CROPS Review

CROPS is the Ethereum Foundation's shorthand for the properties Ethereum must preserve: Censorship Resistance, Open Source and Free (as in Freedom), Privacy, Security. This skill turns those values into concrete dApp and smart contract architecture checks.

Source context: The Promise of Ethereum: Introducing the EF Mandate and the EF Mandate PDF.

What You Probably Got Wrong

"It works" is not enough. A dApp or smart contract can compile, pass tests, and demo cleanly while handing users to a censorable frontend, a closed indexer, an invisible RPC dependency, a custodial wallet, or an admin key with total control.

You treat decentralization as only a contract property. The contract may be permissionless while the app depends on a single hosted frontend, API, relayer, paymaster, sequencer, bridge, or wallet vendor. Users experience the whole stack.

You treat verified contracts as an open dApp. Etherscan verification ties bytecode to source for that contract only; Open needs the whole stack public, and Free needs a license the Mandate counts as actually free, not merely source-available (EF Mandate p.13). OSI-permissive or copyleft is the practical bar.

You check privacy after the architecture already leaks data. Before choosing contracts, wallets, RPCs, analytics, indexers, or identity flows, tell the builder which addresses, balances, counterparties, timing data, IP metadata, wallet fingerprints, analytics events, and identity links could be exposed.

You treat security as only code bugs. Reentrancy and oracle manipulation matter, but so do custody, upgrades, admin keys, recovery, emergency powers, approvals, and whether the app still works if the team or vendor disappears.