Formal Verification
Dowsers / Formal verification
Formal verification
Prove what must never fail.
Formal verification establishes, through mathematical proof, whether software satisfies precisely defined properties under stated assumptions.
What formal verification is
A stronger answer to a precise question
Formal verification uses mathematical models and explicitly defined properties to determine whether a program satisfies its specification within a stated scope.
Developed as software became too complex and consequential to assess only through inspection and testing, formal methods have been applied for decades to high-assurance systems.
It replaces “Does the code look secure?” with a question that can be proved. Can this defined failure happen?
Proven where failure is not an option
When lives depend on software, assurance goes beyond testing.
Formal methods have long been used in nuclear systems, automated metros and aircraft software because testing and expert review cannot establish that a defined failure is impossible.
Control and protection systems
Formal methods help verify safety-critical software where failure could have severe consequences.
Paris Métro Line 14
The B-Method was used to develop and verify safety-critical control software.
Aircraft software
Formal methods are recognised as part of the assurance framework for critical airborne software.
Tests, audits and AI-assisted analysis can reveal vulnerabilities. Formal verification establishes whether defined critical properties hold across every relevant state within the verified model and scope.
Failure can compromise essential operations and human safety.
The risk is different, but code executes automatically in an adversarial environment and can directly affect financial assets. Higher consequences require stronger evidence.
Why formal verification
Detection is not proof.
Testing, audits, AI-assisted analysis and static analysis are essential for exposing defects, suspicious patterns and attack paths. Their strength is finding evidence of problems.
Formal verification addresses a narrower but stronger question: whether a precisely defined property can be violated across every behaviour represented by the model.
Finds executions, patterns or findings that may reveal a defect.
Establishes whether a defined property holds within the model, scope and assumptions.
“Program testing can be a very effective way to show the presence of bugs, but it is hopelessly inadequate for showing their absence.”
Edsger W. Dijkstra, “The Humble Programmer”, 1972 · source
What formal verification proves
A precise claim, across a defined behaviour space
The assurance claim is made explicit before it is proved. The property defines what must hold, the program model represents the relevant behaviours, and the assumptions establish where the claim applies.
The code and critical expectations to be assessed.
What must hold and the conditions under which it must hold.
The defined property is checked across the represented behaviours.
The outcome is delivered together with its proof perimeter.
The property holds for every behaviour represented within the verification perimeter.
A concrete behaviour demonstrates how the property can be violated.
No unsupported conclusion is drawn; the limitation remains visible.
Formal verification provides mathematical guarantees within the model and scope defined and agreed before the engagement. Coverage does not extend beyond that agreed scope. The verified property, code version, dependencies and assumptions remain attached to the result.
What can be verified onchain
Properties tied to the way smart contracts fail
The verification target depends on the protocol, its architecture and the decision the evidence needs to support. Typical property families include:
Asset integrity
Conservation rules, solvency conditions, balance relationships and constraints on asset creation or loss.
Access and authority
Permissions, role boundaries, privileged operations and administrative control.
State transitions
Rules that must hold before, during and after sensitive changes in protocol state.
Protocol safety and continuity
Critical failures that must never occur and essential operations that must remain possible.
Standards and protocol invariants
Conformance with formalised token behaviour and protocol-specific rules across the covered state space.
Dowsers
From formal proof to decision-ready evidence.
Dowsers connects formally verified properties to a defined code version, model, assumptions and scope, so protocol teams, asset managers and institutions can understand precisely what has been proved — and what has not.
Explore the Dowsers Shield