add correctness proof sketch