A dApp is not a normal app with a wallet button. It is an application where some critical state or logic lives on a public chain, so nobody — including you — can silently change it. That property is expensive. Use it only where it earns its cost.
What belongs on-chain
- Ownership records where the owner needs to be able to prove it without you.
- Value transfer that must settle without a trusted intermediary — including agent-to-agent payments.
- Rules that must be credibly unchangeable — vesting, escrow, payouts, governance.
- Provenance for things whose origin must be verifiable later.
Everything else — user profiles, media files, analytics, chat, search — belongs off-chain, where it is a hundred times cheaper and easier to fix.
The build order
Design the trust boundary first
Write down exactly what must be trustless and why. If nothing must be, build a normal app and save yourself the audit budget.
Model the contracts before writing them
State, permissions, upgrade path, emergency stop. Decide who can change what, forever.
Use audited libraries
OpenZeppelin for standards. Never hand-roll a token or an access control system.
Test adversarially
Foundry with fuzzing. Assume every external call is hostile — checks, effects, interactions.
Make onboarding invisible
Account abstraction, sponsored gas, email login. Every wallet step loses most of your users.
Ship to testnet with real people
Then audit. Then mainnet. In that order, without exception.
Where AI agents fit
The interesting frontier is agents with wallets: software that pays for compute, settles with other agents, and executes strategies inside limits you set. The engineering requirement is unforgiving — spending caps, allow-listed contracts, session keys with expiry, a human-controlled recovery path, and an alert when anything unusual happens. Full argument in crypto, tokenization and smart contracts.
AI-generated Solidity is a special risk
It compiles, it reads well, and it can contain a reentrancy hole or a missing access check that costs everything in the contract. Generated contract code gets human review and an audit before it holds a cent.
Tools
Related: smart contracts and tokenization, regular apps.