CertiK vs Peckshield: Verification Depth and Threat Tracking
CertiK and Peckshield both launched in 2018 to evaluate smart contract code and monitor on-chain security. While both teams perform manual code reviews and penetration testing, their toolkits differ. CertiK applies mathematical formal verification alongside manual reviews. The firm holds SOC 2 Type II compliance and ISO 27001 certification. Its offerings include the CertiK Hunt bug bounty platform and automated continuous ratings through Skynet, which tracks over 21,000 projects across 100 ecosystems.
Peckshield focuses on decentralized finance code analysis, fund flow tracing, and fast incident detection through its PeckShieldAlert research division. Established after discovering the Ethereum BatchOverflow flaw, Peckshield investigates live exploits, decompiles unverified contract logic, and audits systems across networks like Ethereum, BNB Chain, Arbitrum, and Base. Unlike CertiK, Peckshield does not run a public native bug bounty platform or emphasize formal verification proofs.
Quick verdict
The choice between these two security firms rests on whether a protocol requires formal mathematical proofs and formal institutional compliance, or rapid DeFi auditing paired with live on-chain incident tracing.
Choose CertiK if you require mathematical formal verification for protocol consensus or complex contracts, need formal compliance standards like SOC 2 Type II and ISO 27001, or want to launch a coordinated bug bounty program alongside continuous Skynet project ratings.
Choose Peckshield if your project operates primarily in the EVM decentralized finance sector, demands manual code scrutiny informed by continuous exploit monitoring, or needs forensic fund tracing and incident response during live security events.
| Feature | ||
|---|---|---|
| Ratings | ||
| Our score | 3.8/5 | 3.8/5 |
| User rating | No reviews yet | No reviews yet |
| Expertise | 4.5 | 4.5 |
| Track record | 4.5 | 4.5 |
| Transparency | 3.5 | 3.5 |
| Turnaround | 3.0 | 3.0 |
| Pricing | 2.5 | 3.0 |
| Specs | ||
| Services | Smart contract audits, Formal verification, Penetration testing, Bug bounty platform, Monitoring | Smart contract audits, Penetration testing, Monitoring, Incident response |
| Languages & ecosystems | EVM, Ethereum, Sui, XRP Ledger, TON, Sei | EVM, Solidity, Ethereum, BNB Chain, Arbitrum |
| Publishes audit reports | Yes | Yes |
| Notable clients | OKX, Fireblocks, Ledger, Sui, TON, Bitget Wallet | PancakeSwap, Sushi, dYdX, ParaSwap |
| Formal verification | Yes | Not disclosed |
| Bug bounty platform | Yes | No |
| Live monitoring | Yes | Yes |
| Company | ||
| Founded | 2018 | 2018 |
| Headquarters | United States | China |
| Investors | Not disclosed | Not disclosed |
| Strengths and weaknesses | ||
| Pros |
|
|
| Cons |
|
|
| Best for | Protocol security assessments, Smart contract formal verification, Web3 penetration testing | DeFi protocols requiring smart contract audits, Web3 developers needing infrastructure penetration testing, Teams seeking live on-chain exploit tracking |
Highlighted cells show the stronger value in each row. Data comes from each provider's site and public sources; check details before you sign up.
FAQ
Do CertiK and Peckshield provide formal verification?
CertiK provides mathematical formal verification to test code against explicit specifications, whereas Peckshield focuses its assessments on manual code inspection and automated vulnerability scanning.
Which firm operates a bug bounty platform?
CertiK hosts a native bug bounty platform called CertiK Hunt. Peckshield conducts audits and incident response but does not run a public native bug bounty service.
Where are CertiK and Peckshield headquartered?
CertiK is based in New York, United States. Peckshield was founded and is headquartered in China.
Which blockchains do CertiK and Peckshield audit?
CertiK evaluates code across Ethereum, Sui, XRP Ledger, TON, and Sei. Peckshield audits smart contracts across EVM networks including Ethereum, BNB Chain, Arbitrum, Base, and Blast.