We manage your security to weather the AI storm →
Get a quote

← Resource Hub

Is CertiK Legit? What Its Audits Do and Don't Tell You

By Ashkan KhamsehpourPublished 7 min read

Is CertiK Legit? What Its Audits Do and Don't Tell You

Quick answer. Yes: CertiK is a real Web3 security company, founded in 2017, but its audit covers named code at one point in time, not the whole project. Trust a report only after checking its scope, finding statuses, privileged roles and later code changes.

Watch: Is CertiK Legit? What Its Audits Do and Don't Tell You 1:43
Video transcript

Yes, CertiK is a real Web3 security company. But its audit covers named code at one point in time, not the whole project.

CertiK says it was founded in 2017. In April 2022, TechCrunch reported an 88 million dollar raise. That shows a real business, not audit depth.

CertiK says every audit includes manual review. AI analysis is an extra layer, and formal verification is optional.

Formation's Skynet panel shows 19 findings, only eight resolved. All five High findings are privilege issues, and none is resolved.

Audited projects can still rug. In May 2023, Swaprum's deployer swapped its audited contract for malicious code, and 3 million dollars was lost. CertiK says its audit flagged that upgrade path.

Open CertiK reports on Skynet, and other firms' reports on their own site or GitHub. Note the scope by commit. Match the final commit to deployed code, read every High and Critical status, and map privileged roles.

Scammers also misuse CertiK's name. Watch for unrequested audit offers, senders outside certik dot com, badges with no Skynet page, and fund recovery offers.

Guardian also sells audits, so ask every firm, us included, for named reviewers, scope by commit and public reports on code like yours. A badge alone does not show depth.

Read the full guide for the checklist, or talk to Guardian about an audit with two independent review teams, invariant fuzzing and a fix review.

The Short Answer

CertiK is a real, operating company. It says it was founded in 2017 by Columbia and Yale professors Ronghui Gu and Zhong Shao. CertiK

In April 2022, TechCrunch reported that CertiK raised $88 million at a $2 billion valuation, with Goldman Sachs among its investors. Funding shows a substantial business, not how deep any single audit went. TechCrunch

In June 2024, Kraken said a security research firm exploited a deposit bug and ignored its bug bounty expectations; Decrypt reported about $3 million was withdrawn. Kraken, Decrypt

CertiK said it was that firm, and Kraken's security chief confirmed the funds were returned, minus fees. CertiK's August 2024 statement called it whitehat research but admitted errors in judgment and poor communication.

Audited projects can still rug: in May 2023, Swaprum's deployer swapped its audited MasterChef for malicious code, and $3 million was lost. CertiK says its audit had flagged that upgrade path as a major vulnerability.

Guardian also sells smart contract audits, so claims about CertiK here cite primary pages or press reports.

This guide covers trust. For CertiK's report fields and labels, read our guide to reading a CertiK audit report.

What a CertiK Audit Covers

CertiK describes five steps: source submission, scoping and a quote, security analysis, remediation guidance and final report delivery. CertiK

It says every audit includes expert manual review. AI analysis is an extra layer, and formal verification is optional, against custom specifications.

Its published methodology adds architecture review, threat modeling and static analysis alongside manual review and remediation.

Each finding is rated by severity. Resolved issues are marked as such; acknowledged ones stay unresolved, with their effects and the team's reasons.

Formation's September 2021 audit, on Skynet, lists manual review and static analysis across six files, with no formal-verification properties. CertiK Skynet

Public method pages do not give the people, days or exclusions of a given audit. Ask for those, because they set the depth.

ComponentCertiK's descriptionWhat to confirm
Manual reviewIncluded in every auditWho reviewed, and for how many days
AI analysisAn additional layerWhether a human checked each AI finding
Formal verificationOptional, against custom specificationsWhich properties were proven, if any
RemediationGuidance, then a final reportWhich commit holds each fix

What It Does Not Guarantee

CertiK's methodology calls an audit a baseline code assessment. It lists pentesting, bug bounties, monitoring, incident response and team KYC as extensions beyond it. CertiK

CertiK's 2021 Formation report says it is neither an endorsement nor a disapproval, and no indication of a project's economics, asset value or business model. It gives no guarantee the code is bug-free.

Formation's live Skynet panel shows 19 findings: 8 resolved and 11 acknowledged. All five High findings are privilege issues, and all five are acknowledged. CertiK Skynet

Guardian's Umami eGMX finding M-08 (Medium) found an admin could withdraw arbitrary tokens from any vault and upgrade every vault via a beacon. It was resolved in PR#17; still, check who holds such power today. Guardian

Skynet also tracks coverage, meaning how well deployed code matches audited code, and freshness, meaning new contracts and lines since the latest CertiK audit.

How to Read the Report Yourself

These checks work for a CertiK report or any auditor's. Run them before you rely on a badge or a score.

Our guide on how to check if a project is audited walks through explorer labels and proxies step by step.

  • Open CertiK reports on Skynet and other firms' reports on their own site or GitHub, never via a link the project or a stranger sends. CertiK, Guardian Resource Hub
  • Write down the scope: repository, files and commit hashes. Code outside that list was not reviewed.
  • Find the final fix-review commit and compare it with the verified code deployed onchain.
  • Follow each proxy to its current implementation, and look for upgrades after the report date.
  • Read the status of every High and Critical finding, plus the team's reason for anything acknowledged.
  • Map privileged roles: who can upgrade, pause, mint or withdraw, and whether a multisig or timelock holds them.
  • Read Skynet's Audited Code Percentage and Audit Freshness before trusting the score. CertiK Skynet
  • Ask what sits outside scope: oracles, bridges, offchain services and third-party dependencies.

CertiK Scam Emails and Fake Audits

CertiK has publicly warned that scammers misuse its brand. CertiK

Its warning names phishing sites, counterfeit audit certificates, people posing as CertiK employees and fund-recovery scams.

CertiK tells users to verify projects on Skynet and to confirm staff through its employee-verification channel, not through unsolicited messages.

A Skynet page alone does not prove a CertiK audit, since Skynet also lists third-party audits; check that the audit listed is CertiK's own. CertiK Skynet

Treat any message using the CertiK name as unverified until those checks pass. Check for these signs:

  • An unrequested email offering an audit, a listing or a better security score.
  • A sender whose email domain is not certik.com, which CertiK says to check on every message.
  • A certificate or badge image with no matching project page on Skynet.
  • A domain that looks like CertiK's but is not the address you typed.
  • Someone claiming to be CertiK staff on Telegram or X whom the verification channel does not confirm.
  • An offer to recover stolen crypto in CertiK's name.
  • Any request to connect a wallet, sign a transaction or share a seed phrase.

Questions for Founders and Allocators

Founders face the same question when buying an audit.

Ask every firm, Guardian included, for named reviewers, scope by commit and public reports on code like yours.

Our guide to choosing a smart contract auditor lists the questions, red flags and a proposal scorecard.

Allocators can paste the checklist above into due diligence notes and record each answer with its source and date.

Comparing firms instead? Our CertiK alternatives guide maps ten firms to the audit need each one fits.

Frequently Asked Questions

What should I do with a suspected CertiK scam email?

Don't click, reply or connect a wallet. Report the message through CertiK's official channels. If you signed anything, revoke token approvals and move funds from that wallet. CertiK

What do CertiK's severity levels mean?

Skynet 101 defines five levels. Critical must be resolved before launch; Major includes centralization and logic errors; Medium affects how a platform functions; Minor covers smaller risks; Informational covers style recommendations. Some panels, like Formation's, show High and Low instead, so use each document's own labels. CertiK Skynet

How can I check that someone really works for CertiK?

Use CertiK's Employee Verification page, opened by typing CertiK's address yourself. It checks email addresses, WeChat IDs, X accounts and Telegram IDs, so you can test a contact before replying. CertiK

Sources

Need an audit that goes past the badge?

Guardian's smart contract audit puts two independent review teams on one scope, with invariant fuzzing, human-verified findings and a fix review. Talk to us about scope before you sign.

Talk to GuardianExplore the service