Curriculum·G301 Solidity Mental Models·about 33 min
A contract does what it says, not what you meant
By the end of this lesson you can
- →Explain that a deployed contract executes its literal code, not the author's intention
- →Describe how Rubixi's mis-named constructor became a public function that handed ownership to any caller
- →Reason that the gap between intended and actual behavior is closed by code, never by good intentions
- →Adopt the mental model that a contract is a literal, adversarial machine before learning to write one
Graduate · enrolled learners
This lesson opens with Rubixi, 2016.
- What happened
- Rubixi was a smart contract for a pyramid-style game whose developer had renamed the contract from an earlier name, DynamicPyramid, but had left the constructor, the special function that runs once at deployment to set the owner, under the old name. In the Solidity of the time a constructor was identified only by having the same name as the contract, so once the contract was renamed to Rubixi the old-named function was no longer a constructor at all; it was an ordinary public function that anyone could call at any time. Because that function set the caller as the owner, any user could call it to make themselves the owner and then withdraw the fees the contract had collected. Nothing was hacked in the cryptographic sense and no key was stolen: the contract did exactly what its code said, and its code, through a simple misunderstanding of how constructors were identified, offered ownership to whoever asked for it. The developer had meant the function to run once, privately, at birth; the code said it was a public button anyone could press.
- The decision point
- A deployed smart contract executes the literal meaning of its code, not the intention in the author's head, so the only behavior that exists is the behavior the code specifies, and any gap between what was meant and what was written is resolved in favor of what was written, in public, against an adversary. Rubixi is the case: the developer meant a constructor that set the owner once at deployment, but after renaming the contract the code said an ordinary public function set the owner for anyone who called it, so ownership went to whoever asked, exactly as written and not at all as meant. This is the first mental model of building, and the reason this track exists before a learner writes production code: a contract is not a description of intent that the machine interprets charitably; it is an instruction the machine follows literally, forever, in front of everyone, including people actively looking for the difference between what you meant and what you said. So the discipline is to read and reason about a contract as the machine will, by what it literally does under every possible caller, not by the story you had in mind when you wrote it, because the machine has no access to that story and the adversary has no interest in it, and Rubixi is what the gap between meaning and code becomes when it is left for a stranger to find.
What you will be able to answer
- →Why could anyone become owner of Rubixi (2016)?
- →What does a deployed contract execute: intent or code?
- →The first mental model of building a contract
- →Why is 'the function is meant to run once' not a control?
Orientation and Year One are open: anyone can read them without an account. From Year Two onward the lessons are for enrolled learners, because progress through the later years only means anything if it is tracked against a record.
It is free. We do not sell the list and there is nothing to buy at the end of it.
Sources and review
Confidence high·Volatility low·Reviewed 2026-09-17·Owner unassigned
Contested
The loss is recorded as 0 because the harm was the theft of the contract's collected fees by whoever seized ownership, a modest and disputed sum in a 2016 game contract, not a headline figure; the lesson is the mechanism, a mis-named constructor as a public function, not the amount.
Constructors in current Solidity are declared with the constructor keyword, which removes this specific footgun; the mental model, that the code is literal and public, is what carries forward, not the 2016 naming rule.