Developing provably correct Rust code with Verus

Amazon Science described Verus, an open-source automated program verifier for Rust that mechanically checks code against formal mathematical specifications for all possible inputs, going beyond traditional testing to catch corner cases. Developers annotate Rust source code directly with preconditions and postconditions using Rust-like syntax, and normal Rust compilers ignore these annotations, allowing Verus-annotated code to be consumed by both verified and unverified projects, including those using Cargo.

Verus handles low-level proof construction automatically while developers provide high-level guidance, such as inductive proofs or loop invariants. It uses multiple solvers to discharge proof obligations, typically returning feedback in under a second. At the project level, Verus can verify complex projects with thousands of lines of code and proof in the time some prior verifiers took for individual functions.

The tool enables mathematical verification of Rust's unsafe code and concurrent code, including custom locking schemes. It also supports adding invariant properties to locks and proving lock implementations correct.

Amazon says it was a founding member of the Rust Foundation and uses Rust extensively for projects including Firecracker, which powers AWS Lambda and AWS Fargate, its serverless distributed SQL database, and the Nitro Isolation Engine, which enforces virtual-machine isolation for the Nitro hypervisor. Amazon has used Verus to prove correctness of key primitives in the Nitro Isolation Engine and a number of critical pieces of infrastructure.

Like all program verifiers, Verus's guarantees rely on the correctness of Verus itself, top-level specifications, bottom-level run-time assumptions, and the compiler toolchain.

Open-source projects using Verus include Vest for binary data format parsing and serialization, Verdict for x.509 certificate validation, CapybaraKV for persistent-memory log crash safety, the Atmosphere microkernel, Anvil for Kubernetes controller correctness and liveness, and CortenMM for concurrent memory management. Verus is free and open source, developed by a distributed collaboration of academic and industrial researchers.