Tridirectional Discriminating-Power Formal Verification of Smart Contract Reentrancy Defense Against Production-Deployed Solidity Source
2026-06-01 • Cryptography and Security
Cryptography and SecurityLogic in Computer ScienceProgramming Languages
AI summaryⓘ
The authors provide the first fully machine-verified proof that OpenZeppelin's ReentrancyGuard pattern effectively prevents reentrancy attacks in smart contracts based on real-world Solidity code. They prove that the guard stops attacks on vulnerable contracts while allowing normal transactions to work correctly, and they test this on actual contracts like DAO 2016, Compound v2, and Aave V3 flashLoan. Their approach includes creating a vulnerable mutant version to carefully show the difference the guard makes. This work uses formal methods in Lean 4 to verify security properties rigorously across different contract implementations.
OpenZeppelinReentrancyGuardsmart contractsLean 4formal verificationSolidityDAO 2016 attackDeFiflashLoanmutation testing
Authors
Ray Iskander
Abstract
We present the first machine-checked correctness proof of the OpenZeppelin reentrancy-guard pattern against a Lean 4 state-machine model of production-deployed Solidity source. All thirteen theorems are machine-checked with zero sorry, zero user-introduced axioms, and an axiom footprint bounded by [propext] (a standard mathlib4 axiom), gated under continuous integration. Smart contract reentrancy has caused over US$500M in documented losses since 2016, with the DAO 2016 attack draining ~3.6M ETH and forcing the hard fork that split Ethereum. The OpenZeppelin ReentrancyGuard pattern is the de facto defense across production DeFi, yet no prior work has established its discriminating power: that the guard blocks attacks on vulnerable instances, preserves correct execution for non-attacking transactions, and distinguishes adjacent safe and vulnerable variants. Prior efforts formalized either guard correctness on toy contracts or attack feasibility on isolated instances - not both directions plus boundary cases against production source. We verify three production instantiations - DAO 2016, Compound v2, and Aave V3 flashLoan - plus a minimal-diff mutant of Aave V3's flashLoan (flashLoanVulnerable) isolating one security-critical difference, via mutation testing. The tridirectional structure pairs (a) attack reproduction of the DAO 2016 pattern, (b) a correctness proof for Compound v2, and (c) a boundary-case proof distinguishing Aave V3's CEI-correct flashLoan from the mutant. A capstone meta-theorem composes the three under a no-retrofit discipline, demonstrated at the first cross-protocol stress test (Compound v2 to Aave V3); broader-family portability is future work. Full Lean 4 source, CI config and reproduction commands are at https://github.com/rayiskander2406/qanary-contracts, reproducible at v1.6-phase7-closure (substrate: v1.3-layer6-closure).