Formally proving the correctness of the (un)currying refactoring