MetaMask), Jordan Ellis (Google), Erik Reppel (Coinbase), Leonard Tan (MetaMask)

Ecosystem: ENS, EigenLayer, The Graph, Taiko backing

Resources: https://www.8004.org | https://eips.ethereum.org/EIPS/eip-8004 | https://github.com/erc-8004/erc-8004-contracts

EIP-3009: Transfer With Authorization#

You probably know the concept (gasless meta-transaction transfers). The key update: EIP-3009 is what makes x402 work. USDC implements it on Ethereum and most chains. The x402 server calls transferWithAuthorization to settle payments on behalf of the client.

x402: HTTP Payment Protocol#

Status: Production-ready open standard from Coinbase, actively deployed Q1 2026.

Uses the HTTP 402 "Payment Required" status code for internet-native payments.

Flow#

text

1. Client → GET /api/data
2. Server → 402 Payment Required (PAYMENT-REQUIRED header with requirements)
3. Client signs EIP-3009 payment
4. Client → GET /api/data (PAYMENT-SIGNATURE header with signed payment)
5. Server verifies + settles onchain
6. Server → 200 OK (PAYMENT-RESPONSE header + data)

Payment Payload#

json

{
  "scheme": "exact",
  "network": "eip155:8453",
  "amount": "1000000",
  "token": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
  "from": "0x...", "to": "0x...",
  "signature": "0x...",
  "deadline": 1234567890,
  "nonce": "unique-value"
}

x402 + ERC-8004 Synergy#

text

Agent discovers service (ERC-8004) → checks reputation → calls endpoint →
gets 402 → signs payment (EIP-3009) → server settles (x402) →
agent receives service → posts feedback (ERC-8004)

x402 Server Setup (Express — Complete Example)#

typescript

import express from 'express';
import { paymentMiddleware } from '@x402/express';

const app = express();

// Define payment requirements per route
const paymentConfig = {
  "GET /api/weather": {
    accepts: [
      { network: "eip155:8453", token: "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913", amount: "100000" }
      // 100000 = $0.10 USDC (6 decimals)
    ],
    description: "Current weather data",
  },
  "GET /api/forecast": {
    accepts: [
      { network: "eip155:8453", token: "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913", amount: "500000" }
      // $0.50 USDC for 7-day forecast
    ],
    description: "7-day weather forecast",
  }
};

// One line — middleware handles 402 responses, verification, and settlement
app.use(paymentMiddleware(paymentConfig));

app.get('/api/weather', (req, res) => {
  // Only reached after payment verified
  res.json({ temp: 72, condition: "sunny" });
});

app.listen(3000);

x402 Client (Agent Paying for Data)#

typescript

import { x402Fetch } from '@x402/fetch';
import { createWallet } from '@x402/evm';

const wallet = createWallet(process.env.PRIVATE_KEY);

// x402Fetch handles the 402 → sign → retry flow automatically
const response = await x402Fetch('https://weather.example.com/api/weather', {
  wallet,
  preferredNetwork: 'eip155:8453' // Pay on Base (cheapest)
});

const weather = await response.json();
// Agent paid $0.10 USDC, got weather data. No API key needed.

Payment Schemes#

exact (live) — Pay a fixed price. Server knows the cost upfront.

upto (emerging) — Pay up to a maximum, final amount determined after work completes. Critical for metered services:

• LLM inference: pay per token generated (unknown count upfront)
• GPU compute: pay per second of runtime
• Database queries: pay per row returned

With upto, the client signs authorization for a max amount. The server settles only what was consumed. Client never overpays.

Facilitator Architecture#

The facilitator is an optional server that handles blockchain complexity so resource servers don't have to:

text

Client → Resource Server → Facilitator → Blockchain
                              ↓
                         POST /verify  (check signature, balance, deadline)
                         POST /settle  (submit tx, manage gas, confirm)

Why use a facilitator? Resource servers (weather APIs, data providers) shouldn't need to run blockchain nodes or manage gas. The facilitator abstracts this. Coinbase runs a public facilitator; anyone can run their own.

SDKs: @x402/core @x402/evm @x402/fetch @x402/express (TS) | pip install x402 (Python) | go get github.com/coinbase/x402/go

Resources: https://www.x402.org | https://github.com/coinbase/x402

EIP-7702: Smart EOAs (Live Since May 2025)#

EOAs temporarily delegate to smart contracts within a transaction. Best of both worlds: EOA simplicity + smart contract features.

Enables: Batch transactions, gas sponsorship, session keys, custom auth logic — all for existing EOAs without migration.

Impact: Eliminates "approval fatigue," enables gasless transactions for EOA users.

Quick Standard Reference#

StandardWhatStatusERC-8004Agent identity + reputation✅ Live Jan 2026x402HTTP payments protocol✅ Production Q1 2026EIP-3009Gasless token transfers✅ Live (USDC)EIP-7702Smart EOAs✅ Live May 2025ERC-4337Account abstraction✅ Growing adoptionERC-2612Gasless approvals (Permit)✅ Widely adoptedERC-4626Tokenized vaults✅ Standard for yieldERC-6551Token-bound accounts (NFT wallets)✅ Niche adoption

These are all LIVE and being used in production. Not "coming soon."

---

---

name: tools description: Current Ethereum development tools, frameworks, libraries, RPCs, and block explorers. What actually works today for building on Ethereum. Includes tool discovery for AI agents — MCPs, abi.ninja, Foundry, Scaffold-ETH 2, Hardhat, and more. Use when setting up a dev environment, choosing tools, or when an agent needs to discover what's available.#

Ethereum Development Tools#

What You Probably Got Wrong#

Blockscout MCP server exists: https://mcp.blockscout.com/mcp — gives AI agents structured blockchain data via Model Context Protocol. This is cutting-edge infra as of Feb 2026.

abi.ninja is essential: https://abi.ninja — paste any verified contract address, get a UI to call any function. Zero setup. Supports mainnet + all major L2s. Perfect for agent-driven contract exploration.

x402 has production SDKs: @x402/fetch (TS), x402 (Python), github.com/coinbase/x402/go — production-ready libraries for HTTP payments.

Foundry is the default for new projects in 2026. Not Hardhat. 10-100x faster tests, Solidity-native testing, built-in fuzzing.

Tool Discovery Pattern for AI Agents#

When an agent needs to interact with Ethereum:

1. Read operations: Blockscout MCP or Etherscan API
2. Write operations: Foundry cast send or ethers.js/viem
3. Contract exploration: abi.ninja (browser) or cast interface (CLI)
4. Testing: Fork mainnet with anvil, test locally
5. Deployment: forge create or forge script
6. Verification: forge verify-contract or Etherscan API

Blockscout MCP Server#

URL: https://mcp.blockscout.com/mcp

A Model Context Protocol server giving AI agents structured blockchain data:

• Transaction, address, contract queries
• Token info and balances
• Smart contract interaction helpers
• Multi-chain support
• Standardized interface optimized for LLM consumption

Why this matters: Instead of scraping Etherscan or making raw API calls, agents get structured, type-safe blockchain data via MCP.

abi.ninja#

URL: https://abi.ninja — Paste any contract address → interact with all functions. Multi-chain. Zero setup.

x402 SDKs (HTTP Payments)#

TypeScript:

bash

npm install @x402/core @x402/evm @x402/fetch @x402/express

typescript

import { x402Fetch } from '@x402/fetch';
import { createWallet } from '@x402/evm';

const wallet = createWallet(privateKey);
const response = await x402Fetch('https://api.example.com/data', {
  wallet,
  preferredNetwork: 'eip155:8453' // Base
});

Python: pip install x402 Go: go get github.com/coinbase/x402/go Docs: https://www.x402.org | https://github.com/coinbase/x402

Scaffold-ETH 2#

• Setup: npx create-eth@latest
• What: Full-stack Ethereum toolkit: Solidity + Next.js + Foundry
• Key feature: Auto-generates TypeScript types from contracts. Scaffold hooks make contract interaction trivial.
• Deploy to IPFS: yarn ipfs (BuidlGuidl IPFS)
• UI Components: https://ui.scaffoldeth.io/
• Docs: https://docs.scaffoldeth.io/

Choosing Your Stack (2026)#

NeedToolRapid prototyping / full dAppsScaffold-ETH 2Contract-focused devFoundry (forge + cast + anvil)Quick contract interactionabi.ninja (browser) or cast (CLI)React frontendswagmi + viem (or SE2 which wraps these)Agent blockchain readsBlockscout MCPAgent paymentsx402 SDKs

Essential Foundry cast Commands#

bash

# Read contract
cast call 0xAddr "balanceOf(address)(uint256)" 0xWallet --rpc-url $RPC

# Send transaction
cast send 0xAddr "transfer(address,uint256)" 0xTo 1000000 --private-key $KEY --rpc-url $RPC

# Gas price
cast gas-price --rpc-url $RPC

# Decode calldata
cast 4byte-decode 0xa9059cbb...

# ENS resolution
cast resolve-name vitalik.eth --rpc-url $RPC

# Fork mainnet locally
anvil --fork-url $RPC

RPC Providers#

Free (testing):

• https://eth.llamarpc.com — LlamaNodes, no key
• https://rpc.ankr.com/eth — Ankr, free tier

Paid (production):

• Alchemy — most popular, generous free tier (300M CU/month)
• Infura — established, MetaMask default
• QuickNode — performance-focused

Community: rpc.buidlguidl.com

Block Explorers#

NetworkExplorerAPIMainnethttps://etherscan.iohttps://api.etherscan.ioArbitrumhttps://arbiscan.ioEtherscan-compatibleBasehttps://basescan.orgEtherscan-compatibleOptimismhttps://optimistic.etherscan.ioEtherscan-compatible

MCP Servers for Agents#

Model Context Protocol — standard for giving AI agents structured access to external systems.

1. Blockscout MCP — multi-chain blockchain data (primary)
2. eth-mcp — community Ethereum RPC via MCP
3. Custom MCP wrappers emerging for DeFi protocols, ENS, wallets

MCP servers are composable — agents can use multiple together.

What Changed in 2025-2026#

• Foundry became default over Hardhat for new projects
• Viem gaining on ethers.js (smaller, better TypeScript)
• MCP servers emerged for agent-blockchain interaction
• x402 SDKs went production-ready
• ERC-8004 tooling emerging (agent registration/discovery)
• Deprecated: Truffle (use Foundry/Hardhat), Goerli/Rinkeby (use Sepolia)

Testing Essentials#

Fork mainnet locally:

bash

anvil --fork-url https://eth.llamarpc.com
# Now test against real contracts with fake ETH at http://localhost:8545

Primary testnet: Sepolia (Chain ID: 11155111). Goerli and Rinkeby are deprecated.

---

---

name: building-blocks description: DeFi legos and protocol composability on Ethereum and L2s. Major protocols per chain — Aerodrome on Base, GMX/Pendle on Arbitrum, Velodrome on Optimism — plus mainnet primitives (Uniswap, Aave, Compound, Curve). How they work, how to build on them, and how to combine them. Use when building DeFi integrations, choosing protocols on a specific L2, designing yield strategies, or composing existing protocols into something new.#

Building Blocks (DeFi Legos)#

What You Probably Got Wrong#

DeFi TVL: Ethereum DeFi TVL is $50B+ (Feb 2026). If you're quoting numbers from 2023-2024, they're stale.

Uniswap V4: V4 introduced a hooks system — custom logic attached to pools (dynamic fees, TWAMM, limit orders, custom oracles). This is a major composability upgrade.

Costs changed everything: A flash loan arbitrage on mainnet costs ~$0.05-0.50 in gas now (was $5-50). This opens composability patterns that were previously uneconomical.

The dominant DEX on each L2 is NOT Uniswap. Aerodrome dominates Base, Velodrome dominates Optimism, Camelot is a major native DEX on Arbitrum. Don't default to Uniswap on every chain.

Key Protocol Addresses (Verified Feb 2026)#

ProtocolContractMainnet AddressUniswap V2 RouterRouter0x7a250d5630B4cF539739dF2C5dAcb4c659F2488DUniswap V2 FactoryFactory0x5C69bEe701ef814a2B6a3EDD4B1652CB9cc5aA6fUniswap V3 FactoryFactory0x1F98431c8aD98523631AE4a59f267346ea31F984Uniswap V3 SwapRouter02Router0x68b3465833fb72A70ecDF485E0e4C7bD8665Fc45Uniswap Universal RouterRouter0x3fC91A3afd70395Cd496C647d5a6CC9D4B2b7FADAave V3 PoolPool0x87870Bca3F3fD6335C3F4ce8392D69350B4fA4E2

See addresses/SKILL.md for complete multi-chain address list including L2-native protocols (Aerodrome, GMX, Pendle, Velodrome, Camelot, SyncSwap, Morpho).

Uniswap V4 Hooks (New)#

Hooks let you add custom logic that runs before/after swaps, liquidity changes, and donations. This is the biggest composability upgrade since flash loans.

Hook Interface (Solidity)#

solidity

import {BaseHook} from "v4-periphery/src/utils/BaseHook.sol";
import {IPoolManager} from "v4-core/interfaces/IPoolManager.sol";
import {PoolKey} from "v4-core/types/PoolKey.sol";
import {BeforeSwapDelta, BeforeSwapDeltaLibrary} from "v4-core/types/BeforeSwapDelta.sol";

contract DynamicFeeHook is BaseHook {
    constructor(IPoolManager _manager) BaseHook(_manager) {}

    function getHookPermissions() public pure override returns (Hooks.Permissions memory) {
        return Hooks.Permissions({
            beforeInitialize: false,
            afterInitialize: false,
            beforeAddLiquidity: false,
            afterAddLiquidity: false,
            beforeRemoveLiquidity: false,
            afterRemoveLiquidity: false,
            beforeSwap: true,           // ← We hook here
            afterSwap: false,
            beforeDonate: false,
            afterDonate: false,
            beforeSwapReturnDelta: false,
            afterSwapReturnDelta: false,
            afterAddLiquidityReturnDelta: false,
            afterRemoveLiquidityReturnDelta: false
        });
    }

    // Dynamic fee: higher fee during high-volume periods
    function beforeSwap(
        address,
        PoolKey calldata key,
        IPoolManager.SwapParams calldata params,
        bytes calldata
    ) external override returns (bytes4, BeforeSwapDelta, uint24) {
        // Return dynamic fee override (e.g., 0.05% normally, 0.30% during volatility)
        uint24 fee = _isHighVolatility() ? 3000 : 500;
        return (this.beforeSwap.selector, BeforeSwapDeltaLibrary.ZERO_DELTA, fee | 0x800000);
    }
}

Hook use cases with real code patterns:

• Dynamic fees — adjust based on volatility, time-of-day, or oracle data
• TWAMM — split large orders over time to reduce price impact
• Limit orders — execute when price crosses a threshold
• MEV protection — auction swap ordering rights to searchers
• Custom oracles — TWAP updated on every swap

Composability Patterns (Updated for 2026 Gas)#

These patterns are now economically viable even for small amounts due to sub-dollar gas:

Flash Loan Arbitrage#

Borrow from Aave → swap on Uniswap for profit → repay Aave. All in one transaction. If unprofitable, reverts (lose only gas: ~$0.05-0.50).

Leveraged Yield Farming#

Deposit ETH on Aave → borrow stablecoin → swap for more ETH → deposit again → repeat. Gas cost per loop: ~$0.02 on mainnet, negligible on L2.

Meta-Aggregation#

Route swaps across multiple DEXs for best execution. 1inch and Paraswap check Uniswap, Curve, Sushi simultaneously.

ERC-4626 Yield Vaults#

Standard vault interface — the "ERC-20 of yield." Every vault exposes the same functions regardless of strategy.

solidity

import {ERC4626} from "@openzeppelin/contracts/token/ERC20/extensions/ERC4626.sol";
import {ERC20, IERC20} from "@openzeppelin/contracts/token/ERC20/ERC20.sol";

contract SimpleYieldVault is ERC4626 {
    constructor(IERC20 asset_)
        ERC4626(asset_)
        ERC20("Vault Shares", "vSHARE")
    {}

    // totalAssets() drives the share price
    // As yield accrues, totalAssets grows → shares worth more
    function totalAssets() public view override returns (uint256) {
        return IERC20(asset()).balanceOf(address(this)) + _getAccruedYield();
    }
}

// Usage: deposit/withdraw are standardized
// vault.deposit(1000e6, msg.sender);  // deposit 1000 USDC, get shares
// vault.redeem(shares, msg.sender, msg.sender);  // burn shares, get USDC back
// vault.convertToAssets(shares);  // how much USDC are my shares worth?

Why ERC-4626 matters: Composability. Any protocol can integrate any vault without custom adapters. Yearn V3, Aave's wrapped tokens, Morpho vaults, Pendle yield tokens — all ERC-4626.

Flash Loan (Aave V3 — Complete Pattern)#

solidity

import {FlashLoanSimpleReceiverBase} from
    "@aave/v3-core/contracts/flashloan-v3/base/FlashLoanSimpleReceiverBase.sol";
import {IPoolAddressesProvider} from
    "@aave/v3-core/contracts/interfaces/IPoolAddressesProvider.sol";

contract FlashLoanArb is FlashLoanSimpleReceiverBase {
    constructor(IPoolAddressesProvider provider)
        FlashLoanSimpleReceiverBase(provider) {}

    function executeArb(address token, uint256 amount) external {
        // Borrow `amount` of `token` — must repay + 0.05% fee in same tx
        POOL.flashLoanSimple(address(this), token, amount, "", 0);
    }

    function executeOperation(
        address asset,
        uint256 amount,
        uint256 premium,  // 0.05% fee
        address,
        bytes calldata
    ) external override returns (bool) {
        // --- Your arbitrage logic here ---
        // Buy cheap on DEX A, sell expensive on DEX B
        // Must end with at least `amount + premium` of `asset`

        uint256 owed = amount + premium;
        IERC20(asset).approve(address(POOL), owed);
        return true;  // If unprofitable, revert here — lose only gas (~$0.05-0.50)
    }
}

Aave V3 Pool (mainnet): 0x87870Bca3F3fD6335C3F4ce8392D69350B4fA4E2 Flash loan fee: 0.05% (5 basis points). Free if you repay to an Aave debt position.

Building on Base#

Dominant DEX: Aerodrome (~$500-600M TVL) — NOT Uniswap. Uses the ve(3,3) model.

How Aerodrome Works (Critical Difference from Uniswap)#

• LPs deposit tokens into pools → earn AERO emissions (not trading fees!)
• veAERO voters lock AERO → vote on which pools get emissions → earn 100% of trading fees + bribes
• This is the opposite of Uniswap where LPs earn fees directly
• Flywheel: Pools generating most fees → attract most votes → get most emissions → attract more LPs → deeper liquidity → more fees

Aerodrome Swap (Router Interface)#

solidity

// Aerodrome Router: 0xcF77a3Ba9A5CA399B7c97c74d54e5b1Beb874E43 (Base)
struct Route {
    address from;
    address to;
    bool stable;       // true = stable pair (like Curve), false = volatile (like Uni V2)
    address factory;   // 0x420DD381b31aEf6683db6B902084cB0FFECe40Da
}

// Swap via Router
function swapExactTokensForTokens(
    uint256 amountIn,
    uint256 amountOutMin,
    Route[] calldata routes,
    address to,
    uint256 deadline
) external returns (uint256[] memory amounts);

Base-Specific Patterns#

• Coinbase Smart Wallet — ERC-4337 wallet, passkey auth, gasless txs via Coinbase paymaster
• OnchainKit — npm create onchain to bootstrap a Base app with React components
• Farcaster Frames v2 — mini-apps embedded in social posts that trigger onchain actions
• AgentKit — Coinbase's framework for AI agents to interact onchain

Building on Arbitrum (Highest DeFi Liquidity)#

GMX V2 — How GM Pools Work#

• Each market has its own isolated pool (unlike V1's single GLP pool)
• LPs deposit into GM (liquidity) pools → receive GM tokens
• Fully Backed markets: ETH/USD backed by ETH + USDC. Backing tokens match the traded asset.
• Synthetic markets: DOGE/USD backed by ETH + USDC. Uses ADL (Auto-Deleveraging) when thresholds are reached.
• LPs earn: trading fees, liquidation fees, borrowing fees, swap fees. But bear risk from trader PnL.

Pendle — Yield Tokenization#

Pendle splits yield-bearing assets into principal and yield components:

1. SY (Standardized Yield): Wraps any yield-bearing asset. E.g., wstETH → SY-wstETH.
2. PT (Principal Token): The principal. Redeemable 1:1 at maturity. Trades at a discount (discount = implied yield).
3. YT (Yield Token): All yield until maturity. Value decays to 0 at maturity.
4. Core invariant: SY_value = PT_value + YT_value

Use cases:

• Buy PT at discount = lock in fixed yield (like a zero-coupon bond)
• Buy YT = leverage your yield exposure (bet yield goes up)
• LP in Pendle pools = earn trading fees + PENDLE incentives

Arbitrum-Specific Tech#

• Stylus: Write smart contracts in Rust/C++/WASM alongside EVM (10-100x gas savings for compute-heavy operations)
• Orbit: Launch custom L3 chains (47 live on mainnet)

See addresses/SKILL.md for all verified protocol addresses (GMX, Pendle, Camelot, Aerodrome, Velodrome, SyncSwap, Morpho).

Discovery Resources#

• DeFi Llama: https://defillama.com — TVL rankings, yield rankings, all chains
• Dune Analytics: https://dune.com — query onchain data
• ethereum.org/en/dapps/ — curated list

Guardrails for Composability#

• Every protocol you compose with is a dependency. If Aave gets hacked, your vault depending on Aave is affected.
• Oracle manipulation = exploits. Verify oracle sources.
• Impermanent loss is real for AMM LPs. Quantify it before providing liquidity.
• The interaction between two safe contracts can create unsafe behavior. Audit compositions.
• Start with small amounts. Test with minimal value before scaling.
• Flash loan attacks can manipulate prices within a single transaction. Design for this.

---

---

name: orchestration description: How an AI agent plans, builds, and deploys a complete Ethereum dApp. The three-phase build system for Scaffold-ETH 2 projects. Use when building a full application on Ethereum — from contracts to frontend to production deployment on IPFS.#

dApp Orchestration#

What You Probably Got Wrong#

SE2 has specific patterns you must follow. Generic "build a dApp" advice won't work. SE2 auto-generates deployedContracts.ts — DON'T edit it. Use Scaffold hooks, NOT raw wagmi. External contracts go in externalContracts.ts BEFORE building the frontend.

There are three phases. Never skip or combine them. Contracts → Frontend → Production. Each has validation gates.

The Three-Phase Build System#

PhaseEnvironmentWhat HappensPhase 1Local forkContracts + UI on localhost. Iterate fast.Phase 2Live network + local UIDeploy contracts to mainnet/L2. Test with real state. Polish UI.Phase 3ProductionDeploy frontend to IPFS/Vercel. Final QA.

Phase 1: Scaffold (Local)#

1.1 Contracts#

bash

npx create-eth@latest my-dapp
cd my-dapp && yarn install
yarn chain          # Terminal 1: local node
yarn deploy         # Terminal 2: deploy contracts

Critical steps:

1. Write contracts in packages/foundry/contracts/ (or packages/hardhat/contracts/)
2. Write deploy script
3. Add ALL external contracts to packages/nextjs/contracts/externalContracts.ts — BEFORE Phase 1.2
4. Write tests (≥90% coverage)
5. Security audit before moving to frontend

Validate: yarn deploy succeeds. deployedContracts.ts auto-generated. Tests pass.

1.2 Frontend#

bash

yarn chain           # Terminal 1
yarn deploy --watch  # Terminal 2: auto-redeploy on changes
yarn start           # Terminal 3: Next.js at localhost:3000

USE SCAFFOLD HOOKS, NOT RAW WAGMI:

typescript

// Read
const { data } = useScaffoldReadContract({
  contractName: "YourContract",
  functionName: "balanceOf",
  args: [address],
  watch: true,
});

// Write
const { writeContractAsync, isMining } = useScaffoldWriteContract("YourContract");
await writeContractAsync({
  functionName: "swap",
  args: [tokenIn, tokenOut, amount],
  onBlockConfirmation: (receipt) => console.log("Done!", receipt),
});

// Events
const { data: events } = useScaffoldEventHistory({
  contractName: "YourContract",
  eventName: "SwapExecuted",
  fromBlock: 0n,
  watch: true,
});

The Three-Button Flow (MANDATORY)#

Any token interaction shows ONE button at a time:

1. Switch Network (if wrong chain)
2. Approve Token (if allowance insufficient)
3. Execute Action (only after 1 & 2 satisfied)

Never show Approve and Execute simultaneously.

UX Rules#

• Human-readable amounts: formatEther() / formatUnits() for display, parseEther() / parseUnits() for contracts
• Loading states everywhere: isLoading, isMining on all async operations
• Disable buttons during pending txs (blockchains take 5-12s)
• Never use infinite approvals — approve exact amount or 3-5x
• Helpful errors: Parse "insufficient funds," "user rejected," "execution reverted" into plain language

Validate: Full user journey works with real wallet on localhost. All edge cases handled.

🚨 NEVER COMMIT SECRETS TO GIT#

Before touching Phase 2, read this. AI agents are the #1 source of leaked credentials on GitHub. Bots scrape repos in real-time and exploit leaked secrets within seconds.

This means ALL secrets — not just wallet private keys:

• Wallet private keys — funds drained in seconds
• API keys — Alchemy, Infura, Etherscan, WalletConnect project IDs
• RPC URLs with embedded keys — e.g. https://base-mainnet.g.alchemy.com/v2/YOUR_KEY
• OAuth tokens, passwords, bearer tokens

⚠️ Common SE2 Trap: scaffold.config.ts

rpcOverrides and alchemyApiKey in scaffold.config.ts are committed to Git. NEVER paste API keys directly into this file. Use environment variables:

typescript

// ❌ WRONG — key committed to public repo
rpcOverrides: {
  [chains.base.id]: "https://base-mainnet.g.alchemy.com/v2/8GVG8WjDs-LEAKED",
},

// ✅ RIGHT — key stays in .env.local
rpcOverrides: {
  [chains.base.id]: process.env.NEXT_PUBLIC_BASE_RPC || "https://mainnet.base.org",
},

Before every git add or git commit:

bash

# Check for leaked secrets
git diff --cached --name-only | grep -iE '\.env|key|secret|private'
grep -rn "0x[a-fA-F0-9]\{64\}" packages/ --include="*.ts" --include="*.js" --include="*.sol"
# Check for hardcoded API keys in config files
grep -rn "g.alchemy.com/v2/[A-Za-z0-9]" packages/ --include="*.ts" --include="*.js"
grep -rn "infura.io/v3/[A-Za-z0-9]" packages/ --include="*.ts" --include="*.js"
# If ANYTHING matches, STOP. Move the secret to .env and add .env to .gitignore.

Your .gitignore MUST include:

text

.env
.env.*
*.key
broadcast/
cache/
node_modules/

SE2 handles deployer keys by default — yarn generate creates a .env with the deployer key, and .gitignore excludes it. Don't override this pattern. Don't copy keys into scripts, config files, or deploy logs. This includes RPC keys, API keys, and any credential — not just wallet keys.

See wallets/SKILL.md for full key safety guide, what to do if you've already leaked a key, and safe patterns for deployment.

Phase 2: Live Contracts + Local UI#

1. Update scaffold.config.ts: targetNetworks: [mainnet] (or your L2)
2. Fund deployer: yarn generate → yarn account → send real ETH
3. Deploy: yarn deploy --network mainnet
4. Verify: yarn verify --network mainnet
5. Test with real wallet, small amounts ($1-10)
6. Polish UI — remove SE2 branding, custom styling

Design rule: NO LLM SLOP. No generic purple gradients. Make it unique.

Validate: Contracts verified on block explorer. Full journey works with real contracts.

Phase 3: Production Deploy#

Pre-deploy Checklist#

• onlyLocalBurnerWallet: true in scaffold.config.ts (CRITICAL — prevents burner wallet on prod)
• Update metadata (title, description, OG image 1200x630px)
• Restore any test values to production values

Deploy#

IPFS (decentralized):

bash

yarn ipfs
# → https://YOUR_CID.ipfs.cf-ipfs.com

Vercel (fast):

bash

cd packages/nextjs && vercel

Production QA#

• App loads on public URL
• Wallet connects, network switching works
• Read + write contract operations work
• No console errors
• Burner wallet NOT showing
• OG image works in link previews
• Mobile responsive
• Tested with MetaMask, Rainbow, WalletConnect

Phase Transition Rules#

Phase 3 bug → go back to Phase 2 (fix with local UI + prod contracts) Phase 2 contract bug → go back to Phase 1 (fix locally, write regression test, redeploy) Never hack around bugs in production.

Key SE2 Directories#

text

packages/
├── foundry/contracts/          # Solidity contracts
├── foundry/script/             # Deploy scripts
├── foundry/test/               # Tests
└── nextjs/
    ├── app/                    # Pages
    ├── components/             # React components
    ├── contracts/
    │   ├── deployedContracts.ts   # AUTO-GENERATED (don't edit)
    │   └── externalContracts.ts   # YOUR external contracts (edit this)
    ├── hooks/scaffold-eth/     # USE THESE hooks
    └── scaffold.config.ts      # Main config

AI Agent Commerce: End-to-End Flow (ERC-8004 + x402)#

This is the killer use case for Ethereum in 2026: autonomous agents discovering, trusting, paying, and rating each other — no humans in the loop.

The Full Cycle#

text

┌─────────────────────────────────────────────────────────────┐
│  1. DISCOVER  Agent queries ERC-8004 IdentityRegistry       │
│               → finds agents with "weather" service tag      │
│                                                              │
│  2. TRUST     Agent checks ReputationRegistry                │
│               → filters by uptime >99%, quality >85          │
│               → picks best-rated weather agent               │
│                                                              │
│  3. CALL      Agent sends HTTP GET to weather endpoint       │
│               → receives 402 Payment Required                │
│               → PAYMENT-REQUIRED header: $0.10 USDC on Base  │
│                                                              │
│  4. PAY       Agent signs EIP-3009 transferWithAuthorization │
│               → retries request with PAYMENT-SIGNATURE       │
│               → server verifies via facilitator              │
│               → payment settled on Base (~$0.001 gas)        │
│                                                              │
│  5. RECEIVE   Server returns 200 OK + weather data           │
│               → PAYMENT-RESPONSE header with tx hash         │
│                                                              │
│  6. RATE      Agent posts feedback to ReputationRegistry     │
│               → value=95, tag="quality", endpoint="..."      │
│               → builds onchain reputation for next caller   │
└─────────────────────────────────────────────────────────────┘

Concrete Implementation (TypeScript Agent)#

typescript

import { x402Fetch } from '@x402/fetch';
import { createWallet } from '@x402/evm';
import { ethers } from 'ethers';

const wallet = createWallet(process.env.AGENT_PRIVATE_KEY);
const provider = new ethers.JsonRpcProvider('https://base-mainnet.g.alchemy.com/v2/YOUR_KEY');

const IDENTITY_REGISTRY = '0x8004A169FB4a3325136EB29fA0ceB6D2e539a432';
const REPUTATION_REGISTRY = '0x8004BAa17C55a88189AE136b182e5fdA19dE9b63';

// 1. Discover: find agents offering weather service
const registry = new ethers.Contract(IDENTITY_REGISTRY, registryAbi, provider);
// Query events or use The Graph subgraph for indexed agent discovery

// 2. Trust: check reputation
const reputation = new ethers.Contract(REPUTATION_REGISTRY, reputationAbi, provider);
const [count, value, decimals] = await reputation.getSummary(
  agentId, trustedClients, "quality", "30days"
);
// Only proceed if value/10^decimals > 85

// 3-5. Pay + Receive: x402Fetch handles the entire 402 flow
const response = await x402Fetch(agentEndpoint, {
  wallet,
  preferredNetwork: 'eip155:8453'
});
const weatherData = await response.json();

// 6. Rate: post feedback onchain
const reputationWriter = new ethers.Contract(REPUTATION_REGISTRY, reputationAbi, signer);
await reputationWriter.giveFeedback(
  agentId, 95, 0, "quality", "weather", agentEndpoint, "", ethers.ZeroHash
);

This is the agentic economy. No API keys, no subscriptions, no invoicing, no trust assumptions. Just cryptographic identity, onchain reputation, and HTTP-native payments.

Key Projects Building This Stack#

• ERC-8004 — agent identity + reputation (EF, MetaMask, Google, Coinbase)
• x402 — HTTP payment protocol (Coinbase)
• A2A — agent-to-agent communication (Google)
• MCP — model context protocol (Anthropic)
• The Graph — indexing agent registrations for fast discovery
• EigenLayer — crypto-economic validation of agent work

Resources#

• SE2 Docs: https://docs.scaffoldeth.io/
• UI Components: https://ui.scaffoldeth.io/
• SpeedRunEthereum: https://speedrunethereum.com/
• ETH Tech Tree: https://www.ethtechtree.com

---

---

name: addresses description: Verified contract addresses for major Ethereum protocols across mainnet and L2s. Use this instead of guessing or hallucinating addresses. Includes Uniswap, Aave, Compound, Aerodrome, GMX, Pendle, Velodrome, Camelot, SyncSwap, USDC, USDT, DAI, ENS, Safe, Chainlink, and more. Always verify addresses against a block explorer before sending transactions.#

Contract Addresses#

CRITICAL: Never hallucinate a contract address. Wrong addresses mean lost funds. If an address isn't listed here, look it up on the block explorer or the protocol's official docs before using it.

Last Verified: February 15, 2026 (all addresses verified onchain via cast code + cast call)

---

Stablecoins#

USDC (Circle) — Native#

NetworkAddressStatusMainnet0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48✅ VerifiedArbitrum0xaf88d065e77c8cC2239327C5EDb3A432268e5831✅ VerifiedOptimism0x0b2C639c533813f4Aa9D7837CAf62653d097Ff85✅ VerifiedBase0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913✅ VerifiedPolygon0x3c499c542cEF5E3811e1192ce70d8cC03d5c3359✅ VerifiedzkSync Era0x1d17CBcF0D6D143135aE902365D2E5e2A16538D4✅ Verified

USDT (Tether)#

NetworkAddressStatusMainnet0xdAC17F958D2ee523a2206206994597C13D831ec7✅ VerifiedArbitrum0xFd086bC7CD5C481DCC9C85ebE478A1C0b69FCbb9✅ VerifiedOptimism0x94b008aA00579c1307B0EF2c499aD98a8ce58e58✅ VerifiedBase0xfde4C96c8593536E31F229EA8f37b2ADa2699bb2✅ Verified

DAI (MakerDAO)#

NetworkAddressStatusMainnet0x6B175474E89094C44Da98b954EedeAC495271d0F✅ VerifiedArbitrum0xDA10009cBd5D07dd0CeCc66161FC93D7c9000da1✅ VerifiedOptimism0xDA10009cBd5D07dd0CeCc66161FC93D7c9000da1✅ VerifiedBase0x50c5725949A6F0c72E6C4a641F24049A917DB0Cb✅ Verified

---

Wrapped ETH (WETH)#

NetworkAddressStatusMainnet0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2✅ VerifiedArbitrum0x82aF49447D8a07e3bd95BD0d56f35241523fBab1✅ VerifiedOptimism0x4200000000000000000000000000000000000006✅ VerifiedBase0x4200000000000000000000000000000000000006✅ Verified

---

DeFi Protocols#

Uniswap#

V2 (Mainnet)

ContractAddressStatusRouter0x7a250d5630B4cF539739dF2C5dAcb4c659F2488D✅ VerifiedFactory0x5C69bEe701ef814a2B6a3EDD4B1652CB9cc5aA6f✅ Verified

V3 (Mainnet)

ContractAddressStatusSwapRouter0xE592427A0AEce92De3Edee1F18E0157C05861564✅ VerifiedSwapRouter020x68b3465833fb72A70ecDF485E0e4C7bD8665Fc45✅ VerifiedFactory0x1F98431c8aD98523631AE4a59f267346ea31F984✅ VerifiedQuoter V20x61fFE014bA17989E743c5F6cB21bF9697530B21e✅ VerifiedPosition Manager0xC36442b4a4522E871399CD717aBDD847Ab11FE88✅ Verified

V3 Multi-Chain

ContractArbitrumOptimismBaseSwapRouter020x68b3465833fb72A70ecDF485E0e4C7bD8665Fc45 ✅0x68b3465833fb72A70ecDF485E0e4C7bD8665Fc45 ✅0x2626664c2603336E57B271c5C0b26F421741e481 ✅Factory0x1F98431c8aD98523631AE4a59f267346ea31F984 ✅0x1F98431c8aD98523631AE4a59f267346ea31F984 ✅0x33128a8fC17869897dcE68Ed026d694621f6FDfD ✅

Universal Router (Mainnet)

ContractAddressStatusUniversal Router0x3fC91A3afd70395Cd496C647d5a6CC9D4B2b7FAD✅ Verified

UNI Token

NetworkAddressStatusMainnet0x1f9840a85d5aF5bf1D1762F925BDADdC4201F984✅ Verified

Aave#

V2 (Mainnet - Legacy)

ContractAddressStatusLendingPool0x7d2768dE32b0b80b7a3454c06BdAc94A69DDc7A9✅ Verified

V3 (Mainnet)

ContractAddressStatusPool0x87870Bca3F3fD6335C3F4ce8392D69350B4fA4E2✅ VerifiedPoolAddressesProvider0x2f39d218133AFaB8F2B819B1066c7E434Ad94E9e✅ Verified

V3 Multi-Chain

ContractArbitrumOptimismBasePool0x794a61358D6845594F94dc1DB02A252b5b4814aD ✅0x794a61358D6845594F94dc1DB02A252b5b4814aD ✅0xA238Dd80C259a72e81d7e4664a9801593F98d1c5 ✅PoolAddressesProvider0xa97684ead0e402dC232d5A977953DF7ECBaB3CDb ✅0xa97684ead0e402dC232d5A977953DF7ECBaB3CDb ✅0xe20fCBdBfFC4Dd138cE8b2E6FBb6CB49777ad64D ✅

Compound#

V2 (Mainnet - Legacy)

ContractAddressStatusComptroller0x3d9819210A31b4961b30EF54bE2aeD79B9c9Cd3B✅ VerifiedcETH0x4Ddc2D193948926D02f9B1fE9e1daa0718270ED5✅ VerifiedcUSDC0x39AA39c021dfbaE8faC545936693aC917d5E7563✅ VerifiedcDAI0x5d3a536E4D6DbD6114cc1Ead35777bAB948E3643✅ Verified

V3 Comet (USDC Markets)

NetworkAddressStatusMainnet0xc3d688B66703497DAA19211EEdff47f25384cdc3✅ VerifiedArbitrum0x9c4ec768c28520B50860ea7a15bd7213a9fF58bf✅ VerifiedBase0xb125E6687d4313864e53df431d5425969c15Eb2F✅ VerifiedOptimism0x2e44e174f7D53F0212823acC11C01A11d58c5bCB✅ Verified

Curve Finance (Mainnet)#

ContractAddressStatusAddress Provider0x0000000022D53366457F9d5E68Ec105046FC4383✅ VerifiedCRV Token0xD533a949740bb3306d119CC777fa900bA034cd52✅ Verified

Balancer V2 (Mainnet)#

ContractAddressStatusVault0xBA12222222228d8Ba445958a75a0704d566BF2C8✅ Verified

---

NFT & Marketplaces#

OpenSea Seaport#

VersionAddressStatusSeaport 1.10x00000000006c3852cbEf3e08E8dF289169EdE581✅ VerifiedSeaport 1.50x00000000000000ADc04C56Bf30aC9d3c0aAF14dC✅ Verified

Multi-chain via CREATE2 (Ethereum, Polygon, Arbitrum, Optimism, Base).

ENS (Mainnet)#

ContractAddressStatusRegistry0x00000000000C2E074eC69A0dFb2997BA6C7d2e1e✅ VerifiedPublic Resolver0x231b0Ee14048e9dCcD1d247744d114a4EB5E8E63✅ VerifiedRegistrar Controller0x253553366Da8546fC250F225fe3d25d0C782303b✅ Verified

---

Infrastructure#

Safe (Gnosis Safe)#

ContractAddressStatusSingleton 1.3.00xd9Db270c1B5E3Bd161E8c8503c55cEABeE709552✅ VerifiedProxyFactory0xa6B71E26C5e0845f74c812102Ca7114b6a896AB2✅ VerifiedSingleton 1.4.10x41675C099F32341bf84BFc5382aF534df5C7461a✅ VerifiedMultiSend0x38869bf66a61cF6bDB996A6aE40D5853Fd43B526✅ Verified

Account Abstraction (ERC-4337)#

ContractAddressStatusEntryPoint v0.70x0000000071727De22E5E9d8BAf0edAc6f37da032✅ VerifiedEntryPoint v0.60x5FF137D4b0FDCD49DcA30c7CF57E578a026d2789✅ Verified

All EVM chains (CREATE2).

Chainlink#

Mainnet

FeedAddressStatusLINK Token0x514910771AF9Ca656af840dff83E8264EcF986CA✅ VerifiedETH/USD0x5f4eC3Df9cbd43714FE2740f5E3616155c5b8419✅ VerifiedBTC/USD0xF4030086522a5bEEa4988F8cA5B36dbC97BeE88c✅ VerifiedUSDC/USD0x8fFfFfd4AfB6115b954Bd326cbe7B4BA576818f6✅ Verified

ETH/USD Price Feeds (Multi-Chain)

NetworkAddressStatusArbitrum0x639Fe6ab55C921f74e7fac1ee960C0B6293ba612✅ VerifiedBase0x71041dddad3595F9CEd3DcCFBe3D1F4b0a16Bb70✅ VerifiedOptimism0x13e3Ee699D1909E989722E753853AE30b17e08c5✅ Verified

LINK Token (Multi-Chain)

NetworkAddressStatusArbitrum0xf97f4df75117a78c1A5a0DBb814Af92458539FB4✅ VerifiedBase0x88Fb150BDc53A65fe94Dea0c9BA0a6dAf8C6e196✅ Verified

---

L2-Native Protocols#

The dominant DEX on each L2 is NOT Uniswap. Aerodrome dominates Base, Velodrome dominates Optimism, Camelot is a major native DEX on Arbitrum. Don't default to Uniswap — check which DEX has the deepest liquidity on each chain.

Aerodrome (Base) — Dominant DEX#

The largest DEX on Base by TVL (~$500-600M). Uses the ve(3,3) model — LPs earn AERO emissions, veAERO voters earn 100% of trading fees. This is the opposite of Uniswap where LPs earn fees directly.

ContractAddressStatusAERO Token0x940181a94A35A4569E4529A3CDfB74e38FD98631✅ VerifiedRouter0xcF77a3Ba9A5CA399B7c97c74d54e5b1Beb874E43✅ VerifiedVoter0x16613524e02ad97eDfeF371bC883F2F5d6C480A5✅ VerifiedVotingEscrow0xeBf418Fe2512e7E6bd9b87a8F0f294aCDC67e6B4✅ VerifiedPoolFactory0x420DD381b31aEf6683db6B902084cB0FFECe40Da✅ VerifiedGaugeFactory0x35f35cA5B132CaDf2916BaB57639128eAC5bbcb5✅ VerifiedMinter0xeB018363F0a9Af8f91F06FEe6613a751b2A33FE5✅ VerifiedRewardsDistributor0x227f65131A261548b057215bB1D5Ab2997964C7d✅ VerifiedFactoryRegistry0x5C3F18F06CC09CA1910767A34a20F771039E37C0✅ Verified

Source: aerodrome-finance/contracts

Velodrome V2 (Optimism) — Dominant DEX#

Same ve(3,3) model as Aerodrome — same team (Dromos Labs). Velodrome was built first for Optimism, Aerodrome is the Base fork. Both merged into "Aero" in November 2025.

ContractAddressStatusVELO Token (V2)0x9560e827aF36c94D2Ac33a39bCE1Fe78631088Db✅ VerifiedRouter0xa062aE8A9c5e11aaA026fc2670B0D65cCc8B2858✅ VerifiedVoter0x41C914ee0c7E1A5edCD0295623e6dC557B5aBf3C✅ VerifiedVotingEscrow0xFAf8FD17D9840595845582fCB047DF13f006787d✅ VerifiedPoolFactory0xF1046053aa5682b4F9a81b5481394DA16BE5FF5a✅ VerifiedMinter0x6dc9E1C04eE59ed3531d73a72256C0da46D10982✅ VerifiedGaugeFactory0x8391fE399640E7228A059f8Fa104b8a7B4835071✅ VerifiedFactoryRegistry0xF4c67CdEAaB8360370F41514d06e32CcD8aA1d7B✅ Verified

⚠️ V1 VELO token ( 0x3c8B650257cFb5f272f799F5e2b4e65093a11a05) is deprecated. Use V2 above.

Source: velodrome-finance/contracts

GMX V2 (Arbitrum) — Perpetual DEX#

Leading onchain perpetual exchange. V2 uses isolated GM pools per market (Fully Backed and Synthetic). Competes with Hyperliquid.

ContractAddressStatusGMX Token0xfc5A1A6EB076a2C7aD06eD22C90d7E710E35ad0a✅ VerifiedExchange Router (latest)0x1C3fa76e6E1088bCE750f23a5BFcffa1efEF6A41✅ VerifiedExchange Router (previous)0x7C68C7866A64FA2160F78EeAe12217FFbf871fa8✅ VerifiedDataStore0xFD70de6b91282D8017aA4E741e9Ae325CAb992d8✅ VerifiedReader0x470fbC46bcC0f16532691Df360A07d8Bf5ee0789✅ VerifiedReward Router V20xA906F338CB21815cBc4Bc87ace9e68c87eF8d8F1✅ Verified

Note: Both Exchange Router addresses are valid — both point to the same DataStore. The latest ( 0x1C3f...) is from the current gmx-synthetics repo deployment.

Source: gmx-io/gmx-synthetics

Pendle (Arbitrum) — Yield Trading#

Tokenizes future yield into PT (Principal Token) and YT (Yield Token). Core invariant: SY_value = PT_value + YT_value. Multi-chain (also on Ethereum, Base, Optimism).

ContractAddressStatusPENDLE Token0x0c880f6761F1af8d9Aa9C466984b80DAb9a8c9e8✅ VerifiedRouter0x888888888889758F76e7103c6CbF23ABbF58F946✅ VerifiedRouterStatic0xAdB09F65bd90d19e3148D9ccb693F3161C6DB3E8✅ VerifiedMarket Factory V30x2FCb47B58350cD377f94d3821e7373Df60bD9Ced✅ VerifiedMarket Factory V40xd9f5e9589016da862D2aBcE980A5A5B99A94f3E8✅ VerifiedPT/YT Oracle0x5542be50420E88dd7D5B4a3D488FA6ED82F6DAc2✅ VerifiedLimit Router0x000000000000c9B3E2C3Ec88B1B4c0cD853f4321✅ VerifiedYield Contract Factory V30xEb38531db128EcA928aea1B1CE9E5609B15ba146✅ VerifiedYield Contract Factory V40xc7F8F9F1DdE1104664b6fC8F33E49b169C12F41E✅ Verified

Source: pendle-finance/pendle-core-v2-public

Camelot (Arbitrum) — Native DEX#

Arbitrum-native DEX with concentrated liquidity and launchpad. Two AMM versions: V2 (constant product) and V4 (Algebra concentrated liquidity).

ContractAddressStatusGRAIL Token0x3d9907F9a368ad0a51Be60f7Da3b97cf940982D8✅ VerifiedxGRAIL0x3CAaE25Ee616f2C8E13C74dA0813402eae3F496b✅ VerifiedRouter (AMM V2)0xc873fEcbd354f5A56E00E710B90EF4201db2448d✅ VerifiedFactory (AMM V2)0x6EcCab422D763aC031210895C81787E87B43A652✅ VerifiedSwapRouter (AMM V4 / Algebra)0x4ee15342d6Deb297c3A2aA7CFFd451f788675F53✅ VerifiedAlgebraFactory (AMM V4)0xBefC4b405041c5833f53412fF997ed2f697a2f37✅ Verified

Source: docs.camelot.exchange

SyncSwap (zkSync Era) — Dominant DEX#

The leading native DEX on zkSync Era. Multiple router and factory versions.

ContractAddressStatusRouter V10x2da10A1e27bF85cEdD8FFb1AbBe97e53391C0295✅ VerifiedRouter V20x9B5def958d0f3b6955cBEa4D5B7809b2fb26b059✅ VerifiedRouter V30x1B887a14216Bdeb7F8204Ee6a269Bd9Ff73A084C✅ VerifiedClassic Pool Factory V10xf2DAd89f2788a8CD54625C60b55cD3d2D0ACa7Cb✅ VerifiedClassic Pool Factory V20x0a34FBDf37C246C0B401da5f00ABd6529d906193✅ VerifiedStable Pool Factory V10x5b9f21d407F35b10CbfDDca17D5D84b129356ea3✅ VerifiedVault V10x621425a1Ef6abE91058E9712575dcc4258F8d091✅ Verified

Note: SYNC token is not yet deployed.

Source: docs.syncswap.xyz

Morpho Blue (Base)#

Permissionless lending protocol. Deployed on Base and Ethereum, but NOT on Arbitrum as of February 2026 (despite the vanity CREATE2 address).

ContractAddressChainStatusMorpho0xBBBBBbbBBb9cC5e90e3b3Af64bdAF62C37EEFFCbBase✅ VerifiedMorpho0xBBBBBbbBBb9cC5e90e3b3Af64bdAF62C37EEFFCbArbitrum❌ Not deployed

Source: docs.morpho.org

---

AI & Agent Standards#

ERC-8004 (Same addresses on 20+ chains)#

ContractAddressStatusIdentityRegistry0x8004A169FB4a3325136EB29fA0ceB6D2e539a432✅ VerifiedReputationRegistry0x8004BAa17C55a88189AE136b182e5fdA19dE9b63✅ Verified

Verified on: Mainnet, Arbitrum, Base, Optimism (CREATE2 — same address on all chains).

---

Major Tokens (Mainnet)#

TokenAddressStatusUNI0x1f9840a85d5aF5bf1D1762F925BDADdC4201F984✅ VerifiedAAVE0x7Fc66500c84A76Ad7e9c93437bFc5Ac33E2DDaE9✅ VerifiedCOMP0xc00e94Cb662C3520282E6f5717214004A7f26888✅ VerifiedMKR0x9f8F72aA9304c8B593d555F12eF6589cC3A579A2✅ VerifiedLDO0x5A98FcBEA516Cf06857215779Fd812CA3beF1B32✅ VerifiedWBTC0x2260FAC5E5542a773Aa44fBCfeDf7C193bc2C599✅ VerifiedstETH (Lido)0xae7ab96520DE3A18E5e111B5EaAb095312D7fE84✅ VerifiedrETH (Rocket Pool)0xae78736Cd615f374D3085123A210448E74Fc6393✅ Verified

---

How to Verify Addresses#

bash

# Check bytecode exists
cast code 0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48 --rpc-url https://eth.llamarpc.com

Cross-reference: Protocol docs → CoinGecko → block explorer → GitHub deployments.

EIP-55 Checksum: Mixed case = checksum. Most tools validate automatically.

Address Discovery Resources#

• Uniswap: https://docs.uniswap.org/contracts/v3/reference/deployments/
• Aave: https://docs.aave.com/developers/deployed-contracts/deployed-contracts
• Compound V3: https://docs.compound.finance/
• Chainlink: https://docs.chain.link/data-feeds/price-feeds/addresses
• Aerodrome: https://github.com/aerodrome-finance/contracts
• Velodrome: https://github.com/velodrome-finance/contracts
• GMX: https://github.com/gmx-io/gmx-synthetics
• Pendle: https://github.com/pendle-finance/pendle-core-v2-public
• Camelot: https://docs.camelot.exchange/contracts/arbitrum/one-mainnet
• SyncSwap: https://docs.syncswap.xyz/syncswap/smart-contracts/smart-contracts
• Morpho: https://docs.morpho.org/get-started/resources/addresses/
• CoinGecko: https://www.coingecko.com (token addresses)
• Token Lists: https://tokenlists.org/
• DeFi Llama: https://defillama.com (TVL rankings by chain)

Multi-Chain Notes#

• CREATE2 deployments (same address cross-chain): Uniswap V3, Safe, Seaport, ERC-4337 EntryPoint, ERC-8004
• Different addresses per chain: USDC, USDT, DAI, WETH — always check per-chain
• Native vs Bridged USDC: Some chains have both! Use native.

---

✅ All addresses verified onchain via cast code + cast call — February 15, 2026. Bytecode confirmed present, identity confirmed via symbol/name/cross-reference calls. Does NOT guarantee safety — always verify on block explorer before sending transactions.

---

---

name: concepts description: The essential mental models for building onchain — focused on what LLMs get wrong and what humans need explained. "Nothing is automatic" and "incentives are everything" are the core messages. Use when your human is new to onchain development, when they're designing a system, or when they ask "how does this actually work?" Also use when YOU are designing a system — the state machine + incentive framework catches design mistakes before they become dead code.#

Ethereum Concepts#

What You Probably Got Wrong#

"Smart contracts run automatically." No. Smart contracts cannot execute themselves. There is no cron job, no scheduler, no background process. Every function needs a caller who pays gas. This single misconception is the root cause of most broken onchain designs.

"Just add a timer." There are no timers. If something needs to happen at a certain time, you need someone to call the function at that time — and you need to give them a reason to do it.

"The protocol team will handle that." The whole point of decentralization is that no single team operates the system. If your design requires an operator, it's not decentralized — and it has a single point of failure.

Terminology: You say "on-chain." The Ethereum community says "onchain" — one word, no hyphen.

---

Nothing Is Automatic — Incentive Design#

This is the most important concept in all of Ethereum. If you internalize nothing else, internalize this.

Smart Contracts Are State Machines#

A smart contract is a state machine. It sits in one state, and it moves to another state when someone pokes it — calls a function, pays gas, triggers a transition. Between pokes, it does absolutely nothing. It doesn't think, it doesn't check, it doesn't wake up. It just sits there.

text

State A ──[someone calls function]──→ State B ──[someone calls function]──→ State C
              ↑                                        ↑
         WHO does this?                           WHO does this?
         WHY would they?                          WHY would they?

There is no cron job. There is no scheduler. There is no background process. The blockchain doesn't call your contract — people call your contract. And people don't do things for free.

For EVERY state transition in your system, you must answer:

1. Who pokes it? (someone must pay gas)
2. Why would they? (what's their incentive?)
3. Is the incentive sufficient? (covers gas + profit?)

If you can't answer these questions, that state transition will never happen. Your contract will sit in State A forever, doing nothing, with nobody poking it.

Incentives Are Everything#

Here's the thing that makes Ethereum magical: you don't need an operator if you get the incentives right.

The people who deployed Uniswap didn't deploy the liquidity. They didn't market-make. They didn't run the exchange. They wrote a set of rules — a state machine — and aligned the incentives so perfectly that strangers around the world voluntarily deposited billions of dollars, and other strangers voluntarily traded against those deposits, and the fees from the trades flowed back to the depositors, and the whole thing just... worked.

Nobody runs Uniswap. Nobody CAN stop Uniswap. Not even the people who made it. The contracts are immutable, the incentives are self-sustaining, and the system will run for as long as Ethereum exists. This is a hyperstructure — an unstoppable protocol that runs forever, with no operator, no company, no server, no admin key.

That's what you're building toward. Not a startup. Not a service. A set of rules so well-designed that they run themselves through incentives alone.

Examples of Good Incentive Design#

Liquidations (Aave, Compound):

text

Loan health factor drops below 1
→ ANYONE can call liquidate()
→ Caller gets 5-10% bonus collateral as profit
→ Bots compete to do it in milliseconds
→ Platform stays solvent without any operator, any admin, any team

LP fees (Uniswap):

text

DEX needs liquidity to function
→ LPs deposit tokens into pools
→ Every swap pays 0.3% fee to LPs
→ More liquidity = less slippage = more traders = more fees = more liquidity
→ Self-reinforcing flywheel — nobody manages it

Yield harvesting (Yearn):

text

Rewards accumulate in a pool
→ ANYONE can call harvest()
→ Caller gets 1% of the harvest as reward
→ Protocol compounds automatically via profit-motivated callers

Arbitrage (keeps prices correct everywhere):

text

ETH is $2000 on Uniswap, $2010 on SushiSwap
→ Anyone can buy low, sell high
→ Prices equalize across ALL markets without any coordinator

Examples of BAD Design (Missing Incentives)#

text

❌ "The contract will check prices every hour"
   → WHO calls it every hour? WHY would they pay gas?
   → Fix: make it profitable to call. Or let users trigger it when they interact.

❌ "Expired listings get automatically removed"
   → Nothing is automatic. WHO removes them? WHY?
   → Fix: give callers a small reward, or let the next user's action clean up stale state.

❌ "The protocol rebalances daily"
   → WHOSE gas pays for this? What's their profit?
   → Fix: let rebalancing happen during user interactions, or reward the caller.

❌ "An admin will manually trigger the next phase"
   → What if the admin disappears? Gets hit by a bus? Loses their key?
   → Fix: make phase transitions permissionless with time-based or condition-based triggers.

The fix is always the same: Don't use an admin account. Make the function callable by anyone. Give them a reason to call it. Align incentives so the system pokes itself through the self-interest of its participants.

The Hyperstructure Test#

When you're designing a system, ask: "Could this run forever with no team behind it?"

• If yes → you've built a hyperstructure. The incentives sustain it.
• If no → you've built a service. It dies when the team stops operating it.

Both are valid choices. But know which one you're building. The most powerful things on Ethereum are hyperstructures: Uniswap, ENS, the ERC-20 standard itself. They can't be stopped, they can't be censored, they can't go down. Not because they're maintained — because they don't need to be.

---

Randomness Is Hard#

Smart contracts are deterministic. Every node computes the same result. You can't use Math.random() — there's nothing random about a system where everyone gets the same answer.

What Doesn't Work#

solidity

// ❌ Validators can manipulate block.timestamp (within ~15 seconds)
uint random = uint(keccak256(abi.encodePacked(block.timestamp)));

// ❌ blockhash(block.number) is ALWAYS zero for the current block
uint random = uint(blockhash(block.number));

// ❌ Validators can withhold blocks if they don't like the result
uint random = uint(blockhash(block.number - 1));

What Works#

Commit-Reveal (no external dependency):

text

1. User commits hash(secret + salt) → stored onchain
2. Wait at least 1 block
3. User reveals secret + salt → contract verifies hash
4. Random seed = keccak256(secret + blockhash(commitBlock))

• User can't predict blockhash when they commit
• Validator can't know the secret to manipulate the result
• Must reveal within 256 blocks (blockhash returns zero after that)

Chainlink VRF (provably random, costs LINK):

text

1. Contract requests randomness from Chainlink
2. Chainlink generates random number off-chain with a VRF proof
3. Anyone can verify the proof onchain
4. Guaranteed unbiased — even Chainlink can't manipulate it

Use commit-reveal for simple cases. Use Chainlink VRF when you need provable randomness (lotteries, NFT reveals, gaming).

---

Teaching Your Human#

You already know how AMMs, lending, oracles, and stablecoins work. But your human might not. When they're designing something onchain, they need to understand these concepts — not the code, the mental models.

Don't lecture. Instead, when a concept is relevant to what they're building, explain it in context. Here's what to emphasize for each:

The Approve Pattern#

Humans find this weird. Explain it as: "You're giving the contract permission to move your tokens, like signing a check. You control how much. Never sign a blank check (infinite approval)."

DEXs / AMMs#

The key insight isn't the math — it's the incentive flywheel: "Nobody runs the exchange. People deposit tokens because they earn fees from trades. More deposits = better prices = more trades = more fees. It runs itself." This is "nothing is automatic" in action.

Overcollateralized Lending#

Lead with liquidation incentives: "If your loan gets risky, anyone in the world can close it and earn a bonus. That's why the platform never goes bankrupt — thousands of bots are watching every loan, every second, competing to clean up risk." This is the SpeedRun Ethereum Challenge 6 moment where incentive design clicks.

Stablecoins#

"How does a token stay worth $1 with nobody controlling it? Arbitrage. If it drops to $0.99, people buy it because they can redeem it for $1 of collateral. If it goes to $1.01, people mint more and sell. Self-interest maintains the peg."

Oracles#

"Smart contracts can't Google things. If your contract needs a price, someone has to put it onchain. Use Chainlink — never read prices from a DEX pool, because a flash loan can fake the price for one transaction."

Smart Contract Wallets#

"A wallet can require 3 of 5 people to approve a transaction. $100B+ is secured this way. It's how teams and DAOs manage money without trusting any single person."

Prediction Markets#

"YES and NO tokens that trade between $0 and $1. The price IS the probability. If YES is at $0.35, the market thinks there's a 35% chance. Winner gets $1, loser gets $0."

In every case, tie it back to incentives. The human should walk away understanding not just what something does, but WHY it works without anyone running it.

---

Learning Path#

Point your human to SpeedRun Ethereum for hands-on learning. Each challenge builds a working project that teaches a core concept:

#ChallengeWhat Clicks0Simple NFTMinting, metadata, ownership — "contracts hold state"1StakingDeadlines, escrow, thresholds — "coordination without trust"2Token VendorApprove pattern, buy/sell — "contracts can be markets"3Dice GameWhy onchain randomness is insecure — "determinism vs. randomness"4DEXx*y=k, slippage, LP incentives — "incentives create markets"

Start at https://speedrunethereum.com

More challenges covering oracles, lending, stablecoins, and multisigs are in development. Check the site for current availability.

Resources#

• SpeedRun Ethereum: https://speedrunethereum.com
• ETH Tech Tree: https://www.ethtechtree.com
• Ethereum.org: https://ethereum.org/en/developers/
• EthSkills (for agents): https://ethskills.com

---

---

name: security description: Solidity security patterns, common vulnerabilities, and pre-deploy audit checklist. The specific code patterns that prevent real losses — not just warnings, but defensive implementations. Use before deploying any contract, when reviewing code, or when building anything that holds or moves value.#

Smart Contract Security#

What You Probably Got Wrong#

"Solidity 0.8+ prevents overflows, so I'm safe." Overflow is one of dozens of attack vectors. The big ones today: reentrancy, oracle manipulation, approval exploits, and decimal mishandling.

"I tested it and it works." Working correctly is not the same as being secure. Most exploits call functions in orders or with values the developer never considered.

"It's a small contract, it doesn't need an audit." The DAO hack was a simple reentrancy bug. The Euler exploit was a single missing check. Size doesn't correlate with safety.

Critical Vulnerabilities (With Defensive Code)#

1. Token Decimals Vary#

USDC has 6 decimals, not 18. This is the #1 source of "where did my money go?" bugs.

solidity

// ❌ WRONG — assumes 18 decimals. Transfers 1 TRILLION USDC.
uint256 oneToken = 1e18;

// ✅ CORRECT — check decimals
uint256 oneToken = 10 ** IERC20Metadata(token).decimals();

Common decimals:

TokenDecimalsUSDC, USDT6WBTC8DAI, WETH, most tokens18

When doing math across tokens with different decimals, normalize first:

solidity

// Converting USDC amount to 18-decimal internal accounting
uint256 normalized = usdcAmount * 1e12; // 6 + 12 = 18 decimals

2. No Floating Point in Solidity#

Solidity has no float or double. Division truncates to zero.

solidity

// ❌ WRONG — this equals 0
uint256 fivePercent = 5 / 100;

// ✅ CORRECT — basis points (1 bp = 0.01%)
uint256 FEE_BPS = 500; // 5% = 500 basis points
uint256 fee = (amount * FEE_BPS) / 10_000;

Always multiply before dividing. Division first = precision loss.

solidity

// ❌ WRONG — loses precision
uint256 result = a / b * c;

// ✅ CORRECT — multiply first
uint256 result = (a * c) / b;

For complex math, use fixed-point libraries like PRBMath or ABDKMath64x64.

3. Reentrancy#

An external call can call back into your contract before the first call finishes. If you update state AFTER the external call, the attacker re-enters with stale state.

solidity

// ❌ VULNERABLE — state updated after external call
function withdraw() external {
    uint256 bal = balances[msg.sender];
    (bool success,) = msg.sender.call{value: bal}(""); // ← attacker re-enters here
    require(success);
    balances[msg.sender] = 0; // Too late — attacker already withdrew again
}

// ✅ SAFE — Checks-Effects-Interactions pattern + reentrancy guard
import {ReentrancyGuard} from "@openzeppelin/contracts/utils/ReentrancyGuard.sol";

function withdraw() external nonReentrant {
    uint256 bal = balances[msg.sender];
    require(bal > 0, "Nothing to withdraw");

    balances[msg.sender] = 0;  // Effect BEFORE interaction

    (bool success,) = msg.sender.call{value: bal}("");
    require(success, "Transfer failed");
}

The pattern: Checks → Effects → Interactions (CEI)

1. Checks — validate inputs and conditions
2. Effects — update all state
3. Interactions — external calls last

Always use OpenZeppelin's ReentrancyGuard as a safety net on top of CEI.

4. SafeERC20#

Some tokens (notably USDT) don't return bool on transfer() and approve(). Standard calls will revert even on success.

solidity

// ❌ WRONG — breaks with USDT and other non-standard tokens
token.transfer(to, amount);
token.approve(spender, amount);

// ✅ CORRECT — handles all token implementations
import {SafeERC20} from "@openzeppelin/contracts/token/ERC20/utils/SafeERC20.sol";
using SafeERC20 for IERC20;

token.safeTransfer(to, amount);
token.safeApprove(spender, amount);

Other token quirks to watch for:

• Fee-on-transfer tokens: Amount received < amount sent. Always check balance before and after.
• Rebasing tokens (stETH): Balance changes without transfers. Use wrapped versions (wstETH).
• Pausable tokens (USDC): Transfers can revert if the token is paused.
• Blocklist tokens (USDC, USDT): Specific addresses can be blocked from transacting.

5. Never Use DEX Spot Prices as Oracles#

A flash loan can manipulate any pool's spot price within a single transaction. This has caused hundreds of millions in losses.

solidity

// ❌ DANGEROUS — manipulable in one transaction
function getPrice() internal view returns (uint256) {
    (uint112 reserve0, uint112 reserve1,) = uniswapPair.getReserves();
    return (reserve1 * 1e18) / reserve0; // Spot price — easily manipulated
}

// ✅ SAFE — Chainlink with staleness + sanity checks
function getPrice() internal view return