Certora
@Certora
Your End-To-End Security Partner.
Manual Audits, Formal Verification, and Protocol Design Review.
Trusted by Aave, Uniswap, Lido, EigenLayer, Solana and more.
341 Following 12.1K Followers
Congrats to @MezzanineFi on the launch!
Great to see the protocol go live after our formal verification work with the team.
Looking forward to what's next 🫡
Mezzanine is finally live!
Our first vault is the @HastraFi Optimizer, with many more on the way.
Pick your side: higher yield or built-in buffer.
Every vault tracked live by @AccountableData
Show more
What does it take to build and integrate applications on @CantonNetwork?
Join @Jpandya26 from @CantonFdn, alongside @ChandrakanaNaN and @iamandreiski from Certora, to discuss wallet integrations, Daml development, and what it takes to ship on Canton.
Plus, a live demo of Canton Package Analyzer ⬇️
Show more
At @EFDevcon tomorrow, Certora co-founder @SagivMooly will discuss how AI agents can make formal verification more accessible to Solidity developers.
📍 Lotus Stage 2 | 12:30 PM IST
If you're at Devcon, come join us!
Show more
If you are at @Devcon, I am talking tomorrow at the Lotus stage at 12 on democratizing formal verification for Solidity. My talk should be accessible. Please come
In August, an attacker bypassed Moonwell’s MAMO supply cap in an $8.7M exploit.
After the attack, we ran AutoProver on the pre-attack code. The Certora Prover found a violation of the generated property.
In our latest blog, @AliceAndB0b breaks down the attack, the rule that catches it, and a proposed fix the Prover verifies. ⬇️
Show more
Security has always been central to Ethereum, and this year it's part of the @EFDevcon opening ceremony.
Join Certora co-founder @SagivMooly alongside @nethan_eth, @VitalikButerin, @drakefjustin, @ncsgy, @donnoh_eth, @dhsorens, Kev, and @audreyt.
See you tomorrow, Mumbai! 🇮🇳
Show more
The Certora team will be in Mumbai this week for @summit_defi and @EFDevcon.
Come talk smart contract security, formal verification, and safer AI-generated code with our researchers and team.
See you there 🇮🇳
Show more
We completed a security audit of @MidasRWA’s smart contracts. No critical or high-severity findings.
Midas is a platform that issues onchain investment products (mTokens). Our review included issuance and redemption, cross-chain minting, access control, and Aave, Morpho, USTB and mToken integrations.
Full report ⬇️
Show more
What does it take to audit @solana programs?
In our latest blog, we share insights from our security work with Solana protocols including @uselulo, @ManifestTrade, @kamino, and @fragmetric.
From account validation and cross-program calls to oracle integrations and protocol accounting, we explore common security risks, real audit findings, and what developers should watch out for.
Read more ⬇️
Show more
Certora co-founder @SagivMooly is heading to @EFDevcon 8 to share insights from our work on @aave V4, exploring how AI agents and formal verification can help developers build safer smart contracts.
📅 Thu, Nov 5 | 12:30–12:55
📍 Lotus Stage 2
See you soon, Mumbai! 🇮🇳
Show more
❌🪲 @SagivMooly of @Certora is joining Devcon 8 for “Bug-Free Solidity Coding Agents,” digging into how verification and program analysis can help make AI-generated smart contracts safer.
Catch his talk on the Security stage.
Show more
Going from seconds to milliseconds in finality is an impressive engineering achievement.
Congrats to the @anza_xyz and @solana teams on this major upgrade!
Alpenglow is now live on Solana mainnet. ⛰️
Finality just went from ~12.8 seconds to ~150ms.
The biggest consensus upgrade in Solana’s history, built by @anza_xyz.
excited to see more and more traditional finance companies moving to blockchain. @CantonNetwork is one of the networks getting a lot of interest
sharing some insights from our experience securing DAML smart contracts on Canton
Show more
Daml takes a different approach to smart contracts. What does that mean for security?
We share insights from our @CantonNetwork audits: authorization checks, contract references, and how locks and accounting can break across workflows.
🔗 Learn more:
Show more
Can formally verified code still have bugs?
The answer is yes. A proof can pass, and the system can still be vulnerable.
Our latest article explores four ways formally verified code can still go wrong, with real-world examples and how to catch them before deployment.
Show more
Kudos to the @Certora team for the great research and responsible disclosure! The write-up is such an interesting read. It’s an honor to collaborate with such talented security researchers. Thanks @tpiliposian for sharing the behind-the-scenes story!
Show more
On September 24, forged zero-knowledge proofs took ~$1.92M in USDC from Payy's bridge.
The fix for the Barretenberg verifier bug Payy blames had been in a public release for 73 days.
Find out why Payy was still exposed ⬇️
Show more
@Certora all defi protocols should be formally verified
Bringing Bitcoin into onchain financial markets requires strong security foundations, especially at this scale.
Proud to have formally verified Hashi’s smart contracts ahead of its mainnet launch. 🫡
Show more
Just in from the main stage at Sui Basecamp:
👉 Hashi mainnet starts rolling out this month, with $500M+ in capital already committed.
👉 @Anchorage joins as a launch partner, bringing qualified custody and stablecoin liquidity.
Learn more ⤵️
Show more
Building on @StellarOrg comes with a different set of security assumptions.
Authorization, storage, cross-contract calls, native assets, cross-chain messaging. Soroban handles each differently from the EVM, and those differences matter when designing secure applications.
Based on our work across the Stellar ecosystem, we break down what builders should know about securing smart contracts on Soroban.
Read the full article by @tpiliposian:
Show more
Congrats to @Polymarket on the launch of V2, a significant rebuild of the system behind one of the largest prediction markets.
Proud to have formally verified the new protocol alongside a strong group of security teams that audited the codebase 🫡
Show more
Introducing Polymarket Protocol V2, a new smart-contract foundation built for prediction markets.
To give developers and market makers time to integrate, we’re running canary markets October 5–30, with new markets tentatively switching on November 2.
With this release, we’re also introducing Data API v2, a new Rust service powered by our in-house on-chain indexer
Start with the migration docs here:
Read more about both in the blog below:
Show more
Bitget lost ~$387.5M in one of the largest crypto hacks of 2026.
Attackers exploited a zero-day in a third-party security product, gained access to Bitget’s wallet infrastructure, and fed it forged withdrawal requests that bypassed normal risk controls.
We break down what happened and what formal verification can establish about withdrawal signing.
➡️
Show more
