vaayaa Inclusive Education
Technical risk assessment

Blockchain Development Risk Assessment: Contract, Key and Infrastructure Controls

A worked example of how a blockchain development team finds, scores and controls risks to smart contracts, signing keys, infrastructure, user data and people, from code defects and phishing to third-party libraries and incident response.

Updated November 2026 8 hazards assessed Review every 6 months Highest risk: Critical to Medium
See the Blockchain Development course

Executive summary

This assessment shows how a small blockchain development team can find, rate and control the risks that matter most to its contracts, keys, infrastructure and users. Eight hazards were chosen because they are plausible in the everyday building and running of a ledger application. Compromised signing keys and flaws in contract logic carry the highest inherent scores, because a single error can move or lock value at once. Each hazard is scored before controls and again after existing and added controls. Most fall to Medium or Low once controls are in place, but key compromise stays at High because the impact is severe even when unlikely. The first actions are multi-signature control of upgrades, independent code review before every release, hardware-backed key storage and a tested incident runbook. Every score illustrates method, not a real organization.

Focus area
Blockchain development and distributed ledger engineering
Setting
Software team building smart contracts and supporting services for a ledger-based application
Method
Five by five likelihood and impact risk register with residual scoring

Scope

This assessment covers a small team that writes, tests and deploys smart contracts, runs nodes and backend services, and manages signing keys for a ledger-based application. It covers code, keys, build pipelines, infrastructure, personal data and staff access. It does not cover investment decisions, token pricing or the legal status of any digital asset. Jurisdiction, network type and product are assumptions made for teaching.

Context

The team uses a version control system, an automated build and test pipeline, a public test network before any production release, and a cloud host for node and API services. Contracts are upgraded through a proxy pattern, and deployment keys sit in a hardware-backed vault. Users submit transactions through a web front end, and some profile data is stored off chain. Each risk is scored before controls to show its natural level, then again after existing controls and the additional controls that should be added.

Objectives, assets and stakeholders

The objective is to ship correct and secure contracts, protect signing keys and user data, keep services available and meet the duties owed to users and regulators. Assets in scope are deployed contracts, source code and build artifacts, signing keys, node and API infrastructure, user profile data and the team's reputation. Stakeholders include developers, the product owner, security reviewers, users, token holders, hosting providers, library maintainers and regulators where they apply. Each risk has one owner role. The engineering lead keeps the register current and reports to leadership each review cycle, and any change to a live contract passes through a documented sign-off.

Risk matrix: before and after controls

Each cell shows hazard numbers placed by likelihood and impact. Compare the two grids to see how controls move each hazard.

Before controls

Inherent risk

Risk before controls: rows are likelihood from almost certain to rare, columns are impact from insignificant to catastrophic. Cells list hazard numbers.
1
Insignificant		 2
Minor		 3
Moderate		 4
Major		 5
Catastrophic
5 Almost certain
4 Likely Likelihood 4, impact 3, score 12, high: H03 Likelihood 4, impact 4, score 16, high: H01 Likelihood 4, impact 5, score 20, critical: H02
3 Possible Likelihood 3, impact 3, score 9, medium: H05 Likelihood 3, impact 4, score 12, high: H04 H07
2 Unlikely Likelihood 2, impact 4, score 8, medium: H08 Likelihood 2, impact 5, score 10, high: H06
1 Rare

After controls

Residual risk

Risk after controls: rows are likelihood from almost certain to rare, columns are impact from insignificant to catastrophic. Cells list hazard numbers.
1
Insignificant		 2
Minor		 3
Moderate		 4
Major		 5
Catastrophic
5 Almost certain
4 Likely
3 Possible
2 Unlikely Likelihood 2, impact 2, score 4, low: H05 Likelihood 2, impact 3, score 6, medium: H03 H04 H06 H07 Likelihood 2, impact 4, score 8, medium: H01 H02
1 Rare Likelihood 1, impact 3, score 3, low: H08
  • Low 1 to 4
  • Medium 5 to 9
  • High 10 to 16
  • Critical 17 to 25

Hazard register

A summary first, then the detail for each hazard.

Summary of hazards with scores before and after controls
No.HazardBeforeAfterOwner
H01 Smart contract logic defects 16 High 8 Medium Lead smart contract developer
H02 Compromise of signing keys and wallets 20 Critical 8 Medium Security engineer
H03 Phishing and social engineering of developers 12 High 6 Medium IT security lead
H04 Third-party library and supply chain compromise 12 High 6 Medium Lead developer
H05 Node and infrastructure misconfiguration causing outage 9 Medium 4 Low Operations manager
H06 Insider misuse of privileged access 10 High 6 Medium Engineering lead
H07 Personal data exposure on or around the ledger 12 High 6 Medium Privacy lead
H08 Gaps in logging, monitoring and incident response 8 Medium 3 Low Operations manager
H01

Smart contract logic defects

Technology and data Before 16 After 8

Flaws in contract logic, such as missed access checks, rounding errors or unsafe external calls, let an attacker drain funds or lock assets, and the defect may stay hidden until the contract is used.

Who or what is affected: Users, token holders and the product owner

Causes

Complex logic, tight deadlines and reliance on one reviewer for critical code paths.

Consequences

Loss or locking of user funds, emergency pauses, costly redeployment and loss of trust.

Existing controls

  • Unit tests cover the main contract functions and run on each commit.
  • A senior developer reviews changes to value transfer code before merge.

Control gaps

Edge cases and interactions between contracts are tested less thoroughly than single functions.

Additional controls

  • Prevent: Use formal verification or a property-based test suite for every function that moves value.
  • Detect: Run an automated analysis tool on each build and track any new findings.
Likelihood 4 x impact 4 before; 2 x 4 after Owner: Lead smart contract developer Target: Within 45 days Early warning: A new static analysis finding on a function that transfers value.
H02

Compromise of signing keys and wallets

Technology and data Before 20 After 8

Deployment or administrator keys are copied, stolen or misused, letting an attacker upgrade contracts, move treasury funds or sign false transactions.

Who or what is affected: Users, token holders, operators and the treasury

Causes

Keys kept on developer machines, shared secrets and weak device hygiene.

Consequences

Theft of funds, malicious upgrades, irreversible transactions and severe reputational harm.

Existing controls

  • Keys are stored in an encrypted vault with every access logged.
  • Deployments require a second person to confirm the transaction.

Control gaps

Some legacy scripts still read keys from environment variables on build servers.

Additional controls

  • Prevent: Hold upgrade and treasury authority in a multi-signature arrangement with distinct approvers.
  • Respond: Keep a tested procedure to pause contracts and rotate keys from a clean device.
Likelihood 4 x impact 5 before; 2 x 4 after Owner: Security engineer Target: Within 30 days Early warning: Signing key use outside the approved window or from an unrecognized device.
H03

Phishing and social engineering of developers

People Before 12 After 6

Fake pull requests, counterfeit wallet extensions and messages impersonating maintainers trick developers into revealing credentials or approving malicious transactions.

Who or what is affected: Developers, operations staff and users

Causes

Urgent requests, public contributor channels and remote working habits.

Consequences

Compromised accounts, malicious code merged into releases, and funds approved to an attacker.

Existing controls

  • Staff complete security awareness training when they join.
  • Two factor sign in is required for the code host.

Control gaps

Training is annual and does not include practice with realistic lures.

Additional controls

  • Prevent: Enforce hardware security keys for all code and cloud accounts and block legacy sign in methods.
  • Detect: Flag new sign ins from unfamiliar locations and review wallet approval requests that look unusual.
Likelihood 4 x impact 3 before; 2 x 3 after Owner: IT security lead Target: Within 30 days Early warning: Reports of a developer asked to approve an unexpected wallet request or repository access.
H04

Third-party library and supply chain compromise

Supplier Before 12 After 6

A dependency, build plugin or compiler toolchain is replaced with a malicious or vulnerable version, which then enters the build and runs with the team's privileges.

Who or what is affected: Developers, users and library maintainers

Causes

Large dependency trees, abandoned packages and automatic updates.

Consequences

Malicious code in production, emergency rebuilds and loss of user trust.

Existing controls

  • Dependencies are pinned to fixed versions in the lock file.
  • A developer approves each new library before it is added to the project.

Control gaps

Transitive dependencies are not reviewed, and build tools are not pinned to fixed versions.

Additional controls

  • Prevent: Verify package checksums and mirror approved dependencies in a controlled internal repository.
  • Detect: Scan dependencies for known vulnerabilities on every build and alert on new advisories.
Likelihood 3 x impact 4 before; 2 x 3 after Owner: Lead developer Target: Within 60 days Early warning: A new version of a dependency that changes its maintainer or adds install scripts.
H05

Node and infrastructure misconfiguration causing outage

Operational Before 9 After 4

Open ports, default settings or an unpatched node software version leave services unavailable, or let nodes fall out of step with the network after an upgrade.

Who or what is affected: Users, operators and support staff

Causes

Manual changes, missed patches and default settings left in place.

Consequences

Service outage, delayed transactions and extra load on support staff.

Existing controls

  • Infrastructure is defined in version controlled templates.
  • Node health checks report to the operations dashboard.

Control gaps

Manual hotfixes are applied to servers without updating the template.

Additional controls

  • Prevent: Apply a hardened baseline and close unused network ports through the template.
  • Recover: Keep a rebuild script and test restoring a node from snapshot each quarter.
Likelihood 3 x impact 3 before; 2 x 2 after Owner: Operations manager Target: Within 60 days Early warning: A node out of sync with the network for more than 30 minutes.
H06

Insider misuse of privileged access

People Before 10 After 6

A developer or administrator with broad rights reads user data, changes production code or deploys an unreviewed build, either for personal gain or out of grievance.

Who or what is affected: Users, colleagues and the business

Causes

Broad standing access, weak offboarding and little separation of duties in small teams.

Consequences

Data theft, sabotage, legal exposure and damage to reputation.

Existing controls

  • Privileged accounts are granted only by a named approver.
  • Production access is logged for each session.

Control gaps

Access reviews are not scheduled, and session logs are not checked by anyone other than the account holder's line manager.

Additional controls

  • Prevent: Apply least privilege and separate the duty of writing code from the duty of deploying it.
  • Respond: Revoke access within one hour when a role changes or an employee leaves.
Likelihood 2 x impact 5 before; 2 x 3 after Owner: Engineering lead Target: Within 45 days Early warning: A privileged account used at unusual hours or deploying a build with no linked review.
H07

Personal data exposure on or around the ledger

Legal and compliance Before 12 After 6

Personal details are written to a public ledger or logged in plain text, or profile data stored off chain is exposed, creating duties under privacy rules that vary by jurisdiction.

Who or what is affected: Users, customers and the compliance officer

Causes

Design choices made without a privacy review and debug logging left on in production.

Consequences

Regulatory inquiry, user complaints and forced data removal that a ledger cannot easily support.

Existing controls

  • The design writes only hashed identifiers to the ledger.
  • Personal data is encrypted at rest in the profile store.

Control gaps

Logging rules are not reviewed when new events are added to the contracts.

Additional controls

  • Prevent: Review each data field with the privacy lead before it is stored or emitted as an event.
  • Detect: Scan logs and ledger events for patterns that look like personal data.
Likelihood 3 x impact 4 before; 2 x 3 after Owner: Privacy lead Target: Within 60 days Early warning: A new event type or log field that includes a name, email address or account number.
H08

Gaps in logging, monitoring and incident response

Operational Before 8 After 3

Events are not recorded with enough detail or kept long enough, alerts are ignored and no rehearsed plan exists, so an intrusion can run for days before anyone acts.

Who or what is affected: Users, operators and the incident team

Causes

High log volume, unclear ownership of alerts and no practice runs.

Consequences

Longer exposure, weak evidence for investigation and slower notice to users.

Existing controls

  • Application and build logs are kept in a central store.
  • An on call rota covers service alerts outside working hours.

Control gaps

Logs for key signing events are not kept in a tamper resistant store.

Additional controls

  • Detect: Alert on privileged actions, failed sign ins and contract upgrades in a monitored queue.
  • Respond: Rehearse the incident runbook twice a year with a named owner for each step.
Likelihood 2 x impact 4 before; 1 x 3 after Owner: Operations manager Target: Within 60 days Early warning: An alert that remains unacknowledged for more than two hours.

Rating method and evaluation

Each hazard is rated on two five-point scales. Likelihood runs from Rare to Almost certain, and impact runs from Insignificant to Catastrophic. Multiplying the two gives a score from 1 to 25, which falls into one of four bands: Low from 1 to 4, Medium from 5 to 9, High from 10 to 16 and Critical from 17 to 25. The score orders work and is not a measurement. Inherent risk is the score before any controls. Residual risk is the score after the existing and added controls, and it must never be higher than the inherent score. Impact considers lost or locked value, user harm, downtime, legal exposure and damage to trust. A risk is never rated down only because it has not yet happened. Critical and High risks need senior attention and a dated plan, Medium risks need routine controls with a named owner, and Low risks are accepted and watched. Peer reviewers who did not write the affected code challenge the ratings, and the register is reviewed whenever an indicator reaches its escalation threshold or after a material change to the system.

Likelihood, impact and rating bands

Likelihood

  • 5 Almost certain: Expected to happen in most circumstances.
  • 4 Likely: Will probably happen in many circumstances.
  • 3 Possible: Could happen at some time.
  • 2 Unlikely: Not expected, but it could happen.
  • 1 Rare: Only in exceptional circumstances.

Impact

  • 1 Insignificant: No lasting effect. Handled within routine work.
  • 2 Minor: Small effect that is quickly corrected.
  • 3 Moderate: Noticeable effect that needs managed effort to correct.
  • 4 Major: Serious effect on people, delivery or reputation.
  • 5 Catastrophic: Severe or lasting effect that threatens the whole activity.

Bands (likelihood x impact)

  • Low (1 to 4): Accept and monitor.
  • Medium (5 to 9): Manage with routine controls.
  • High (10 to 16): Senior attention and a treatment plan.
  • Critical (17 to 25): Act first. Do not proceed until reduced.

Monitoring, escalation and review

Review this assessment every 6 months, and sooner when an indicator below reaches its threshold.

Early-warning indicators and escalation thresholds
Indicator to watchEscalate when
Unreviewed code or dependency changes merged into a release branch.Escalate to the engineering lead at once, and block the release until a second reviewer signs off.
Signing key use outside the approved window or from an unrecognized device.Escalate to the security engineer immediately, freeze upgrades and rotate the key within 24 hours.
Failed sign in attempts or new access grants on code and cloud accounts.Escalate to the IT security lead when more than five failures occur in an hour, and to the engineering lead if any grant is unexplained.
Node downtime or API error rate above the agreed service level for a day.Escalate to the operations manager when the threshold is breached, and to leadership if service is not restored within four hours.
Open vulnerability findings or outdated third-party libraries past their fix date.Escalate to the lead developer when a finding passes its fix date, and to the engineering lead if it is rated Critical.

Contingency arrangements

If a serious event occurs, such as a suspected key compromise, an exploitable contract flaw or a data exposure, the engineering lead pauses related deployments and calls the incident team. Upgrade rights are frozen where the design allows, keys are rotated from a clean device and logs are preserved. Affected users are told what happened and what they should do, through a checked channel. Legal and specialist security advisers are engaged as needed for the relevant jurisdiction. Recovery uses the latest reviewed build and a tested restore of service data.

Prioritized action plan

  1. Move contract upgrade rights to a multi-signature arrangement with two approvers, owner engineering lead, within 30 days.
  2. Store deployment and signing keys in hardware-backed storage with rotation records, owner security engineer, within 30 days.
  3. Require an independent code review and a passing analysis tool run before any release, owner lead developer, within 45 days.
  4. Enforce hardware security keys and least privilege on code, cloud and pipeline accounts, owner IT security lead, within 30 days.
  5. Write and rehearse an incident runbook with a named backup for each role, owner operations manager, within 60 days.

Conclusion

Secure blockchain delivery rests on a few steady habits: independent review of every release, multi-party control of upgrades, protected keys, disciplined logging and a rehearsed response. The highest scores sit with key compromise and contract logic, and each has actions that bring the residual score down. Treat the register as a living record, review it on the stated cycle, and seek qualified advice for any real security, legal or financial question.

Assumptions and limitations

Assumptions

  • The application runs on a ledger with a small number of deployed contracts, so network type is assumed for teaching.
  • Developers use common languages, frameworks and analysis tools on managed laptops.
  • Jurisdiction is not specified, so legal duties are described only in general terms.

Limitations

  • Scores are examples for learning and do not describe any real network, product or team.
  • Smart contract security, cryptography and financial rules are specialist fields, so qualified review is needed before any release.
  • This is educational content and does not replace a formal site-specific assessment or licensed advice.

Related frameworks to study

  • Threat modeling with a structured method such as STRIDE
  • Secure software development lifecycle guidance
  • Three lines model of risk ownership
  • Hierarchy of controls
  • Incident response lifecycle

Technical Risk Assessment

China, India, United States, Indonesia, Pakistan, Nigeria, Brazil, Bangladesh, Russia, Japan, Mexico, Philippines, Vietnam, Egypt, Turkey, Germany, United Kingdom, France, Italy, Canada, South Korea, Australia, Spain.

For Learning Reference Only: This assessment demonstrates how risk assessment principles are applied in a practical setting, providing a useful reference for learning and understanding. Actual assessments may be adapted to suit specific site conditions and circumstances.

Keep learning

Study the subject behind this assessment.

Blockchain Development course Read the best practices for this course

More Technical risk assessments

Hourly Active: 39,499 Learners