Crypto Due Diligence

Originally published December 30, 2025 · 4 min read · Updated July 18, 2026

Crypto due diligence starts with deployed contracts and live permissions, not a marketing site; use this source hierarchy and 15-minute rejection test.

TL;DR: Check the deployed contract, proxy implementation, admin powers, liquidity, and withdrawal path first; an audit PDF cannot override live onchain permissions.

crypto due diligencesmart contractssecurityresearch

Table of contents

Forensic review of a smart-contract blueprint and administrative keys

Crypto due diligence should begin with the deployed contract address and its current control surface; names, logos, audits, and follower counts are secondary evidence.

A crypto due diligence source hierarchy

Use sources in this order when claims conflict:

Live onchain state: deployed bytecode, proxy implementation, owners, roles, balances, and recent transactions.
Official product and technical docs: withdrawal rules, supported assets, liquidation logic, and addresses.
Dated governance records: proposals, votes, timelocks, and executed changes.
Audit reports: useful for the reviewed commit and scope, not proof of the current deployment.
Official announcements: evidence of intent, weaker than executed state.
Third-party dashboards and posts: discovery aids that must link back to evidence.

An audit dated after a deployment can still review different code. Match the report's commit hash and contract addresses where provided.

The 15-minute cryptocurrency due diligence test

The first pass is a rejection test, not a complete security review.

Minute	Check	Reject or reduce size when
0-3	Official contract addresses and chain	Addresses are missing or inconsistent across docs and app
3-6	Proxy, owner, roles, pause, mint, and upgrade powers	One key can replace logic or seize funds without delay
6-9	Deposit and withdrawal path	Exit requires an undocumented queue, bridge, or discretionary approval
9-12	Asset liquidity and oracle	Quoted value depends on a thin market or one stale feed
12-15	Audit scope and incident history	Current code is outside scope or past failures are not explained

Failing this pass does not prove fraud. It proves the position needs a smaller limit or deeper work before capital moves.

Smart-contract due diligence for proxies

A verified proxy is not the application logic. Read the implementation address, then identify who can change it. EIP-1967 standardizes common proxy storage slots; explorers often expose those values directly.

Ask four questions:

Is the implementation verified?
Who controls the upgrade role: an EOA, multisig, governance contract, or timelock?
How many signatures are required and who are the signers?
Can an upgrade execute before users have time to withdraw?

OpenZeppelin's proxy documentation explains why storage layout and upgrade authorization are separate failure surfaces. "Audited" is not an answer to either one.

Crypto project due diligence on the exit

Model the exit before estimating yield. Record:

the exact withdrawal function or UI path;
cooldown, queue, epoch, and claim steps;
the asset received on exit;
available liquidity at 1%, 5%, and 10% of your intended size;
any bridge needed to return to the settlement chain;
who can pause or ration withdrawals.

If a $20,000 receipt token has only $80,000 of visible exit liquidity, the quoted price is not a reliable exit price. Price impact, other sellers, and withdrawal limits matter more than the dashboard APY.

Due diligence for crypto economics

Separate cash yield from token emissions and points:

net cash yield = fees + interest - incentives sold - financing - gas - hedging cost - realized losses

Then add incentives back at the price you can actually sell, not the fully diluted valuation shown in a launch announcement. Value unreleased points at zero. A 30% headline APR funded entirely by a token falling 5% per week is not a 30% return stream.

Use the yield farming risks veto checklist and calculate position outcomes with the crypto trading calculator.

Stop conditions are the useful output

Write conditions that trigger an exit or a new review:

proxy admin or signer threshold changes;
oracle, bridge, or withdrawal contract changes;
stable asset trades below a chosen threshold;
utilization or borrow cost crosses a limit;
withdrawals exceed the documented time;
official rules change without a dated notice.

Our opinion: a due-diligence memo without stop conditions is a history report. The value is deciding which observable fact will make you act.

Keep evidence, transaction hashes, and the next review time in the crypto tracking spreadsheet. A URL without an access date is not enough for a rule that can change tomorrow.