creusot-rs

creusot

Rust2022–2026

creusot-rs / creusot

creusot

Creusot helps you prove your Rust code is correct.

Explore on GitHub Read Hacker News discussions

15Distinct people

17Mentions

0Explicit recommenders

2KGitHub stars

REPOSITORY AT A GLANCE

What to know before exploring

What it is

Creusot helps you prove your Rust code is correct.

GitHub

Where it is used

No documented product use was verified in the last source check.

What people are saying

No recommendation phrase was found in the indexed comments.

No classified warning is attached to this page. Read the discussions before treating silence as approval.

Also in these discussions

No other repository is repeatedly linked in the same discussions.

This week on Hacker News

Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 5:04:57 PM UTC.

No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.

Mentions over time

HN mentions by year17 dated mentions

Observed mentions: 2022-02-02 10:33:34 UTC to 2026-09-17 14:02:35 UTC.

* An incomplete calendar period is marked with an outlined bar. Its count is not directly comparable with a full period.

Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.

View mention counts and date ranges

UTC ranges include their start and exclude their end. Select a period to filter the source evidence.
Period	Start (UTC)	End (exclusive, UTC)	Mentions	Submissions	Comments
2022	2022-01-01 00:00:00 UTC	2023-01-01 00:00:00 UTC	7	1	6
2023	2023-01-01 00:00:00 UTC	2024-01-01 00:00:00 UTC	0	0	0
2024	2024-01-01 00:00:00 UTC	2025-01-01 00:00:00 UTC	6	4	2
2025	2025-01-01 00:00:00 UTC	2026-01-01 00:00:00 UTC	1	0	1
2026 (partial)	2026-01-01 00:00:00 UTC	2027-01-01 00:00:00 UTC	3	1	2

What Hacker News says

17 sources

63·Sep 17, 2026

If you found this interesting, you may also be interested to hear about some related projects with similar goals/scopes: Miri[0], Kani[1], and Creusot[2]. There looks to be some significant overlap between Verus, Kani, and Creusot but I've not used any of them so I'll refrain from trying to differentiate them. [0]https://github.com/rust-lang/miri [1]https://github.com/model-checking/kani [2]https://github.com/creusot-rs/creusot

In Developing provably correct Rust code with Verus

fanf2·May 28, 2026Submission

Creusot helps you prove your Rust code is correct

66 points · Open discussion

suis_siva·May 19, 2026

> - Is there a way to generate #[hsrs::data_type] bindings for Rust library types, or do you need to create custom wrapper types for them? At the moment, no. I'll ad this to the list of features for 0.2, totally slipped my mind, and if I remember correctly, both napi-rs and pyo3 have support for this. > - It seems like all #[hsrs::function]s are translated to return IO (since Rust functions can do arbitrary side effects). It would be great if you could (unsafely) mark functions as pure, to get pure Haskell functions without having to wrap them in unsafePerformIO. I did think through this a little bit and couldn't find a good way to implement this so decided to delay it until the next release, until I come up with some better ideas. I wanted some sort of automated mechanism to determine purity, but that, obviously, doesn't exist in Rust. T

Read the rest

here _are_ some ways to approach this -- `const fn` are pure (I think), and it would be cool if I added support for https://github.com/creusot-rs/creusot. I was thinking of walking down the AST of a function to automatically infer purity, but that seems like a whole other, order-of-magnitude larger project. I'm still not sure what to do about this (bar a simple annotation), but I'll land something for 0.2. https://github.com/harmont-dev/hsrs/issues/1 > - Both Haskell and Rust have HM type systems, so I wonder if you could also translate type classes from Rust to Haskell. Yes!! I do think that would be quite neat and I spent a little bit of time thinking through it, but I couldn't really come up with a great use-case (at least for my needs) that justified the necessity of this feature. This _might_ (probably won't) land 0.2, but it's definitely something I'm thinking about. One of the big problems that makes this quite non-trivial is monomorphization -- it's unclear what kind of specializations of a particular generic function you want in Rust. Trait objects _should_ be able to work, but I still haven't figured out the details of all of that. https://github.com/harmont-dev/hsrs/issues/2

In Show HN: Hsrs – Type-Safe Haskell Bindings Generator for Rust

sitkack·Mar 17, 2025

Speaking of https://www.why3.org/ For completeness https://github.com/creusot-rs/creusot The French were right about so many things.

In Coq-of-rust: Formal verification tool for Rust

nextaccountic·Oct 8, 2024

> further tooling. Just a heads up, Rust does have further tooling. I wish they were more widely used Here are three of them https://github.com/creusot-rs/creusot https://viperproject.github.io/prusti-dev/user-guide/ https://model-checking.github.io/kani/

In Rust is rolling off the Volvo assembly line

todsacerdoti·May 20, 2024Submission

Release Creusot 0.1 · creusot-rs/creusot

2 points · Open discussion

syrak·Apr 24, 2024

For verified Rust there is also https://github.com/creusot-rs/creusot

In Dafny is a verification-aware programming language

PaulHoule·Feb 29, 2024Submission

Creusot, a deductive verifier for Rust code

2 points · Open discussion

nextos·Feb 25, 2024Submission

Creusot, a deductive verifier for Rust code

3 points · Open discussion

varbhat·Feb 21, 2024Submission

Creusot: A deductive verifier for Rust code

3 points · Open discussion

Raphael_Amiard·Nov 7, 2022

SPARK allows you to formally prove that your code is correct according to a given specification. It can thus provides much stronger guarantees than what Rust would be able to provide. Similar technology exists for Rust, but it is much less advanced than SPARK is (https://github.com/xldenis/creusot)

In Nvidia Security Team: “What if we just stopped using C?”

gpm·Sep 13, 2022

> No support for using something like separation logic within Rust itself to verify that unsafe code upholds the invariants that the safe language expects. I think this is something we might see in the future. There are a lot of formal methods people who are interested in rust. Creusot in particular is pretty close to doing this - at least for simpler invariants https://github.com/xldenis/creusot

In A personal list of Rust grievances

sitkack·Jun 24, 2022

You often encounter this entire thread of rhetoric when someone wants to put a diversion into the central argument, yeah but it doesn't ____. But Rust does do that, match exhaustiveness, forcing the handling of errors and the type system enables things like CreuSAT [1] using creusot [2] [1] https://news.ycombinator.com/item?id=31780128 [2] https://github.com/xldenis/creusot > Creusot works by translating Rust code to WhyML, the verification and specification language of Why3. Users can then leverage the full power of Why3 to (semi)-automatically discharge the verification conditions! Units of Measure, https://github.com/iliekturtles/uom The base properties of the language enable things that can never be done in C++.

In What it feels like when Rust saves your bacon

harporoeder·Jun 17, 2022Submission

Creusot: Deductive Verification of Rust

1 points · Open discussion

zozbot234·Apr 11, 2022

> I’ve been working on a tool: https://github.com/xldenis/creusot to put this into practice Note that there are other tools trying to deal with formal statements about Rust programs. AIUI, Rust developers are working on forming a proper team or working group for pursuing these issues. We might get a RFC-standardized way of expressing formal/logical conditions about Rust code, which would be a meaningful first step towards supporting proof-carrying code directly within Rust.

In What Is Rust's Unsafe? (2019)

Showing the 15 most recent of 17 sources. Enable JavaScript to search and browse every indexed mention.