Orivions / Blog / Red flags when hiring

Guides · 6 min read

15 red flags when hiring a Web3 agency, developer or auditor

By Jakub Malarczyk, Founder, Orivions · October 18, 2026

Key takeaways

Unverifiable portfolios and guaranteed results are the most common early warning signs.
A precise quote from a vague brief is a guess, not an estimate.
Never let a provider hold your upgrade authority, treasury or deployment keys.
Pay per accepted milestone and keep the right to stop after any of them.
Treat changed payment details as fraud until confirmed through a second channel.

Most bad hires in Web3 are not a surprise in hindsight. The signs were visible in the portfolio, the first call or the contract. None of the flags below is proof on its own, but each one deserves a direct question, and several together are a reason to walk away.

Before the first call

1. A portfolio you cannot verify.

Logos and screenshots without program addresses, repositories or client contacts prove nothing.

2. Guaranteed outcomes.

Guaranteed followers, listings, token prices or "zero bugs" are promises nobody honest can make.

3. Pressure to decide fast.

"Our slot closes today" is a sales tactic, not a scheduling fact.

4. No identifiable people.

An anonymous team with no public track record and no references carries risk you cannot measure.

During scoping

5. A big fixed price from a two-line brief.

Without understanding your project, any precise number is a guess.

6. No questions about your users or goals.

Teams that only talk about their stack will build what is easy for them, not what you need.

7. Vague answers about who does the work.

The senior person on the call should tell you who will actually write the code or the report.

8. No mention of testing or audits.

For anything that holds funds, a team that does not raise security itself is a concern.

In the contract

9. Full payment upfront.

Fair terms tie payment to accepted milestones, with at most a modest deposit.

10. They keep the keys.

Upgrade authority, treasury, deployment keys and admin roles must sit with you, ideally in a multisig.

11. They keep the code.

All IP should transfer to you, and the repository should live in your organisation from day one.

12. No exit clause.

You should be able to stop after any milestone and take the work done so far.

During the work

13. No access to progress.

You should see the repository and a demo or written update at least weekly.

14. Changed payment details.

A new wallet address "because of an issue" is a classic fraud pattern. Confirm through a second channel.

15. Silence before deadlines.

Problems discovered on delivery day were usually known much earlier.

One question catches many of these: "Can you show me something you shipped on Solana mainnet, and put me in touch with that client?" Good providers answer it easily.

For a fast way to check a provider, follow how to verify a Web3 agency in 30 minutes. For contract terms, see milestone payments and escrow, and for marketing specifically, how to choose a Solana marketing agency.

Frequently asked questions

What is the biggest red flag when hiring a Web3 developer?

Asking to hold your program upgrade authority, treasury keys or deployment keys. Your team, ideally through a multisig, should control every key that can change or move what you own.

Is an anonymous Web3 team always a red flag?

Not always; some reputable contributors are pseudonymous with long public track records. It is a red flag when a team is anonymous and also has no verifiable history, no references and wants large payments upfront.

How can I check a Web3 provider before hiring?

Verify their work on-chain or in public repositories, speak to past clients, check that the people on the call are the people doing the work, and prefer providers whose identity and portfolio were verified by a third party.

Start with verified providers

Every provider on Orivions was checked by a person before getting the Verified badge. Describe your project and get matched. Free for teams.

Get matched →