AlexZoid FV

@alexzoid

Oct 14

Centrifuge

@centrifuge

Oct 14

Audits try to find ways code can break.

Formal verification asks whether critical properties of the code can be proven to always hold.

For the first time, we've formally verified the Centrifuge core using @Certora Prover. The initial work covered 1,589 properties across hare issuance, the Hub and Spoke, messaging and other core components.

It's another layer in a security process built around continuous review rather than a single pre-deployment checkpoint.

AlexZoid FV

@alexzoid

Sep 23

Boris Cherny

@bcherny

Sep 22

I used Opus 5.5 to formally verify the Claude Agent SDK using Lean. A couple short prompts = 16 PRs fixing various bugs and race conditions. Video attached.

TLA+ also works well. I sometimes combine Lean and TLA+ to look for issues around data flow, concurrency, and state mgmt.
nguage well, but Claude is excellent at both. This approach is super useful for formally modeling your code and finding bugs that a human probably wouldn't have spotted.

Is formal verification the future of coding (or at least, bug finding)?

AlexZoid FV

@alexzoid

Aug 21

ClaudeDevs

@ClaudeDevs

Aug 7

New in Claude Code: your sessions can now message each other.

Instead of having to re-explain yourself in another session, you can now tell Claude to do it. It sends a summary (not your history or files), and the other session picks it up mid-task.

AlexZoid FV

@alexzoid

Aug 10

Dacian

@DevDacian

Aug 10

Wow @cyfrin has finalized 20 Formal Verification (FV) private audit engagements with avg 4 Crit/High per engagement!

FV very valuable for proving valuable properties and finding weird unexpected edge-case bugs!

See our FV audits at github.com/cyfrin/cyfrin-…

AlexZoid FV

@alexzoid

Jul 22

Dacian

@DevDacian

Jul 21

Shout out @0xStalin @AliX__40 @BengalCatBalu @alexzoid AMAZING work on vault aggregator audit with formal verification finding:

* 1 Critical
* 5 High
* 7 Med
* 16 Low
* 29 Info, 5 Gas

A difficult audit but @cyfrin auditors pushed hard to provide great findings 🚀

AlexZoid FV

@alexzoid

Jul 21

Mooly Sagiv

@SagivMooly

Jul 20

x.com/i/article/2078…

AlexZoid FV

@alexzoid

Jul 15

Tenor

@TenorFinance

Jul 15

We’re building Tenor with a strong commitment to security.

That means a codebase built on @Morpho Midnight 🕛, 5 independent audits by leading firms, formal verification using the Certora prover, AI-assisted reviews, a bug bounty program, and ongoing monitoring using @blockaid_

Learn more about our approach to security:

AlexZoid FV

@alexzoid

Jul 9

ClaudeDevs

@ClaudeDevs

Jul 7

Claude Managed Agents supports both patterns with sub-agents.

Escalate up to a Fable 5 advisor, or delegate down to Sonnet 5 workers.

Each sub-agent keeps its own cache, so repeat calls don't pay in full for the same context twice.

platform.claude.com/docs/en/manage…

AlexZoid FV

@alexzoid

May 13

Code4rena

@code4rena

May 13

After careful consideration, we’ve made the decision to wind down @code4rena. This community has meant a great deal to everyone who has been part of building it, and sharing this news is not easy.

AlexZoid FV

@alexzoid

Mar 30

Dacian

@DevDacian

Mar 30

Q) How are you using 5-10m tokens per day?

1⃣ I created & train Solace, the latest experimental iteration of our internal vulnerability scanner. Recently I've made some major breakthroughs which unlocked new levels of performance.

Running it can take ~45 mins or more per audit and use 1.5m -> 3m+ tokens depending on the size of the codebase. I have a systematic method for continuing to train it to find new types of vulnerabilities when it misses them.

Doing a few runs each day can easily hit 5-10m tokens.

2⃣ I created & train Bastion, which to my knowledge is the first Specialist AI capable of automated formal verification for Medium complexity smart contracts. I've been quietly using it to ship FV suites as an additional deliverable for my private audit clients.

Running it can take anywhere from 30 mins -> 5 hours+, especially if it struggles which it does on more complicated codebases. Can easily use 500k-1m+ tokens. It doesn't fully replace humans but is great for 3-5 day audits where human FV isn't feasible & can also be an efficiency gain for longer audits where a human does FV using Bastion's output as the starting point.

3⃣ I created process-reports which automates a lot of our various report workflows, not a great token user but a nice efficiency gain for some of our more complicated report workflows and also minimizes human error.

4⃣ I created another internal AI that does a lot of my management job & handles a lot of the "business intelligence/optimization" work. Again not a huge token user here but a huge efficiency gainer as it frees up my time and provides very useful business intelligence to enable data-driven decision making.

5⃣ I'm continually improving these AIs and most likely I will create more specialist AIs whenever I have a need. My goal for 2026 is to automate & optimize away as much of my job as possible, to continue making @cyfrin among the most efficient security providers maximizing value for our clients' spend.

You may think that is foolish, what about your job security etc? Well firstly I do this primarily for fun though the $ is also nice. And secondly I think the future is one of limitless possibilities so if I manage to automate & optimize away most of my job, that will free me to do even more interesting things - and I'll be even better at creating & training specialist AIs so even better equipped for the future.

AlexZoid FV

@alexzoid

Mar 25

AlexZoid FV

@alexzoid

Jan 21

Just kicked off my curated list of premium resources for Formal Verification with @Certora Prover (EVM, Stellar, Solana).

Hand-picked, always updated, all in one spot. Bookmark this treasure, anon!

github.com/alexzoid-eth/f…

AlexZoid FV

@alexzoid

Mar 2

Jeffrey Scholz

@Jeyffre

Feb 23

Let me add some color to this spicy tweet because I suspect some folks have interpreted this as "leave Web3."

In 2020-2022 (before FTX crash), Solidity was legitimately easy money.

Deploy a few "advanced" contracts, get a six-figure remote job.

Report "function is reentrant" on code4rena and make $3,000.

There was also an insane amount of money flying around due to the money printer working overtime and almost nobody knowing about Web3 dev.

People were paying hundreds of thousands of dollars for monkey jpegs in case you forgot your history.

It's no secret that 80% of the industry is essentially a casino -- and people only go the casino when they have extra money to gamble, and numbers are generally up only. That's been less and less the case as we move away from the pandemic years.

Since then, the Web3 industry has been steadily contracting, while the supply of engineering talent has steadily increased to arbitrage the relatively easy money that Web3 offers.

So, there is no more easy money career-wise in Web3.

--

Now let me offer some nuance:

1) If you are born in a country with unfair advantages, and you think $1,000 / mo for a remote job is a great salary, then there are still opportunities for you -- if you can think on your feet.

The market is too harsh to just follow a roadmap and get a steady job, but the opportunities are there. However, it won't be a "sip cocktails on the beach" kind of job. Even companies that are "doing okay" now have all the cards when it comes to job negotiation.

2) If your benchmark for a good salary is $100,000 per year ($8,333 / mo) remote, then you are smoking crack if you think that salary is achievable within a year of grinding, given the current conditions. It used to be. It's not anymore.

If you have an exceptional background (i.e., you won math or programming competitions), then Web3 might have some advantages for you relative to other industries, as web3 is still somewhat merit-based. If you have a cryptography or distributed systems background, then you have the necessary edge.

You can make $100k in Web3, but not if you are starting fresh. You need some kind of an advantage going into it. I personally had a huge advantage -- I already had decades of technical writing experience + leadership experience at big tech. RareSkills didn't succeed only because I tried hard.

There is no such thing as a junior solidity dev or junior auditor anymore. What anyone calls a "junior" today would have been "senior" two years ago.

--

Keep in mind, I actually have a financial incentive to tell you "OMG YOU CAN MAKE $100,000 IN WEB3 DEV/AUDITING" -- I run a web3-oriented bootcamp and recruitment company for crying out loud.

In fact, even if you don't take our bootcamps or use @RareTalent_xyz, the more people who are (at least attempting) to do something related to Web3 dev/auditing benefits me because I can show more numbers on the RareSkills website and cut bigger deals with other companies.

So no, I still want you in this industry -- if anything -- for selfish reasons.

So am I just trying to scare people away?

Well, I am trying to scare away the people who ought to be scared away.

And I'm doing them a favor. They'll be disillusioned when they find out that the messaging they repeatedly got that "entry-level jobs pay well and are relatively easy to obtain" isn't true. Those are the sort of people who will leave crypto and never come back. We don't want that.

--

Now let's zoom out. In most countries, it requires at least six years of schooling to get "six-figure jobs" like accounting, medicine, law, architecture, etc.

Six years to six figures.

Has a nice ring to it, and it's what most industries seem to converge to.

If you can grind in Web3 for six years, I guarantee you will succeed. RareSkills hasn't even been around that long. Heck, Solana is barely six years old.

But if you're willing to grind for six years, why not just do one of those traditional jobs? One valid answer is that you live in a country that doesn't offer them.

Fair.

But can you sustain grinding for six years, let alone three?

Objectively -- most people cannot, whether due to personality traits or circumstances.

Your decision should be conditioned on those time horizons.

In fact, there was once a time I made the RareSkills Solidity bootcamp 5-6 months long. The very long duration was to scare away people who weren't willing to invest in self-development for long periods.

I saw many disciplined people join with the right intentions, but life still got in their way. So if someone I judge to be disciplined commits to a five-month program and pays several thousand dollars to join, but life still gets in the way, what does that tell you about how tough the journey into web3 is? It says most are not going to complete the journey even if the stars aligned at one point.

So I shortened the bootcamps to a max of 1-3 months because life can be unpredictable for most people on longer time horizons. This has nothing to do with "lack of discipline" or "not sticking to goals."

Life happens.

--

Here's my advice:

Only do Web3 because you honest-to-goodness love it.

That's the only way you can grind for so long.

I've mentored hundreds of people. The ones that made it 1) genuinely enjoyed the subject and 2) came in with at least some kind of an edge.

If you "enjoy" web3 because you think it will get you a good salary someday, you are in for a rude awakening. I've seen this play out several times.

Even if you get lucky and land a job, you'll not genuinely enjoy what you do. Then you will coast, then the job market goes south, then you are toast.

Opportunism either makes it out early or gets washed out eventually. I've seen that play out over and over.

If you know deep down inside you are opportunistic, then I suggest making a quick buck on AI agents while you still can.

The attitude of "making a quick/easy buck" actually keeps you poor.

The "easy money attitude" keeps you staring at charts, hoping for the lucky trade that never comes.

The "easy money attitude" keeps you passively consuming technical content like a dummy thinking that doing so brings you closer to your dream job.

The "easy money attitude" keeps you spending more energy thinking about the future than making the future happen.

Have an edge. Choose long-term. Choose fun.

AlexZoid FV

@alexzoid

Feb 27

CZ 🔶 BNB

@cz_binance

Feb 27

Reality: Learn to use AI to the max, or be laid off.

AlexZoid FV

@alexzoid

Feb 19

predict.fun

@predictdotfun

Feb 16

We recently partnered with @cyfrin to perform a full audit and formal verification.

It provides mathematical proof that our contracts behave exactly as intended.

See here for the full report:
docs.predict.fun/developers/aud…