Three ways formally verified code can go wrong in practice

Formally verified code can still have bugs in practice due to invalid proofs, incorrect specifications, or flawed assumptions. Even when code is proven correct against a specification, the specification may not capture all desired properties or may rely on assumptions that don't hold in real-world use.