LeanDY: Type-Based and Trace-Based Symbolic Protocol Verification in Lean
Simon Jeanteur, Lorenzo Veronese, Magdalena Soltiro, Matteo Maffei
cs.CR
Jul 3, 2026 · v1
cs.PL
TL;DR
LeanDY is a Lean library for symbolic cryptographic protocol verification, combining type-based and trace-based reasoning to verify stateful protocols.
Abstract
Computer-aided formal verification is a widely used approach for the symbolic analysis of cryptographic protocols. However, many modern protocols rely on features that remain challenging for existing techniques. In particular, reasoning about state, time-dependent behavior, inductively defined data structures, unbounded executions, and conditional secrecy requires a level of expressiveness that is difficult to reconcile with effective automation. As a result, protocol verification has largely followed two disjoint paths: fully automated methods with limited expressiveness, or interactive proofs in general-purpose theorem provers that offer flexibility but only limited, non-specialized automation. We present an orthogonal approach that bridges this gap by combining compositional type-based reasoning with trace-based reasoning, enabling modular verification of stateful and unbounded protocols. Guided by the language-and-automation co-design (LAC) principle, our approach delivers protocol-specific automation while retaining high expressiveness. We implement this framework as the LeanDY library for the Lean proof assistant, building on and extending the design of DY*, and combining protocol-specific automation with interactive proofs. Our framework supports, in a unified setting, a broad class of functional and security requirements, including secrecy and authentication for stateful protocols, as well as recursive conditional secrecy for protocols using XOR. We formalize SegWit-style blockchain primitives in LeanDY and demonstrate its expressiveness by carrying out an in-depth formalization of payment channels on top of this blockchain model, verifying punishment mechanisms and properties that depend on chain liveness.
Problem
Symbolic protocol verification splits into fully automated methods with limited expressiveness and interactive proofs with flexibility but weak specialized automation. Modern protocols requiring state, time-dependent behavior, unbounded executions, and conditional secrecy (e.g., blockchain payment channels using XOR) remain hard to verify.
Approach
LeanDY is a Lean framework combining compositional type-based reasoning with inductive trace-based reasoning for modular verification of stateful, unbounded protocols. It follows the language-and-automation co-design principle, providing a general parameterized trace invariant (valid_trace), a DSL for protocol specifications, and a type system with security labels supporting conditional secrecy. It builds on and extends the design of DY*. A SegWit-style UTXO blockchain model is formalized on top of the core primitives.
Results
The framework supports secrecy and authentication for stateful protocols and recursive conditional secrecy for XOR-based protocols. An in-depth formalization of payment channels was carried out, verifying punishment mechanisms and properties depending on chain liveness.