Verifying deployed bytecode against executable EVM semantics, with exact gas and no added axioms
Seulkee Baek
cs.PL
Oct 14, 2026 · v1
cs.LO
TL;DR
Builds Blanc, a Lean 4 stack that verifies deployed EVM bytecode against Jaune, an executable Lean EVM semantics, using kernel-checked certificates and no added axioms.
Abstract
Much of Ethereum's most consequential code is immutable bytecode: old output of unverified compilers, and protocol logic run as contract code. We show that such bytecode can be verified as it is, without trusting what produced it, without simplifying the machine it runs on, and with no axioms beyond Lean's own. Blanc, a Lean 4 verification stack, reads fixed runtime bytes via kernel-checked certificates and states every theorem against Jaune, an executable semantics of the EVM and block processing that passes all 34,205 blockchain-test cases of Ethereum's fixture release v20.0.2 that involve only forks that have governed mainnet since May 2025. Eight artifacts, deployed from 2017 to 2026, come from seven compiler versions and an assembler. For the EIP-7002 contract, we prove that the end-of-block call to it, whose failure would invalidate the block, succeeds whatever its storage holds, and that each block's withdrawal requests are exactly the oldest pending submissions; mainnet met these theorems' starting premises when Prague began. For a Uniswap V2 pair, we prove that after any valid history whose hashed slots stay apart, from any checkpoint representing its Solidity model's state, the storage represents that model replayed over exactly the committed calls, a balanced liquidity ledger stays balanced, and, under a premise on token answers, geometric-mean reserves per share fall only through the protocol fee. Exact gas makes liveness provable: a tracked WETH9 holder without code can withdraw by a transaction whose gas has a closed form, matching all 3,748 comparable mainnet receipts of its shape in 30,000 blocks. On Curve pool bytes compiled with the lock bug exploited in 2023, Jaune executes such a reentrancy from deployment; for bytes from a fixed compiler, we prove the lock excludes it. AI agents wrote the proofs in fifteen days under one author's direction, atop an existing stack.
Problem
Much consequential Ethereum code is immutable bytecode produced by unverified compilers. The goal is to verify such bytecode as deployed, without trusting its compiler, without simplifying the EVM, and with no axioms beyond Lean's three standard ones.
Approach
Blanc, a Lean 4 verification stack, lifts fixed runtime bytes through certificates proposed by an untrusted program and checked by a decision procedure run in Lean's kernel. Every theorem is stated against Jaune, an executable Lean semantics of the EVM and block processing that is conformance-tested on Ethereum fixtures. Gas is modeled exactly, which makes liveness properties provable. AI agents wrote the proofs in fifteen days under one author's direction.
Results
Jaune passes all 34,205 relevant blockchain-test cases. Theorems cover eight mainnet artifacts from seven compiler versions and an assembler. They include EIP-7002 end-of-block call success, Uniswap V2 model refinement and a liquidity invariant, and WETH9 withdrawal liveness with a closed-form gas cost that matches 3,748 mainnet receipts. For Curve, Jaune executes the 2023 reentrancy on the vulnerable bytes, and the lock is proved to exclude it in the fixed bytes. The 725,186-line library uses no axioms beyond Lean's three.
| Calldata tokens | Predicted gas (not emptying) | Matches | Predicted gas (emptying) | Matches |
|---|
| 63 | 35,192 | 128 of 128 | 30,392 | 238 of 238 |
| 66 | 35,204 | 481 of 481 | 30,404 | 1,097 of 1,097 |
| 69 | 35,216 | 465 of 465 | 30,416 | 900 of 900 |
| 72 | 35,228 | 150 of 150 | 30,428 | 250 of 250 |
WETH9 withdrawal gas predictions versus mainnet receipts