nowarp

Smart contracts security tooling and audits

[nowarp @nowarp_io]

7/ Some real world-findings are demonstrated. Full write-up: https://t.co/ypJokmhDLC

[nowarp @nowarp_io]

1/ Part 2 of the compiler fuzzing series: 15+ miscompilations in production compilers -- Polkadot Revive, ZKsync, Solang, TON, Gno. Some earned bug bounties.

Every mutation is proven equivalence-preserving in Lean4 — any divergence is a real bug.

🧵👇 https://t.co/ypJokmhDLC

[nowarp @nowarp_io]

6/ Hand-writing doesn't scale. A bottom-up enumerator proposes candidates, a Python mirror of the semantics fingerprints them, and the Lean kernel decides which are real.

Result: 1600+ machine-checked mutations, stacked together.

[nowarp @nowarp_io]

7/
Part 1 focuses on ICE. Part 2 coming later.

Full write-up: https://t.co/gei746QL2c

[nowarp @nowarp_io]

100+ compiler bugs found across 5 smart-contract compilers (Sui Move, Cairo, Solang, Solidity, Leo).

Coverage-guided fuzzing + tree-sitter + LLM-generated mutators. Not parser crashes — every bug is a real ICE from valid programs.

https://t.co/gei746QL2c

🧵👇

[nowarp @nowarp_io]

6/
Corpus + dict: collect broadly, minimize aggressively. Triage: LLM-driven dedup + MRE.

Three open-source utilities published, plus the complete Sui Move fuzzing harness with 884 custom mutators.

[nowarp @nowarp_io]

Skry: security tool for Sui Move contracts.

Hybrid static analysis + constrained LLM usage.
Focused on access control, centralization, and governance issues.

Tested on real Sui projects.
Proof-of-concept source code is available.

https://t.co/DrJoWP9KkC

[nowarp @nowarp_io]

5/ 📜 Check out the full changelog: https://t.co/CdLINLI66Z

[nowarp @nowarp_io]

1/ 🎉 Misti 0.9 has just landed on NPM: https://t.co/CdLINLI66Z!

Explore its new features 👇

[nowarp @nowarp_io]

4/ 🛠️ Custom Tools: Misti now enables users to write Custom Tools, just like Custom Detectors: https://t.co/pOFRZCpetE