Shelly Grossman

CTO @Certora - Making trustworthy Smart Contracts a reality!

[Certora @Certora]

Writing formal specifications has always been the bottleneck in formal verification.

Today we're launching AutoProver, an agentic formal verification system that reads your code, generates specifications, and verifies them. 🧵

[Mooly Sagiv @SagivMooly]

Certora audit knocks this service out of the park:

1. Two dedicated fulltime researchers with deep experience in your code

2. We demand our team review the last commit — the one that goes on-chain — even if there were other audits

3. Verified CVL rules

Don’t settle for less.

[Certora @Certora]

InfiniFi implements an innovative new fractional reserve banking system that enables its users more flexibility and control.

Users, not banks, decide how long capital stays locked.

Conventional banks use fractional reserves wherein they must predict the cash outflow in order to know how much of this money can be invested. The banks control how long these funds are invested and offer little transparency to users. By contrast, InfiniFi’s fractional reserve allows users to decide whether their funds are held in illiquid assets and for how long, offering greater transparency and enabling them to set their own risk-reward tolerance.

Our formal verification report of InfiniFi is now available → https://t.co/jAEF0XEcMr

[Shelly Grossman @ShellyGr15]

@ShellyGr15
is looking to join the Lido Dual Governance Emergency Committee multisig with address 0x8f929Defb7638B5ee6390bdd3bf87B266Df5EDf4

Sig:
00372ed2e4bf957d8a3b08752a3e3ba83efe21216d7a5c7c8f56cc17f21f4c013d2393dd41f85713e2cf28c9b61f26f97077ab167e72f4244b5194047e003cd11c
https://t.co/68rEHFermg

[Shelly Grossman @ShellyGr15]

@ShellyGr15 is looking to join the Lido Dual Governance Emergency Committee multisig with address 0x8f929Defb7638B5ee6390bdd3bf87B266Df5EDf4

Sig:
00372ed2e4bf957d8a3b08752a3e3ba83efe21216d7a5c7c8f56cc17f21f4c013d2393dd41f85713e2cf28c9b61f26f97077ab167e72f4244b5194047e003cd11c

[Elad Erdheim @EladErdheim]

After 2 decades leading cyber investigations at the Israeli PMO, as VP R&D Cyber Security, I retired seeking an impactful domain, and Web3 stood out. I’d love to combine Web2 skills with @certora's 360 security services. Ready to make a difference in DeFi Security 🫡

[Certora @Certora]

We have been working with Balancer since 2020 and consider them one of the most innovative and security-conscious DeFi protocols.

We stand with their team and are genuinely shocked by this unfounded decision.

[Mooly Sagiv @SagivMooly]

The Certora Prover is a huge team effort. 100 amazing engineers from four continents built a robust formal verification platform.
In 2024, 100 excellent DeFi clients used the Certora Prover, which became more robust with each client. 200 external security researchers wrote formal verification rules in audit contests for the FV.

[Certora @Certora]

Certora is now open source!

What’s your excuse now for not securing your protocol, anon?

[Certora @Certora]

Building @Uniswap hooks, anon?

Applications for the Security Fund are open! Our team is ready to audit & formally verify your code ✨🦄

[Tomer Ganor @tomer_ganor]

1/ DAOs can be a double-edged sword - a potential bug in @LidoFinance will ripple across the DeFi ecosystem.
That’s why when they introduced their innovative Dual Governance, I reviewed the design before a single line of code was written and prevented the apocalypse. 🧵

[Certora @Certora]

A tricky edge case in @eigencloud’s interaction with @ethereum's upcoming Electra upgrade almost slipped past the radar and even top-tier auditors missed it.

Here’s how it was caught by Certora and resolved 👇

[Czar102 @Czar102]

If you know you're a pro auditor, I strongly recommend applying to @certora. They are actively hiring security researchers.

I know from experience it's a pleasure to work with them. It's also an opportunity to spend time with the smartest people in the space.

[Shelly Grossman @ShellyGr15]

@DevDacian This would be possible in the future, but not in the current version of the Prover. Asserting on revert reasons is on our roadmap. Stay tuned!

[Shelly Grossman @ShellyGr15]

@DevDacian In any case we'll update the docs to reflect this more precisely to avoid future confusion - thanks for the feedback!
If you need more help feel free to send a run link here or in our Discord

[Shelly Grossman @ShellyGr15]

@DevDacian Hi Dacian, the state that you're inspecting in the screenshot is representing the non-deterministic values that all storage and ghost state variables receive _at the beginning of any rule_. This non-deterministic value assignment is labeled HAVOC in the trace.

[Shelly Grossman @ShellyGr15]

@DevDacian Usually when we say 'havoc' we refer to an event that causes certain variables to be havoc'd, e.g. an unresolved call that is not summarized. But we also use 'havoc' as a term that describes values that are assigned non-deterministically, which is what you see
here

[Mooly Sagiv @SagivMooly]

Certora will be six years old tomorrow. We learned so much thanks to the amazing Web3 community for the last six years. We are especially proud of six things:
(1) Top-class strongest engineering team,
(2) Top loyal clients who are building sophisticated and reliable DeFi protocols,
(3) Our investors who constantly introduce us to new challenges and constantly stand up for us,
(4) A disruptive product Certora Prover which solves one of the hardest problem in computer science
(5) The quality of our security services to prevent bugs of our clients and
(6) Our core values and goals that provide company focus.

In the next six years, we want to improve every one of these aspects and make DeFi safe.

Onward!

@ShellyGr15 & Mooly

[Certora @Certora]

📅 November 13th

Catch @SagivMooly on a panel at the DeFi Security Happy Hour, along with @Mudit__Gupta, Mike O’Keeffe (@immunefi), and @0xren_cf.

https://t.co/vUqm1zoVo2

[Chandrakana Nandi @ChandrakanaNaN]

Excited to present our work on verifying Ethereum bytecode next week at OOPSLA 2024! See you there :)