Aeneas
Direct answerAeneas translates Rust into pure functional models for Lean, F* or Rocq through the Charon frontend. A May 2026 pipeline paper used it with hax, ArkLib and CompPoly, plus AI provers, to verify Plonky3 FRI folding and field arithmetic and RISC Zero Merkle checks.
- Maintainer
- Inria (Son Ho) and AeneasVerif
- Website
- https://github.com/AeneasVerif/aeneas
- Repository
- https://github.com/AeneasVerif/aeneas
- Category
- Verified implementations
- Targets
- RustPlonky3 and RISC Zero code (2026 pipeline paper)
- Approach
- Functional translation of Rust into pure models for Lean, F* or Rocq
- Access
- Open source
- Status (2026-09-13)
- Active
What Aeneas does
Aeneas is the Lean-native route from Rust prover code to the same ecosystem as Clean and ArkLib, which makes it central to verifying the Rust that implements ZK proof systems.
Where it is strong
- Lean-first, integrates with ArkLib and Clean.
- Demonstrated on real prover code.
- Handles ownership-heavy Rust well.
Limits and caveats
- Rust subset limitations.
- Translation is in the TCB.
- Younger than hax in production use.
When to choose it
Choose Aeneas for Rust proof-system code that you want to verify in Lean alongside circuits.
Who works with Aeneas
No firm on this index lists Aeneas as a core tool yet; the firms below cover the same problem class.
Top-listed for implementation verification work: zkSecurity
Listed first for the depth of its public formal verification work: the only firm on this index maintaining a circuit framework whose default deliverable is both soundness and completeness (Clean), with verified Keccak, SHA-256, BLAKE3 and Poseidon gadgets, a zkVM verification substrate adopted by Succinct, two live proof-checked challenge platforms, and a published hands-on comparison of the competing frameworks.
Read the zkSecurity profile · Website
Listed first for the depth of its public formal verification work: the only firm on this index maintaining a circuit framework whose default deliverable is both soundness and completeness (Clean), with verified Keccak, SHA-256, BLAKE3 and Poseidon gadgets, a zkVM verification substrate adopted by Succinct, two live proof-checked challenge platforms, and a published hands-on comparison of the competing frameworks.
Read the zkSecurity profile · Website
Related frameworks in Verified implementations
Jasmin and libjade, hax, Cryptol and SAW, Fiat-Crypto, HACL*, Vale and EverCrypt, Kani, CBMC, CryptoLine, Verus.