Michael M.

Security architect @Certora

[Michael M. @MichaelMorami]

@m4rio_eth Where can i read your thoughts on the matter?
I had the privilege to work with some great projects and companies on IRR. I'd love to hear your view.

[Michael M. @MichaelMorami]

@yieldsandmore @ResolvLabs That's your take? Hand out power to more people?
Can at least first talk about proper preparation for emergencies -
Pagers, defining SLA, geo-distribution for (as close to) 24/7 coverage, preparing FMEA table, monitoring, educating safe signing, practice dummy signing, etc.

[Michael M. @MichaelMorami]

@Jeyffre Interesting take. I don't believe pay-to-work becomes the norm. Maybe some will do it, but not "The norm".
I foresee people being forced to take the initiative and build their own small businesses. I can't see how pay-to-work is a sustainable model.

[Michael M. @MichaelMorami]

I witnessed the magic firsthand.
EVERYONE should attend this talk

[Tomer Ganor @tomer_ganor]

Security isn’t a feature, it's a commitment. And for the @LidoFinance it's the first priority 🛡️💧

At #ETHDenver2026 I will share the security driven design of Lido V3. Beyond just catching bugs, we’ve been obsessed with outsmarting the most complex edge cases in DeFi to build real resilience.

If you want to see how to build robust secure protocols like Lido V3, come catch my talk. 🚀

See you there!

#ETHDenver #Lido #Ethereum #Web3Security

[Michael M. @MichaelMorami]

@ManInBlackie @pashov So worth a read from cover to cover for those who read the 1st edition (and enjoyed 😄)?

[Michael M. @MichaelMorami]

@LuboslavLubeno1 It's great to get proper testing for these tools, not from their creators. I use AI, and it's great for some things, but from my **limited** experience of feeding it code and trying to extract bugs, I've found it doesn't identify anything deep

[Certora @Certora]

Umbrella marks a significant advancement in decentralized lending security within @Aave.

In this thread, we cover key properties that we've mathematically proven through formal verification, including token stability, accurate reward accrual, and the correctness of slashing logic.

[Michael M. @MichaelMorami]

@m4rio_eth @SagivMooly @certora Hey @m4rio_eth, thanks for flagging this. We'll attach the entire link list in order so it will be easy to match posts to links.

[Michael M. @MichaelMorami]

@cmichelio @J4X_Security Interesting insights!
I like to save the recommendation for the end.
I try to describe the issue as detailed as possible including attack vector, concrete example and potential harm.
In the process, I often understand the issue better and my original recommendation can change.

[Michael M. @MichaelMorami]

@phtevenstrong Aave. No doubt.
Learn the fundamentals first

[Michael M. @MichaelMorami]

@BowTiedDravee For me, it's a sign that I'm too focused on one short-term thing.
What usually helps me is diversifying my days —meetups, sports, hobbies — and finding a way to change my focus to something else, usually a longer-term goal.

[Michael M. @MichaelMorami]

This tool was born from a real need on the battlefield and it's already being used in the wild to protect @aave.
It's abstract yet practical and concrete.

If your protocol supports decentralized decision-making, with slight adjustments, Quorum can help you improve the process.

[Certora @Certora]

Introducing Quorum: A game-changer for DAO governance security.

An open-source tool that automates verification, detects risks and ensures proposals execute as intended.

Built for DAOs, inspired by @Aave’s Seatbelt.

Learn more👇

[Michael M. @MichaelMorami]

@andyyy Can't agree more. The number of "crypto rookie" asking me basic questions and help with trivial actions in the traditional world is staggering.
Until we make usage seamless for them we won't see more crypto adoption that exceeds the odd crypto etf

[Michael M. @MichaelMorami]

@alexzoid @cantinaxyz @certora @Uniswap Congrats @alexzoid 👏
Very good breakdown of the approach you take with proving & bug hunting using FV.

Question - how and when will you use FV? Will you use it as approach to hunt bugs or to prove the code?

[Michael M. @MichaelMorami]

@m4rio_eth I generally agree, we even moved to MD for a short while. However, Im my concerns with MD is it's too easy to modify. it's a double-edged sword.
PDFs are harder to forge/modify by forks, scams, rug-pulls, etc.
Maybe not the strongest argument, but I am truly concerned about it

[Michael M. @MichaelMorami]

@westhamdefence I recommend signal. I think we'll be ok...

[Michael M. @MichaelMorami]

@StErMi Not that I know of. Let me know if you find it.
I recently discovered this, though helps me collapse everything as soon as I start to have more organized environment:
https://t.co/wFzNB7FrFa

[Jeffrey Scholz @Jeyffre]

Formal verification falls broadly into two categories:

1) exhaustive search (technically “constraint satisfaction”). This is where you write the invariant and the computer does the heavy lifting — but it might get stuck if the search space is too large. Think like Certora or Halmos.

2) correct by design. You literally write a math proof that the code is correct. Think Lean or Coq (or even by hand). The human does the heavy lifting, but with some cleverness you can avoid the issue of large search spaces.

The second one has me regretting not taking proof writing more seriously early on, like “this is something the mathematicians take care of, I’ll just wire the algorithms together.”

This is one thing I like about web3. Some stuff that is highly “theoretical” is actually immensely practical.

Thankfully, GPT/Claude has been able to bail me out of proofs I got stuck on, but 1) they sometimes give faulty proofs 2) if you don’t already know how proofs work, good luck prompting it or verifying its work.

[Michael M. @MichaelMorami]

The tooling, processes and human talent that work to keep it safe are second to none.

[Michael M. @MichaelMorami]

After extensive research on DeFi's top protocols' governance systems, and as a reviewer of @aaveaave AIPs on behalf of @certora, I can attest that Aave has by far the most active, advanced, and inclusive governance in DeFi to date.

[Aave @aave]

Beyond the governance process itself, decentralization requires consistent participation from token holders and organizations alike.

Aave DAO historically has had some of the most active governance: 661 proposals, 74.2K lifetime participating addresses, and 1.7M votes.