Problem
Research questions and friction points this paper is trying to address.
formal verification
first-class functions
imperative programming
smart contracts
behavioral predicates
Formal Verification of Imperative First-Class Functions in Move
🤖 AI Summary
This work presents the first formal verification methodology for Move smart contracts supporting imperative first-class functions—functions that can be passed, stored, and dynamically dispatched. By introducing behavioral predicates and state labels into the Move specification language to capture termination behavior and pre-/post-conditions of functions, and by leveraging SMT encodings that distinguish between concrete and unknown function values, the approach enables efficient verification grounded in static memory separation. The method extends the Move Prover by integrating weakest precondition reasoning with specification inference, thereby enabling semi-automatic verification of higher-order imperative functions that mutate state. This significantly reduces annotation overhead while enhancing verification efficiency and usability, surpassing the capabilities of existing tools such as Dafny.
📝 Abstract
The Move Prover (MVP) is a formal verifier for smart contracts written in the Move programming language. Recently, Move on Aptos was extended with higher-order functions: imperative functions as first-class values that can be passed around, stored in data structs, and kept in persistent storage, enabling dynamic dispatch. This paper describes the representation of function values in the Move specification language and their implementation in MVP. We introduce behavioral predicates which characterize Move functions (aborts and pre/post conditions) by single-state or two-state predicates. We also introduce state labels for naming intermediate memory states in which expressions are evaluated and which allow to compose behavioral predicates to describe sequences of state transitions. On SMT level, function values are encoded by discriminating over the possible function values reaching a call site: when the concrete function is known, its effect is accounted for directly; when it is unknown (for example, a function parameter, or a closure loaded from storage), its behavioral predicates describe the effect. Our approach goes beyond, for example, Dafny, by supporting imperative first-class functions which can modify state via Rust-style references and global variables, and leads to more efficient SMT encodings than separation logic because of the static separation of memory enabled by Move. We further extend MVP's specification inference tool to work with function values: given arbitrary higher-order Move code, weakest-precondition analysis semi-automatically derives behavioral-predicate-based specifications, reducing the annotation burden and providing a validation pipeline for the new specification constructs.
Innovation
Methods, ideas, or system contributions that make the work stand out.
behavioral predicates
first-class functions
state labels
SMT encoding
specification inference
🔎 Similar Papers
No similar papers found.
