RIADeFi
Due diligence

DeFi due-diligence checklist for financial advisors

A protocol audit is one input. Advisor diligence has to connect the client’s legal and economic exposure to every technical and operational dependency.

By 2 min read

Educational analysis for financial professionals. Not legal, tax, compliance, or investment advice. Regulatory statements are source-linked and time-stamped.

Reader objective

Build a repeatable pre-approval and monitoring process.

1. Define the position

  • Name the exact token, contract, chain, protocol, market, and strategy.
  • State the economic exposure and source of expected return.
  • Identify the legal claim, issuer, counterparty, or lack of one.
  • Record eligible investor and jurisdiction restrictions.

2. List every party that can change the position

  • Asset issuer, collateral, redemption, and freeze authority
  • Protocol contracts, upgrades, pauses, governance, and audits
  • Oracles, bridges, curators, keepers, relayers, and front ends
  • Chain liveness, transaction ordering, validators, and upgrade control
  • Wallet, custodian, signer, recovery, and transaction-approval workflow

3. Test loss and exit

  • Historical exploits, bad debt, depegs, halts, and governance failures
  • Observable liquidity at client size, not only TVL
  • Redemption gates, queues, market depth, fees, and settlement delay
  • Failure scenarios for oracle, bridge, collateral, issuer, and keys
  • Expected recovery path and responsible party

4. Make the decision monitorable

  • Separate research assessment and firm-shelf reasons
  • Client-specific position constraint and advisor-selected amount
  • Observable review conditions set for the relevant research or decision layer
  • Named owner, next review date, and evidence archive
  • Client-language risk statement and suitability rationale
  • Version history for corrections and changed decisions
Evidence standardIf a fact can revoke the recommendation, record its source and monitoring method when the position is approved.

What each step has decided

Each step above supports a distinct published research finding.

  • Defining the position decided USD.AI: write down what the instrument actually is and the synthetic dollar becomes non-recourse lending against depreciating GPU hardware with a 30-day exit queue. Rejected.
  • Listing every party that can change the position decided Kelp's rsETH: the staking logic was fine, and the cross-chain bridge was the real security model. In April 2026 a forged bridge message minted about 116,500 unbacked tokens, roughly 18% of supply. Rejected.
  • Testing loss and exit decided Convex: converting CRV to cvxCRV is one-way, with no redemption path back. The only exit is a market sale at whatever discount prevails, which is worst exactly when everyone wants out. Rejected.
  • Making the decision monitorable is why every Ketju memo, including every adverse assessment, ships with the observable events that would reopen the file and a scheduled next review.

Primary and reference sources