Name

Request the latest threat intelligence and newest custom research based on relevant Web3 contextual factors. This unique service is the only way to unlock direct access to CertiK Intelligence Analysts

Account Settings

Profile

Sign Out

Watchlists

Have your code reviewed by CertiK’s team of seasoned security experts, who have audited 1000’s of projects

Effective findings culminated through performing thousands of audits and a cross-check against a large internal database of security vulnerabilities.

Receive rich reporting, covering findings and recommendations on on how to remediate vulnerabilities.

Our unparalleled expertise in Web3 security and risk management ensures that clients make informed decisions about their investments.

Whether a project has been audited by CertiK

Smart Contract Audit Process

Audited by CertiK

Active Bounty

CertiK Contract Verified

CertiK Formal Verification

CertiK KYC

CertiK Penetration Testing

CertiK Skynet

Top 10% Code Security Score

Top 10% Community Trust Score

Top 10% Fundamental Health Score

Top 10% Governance Strength Score

Top 10% Market Stability Score

Top 10% Operational Resilience Score

Top 10% Security Score

Top 10% Trust Score

Top 10% Watchlisted

CertiK is Web3's leading smart contract auditor and provides a comprehensive suite of tools to secure the industry at scale.

Provable Trust For All.

Securing The

World

Identify and eliminate security vulnerabilities in blockchains, smart contracts, and Web3 apps using the most rigorous and thorough cybersecurity techniques.

You can now discover projects within the same categories or ecosystems, by clicking the ecosystem icon or category tag within their security leaderboard columns.

Crowdsourcing from a list of the world's top ethical hackers to provide you continuous assessment, for uncovering vulnerabilities before anyone else does.

About

We're Hiring

Disclaimer

Worker Validation

Partnership

Resources

Testimonials

Ventures

CertiK audits all of Web3, from decentralized applications to the blockchains they’re built on. We work closely with clients to deliver tailor-made security solutions.

Our industry-leading audit methodology and tooling includes a review of your code’s logic, with a mathematical approach to ensure your program works as intended.

Our industry-leading L1 chain auditing process combines expert manual review of smart contract code with advanced AI and mathematical techniques to ensure blockchain protocols work as intended.

CertiK’s speed in execution of audits at scale leaves the competition behind. But don't just take our word for it, listen to what our customers are saying:

Every smart contract audit involves comprehensive manual review by our team of experienced security experts. Automated AI-powered review provides an additional layer of security. Formal verification is an optional further step that certifies smart contract behavior with respect to custom function specifications. This helps developers get a handle on the entire scope of their platform.

How Does a Smart Contract Audit Work?

Every audit involves comprehensive manual review by our team of experienced security experts. Formal verification certifies L1 chain code behavior with respect to custom function specifications, helping developers get a handle on the entire scope of their platform. The process of auditing an L1 is the same as for auditing a smart contract. The five-step process is as follows:

Report an incident if you are under cyber attack and need help!

24/7 Incident Response

An L1 chain audit provides a comprehensive security assessment of a Layer 1 blockchain to identify vulnerabilities and recommend ways to fix them.

CertiK has audited nearly a dozen L1s, along with projects written in all major programming languages, thousands of Web3 projects, and tens of thousands lines of code. As a pioneer in the blockchain security industry, CertiK brings expertise that can only be gained from years of experience with thousands of projects to each and every L1 chain audit.

Web3 Security Leaderboard

What's New

Visit the project’s profile page directly for more details about their status. Some projects may temporarily display as ‘Pending’ but will be available soon.

CertiK has audited thousands of Web3 projects and tens of thousands lines of code written in all major smart contract programming languages.

We bring expertise that can only be gained from years of experience with thousands of projects to each and every audit.

When it comes to security, only the best will do.

productsItemDescription.security-scores-ranking

Advisory Services

Bug Bounty

Formal Verification

Incident Response

L1 Chain Audit

Penetration Testing

Security Score

Security Scores & Ranking

Sky Harbor

SkyHarbor

SkyInsights

Skynet

SkyTrace

Smart Contract Audit

Web 3 Security Audit

Protect Your Project Today

Apply to CertiK Ventures

Security Score evaluates a project’s real-time security posture using on-chain and off-chain data.

Sign up and gain access to curated features like watchlist and so on in two simple steps.

SkyHarbor can quickly identify vulnerabilities or suspicious activities in your system, ensuring that your assets are safe and secure.

Actively monitor on-chain smart contracts in real time and present actionable security and Web3 app data insights for the community.

A comprehensive security assessment of your smart contract and blockchain code to identify vulnerabilities and recommend ways to fix them.

What’s in a Smart Contract Audit Report?

smartContractAuditSubtitle

An index measuring a crypto project's relative security, market performance, and social sentiment

Providing the largest coverage on languages and ecosystem, as well as faster onboarding options, depending on project code size.

Explore growth opportunities with CertiK Ventures.

We offer strategic investments and comprehensive security solutions, leveraging our expertise to support and develop the future of Web3.

CertiK Ventures

Clients receive rich reports on their smart contract code, complete with comprehensive vulnerability analyses and recommended remediations.

CertiK KYC provides private identity verification for project teams through a rigorous vetting process while maintaining the highest standards of data protection.

Most crypto and blockchain enthusiasts know that it is essential to do your own research (DYOR) before investing in a crypto project. Nevertheless, it is challenging to do so systematically. First, because there are thousands of projects and it would take a lifetime to research every single one of them, and second, because no matter how well-prepared you are, fine-tuned marketing tactics can lure even the most seasoned-investors into neglecting the tedious research.

In order to protect yourself from falling for the wrong crypto project, we have developed this simple safety check-list, which should help quickly screen out of your watch-list any projects exhibiting one of these 5 red flags:

__#1. Marketing Traps__ - If a project uses any of the following lures to catch your attention and your money, you should immediately cross them off your list: 100,000% APY, super auto-compounding rebasing mechanisms, multi-level marketing rewards, reflection taxes, transaction taxes, advertising banners, influencers, fake news articles or false success stories. Crypto scammers are masters in FOMO (Fear of Missing Out) tactics or messages, such as “Do not miss”, “unique opportunity”, “starts in 3 days”, etc.  All of these tricks are indicative of ponzis, pyramids, rugs, slow rugs, pump and dumps and/or fake hacks - real startup projects will never use any of these marketing terms.

__#2. Unverified Dev Team__ - If a project team asks you to invest your hard-earned money in them, but they find various excuses to not be fully transparent, accountable and liable, you have absolutely no reason to trust them, no matter how attractive the project. Note that when it comes to crypto, a basic KYC is unfortunately not sufficient, because it is merely a simple ID check that can be easily defrauded using actors and/or falsified documents. Honest teams will not shy away from appropriate due diligence processes, which include a full background check and verification of the history of every key team member, and this is why it is an integral part of the CertiK KYC Badge. You can verify if a team has obtained our KYC Badge on our [Security Leaderboard](https://www.certik.com/).

__#3. Absence of product__ - If you can not easily understand what the product is, this likely means it is inexistent or fake, and you should run in the opposite direction. A common tactic scammers use is to either convince you that the product is too sophisticated and complex for you to understand, or that it is still at the idea stage, or that there is no product or utility yet but the team will build many utilities later on based on the desires of the community. These are all mere excuses to collect your cash, but the real likelihood is that there is no product, and there never will be. Keep in mind that if investing in a new product has a high risk of failure, the risk of investing in a non-existent product will be exponentially higher.

__#4. Coding Issues__ - To reduce the risk of blockchain projects technical failures and cyber-attacks, legit developers routinely audit their smart contracts. You should always check the result of these audits on our [Security Leaderboard](https://www.certik.com/), and be wary of any major issues, or if the project is not listed. If a project does not have enough budget to audit or re-audit their code, it not only puts the project at a higher cyber risk, but it also means that the project is not solid enough or convincing enough to raise seed funds and invest in the fundamentals. And if a team is not seasoned enough to convince professional investors, why should you trust them to use your personal money to carry out the next steps of their project? 

__#5. Geographical Havens__ - If the key developers are located in another country, or in a country that has a less-developed regulatory, law enforcement, and/or judicial system, they can easily leverage this geographic distance to render difficult or near-impossible any future litigation/prosecution. Developers who have fraudulent intentions are well-aware of this and they will use it to their advantage to steal your funds without the legal risk. The CertiK KYC process includes a full verification and risk analysis of the geographical locations of each key team member, so you can mitigate this risk by ignoring projects teams without a KYC Badge on our [Security Leaderboard](https://www.certik.com/).

Detecting just one of these red flags should be a warning for you to immediately dismiss a potential investment. Don't forget - if you have the slightest doubt, consider it a red flag. It is unfortunately today too easy to be lured into a trap, to trust an unverified team because of the high returns they promise, to invest in a fake product, to deposit funds in a flawed smart contract, or to confide your hard-earned money to someone who is out of your judicial reach. CertiK’s security audits and KYC due diligence are carried out by experienced security engineers and law enforcement professionals, and the results of our verifications are publicly available on the [CertiK Security Leaderboard](https://www.certik.com/), so that you can easily compare security scores and badges, and confidently build your own personal CertiK crypto watch-list.


In order to protect yourself from falling for the wrong crypto project, we have developed this simple safety check-list, which should help quickly screen out of your watch-list any projects exhibiting one of these 5 red flags


5 Definitive Red Flags in Crypto-Investment

Not all threats come from external sources. Some of the most devastating can come from inside a project team, from a trusted member of the group. A vital element in reducing the risk of insider threats in crypto projects is to thoroughly vet new team members. 

How to Protect Crypto Projects from Insider Threats

### How a Due Diligence Investigation Stumbled Upon an Undercover Government Operation

CertiK is a Web3 cybersecurity company that provides a wide array of security, research and due diligence services. As part of our advisory service, CertiK conducts in-depth Web3 security investigations and technical assessments on behalf of institutional investors, Fortune 500 companies, and crypto exchanges. While conducting an assessment for a specific Web3 project, CertiK investigators detected that some of the core developers were actively concealing their existence from us. Once discovered, the stealth development team eventually agreed to give us more information about their motive for hiding. In doing so, they told us a story with ramifications for everyone in crypto.

According to the project’s lead developer, soon after he launched his Web3 project in his home country of Iran, he was summoned to the local Islamic Revolutionary Guard Corps offices. Once on site, intelligence agents began by asking him to “cooperate” with them. The developer was reluctant to compromise the integrity of his project by giving up any degree of control without informing the community of such a measure. Unsurprisingly, the Revolutionary Guards were not impressed. They quickly progressed from firm requests to aggressive manipulation techniques. They held the developer for multiple weeks in solitary confinement in a room that measured just 2x1 meters: barely enough room to lie down. They combined this with a variety of persuasion techniques, aggressive interrogation, and threats. 

The developer explained to us that it was very difficult for him to endure this mental torture over such an extended time period. While he was undergoing this, the intelligence operatives wanted him to keep working on his Web3 venture to maintain the facade that everything was going well while they retained ultimate control over the project.

After finally convincing the operatives that he was sufficiently “broken” and would continue to cooperate, they allowed him to return home. Instead of complying, the developer leveraged the resources of his network and on-chain assets to flee the country, obtain a new nationality, and start another Web3 project with other developers who fled the country for similar reasons. The developer explained that because of this defection, he could not return to Iran, and his team was now working in stealth mode in order to avoid potential extraterritorial retaliation.

## A Credible Threat to Web3

According to our investigators, who have participated in multiple international undercover operations during their time in law enforcement, there is credibility to these reports. We also discovered  a trend of several other developers working in stealth mode behind other Web3 projects due to  similar concerns. These intelligence and investigative observations suggest there could be a systematic effort on the part of some intelligence services to infiltrate the crypto industry by targeting specific developers.

Our investigators noted the source’s claims were consistent with how unilateral undercover operations can be conducted by state actors to advance their national interests. In certain countries (including some that do not have a reputation for having a “repressive regime” like Iran) threatening to prosecute a software developer unless they become an active informant or agent is a common practice. Operatives call this the “flipping” tactic, as it consists of converting a potential adversary into a confidential informant. Our investigators added that these undercover operations are especially focused on encryption specialists, because the control of encryption-related technologies and applications is key to national security and sovereignty.

These findings suggest a fundamental risk for a number of people involved in crypto and Web3. In the short term, some software developers may face legitimate risks to their personal security. In the long run, once a state organization secretly gains control of a crypto project, they could use their leverage to access confidential data, insert intentional zero-day vulnerabilities, distribute malware, mobile backdoors, and use these integrated systems to conduct surveillance, censorship, extortion, or cause significant damage to specific targets in the future.

## Preserving Web3 Integrity

It does not come as a surprise that state agencies are specifically targeting Web3 projects and attempting to infiltrate them. As new blockchain applications continue to gain adoption, they have become strategic targets for geopolitical influence and intelligence operations. 

Web3 developers should consider the legal protections and potential risks they may face in the jurisdiction where they operate, particularly from state agencies and institutions. 

From a cybersecurity standpoint, it is crucial for the Web3 industry to raise its standard for due diligence and risk management to preserve the integrity of the industry. The hidden risks associated with  Web3 projects can have severe consequences for the security of individuals and organizations involved in or with these projects, including operational, reputational, and legal damage.

The [anonymity and pseudonymity](https://www.certik.com/resources/blog/7t4Q5urGbcmiQdUFi4GD79-what-is-pseudonymity-and-anonymity) inherent to crypto is important to protect the security of users and developers worldwide. However, these features can also be exploited by  repeat scammers to evade responsibility for their actions. A balance between privacy and transparency is crucial. [CertiK’s KYC process](https://www.certik.com/resources/blog/1zdTBrczkSD8Rjw9nm3fXV-introducing-kyc-badge-awards) keeps private information private while allowing teams to demonstrate their commitment to transparency.

We recommend that organizations seeking to engage with Web3 projects deploy due diligence efforts proportional to the cyber risks at stake. A comprehensive risk assessment can help organizations to detect potential issues and take appropriate measures to mitigate them. The [CertiK expert advisory team](https://www.certik.com/company/about) is composed of 250+ seasoned security engineers, data scientists, intelligence analysts, and criminal investigators, and has acquired a unique expertise in working with over 3,700 Web3 projects on security matters over a five-year period. Not only is this team able to conduct in-depth risk assessments of Web3 projects or ecosystems, but they are also able to recommend and deploy ad-hoc cybersecurity measures, such as tailored technical audits, on-chain monitoring, penetration testing, bug bounty programs, and cyber-incident management programs.

Editor’s note: Due to concerns for the safety of our sources, some details have been intentionally modified and the report has been redacted of any detail that could lead to the identification of the alleged victims or their location. As part of our core mission to secure the Web3 world, CertiK is regularly contacted by victims of crypto crimes, and provides investigation reports to law enforcement authorities in order to support their effort to prosecute criminal operators.

CertiK recently uncovered indications that Iranian intelligence operatives could be actively attempting to infiltrate some crypto projects early in their development phase. In this article, our team of former law enforcement investigators and intelligence analysts share their findings and give their expert takeaways on how to preserve the integrity of the Web3 industry.

Crypto Due Diligence

Navigate the Web3 World in Safety with CertiK's Crypto Due Diligence

Technical Due Diligence

Security Research

Web3 Strategy

200+

3700+

5+

Proven Risk Evaluation and Crypto Due Diligence Frameworks

Our Latest Insights

Products & Technology

KYC

Smart Contract Audit

Bug Bounty

L1 Chain Audit

Incident Response

Penetration Testing

Advisory Services

Skynet

SkyHarbor

SkyInsights

Formal Verification

Security Score

Featured Ecosystems

BNB Chain

Ethereum

Bitcoin

Solana

TON

Cosmos

Polygon

Cardano

Avalanche

Aptos

Arbitrum

WEMIX

NEAR

Algorand

Company