BEGIN:VCALENDAR
VERSION:2.0
PRODID:-//pretalx//cfp.ducttape.events//ethereum-zurich-2026//speaker//GZ33
 LN
BEGIN:VTIMEZONE
TZID:CET
BEGIN:STANDARD
DTSTART:20001029T040000
RRULE:FREQ=YEARLY;BYDAY=-1SU;BYMONTH=10
TZNAME:CET
TZOFFSETFROM:+0200
TZOFFSETTO:+0100
END:STANDARD
BEGIN:DAYLIGHT
DTSTART:20000326T030000
RRULE:FREQ=YEARLY;BYDAY=-1SU;BYMONTH=3
TZNAME:CEST
TZOFFSETFROM:+0100
TZOFFSETTO:+0200
END:DAYLIGHT
END:VTIMEZONE
BEGIN:VEVENT
UID:pretalx-ethereum-zurich-2026-BHFH3W@cfp.ducttape.events
DTSTART;TZID=CET:20260410T140000
DTEND;TZID=CET:20260410T142000
DESCRIPTION:Decentralized Finance (DeFi) has turned blockchains into financ
 ial infrastructure\, allowing anyone to trade\, lend\, and build protocols
  without intermediaries\, but this openness exposes pools of value control
 led by code. Within five years\, the DeFi ecosystem has lost over 15.75B U
 SD to reported exploits. Many exploits arise from permissionless opportuni
 ties that any participant can trigger using only public state and standard
  interfaces\, which we call Anyone-Can-Take (ACT) opportunities. Despite o
 n-chain transparency\, postmortem analysis remains slow and manual: invest
 igations start from limited evidence\, sometimes only a single transaction
  hash\, and must reconstruct the exploit lifecycle by recovering related t
 ransactions\, contract code\, and state dependencies.\nWe present ClaraHac
 ks\, a Large Language Model (LLM) agentic postmortem system that uses tool
  calls to reconstruct live ACT attacks from limited evidence. Starting fro
 m one or more seed transactions\, ClaraHacks recovers the exploit lifecycl
 e\, derives an evidence-backed root cause\, and generates a runnable\, sel
 f-contained Proof of Concept (PoC) that deterministically reproduces the i
 ncident. ClaraHacks self-checks postmortems by encoding incident-specific 
 semantic oracles as executable assertions.\nTo evaluate PoC correctness an
 d quality\, we develop PoCEvaluator\, an independent agentic execution-and
 -review evaluator. On 114 incidents from DeFiHackLabs\, ClaraHacks produce
 s an expert-aligned root cause and an executable PoC for 105 incidents\, a
 chieving 92.11% end-to-end reproduction. Under PoCEvaluator\, 98.1% of Cla
 raHacks PoCs avoid hard-coding attacker addresses\, a +22.9pp lift over De
 FiHackLabs. In a live deployment\, ClaraHacks delivers validated root caus
 es in 40 minutes and PoCs in 59 minutes at median latency. ClaraHacks's or
 acle-validated PoCs enable attack imitation\, improving coverage by 15.6% 
 and 65.5% over STING and APE.\n\nAcademic paper with all technical details
 : https://arxiv.org/abs/2602.01317
DTSTAMP:20261013T172930Z
LOCATION:Limmat (Y15-G-60)
SUMMARY:ClaraHacks - Real-time DeFi Attack Postmortem + Proof of Concept Ge
 neration - Arthur Gervais
URL:https://cfp.ducttape.events/ethereum-zurich-2026/talk/BHFH3W/
END:VEVENT
END:VCALENDAR