Boba

Spot across nine EVM chains and Solana, perps on Hyperliquid. Order book, leverage, TWAP and stop-loss, positions and fills updating continuously, and a portfolio that totals holdings across every chain at once.

Each chain brings its own assets, fees and deposit rules, and the interface has to make those differences feel consistent.

Early in 2026 I spent a stretch going through the platform logging render counts, page by page. The same thing kept turning up: components re-rendering constantly for updates they didn't care about.

The cause was where the state lived. Fast-moving data was held in React and propagated down the render path, so a single price tick reached everything below the component holding it. Memoization helps at the edges, but the work was being scheduled at all because of where the data sat.

So I moved it out. Live state went into external stores with key-level subscriptions, so an update notifies only what's watching that key. The wallet tracker was the clearest case: its state lived in a context provider, which meant every consumer re-rendered on any change. The provider came out, the state moved into a proxy store, and consumers subscribed by key.

I introduced that pattern during this work, and it was picked up more widely afterwards.

On the backend I built Boba's authentication service, covering wallet signatures, Google and X OAuth, and Turnkey passkeys. It issues RS256 tokens and publishes a JWKS endpoint, so the gateway verifies signatures at the edge instead of every service doing it. Staff sign in through a separate service with its own trust boundary, Google identity plus a WebAuthn passkey, which is what the internal console authenticates against.

One of the nastier bugs came out of refresh-token rotation. Two tabs could refresh the same session at nearly the same moment, both pass validation because both were holding the current token when they checked, and both rotate. Only one of the two new tokens ends up current in the session, which leaves the other tab holding a token that was legitimately issued and is already stale. Presenting it looks exactly like token reuse, so the session gets blocked and the user is signed out everywhere.

Check and rotate were separate operations with a gap between them, and a lock inside the service wouldn't close it because more than one instance is running. The fix moved the whole sequence into a single Lua script that Redis runs atomically. One caller wins and rotates; the other lands in a grace path and gets the current token back instead of tripping reuse detection.