The Journey
Key moments that shaped the T3Token programmable fiat framework.
The Loss
A sophisticated spear-phishing attack drains $44,000. The existing banking system and crypto markets offer no practical reversal path.
HalfLife & SmartLock Invented
Design and prototype programmable reversal windows, emergency coordination, and role-based controls for a new class of digital cash.
Ethereum → Avalanche
The first contracts were conventional ERC-20s on Ethereum. A governed reversal window means holding per-transfer state for the length of that window, and on Ethereum mainnet the gas cost of doing so made the entire premise uneconomic. The contracts moved to Avalanche C-Chain and the fee logic was rebuilt around it.
Monolith → Diamond (EIP-2535)
A compliance surface changes whenever a rule, a jurisdiction, or a counterparty does. A monolithic contract makes every such change a redeployment and a balance migration. Refactoring to the Diamond standard made individual facets replaceable without touching stored balances — and made contract-size limits a permanent engineering constraint rather than a one-time problem.
Public chain → permissioned consortium
Running on a public chain meant every amount and counterparty was visible, so the design accumulated cryptographic privacy layers — masked balances, commitment-only events, blinding primitives. Moving to a permissioned Hyperledger Besu consortium changed the threat model at its root: no public mempool, no anonymous explorer, no untrusted validators. The privacy machinery was removed rather than ported.
The envelope model
Transfers stopped being events and became envelopes: objects with an expiration, a dispute path, a settlement behaviour, and an issuing institution recorded against them. Reversibility stopped being a bolt-on and became the shape of the primitive itself — and per-bank claim attribution meant liabilities could be tracked and substituted across institutions rather than pooled anonymously.
A risk engine built for how banks actually adopt
The rules engine scores each transfer against weighted rules at three scopes — network, institution, and wallet — with Merkle-proof allow and deny lists so screening lists scale without bloating on-chain storage. Critically it has an observation mode: score everything, block nothing. An institution can run the engine in shadow against real traffic and see what it would have stopped before it stops anything.
Open sourced under Apache-2.0
After roughly seventeen months, the framework was published at github.com/jessedh/t3 — 41 facets, 1,545 passing tests, and the open legal and compliance questions documented rather than omitted. It is a reference implementation and a starting point for discussion, not a finished product.