Research Platform — Est. 2026

Deterministic Execution.
Invariant Systems. Formal verification for distributed state machines

RFT-SIRM builds mathematically rigorous execution platforms where every state transition is provably correct. Zero invariant violations across 4.29 billion+ operations.

CLAIM
→
MODEL
→
EXECUTION
→
VERIFICATION
→
EVIDENCE
→
REPRODUCTION
Click any stage above to trace the research pipeline from mathematical claim to reproducible evidence.
State Machine

SIRM Transition Model

Interactive execution flow. Hover each node for technical specification.

INITIAL STATE S₀
↓
OPERATION op(t)
↓
PRECONDITION
↓
STATE TRANSITION
↓
INVARIANT CHECK I(S)
PASS → COMMIT
FAIL → REJECT
↓
STATE HASH
Hover over any node to see technical specification
Hard Constraints

Invariant Explorer

Click any invariant to expand full technical specification.

∑

I1 — Supply Conservation

VALIDATED
total_supply = Σ base_balance[i] + global_field × p

Total supply is conserved as the sum of all base balances plus a global scalar field multiplied by participant count.

Definition: Conservation invariant over the entire protocol state.
State variables: total_supply, total_base_sum, global_field, participants_count.
Why it exists: Prevents silent supply inflation/deflation outside explicit mint/burn operations.
Failure mode: Overflow in global_field × p, desync between base_sum and individual balances, rounding error accumulation.
How checked: check_invariant() after every op in Rust core. Checked arithmetic throughout.
Repository: Rift-L1-Blockchain
Evidence: 1T+ ops fuzzed, 0 violations. → View Evidence
Limitation: In-memory state machine only; no consensus/network layer tested.
±

I2 — Mint/Burn Accounting

VALIDATED
total_supply = total_minted − total_burned

Every token created or destroyed is explicitly tracked. Supply never changes without a corresponding mint or burn record.

Definition: Accounting invariant ensuring complete audit trail of supply changes.
State variables: total_supply, total_minted, total_burned.
Why it exists: Ensures no supply manipulation outside tracked operations.
Failure mode: Transfer that creates supply out of nowhere, burn without decrement, double-mint.
How checked: Monotonic: total_minted ≥ total_burned. Verified after every state-mutating instruction.
Repository: Rift-L1-Blockchain, Rift-Network
Evidence: 1T+ ops + 2.5B+ on-chain fuzz runs. → View Evidence
Limitation: On-chain model does not include all edge cases of SPL token interactions.
⌊

I3 — Dust Bound

VALIDATED
dust_accumulator < p (when p > 0)

When precision parameter p > 0, accumulated rounding dust is strictly bounded below the precision threshold.

Definition: Bounded invariant on rounding error accumulation.
State variables: dust_accumulator, participants_count (p).
Why it exists: Prevents rounding error accumulation from destabilizing supply accounting over time.
Failure mode: Dust grows unbounded through repeated operations, violating I1 indirectly. Unregister without normalization.
How checked: Normalized on unregister(). Fuzzed with p=0 and large-p stratified modes.
Repository: Rift-L1-Blockchain
Evidence: 5-mode stratified fuzz, dust edge case found and fixed during development. → View Evidence
Limitation: Dust behavior under extreme churn (rapid register/unregister) not fully characterized.
≥

I4 — Debt Limit

VALIDATED
effective_balance[i] ≥ −(total_supply / 10p)

No single participant can hold negative effective balance beyond 10% of total supply, preventing concentration attacks.

Definition: Safety invariant limiting systemic risk from negative positions.
State variables: base_balance[i], global_field, total_supply, participants_count.
Why it exists: Limits concentration risk. One account cannot accumulate unlimited debt.
Failure mode: Negative global_field shifts all balances; single participant exceeds 10% threshold.
How checked: DebtOnExit rejection path. Negative field boundary mode (Mode 2) in fuzzer.
Repository: Rift-L1-Blockchain, Rift-Network
Evidence: Negative field mode in 1T+ fuzz campaign. → View Evidence
Limitation: 10% threshold is protocol parameter; economic optimality not proven.
Every Number Has Provenance

Evidence Center

Repository, harness, seed, environment, limitation — every metric traced to its source.

1T+
VALIDATED

Rift L1 Core Operations

Repository: Rift-L1-Blockchain
Harness: libFuzzer, 5 stratified modes
Duration: 5h 55m per CI run
Throughput: ~5.75M ops/sec (GH Runner)
Invariant set: I1–I4
Result: 0 violations, 0 crashes
Limitation: In-memory state machine; no network/consensus
View Repository → View CI →
4.29B+
VALIDATED

ABIv2 Memory Contexts

Repository: agave-abiv2-memory-contexts
Harness: libFuzzer + Agave SVM mock
Focus: Per-frame writable permission rollback
Findings: 1 PoC-only bug documented
Upstream: svm#25 (closed, PoC)
Result: 0 kernel crashes
Limitation: Research artifact; not merged upstream
View Repository → View Issue →
91M
VALIDATED

Agave Scheduler Fuzz

Repository: agave-rift-scheduler
Harness: libFuzzer, conflict-graph scheduler
Duration: 5h 55m per CI run
Throughput: ~4,300 exec/sec
Invariant set: I1–I4 (accounting, monotonicity, drain)
Result: 0 violations
Limitation: Standalone scheduler; not integrated into Agave
View Repository → View RFC →
184K
VALIDATED

Aave V4 Hub Model

Repository: aave-v4-hub-model-review
Harness: Python state machine, seeded
Scope: draw/restore/reportDeficit/eliminateDeficit
Precision: RAY = 10²⁷, explicit rounding
Boundary: B-1 … B-5 edge cases
Result: 0 invariant violations
Limitation: Model-level only; not bytecode audit
View Repository → View Memo →
1B+
VALIDATED

seL4 CDT Verification

Repository: UltraCore-RFT (seL4 module)
Harness: Deterministic state-machine fuzz
Target: Capability Derivation Tree
Duration: Marathon + post-marathon suite
Tests: 123/123 passed
Result: 0 kernel crashes
Limitation: Complementary validation; not replacing seL4 proof
View Repository →
2.5B+
VALIDATED

Rift Network On-Chain

Repository: Rift-Network
Harness: Anchor workspace fuzz + manual review
Audit: Independent security audit, 14 findings
Framework: Anchor + SPL on Solana
Result: All findings addressed
Status: RC v1.0
Limitation: Audit report under NDA; summary only public
View Repository → Audit Summary
Traceability

Claims Registry

Every technical claim with its current evidentiary status. Never automatically promoted.

VALIDATED SIRM I1–I4 hold across 1T+ core operations Rift-L1-Blockchain →
VALIDATED O(1) distribution complexity via global_field Rift-L1 / Rift-Network →
VALIDATED Aave V4 Hub model: 0 invariant violations in 184K ops aave-v4-hub-model →
EXPERIMENTAL Conflict-aware scheduler reduces lock churn in Agave banking_stage agave-rift-scheduler →
IMPLEMENTED Per-frame writable permission rollback for ABIv2 agave-abiv2-mem →
RESEARCH Invariant-preserving deterministic AI agents UltraCore-RFT →
PLANNED TLA+ machine-checked proofs of critical invariants UltraCore-RFT →
PLANNED Coq development for core state transition properties UltraCore-RFT →
Stack

Verification Matrix

Layer Method Status Evidence Scope
L1 Static Analysis ACTIVE Clippy, Miri, cargo-audit on every push All Rust repos
L2 Engineering Tests ACTIVE 15+ tests/component, differential hash comparison All repos
L3 Stateful Fuzzing ACTIVE libFuzzer, 4.29B+ executions, seed-reproducible All systems
L3b Kernel Verification ACTIVE seL4 CDT, 1B+ ops, 123/123 tests UltraCore-RFT
L3c DeFi Model Fuzz ACTIVE Aave V4 Hub, 184K ops, 0 violations aave-v4-hub-model
L4 TLA+ Specifications PLANNED Machine-checked proofs in development UltraCore-RFT
L4 Coq Proofs PLANNED Core state transition properties UltraCore-RFT
Reproducibility

Reproducibility Protocol

Every experiment must be traceable from source to result. No black boxes.

$ git clone https://github.com/RFT-SIRM/Rift-L1-Blockchain.git
$ cd Rift-L1-Blockchain
$ cargo build --release
$ cargo test --lib
$ ./target/release/fuzz_integrated --seconds 30 --threads 2

[ 5s] cases= 28750000 ops= 57500000000 ops/sec= 5750000
[ 10s] cases= 57500000 ops= 115000000000 ops/sec= 5750000
...
DONE. Total ops: 1,000,000,000,000+ Violations: 0 Crashes: 0
SOURCE
Git Commit
→
ENV
Rust + libFuzzer
→
SEED
Deterministic
→
CORPUS
Structured Input
→
EXECUTE
1T+ Ops
→
HASH
State Hash
Infrastructure

Architecture Map

Click any node to explore the research ecosystem.

RFT-SIRM LABORATORY
SIRM CORE
Execution
Rift L1
Runtime
Agave / ABIv2
Verify
Fuzz / Diff / Formal
Rift Network
Solana / Anchor
AI Research
Deterministic Agents
seL4 Kernel
CDT Validation
RESEARCH EVIDENCE
Evidence

Case Studies

Real systems. Real verification. Real results across multiple domains.

DeFi

Aave V4 Hub Model Review

Problem: Verify drawn/deficit ledger transitions in Aave V4 Hub invariant model.

Model: Deterministic Python state machine simulating draw, restore, reportDeficit, eliminateDeficit.

Invariants: Supply conservation, mint/burn accounting, dust bound, debt limit.

Method: Seeded fuzzing + boundary matrix B-1…B-5 with RAY = 10²⁷ precision.

Scale: 184,000 operations.

Findings: 0 novel Class A/B findings. R-01 dust events (expected rounding). R-02 liquidity checks passed.

Limitation: Model-level only. Not bytecode audit. Premium, dual-ledger, add/remove/sweep out of scope.

184K
Operations
0
Violations
# Aave V4 Hub — RAY arithmetic class AaveHubModel: def ray_mul(self, a, b): return (a * b + RAY/2) // RAY def check_invariant(self, state): return state.supply == state.minted - state.burned
SVM

Agave Conflict-Aware Scheduler

Problem: Unbounded deferral latency under sustained account-level write contention in Agave banking_stage.

Model: Conflict-graph scheduler with hotspot heat map, generation aging, bounded retry semantics.

Invariants: Accounting (I1), generation monotonicity (I2), pass counter monotonicity (I3), deferred queue drain (I4).

Method: libFuzzer with random SchedulerConfig, transactions, and scheduling passes.

Scale: 91M executions per run, ~4,300 exec/sec.

Findings: RFC published (agave#14274). Not a production patch — research artifact.

Limitation: Standalone scheduler. Not integrated into Agave validator. No mainnet benchmarks.

91M
Exec/Run
#14274
Upstream
# Scheduler — conflict graph fn schedule_batch(txs: &[Tx]) -> Batch { let graph = build_conflict_graph(txs); let groups = independent_sets(&graph); execute_parallel(groups) } // 91M exec/run, upstream #14274
Memory

ABIv2 Memory Contexts

Problem: Writable permission leakage in nested CPI calls under Agave SVM ABIv2.

Model: Per-frame writable permission rollback with dynamic region count calculation.

Invariants: Permission isolation, no cross-frame leakage, bounded region growth.

Method: libFuzzer + Agave SVM mock with structured CPI sequences.

Scale: 4.29B+ executions.

Findings: 1 PoC-only bug found and documented. Upstream uses abi_v2_prepare_for_instruction architecture.

Limitation: Research artifact. Not merged. svm#25 closed.

4.29B
Executions
1
PoC Bug
# Memory — per-frame rollback fn push_frame(&mut self) { let snapshot = writable_snapshot(); self.stack.push(snapshot); } fn pop_frame(&mut self) { let snap = self.stack.pop().unwrap(); restore_writable(snap); }
Kernel

seL4 CDT Complementary Verification

Problem: Independent engineering validation of formally verified seL4 microkernel CDT.

Model: Deterministic state-machine fuzzing of Capability Derivation Tree operations.

Invariants: CDT structural integrity, no dangling capabilities, derivation monotonicity.

Method: Deterministic replay with seed-generated operation sequences.

Scale: 1B+ operations, 123/123 post-marathon tests passed.

Findings: 0 kernel crashes. Independent confirmation of seL4 formal proof.

Limitation: Complementary validation, not replacement of formal proof. Does not cover all seL4 subsystems.

1B+
Operations
123/123
Tests Passed
# seL4 CDT — deterministic fuzz for op in generate_ops(seed): state = cdt_apply(state, op) assert(cdt_invariant(state)) // 1B+ ops, 0 crashes // 123/123 post-marathon pass
Blockchain

Rift-L1 & Rift Network

Problem: Standalone L1 validator core and Solana on-chain protocol with deterministic economic invariants.

Model: SIRM invariants (I1–I4) enforced at protocol core. O(1) distribution via global_field.

Invariants: Supply conservation, mint/burn accounting, dust bound, debt limit.

Method: Stratified libFuzzer (5 modes) + differential validation (Python vs Rust).

Scale: 1T+ L1 ops, 2.5B+ on-chain fuzz runs, 14 audit findings addressed.

Findings: Dust/unregister edge case found and fixed during development.

Limitation: L1 is in-memory state machine; no p2p/consensus yet. On-chain: RC v1.0.

1T+
L1 Ops
14
Findings Fixed
# Rift-L1 — deterministic core pub fn validate_block(block: Block) -> Result { for tx in block.txs { state = apply(state, tx)?; assert_invariants(&state)?; } Ok(state) }
Intelligence — Roadmap

AI & Research

Planned research directions. No public artifacts yet — active development tracks, not deployed systems.

🧠

Deterministic Agents

Neural networks constrained by invariant-preserving execution. Every agent action is a state transition subject to SIRM checks.

RESEARCH
Hypothesis: Agent state can be modeled as SIRM state machine.
Invariant: Agent actions never violate protocol invariants.
Current Status: Conceptual framework only.
Evidence Needed: Prototype agent with invariant enforcement.
↻

Stateful AI Workflows

Multi-step inference pipelines where intermediate state is hashable and replayable. No hidden state between steps.

RESEARCH
Hypothesis: LLM inference chains can be deterministic given fixed seed and temperature=0.
Invariant: State hash at each step is reproducible.
Current Status: Literature review.
Evidence Needed: Benchmark across models showing hash stability.
🔒

Invariant-Preserving Agents

Agents that generate operations but cannot commit state transitions without passing invariant checks. Separation of generation and validation.

RESEARCH
Hypothesis: AI-generated transactions can be sandboxed and validated before execution.
Invariant: Generated ops are rejected if they violate I1–I4.
Current Status: Architecture sketch.
Evidence Needed: Integration with Rift-L1 core.
📊

Reproducible Inference

Seed-reproducible model inference with state-hash-based validation. Every output trace is verifiable.

RESEARCH
Hypothesis: Model weights + input + seed = deterministic output hash.
Invariant: Hash(output) is constant across identical inputs.
Current Status: Not started.
Evidence Needed: Cross-platform reproducibility study.
🎯

Deterministic Orchestration

Multi-agent coordination where message passing is modeled as state transitions with ordering invariants.

RESEARCH
Hypothesis: Multi-agent systems can use conflict graphs for deterministic scheduling.
Invariant: No two conflicting agents execute simultaneously.
Current Status: Theoretical extension of scheduler research.
Evidence Needed: Simulation with 2+ agents.
🔍

Invariant Discovery via Learning

Neural networks trained on execution traces to identify implicit invariants that human reviewers might miss.

RESEARCH
Hypothesis: Execution traces contain patterns indicating implicit invariants.
Invariant: Discovered invariants are validated against fuzz corpus.
Current Status: Literature review on invariant mining.
Evidence Needed: Corpus of traces + classifier accuracy.
History

Research Timeline

From first principles to production systems. A trace of verifiable milestones.

2026 Q2 — Foundation COMPLETED

RFT-SIRM Laboratory Established

Initial formulation of Stable Invariant Rift Model. First mathematical proofs of I1-I4 constraints. Repository structure and CI pipeline.

2026 Q2 — Verification COMPLETED

First Fuzzing Campaign

libFuzzer integration with structured state-machine inputs. 100M+ executions in first month. Zero invariant violations. Differential validation framework between Python and Rust.

2026 Q3 — seL4 COMPLETED

Kernel Complementary Verification

Independent validation of seL4 CDT. 1B+ operations, 0 crashes. Post-marathon test suite: 123/123 passed. First external research collaboration.

2026 Q3 — DeFi COMPLETED

Aave V4 Hub Model Review

Deterministic fuzzing of Aave V4 Hub invariant model. 184K operations, 0 violations. Complementary to Certora formal verification. Published methodology.

2026 Q4 — Scheduler COMPLETED

Conflict-Aware Scheduling

Agave banking_stage scheduler with contention graph analysis. 91M exec/run. Upstream issue #14274 filed. Permission rollback memory contexts.

2026 Q4 — Network ACTIVE

Rift Network Audit Complete

14 security findings addressed. 2.5B+ fuzz runs. Rift-L1 standalone validator core: 1T+ operations, 0 invariant violations.

2026 Q4 — Formal PLANNED

TLA+ Specifications

Machine-checked proofs of critical invariants in TLA+. Coq development for core state transition properties. Target: fully verified execution path.

2026 Q4 — Scale PLANNED

High-Assurance Infrastructure

Kernel-agnostic deployment. Critical computing environments. Additional verified kernels beyond seL4. Production-ready validator network.

Reference

Glossary 2.0

Precise definitions for terms used throughout the RFT-SIRM ecosystem. Click to expand.

SIRM +
Stable Invariant Rift Model — the mathematical core enforcing four hard constraints (I1-I4) after every state transition.
Full name: Stable Invariant Rift Model
Type: Mathematical framework
Constraints: I1 Supply Conservation, I2 Mint/Burn Accounting, I3 Dust Bound, I4 Debt Limit
Property: Every state transition is rejected if any invariant is violated.
First defined: 2026 Q2, RFT-SIRM Laboratory
Invariant +
A predicate over state that must hold before and after every transition. In RFT-SIRM, invariants are hard constraints: violation returns Err, not panic.
Types: Safety, conservation, monotonic, bounded, temporal
Enforcement: Hard constraint — operation rejected on violation
Contrast: Soft invariant = warning; Hard invariant = rejection
Example: total_supply = total_minted - total_burned
State Machine +
Deterministic automaton where every operation is a total function from state to state. Same inputs always produce same outputs.
Property: Deterministic — no randomness in transition function
Property: Total — defined for all valid inputs
Transition: S(t+1) = T(S(t), op(t))
Verification: Hash(S_final) = deterministic(seed, ops[])
Deterministic Execution +
Given the same initial state and operation sequence, the system always produces the identical final state and hash. No randomness in critical paths.
Requirement: Seed-reproducible testing
Benefit: Differential validation between implementations
Scope: Core state transitions; networking is explicitly out of scope
Tool: libFuzzer with structured inputs
Deterministic Replay +
Given seed + operations[], the system reproduces the exact state trace. Enables bug reproduction and differential validation.
Formula: seed + ops[] → S_final → Hash
Use: Regression testing, audit trails, differential validation
Requirement: No non-determinism in transition function
Repository: All RFT-SIRM fuzz harnesses
Differential Validation +
Comparing state hashes between two implementations (e.g., Python vs Rust) to prove equivalence under a test corpus.
Method: Hash_python(S_t) == Hash_rust(S_t)
Scope: Same seed, same ops, same initial state
Limitation: Proves equivalence under corpus, not formal proof for all inputs
Used in: Rift-L1-Blockchain (Python reference vs Rust impl)
State Hash +
Cryptographic hash of the entire protocol state. Used for differential validation and replay verification.
Input: All state variables (global_field, total_base_sum, participants, etc.)
Property: Any state change produces different hash
Use: Detect divergence between implementations
Algorithm: Deterministic serialization + hash function
O(1) Distribution +
Updating a global scalar field changes every participant's effective balance simultaneously, regardless of participant count.
Standard: for i in 0..N: balance[i] += reward/N → O(N)
Rift: global_field += reward/p → O(1)
Effective balance: base_balance[i] + global_field
Trade-off: Reading individual balance requires addition; no free lunch
RAY +
Fixed-point arithmetic with 27 decimal places (10²⁷). Used in Aave V4 Hub and DeFi invariant models.
Value: RAY = 1,000,000,000,000,000,000,000,000,000
Rounding: Explicit directional — ray_mul_up, ray_mul_down, ray_div_up, ray_div_down
No half-up: Only floor and ceiling modes
Used in: Aave V4 Hub model review
CPI +
Cross-Program Invocation — the mechanism by which Solana programs call other programs. Requires careful memory isolation.
Full name: Cross-Program Invocation
Risk: Writable permission leakage in nested calls
Mitigation: Per-frame permission rollback (ABIv2 research)
Upstream: svm#25 (closed, PoC-only finding)
Conflict Graph +
A graph where nodes are transactions and edges represent shared state access. Used for parallel batch scheduling.
Nodes: Transactions
Edges: Shared writable account access
Use: Independent set extraction for parallel execution
Research: agave-rift-scheduler, upstream #14274
Capability Derivation Tree +
The formally verified subcomponent of the seL4 microkernel handling capability relationships.
Context: seL4 microkernel
Property: Formally proven correct (seL4 proof)
RFT-SIRM work: Complementary engineering validation via fuzzing
Result: 1B+ ops, 0 crashes, 123/123 tests passed
Fuzz Corpus +
Collection of seed inputs that maximize code coverage. Used for continuous invariant verification.
Generator: libFuzzer with structured state-machine inputs
Coverage: ~2,661 features, ~436 corpus entries (scheduler)
Stabilization: Typically within first 100K executions
CI: 5h 55m runs on every push
Formal Verification +
Mathematical proof that a system satisfies its specification. Contrasts with testing, which only samples behavior.
Current status (RFT-SIRM): Planned (TLA+, Coq)
Complementary: Fuzzing increases confidence but does not prove correctness
Target: Machine-checked proofs of I1–I4
Timeline: 2026 Q4 planned
Connect

Contact & Resources

Research collaborations, security disclosures, and architectural discussions.

Research Laboratory

RFT-SIRM is a deterministic invariant systems research laboratory. We collaborate on formal verification, state transition architectures, and high-assurance distributed systems.

All repositories are open source under Apache 2.0. Contributions, corrections, and architecture discussions are welcome.

⚡
Organization github.com/RFT-SIRM
◈
Main Repository UltraCore-RFT
🌐
Laboratory Website rft-sirm.github.io
Loading...