The decentralized finance (DeFi) landscape is undergoing a fundamental shift toward institutional-grade security standards, as evidenced by Sky’s (formerly MakerDAO) aggressive new governance proposal. By introducing a rigorous ranking system for smart contract auditors and setting a hard deadline of October 22, 2026, for its latest Atlas Edit, Sky is effectively drawing a line in the sand regarding which security firms it deems trustworthy themerkle.com. This move, which notably excludes industry giant CertiK from its recognized list, signals a departure from the "move fast and break things" ethos of early DeFi in favor of a highly structured, verifiable, and multi-layered security framework themerkle.com. As Sky prepares to enforce these standards, the broader market is watching how this precedent will affect protocol integrations and the valuation of security audits across the ecosystem.
The Sky Atlas Edit: A New Benchmark for DeFi Security
On October 19, 2026, Sky’s governance portal saw the introduction of the Atlas Edit Weekly Cycle Proposal, a comprehensive package of eight edits designed to tighten protocol controls themerkle.com. The proposal, which requires a minimum of 480 million SKY tokens in support to pass, represents one of the most significant overhauls of Sky's security policy to date themerkle.com. Central to this proposal is a new framework for evaluating "outside audits"—those not directly commissioned by Sky but performed on third-party protocols where Sky’s Prime Agents, such as Spark or Grove, deploy capital themerkle.com.
The technical depth of this edit is substantial, adding approximately 390 lines of code across eight Atlas documents themerkle.com. Of these, 100 lines are dedicated specifically to a new Governance Scope section that outlines six mandatory conditions for an audit to be recognized themerkle.com. These conditions include independent verification of the audit source, a clear scope statement, and the recording of exact commit hashes to ensure the audit corresponds precisely to the deployed code themerkle.com. By mandating that every finding of medium severity or higher be confirmed as resolved by the auditor—rather than just the project team—Sky is attempting to eliminate the common industry practice of "self-certified" fixes themerkle.com.
The Auditor Hierarchy: Tiered Trust and the CertiK Exclusion
Perhaps the most controversial aspect of the proposal is the explicit ranking of audit firms into two tiers. The "Top Tier" is remarkably exclusive, featuring only two firms: ChainSecurity and Cantina themerkle.com. The "Mid Tier" is more expansive, encompassing 33 entities including well-known names like OpenZeppelin, Trail of Bits, ConsenSys Diligence, and even audit contest platforms like Code4rena and Sherlock themerkle.com.
The total absence of CertiK from either tier has sent shockwaves through the security community. Despite CertiK being one of the most prolific auditors in the space by volume, Sky’s new rules mean that any protocol relying solely on a CertiK audit will fail to meet Sky’s "two-audit rule" for materially relevant contracts themerkle.com. This rule requires that any contract holding or moving Sky-managed assets must be covered by at least two recognized audits from different firms themerkle.com. Furthermore, Sky has closed potential loopholes by stating that audits from different brands under the same parent company will only count as a single firm themerkle.com.
Implementation Deadlines and the January 1 Ultimatum
The transition to these new standards follows a two-phase timeline. Any new contract that Sky begins to rely on after the October 22, 2026, deadline must meet these rigorous standards immediately themerkle.com. For existing positions, Sky has provided a grace period until January 1, 2027 themerkle.com. After this date, any non-compliant contract can only remain in use with the explicit approval of the Protocol Security Workstream Lead themerkle.com. This ten-week window will likely force a massive re-evaluation of external protocols currently integrated with Sky’s ecosystem, potentially leading to a wave of new audit commissions as projects scramble to maintain their "Sky-eligible" status themerkle.com.
Broader Market Context: Security and Governance Trends
Sky’s move toward stricter security is mirrored by other major players in the DeFi space. For instance, Aave is currently navigating its own complex governance process regarding a deployment on the Tempo blockchain, a Layer 1 incubated by Stripe and Paradigm themerkle.com. The Aave V4 proposal for Tempo, which appeared on October 16, 2026, has faced scrutiny for omitting previously promised incentives, such as a yield close to the US benchmark interest rate (SOFR) themerkle.com. This highlights a growing trend where DeFi communities are demanding higher transparency and more detailed risk assessments before approving major protocol expansions themerkle.com.
Simultaneously, the industry is dealing with immediate technical threats. SlowMist recently urged crypto platforms to prepare for critical PHP fixes, with patches scheduled for release on October 21, 2026 thefifiant.io. This underscores the constant pressure on security teams to manage both protocol-level logic and the underlying infrastructure that supports web-based crypto interfaces thefifiant.io.
Economic Adjustments: Supply and Issuance Shifts
While security dominates the headlines, several protocols are also adjusting their economic models to ensure long-term sustainability. PancakeSwap has opened a vote on "The Flip," a plan that includes a roughly 69% reduction in effective daily emissions for CAKE tokens while retaining buybacks from protocol fees thefifiant.io. Similarly, the NEAR protocol is voting on HSP-029, which would lower token issuance to 1.6% over a 24-month period thefifiant.io. These moves toward "sound money" principles often coincide with increased security rigor, as protocols seek to attract more conservative institutional capital.
In the staking sector, Ethereum has reached a record 43.8 million ETH staked, even as gross annualized yields have dipped from 2.81% to 2.63% thefifiant.io. This record participation suggests that despite lower returns, the perceived security and maturity of the Ethereum network continue to draw significant volume, with Pendle recently hitting $159 million in daily volume led by Ethereum-based trading thefifiant.io.
Operational Tightening Beyond Audits
The Sky proposal also includes several operational tightening measures that extend beyond smart contract audits. These include formalizing the description of the Core Council Multisig on Arbitrum and requiring that every Prime Spell action be authorized in the Atlas before approval themerkle.com. Additionally, Sky is imposing stricter limits on rate-limit capacity restoration from burning USDS or swapping USDC, capping it at the maximum amount for each limit themerkle.com. These granular adjustments suggest a protocol-wide effort to minimize edge-case risks and ensure that every administrative action is traceable and pre-approved themerkle.com.
What We Don't Know
It remains unclear exactly why CertiK was excluded from the recognized list, as the proposal does not provide specific justifications for the omission of individual firms themerkle.com. Furthermore, the impact of the January 1, 2027, deadline on Sky's current liquidity positions is unknown; if major integrated protocols fail to secure a second recognized audit in time, Sky may be forced to withdraw significant capital, potentially causing market volatility themerkle.com. Finally, it is yet to be seen if other major DeFi protocols will adopt Sky's auditor rankings as an industry standard or develop their own competing hierarchies.
In summary, Sky’s October 22 deadline and its new auditor ranking system represent a watershed moment for DeFi governance. By codifying strict requirements for audit verifiability and mandating multi-firm redundancy, Sky is setting a high bar that may redefine the relationship between DeFi protocols and security providers. While the exclusion of CertiK is the most visible change, the underlying rules regarding commit hashes and resolution confirmation are likely to have a more profound long-term impact on how smart contract security is practiced and reported across the industry.
