I fixed a vulnerability in my Solana swap and opened a panic. A property-based test found it, not me. The fix first. The reference code took token decimals as an instruction parameter, even though the Mint accounts were right there. Declare decimals_a = 0 on a 9-decimal mint and the math is wrong forever, because the value is stored when the market is created. Two lines fixed it: read the decimals from the Mint. What that fix opened: the caller can no longer lie about decimals, but the program now accepts whatever the Mint says. And an SPL mint can have any u8, from 0 to 255. 10^38 fits in a u128. 10^39 doesn't. The code did 10u128.pow(decimals) unchecked, so with a mint of 39+ decimals every swap panicked instead of returning the MathOverflow error the program already had for exactly that case. 27 integration tests never saw it. They all use 6 and 9 decimals, the range real tokens live in, which is the range anyone tests by hand. The property tests sample decimals across the full 0..255. Capping them at 38 would have been a test designed to pass. proptest shrank the failure to the smallest case that still broke: amount = 0, price = 1, dec_a = 0, dec_b = 39. The fix is a pow10() that uses checked_pow and returns the typed error. Side effect I didn't expect: the program binary shrank by 1,984 bytes. How the tests were made: Claude Code wrote them. I chose the four properties the math had to obey and checked each one by breaking the code on purpose until it went red. What I take from it: moving trust from the caller to the Mint doesn't remove the input. It widens it. Validating where a value comes from means validating its range too. xitter.cf/Ale_Beta/status/211002…

I sabotaged my CI and it stayed green. That was the correct result. Same type error, two runs: ❌ without `yarn typecheck` → green ✅ with it → red, tests never ran Vitest doesn't check types. It strips them and runs the JavaScript. So typecheck is its own step, before the tests. 🔑 A green check means nothing until you've seen it go red. Repo: github.com/alebeta06/solana-… xitter.cf/Ale_Beta/status/211002…

Spent two weeks building a rug-pull detector on Solana. Not the "we flag suspicious tokens" kind — one with a measured number next to every alert. The signal: the creator adds liquidity to its own token. 97.9% of those ended in a drain (422 of 431, 431 distinct wallets), median 8 minutes of warning before the pool went to zero. The part nobody publishes: it only catches 65.3% of pool rugs. The other 35% are dev dumps and migration pulls, where the drain IS the event — there is nothing to warn about beforehand. That's on the dashboard, not buried in a footnote. I also killed four of my own hypotheses with data. ">10 launches in 24h" as a signal: 1.0% precision. Sell-share before the drain: inverted once I fixed the liquidity metric. Both documented as discarded, with the numbers that killed them. Calibrated against 17M frames from one full night of mainnet, over Solami's Blur stream. TypeScript, 242 tests, docker compose up and it runs. Without an API key it replays a real recorded hour through the same detector. @useSolami

New project: Northwind Customer Management. A REST API in Rust with a Next.js admin panel on top. Full CRUD over the classic Northwind database (93 customers, 16,282 orders): filter, sort, create, edit and delete customers. Stack: Rust + Rocket, rusqlite (SQLite) and Docker on the backend. Next.js 15, TypeScript, Tailwind and shadcn/ui on the frontend. Backend on Render, frontend on Vercel. A CRUD looks boring from the outside. Inside, it made me deal with: - Concurrency: rusqlite's Connection isn't Sync, so Rocket won't even compile until it's behind a Mutex - Referential integrity: deleting a customer with orders returns a 409, shown as a business rule, not as an error - SQLite traps that only show up when you actually run things - A free-tier backend that goes to sleep, handled in the UI with retries instead of a red error 15 tests, clippy clean with -D warnings, and a README that explains why each decision was made. Try it, read the code, and tell me what you'd do differently: Demo: northwind-fullstack.vercel.a… (the first load can take up to a minute while the backend wakes up) Code: github.com/alebeta06/northwi… Audio note: I recorded the video in Spanish. The English you hear is YouTube's auto-dubbed track, not my voice. #rustlang