Tools For Supporting Manual Auditing At Scale
summary
CertiK runs automated toolchains plus human review to scale auditing: 1,217 projects audited in six months with 4,938 medium-or-worse issues found. Pipeline includes a relevancy matcher, source-level checkers, visual program analyzers, semantic analysis (abstract interpretation), model checking and a workflow system that runs all tools and require triage of any minor-or-above finding. A database of 60,000 findings is clustered with ML to produce about 500 clusters, guiding which new detectors to build and exposing false negatives and tool blind spots.
AI-written summary · about
related talks
41mManaging Audits for Critical Open Source Projects
14mTool Talk: CodeChecker
31mHow to Prepare for an Audit AKA Make Audits Suck Less
47mA Root Canal Static Analysis Based Audit of Zephyr
27mCatch Me If You Can: Hunting Misconfigurations Before They...
01h 00mWorkshop
32mAutomating Security Compliance at Scale
30mSmart-Contract Security 201: Auditing Lessons for Solana Founders