Hello everyone,

For some time I've been developing an open-source project called Framework for Trust (FfT).

The idea is to create a decentralized geospatial trust layer where reports and real-world events are anchored to precise location, time, source reputation, and a verifiable history — instead of treating blockchain purely as a financial system, I'm exploring its use as infrastructure for recording and correlating information about real-world places.

Current prototype includes:

• geographic areas represented as blockchain-based identifiers (NFTs)
• event registration tied to latitude, longitude, and time
• Polygon smart contracts
• a React + Leaflet frontend
• a FastAPI backend
• semantic similarity / event correlation via Qdrant
• GCD — a functional contribution and reputation token
• event proofs and auditable records
• early mechanisms for source reputation, staking, and abuse prevention

The project is still early-stage. This is not an investment offer, token sale, or a finished commercial product — I made the repo public because I'd like the architecture and implementation to get real outside scrutiny.

I'd especially appreciate feedback on:

• whether the core problem is clearly explained
• the geospatial data model
• the blockchain / smart contract architecture
• mechanisms for preventing false or coordinated reports
• security weaknesses
• practical use cases where this could actually add value

Repo link in the top comment (Reddit flags posts with links for manual review, didn't want that delay).

I built the current prototype independently. Honest criticism, technical pushback, and open-source contributions are all welcome.

Many say that the market is in the worst condition. Spending money to go there will not be a good choice?

Or shall I think like this?

Going now to avoid an annoying crowd? So that I could get noticed?!

Hey Guys,

My understanding of blockchain is the balance has to be public. Only then a competition can happen from A to B. Once balance is decreased, the other balance is increased. Due to the decentralized nature of the blockchain, the balances are public domain and the transactions are public domain and anybody can trace it and they are not reliant on central banks and government agency or any other centralized institution. Instead, they are calculated and computed and executed by decentralized network of nodes. But my application require privacy. If I'm trying to build something which protect how much balance is there in one account and if there is possible way to keep a ledger of transaction for compliance requirement but still hide it from general public.

is it even possible to do it or has it been done by any major-protocol like L2 or L3 ETH networks.

What my team is looking into is a
A)Stable-coin(We are building our own) build on ETH network integrated with BANK/Credit-Cards( for cash-in/out). Which has balances hidden (not scan-able on eth-scan or any public scanner). On Court order, company is obligated to show balance to TAX-Man (Addresses are linked to companies{this application allows commercial user send and receive money and to lend to other via smart contracts} .Address to company linking is done via APIs )

B) Transfer & Tranx-records : Same as balances. There's no public record of these transactions, but the money is still traceable on Tax-Man orders. So the traceability and the record keeping of transaction has to be kept for 5-10 years per company, but it is just not available to some random dude over the internet.

If you would go over how tranx is verified [the Math & algorithmic side of it that will be really cool ]

Hey Guys,

My understanding of blockchain is the balance has to be public. Only then a competition can happen from A to B. Once balance is decreased, the other balance is increased. Due to the decentralized nature of the blockchain, the balances are public domain and the transactions are public domain and anybody can trace it and they are not reliant on central banks and government agency or any other centralized institution. Instead, they are calculated and computed and executed by decentralized network of nodes. But my application require privacy. If I'm trying to build something which protect how much balance is there in one account and if there is possible way to keep a ledger of transaction for compliance requirement but still hide it from general public.

is it even possible to do it or has it been done by any major-protocol like L2 or L3 ETH networks.

Hi everyone,

I am building Quoti, an Ethereum liquid staking token (LST) project. I am looking for a small group of users and developers to test it on the Hoodi testnet.

I started Quoti because I stake ETH myself. I have seen staking APR decrease as more ETH is staked. I want to explore better ways to build staking infrastructure for people who plan to stake for a long time.

I want to build Quoti with the Ethereum community. Early testing can help me find problems and improve the project before mainnet.

I am looking for:

• Stakers and validator operators
• Ethereum developers
• Security-focused testers
• Users who can report bugs/improvements

Early testers will get:

• Early access to Quoti as the economics are built upon bonding curves
• A chance to influence the project
• Priority access to future test releases

Testnet status:

• Hoodi testnet only
• No real ETH is required
• Mainnet plans are not final
• Testing and feedback are the main goals

Website: https://quoti.org/
GitHub: https://github.com/skaibaLab/quoti-core
Discord: https://discord.com/invite/QGJEwNE3hw

If you want to test Quoti or help with development, please reply or contact me!

Hi all I am a bsc graduate in physics from india and recently I was researching about Blockchain technology

As I was reading protocol and consensus developer caught my eye

As there is not much awareness about Blockchain and Ethereum in india,I would like to know what it takes to become a protocol or consensus dev

I mean how to target remote jobs as a fresher,what to study and how to approach this domain

Any help or advice would be highly appreciated

I know coding as I am an engineering dropout

Ok so this happened about a year ago. I haven't posted about it because I was embarrassed, and I'm finally past caring about that.

I fell for one of these. Not a junior dev. I build in crypto and I figured I was the last person who'd get caught by a job scam.

A recruiter walked me through their process and asked me to install an app on my Mac. It wanted my user password.

Something felt off. I typed it in anyway, because I was out of work at the time and wanted the job badly enough to talk myself past it.

Once it had admin, it went after:

• my Chrome profile data
• my Chrome extensions, wallet ones included
• wallet private keys of cos
• passport and ID photos sitting on the machine

It staged all of it in one folder that wasn't hidden well. That's the only reason I caught it. Then it almost certainly phoned home.

I moved every asset out of every wallet extension into fresh ones inside the hour, then wiped the machine.

Never trusted it again, sold it second-hand later.

I lost nothing. That's luck, and luck isn't a security model.

The part I want to say out loud: it didn't beat my technical judgment.

It beat my job search. I saw the red flag and went through it because I needed the role.

That's the real exploit, and it's why "just be more careful" is worthless advice for anyone actually looking for work.

A year of saying nothing about it didn't help anybody.

So if one of these has come at you, post what they sent.

The repo, the app, the profile.

The more of it that's searchable, the fewer people run the installer.

A general-purpose ERC-4626 vault for leveraged lending on Morpho Blue. Depositors supply a single asset; an allocator opens leveraged positions across multiple isolated markets, with the target leverage passed in calldata per action rather than fixed per market.

Everything is atomic through Morpho's flashloan and Bundler3. Opening, unwinding, and changing an existing position's ratio without closing it all happen in one transaction, including rebalancing between two markets in a single call.

would love to get some feedback

ETH-AVM Light Client — a trustless Ethereum→Algorand light client. Verifies real Ethereum receipts/logs on-chain via Algorand smart contracts, with an optional zero-RPC-trust mode (BLS sync-committee verification anchors the real Ethereum state root on Algorand, so you're not trusting any RPC provider's word for it)

https://github.com/m-reynaldo35/eth-avm-light-client

A trustless way for AI agents to confirm a transaction on eth for a predictable fee and fast confirmation times on algorand

So I've been prepping for Solidity interviews and decided to actually build something instead of just reading about it. Ended up making an ERC-4626 vault (the standard behind Yearn, Morpho, etc.) and specifically targeting the "inflation attack," a real exploit that's hit live vaults in production.

The attack is stupidly simple: deposit 1 wei, become the first depositor, then just transfer() a pile of tokens directly into the contract instead of going through deposit(). The next real user who deposits normally gets their shares rounded down to basically zero. No hacking required, just unchecked integer math.

I built the attack against my own vault first (to prove I understood it, not just copy a fix), then patched it using OpenZeppelin's decimals offset defense, and wrote a Foundry test that actually runs the exploit and checks the outcome. Result: attacker loses roughly half their money instead of stealing everything.

It's deployed live on testnet with a working demo, you can connect a wallet, mint fake tokens, deposit, simulate yield, and try to break it yourself:
https://vaultiss.vercel.app/

Code + tests + README:
https://github.com/SIDHARTH20K4/vaultis

Genuinely looking for feedback, brutal is fine. Is this the kind of project that'd actually get someone's attention for a junior/entry Solidity role, or am I missing something obvious that a real auditor would catch in five seconds?

I’ve been building an open-source monitor for Continuous Clearing Auction (CCAs).

What’s new:

6 chains monitored
Ethereum, Base, Arbitrum, Unichain, Optimism, and Polygon. The monitor auto-detects new auctions across all factory contracts.

Multi-channel alerts
Telegram, Discord, Slack webhooks, and email via SendGrid. Whale bids, auction endings, daily digests.

Auction comparison
Compare up to 4 auctions side-by-side: clearing ratios, bidder overlap, concentration, and more.

Post-graduation tracking
Graduated tokens now get sparkline charts with -10%, -20%, and -30% alert bands.

REST API
Cloudflare Workers API with a free tier for basic data and a pro tier for concentration/overlap analytics.

4 of 5 real CCAs graduated.

AKITA on Base was the first to fail.

And honestly, that's a good thing.

If every auction graduated, the mechanism wouldn't be doing much filtering. A failed auction is evidence that the graduation threshold actually matters.

The more interesting signal is bidder overlap.

Some wallets are showing up in almost every CCA.

As more auctions launch, that cross-auction behavior could become one of the most valuable datasets from the monitor.

And then things broke.

polygon-rpc.com started returning 401s.

They silently introduced API key requirements.

Lesson: never depend on a single RPC provider.

The monitor now has 2–3 fallback RPCs per chain and automatically fails over between Blockscout, dRPC, PublicNode, and others.

Windows + PM2 started spawning console windows.

The watchdog uses execSync to check PM2 status every 5 minutes. On Windows, that meant a console window popping up every time.

One little windowsHide: true fixed it.

Small problem. Surprisingly annoying.

Viem's default RPCs went stale.

If you don't explicitly configure an RPC, viem uses the chain's built-in default. Those endpoints can eventually stop working without much warning.

The client factory now falls back to the monitor's public RPC list instead.

Current state

The whole thing is running on a Windows box:

• 4 PM2 processes
• ~250 MB RAM
• ~$0/month infrastructure
• 30-second polling
• Automatic auction detection
• Automatic analysis
• Automatic dashboard updates

Waiting for the next wave of CCA launches.

Dashboard: cca-monitor dashboard
Repo: GitHub repository

Dashboard and API are free. PRs welcome.

Bots are getting to the point where they can do a lot more than moderate chats or post alerts. They can potentially execute trades, distribute rewards, manage memberships, interact with contracts, etc.

But once a bot can actually move money, the trust model changes completely.

How much authority would you realistically give one?

Would you be comfortable with a bot having a dedicated wallet if it had strict permissions and spending limits? Maybe it can interact with specific contracts but can't send funds anywhere else.

Or would you still want a human approval step for every transaction?

The part I keep coming back to is what happens if the bot itself gets compromised. Even with limited permissions, an attacker could potentially do a lot of damage within whatever boundaries you've given it.

Curious where people would draw the line.

I’ve been building an open-source monitor for Capped Continuous Auctions (CCAs).

What’s new:

6 chains monitored
Ethereum, Base, Arbitrum, Unichain, Optimism, and Polygon. The monitor auto-detects new auctions across all factory contracts.

Multi-channel alerts
Telegram, Discord, Slack webhooks, and email via SendGrid. Whale bids, auction endings, daily digests.

Auction comparison
Compare up to 4 auctions side-by-side: clearing ratios, bidder overlap, concentration, and more.

Post-graduation tracking
Graduated tokens now get sparkline charts with -10%, -20%, and -30% alert bands.

REST API
Cloudflare Workers API with a free tier for basic data and a pro tier for concentration/overlap analytics.

4 of 5 real CCAs graduated.

AKITA on Base was the first to fail.

And honestly, that's a good thing.

If every auction graduated, the mechanism wouldn't be doing much filtering. A failed auction is evidence that the graduation threshold actually matters.

The more interesting signal is bidder overlap.

Some wallets are showing up in almost every CCA.

As more auctions launch, that cross-auction behavior could become one of the most valuable datasets from the monitor.

And then things broke.

polygon-rpc.com started returning 401s.

They silently introduced API key requirements.

Lesson: never depend on a single RPC provider.

The monitor now has 2–3 fallback RPCs per chain and automatically fails over between Blockscout, dRPC, PublicNode, and others.

Windows + PM2 started spawning console windows.

The watchdog uses execSync to check PM2 status every 5 minutes. On Windows, that meant a console window popping up every time.

One little windowsHide: true fixed it.

Small problem. Surprisingly annoying.

Viem's default RPCs went stale.

If you don't explicitly configure an RPC, viem uses the chain's built-in default. Those endpoints can eventually stop working without much warning.

The client factory now falls back to the monitor's public RPC list instead.

Current state

The whole thing is running on a Windows box:

• 4 PM2 processes
• ~250 MB RAM
• ~$0/month infrastructure
• 30-second polling
• Automatic auction detection
• Automatic analysis
• Automatic dashboard updates

Waiting for the next wave of CCA launches.

Dashboard: cca-monitor dashboard
Repo: GitHub repository

Dashboard and API are free. PRs welcome.

Many token and protocol designs include pause or emergency functions.
I understand why they exist, but “for emergencies only” does not describe a control model.

The questions I keep coming back to are:
• Who can activate the power?
• What exactly becomes possible while it is active?
• Which normal rules can be bypassed?
• Is there an automatic expiry?
• Is activation publicly observable?
• Who can review or reverse the decision afterwards?

My concern is less “admin powers are always bad” and more that undefined emergency authority can turn temporary discretion into permanent governance.

For people who have designed or audited these systems: what constraints would you consider the minimum credible baseline?
Timelocks, guardian sets, automatic expiry, bounded functions, on-chain event logs, post-action review — which mechanisms actually help in practice, and which mostly look good on paper?

Are they sort of entirely non existent or just less in number compared to other fields? I m really getting interest in decentralised stuff but i also need a job as a soon to graduate guy. So will it be worth it to learn ethereum/solana as a pretty decent backend developer?