How I Decide Which New Web3 Infrastructure to Trust

Frequently Asked Questions

01.What do you check before trusting new Web3 infrastructure?

I ask three things of every new dependency: what happens when it fails mid-transaction and whether funds stay recoverable, who audited it and whether the audit scope covers the code path we would truly use, and whether it has run in production long enough for edge cases to surface. I want at least six months of mainnet history with real value at stake before a client's contract depends on it.

02.Why doesn't audit coverage alone guarantee safety?

Audits catch what they are scoped to catch. Research from Olympix found that 90 percent of exploited smart contracts had already passed a formal audit, because most hacks target integration seams, dependency chains, and key management rather than the audited code path itself. An audit is one input into our vetting decision, never the whole answer.

03.How does composability change infrastructure risk?

Composability means inheriting the liquidity and users of a new layer, but also its bugs and its dependency chain. When a Balancer v2 vulnerability hit forks that copied the same pool math in November 2025, every integrator that inherited that code inherited the exploit too. We map the full dependency graph before integrating so a failure three layers down cannot silently drain a client's position.