add proof of correctness