Notes& arguments

A specification is a pile of decisions, and most of them look arbitrary until you see what the alternative cost. These are the ones worth writing down.

Writing

DesignAugust 14, 2026

Forty-five bytes with nowhere to hide

Every answer a token gives about itself is a claim, and a token declaring nothing while charging two percent is simply a token that lied. The second half of the framework removes the token's opinion from the answer.

Read post — 10 min read

DesignAugust 11, 2026

The flags that name an authority

The vocabulary described what a transfer does. A review round found the hole: a token with no extensions at all reported zero, while its supply key could dilute every holder and burn any balance.

8 min read

InternalsAugust 8, 2026

What four rounds of review found

A gas cap that was not a cap, an inverse that overflowed on valid input, a vocabulary with a hole in the middle of it, and a deployment that could not be fixed. Four rounds, four findings that changed the code.

9 min read

DesignAugust 6, 2026

Finding out by losing money

There are two ways to learn how a token behaves before you integrate it. One assumes the verified source is what is deployed. The other is a sample of size one.

8 min read

InternalsJuly 22, 2026

Phases, not super calls

Letting every module override the update path and chain super looks composable. It makes execution order an accident of the inheritance list, and it sends the fee leg through checks written for user transfers.

11 min read

IntegrationJuly 3, 2026

Reproducing the K error

Same pool, same token, same two percent. One route reverts on the constant-product invariant. Four others ask the token something first, and every one of them goes through.

9 min read

InternalsJune 18, 2026

The hook is the expensive one

A transfer hook is the most costly thing this framework lets a token do to the people integrating with it. So it is built to be survivable rather than flexible.

8 min read

DesignJune 2, 2026

The flag that subsumes the others

A token whose code can be replaced can acquire a fee it never declared. A framework built on declaring behaviour cannot leave that one out, however uncomfortable it is to include.

7 min read

InternalsMay 20, 2026

Inverting a floored ratio

A caller who needs a recipient to end up with exactly N has to invert the fee function. The obvious formula is off by one for most N, and everyone who gets it wrong either overpays or reverts.

9 min read

IntegrationMay 6, 2026

What the pipeline costs

Three and a half thousand gas over a plain transfer, and none of it is discovery. Reading a token's declarations costs its transfer path nothing, and there is a test that pins it to the byte.

6 min read

DesignApril 15, 2026

Installed, not active

A token with the fee module installed and its rate at zero still declares a fee. That is the useful answer rather than a sloppy one, and the reason is what makes the word cacheable.

6 min read

DesignMarch 26, 2026

A freeze that survives the burn

Pausing a token does not stop it minting. Burning works on a frozen account. Both asymmetries read as bugs until you ask what the authority pulled the lever for.

7 min read

InternalsMarch 4, 2026

Sealing should be loud

Until an assembly seals its extension set, every discovery view reverts. A forgotten seal should be impossible to ship, not merely unlikely to be shipped.

7 min read