Sky, a prominent decentralized finance (DeFi) protocol, has initiated a significant shift in its approach to smart contract security, publishing a novel ranking of auditors that is poised to send ripples throughout the industry. The proposed "Atlas Edit" introduces not only a tiered classification of audit firms but also a groundbreaking framework for validating external audits, setting a new, rigorous benchmark for the entire DeFi ecosystem. This move, currently undergoing a governance vote by Sky holders, places firms like ChainSecurity and Cantina in an exclusive top tier, while notably excluding industry giant CertiK from its recognized list entirely, alongside a comprehensive overhaul of its internal security protocols.
The announcement, delivered as part of the Atlas Edit Weekly Cycle Proposal for October 19, 2026, marks a pivotal moment for Sky and potentially for the broader DeFi space. The proposal, live on Sky’s governance portal since Monday at 16:00 UTC, is a three-day binary poll, closing on October 22. It bundles eight distinct edits, with the most impactful being the establishment of stringent standards for audits not commissioned directly by Sky and a revised, highly selective list of recognized audit firms. This initiative underscores a proactive effort by Sky to fortify its defenses against the persistent threat of smart contract vulnerabilities, which have historically led to billions of dollars in losses across DeFi.
The Imperative for Rigorous Audits in DeFi
The landscape of decentralized finance has been characterized by rapid innovation alongside significant security challenges. From flash loan attacks to re-entrancy vulnerabilities and logical errors in complex protocols, smart contract exploits have been a recurring theme, eroding user trust and capital. Major incidents such as the 2020 Yam Finance rebase bug, the 2021 Poly Network hack ($610 million), and numerous bridge exploits throughout 2022 and 2023, underscore the critical need for robust security audits. While audits have become a standard practice, their quality, scope, and independence have varied widely, often leaving protocols vulnerable.
Many projects, in their haste to launch or cut costs, have relied on superficial audits, often from less reputable firms, or have failed to implement fixes adequately. Common shortcuts include audits with vague scopes, reports hosted solely by the audited project without independent verification, or claims of fixes without specifying the exact, audited code version. These practices have contributed to a perception that not all audits are created equal, necessitating a more discerning approach from major protocols that manage substantial user funds. Sky’s new framework directly addresses these systemic weaknesses, aiming to instill a higher degree of verifiable security.
Deep Dive: Sky’s New Audit Recognition Framework
At the heart of Sky’s proposed changes is a newly introduced section within its Governance Scope, a framework unprecedented in its specificity for deciding which external audits it will deem trustworthy. This framework is particularly crucial for Sky, as its "Prime Agents"—entities such as Spark, Grove, and Osero—deploy capital into third-party systems, including various Morpho vaults and other external protocols. Historically, Sky did not directly commission the audits for these underlying codes, relying on the third-party protocols’ due diligence. The new rules aim to standardize and elevate this reliance.
Under the proposed edit, an external audit will only be recognized by Sky if it adheres to six stringent conditions:
- Public Verifiability: The audit report must be publicly available on the auditor’s official website, not merely hosted by the project being audited. This ensures independent publishing and reduces the risk of manipulated or selectively presented reports. This condition directly counters instances where projects might obscure or selectively present audit findings that are not independently verifiable.
- Specific Scope: The audit scope must explicitly detail the exact version of the code (via a commit hash or equivalent immutable identifier) that was reviewed. This eliminates ambiguity and ensures that subsequent code changes do not invalidate the audit’s findings. This is crucial as a minor change in code post-audit can introduce new vulnerabilities, rendering the original audit irrelevant to the deployed version.
- Comprehensive Coverage: The audit must cover the entire relevant code of the contract or system in question. Partial audits or reviews of isolated components will not suffice for critical contracts. This prevents "security theater" where only easily audited parts of a complex system are reviewed, leaving critical integration points or less obvious components vulnerable.
- Actionable Findings: The report must clearly list all identified vulnerabilities, their severity, and specific recommendations for remediation. It must also indicate whether these recommendations were addressed in the audited version or a subsequent one. This ensures that audits are not merely diagnostic but lead to concrete security improvements, with clear accountability for implementation.
- Professional Conduct: The audit must be conducted by a recognized, independent professional firm with a demonstrable track record in smart contract security, adhering to industry best practices. This filters out less experienced or unqualified auditors, emphasizing proven expertise and adherence to established security methodologies.
- Non-Anonymous Auditor: The firm performing the audit must be clearly identifiable, with public information about its team and methodology. Anonymous or pseudonymous audit reports will not be accepted, emphasizing accountability and the ability for due diligence on the auditor itself.
These rules are not merely suggestions; they are meticulously crafted to counteract prevalent weaknesses in current DeFi audit practices. By mandating public availability on the auditor’s site, Sky challenges the common practice of projects selectively publishing reports or hosting them on their own domains, where they could potentially be altered or removed. The insistence on an immutable commit hash directly targets the "we fixed it in a later PR" excuse, demanding a clear audit trail for the deployed code. Furthermore, the emphasis on a specific scope and non-anonymous auditors aims to foster greater transparency and accountability within the auditing landscape.
The Two-Audit Mandate and Its Implications
Beyond simply recognizing audits, the Atlas Edit introduces a crucial "two-audit rule" for any external contract deemed "materially relevant" to the security of assets Sky holds or moves. This elevates the standard significantly, moving beyond a single point of failure in the audit process. The definition of "materially relevant" is intentionally broad, encompassing:
- Contracts where Sky’s assets are directly held.
- Contracts through which assets pass during deposit, redemption, and withdrawal processes.
- The implementation behind any proxy contracts, which often contain the core logic of a protocol.
- Any contract capable of altering the behavior, parameters, or price sources of these critical contracts, such as governance modules or administrative keyholders.
For such deployed code, the bar is exceptionally high: it must have undergone two independent audits from two distinct firms appearing on Sky’s newly published recognized list. This requirement is designed to introduce a robust layer of redundancy and reduce the risk of a single auditor missing a critical vulnerability. The principle here is akin to a "defense in depth" strategy, where multiple layers of security are applied to protect assets, acknowledging that even the best single audit might miss subtle flaws.
Crucially, the proposal includes a "loophole closer": audits published under different names by the same firm, or by firms under common ownership or control, will count as a single firm. This foresight prevents protocols from circumventing the two-firm rule by engaging subsidiaries or rebranded entities of the same parent company, ensuring genuine independence in the audit process. This provision highlights Sky’s commitment to genuine, diversified security assessment rather than merely fulfilling a numerical requirement.
While the standards are strict, a singular exception exists: Sky can still rely on a contract that falls short of these requirements, but only with the explicit approval of the Protocol Security Workstream Lead. This provides a necessary safety valve for extraordinary circumstances or highly specialized, low-risk integrations, though it is expected to be invoked sparingly and with rigorous justification. This two-audit rule, coupled with the rigorous conditions for individual audit recognition, establishes one of the most stringent public audit standards observed from a major DeFi protocol to date.
The Controversial Auditor Ranking
Perhaps the most immediately attention-grabbing aspect of the Atlas Edit is Sky’s new, tiered ranking of smart contract audit firms. This list, which will undoubtedly influence market dynamics and auditor reputations, sorts recognized firms into two distinct tiers:
- Top Tier: This exclusive category features just two names: ChainSecurity and Cantina. Their inclusion at the apex signals Sky’s profound trust in their methodologies, expertise, and consistent delivery of high-quality, verifiable audits. Both firms are known for their deep technical expertise, often employing formal verification methods, advanced tooling, and a highly meticulous approach to security analysis, which typically involves a significant amount of manual review by seasoned experts. This recognition could significantly boost their market position and demand for their specialized services.
- Mid Tier: This broader category comprises 33 firms, a comprehensive list that includes many well-respected names in the industry. Among them are OpenZeppelin, Trail of Bits, ConsenSys Diligence, Certora, Sigma Prime, Zellic, Quantstamp, Halborn, PeckShield, SlowMist, Cyfrin, OtterSec, ABDK, and Runtime Verification. The mid-tier also acknowledges the growing importance of audit contest platforms like Code4rena and Sherlock, which leverage decentralized communities of security researchers to identify vulnerabilities, alongside prominent independent auditors such as Pashov and StErMi. Their inclusion indicates Sky’s recognition of their significant contributions to smart contract security, albeit perhaps with a perceived difference in the depth, consistency, or specific methodologies required for the highest tier. This tier represents a robust pool of talent, and protocols seeking to integrate with Sky will have a wide, yet curated, selection of auditors.
The most striking omission from this entire ranking is CertiK. Despite being one of the most prolific audit firms in the industry, publishing a vast number of reports and often marketing its "Skynet" and "KYC" services, CertiK does not appear in either tier. Under Sky’s new rules, a CertiK report would not contribute towards the two-audit requirement for materially relevant contracts, regardless of its scope or the number of contracts it covers. This exclusion is particularly noteworthy and is likely to spark considerable debate within the DeFi and cybersecurity communities. It suggests that Sky’s criteria for audit quality and independence extend beyond mere volume of work, potentially scrutinizing specific methodologies, reporting standards, the depth of manual review versus automated tooling, or post-audit verification processes that CertiK may not align with. While the exact reasons for CertiK’s absence are not explicitly stated, industry observers might infer it relates to aspects of their audit depth, the verifiability of their findings, or their perceived independence relative to Sky’s new, elevated benchmarks. This decision could force a re-evaluation of audit practices for firms that prioritize quantity over the specific quality metrics Sky has now defined.
Chronology and Deadlines: A Race to Compliance
The implementation of these rigorous new standards is not immediate but follows a structured transition period, creating clear deadlines for compliance.
- October 19, 2026: The Atlas Edit Weekly Cycle Proposal for October 19, 2026, goes live on Sky’s governance portal. This date marks the official start of the three-day binary poll, allowing Sky holders to review the proposed changes and cast their votes.
- October 22, 2026: The governance poll closes. If "Yes" votes exceed "No" votes and reach at least 480 million SKY, the pull request will be merged into the Sky Atlas, officially enacting the new rules. After this date, any contract Sky first relies on (i.e., new integrations or expanded use of existing ones) must immediately meet the new audit standards. This creates an immediate compliance requirement for future growth.
- January 1, 2027: This is the critical deadline for existing contracts. Any contracts Sky is already relying on as of October 22, 2026, have until January 1, 2027, to achieve full compliance with the new audit framework. After this date, Sky can only continue using a non-compliant contract with the specific approval of the Protocol Security Workstream Lead.
This relatively short transition period of approximately ten weeks for existing positions is designed to prompt swift action across the ecosystem. It will undoubtedly test the current security posture of numerous protocols that Sky’s Prime Agents interact with. Many will need to demonstrate that their deployed code has undergone two independent audits, complete with verifiable commit hashes, from firms on Sky’s approved list. This period is expected to reveal the true extent of audit redundancy and quality across the protocols Sky currently integrates with, potentially leading to adjustments in Sky’s capital allocations if compliance is not met. Protocols that fall short face the difficult choice of commissioning new audits, risking Sky withdrawing its capital, or seeking special exemption, which is likely to be a high bar.
Broader Governance Enhancements
While the audit standards and firm ranking are the most significant changes, the Atlas Edit proposal encompasses a broader package of seven other edits, all aimed at tightening controls and enhancing the overall security and resilience of the Sky ecosystem. These include:
- Revised Treasury Management Framework: Enhancing oversight, transparency, and security protocols for Sky’s treasury assets, potentially including multi-signature requirements, time-locks, and clearer spending policies.
- Stricter Collateral Type Requirements: Refining the criteria for assets accepted as collateral within Sky’s ecosystem, likely favoring more liquid and less volatile assets with robust security histories and proven decentralization. This could involve stricter risk assessments for newer or less established tokens.
- Updated Risk Parameter Adjustments: Establishing more dynamic and responsive mechanisms for modifying risk parameters (e.g., loan-to-value ratios, liquidation thresholds) based on real-time market conditions, oracle health, and protocol security assessments, allowing for faster adaptation to unforeseen events.
- Enhanced Emergency Procedures: Improving the protocol’s ability to respond swiftly and effectively to unforeseen events or critical vulnerabilities, including clearer guidelines for emergency shutdowns, upgrades, or fund recovery efforts. This often involves predefined roles and communication channels.
- Clearer Governance Scope Definitions: Providing more precise definitions for various governance roles and their responsibilities, reducing ambiguity and improving accountability within Sky’s decentralized autonomous organization (DAO) structure.
- Refined Oracle Security Guidelines: Strengthening the reliance on and security of external data feeds (oracles) that are crucial for pricing and protocol operations, potentially including requirements for multiple independent oracle sources and robust deviation checks.
- Standardized Incident Response Protocols: Formalizing the steps and communication channels for handling security incidents, from detection and initial assessment to mitigation, communication with users, and post-mortem analysis.
These additional edits collectively paint a picture of a protocol committed to a holistic security upgrade, moving towards a more institutional-grade risk management framework. The emphasis is on proactive measures and clear, documented procedures to minimize risk and maximize resilience.
Industry Reactions and Future Outlook
Sky’s move is poised to elicit diverse reactions across the DeFi ecosystem. For the audit firms in the top tier, ChainSecurity and Cantina, this recognition is a significant endorsement, potentially leading to increased demand for their services and solidifying their market leadership. For the mid-tier firms, it provides a clear pathway for continued engagement with a major protocol like Sky, while also implicitly setting a higher bar for aspiring top-tier status. This could spur greater investment in advanced auditing techniques and talent development across the industry.
The exclusion of CertiK, however, is likely to be a focal point of discussion. It challenges the conventional wisdom that high audit volume equates to comprehensive security assurance. This decision could prompt CertiK and similar firms to re-evaluate their methodologies and reporting standards to align with the increasingly stringent demands of protocols like Sky. It may also lead to greater transparency from audit firms regarding their internal processes, tools, and auditor qualifications.
For other DeFi protocols, Sky’s Atlas Edit serves as both a challenge and a potential blueprint. It raises the question of whether similar stringent standards will become the norm, pressuring other major protocols to adopt comparable frameworks for vetting external audits and managing risk. Protocols that currently rely on single audits or less rigorous verification processes may find themselves under pressure from their communities and investors to enhance their security posture. The increased demand for high-quality, independent audits from genuinely distinct firms could also drive up costs and lead to longer waiting times for audit slots, impacting development timelines for new projects. This could, in turn, accelerate the professionalization of the smart contract auditing industry, fostering specialization
