Blockchain basics for infrastructure people

In one line

A blockchain is a replicated append-only log run by servers that do not trust each other. Ethereum adds a virtual machine on top, so programs (smart contracts) live on that log, hold money, and can be called by anyone.

Why it exists

The story in five steps.

2009, Bitcoin: a shared ledger nobody owns. Thousands of servers each keep a full copy of one table: who owns how many coins. New rows arrive in batches called blocks. To rewrite history you would have to outvote or out-compute the whole network. It does one thing: move coins from A to B.
2015, Ethereum: put programs on that ledger. Same replicated ledger, plus a virtual machine (the EVM, Ethereum Virtual Machine) that every node runs identically. Programs deployed there are called smart contracts. Think of deploying a microservice onto a cluster run by thousands of strangers: every node runs your code, gets the same result and stores the same data. The service can also hold money.
2017 onwards, tokens and DeFi: banks rebuilt as contracts. Because a contract can hold balances, people rebuilt financial services as contracts. Tokens are contracts that keep a balance table, like USDC. Exchanges run with no operator (Uniswap). Lending pools work the same way (Aave). Contracts call each other freely, like microservices with no auth between them. That composability is where most attacks come from.
2020 onwards, scaling and bridges. Ethereum itself (L1, layer 1) is slow and expensive. L2s (layer 2) such as Arbitrum, Optimism and Base run transactions on the side and post compressed batches back to Ethereum. Bridges move assets between chains. They are the most-hacked part of the stack, because a bridge is a message bus where whoever forges a message gets paid.
Now, institutions. Funds want leverage on DeFi with proper controls. Prime brokers put lenders’ money into vaults and let a fund borrow from them. The borrowed money sits in a smart-contract margin account that can only be used in approved protocols. Because it is on-chain, the lender can watch it and liquidate it (force-close it) if it gets too risky.

How it works

One state change, from intent to permanent record.

A user holds a private key. The public key derived from it gives a 20-byte address like 0x8f3c.... No admin can reset it.
The user builds a transaction: a signed request that says “call this function on this contract with these arguments”, plus a sequence number (nonce) and a fee offer.
The transaction goes to an RPC endpoint, which gossips it into the public mempool, the queue of pending requests. Anyone can read that queue.
A block builder picks transactions, orders them (mostly by fee) and seals a block. Ethereum produces one block every 12 seconds.
Every node runs the same transactions through the EVM and arrives at the same new state. Each instruction costs gas, which the sender pays.
About 13 minutes later the block is final. Before that it can still be rolled back in a reorganisation (reorg).

The full path with numbers is in EVM and Solidity and Chain mechanics.

Why security is different here

Imagine a production API with the bank vault inside it, its source code on GitHub, no WAF, no rollback and no way to patch it in place.

Public and callable by anyone. Every public function can be called by anyone on the internet. You cannot firewall it or IP-allowlist it. Only the code’s own checks protect it.
The code holds the money. A bug is not a data leak, it is instant theft, and every bug comes with a payout. Attackers read the code more carefully than the reviewers did.
Immutable. Deployed code cannot be changed. Upgrades need special tricks (proxies), and those tricks become the new target.
Final. A confirmed transaction cannot be reversed. There are no chargebacks and no support desk.
Keys are everything. A private key is like an SSH key with money behind it. It cannot be revoked or reset, and whoever has it is you. That is why signing infrastructure is where the biggest losses happen. See Key and signer attacks.
Atomic. A transaction either fully succeeds or fully reverts. Attackers use this to borrow, manipulate, profit and repay in one go at zero risk. See Contract attacks.

Where the names and numbers come from

EIP is an Ethereum Improvement Proposal: Ethereum’s RFC or KEP. Anyone opens a proposal in the ethereum/EIPs GitHub repository, and it gets a number.
ERC is an Ethereum Request for Comments: an EIP that defines an application-level interface (tokens, vaults, wallets) rather than a change to the protocol. ERC-20 and EIP-20 are the same document.
The numbers look random because they are ticket numbers, not versions. ERC-20 was GitHub issue #20 in 2015, and ERC-721 was issue #721. Higher means later. Same as CVE or KEP IDs: you do not derive them, you recognise them.

The ones worth recognising:

Number	What it is
ERC-20	Fungible token interface (USDC, USDT).
ERC-721	NFT (non-fungible token) interface.
ERC-4626	Vault interface: deposit money, get shares.
EIP-1559	The current fee model (base fee plus tip).
EIP-712	Standard for signing structured messages, so a signature cannot be replayed elsewhere.
ERC-1967	Where proxies store the address of their code.
ERC-2535	Diamond proxy.
EIP-7702	Lets a normal wallet temporarily run contract code (since May 2025).

Details are in Token standards.

Glossary in plain words

Term	Plain words
Address	A 20-byte ID like `0x8f3c...`. Belongs to a wallet or a contract.
AMM / DEX	Automated market maker, decentralised exchange. An exchange run by a contract: a pool of two tokens whose price comes from the ratio between them. Easy to move with a big trade, which is why pools make bad price oracles.
Beacon	A contract that tells many proxies which code to run, like a lighthouse every ship watches. See proxies.
Calldata	The request body of a transaction: which function to call, with which arguments.
DeFi	Decentralised finance: lending, trading and vaults run by contracts, not companies.
delegatecall	“Run that other contract’s code, but on my data and with my permissions.” It is how proxies work, and how one bad signature rewrote Bybit’s wallet.
Diamond / facet	One proxy with many code modules (facets), each handling some functions. Named after a cut diamond’s faces.
EOA	Externally Owned Account. A normal wallet controlled by a private key, owned from outside the chain by a person or a server. The opposite of a contract account.
Finality	The point where a block can no longer be rolled back.
Front-running / MEV	Someone sees your pending transaction and places theirs before and after it to profit. MEV (maximal extractable value) is the money made by reordering transactions.
Implementation	The contract holding the actual code behind a proxy.
Liquidation	Force-closing a borrower’s position when collateral no longer covers the debt. It needs a correct price at the right moment.
Opcode	A single EVM machine instruction: ADD, SSTORE, CALL. Gas is charged per opcode.
Reentrancy	OS term: a function entered again before its first run finished. On-chain: your contract sends money to someone, and their code calls you back while you are still mid-function, before you have updated the balance. ATM version: the machine hands out cash before debiting the account, and you press “withdraw” again while the cash is coming out.
Rollup	An L2 that runs transactions elsewhere and posts proofs or batches to Ethereum.
Signer / blind signing	The device or service holding the key. Blind signing means approving a hash or a UI summary without seeing what the transaction really does.
Slippage	The worst price you accept on a trade. Without a limit, front-runners take the difference.
Storage slot	A contract’s database is a key-value store of 32-byte slots, numbered from 0 in the order variables are declared.
Vault (ERC-4626)	A pool where you deposit a token and get “shares” back, like units of a fund.
Wei / decimals	There are no floats. 1 ETH = 10^18 wei; 1 USDC = 10^6 units. All maths is integer, and rounding direction matters.

Compare

Where shared state can live

System	Who runs it	What it can do	Commit time	Trust model
Replicated log (etcd, Raft)	One organisation	Whatever the application writes	Milliseconds	Nodes trust each other; an admin can rewrite anything
Bitcoin (2009)	Anyone	Move coins from A to B	A block about every 10 minutes	Nodes do not trust each other; rewriting needs most of the computing power
Ethereum L1 (2015)	Anyone	Run arbitrary programs (smart contracts) that hold money	A block every 12 s, final after about 13 min	Same idea, plus every node re-executes every program
L2 rollup (2020 onwards)	Usually one sequencer	Same programs, cheaper and faster	Fast on the L2, then checkpoints into L1	Posts its batches to L1; the single sequencer can go down

Chain terms in DevOps terms

Chain term	Closest DevOps thing	The difference that matters
Blockchain	Replicated append-only log (etcd or Raft log)	Nodes do not trust each other; anyone can run one.
Node / client	A server running the software (Geth, Reth)	You run your own or rent one from a provider.
RPC endpoint	kube-apiserver: the API you query and submit to	A lying or lagging RPC feeds you a false view of the chain (KelpDAO).
Block	A committed batch of changes, every 12 s on Ethereum	It can still be rolled back (reorg) until it is final, about 13 min later.
Address / account	A user ID derived from a public key	No admin can reset it.
EOA (wallet)	A human user: a key pair	Can start transactions. Has no code (before EIP-7702).
Contract account	A service with its own database and bank balance	Cannot act by itself; it only reacts to calls.
Transaction	A signed API request that changes state	Public before it is included, and permanent after.
Nonce	A sequence number per sender	Stops replay; a gap blocks every later transaction.
Gas	Per-instruction CPU billing, like Lambda per ms	Also caps runaway loops; the sender pays.
Solidity	The language (like Go)	Compiles to EVM bytecode.
EVM / opcode	The VM, like the JVM / one CPU instruction	ADD, SSTORE (write storage), CALL, DELEGATECALL.
ABI / selector	The API schema (like protobuf) / the route	The function is picked by the first 4 bytes of a hash of its signature.
Event	Structured log line	What indexers and monitoring read.
Token	A service whose database is `address → balance`	“Owning USDC” means a row in Circle’s contract.
Approve	Granting an OAuth scope: “this app may pull up to N of my tokens”	Often unlimited and forgotten; drained later.
Oracle	An external config or data source, such as a price	Trust boundary: a bad price means bad liquidations.
Multisig	The 2-person rule for prod, enforced in code	M of N keys must sign.
MPC	Shamir-style split key; the whole key never exists in one place	Off-chain; the chain sees one normal signature.
Timelock	A mandatory change window before a change applies	Gives watchers time to react.
Proxy	A k8s Service in front of a Deployment	Here the Service also keeps the data.
Mempool	The public queue of pending requests	Anyone can read it and cut in line (front-running, MEV).
Flash loan	Borrow any amount for one transaction	If it is not repaid by the end, everything reverts.
Bridge	A cross-cluster message bus with a verifier	Forge a message and you mint money.
L2 rollup	A faster cluster that checkpoints into the main one	It has a single sequencer that can go down.

Proposal and identifier schemes

Scheme	What gets a number	Example	Number means
EIP	A proposed change to Ethereum	EIP-1559 (fee market)	Ticket number in `ethereum/EIPs`
ERC	An EIP for an application-level interface	ERC-20 (token)	Same numbering as EIPs
RFC	An internet standards document	RFC 9110 (HTTP)	Sequential number
KEP	A Kubernetes Enhancement Proposal	KEP-1287	Issue number
CVE	A publicly known vulnerability	CVE-2021-44228	Year plus sequence

What breaks

Each property that makes a chain useful removes a safety net that infrastructure people are used to.

Habit from ordinary infrastructure	Why it fails on-chain	What replaces it
Put a firewall or WAF in front	Every public function is reachable by anyone	Access checks inside the contract code
Patch in place	Deployed code is immutable	Proxies, with the upgrade key as the new crown jewel
Roll back a bad change	Final transactions cannot be reversed	Timelocks, pause switches, withdrawal caps (Defence stack)
Rotate a leaked credential	A private key cannot be revoked; whoever has it is you	Multisig, MPC, moving funds to a new address
Hide internals	Bytecode, storage, every transaction and every event are public	Assume the attacker has read everything
Trust the API you query	An RPC can lie or lag	Compare several providers and your own node (Chain mechanics)
Assume an attacker has limited capital	A flash loan gives anyone huge capital for one transaction	Never rely on “nobody has that much money”

Keywords

blockchain, block, Bitcoin, Ethereum, EVM, smart contract, token, DeFi, L1, L2, rollup, sequencer, bridge, vault, margin account, liquidation, address, EOA, contract account, transaction, nonce, gas, Solidity, opcode, ABI, selector, event, approve, oracle, multisig, MPC, timelock, proxy, mempool, MEV, front-running, flash loan, finality, reorg, EIP, ERC, ERC-20, ERC-721, ERC-4626, EIP-1559, EIP-712, ERC-1967, ERC-2535, EIP-7702, AMM, DEX, calldata, delegatecall, storage slot, wei, decimals, slippage, blind signing.