Michal Převrátil

Ethereum security tooling developer at @ackeeblockchain

[Michal Převrátil @michprev]

@alexalbert__ This is pretty obvious from the number of bugs I run into every day, how slowly they're resolved, and the state of many repositories—flooded with AI-generated issues and fix attempts, yet somehow nobody actually fixing the underlying problems.

[Michal Převrátil @michprev]

Honored to own one of these now 👀

Huge thanks to @d_gusakov for bringing me this gem at @EthPrague! 📚🫡

[Michal Převrátil @michprev]

@pashov https://t.co/BPP3mKWn0V
Python-based all-in-one toolkit for Solidity: static analysis detectors, unit testing, fuzzing, language server

Recently reworked with Rust revm core for amazing performance while still writing tests in Python

https://t.co/qytaKoT3rn
VS Code extension

[Michal Převrátil @michprev]

Funding helps bring:

• High-quality static analysis for LLMs via MCP
• AI-compatible fuzzing for autonomous large-scale audits
• AI vuln. explanations + fix suggestions in VS Code

The goal: better tools for defenders.

[Michal Převrátil @michprev]

Wake + Solidity (Wake) VS Code extension are live in QF for Ethereum Security.

It's now more important than ever to equip Solidity devs + whitehats with tools for the AI-powered future.

Even a very small donation helps 👇
https://t.co/BPP3mKWn0V
https://t.co/qytaKoT3rn

[Giveth @Giveth]

If you’re tired of watching exploits dominate the timeline, this is your moment to act.

The Ethereum Security QF Round is LIVE!

Support the people and projects securing Ethereum and its L2s.

500 ETH (~$1M+) in matching from @thedaofund.

Explore & donate:
https://t.co/IlryUemfIJ

[Georgios Konstantopoulos @gakonst]

still can't believe the solidity team hasn't prioritized solving stack too deep at any cost lol, "let's instead let's do a new solidity language nobody asked for" smh

[Michal Převrátil @michprev]

Time to see how strong GPT-5.4 Cyber really is 👀

[Ackee Blockchain Security @AckeeBlockchain]

EVMbench for Solana: Trident Arena, a multi-agent AI security scanning solution.

21 out of 30 critical/high-severity vulnerabilities found across 6 open source Solana code bases in benchmarks.

70%+ true positive rate.

See it in action: During a manual audit, TridentArena helped us find a critical-severity issue (later fixed), making @MetaDAOProject even more secure.

Built by the School of Solana senior auditors, securing leading protocols.

Time to IBRL of Solana security audits!

Launch blog post: https://t.co/KgnWZWA6nz

Request access → https://t.co/bs5oEOUyvd

Follow @TridentSolana for product updates and insights.

[Michal Převrátil @michprev]

@sahuang97 For example, this issue from Virtuals 2025-08-04 was excluded from EVMBench even though it leads to a loss of funds.

[Michal Převrátil @michprev]

@sahuang97 I think the message is that people shouldn't rely on EVMBench to catch all severe issues. LLMs may fail to recognize if an issue leads to a loss of funds. And even issues without direct loss may have severe consequences for protocols.

[Ackee Blockchain Security @AckeeBlockchain]

We ran EVMbench on @zellic_io's public dataset, high-severity only.

@WakeFramework beat OpenAI by 96%. Looks like AI isn't killing this startup yet.

EVMbench (codex-gpt-5.2-xhigh): 22/94
Wake Arena (already tested pre-release): 43/94

https://t.co/KlyIKUKOyY

@OpenAI @paradigm @osec_io

[Wake @WakeFramework]

https://t.co/FZmi3GKMdc

[Josef Gattermayer | Ackee @jgattermayer]

The AI security trilemma
Every AI security tool must solve this: optimize for detection rate, false positive rate, or cost. Can’t have all.

Detection rate
We focused on what matters most: high-severity and critical vulnerabilities.
First benchmark: outperform plain GPT-5. If we can’t beat the best base model, there’s no point building a tool around it. Result: 43/94 vs 24/94.
Then benchmark against competition. Zellic V12 - the only AI team to publish reproducible benchmark. Thank you for that. Result: 43/94 vs 41/94.

False positives
This is where we spent most of our effort. A tool that floods auditors with false positives only steals time.
Target: get it under 50%.

Cost
Aim to generate positive revenue. Could find more issues running more models multiple times with unlimited LLM token budgets. But Wake Arena has to be economically reasonable.

→ The Result
A tool we use ourselves. Wake Arena now runs as the 6th step in Ackee’s manual audit methodology (after fuzzing). A safety net for manual reviews. One that will grow stronger as LLM capabilities evolve.

[Ackee Blockchain Security @AckeeBlockchain]

Wake Arena: multi-agent AI audit with graph-driven reasoning and LLM-tailored static analysis.

43/94 high-severity vulnerabilities found in historical audit competitions.

26 findings, including 5 criticals in 4 production audits by Akcee in Nov 2025.

Full benchmarking report: https://t.co/iKU7xvdsqC

Built by senior auditors securing Lido, Aave, Axelar, and Safe.

50%+ true positive rate.

Scan your protocol → https://t.co/Vp5XvyLrdt

Follow @WakeFramework for product updates and insights.

[Josef Gattermayer | Ackee @jgattermayer]

Just presented "State of Fuzzing: Closing the Circle From Machine to Human and Back" at DeFi Security Summit.

The evolution of smart contract testing → from blackbox automation to auditor-guided fuzzing to AI-assisted workflows.

Thread ↓

[Trident @TridentSolana]

The first VS Code extension for Solana is here.

Real-time security analysis + fuzz coverage visualization.

Built by the auditors and educators behind School of Solana.

Thread ↓

[Wake @WakeFramework]

Everything you need for secure Solidity development. In 1 tool.

• Slither: Static analysis only
• Hardhat/Foundry: Testing + some features
• Wake: ALL features combined → testing, fuzzing, static analysis, language server

+ New Rust testing core = same syntax, much faster execution ↓

[Michal Převrátil @michprev]

@WakeFramework LIST

[Wake @WakeFramework]

Yesterday, Tim Ferriss released an interview with the world's scariest hacker, Pablos Holman.

Here are 6 insights that every Solidity developer and smart contract security researcher should know.

Thread ↓

[Wake @WakeFramework]

Perfect security. Zero reentrancy, bulletproof access controls, 100% test coverage.

Yet, an attacker front-ran and hijacked user assets.

Here's how Wake's Manually Guided Fuzzing catches what traditional testing misses:

Thread ↓