Blockchain App Development Company: Smart Contracts, dApps, Wallets and Tokenization Built to Pass an Audit

Updated September 2026 · Written and maintained by the Progression Agency strategy team

A blockchain app development company designs, writes, tests and ships software whose key records or transfers of value run on a blockchain: smart contracts, the web or mobile front end, wallets and key management, token systems, and the conventional backend that connects all of it to the rest of the business. Progression Agency builds on public Ethereum, its layer 2 networks and permissioned ledgers such as Hyperledger Fabric and Besu, and starts with the question many teams skip: whether the product needs a chain at all. Progression Agency is a New York City company working with clients across the United States and worldwide.

Does your product need a blockchain?

Only if several parties must share one record that none of them controls, or users must hold and move value without asking you. NIST’s Blockchain Technology Overview (NIST IR 8202) describes blockchains as tamper evident and tamper resistant digital ledgers implemented in a distributed fashion, usually without a central authority, and that property is what you pay for.

ethereum.org is candid about the trade-offs in its guide to dapps: code and data published to a blockchain are harder to modify, the performance overhead is large and scaling is hard, one busy application can congest the whole network, and practical designs can end up looking like centralized services anyway. When a brief fails the test above, we say so and build the product on a conventional stack with our custom software development team.

Public, layer 2 or permissioned: where should the contracts run?

Public Ethereum gives open settlement and composability, layer 2 networks cut fees while building on Ethereum, and permissioned ledgers keep participation and data among known parties. NIST draws the line simply: in a permissionless network anyone can read and write without authorization, while permissioned networks limit participation to specific people or organizations.

Ethereum and its layer 2 networks

ethereum.org describes Ethereum as “no longer just a single network” now that hundreds of chains are built on top of it, and cautions that the safety of those layer 2 networks depends on the underlying technology, smart contract security and the maturity of each network. We choose a layer 2 on its security model and exit arrangements, not on fees alone.

Permissioned networks: Besu and Fabric

Besu is an open source Ethereum client, written in Java under the Apache 2.0 license, that runs on public and private networks, so a consortium can use Solidity and Ethereum tooling with approved members. Hyperledger Fabric is “an open-source enterprise-grade permissioned distributed ledger technology (DLT) platform” whose participants are known to each other, with pluggable consensus, channels and private data for confidentiality, and smart contracts written in general-purpose languages.

Hybrid designs

Some needs are met by keeping data in a private system and publishing only hashes or proofs to a public chain, which gives outsiders something they can verify without exposing the records themselves.

Smart contract development in Solidity

Smart contracts are small, public, hard-to-change programs, so the craft is writing as little on-chain code as possible and making every line of it provable.

ethereum.org defines a smart contract as “simply a program that runs on the Ethereum blockchain,” code and data at a specific address, and notes that contracts cannot be deleted by default, that interactions with them are irreversible, that they cannot retrieve off-chain data without oracles, and that a contract is limited to 24KB. The Solidity documentation describes the language as object-oriented, high-level and statically typed, designed to target the Ethereum Virtual Machine, and advises deploying with the latest released version because, apart from exceptional cases, only the latest version receives security fixes.

Keep on-chain logic minimal

Only the rules every party must trust go on-chain: balances, ownership, permissions and settlement. Search, reporting, notifications and anything involving personal data stay off-chain, where they are cheaper and can be changed.

Build on audited libraries

We use established libraries such as OpenZeppelin Contracts for token standards and access control, and follow its instruction to use the installed code as-is rather than copying or modifying it. Custom code is limited to what makes the product different.

Decide the upgrade policy before deployment

ethereum.org’s guide to upgrading smart contracts starts from the fact that contracts are immutable by design and describes the workarounds: migration, data separation, proxy patterns, the strategy pattern and the diamond pattern. Each trades some immutability for flexibility, so upgrade rights sit behind timelocks and multisig approval and are disclosed to users.

Treat gas as a product cost

Every operation costs gas, the unit ethereum.org uses to measure computational effort; the fee is the gas used multiplied by the protocol-set base fee plus a priority tip, and the base fee is burned. Storage-heavy designs cost users money on every call, so data structures are chosen for cost as well as clarity.

The rules the Solidity docs insist on

The security considerations chapter warns that everything in a contract is publicly visible, even state variables marked private, that the Checks-Effects-Interactions pattern guards against re-entrancy, that loops without a fixed bound can hit block gas limits, and never to use tx.origin for authorization. We treat those as build rules enforced in code review.

What belongs on-chain in a dApp, and what does not?

A dApp is mostly ordinary software around a thin on-chain core. ethereum.org says a dapp has its backend code running on a decentralized peer-to-peer network rather than centralized servers; in practice that backend is the contracts, while indexing, interfaces and storage run conventionally.

Oracles deserve their own risk review. ethereum.org describes oracles as applications that produce data feeds making off-chain sources available to smart contracts, and warns that a centralized oracle can go rogue, be hacked or stop serving data, leaving contracts to act on bad inputs; price-feed manipulation is second on OWASP’s list further down this page. The indexer and API layer is conventional engineering, built by our API development team like any production API.

Who should hold the keys in a blockchain app?

Decide who holds the keys before anything else: users (self-custody), you (a hosted wallet), or a smart account that pairs self-custody with recovery and sponsored fees. The choice changes the user experience, the security model and the regulatory position.

Self-custody wallets

On Ethereum, externally owned accounts are controlled by whoever holds the private key, and ethereum.org is explicit that losing the key means losing access to the funds. Self-custody apps therefore invest in backup prompts, clear signing screens and warnings before irreversible transfers.

Hosted wallets

A hosted wallet feels like a normal account, but the provider holds the value. FinCEN’s 2019 guidance describes hosted wallet providers as account-based money transmitters that must identify and monitor customers under an anti-money-laundering program, and Apple’s guideline 3.1.5(i) allows wallet apps only from developers enrolled as an organization.

Smart accounts and sponsored gas

ERC-4337, a final Ethereum standard, delivers account abstraction without consensus-layer changes: users submit UserOperations that bundlers package for an EntryPoint contract, and paymaster contracts can pay fees for users or accept ERC-20 tokens for gas. That lets a consumer app hide gas and offer recovery without taking custody.

Recovery and support

Whatever the model, support needs a documented answer for lost devices, compromised keys and mistaken transfers, including what cannot be undone. Writing that answer early often changes the wallet model chosen.

Tokenization: fungible tokens, NFTs and real-world assets

Tokens are contracts that follow shared standards, so wallets and exchanges can handle them without custom code; the legal character of a token depends on what it represents and how it is sold, not on the standard it uses.

ethereum.org’s token standards page lists ERC-20 for fungible tokens such as voting, staking or virtual currency tokens, ERC-721 for non-fungible tokens such as a deed for artwork or a song, and ERC-1155 for contracts that hold both kinds and bundle transfers to save costs.

Utility, loyalty and access tokens

Memberships, tickets, credentials and loyalty points map well to tokens because they need transfer rules and proof of ownership. The SEC’s March 2026 interpretation classes crypto assets that perform a practical function, such as a membership, ticket, credential, title instrument or identity badge, as digital tools that are not securities.

NFTs and digital collectibles

The same interpretation treats digital collectibles, such as rights to artwork, music, videos, trading cards or in-game items, as not securities. App stores add their own rules: Apple lets apps use in-app purchase for NFT services such as minting, listing and transferring, provided NFT ownership does not unlock app features, and Google Play requires apps that sell or let users earn tokenized digital assets to declare it and not promote potential earnings.

Tokenized securities and real-world assets

Tokenized stocks, bonds and fund interests remain securities: the SEC’s taxonomy lists digital securities, financial instruments represented by a crypto asset with ownership recorded on a crypto network, as securities. Builds for regulated assets use permissioned token standards such as ERC-3643, a final standard for security tokens that checks investor identity and compliance rules on each transfer. In September 2026 the SEC also granted temporary, conditional exemptive relief, set to expire five years after publication, to Tokenized Securities Venues trading tokenized NMS stock, with smart contracts that must be auditable, public and deployed on a public, permissionless ledger (SEC press release 2026-90).

Security and audits: the part that decides whether you launch

Plan security from the first design review, because deployed mistakes are public and often irreversible. ethereum.org’s security guide says the value stolen or lost to security defects in smart contracts is estimated at “easily over $1 billion.”

The list is the OWASP Smart Contract Top 10, 2025 edition. ethereum.org’s smart contract security guidance adds the practices around it: access controls, require, assert and revert guards, testing with static and dynamic analysis and formal verification, independent audits and bug bounties, simple code built on audited libraries, and disaster recovery through upgrades, emergency stops and event monitoring.

Testing before anyone else sees the code

Unit tests cover every function, property-based and fuzz tests hunt for broken invariants, static analysis runs on every commit, and a written specification states what must always be true, such as total supply never exceeding the cap.

Independent audit and bug bounty

An outside audit firm reviews the frozen code before mainnet, and every finding is fixed or answered in writing. After launch, a bug bounty gives researchers a legitimate way to report problems.

After launch: limits, monitoring and a pause switch

New contracts launch with value caps, alerts on unusual activity and admin actions, and a tested emergency stop controlled by a multisig, so an incident can be contained while it is investigated.

Which US rules shape a blockchain build?

Four federal sources settle most design questions: the SEC on whether a token is a security, FinCEN on money transmission, OFAC on sanctions and the GENIUS Act on payment stablecoins. We design within them and leave legal conclusions to your counsel.

SEC: the March 2026 token taxonomy

On March 17, 2026 the SEC issued an interpretive release, Application of the Federal Securities Laws to Certain Types of Crypto Assets and Certain Transactions Involving Crypto Assets, effective March 23, 2026, which the CFTC joined. Its fact sheet sorts crypto assets into digital commodities, digital collectibles and digital tools, which are not securities; stablecoins issued under the GENIUS Act, which are not securities; and digital securities, which are. It explains how a non-security crypto asset becomes subject to an investment contract under the Howey test and how that ends, and the staff’s 2019 framework for investment contract analysis is now marked withdrawn and superseded by it. A separate proposal announced on August 18, 2026, Regulation Crypto Assets, would add a startup exemption of up to $5 million over four years, a fundraising exemption of up to $75 million a year and an investment contract safe harbor; it is a proposal, not a rule (Chairman Atkins’ statement).

FinCEN: money transmission and DApps

FinCEN’s FIN-2019-G001, issued May 9, 2019, applies existing Bank Secrecy Act rules to convertible virtual currency business models without creating new requirements. It says the developer of a DApp is not a money transmitter for the mere act of creating it but becomes one if it uses or deploys the DApp to engage in money transmission; that when DApps perform money transmission, the definition applies to the DApp, its owners or operators, or both; that hosted wallet providers are money transmitters; and that anonymizing software providers are not, while anonymizing service providers are.

OFAC: sanctions screening

OFAC’s virtual currency FAQs say U.S. persons’ sanctions obligations are the same whether a transaction is in fiat or virtual currency, and that OFAC may add digital currency addresses to the SDN List. Its Sanctions Compliance Guidance for the Virtual Currency Industry notes that civil penalties can rest on strict liability, encourages technology companies and wallet providers, among others, to run a risk-based sanctions program, and recommends geolocation and IP blocking, screening customers at onboarding and screening transactions, wallet addresses included, with blockchain analytics tools where appropriate.

The GENIUS Act: payment stablecoins

The Guiding and Establishing National Innovation for U.S. Stablecoins Act, Public Law 119-27, was approved on July 18, 2025. It makes it unlawful for anyone other than a permitted payment stablecoin issuer to issue a payment stablecoin in the United States; requires reserves of at least 1 to 1 in listed assets such as U.S. currency, demand deposits and Treasury bills with 93 days or less to maturity; requires issuers to publish the monthly composition of their reserves; bars issuers from paying interest or yield solely for holding a stablecoin; and treats issuers as financial institutions under the Bank Secrecy Act. It takes effect on the earlier of 18 months after enactment or 120 days after the primary federal regulators issue final implementing rules.

This section summarizes primary sources for engineering purposes; it is not legal advice. Crypto rules are changing quickly, and the SEC’s Crypto Task Force page lists current statements, so we check each source again at kickoff.

What do Apple and Google allow in crypto and NFT apps?

Both stores allow crypto apps with conditions, and those conditions decide how the company publishes the app and where it is available.

• Apple 3.1.5(i): wallet apps may facilitate virtual currency storage if offered by developers enrolled as an organization.
• Apple 3.1.5(ii): no mining on the device; processing must happen off-device.
• Apple 3.1.5(iii): exchange features only in countries or regions where the app has appropriate licensing and permissions.
• Apple 3.1.5(iv): ICOs, cryptocurrency futures and other crypto-securities trading must come from established banks, securities firms, futures commission merchants or other approved financial institutions.
• Apple 3.1.5(v): no cryptocurrency rewards for tasks such as downloading other apps or posting to social networks.
• Apple 3.1.1: in-app purchase may be used for NFT services such as minting, listing and transferring; NFT ownership may not unlock features.
• Google Play: apps that sell or let users earn tokenized digital assets must declare it in Play Console, may not promote potential earnings from playing or trading, and, unless approved as gambling apps, may not take anything of monetary value for a chance at an NFT of unknown value.

Sources: Apple’s App Store Review Guidelines and Google Play’s blockchain-based content policy. Mobile web3 app development is planned around these rules from the first sprint, because they decide the developer account, the markets and sometimes the features.

Enterprise blockchain app development

Enterprise projects are best served by a permissioned ledger that several organizations run together, integrated with ERP, identity and document systems, with public chains used only where proof or settlement must be public.

Provenance and supply chain records

Suppliers, carriers and buyers write shipment and certification events to a shared ledger, so each party sees the same history without reconciling spreadsheets. Our logistics software development team connects the ledger to the warehouse and transport systems that produce those events.

Inter-company reconciliation and settlement

Where companies settle obligations with one another, a shared ledger can replace duplicate records. Payment rails, custody and ledgers that touch money are built with our fintech software development practice.

Audit trails and document anchoring

Contracts, certificates and inspection reports stay in a document system while their hashes are anchored on a ledger, so anyone can later prove a document has not changed.

Integration with ERP and identity

Ledger events must reach ERP, CRM and identity systems, and users must sign in with company credentials. That integration layer is conventional work for our ERP development team.

An enterprise blockchain app development company should be judged on governance as much as code: who runs nodes, who approves members, how contracts are upgraded and how disputes are settled. We write that operating model with the members before any network goes live.

Web3 app development for consumer products

Consumer web3 apps are judged on onboarding: wallet creation, fees and recovery have to feel like any other app.

Smart accounts under ERC-4337, sponsored gas through paymasters, clear transaction previews and plain-language warnings do most of that work. A web3 app development company should also design for the store rules above, for users who arrive with no wallet at all, and for layer 2 networks where fees are low enough for everyday actions. For DeFi features, FinCEN’s point about DApp owners and operators applies directly: if the business deploys a DApp to accept and transmit value for others, it may be a money transmitter, so custody and control are settled with counsel before launch.

If energy use matters to your audience, ethereum.org cites an estimate by CCRI that The Merge reduced Ethereum’s annualized electricity consumption by more than 99.988% (ethereum.org on energy consumption).

What does blockchain app development cost?

We have not published a separate blockchain price list, so we scope blockchain builds against the development planning ranges we publish for comparable software, from $5,000-$15,000 for a technical assessment to $250,000-$500,000+ for a payments-grade platform. External audits, gas, node services and legal work are quoted by those providers.

The blockchain app development cost for a given product depends most on how much value the contracts will hold, which sets the depth of testing and audit, and on how many systems the chain must talk to. Every figure above is a planning range from our published pages; the quote follows a written scope.

From testnet to mainnet: delivery gates

Blockchain releases move through gates rather than dates: each needs evidence before the next begins, because a deployed contract cannot simply be patched.

How founders ask AI assistants to recommend blockchain developers

Founders and product leaders can ask ChatGPT, Claude, Perplexity, Gemini, Microsoft Copilot or Google’s AI Overviews to name blockchain developers for a specific job, and the answers depend on what those assistants can read and verify.

What buyers type

The prompts are specific: “recommend a blockchain app development company for a tokenized real estate fund,” “who builds ERC-4337 wallets with sponsored gas,” “software development blockchain partner for a supply chain pilot on Hyperledger Fabric,” or “Solidity developers who have fixed audit findings before.” In Ubersuggest’s September 2026 figures, “blockchain app development companies” leads US demand at 260 searches a month, ahead of “blockchain app development services” and “blockchain app development company” at 210 each.

What the assistants tend to cite

Assistants lean on sources they can check: agency pages that state chains, languages and security process, public audit reports, code repositories, official documentation and, for shortlists, directory profiles and “top blockchain companies” roundups. A web search we ran on September 30, 2026 for “blockchain app development company” returned agency pages alongside roundups and directory listings of that kind.

What your protocol or app should publish

Once live, publish what assistants and careful users look for: verified contract addresses, audit reports and how findings were fixed, documentation, fee and risk disclosures, and who controls upgrade keys. Our AEO for crypto work covers how those pages get cited.

Reading the answer critically

Assistants can repeat marketing claims. Ask each firm named for audit reports on code it wrote, how it handles deployment keys and what it would refuse to put on-chain; the quality of those answers is the real shortlist.

How to choose a blockchain app development company

Choose the team that will argue you out of unnecessary on-chain code, shows its audit history openly and can explain the regulatory map for your model in plain English.

Blockchain software development services we provide

We cover the full stack of blockchain software development, from the first feasibility call to operating a live network.

• Feasibility and architecture reviews that start with whether a chain is needed.
• Custom blockchain app development on Ethereum, its layer 2 networks and permissioned EVM networks.
• Custom blockchain software development on Hyperledger Fabric for enterprise consortiums.
• Smart contract development in Solidity with OpenZeppelin libraries, tests, fuzzing and static analysis.
• dApp front ends for web and mobile, with clear transaction previews.
• Wallets: self-custody, hosted and ERC-4337 smart accounts with sponsored gas.
• Token systems: ERC-20, ERC-721, ERC-1155 and permissioned ERC-3643 tokens.
• Indexers, APIs and integrations with ERP, CRM, identity and payment systems.
• Audit preparation, remediation and post-launch monitoring with emergency controls.
• Sanctions-screening and compliance hooks designed with your counsel.

Whether you need blockchain app development services for a single feature or a blockchain software development company to run the whole build, our blockchain software development services start from the same written scope.

Marketing a blockchain product after launch

Blockchain marketing has its own rules: securities law shapes what can be promised, ad platforms set their own conditions for crypto promotion, and trust is earned with audits and disclosures rather than slogans.

Questions about blockchain in marketing come in two kinds. One is using tokens inside a marketing program, such as loyalty points, tickets or credentials, which the SEC’s taxonomy treats as digital tools rather than securities when they perform a practical function. The other is marketing a blockchain product itself, which our crypto marketing agency team handles, alongside fintech marketing for regulated financial products and AEO for crypto for AI search. Blockchain marketing and PR land better when the launch team can point to audit reports, contract addresses and plain-language risk disclosures.

Related services

• Crypto marketing agency: growth for exchanges, wallets, protocols and web3 products.
• Fintech software development: payments, lending and banking software around the ledger.
• API development: indexers, integrations and developer APIs.
• App development agency: mobile and web apps that front a chain.
• Stock trading app development: brokerage and trading apps built around SEC and FINRA requirements.
• AEO for crypto: getting a crypto product cited by AI assistants.
• Backend development and DevOps services: the conventional infrastructure every dApp needs.
• Web app development: dashboards and portals for tokenized products.
• Logistics software development: supply chain systems that feed provenance ledgers.
• Software development for startups: an engineering partner for funded web3 teams.
• Cloud app development: cloud-native backends for indexers and APIs.

Frequently asked questions