30
42
30
55
30
55
30
30
There Is No Patch Tuesday on the Blockchain: Why Solidity Developers Need Fusion-Grade AppSec Before They Deploy
Checkmarx argues Solidity developers need pre-deployment AppSec because disclosure-to-weaponization time has collapsed from 840 days to 1.6 days.
A Checkmarx write-up contrasts traditional software patch cycles with blockchain development, where there is no Patch Tuesday and fixes require on-chain upgrades. It cites stats that median disclosure-to-weaponization time collapsed from 840 days to 1.6 days and that 80% of exploitations now occur on or before disclosure day. The piece advocates fusion-grade application security for Solidity teams before contracts deploy.
30
CertiFlash: A Formal Verification Framework for Flash Translation Layers in Computational Solid State Drives
CertiFlash provides machine-checked formal verification of SSD flash translation layers, proving isolation, integrity, and ownership invariants to prevent tenant data leaks.
CertiFlash is an open-source formal verification framework for Flash Translation Layers (FTL) in computational SSDs, mechanized in the Rocq proof assistant. It shows that a faulty FTL can corrupt device state at five surfaces (e.g., leaking data between tenants or dropping integrity tags), demonstrated on a DaisyPlus OpenSSD. Designers prove once that every operation of a general FTL model preserves a global invariant covering mapping, isolation, integrity, ownership, and allocation; new designs need only discharge five hypotheses. Across four case studies, added effort was 27-3,231 lines against a 16,489-line framework.
25
55
30
60
55
57
30
35
42
30
57
42
IntentFuzz: A Protocol-Aware Fuzzer for Automated Invariant Violation Detection in Intent-Based Cross-Chain Bridges
IntentFuzz protocol-aware fuzzer recovers bridge structure from unannotated Solidity and confirmed 22 invariant violations across 24 real-world deployments.
IntentFuzz formalizes a taxonomy separating invariant violations from settlement exposures in intent-based cross-chain bridges, then recovers a bridge's intent structure and deposit/fill function roles from unannotated Solidity source. It classified deposit and fill functions with 100% recall and 82% combined precision, and achieved 100% recall and precision on 23 planted-bug mutants. Across 24 real-world deployments it confirmed 17 genuine invariant violations with heuristic-only input generation, rising to 22 with its LLM-assisted tier, spanning eight vulnerable GitHub repositories with findings reproducible against public deployed bytecode.
50
42
30
42
60
57
55
30
30
55
30
42
30
45
30
47
55
60
55