Ethskills

Critical Standards

• ERC-8004: Onchain agent identity registry. Deployed January 2026 on 20+ chains. Production-ready.
• x402: HTTP 402 payment protocol for machine-to-machine commerce. Production-ready.
• EIP-3009: Gasless token transfers — what makes x402 work. USDC implements it.
• EIP-7702: Smart EOAs. Live since Pectra (May 2025).

Verified Contract Addresses (Base)

• USDC: 0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913 (6 decimals!)
• WETH: 0x4200000000000000000000000000000000000006
• Uniswap V3 Factory: 0x33128a8fC17869897dcE68Ed026d694621f6FDfD
• Uniswap V4 PoolManager: 0x000000000004444c5dc75cB358380D2e3dE08A90
• Aerodrome Router: 0xcF77a3Ba9A5CA399B7c97c74d54e5b1Beb874E43
• Multicall3: 0xcA11bde05977b3631167028862bE2a173976CA11
• Safe Singleton: 0x41675C099F32341bf84BFc5382aF534df5C7461a

Security (Top Mistakes)

• USDC has 6 decimals, not 18. #1 "where did my money go?" bug.
• Always use SafeERC20 — USDT doesn't return bool on transfer().
• Never use DEX spot prices as oracles — flash loans manipulate them in one tx.
• MEV: sandwich attacks steal value from swaps. Use Flashbots Protect or slippage limits.
• Never commit private keys or API keys to Git. Bots exploit leaked secrets in seconds.

Hyperstructure Mental Model

Smart contracts cannot execute themselves. Every function needs a caller who pays gas. For every state transition: who calls it? why would they? what if nobody does? There are no timers, no cron jobs, no schedulers. Design with incentives.

Deep Dives (fetch when needed)

• ethskills.com/ship/SKILL.md — End-to-end build guide
• ethskills.com/security/SKILL.md — Full security patterns
• ethskills.com/building-blocks/SKILL.md — DeFi composability
• ethskills.com/addresses/SKILL.md — All verified addresses
• ethskills.com/audit/SKILL.md — 500+ item audit checklist