# DeFi due-diligence checklist for financial advisors

> A protocol audit is one input. Advisor diligence has to connect the client’s legal and economic exposure to every technical and operational dependency.

- URL: https://riadefi.com/due-diligence/defi-checklist/
- Section: Due diligence
- Author: Jon Ragsdale
- Reviewed: 2026-08-11

Reader objective: Build a repeatable pre-approval and monitoring process.

## 1. Define the position

- Name the exact token, contract, chain, protocol, market, and strategy.
- State the economic exposure and source of expected return.
- Identify the legal claim, issuer, counterparty, or lack of one.
- Record eligible investor and jurisdiction restrictions.

## 2. List every party that can change the position

- Asset issuer, collateral, redemption, and freeze authority
- Protocol contracts, upgrades, pauses, governance, and audits
- Oracles, bridges, curators, keepers, relayers, and front ends
- Chain liveness, transaction ordering, validators, and upgrade control
- Wallet, custodian, signer, recovery, and transaction-approval workflow

## 3. Test loss and exit

- Historical exploits, bad debt, depegs, halts, and governance failures
- Observable liquidity at client size, not only TVL
- Redemption gates, queues, market depth, fees, and settlement delay
- Failure scenarios for oracle, bridge, collateral, issuer, and keys
- Expected recovery path and responsible party

## 4. Make the decision monitorable

- Separate research assessment and firm-shelf reasons
- Client-specific position constraint and advisor-selected amount
- Observable review conditions set for the relevant research or decision layer
- Named owner, next review date, and evidence archive
- Client-language risk statement and suitability rationale
- Version history for corrections and changed decisions

**Evidence standard** If a fact can revoke the recommendation, record its source and monitoring method when the position is approved.

## What each step has decided

Each step above supports a distinct published research finding.

- Defining the position decided USD.AI: write down what the instrument actually is and the synthetic dollar becomes non-recourse lending against depreciating GPU hardware with a 30-day exit queue. [Rejected.](/rejections/usd-ai/)
- Listing every party that can change the position decided Kelp's rsETH: the staking logic was fine, and the cross-chain bridge was the real security model. In April 2026 a forged bridge message minted about 116,500 unbacked tokens, roughly 18% of supply. [Rejected.](/rejections/kelp/)
- Testing loss and exit decided Convex: converting CRV to cvxCRV is one-way, with no redemption path back. The only exit is a market sale at whatever discount prevails, which is worst exactly when everyone wants out. [Rejected.](/rejections/convex-finance/)
- Making the decision monitorable is why every Ketju memo, including every adverse assessment, ships with the observable events that would reopen the file and a scheduled next review.

## Sources

- [Investment Management — Investment Advisers](https://www.sec.gov/investment-management) — U.S. Securities and Exchange Commission
- [Crypto Assets](https://www.finra.org/rules-guidance/key-topics/crypto-assets) — FINRA

---

Published by Ketju Research (https://ketjuresearch.com). Educational analysis only; not legal, tax, compliance, or investment advice.
Machine-readable index: https://riadefi.com/llms.txt · Content API: https://riadefi.com/content.json