Track papers across labs, topics, and trends.
Search papers, labs, and topics across Lattice.
COBALT-TLA is a neuro-symbolic system that combines an LLM with the TLC model checker to automatically verify TLA+ specifications of cross-chain bridges. The LLM generates TLA+ specifications, which are then checked by TLC, and error traces are fed back to the LLM to refine the specifications. Evaluated on three cross-chain bridge targets, COBALT-TLA consistently finds vulnerabilities, including an "Optimistic Relay Attack" not present in human baselines, within a few iterations.
LLMs, guided by deterministic model checker feedback, can autonomously discover novel vulnerability classes in complex systems, even surpassing human-written specifications.
We present COBALT-TLA, a neuro-symbolic verification loop that pairs an LLM with TLC, the TLA+ model checker, in an automated REPL. The LLM generates bounded TLA+ specifications; TLC acts as a semantic oracle; structured error traces are parsed and injected back into the model's context to drive convergence. We evaluate the system against three cross-chain bridge targets, including a faithful model of the Nomad $190M exploit. COBALT-TLA reaches a verified BUG_FOUND state in at most 2 iterations on all targets, with TLC execution consistently below 0.30 seconds. Notably, the system autonomously discovers an unprompted vulnerability class -- the Optimistic Relay Attack -- not present in the human-written baseline specification. We argue that deterministic prover feedback is sufficient to neutralize LLM hallucination in formal methods, transforming zero-shot code generation into a convergent proof-finding strategy.