LeanDY: Type-Based and Trace-Based Symbolic Protocol Verification in Lean
Simon Jeanteur, Lorenzo Veronese, Magdalena Solitro, Matteo Maffei
cs.CR
Jul 3, 2026 · v2
cs.PL
TL;DR
Presents LeanDY, a Lean library combining type-based and trace-based symbolic verification of cryptographic protocols, applied to blockchain payment channels.
Abstract
Computer-aided formal verification is a widely used approach for the symbolic analysis of cryptographic protocols. However, many modern protocols rely on features that remain challenging for existing techniques. In particular, reasoning about state, time-dependent behavior, inductively defined data structures, unbounded executions, and conditional secrecy requires a level of expressiveness that is difficult to reconcile with effective automation. As a result, protocol verification has largely followed two disjoint paths: fully automated methods with limited expressiveness, or interactive proofs in general-purpose theorem provers that offer flexibility but only limited, non-specialized automation. We present an orthogonal approach that bridges this gap by combining compositional type-based reasoning with trace-based reasoning, enabling modular verification of stateful and unbounded protocols. Guided by the language-and-automation co-design (LAC) principle, our approach delivers protocol-specific automation while retaining high expressiveness. We implement this framework as the LeanDY library for the Lean proof assistant, building on and extending the design of DY*, and combining protocol-specific automation with interactive proofs. Our framework supports, in a unified setting, a broad class of functional and security requirements, including secrecy and authentication for stateful protocols, as well as recursive conditional secrecy for protocols using XOR. We formalize SegWit-style blockchain primitives in LeanDY and demonstrate its expressiveness by carrying out an in-depth formalization of payment channels on top of this blockchain model, verifying punishment mechanisms and properties that depend on chain liveness.
Problem
Symbolic verification of cryptographic protocols splits between automated methods with limited expressiveness and interactive provers with weak specialized automation. Modern protocols involving state, time, unbounded executions, conditional secrecy, and XOR remain hard to verify, especially blockchain-based protocols like payment channels.
Approach
LeanDY is a Lean library combining compositional type-based reasoning with inductive trace-based reasoning, extending the design of DY*. It provides a general parameterized trace invariant (valid_trace), a DSL for protocol specifications, and a type system with security labels including conditional label swaps for XOR-based secrecy. Following the language-and-automation co-design principle, it offers protocol-specific automation while allowing interactive proofs for expressiveness. A SegWit-style UTXO blockchain model is built atop the parsing framework to inherit soundness and automation.
Results
The framework verifies secrecy and authentication for stateful, unbounded protocols and recursive conditional secrecy for XOR-based protocols. It formalizes SegWit-style blockchain primitives and carries out an in-depth formalization of payment channels, verifying punishment mechanisms and liveness-dependent properties.