Skip to content
Zoran Zhou WEB3 LAB Build · Test · Document 中文
INDEPENDENT TECHNICAL SUBSITE / V1

Building secure systems for the onchain world.

Wallet Integration · Backend Engineering · Product Security · Solution Architecture

Inspect the featured build View learning outcomes
  1. TYPESCRIPT TYPE-SAFE EVENTS
  2. VIEM RPC LOG DECODING
  3. SOLIDITY REPLAY PROTECTION
  4. FOUNDRY FUZZ + INVARIANT TESTS
  5. SEPOLIA VERIFY + PUBLISH
SECURE EVENT HANDLER STATIC / V1
SOLIDITY / EXECUTION PREVIEW ~/web3-lab
CONTRACT ReplayGuard EIP-712 / SOLIDITY
  1. TYPEHASH bytes32 constant TYPEHASH = keccak256("TransferAuthorization(bytes32 key,address token,uint256 amount,uint48 deadline)");
  2. DIGEST bytes32 digest = _hashTypedDataV4(keccak256(abi.encode(TYPEHASH, key, token, amount, deadline)));
  3. AUTH if (!SignatureChecker.isValidSignatureNow(signer, digest, signature)) revert InvalidSignature();
  4. EXPIRY if (block.timestamp > deadline) revert Expired(deadline);
  5. REPLAY if (_processed[key]) revert Replayed(key); _processed[key] = true;
  6. AUDIT emit AuthorizationConsumed(key, signer, digest, deadline);

forge test --match-test testReplayProtection -vvvv

READY

EIP-712 ERC-1271 DEADLINE ATOMIC CONSUME
REFERENCE PATTERN · NOT AN IMPLEMENTATION CLAIM STATIC / NO SECRETS
04 / TECHNICAL TRACKS

Four technical domains. One engineering system.

The Lab organizes work by the systems being built and validated, not by market narratives or token activity.

01 / INTEGRATION

Wallet Integration

Connect product workflows to wallet APIs, custody interfaces, RPC providers, webhooks, and transaction lifecycles.

  • Wallet APIs
  • Blockchain RPC
  • Webhooks
  • Transaction lifecycle
02 / BACKEND

Backend Engineering

Design predictable asset workflows with explicit state, consistency boundaries, retries, and recovery paths.

  • TypeScript
  • NestJS
  • PostgreSQL
  • Idempotency
03 / SECURITY

Product Security

Test authorization, signatures, wallet business logic, threat boundaries, and security regressions.

  • API security
  • Threat modeling
  • Signature security
  • Regression tests
04 / SOLUTIONS

Solutions

Turn requirements into explainable proofs of concept, architecture decisions, and technical documentation.

  • Architecture
  • Integration design
  • Proof of concept
  • Documentation
BUILD / 001

Featured build

The long-term center of the Lab: implementations, evidence, constraints, and decisions that can be inspected.

FEATURED BUILD PLANNED
BUILD / TESTNET-WALLET-PLATFORM

Testnet Digital Asset Wallet Platform

A planned educational platform for documenting wallet API, transaction lifecycle, backend consistency, and product-security decisions on testnets.

EDUCATIONAL TESTNET ONLY UNAUDITED NO REAL FUNDS
Open build record
STATUS
PLANNED
CURRENT PHASE
Scope definition
PLANNED STACK
  • SERVER TypeScript + NestJS
  • ONCHAIN viem
  • DATA PostgreSQL
  • CONTRACTS Solidity + Foundry
  • NETWORK Sepolia
PLANNED SELECTION · NOT IMPLEMENTED OR VERIFIED
IMPLEMENTED
No features are claimed as implemented yet.
LEARNING / PUBLIC OUTCOMES

Learning outcomes, published when they can be verified.

Public entries focus on concrete outputs, problems encountered, security findings, related code, and the date each result was last verified.

No learning outcome is currently claimed as verified. Entries will appear only after there is a concrete implementation or documented result.
WEB3 VERIFICATION ROUTE CURRENT STAGE / 01
  1. CURRENT STAGE TYPESCRIPT

    Typed chain-event ingestion

  2. PENDING VIEM

    RPC log decoding and ERC-20 normalization

  3. PENDING SOLIDITY

    Replay-protected event registry

  4. PENDING FOUNDRY

    Unit, fuzz, and invariant tests

  5. PENDING SEPOLIA

    Deployment, transaction hashes, and verification report

TECHNICAL ROUTE / TYPESCRIPT → VIEM → SOLIDITY → FOUNDRY → SEPOLIA EVIDENCE
SECURITY / ATTACK SURFACE

Security work stays attached to real workflows.

SECURITY THEORETICAL / NOT TESTED

Why a valid webhook signature is not enough

A theoretical security analysis of the gap between authentic webhook delivery and unique business processing.

THEORETICAL ANALYSIS · NOT IMPLEMENTATION-TESTED
Read the security case
ABOUT / OPERATING PRINCIPLES

A technical record of builds, validation, and system boundaries.

Web3 Lab is an independent technical subsite for documenting wallet integration, digital asset backend engineering, product security, and solution architecture through concrete work.

The Lab prioritizes practical implementation, security validation, architecture decisions, and documented engineering outcomes. Learning, building, testing, and completed work are labeled separately.

Current work is educational, testnet-oriented, unaudited, and does not handle real funds.

  1. 01 Build concrete prototypes
  2. 02 Validate security claims
  3. 03 Document decisions and limits
  4. 04 Keep evidence boundaries explicit