verus-lang/verus

What Verus does

Verus checks Rust code against specifications. Developers write preconditions and postconditions for functions, and Verus uses solver-backed static analysis to prove that the executable code satisfies those specifications for every possible execution. It is not a runtime assertion framework: checks happen at verification time, and the code can then run as ordinary Rust (within the supported subset).

The tool supports a subset of Rust and is being expanded. Because verification is not limited to the standard type system, it can also reason about code that manipulates raw pointers and other low-level patterns, which is why the project targets systems code. The README marks the project as under active development, with missing or unstable features and incomplete documentation.

Getting started

For a first look, the browser-based Verus Playground requires no local setup. For real development, follow the installation instructions, then work through the tutorial and reference.

A verified function states its contract directly in the signature:

fn octuple(x1: i8) -> (x8: i8)
    requires
        -16 <= x1,
        x1 < 16,
    ensures
        x8 == 8 * x1,
{
    let x2 = x1 + x1;
    let x4 = x2 + x2;
    x4 + x4
}

This example comes from a Hacker News comment illustrating the style, not from the installer. In practice, you put specifications and implementations in Verus-annotated Rust files, run the verifier, and expect either a proof success or a counterexample-oriented error report. The installation guide is the authoritative source for the exact command, toolchain version and editor integration; the README does not repeat those details.

Constraints and status

• Rust subset: Verus does not accept all Rust. Some language features remain unsupported, and the supported surface is still growing.
• Documentation maturity: The README describes the docs as work in progress; expect to consult the Zulip chat for help.
• Specification effort: Writing contracts and debugging failed proofs is part of the workflow. Verification proves the stated specification, so an inaccurate or incomplete specification limits what the result means.
• Ecosystem fit: Verified crates have separate publishing guidance for crates.io. A code formatter, verusfmt, is available separately.
• License: The repository is MIT-licensed.

HotRepo's take

Verus appeared in a Hacker News discussion in May 2024 that drew 284 points and 103 comments. The concrete adoption example in that thread is notable: lsuresh reported using Verus to write formally verified Kubernetes controllers and proving liveness properties such as eventual reconciliation to the desired state, with code and an OSDI 2024 paper linked. That is a stronger signal than generic praise because it names the property being proved and the domain where the specification itself is subtle. The thread also surfaced a practical friction point: one commenter noted that Verus wraps code in a proc-macro, while alternatives such as Creusot use attribute-based syntax, which some find more idiomatic. The project last recorded a Rust-language daily snapshot on 2026-11-14 with 3,768 stars and 20 stars gained that day, at rank 3 on that list. The single snapshot supports that day's standing, not a trend.

Project source and documentation