Sky security record
As of 3 Nov 2026, Sky has 150 audit reports by 3 security firms on Trustblock; the latest is by ChainSecurity, dated 7 Sep 2026. Those reports list no open critical findings. It also holds 1 deployed contract on 1 chain.
Record last updated . It holds audits, findings and contracts up to Nov 2026, and incidents up to Oct 2026. Trustblock does not review code.
Audits150
Newest first
150 audit reports, 77 in Cantina’s series, 68 in ChainSecurity’s series
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Sky: Keel ALM Controller v1. | Security firm: Cantina | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · cantina.xyz |
| Sky: Solana Bridge Migration | Security firm: Cantina | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · cantina.xyz |
| Sky: Migration NTT Manager EVM | Security firm: Cantina | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · cantina.xyz |
| Sky: Migration NTT Manager Solana | Security firm: Cantina | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · cantina.xyz |
| Sky: LZ Solana Governance | Security firm: Cantina | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · cantina.xyz |
| Sky: LZ Governance EVM | Security firm: Cantina | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · cantina.xyz |
| Sky: LZ Governance Relay | Security firm: Cantina | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · cantina.xyz |
| Sky: LZ EVM Token Bridge | Security firm: Cantina | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · cantina.xyz |
| Sky: Solana Cross-chain Payloads for LZ Migration | Security firm: Cantina | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · cantina.xyz |
| Sky: LZ Solana Token Bridge | Security firm: Cantina | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · cantina.xyz |
| WH LZ Migration | Security firm: Cantina | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · cantina.xyz |
| Wormhole LayerZero Migration Library | Security firm: ChainSecurity | Date: | Scope: Files named in the report | No open critical findings | Open · chainsecurity.com |
| Sky: Star Guard | Security firm: Cantina | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · cantina.xyz |
| DSS Flappers | Security firm: Cantina | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · cantina.xyz |
| Dss Flappers | Security firm: ChainSecurity | Date: | Scope: Files named in the report | No open critical findings | Open · chainsecurity.com |
| Solana Crosschain Governance Payload Scripts | Security firm: ChainSecurity | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · chainsecurity.com |
| Sky Wormhole NTT Migration Update | Security firm: ChainSecurity | Date: | Scope: Files named in the report | No open critical findings | Open · chainsecurity.com |
| Sky Governance OApp | Security firm: ChainSecurity | Date: | Scope: Files named in the report | 1 critical finding, fixed | Open · chainsecurity.com |
| Lockstake: Sky Max Price Oracle | Security firm: Cantina | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · cantina.xyz |
| Lockstake Smart Contracts | Security firm: ChainSecurity | Date: | Scope: Files named in the report | No open critical findings | Open · chainsecurity.com |
| Star Guard | Security firm: ChainSecurity | Date: | Scope: Files named in the report | No open critical findings | Open · chainsecurity.com |
| stUSDS | Security firm: Cantina | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · cantina.xyz |
| Lockstake | Security firm: Cantina | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · cantina.xyz |
| Sky Rates Converter | Security firm: ChainSecurity | Date: | Scope: Repository at commit a36dec2 | No open critical findings | Open · chainsecurity.com |
| MakerDAO Sky smart contracts | Security firm: ChainSecurity | Date: | Scope: Files named in the report | No open critical findings | Open · chainsecurity.com |
Findings204
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 2 |
| High | 0 | 0 | 6 |
| Medium | 2 | 5 | 17 |
| Low | 6 | 59 | 107 |
CriticalArbitrary Call in lzReceiveSky Governance OApp · ChainSecurity · 17 Oct 2025Fixed
The report gives no description here.
Open the reportCriticalOutdated InterfacesFixed
The report gives no description here.
HighDSPC.set can bypass the cfg.step constraint by including the same id multiple times in the updates array and continuously increase the bpsFixed
The report gives no description here.
HighFees May Block Slow PathFixed
The report gives no description here.
HighIncreasing VAT Debt After Shutdown, After thaw()Fixed
The report gives no description here.
HighStakingRewards rewardsDistribution Ownership InconsistencyFixed
The report gives no description here.
HighVest Minting Not PossibleFixed
The report gives no description here.
HighVest Ownership Not Transferred at DeploymentFixed
The report gives no description here.
MediumIncorrect newMintAuthority in the payload to migrate the USDS mint authority on Solana from NTT to OFTSky: Solana Bridge Migration · Cantina · 12 Nov 2025Fixed
The report gives no description here.
Open the reportMediumComments Regarding vow.heal()Fixed
The report gives no description here.
Show 10 more
MediumCritical Tests MissingFixed
The report gives no description here.
MediumCurrent diamond-pau changes that affect GroveFixed
The report gives no description here.
Mediumfile() Has No Access ControlFixed
The report gives no description here.
Mediumfinalize_register_teleport() Only Possible When OpenFixed
The report gives no description here.
MediumGate1.heal()Fixed
The report gives no description here.
MediumGovernance Can Burn From UsersFixed
The report gives no description here.
MediumL2 AddressesFixed
The report gives no description here.
MediumMinting Pending DAI Incurs Additional FeesFixed
The report gives no description here.
MediumMissing DocumentationFixed
The report gives no description here.
MediumPossible Revert Due to UnderflowFixed
The report gives no description here.
Show 10 more
MediumRefund Recipient Is Not AliasedFixed
The report gives no description here.
MediumtotalSupply Mapping Not UpdatedFixed
The report gives no description here.
MediumUnclaimable or Leftover PoolShares During Global SettlementFixed
The report gives no description here.
MediumUniswapV3 removeLiquidity can DoS when accrued fees are large relative to removed principalFixed
The report gives no description here.
MediumUnpermissioned Access to onlyMate MethodsFixed
The report gives no description here.
LowIncomplete ILayerZeroReceiver Interface ImplementationSky xchain-helpers · ChainSecurity · 21 Aug 2026Fixed
The report gives no description here.
Open the reportLowIncorrect Amount Passed in quote_sendSky OApp OFT · ChainSecurity · 21 Aug 2026Fixed
The report gives no description here.
Open the reportLowUnable to Receive Transfers to address(0) or Token Contract AddressSky OApp OFT · ChainSecurity · 21 Aug 2026Fixed
The report gives no description here.
Open the reportLowFlipperMom Missing in ChainlogSky DSS Exec Lib · ChainSecurity · 12 Jun 2026Fixed
The report gives no description here.
Open the reportLowDouble count of balance in the offchain events in the Kamino syncSky: Keel ALM Controller v1. · Cantina · 25 Nov 2025Fixed
The report gives no description here.
Open the reportShow 10 more
LowDrift integration state.balance should update to the current lending balanceSky: Keel ALM Controller v1. · Cantina · 25 Nov 2025Fixed
The report gives no description here.
Open the reportLowDrift withdrawal is not updating state.balance resulting in double-counted sync eventsSky: Keel ALM Controller v1. · Cantina · 25 Nov 2025Fixed
The report gives no description here.
Open the reportLowMissing reserve checks results in bogus sync events on DriftSky: Keel ALM Controller v1. · Cantina · 25 Nov 2025Fixed
The report gives no description here.
Open the reportLowRent is lost in the controller_authority when Kamino Obligation is closedSky: Keel ALM Controller v1. · Cantina · 25 Nov 2025Fixed
The report gives no description here.
Open the reportLowsync_drift_balance() is reading stale cumulative_deposit_interest and emitting inaccurate interest valuesSky: Keel ALM Controller v1. · Cantina · 25 Nov 2025Fixed
The report gives no description here.
Open the reportLowMigration test run on Solana devnet upgraded the NTTManager to an incorrect older versionSky: Solana Bridge Migration · Cantina · 12 Nov 2025Fixed
The report gives no description here.
Open the reportLowMetadata Update Authority is left to the old WH governance PDASky: Migration NTT Manager Solana · Cantina · 28 Oct 2025Fixed
The report gives no description here.
Open the reportLowMissing authority change check in wh-program-upgrade and wrong spill accountSky: Solana Cross-chain Payloads for LZ Migration · Cantina · 28 Oct 2025Fixed
The report gives no description here.
Open the reportLowScripts payload output should be in hex format to allow exact validationSky: Solana Cross-chain Payloads for LZ Migration · Cantina · 28 Oct 2025Fixed
The report gives no description here.
Open the reportLowDangling ApprovalDss Flappers · ChainSecurity · 21 Oct 2025Fixed
The report gives no description here.
Open the reportShow 10 more
LowIncorrect SpecificationDss Flappers · ChainSecurity · 21 Oct 2025Fixed
The report gives no description here.
Open the reportLowInitialization Does Not Check DivisorDss Flappers · ChainSecurity · 21 Oct 2025Fixed
The report gives no description here.
Open the reportLowMissing Check for BumpDss Flappers · ChainSecurity · 21 Oct 2025Fixed
The report gives no description here.
Open the reportLowMissing Check of Reward Token on Farm ContractDss Flappers · ChainSecurity · 21 Oct 2025Fixed
The report gives no description here.
Open the reportLowSplitter.cage() Does Not Lock the SplitterDss Flappers · ChainSecurity · 21 Oct 2025Fixed
The report gives no description here.
Open the reportLowinit_governance Can Be DoSedSky Governance OApp · ChainSecurity · 17 Oct 2025Fixed
The report gives no description here.
Open the reportLowInconsistent Wards Safety CheckStar Guard · ChainSecurity · 4 Sep 2025Fixed
The report gives no description here.
Open the reportLowLockstakeInit.updateClipper is missing stUSDS.rely(clipper)Lockstake · Cantina · 18 Aug 2025Fixed
The report gives no description here.
Open the reportLowAave V3 Reward Claiming FailureFixed
The report gives no description here.
LowActors can self-call the agent to escalate rolesFixed
The report gives no description here.
Show 10 more
LowAddress of VOWFixed
The report gives no description here.
LowAuction may halt if peek is zeroFixed
There is no check that enforces the price returned by `pip.peek()` be greater than zero inside `Clipper.kick` and `Clipper.redo`. This would lead to setting the `top` value of an auction to zero, which is probably not desired. Having `top == 0` would cause a revert in the `rdiv(price, top)` inside the `Clipper.status` function, which would block access to calling `Clipper.redo` and `Clipper.take` again for `tail` amount of seconds.
LowBurn Function Redundant ChecksFixed
The report gives no description here.
LowBypassing Step-SizeFixed
The report gives no description here.
LowCCTPLib hardcoded MAX_FEE = 0 has no on-chain update pathFixed
The report gives no description here.
LowCode InefficiencyFixed
The report gives no description here.
LowContract L2GovernanceRelay Unnecessary StatefulnessFixed
The report gives no description here.
LowCurve RegistryFixed
The report gives no description here.
LowDiscrepancy in the Handling of Unachievable Target Interest RatesFixed
The report gives no description here.
LowDivision by zeroFixed
There is a primitive division operation inside the `bark` function which could lead to a “division by zero” error, because the divisor is not checked to be greater than zero, i.e. the 2nd division on L174: `dart = min(art, mul(room, WAD) / rate / milk.chop);` where `milk.chop` could be zero if set by the `Dog.file` function.
Show 10 more
LowDocumentation Not up to DateFixed
The report gives no description here.
LowDoSing Ilk InitializationsFixed
The report gives no description here.
LowDSPC could lead to undesirable configuration of ratesFixed
The report gives no description here.
LowDssProxy Constructor Does Not Emit SetOwner EventFixed
The report gives no description here.
LowDuplicate CheckFixed
The report gives no description here.
LowERC-20 Missing Return ValueFixed
The report gives no description here.
LowEvent Fields ConsistencyFixed
The report gives no description here.
Lowfile() Casting Bytes32 to Uint256Fixed
The report gives no description here.
LowFloating PragmaFixed
The report gives no description here.
LowImpossibility to Create One-Side Token1 LiquidityFixed
The report gives no description here.
Show 10 more
LowInaccurate SpecificationFixed
The report gives no description here.
LowInconsistent Retrieval of Ilk ParameterFixed
The report gives no description here.
LowInconsistent Use of InterfacesFixed
The report gives no description here.
LowIncorrect Decimal AnnotationFixed
The report gives no description here.
LowIncorrect Ilk ClassFixed
The report gives no description here.
LowIncorrect Uniswap V3 Path InterpretationFixed
The report gives no description here.
LowIncorrect Use of try/catchFixed
The report gives no description here.
LowInit Function of L2GovernanceRelayFixed
The report gives no description here.
LowInitialize default BeamState.maxChange to 100% to unblock rate-limit decreasesFixed
The report gives no description here.
Lowink Used as daiDebtFixed
The report gives no description here.
Show 10 more
LowInsufficient Conditions for active() PlanFixed
The report gives no description here.
LowInterface MismatchFixed
The report gives no description here.
LowLack of DocumentationFixed
The report gives no description here.
LowLayerZeroLib: no refund for overpaid nativeFee in ETHFixed
The report gives no description here.
LowMaturity in the PastFixed
The report gives no description here.
LowMinor issues, Typos & DocumentationFixed
The report gives no description here.
LowMissing ChecksFixed
The report gives no description here.
LowMissing ChecksFixed
The report gives no description here.
LowMissing IndexFixed
The report gives no description here.
LowMissing or Incomplete NatspecFixed
The report gives no description here.
Show 10 more
LowNewProxy Event ConsistencyFixed
The report gives no description here.
LowNo Event for finalize_teleport()Fixed
The report gives no description here.
LowNo EventsFixed
The report gives no description here.
LowNo NatspecFixed
The report gives no description here.
LowNo Vat line Check for Line WipesFixed
The report gives no description here.
LowOptimization of delegatecall Success CheckFixed
The report gives no description here.
LowOutdated Compiler VersionFixed
The report gives no description here.
LowPhase 2 Might Not Migrate GemFixed
The report gives no description here.
LowPossible Failure of create2Fixed
The report gives no description here.
LowPossible Optimization in Proxy Check of RegistryFixed
The report gives no description here.
Show 10 more
LowPossible Optimization on Getting vat AddressFixed
The report gives no description here.
LowPotential InconsistencyFixed
The report gives no description here.
LowPull DAI From Vow All at OnceFixed
The report gives no description here.
Lowrate and rate constraints can be set for non-existing ilk in jugFixed
The report gives no description here.
LowRate Is Not ValidatedFixed
The report gives no description here.
LowReadme Is Outdated About Wards of NSTFixed
The report gives no description here.
LowRemaining TODO in the Source CodeFixed
The report gives no description here.
LowSetting new NSR breaks reliability of extrapolating view functionsFixed
The report gives no description here.
LowSkim in _Free()Fixed
The report gives no description here.
LowSpecification MismatchFixed
The report gives no description here.
Show 10 more
LowStUsdsWipeParamSpell.done() can report line wipe completion before the effective Vat line is zeroFixed
The report gives no description here.
LowSubProxy rely() to MCD End Instead of MCD ESM During InitializationFixed
The report gives no description here.
LowSwapperCalleeUniV3 is incompatible with USDTFixed
The report gives no description here.
LowThe withdraw function can withdraw less than lotFixed
The report gives no description here.
Lowthis Keyword in initializeIlkFixed
The report gives no description here.
LowTokens With More Than 18 Decimals Not Caught in ConstructorFixed
The report gives no description here.
LowUninitialized Vow in DssLitePsmInitFixed
The report gives no description here.
LowUniswap V3 and Uniswap V4 asymmetriesFixed
The report gives no description here.
LowUnlimited-to-finite rate-limit transition reverts due overflow, blocking decreasesFixed
The report gives no description here.
LowUnused CodeFixed
The report gives no description here.
Show 10 more
LowUnused Constant VariableFixed
The report gives no description here.
LowUnused Constants and FunctionFixed
The report gives no description here.
LowUnused enumFixed
The report gives no description here.
LowUnused Function _sub()Fixed
The report gives no description here.
LowUnused Function _toRad()Fixed
The report gives no description here.
LowUnwind Collects Interest, Fails to Reach Target Interest RateFixed
The report gives no description here.
LowUrn Proxy Load InefficiencyFixed
The report gives no description here.
LowUse Defined ConstantFixed
The report gives no description here.
LowUse of Unsafe Math Subject to OverflowsFixed
The report gives no description here.
LowVarious Event IssuesFixed
The report gives no description here.
Show 2 more
LowVest Should Not Have a Cliff PeriodFixed
The report gives no description here.
LowWrong Chainlog IdentifiersFixed
The report gives no description here.
Contracts1
| Address | Chain | Source code |
|---|---|---|
| 0xdc035d45d973e3ec169d2276ddab16f1e407384f | Chain: Ethereum | Source code: Verified source |
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="sky"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us