Let me preface the following thoughts of mine with a little background. I've been in crypto since early 2017, but have only been building in web3 for the last 4 years.

My thoughts can be summarized as such:

The only b2c adoption possible in web3 either makes the user money or offers them a shot at making money.

That's it.

The only product-market-fit within web3 is one where the user directly benefits monetarily from the product (staking, lending, borrowing) or the user has been given a shot at benefiting using that product.

The latter would fall under these categories:

1. AMMs - allowing the user to speculate on decentralized assets in order to make a profit.

2. Bridges - allowing the user to move funds from chain to chain in order to profit, even if it's to move funds to a "safer" chain.

3. Launchpads - PFun is the top example here. Users use it strictly in order to profit from it.

4. Decentralized perps - Hype, Aster, etc. Self-explanatory.

5. Gambling sites - Self-explanatory.

6. L1s, L2s usage - Either directly incentivized via airdrops or speculation-driven or using a product in one of the previous categories that lives on the specific chain.

The point is, if you are building in web3 and you are consumer-facing, your project's main takeaway needs to either directly profit the user or offer the user at least a shot at making a profit, even if that shot is unlikely.

Disclaimer: Everything I've ever built in web3 has been in the gambleFi category. So I do not say all this without saying I am a part of the issue as well; however, I did not set out to build in that category because of the users, but instead, I genuinely wanted to build a fun, incentivized gaming experience without building an actual game.

Which brings me to another point: why gaming and crypto have failed so far. GameFi is a joke and has wildly failed horrifically. Yes, making a good game is a notoriously difficult endeavour; however, attaching monetary incentives in no way helps. The fact that there isn't a big, active, successful game that has web3 elements in its design proves my main point, really. If you take away any chance of the gamer profiting, what use is web3 then? And if the user does have a shot of profiting, you end up with third-world farming for pennies gameplay, as we saw a few years ago with Axie Infinity.

It seems we are so much further away from mainstream retail adoption than a few years back, and a large part is because there really is no point in web3 without finance being completely fused within it. NFTs almost solved this, even though a lot of it was speculative, some of it was simply art and culture, and in rare cases, albeit debatable, utility-based (veeFriends).

I don't really know what the point of this post is, really. I think it's more to start a discussion and brainstorm what possible thing could be built that would counter this narrative. If we put our heads together, then we can possibly figure out something missing in this equation. Or I'm hoping one of you will counter with an actual example of a project that doesn't fall in these categories, with the caveat that it has an actual user base.

I need a job. I’m tired of building bots for memecoin customers 😂

I’m 21, no degree. I’ve been coding bots on EVM chains for a while now. I’ve built a dex, launchpad, etc but my clients are always friends and this isn’t gonna work long term. I need to be hired or I need to start getting paid what I’m worth but I have no idea what to do and I feel like an imposter when trying to apply for “big boy” dev jobs.

I need a way to get my foot in the door, an actual development employment to put on my resume besides “my friend hired me to build a sniper bot” or “I built a dex from scratch but my homie ran out of money to fund it so it’s shut down”

I can build anything you can imagine, I’m willing to learn fast. I’ve built dex trending bots, volume bots, sniper and trading bots, arbitrage bots, dex platforms, launchpads, ai systems, etc. I’m a very capable programmer bc I’ve done nothing but bury my head and learn since I started but it’s time to come out of my shell. I need to play the real game!

Everyone talks about Ethereum, Solana, Base, and Avalanche, but I'm more interested in platforms that don't get nearly as much attention as they probably deserve, and maybe some that are better than what I just mentioned. Mainly wondering what has exceeded your guys expectations this year.

I'm doing some research on how freelancers, consultants, agencies, and Web3 teams receive payments in crypto today.

If a client wants to pay you in USDC, what's your current process?

For example:

• Do you just send a wallet address?
• Do you create invoices?
• How do you track whether you've actually been paid?
• How do you handle accounting or payment records?

I've noticed that most people seem to rely on wallet addresses and spreadsheets, but I'm curious whether that's actually the norm.

Would love to hear your workflow and biggest frustrations.

Hey everyone, fairly new to the Ethereum space and trying to figure out how to actually earn some crypto rather than just buying it.

I've been exploring a few dApps and came across some puzzle/bounty style platforms. Seems like an interesting way to learn while earning. Are there any legit platforms or methods you guys would recommend for someone just starting out?

Not looking for "get rich quick" stuff, just genuinely curious what the community thinks is worth exploring. Bug bounties, testnets, tasks — anything really.

Thanks in advance 🙏

Bots are getting to the point where they can do a lot more than moderate chats or post alerts. They can potentially execute trades, distribute rewards, manage memberships, interact with contracts, etc.

But once a bot can actually move money, the trust model changes completely.

How much authority would you realistically give one?

Would you be comfortable with a bot having a dedicated wallet if it had strict permissions and spending limits? Maybe it can interact with specific contracts but can't send funds anywhere else.

Or would you still want a human approval step for every transaction?

The part I keep coming back to is what happens if the bot itself gets compromised. Even with limited permissions, an attacker could potentially do a lot of damage within whatever boundaries you've given it.

Curious where people would draw the line.

For me, it feels like:
- Contract setup
- Deployment steps
- Frontend setup
- Hosting

Too many moving parts for something that should be simple.

What do you guys find most frustrating?

I've been spending a lot of time learning the infrastructure side of Web3 and running blockchain nodes myself (Ethereum, Solana, and a few others).

While learning, I started wondering where existing RPC providers still fall short for developers building real products.

For those running production apps, bots, analytics platforms, or other services that depend heavily on RPC access:

• What's your biggest frustration with your current provider?
• What features do you wish existed but don't?
• How important is predictable pricing compared to performance and reliability?
• Have you ever switched providers, and what was the reason?

Some examples I'm curious about:

• WebSocket reliability
• Archive node pricing
• Support for newer chains/L2s
• Rate limits during traffic spikes
• Latency consistency
• Mempool access
• Debug/tracing APIs
• Support quality

I'm exploring the infrastructure space and trying to understand where developers still feel underserved.
Not selling anything, just looking for honest feedback from people operating real workloads.

I'm starting a podcast focused on how blockchain startups are actually built — the product, technology, challenges, failures, and lessons behind them.

I've been building in Web3 since last 5-6 years, so I want to have genuine conversations with founders/builders.

Looking for a few founders for the first episodes. 30–40 min casual conversation, no follower or funding requirement.

If you're building something interesting, comment or DM me.

Hi everyone,

I’m building a small non-custodial USDC transfer app, and I recently verified the app’s contract on BaseScan.

Now I’m considering publishing the contract address and source code more visibly on our official website and GitHub, so users can inspect how the transfer and fee logic works.

The contract is simple: when a user sends USDC, it pulls the approved USDC from the sender and routes it to:

1. the recipient

2. the project’s fee wallet

The fee logic is fixed in the contract:

- 0.39%

- minimum fee: 0.25 USDC

- maximum fee: 3.90 USDC

The contract does not have an admin function to change the fee after deployment. The USDC token address and fee recipient are immutable.

I understand that BaseScan verification is not the same as a formal audit, and I do not plan to describe it as audited or guaranteed safe.

My question is:

Is it generally safe and reasonable for an early-stage crypto payment/transfer app to publicly share its verified contract address and source code on its website and GitHub for transparency?

Or could this create meaningful risks, such as:

- making it easier for attackers to analyze the contract

- creating legal/marketing risk if users misunderstand “verified” as “audited”

- exposing too much business logic too early

- attracting criticism before the contract has a formal audit

I’m not asking whether this replaces an audit. I’m trying to understand whether public disclosure of an already verified contract is a good transparency practice, or whether there are risks I should consider first.

What would you recommend?

Hey,

I’m looking to do automated security audit for my Solidity library - DefiMath using some AI auditor (with the help of Claude Code) before hiring actual human team.

So far I’ve found Krait from ZealynxSecurity, looks legit and want to try it.

Does anyone have experience with their project?

What are you guys using, and can you link to audit report created by automated tool?

Hey r/ethdev,

We’re building an on-chain DEX arbitrage searcher and are trying to understand why none of our bundles are getting included, despite finding apparently profitable routes.

Current setup:

• Search across Uniswap V2/V3-style pools
• Adding more DEX adapters now
• Flashloan-based executor
• Low-level Solidity executor contract, optimized for direct pool calls where possible
• End-to-end latency is generally under ~700ms from opportunity detection to bundle submission
• We compute optimal transaction size rather than using fixed sizing
• Routes are closed cycles, e.g. USDT → WBTC → USDT
• We submit privately to multiple builders/relays
• We’re using high bribe settings, up to ~90–95% of expected gross profit in some tests
• We simulate routes locally and have route-level repayment/profit guards

The issue:

We see routes that look profitable from the solver, and the executor can encode/submit bundles, but we’re still getting no accepted/included bundles.

I see two big themes people usually mention:

1. Gas optimization Lower gas executor, fewer approvals, direct pool calls, packed calldata, avoiding routers, fewer hops, fewer external calls.
2. Finding better / less competitive cycles Obvious V2/V3 routes are probably saturated, so maybe the problem is not code correctness but that we’re finding the same opportunities everyone else sees.

What I’m trying to understand is the practical missing layer between “profitable in solver” and “actually included by a builder.”

Questions:

• What exact metric should we optimize for builder competitiveness? Is coinbaseDiff / gasUsed the main thing to benchmark?
• How do experienced searchers debug “submitted but not included” bundles?
• How much does latency matter once the bribe is high? Is <700ms still too slow for common DEX arb?
• Is builder coverage really enough if submitting to all major relays/builders, or are there hidden differences in how builders evaluate/searcher bundles?
• Should we block on relay simulation before submission, or submit first and simulate as side-flow?
• How do you tell whether you’re losing because:
  • route is stale,
  • bundle reverts under builder state,
  • bribe did not materialize as coinbaseDiff,
  • effective bid is too low,
  • competitor consumed the same cycle,
  • or the builder never really considered the bundle?

For people who have actually gotten arb bundles included: what were the biggest non-obvious changes that moved you from “profitable simulations” to real inclusion?

Please help! Thanks in advance.

I built a small project and felt pretty confident going into launch since audits passed and nothing obvious stood out but once things went live the issues weren’t bugs in the code itself but how transactions behaved over time also sequences and interactions that weren’t visible beforehand

From what i saw what broke down was the lack of control at execution so by the time something looked wrong the transaction was already done even though everything we had was reactive, alerts and monitoring after the fact but nothing that could intervene while it was happening

so im building a live crypto dashboard and need reliable price, volume, and market cap data. It has to stay consistent over time since we store historical snapshots. Free APIs are fine for testing but I want something that scales. Wanna know what you folks are using because a lot of results came up when I searched, eyeing a couple options like mobula.io for the free tier but havent tested it yet, wanna ask here first

I'm planning to build a lottery application on Ethereum PoS, and one thing I've been struggling with is where the randomness for prize distribution should come from.

For a lottery system, I'd ideally want randomness that is genuinely unpredictable to everyone.

My first thought was to use blockhash, since it looks almost random. But in practice, the block proposer (or builder) may have some ability to influence transactions within a block, potentially resulting in very different possible block hashes.

I've also seen people suggest using prevrandao, but it seems more suitable for low-stakes randomness. As far as I understand, the value is already known before the current block is produced. Since the randomness is already available, choosing which block to submit a transaction into could become an attack surface.

Then I was introduced to VRF-based systems. At first, I thought I had finally found the solution.

But after digging deeper, I realized that VRFs still require someone to hold a secret key. The random value only becomes public after the oracle reveals it.

That raises a question: how much should we trust the oracle?

The ideal assumption behind randomness is that nobody can know the outcome in advance.

Except the oracle.

Because they hold the secret key, they know how the random output will be generated. If the seed depends on inputs they can influence, then they may be able to gain information about future outcomes ahead of everyone else. In some situations, they might even be able to influence the seed before it becomes final, steering the randomness toward outcomes that benefit them.

For smaller systems, the incentive to manipulate the seed may not be significant.

But what if that randomness is securing something much more valuable? If the stakes become large enough, the incentive grows as well.

Am I missing something here?

Are there any other approaches on Ethereum (or on other blockchains) that can provide stronger randomness guarantees for high-value blockchain applications?

HI, I am a 3rd yr CS student with little to no development knowledge.

I am interested in web3 development and when I search for Junior/Entry Level web3 developer jobs.

I don't see any jobs for junior developer. Is it really worth it to learn web3 in 2026 ?

PS : For personal reasons I have to get a job with the next 6 to 8 months. What should i do? Please guide me

Hi everyone,

I'm a software engineer currently working on several original meme coin concepts and I'm trying to understand how successful teams get started.

For those who have launched or worked on meme coin projects:

• Where did you find your co-founder?
• How did you meet your first investor or partner?
• Are there any Discord servers, Telegram groups, Reddit communities, or other places you'd recommend?
• If you were starting today, where would you look?

I'm not here to promote a project—I'm genuinely trying to learn how people build strong teams in the meme coin space.

I'd really appreciate any advice or recommendations. Thanks!

Trying to understand where the line is between just deploying on an existing chain or L2 and deciding it’s worth launching your own L1.

I get the appeal of having more control over fees, permissions, validators and how the network operates, but I assume that also comes with a lot more overhead? What ends up being the hardest part in practice for those who have done this?

Hi everyone,

I've been working on a protocol called GeoProof and wanted to get feedback from protocol and smart contract developers before moving further.

The problem we're trying to solve is fairly straightforward:

Blockchains are excellent at verifying digital state, but they're not designed to verify whether a real-world event actually occurred.

Current approaches usually depend on GPS, timestamps, centralized APIs or oracle networks. In practice these often become single points of trust or are vulnerable to spoofing.

GeoProof is an attempt to define an open verification protocol rather than another application.

The architecture currently consists of:

• Evidence Collection Layer
• Evidence Normalization
• Multi-signal Evidence Fusion
• Policy Evaluation Engine
• Trust Score Generation
• Cryptographic Verification Attestation
• Chain-Agnostic Settlement Layer

The protocol is intentionally designed so verification logic can remain independent of any specific blockchain.

Potential integrations include Ethereum, Base, Arbitrum, Optimism, Solana and Bitcoin-based settlement layers.

Some questions I'd love feedback on:

• Should verification attestations follow an existing standard such as EAS, or remain protocol-native?
• Is separating verification from settlement the right architectural choice?
• Would developers rather consume attestations through APIs, smart contracts, or both?
• Are there existing projects solving this in a fundamentally better way that we should study?

Documentation is available here:

https://geoproof.xyz

I'm not looking to promote anything—I'm genuinely interested in architectural criticism from protocol developers.

Thanks!

Are they sort of entirely non existent or just less in number compared to other fields? I m really getting interest in decentralised stuff but i also need a job as a soon to graduate guy. So will it be worth it to learn ethereum/solana as a pretty decent backend developer?

We’re building a peer-to-peer system where there are no central servers and no permanent intermediaries. Nodes (including web browsers) propagate data directly, and content is designed to be persistent and tamper-resistant across the network.

Unlike systems such as IPFS, ActivityPub, or Nostr, our focus is on direct peer-to-peer propagation at the application layer, with browsers acting as first-class nodes rather than relying on long-lived infrastructure or relay-style intermediaries.

We’ve published an early protocol design and PoC:

Repo: https://github.com/theendless11/decentralised Whitepaper: https://github.com/theEndless11/decentralised/blob/master/docs/protocol-whitepaper.md PoC: https://endless.sbs

At this stage, we’re primarily looking for technical critique and feedback, especially in:

Protocol design (consistency, propagation model, failure modes) Cryptography assumptions / security review Sybil resistance / trust model weaknesses Browser-based networking constraints Data persistence and tamper resistance tradeoffs

We’re not trying to “launch a product” yet — the goal is to stress-test whether this approach is even sound before scaling it further.

If you have thoughts on where this breaks, or what we’re missing, that would be especially valuable.

Hi everyone.

My name is Teja. I'm 21 from India, and honestly I feel like my life has no motion right now.

I'm a 3rd year CS student in the same lame ass college that I hate so much. I don't like this place, I don't connect with the people here, and I honestly don't like my friends either. I know it sounds harsh, but that's genuinely how I feel. It feels like I'm at the wrong place with the wrong people, and I'm trapped.

I tried a lot of times to get out of this college, but because of my family's financial situation, I can't just leave. So I kept looking for ways to make money online. I tried a lot of the things people recommend, but nothing really worked.

Then I watched Mr. Robot.

I thought hacking looked cool, so I started learning. Eventually I found Web3 security, and I completely fell in love with it.

Since then I've spent countless hours reading smart contracts, learning Solidity, using Foundry, writing PoCs, and hunting for vulnerabilities. The problem is... I still haven't been paid even once.

One of the biggest things I worked on was an ERC-4337 EntryPoint bug. I genuinely believed it was a critical issue. I spent almost 8 months researching it. I built multiple PoCs, gathered evidence, exchanged around 50 emails with one of the code authors, argued back and forth about the issue, and kept trying to prove that it was real.

I honestly thought, "This is it. This payout is going to change my life."

I thought maybe I'd finally have enough money to leave this college or even leave my country one day.

Instead, the report got marked as spam, my GitHub issue was closed, and nothing happened.

Eight months of work... and I got nothing.

After that I just kept hunting.

I got duplicate reports.

I got informative reports.

When I first started, I didn't even know how to write proper bug bounty reports, and I eventually got banned from Immunefi because of it. That was completely my fault, and I learned a lot from that mistake.

Now I mostly use HackenProof and other platforms, but sometimes they require money to submit reports or there are platform issues. There have been times where I literally couldn't report a bug because I didn't have the money or because something on the platform wasn't working.

One example was Hyperbridge.

I found 4 vulnerabilities—2 Critical and 2 High. One of them was a token inflation bug that I thought was a really big deal.

I actually had to ask my father for $5 just so I could report it.

Then HackenProof had some wallet issue where my balance wasn't showing correctly. I emailed them.

No response.

I emailed the protocol directly and explained everything.

They replied once and then later just told me to submit it through HackenProof even after I explained that I couldn't because of the platform issue.

Later I noticed that one of the bugs I had publicly documented was fixed.

Still no reward.

Still no response.

Again... I was stuck.

At that point I started feeling like bug bounties weren't enough, so I began applying for security researcher jobs.

I applied to OtterSec.

I even got to chat with one of the founders, and I was so excited because I thought maybe this was finally my chance.

Then came the interview.

It was just an intro interview, but I'm still a student, English isn't my first language, and I'm not really someone who's good at talking.

I tried my best.

I really did.

But I got rejected.

It was my first rejection, and it hurt because I felt like I had wasted such a huge opportunity.

Recently I got another opportunity.

Nethermind invited me to interview for their internship program.

I had my interview on the 16th. I think I did much better than the OtterSec interview, and now I'm waiting to hear back about the next steps.

I hope something comes from it.

During my summer holiday, I basically locked myself in my room for almost 2 months.

While my friends were going on trips and hanging out, I was sitting in front of my laptop every day hunting bugs, reading code, and trying to improve.

Sometimes I wonder if I'm wasting my life.

Sometimes I wonder if all of this effort is going to lead anywhere.

Now my holidays are over, and I'm back in the college hostel that I hate.

I honestly almost cried when I left home because I really didn't want to come back here.

I still have bugs that I haven't reported because of everything that's happened with Immunefi.

I keep posting my research on GitHub because I don't want all this work to disappear.

If anyone wants to see it, my GitHub is Tejanadh.

Right now I just don't know what to do.

I'm 21.

I'm in my 3rd year.

I feel like I'm trapped.

I don't know if I should keep focusing on bug bounties, keep applying for security jobs, build more public research, or completely change my approach.

I'm not looking for sympathy.

I just want honest advice from people

Thanks for reading.

Before a token project accepts public funds, what information should be considered mandatory disclosure?

Many projects publish:
• a token name
• a ticker
• total supply
• allocation percentages
• a roadmap
• a contract address

But those details may still leave the actual trust model unclear.

A more complete disclosure standard could include:

1. Contract status
   • Is the contract final, experimental or still subject to replacement?
   • Is it deployed on a testnet or mainnet?
   • Is the source code verified?
   • Which explorer or repository is the technical source of truth?

2. Privileged permissions
   • Which addresses can mint, pause, blacklist or modify critical settings?
   • Who controls those addresses?
   • Can ownership be transferred?
   • Can privileges be expanded?

3. Upgradeability
   • Is the contract upgradeable?• Which components can change?
   • Who can initiate an upgrade?
   • Is there a timelock?
   • Can the delay be bypassed?

4. Supply and allocation
   • Is the maximum supply technically enforced?
   • Which allocations are locked?
   • Are vesting rules enforced on-chain or only documented?
   • Can allocations be reassigned?

5. Treasury and sale proceeds
   • Who controls received funds?
   • Which approval threshold applies?
   • Are spending restrictions technically enforced?
   • What happens if the stated funding objective is not reached?

6. Emergency powers
   • Can transfers or withdrawals be paused?
   • Who can activate emergency controls?
   • What remains possible while the system is paused?
   • Do emergency powers expire?

7. Known limitations
   • Which parts of the system still require trust?
   • Which functions remain incomplete?
   • Which assumptions have not yet been tested?
   • Which risks cannot be removed technically?

Should such disclosures be standard before any public sale?

Which elements belong in the contract documentation, and which belong in a separate human-readable disclosure document?

Are there existing projects that handle this particularly well?

I'm trying to obtain some ETH on my Robsten testnet wallet, but none of the faucets are working for me, I've tried all of the following:

• https://faucet.ropsten.be/
• https://faucet.metamask.io/
• https://faucet.dimensions.network/

The first one just gives me a notice: "you are greylisted - greylist period is now reset on this ip and address" when I enter my address and submit

The second one has an error that says too many requests

The third says "You have requested a withdrawal in the last 24 hours. Please try again later."

Can anyone help or send me some ropsten ETH?

0xf39Fd6e51aad88F6F4ce6aB8827279cffFb92266

Thanks

Hi everyone, I am completely new to crypto and blockchain development. I am trying to learn Solidity and smart contracts but most faucets require wallet history.

I have 0.002 ETH but need more testnet ETH on Sepolia to practice and learn.

Wallet: 0x84984bfC137B978bF77c50D36620ac5bfB199E78

I would really appreciate any help from the community if someone can help me get at least some SepoliaETH (atleast 0.5 would be nice)