Security1 publisher2 min readPublished
Trail of Bits spent six months having agents build MASM tooling before reviewing Miden's VM
Six months before the review of Miden's zero-knowledge VM began, Trail of Bits set its agents to writing developer tooling for the project's custom assembly language, then reviewed the code with it.
The Watch · Security desk
What happened
- The Miden team came to Trail of Bits in late 2025 asking for a review of parts of its zero-knowledge virtual machine before the project launched.
- The implementation was not feature complete, so the firm had six months of lead time and used it to have agents build an LSP server, a decompiler, a static analysis engine and a Lean model of the VM executor.
- The tooling turned up an unvalidated prover-supplied input that would let a malicious prover forge Falcon signatures and steal funds from Miden account holders.
- The Lean model yielded 95 machine-checked correctness proofs covering a large component of the Miden core library.
- Claude produced a working language server and VS Code extension in a few days, with syntax highlighting, goto definition, reference finding and procedure docstrings on hover.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- capability A review team willing to spend agent time can now build the IDE layer itself, so deep review of a bespoke architecture no longer waits on the vendor shipping developer tooling.
- constraint Because MASM analysis failures travel upward, a decompiler's output for any procedure is only as sound as the least analyzable call beneath it. That caps what automated review can conclude on its own.
- cost The client of a pre-launch audit funds half a year of tool building before the first bug report arrives, and that spend is only available to projects whose code is late.
Decompiling hand-written MASM is harder than the textbook stack-machine problem, which is well studied [19]. Most procedures in the Miden core library have no declared signature, and the number of inputs and outputs has to be inferred from context [11]. Procedures do not follow a well-defined calling convention either, and the net stack effect of a call generally cannot be determined statically; an analysis failure at one call site propagates up the chain [12]. While-loops need not be stack neutral. The loop condition can sit in a different stack slot on each iteration [13]. Every instruction reads its operands off the stack and writes the result back to the top, and a procedure's inputs and outputs stay implicit in the source [7].
The code in scope is a small set of cryptographic primitives in the Miden core library, written in that custom assembly language [2]. When the engagement started the project had very little in the way of IDE support, language server, or linter [8]. The implementation was not yet feature complete, so the firm had six months of lead time [3]. It wrote that it asked itself, "What could we spend our time and tokens on to make sure that the review would root out as many bugs as possible in the codebase?" [14]
Later additions to the language server were specific to MASM: inline instruction documentation, and the stack effect of each instruction displayed in the editor [10]. That display gives a reviewer the operand counts the source text leaves implicit [7]. The Lean work ran at roughly 16 machine-checked proofs a month across the six-month window [17].
Trail of Bits is pushing back on a kind of post it has published itself. Security firms, itself among them, have published posts about pointing an agent harness at a codebase and counting the bugs; the firm's position is that agents building custom tooling and formal models before code review starts is what raised the quality and depth of this one [15]. The account is the firm's own, published 18 September 2026 [16]. Trail of Bits did not disclose what the tokens or engineer hours cost, and no parallel review was run without the tooling [18].
What to watch
- Whether the unvalidated prover input was fixed before Miden's launch, and whether the team publishes an advisory for it.
- Whether Trail of Bits releases the MASM language server, decompiler, static analyzer or Lean model for outside reviewers to use.
- Whether the 95 proofs are extended past the one core library component they currently cover.