No, the proof that the compiled code is &quot;correct&quot; does <i>not</i> depend on the compiler being correct - it can be checked independently.<p>Of course, if the compiler is incorrect it might generate incorrect code, but then the &quot;proof&quot; that the code is correct would not check.<p>Mind you, it&#x27;s very ambiguous to describe what their compiler is doing as producing a proof of &quot;correctness&quot;. Any time someone says &quot;correct&quot;, you should ask, &quot;correct with respect to what?&quot; In this case, AIUI, their compiler produces:
(a) a formal description of what the program does (what they call &quot;a high-level shallow embedding of the program&#x27;s semantics&quot;)
(b) a proof that this is in fact what the program does (its &quot;correctness&quot;)<p>The idea being that if you want to show that your program is <i>actually</i> correct with respect to the specification you really care about, you do the proof on the formal description (a), and then (b) automatically guarantees your proof carries over to the actual program.