Crypto Due Diligence Checklist for Token Research

Why Question-Driven Crypto Due Diligence Beats a Long List

Long checklists fail when they treat cosmetic milestones as equal to structural hazards. A project can publish a whitepaper and list on exchanges while leaving an unverified admin key or a frozen bank account in position to impair holders. Effective crypto due diligence focuses on the failure modes that determine whether a protocol survives stress.

In the STRICT framework, each asset receives a composite score from 0 to 100 across six pillars alongside an independent Risk score from 1 to 10. Separating fundamental quality from operational hazard matters because a technically differentiated network can still carry severe exploit or regulatory exposure.

Below, the nine questions a careful buyer asks are grouped into four verification stages, followed by a completed walkthrough using StrictScore's dated evidence for USDC, Arbitrum, THORChain, and TrueUSD.

Step 1: Verify Team Control, Governance, and Contract Permissions

The first stage of crypto due diligence establishes who can alter protocol rules or move user funds. A protocol may be described as community-run while a founding company or small multisig retains unilateral upgrade power.

Who Controls the Team and Governance Execution?

This question maps to the Transparency pillar. Read foundation setup disclosures, corporate filings, and governance documentation first, such as the Arbitrum Foundation initial setup transparency report (abre em uma nova aba) and Arbitrum DAO governance documentation (abre em uma nova aba).

• Não marcado: What to check: Legal entity structure, leadership disclosures, and quorum rules. Where to check it: Foundation transparency reports, SEC filings, and DAO docs. Red flag: Anonymous operators controlling treasury transfers without timelocks.
• Não marcado: What to check: Whether proposals execute via on-chain timelocks or manual team action. Where to check it: Governance portals and timelock contracts on a block explorer. Red flag: A board or single wallet can veto votes without a delay window.

Who Holds the Smart Contract and Admin Keys?

This question maps to the Transparency pillar. Read verified contract source code on Etherscan (abre em uma nova aba), rollup stage profiles on L2BEAT (abre em uma nova aba), and open-source repositories such as Offchain Labs' Nitro GitHub (abre em uma nova aba) and BoLD fault-proof documentation (abre em uma nova aba).

• Não marcado: What to check: Proxy admin ownership, multisig thresholds, and timelock delays on vault or bridge contracts. Where to check it: Verified contract tabs on Etherscan and permission matrices on L2BEAT. Red flag: Unverified bytecode or an externally owned admin key with zero delay.
• Não marcado: What to check: Freeze, blacklist, or pause permissions inside token contracts. Where to check it: Token code on GitHub and block explorers, plus legal terms. Red flag: Undisclosed mint or pause privileges omitted from public docs.

Step 2: Inspect Security Audits and Operational Incident History

Security reviews and past crisis responses show how a protocol handles real-world threats. In crypto due diligence, an auditor's badge on a website never substitutes for reading the scope table and post-mortem archive.

What Do Security Audits Cover and Leave Out?

This question maps to the Transparency pillar and the Innovation pillar. Read signed audit PDFs in the project's GitHub repository, check the commit hashes tested, and compare them against architecture docs. A contract audit covers only the listed files at a single commit hash, leaving off-chain signing layers or later code upgrades outside its guarantee.

• Não marcado: What to check: Whether deployed bytecode matches the exact GitHub commit hash in the audit report. Where to check it: Audit scope tables, GitHub release tags, and block explorer compiler settings. Red flag: Core contracts modified after the audit without a follow-up review.
• Não marcado: What to check: Remediation of high-severity findings and excluded subsystems. Where to check it: Audit remediation appendices and architecture docs. Red flag: Unresolved high-severity findings or off-chain signing layers excluded from scope.

How Did the Protocol Handle Past Security Incidents?

This question maps to the Sustainability pillar and the Transparency pillar. Read official incident post-mortems, validator recovery logs, and regulator press releases. THORChain's exploit report (abre em uma nova aba) documents the May 15 GG20 failure (StrictScore analysis dated 2026-10-03), and the SEC release on TrueUSD (abre em uma nova aba) documents charges over TUSD reserves (analysis dated 2026-10-21). Reported multi-week halts, a reported researcher disclosure dispute, and court freezes are the kind of incident outcomes StrictScore's Sustainability and Transparency ratings weigh for these two coins.

• Não marcado: What to check: Root-cause disclosure, network halt duration, loss absorption, and researcher communications. Where to check it: Official incident reports, treasury flows, and regulatory filings. Red flag: Vague post-mortems, multi-week liquidity freezes, or researcher disclosure disputes.
• Não marcado: What to check: Whether a past security or custody failure left balance-sheet impairment or court freezes. Where to check it: Court dockets, SEC releases, and reserve attestations. Red flag: Frozen collateral or bankruptcy proceedings that remain unresolved.

Step 3: Examine Treasury Runway and Protocol Revenue Capture

A sustainable protocol funds development and security without relying on endless token dilution. Our crypto fundamental analysis guide explains on-chain financial statements; during crypto due diligence, verify runway and fee capture directly from primary dashboards and filings.

Does the Treasury Provide Multi-Year Runway?

This question maps to the Sustainability pillar. Read DAO treasury wallets, foundation transparency reports, DeFiLlama chain dashboards (abre em uma nova aba), L2BEAT Total Value Secured trackers (abre em uma nova aba), and SEC filings.

• Não marcado: What to check: Treasury size and liquid asset mix relative to annual operating outlays. Where to check it: Treasury addresses, foundation reports, and SEC EDGAR filings. Red flag: A treasury held mostly in an illiquid native token, or parent-company bankruptcy and court freezes.
• Não marcado: What to check: Ecosystem depth supporting longevity, including DeFi TVL and stablecoin balances. Where to check it: DeFiLlama dashboards and L2BEAT Total Value Secured records. Red flag: Shrinking liquidity after prolonged halts or regulatory exchange delistings.

Where Does Revenue Come From and Who Captures It?

This question maps to the Revenue pillar. Read DeFiLlama fee trackers (abre em uma nova aba), fee-routing documentation such as Arbitrum's Timeboost docs (abre em uma nova aba), and company financial statements such as Circle's Q2 2026 financial release (abre em uma nova aba) and its SEC Form 10-Q for the first quarter of 2026 (abre em uma nova aba). Separate protocol fee generation from token-holder value capture, since sequencing fees or issuer reserve income may accrue to a DAO treasury or a corporate parent rather than token holders, as StrictScore records for Arbitrum's fees (as of 2026-10-21).

• Não marcado: What to check: Consistency of 30-day and quarterly fee generation from organic demand. Where to check it: DeFiLlama fee dashboards, SEC filings, and earnings releases. Red flag: Fee generation interrupted by multi-week outages or dependent on emission subsidies.
• Não marcado: What to check: Whether protocol fees flow to token stakers, burn contracts, a DAO treasury, or a corporate parent. Where to check it: Fee-collector contracts and governance docs. Red flag: Governance tokens with zero claim on fees routed to a treasury or equity issuer.

Step 4: Audit Token Supply, Unlock Schedules, Liquidity, and Reserves

Sound technology can still produce poor outcomes if scheduled token unlocks overwhelm demand or thin liquidity prevents clean execution. Our tokenomics evaluation guide and rug-pull detection guide explain these mechanics; run the checks below during crypto due diligence.

What Are the Supply Mechanics and Upcoming Unlocks?

This question maps to the Tokenomics pillar. Read CoinGecko supply profiles (abre em uma nova aba) and governance vesting docs such as Arbitrum's DAO governance documentation (abre em uma nova aba). Verify the circulating supply ratio, annual inflation cap, and 12-month unlock schedule.

• Não marcado: What to check: Circulating versus maximum supply, annual inflation cap, and 12-month unlocks. Where to check it: CoinGecko supply pages and foundation tokenomics docs. Red flag: Recurring monthly insider unlocks with no fee-sharing or burn mechanism.
• Não marcado: What to check: Whether the token has mandatory utility in node bonding or settlement versus voting only. Where to check it: Protocol staking and pool documentation. Red flag: Governance-only tokens absorbing continuous vesting dilution without cash-flow rights.

How Deep Is Liquidity and Exchange Exposure?

This question maps to the Community pillar and the Sustainability pillar. Read DEX volume trackers on DeFiLlama (abre em uma nova aba), spot market pairs on CoinGecko (abre em uma nova aba), and regional compliance notices. Verify whether trading sits on tier-1 regulated exchanges or has retreated to tier-3 venues following MiCA delistings or margin collateral removals.

• Não marcado: What to check: Exchange tier quality, 30-day DEX volume, and regulatory status across US and EU MiCA venues. Where to check it: DeFiLlama DEX dashboards, CoinGecko market pairs, and exchange collateral notices. Red flag: Reliance on tier-3 exchanges, regional delistings, or removal from margin collateral schedules.

Are Stablecoin Reserves Segregated and Independently Attested?

This question maps to the Transparency pillar, the Sustainability pillar, and the Tokenomics pillar. Secondary market trading near $1.00 never proves a stablecoin is solvent. Read issuer attestation pages such as Circle's transparency portal (abre em uma nova aba) and USDC legal terms (abre em uma nova aba), SEC EDGAR filings (abre em uma nova aba), S&P Global stability assessments (abre em uma nova aba), and Chainlink Proof of Reserve feeds (abre em uma nova aba).

• Não marcado: What to check: Reserve asset quality, legal segregation of backing assets, and monthly third-party assurance. Where to check it: Issuer transparency pages, Big Four AICPA assurance reports, SEC filings, and S&P Global assessments. Red flag: Relying on an on-chain balance feed while off-chain custodians face court freezes, SEC action, or bankruptcy.

Step 5: Compare Completed Due Diligence Across Four Real Tokens

Applying this crypto due diligence checklist to USDC, Arbitrum, THORChain, and TrueUSD shows how primary evidence maps into composite ratings and risk scores, each on the coin's own analysis date: USDC 2026-10-15, THORChain 2026-10-03, Arbitrum and TrueUSD 2026-10-21.

THORChain vs. USDC: Incident Recovery Next to Attested Reserves

Comparing THORChain (StrictScore analysis dated 2026-10-03) with USDC (analysis dated 2026-10-15) shows why composite and risk scores work together in crypto due diligence. StrictScore scores THORChain 62 overall (down from 69 previously), led by 80 on Innovation for native cross-chain swaps without wrapped assets and 70 on Tokenomics because RUNE keeps pool and node-bonding utility and the exploit losses were reported as absorbed without minting new RUNE. Yet THORChain carries a 9/10 Risk score, four risk flags (regulatory, bridge risk, security incident, and low liquidity), third-tier exchange depth, and negative regulatory standing in StrictScore's input set. Per THORChain's exploit report (abre em uma nova aba), the May 15 GG20 signing-layer failure caused about $10.7 million in losses. Press coverage reports that core operations halted for more than five weeks (The Defiant (abre em uma nova aba)). StrictScore's rationale ties the 55 on Sustainability, Revenue, and Community to that halt, and the 60 on Transparency to a reported researcher dispute over a similar earlier disclosure.

In contrast, USDC (analysis dated 2026-10-15) earns a 94 STRICT score and a 2/10 Risk score (first-tier exchange access and positive regulatory standing, with regulatory exposure, depeg history, and concentration tracked as baseline stablecoin flags). StrictScore records that Circle held $73.00 billion in segregated reserves backing $72.69 billion circulating on October 12, 2026 (87.0% in short-dated US Treasuries and overnight repos; see Circle's transparency page (abre em uma nova aba) and USDC legal terms (abre em uma nova aba)), earning 97 on Transparency, 94 on Tokenomics, and 93 on Sustainability. StrictScore also records $701 million in Q2 2026 revenue and reserve income (up 7% year-over-year after $694 million in Q1 2026) and $48 million in net income (see Circle's Q2 2026 release (abre em uma nova aba) and its first-quarter 10-Q (abre em uma nova aba)), scoring 93 on Revenue. On Innovation (92) and Community (94), StrictScore records CCTP V2 as Circle's current native cross-chain transfer protocol, and Circle's migration guide (abre em uma nova aba) schedules the V1 (Legacy) deprecation to begin October 31, 2026 (see also the supported chains (abre em uma nova aba)), and records an Arc mainnet launch on September 16, 2026. StrictScore's input set also records $14.8 trillion in Q2 2026 volume and 175 institutions enrolled in the Circle Payments Network, both in Circle's Q2 2026 release (abre em uma nova aba), and $346.69 billion in issuance over the trailing 365 days, a figure tied to Circle's transparency page (abre em uma nova aba).

TrueUSD vs. Arbitrum: Reserve Red Flags and Layer 2 Governance Tradeoffs

TrueUSD (StrictScore analysis dated 2026-10-21, STRICT score 33, Risk 10/10, an all-time high recorded in October 2023, first-tier exchange access, negative regulatory standing, and risk flags for regulatory exposure, depeg history, and security incident) shows how custody failures can outweigh a secondary price near $1.00 on Etherscan (abre em uma nova aba) and CoinGecko (abre em uma nova aba). While Chainlink's Proof of Reserve feed (abre em uma nova aba) and automated minting checks in TrustToken's GitHub contracts (abre em uma nova aba) support 50 on Transparency and 45 on Innovation, Revenue is unrated, Sustainability is 20, and Community is 20 after European MiCA delistings and collateral removals. Tokenomics is 35 because $456 million in reserves is frozen by the Dubai DIFC Court and S&P Global rates TrueUSD at its lowest stability rating (abre em uma nova aba); the Archblock LLC Chapter 11 bankruptcy and the SEC charges (abre em uma nova aba) weigh on Sustainability and Transparency.

Arbitrum (StrictScore analysis dated 2026-10-21, STRICT score 83, Risk 4/10, a concentration risk flag, first-tier exchange access, neutral regulatory standing) pairs strong operations with a tokenomics constraint. It scores 88 on Transparency and 88 on Innovation with Nitro docs (abre em uma nova aba), Stylus Rust and C++ contracts (abre em uma nova aba) (Stylus SDK (abre em uma nova aba)), BoLD fault proofs (abre em uma nova aba), and October 2026 Fhenix CoFHE execution. It earns 82 on Sustainability ($1,450,761,597 DeFi TVL and $3.79 billion in stablecoins on DeFiLlama (abre em uma nova aba), plus over $16 billion in Total Value Secured as of 2026-10-21; L2BEAT (abre em uma nova aba)'s live figure moves, so check its current page) and 83 on Community (over 2.4 billion transactions, $5.26 billion in 30-day DEX volume, $158.86 million in tokenized funds, and $264.7 million in spot volume, all as of 2026-10-21; StrictScore's input set also records a $16,472,154,924 all-time-high market cap in January 2024; live figures on CoinGecko (abre em uma nova aba) move, so check its current page). Yet Revenue scores 78 and Tokenomics scores 71: circulating supply is 6.89 billion of the 10 billion ARB cap (68.9%) with a 2.0% annual inflation cap and 92.65 million ARB unlocking monthly through March 2027 (4.63% of supply over the next 12 months, per StrictScore's Arbitrum input set sourced to CoinGecko (abre em uma nova aba) and Arbitrum DAO documentation), while $699,246 in 30-day chain fees from sequencing and Timeboost auctions (abre em uma nova aba) accrue to the DAO treasury rather than ARB holders.

Step 6: Cross-Check Your Findings With StrictScore Reports

After completing your manual review, use StrictScore to benchmark your conclusions and monitor changes over time. Individual token reports for USDC, Arbitrum, THORChain, and TrueUSD display the composite score, the scored pillar ratings (TrueUSD's Revenue is unrated), active risk flags, and dated source links.

Review the STRICT scoring methodology to see how Sustainability, Transparency, Revenue, Innovation, Community, and Tokenomics are weighted across sectors. Filter the coverage universe on the crypto rankings table, run head-to-head pillar checks in the token comparison tool, and audit rating accuracy on our public prediction track record. Pairing automated registry evidence with disciplined crypto due diligence helps you spot structural weaknesses early.