A Solana cybersecurity researcher said that the firm does the bare minimum when auditing protocols.\n<\/p>\n
Certik found a vulnerability in crypto exchange Kraken and proceeded to hold $3 million of the exchange\u2019s funds hostage<\/a> last week. As other of the blockchain security firm\u2019s clients come forward, their experiences show the judgment lapse may have not been a one-off.<\/p>\n These red flags call into question one of the most well-known security firms in the space. Certik has raised more than $140 million from venture capital firms including Sequoia Capital, Coinbase Ventures, and Tiger Management Capital among others.<\/p>\n According to the company, they have audited<\/a> more than 5,021 smart contracts, and 685 \u201cformally-verified\u201d projects, in a space where expert analysis of smart contract code is crucial with $5.7 billions lost in exploit in the past two years alone, as per data from Web3 bug bounty firm ImmuneFi.<\/p>\n Certik did not reply to multiple requests for comment from The Defiant.<\/p>\n Three years ago, Mat\u00edas Barrios<\/a> was employed at Stacktical, a French company that made smart contracts on the Ethereum<\/a> blockchain. Stacktical employed Certik to audit their code.<\/p>\n According to Barrios, who is currently an offensive security engineer for blockchain cybersecurity company Halborn and one of the foremost security experts on Solana, Certik did the bare minimum, and left their code without a deeper review.<\/p>\n \u201cInstead of running three layers of audits, which includes static analyzers, manual review, and then testing, they only did the first,\u201d he told The Defiant. The static analyzer, Barrios explained, is just an automated, \u201cvery basic,\u201d review of the code.<\/p>\n Barrios alleged that this is Certik\u2019s modus operandi.<\/p>\n \u201cThey go over the code through some automatic tooling, offer a very simple report, and leave it at that,\u201d he said. According to Barrios, they never go through the manual review, which he considers the most important part of the process.<\/p>\n Aggregated data backs Barrios\u2019s impression. Certik is the auditing firm whose clients have suffered the biggest losses in exploits, with $1.22 billion lost, according to data compiled by IntoTheBlock. Out of Certik-related exploits, the Venus exchange on the BNB chain suffered the biggest losses, due to price manipulation of the Venus token, which led to massive liquidations<\/a>.<\/p>\n In April 2023, hackers drained $2 million from Zksync-based decentralized exchange Merlin, after it was audited by Certik.<\/p>\n \u201cAs a core auditor of the CamelotDEX contracts, I can say with 95% confidence that the said company did not audit these contracts,\u201d wrote cybersecurity expert Charles Wang after the Merlin rug pull. \u201cThere is no possibility to miss this change. Zero.\u201d<\/p>\n Merlin did not immediately reply to a request for comment from The Defiant.<\/p>\n After the Kraken exploit, founder of crypto insurance company Nexus Mutual Hugh Karp noted that Nexus Mutual stakers often price a protocol higher if it has been audited by CertiK than not at all.<\/p>\n \u201cFeel like I can say this out loud now,\u201d he wrote<\/a><\/p>\n Kraken\u2019s Chief Security Officer, Nick Percoco, took to X on June 19 to call out that a cybersecurity firm that found a bug in their system, filed a bug bounty report, but later exploited the vulnerability to the tune of $3 million.<\/p>\n \u201cThis is not whitehat hacking,\u201d exclaimed<\/a> Percoco, \u201cthis is extortion.\u201d<\/p>\n Hours later, Certik came forward as the company, countering allegations that Kraken was threatening their employees. Certik returned the funds<\/a> a day later.<\/p>\n Michael Perklin, former CISO of Shapeshift, said \u201cI\u2019d never hire a security company that did this. Extortion is a bad look.\u201d<\/p>\n Many in the crypto community were quick to label<\/a> Certik\u2019s behavior as nefarious, but some cybersecurity experts pushed back.<\/p>\n According to Tal Be\u2019ery<\/a>, co-founder and CTO of crypto wallet ZenGo, it\u2019s hard to tell what happened but he points to a lack of accountability.<\/p>\n \u201cFrom the corporate side it\u2019s probably much more about checks and controls, and not about premeditated nefarious behavior,\u201d he told The Defiant.<\/p>\n Be\u2019ery added that his company had a good experience after working with Certik in the past. \u201cI would say they are the most professional team I\u2019ve worked with in this field,\u201d he said.<\/p>\n However, Be\u2019ery pointed out that his interaction with Certik was purely research-focused.\u00a0<\/p>\n Late last year, pseudonymous developer PopPunkOnChain alleged<\/a> that a Discord link from security auditing firm Certik’s website connected to a bot and malware to drain wallet assets.<\/p>\n PopPunkOnChain has been critical<\/a> of Certik since the Merlin exploit, saying that most of Certik\u2019s audits are of tokens with just a few lines of code, and even that is because exchanges require projects an audit from a big-name firm to be listed.<\/p>\nDid “Bare Minimum\u201d<\/strong><\/h2>\n
Merlin Post-Audit Hack<\/h2>\n
Not White-Hat Hacking<\/strong><\/h2>\n
Checks And Balances<\/strong><\/h2>\n
Malware Bot<\/strong><\/h2>\n