Need Help with Technical Due Diligence?
Get expert guidance on evaluating blockchain protocols and companies.
Tool Workspace
Use, understand, and apply the results
Tool Overview
This checklist is for investors, acquirers, and enterprise partners evaluating a blockchain protocol or company's technical maturity.
Key Result
A technical due diligence checklist for evaluating blockchain protocols: Tier 1 Non-Negotiable (smart contract audit by named firm, zero unresolved Critical/High findings, multi-sig admin keys, timelocks ≥48 hours). Tier 2 Strong Signals (test coverage ≥95%, fuzz tests, invariant tests, clear upgrade path). Tier 3 Concerns (red flags: no audit, unlimited admin access, single-key admin, anonymous team, audit report not public). Technical interview questions: 'Walk me through responding to a 2am exploit,' 'What happens if oracle goes down for 30 minutes?', 'Who can pause the protocol?'
TIER 1: NON-NEGOTIABLE (Fail if absent)
Smart Contract Security:
All production contracts audited by named, reputable firm
Audit report publicly available (with findings and remediation status)
Zero unresolved Critical or High findings
Contracts verified on Etherscan (source code visible)
Bug bounty program active with material bounty ($50K+ Critical)
Key Management:
Admin keys held in multi-sig (3-of-N minimum)
No single-EOA admin keys for any production protocol
Upgrade timelocks ≥ 48 hours for any significant parameter change
Multisig signers are named individuals, not anonymous
Verifiable History:
Deployed contract addresses provided and match description
On-chain transaction history consistent with claimed launch date and usage
Named engineers with verifiable GitHub history
TIER 2: STRONG POSITIVE SIGNALS
Testing and Quality:
Test coverage ≥ 95% (evidence: coverage report)
Fuzz tests implemented for all critical math functions
Invariant tests passing
Fork tests against mainnet state
Architecture:
Clear and reasonable upgrade path (UUPS or Transparent Proxy)
Oracle design: dual-oracle with divergence threshold
No circular dependencies in token economics
Clear mechanism for emergency pause
Track Record:
Protocol has operated without incident for ≥ 90 days
No prior exploits (or prior exploits fully disclosed and resolved)
TVL trend: flat or growing (declining TVL = trust signal)
Protocol revenue covers operating costs at current scale
TIER 3: CONCERNS (Flag for further investigation)
Yellow flags:
Single audit by lesser-known firm
Admin timelock < 24 hours
Closed-source contracts
No bug bounty program
Anonymous team
Token emissions significantly exceeding protocol revenue
Recent large TVL decline without explanation
Governance controlled by <5 addresses
Red flags:
No audit at all for protocol handling funds
Unlimited admin access (no timelock, no multi-sig)
Team cannot explain their own codebase clearly
Prior exploit not disclosed
Audit report not publicly available
Admin keys held by single person
Technical Interview Questions for Protocol Team
"Walk me through how you would respond if your protocol were exploited at 2am UTC."
"What is the worst-case scenario if your oracle goes down for 30 minutes? Walk me through exactly what happens."
"If token price drops 70%, does your emission model still work? Show me the numbers."
"Who can pause the protocol? What is the exact process?"
"What is the most dangerous thing an insider could do with their current access?"