No, it doesn&#x27;t break the promises in any way. If <i>all your code</i> does potentially dangerous memory manipulation, then there&#x27;s very little hope that there will ever be an automatic checker for the safety of your program.<p>The promise of Rust rests on the assumption that <i>most code is not like that</i>. There are a few fundamental data structures that do crazy stuff, and okay, we have to use `unsafe` there - and if we want to have any formal guarantees, we have to do a formal proof. If are happy with less, we just manually audit that data structure extra carefully. We also put every such data structure in its own module, which carefully limits the amount of code that is exposed to this unsafety.<p>However, most of the code will just <i>use</i> those data structures, and that&#x27;s where Rust gives you a safety guarantee. Combing `Vec` and `HashMap` and all the other types from the standard library in any way you want, hammer them from multiple threads, send stuff across channels, whatever - you can do all of that safely, and if your code crashes, you don&#x27;t have to look at all this code because you did not write `unsafe`, only the standard library did - and you are in a separate module.<p>&gt; Now its that you have to just make sure all your code is correct, not just the unsafe blocks.<p>This is not correct. As I wrote in the post, you have to check <i>all code within a module that contains `unsafe`</i>. Most of the modules people write do not contain `unsafe`, and hence are not checked.<p>I&#x27;d be curious to learn why you think this is the case.