Blockchain Due Diligence Checklist for Enterprises

By Ashkan KhamsehpourPublished November 14, 202611 min read

Quick answer. Check the network's validators, finality, upgrade powers and bridges; the vendor's SOC 2 scope, pentests, subcontractors and exit plan; the contracts' audited code, signer thresholds and timelocks; and your integration's limits, reconciliation and runbooks. Request dated evidence for each, not assurances.

Watch: Blockchain Due Diligence Checklist for Enterprises 1:38

Video transcript

Adopting a blockchain means inheriting risk from parties you may never sign with. Here is what to check first.

An enterprise asks whether it can run a process on a network, and leave it safely. Answer with dated evidence, not assurances.

Check four layers: the network, the vendor, the contracts and keys, and your own integration.

Ethereum finality needs two-thirds of staked ETH. About one-third can prevent it, so validator concentration matters.

A SOC 2 report covers only the system and period tested. Confirm your service is in scope, and ask for pentests and a tested exit plan.

Count thresholds, not signers. In Guardian's USDT0 Hedera review, a five-owner ProxyAdmin wallet needed one signature to authorize an upgrade.

Before go-live, pin chain IDs, read from two node providers, credit only at finality, enforce signing limits, and reconcile daily.

Request documents with dates and owners, then re-verify at procurement, before launch and after any material change.

Red flags include bytecode matching no audited commit, a one-of-many upgrade threshold, no delay before privileged changes, unnamed subcontractors and an untested exit.

Read the full checklist, or talk to Guardian about the Digital Asset Assurance Pilot, from architecture assessment to smart contract audits and offchain pentests.

Why Enterprises Need Their Own List

Adopting a blockchain means inheriting risk from parties you may never sign with: a network's validators, a vendor's keys and the contracts between them.

Investor checklists ask whether a protocol is worth backing. An enterprise asks a different question: can we run a process on this network, and leave it safely?

The US banking agencies' 2023 third-party guidance runs from planning and due diligence through contracting, monitoring and termination. It is supervisory guidance, not a regulation. Office of the Comptroller of the Currency, Federal Reserve and FDIC

A September 15, 2026 proposal from the OCC, Federal Reserve, FDIC and NCUA would replace it; the 2023 guidance stays relevant meanwhile. On November 13, 2026, they extended comments to December 16, 2026. Federal Register, OCC, Federal Reserve, FDIC and NCUA, Office of the Comptroller of the Currency, National Credit Union Administration, OCC, Federal Reserve Board, FDIC and NCUA

In the EU, DORA has applied since 17 January 2025. Articles 28 to 30 cover ICT third-party risk, concentration and written contract terms. European Union, EUR-Lex

NIST's CSF 2.0 quick-start guide on supply-chain risk says to set supplier requirements through governance, then run them as a program. National Institute of Standards and Technology

This checklist covers the network, the vendor and your integration, with the evidence to request for each. For the wider control set, see digital asset security for banks.

To send a vendor written questions, use our digital asset vendor due diligence questionnaire. For the full contract life cycle, see third-party risk management for crypto.

It covers the security side only and is not legal advice. DORA binds in-scope EU financial entities; whether a service supports a critical or important function decides the extra Article 30(3) contract terms, so confirm both with counsel.

Network Checks

A network is a dependency you cannot patch. Check who runs it, how it settles and who can change it.

Ethereum is a useful benchmark. Each validator runs an execution client, a consensus client and a validator client. Ethereum.org

Finality needs votes from at least two-thirds of staked ETH. About one-third can prevent it, so operator concentration is a diligence question, not trivia.

Still choosing a model? Our guide to permissioned vs permissionless blockchains compares who you trust in each.

Consensus: how blocks finalize, and what share of validators could halt or revert them.
Operators: the validator or sequencer roster, and how many independent organizations run it.
Clients: which software versions run, and what share of validators depends on one implementation.
History: dated halts, reorganizations and finality delays, each with a post-mortem.
Upgrades: who ships protocol changes, who can pause the network, and with what notice.
Dependencies: every bridge and oracle your assets or data would cross.
Monitoring: live alerts on finality lag, missed blocks and validator set changes.

Vendor Due Diligence Checks

A vendor might be a custodian, a wallet platform, a node provider or a tokenization platform. Its controls become yours once you integrate.

A SOC 2 report tests a service organization's controls against chosen Trust Services Criteria: security, availability, processing integrity, confidentiality and privacy. AICPA & CIMA

Its conclusions cover the system described and the period tested. They are not a guarantee for every service or deployment the vendor runs.

DORA Article 30 requires written contracts that describe the service, where it is provided, subcontracting conditions, and access to and return of your data. It is a useful floor outside the EU too. European Union, EUR-Lex

Our guide to SOC 2 for crypto companies explains carve-outs and what the report misses onchain.

Scope: the SOC 2 system description names the custody, signing or node service you will use.
Currency: a recent report, with a bridge letter covering the months since its period ended.
Exceptions: each tested control that failed, and management's response.
Subservice providers: whether each cloud, MPC or custody vendor is included or carved out, and carved-out vendors' own reports. AICPA Assurance Services Executive Committee
Pentests: independent reports on apps, APIs and signing services, with retest results.
Subcontractors and locations: who touches your data or transactions, and where.
Incident notice: a deadline in hours that explicitly includes key compromise.
Continuity: the date of the last test, and what failed.
Insurance: what covers theft of client assets, and what is excluded.

Contracts and Key Control

If the deployment runs on smart contracts, whoever can upgrade them can rewrite your business rules overnight.

OWASP's 2026 Smart Contract Top 10 ranks access control first. Business logic, oracle manipulation, input validation and proxy upgradeability also make the list. OWASP Smart Contract Security

Signer counts mislead without thresholds. In Guardian's USDT0 Hedera deployment review, the wallet owning the ProxyAdmin had five owners and a one-signature threshold. Guardian

One compromised owner could authorize an implementation upgrade. Guardian recommended a multi-signature quorum and a documented emergency upgrade process; the Low finding was acknowledged.

Audit findings are point-in-time evidence. Read the live configuration onchain before relying on any report.

If you will integrate an existing protocol, our DeFi protocol due diligence checklist covers the protocol side.

Bytecode: deployed code on every chain matches the commit the audit reviewed.
Roles: every owner, admin, upgrader, pauser and minter, read from chain state with a block number.
Multisigs: signers, threshold and how independent the signers are from each other.
Timelocks: the upgrade delay, compared with the time you need to see a change and exit.
Bypasses: any role that skips the delay, and when it was last used.
Key inventory: every key, where it lives, who holds it and its cryptoperiod. National Institute of Standards and Technology
Split knowledge and dual control: no single person holds a whole critical key, or can use or recover it alone.
Compromise recovery: a documented plan to revoke signers and rotate keys, tested on a recorded date.

Integration and Data Checks

Your own integration is the layer you control best. Test it before production, not after the first incident.

Our settlement finality by chain guide shows what final means on each network, and how long it takes.

Controls enforced only in a user interface do not count. Test each one at the API and contract level, where an attacker would.

Configuration: chain ID and contract addresses pinned, and checked at startup.
Node sources: balances and events read from at least two independent providers.
Finality: credit and release funds only at the chain's finality signal.
Signing limits: per-transaction and daily caps, plus allowlisted destinations, enforced in the signer.
Reconciliation: onchain balances matched to offchain ledgers daily, with breaks escalated to an owner.
Oracle and bridge messages: source, freshness and bounds validated before your system acts. OWASP Smart Contract Security
Runbooks: pause, rollback and key compromise exercised end to end before go-live.

Evidence to Request

Ask for documents with dates and owners, not answers. Get assurance reports under NDA and read the exceptions.

Validator sets, software versions, signers and bridge settings change. Re-verify them at procurement, before launch and after any material change.

Layer	Evidence to request	What it should show
Network	Consensus docs and validator or sequencer roster	Independent operators; no party near one-third of stake
Network	Halt, reorganization and incident history	Dated events, each with a post-mortem
Network	Upgrade and pause authority	Named holders, thresholds and notice periods
Vendor	SOC 2 report and bridge letter	Your service in scope; exceptions explained
Vendor	Pentest reports with retests	Signing services and APIs in scope; fixes verified
Vendor	Subcontractor and location register	Matches the contract; notice before changes
Vendor	Tested exit plan	Assets, keys and data returned on a set timeline
Contracts	Audit reports with commit hashes	Deployed bytecode matches the audited commit
Keys	Key inventory and ceremony records	Split knowledge and dual control; a dated recovery test
Integration	Reconciliation logs and drill records	Breaks resolved; drills passed before go-live

Red Flags

One red flag is not always a stop. Each one needs an owner and a documented decision on the residual risk.

Deployed bytecode that matches no audited commit.
A SOC 2 whose scope or period misses the service you will use. AICPA & CIMA
One signer, or a one-of-many threshold, able to upgrade contracts. Guardian
No delay before privileged changes, or a delay shorter than your exit time.
Validators or a sequencer run by one organization, or a handful.
Subcontractors the vendor will not name. European Union, EUR-Lex
An exit plan that has never moved assets.
A past incident with no post-mortem.

Frequently Asked Questions

Is a SOC 2 report enough for blockchain vendor due diligence?

No. Under the AICPA's description criteria, the report discloses complementary user entity controls that management assumed customers would run. Map each one to an owner on your side, or the conclusion may not hold for your deployment. It also does not test contract code. AICPA Assurance Services Executive Committee, AICPA & CIMA

Do Ethereum's validator rules apply to every network?

No. Ethereum's two-thirds finality rule is one design. Permissioned networks and rollups use different consensus and operator models, so ask each network for its own fault thresholds and who can halt it. Ethereum.org

What if a vendor will not share the evidence?

Record the gap as a finding. Ask for an alternative, such as an independent assessor's report under NDA or onchain facts you can read yourself. If none exists, limit what the vendor can move or hold until it does.

Sources

Test the Network, Vendor and Keys Before You Commit

Guardian's Digital Asset Assurance Pilot lets you choose modules, from an architecture assessment to a smart contract audit and offchain pentests of the consoles, APIs and signing services that can reach your keys.

Talk to Guardian Explore the service