It depends on how you perform formal verification and exactly how much you kind of constrain the problem. The verifier that I created was actually very flexible in that it used a specification class called temporal specifications which basically state properties over time. And because we were using this very I guess flexible but particular specification language it was able to find attacks that required a series of transactions or that even would require fallback functions to be synthesized. It's always gotten this impression that it was a very precise testing tool but a very limited one. This is sort of surprising that it sort of can find things past what it's been specked for.

Get the Snipd
podcast app

Unlock the knowledge in podcasts with the podcast player of the future.
App store bannerPlay store banner

AI-powered
podcast player

Listen to all your favourite podcasts with AI-powered features

Discover
highlights

Listen to the best highlights from the podcasts you love and dive into the full episode

Save any
moment

Hear something you like? Tap your headphones to save it with AI-generated key takeaways

Share
& Export

Send highlights to Twitter, WhatsApp or export them to Notion, Readwise & more

AI-powered
podcast player

Listen to all your favourite podcasts with AI-powered features

Discover
highlights

Listen to the best highlights from the podcasts you love and dive into the full episode