Where to go next, and the honest handoff

Graduate · enrolled learners

This lesson opens with Pickle Finance, November 2020.

What happened

Pickle Finance ran yield strategies through contracts it called jars, and its logic trusted the jars it interacted with without properly checking that a given jar was one of its own legitimate contracts. An attacker introduced a malicious jar, an 'evil jar' that looked enough like a real one, and because the protocol did not validate which jar it was dealing with, it treated the attacker's contract as legitimate and used it to swap out about 20 million dollars of real DAI. The system was clever and composable, built to plug strategies together, and that very composability was the seam: it assumed the things it composed with were its own, and it did not enforce that assumption in code. It is a fitting final autopsy for this track, because it is not an exotic failure but a gap of exactly the kind rigorous, ongoing education and independent review are meant to close, a missing check on trust in a system whose designers were plenty smart and not yet disciplined enough. The cleverness built the composable machine; the missing validation let a stranger's contract walk into it.

The decision point

This bridge has taught you to think about contracts as literal, adversarial, immutable machines, to reason about the EVM's gas and calls, to understand where storage, upgrades and initialization break, and to read a deployed contract for who controls it and what it does, and that is genuinely valuable, but it is deliberately not the same as teaching you to build production smart contracts safely, which requires rigorous, hands-on education this track hands you off to rather than pretending to provide. Pickle Finance is the closing case: a clever, composable system drained of about 20 million dollars through a missing check that its own contracts were the ones it trusted, the kind of gap that discipline and review close and cleverness alone does not. The honest handoff is the point of this final lesson: xdripacademy's Builder Bridge prepares you for best-in-class free developer education and says so plainly; it does not compete with it or replace it. So the next step, for anyone who wants to build rather than only to understand and read, is to go to the places that teach building for real, hands-on, deeply, under instruction, and the three to name are Cyfrin Updraft, Alchemy University, and LearnWeb3, all free and excellent. What you carry there from this bridge is not the ability to write a safe contract, which they will teach you, but the mental models and the humility to learn it well: the knowledge that the machine is literal, that the seams are where things break, that an audit is not a guarantee, and that knowing a little is dangerous. Pickle Finance is why the handoff has to be honest: building safely is hard enough that a bridge which pretended to finish the job would be doing exactly what this track has warned against, sending out builders confident and undertrained, and the responsible thing is to prepare you well and point you clearly at where the real training is.

Recorded loss

$20,000,000

Orientation and Year One are open: anyone can read them without an account. From Year Two onward the lessons are for enrolled learners, because progress through the later years only means anything if it is tracked against a record.

It is free. We do not sell the list and there is nothing to buy at the end of it.