Kostas Ferles

Chief Technical Officer @VeridiseInc! Building automated tools to secure the web3 ecosystems.

[Kostas Ferles @KFerles]

The ResupplyFi $9.6M bug shipped past an audit. AuditHub catches the class on every commit.

A custom static check flags the shape. A targeted fuzzer confirms the exploit. The combination is the part audits cannot run for you continuously.

[Kostas Ferles @KFerles]

@VeridiseInc @FormallyJon The gap is also tooling. Most teams can name the risk. Few have tooling that does anything about it.

[Kostas Ferles @KFerles]

@VeridiseInc @AuditHubDev Glad to see this getting traction.

[Kostas Ferles @KFerles]

@VeridiseInc @FormallyJon @DavidThaDegen @Genzio Always good seeing Jon on stage. The tooling argument is the right one!

[Kostas Ferles @KFerles]

Read the breakdown in our Pre-mortem: https://t.co/xerlCAKGS1

[Kostas Ferles @KFerles]

The ResupplyFi $9.6M bug shipped past an audit. AuditHub catches the class on every commit.

A custom static check flags the shape. A targeted fuzzer confirms the exploit. The combination is the part audits cannot run for you continuously.

[AuditHub @AuditHubDev]

Vitalik finally said it out loud. "Formal verification is the future of crypto security."

Our tool Picus has been doing it since before the blog post.

[Veridise @VeridiseInc]

The ResupplyFi check approved a $9.6M borrow against 1 wei of collateral. The exchange rate fed in was zero, and zero passed the LTV ceiling.

Veridise auditors treat oracle-fed arithmetic as a boundary problem.

Here are a few learnings from the audit: https://t.co/bfv5ol07az

[Kostas Ferles @KFerles]

Zero < any positive LTV ceiling. The check did exactly what it was written to do. That's what makes this a boundary problem. Busy writing a follow up on how you catch it with a custom detector.

[Veridise @VeridiseInc]

The ResupplyFi check approved a $9.6M borrow against 1 wei of collateral. The exchange rate fed in was zero, and zero passed the LTV ceiling.

Veridise auditors treat oracle-fed arithmetic as a boundary problem.

Here are a few learnings from the audit: https://t.co/bfv5ol07az

[Kostas Ferles @KFerles]

@VeridiseInc The hard part was never finding more bugs.
It was knowing when you'd found them all.

That's the question formal verification actually answers.

[Peter Kacherginsky @iphelix]

https://t.co/CC6IQA39l7

[Kostas Ferles @KFerles]

Thanks @The_DAO_Project for the badge! Truly honored to be selected among such an elite group :)

[thedao.fund @thedaofund]

The next 60 ETHSecurity Badge holders have been selected using a new rubric updated by the applicants themselves!

Thank you to the people who chatted with the bot, your refinement of the rubric is the first DAO experiment we have tested.

And thank you to @bonfiresai for making amazing DAO tooling!

[Veridise @VeridiseInc]

Our CEO @FormallyJon is live from @EthCC on :

Live State Fuzzing: Testing Live Deployments Proactively

https://t.co/62elGaNxQK

[Veridise @VeridiseInc]

We're giving away 2 full-access passes to @EthCC in Cannes 30 March - 2 April

To enter:

1⃣Follow @VeridiseInc
2⃣Repost this post

Winner drawn on 28 March

Our partner @AuditHubDev will be at the booth running a security quiz

Stop by, test your knowledge, take home merch

[Ethproofs @eth_proofs]

📺 Ethproofs day

Panel Discussion: Formal Verification & Fuzzing moderated by @alexanderlhicks , Ethereum Foundation

@CodyGunton @vwuestholz @KFerles

@VeridiseInc @ConsensysAudits

https://t.co/DllN0BD7Yq

[AuditHub @AuditHubDev]

Today we're launching AuditHub for Professional Audit Firms, the comprehensive platform!

Four integrated formal methods tools that handle routine vulnerability detection automatically, enabling audit firms to deliver mathematical guarantees that competitors cannot match.

[Veridise @VeridiseInc]

🚀 @AuditHubDev is back — now purpose-built for blockchain security firms.

A full-stack audit platform that streamlines the audit lifecycle, built around how professional audit teams actually work

1/7

[Defi Security Summit @summit_defi]

Security audits in Web3 are often slow, opaque, and hard to coordinate.

At DSS, @KFerles from @VeridiseInc presents AuditHub, a platform that automates repetitive tasks, improves transparency, and helps analysts and developers collaborate efficiently during security reviews.

[AuditHub @AuditHubDev]

The future Jon (@FormallyJon) outlined at Verifying Intelligence isn't theoretical: it's live.

AuditHub brings continuous ZK + DeFi security into your development workflow today.

One setup.
Always-on verification.
No "out of scope" blind spots.
This is what secure-by-default looks like. 🛡️

[AuditHub @AuditHubDev]

$350M lost to smart contract exploits in 2024. One-third were audited.

Point-in-time audits arrive too late. Bugs surface right before launch, when fixes cost the most.

Watch Veridise CEO Jon Stephens @FormallyJon explain why we built AuditHub!