Aryan | timberman

1/5 On-chain DAO voting is broken. It secretly taxes every token holder for security. I developed a new model to fix this. Introducing Reactive Governance: A new design for secure, scalable, AND gas-efficient on-chain voting. 🧵 Full research & solution. paragraph.com/@timberman/on-…

Just shipped the official launch for @LegacyForgeHQ Solo dev. Zero funding. MVP done. Testnet dropping this week on Base Sepolia. I’ve watched too many stories of families losing life-changing money because a seed phrase died with the holder. Self-custody is powerful — until it isn’t. LegacyForge is the simplest trustless on-chain inheritance layer: → Factory vault → Beneficiary + timer → Proof-of-life pings → Auto-claim if silent No custody. No admin keys. No bullshit. Full thread here → xitter.gq/LegacyForgeHQ/status/2… If you're a self-custody maxi, founder, or running a DAO treasury — this one’s built for you. Testnet waitlist open: tally.so/r/J9ezBY Let’s fix digital legacy.

After battling with arXiv for what felt like forever, my paper is finally out on Zenodo! Reactive Governance: A Selective Snapshotting Framework for Secure and Gas-Efficient DAO Voting No more constant checkpointing overhead. Just reactive balance snapshots that keep DAOs safe from flash-loan & late-stake attacks while slashing gas costs (~17k marginal gas + zero transfer overhead). Formal model, security proofs, Foundry benchmarks + full Solidity implementation included. Paper: zenodo.org/records/20037058 GitHub: github.com/timburman/Reactiv… Would love feedback from the web3/governance crew! 🧵 #DAO #Ethereum #Solidity #BlockchainGovernance

Week-1 Day-5: EVM Portfolio Tracker (Dissertation) Today I wrapped up Week 1 by completing the core wallet data generation and setting up the database foundation. 1. All tests passing green and wallet data successfully generated for the first time. This is the first real on-chain output coming through the pipeline. 2. Created parser.py: Converts raw blockchain data into clean, structured, DB-ready format. This module handles the full transformation so data can be easily ingested without any loss. 3. Created database.py: Full Supabase client setup with connection handling, pooling configured, and basic insert/query operations tested and working smoothly. Nothing flashy today, but these foundational pieces are making the system more solid and ready for scaling as the project grows. Slow progress > no progress. On to week-2. ⚡ #buildinpublic #web3 #python #evm #supabase #devlog

Week-1 Day-4: EVM Portfolio Tracker (Dissertation) Today was mostly about improving the data pipeline and project structure. 1. While working on coingecko.py, I realized returning the full dataset at once isn’t ideal when we’re processing data in batches. So instead of returning everything, I switched the logic to yield results progressively. This means: - we can process data batch-by-batch - if some API calls fail, we don’t lose the data already fetched - overall the pipeline becomes more resilient and memory-efficient 2. Created main.py, which will act as the server entry point for the application. This sets the foundation for how different modules will connect and run together. 3. Cleaned up etherscan.py by fixing several typos and small issues that could cause problems later. Nothing flashy today, but these kinds of improvements make the system more reliable and easier to scale as the project grows. Slow progress > no progress. On to Day-5 tomorrow. ⚡ #buildinpublic #web3 #python #evm #devlog

Week 1 — Day 3 of building EVM Portfolio Tracker (Dissertation) Today I built a proper token layer so I don’t have to keep re-solving the same problems in every script. I added a token_registry.py module that works hand-in-hand with coingecko.py: • coingecko.py handles fetching token data from the CoinGecko API • token_registry.py sits on top as the “source of truth” for my app and adds the real-world glue: • caching (so we don’t spam the API / speed up repeated lookups) • blacklisting (ignore scammy/unsupported tokens cleanly) • consistent token lookup/normalization (one clean interface everywhere) Result: cleaner code, fewer repeated requests, and a registry I can extend later (better metadata, fallbacks, more sources, etc.) Week 1 momentum continues — onto Day 4.

Week 1 dissertation progress: EVM Portfolio Tracker. Day-2 Built coingecko.py, a small token-discovery + caching layer on top of @coingecko . What it does: • Fetches the valid tokens listed on CoinGecko • Stores a local cache so I’m not hitting the API constantly • Skips API calls if the cache was updated in the last 30 minutes • Auto-refreshes the token list after 1 day • Supports an automatic blacklist (tokens I want to exclude from cache/refetch) • Re-checks blacklisted tokens after 3 days via API (in case they become valid again) Question for the readers: • If you were building this, would you prefer blacklist re-checks to be time-based (like now) or event/threshold-based (e.g., only when a token is requested X times)?

Day 8 of Cyfrin Updraft Puppy Raffle audit grind 🔥 Dived deep into recon + multiple exploit classes today: • Finished initial docs & code walkthrough (smelled a bug early 👀) • Studied sc-exploits-minimized repo • Denial of Service: theory → minimal PoC → real cases (GMX V2 + Bridges) → Puppy Raffle unfair late-entry DoS attack + report + mitigation (remove duplicates!) • Business logic edge case: smart contract players • Reentrancy deep dive: Puppy Raffle deposit→withdraw loop exploit → Remix drain demo → CEI + nonReentrant fixes → The DAO history lesson Reentrancy still menaces society 😈 Onward to more bugs 🕵️‍♂️ #SmartContractAudit #EthereumSecurity #CyfrinUpdraft

Reentrancy Guards in Solidity: Basics + Why They Matter + OpenZeppelin's Latest Upgrades 🔥 Reentrancy = deadly vuln where attacker re-calls your function mid-execution → drains funds (e.g., DAO hack ~$60M lost). Guards lock the function during external calls to prevent this. Why reentrancy guards are essential: - Block multiple withdrawals before balance updates - Enforce Checks-Effects-Interactions (CEI) pattern: Check → Update state → External calls - Prevent massive DeFi/NFT losses - Must-have for any function with external calls + state changes Classic OpenZeppelin ReentrancyGuard (still default in v5.5+): - Uses persistent storage slot to track "entered" state - Cost ~2,000–3,000 extra gas per call (SLOAD/SSTORE) OpenZeppelin's big shift (v5.1+ post-Dencun/EIP-1153): - Added ReentrancyGuardTransient variant using transient storage (temp per tx only) - No persistent writes → gas savings of ~50–70% (often 2,000+ per guarded call) - Same security, cheaper, greener, no chain bloat - ReentrancyGuardUpgradeable removed (stateless Transient works with proxies, no storage vars needed, flagged as "stateless" in releases) - Not default yet (use Transient explicitly for efficiency), but community notes suggest classic may deprecate soon Bottom line: → Always CEI + guards in prod → Use @openzeppelin/contracts/utils/ReentrancyGuardTransient.sol on modern chains for wins → Massive gas boost for high-traffic protocols Switching to Transient yet? Share your gas savings or fave reentrancy story 👇 #Solidity #Web3Security #Ethereum #OpenZeppelin #SmartContracts

Day 7 of Cyfrin Updraft grind + Solidity security learning 🚀 Back after a busy IRL, streak alive! Kicked off Section 4: Puppy Raffle audit in @CyfrinUpdraft's Auditor track (the big DeFi-style mock raffle). Covered so far: - Intro & Primer: Overview of the contract & bug-hunting flow - Phase 1: Scoping — codebase/Git/Foundry setup, test coverage, security view, exploits prep - Tooling: Slither (Trail of Bits static analysis — non-exec bug detection) introduced by Patrick - Tooling: Aderyn (Rust-based static analyzer by Alex Roan — quick vuln flags) Biggest aha: Tools like Slither/Aderyn give instant red flags (reentrancy guards? weak randomness from timestamp?) before manual review — huge time-saver in real audits. Puppy Raffle feels way more complex than PasswordStore, excited for the vulns ahead. Next sessions: Dive deeper into manual review & specific exploits. Who's deep in Puppy Raffle? Share Slither/Aderyn tips or fave bug you spotted. Dissertation leaning: Vuln detection tool integrating static tools like these? #Solidity #Web3Security #Cyfrin #SmartContractAudit #Blockchain #CryptoIndia

Day 6 of Cyfrin Updraft grind + Solidity security learning 🚀 IRL work ate the day today, no new modules, but checking in to keep accountability. First full audit (PasswordStore) still fresh in the brain: access control PoCs, severity ratings, PDF reports, Docker key protection. Reset mode: Back tomorrow for Section 4 – Puppy Raffle (reentrancy + randomness vulns incoming). Who's audited Puppy Raffle? Any early scoping tips or fave vuln you found? Dissertation still leaning vuln detection tool (auto-flagging access control + reentrancy patterns). Let's go. #Solidity #Web3Security #Cyfrin #SmartContractAudit #CryptoIndia

Day 5 of Cyfrin Updraft grind + Solidity security learning 🚀 First full audit section COMPLETE! Wrapped the rest of Section 3 (PasswordStore) + wrap-up modules in @CyfrinUpdraft's Auditor track. Key learnings: - Writing killer findings: Detailed descriptions, undeniable PoCs (test cases in protocol suite), actionable mitigations - Structured writeups (access control on setPassword, incorrect NatSpec) with code snippets & markdown tips - Using AI to polish reports - Severity ratings (High via likelihood/impact, Informational lows) per CodeHawks guide - Timeboxing for efficient reviews (Patrick tip) - Generating pro PDF reports from markdown - Building public GitHub portfolio for audit journeys - Isolated dev envs with Docker (protect keys from malicious risks) - Patrick's recap: Full lifecycle from scope to mitigation #Solidity #Web3Security #Cyfrin #SmartContractAudit #Blockchain #CryptoIndia

Day 4 of Cyfrin Updraft grind + Solidity security learning 🚀 Finished Section 3: Your First Audit | PasswordStore Audit in @CyfrinUpdraft's Auditor track, my first full hands-on audit complete! Built on Tincho's recon mindset: - Deep code understanding with 'How can I break this?' approach - Found exploit: Access control vulnerability (missing/improper auth on sensitive ops) - Wrote full report: Structured findings, PoC code, severity/impact - Ended with mitigations (e.g., proper modifiers, owner checks) Biggest aha: Writing a clear PoC turns 'maybe vulnerable' into undeniable proof, and mitigations make the report actionable. PasswordStore felt simple but taught end-to-end process perfectly. #Solidity #Web3Security #Cyfrin #SmartContractAudit #Blockchain #CryptoIndia

Day 3 of Cyfrin Updraft grind + Solidity security learning 🚀 Halfway through Section 3: Your First Audit | PasswordStore Audit in @CyfrinUpdraft's Auditor track. Learned (scoping phase): - Scoping contracts on Etherscan (source verification, deployment context, proxy checks) - Audit details & documentation essentials - Using cloc for scoping (LOC counts, complexity metrics to estimate attack surface) - Key insights from @tinchoabbate (Tincho's method: docs/context first, 'How can I break this?' recon mindset, time-bound audits, fuzz + detailed notes) Scoping isn't busywork cloc + Etherscan recon reveals hidden complexity early. Still got the vuln hunting + findings/reporting in PasswordStore to go, hands-on starts soon! Who's tackled PasswordStore or used cloc in audits? Drop scoping tips or Tincho gems below. Dissertation ideas still welcome (vuln detection tool leaning harder after this recon focus). #Solidity #Web3Security #Cyfrin #SmartContractAudit #Blockchain #CryptoIndia