Verify the Rust’s Standard Library’s 7,500 Unsafe Functions – and Win ‘Financial Rewards’
The Rust community has “recognized the unsafety of Rust (if used incorrectly),” according to a blog post by Amazon Web Services.
So now AWS and the Rust Foundation are “crowdsourcing an effort to verify the Rust standard library,” according to an article at DevClass.com, “by setting out a series of challenges for devs and offering financial rewards for solutions…”
Rust includes ways to bypass its safety guarantees though, with the use of the “unsafe” keyword… The issue AWS highlights is that even if developers use only safe code, most applications still depend on the Rust standard library. AWS states that there are approximately 7.5K unsafe functions in the Rust Standard Library and notes that 57 “soundness issues” and 20 CVEs (Common Vulnerabilities and Exposures) have been reported in the last three years. [28% of the soundness issues were discovered in 2024.]
Marking a function as unsafe does not mean it is vulnerable, only that Rust does not guarantee its safety. AWS plans to reduce the risk by using tools and techniques for formal verification of key library code, but believes that “a single team would be unable to make significant inroads” for reasons including the lack of a verification mechanism in the Rust ecosystem and what it calls the “unknowns of scalable verification.” The plan therefore is to turn this over to the community, by posing challenges and rewarding developers for solutions…. A GitHub repository provides a fork of the Rust code and includes a set of challenges, currently 13 of them… The Rust Foundation says that there is a financial reward tied to each challenge, and that the “challenge rewards committee is responsible for reviewing activity and dispensing rewards.” How much will be paid though is not stated.
Despite the wide admiration for Rust, there is no formal specification for the language, an issue which impacts formal verification efforts.
Thanks to Slashdot reader sean-it-all for sharing the news.
Read more of this story at Slashdot.
The Rust community has “recognized the unsafety of Rust (if used incorrectly),” according to a blog post by Amazon Web Services.
So now AWS and the Rust Foundation are “crowdsourcing an effort to verify the Rust standard library,” according to an article at DevClass.com, “by setting out a series of challenges for devs and offering financial rewards for solutions…”
Rust includes ways to bypass its safety guarantees though, with the use of the “unsafe” keyword… The issue AWS highlights is that even if developers use only safe code, most applications still depend on the Rust standard library. AWS states that there are approximately 7.5K unsafe functions in the Rust Standard Library and notes that 57 “soundness issues” and 20 CVEs (Common Vulnerabilities and Exposures) have been reported in the last three years. [28% of the soundness issues were discovered in 2024.]
Marking a function as unsafe does not mean it is vulnerable, only that Rust does not guarantee its safety. AWS plans to reduce the risk by using tools and techniques for formal verification of key library code, but believes that “a single team would be unable to make significant inroads” for reasons including the lack of a verification mechanism in the Rust ecosystem and what it calls the “unknowns of scalable verification.” The plan therefore is to turn this over to the community, by posing challenges and rewarding developers for solutions…. A GitHub repository provides a fork of the Rust code and includes a set of challenges, currently 13 of them… The Rust Foundation says that there is a financial reward tied to each challenge, and that the “challenge rewards committee is responsible for reviewing activity and dispensing rewards.” How much will be paid though is not stated.
Despite the wide admiration for Rust, there is no formal specification for the language, an issue which impacts formal verification efforts.
Thanks to Slashdot reader sean-it-all for sharing the news.
Read more of this story at Slashdot.