All guides
Web3 projects fail more often from skipped basics than from clever code. Decide what you are actually trying to do, then choose the least risky way to do it. This guide is general information, not legal or tax advice.
Do you need your own smart contract?
| Goal | Usual approach |
|---|---|
| Accept crypto payments for goods or services | A regulated payment processor that settles in dollars or stablecoins. No custom contract needed. |
| Token, membership or on-chain record | A smart contract, built on audited libraries and tested heavily |
| Read on-chain data for reporting | An indexer or provider API feeding your own database |
| Hold company funds | A custody provider or a multisignature wallet with documented procedures |
Keys are the whole security model
- Private keys never go in code, repositories, chat or email.
- Use hardware wallets or a managed key service, and a multisignature wallet for company funds.
- Separate roles: the people who deploy are not the only people who can move money.
- Write down recovery and offboarding procedures and test them.
Smart contract practice
- Write contracts in Solidity for Ethereum and compatible networks, or Rust for Solana programs.
- Build on well-reviewed libraries such as OpenZeppelin instead of rewriting standard pieces.
- Test with a framework such as Foundry or Hardhat, including failure cases and fuzzing.
- Pay for an independent audit before mainnet. Deployed contracts are hard to change and bugs can be permanent.
- Be careful with upgradeable patterns: they add flexibility and a new trust assumption.
Pick the network deliberately
Ethereum mainnet offers the deepest ecosystem and the highest fees, so many projects use a layer-2 network for everyday activity. Solana is fast and inexpensive with a different programming model. Bitcoin is best known as a store of value and payment rail, with limited programmability.
Compliance questions to ask early
- Do you touch customer funds? Money-transmission and licensing rules may apply, state by state in the US.
- What identity checks (KYC) and anti-money-laundering controls do you need?
- How will you record transactions for accounting and tax?
- Who is responsible when a transaction goes wrong?