Introduction to Stage 5
Infrastructure & Security. Data infrastructure, cross-chain systems, account abstraction, contract security, economic attacks, and audits.
The questions this stage addresses
The first four stages let you build things. This one helps ensure they are not drained the day after launch.
Two main threads:
- Infrastructure: Turn chain-wide data into queryable systems, understand cross-chain trust assumptions, and improve user experience with account abstraction.
- Security: Contract vulnerabilities, protocol-level economic attacks, and threat models and invariants connecting both.
The key insight: most losses arise from state ordering, permission boundaries, and profitable incentives rather than syntax errors.
Six chapters
How can you turn all on-chain data into a queryable warehouse?
Is an asset still the same asset after crossing chains?
Can users stay safe without holding private keys directly?
The code was correct, so why was it still stolen?
What can attackers do with money alone, without exploiting a bug?
What does an audit actually examine?
After this stage
You can write a threat model and invariant checklist for your system and have them checked automatically.
Stage artifact: A threat model and invariant checklist, accompanied by fuzzing tests, monitoring, and alerts.
Study suggestions
- T28 requires you to write a vulnerable contract and exploit it yourself. Do not skip this: experiencing it once teaches more than ten analyses.
- T29's calculations matter. Calculate your own protocol's attack cost. If you cannot, you do not yet understand its boundaries.
- From this stage onward, every assignment must identify its “most likely point of failure.”