Smart contracts & Ethereum

L1The EVM: a world computer with a meter

Ethereum is one giant, replicated state machine. Every node executes every transaction through the Ethereum Virtual Machine (EVM) and must arrive at the identical result — that redundancy is what makes the outcome trustworthy, and what makes computation expensive.

• Two account types. Externally owned accounts (EOAs — a keypair, e.g. your MetaMask) and contract accounts (code + storage at an address). Only EOAs start transactions; contracts react.
• Gas. Every EVM instruction has a price. You attach a gas budget to a transaction; run out and everything reverts (but the fee is spent). Gas is the spam-defence and the reason on-chain code stays lean — heavy logic and data belong off-chain.
• Transactions are atomic. A transaction either fully succeeds or fully reverts. There is no "half-paid claim" state — a genuinely useful property for financial workflows.

L2Solidity anatomy — HelloPolicy, line by line

Solidity is the dominant contract language: statically typed, compiled to EVM bytecode. Here is a deliberately small but honest insurance contract — one product, one insured, fixed sums. You will deploy it in the lab below.

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.24;

/// Minimal fixed-benefit cover — learning scaffold, not production.
contract HelloPolicy {
    address public insurer;                       // deployer = the carrier
    uint256 public constant PREMIUM = 0.01 ether;
    uint256 public constant PAYOUT  = 0.05 ether;

    struct Policy { address holder; uint64 expiry; bool paid; bool claimed; }
    mapping(address => Policy) public policies;   // on-chain "policy admin table"

    event PolicyIssued(address indexed holder, uint64 expiry);
    event ClaimPaid(address indexed holder, uint256 amount);

    error NotInsurer();
    error NoActivePolicy();
    error AlreadyClaimed();

    modifier onlyInsurer() { if (msg.sender != insurer) revert NotInsurer(); _; }

    constructor() payable { insurer = msg.sender; }  // fund it on deploy: claims reserve

    /// Customer pays exactly the premium; cover runs 30 days.
    function buyPolicy() external payable {
        require(msg.value == PREMIUM, "premium is 0.01 ETH");
        uint64 expiry = uint64(block.timestamp + 30 days);
        policies[msg.sender] = Policy(msg.sender, expiry, true, false);
        emit PolicyIssued(msg.sender, expiry);
    }

    /// Insurer approves a claim → contract itself pays out. Checks-Effects-Interactions.
    function approveClaim(address holder) external onlyInsurer {
        Policy storage p = policies[holder];
        if (!p.paid || block.timestamp > p.expiry) revert NoActivePolicy();
        if (p.claimed) revert AlreadyClaimed();
        p.claimed = true;                                // EFFECT first…
        (bool ok, ) = holder.call{value: PAYOUT}(""); // …INTERACTION last
        require(ok, "transfer failed");
        emit ClaimPaid(holder, PAYOUT);
    }
}

Read it as an insurance engineer:

• mapping(address → Policy) is your policy-admin table; public auto-generates a free read function.
• Events (PolicyIssued, ClaimPaid) are the integration bus — indexed, cheap, subscribable. Contract events : Ethereum :: ledger entries → Kafka : Galileo.
• Custom errors + modifiers encode authority ("only the insurer approves claims") in code that a regulator can read.
• The checks-effects-interactions ordering in approveClaim is the canonical reentrancy defence — flag before paying.
• Notice what's missing: underwriting, KYC, variable pricing, privacy. On a public chain, everything here is world-readable — a core reason enterprise insurance work moved to permissioned platforms (Module 03) or hybrid designs (public anchor + private data).

L3Tokens in one lesson

L4Oracles — the bridge that decides parametric claims

Contracts cannot call APIs; the chain only trusts what's already on it. An oracle brings external facts (wind speed, flight status, an official index) on-chain — and instantly becomes the most attackable part of any parametric design. Chainlink, the dominant network, answers with decentralised oracle committees: many independent nodes fetch, aggregate, sign.

L5Security — the eight classic wounds

L6Lab — deploy HelloPolicy in 15 minutes

▶Watch / go deeper

Sources: Antonopoulos & Wood, Mastering Ethereum (EVM, wallets, security); Mastering Solidity (supplementary); Chainlink docs for the oracle pattern. DAO figures: contemporaneous reporting, 2016.