INFRA Signal 422 2 feeds carried it
Postmortem for Kernel Soundness Bug #14576
The incident shows that implementation bugs in proof assistants can undermine soundness, and that independent checkers provide real protection—though here two unrelated bugs in two implementations coincidentally aligned to let the exploit slip through. Anyone relying on Lean for formal verification needs current patch releases, and the postmortem reinforces that the kernel must be the sole trust boundary for type checking, not the frontend or elaborator.
Written by elseif from the cluster below · every claim links back to a sourceThe three things worth knowing
The bug let phantom parameters in nested inductive types escape type checking, enabling a proof of False, but was only reachable through metaprogramming that bypassed the frontend's own checks.
An independent checker (nanoda) missed the exploit due to a separate coincidental bug, demonstrating that multi-implementation checking works in principle but requires keeping all implementations current.
AI-assisted auditing found additional programming mistakes in the kernel, all now fixed, and the project has hardened kernel invariants and now runs nanoda by default in its continuous comparison infrastructure.
THE CLUSTER