--- title: Lean proved this program was correct; then I found a bug. description: A developer fuzzed lean-zip, a formally verified zlib implementation built by 10 AI agents and proven correct in Lean 4, using Claude, AFL++, AddressSanitizer,... canonical: https://daily.dev/posts/lean-proved-this-program-was-correct-then-i-found-a-bug--n0f0rtus1 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Lean proved this program was correct; then I found a bug. | daily.dev og:description: A developer fuzzed lean-zip, a formally verified zlib implementation built by 10 AI agents and proven correct in Lean 4, using Claude, AFL++, AddressSanitizer,... og:url: https://daily.dev/posts/lean-proved-this-program-was-correct-then-i-found-a-bug--n0f0rtus1 og:image: https://api.daily.dev/og/posts/n0F0rTUS1.png og:image:alt: Lean proved this program was correct; then I found a bug. og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Lean proved this program was correct; then I found a bug. **[Lobsters](https://daily.dev/sources/lobsters)** · 8 min read · 0 upvotes · 0 comments ## Summary A developer fuzzed lean-zip, a formally verified zlib implementation built by 10 AI agents and proven correct in Lean 4, using Claude, AFL++, AddressSanitizer, and Valgrind. After 105 million fuzzing executions, the verified application code was completely clean. However, two bugs were found: a heap buffer overflow in the Lean 4 runtime itself (lean_alloc_sarray), triggered by integer overflow when allocating near SIZE_MAX, affecting every Lean 4 version to date; and a denial-of-service in lean-zip's unverified archive parser, which passes untrusted ZIP header sizes directly to allocation without validation. The key takeaway is that formal verification is highly effective within its scope, but bugs can still lurk in unverified code paths and in the trusted computing base (the C++ runtime) that proofs assume to be correct. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [When AI Writes the World’s Software, Who Verifies It?](https://daily.dev/posts/when-ai-writes-the-world-s-software-who-verifies-it--tsppkfj9s) · Hacker News · 1 upvotes · 0 comments - [Creator of Lean: Handwritten Math Will Change Dramatically](https://daily.dev/posts/creator-of-lean-handwritten-math-will-change-dramatically-ssexcp90l) · The Developing Dev · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security) [View this post on daily.dev](https://daily.dev/posts/lean-proved-this-program-was-correct-then-i-found-a-bug--n0f0rtus1) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Lean proved this program was correct; then I found a bug.","url":"https://daily.dev/posts/lean-proved-this-program-was-correct-then-i-found-a-bug--n0f0rtus1","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/lean-proved-this-program-was-correct-then-i-found-a-bug--n0f0rtus1"},"datePublished":"2026-04-13T19:39:05.419Z","dateModified":"2026-04-13T19:39:29.832Z","description":"A developer fuzzed lean-zip, a formally verified zlib implementation built by 10 AI agents and proven correct in Lean 4, using Claude, AFL++, AddressSanitizer,...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/ba1fc0b72dee56b80dd0ef338683feca?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/ba1fc0b72dee56b80dd0ef338683feca?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Lobsters","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Lobsters","logo":"https://media.daily.dev/image/upload/s--tl8v_Fku--/f_auto,t_logo/v1698841318/logos/lobste.jpg","url":"https://daily.dev/sources/lobsters"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/lean-proved-this-program-was-correct-then-i-found-a-bug--n0f0rtus1","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security","timeRequired":"PT8M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Lobsters","item":"https://daily.dev/sources/lobsters"},{"@type":"ListItem","position":3,"name":"Lean proved this program was correct; then I found a bug."}]} ```