2026-11-04 –, Lightning Stage
A developer signature on the binary proves who published it, not that it was built from the public source code. In this session, we explore the approaches to verify opaque binaries in a fairly decentralised manner.
In this lightning talk, I'd like to share ideas and results from my recent exploration in the opaque binary verification.
Talk TLDR
1. Problem: in ecosystems like apple, devs sign compiled binaries with their certificate/pvt key. in some ecosystems like npm, crates, and more user trust that the platform and dev both are legit.
2. How hackers are exploiting the gap.
3. Approaches to binary verification:
- self build (no trust assumptions, CPU intensive, hardly anyone does),
- delegated build (google's oss rebuild tool)
- zk proof of compilation (5000x overhead from feb 2026 study)
- builds in TEE
- social layer attestations.
4. How social layer attestation can be leveraged today in ethereum consensus/execution client binaries, various design vectors, positives and negatives of this approach.
5. PoC screenshots/GIF verifying an update to ethereum client in a fairly decentralised way.
Currently I work as a protocol engineer contributing to Ream client.
Previously I worked at PSE, EF's Javascript Team and DeFi startups.
I am a proud crypto-native based in Mumbai, India. Fun fact: I got a UK visitor visa (a relatively tough one for us) by showing a wallet screenshot as proof of funds!