Shane retweeted
Over 7 years auditing and formally verifying complex DeFi code, now we've built AutoProver, which leverage LLMs to automate security processes and produce mathematical proofs.
Devs will use it to secure code against LLM attacks. Premium audits continue full force🧵
Shane retweeted
Rounding errors have drained millions from DeFi protocols.
Certora is building an open source static analysis tool for Solidity to prevent them, and we're participating in the @ethereum Security QF Round from @thedaofund.
Your donation helps us go further ↓
This week the @arbitrumdao_gov Security Council froze 30,766 ETH (~$71M) connected to the @KelpDAO exploit, taking it out of reach of the Lazarus Group (a hacking collective with ties to the DPRK).
Certora's VP of Security Labs Elad Erdheim was one of the signers protecting the funds.
Before it all happened, our team flagged two critical edge cases that hadn't been identified yet:
1. If the recovery process wasn't atomic, it would open a window for anyone to drain @arbitrum user funds. Billions of dollars would have been exposed.
2. If the exploiter reduced their balance by even a small amount, the proposed tx would fail, giving them time to move funds before the council could regroup and sign a new one.
Both issues were mitigated before the transaction was finalized: the sequencer could be paused in either scenario, giving the council a 24-hour window to respond.
The tx went through. $71M was protected thanks to smart, thoughtful, and security-first responders.
Certora supports decentralization. And we support the failsafes, circuit breakers, and redundancies that will help the industry mature.
The Arbitrum Security Council has taken emergency action to freeze the 30,766 ETH being held in the address on Arbitrum One that is connected to the KelpDAO exploit. The Security Council acted with input from law enforcement as to the exploiter’s identity, and, at all times, weighed its commitment to the security and integrity of the Arbitrum community without impacting any Arbitrum users or applications.
After significant technical diligence and deliberation, the Security Council identified and executed a technical approach to move funds to safety without affecting any other chain state or Arbitrum users.
As of April 20 11:26pm ET the funds have been successfully transferred to an intermediary frozen wallet. They are no longer accessible to the address that originally held the funds, and can only be moved by further action by Arbitrum governance, which will be coordinated with relevant parties.
Shane retweeted
Your AI agent now has access to 20k+ smart contract audit findings.
claudit - one-line install, works with Claude Code & Codex CLI, searches across all @SoloditOfficial findings, open source.
Huge shoutout to @Cyfrin for opening the Solodit API 🫡
Link below 🔗👇
Shane retweeted
Safe Smart Contract Vibe Coding by @SagivMooly Chief Scientist of @Certora
“Vibe coding” in web3 often fails due to missing guardrails.
Full video below 👇🧵
Today @SagivMooly is taking the stage at @EthereumDenver to present:
“Safe Smart Contract Vibe Coding”
If you vibe code, this one’s for you 👀
📅 12:40 PM
📌 Futurllama Stage
We’re thrilled to announce @SagivMooly, Chief Scientist at @Certora, as a speaker for ETHDenver 2026!
Mooly Sagiv is a leading researcher in formal verification, applying mathematical rigor to smart contract security.
In New BUIDL City, leaders like Mooly help show there’s somETHing for everyone to build and explore.
Shane retweeted
Similar bugs already occur in web2, like the Cloudflare one: news.ycombinator.com/item?id…
This is a perfect introduction to my @EthereumDenver talk today, 'Safe Smart Contract Vibe Coding'
gm Denver! 🏔️
The Certora team has landed in the Mile High City and will be speaking today at darkMode 2026, organized by @_SEAL_Org.
🟢 14:35 — @tomer_ganor explores how @LidoFinance V3 combines security thinking with protocol design to reduce attack surfaces and prevent bugs.
🟢 16:00 — @SagivMooly joins @LewellenMichael, @AndrewMohawk, and @blocksec for a panel on Web3 security’s evolution toward mainstream adoption.
See you there!
Shane retweeted
One of the hardest and most interesting live DeFi CTF. Try it out if you haven't already!
Shane retweeted
Replying to @_AlexBiryukov_
specially in the era of vibe-coded smart contracts, formal verification is no longer optional, it's mandatory.
Fuzzing gets you to 99.999%, but the last 0.001% is where the $10M+ exploits live.
Shane retweeted
For the past 2.5 years, I've watched the @Certora team hone their Prover - and the last year in open-source mode.
It gets better every week without pause. This consistency is a key to success!
Certora Prover v8.8.0 released 🎉
The @Certora Prover is an open-source formal verification engine that proves smart contracts can only behave as intended ... & finds real bugs, otherwise.
And it keeps getting better.
Here’s what’s new 👇
bear market or not, we’re still dropping bangers like this.
@Certora 📓 by @RareSkills_io
enjoy, anon!
After nearly a year of writing and revision, we’re proud to finally present a new book from RareSkills, created in collaboration with @Certora:
Formal Verification with the Certora Prover
Certora makes formal verification accessible—but for newcomers, there’s still a large set of unfamiliar concepts to learn.
Teaching a broad and unfamiliar field comes with pedagogical challenges. Dive into projects too early, and you’re forced to use syntax you don’t yet understand. Delay compelling applications too long, and readers lose interest.
We worked carefully to balance showing “cool examples” without presenting anything that feels magical—i.e., concepts the reader hasn’t yet built a mental framework for.
Our hope is that this work helps formal verification become a more standard part of development and auditing.
Clocking in at well over 60,000 words, this is not a small book. But like any RareSkills publication, it’s information-dense yet approachable, thorough without being academic, and above all, practical and illuminating.
In a space that quickly jumps from one meta to the next, we’re proud to collaborate with a company willing to invest in long-horizon projects that make Web3 safer.
Link in the reply.
Open tools need open learning.
This book walks through formal verification step by step, from basic specs and CVL syntax to invariants, ghosts, and real ERC-20 / ERC-721 contracts.
Thanks to RareSkills for the collaboration 🫡
After nearly a year of writing and revision, we’re proud to finally present a new book from RareSkills, created in collaboration with @Certora:
Formal Verification with the Certora Prover
Certora makes formal verification accessible—but for newcomers, there’s still a large set of unfamiliar concepts to learn.
Teaching a broad and unfamiliar field comes with pedagogical challenges. Dive into projects too early, and you’re forced to use syntax you don’t yet understand. Delay compelling applications too long, and readers lose interest.
We worked carefully to balance showing “cool examples” without presenting anything that feels magical—i.e., concepts the reader hasn’t yet built a mental framework for.
Our hope is that this work helps formal verification become a more standard part of development and auditing.
Clocking in at well over 60,000 words, this is not a small book. But like any RareSkills publication, it’s information-dense yet approachable, thorough without being academic, and above all, practical and illuminating.
In a space that quickly jumps from one meta to the next, we’re proud to collaborate with a company willing to invest in long-horizon projects that make Web3 safer.
Link in the reply.
Certora is formally verifying @powdr_labs autoprecompiles, supported by a grant from @ethereumfndn.
All specs + proofs will be open-sourced for the ZK ecosystem 🫡
AI coding has taken over.
It writes code faster than humans, but not always safely.
LLMs are great at producing plausible code that’s almost right.
Which means today, humans still have to double-check every line.
But that doesn’t have to be the case. 🧵
Shane retweeted
A write-up for the recent @Certora Capture The Funds CTF:
github.com/k4zanmalay/Captur…
Shane retweeted
Formal verification of smart contracts relies on 3 key mindsets:
Developer • Auditor (Hacker) • Invariants
The last one is crucial for FV and super powerful in regular security audits too.
Below is a breakdown and examples of how to build your Invariants mindset 🧵👇
Shane retweeted
Testing finds bugs. Formal verification proves their absence.
@Certora Prover is an ideal tool for verifying EIP compatibility, leading to the discovery of real bugs:
1. Go to EIP doc
2. Extract all `MUST (NOT)` statements
3. Write a property for each
Shane retweeted
Replying to @TrustSecAudits @trust__90
Great write-up!
This is why we believe formal verification is more necessary than ever, as we cannot rely anymore on "if there are still bugs, they will be too hard to find anyway".
We need to work on end-to-end FV methods with generic properties stating that a system is safe.


























