RustBelt: Securing the Foundations of the Rust Programming Language
Proceedings of the ACM on Programming Languages, 2017 · paper · Computer science
Gives the first formal, machine-checked safety proof for a language representing a realistic subset of Rust. The proof is extensible: each library using unsafe features must meet a verification condition, which the authors checked for several important Rust libraries.
Checked: PDF from people.mpi-sws.org, fetched 4 Oct 2026. Page numbers are those of that PDF.
5 findings
Substance Fig. 1, rule C-split-own reads "E; L ⊢ p ◁ own_n τ1 × τ2 ⇔ctx p.0 ◁ own_n τ1, ◁ own_n τ2". The second type assignment has no path before ◁, and the rule also lacks the "Γ |" prefix that the other rules carry.
- p. 15 Fig. 1, rule C-split-own
p.0 ◁ownn τ1, ◁ownn τ2
- p. 15 Fig. 1, rule C-split-own
p.0 ◁ own_n τ1, ◁ own_n τ2
Only the authors can say what is right here.
Judge's note: I looked at the crop and at the full page 15. In the typeset rule there is nothing between the comma and "◁ own_n τ2", so this is not an extraction artefact. Type assignments have the form p ◁ τ, so the context on the right is ill-formed as printed. The missing path is presumably the offset of the second component, e.g. p.size(τ1). The rule is also the only one in the group printed without the "Γ |" prefix. The fix looks like a typesetting slip, but only the authors can say what was intended, and the rule as printed is not a well-formed equivalence.
Second check: another model agreed
Report a problem with this finding
Substance Fig. 2, rule F-consequence has the premise "Γ | E; L′ | K′; T′ ⊢ F" but the conclusion "Γ | E; L | K; T ⊢ F". No premise relates L′ to L, so L′ is unconstrained.
- p. 16 Fig. 2, rule F-consequence
Γ | E; L′ | K′; T′ ⊢F
Only the authors can say what is right here.
Judge's note: I looked at the crop of page 16. The premises are Γ | E; L ⊢ T ⇒ctx T′, then K′ ⊆ K, then Γ | E; L′ | K′; T′ ⊢ F. L′ appears nowhere else in the rule. My own reworking: Lalive-local (Fig. 1, p.15) needs κ ⊑l κ̄ ∈ L and that every κi in κ̄ is alive. Choose L′ = L, α ⊑l [] where α is not alive under L. Then E; L′ ⊢ α alive holds with no premises, so the body could be typed as if a lifetime that has ended were still alive. The rule as printed therefore admits arbitrary local lifetime contexts. The likely fix is to drop the prime, or to add a side condition relating L′ to L, but that is for the authors to say.
Second check: another model agreed
Report a problem with this finding
Reference or label Two different ESOP 2017 entries carry the same DOI: Charguéraud and Pottier, "Temporary read-only permissions for separation logic", and Tassarotti, Jung and Harper, "A higher-order logic for concurrent termination-preserving refinement", both print "https://doi.org/10.1007/978-3-662-54434-1_10".
- p. 32 References, Charguéraud and Pottier 2017
https://doi.org/10.1007/978-3-662-54434-1_10
- p. 34 References, Tassarotti, Jung, and Harper 2017
In ESOP (LNCS). https://doi.org/10.1007/978-3-662-54434-1_10
- p. 34 References, Tassarotti, Jung and Harper 2017
https://doi.org/10.1007/978-3-662-54434-1_10
Only the authors can say what is right here.
Judge's note: Read the crops of PDF pages 32 and 34. Both entries print the identical DOI string ending _10. They are distinct chapters of the same proceedings volume, and a third chapter from that volume (Krebbers et al. 2017a, text line 2003) has suffix _26, so the suffix is per chapter and one of the two entries must be wrong. The duplication is established from the PDF alone. Which entry is wrong, and the correct DOI, cannot be settled from the files; one reviewer's suggestion of _29 for Tassarotti et al. is from memory and unverified.
Second check: another model agreed
Report a problem with this finding
Wording "ownership of the data is considered to have moved, and thus no longer available in the callee" should say "caller": the function receiving ownership (send) is the callee, and it is the caller that loses access.
- p. 6 §2.1, paragraph after the code listing
ownership of the data is considered to have moved, and thus no longer available in the callee
- p. 6 Sec 2.1, paragraph after the code example
no longer available in the callee
Judge's note: The crop shows "available in the callee". The preceding sentence says "When ownership is passed to a function (e.g., send), the function receives a shallow copy of the data", so the callee is the one that has the data; the next sentence ("if both threads were to use the vector, they could end up racing") confirms the sender/caller is meant. Wrong word with an evident fix; the surrounding text makes the intended meaning clear, hence S3 not S1.
Second check: another model agreed
Report a problem with this finding
Wording "the full type of push is given by for<'c> push(&'c mut Vec<i32>, i32)" uses the function name where the keyword fn belongs; it should read for<'c> fn(&'c mut Vec<i32>, i32).
- p. 9 §2.4, paragraph 'Lifetimes were not visible...'
for<'c> push(&'c mut Vec<i32>, i32)
- p. 9 §2.4, type of index_mut for comparison
for<'b> fn(&'b mut Vec<i32>, usize) -> &'b mut i32
- p. 7 §2.2, type of push
fn(&mut Vec<i32>, i32) -> ()
Judge's note: Page 9 image and crop show "for<'c> push(...)" with push typeset in the green identifier font, while the type of index_mut on the same page is written "for<'b> fn(&'b mut Vec<i32>, usize) -> &'b mut i32". The text calls it a "full type", so fn is intended.
Second check: another model agreed
Report a problem with this finding
11 minor (typos and the like; most checked by the judge only)
Wording Section 1.1 lists Ynot among "substructural type systems like Ynot [Nanevski et al. 2008], Alms [...], and Mezzo", while Section 8 places it in "a related but very different line of work, systems like Ynot [Nanevski et al. 2008], FCSL [...], and F* [...] integrate variants of separation logic into dependent type theory", contrasted with the substructural systems.
- p. 2 Section 1.1
substructural type systems like Ynot [Nanevski et al. 2008]
- p. 29 Section 8 Related Work
systems like Ynot [Nanevski et al. 2008], FCSL [Nanevski et al. 2014], and F∗[Swamy et al. 2016] integrate variants of separation logic into dependent type
Judge's note: Read both crops. The two passages classify Ynot differently, and Section 8 explicitly contrasts the two groups (Mezzo is said to sit "between these two approaches"). The intro list is illustrative and loose, so this is a minor consistency point, not an objective error.
Second check: another model agreed
Report a problem with this finding
Typo Stray comma: "This proof is "extensible" in the sense, that whenever you have a new library" should read "in the sense that whenever".
- p. 4 paragraph after the list of three proof parts
in the sense, that whenever you have a new library
Judge's note: The crop shows the comma after "sense". The paper writes "in the sense that" without a comma elsewhere (e.g. page 29, "modular in the sense that the authors"). Cosmetic punctuation.
Second check: none (judge only)
Report a problem with this finding
Typo Missing word: "Rust's approach to guaranteeing the absence of races and other memory safety is to rule out the combination of aliasing and mutation" lacks a noun after "memory safety" (e.g. "violations" or "issues").
- p. 7 §2.3, first sentence
guaranteeing the absence of races and other memory safety is to rule out
- p. 7 §2.3, first sentence
the absence of races and other memory safety is to rule out
Judge's note: The crop of the first sentence of Section 2.3 shows the wording as quoted. As printed it reads as the absence of memory safety; a noun has dropped out.
Second check: none (judge only)
Report a problem with this finding
Typo The continuation type for k is written without a binder, "k ◁ cont(ϝ ⊑l []; r ◁ own (() + &α mut int), x ◁ own ↯1)", whereas the form used elsewhere is cont(L; x̄. T) and ret is written "cont(ϝ ⊑l []; r. r ◁ own ...)".
- p. 17 Section 3.3, text after F-letcont
k ◁cont(ϝ ⊑l []; r ◁own (() + &α
- p. 13 Section 3.3, types and contexts grammar
K ::= ∅| K,k ◁cont(L;x. T)
Judge's note: Page 17 image and the Fig. 3 crop show k's type with no binder and ret's with "r.". k is declared as "letcont k() := ..." with no arguments, so the binder list is empty and omitting the dot is a natural shorthand; r and x are bound in Γ. A minor notational inconsistency where either form could be legitimate.
Second check: none (judge only)
Report a problem with this finding
Typo Typo: "The lifetime ϝ here is a binder than can be used in E" should read "a binder that can be used in E".
- p. 14 §3.3, paragraph on function types
The lifetime ϝ here is a binder than can be used in E
- p. 14 §3.3, function types paragraph
is a binder than can be used in
- p. 14 Function types paragraph
is a binder than can be used in E
Judge's note: Page 14 image and crop show "than". Plain misspelling.
Second check: none (judge only)
Report a problem with this finding
Typo In the example function type "∀α. fn(ϝ : ϝ ⊑ α; &α mut int) → ()" the external lifetime context is written with plain ⊑, whereas elements of E are written with ⊑e elsewhere ("E1 := ϝ ⊑e α" on the same page, and rule Lincl-extern).
- p. 14 §3.3, paragraph on function types
fn(ϝ : ϝ ⊑α; &α
- p. 14 §3.3, initial contexts
E1 := ϝ ⊑e α
Judge's note: The crop shows no subscript e in the function type; a few lines below on page 14 the same constraint is printed "ϝ ⊑e α", and Lincl-extern on page 15 uses "κ ⊑e κ′ ∈ E". Plain ⊑ is the derived inclusion judgment. Minor notational slip; the meaning is clear.
Second check: none (judge only)
Report a problem with this finding
Typo Several judgments in Fig. 1 omit the "Γ |" prefix of the declared judgment forms: the conclusion of Lalive-incl ("E; L ⊢ κ′ alive"), the second premise of Lalive-local ("∀i. E; L ⊢ κi alive"), C-split-own ("E; L ⊢ p ◁ own_n τ1 × τ2 ...") and the conclusion of S-sum-assgn ("E; L | p1 ◁ τ1, p2 ◁ τ ⊢ ..."), which also omits the "x." binder after ⊣.
- p. 15 Fig. 1, rule Lalive-incl (conclusion)
E; L ⊢κ′ alive
- p. 15 Fig. 1, rule Lalive-local (premise)
∀i. E; L ⊢κi alive
- p. 15 Fig. 1, rule S-sum-assgn (conclusion)
E; L | p1 ◁τ1,p2 ◁τ ⊢p1
- p. 15 Fig. 1, C-split-own
E; L ⊢p ◁ownn τ1 × τ2
Judge's note: Page 15 image: the section headers declare "Γ | E; L ⊢ κ alive" and "Γ | E; L | T ⊢ I ⊣ x. T2", and the other rules (including the premises of Lalive-incl) carry "Γ |"; the four places listed do not. Page 17 running text also abbreviates to "E; L ⊢ α alive", so this is harmless shorthand applied inconsistently. Cosmetic.
Second check: none (judge only)
Report a problem with this finding
Typo Number disagreement: "Both of our continuation expect the local lifetime context at their call site to be ϝ ⊑l []" should read "Both of our continuations expect".
- p. 18 §3.3, first paragraph of the page
Both of our continuation
- p. 18
Both of our continuation expect the local lifetime context at their call site
Judge's note: The crop of the top of page 18 shows the singular "continuation" after "Both of our" with the plural verb "expect"; the two continuations ret and k are meant.
Second check: none (judge only)
Report a problem with this finding
Typo Subject-verb disagreement: "The only properties that hold for &T in general is that it can be created from a &mut T, it is Copy, it has size 1, and its values have to be memory locations" should read "are that".
- p. 21 §4.3, first paragraph of the page
The only properties that hold for &T in general is that
Judge's note: Read the crop of PDF page 21. The sentence is printed as quoted, with the plural subject "properties" and the singular verb "is", followed by a list of four properties. Grammar slip only; meaning unaffected.
Second check: none (judge only)
Report a problem with this finding
Typo Missing article: "Assume we have a fractured borrow of lifetime token for another lifetime κ′" should read "of a lifetime token".
- p. 25 §5.3.1
Assume we have a fractured borrow of lifetime token for another lifetime
Judge's note: Read the crop and the full image of PDF page 25 (§5.3.1). The sentence is printed as quoted. The next sentence ("That is, assume Φ(q′) = [κ′]q′") shows a single token is meant, so the singular count noun needs an article. Cosmetic.
Second check: none (judge only)
Report a problem with this finding
Typo Notation clash on one page: the prose says "we get Φ(q) for some unknown fraction q", but in rule LftL-fract-acc (Fig. 5) q is the fraction of the lifetime token [κ]q and the unknown content fraction is q′ ("∃q′. ▷Φ(q′)").
- p. 25 §5.3, third paragraph
we get Φ(q) for some unknown fraction q
- p. 25 Fig. 5, rule LftL-fract-acc
∃q′. ▷Φ(q′) ∗
Judge's note: Read the full image of PDF page 25. Fig. 5 prints the rule with [κ]q on the left and ∃q′. ▷Φ(q′) on the right; the §5.3 prose names the existential fraction q. §5.3.1 lower on the page uses Φ(q′), matching the rule. The prose q is an informally bound variable, so nothing is wrong mathematically, but the symbol is reused for a different quantity than in the rule beside it. Either form could stand; changing the prose to q′ would remove the clash.
Second check: none (judge only)