Capstone Projects

Decentralized Exchange (AMM + Router) — constant-product pools with a factory (CREATE2 pair addresses), router with multi-hop swaps, slippage and deadlines, LP tokens, a TWAP oracle, and a React/wagmi frontend. *Concepts:* ERC-20, CREATE2, math precision, reentrancy, events, fork testing, frontend integration.

Over-collateralized Lending Protocol — supply/borrow two assets, interest-rate model by utilization, health factor, liquidations with bonus, Chainlink oracles with staleness and sequencer checks. *Concepts:* interest indices, oracles, liquidation incentives, invariant testing, rounding, access control.

ERC-4626 Yield Vault with Strategy — vault that deploys assets into a strategy (e.g., a mock lending market), harvests yield, charges performance fees, and defends against inflation attacks. *Concepts:* ERC-4626, SafeERC20, share accounting, fee math, fuzz/invariant tests, upgradeability (UUPS).

NFT Collection + Marketplace — ERC-721 with Merkle allowlist, reveal via Chainlink VRF, ERC-2981 royalties, on-chain or IPFS metadata, and a marketplace with EIP-712 signed listings and offers. *Concepts:* ERC-721, ERC-165, ERC-2981, Merkle proofs, VRF, EIP-712, pull payments.

DAO with Treasury — ERC20Votes governance token, OpenZeppelin Governor + TimelockController, treasury multisig fallback, proposal UI that encodes calldata, and simulations of proposals on forks. *Concepts:* checkpoints, delegation, governance lifecycle, timelocks, ABI encoding, security of upgrades via governance.

Smart Account (ERC-4337) Wallet — account with ECDSA and passkey (P-256) signers, session keys, batched execution, a paymaster that sponsors gas for whitelisted actions, and a counterfactual factory. *Concepts:* ERC-4337, EntryPoint, CREATE2, ERC-1271, signatures, EIP-7702 awareness, gas accounting.

Upgradeable Token Bridge (Lock-and-Mint) Simulator — lock tokens on chain A, mint wrapped tokens on chain B through a mock relayer with signed messages, rate limits, pause, and replay protection; later swap in Chainlink CCIP. *Concepts:* signatures and replay protection, chain IDs, UUPS proxies, ERC-7201 storage, rate limiting, incident response.

Security Capture-the-Flag Suite — build ten intentionally vulnerable contracts (reentrancy, oracle manipulation, signature replay, delegatecall collision, DoS, front-running, unsafe casts, uninitialized proxy, tx.origin, rounding) each with a Foundry exploit test and a fixed version. *Concepts:* every vulnerability class in Chapter 33, Foundry cheatcodes, fork testing, Slither/Aderyn, writing audit-style reports.