Vitalik Buterin, the co-founder of Ethereum, has addressed growing concerns that artificial intelligence-driven bug hunting could overwhelm developers and create continuous exploitation opportunities within blockchain systems.
AI as a Security Enhancement
Buterin suggests that the application of AI in the near future could actually enhance the security of crypto systems. He posits that AI-assisted formal verification may become a key defense against security vulnerabilities in both crypto and broader internet infrastructure.
Formal verification involves creating mathematical proofs about software that a computer can automatically validate, as opposed to manual review by humans. While this concept has existed for decades, it has not gained widespread adoption because manually generating such proofs has been a tedious process for software developers.
Buterin argues that AI has altered this dynamic. Instead of developers writing the proofs themselves, they can utilize AI to generate both the code and the accompanying proofs. Developers would then simply verify that the final statement proven aligns with their intended outcome.
Addressing Potential Vulnerabilities
Buterin considered a scenario where AI models become powerful enough to automate the discovery of bugs in existing code. He then explored the implications for systems where a single flaw can lead to significant financial losses for users.
His response was that end-to-end formal verification allows for a mathematical proof that a piece of code behaves exactly as intended. Consequently, a sufficiently advanced AI searching for flaws would be examining code that has already been proven to be free of them.
He also highlighted specific Ethereum infrastructure projects currently implementing this approach. These include Arklib, which is working towards a fully formally verified STARK implementation, and evm-asm, which is building an EVM written in low-level RISC-V assembly and verifying its correctness against a human-readable reference implementation.
Useful AI Models
Regarding the specific AI models useful for this purpose, Buterin cited Claude and Deepseek 4 Pro as being sufficient for writing Lean proofs.
He also mentioned Leanstral, a smaller open-weights model fine-tuned specifically for Lean, as capable of running locally and outperforming larger general-purpose models on formal verification benchmarks.
Limitations and Broader Context
Despite his optimism for formal verification, Buterin also acknowledged its practical limitations.
These include bugs in verified compilers, libraries where only a portion of the code was proven, and specifications that, while technically proven, did not accurately reflect the developer’s intended guarantees.
However, Buterin frames formal verification not as a replacement for all security practices, but as a powerful tool within a broader trend toward reducing bugs per line of code.
This discussion is particularly relevant given the recent security incidents in the crypto sector. On the day Buterin’s post was published, the sector was dealing with a third major exploit in just four days, after a hacker stole over $76 million worth of crypto from the cross-chain bridge of the Echo Protocol.
Prior to that, reports emerged regarding a hack on THORChain, resulting in losses of over $10 million.
Another attack targeted the Verus-Ethereum Bridge, where a hacker exploited a lack of validation checks to steal $11.58 million. This type of specific, localized flaw is one that formal proof checks could potentially identify.
Leave a Reply