Web3 Development Tools and Stack in 2026: What to Use and Why
The layers of a Web3 stack
A regular web app has a front end, a backend and a database. A Web3 app adds a public blockchain that nobody on your team controls, and a set of tools to reach it. Think of it as nine layers:
- Chain. The blockchain where your smart contracts (programs that run on the chain) and tokens live.
- Smart contract framework. Tools to write, test and deploy those contracts.
- Client library. Code in your web or mobile app that reads the chain and builds transactions.
- Node or RPC provider. A managed API to the chain, so you don't run your own servers (nodes) to read and send data.
- Indexer. A service that turns raw chain events into a fast, queryable database for history and dashboards.
- Wallets and login. How users hold keys and approve transactions.
- Storage. Where files and metadata live, since chains are too expensive for large data.
- Oracles. Services that bring outside data, such as prices, onto the chain.
- Security and testing. Analyzers, fuzzers, simulators and monitoring.
The order matters. Choose the chain first, because it decides the contract language, the frameworks, and which wallets and providers are available. Everything else follows.
Chains: where your contracts live
Most new products choose between the EVM family (Ethereum and chains compatible with its virtual machine, written in Solidity) and Solana (programs written in Rust). Layer 2 networks (L2s) are chains that settle to Ethereum and charge far lower fees.
| Option | Typical use | What to weigh |
|---|---|---|
| Ethereum mainnet | High-value protocols, assets that need the deepest security and liquidity | Higher fees per transaction; the largest pool of Solidity developers and auditors |
| Ethereum L2s (for example Base, Arbitrum, Optimism) | Most new consumer and DeFi apps | Low fees, same tools as Ethereum; liquidity and users are split across L2s |
| Other EVM chains | Ecosystems where your partners or users already are | Same tooling, different security model and liquidity; check provider coverage |
| Solana | High-frequency trading, payments, consumer apps with many small transactions | Rust programs and different tooling; fewer auditors than Solidity |
Test networks (testnets) let you deploy without real money. According to ethereum.org, as of October 2026 Sepolia is the recommended default testnet for application development, while Holesky was deprecated in September 2025 and Hoodi is meant for protocol and validator testing. Our DeFi app guide covers the chain decision in more depth.
Smart contract frameworks
A framework compiles your contracts, runs tests against a local chain, and scripts deployments. On EVM chains, two are standard:
| Tool | Chain | What it is | Fits when |
|---|---|---|---|
| Foundry | EVM | Toolkit with Forge (build, test, deploy), Cast (command line chain access), Anvil (local node that can fork mainnet) and Chisel (Solidity console). Tests are written in Solidity, with built-in fuzz and invariant testing. | Security-heavy contracts, teams that want fast tests and fuzzing in one tool |
| Hardhat 3 | EVM | Plugin-based environment from the Nomic Foundation. Supports Solidity tests and TypeScript tests (its recommended setup uses viem), and Hardhat Ignition for deployments. | Teams that live in TypeScript, projects with complex deployment scripts and plugins |
| Anchor | Solana | Framework for building Solana programs in Rust, with generated TypeScript and Rust clients and testing libraries. | Almost any new Solana program |
Many teams use Foundry and Hardhat together: Foundry for tests and fuzzing, Hardhat for deployment scripts. Either way, build on audited contract libraries for tokens, access control and upgrades instead of writing those parts from scratch.
Client libraries: how your app talks to the chain
The client library runs in your front end or backend. It reads balances and contract state, prepares transactions, and asks the wallet to sign them.
| Library | Status as of October 2026 | Use it for |
|---|---|---|
| viem | Active. A type-safe TypeScript interface for Ethereum. | New EVM projects, backends and scripts |
| wagmi | Active. Built on viem; React hooks for accounts, contracts and transactions, plus Vue, Solid and a framework-agnostic core. | React front ends on EVM chains |
| ethers.js | Active, version 6. | Existing codebases and teams that already know it |
| web3.js | Sunset. ChainSafe archived it on March 4, 2025. | Nothing new. Migrate existing code to viem or ethers.js |
| Solana Kit (@solana/kit) | Active. Anza's JavaScript SDK, the renamed 2.x line of @solana/web3.js. | New Solana front ends and backends |
ChainSafe announced the sunset in January 2025 and published migration guides to both viem and ethers.js. An archived library gets no security fixes, so plan the migration as part of your next release, not after an incident.
Node and RPC providers
Every read and write goes through a node. You can run your own, but most teams rent access through an RPC (remote procedure call) API. The main providers overlap a lot; the differences are in data products, coverage and price.
| Provider | What its docs describe (October 2026) |
|---|---|
| Alchemy | JSON-RPC for 100+ chains, data APIs (portfolio, transfers, prices, NFTs, simulation), webhooks, and smart wallet tooling (bundler, gas sponsorship) |
| Infura | Managed API access to Ethereum and major L2s such as Base, Arbitrum, Optimism, Linea and Polygon PoS, plus a gas API |
| QuickNode | RPC endpoints for more than 75 chains (gRPC for Solana data), Streams (real-time data pipelines), webhooks, IPFS gateways and endpoint add-ons |
| Others | Data-focused vendors such as Goldsky also offer RPC endpoints; large teams sometimes run their own nodes for critical paths |
How to choose: confirm your chains are supported in production, not just listed. Load-test with your real request mix (log queries and traces are heavier than balance reads, and some plans price them higher). Compare price at your expected volume, and configure a second provider your app can fail over to. A single RPC outage should slow your app, not stop it.
Indexing: turning chain events into data
Blockchains are good at recording events and bad at answering questions like "show this user's last 50 trades." An indexer listens to your contracts' events and writes them into a database your app can query.
| Tool | Model | Fits when |
|---|---|---|
| The Graph | Subgraphs (GraphQL APIs over chain data) served by a decentralized network; Substreams for parallel processing | You want an open, decentralized data layer and GraphQL |
| Goldsky | Hosted subgraphs and Turbo, which streams chain data into your own database or warehouse | You want managed hosting or data in your own warehouse |
| Ponder | Open-source TypeScript framework for EVM indexing that you host | Your team writes TypeScript and wants full control |
| Moralis, Alchemy, QuickNode data APIs | Ready-made APIs for wallets, tokens, NFTs, prices; streams or webhooks for events | You need standard data (balances, transfers) rather than your own contract logic |
A common pattern: ready-made data APIs for wallet balances and token prices, plus your own indexer for your contracts' events, because that data is your product.
Wallets and authentication
A wallet holds the private key that signs transactions. This layer decides whether a new user is in your app in 20 seconds or gives up at "install an extension first."
- What it is: users bring an existing wallet (browser extension or mobile app) and connect it to your app.
- Tools: the WalletConnect protocol, which most wallets support. The company behind it, WalletConnect Inc., rebranded to Reown in September 2024 and ships AppKit, an open-source SDK for connect buttons with email and social login options. The network itself kept the WalletConnect name, so you will see both names.
- Fits: DeFi and trading apps whose users already have wallets.
- What it is: the app creates a wallet for the user at sign-up with email, phone or social login. No extension, no seed phrase on day one.
- Tools: Privy (Stripe announced its acquisition in June 2025, and Privy says it keeps running as an independent product), Dynamic (acquired by Fireblocks, announced October 2025), thirdweb (wallet SDKs for TypeScript, React, React Native, Unity, .NET and Unreal), and Alchemy's smart wallets.
- Fits: consumer apps, games, loyalty and payments, where most users have never owned crypto.
- What it is: accounts controlled by a smart contract, which allows gas sponsorship (your app pays fees), batched actions, spending limits and recovery.
- Standards: ERC-4337 account abstraction, and EIP-7702, which shipped with Ethereum's Pectra upgrade on May 7, 2025 and lets a regular wallet address take on smart contract behavior.
- Tools: Safe for multi-signature treasury and admin accounts; embedded wallet vendors and Alchemy for user-facing smart accounts.
Before you pick an embedded wallet vendor, ask who controls the keys, how users export their wallet if you switch vendors, and what happens to user funds if the vendor shuts down. Our crypto wallet development cost guide covers custody models and budgets.
Built by Gilzor
Results we’ve shipped
Talk to the people who build it. Tell us about your project and get a free estimate of scope, timeline and cost.
Storage and oracles
Storing a profile picture on a chain would cost far more than storing it on a server. Large files go to storage networks, and the chain keeps only a short reference (a content hash).
| Tool | What it does | Watch out for |
|---|---|---|
| IPFS | Protocols for content-addressed files: the address is derived from the content, so anyone can verify a file wasn't swapped | IPFS is a protocol, not a storage provider. Files stay available only while you or a pinning service keep them |
| Arweave | A network built for permanent storage | Check current pricing and gateway options before you commit large volumes |
| Chainlink | Oracle network: price feeds, low-latency Data Streams, cross-chain messaging (CCIP), verifiable randomness (VRF), Automation, Proof of Reserve and Functions | Each feed has its own update rules; your contracts must handle stale or paused data |
If your contracts use prices, the oracle is part of your security model. Manipulated prices are a common way DeFi protocols lose funds, which is why prices should come from an oracle a single large trade can't move. NFT projects should check where their metadata is pinned; our NFT marketplace development cost guide covers that build.
Security and testing tools
Contracts that hold money are hard to fix after launch, so most security work happens before deployment. A practical toolkit:
| Stage | Tools | What it catches |
|---|---|---|
| Static analysis | Slither (Solidity and Vyper, from the Crytic project on GitHub) | Known vulnerability patterns, on every commit in CI |
| Fuzzing and invariants | Foundry's fuzz and invariant tests, Echidna, Medusa | Edge cases: random inputs and call sequences that break rules such as "total deposits always equal balances" |
| Local and forked chains | Anvil, Hardhat's network, Sepolia | Integration bugs against real protocol state before mainnet |
| Simulation and debugging | Tenderly (simulations, debugger, virtual environments); Alchemy's simulation API | What a transaction will do before users sign it |
| Operations | Monitoring and alerts; relayers for automated transactions | Unusual activity after launch |
OpenZeppelin phased out its hosted Defender platform: new sign-ups closed on June 30, 2025, and the company set July 1, 2026, a date that has now passed, as the final shutdown of the hosted service. Its replacements are the open-source Relayer and Monitor, which teams run themselves. If an older runbook relies on Defender, it needs a replacement.
Tools don't replace an external audit for contracts that hold user funds. They make the audit cheaper and shorter, because auditors spend time on logic instead of issues a scanner would catch.
Three example stacks
These are starting points, not recommendations for every product. Swap any tool for an equivalent that fits your team.
- Chain: one Ethereum L2 at launch.
- Contracts: Solidity with Foundry (fuzz and invariant tests), audited library code, a multisig (Safe) plus timelock on admin keys.
- App: Next.js with wagmi and viem; WalletConnect-based connection through AppKit or similar.
- Data: two RPC providers with failover; The Graph or Ponder for your contracts' events.
- Oracles and security: Chainlink price feeds, Slither in CI, transaction simulation, external audits, monitoring.
- Chain: a low-fee L2 or Solana.
- Wallets: embedded wallets (Privy, Dynamic or thirdweb) with email or social login; smart accounts so your app sponsors fees.
- App: React Native or web; viem and wagmi on EVM, Solana Kit on Solana.
- Data: ready-made data APIs for balances and NFTs (Moralis, Alchemy or QuickNode); IPFS with pinning for media.
- Watch: per-user pricing of the wallet vendor and the export path for user keys.
- Chain: Ethereum or an L2 your institutional partners support; sometimes a permissioned network for internal settlement.
- Contracts: token contracts with transfer restrictions (allowlists of verified holders), role-based admin, upgrade paths reviewed by counsel.
- Custody: an institutional custody or wallet-infrastructure provider rather than user-held keys.
- Integration: your existing KYC, ledger and reporting systems connected through an API layer; oracles such as Proof of Reserve where off-chain assets back tokens.
- More: our RWA tokenization guide covers the business and legal side.
Budgets depend more on contract complexity, audits and integrations than on tool licenses. Our blockchain app development cost guide breaks the numbers down by app type.
How to choose a Web3 development platform
There is no single best platform for Web3 development, and vendor rankings change quickly. In 2025 alone, web3.js was archived, Privy and Dynamic were acquired, and OpenZeppelin announced the end of hosted Defender. Use criteria instead of rankings:
Is your tool choice sound?
Keep vendor SDKs behind your own thin interfaces (one module for RPC, one for wallets, one for data). Then switching a provider is a sprint, not a rewrite. For apps that move money for US users, legal questions such as money transmission and sanctions screening shape the stack too; this guide is general information, not legal or investment advice.
FAQ
What are Web3 development tools?
What is a typical Web3 development stack in 2026?
What is the best platform for Web3 development?
Is web3.js still maintained?
Which SDKs work for multi-chain development?
Alchemy vs Infura vs QuickNode: which should I use?
Where Gilzor fits
We help teams choose and build the stack: Web3 and dApp development, smart contracts, wallets, and the backends and APIs that connect on-chain logic to your existing systems. In crypto, our team refactored the architecture of the KickEX exchange app and rewrote unstable code so users could trade, transfer and withdraw reliably. We work from Poland and Cyprus, with a few shared hours a day with the US East Coast.
Tell us who your users are and what happens on-chain. We'll map each layer, the tools that fit, and what to build versus rent.
No sales pitch
Get a straight answer for your project
Tell us what you’re building. We’ll reply with options, a rough cost and timeline. If we’re not the right fit, we’ll say so.
Co-Founder of Gilzor. Works with founders and product companies on how to staff and run engineering: team extension, dedicated teams, and getting stalled projects moving again.
Gilzor · Web Development partner
Need a team for your web product?
Services
Web DevelopmentCustom websites and web apps — front-end, back-end, launch and support.→By company type
Selected projects
The team behind them
