At Runtime Verification, we saw a need for advanced Solidity debugging tools combining traditional breakpoint debugging with symbolic execution. Enter "Simbolik: The Symbolic Solidity Debugger." This tool bridges the gap between user-friendly debugging and powerful formal methods. Developers start with familiar techniques, like setting breakpoints, and gradually integrate formal methods, enhancing the security and reliability of their smart contracts.

View Details

Rounding-related hacks are having a moment in the spotlight. Yet, they're one of the most misunderstood class of vulnerabilities. In this talk, we explore the history of rounding related exploits, diagnose root causes, and provide practical mitigations for protocols.

View Details

Threshold cryptography, crucial for blockchain and cryptocurrencies, faces a critical issue: threshold key destruction. This talk will cover how attackers can prevent honest participants from using threshold keys, focusing on three cases: the severe impact of the Forget-and-Forgive attack (BHUSA '20), the risks of missing length checks in Feldman VSS, and the novel method in DKLs23 that exploits honest participants.

View Details

Blockchain security often focuses on smart contracts and cryptography attacks, neglecting the security of other critical components like cloud infrastructures, web applications, and API gateways. Our research uncovers vulnerabilities at the Web2-Web3 intersection, revealing how simple cloud exploits breached the privacy of major blockchains like ZetaChain by linking wallets to real-world IPs. We expanded this vulnerability to Ethereum and developed a new MEV attack, causing economic damage to DEXs. This talk highlights these exploits and the overlooked Web2 security issues in Web3 designs.

View Details