Must Know

• A blockchain is a replicated state machine whose history can have temporary competing views. “Included,” “confirmed,” “safe,” and “finalized” are different claims.
• A transaction is an adversarial input. Its sender, ordering, gas, callbacks, tokens, external data, and surrounding transactions may all be hostile.
• Contract state is public; signatures authorize messages but do not make their contents secret.
• Code correctness is not economic safety. A mathematically correct transition can encode a manipulable oracle, insolvent market, captured governance process, or unusable recovery path.
• Every privileged key and upgrade route belongs in the protocol threat model.
• Logs are not contract storage. Indexes and dashboards are derived views that must survive reorgs, backfills, duplicate delivery, and dishonest RPC responses.
• Standards specify interfaces and behavior, not universal token safety or implementation quality.
• Cross-chain messages inherit multiple consensus, finality, relayer, bridge, admin, and recovery assumptions.
• “Audited,” “formally verified,” “decentralized,” and “production-ready” require scoped evidence.
• Tests can prove the presence of checked behavior, not the absence of every bug. State assumptions explicitly.

For current pins and mutable facts, use Tools Registry, Standards Registry, and Networks Registry.