Context: .github/workflows/formal-verification.yml runs Kani on contracts/lib harnesses (balance_proofs, access_control_proofs, oracle_proofs) only; lending (LTV/interest), fees (rounding invariant), and staking (snapshot arithmetic) have unsafe-by-design arithmetic that formal methods would pin.
Problem: The workflow provides proof airtightness for one helper crate while the entities with real value-movement math (lending borrow overflow handled but rate math unwired, fees distribute remainder) remain unchecked; a saturating/overflow regression there ships with no formal backstop.
Proposed approach: Add Kani harnesses for borrow_rate::compute_borrow_rate, fee rounding (derive dust-bound), and staking reward-points math; wire them in formal-verification.yml; keep mdbook-verification docs in sync.
Acceptance criteria: lending/fees/staking harnesses added and green in CI; docs list the new proofs.
Context:
.github/workflows/formal-verification.ymlruns Kani oncontracts/libharnesses (balance_proofs,access_control_proofs,oracle_proofs) only; lending (LTV/interest), fees (rounding invariant), and staking (snapshot arithmetic) have unsafe-by-design arithmetic that formal methods would pin.Problem: The workflow provides proof airtightness for one helper crate while the entities with real value-movement math (lending
borrowoverflow handled butratemath unwired, feesdistributeremainder) remain unchecked; a saturating/overflow regression there ships with no formal backstop.Proposed approach: Add Kani harnesses for
borrow_rate::compute_borrow_rate, fee rounding (derive dust-bound), and staking reward-points math; wire them informal-verification.yml; keep mdbook-verification docs in sync.Acceptance criteria: lending/fees/staking harnesses added and green in CI; docs list the new proofs.