Formal verification
Tests sample the states you thought of. A proof covers the ones you did not.
What it is
Testing shows the presence of behaviour at the points you sampled. It cannot show the absence of a failure somewhere you did not look, and the exploited state is almost always one nobody thought to write a test for.
Formal verification states a property in mathematics (total supply always equals the sum of balances; no path lets a caller withdraw more than they deposited) and then proves it holds across every reachable state, or produces the counterexample where it does not.
What we examine
- Critical invariants specified with you, in plain language first and mathematics second.
- Proofs over the core accounting: supply, balances, collateral, share price.
- Access-control properties proved, not sampled: no path reaches this function without this role.
- Counterexamples produced where a property fails, as a concrete sequence of calls.
- Symbolic execution and bounded model checking where a full proof is not warranted.
- Specifications handed over, so the properties become part of your CI rather than a one-off artefact.
What you get
The specification: every property we proved, written so your engineers can read it.
The proofs themselves, reproducible on your side.
A counterexample for each property that failed, as a call sequence you can replay.
Specifications wired into your test suite so a future change that breaks them fails the build.
How the engagement runs
- 01
Specify
We agree the properties that actually matter. This step is most of the value. Fixed quote.
- 02
Model
The contract is expressed in a form a solver can reason about, faithfully.
- 03
Prove
Each property is proved, or a counterexample is produced showing where it fails.
- 04
Hand over
Specifications and proofs delivered runnable, so they keep working after we leave.
What we cover
Languages
- Solidity
- Vyper
- Rust
- Move
- Cairo
- Go
- TypeScript
- Huff
- Yul
Chains
- Ethereum
- Solana
- BNB Chain
- Polygon
- Avalanche
- Arbitrum
- Base
- TRON
- Optimism
- Cardano
- Polkadot
- Cosmos
- NEAR
- Aptos
- Sui
- TON
- Hedera
- Algorand
- Stellar
- Starknet
- ZKsync Era
- Linea
- Sei
- Sonic
- Scroll
- Mantle
- Injective
- Cronos
- Celo
- Gnosis
- Fantom
- Kaia
- Ronin
- Immutable
- Blast
- Berachain
- Monad
- Hyperliquid EVM
- Stacks
- Rootstock
- Kava
- Osmosis
- MultiversX
- Conflux
- Telos
- Theta
- Chiliz
- XDC Network
- Filecoin FVM
- Ontology
- WEMIX
- Fuel
- Taiko
- Polygon zkEVM
- BOB
- Fraxtal
- Mode
- ZetaChain
- Metis
- Manta Pacific
- IOTA EVM
- Neo X
- Unichain
- World Chain
- Soneium
- Abstract
- Ink
- Movement
- Plume
- Etherlink
- EOS
- Flow
- Zilliqa
- Harmony
- Moonbeam
- Astar
- Aurora
Not listed? Ask. If it runs smart contracts, we almost certainly review it.
Questions we get asked
Does a proof mean the contract cannot be exploited?
No, and this is the honest limit. A proof shows the stated properties hold in the modelled system. If the property was the wrong one, or the model omits something real, an exploit can still exist. Proofs remove doubt about what they cover, and nothing else.
Is this worth it for our contract?
It is worth it for core accounting and access control in systems holding meaningful value. For a standard token or a short one-off contract it usually is not, and we will tell you that rather than sell it.
Do we need it if we have an audit?
They answer different questions. An audit asks what could go wrong anywhere; verification proves that a specific critical thing cannot. Most teams buy the audit first and verify only the core.
What do you need from us?
Time from an engineer who understands the intended behaviour. Writing the right property is a conversation, not a deliverable we can produce alone.
Often bought with
Web3 and protocol audit
Line-by-line review of contracts, chain layer and upgrade paths, with proof-of-concept for every finding.
Deployment verification
We check that what reached production matches what was actually reviewed.
Build, harden and maintain
Engineering that implements the security work rather than recommending it.
Tell us what you are building and when you launch. Fixed quote in 48 hours.
Get a fixed quote