Dafny program verifier finished with 4 verified, 0 errors