Launch on-chain with a team that has done it before.

An audit is a time-boxed review of a specific commit by people who combine manual reading with static analysis, fuzzing, and invariant testing, producing findings ranked by severity with remediation advice and usually a re-review of fixes. It does not prove the absence of bugs, it rarely covers economic design in depth, and it says nothing about the deployment configuration, the admin keys, or the off-chain systems unless those are in scope. A well-run project books the audit early, freezes the code before it starts, and treats the audit as one layer alongside internal review, a bug bounty, and monitoring.

Upgradeable contracts route calls through a proxy that delegates to an implementation contract that can be swapped, with the storage living in the proxy, which is why storage layout mistakes and uninitialized implementations are a recurring source of exploits. Upgradeability lets a team fix bugs and evolve the protocol, but it asks users to trust whoever holds the upgrade key, so immutable contracts with tunable parameters often earn more trust. When it is justified, a well-built system puts the upgrade right behind a multisig and a timelock and checks storage layout in CI on every change.

Assets can be held in user-controlled wallets, in smart accounts with recovery rules, in multisig wallets, in MPC wallets where no single party holds a full key, or with a qualified custodian that takes legal responsibility, each with different trade-offs between control, operational risk, and liability. Whether your product ever holds user assets is also the question that most often determines how regulators classify it. A well-built architecture decides the custody model first and designs key management, signing flows, and incident procedures around that decision.

A layer-1 such as Ethereum offers the strongest settlement guarantees and the deepest liquidity at the highest fees, while layer-2 rollups inherit much of that security at lower cost, with differences in how withdrawals work: optimistic rollups impose a challenge window and ZK rollups rely on validity proofs. Each also differs in sequencer decentralization, bridging risk, tooling, and where the users and the liquidity you need already are. A well-reasoned choice starts from the users and the unit economics, launches on one chain, and keeps the code portable rather than going multi-chain on day one.

In the United States, a token may be treated as a security under the Howey test, as a commodity, or as something that triggers money transmission rules under FinCEN and the states, depending on how it is sold and used. In Canada, the securities regulators have published guidance on when crypto assets and crypto trading platforms fall under securities law, platforms generally must register or operate under undertakings, and dealing in virtual currency makes a business a money services business registered with FINTRAC. Classification depends on facts and changes with enforcement, so this is a question for counsel; a well-built system supports whatever controls they specify, such as KYC gating, geofencing, transfer restrictions, and record-keeping.

The recurring causes are reentrancy, price oracle manipulation often funded with flash loans, access control mistakes on privileged functions, compromised upgrade or admin keys, rounding and precision errors in math, bridge vulnerabilities, and governance attacks where voting power is borrowed. Most of these are known classes with known defenses, and the losses usually come from a rushed deployment or an unaudited change. A well-built protocol tests the invariants attackers would target, limits what any single key can do, and monitors critical events so a pause can happen before the drain completes.

A blockchain node answers questions about current state and individual transactions, but it cannot efficiently answer the questions an application asks, such as every position held by a user or the history of a pool. An indexer listens to events and blocks, writes them into a queryable database, and must handle chain reorganizations and lag honestly, with hosted subgraphs or custom indexers as the usual options. A well-built indexer reports its lag, reprocesses after a reorg, and never shows the user a state the chain has since reverted.

An oracle brings off-chain information such as asset prices on chain, either pushed by a network of node operators, pulled on demand with signed updates, or computed from on-chain sources such as a time-weighted average price on a decentralized exchange. Each has failure modes: stale updates, deviation thresholds that lag a crash, thin liquidity that makes an on-chain price manipulable, and operator collusion. A well-built protocol documents its oracle assumptions, checks staleness and deviation before acting on a price, and has a circuit breaker for when the feed looks wrong.

Account abstraction, standardized on the EVM through ERC-4337, lets a user's account be a smart contract rather than a key pair, so the account can define its own rules: who pays gas, which signatures count, session keys for a game or an app, spending limits, and social recovery. Bundlers and paymasters are the new infrastructure pieces that relay these operations and sponsor fees. A well-built product uses it to remove seed phrases and gas from the first-time experience while keeping the trust assumptions about the paymaster and the bundler explicit.

A launch is a scripted sequence: deterministic deployment, contract verification on explorers, parameter checks against the specification, transfer of ownership to a multisig behind a timelock, activation of monitoring on critical events, and a public bug bounty, with a communications plan for the first days. The incident runbook should name who can pause what and how fast. A well-prepared team rehearses the whole sequence on a fork until the checklist runs without surprises.

Businesses that exchange, transfer, or hold virtual currency for customers are generally money services businesses under Canadian and US anti-money-laundering law, with client identification, record-keeping, and reporting duties, and both countries apply versions of the FATF Travel Rule requiring originator and beneficiary information to accompany transfers above a threshold. Sanctions screening applies regardless of business model, and regulators have sanctioned specific addresses and protocols. The scope depends on your role in the transaction, so confirm it with counsel; a well-built platform integrates chain analytics for wallet screening and keeps the records a regulator will ask to see.

Maximal extractable value is the profit that block builders and searchers capture by ordering, inserting, or censoring transactions, and users feel it as front-running, sandwich attacks on swaps, and liquidations taken at the worst moment. It is a structural feature of public mempools rather than a bug, and layer-2 sequencers change the dynamics without removing it. A well-designed protocol limits the damage with slippage controls, batch or commit-reveal mechanisms, and private order flow where appropriate, and tests its economics against adversarial ordering rather than the happy path.