Blog
Technical insights
Deep dives into smart contract vulnerabilities, blockchain security best practices, and technical research from CertiK engineers.
EducationalWhat is Formal Verification in Smart Contract Auditing?Formal verification is a method of mathematically proving that a computer program functions as intended. It involves expressing the program's properties and expected behavior as mathematical formulas, and then using automated tools to check that these formulas hold true. This process helps ensure that the program meets its desired specifications.
EducationalHacktivism Report: Part OneHacktivism is the act of misusing a computer system or network for a socially or politically motivated reason. This report examines the history and techniques of hacktivism in Web3, the laws and regulations developed in response to Web3 hacks, and looks at several case studies that are most famous for their hacktivism.
Technology analysisWeb3 Mobile Wallet Apps: A Secret Key Protection Perspective The security of private keys and mnemonic phrases is of paramount importance in the world of cryptocurrency, as they grant access to one's digital assets and their loss or theft can lead to financial ruin. With the rise of mobile wallet apps in the Web3 space, it's crucial to understand the various security mechanisms that are in place to protect these keys.
Vulnerability researchCross-Function Reentrancy Attacks in Kadena Smart ContractsIn this post, we briefly explain the difference between reentrancy and cross-function reentrancy, and how Turing incompleteness can prevent some such attacks. We then provide an example of a cross-function reentrancy exploit not prevented by Turing incompleteness using Pact, the programming language utilized on the Kadena blockchain.
Technology analysisHow to Protect Crypto Projects from Insider ThreatsNot all threats come from external sources. Some of the most devastating can come from inside a project team, from a trusted member of the group. A vital element in reducing the risk of insider threats in crypto projects is to thoroughly vet new team members. 
Technology analysisSecurity Considerations When Designing Blockchain Governance SystemsGovernance is one of the primary features of decentralized blockchain networks. Users come to consensus, or at least majority agreement, on the management of decentralized protocols. The unique features of blockchain governance systems offer many benefits, and a number of risks.
Technology analysisAptos Capture The Flag - MOVEment 2022CTF MOVEment is a contest hosted on Aptos that offers participants the chance to learn about Move – a programming language used to build secure smart contracts, and the differences between Move-compatible blockchains.
Vulnerability researchHow to Secure NFTs: Part Two - NFT Smart Contract SecurityIn Part Two of this series on NFT security, we examine some of the most common smart contract bugs that expose NFT projects to security vulnerabilities.
Technology analysisAI-Powered Code Auditing – Using ChatGPT to Capture the FlagCan AI tools be leveraged to audit smart contract code? We applied ChatGPT to a recent Capture the Flag competition to see how well it would fare.
Vulnerability researchHow to Secure NFTs: Part OneNon-fungible tokens (NFTs) are one of the newest and most popular applications of Web3 technology. Their specific security considerations are similar to other cryptocurrencies and tokens, but there are a couple of important differences worth exploring.
EducationalAn Introduction to the Cairo Programming LanguageEthereum layer 2 scaling solutions are rapidly evolving, and zero-knowledge rollups are one of the most exciting developments in the space. This article examines StarkNet - a general purpose ZK-rollup - and the programming language it uses: Cairo.
Technology analysisMove Capture the Flag Competition RecapMove is a programming language specifically designed for building secure smart contracts that can be formally verified. Recently, Sui hosted a Capture the Flag competition on its developer testnet. In this article, we run through each of the challenges and their solutions.
The Contest includes four challenges. In the followings, we will introduce them one by one:
Challenge 1 - CheckIn
Challenge 2 - SimpleGame
Challenge 3 - FlashLoan
Challenge 4 - MoveLock