Soteria: Efficient Symbolic Execution as a Functional Library

2025-11-11

AI Summary

Existing symbolic execution tools rely on intermediate representations (IRs), inherently compromising performance, precision, and support for language-specific semantics. To overcome this trade-off, we propose a novel paradigm: building lightweight symbolic execution engines directly atop source-language semantics—bypassing IR-induced compromises. We design and implement Soteria, a functional OCaml library enabling configurable, composable static analysis architectures. Leveraging this framework, we develop the first high-fidelity, high-performance native symbolic executors for Rust—including full support for the Tree Borrows memory model—and for C: Soteria^Rust and Soteria^C. Empirical evaluation shows both outperform or match state-of-the-art tools—including Kani, Pulse, CBMC, and Gillian-C—in vulnerability detection rate and execution efficiency. Furthermore, we provide formal correctness proofs for their core operational semantics and constraint-solving procedures.

Technology Category

• Constraint Satisfaction and Optimization: Satisfiability Modulo Theories
• Cognitive Modeling & Cognitive Systems: Symbolic Representations
• Knowledge Representation and Reasoning: Automated Reasoning and Theorem Proving

Application Category

• Search and Retrieval-Augmented AI: Web evaluation methodologies and metrics
• Systems and Infrastructure for Web, Mobile and WoT: Web performance, measurement, and characterization
• Semantics and Knowledge: Provenance, trust, security and privacy, and ethical issues in managing semantic data

Abstract

Symbolic execution (SE) tools often rely on intermediate languages (ILs) to support multiple programming languages, promising reusability and efficiency. In practice, this approach introduces trade-offs between performance, accuracy, and language feature support. We argue that building SE engines emph{directly} for each source language is both simpler and more effective. We present Soteria, a lightweight OCaml library for writing SE engines in a functional style, without compromising on performance, accuracy or feature support. Soteria enables developers to construct SE engines that operate directly over source-language semantics, offering emph{configurability}, compositional reasoning, and ease of implementation. Using Soteria, we develop Soteria$^{ ext{Rust}}$, the emph{first} Rust SE engine supporting Tree Borrows (the intricate aliasing model of Rust), and Soteria$^{ ext{C}}$, a compositional SE engine for C. Both tools are competitive with or outperform state-of-the-art tools such as Kani, Pulse, CBMC and Gillian-C in performance and the number of bugs detected. We formalise the theoretical foundations of Soteria and prove its soundness, demonstrating that sound, efficient, accurate, and expressive SE can be achieved without the compromises of ILs.

Problem

• Building symbolic execution engines directly for source languages
• Avoiding performance and accuracy trade-offs of intermediate languages
• Supporting complex language features like Rust's aliasing model

Innovation

• Direct source language symbolic execution engines
• Functional library for configurable compositional reasoning
• Proven soundness without intermediate language compromises