AuditHub is the collaborative auditing platform transforming how security teams secure their protocols. Built by security experts from @VeridiseInc
Austin
- Tweets 459
- Following 78
- Followers 259
- Likes 963
Cheaper analysis does not create the bug, it just finds the one that was always there.
Non constant-time comparisons and secret-dependent branches have been exploitable for years.
The cost of exploitation dropped, the defect class did not change.
AI proliferation has not demonstrably caused real side-channel cryptography attacks.
Its now so cheap to get way more timing samples of sensitive operations on all devices, and to analyze it better.
Curious situation
1
2
73
AuditHub retweeted
Up to an hour. That was the cost of reading one Picus counterexample by hand.
@ShankaraPailoo2 on what happens instead now: the counterexample and the circuit go to AI triage, which returns the root cause class.
Proving was never the bottleneck. Triage was.
2
2
3
90
AuditHub retweeted
Most routers and bridges have a function that will call any contract you name and run any function you pick.
Nobody made a mistake writing it. That is the design.
Four protocols have lost more than $30M to it in two years. 🧵
A function that forwards caller-supplied calldata into a low-level call can perform any operation the target's interface exposes.
Nobody designed that set. No auditor reviewed it.
New Auditor's Take from @FormallyJon covers the class.
veridise.com/blog/audit-insi…
1
3
3
395
AuditHub retweeted
Glad to see that formal method techniques are becoming mainstream.
However, I wished things were as simple as saying to an LLM "verify this." Verification is a more thorough and rigorous process, where you need to clearly define what you need to prove. Leaving that up to the LLM tends to result in poor coverage and the software might still contain critical bugs. And when this happens these days, it's usually formal methods that takes the blame.
Even in this post, the main output of the chat was how many bugs were found and fixed via lean. But the most interesting part when you are using lean is *what properties* you proved.
I used Opus 5.5 to formally verify the Claude Agent SDK using Lean. A couple short prompts = 16 PRs fixing various bugs and race conditions. Video attached.
TLA+ also works well. I sometimes combine Lean and TLA+ to look for issues around data flow, concurrency, and state mgmt.
I don't know either language well, but Claude is excellent at both. This approach is super useful for formally modeling your code and finding bugs that a human probably wouldn't have spotted.
Is formal verification the future of coding (or at least, bug finding)?
3
1
7
131
AuditHub retweeted
1/ Some bugs hide behind a check that looks fine.
A function makes a risky call, and right underneath it sits a require statement. A reviewer sees that and moves on.
Here's why that instinct fails, and what catches it instead. 🧵
An interesting "pre-mortem" this week. See how running continuous checks on your code can help you catch bugs even in the cases where you deem an external audit is not necessary.
1
2
4
131
1/ Some bugs hide behind a check that looks fine.
A function makes a risky call, and right underneath it sits a require statement. A reviewer sees that and moves on.
Here's why that instinct fails, and what catches it instead. 🧵
An interesting "pre-mortem" this week. See how running continuous checks on your code can help you catch bugs even in the cases where you deem an external audit is not necessary.
1
2
4
131
4/ A detector doesn't relax at a require. It asks a narrower question: is the value that decides the call constrained, anywhere, before it reaches that call.
If nothing constrains it, the detector flags the call. The nearby require doesn't matter.
1
1
13
5/ That's a property of the code itself. It can be checked without running anything, on every commit, before a bug like this ever ships.
How the detector works, with the actual query:
audithub.dev/blog/security-a…
1
1
17
AuditHub retweeted
The detector behind this asks one question. Does anything constrain the value that decides the call, anywhere on its path to that call?
A require elsewhere in the function does not answer it.
New Pre-Mortem from @KFerles
An interesting "pre-mortem" this week. See how running continuous checks on your code can help you catch bugs even in the cases where you deem an external audit is not necessary.
1
2
69
AuditHub retweeted
Your last audit has a date on it
But do you know how many commits have shipped since then ?
1
2
3
44
Zero-click means the victim does nothing and the attacker still wins.
When the only defense is patching after exploitation, the window is already lost.
🚨 Google confirms Pixel phones targeted in zero-click zero-day attacks
Google has patched CVE-2026-58704, a high-severity vulnerability in Pixel phones' cellular modem that the company says was already under "limited, targeted exploitation."
⠀
The flaw is caused by a logic error that can allow an attacker to bypass permission checks and escalate privileges beyond the modem's isolated environment.
⠀
Most importantly, exploitation requires no interaction from the victim.
No malicious link needs to be clicked and no file needs to be opened, making it a zero-click attack.
⠀
Google has not disclosed:
• Who carried out the attacks
• How many Pixel owners were targeted
• How the victims were selected
• What tools or spyware may have been deployed
⠀
CISA has added CVE-2026-58704 to its Known Exploited Vulnerabilities catalog and set a September 19 remediation deadline for affected federal systems.
⠀
Google says Pixel devices with the September 5, 2026 security patch level or later are protected.
Pixel owners should update their devices immediately.
1
1
56
"AI has been a ‘net negative’ for crypto"
AI is making attackers faster. Your audit cadence hasn't changed.
Quarterly reviews can't outpace automated exploit generation.
1
6
45
AuditHub retweeted
Formal verification tells you a property fails. It doesn't tell you why.
@ShankaraPailoo2 on turning a counterexample into a root cause.
1
4
10
371
AuditHub retweeted
@KFerles: A defender has to find every vulnerability. An attacker needs one.
AI just made finding that one cheaper. Point-in-time audits cannot keep pace with that. Exploits climbed in the first half of this year.
Continuous validation is the only way defenders catch up.
1
3
8
112