Sky's zero-finding audit framework: Six-month onboarding and process investigation | Deniz Yilmaz

When Sky's audits return serious issues, they don't just fix bugs and ship—they pull the brake and investigate what failed in their internal review process. Deniz Yilmaz, CTO of Sky Frontier Foundation, walks through the defensive layers behind USDS (third-largest stablecoin globally): six-month engineer onboarding requirements, spellcrafting governance with mandatory execution delays, and a protocol security team dedicated to codifying the implicit knowledge that keeps audit reports clean.

Topics discussed:

• Treating audit findings as internal process failures requiring investigation, not just bug fixes

• Six-month mandatory onboarding periods before engineers can modify spellcrafting code

• Pre-audit internal review standards achieving consistent zero-finding results across multiple audit firms

• Spellcrafting governance requiring bi-weekly token holder votes and execution delays for all protocol changes

• LLM auditing integration delivering PR-level feedback before code reaches internal review

• Mandatory OPSEC certification with domain hash verification testing for multisig signers

• Protocol security workstreams codifying senior engineer practices into transferable frameworks

• Auditor selection prioritizing codebase-specific experience over firm reputation

• Subdao security enforcement maintaining core standards across autonomous entities with independent economics

• Game theory-based development considering internal actor exploitation during code design