Ethereum Team Explains How AI Is Changing the Approach to Smart Contract Security

The Ethereum network team has published a guest series of posts from a leading Vyper developer under the pseudonym big_tech_sux, dedicated to the role of formal verification in the era of rapid artificial intelligence development.

The author argues that progress in LLMs is making mathematical proof of program correctness more accessible, and for smart contracts managing billions of dollars, formal verification is gradually becoming a necessity.

AI Is Changing the Approach to Software Verification

The series explains that formal verification is a mathematical method that allows proving the correctness of a program's operation for all possible execution scenarios, not just those covered by tests.

As an example, the author cited the function f(x) = x/2, for which one can mathematically prove that the result will never exceed the input value.

According to them, this methodology can find extremely rare bugs that are practically impossible to detect through ordinary testing.

"Formal verification can detect one case in a quadrillion that will never appear during testing, but it is precisely this case that can lead to a catastrophic failure," the author noted.

At the same time, they acknowledged that until recently, using this approach required the work of large teams of experts who created mathematical models of programs and conducted complex proofs.

In the developer's opinion, modern LLMs significantly simplify this process as we move closer to AGI.

However, the author emphasized that even with the help of AI, formal verification remains a complex and resource-intensive process. In particular, converting program code into a formal model can contain inaccuracies that affect the reliability of the results.

The Development of AI Changes the Balance Between Attack and Defense

The material notes that the development of artificial intelligence simultaneously increases the effectiveness of both defenders and attackers.

The author recalled a case where an unreleased OpenAI model was able to find zero-day vulnerabilities that allowed bypassing multiple layers of protection.

Against this backdrop, formal verification, according to the author, allows shifting the advantage in favor of defenders.

"While attackers only need to find one sequence of input data to hack a system, defenders can use formal verification to prove its resilience to all possible input data," they emphasized.

This is precisely why for critical software, particularly smart contracts managing billions of dollars in user funds, formal verification is becoming "not an option, but a necessary prerequisite."

It is worth noting that this continues a discussion previously initiated by Ethereum co-founder Vitalik Buterin regarding the use of AI for formal code verification.