Show Me The Money: An Exercise in Proof-Driven Software Understanding

2026-07-17

AI Summary

This work addresses the challenge of formally verifying mature, safety-critical industrial C++ codebases by strategically integrating theorem proving (PVS) and model checking (SeaHorn), augmented with large language models to assist in specification construction. The approach is applied to the core order book algorithm of Stellar’s SDEX blockchain module. The verification effort successfully establishes critical correctness properties—including state consistency and unreachability of erroneous states—uncovers discrepancies between documentation and implementation, and produces reusable formal artifacts. These assets enable continuous validation of invariants during future code evolution, thereby enhancing long-term reliability and maintainability of the system.

Abstract

We present a case study on proof-driven software understanding of mature, security-critical infrastructure. While formal methods are traditionally applied during the design phase, we present our experience applying formal reasoning onto a mature industrial C++ codebase. We focus on a formal analysis of the core algorithm that implements the Stellar blockchain's SDEX order book. By combining large language models (LLMs), Prototype Verification System (PVS), and SeaHorn, we are able to prove core properties of the production codebase. Our approach also identified an inconsistency in documentation related to the reachability of an exception location. Most importantly, however, we produce artifacts that make it easy for code changes to be checked against established invariants. This work demonstrates how the strategic combination of theorem proving and model checking provides a path for delivering robust assurance to legacy systems.

Problem

• proof-driven software understanding
• formal verification
• legacy code
• security-critical systems
• blockchain

Innovation

• proof-driven software understanding
• formal verification
• legacy system assurance
• large language models
• theorem proving