Sky has published a ranking of smart contract auditors that will surprise a lot of people. ChainSecurity and Cantina are in the top tier.
OpenZeppelin, Trail of Bits and ConsenSys Diligence are in the mid tier, alongside 30 other firms. CertiK doesn’t appear at all.
The list is part of an Atlas edit that Sky holders are voting on until October 22. The ranking will get the attention, but I’d argue the rules underneath it matter more. For the first time, Sky is spelling out exactly when it will trust an audit it didn’t commission, and the standard is stricter than anything I’ve seen from a major DeFi protocol.
A Weekly Atlas Edit With an Unusually Big Change
The Atlas Edit Weekly Cycle Proposal for October 19, 2026 went live on Sky’s governance portal on Monday at 16:00 UTC. It’s a three-day binary poll that the Core Facilitators placed on behalf of Ranked Delegate cloaky, and it closes on October 22.
The poll bundles eight edits. Most are routine. The first one, listed at the top, adds standards for audits not commissioned by Sky and revises the list of recognized audit firms.
The underlying pull request on GitHub was opened on October 16 and adds 390 lines across eight Atlas documents. About 100 of those lines go into a new section of the Governance Scope that Sky has never had before: a framework for deciding which outside audits it will trust.
What Counts as a Recognized Audit Now
The new section covers audits Sky didn’t order through its own process, including audits of external protocols and their contracts. That’s an important category. Sky’s Prime Agents, such as Spark, Grove and Osero, put capital into third-party systems like Morpho vaults, and Sky didn’t hire the firms that audited that code.
Under the edit, an outside audit counts only if it meets six conditions:
- It was performed by a firm on Sky’s recognized list.
- Its source can be independently verified, for example through the auditor’s own website or official code repository. A PDF uploaded to the audited project’s own codebase doesn’t count.
- It includes a scope statement naming exactly what was reviewed.
- It records the exact commit hash where the audit ended. A link to a pull request with fixes, but no commit hash, doesn’t count.
- It records the severity and resolution status of every finding.
- It documents the system’s trust assumptions, or the codebase documents them at that commit.
It’s important to note how specific this is. Each rule targets a common shortcut in DeFi: audit PDFs hosted by the project being audited, vague scopes, and “we fixed it in a later PR” with no exact version reviewed. Sky is rejecting each of these explicitly.
The Two-Audit Rule for Contracts That Hold Sky’s Money
Recognizing an audit is one step. The edit also sets coverage requirements for any outside contract that matters to the security of assets Sky holds or moves.
The definition of “materially relevant” is broad. It includes the contracts where assets are held, contracts the assets pass through on deposit, redemption and withdrawal, the implementation behind any proxy, and any contract that can change the behavior, parameters or price sources of those contracts.
For that code as deployed, the bar is high:
- It must be covered by at least two recognized audits, each from a different firm.
- Each audit must target the deployed commit, or any later change must itself be covered by two recognized audits from different firms.
- Every finding of medium severity or above must be confirmed as resolved by the auditor, not just by the project.
There’s also a loophole closer here. Audits published under different names by the same firm, or by firms under common ownership or control, count as a single firm. A protocol can’t meet the two-firm rule by using two brands of the same company.
The one exception is that Sky can still rely on a contract that falls short, but only with the approval of the Protocol Security Workstream Lead.
The New Audit Firm Ranking
The new list splits recognized firms into two tiers. The top tier has just two names: ChainSecurity and Cantina.
The mid tier has 33 firms, including OpenZeppelin, Trail of Bits, ConsenSys Diligence, Certora, Sigma Prime, Zellic, Quantstamp, Halborn, PeckShield, SlowMist, Cyfrin, OtterSec, ABDK and Runtime Verification. It also includes audit contest platforms Code4rena and Sherlock, along with well-known independent auditors Pashov and StErMi.
Some names are missing. CertiK, which publishes more audits than almost anyone in the industry, doesn’t appear in either tier. Under these rules, a CertiK report wouldn’t count toward Sky’s two-audit requirement, however many contracts it covers.
Deadlines That Will Test Sky’s Current Positions
The rules don’t take effect immediately. Under the transition section, any contract Sky first relies on after October 22, 2026 must meet the standards before Sky uses it. Contracts Sky already relies on as of that date have until January 1, 2027. After that, Sky can only keep using a non-compliant contract with the Workstream Lead’s approval.
That gives about ten weeks to check every existing external position Sky has. I expect that’s when we’ll learn how many of the protocols Sky’s Prime Agents use actually have two independent audits, with commit hashes, from firms on this list.
The Rest of the Proposal
The other seven edits share the same theme of tightening controls:
- The Executive Process Liaison must now confirm that every Prime Spell action is authorized in the Atlas before approving the spell’s address.
- The Core Council Multisig on Arbitrum is now formally described as a separate deployment, and signer changes must be applied on every network where it exists.
- Each Prime Agent’s Morpho vault records must list every permissioned role, who holds it and its on-chain address.
- Restored rate-limit capacity from burning USDS or swapping USDC is capped at each limit’s
maxAmount. - Pattern’s River I Instance gets a 7% Capital Ratio Requirement.
- Osero’s Gauntlet USDC Prime Morpho Vault deposit slope goes from zero to 650,000 USDC per day.
To pass, “Yes” votes must exceed “No” votes and reach at least 480 million SKY. If they do, the pull request is merged into the Sky Atlas.
The audit section is the most rigorous public audit standard I’ve seen from a major DeFi protocol. The firm rankings will get the attention, but the commit-hash and two-firm rules are what will actually decide which outside protocols Sky can use.
Disclosure: This is not trading or investment advice. Always do your research before buying any cryptocurrency or investing in any services.
Follow us on Twitter @themerklehash to stay updated with the latest Crypto, NFT, AI, Cybersecurity, and Metaverse news!