Modularity for Accurate Static Analysis of Smart Contracts

Modularity for
Accurate Static
Analysis of Smart
Contracts
The Smart Contract Spechub
MOOLY SAGIV

Noam Rinetzky
James Wilcox
Ittai Abraham
Guy Golan-Gueta
David Dill
Yan Michalevsky
Yoni Zohar
Shelly Grossman
Marcelo Taube

• Software is Eating the World
• Software applications are built of numerous disparate sources
• unknown
• untrusted
• constantly evolving
• Correctness of code = safety, money, human life, …
• Even worse in blockchain
• Immutability: code is law
• Cryptocurrency: code is money

• Problem: Automated financial contracts
• Bugs in contracts = money lost to adversaries for ever
• Pain: Very hard to find bugs in the contracts
• Lots of examples where people have lost large amounts of money
• Customers are willing to >= 6 figures for solutions
• Solution: Automatic Verification
• Find bugs, or prove the absence of bugs (one or the other!)
• Key enabler: higher level specifications that can be checked
• Developers are willing to do most of the work, for reward
• Standards ERC20, ERC721

• Develop a library of reusable
correctness rules
• Community effort
• Code is the law  Spec is the law
• No overdraft
• If no transaction is executed then no cost
• No radical currency changes
• Develop unique static analysis of code
Verification
Report
Test cases
Smart Contract CERTORA
ASA
Rules

• Top-tier paying customers:
• Compound Finance
“We installed Certora's technology and it is used daily by our software engineers
to locate mind blowing bugs”
Geoff Hayes
CTO of Compound Finance
• Coinbase
“The Certora ASA surfaces problems before a contract is available on our platforms, to help
us better inform our customers of risk. The ASA has already surfaced significant problems
missed by expensive and unscalable manual audits."
Shamiq Islam
Head of Security at Coinbase Global
• Investors
• Scott Shenker, repeat unicorn founder (Nicira, Databricks, Nefali)
• Coinbase

contract toyERC20 {
mapping (address => uint) balances;
constructor(address bank, uint initial_amount) {
balances[bank] = initial_amount;
}
function transfer(address to, uint amount) {
uint updatedFrom;
uint updatedTo;
address from = msg.sender;
if (balances[from] >= amount) {
updatedFrom = balances[from] - amount;
updatedTo = balances[to] + amount;
} else { revert(); }
balances[from] = updatedFrom;
balances[to] = updatedTo;
}
}
invariant  a: address balances[a]

balances[from]>=
amount
updatedFrom=balances[from]-amount
revert
TrueFalse
from=msg.sender
updatedTo=balances[to]+amount
balances[from]=updatedFrom
balances[to]=updatedTo
50
Alice Bob
70Alice to=Alice
0
100
70100

g
contract toyERC20 {
mapping (address => uint) balances;
constructor(address bank, uint initial_amount)
{
balances[bank] = initial_amount;
}
function transfer(address to, uint amount) {
uint updatedFrom;
uint updatedTo;
address from = msg.sender;
require from != to ;
if (balances[from] >= amount) {
updatedFrom = balances[from]-amount;
updatedTo = balances[to] + amount;
} else { revert(); }
balances[from] = updatedFrom;
balances[to] = updatedTo;
}
}

DAO_withdraw(to) {
if (shares[to] > 0) {
to.send(shares[to]);
shares[to] = 0 ;
}
}
f () {
DAO(x).withdraw(me)
}

DAO_withdraw(to) {
shares[to] = 0 ;
}
}
DAO_withdraw(to) {
shares[to] = 0 ;
}
}

• Contracts that are vulnerable to reentrancy attacks are dangerous to use
• Sensitive to changes in the EVM
• Constantinople fork postponement
• Most precise method
• Guarantee atomicity in presence of callbacks

• Goal: enable human mitigation of money theft
• Requirement: Price changes must be less than 10% every hour
For all t1,t2. |t2-t1| < 1 hour, |p2-p1| < 0.1p1
Geoff Hayes | CTO

Verification
Condition
Code
Solution:
Bug
No Solution:
Proof
Front End Constraint
Solver
[Z3] Microsoft Research, [CVC4] Stanford University, [Yices] Stanford Research Institude SMT*

z>0
t>z
x:=1x:=0
y:=1y:=0
t=4 z=0
)z>0x=1 ()z0 x=0(
(t>zy=1 ()z0 y=0)
x y
Front End Constraint
Solver
z>0
t>z
x:=1x:=0
y:=1y:=0
TrueFalse
TrueFalse
False
x==y
TrueFalse
TrueFalse
x==y
False

Modularity for decidability
of deductive verification with
applications to distributed systems
Mooly Sagiv

Contributors
Marcelo Taube, Giuliano Losa, Kenneth McMillan, Oded Padon, Sharon Shoham
James R. Wilcox, Doug Woos
http://microsoft.github.io/ivy/

And Also
19
Anindya Benerjee Yotam Feldman Neil Immerman Aurojit Panda
Shachar Itzhaky Aleks Nanevsky Orr Tamir Robbert van Renesse

Why verify distributed protocols?
• Distributed systems are everywhere
• Safety-critical systems
• Cloud infrastructure
• Blockchain
• Distributed systems are notoriously hard to get right
• Even small protocols can be tricky
• Bugs occur on rare scenarios
• Testing is costly and not sufficient

What about correctness of the low level implementation?

Decidable Reasoning for Verification:
How Far Can You EPR?
Oded Padon
PhD Thesis
http://www.cs.tau.ac.il/~odedp
23
http://microsoft.github.io/ivy/

Deductive Verification in First-Order Logic
[CAV’13] Shachar Itzhaky, Anindya Banerjee, Neil Immerman, Aleksandar Nanevski, MS:
Effectively-Propositional Reasoning about Reachability in Linked Data Structures
[PLDI’16] Oded Padon, Kenneth McMillan, Aurojit Panda, MS, Sharon Shoham
Ivy: Safety Verification by Interactive Generalization
[POPL’16] Oded Padon, Neil Immerman, Aleksandr Karbyshev, Sharon Shoham, MS
Decidability of Inferring Inductive Invariants
[OOPSLA’17] Oded Padon, Giuliano Losa, MS, Sharon Shoham
Paxos made EPR: Decidable Reasoning about Distributed Protocols
[POPL’18] Oded Padon, Jochen Hoenicke, Giuliano Losa, Andreas Podelski, MS, Sharon Shoham
Reducing liveness to safety in first-order logic. PACMPL 2(POPL): 26:1-26:33 (2018)
[PLDI’18] Marcelo Taube, Giuliano Losa, Kenneth L. McMillan, Oded Padon, MS, Sharon Shoham, James R.
Wilcox, Doug Woos: Modularity for Decidability of Deductive Verification with Applications to Distributed
Systems
[FMCAD’18] Oded Padon, Jochen Hoenicke, Kenneth L. McMillan, Andreas Podelski, MS, Sharon Shoham:
Temporal Prophecy for Proving Temporal Properties of Infinite-State Systems. FMCAD 2018: 1-11

Verification
Is there a behavior
of 𝑆 that violates 𝜑?
Counterexample Proof
Automatic verification of infinite-state systems
Property 𝜑System 𝑆
25

“Program testing can be used to show the presence of bugs, but never to show their absence!” Dijkstra (1970)
Naïve period in
program verification 70’s

Safety
Property 
Verification
Is there a behavior
of P that violates ?
Counterexample Proof
Program P
Disillusionment in program verification 80’s
[POPL’78, CACM’79] R.A. DeMillo, R.J. Lipton, A. J. Perlis:
Social Processes and Proofs of Theorems and Programs
Rice’s Theorem 
I can’t decide!
Unknown

Challenges in program verification
• Specifying program behavior
• Asymptotic complexity of program verification
• The halting problem
• Rice theorem
• The ability of simple programs to represent complex behaviors
• The complexity of realistic systems
• Huge code
• Heterogeneous code
• Missing code

Mathematical Induction
• P(n) is a property of natural number n
• To show that P(n) holds for every n, it suffices
to show that:
– P(0) is true
– If P(m) is true then P(m+1) is true for every
number m
• In logic
– (P(0) m N. P(m) P(m+1)) 
n N. P(n)
0 m
P(0) P(m)
m+1
P(m+1)

Induction on a ball game
• Four players pass a ball:
–A will pass to C
–B will pas to D
–C will pass to A
–D will pass to B
• The ball starts at player A
• Can the ball get to D?
A B
C D

Formalizing with induction
• 𝑥0 = 𝐴
• 𝑥 𝑛+1 =
𝐶 𝑖𝑓 𝑥 𝑛 = 𝐴
𝐷 𝑖𝑓𝑥 𝑛 = 𝐵
𝐴 𝑖𝑓𝑥 𝑛 = 𝐶
𝐵 𝑖𝑓𝑥 𝑛 = 𝐷
• Prove by induction ∀𝑛. 𝑥 𝑛 ≠ 𝐷
– 𝑥0 ≠ 𝐷 ?
– 𝑥 𝑚 ≠ 𝐷 ⇒ 𝑥 𝑚+1 ≠ 𝐷 ?
A B
C D

Formalizing with induction
• 𝑥0 =
𝐴
• 𝑥 𝑛+1 =
𝐶 𝑖𝑓 𝑥 𝑛 = 𝐴
𝐷 𝑖𝑓𝑥 𝑛 = 𝐵
𝐴 𝑖𝑓𝑥 𝑛 = 𝐶
𝐵 𝑖𝑓𝑥 𝑛 = 𝐷
• Prove a stronger claim by induction ∀𝑛. 𝑥 𝑛 ≠ 𝐵 ∧ 𝑥 𝑛 ≠ 𝐷
– 𝑥0 ≠ 𝐵 ∧ 𝑥0 ≠ 𝐷
– 𝑥 𝑚 ≠ 𝐵 ∧ 𝑥 𝑚 ≠ 𝐷 ⇒ 𝑥 𝑚+1 ≠ 𝐵 ∧ 𝑥 𝑚+1 ≠ 𝐷
A B
C D

Inductive Invariants
Transition System
BadInv
The program is safe with respect Bad iff there exists an
inductive invariant Inv satisfying:
The program is safe if all the reachable states satisfy the property
Inv Bad =  (Safety) Bad = Safety
Init  Inv (Initiation)
if   Inv and  T ’then ’ Inv (Consecution)
Initial
Reach

Counter-model Proof
Deductive verification
Property 𝜑Program 𝑃 Invariant 𝐼𝑛𝑣
Deductive Verification
Is 𝐼𝑛𝑣 an inductive invariant for P that proves 𝜑 ?
 Are the logical verification conditions valid ?

Simple Example: inductive Invariants
x=1, y =1
x=1, y =3
x=3, y =4 x=7, y =6
x=3, y =0 x=3, y =2
x=5, y =4
1: x := 1;
2: y := 2;
while * do {
3: assert odd[x];
4: x:= x + y;
5: y := y + 2
}
6:
x=2, y =2
x=2, y =3
x=4, y =5
odd[x]
x=1, y =0
x=0, y =3
x=1, y =2

Simple Example: inductive Invariants
x=1, y =2
x=1, y =1
x=1, y =0
x=1, y =3
x=3, y =4 x=7, y =6
x=3, y =0 x=3, y =2
x=5, y =4
1: x := 1;
2: y := 2;
while * do {
3: assert odd[x];
4: x:= x + y;
5: y := y + 2
}
6:
x=2, y =2
x=2, y =3
x=4, y =5
x=0, y =3

Dafny [Leino’17]
Property 𝜑System 𝑆 Invariant 𝐼𝑛𝑣
Deductive Verification
Is 𝐼𝑛𝑣 an inductive invariant for 𝑆 that proves 𝜑 ?
K. Rustan M. Leino: Accessible Software Verification with Dafny. IEEE Software 34(6): 94-97 (2017)
SMT Formula
SAT UNSAT
?

Counter-model Proof
Deductive verification
Property 𝜑System 𝑆 Invariant 𝐼𝑛𝑣
Unknown / Diverge
Church’s Theorem
I can’t decide!Deductive Verification
Is 𝐼𝑛𝑣 an inductive invariant for 𝑆 that proves 𝜑 ?

Effects of undecidability(SMT)
• The verifier may fail on tiny programs
• No explanation when tactics fails
– Counterproofs
Copyright: Michael Hanke

Challenges in deductive verification
1. Formal specification: formalizing infinite-state systems and their properties
2. Deduction: checking inductiveness
– Undecidability of implication checking
• Unbounded state (threads, messages), arithmetic, quantifier alternation
3. Inference: finding inductive invariants (Inv)
– Hard to specify
– Hard to maintain
– Hard to infer
• Undecidable even when deduction is decidable

State of the art in formal verification
Expressiveness
Automation
Proof Assistants
Ultimately limited by human
proof/code:
Verdi: ~10
IronFleet: ~4
Decidable Models
Model Checking
Static Analysis
Ultimately limited by undecidability
Ivy
Decidable deduction
Finite counterexamples
proof/code: ~0.2

Effectively Propositional Logic – EPR
a.k.a. Bernays-Schönfinkel-Ramsey class
• Limited fragment of first-order logic without theories
• No function symbols
• Restricted quantifier prefix: ∃∗∀∗ 𝜑 𝑄𝐹
• No ∀∃
F. Ramsey. On a problem in formal logic. Proc. London Math. Soc. 1930

EPR Satisfiability
∃𝑥, 𝑦. ∀𝑧. 𝑟 𝑥, 𝑧 ↔ 𝑟(𝑧, 𝑦)
=SAT ∀𝑧. 𝑟 𝑐1, 𝑧 ↔ 𝑟(𝑧, 𝑐2)
=SAT 𝑟 𝑐1, 𝑐1 ↔ 𝑟 𝑐1, 𝑐2 ∧ 𝑟 𝑐1, 𝑐2 ↔ 𝑟 𝑐2, 𝑐2
=SAT 𝑝11 ↔ 𝑝12 ∧ 𝑝12 ↔ 𝑝22
Skolem
Herbrand

Effectively Propositional Logic – EPR
a.k.a. Bernays-Schönfinkel-Ramsey class
• Limited fragment of first-order logic without theories
• No function symbols
• Restricted quantifier prefix: ∃∗
∀∗
𝜑 𝑄𝐹
• Finite model property
• A formula is satisfiable iff it has a model of size:
# constant symbols + # existential variables
• Complexity:
• NEXPTIME-complete
• Σ2
𝑃
if relation arities are bounded by a constant
• NP if quantifier prefix is also bounded by a constant
F. Ramsey. On a problem in formal logic. Proc. London Math. Soc. 1930

EPR++
• EPR++ allow acyclic function and quantifier alternations
• E.g., 𝑓: 𝐴 → 𝐵 without 𝑔: 𝐵 → 𝐴
• Maintains small model property of EPR
• Finite complete instantiations
• But what can you possibly express in such a restricted logic?
• Transtive closure over deterministic paths
• Set cardinalities
• Avoiding quantifier alternations
• Encoding liveness and LTL [POPL’18]
46

Key idea: representing deterministic paths
[Shachar Itzhaky PhD, SIGPLAN Dissertation Award 2016]
Alternative 1: maintain 𝑛
• 𝑛∗ defined by transitive closure of n
• not definable in first-order logic
𝑛𝑛
𝑛∗
h t
nnh t
Alternative 2: maintain 𝑛∗
• 𝑛 defined by transitive reduction of 𝑛∗
• Unique due to outdegree  1
• Definable in first order logic
𝑛 𝑥, 𝑦 ≡ 𝑛∗ 𝑥, 𝑦 ∧ 𝑥 ≠ 𝑦 ∧
∀𝑧. 𝑛∗ 𝑥, 𝑧 → 𝑧 = 𝑦 ∨ 𝑧 = 𝑥
n*
h tNot first order expressible
First order expressible

Ivy’s principles
• Modularity
– The user breaks the verification system into small problems expressed in decidable logics
– The system explores circular assume/guarantee reasoning to prove correctness
• Inductive invariants and transition systems are expressed in decidable logics
– Turing complete imperative programs over unbounded relations
– Allows quantifiers to reason about unbounded sets
• But no arbitrary quantifier alternations and theories
– Checking inductiveness is decidable
– Display CTIs as graphs (similar to Alloy)

Languages and verification
Language Executable Expressiveness Inductiveness
C, Java, Python…  Turing-Complete Undecidable
SMV  Finite-state Temporal Properties
TLA+  Turing-Complete Manual
Coq, Isabelle/HOL  Expressive Manual with tactics
Dafny  Turing-Complete
Undecidable with
lemmas
Ivy  Turing-Complete Decidable(EPR)

Example: Leader election in a ring
• Unidirectional ring of nodes, unique numeric ids
• Protocol:
• Each node sends its id to the next
• Upon receiving a message, a node passes it (to the next) if
the id in the message is higher than the node’s own id
• A node that receives its own id becomes a leader
• Theorem: The protocol selects at most one leader
• Inductive?
3 5
2
4
1
6
next
next next
next
next
next
[CACM’79] E. Chang and R. Roberts. An improved algorithm for decentralized extrema-finding in circular configurations of processes
3 5
2
4
1
6
2
3 5
2
4
1
6
NO

Example: Leader election in a ring
• Unidirectional ring of nodes, unique numeric ids
• Protocol:
• Each node sends its id to the next
• Upon receiving a message, a node passes it (to the next) if
the id in the message is higher than the node’s own id
• A node that receives its own id becomes a leader
• Theorem: The protocol selects at most one leader
3 5
2
4
1
6
next
next next
next
next
next
[CACM’79] E. Chang and R. Roberts. An improved algorithm for decentralized extrema-finding in circular configurations of processes

Leader election protocol – first-order logic
•  (ID, ID) – total order on node id’s
• btw (Node, Node, Node) – the ring topology
• id: Node  ID – relate a node to its unique id
• pending(ID, Node) – pending messages
• leader(Node) – leader(n) means n is the leader
|
Axiomatized in first-order logic
first-order structureprotocol state
≤
n1
L
id1
n2
L
id2
n3
L
≤ id3
n4
L
n5
L
id5 id6
≤ ≤
<n5, n1, n3> ∈ 𝐼(btw)
id4
n6
L
≤
n1
3 5
2
4
1
6
next
next next
next
next
next 2
5
pnd
id
id id idpnd
n5

|
Axiomatized in first-order logic
first-order structureprotocol state
≤
n1
L
id1
n2
L
id2
n3
L
≤ id3
n4
L
n5
L
id5 id6
≤ ≤
<n5, n1, n3> ∈ 𝐼(btw)
id4
n6
L
≤
n1
3 5
2
4
1
6
next
next next
next
next
next 2
5
pnd
id
id id idpnd
n5

1
 L
next
2
L
next
id id
3
L

id
next
pnd
≤
1
 L
next
2
L
next
id id
3
L
≤
id
next
≤
1
 L
next
2
L
next
id id
3
L
≤
id
next
pnd
≤
1
 L
next
2
L
next
id id
3
L
≤
id
next
≤
1
 L
next
2
L
next
id id
3
L
≤
id
next
pnd

1
 L
next
2
L
next
id id
3
L

id
next

1
 L
next
2
L
next
id id
3
L

id
next
pnd
…
Specify and verify the protocol for any number of nodes in the ring

|
action receive(n: Node, m: ID) = {
requires pending(m, n);
if id(n) = m then
// found leader
leader(n) := true
else if id(n)  m then
// pass message
“s := next(n)”;
pending(m, s) := true
}
action send(n: Node) = {
“s := next(n)”;
pending(id(n),s) := true
}
𝑇𝑅(send):
∃n,s: Node. “s = next(n)” ∧ ∀x:ID,y:Node. pending'(x,y)↔ (pending(x,y)∨(x=id(n)∧y=s))
𝐵𝑎𝑑:
assert I0 = ∀ x,y: Node. leader(x)leader(y) → x = y


1
 L
next
2
L
next
id id
3
L

id
next

1
 L
next
2
L
next
id id
3
L

id
next

1
 L
next
2
L
next
id id
3
L

id
next
pnd

1
 L
next
2
L
next
id id
3
L

id
next
pnd

1
 L
next
2
L
next
id id
3
L

id
next
pnd

Representing Sets of States with First Order
Formulas
• Configurations with at least two leaders
•  X,Y: Node. leader(X)leader(Y) X Y

1
L next
2
L
next
id id

1
L next
2
 L
next
id id
X Y

Representing Sets of States with First Order
Formulas
• Configurations with at least two leaders
•  X,Y: Node. leader(X)leader(Y)  X  Y

1
L next
2
L
next
id id

1
L next
2
L
next
id id

L L L

next next
next
…

Safety property: I0
I0 = x, y: Node. leader(x) ∧ leader(y) → x = y
Inductive invariant: Inv = I0 I1 I2 I3
I1 = n1,n2: Node. leader(n2) → id[n1]  id[n2]
I2 = n1,n2: Node. pending(id[n2],n2) → id[n1]  id[n2]
I3 =n1,n2,n3: Node. btw(n1,n2,n3)  pending(id[n2], n1) → id[n3]  id[n2]
The leader has the highest ID
Only the leader can be self-pending
Cannot bypass higher nodes
Leader election protocol – inductive invariant
EPR Solver
𝐼𝑛𝑖𝑡 𝑉 ∧ ¬𝐼𝑛𝑣 𝑉
𝐼𝑛𝑣 𝑉 ∧ 𝑇𝑅 𝑉, 𝑉′ ∧ ¬𝐼𝑛𝑣 𝑉′
𝐼𝑛𝑣 𝑉 ∧ 𝐵𝑎𝑑(𝑉)
Proof
I can decide EPR!
VC Generator

Leader Protocol 𝐼𝑛𝑣 = I0 I1 I2
rcv(1, id(2))
I0I1 I2  I2

1
 L
next
2
L
next
id id
pnd
3
L

id
next

1
 L
next
2
L
next
id id
pnd
3
L

id
next
Check Inductiveness
CTI
EPR
Ivy: check inductiveness

𝐵𝑎𝑑 =  I0
VC Generator
Leader Protocol 𝐼𝑛𝑣 = I0 I1 I2 I3
EPR Solver
Proof
I0 I1 I2 I3 is an inductive invariant for the leader protocol, proving its safety
I can decide EPR!
Ivy: check inductiveness
𝐼𝑛𝑖𝑡 𝑉 ∧ ¬𝐼𝑛𝑣 𝑉
𝐼𝑛𝑣 𝑉 ∧ 𝑇𝑅 𝑉, 𝑉′ ∧ ¬𝐼𝑛𝑣 𝑉′
𝐼𝑛𝑣 𝑉 ∧ 𝐵𝑎𝑑(𝑉)

L L
≤
id idpnd
pnd
id
≤
id
btw
≤
L
id id
𝐼𝑛𝑖𝑡 ⊆ 𝐼𝑛𝑣 (Initiation)
if 𝜎 ∈ 𝐼𝑛𝑣 and 𝜎 → 𝜎′ then 𝜎′ ∈ 𝐼𝑛𝑣 (Consecution)
𝐼𝑛𝑣 ∩ 𝐵𝑎𝑑 = ∅ (Safety)
∀∗ invariant – excluded substructures
substructure
The leader has
the highest ID
Only the leader can
be self-pending
Cannot bypass
higher nodes
At most
one leader

Modularity
Original system Original inductive argument
Original property

Separate Verification of each module
Incorrect
Finds bug
Correct
Finds proof
subsystem Partial
argument Property
Verification tool

An ADT for pid sets
datatype set(pid) = {
relation member (pid, set)
relation majority(set)
procedure empty returns (s:set)
procedure add(s:set,e:pid) returns (r:set)
specification {
procedure empty ensures ∀𝑝. ¬member(𝑝, s)
procedure add ensures ∀𝑝. member 𝑝, 𝑟 ↔ (member 𝑝, s ∨ 𝑝 = 𝑒)
property [maj] ∀𝑠, 𝑡. 𝑚𝑎𝑗𝑜𝑟𝑖𝑡𝑦 𝑠 ∧ 𝑚𝑎𝑗𝑜𝑟𝑖𝑡𝑦 𝑡 → ∃𝑝. member 𝑝, 𝑠 ∧ member(𝑝, 𝑡)
}
}
We have hidden the cardinality and arithmetic
The key is to recognize that the protocol only needs property maj

Implementation of the set ADT
• Standard approach
• Implement operations sets using array representation
member(p, s) i. repr(s)[i] = p
• Define cardinality of sets as a recursive function ||: set int
• majority(s) |s| + |s| > |all|
• Prove lemma by induction on |all|
∀𝑠, 𝑡. 𝑠 + 𝑡 > all → ∃𝑝. 𝑚𝑒𝑚𝑏𝑒𝑟 𝑝, 𝑠 ∧ 𝑚𝑒𝑚𝑏𝑒𝑟(𝑝, 𝑡)
• The lemma implies property maj
• All the verification conditions are in EPR+++limited
arithmetic (FAU)

• Protocol state
voters: pid  set
• Property maj
s, t: set. ∃p: pid. majority(s) majority(t)
member(p, s)member(p, t)
• Solution: Harness modularity
• Create an abstract protocol model that doesn’t use voters
• Prove an invariant using maj, then use this as a lemma to prove the concrete
protocol implementation
Quantifier alternation cycles
setpid
Quantifier
Alternation Cycle

Abstract protocol model
procedure vote(v : pid, n : pid) = {
require ∀ 𝑚. ¬vote𝑑(v, 𝑚);
voted(v,n) := true;
}
procedure make_leader(n : pid, s : set) = {
require majority(s);
require ∀𝑚. member 𝑚, s → voted(𝑚, n);
isleader(n) := true;
quorum := s;
}
• one leader: ∀𝑛, 𝑚. 𝑖𝑠𝑙𝑒𝑎𝑑𝑒𝑟 𝑛 ∧ 𝑖𝑠𝑙𝑒𝑎𝑑𝑒𝑟 𝑚 → 𝑛 = 𝑚
• voted is a partial function: ∀p,𝑛,𝑚. voted(p,n) ∧ voted(p,m)→𝑛=𝑚
• leader has a quorum: ∀𝑛, 𝑚. 𝑖𝑠𝑙𝑒𝑎𝑑𝑒𝑟 𝑛 ∧ 𝑚𝑒𝑚𝑏𝑒𝑟 𝑚, 𝑞𝑢𝑜𝑟𝑢𝑚
→ 𝑣𝑜𝑡𝑒𝑑(𝑚, 𝑛)
Invariant:
Provable in EPR++
relation voted(pid, pid)
relation isleader(pid)
var quorum: set

Implementation
• Uses real network vote messages
• Decorated with ghost calls to abstract model
• Uses abstract mode invariant in proof
relation already_voted(pid)
handle req(p:pid, n:pid) {
if ¬already_voted p {
already_voted p := true;
send vote(p,n);
ghost abs.vote(p,n);
}
}
call to abstract model must satisfy precondition
In place of property maj, we use the one leader invariant of the abstract model
∀𝑝, 𝑛. 𝑎𝑏𝑠. 𝑣𝑜𝑡𝑒𝑑 𝑝, 𝑛 → 𝑎𝑙𝑟𝑒𝑎𝑑𝑦_𝑣𝑜𝑡𝑒𝑑 𝑝
∀𝑝, 𝑛. 𝑛𝑒𝑡𝑤𝑜𝑟𝑘. 𝑣𝑜𝑡𝑒 𝑝, 𝑛 ↔ 𝑎𝑏𝑠. 𝑣𝑜𝑡𝑒𝑑 𝑝, 𝑛
∀𝑛. 𝑙𝑒𝑎𝑑𝑒𝑟 𝑛 ↔ 𝑎𝑏𝑠. 𝑖𝑠𝑙𝑒𝑎𝑑𝑒𝑟 𝑛
…

Proof using Ivy/Z3
• For each module, we provide suitable inductive invariants
• Reduces the verification to EPR++ verification conditions
• the sub verification problems
• Each module’s VC’s in decidable fragment
• Support from Z3
• If not, Ivy gives us an explanation, for example a function cycle
• Z3 can quickly and reliably prove all the VC’s

Proof Length
Protocol System/Project LOC
# manual
proof
Ratio
RAFT
Coq/Verdi 530 50,000 94
Ivy 560 200 0.36
MULTIPAXOS
Dafny/IronFleet 3000 12,000 4
Ivy 330 266 0.8

Verification Effort
Protocol System/Project Human Effort
Verification
Time
RAFT
Coq/Verdi 3.7 years -
Ivy
3 months
(from ground
up)
Few min
MULTIPAXOS
Dafny/IronFleet Several years 6hr in cloud
Ivy
1 month
(pre-verified
model)
few minutes on
laptop

IVY summary
• A system with the following properties
– Proof Automation
• Can be used by non-experts
– Transparency
• The user either get CTI or an error message that the verification condition
falls outside the decidable fragments
• Used to verify small but intricate distributed protocols all the
way from the design to the implementation
• Publically available https://github.com/Microsoft/ivy

Modularity for Accurate Static Analysis of Smart Contracts

Recommended

More Related Content

Similar to Modularity for Accurate Static Analysis of Smart Contracts (20)

More from Facultad de Informática UCM (20)

Recently uploaded (20)

Modularity for Accurate Static Analysis of Smart Contracts