31 times faster than Kani, Amazon’s Rust checker, on the same proof 0.285 s against 8.895 s, with the same code and limits on one CPU core, the middle result of 3 full runs. Three checks on Nexagate, not every Rust feature
How it works
Tests check the inputs someone thought of. Bugs live in the ones nobody did. Phage reasons about all the inputs at once, instead of trying them one by one.
It gives one of three answers: the code is proved, here is an input that breaks it, or it does not know. It checks the code the compiler really makes, not only the code we write.
Three checks on our web server
We ran Phage and Kani, Amazon’s Rust checker, on three parts of Nexagate, with the same code and limits.
| Check | Answer | Phage | Kani | Faster |
|---|---|---|---|---|
| QUIC number reader, every input up to 8 bytes | Proved | 0.285 s | 8.895 s | 31.2 times |
| HTTP/2 header decoder, old version | Found a bug | 2.326 s | 8.268 s | 3.6 times |
| HTTP/2 header decoder, fixed, every input up to 12 bytes | Proved | 1.561 s | 6.078 s | 3.9 times |
Same code and limits, one CPU core, the middle result of 3 runs. Three checks on Nexagate, not every Rust feature.
What it found
A real bug in an old version of our web server: a header with a very long number made the math overflow, and the real program crashed. We fixed it, and Phage proved the fix for every input up to 12 bytes.
It also led us to a bug in LLVM, the engine inside the Rust compiler. LLVM 20.1, 21.1 and 22.1 have it. LLVM had already fixed it for 23.1, in pull request 195516 on 3 May 2026.
These are three checks, not every Rust feature. Phage is still young.