PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Why fuzzing over formal verification?

blog.trailofbits.com | blog | #smart-contracts | #fuzzing | #blockchain | #formal-verification | #trail-of-bits | #invariants | #security-auditing | #symbolic-execution
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Trail of Bits explains why it favors fuzzing over formal verification in most audits: proving bug absence is often unattainable, while fuzzing finds similar bugs with far less skill and time.
Published
Collected

Related coverage

blog · osec.io
Move: an auditor’s introduction
OtterSec's auditor-focused introduction to Move: how its type system and resource model enable safer programming, anti-patterns to avoid, and design tips for safer protocols.
blog · blog.trailofbits.com
Auditing in the age of (good enough) AI
Trail of Bits explains how agents built tooling and a Lean model for the Miden zkVM audit, finding a flaw enabling Falcon signature forgery and yielding 95 machine-checked proofs.
blog · blog.trailofbits.com
A “proof” of Fermat’s Last Theorem that fits the margin
Trail of Bits found a Lean ≤4.33.1 bug: String.Pos.Raw.extract returns a full string where its spec says empty — enough to 'prove' Fermat's Last Theorem. Not a soundness flaw; fixed in 4.34.0-rc1.
blog · blog.trailofbits.com
State divergence enables unauthorized access
This coverage gives security teams current context for monitoring, validation, and remediation.
blog · blog.trailofbits.com
Building secure Uniswap v4 hooks
Uniswap v4 hooks can satisfy PoolManager settlement invariants while still violating application-level accounting or authorization assumptions. The seven recurring failure patterns form a practical review checklist for hook developers and auditors.
blog · hackenproof.com
HackenProof, in Partnership with Hack The Box—the Four Million Platform—Has Launched a CTF Security Challenge for the Blockchain Industry
HackenProof and Hack The Box turn blockchain security into a gamified CTF track with weekly challenges and a ten-quest series, giving top performers a path into the bug bounty ecosystem.
Back