-
Technology
-
Industry
-
Solutions
-
- ASSET MANAGEMENT
- CUSTOMER EXPERIENCE MANAGEMENT
- CYBER SECURITY
- DATA CENTER
- DOCUMENT MANAGEMENT
- ELECTRONIC DATA INTERCHANGE
- ENTERPRISE DATA MANAGEMENT
- ENTERPRISE RESOURCE PLANNING
- ENTERPRISE RISK MANAGEMENT
- ENTERPRISE-GRADE WEB DATA SOLUTIONS
- FACILITY MANAGEMENT
- FIELD SERVICE
- IDENTITY AND ACCESS MANAGEMENT
- INFRASTRUCTURE
- IT SERVICE MANAGEMENT
- MANAGED IT SERVICES
- PAYMENT AND CARD
- PROJECT MANAGEMENT
- SOFTWARE TESTING
- STORAGE
- VIDEO SOLUTIONS
- WORKFLOW
-
-
Platforms
-
Functions
- Leadership Perspectives
- Innovation Insights
- Research
- Magazines
- News
- CXO Awards
Prof. Ronghui Gu, Co-FounderCertiK’s mission is to raise the standard of security and transparency across the Web3 world. It continuously invests in research and development to create cutting-edge security solutions for blockchain ecosystems and actively promotes the adoption of secure coding practices while raising awareness about blockchain security.
“CertiK offers a suite of end-to-end security solutions, which includes pre-deployment code auditing to post-deployment applications and sentiment monitoring,” says Prof. Ronghui Gu, CEO at CertiK. “We aim to make these tools available to retail users for raising the standard of security and transparency across the entire industry.”
One such product is Skynet. This crucial component of CertiK’s end-to-end security solutions for Web3 serves as an all-in-one security analytics platform. Before smart contracts are deployed, CertiK provides security auditing and formal verification services to ensure the code is free of vulnerabilities. This proactive approach helps prevent security issues from arising in the first place. After smart contracts are deployed, Skynet comes into play. It actively monitors on-chain and off-chain data to identify any emerging security risks, providing real-time alerts to users. This helps spot any issues that may have slipped through the pre-deployment phase or that emerge over time due to changes in the blockchain ecosystem.
Skynet offers a range of tools for ongoing risk management, including the security score, the smart money wizard, and the exchange audit feature. These tools enable users to monitor the security of their own projects and others in the ecosystem on an ongoing basis, aiding in informed decision-making and risk mitigation. Skynet’s Project Team KYC verification and the ability to evaluate the trustworthiness of social media influencers enhance transparency and build trust within the community.
CertiK offers a real-time security score for Web3 applications, providing a quantitative measure of their security based on multiple factors. This security score is a core component of Skynet. CertiK uses formal verification technology, a rigorous mathematical method to check system correctness. This approach, borrowed from high-stakes domains like aerospace and chip design, aims to provide the strongest assurance against bugs and vulnerabilities—differentiating CertiK from other security auditors that rely on less exhaustive methods.
The extensive security audits that CertiK provides for entire blockchain ecosystems cover both on-chain smart contracts and the underlying base layer, along with the design of the tokenomics. This holistic approach to auditing ensures that all aspects of a project are secure and reliable.
The HamsterWheel case demonstrates how CertiK’s proactive security analysis and responsible disclosure helped the Sui network overcome a significant hurdle that could have had serious consequences for the network’s operations and its users. By identifying and disclosing the serious vulnerability before the network’s main net launch, CertiK enabled Sui to avoid a potential total network shutdown, which would have been a catastrophic outcome. It clearly illustrates how CertiK’s expertise, proactive approach, and responsible disclosure practices enable its clients to overcome security challenges and achieve their desired outcomes of running secure, reliable blockchain networks.
CertiK offers a suite of end-to-end security solutions, which includes pre-deployment code auditing to post-deployment applications and sentiment monitoring
CertiK’s platform is not just for projects or organizations; it’s also designed to be useful for the wider crypto community. Skynet for Community is a free service that enables users to do better due diligence with access to a curated Security Leaderboard, on- chain analysis dashboards, and more. This focus on community underscores CertiK’s commitment to the founding ideals of crypto, namely, auditability and transparency.
CertiK Partners with OKX to Establish a Comprehensive Security Framework
Tuesday, April 23, 2024
NEW YORK, -- CertiK, the leader in Web3 security audits, announced a strategic partnership with OKX, one of the world’s largest digital asset trading platforms, to co-develop a comprehensive security framework. This collaboration will encompass multiple areas including the exchange platform, mobile applications, wallet security, and smart contract audits. The initiative is designed to boost user trust and growth by developing holistic security solutions, enhancing blockchain security standards, and fostering the safe and sustainable development of the Web3 ecosystem.
With the establishment of this security framework, the two organizations will engage in extensive cooperation in areas such as auditing newly launched token contracts and platform and application security. This will further develop industry standards and practices, contribute to the secure evolution of the Web3 ecosystem, and provide users with safer, more reliable services.
CertiK and OKX have a longstanding security relationship that is solidified by this partnership. In 2023, CertiK completed security audits of OKX's implementation of the BRC-20 token standard and of key components within OKX’s Web3 wallet. OKX has also integrated CertiK’s Skynet Security Score into the its Web3 Earn DeFi aggregator.
CertiK discovered $5M security flaw in Wormhole bridge on Aptos
Monday, June 03, 2024
A security flaw in the Wormhole bridge on the Aptos network could have resulted in $5 million worth of losses had it not been discovered, according to a social media post from blockchain security platform CertiK. The platform claimed to have discovered the bug and reported it to the Wormhole team before it could be exploited. The flaw has been patched, and the bridge is no longer vulnerable.
Aptos is a blockchain network that uses the MOVE programming language, which was originally developed by Facebook for the Libra project. Supporters of MOVE claim that it is a safer language to write smart contracts when compared to Ethereum’s Solidity or other alternatives.
The CertiK report was posted in the form of a video. It claimed the flaw “arose from an incorrect implementation of the ‘public(friend)’ and ‘entry’ modifiers in the MOVE programming language.” The ‘public(friend)’ modifier allows a function to be called by other functions within the same module or by external accounts specified on a “friends list,” but not by other callers. On the other hand, the “entry” modifier specifies that a function can be called by any external account.
The bridge contained a function called “publish_event,” which was used to announce events such as token transfers. It was only supposed to be callable by other functions within the same module or by certain “specified external entities.” However, in the version of the bridge that CertiK studied, the function was modified by both “public(friend)” and “entry.” This made it possible for anyone to call “publish_event,” even if they were not an approved caller.
Because of this flaw, an attacker could have created fake transactions that appeared to move tokens from one account to another, even though no actual tokens were being moved. These “events” could have caused the Ethereum version of the bridge to mint or unlock tokens without having any real deposits backing them on the Aptos side. As a result, the attacker could have drained up to $5 million worth of funds from the bridge, CertiK stated.
CertiK informed members of the Wormhole team about the flaw on Dec. 5, 2023. After investigating the report, the team developed and tested a patch to close the security loophole and informed the protocol’s Guardians of the issue. Via a multisignature vote, the Guardians approved the patch to be implemented, and the protocol’s Aptos contract was upgraded to implement the new code. Once the flaw was reported, the process of fixing it took approximately three hours, and the new version of the bridge is no longer vulnerable to this exploit.
In addition to removing the “entry” keyword from the “publish_event” function, the new patch also restricted the value of the “governor rate limits” on Aptos from $5 million to $1 million, effectively preventing withdrawals from Aptos of greater than $1 million per day. This was done to limit losses in case of a future exploit. Current usage is below $1 million per day, CertiK claimed, implying that the rate limit shouldn’t affect most users.
Wormhole also performed a “retrospective analysis” to determine whether any user funds had been affected by the issue. They concluded that no funds had been illicitly transferred and that users’ balances were safe.
Wormhole hasn’t always managed to catch security flaws before they are exploited. In 2022, it lost more than $321 million when a bug in the Solana part of the bridge allowed an attacker to mint unbacked tokens. However, the team later patched the bug and compensated users. In January, Wormhole reclaimed $1 billion in total value locked for the first time since the incident, showing that some users feel its security practices have improved.
Company
CertiK
Management
Prof. Ronghui Gu, Co-Founder
Description
CertiK's mission is to raise the standard of security and transparency across the Web3 world. To that end, the company continuously invests in research and development to create cutting-edge security solutions for blockchain ecosystems.
