Many IoT systems now support an app ecosystem model, where third-party developers can produce specialized apps that users can download and use on their own IoT devices. While these third-party apps generally rely on the original IoT device company’s APIs, the original company does not have control over the app’s behavior. This increases the possibility of users downloading malicious third-party apps. This work examines the feasibility of using smart contracts and blockchain to develop a framework to validate the security of IoT apps by checking for certain vulnerabilities in the source code.