Your onchain executor can pass its unit tests, produce valid calldata, and still send funds through an unintended path. The difficult part is not writing more tests. It is knowing what each test environment proves and where its evidence stops.

A useful testing ladder has distinct stages: pure simulation, forked-chain execution, a production canary using a trivial amount, and staged production use. None is a substitute for the others.

The most dangerous design is often a dryRun boolean scattered across the codebase. If some transaction paths respect it while another path broadcasts, the dry run creates false confidence. A system with no dry-run mode is visibly dangerous. A partially enforced one looks safe until the missed branch moves funds.

Start with a deterministic execution plan

Separate deciding what to do from doing it.…