Over the past 90 days, three separate audit engagements have opened with the same question. Not about reentrancy. Not about oracle manipulation. Not about the upgradeability of the governance module. The question was: can this protocol survive contact with Chinese law?
It is not a rhetorical question. It is a forensic one.
The People's Republic of China has no crypto-specific statute. It publishes no binding judicial precedent on smart contract disputes. And despite the explosion of blockchain activity between 2017 and 2021, no court has issued a public judgment that squarely classifies a decentralized token under the Civil Code. A common-law lawyer would read this silence as a market opportunity. A civil-law analyst reads it as a gap in the major premise — and in China, gaps are filled by interpretation.
I have spent fifteen years reviewing code and eleven years reading Chinese legal texts as a DeFi security auditor. The two disciplines converge more often than the industry wants to admit. In 2021, the People's Bank of China declared that all crypto-related business activities are illegal financial activities. In 2017, a multi-ministry notice had already banned token fundraising. Yet the implementing layer of those declarations remains thin: no comprehensive statute, no stable definition of virtual assets, and a regulatory toolkit that works through administrative warnings, network shutdowns, and official statements rather than public court records.
I am not writing about Chinese politics. I am writing about the legal logic that will eventually be applied to a smart contract deployed by a team with a mainland nexus. That logic has four components: a normative grammar of conditions and sanctions, a syllogistic reasoning structure, a hierarchy of interpretation methods, and a procedural system for evidence and limitation periods. Each component has a code equivalent. I will describe each of them, and then I will explain why the entire machinery still shocks Western founders who believe that the absence of a statute implies the presence of freedom.
This is the pattern I have seen since 2017, from ICO mania to the Terra collapse to the current AI-agent experiments. The ledger remembers what the hype forgets. Legal exposure is no exception.
The Legal Stack as Protocol Layers
The Chinese legal system is described by its own jurists as a unified, multi-level normative system. I prefer a different metaphor: it is a protocol stack with a strict inheritance rule. Each lower layer must be consistent with the layer above it. If a local regulation contradicts an administrative regulation, the local layer loses. If an administrative regulation extends beyond the authority of a basic law, the basic law wins. This resembles the way a well-designed smart contract hierarchy enforces that a child contract cannot override the owner's authority.
Let me map the stack precisely, because most Western analyses treat Chinese law as an opaque monolith, and monoliths are dangerous to audit.
Layer One, the Constitution: enacted by the National People's Congress in 1982, amended in 1988, 1993, 1999, 2004, and 2018. It assigns basic rights, creates the state organs, and defines the limits of legislation. In practice, it is not directly invoked in everyday commercial disputes. Think of it as the genesis block: present, authoritative, rarely executed in application code.
Layer Two, Basic Laws: these are the core protocol. The Civil Code, effective January 1, 2021, governs contracts, property, torts, marriage, and inheritance. The Criminal Law defines crimes and penalties. The Civil and Criminal Procedure Laws define procedural rails. The Company Law and the Securities Law circumscribe capital market activity. For crypto matters, this is the execution layer. Most of the norms that will eventually subsume blockchain facts live here.
Layer Three, Administrative Regulations: enacted by the State Council. The Blockchain Information Service Regulations, effective 2020, fall into this layer; they require blockchain service providers to file with the Cyberspace Administration of China, verify user identities, and maintain logs. Administrative regulations do not pass through the NPC plenary session; they need State Council approval, and they carry a wide enforcement mandate.
Layer Four, Local Regulations: enacted by the people's congresses of provinces and cities. Pilot zones such as Hainan have used local regulations to propose blockchain industrial parks. The tension between local enthusiasm and central prohibition is a permanent feature of the Chinese crypto landscape.
Layer Five, Departmental Rules: the central bank, the cyberspace regulator, the securities regulator, and the ministry of industry all issue implementation rules. The 2021 PBOC declaration on virtual currency trading belongs in this layer, as does the 2017 ICO ban. Departmental rules have the administrative reach of law and the political flexibility of a policy instrument.
Layer Six, Judicial Interpretations: the Supreme People's Court and the Supreme People's Procuratorate issue binding interpretations on how lower courts apply statutes. The SPC's provisions on electronic data evidence, and its interpretation of the Civil Code's contract rules, are the closest thing to a patching mechanism in the system. They are not crypto-specific. They are fully capable of being applied to crypto facts.
Layer Seven, International Treaties: treaties to which China has acceded apply internally in their relevant fields, except for reserved provisions. For businesses with no Chinese nexus, this layer matters little. For teams with mainland counterparties, the Financial Action Task Force's anti-money-laundering standards have been absorbed into Chinese administrative practice.
The hierarchy also answers a question that every Western legal analysis gets wrong: which document actually banned ICOs in 2017? It was not a law, in the legislative sense; it was a notice from the PBOC and seven ministries. The distinction is often treated as a loophole. In practice, the Chinese administrative state enforces its notices with the same severity as statutes, because the administrative layer has its own sanctions — blocking websites, freezing accounts, blacklisting companies. The statute base provides the color of legality; the administrative layer provides the operational force.
The most important observation is not the depth of the stack. It is the absence of a dedicated crypto statute in Layer Two. Beijing moved from a warning notice on bitcoin in 2013 to a wholesale prohibition on crypto trading and mining in 2021 without ever passing a comprehensive virtual assets law. Projects are not regulated by a crypto rulebook. They are regulated by the general liability system through interpretation. That is the subsumption problem, and it is structural.
A Western founder treats regulatory silence as design space. In mainland China, silence is an acquisition target. The administrative layer interprets general norms to capture new realities precisely because the legislative layer is slow and the political preference is for flexibility. Clarity precedes capital; chaos precedes collapse. The hierarchy is clear; the point of connection with crypto is deliberately unresolved.
Core Instrument One: The Grammar of the Norm
Open the Civil Code to any provision and you will find the same architecture: assumption, handling, sanction. The assumption defines the facts that trigger the norm. The handling defines the required behavior — a command to act, a prohibition, or a permission. The sanction defines the consequence of noncompliance. Chinese legal scholars recognize this structure instantly. I recognize it because it is also the grammar of a smart contract condition.
Consider the Criminal Law, Article 232. The text reads: whoever intentionally kills another shall be sentenced to death, life imprisonment, or ten or more years of imprisonment. In compiler terms: if the intent condition is true, the sentence branch executes. The assumption is the intent. The sanction is the penalty range. The implied handler is the prohibition of killing. The logical form is minimal and complete.
Now read the illegal fundraising provision, Article 176. Its assumption includes three elements: absence of a license, acceptance of funds from an unspecified public, and a depriving act. A token sale, depending on its structure, satisfies all three. The sanction is criminal liability. The handler is implicit: do not raise money from the public without authorization.
I have been auditing tokens since 2017, when I spent forty hours manually reviewing the Solidity code of a cloud-storage ICO and found an integer overflow in the minting function. In those days, the mainstream assumption was that a token contract was a technical artifact, not a legal instrument. I thought the opposite then and still think it now: every line of code is a legal precedent. The overflow was not an accident of programming. It allowed the minting function to wrap a uint256 and mint unlimited tokens. The equivalent legal failure would be a company charter permitting unlimited share issuance without shareholder approval.
This is where the Chinese norm grammar bites hardest. A smart contract does not need to be drafted with legal intent to satisfy a legal assumption. It needs only to produce the behavior that the assumption describes. A mixer that pools deposits and permits withdrawal without attribution produces, in fact, the behavior of money laundering facilitation, regardless of its documentation. An oracle network that derives price deviation from a single concentrated source produces, in fact, the behavior of market manipulation. An uncollateralized lending protocol that relies on social consensus to avoid liquidation produces, in fact, the behavior of illegal fund raising.
The function names do not matter. The variable labels do not matter. The legal system reads the transaction trail and reconstructs the behavior. In a civil-law system, the behavior is matched against a pre-existing norm with a pre-existing sanction.
I have had 2025 audit engagements in which AI-generated code introduced reentrancy vectors that a human developer would never have written. The AI engine optimized for execution efficiency and ignored the invariant that an external call must occur after all internal state updates. The code was novel; the vulnerability class was old; the legal subsumption will be equally old. A court will not care whether a machine authored the code. It will ask what the code did, who caused it to run, and whose interests were served. The assumption branch of the criminal or financial norm does not care about the authorship of the compiler.
For a developer, the uncomfortable conclusion is that the platform-level code is simultaneously the evidence and the act. In traditional finance, an act requires intent, instrument, and consequence. In smart contract reality, the instrument is public, the consequence is permanent, and the intent is inferred from configuration. Legal logic treats that inference as unproblematic. The trust anchor is not your whitepaper; it is your deployment transaction. Trust is a variable, not a constant.
Core Instrument Two: The Syllogism and Its Failure
Formal Chinese judicial reasoning follows a deductive path: major premise, minor premise, conclusion. The major premise is the legal norm. The minor premise is the set of verified facts. The conclusion is the judgment. A mainland-trained lawyer executes this path in every memo. I execute the same path when I trace a reentrancy attack: the invariant is the major premise, the transaction history is the minor premise, and the protocol failure is the conclusion.
The power of the syllogism is its ruthlessness. Once the major premise is selected, everything else is fact-checking. But the selection of the major premise is where blockchain defies the system.
Take a straightforward scenario: an investor buys a token in an early sale, and the project does not deliver. Which norm applies? If the dispute is classified as a contract dispute, the Civil Code applies, and Chinese contract law requires offer, acceptance, and a clear subject matter. The token has no statutory definition. Some common-law courts have begun to treat certain tokens as property through a series of nuanced judgments. Mainland China has no equivalent; its highest court has not recognized tokens as property in a civil-law sense. The minor premise exists (the purchase), but the major premise is indeterminate (is the right contractual, property-based, or wholly unprotected?).
This indeterminacy has a technical name in Chinese legal methodology: the failure of subsumption. When a fact pattern refuses to fit under the language of an existing norm, the interpreter is not allowed to invent a new norm. They escalate through interpretation methods. That is precisely what makes the logic dangerous for developers: the failure of subsumption under the Civil Code's protective provisions does not grant immunity. It means the dispute is reshuffled into the administrative or criminal deck.
The DAO is the cleanest example. A pure DAO has no legal person, no board, no registered office. Chinese law recognizes natural persons, legal persons, and unincorporated organizations as civil subjects. A DAO is none of these, comfortably. The inability to designate a defendant is a procedural rupture. Western jurisdictions are building legal wrappers for DAOs; the Supreme People's Court has not. For an auditor, this is a critical instruction: if the protocol cannot be sued as an entity, the legal system pierces through to the natural persons on the multisig, the code contributors, the server bill payers, and the price feed operators. The code's pseudonymity is not protection; it is the interpretation target for opposing counsel who knows how to collect IP logs, exchange records, and telemetry data.
The smart contract as contract question follows the same pattern. The Civil Code provides that a contract may be concluded in written form, and written form includes electronic data that can be presented in tangible form. A smart contract is, at least, an electronic record. But Chinese contract law fundamentally requires an agreement between parties: offer, acceptance, and consensus on essential terms. An autonomous protocol that executes automatically, without negotiation, without signature, and without an exit clause resembles a performance rather than an agreement. The code executes; the legal contract hovers somewhere off-chain, in the conversation threads, the governance forum, and the wallet-level message signed by the user. When the court later asks what the parties actually agreed upon, it will not inspect the bytecode first. It will inspect the Telegram logs, the Medium blog, the marketing deck, and the audit report. The code becomes evidence of performance; the off-chain records become evidence of intent. Logic gaps leave holes in the smart contract's social settlement layer: the user expected a promise; the protocol delivered a conditional function.
There is one genuine constraint in this system: the principle of legality in criminal law. Article 3 of the Criminal Law provides that no crime is punishable without a prior legal provision. This is the civil-law version of nullum crimen, nulla poena sine lege. In practice, it protects the defendant against the creation of new offenses after the fact. But the generality of existing provisions erodes the protection. The phrase illegal business operations is broad enough to encompass conduct that the original drafters never imagined. The principle locks the norm in place; the breadth of the norm does the interpretive work.
I reconstruct the Terra collapse the same way I reconstruct any exploit: the invariant was the major premise (one UST must maintain a peg of one dollar); the oracle deviations and minting events formed the minor premise; the conclusion was a thirty-billion-dollar loss. But the legal syllogism that followed is still not fully resolved. The technology failed; the legal classification is still being litigated. The time between technical collapse and legal classification is a hazard window for participants who believe that a technical conclusion resolves a legal question. Data does not lie; people do. The ledger preserves the events. The court still chooses the norm.
Core Instrument Three: Interpretation as a Regulatory Backdoor
Chinese statutes are terse by design. The Civil Code is long, but its provisions are abstract, requiring massive interpretive work. The Supreme People's Court therefore issues judicial interpretations, and lower courts and administrative agencies use four interpretive methods in sequence.
First is textual interpretation: the plain meaning of the words. For crypto, textual interpretation fails immediately, because the word cryptocurrency does not appear in a major-level statute. Second is systematic interpretation: the provision read in the context of the legal family. A financial activity under the central bank's jurisdiction includes activities of the same nature as listed financial activities, even if unnamed. This is the main route for reaching token trading. Third is historical interpretation: the legislative purpose at the time of enactment. The Criminal Law's fundraising provisions were written in 1997, long before bitcoin. Their purpose was protection against unlicensed capital formation. Token sales fit the purpose even if they do not fit the original facts. Fourth is teleological interpretation: the social purpose the law seeks to achieve today.
Regulators do not announce which method they are applying. They simply apply it, and the result is absorbed into practice. The 2021 PBOC prohibition is instructive. It declared that crypto activities are suspected of being illegal financial activities. It did not need to name a specific article of a specific law. It deployed systematic and teleological methods at once: the protection of financial order requires suppressing parallel capital markets, and the parallel market created by tokens is, by purpose, illegal.
The 2020 Blockchain Information Service Regulations operationalize the same logic at the node level. They require service providers to file, to register real user identities, and to preserve logs. In effect, running a blockchain service inside mainland China requires a compliance wrapper. The public chain model, with anonymous validators and permissionless access, violates the wrapper by design. This is why licensed mainland blockchain companies build permissioned enterprise chains, and why public DeFi infrastructure cannot legally operate inside the mainland nexus. The auditor's question becomes trivial: does the protocol have a mainland node operator, a mainland front end, a mainland token seller, or a mainland investor? If yes, the administrative layer applies, regardless of what the smart contract claims to do.
I am not a policy expert, and I do not write to endorse or condemn. I write to warn. The Tornado Cash precedent demonstrated that code can be a sanction target. In mainland China, the equivalent tool is not a sanctions list; it is an administrative declaration followed by a criminal referral. A developer who writes a privacy-preserving smart contract for a global audience may find that a mainland user deposited illicit funds through a Chinese interface, and the teleological interpretation now attaches the developer's conduct to the user's crime. The developer's intent is not the touchstone. The behavior is. In a civil-law system, the purpose of the norm outranks the purpose of the actor. This is the most important variable in my risk assessments for civil-law jurisdictions.
Core Instrument Four: The Practical Playbook
Chinese legal education teaches a six-step path for a legal problem. It deserves to be read through a crypto lens, because the sequence determines the outcome.
Step one, identify the legal relationship: civil, administrative, or criminal. A token purchaser's claim is, at first glance, civil. A regulator's action against an exchange is administrative. A prosecutor's case against a project team for illegal fundraising is criminal. The same set of facts can sustain all three. The classification is the first decision point, and it belongs to the party with the strongest procedural position.
Step two, identify the legal basis. Civil: the Civil Code and its interpretations. Administrative: the Blockchain Information Service Regulations and the PBOC notices. Criminal: the fundraising, money laundering, and illegal business operation articles. This step is mechanical but decisive, because the basis fixes the limitation clock.
Step three, verify the limitation period. Civil claims generally run three years from the date the right holder knows or should have known of the infringement, with a twenty-year outer cap. Administrative penalties generally run two years. Criminal limitations run according to the statutory maximum penalty. For blockchain claims, the clock is treacherous. The on-chain timestamp makes the knowing moment publicly verifiable, an advantage for plaintiffs. But the delay between technical discovery and legal discovery can easily cross the three-year mark. In the 2022 Terra collapse, many mainland retail claimants did not realize that a Chinese court could hear a token dispute until months after the technical event. By the time they filed, the record was fully on-chain but the clock was running. The ledger remembers; the courthouse runs on timers.
Step four, preserve evidence. Electronic data — chat logs, signed transaction hashes, wallet addresses, withdrawal records, audit reports, deployment receipts — is accepted under the electronic data rules. The golden rule is provenance: data must be original, complete, and demonstrably associated with the subject. A deployment record obtained from a public node is broadly tamper-proof; the code itself is preserved on-chain. But the surrounding records — the governance forum, the marketing tweets, the Telegram channels — need a collection process that withstands scrutiny. I advise every team I audit to maintain the full design history in a structured repository, because a court will compare the code's behavior with the documentation's promises. Data does not lie; people do.
Step five, choose the procedure. Negotiation, people's mediation, arbitration, administrative complaint, civil suit, or criminal report. Arbitration requires a written arbitration agreement; a smart contract does not contain one. Many token sales include a forum selection clause in their website terms, and that clause is often more enforceable than the token contract itself. If you intend to transact with parties whose location is unknown, the forum selection clause is your insurance.
Step six, seek professional help. The Chinese bar is small and the crypto specialty is narrower, but a qualified mainland lawyer who understands code is worth the fee. In fifteen years of auditing, the projects with the best legal outcomes were not the ones with the best lawyers. They were the ones whose contracts produced facts that made a favorable classification possible. That starts with clean code, transparent governance, and documentation that matches deployment reality.
The Blind Spots on Both Sides
The comfortable Western narrative says China is a paper dragon: no law, no transparency. That narrative is analytically lazy. The civil-law administrative structure is predictable in a way that common-law regulatory enforcement rarely is. Regulation by enforcement writes the rule after the penalty; the administrative notice writes it in advance. It can be studied. It will be enforced with mechanistic consistency. As a security auditor, I have always preferred a deterministic executor to a principled improviser — even if I distrust the executor's assumptions.
The other blind spot belongs to the Chinese side. The legal system is ill-equipped to distinguish among token projects, because the officials who apply the norms rarely read code. A Bitcoin layer-two project that is an EVM fork behind a Bitcoin wrapper will be classified by its labels and public statements, not by its consensus code. This creates a strange asymmetry: a project that makes precise technical claims and keeps a clean compliance wrapper may avoid the harshest consequences, while a project with marketing hype and a false tech narrative invites the harshest sanctions. The labeling gap is functional.
The real Bitcoin community does not recognize most so-called Bitcoin L2s — they are Ethereum-style rollups rebranded for hype. But the legal system does not care about community recognition. It cares about the facts on the executed transaction. If a mainland user reads the marketing material and believes he has invested in a Bitcoin improvement protocol, the court will read the same material and subsume the token sale under fundraising norms. The mislabeled stack is the mislabeled legal exposure.
There is also the sidechain of Hong Kong. The territorial scope of mainland law excludes Hong Kong, Macau, and Taiwan. Hong Kong retains a separate legal system with licensed digital-asset venues. The practical result is an application-specific sidechain for Chinese crypto capital: mainland enforcement at the border, licensed operation inside Hong Kong. The same sovereign, two rule sets. For teams negotiating the gray zone, this is the most consequential legal variable. It is also, from a security perspective, a governance fork that the mainland can merge with one executive act. The western observer assumes the sidechain will last; the auditor assumes every sidechain has a trusted bridge, and trusted bridges are historically the center of vulnerability.
Finally, the data availability layer. In my experience, the DA layer is the most overhyped slice of the rollup stack. Ninety-nine percent of rollups do not generate enough data to justify a dedicated DA solution. The deeper irony is that the DA layer's promise — data stored everywhere — collides with mainland data-localization rules. Chinese data protection requires personal information and important data to be stored within China. A modular DA system that distributes blocks across nodes in Singapore, Frankfurt, and Tokyo, while serving mainland users, violates the localization rule by design. The decentralized data layer is, from a Chinese legal standpoint, a centralized liability surface. The contradiction is not an engineering problem; it is a legal one. The market will discover it only after the first enforcement action.
In 2025, I audited an AI-agent trading platform and found a reentrancy vulnerability in its cross-chain bridge; I received a fifty-thousand-dollar bounty and published a case study on how AI-generated code introduces novel attack vectors. The same platform's model is already being redeployed by teams with mainland users, and the legal nexus will not be found in the bridge code. It will be found in the governance token's trading venue, the nationality of the operator, and the chat logs where mainland users were invited. The technical audit found the bug; the legal audit will find the subsumption.
The Forecast
China's legal system is the older ledger. It does not fork, it does not migrate, and it does not undergo governance mergers. It accumulates amendments, judicial interpretations, and administrative notices in a strictly sequential way. For a DeFi auditor, the Chinese legal module is not a political opinion. It is a risk input.
This is why my audit reports no longer stop at the bytecode. Every engagement now includes a jurisdiction mapping: where the operator lives, where the front end is served, where the node operators are domiciled, where the token sale occurred, where the investors reside, and which of those facts creates a nexus with a civil-law administrative jurisdiction. The map is not always pleasant to read. It is always necessary.
The next 36 months will produce a decisive event. It will not be a clean statute. It will be a subsumption: some court, in some mainland province, will take a general norm — perhaps Article 225 of the Criminal Law or Article 470 of the Civil Code — attach it to a smart contract deployment record, and issue a judgment that the code's execution path constitutes the illegal act. The facts will be old. The logic will be ancient. The code will be the evidence.
For developers, the lesson is simple. Clarity precedes capital; chaos precedes collapse. The legal ledger remembers the deployment hash, the governance vote, and the investor chat. The null hypothesis is not that your project is fine. The null hypothesis is that some already-existing norm, read teleologically, will eventually subsume your code.
The bug was there before the launch. The precedent is there too.