The decentralized finance (DeFi) landscape is undergoing a significant shift in security standards as major protocols tighten their oversight of third-party code. Sky, formerly known as Maker, has introduced a rigorous new auditor ranking system that sets a high bar for which security firms it will trust when managing protocol assets themerkle.com. This move comes alongside broader industry efforts to patch critical vulnerabilities, such as those recently identified in PHP, and a push for more efficient network operations across the Ethereum and NEAR ecosystems thedefiant.io thedefiant.io. As the sky new governance framework evolves, the focus is moving beyond simple audit reports toward verifiable, multi-firm security validations.
The Exclusion of Major Players: CertiK Was Left Out
The most striking aspect of the sky new governance proposal is the explicit ranking of recognized security firms. While the list includes 35 recognized entities, CertiK was notably absent from both the top and mid-tier categories themerkle.com. This omission is significant given that CertiK is one of the most prolific auditors in the industry by volume. Under the proposed rules, any audit performed by a firm not on the approved list will not count toward Sky's mandatory security requirements for external contracts themerkle.com.
Tiered Rankings and the Two-Firm Rule
Sky’s new auditor framework divides recognized firms into two distinct tiers. The top tier is currently limited to only two names: ChainSecurity and Cantina themerkle.com. The mid-tier includes 33 other firms, such as OpenZeppelin, Trail of Bits, and ConsenSys Diligence themerkle.com. To secure assets Sky holds or moves, a contract must now be covered by at least two recognized audits from different firms themerkle.com. This "two-firm rule" specifically prevents protocols from using two different brands owned by the same parent company to meet the requirement themerkle.com.
Why CertiK and Others Face Stricter Standards
The question of why CertiK and other high-volume firms were excluded may relate to the specific technical conditions Sky now demands. The protocol is rejecting common industry shortcuts, such as audit PDFs hosted only on a project's own website or reports that lack exact commit hashes themerkle.com. For an audit to be valid under the new Atlas edit, it must be independently verifiable through the auditor's own repository and must record the resolution status of every finding themerkle.com.
This push for transparency coincides with urgent warnings from security firm SlowMist, which has urged crypto platforms to prepare for critical PHP fixes scheduled for release on October 21 thedefiant.io. These developments suggest a broader trend where "good enough" security is no longer acceptable for protocols managing billions in TVL. Sky's transition period gives existing positions until January 1, 2027, to comply with these new auditor standards, or they risk forced closure themerkle.com.
Network Efficiency and Protocol Expansion
While security remains the primary focus, network performance and protocol growth are also seeing major updates. Ethereum staking has reached a record 43.8 million ETH, even as annualized yields have dipped to 2.63% thedefiant.io. To combat latency, the Optimum mump2p protocol has launched on mainnet, claiming to deliver blocks 2.42 times faster than the default network en.cryptonomist.ch. This software is already mandatory for all 12 node operators in the ether.fi validator set en.cryptonomist.ch.
In the lending sector, Aave is aggressively expanding its V4 deployment. Aave V4 currently captures over 53% of DeFi deposits for Coinbase tokenized stocks on the Base network, totaling approximately $10.1 million en.cryptonomist.ch. Furthermore, Aave is moving toward a deployment on Tempo, a payments-focused Layer 1 incubated by Stripe and Paradigm themerkle.com. However, analysts note that the formal proposal for Tempo currently lacks some of the yield incentives and stablecoin growth promises initially discussed in earlier governance stages themerkle.com.
What to watch next: The Sky governance vote concludes on October 22, which will formalize the new auditor rankings and trigger a ten-week window for existing protocols to meet the new compliance bar themerkle.com. Additionally, the market will monitor the adoption of the NEAR token issuance cut to 1.6% and the impact of the PHP security patches on exchange infrastructure thedefiant.io thedefiant.io.
