Aryan | timberman

Writing smart contracts, breaking them, fixing them again.
Building @LegacyForgeHQ | Solidity • Foundry • Rust
Web3 is my debug console.

[Aryan | timberman @0xtimbur]

1/5
On-chain DAO voting is broken. It secretly taxes every token holder for security.
I developed a new model to fix this. Introducing Reactive Governance: A new design for secure, scalable, AND gas-efficient on-chain voting.
🧵 Full research & solution.
https://t.co/BCPmUhaqiy

[Aryan | timberman @0xtimbur]

Just shipped the official launch for @LegacyForgeHQ

Solo dev. Zero funding. MVP done. Testnet dropping this week on Base Sepolia.

I’ve watched too many stories of families losing life-changing money because a seed phrase died with the holder. Self-custody is powerful — until it isn’t.

LegacyForge is the simplest trustless on-chain inheritance layer:
→ Factory vault
→ Beneficiary + timer
→ Proof-of-life pings
→ Auto-claim if silent

No custody. No admin keys. No bullshit.

Full thread here → https://t.co/C7ai3Iot6F

If you're a self-custody maxi, founder, or running a DAO treasury — this one’s built for you.

Testnet waitlist open: https://t.co/cpyKJ6IIb5

Let’s fix digital legacy.

[Legacy Forge @LegacyForgeHQ]

1/ What happens to your crypto when you die?

Most people don’t have an answer. $430 billion in Bitcoin is already gone forever because holders passed away without a plan. Families get nothing. Wallets sit cold forever.

LegacyForge fixes this.

[Aryan | timberman @0xtimbur]

After battling with arXiv for what felt like forever, my paper is finally out on Zenodo!
Reactive Governance: A Selective Snapshotting Framework for Secure and Gas-Efficient DAO Voting

No more constant checkpointing overhead. Just reactive balance snapshots that keep DAOs safe from flash-loan & late-stake attacks while slashing gas costs (~17k marginal gas + zero transfer overhead).

Formal model, security proofs, Foundry benchmarks + full Solidity implementation included.

Paper: https://t.co/oxTi2nXAPt
GitHub: https://t.co/2ZHXJmcswY

Would love feedback from the web3/governance crew! 🧵 #DAO #Ethereum #Solidity #BlockchainGovernance

[whizwang @whizwang]

canonically, this means tootsie roll was the first blockchain

[Polygon | POL @0xPolygon]

Every stablecoin transfer on a public chain broadcasts who sent it, who received it, and how much moved.

For a business moving money, privacy is paramount.

We just launched private payments on Polygon. Here's how it works.

[Aryan | timberman @0xtimbur]

@TawohAwa @claudeai They are using claude to improve claude 😴

[Aryan | timberman @0xtimbur]

Week-1 Day-5: EVM Portfolio Tracker (Dissertation)

Today I wrapped up Week 1 by completing the core wallet data generation and setting up the database foundation.

1. All tests passing green and wallet data successfully generated for the first time. This is the first real on-chain output coming through the pipeline.

2. Created https://t.co/hvjWsphbym: Converts raw blockchain data into clean, structured, DB-ready format. This module handles the full transformation so data can be easily ingested without any loss.

3. Created https://t.co/wUNg0rseuQ: Full Supabase client setup with connection handling, pooling configured, and basic insert/query operations tested and working smoothly.

Nothing flashy today, but these foundational pieces are making the system more solid and ready for scaling as the project grows.

Slow progress > no progress. On to week-2. ⚡
#buildinpublic #web3 #python #evm #supabase #devlog

[Mastercard @Mastercard]

@0xPolygon Building the future of global payments, together @0xPolygon! 🤝

[Aryan | timberman @0xtimbur]

Week-1 Day-4: EVM Portfolio Tracker (Dissertation)

Today was mostly about improving the data pipeline and project structure.

1. While working on https://t.co/Ij6Ed0uGnz, I realized returning the full dataset at once isn’t ideal when we’re processing data in batches.
So instead of returning everything, I switched the logic to yield results progressively. This means:
- we can process data batch-by-batch
- if some API calls fail, we don’t lose the data already fetched
- overall the pipeline becomes more resilient and memory-efficient

2. Created https://t.co/EjVAUxZnGV, which will act as the server entry point for the application. This sets the foundation for how different modules will connect and run together.

3. Cleaned up https://t.co/MEFWXqb5Ur by fixing several typos and small issues that could cause problems later.

Nothing flashy today, but these kinds of improvements make the system more reliable and easier to scale as the project grows.

Slow progress > no progress.
On to Day-5 tomorrow. ⚡

#buildinpublic #web3 #python #evm #devlog

[Aryan | timberman @0xtimbur]

Week 1 — Day 3 of building EVM Portfolio Tracker (Dissertation)

Today I built a proper token layer so I don’t have to keep re-solving the same problems in every script.

I added a token_registry.py module that works hand-in-hand with https://t.co/Ij6Ed0uGnz:

• https://t.co/Ij6Ed0uGnz handles fetching token data from the CoinGecko API
• token_registry.py sits on top as the “source of truth” for my app and adds the real-world glue:
• caching (so we don’t spam the API / speed up repeated lookups)
• blacklisting (ignore scammy/unsupported tokens cleanly)
• consistent token lookup/normalization (one clean interface everywhere)

Result: cleaner code, fewer repeated requests, and a registry I can extend later (better metadata, fallbacks, more sources, etc.)

Week 1 momentum continues — onto Day 4.

[Aryan | timberman @0xtimbur]

Week 1 dissertation progress: EVM Portfolio Tracker.

Day-2
Built https://t.co/Ij6Ed0uGnz, a small token-discovery + caching layer on top of @coingecko .

What it does:

• Fetches the valid tokens listed on CoinGecko
• Stores a local cache so I’m not hitting the API constantly
• Skips API calls if the cache was updated in the last 30 minutes
• Auto-refreshes the token list after 1 day
• Supports an automatic blacklist (tokens I want to exclude from cache/refetch)
• Re-checks blacklisted tokens after 3 days via API (in case they become valid again)

Question for the readers:

• If you were building this, would you prefer blacklist re-checks to be time-based (like now) or event/threshold-based (e.g., only when a token is requested X times)?

[Aryan | timberman @0xtimbur]

My Cyfrin's progress is stuck rn, will start to work on it again as soon as I get the Dissertation to a MVP stage.
Rn I'm fully invested in this, I have been working on the idea for a while now, finally landed on one.

[Aryan | timberman @0xtimbur]

Dissertation topic locked: EVM Portfolio Tracker.

Week 1 goal: get the data layer working (CoinGecko + Etherscan) before I even think about UI.

Today’s build:
• Started with Etherscan (Ethereum only for now)
• Pulled wallet transaction history
• Normalized the response: filtered out the noisy fields + kept only what I actually need for later calculations/UX
• Saved the cleaned output into a JSON file as a quick local cache so I can iterate fast without repeatedly hitting the API

I’m treating this as the “boring but necessary” foundation: once the data shape is stable, everything on top (portfolio value, PnL-ish views, charts, UI) becomes way easier.

Next: add token transfers/internal txs + plug in CoinGecko pricing to compute current portfolio value.

[Aryan | timberman @0xtimbur]

@sandeepnailwal This is the right framing: “agents” don’t matter until they can hold keys + settle payments reliably. Curious how you’re handling (1) key mgmt (MPC vs smart accounts vs custodial), (2) per-agent limits/policies, and (3) cross-chain + compliance defaults. Docs link?

[Aryan | timberman @0xtimbur]

Day 8 of Cyfrin Updraft Puppy Raffle audit grind 🔥
Dived deep into recon + multiple exploit classes today:

• Finished initial docs & code walkthrough (smelled a bug early 👀)
• Studied sc-exploits-minimized repo
• Denial of Service: theory → minimal PoC → real cases (GMX V2 + Bridges) → Puppy Raffle unfair late-entry DoS attack + report + mitigation (remove duplicates!)
• Business logic edge case: smart contract players
• Reentrancy deep dive: Puppy Raffle deposit→withdraw loop exploit → Remix drain demo → CEI + nonReentrant fixes → The DAO history lesson

Reentrancy still menaces society 😈
Onward to more bugs 🕵️‍♂️
#SmartContractAudit #EthereumSecurity #CyfrinUpdraft

[Aryan | timberman @0xtimbur]

@pranaykargam @CyfrinUpdraft Cool! 🔥

[Aryan | timberman @0xtimbur]

Reentrancy Guards in Solidity: Basics + Why They Matter + OpenZeppelin's Latest Upgrades 🔥
Reentrancy = deadly vuln where attacker re-calls your function mid-execution → drains funds (e.g., DAO hack ~$60M lost).
Guards lock the function during external calls to prevent this.
Why reentrancy guards are essential:

- Block multiple withdrawals before balance updates
- Enforce Checks-Effects-Interactions (CEI) pattern: Check → Update state → External calls
- Prevent massive DeFi/NFT losses
- Must-have for any function with external calls + state changes

Classic OpenZeppelin ReentrancyGuard (still default in v5.5+):

- Uses persistent storage slot to track "entered" state
- Cost ~2,000–3,000 extra gas per call (SLOAD/SSTORE)

OpenZeppelin's big shift (v5.1+ post-Dencun/EIP-1153):

- Added ReentrancyGuardTransient variant using transient storage (temp per tx only)
- No persistent writes → gas savings of ~50–70% (often 2,000+ per guarded call)
- Same security, cheaper, greener, no chain bloat
- ReentrancyGuardUpgradeable removed (stateless Transient works with proxies, no storage vars needed, flagged as "stateless" in releases)
- Not default yet (use Transient explicitly for efficiency), but community notes suggest classic may deprecate soon

Bottom line: → Always CEI + guards in prod → Use @openzeppelin/contracts/utils/ReentrancyGuardTransient.sol on modern chains for wins → Massive gas boost for high-traffic protocols

Switching to Transient yet? Share your gas savings or fave reentrancy story 👇
#Solidity #Web3Security #Ethereum #OpenZeppelin #SmartContracts

[Aryan | timberman @0xtimbur]

Day 7 of Cyfrin Updraft grind + Solidity security learning 🚀
Back after a busy IRL, streak alive! Kicked off Section 4: Puppy Raffle audit in @CyfrinUpdraft's Auditor track (the big DeFi-style mock raffle).
Covered so far:
- Intro & Primer: Overview of the contract & bug-hunting flow
- Phase 1: Scoping — codebase/Git/Foundry setup, test coverage, security view, exploits prep
- Tooling: Slither (Trail of Bits static analysis — non-exec bug detection) introduced by Patrick
- Tooling: Aderyn (Rust-based static analyzer by Alex Roan — quick vuln flags)

Biggest aha: Tools like Slither/Aderyn give instant red flags (reentrancy guards? weak randomness from timestamp?) before manual review — huge time-saver in real audits.
Puppy Raffle feels way more complex than PasswordStore, excited for the vulns ahead.

Next sessions: Dive deeper into manual review & specific exploits.

Who's deep in Puppy Raffle? Share Slither/Aderyn tips or fave bug you spotted. Dissertation leaning: Vuln detection tool integrating static tools like these?
#Solidity #Web3Security #Cyfrin #SmartContractAudit #Blockchain #CryptoIndia

[Aryan | timberman @0xtimbur]

@rosarioborgesi @CyfrinUpdraft @buidlguidl Amazing! 🔥

[Aryan | timberman @0xtimbur]

@_mannythegreat_ Sure! 🔥

[Aryan | timberman @0xtimbur]

Day 6 of Cyfrin Updraft grind + Solidity security learning 🚀
IRL work ate the day today, no new modules, but checking in to keep accountability. First full audit (PasswordStore) still fresh in the brain: access control PoCs, severity ratings, PDF reports, Docker key protection.
Reset mode: Back tomorrow for Section 4 – Puppy Raffle (reentrancy + randomness vulns incoming). Who's audited Puppy Raffle? Any early scoping tips or fave vuln you found?
Dissertation still leaning vuln detection tool (auto-flagging access control + reentrancy patterns). Let's go.
#Solidity #Web3Security #Cyfrin #SmartContractAudit #CryptoIndia

[Aryan | timberman @0xtimbur]

@valxxntino Happy Birthday 🎂