DeFi & on-chain skills.

How an on-chain transaction actually works

When you click "confirm" in MetaMask, your wallet signs the transaction with your key and broadcasts it. It doesn't land instantly — it goes through three stages:

What a smart contract is

A smart contract is just a program that lives on the blockchain. Instead of a company running the code on its servers, the code runs on the chain itself, and anyone can read it and call it. Aave is a smart contract that lends and borrows. Uniswap is a smart contract that swaps tokens. There is no "Aave company" holding your deposit — there is a contract, and the rules are the rules, visible to everyone.

That's the power and the danger. The code does exactly what it says — no more, no less, no human to appeal to. A good contract is audited and battle-tested. A malicious one can be written to drain anyone who interacts with it. Which is why the next skill matters so much.

Reading a block explorer like a pro

Arbiscan, Basescan, Etherscan — same tool for different chains. Paste any address or transaction hash and you see the unvarnished truth: balances, every transaction, the contracts an address has interacted with, and crucially the token approvals an address has granted. Get comfortable here. When something looks wrong in an app, the explorer tells you what actually happened on-chain.

Aave 101 — earning yield on USDC

Aave is a lending market. You deposit USDC, borrowers pay interest, you earn a slice of it — typically a few percent a year, paid continuously. No lock-up; withdraw any time. It's one of the safest, most audited protocols in DeFi, which makes it the right first stop.

The trade-offs to understand: the yield floats with demand (it's not a fixed rate), and like any contract it carries smart-contract risk — small for Aave, never zero for anything. You're trading a bank's deposit insurance for transparency and self-custody.

Curve 101 — providing liquidity

Curve lets you provide liquidity — deposit a pair of stablecoins into a pool that traders swap against, and earn a share of the trading fees. For stablecoin pools the risk is low because both sides are pegged to a dollar, so they don't drift apart. (Volatile pairs introduce "impermanent loss," which the Academy LP modules cover in depth — that's a deliberately bigger topic.)

Token approvals — the trap that drained billions

Before a contract can move a token on your behalf, you grant it an approval. Most apps, by default, request an unlimited approval — permission to move all of that token, forever. If that contract is later exploited, or was malicious to begin with, the attacker can drain everything you approved, even years later.

• Approve only what you need. When MetaMask shows an approval, edit the amount to the trade size where you can.
• Audit and revoke regularly. revoke.cash lists every approval you've ever granted and lets you cancel stale ones. Make it a monthly habit.
• Read the signature. If a "claim free airdrop" site asks you to approve access to your tokens, that approval is the rug. The airdrop is bait.

Common scams

• Fake tokens. A worthless token appears in your wallet to lure you to a malicious site to "sell" it. Ignore unsolicited tokens entirely.
• Drainer signatures. A signature request that isn't a normal transaction — it's granting sweeping permissions. If you don't understand exactly what you're signing, reject it.
• "Free airdrop" rugs. The claim flow asks for an approval that hands over your funds. Free money that needs your approval to access isn't free.

Practice exercise

Deposit $50 of USDC into Aave on Arbitrum. Let it sit for a day and watch the balance tick up by a fraction. Withdraw it. Then go to revoke.cash and look at the approval you granted — practise revoking it. You've now lent on-chain, earned real yield, and learned the single most important defensive habit in DeFi.