Overview
CertiK is a blockchain security firm that checks smart contracts, the self-running programs behind crypto apps, for bugs before they go live. Project teams hire it to review their code and receive a written report of the issues found, with suggested fixes1. Think of it like a building inspector: the report tells the builder what to repair, and the public can read it later.
Founded in 2017 by computer science professors from Columbia and Yale, CertiK is based in New York2. On Cardano, CertiK runs a dedicated audit service for contracts written in Plutus and Aiken, two languages developers use to build Cardano apps3. The firm is listed in the auditor table of CIP-52, Cardano's audit best practice guidelines, and was one of the audit firms that took part in the discussions that produced those guidelines4.
Key Features
- Catches Cardano transaction flaws. CertiK's Cardano audits look at how transactions are assembled and validated under the eUTxO model, where funds sit in separate coin-like outputs instead of account balances, to catch validation and concurrency flaws, which arise when several transactions try to use the same output at once3.
- Safer token minting rules. CertiK reviews the rules that control creating and destroying Cardano native tokens, including tokens that follow the CIP-113 programmable token design, to block exploits such as minting the same token twice3.
- Expert review plus automated checks. A CertiK smart contract audit combines manual review by security engineers, an AI-assisted automated pass, and optional formal verification, a mathematical method for proving code does what its specification says1.
- Reports anyone can read. CertiK audit reports grade each issue from Critical to Informational, suggest a fix, mark what the team resolved, and are published free to the public1.
- Public security scores. Audited projects appear on Skynet, CertiK's public rating site, which blends code security, fundamental health, operational resilience, community trust, market stability, and governance strength into a single score5.
What to Expect
For Cardano project teams, an engagement starts with a quote request and a review of the full codebase3. Published Skynet records show what that looks like in practice. CertiK has audited the Minswap version 2 exchange and liquidity bootstrapping contracts, which set up a new token's first trading pool6. WingRiders, another Cardano DEX, has CertiK audits covering its stableswap pool contracts, which handle trades between assets meant to hold similar prices7. Skynet also lists CertiK audits for Astarter, described there as a DeFi hub with a token launchpad, and for MLabs, a Haskell and Rust blockchain consultancy8,9.
For everyday users, CertiK is mostly something you look up rather than use. On a project CertiK has audited, such as Minswap, the Skynet page shows the audit history, the review methods used, the files that were checked, and an audit timeline6. That lets you see what was reviewed before you connect a wallet to a Cardano app.
For developers and researchers, CertiK publishes Cardano research such as its analysis of the CIP-113 programmable token standard, which explains how tokens with built-in transfer rules can work across wallets and apps10. Outside audits, the CertiK Cardano page also offers penetration testing, meaning simulated attacks on exchanges, wallets, and DApps, plus identity checks on project teams3.
