---
title: "Developing provably correct Rust code with Verus"
description: "Rust’s type system prevents many memory-safety bugs, but it does not prove that programs compute intended results, avoid leaks, or correctly handle every unsafe and concurrent operation. Verus is an open-source automated program verifier that checks Rust implementations against formal specifications for all possible inputs, using solvers to discharge proof obligations while developers provide guidance such as loop invariants. Specifications and proofs use Rust-like requires and ensures annotations written alongside the code, while ordinary Rust compilers ignore them and Verus typically returns feedback in under a second. The tool can prove properties of unsafe code, lock invariants, and concurrent systems, and Amazon has used it for key Nitro Isolation Engine primitives and other critical infrastructure."
---

# Developing provably correct Rust code with Verus

[AWS](https://yomu.fyi/company/aws) · Bryan Parno · Aug 31, 2026

**Type:** Explainer

## Summary

Rust’s type system prevents many memory-safety bugs, but it does not prove that programs compute intended results, avoid leaks, or correctly handle every unsafe and concurrent operation. Verus is an open-source automated program verifier that checks Rust implementations against formal specifications for all possible inputs, using solvers to discharge proof obligations while developers provide guidance such as loop invariants. Specifications and proofs use Rust-like requires and ensures annotations written alongside the code, while ordinary Rust compilers ignore them and Verus typically returns feedback in under a second. The tool can prove properties of unsafe code, lock invariants, and concurrent systems, and Amazon has used it for key Nitro Isolation Engine primitives and other critical infrastructure.

## Context

Rust provides strong memory-safety guarantees through its type system, but those guarantees do not establish that programs compute intended results, avoid leaking secrets, or correctly implement unsafe and concurrent behavior. The source presents formal verification as a way to provide stronger guarantees for critical Rust systems.

## Approach / What changed

Verus adds formal specifications and proofs directly to Rust source code using Rust-like requires and ensures annotations. Automated solvers discharge proof obligations, while developers provide guidance such as loop invariants; the tool also supports proofs for unsafe code, lock invariants, lock implementations, and concurrent systems.

## Takeaways

- Verus checks specifications against implementations for all possible inputs rather than only the cases covered by traditional tests.
- Verus annotations are ignored by ordinary Rust compilers, allowing annotated code to be used by verified and unverified projects, including Cargo-based projects.
- Amazon has used Verus to prove key primitives in the Nitro Isolation Engine and other critical infrastructure; open-source uses include certificate validation, persistent-memory logs, microkernels, and Kubernetes controllers.

**Tags:** [Rust](https://yomu.fyi/topic/rust)

- Source: [AWS](https://www.amazon.science/blog/developing-provably-correct-rust-code-with-verus)
- Source URL: https://www.amazon.science/blog/developing-provably-correct-rust-code-with-verus
- Ingested by Yomu: 2026-08-31T20:00:49.425Z

[Read original post](https://www.amazon.science/blog/developing-provably-correct-rust-code-with-verus)