CertiK and Cyberscope: Who Are 8lends' Smart Contract Auditors?

What CertiK does

CertiK is a blockchain security company founded in New York in 2018 by academic researchers from Columbia and Yale. The firm audits smart contracts, Layer-1 protocols, DeFi platforms and centralised exchanges. CertiK's audit process typically involves static code analysis, manual review by security engineers, and automated scanning for common vulnerability patterns such as re-entrancy bugs, overflow errors and privilege escalation risks. A final report assigns a numeric security score-often out of 100-and categorises identified issues by severity: critical, major, medium, minor and informational.

CertiK also operates Skynet, a real-time monitoring dashboard that tracks on-chain activity for audited projects. Skynet displays metrics such as transaction volume, wallet concentration and smart contract events. The platform flags anomalies that may indicate economic attacks or governance manipulation, though it does not prevent them. The dashboard is public and searchable at skynet.certik.com. Investors can look up a project by name or contract address to see the audit history, security score and live monitoring data.

CertiK audits are widely cited in the DeFi industry and the firm has reviewed over 4,000 projects as of early 2026. High-profile clients include BNB Chain, Polygon, Aave and numerous smaller protocols. CertiK is not a regulatory body and does not issue licences or guarantees. Its audit is an independent assessment, not a warranty of safety or profitability.

What Cyberscope does

Cyberscope is a Greece-based blockchain security firm founded in 2022. The company focuses on smart contract audits for DeFi protocols, token launches and NFT projects, often serving smaller and mid-sized teams that require faster turnarounds than larger auditors typically offer. Cyberscope's methodology includes automated vulnerability scanning, manual code review and stress testing of contract logic. Reports categorise findings into severity levels-critical, high, medium, low and informational-and issue a pass, conditional pass or fail verdict based on unresolved critical issues.

Cyberscope publishes completed audit reports in a searchable library on its website at cyberscope.io. Each report includes the contract address, audit date, identified vulnerabilities and the project team's response to flagged issues. The library is open to the public, allowing anyone to verify whether a project has undergone a Cyberscope audit and to review the findings independently.

Cyberscope has audited over 1,500 projects since its founding, with a client base concentrated in European and emerging DeFi markets. The firm does not provide on-chain monitoring services in the same manner as CertiK's Skynet. Cyberscope's audit reports tend to be shorter and more focused on code-level vulnerabilities rather than economic or governance risk analysis.

How to verify an audit report independently

A badge or claim on a project's website that states "audited by CertiK" or "audited by Cyberscope" is not sufficient evidence. Marketing pages can display outdated reports, misrepresent the scope of an audit or reference a preliminary review that never concluded. To verify an audit claim for 8lends or any other protocol, follow these steps:

1. Visit the auditor's own domain

   Navigate to skynet.certik.com for CertiK audits or cyberscope.io for Cyberscope audits. Do not rely on links provided by the project-type the URL directly into your browser.

2. Search by project name or contract address

   Use the search function on the auditor's platform to locate the project. If the project operates on Base or another EVM-compatible chain, you can search by the verified smart contract address published in the project's documentation.

3. Download and review the full report

   CertiK and Cyberscope both publish PDF reports that detail the audit scope, methodology, identified vulnerabilities and the project team's responses. Check the publication date-an audit conducted in 2023 may not apply to code deployed or upgraded in 2025 or 2026.

4. Cross-check the contract addresses

   Compare the contract addresses listed in the audit report with the addresses documented by the project in its whitepaper, GitHub repository or official announcement channels. If the addresses do not match, the audit may apply to a different version of the contract or a test deployment.

5. Look for unresolved critical or high-severity issues

   Audit reports categorise findings by severity. Critical issues represent immediate exploit risks; high-severity issues can lead to fund loss under specific conditions. If the report lists critical or high-severity vulnerabilities as "acknowledged" but not "resolved", the project team chose not to fix them. Read the team's justification and decide whether the residual risk is acceptable.

If no report appears on the auditor's own site, treat the audit claim as unverified. Contact the project directly and request a link to the published report before trusting any security assurance.

What an audit does and does not cover

A smart contract audit reviews the code for known vulnerability patterns and logic errors. It does not audit the project's business model, tokenomics, team background, legal structure or compliance with financial regulations. An audit report may identify a re-entrancy flaw or an overflow bug, but it will not assess whether the advertised 18-25 per cent APR is sustainable, whether the collateral is adequately valued or whether the project complies with Swiss AML requirements.

Auditors do not test for economic attacks that exploit governance mechanisms, oracle manipulation or market conditions. A contract may pass an audit with a high score and still be vulnerable to a flash loan attack, a governance takeover or an exploit that was not discovered at the time of the review. Security researchers continue to identify new attack vectors, and an audit is a snapshot assessment, not a permanent certification.

An audit also does not prevent the project team from upgrading the smart contract after the report is published. Many DeFi protocols use proxy patterns that allow the team to deploy new logic without redeploying the entire contract. If the contract owner retains administrative keys or upgrade privileges, the audited code can be replaced at any time. Check whether the project has transferred administrative keys to a multisig wallet or renounced them entirely-this information is sometimes noted in the audit report or the project's technical documentation.

How 8lends uses audit reports

8lends states that its smart contracts have been audited by both CertiK and Cyberscope. The platform operates on the Base network, an Ethereum Layer-2 chain, and settles investments in USDC. To verify the audit claims, visit the auditors' platforms and search for 8lends or the relevant contract addresses. Cross-check the addresses in the audit reports against the addresses documented in 8lends' official channels.

As of this guide's publication date, 8lends has not published a detailed technical whitepaper or GitHub repository that maps all contract addresses to specific functions such as loan origination, collateral management or yield distribution. Verify directly with 8lends which contracts are in scope for each audit and whether any material upgrades have been deployed since the audit dates.

An audit by CertiK or Cyberscope does not address 8lends' regulatory status, the quality of its real-world-asset collateral or the enforceability of its BuyBack Guarantee. Those questions require separate due diligence. The audit reports, if verified, confirm only that the smart contract code was reviewed for technical vulnerabilities at the time of the audit.

Comparing CertiK and Cyberscope

Both firms are widely used in the DeFi ecosystem and neither is a regulatory authority. CertiK's larger client base and on-chain monitoring tools make it a reference name in blockchain security; Cyberscope's faster turnaround and focus on emerging markets appeal to smaller teams. An audit by either firm is a positive signal, but it is not a substitute for independent verification of a project's legal structure, collateral quality and financial sustainability.

Next step: understanding 8lends' broader risk profile

Smart contract security is one component of platform safety. For a full assessment of 8lends' regulatory status, collateral quality, track record and liquidity risk, read our detailed safety analysis, which assigns an overall Due Diligence Index score based on five weighted criteria.