For funds, market makers, trading firms and treasury teams
DeFi technical due diligence
Understand a protocol’s technical risks before committing capital.
An audit report is one input to a deployment decision. Your team also needs to understand the contracts it will interact with, who can change them, and which external systems the position depends on.
I review these technical assumptions within an agreed scope and produce a diligence memo your engineering, investment and risk teams can use in their decision process.
Discuss a DeFi diligence review
When this review helps
- Your team is evaluating a new protocol, vault or onchain integration.
- You need to understand how existing audits relate to the deployed system.
- A protocol upgrade or dependency change requires a fresh assessment.
- You need technical findings explained clearly to colleagues making the deployment decision.
What I assess
The scope follows your intended interaction with the protocol. Depending on the engagement, it can include:
- Contracts and deployment: relevant implementations, configuration, versions and their relationship to the available audit scope.
- Privileged controls: upgrade authority, administrative roles, multisig arrangements, timelocks and emergency permissions.
- Dependencies: oracles, bridges, collateral contracts and other systems that introduce technical assumptions.
- Position mechanics: deposit and withdrawal paths, approvals, restrictions, and failure scenarios relevant to your intended use.
- Existing security evidence: published findings, remediation status where verifiable, and questions requiring confirmation from the protocol team.
What you receive
- A technical diligence memo identifying the reviewed systems, date, evidence and assumptions.
- A map of material dependencies and privileged controls within scope.
- Prioritized findings, unresolved questions and suggested technical mitigations or checks.
- A walkthrough with your team to explain the conclusions and remaining uncertainty.
The memo makes the basis for the assessment explicit. It separates verified observations from assumptions and information that was unavailable.
Scope and engagement
We agree on the protocol, network, intended interaction and review depth before starting. A focused diligence review does not imply a full audit of every underlying contract. If deeper code review is needed, I identify that separately.
The assessment reflects the reviewed deployment and information available at the time. Code changes, governance actions and dependency changes can warrant another review.
This service supports technical risk decisions. Investment selection, market and credit risk, legal advice and regulatory assessments remain outside the engagement unless separately covered by appropriate specialists. A review does not guarantee safety or returns.
Questions before we start
Is DeFi due diligence the same as a smart contract audit?
No. Due diligence examines the deployed system, existing security evidence, dependencies and privileged controls relevant to your intended interaction. A code audit investigates a defined codebase in greater depth. If diligence identifies a need for deeper code review, we scope that separately.
Who is this service for?
Funds, market makers, trading firms and treasury teams evaluating a protocol, vault or integration. The review supports a specific technical decision; it does not replace investment, legal or market-risk analysis.
What determines the cost and timeline?
The number of protocols and networks, deployment complexity, available documentation and required review depth determine the scope. Share the proposed interaction and decision deadline so we can agree on a quote, deliverables and schedule before work begins.
What do you need to begin?
The protocol and network, relevant contract addresses, available documentation and audits, and a description of how your team intends to interact with the system. Any missing information is recorded as an open question.
Can the assessment remain confidential?
Confidentiality terms and any NDA requirements are agreed before sensitive material is shared. Publication of an engagement or its findings is agreed separately; a review does not require a public report.
Bring the protocol and the decision.
Tell me what your team is considering, how it expects to interact with the protocol, and when it needs the assessment. We can define a useful review scope from there.