Although CertiK claims this was a white hat operation, how the incident was reported and the vulnerability tested raises many questions about its security auditing practices.