Forem: Alena

A .NET Dinosaur in Web3. Day 3 - Voting, Sybil Attacks and Identity

Alena — Sun, 03 May 2026 09:51:21 +0000

Day 3 was the first day that felt like actual software engineering rather than syntax tourism. The task: write a voting contract. Simple enough on the surface - until you start poking at the security model and realize the whole thing has serious gaps in its logic.

What looked like a toy example turned out to be a good proxy for real system design problems.

The Contract

Instead of dumping a wall of code here, I moved the full contract and instructions to GitHub. This post is about what actually matters - how it works.

GitHub: github.com/alena-dev-soft/solidity-learn/contracts/03day/

What Actually Clicked

struct → record in C#
Not a class. No methods, no behavior - pure data container. Closer to record
in C# than anything else.

mapping(address => bool) → Dictionary<address, bool>
Exact mental model. The key is a wallet address, the value is whether they've
voted. Lookup is O(1), there's no iteration - same tradeoffs as Dictionary
in .NET.

view modifier → read-only, free to call
Methods marked view don't write to state, so they don't cost gas. The EVM
equivalent of a GET endpoint versus a POST. This clicked immediately because
the cost model maps directly to why you'd separate reads from writes in
any system.

require() → guard clauses + exception in one
require(condition, "message") is exactly if (!condition) throw new Exception("message") - except when it reverts, the entire transaction is reverted. No state is changed, but gas is still spent. Closer to a database transaction abort than a simple exception.

Key Insight

At some point I stopped and asked myself a simple question.

How does the contract know that "Alice" is actually Alice?

The answer was a little unsettling - because I've spent years designing systems where knowing who the user is was fundamental. Authentication, authorization, identity verification. That was always the baseline.

In Web3 there is no baseline like that.

The contract sees only an address. Just a string starting with 0x. No name, no history, no face. If the same person creates 10 wallets - congratulations, they now have 10 votes.

This is just how the system works.

And once that clicks, it quietly rewires how you think about everything else: access control, fairness, "one person = one vote." All the assumptions we carry from Web2 - where identity is tied to accounts, emails, phone numbers - simply don't apply here.

Ownership of a wallet is not identity. It's just… ownership of a wallet.

The fix exists, of course. Several of them, actually.

Whitelist - the owner manually approves addresses. Simple, but it requires trusting whoever manages the list. And it scales terribly.

NFT / Token gating - only wallets holding a specific token can participate. Think of it as a membership card. Still doesn't prove who the person is - just that they own the token.

Proof of Humanity - on-chain verification that a real human stands behind the address. Technically elegant. Still a largely unsolved problem at scale.

And then there's the quiet irony: most production solutions still route back to Web2 identity providers - Google, Binance, Microsoft and others. Web3 solved decentralized execution beautifully - identity remains outsourced to the old world.

So no, dinosaurs aren't extinct yet. Apparently we're still needed. 🦕 (like me 🙃)

Side Observations

Etherscan shows bytecode by default. The contract is there, but unreadable - same as looking at compiled IL instead of C# source. To expose the actual Solidity code, you need to verify the contract: upload the source, match the compiler version exactly. One wrong version number and it fails silently.

Remix doesn't persist deployed contracts across page reloads. After a refresh, the contract still exists on-chain - but Remix has no memory of it. Recovery is straightforward: find the contract address on Etherscan, use "At Address" in Remix to reattach. Good to know before it happens in a less forgiving context.

Testing multi-wallet scenarios requires either Remix VM or separate wallets with testnet ETH. Browser Extension mode only sees what MetaMask sees. Not a problem - just a constraint to know upfront.

Conclusion

Day 3 changed something in how I think about system design in Web3.

In Web2, identity is assumed. You build on top of it. In Web3, identity is your problem to solve - and every solution is either a tradeoff or a dependency on something outside the chain.

The contract works. The logic is sound. The gaps are in the model, not the code.

Stage: Dinosaur 🦕 - mapping the terrain. Starting to see where the edges are.

Day 4 incoming. 🚀

A .NET Dinosaur in Web3. Day 2 - Access Control

Alena — Sun, 03 May 2026 09:44:52 +0000

New day, new challenge...
Counter.sol - a little better than "Hello World", right?

The goal: write a simple Counter contract - increment, decrement, reset -
with real access rules.

The Contract

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.0;

contract Counter {
    uint256 public count;
    address public owner;

    constructor() {
        owner = msg.sender;
        count = 0;
    }

    function increment() public {
        count += 1;
    }

    function decrement() public {
        require(count > 0, "Already zero");
        count -= 1;
    }

    function reset() public {
        require(msg.sender == owner, "Only owner can reset!");
        count = 0;
    }
}

GitHub: github.com/alena-dev-soft/solidity-learn/contracts/02day/

What Actually Clicked

In the .NET world we use HttpContext.User to know who's making a request. In Solidity it's msg.sender - the wallet address of whoever called the method. No login system, no JWT, no sessions. Just a cryptographically verified address. The contract knows exactly who you are. Always.

The next thing - calling count to check the current value is free.Simple rule: no transaction, no gas.

But there's a warning that almost everyone forgets - which makes it kind of dangerous for your budget. If you forget to switch from the real network to the test network, those transactions will cost you actual money. Every single one.

The .NET → Solidity Map (So Far)

Solidity	.NET equivalent
`msg.sender`	`HttpContext.User`
`require()`	Guard clause + exception
`uint256`	`uint` (unsigned)
`address`	No direct equivalent — wallet ID

Day 2 Score: 10/10

Everything is mapping cleanly to .NET concepts. The mental model is familiar, the syntax is new.

Tomorrow I want something with real-world application - not a toy example, but a contract that actually does something useful.

Stage: Dinosaur 🦕 - mapping the terrain.

Day 3 incoming. 🚀

A .NET Dinosaur in Web3. Day 1 - First Smart Contract

Alena — Sun, 03 May 2026 09:37:47 +0000

I've been writing .NET for many years. Today I deployed my first smart contract.
Here's what actually happened.

I'd like to share my journey into Web3 — every single day.
Maybe it'll be helpful for someone out there.

I love what I do — really. I'm a .NET Dinosaur and Azure-passionate developer,
but let's be honest — the .NET niche isn't exactly overflowing with money 💵.
I've been meaning to try something new for a while. Something with a cool and
live market. Something different. So I chose Web3.

The Setup: I Built Myself an AI Mentor

Instead of drowning in YouTube tutorials and boring courses, I did something
a little different. Well — I have ADHD. And I know my brain. It needs dopamine
to stay focused (weird combo, ADHD person and software engineer — but for me,
coding is my dopamine). My brain needs a clear win every single day, not a
promise of understanding. So I configured Claude as my personal AI mentor:
one goal per day, theory only when it's actually needed, and an honest debrief
of where I got stuck.

Think of it as a personal trainer who never judges you for asking "stupid"
questions, and is available 24/7.

So — today was Day 1.

The Goal

Deploy your first smart contract to a test network and see its address
on the blockchain.

Simple, concrete — and I received detailed instructions, step by step.

What I Actually Did

Set up MetaMask. "Piece of cake" — really. I already had an account,
but I'd forgotten my keys (things happen). So I had to create a new one.
Switched to the Sepolia test network. A staging environment where
everything works exactly like the real Ethereum network — but you're not
using real money.
Got free test ETH. ETH is needed for "gas" — the fee you pay for
every piece of code the blockchain executes. It's free, but finding a working
faucet with an empty wallet took 3 attempts.
(I'm a beginner — I don't have funds for that yet 😅)
Wrote my first Solidity contract in Remix IDE. Solidity, by the way,
reads really easily — like other typed languages. For a .NET brain, it's
immediately familiar: classes, constructors, typed fields, public methods.
Deployed it. One click, one MetaMask confirmation, 30 seconds of
waiting — and pure happiness when I received a contract address.

Where I Got Stuck

MetaMask's UI has changed. Sometimes my AI mentor provided instructions
for the old version, so finding things took a little more time than expected.

Three faucets, one winner. Getting free test ETH required more tries
than expected:

Faucet	Result
sepoliafaucet.com	❌ Requires conditions I didn't meet
faucets.chain.link/sepolia	❌ Asks for LINK tokens
Google Web3 Faucet	✅ Worked immediately

Day 1 Score: 9/10

Easier than expected, honestly. The .NET background helps more than I thought —
typed languages, deployment concepts, staging vs production thinking. It all
maps over. I played with the code and the environment.

Solidity feels like home. A strange, decentralised, immutable home — but home.

Stage: Dinosaur 🦕 — mapping the terrain.

See you on Day 2. 🚀

Hello!

Alena — Sun, 03 May 2026 09:31:21 +0000

I'm a .NET dinosaur. And I'm done being one.

Senior .NET and Azure backend developer, also former Tech Lead. Years of enterprise systems, clean architecture, corporate backend at scale. It's a solid career. It's also, if I'm being honest - started to feel like the same hallway walked in circles.

So I'm changing direction. Slowly and deliberately.
Not because .NET is bad or I don't like it anymore. But the work got repetitive, the market got crowded, and somewhere along the way the technology stopped feeling like a frontier.
My new space is blockchain. The execution model is different. The trust model is different. The economics are different. And unlike most of my .NET career - the output is visible, verifiable, and lives on a public ledger forever.
So I'm learning Solidity from scratch. Publicly.

The series "A .NET Dinosaur in Web3" will contain real code, real mistakes, real "naive" thoughts, .NET analogies where they help - and honest notes on what it actually takes to make this switch.

I started writing on another platform - and will gradually move my "historic" articles here.

Stage: Dinosaur 🦕 - mapping the terrain.