ack3 at Devcon Week in Mumbai

ack3 is in Mumbai for Devcon week: two talks at DeFi Security Summit 2026 on November 1 and 2, and our team’s session at Devcon 8, which runs from November 3 to 6. Three topics: which frontier model is the best EVM auditor, what coding agents get wrong when they write fuzz tests, and what running a company without Google Workspace looks like from the inside.

DeFi Security Summit, November 1–2

DeFi Security Summit is the annual conference for DeFi security researchers, auditors, and protocol developers. The 2026 edition takes place in Mumbai in the two days before Devcon. Our team speaks there; ack3 has two talks on the program.

Which frontier model is the best EVM auditor. The talk builds on our private benchmark: nine frontier model configurations re-ran five audits whose code and reports were never published, measured against the 32 critical and high findings in the human reports. Two models cleared that baseline, Opus 5 at ultra reasoning with 35 verified findings and GPT-5.6 Sol at ultra with 33. The leaderboard is the first half of the answer. The second half is issue-level overlap: only nine of the 40 verified issues were found by all nine models, the two leaders missed the same four, and one issue was found by no model at all. The talk shows how to read a benchmark that says a model beat the human report.

Fuzzing with coding agents: what works in practice. In ack3’s manually guided fuzzing workflow, the auditor decides which state transitions and properties matter, and a coding agent turns those decisions into a runnable Python harness on Wake, then iterates on flows, invariants, and coverage. The talk is about the working boundary between the two, with the failure modes we keep finding in generated tests: expected values derived from the contract after execution, Solidity logic reproduced inside the reference model, an event checked for existence but not for its contents, revert and rounding branches never reached, and aggregate coverage mistaken for evidence that a specific path ran. It also explains why the contracts stay in Solidity while the harness is written in Python.

Devcon 8, November 3–6

Devcon 8 runs at the Jio World Centre in Bandra Kurla Complex. Our team speaks in the Privacy & Consent track on what happens when a web3 company applies its values to its own tech stack, or in Devcon’s words, “the reality of building a company without relying on Google Workspace.” ack3 runs without it today; the session is the account of how a security company got there.

Our team is in Mumbai for the whole week.