Creusot: a Foundry for the Deductive Verification of Rust Programs

International audienceRust is a fairly recent programming language for system programming, bringing static guarantees of memory safety through a strict ownership policy. The strong guarantees brought by this feature opens promising progress for deductive verification, which aims at proving the conformity of Rust code with respect to a specification of its intended behavior. We present the foundations of Creusot, a tool for the formal specification and deductive verification of Rust code. A rst originality comes from Creusot's specification language, which features a notion of prophecy to reason about memory mutation, working in harmony with Rust's ownership system. A second originality is how Creusot builds upon Rust trait system to provide several advanced abstraction features