AuditHub is the collaborative auditing platform transforming how security teams secure their protocols. Built by security experts from @VeridiseInc
Austin
Joined February 2025
- Tweets521
- Following78
- Followers254
- Likes1.1K
AuditHub retweeted
In-house security is not a headcount line, it is a response time.
External audits answer in weeks. Code ships daily.
The gap between those two numbers is where incidents live.
AuditHub retweeted
An AI agent’s guardian hits suspend. One block later, the agent is back.
That was a live path in an earlier ERC-8468 draft. The agent named a second key it controlled, with the right to resume.
Agent safety fails the same way access control does. Audit who else holds the key.
ethereum-magicians.org/t/erc…
AuditHub retweeted
An hour per bug. That was the cost of tracing why a ZK circuit failed its proof, by hand.
@ShankaraPailoo2: an AI pass named the cause in seconds. Developers confirmed every one.
AuditHub retweeted
A future quantum computer cracks one Zcash refund address. Every payment that account ever received links together.
Zakura’s fix: a separate viewing key for each NEAR Intents swap. One leaked address exposes one swap.
coindesk.com/tech/2026/10/19…
AuditHub retweeted
You rewrote a ZK circuit to cut constraints. Does it still compute exactly what the original did?
Tests check the inputs you thought of. LLEQ hands the question to an SMT solver, which reasons over all of them.
@RaghavMalik15 shows how to run it.
AuditHub retweeted
@aztecnetwork published a full post-quantum roadmap targeting 2030.
The sequencing stands out. Hardened libraries for private data land in early 2027, ahead of any proof system replacement.
Harvest-now-decrypt-later exposure gets addressed first.
thedefiant.io/news/blockchai…
AuditHub retweeted
Singapore next week✈️. @FormallyJon will be at @token2049 and around the side events from October 5 to 9.
Good time to grab him if security is on your roadmap and you want a straight conversation about it.
DM to book a slot.
AuditHub retweeted
The detector behind this asks one question. Does anything constrain the value that decides the call, anywhere on its path to that call?
A require elsewhere in the function does not answer it.
New Pre-Mortem from @KFerles
AuditHub retweeted
Up to an hour. That was the cost of reading one Picus counterexample by hand.
@ShankaraPailoo2 on what happens instead now: the counterexample and the circuit go to AI triage, which returns the root cause class.
Proving was never the bottleneck. Triage was.
AuditHub retweeted
Cheaper analysis does not create the bug, it just finds the one that was always there.
Non constant-time comparisons and secret-dependent branches have been exploitable for years.
The cost of exploitation dropped, the defect class did not change.
AuditHub retweeted
Most routers and bridges have a function that will call any contract you name and run any function you pick.
Nobody made a mistake writing it. That is the design.
Four protocols have lost more than $30M to it in two years. 🧵
A function that forwards caller-supplied calldata into a low-level call can perform any operation the target's interface exposes.
Nobody designed that set. No auditor reviewed it.
New Auditor's Take from @FormallyJon covers the class.
veridise.com/blog/audit-insi…
AuditHub retweeted
Glad to see that formal method techniques are becoming mainstream.
However, I wished things were as simple as saying to an LLM "verify this." Verification is a more thorough and rigorous process, where you need to clearly define what you need to prove. Leaving that up to the LLM tends to result in poor coverage and the software might still contain critical bugs. And when this happens these days, it's usually formal methods that takes the blame.
Even in this post, the main output of the chat was how many bugs were found and fixed via lean. But the most interesting part when you are using lean is *what properties* you proved.
I used Opus 5.5 to formally verify the Claude Agent SDK using Lean. A couple short prompts = 16 PRs fixing various bugs and race conditions. Video attached.
TLA+ also works well. I sometimes combine Lean and TLA+ to look for issues around data flow, concurrency, and state mgmt.
I don't know either language well, but Claude is excellent at both. This approach is super useful for formally modeling your code and finding bugs that a human probably wouldn't have spotted.
Is formal verification the future of coding (or at least, bug finding)?
AuditHub retweeted
1/ Some bugs hide behind a check that looks fine.
A function makes a risky call, and right underneath it sits a require statement. A reviewer sees that and moves on.
Here's why that instinct fails, and what catches it instead. 🧵
AuditHub retweeted
Read it here: audithub.dev/blog/security-a…
