Function contracts allow for input- and output parameters, in this case a fractional permission. The `drop` function takes as input a fractional permission `p` and gives as output a fractional permission `q` that is at most `p` (so that `q <= p`). This verification example shows how to handle such input/output parameters.