Cargo Sherlock: An SMT-Based Checker for Software Trust Costs

2025-12-13

AI Summary

To address the challenge of quantifying trustworthiness of third-party dependencies in open-source software supply-chain attacks (e.g., typosquatting, AI-assisted maintenance failures), this paper proposes the first formally verifiable trust quantification framework. Methodologically, it integrates SMT-based logical modeling (using the Z3 solver) with actionable metadata (e.g., download counts, author count), uniquely embedding human-interpretable trust indicators into a first-order decidable theory. It formally defines the “minimum trust cost” optimization problem, enabling joint trade-offs between formal security guarantees and empirically grounded trust assessments. Experimental evaluation demonstrates high precision and scalability on dependency graphs comprising thousands of packages, successfully identifying both synthetically crafted and real-world malicious Rust crates.

Technology Category

• Constraint Satisfaction and Optimization: Satisfiability Modulo Theories
• Data Mining & Knowledge Management: Representing, Reasoning, and Using Provenance, Trust
• Machine Learning: Calibration & Uncertainty Quantification

Application Category

• Web Mining and Content Analysis: Web data provenance, reliability, and authenticity
• Graph Algorithms and Modeling for the Web: Foundation models and LLMs for Web-related graphs
• Security and Privacy: Data transparency and provenance

Abstract

Supply chain attacks threaten open-source software ecosystems. This paper proposes a formal framework for quantifying trust in third-party software dependencies that is both formally checkable - formalized in satisfiability modulo theories (SMT) - while at the same time incorporating human factors, like the number of downloads, authors, and other metadata that are commonly used to identify trustworthy software in practice. We use data from both software analysis tools and metadata to build a first-order relational model of software dependencies; to obtain an overall "trust cost" combining these factors, we propose a formalization based on the minimum trust problem which asks for the minimum cost of a set of assumptions which can be used to prove that the code is safe. We implement these ideas in Cargo Sherlock, targeted for Rust libraries (crates), incorporating a list of candidate assumptions motivated by quantifiable trust metrics identified in prior work. Our evaluation shows that Cargo Sherlock can be used to identify synthetically generated supply chain attacks and known incidents involving typosquatted and poorly AI-maintained crates, and that its performance scales to Rust crates with many dependencies.

Problem

• Develops a formal framework to quantify trust in third-party software dependencies
• Proposes a method combining formal verification with human factors for trust assessment
• Implements a checker to identify supply chain attacks in Rust libraries

Innovation

• SMT-based formal framework for quantifying trust
• Combines software analysis with human metadata factors
• Implements minimum trust problem for safety proofs