added proof and runtime analysis