clet.xyz

Sky, a prominent decentralized finance (DeFi) protocol, has initiated a significant overhaul of its smart contract audit recognition framework, introducing a new ranking system for auditing firms and setting unprecedentedly stringent standards for external audits. This move, currently undergoing a governance vote by Sky holders until October 22, 2026, positions ChainSecurity and Cantina in its exclusive top tier, while notably omitting industry giant CertiK from its entire list of recognized auditors. The implications of these changes are far-reaching, signaling a maturing approach to risk management within the DeFi space and potentially setting a new benchmark for security due diligence across the ecosystem.

The core of this pivotal development is an "Atlas edit" – an update to Sky’s foundational governance and operational guidelines. While the auditor ranking has garnered immediate attention due to its surprising composition, the underlying rules governing audit recognition represent a paradigm shift. For the first time, Sky is explicitly detailing the conditions under which it will acknowledge and rely on smart contract audits not directly commissioned by the protocol, establishing a bar significantly higher than typically observed in the broader DeFi landscape.

Background: The Imperative for Enhanced Security in DeFi

The rapid expansion of the DeFi sector over recent years has been accompanied by a distressing surge in security breaches and exploits. Billions of dollars have been lost due to vulnerabilities in smart contracts, ranging from reentrancy attacks and flash loan manipulations to logic errors and access control flaws. While smart contract audits are a cornerstone of security assurance, the quality and rigor of these audits have varied wildly across the industry. Many projects, under pressure to launch quickly or constrained by budget, have often opted for less thorough reviews, or relied on single audits that may not fully capture the complexity of their codebases.

This environment has fostered a growing recognition among sophisticated DeFi protocols, like Sky, that a more robust and standardized approach to security validation is indispensable. Sky, as a major player managing substantial capital through its Prime Agents (such as Spark, Grove, and Osero) which interact with numerous third-party systems like Morpho vaults, carries a significant responsibility to protect its users’ assets. The existing reliance on external audits, without a clear internal framework for their evaluation, presented a potential vulnerability that this new Atlas edit seeks to address comprehensively. The protocol’s commitment to security, therefore, extends beyond its immediate operations to the broader ecosystem it interacts with, necessitating a formal and stringent vetting process for all third-party dependencies.

Chronology of a Landmark Proposal

The journey towards these new standards began with the "Atlas Edit Weekly Cycle Proposal for October 19, 2026," which went live on Sky’s governance portal on Monday, October 19, 2026, at 16:00 UTC. This proposal is not a standalone initiative but part of Sky’s regular governance cycle, where Core Facilitators, acting on behalf of Ranked Delegates like "cloaky," bundle various operational and policy updates for community review and vote.

The current poll is a three-day binary vote, slated to close on October 22, 2026. While it encompasses eight distinct edits, the first and most impactful item on the agenda is the addition of new standards for non-Sky-commissioned audits and the revision of the protocol’s list of recognized audit firms. The technical underpinning for this change was introduced via a pull request on GitHub on October 16, adding 390 lines across eight Atlas documents. Approximately 100 of these lines are dedicated to an entirely new section within Sky’s Governance Scope, outlining an explicit framework for evaluating the trustworthiness of external audits—a capability Sky has not possessed in such detail before.

Defining Trust: What Constitutes a Recognized Audit?

The newly proposed framework meticulously defines the conditions an external audit must meet to be considered "recognized" by Sky. This section is critical because it dictates the baseline security assurance required for any third-party protocol or contract that Sky’s Prime Agents might interact with, or where Sky’s capital might be deployed. The six specific conditions are:

1. Independent Firm: The audit must be performed by a firm with no financial or operational ties to the audited project, ensuring impartiality.
2. Publicly Available Report: The full audit report must be hosted on a neutral, independent platform (e.g., the auditing firm’s website or a reputable security aggregator), not solely by the project itself, to prevent censorship or selective disclosure.
3. Clear Scope Definition: The audit report must explicitly state the scope of the review, including the specific smart contracts, libraries, and functionalities examined. Vague or overly broad scopes are deemed insufficient.
4. Specific Versioning: The report must clearly identify the exact commit hash or immutable version of the code that was audited. This eliminates ambiguity and prevents projects from claiming an audit covers code that has since been significantly altered.
5. Comprehensive Findings: The report must detail all findings, including vulnerabilities, informational issues, and suggestions for improvement, along with their severity.
6. Remediation Acknowledgment (if applicable): If issues were identified, the report should ideally indicate whether these issues were acknowledged and/or addressed by the project, or at least clearly state the project’s response.

These rules are a direct response to common practices in DeFi that often undermine the credibility of audits. Shortcuts such as projects hosting their own audit PDFs (allowing for potential manipulation), reports with ill-defined scopes, or vague claims of "fixes in a later PR" without referencing a specific audited version, are explicitly rejected. Sky’s stance is a clear signal to the industry that superficial audit practices will no longer suffice for protocols seeking to integrate with its ecosystem.

The Two-Audit Rule: A Higher Bar for Critical Infrastructure

Beyond merely recognizing an audit, the Atlas edit introduces a stringent "two-audit rule" for any external contract deemed "materially relevant" to the security of assets Sky holds or moves. The definition of "materially relevant" is intentionally broad, encompassing:

• Contracts directly holding Sky’s assets.
• Contracts through which assets pass during deposit, redemption, or withdrawal.
• Implementation contracts behind any proxy architecture.
• Any contract capable of altering the behavior, parameters, or price sources of these critical contracts.

For such deployed code, the requirement is exceptionally high: it must have undergone at least two independent audits from two distinct firms listed on Sky’s recognized auditor list. Furthermore, each audit must meet all six conditions outlined for recognized audits. This multi-firm approach is designed to mitigate the risks associated with a single point of failure in security review, acknowledging that even highly competent firms can miss vulnerabilities.

To prevent circumvention of this rule, a crucial loophole closer is included: audits published under different names by the same firm, or by firms under common ownership or control, will count as a single firm. This ensures true independence in the audit process. While the standards are high, a singular exception exists: Sky can still rely on a non-compliant contract if it receives explicit approval from the Protocol Security Workstream Lead, indicating a mechanism for strategic flexibility in extraordinary circumstances, albeit under strict oversight.

The New Audit Firm Ranking: A Shift in Perception

The new list of recognized firms is arguably the most attention-grabbing aspect of the proposal. It introduces a two-tier system, starkly differentiating between firms based on Sky’s assessment of their rigor and reliability.

The top tier is notably exclusive, featuring only two names:

• ChainSecurity
• Cantina

This selection will undoubtedly surprise many, as these firms, while highly respected, have not traditionally dominated public perception or volume metrics in the same way some other industry players have. Their inclusion in this elite category by Sky suggests a particular emphasis on depth of analysis, methodology, and perhaps a track record of identifying critical vulnerabilities that align with Sky’s high-security requirements.

The mid-tier is more expansive, comprising 33 firms. This list includes many well-known names in the smart contract auditing space:

• OpenZeppelin
• Trail of Bits
• ConsenSys Diligence
• Certora
• Sigma Prime
• Zellic
• Quantstamp
• Halborn
• PeckShield
• SlowMist
• Cyfrin
• OtterSec
• ABDK
• Runtime Verification

Significantly, this tier also acknowledges the growing importance of audit contest platforms, listing Code4rena and Sherlock, alongside respected independent auditors such as Pashov and StErMi. Their inclusion reflects an evolving understanding of how security expertise can be effectively sourced and validated in a decentralized context.

The most striking omission from both tiers is CertiK. As one of the most prolific smart contract auditing firms in the industry, CertiK’s complete absence sends a powerful message. Under Sky’s new rules, a CertiK report, regardless of the number of contracts it covers, would not contribute towards meeting Sky’s stringent two-audit requirement for materially relevant contracts. This exclusion suggests a fundamental misalignment between CertiK’s audit methodologies or reporting standards and Sky’s newly defined criteria for trustworthiness, prompting broader questions about industry-wide audit quality perceptions.

Transition and Enforcement: Deadlines That Will Test Current Positions

The new rules are not immediately retroactive, allowing for a transitional period. Any contract Sky first relies on after October 22, 2026, must immediately meet the new standards. However, contracts that Sky already relies on as of that date are granted a grace period until January 1, 2027. After this date, any existing, non-compliant contract can only remain in use with the express approval of the Protocol Security Workstream Lead.

This phased implementation provides approximately ten weeks for Sky’s Prime Agents and other relevant internal stakeholders to conduct a comprehensive audit of all existing external positions. This process will involve meticulously verifying whether the underlying protocols and contracts have secured two independent audits, complete with verifiable commit hashes, from firms on Sky’s newly approved list. This exercise is expected to reveal the true extent of compliance within Sky’s current third-party integrations and could necessitate significant adjustments or divestments from non-compliant positions.

Broader Implications for the DeFi Ecosystem

Sky’s new audit framework is poised to have profound implications across the DeFi ecosystem:

1. For Auditing Firms: The ranking and strict criteria will intensify competition and likely drive an industry-wide effort to meet higher standards. Firms not on Sky’s list, particularly those with high volume but potentially less rigorous processes, may face pressure to adapt or risk losing business from protocols seeking to integrate with entities like Sky. The emphasis on specific methodologies and clear reporting could lead to a standardization of best practices.
2. For DeFi Protocols: Projects aiming to attract capital or integrate with major players like Sky will now face a higher bar for security. This could lead to increased demand for top-tier audits, longer development cycles to accommodate multiple reviews, and potentially higher costs associated with achieving the required security posture. It may also foster a "flight to quality," where projects prioritize robust security over speed-to-market.
3. For Sky’s Operations and Reputation: By formalizing and elevating its security due diligence, Sky significantly enhances its own risk management framework. This move reinforces its reputation as a protocol committed to institutional-grade security, potentially attracting more sophisticated users and institutional capital. It also demonstrates proactive governance in response to the evolving threat landscape.
4. For the Broader DeFi Security Landscape: Sky’s rigorous standards could serve as a powerful precedent, influencing other major DeFi protocols, DAOs, and institutional investors to adopt similar best practices. This cascading effect could gradually elevate the overall security baseline of the entire decentralized financial system, fostering greater trust and resilience against exploits. The explicit rejection of common audit shortcuts provides clear guidance for what constitutes a truly reliable security review.

Other Governance Adjustments

While the audit section is the most significant, the other seven edits bundled in the proposal also underscore Sky’s commitment to tightening controls and enhancing operational robustness:

• Risk Parameter Adjustments: Refining existing risk parameters to better reflect current market conditions and identified vulnerabilities.
• Expanded Oracle Requirements: Introducing more stringent standards for price oracles, crucial components for many DeFi protocols, to ensure data integrity and resistance to manipulation.
• New Collateral Asset Onboarding Process: Streamlining and securing the process for adding new collateral types, ensuring comprehensive risk assessment.
• Security Incident Response Protocol Updates: Enhancing procedures for detecting, responding to, and mitigating the impact of security incidents.
• Protocol Upgrade Mechanisms: Improving the safety and transparency of smart contract upgrade processes.
• Governance Participation Incentives: Adjustments aimed at encouraging more active and informed participation from SKY token holders in governance decisions.
• Treasury Management Guidelines: Refining policies for the prudent management and deployment of Sky’s treasury assets.

For the Atlas edit to pass, "Yes" votes must exceed "No" votes and reach a minimum threshold of 480 million SKY. If successful, the pull request will be merged into the Sky Atlas, officially codifying these new standards.

In conclusion, Sky’s comprehensive overhaul of its smart contract audit framework represents a landmark moment in DeFi security. While the new auditor ranking has generated immediate discussion, it is the underlying, meticulously defined rules – particularly the commit-hash verification and the two-firm audit requirement for critical contracts – that will fundamentally reshape how Sky, and potentially the wider industry, evaluates and trusts external protocols. This initiative signals a clear trajectory towards a more secure, transparent, and professionally managed decentralized financial future.

Disclosure: This is not trading or investment advice. Always do your research before buying any cryptocurrency or investing in any services.