LeanDY: Type-Based and Trace-Based Symbolic Protocol Verification in Lean

Abstract: Computer-aided formal verification is a widely used approach for the symbolic analysis of cryptographic protocols. However, many modern protocols rely on features that remain challenging for existing techniques. In particular, reasoning about state, time-dependent behavior, inductively defined data structures, unbounded executions, and conditional secrecy requires a level of expressiveness that is difficult to reconcile with effective automation. As a result, protocol verification has largely followed two disjoint paths: fully automated methods with limited expressiveness, or interactive proofs in general-purpose theorem provers that offer flexibility but only limited, non-specialized automation. We present an orthogonal approach that bridges this gap by combining compositional type-based reasoning with trace-based reasoning, enabling modular verification of stateful and unbounded protocols. Guided by the language-and-automation co-design (LAC) principle, our approach delivers protocol-specific automation while retaining high expressiveness. We implement this framework as the LeanDY library for the Lean proof assistant, building on and extending the design of DY*, and combining protocol-specific automation with interactive proofs. Our framework supports, in a unified setting, a broad class of functional and security requirements, including secrecy and authentication for stateful protocols, as well as recursive conditional secrecy for protocols using XOR. We formalize SegWit-style blockchain primitives in LeanDY and demonstrate its expressiveness by carrying out an in-depth formalization of payment channels on top of this blockchain model, verifying punishment mechanisms and properties that depend on chain liveness.

• The paper introduces LeanDY, a unified framework that merges compositional type techniques with trace-based reasoning to verify complex cryptographic protocols.
• It presents an extensible security label system that automates label assignment for XOR terms and supports dynamic, conditional secrecy across protocol executions.
• The framework is demonstrated through mechanized verification of blockchain-backed payment channel protocols, ensuring structural correctness and formal liveness guarantees.

LeanDY: Type-Based and Trace-Based Symbolic Protocol Verification in Lean

Motivation and Approach

The paper "LeanDY: Type-Based and Trace-Based Symbolic Protocol Verification in Lean" (2607.03406) addresses the persistent challenge in computer-aided symbolic cryptographic protocol analysis: balancing expressiveness for advanced protocol features (mutable state, unbounded executions, complex conditional secrecy, and stateful blockchain-based logic) with practical proof automation. Prevailing automated protocol analyzers (e.g., ProVerif, Tamarin) offer push-button support but are fundamentally limited by their underlying proof search and representational frameworks, especially in the presence of algebraic operators such as XOR, complex state manipulation, and liveness arguments. On the other hand, the adoption of general-purpose theorem provers (e.g., Isabelle/HOL, Lean, F★) enables much greater expressiveness but typically comes at the cost of manual, non-specialized proof effort and limited automation.

LeanDY offers an orthogonal approach that unifies compositional type-based techniques and global trace-based reasoning. Specifically, it implements a framework in Lean, inspired by DY*, that makes type-based automation accessible while incorporating mechanisms for trace-based inductive arguments and protocol-specific interactive proofs. The design follows language-and-automation co-design (LAC): carefully structuring protocol representation in an embedded DSL permits targeted protocol-level proof automation without sacrificing the expressiveness of Lean for cases where manual intervention is necessary.

Symbolic Model and Secrecy Label System

The LeanDY symbolic model builds on Dolev-Yao-style equational terms for protocol messages, supporting constructors for constants, keys, cryptographic operations (hashing, signing, (a)symmetric encryption), and notably, an algebraic XOR operator over nonces. A central technical innovation is an extensible security label system: every symbolic term is assigned a unique confidentiality label reflecting its intended release condition, supporting static, principal-scoped, and dynamic conditionally releasable secrets.

Labels are modeled as parameterized, monotone predicates over traces (i.e., the set of traces for which a term is considered public). The formulation is general enough to encode classical public/secret, dynamically compromised principal-scoped secrets (via $\mathcal{P}riv^n$), and arbitrary event- or state-dependent conditional secrecy (e.g., $[\mathcal{S}ec/\mathcal{P}ub]_E$ for release upon protocol event $E$). The system supports protocol-dependent user extension and admits automation for label assignment over XOR terms, leveraging algebraic properties of XOR and a lattice-theoretic meet operator that reflects that the security of a XOR aggregation degrades only as each constituent term is revealed.

The type system is proved sound: any message derivable by the (Dolev-Yao) adversary in a valid trace is both well-formed and labeled $\mathcal{P}ub$ (public). Thus, for any valid protocol execution, secrecy claims can be reduced to label assignments and the monotonicity of the confidentiality lattice.

LeanDY Library Design

LeanDY is implemented as a Lean library and comprises several key components:

• Symbolic Trace Infrastructure: Traces are first-class, explicit lists of observable events (messages, state commits, principal corruptions, protocol events). All protocol-specific properties are phrased as invariants over the trace.
• Type System: Compositional, protocol-dependent type checking is enforced for all message exchanges. The confidentiality lattice, combined with rules for public, secret, principal-specific, and event-conditional labels, is central to automating much of the reasoning. Automation is provided for typical cases but remains extensible for protocol-specific rules via Lean's tactic and type class mechanisms.
• Attacker and Well-formedness: The Dolev-Yao attacker is represented by an inductive predicate, encompassing standard algebraic derivations (including compositional XOR knowledge), and the type system guarantees that only public, well-formed values may be transmitted or constructed by honest parties.
• Protocol Composition and Automation: The protocol DSL models each participant as a set of state-machine exchanges. Proof obligations are modularized to exchange-level correctness. Lean tactics and type class inference are heavily used to discharge routine proof components, with the proof burden focused only on protocol-specific, cryptographically meaningful arguments (e.g., state invariants, custom cryptographic predicates).
• Automated Label Assignment for XOR Terms: Assignment of security labels in the presence of XOR is automated based on an algebraic basis specification; complex chained secrets (as in chained HTLC or payment channel revocation chains) are handled with minimal manual annotation.

Expressive Applications: Blockchain and Payment Channel Protocols

A significant application focus is the mechanized verification of protocol-level logic depending on stateful, time-dependent blockchain primitives, particularly features like SegWit, timelocks, and chained scripts. The authors develop a mechanized model of a SegWit-style UTXO blockchain using the LeanDY library, complete with transaction validation (structural and script-level), proper handling of script abstraction (to model P2WSH and custom scripts), and pointer uniqueness.

On top of the blockchain model, the expressiveness of LeanDY is demonstrated through a fully mechanized formalization of a punishment-secured, two-party payment channel protocol (a core building block of Lightning), including model components:

• Distributed, off-chain channel state management,
• Modular revocation and punishment mechanisms with secrets released under protocol events,
• Safety proofs for transaction structure, signing policy, and the presence of punishment scripts,
• Formal liveness arguments, extending beyond the capabilities of black-box Dolev-Yao adversary models. The soundness of the revocation/punishment mechanism is harnessed by explicit liveness hypotheses (responsiveness of the defender and miner inclusion), giving formal proofs that punishment transactions will be posted on-chain within time constraints under the protocol's threat model.

Broader Implications and Comparison

LeanDY occupies a point in the symbolic protocol verification landscape that is characterized by maximal compositionality, expressive label management (especially for protocols with intricate, dynamic conditional secrecy as in blockchain/FSM protocols), and an automation/interactivity blend that supports both efficient push-button verification of common-case exchanges and deep, Lean-level proofs for protocols with unique proof obligations. In particular, it surpasses DY* in terms of extensible, protocol-dependent labels and offers substantially more facility for interactive/trace-based reasoning where full automation is infeasible.

Unlike the monolithic and fixed-model approaches common in tools like ProVerif or Tamarin, LeanDY supports vertical protocol stack reasoning (e.g., application-level payment protocols layered atop blockchain-level transaction logic), and the extensibility favors the definition of protocol families and reusable mechanized libraries. The ability to formalize liveness arguments, which are largely inaccessible to classical Dolev-Yao-based tools, signals practical relevance for protocols whose security is inherently conditional on network behavior and timing, as with payment channels.

Conclusion

LeanDY provides an advanced framework for symbolic protocol analysis in Lean, combining rigorous type-based confidentiality invariants, algebraic operator (notably XOR) reasoning, and inductive trace-based methods in a design that enables both significant automation and necessary interactivity for protocol classes beyond the reach of existing tools. The mechanized verification of blockchain-backed payment channels, including sound liveness analyses, attests to its expressiveness and adaptability. This approach is expected to be foundational for the formal analysis of protocols at the intersection of cryptography, distributed consensus, and cross-layer protocol composition, and can serve as the basis for future work on the verification of the complete Lightning Network and similar protocols.