It is live and adversarial the moment it deploys

Graduate · enrolled learners

This lesson opens with Eminence (EMN), September 2020.

What happened

A well-known DeFi developer deployed a set of contracts for an unreleased, unfinished game project to Ethereum mainnet, without announcing a launch, apparently as work in progress. But the contracts were on a public chain, so they were immediately visible, and people who watched the developer's address found them, recognized who was behind them, and poured about 15 million dollars into the unfinished system within hours, before it was ready or announced. An attacker then used a flash loan to exploit the incomplete mint-and-burn mechanics and drained the funds; roughly half was later returned. Nothing had been 'launched': there was no announcement, no audit, no final version. The contracts were simply live, because on a public chain deployment is the launch, whatever the developer intended, and being live meant being found, funded, and attacked, all before the project existed in the developer's own mind as finished.

The decision point

On a public blockchain, a contract is live, visible and callable the instant it is deployed, whether or not it is finished, announced, or ready, so deployment, not announcement, is the moment adversaries can find and use it, and there is no private staging area on mainnet. Eminence is the case: an unfinished, unannounced project was deployed to mainnet, found within hours by people watching the developer, funded with about 15 million dollars, and drained through its incomplete mechanics, all before any launch, because the chain does not know the difference between 'deployed' and 'launched.' This extends the course's mental model: not only does the machine run exactly what the code says, it begins running it for everyone the moment the code is on-chain, in an environment where addresses are watched, new contracts are indexed within blocks, and money moves toward anything that looks live. So the discipline is to treat deployment to mainnet as the launch, meaning nothing goes there until it is finished, reviewed and ready to be attacked, and anything that must be tested is tested on a testnet or a local fork where value is not real, because a public chain has no 'coming soon' and no 'ignore this, it is not ready.' Eminence is what 'we had not launched yet' means when the contracts are already on mainnet: nothing, because the chain launched them the moment they were deployed, and the adversary does not wait for the announcement.

Recorded loss

$15,000,000

Orientation and Year One are open: anyone can read them without an account. From Year Two onward the lessons are for enrolled learners, because progress through the later years only means anything if it is tracked against a record.

It is free. We do not sell the list and there is nothing to buy at the end of it.