In safety-critical applications, using a Model Driven Engineering (MDE) approach requires a high level of trust in its underlying model transformations, the correctness of which should be verified formally. However, such verification remains challenging due to the absence of formal foundations of most model-based frameworks involved in MDE (e.g. AADL, SysML). In this paper, we propose a formally founded environment to verify certain aspects of correctness of model transformations in MDE. First, we define a transformation formally: this involves formalizing input and output models at some level of abstraction, as well as the transformation rules. Then, we extend the formalized transformation with contracts to build a Transition System (TS) representing a lightweight extensible verification environment. Finally, we formulate and verify correctness properties which we reduce, based on the previous steps, to reachability properties over the TS. We show how our approach is implemented in Ocarina, an open-source transformation tool for AADL, and how it applies, for example, to build correct transformations from AADL models to real-time task models in Cheddar ADL.