Seems like INRIA is starting to do some formal checking of OpenSSL. Here's their page: http://prosecco.gforge.inria.fr/

Here's another OpenSSL flaw that was found with Coq, a formal prover: http://ccsinjection.lepidum.co.jp/blog/2014-06-05/CCS-Inject...