(no title)
bennettnate5 | 10 months ago
I'm curious how they decided whether an implementation had a vulnerability. Did they use formal methods to test for the absence of panics (maybe something like Kani)? Or was it manual code inspection and/or fuzzing? If the latter, this comparison is unfair in that the developers got to test their code on its evaluation criteria before it was evaluated and correct their mistakes (similar to training an ML model on the test set).
No comments yet.