Your End-To-End Security Partner. Manual Audits, Formal Verification, and Protocol Design Review. Trusted by Aave, Uniswap, Lido, EigenLayer, Solana and more.
Joined February 2019
- Tweets3.1K
- Following341
- Followers12.1K
- Likes3.5K
Going from seconds to milliseconds in finality is an impressive engineering achievement.
Congrats to the @anza_xyz and @solana teams on this major upgrade!
Alpenglow is now live on Solana mainnet. ⛰️
Finality just went from ~12.8 seconds to ~150ms.
The biggest consensus upgrade in Solana’s history, built by @anza_xyz.
Certora retweeted
excited to see more and more traditional finance companies moving to blockchain. @CantonNetwork is one of the networks getting a lot of interest
sharing some insights from our experience securing DAML smart contracts on Canton
Daml takes a different approach to smart contracts. What does that mean for security?
We share insights from our @CantonNetwork audits: authorization checks, contract references, and how locks and accounting can break across workflows.
🔗 Learn more:
certora.com/blog/auditing-sm…
Daml takes a different approach to smart contracts. What does that mean for security?
We share insights from our @CantonNetwork audits: authorization checks, contract references, and how locks and accounting can break across workflows.
🔗 Learn more:
certora.com/blog/auditing-sm…
Can formally verified code still have bugs?
The answer is yes. A proof can pass, and the system can still be vulnerable.
Our latest article explores four ways formally verified code can still go wrong, with real-world examples and how to catch them before deployment.
certora.com/blog/formally-ve…
Certora retweeted
Kudos to the @Certora team for the great research and responsible disclosure! The write-up is such an interesting read. It’s an honor to collaborate with such talented security researchers. Thanks @tpiliposian for sharing the behind-the-scenes story!
our team found this nice bug during one of our zero knowledge audits. a very interesting read, and quite a story.
we reported it to Consensys, they confirmed the issue, and we started identifying downstream projects. happy to see everything handled so well.
special kudos to the @Consensys team for their quick responses and responsiveness, and huge thanks to @_SEAL_Org for the super quick response, and to @pcaversaccio for the great advice on how to proceed given the situation
certora.com/blog/take-no-hin…
Nothing asserted that R was on the curve. In ECDSA verification, that let a malicious prover steer the x-coordinate the signature is checked against, and pass verification under any public key. In-circuit EIP-7951 P-256 verification was affected.
Fixed in gnark v0.16.4 (GHSA-7fx8-hmgc-82jp). Thanks to the gnark team at @Consensys and @_SEAL_Org for fast disclosure coordination.
Full write-up by Lior Oppenheim and Giuseppe Cocomazzi:
certora.com/blog/take-no-hin…
On September 24, forged zero-knowledge proofs took ~$1.92M in USDC from Payy's bridge.
The fix for the Barretenberg verifier bug Payy blames had been in a public release for 73 days.
Find out why Payy was still exposed ⬇️
certora.com/blog/payy-exploi…
Bringing Bitcoin into onchain financial markets requires strong security foundations, especially at this scale.
Proud to have formally verified Hashi’s smart contracts ahead of its mainnet launch. 🫡
Just in from the main stage at Sui Basecamp:
👉 Hashi mainnet starts rolling out this month, with $500M+ in capital already committed.
👉 @Anchorage joins as a launch partner, bringing qualified custody and stablecoin liquidity.
Learn more ⤵️
sui.io/blog/hashi-mainnet-to…
Building on @StellarOrg comes with a different set of security assumptions.
Authorization, storage, cross-contract calls, native assets, cross-chain messaging. Soroban handles each differently from the EVM, and those differences matter when designing secure applications.
Based on our work across the Stellar ecosystem, we break down what builders should know about securing smart contracts on Soroban.
Read the full article by @tpiliposian:
certora.com/blog/auditing-sm…
Congrats to @Polymarket on the launch of V2, a significant rebuild of the system behind one of the largest prediction markets.
Proud to have formally verified the new protocol alongside a strong group of security teams that audited the codebase 🫡
Introducing Polymarket Protocol V2, a new smart-contract foundation built for prediction markets.
To give developers and market makers time to integrate, we’re running canary markets October 5–30, with new markets tentatively switching on November 2.
With this release, we’re also introducing Data API v2, a new Rust service powered by our in-house on-chain indexer
Start with the migration docs here: poly.market/v2-migration
Read more about both in the blog below:
Bitget lost ~$387.5M in one of the largest crypto hacks of 2026.
Attackers exploited a zero-day in a third-party security product, gained access to Bitget’s wallet infrastructure, and fed it forged withdrawal requests that bypassed normal risk controls.
We break down what happened and what formal verification can establish about withdrawal signing.
➡️ certora.com/blog/bitget-hack…
An audit, a fuzzing run, and a formal proof do different things.
Our new guide compares what each one catches, what a clean result actually tells you, and where its guarantees stop.
Second in our formal verification series for the people who approve the budget and carry the risk.
certora.com/blog/formal-veri…
Proud to continue supporting the @arbitrum ecosystem as one of the firms powering the Security Program for @ArbitrumDevs 🫡
The Arbitrum Security Program is now live.
The program is expanding to support projects across the full security lifecycle, including:
- Preliminary AI-assisted screening
- Traditional audits conducted by auditors
- Bug bounty program
- The ArbitrumDAO Security Council
Apply and learn more. 👇
tally.so/r/3xzEzv
Human review contributes something neither approach can: context and judgment.
A reviewer can ask whether the design serves its intended purpose, or whether a mechanism that works correctly is nevertheless a bad idea.
That’s why these practices are complementary.
We explain the differences in more detail in our latest guide to formal verification ↓
certora.com/blog/what-is-for…
