# M02-L02 — Lab contract

**Build:** Generate test key, derive address, compare known vector with Web3j.

**Pass:** Derived 0x address is 20 bytes and matches reference vector.

**Failure injection:** Confusing SHA3-256 with Keccak-256 derives the wrong address.

**Review question:** Why must private keys never enter application logs?

Status: specification; only count as executable when source and tests are present and verified.