Thomas Pani | blltprf.xyz

Model-based adversarial testing for distributed systems. Executable specs, better oracles, fewer 3am on-call pages. Make software boring again.

[Thomas Pani | blltprf.xyz @audithare]

Recording now online! 🎥

I gave a hands-on workshop at Protocol Berg 2025:
25-Minute Solidity Fuzzer: Fuzzing Smarter, Not Harder 🎤

Learn EVM fuzzing by building a Solidity fuzzer in Python from scratch — in just 25'.
+ Better input generation
+ Smarter metrics (beyond # of runs)
+ Formal Methods mindset

🧠 Recording + blog: https://t.co/Nocp3cjMeL
💻 Code: https://t.co/3fVdoErJLD
📽️ Video: https://t.co/BMDuE9VFWR

#web3 #EVM #fuzzing #smartcontracts #Security
@protocol_berg

[[email protected] | (spec|ver)ification | security @k0nn0v]

There is a growing interest in formal specifications and #tlaplus again! Check the recordings of the TLA+ Community Meeting 2026 to see the examples of what can be done with it (hint: a lot).

The TLA+ YouTube channel: https://t.co/qwMzJyGw72

The talks in the thread...

[Thomas Pani | blltprf.xyz @audithare]

@mitsuhiko @openclaw Only its LOC growing faster 😄

[Thomas Pani | blltprf.xyz @audithare]

For an example, let's say your system has a single counter x, initially at least 42, and it can non-deterministically increment x by either 5 or 12.

x ≥ 10 is an inductive invariant.

Let's say we want to check the property "x is always positive" (x>0).

So we discharge in SMT:
1) initial state satisfies the inductive invariant:
x ≥ 42 ⇒ x ≥ 10
2) ind.inv. preserved under steps:
x ≥ 42 ∧ x' = x + 5 ⇒ x' ≥ 10 and
x ≥ 42 ∧ x' = x + 12 ⇒ x' ≥ 10
3) ind.inv. implies the property:
x ≥ 10 ⇒ x > 0

These four queries can be checked by Z3 in a fraction of a second, even though there are infinitely many initial states (any state where x is at least 42).

Obviously, for real systems with more complex state, the inductive invariant become more complex. But the basic principle remains as simple as illustrated here.

In practice, the challenge becomes finding an invariant that is inductive for the system and strong enough to satisfy the property. This is an intellectual puzzle, but one that can be done with a bit of practice.

[Thomas Pani | blltprf.xyz @audithare]

@SivukhinN @k0nn0v @DominikTornow Checking these against a property P is symbolic, on the formulas – we don't need to deal concretely with the (possibly many) concrete states described by S and apply(s, a).
We simply hand over S ⇒ P and apply(s, a) ⇒ P (for all a \in Actions) to Z3.

[Thomas Pani | blltprf.xyz @audithare]

@MichaelAArouet So? This difference covers healthcare, school through university, unemployment insurance, plus childcare and public transport subsidies.

The US just takes smaller deductions and pushes the same costs out-of-pocket and risk-based. Just a different way of paying 🤷🏻‍♂️

[Dominik Tornow @DominikTornow]

Fun with Protocols

A challenging but rewarding read, perfect for a holiday break:

Proving completeness of an eventually perfect failure detector in Lean4 by @k0nn0v

Igor uses Lean to prove (not model check) a distributed protocol's safety and liveness

https://t.co/22l1uiSjqO

[[email protected] | (spec|ver)ification | security @k0nn0v]

"This is all good, but how does your spec match my implementation?"

Here is how. We generate a test harness that tries the code and the spec. Both get tested! Want it fast? Let's use Claude.

Does it find bugs? Oh yes!

https://t.co/Uw6KspBrSG

[Thomas Pani | blltprf.xyz @audithare]

Our full write-up with a lot more details:

👉 https://t.co/7Aa4eSyReC

[Thomas Pani | blltprf.xyz @audithare]

Recently wrapped up a month-long engagement to formally verify the new Aztec Governance Protocol together with @k0nn0v.

No critical issues, but we did uncover subtle cross-contract interactions and timing-related edge cases that rarely appear in conventional audits or fuzzing.

Aztec Labs addressed all findings, and working with them was a pleasure. 🤝 @aztecnetwork

[Thomas Pani | blltprf.xyz @audithare]

What a cool event: curious people, interesting tech, and a stunning location ✨

Thanks @renerocksai for bringing the @TigerBeetleDB spirit to Vienna! Hope this can be repeated (and lure @jorandirkgreef to Vienna) 😄

[riccardo busetti ☻ @iambriccardo]

Can’t believe this happened but @TigerBeetleDB was in Vienna.

@jorandirkgreef was missing though :(

Thanks a lot to @renerocksai for hosting!

[Wake @WakeFramework]

https://t.co/nSeXie5coN

[Thomas Pani | blltprf.xyz @audithare]

@WakeFramework Exactly. Unfortunately, a lot of people believe that security is becoming cheaper with AI, when the economic incentives heavily favor blackhats over whitehats.
The sooner we can correct this narrative, the better for web3.

[Thomas Pani | blltprf.xyz @audithare]

@DominikTornow The miracle is that we build complex global systems on agreed-upon points in the past… and it not only works, it scales 😄

[Thomas Pani | blltprf.xyz @audithare]

Security is a risk mitigation race, not a cost-curve problem.
"Better" tools end up empowering both whitehats and blackhats.

AI doesn't make security cheaper; it just shifts the battlefield and raises the stakes.

[Larry Engineer 🍡 @larry0x]

Smart contract auditing cost is about to plummet. Good

[Armin Ronacher ⇌ @mitsuhiko]

Ad GitHub: would love to see a modern version of Trac that can be self hosted, but is federated so that it can be used to host many projects and survives the shutdown of instances.

[Brian Cardarella @bcardarella]

I told Claude to one-shot an integration test against a detailed spec I provided. It went silet for about 30 minutes. I asked how it was going twice and it reassured me it was doing work. Then I asked why it was taking so long:

[Thomas Pani | blltprf.xyz @audithare]

@TommyYesItsMe @tsoding Just because critical bugs don't hit users or cause outages doesn't mean they're easy to debug. We've had plenty of user-facing examples recently.

Not sure I follow your point – if the issue is running stripped release builds, what's the connection to overengineered languages?

[Thomas Pani | blltprf.xyz @audithare]

@TommyYesItsMe @tsoding Fair, but many complex systems can take hundreds of engineers three hours to figure out, regardless of the language?

I'm not too happy about the Rust hype, but I'd say there's better angles here than language choice.