Architecture

Architecture thinking

Projects demonstrate what was built. This page demonstrates how I think: the recurring system shapes I design, the concerns each one must address, and the decisions behind them.

Blueprints

Five system shapes I design

Token Infrastructure

Lifecycle
  1. Token
  2. Deployment
  3. Vesting
  4. Staking
  5. Treasury
  6. Bridge
  7. Multi-chain

A token is a system, not a contract. Issuance, release schedules, incentives, treasury custody and cross-chain supply each carry their own roles, failure modes and operational owners.

  • Who can mint, pause or upgrade — and through which multisig
  • Vesting and staking contracts that cannot drain treasury under edge cases
  • One canonical supply across every chain the token lives on
  • Identical, verifiable addresses so integrators trust what they see
Applied in RBC / FRK

Real-World Assets

Compliance
  1. Asset
  2. Identity
  3. Compliance
  4. Registry
  5. Token
  6. Controlled Transfer
  7. Custody

RWA tokens must enforce off-chain rules on-chain. Transfers are only valid between verified identities, under jurisdictional and lock-up rules, with privileged agents for recovery and enforcement.

  • Identity and claim verification before any balance moves
  • Modular compliance rules that can evolve without redeploying the token
  • Agent permissions: freeze, force-transfer and recovery, tightly scoped
  • Institutional custody with approval policies for issuer and treasury flows
Applied in RealProton

DeFi Protocol

Solvency
  1. Collateral
  2. Oracle
  3. Lending
  4. Borrowing
  5. Interest
  6. Liquidation
  7. Treasury

Lending protocols are solvency machines. Every design decision — collateral factors, oracle choice, liquidation incentives — is ultimately about keeping the system over-collateralised under stress.

  • Oracle freshness, manipulation resistance and fallback behaviour
  • Collateral-ratio thresholds tuned per asset risk profile
  • Liquidations that remain profitable to execute in volatile markets
  • Reserve accounting and recovery paths when positions go under
Applied in USDAO

Cross-Chain

Interoperability
  1. Chain A
  2. Messaging / Bridge
  3. Token Representation
  4. Chain B

Cross-chain design is trust design. The question is always: who attests that an event on Chain A happened, and what does Chain B do if that attestation is wrong?

  • Burn-and-mint vs lock-and-release, and where the canonical supply lives
  • Peer configuration — only trusted remote contracts may send messages
  • Verifier / DVN configuration and the security it actually provides
  • Rate limits and pause paths if one side is compromised
Applied in RBC / FRK

Blockchain-backed Metaverse

Ownership
  1. Digital Identity
  2. Wallet
  3. Digital Assets
  4. NFT
  5. Ownership
  6. Smart Contracts
  7. On-chain Interaction
  8. Metaverse Ecosystem

When blockchain is the foundation of a metaverse rather than a feature, identity, assets and ownership become shared primitives. Every other component — DAO, DeFi, the experience itself — trusts what the contracts say a user is and owns.

  • Identities that evolve without losing ownership or authenticity
  • Explicit ownership models for every asset type
  • Permissioned metadata changes, so tokens keep their meaning
  • Interfaces other components can rely on as the ecosystem grows
Applied in Maavatar
Architecture decisions

Architecture considerations I work with

Framed as lightweight architecture decision records: the context, what I weigh, and the trade-off I accept.

ADR-01

Why CREATE2?

Multi-chain tokens are easier to integrate, audit and trust when the contract lives at the same address everywhere.

  • Address = keccak256(0xff ‖ deployer ‖ salt ‖ keccak256(initCode)) — deterministic and computable before deployment.
  • Identical addresses require an identical deployer (usually a factory at the same address) and identical init code, including constructor arguments.
  • Chain-specific configuration should move out of the constructor into post-deploy initialisation, so init code stays the same.
  • Salts and deployer keys become part of the release process — they need the same care as any other deployment secret.
Trade-offDeterminism pushes configuration into initialisation functions, which must then be protected against front-running and double-initialisation.
Applied in: RBC / FRK · G Future Tech multi-chain token infrastructure
ADR-02

Why ERC-3643?

Securities-style real-world assets cannot be freely transferable bearer tokens. The token must know who may hold it.

  • Transfers are gated by an identity registry: sender and receiver must hold verified on-chain identities.
  • Claim topics and trusted issuers define which attestations (e.g. KYC, jurisdiction) are required.
  • A modular compliance contract enforces rules — country restrictions, holder limits, lock-ups — without changing the token.
  • Agent roles support freezing, forced transfers and wallet recovery, which regulated assets need but which must be tightly governed.
Trade-offCompliance adds gas cost and integration complexity, and concentrates power in agent roles — so custody and role design matter as much as the token.
Applied in: RealProton · compliance-ready RWA tokenization
ADR-03

Why ERC-1155?

Ecosystems with identities, tiers and many asset types need more than one-token-per-contract NFTs.

  • One contract can hold many token classes — identities, NFT tiers and fungible or semi-fungible assets.
  • Batch transfers and mints reduce gas and simplify multi-asset interactions.
  • Per-token metadata URIs support dynamic metadata, but mutation rules must be designed explicitly.
  • Wallet and marketplace support is broad, which matters for ownership users can actually see.
Trade-offFlexibility moves design burden into the contract: what each token ID means, who may change its metadata, and how supply is controlled must all be defined up front.
Applied in: Maavatar · blockchain-backed metaverse identities and assets
ADR-04

Why cross-chain architecture?

A token that lives on several chains needs a single, coherent supply rather than a set of unrelated wrapped copies.

  • The OFT pattern debits on the source chain and credits on the destination, keeping total supply consistent across chains.
  • An adapter variant can wrap an existing token with lock-and-release where the original contract cannot change.
  • Each deployment must be explicitly peered with its remote counterparts; unpeered contracts must reject messages.
  • Security depends on verifier (DVN) and executor configuration — defaults should be reviewed, not assumed.
Trade-offMessaging infrastructure removes the need to build a bespoke bridge, but introduces an external trust dependency that must be documented for stakeholders.
Applied in: RBC / FRK · LayerZero OFT-oriented bridging and cross-chain supply
ADR-05

Why Fireblocks?

Institutional issuers need to operate privileged roles — minting, treasury moves, agent actions — without single-key risk.

  • MPC-based custody removes single private keys from operational flows.
  • Vault separation maps naturally to responsibilities: issuer, treasury, transfer vault, legal / administrative.
  • Policy rules and approval quorums turn operational procedures into enforced controls.
  • Contract roles should be designed with the custody model in mind, not bolted on afterwards.
Trade-offCustody platforms add operational dependency and cost; the benefit is auditable, policy-driven control over the most dangerous transactions.
Applied in: RealProton · G Future Tech wallet and treasury architecture
ADR-06

EVM + Solana

Serving users on both ecosystems means designing one product across two very different execution models.

  • EVM contracts own their storage; Solana programs are stateless and operate on accounts passed into each instruction.
  • Deterministic addresses: CREATE2 on EVM, program-derived addresses (PDAs) on Solana — similar goal, different mechanics.
  • Tokens: ERC-20 contracts per token on EVM vs the shared SPL Token / Token-2022 programs with mint and token accounts on Solana.
  • Tooling, fee models, account rent and upgrade authority all differ — so do the security review checklists.
Trade-offA shared product spec with chain-specific implementations is usually safer than forcing one chain's patterns onto the other.
Applied in: AppMindsGlobal multi-chain engagements
ADR-07

Crypto-backed vs RWA-backed models

Financial infrastructure that accepts both crypto and real-world assets as collateral has to treat them as different risks inside one system.

  • Crypto collateral is liquid and priced continuously, but volatile — liquidation must be fast.
  • RWA collateral is more stable in value but illiquid and priced slowly — it needs conservative ratios and recovery paths beyond liquidation.
  • RWA brings eligibility and transfer rules (e.g. ERC-3643) that crypto collateral does not.
  • Oracle design differs: market feeds for crypto, valuation and attestation inputs for real-world assets.
Trade-offSharing infrastructure across both models reduces duplication, but only if risk parameters, pricing and liquidation are configured per collateral type.
Applied in: USDAO · G Future Tech financial infrastructure
ADR-08

Blockchain-backed metaverse architecture

In a blockchain-backed metaverse, the chain is the source of truth for identity and ownership — so its design shapes the whole product.

  • Decide early what lives on-chain (identity, ownership, key interactions) and what stays off-chain (rendering, heavy media, AI).
  • Model identities and assets as token classes with explicit ownership semantics.
  • Control how dynamic metadata can change, and by whom.
  • Expose stable interfaces so NFT, DAO and DeFi components can build on the same primitives.
Trade-offPutting more on-chain increases trust and interoperability but adds cost and rigidity; the architecture has to evolve as product requirements change.
Applied in: Maavatar · Blockchain SME and core technical contributor
Security leadership

Security by Design

Security should appear throughout the development lifecycle.

  1. Architecture
  2. Threat Modeling
  3. Implementation
  4. Testing
  5. Static Analysis
  6. Security Review
  7. Audit Preparation
  8. Deployment
  9. Verification

Tooling

SlitherStatic analysis and detectors across the codebase
MythrilSymbolic execution for exploitable paths
MythXCombined analysis used in earlier review workflows
OpenZeppelinReviewed building blocks for access control and token standards

Practice

  • Vulnerability analysis
  • Contract testing
  • Security reviews
  • Contract reviews
  • Test-coverage reviews
  • Gas optimization
  • Audit preparation
  • Deployment verification

Security is treated as a property of the whole lifecycle — from threat modeling during architecture to verification after deployment — rather than a single audit at the end.