Skip to content
Quantix Security Labs

Formal verification and fuzzing

Unit tests show that code behaves correctly in the cases someone thought of. Fuzzing and formal verification widen that to cases nobody wrote down: a fuzzer searches millions of call sequences for a broken property, and a prover checks that the property holds in every reachable state under stated assumptions.

In this area

Publications
3
Reading time
19 min

Primers explain a known class of issue with illustrative code. Analyses synthesise public incidents, standards and papers, each cited.

Publications

3 publications on formal verification and fuzzing

These publications explain how to write invariants precise enough to fail, how stateful fuzzing finds multi-step bugs, and what a proof buys a DeFi protocol and what it leaves out.

  • Formal Verification6 min read

    Technical analysis

    Formal verification in DeFi: what a proof buys you

    Provers can establish that a property holds in every reachable state. Whether that matters depends on which properties were written, what the model assumed, and what was left out. A practitioner’s map.

  • Formal Verification7 min read

    Primer

    Writing invariants that find bugs

    Fuzzers and provers are only as good as the properties they check. How to move from vague requirements to invariants precise enough to fail.

  • Formal Verification6 min read

    Primer

    Smart contract fuzzing techniques

    Coverage-guided and stateful fuzzers explore sequences of calls no reviewer would think to write. How they work, how to give them good inputs, and how to tell whether a green run means anything.

Apply it

Services and tools that use this research

Want this reasoning applied to your code?

Share the repository, the commit you plan to deploy and your timeline. The first output of any engagement is a written scope.

Request a Smart Contract AuditAll research