Blockchain and Formal verification (English)

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Blockchain
and
Smart Contract Veriﬁcation
Tezos Japan, DaiLambda, Inc.
Jun FURUSE/古瀬淳, Taipei, 2019-08-29FLOLAC’19

Bit of myself: Past
OCaml researcher and programmer
Studied type system of FP
Like Haskell too
FP in Financial Systems
Der...

Bit of myself: Now
NPO to promote Tezos technology in
Japan.
A small company to participate Tezos
core development.

Bit of Tezos
3rd gen. cryptocurrency
(1st: Bitcoin, 2nd: Ethereum, 3rd: many)
Consensus algorithm: Proof of Stake
On Chain...

Today’s Agenda
Brief History of Currency
What is Blockchain?
Technical Aspects of Blockchain
Proof of Stake
Bit more about...

Brief History of Currency

Brief History of Currency
Main theme: “How to trade smoothly?”

Bartering
⇄

Complex Bartering
←
↘ ↗

Birth of Currency
⇄ ⇄
⇅

貝貨
China, 1100 BC
貝貞負貢財貨貫責貪販
貧貶貽賀貲貳貰貸貯貼
買費貿賈賊賃賂賄賑賓
賜質賞賤賠賣賦賚賢賭
購賽賺賻贄贅贇贊贈贏Monetaria moneta
Shell has a built-in value (beaut...

Conditions for Currencies
Scale of value (comparison of values)
Means of exchange (easy to carry)
Means of store of value ...

Coins
Mintable: Governments can control the money
supply.
China, 800 BC (刀貨, 布貨)
Coins have built-in values as precious
me...

Convertible Paper Money
Easier to carry
Assured conversion to gold (or silver, copper)
Total supply is limited to the gove...

The First Convertible Paper Money
交子in China, around 1050
Started as private notes for iron coins.
宋dynasty assured the co...

Credit
This is not currency, but optimized trade efﬁciency
by recording credit/debt using numbers.

Fiat Money
Inconvertible!「法定通貨」
Since 1971, at the end of .
No more support by precious metal, but money stayed as money.
...

The First Fiat Money
交子in China, around 1050, again.
The world ﬁrst convertible paper money
… and soon became the world ﬁr...

Electronic Money
No more medium. Just numbers in electrons.
Pegged with government currencies.
Very centralized. Manager c...

The Basis of the Value of Currencies
Less and less:
The value of the medium: Nothing
Convertible with precious metal: No
T...

Chartalism
Means of paying tax
You have to pay tax or you get arrested.

Radical Theory: Common Knowledge
Common knowledge that it is money.
With it, no need of centralized power!!
Iraqi Swiss di...

Rise of Cryptocurrencies
Since 2009-01-03 (Bitcoin):
Electronic
Decentralized: no central bank
Cryptography to prevent cou...

Tracking vs Privacy
Electronic money made tracking much easier.
Powers love tracking.
Public do not like being tracked.
No...

Blockchain Overview

What is Blockchain?
Let’s forget currency for now:
Ledger style DB
Distributed
Open network
Token
Smart contracts

Ledger Style DB
DB by history accumulation
B1 → B2 → B3 → B4 → ..
S0 = ∅
S1 = B1(S0)
Sn = Bn(Sn-1) = Bn(Bn-1(..(B1(S0))))
...

Distributed DB
Multiple DB nodes, each carries a replica of the DB:
Fault tolerance
Load balancing

Distributed DB: conﬂicts
How to resolve conﬂicts?
B
→→
A
x = A
x = A
x = A →→x = B
x = B
x = A
x = B
or
?
? ?

Consensus Algorithm
Algorithm to resolve conﬂicts between nodes.
Bad news: There is no such algorithm [FLP85].
Every proto...

Good news: Paxos
It may not terminate, but practically it is OK.
Voting between nodes
Only for closed network with
ﬁxed no...

Closed Network
If you are happy with it, you do not need
“Blockchain”.

Open Network
Permissionless public network,
where anyone can join with a node.
Decentralized, therefore neutral
Almost imp...

Problem of Open Network Consensus
Consensus control and inhibition
by Sybil attack: produces fake
identities to dominate t...

Satoshi Nakamoto and Bitcoin
Prevent Sybil attacks i.e. inﬁnite identity creations:
Requirement of real world resource:
co...

Cryptocurrencies
A solution to Sybil attacks against open networks.

Smart Contracts
Ledger DB can carry not only account balance,
but any data, even program code.
Code attached to an account...

Gas cost
Smart contracts cannot run inﬁnitely.
To prevent DoS attacks, the caller
must pay the running cost to the miner:
...

What is Blockchain
Ledger DB
Distributed
Open network
Token for incentives
Smart contracts

Blockchain: Technical Details

Blockchain Network
P2P network with multiple nodes,
each has a replica of the ledger DB.

Reading from the DB
Query past / current state of the ledger to a node.
! ?
→
? !
→

Writing to the DB
Sending operation to a node:
Transactions
Account creations, etc
Operations spread into the P2P network....

Block creation
Block proposer (or miner) chooses operations found
in his node and form a block of them.
The validator rele...

Ledger Update
Each node updates its state by applying .
where
This forms a “blockchain”:
S B
= ∅S0
= ( ) = ( (. . ( ( )). ...

Cryptographic Integrity
More precisely, and are digitally signed
to avoid forgery:
where is a raw operation.
where
Digital...

Conﬂicts
Chain branches when multiple miners propose more
than one blocks:
B = [ O1, O2 ]
→
B
B →
B'
B'
B' = [ O3, O1 ]
B
...

Attack: Double Spending
You can steal exchanging tokens in the both branches:
↗
↗ →
Bn+1
Sn+1 →
Bn+2
Sn+2 →
Bn+3
Sn+3
. . ...

Proof of Work (PoW)
Blocks must be with an answer to a hash puzzle :
is generated from .
is a weak hash function.
The node...

Incentivize Miners
The cost of solving hash puzzles is covered by
rewards.
Block reward , newly minted.
Transaction fee: i...

Nakamoto Consensus
Rewards are only available in the branch. No incentive to bet on
shorter branches.
Longer branches migh...

51% Attack
Someone with more than 50% of computation power
can take over the chain to perform double spending.
⬇
. . → . ....

51% Attacks are Real
Minor PoW blockchains, which requires less hash
power, are targets of 51% attacks:
Verge (XVG), 2M US...

Blockchain: Technical Details
Typical PoW
Operation injection
Block creation of operations, and upload
Ledger update by bl...

Proof of Stake and Tezos

PoW is Energy Inefﬁcient
Bitcoin uses 73.12T Wh to maintain its network per year.
Which is 3.6B USD/y.
Equivalent with the...

Risk of Centralization
Miners tend to concentrate:
PoW is less proﬁtable in regions with higher electricity fee.
Concentra...

Incentive Misalignment of PoW
Stakeholders and miners are largely different, and
their incentives are different.
Most of t...

Proof of Stake (PoS)
PoS: Another Solution to Sybil Attack:
Block mining right based not on computation power but on the
s...

Raspberry PI 3, 2watts
for Tezos
PoS: Eco-Friendly + Decentralization
No competition of solving puzzles:
Mining → “Baking”...

PoS: Aligned Incentives
Miners ⊂ Stakeholders
You have to hold your position long enough
to participate the consensus.
Min...

Possible Attacks to PoS
Double spending by branching with past stake:
Nothing at stake attacks
Long range attacks
Excha...

Tezos Consensus
Countermeasures against the attacks.
For nothing at stake attacks
Endorsement
Security deposit
For nothing...

Endorsement
Based on Nakamoto Consensus with endorsement.
For each block level , 32 endorsers are chosen:
Each endorse one...

Security Deposit
Security deposit for mining and endorsement.
Branching attempt is punished by slashing the deposit and
re...

Checkpoints
Record block hashes periodically outside of the
chain:

H(B)
https://www.news.com
Tezos’s block hash at i...

PoS and Tezos
PoW has energy inefﬁciency and incentive unalignment
PoS: Mining right proportional to the stake against Syb...

Other Tezos Highlights

Other Tezos Highlights
Basic philosophy
Liquid PoS
On chain governance
Formal veriﬁcation

Philosophy of Tezos
Blockchain protocol for stakeholders
Safety is the ﬁrst priority

(Virtual) Pure PoS
All the stakeholders can propose blocks.
Direct democracy.
Problem: it does not scale:
Not all stakehol...

Delegated PoS
Blocks are proposed only by small num of delegates.
Stakeholders can vote to select delegates.
Indirect demo...

Liquid PoS (Tezos)
All the stakeholders can propose blocks,
or they may delegate their rights to other miners.
“Protocol i...

Liquid Democracy
https://medium.com/organizer-sandbox/liquid-democracy-true-democracy-for-the-21st-
century-7c66f5e53b6f

Tezos and On Chain Governance

What is Governance in Blockchain
“How to fork (upgrade) protocols?”
Soft/Hard fork
Soft fork
Backward compatible
Hard fork...

Risk of Hard Fork
A hard fork of a protocol may cause
a hard fork of the community.
Ethereum and Ethereum Classic hard for...

On Chain Governance
Protocol upgrade is implemented in protocol itself,
and all the processes are recorded on chain:
Proto...

Tezos: Protocol Separation
Deﬁne the target of on chain governance:
Shell
Network, storage, etc. Not the target, since the...

Tezos: On Chain Governance
90 day cycle of governance:
Code of proposals uploaded
First vote: select one of them
Second vo...

Tezos: Governance History
“Athens”: Tezos’s ﬁrst protocol upgrade.
Just changes of few constant parameters.
2019-05-21: Pa...

Other Tezos Highlights
Basic philosophy
Liquid PoS
On chain governance
Formal veriﬁcation ← Coming soon

Formal Veriﬁcation in Tezos

What is Blockchain (again)
Ledger DB
Distributed
Open network
Token for incentives
Smart contracts

Safety Requirements of Blockchain
As a consequence of introduction of token rewards
for open distributed DB:
Speculative m...

Safety of Smart Contracts
Smart contracts must be also very secure.
Past incidents around smart contracts:
The DAO (3.6M E...

$The DAO contract user { do_deposit() { bank.deposit(100); } do_withdraw() { bank.withdraw(); } } contract bank { deposit()...$

$The DAO contract attack { do_deposit() { bank.deposit(100); } do_withdraw() { bank.withdraw(); } default() { bank.withdraw...$

Blockchain is a Big Pile of Components
Protocol: consensus, incentive design, transaction semantics
Smart contract: semant...

How to Secure Blockchain
Test
Important but not enough.
Formal veriﬁcation
The way to go.

Software Test
Run a system under given conditions
to see everything goes ﬁne.
Run and see, then repeat. Easy.
Testable onl...

Formal Veriﬁcation
Mathematically prove programs have good/bad
properties.
Property is assured for all the cases,
if prove...

Formal Veriﬁcation Methods
Static typing
Model checking
Theorem proving

Static Type Checking
Express properties of values and expressions in types.
Restrict program compositions to those typable...

Model Checking
Abstract a program to a ﬁnite state transition system,
then check it satisﬁes the properties we want.
Pros:...

Theorem Proving
Prove the property of program directly,
using proof assistant such as Coq:
Pros: most powerful
Cons: Writi...

Formal Veriﬁcation for Blockchain
Formal veriﬁcation is used for critical systems such
as:
Aerospace industry
Nuclear plan...

Tezos and Formal Veriﬁcation
Statically typed smart contracts
both at VM and high level language levels
Modeling of smart ...

Michelson: Tezos Smart Contract VM
Stack VM
Purely functional: no side effects
No mutable variables
Transactions are not s...

Michelson interpreter
Implements the semantics of Michelson in node:
Purely functional: no side effects
Secured by GADTs (...

Mi-Cho-Coq: VM modeling in Coq
Michelson is reimplemented in Coq proof assistant.
Provides framework to prove correctness ...

Smart Contract Correctness Proofs
Using Mi-Cho-Coq.
例:
An operation to the account is performed only when enough
number of...

HACL*: Veriﬁed Cryptography
Formally veriﬁed cryptographic functions in F*.
ChaCha20, Salsa20, HMAC, SHA-256, SHA-512, Ed2...

F*
Functional language with reﬁnement types,
developed by Microsoft:
Compatible syntax with OCaml
Some veriﬁcations can be...

On Going Projects
They are just I know so far:
Sparse Merkle tree for storage.
The correctness of tree operations will be ...

Tezos and Formal Veriﬁcation
Blockchain is a critical system.
Test is important, but FV is also required.
All components s...

Tezos Hands on

Calicurum
Preparation
Docker images install
Git repository
Basic transaction
Try tezosclient
Account creation
Token trans...

Preparation

Prep #1: Docker and images
Install
Linux users: conﬁgure so that you can run docker command
without sudo: ( )
Install 2 do...

Prep #2: Clone Git repository
Contents
tezoshandsonnode
A sandboxed node for hands-on
tezosclient
. You can do everythi...

If you dare want to build Docker
images…
Sources are available in
dockernode/ and dockerligo/ of the repo.

Are You Ready?

Usual Tezos Development…
We usually start a Tezos node connecting to the test
network called “Alpha net”:
↪↪
Tezos Network...

Today, We Use Sandbox
↪↪
Closed in your computuer. No external net access required.
No need to sync with the test/main net...

Sandboxed Environment for Hands-on
Let’s start it:
and keep it running.
Note: The node uses TCP port 18732.
Reset, if some...

Start-up Example
$ ./tezoshandsonnode
Starting /home/tezzy/tezos//tezosnode run datadir
/home/tezzy/.tezoshandso...

Check it is working
Open a new terminal, then:
$ ./tezosclient bootstrapped ↩
Current head: BLNeoW9n94mD (timestamp: .....

ICO Commitments
Tezos fundraiser donors receive commitment
information to activate their Tezos accounts in
Mainnet.
In thi...

Account Activation
Careful of typo.
tz1xx..xx is the name (public key hash) of the account.
alice is an alias, which you c...

What Happend?!
I do explain.
$ ./tezosclient activate account alice with
commitments/tz1MawerETND6bqJqx8GV3YHUrvMBCDasRB...

1. Check the connected node
The node must be well sync’ed with the network:
The sandbox is always bootstrapped, so no prob...

→
→
O1
O1
O1
O1
O1
O1
O2
O2
O2
O2
O2
O2
O2
O2
2. Inject the operation to the network
Operation ooyyy..yyy for the
account ...

B1 = [ O1, O2 ]
→
B
B
B
B
B
B
B
B
3. The Op. is now in a new block
There is a validator in the sandbox.
Detected the valid...

4. You may wait for more blocks.
The block may be still overridden by the consensus.
Under Nakamoto consensus, longer you ...

Operation Processing in Tezos
The same as we saw for the activation:
Make an operation.
Upload the operation to the P2P ne...

Account Query

How much do I have?
Ask the blockchain:
alice is an alias of
tz1MawerETND6bqJqx8GV3YHUrvMBCDasRBF.
Therefore,
$ ./tezoscl...

Balance of the others
Tezos accounts are not anonymous.
You can check the balance of other’s. For example,
tz1TGu6TN5GSez2...

Account Alias
You can give an alias to an account:
$ ./tezosclient add address jun
tz1TGu6TN5GSez2ndXXeDX6LgUDv...

Accounts known by tezosclient
alice’s secret key (sk) is known. It is your account.
jun’s secret key is not available. It...

Sending tokens

Send some to jun
Thanks! It prints lots:
I do explain.
$ ./tezosclient transfer 100 from alice to jun ↩
$ ./tezosclient...

1. Check the connected node
Waiting for the node to be bootstrapped before injection...
Current head: BL.. (timestamp: .....

2. Gas estimation
and operation injection
Estimated gas: 10200 units (will add 100 for safety)
Estimated storage: no ...

3. The operation is now in a new block
Let’s see more details here.
Operation found in block: BL6H8145DMyPeXBQBc2JPRKpVstJ...

3.1 Revealation the public key
The public key edpkuSR6ywqsk.. of alice must be
revealed to the blockchain, so that others ...

3.2 The transaction
  Manager signed operations:
    From: tz1MawerETND6bqJqx8GV3YHUrvMBCDasRBF
    Fee to the baker: ꜩ0...

4. You may wait for more blocks.
The operation has only been included 0 blocks ago.
We recommend to wait more.
Use comma...

Check the balance
The token was really transferred? Check it:
The balance of alice should decrease by 100tz + the
fee paid...

You cannot steal jun’s token
Since you do not know his secret key:
alice’s secret key is known by tezosclient.
It is stor...

Gas, Storage, and Fee of Tezos
Who wants to issue opreations in Tezos must propose:
Cost Estimation
Gas limit
How much CPU...

What Validator Does
Compare the cost estimation and the fee:
Fee > Cost estimation
Take the operation into the new block t...

Build your new account
Create a pair of secret and public keys. Easy:
$ ./tezosclient gen keys alice2
$ ./tezosclient li...

Burn: fee to add storage
Sending from alice to alice2 10000ꜩ fails:
Additional storage is required to record the new
accou...

Smart Contract

How Tezos Smart Contracts Work
Accounts KTxxx..xxx can have smart contracts.
Contract state
Balance
Code
Persistent storag...

Tezos Contract is Pure Function
Input
Parameter given at the transaction.
Storage contents
Global constants
(current accou...

Michelson
for Tezos smart contracts, and its language.
VM but high level:
Statically typed
, with arbitrary precision. No ...

CameLIGO
Today, we use
high level language for Tezos smart contracts.
Compiler
LIGO code is compiled down to Michelson
2 s...

Disclaimer
to talented OCaml programmers
CamLIGO is not OCaml.
No recursions: let rec
Type inference is not fully automati...

The First CamLIGO Contract
Replace the storage by the parameter string:
Puzzled?
Relax. I do explain.
let main (parameter ...

Function Deﬁnition
Arguments must be type-annotated:
(parameter : string)
Arguments are white space separated:
let f (x : ...

Contract Entrypoint
A function with 2 arguments of:
Parameter: here, parameter
Storage value: here, storage
returns a tupl...

Compilation
Place the contract code at contracts/first.mligo
Specify the entrypoint function name main
If you made no mist...

Look of Michelson Code
Puzzled?
No worry, I do not explain.
{ parameter string ;
  storage string ;
  code { {} ;
     ...

Contract Deployment
first: Alias of the contract
for alice: Manager is alice
transferring 0 from alice: Initial balance is...

Did not work for you?
Few things you should check:
Check typo
Your account alias is alice?
Quotes are important: '"initial...

If you are successful
I do explain.
$ ./tezosclient originate contract first for alice transferring 0 from alice running ...

Deploy Result
Gas limit: 16374, Storage limit 526 bytes
Proposing fee to the validator: ꜩ0.002139
The contract is owned by...

The wallet knows the new contract
Not addresses but contracts this time.
$ ./tezosclient list known contracts ↩
first: ...

Check the state of the contract
$ ./tezosclient get script code for first ↩
{ parameter string ;
storage string ;
...

Call the Smart Contract
Same as the simple transaction we did,
but specify the parameter with arg
$ ./tezosclient trans...

Did not work for you?
Check typo
Your account alias is alice?
Commands are designed intentionally long to avoid mistakes.
...

Let’s check the result
$ ./tezosclient get script storage for first ↩
"whatever you sent"

$ ./tezosclient get balan...

Congratulations!
You are now a Tezos engineer.

Smarter Contracts
Returning Operations
By returning non empty operation list, smart
contracts can send tokens to other add...

Smarter Contracts: Boomerang
If someone sends non-zero token, return it to the
source. Otherwise, do nothing.
Function arg...

Smarter Contracts: Global Constants
Global constants to use:
amount: The amount of transaction
source: The address which i...

Smater Contracts: functions for ops.
Functions to create operations:
Operation.transaction
: 'a > tez > 'a contract > o...

Smater Contracts: Boomelang
Conditional
if e1 then e2 else e3
Non empty list
[ 1 ; 2 ; 3 ]
Local deﬁnition
let v = e1 in e...

Compile+Deploy
$ ./ligo compilecontract contracts/boomerang.mligo main

$ ./tezosclient originate contract boomerang f...

Then Call!
Check the token was returned to alice.
$ ./tezosclient transfer 10 from alice to boomerang
Balance update...

Advanced Excersize
Simple banking: bank
Parameter type
unit
Storage type
Table of deposits, (address, tez) map: you can lo...

Hints
を参考に。
Global constants
amount, sender
The transferred amount is 0 or not:
amount = 0tz かamount <> 0tz
Map operations...

Hints
Deployment
You can give the initial empty map value by init '{}'
Call
You will need burncap when the call makes...

Yet Another Advanced Excersize
The DAO attack used a contract attacker with the
following behavior:
The initial balance is...