In this blog post, we will take you on a tour of how we developed Medjai, a new symbolic execution tool for finding bugs in Cairo programs. We’ll begin our journey with a quick tour by helicopter over Cairo. On the way, we’ll peer out at the grand famous OpenZeppelin…

In the previous blog posts, we introduced static program analysis and discussed how it can identify security vulnerabilities in smart contracts. In the next few blog posts, we will talk about program verification and discuss what it can add over static analysis. As we saw in the previous blog post…

In the previous blog posts, we looked at how static analysis works at a high level. In this blog post, we look into three examples of common smart contract vulnerabilities and explain how static analysis can help detect them. Reentrancy One of the oldest DeFi attacks (responsible for the DAO Hack…

In the previous blog post, we talked about what the basic idea behind static analysis is and how it can help uncover security vulnerabilities. In this blog post, we’ll dive a little more into how (sound) static analysis actually works. Static Analysis via Abstract Interpretation At a high level, most static analyzers are based on…

If you are interested in blockchain technology, you’ve likely heard of many incidents in which large amounts of funds were stolen due to an attacker exploiting some vulnerability in the application code. For example, the infamous DAO hack from 2016 allowed attackers to withdraw more money than they were eligible…