A Web3 application review needs to explain what the user authorizes and which components deliver the advertised function. Start with a concrete action, such as depositing an asset or accessing a membership service, and follow that action through the interface, contracts, data sources, and operators involved. Record where control changes hands and what must remain available. This framework turns a broad application description into an inspectable sequence of dependencies, permissions, and exit conditions that can be assessed before an operational decision is made.
What to examine
For each contemplated interaction, identify the recipient, affected asset, requested permission, and duration or scope shown. Explain why the application needs that access for the intended task. Keep an account connection, a signature request, and an asset transaction as separate review events with separate evidence.
Identify the deployed components that determine the application's behavior and the parties able to change them. Look for documented upgrade, pause, or configuration processes relevant to the actual implementation. Preserve what was examined, including version information, so a technical assessment has an understandable scope and date.
Map the services required between a user's request and the expected result. Include interfaces, data inputs, payment or settlement routes, and any operator expected to resolve exceptions. Ask which functions remain accessible during an interruption and what documentation supports the proposed recovery or alternative access process.
A practical review sequence
Choose a specific action and write the expected starting and ending state. Identify the asset or access involved and the evidence of success. Avoid evaluating every advertised feature at once; establish a reproducible action path that exposes the dependencies relevant to the review.
Record the permission presented at each interaction and compare it with the action's stated purpose. Resolve unexplained differences in recipient or scope before proceeding. Where technical interpretation is needed, preserve the details for a qualified reviewer instead of guessing from the interface label.
Follow a plausible interruption through the action path. Identify the component that fails, the user's resulting position, and the party responsible for recovery. Record the evidence needed to understand any pending transaction, unavailable interface, or delayed external input in that specific scenario.
Describe the steps required to withdraw, transfer, revoke a permission, or end access as applicable. Distinguish documented procedures from assumptions about the interface. Preserve eligibility rules, timing conditions, and unresolved controls so the review explains how the relationship is expected to end.
Primary-source context: ERC-721: Non-Fungible Token Standard. Use it alongside the asset-specific records relevant to your review.
Questions to resolve
Treat it as one interaction to inspect in context. Record what information or access is requested, then examine later signatures and transactions individually. The review should explain each authorization event rather than using a connection status as a summary of all permissions associated with an application.
Check the examined version, components, methods, and stated limitations. Compare that scope with the deployment and function under review. Preserve unresolved differences and later changes, since the report's existence alone does not establish that every current dependency or operational process was examined.
Investigate the documented alternative access route and the conditions required to use it. Identify which functions depend on the interface, external services, or an operator. Record demonstrated access separately from a theoretical possibility, and keep any technical or practical limitations visible in the result.
Read the Lab
An NFT can connect a token, a media reference, and a promised experience without making them the same asset. Use a structured rights and dependency review to establish what is documented, controllable, transferable, and still uncertain.
Read the guide: NFT and Web3 Due Diligence: What the Token Actually Gives YouA token's name and price chart reveal little about its controls. Build a Solana screening record that connects the correct mint to supply permissions, concentration, liquidity, and the evidence needed to resolve uncertain findings.
Read the guide: Solana Token Screening: Mint Authorities, Supply, and LiquidityA real-world asset token needs a documented connection to something beyond its ledger entry. Follow the claim from token to underlying asset, identify the responsible parties, and test how reconciliation, payments, redemption, and exceptions are supposed to work.
Read the guide: RWA Token Screening: Connect the Token to the Underlying ClaimRelated screening lenses
Questions worth asking
Explore a new asset class or suggest a topic for the Lab.
