Verus: Verifying Rust Programs using Linear Ghost Types (extended version)

• Main Authors: Lattuada, Andrea, Hance, Travis, Cho, Chanhee, Brun, Matthias, Subasinghe, Isitha, Zhou, Yi, Howell, Jon, Parno, Bryan, Hawblitzel, Chris
• Format: Journal Article
• Language: English
• Published: 09-03-2023
• Subjects: Computer Science - Logic in Computer Science; Computer Science - Programming Languages
• DOI: 10.48550/arxiv.2303.05491

The Rust programming language provides a powerful type system that checks
linearity and borrowing, allowing code to safely manipulate memory without
garbage collection and making Rust ideal for developing low-level,
high-assurance systems. For such systems, formal verification can be useful to
prove functional correctness properties beyond type safety. This paper presents
Verus, an SMT-based tool for formally verifying Rust programs. With Verus,
programmers express proofs and specifications using the Rust language, allowing
proofs to take advantage of Rust's linear types and borrow checking. We show
how this allows proofs to manipulate linearly typed permissions that let Rust
code safely manipulate memory, pointers, and concurrent resources. Verus
organizes proofs and specifications using a novel mode system that
distinguishes specifications, which are not checked for linearity and
borrowing, from executable code and proofs, which are checked for linearity and
borrowing. We formalize Verus' linearity, borrowing, and modes in a small
lambda calculus, for which we prove type safety and termination of
specifications and proofs. We demonstrate Verus on a series of examples,
including pointer-manipulating code (an xor-based doubly linked list), code
with interior mutability, and concurrent code.