How to Read a CertiK Audit Report: Statuses and Fixes
Quick answer. Open View PDF from the project's Skynet audit history, note the commits and files in scope, then read each finding's status and Alleviation. Treat Resolved as confirmed only when the Alleviation names the fix and the deployed contracts match that reviewed code.
Video transcript
A CertiK badge claims an audit. It does not show which issues were fixed, or whether that code is what you hold. Guardian publishes this guide and competes with CertiK.
CertiK says an audit has no pass or fail. Read the summaries, repository commits, files in scope, findings, and the Alleviation note on each one.
The PDF and dashboard can disagree. Formation Finance's 2021 PDF lists 15 findings, while its live Skynet panel lists 19. Ask which version is authoritative.
Resolved means the issue was addressed. Acknowledged means it stays open, with potential effects and the team's justification expected. The Alleviation should name the fix commit.
Treat Resolved as one of three checks. The status records closure. The note names what changed. And the deployed contracts, behind any proxy, must match that reviewed code.
CertiK changed its centralization workflow on March 24, 2025, so older reports may use other labels. Multisigs and timelocks reduce risk, but the multisig itself is not automatically in scope.
Ask the team which PDF is authoritative, which commit fixed each finding, which contracts are live, who holds privileged roles, and what sits outside scope.
Read the full guide for the complete checklist, or talk to Guardian at guardian.security if you need your fixes reviewed before you ship.
Read Past the Badge
A CertiK logo or badge claims an audit. It does not show which issues were fixed, or whether the fixed code is the code you hold.
On November 11, 2026, CertiK's homepage claimed 8,512 audits delivered and 120,000+ findings, figures it reports itself. CertiK
Guardian publishes this guide and competes with CertiK, so CertiK claims here cite its own pages. For any firm's reports, see how to read a smart contract audit report; this guide covers CertiK's own fields and labels.
What a CertiK Report Contains
CertiK's walkthrough lists the parts: project and audit summaries, repository and commits, files in scope, findings, and an Alleviation note on each finding. CertiK
CertiK says an audit has no pass or fail. Read the report as a record of what was found and answered.
Its methodology runs from architecture review and threat modeling through static analysis, manual review, reporting and remediation. Formal verification is optional, per its service page.
CertiK's methodology describes each finding as a title and metadata (category, severity, file location and Alleviation status), then Description, Scenario, Proof of Concept and Recommendation. Older PDFs may differ.
CertiK's walkthrough defines Alleviation as how the team resolved the finding, if it did. Look there for the commit that holds any fix.
On Skynet, CertiK's project site, View Findings opens a summary of code findings. View PDF opens the full report.
The two can disagree. Formation Finance's September 2, 2021 PDF lists 15 findings, 6 Resolved and 9 Acknowledged; its live Skynet panel lists 19, 8 Resolved and 11 Acknowledged.
Ask CertiK or the team which version is authoritative before counting anything.
Match the PDF to Deployed Code
A report covers named code only. Formation's Skynet panel lists six audited files, each with a SHA-256 entry. CertiK
Compare against the last commit the report lists as audited, and check that each Alleviation fix commit is included in it.
Next, take deployed addresses from the project's own docs, then read the verified source on an explorer.
Etherscan says matching deployed bytecode needs the same source and compiler settings, constructor arguments, libraries and metadata. Sourcify's Match, unlike its Exact Match, allows metadata differences. Etherscan, Sourcify
Follow an ERC-1967 proxy to its current implementation. Our guide on how to check if a project is audited walks through verification labels and proxies. Ethereum Improvement Proposals
Verification shows which source is deployed, not that CertiK reviewed it. Compare those files with the reviewed commit; our deployed vs audited code study shows how the two drift.
Severity and Status Labels
Skynet's guide defines five levels. Critical must be addressed before launch, Major can lead to loss of funds or control, and Medium can affect how a platform functions. CertiK
Minor covers smaller issues. Informational items are recommendations.
Labels vary by document. The guide says Major and Minor, while the current Formation panel shows High and Low, so use each document's own terms.
CertiK marks addressed vulnerabilities Resolved. For acknowledged issues left unresolved, it says the report should give the potential effects and the team's justification.
Its remediation step takes updated code or comments, updates the findings and publishes a revised report.
All five High findings on Formation's panel are Acknowledged. In the PDF, FTF-01, a Major centralization finding, is Acknowledged; the team's response says the contract was created for testing purposes only.
Treat Resolved as one of three checks. The note should say what changed and what was reviewed, and the deployment must match that code.
For how Guardian defines each status and what to ask about open ones, see audit finding statuses explained.
| Label or field | What CertiK says | What to check |
|---|---|---|
| Resolved | The vulnerability was addressed | Fix commit in the Alleviation; deployed code matches it |
| Acknowledged | Unresolved; potential effects and justification expected | The stated reason, and who carries the risk |
| Alleviation | Team response and update after remediation | Commit hash, review round, anything left open |
Centralization and Privileged Roles
Skynet's Centralization Overview sorts these concerns into Distribution, Upgrade, Privilege and Other. CertiK
Upgrade means authority to change a proxy's logic. Privilege means control over functions that affect operations or core business logic.
CertiK changed its centralization workflow on March 24, 2025, so older reports may use other statuses.
Current labels include Acknowledged, X/Y Multi-sig, X-hour Timelock, Renounced, Removed and Disabled. Acknowledged means no recommended action was applied.
Disabled is reserved for irreversibly turning off built-in upgradability on non-EVM chains.
CertiK says multisigs and timelocks reduce centralization risk rather than remove it. Its guidance recommends at least a 2-of-3 onchain multisig.
It asks teams for the wallet, the role-transfer transaction and signer addresses. The multisig or timelock contract is not automatically in audit scope.
So check those addresses onchain, and confirm the multisig governs every privileged path, including its own settings.
Guardian's public reports show both outcomes. Guardian
In Guardian's Umami eGMX report, M-08 flagged an admin able to withdraw arbitrary tokens from any vault and upgrade implementations through a beacon. It is Resolved, with the team's fix in PR#17.
In LayerZero OneSig on Canton, main-review M-02 found an admin exception to the advertised quorum. It is Medium and Acknowledged, with impact depending on hosting.
What the Report Does Not Cover
CertiK calls a code audit a baseline. Pentesting, bug bounties, monitoring, incident response and identity checks sit beyond it. CertiK
Dependencies are a common gap. Check which third parties the report assumes work correctly.
A leaderboard rank or security score is different evidence from a PDF that names commits and files.
Skynet's guide tracks audited-code coverage and audit freshness. An old report on heavily changed code says little about what runs today.
Questions to Ask the Team
Send these to the team. Where an answer concerns the report itself, confirm it with CertiK.
The same questions apply to any auditor, Guardian included.
Guardian's portfolio listed 321 public reports and 9,620 findings on November 11, 2026. Each report page shows every finding's severity and status, with any recorded response. Guardian
Published reports are a selected public record, not every engagement.
| Question | Evidence to ask for | Red flag |
|---|---|---|
| Which PDF is authoritative? | Final version, date and finding count | PDF and Skynet counts differ without explanation |
| Which commit fixed each finding? | Finding ID, fix commit and review round | Resolved with no commit in the Alleviation |
| Which contracts are live? | Chains, addresses, verified source, current implementation | Proxy points to unverified or unreviewed code |
| Why was it Acknowledged? | Potential effects and the team's justification | Serious finding with no stated reason |
| Who holds privileged roles? | Multisig wallet, signer addresses, role-transfer transaction | One wallet, or a multisig that bypasses its own quorum |
| What changed since the report? | Later reports covering the new code | Upgrades after the report with no review |
| What sits outside scope? | Dependencies and offchain components | Bridges or oracles treated as black boxes |
Frequently Asked Questions
Where do I find a CertiK audit report PDF?
Search for the project on CertiK Skynet, open its project page, select the audit under Code Audit History and choose View PDF. Compare any copy the project sends against that one. CertiK
What do the dates on a Skynet audit panel mean?
They describe the audit, not the webpage. Formation's panel shows the audit was requested on August 13, 2021 and revised on September 2, 2021, and lists Manual Review and Static Analysis as methods. CertiK
Is an Acknowledged centralization finding always a red flag?
Not always. CertiK says some designs, such as a bridge's fund-release role or custodial trading bots, may have no applicable mitigation, so they receive Acknowledged. Read the stated reason and who holds the role. CertiK
Related reading
- how to read a smart contract audit report
- audit finding statuses
- how to check if audited
- deployed vs audited code match rate
- certik alternatives
Sources
- CertiK: How We Audit: A Comprehensive Guide to CertiK's Auditing Methodology (February 23, 2024)
- CertiK: Navigating a CertiK Security Audit (August 18, 2021)
- CertiK: Centralization Risk Handling Strategies
- CertiK: Formation FI Security Score and Audit
- CertiK: Formation Finance Security Assessment
- CertiK: Smart Contract Audit
- CertiK: Code Security: CertiK Skynet 101
- CertiK: CertiK Digital Asset Security and Compliance
- Ethereum Improvement Proposals: ERC-1967: Proxy Storage Slots
- Etherscan: Common Verification Errors
- Sourcify: Exact Match vs Match
- Guardian: Published Smart Contract Audit Reports
- Guardian: Umami eGMX Audit Report: M-08 Centralization Issues
- Guardian: LayerZero OneSig on Canton: Main Review M-02
- Guardian: Smart Contract Audit Services
Need your fixes reviewed before you ship?
Guardian's smart contract audit puts two independent teams on one commit scope, adds invariant fuzzing and reviews your fixes before the report is delivered. Offchain pentesting and post-launch update review are scoped separately.