
Nagini
An automated, deductive verifier for statically typed Python programs. Nagini proves memory safety, absence of runtime errors, and rich functional, progress and information flow properties of real Python code. I lead its development.
Senior Researcher (Oberassistent), Programming Methodology Group
I am a senior researcher in the Programming Methodology Group at ETH Zurich, led by Prof. Peter Müller. I work on automated, deductive program verification, building tools and theory that let us prove, mechanically and with strong guarantees, that software behaves as intended.
My research focuses in particular on the verification of hyperproperties and information flow security for object-oriented programs, and on making powerful verification techniques usable for real-world languages. I lead the development of the Nagini verifier for Python, supervise the 2vyper verifier for Ethereum smart contracts, have been the main developer of the Viper verification infrastructure since 2022, and contributed to the VerifiedSCION project. I received my PhD from ETH Zurich in 2022, for which I was awarded the ETH Medal.
Our paper Towards Cross-Language Verification between Python and C has been accepted in the SpecifyThis track at ISoLA 2026.
I am on the program committee of OOPSLA 2027.
I will give a talk at HYPER 2026.
Our paper Modular Reasoning about Object Relations has been accepted at CAV 2026 and is available here.
I am on the program committee of FMCAD 2026.
I am on the program committee of CCS 2026.
Won second-best team at the VerifyThis 2026 verification competition, together with Jonáš Fiala.
Protocols to Code: Formal Verification of a Secure Next-Generation Internet Router appeared at CCS 2025, where it received a Distinguished Artifact Award.
I design verification techniques and build the tools that put them to work, spanning everyday programming languages, security properties that relate multiple executions, and safety-critical systems from internet routers to smart contracts.

An automated, deductive verifier for statically typed Python programs. Nagini proves memory safety, absence of runtime errors, and rich functional, progress and information flow properties of real Python code. I lead its development.
Techniques to prove that programs do not leak secret information, and more generally to verify hyperproperties relating multiple executions. I design techniques that let standard verification tools check hyperproperties via modular product programs and extend them to concurrent programs (CommCSL).

A verification infrastructure for permission-based reasoning developed at ETH Zurich. Its intermediate language and back-end verifiers are the foundation of tools like Nagini, 2vyper, Prusti, Gobra and VerCors. I have been one of its main developers since 2022.

Full-stack verification of the SCION next-generation internet architecture. Using Viper-based tools, we prove safety and security properties of the production Go implementation of the SCION router — from protocol models all the way down to running code.

Specifying and verifying rich functional and security properties of Ethereum smart contracts. The 2vyper tool verifies contracts written in Vyper against expressive, resource-style specifications that capture properties beyond conventional contract analyzers.
A full and up-to-date list is available on DBLP and Google Scholar.
Second-best team, VerifyThis 2026 verification competition (with Jonáš Fiala).
Distinguished Artifact Award, CCS 2025 CCS ★
for Protocols to Code: Formal Verification of a Secure Next-Generation Internet Router.
Best team, VerifyThis 2023 verification competition (with Alexander J. Summers).
ETH Medal ETH ★ for an outstanding doctoral thesis, ETH Zurich.
Distinguished Artifact Award, OOPSLA 2021 OOPSLA ★
for Rich Specifications for Ethereum Smart Contract Verification.
Best student team, second place, VerifyThis 2021 (with Vytautas Astrauskas).
Best Paper Award nomination, ESOP 2018, for Modular Product Programs.
Best student in Business Information Systems (2008 cohort), Berlin School of Economics and Law.
DMV-Abiturpreis, awarded by the Deutsche Mathematiker-Vereinigung.
Protocols to Code: Formal Verification of a Secure Next-Generation Internet Router (poster) · Dagstuhl seminar “Software Contracts Meet System Contracts”
Modular Reasoning about Global Variables and Their Initialization · OOPSLA, Singapore
Fifteen Years of Viper · CAV, Zagreb
Verification Algorithms for Automated Separation Logic Verifiers · CAV, Montreal
VerifiedSCION: Verified Secure Routing · FRIDA workshop, Montreal
Resource-Based Specifications for Smart Contracts · Lorentz Center, Leiden
Proving Python code correct with Nagini · Swiss Python Summit, Rapperswil
CommCSL: Proving Information Flow Security for Concurrent Programs using Abstract Commutativity · PLDI, Orlando
Rich Specifications for Ethereum Smart Contract Verification · Formal Reasoning about Financial Systems Workshop, Stanford
Rich Specifications for Ethereum Smart Contract Verification · Dagstuhl seminar “Rigorous Methods for Smart Contracts” & OOPSLA, Chicago
Product Programs in the Wild: Retrofitting Program Verifiers to Check Information Flow Security · CAV (online)
Modular Product Programs · Workshop on Program Equivalence and Relational Reasoning (PERR), Prague
Viper: A Verification Infrastructure for Permission-based Reasoning · Tezos/Nomadic, Paris
Nagini: A Static Verifier for Python · CAV, Oxford
MaxSMT-based Type Inference for Python 3 · CAV, Oxford
Modular Product Programs · ESOP, Thessaloniki
Nagini: Verifying Python Programs in Viper · Charles University, Prague
As lecturer at ETH Zurich:
Lecturer · Program Verification (MSc), every spring semester
I have also been a teaching assistant for MSc and BSc courses including Concepts of Object-Oriented Programming, Software Architecture & Engineering, Rigorous Software Engineering and Computer Science I.
I have supervised more than 30 Master’s and Bachelor’s theses, internships and research projects. A selection:
Luca Schafroth, MSc · Formally Verified ASN.1 Python Encoders and Decoders · Report
Nicolas Kaletsch, MSc · Verification of Information Flow Security in the Presence of Unverified Code · Report
Markus Limbeck, MSc · Enhancing Deductive Verification of Unbounded Heap Data Structures · Report
Etienne Birling, MSc · Cross-Language Verification of Python Modules Written in C · Report
Frédéric Necker, MSc · Verification of Object Invariants in the Presence of Unverified Code · Report
Christian Bräm, MSc · Verification of Advanced Properties for Real World Vyper Contracts · Report
Rémi Germe, internship · Idiomatic Specification of Magic Wands in Implicit Dynamic Frames
Felix Beckers, practical work · VS Code Integration for an Automated Python Verifier
Marco Principe, BSc · Enabling Ghost Code in the Nagini Verifier · Report
Johannes Gasser, MSc · Theory-Based Verification Condition Encoding · Report
Micha Greutmann, BSc · Enabling Object Equality Reasoning for Python · Report
Victor Canard-Duchene, practical work · Exploring Loop Pre- and Postconditions in Viper
Pascal Devenoge, BSc · Specification of Python Math and Data Science Libraries
Edgars Vitolins, MSc · Verification of Python Code with a Dynamic Object Model · Report
Patricia Firlejczyk, BSc · Specifying and Verifying Static Initialization in Deductive Program Verifiers · Description
Andrea Keusch, practical work · Adding Debugging Functionality to Viper · Report
Saman Eslami, summer fellowship · Bounded Model Checking for Viper
Raoul van Doren, BSc · Advanced Counterexample Generation for Viper · Report
Christian Bräm, internship
Constantin Müller, MSc · Verification of Programs Written in Libra’s Move Language · Report
Robin Sierra, internship
Robin Sierra, MSc · Verification of Ethereum Smart Contracts Written in Vyper · Report
Pavel Pozdnyakov, BSc · Lightweight Automatic Loop Invariant Selection · Report
Mathias Blarer, BSc · Static Analysis of GPU Kernel Performance Hyperproperties · Report
Severin Meier, MSc · Verification of Information Flow Security for Python Programs · Report
Sascha Forster, BSc · Static Verification of the SCION Router Implementation · Report
Christian Knabenhans, BSc · Automatic Inference of Hyperproperties · Report
Benjamin Schmid, BSc · Abstract Read Permission Support for an Automatic Python Verifier · Report
Benjamin Weber, MSc · Automatic Verification of Closures and Lambda-Functions in Python · Report
Mostafa Hassan, BSc · A Static Type Inference for Python · Report
Anatole Dahan, internship
Vytautas Astrauskas, MSc · Input-Output Verification in Viper · Report
Sahil Rishi, internship
Program committees: OOPSLA 2027, FMCAD 2026, CCS 2026, CAV 2026, iFM 2024, SOAP 2023, PriSC 2023, PERR 2022.
Artifact evaluation committees: ECOOP 2019.
Journal reviews: Formal Aspects of Computing (2025); International Journal on Software Tools for Technology Transfer (STTT, 2023 & 2024).
Subreviews: PLDI 2025, POPL 2024, ICALP 2023, ESOP 2023, ICTAC 2022, ISSTA 2022, SEFM 2020, CAV 2020, VMCAI 2020, iFM 2019, LOPSTR 2019, CAV 2019, ISSTA 2019, TACAS 2019, VMCAI 2019, FM 2018, ESOP 2017.