SafeDep: Detecting State Mutation Unsoundness in Rust via Dependency Slicing and LLM Reasoning

Abstract

Rust's type system protects safe code, but many low-level abstractions depend on internal unsafe operations whose correctness rests on memory and logical invariants. In struct-based abstractions, a sibling method may legally modify internal fields while invalidating a precondition required by another method's unsafe operation. We call this defect an unsound state mutation. Traditional pattern-based static analyzers support inter-procedural tracking but may lack the capability to model cross-method state interference. Furthermore, they cannot interpret natural-language safety contracts, making these deep defects difficult to detect. LLMs can reason about these contracts, but whole-crate prompting is expensive and often prone to hallucinated paths. To bridge this gap, we present SafeDep, a vulnerability discovery framework that combines compiler-driven static analysis with LLM-based semantic reasoning. SafeDep analyzes Rust MIR to build a field-sensitive read/write dependency graph and slices the graph to retain methods that may affect safety-critical state. An LLM then reconstructs cross-method state transitions from this compact context and generates PoC candidates. A bounded compiler/Miri feedback loop refines the candidates and their exploitability judgments before manual audit. On our evaluation dataset, SafeDep outperforms static and LLM baselines while reducing prompt context. A scan of the top 4,000 crates.io projects found 24 previously unreported soundness vulnerabilities, 18 of which had been confirmed by maintainers or accepted as RustSec advisories at the time of writing.