Implementing and Mechanically Verifying Smart Contracts

Transcription

1 Implementing and Mechanically Verifying Smart Contracts Ilya Sergey ilyasergey.net

2 Smart Contracts Stateful mutable objects replicated via a (Byzantine) consensus protocol State typically involves a stored amount of funds/currency One or more entry points: invoked reactively by a client transaction Main usages: crowdfunding and ICO multi-party accounting voting and arbitration puzzle-solving games with distribution of rewards Supporting platforms: Ethereum, Tezos, Zilliqa, EOS,...

3 contract Accounting { /* Define contract fields */ address owner; mapping (address => uint) assets; Mutable fields /* This runs when the contract is executed */ function Accounting(address _owner) { owner = _owner; } Constructor } /* Sending funds to a contract */ function invest() returns (string) { if (assets[msg.sender].initialized()) { throw; } assets[msg.sender] = msg.value; return "You have given us your money"; } Entry point msg argument is implicit funds accepted implicitly can be called as a function from another contract

4 contract Accounting { /* Define contract fields */ address owner; mapping (address => uint) assets; /* This runs when the contract is executed */ function Accounting(address _owner) { owner = _owner; } /* Sending funds to a contract */ function invest() returns (string) { if (assets[msg.sender].initialized()) { throw; } assets[msg.sender] = msg.value; return "You have given us your money"; } } function stealmoney() { } if (msg.sender == owner) { owner.send(this.balance) }

5 Misconceptions about Smart Contracts Deployed in a low-level language Uniform compilation target Must be Turing-complete Run arbitrary computations Code is law What else if not the code?

6 Misconceptions about Smart Contracts Deployed in a low-level language Infeasible audit and verification Must be Turing-complete DoS attacks, cost semantics, exploits Code is law Cannot be amended once deployed

7 What about High-Level Languages? contract Accounting { /* Define contract fields */ address owner; mapping (address => uint) assets; } /* This runs when the contract is executed */ function Accounting(address _owner) { owner = _owner; } /* Sending funds to a contract */ function invest() returns (string) { if (assets[msg.sender].initialized()) { throw; } assets[msg.sender] = msg.value; return "You have given us your money"; } Ethereum's Solidity JavaScript-like syntax Calling a function = sending funds General recursion and loops Reflection, dynamic contract creation Lots of implicit conventions No formal semantics

8 What about High-Level Languages? contract Accounting { /* Define contract fields */ address owner; mapping (address => uint) assets; } /* This runs when the contract is executed */ function Accounting(address _owner) { owner = _owner; } /* Sending funds to a contract */ function invest() returns (string) { if (assets[msg.sender].initialized()) { throw; } assets[msg.sender] = msg.value; return "You have given us your money"; } Ethereum's Solidity JavaScript-like syntax Calling a function = sending funds General recursion and loops Reflection, dynamic contract creation Lots of implicit conventions No formal semantics

9 Sending a Message or Calling? contract Accounting { /* Other functions */ /* Sending funds to a contract */ function invest() returns (string) { if (assets[msg.sender].initialized()) { throw; } assets[msg.sender] = msg.value; return "You have given us your money"; } } function withdrawbalance() { uint amount = assets[msg.sender]; if (msg.sender.call.value(amount)() == false) { throw; } assets[msg.sender] = 0; }

10 Sending a Message or Calling? contract Accounting { /* Other functions */ /* Sending funds to a contract */ function invest() returns (string) { if (assets[msg.sender].initialized()) { throw; } assets[msg.sender] = msg.value; return "You have given us your money"; } } function withdrawbalance() { uint amount = assets[msg.sender]; if (msg.sender.call.value(amount)() == false) { throw; } assets[msg.sender] = 0; } Can reenter and withdraw again

11 Smart Contracts in a Nutshell Computations self-explanatory State Manipulation changing contract's fields Effects accepting funds, logging events Communication sending funds, calling other contracts

12 Computations State Manipulation Communication Effects

13 Verified Specification Communication Verified Specification State Manipulation Effects Verified Specification Computations

14 Verified Specification abstraction level Communication Verified Specification State Manipulation Effects Verified Specification Computations

15 Scilla Communication Verified Specification State Manipulation Effects Verified Specification Computations

16 Scilla Smart Contract Intermediate-Level Language Principled model for computations System F with small extensions Not Turing-complete Only primitive recursion/iteration Explicit Effects State-transformer semantics Communication Contracts are autonomous actors

17 Zilliqa Team ngapore and United Kingdom zilliqa.com me semancontracts he key lancipline for ted formal e the chaln Z tax, static, nteraction Types Primitive type P ::= Int Integer String Hash Block number Account address String Hash BNum Address Type T, S ::= P Map P T Message T -> S D htk i forall.t primitive type map message value function instantiated data type type variable polymorphic function

18 Expressions (pure) Term Expression Simple expression e f ::= ::= f let x h: T i = f in e l x { hentry ik } fun (x : T ) => e builtin b hx k i Selector Pattern sel pat ::= ::= x hx k i tfun => T C h {htk i} i hx k i match x with h sel k i end pat => e x C hpat k i ( pat ) _ Message entrry Name entry b ::= b :x Meaning simple expression let-form primitive literal variable Message function built-in application application type function type instantiation constructor instantiation pattern matching variable binding constructor pattern paranthesized pattern wildcard pattern identi er Description

19 Structural Recursion in Scilla Natural numbers (not Ints!) nat_rec : forall. -> (nat -> -> ) -> nat ->. {z } Result type number of iterations Value for 0 constructing the next value final result

20 Example: Fibonacci Numbers 1 let fib = fun (n : Nat) => 2 let iter_nat nat_rec (Pair Int Int) in 3 let iter_fun = 4 fun (n: Nat) => fun (res : Pair Int Int) => 5 match res with 6 And x y => let z = builtin add x y in 7 And {Int Int} z x 8 end 9 in 10 let zero = 0 in 11 let one = 1 in 12 let init_val = And {Int Int} one zero in 13 let res = iter_nat init_val iter_fun n in 14 fst res

21 Example: Fibonacci Numbers 1 let fib = fun (n : Nat) => 2 let iter_nat nat_rec (Pair Int Int) in 3 let iter_fun = 4 fun (n: Nat) => fun (res : Pair Int Int) => 5 match res with 6 And x y => let z = builtin add x y in 7 And {Int Int} z x 8 end 9 in Value for 0: (1, 0) 10 let zero = 0 in 11 let one = 1 in 12 let init_val = And {Int Int} one zero in 13 let res = iter_nat init_val iter_fun n in 14 fst res

22 Example: Fibonacci Numbers 1 let fib = fun (n : Nat) => 2 let iter_nat nat_rec (Pair Int Int) in 3 let iter_fun = 4 fun (n: Nat) => fun (res : Pair Int Int) => 5 match res with 6 And x y => let z = builtin add x y in 7 And {Int Int} z x 8 end 9 in 10 let zero = 0 in 11 let one = 1 in Iteration 12 let init_val = And {Int Int} one zero in 13 let res = iter_nat init_val iter_fun n in 14 fst res

23 Example: Fibonacci Numbers 1 let fib = fun (n : Nat) => 2 let iter_nat nat_rec (Pair Int Int) in 3 let iter_fun = 4 fun (n: Nat) => fun (res : Pair Int Int) => 5 match res with 6 And x y => let z = builtin add x y in 7 And {Int Int} z x 8 end 9 in 10 let zero = 0 in (x, y) (x + y, x) 11 let one = 1 in 12 let init_val = And {Int Int} one zero in 13 let res = iter_nat init_val iter_fun n in 14 fst res

24 Example: Fibonacci Numbers 1 let fib = fun (n : Nat) => 2 let iter_nat nat_rec (Pair Int Int) in 3 let iter_fun = 4 fun (n: Nat) => fun (res : Pair Int Int) => 5 match res with 6 And x y => let z = builtin add x y in 7 And {Int Int} z x 8 end 9 in 10 let zero = 0 in The result of iteration is a pair of integers 11 let one = 1 in 12 let init_val = And {Int Int} one zero in 13 let res = iter_nat init_val iter_fun n in 14 fst res

25 Example: Fibonacci Numbers 1 let fib = fun (n : Nat) => 2 let iter_nat nat_rec (Pair Int Int) in 3 let iter_fun = 4 fun (n: Nat) => fun (res : Pair Int Int) => 5 match res with 6 And x y => let z = builtin add x y in 7 And {Int Int} z x 8 end 9 in 10 let zero = 0 in Iterate n times 11 let one = 1 in 12 let init_val = And {Int Int} one zero in 13 let res = iter_nat init_val iter_fun n in 14 fst res

26 Example: Fibonacci Numbers 1 let fib = fun (n : Nat) => 2 let iter_nat nat_rec (Pair Int Int) in 3 let iter_fun = 4 fun (n: Nat) => fun (res : Pair Int Int) => 5 match res with 6 And x y => let z = builtin add x y in 7 And {Int Int} z x 8 end 9 in 10 let zero = 0 in return the first component of the result pair 11 let one = 1 in 12 let init_val = And {Int Int} one zero in 13 let res = iter_nat init_val iter_fun n in 14 fst res

27 Why Structural Recursion? Pros: All programs terminate Number of operations can be computed statically as a function of input size Cons: Some functions cannot be implemented efficiently (e.g., QuickSort) Cannot implement Ackerman function :( A(m, n) = 8 < : n +1 ifm =0 A(m 1, 1) if m>0 and n =0 A(m 1,A(m, n 1)) if m>0 and n>0

28 Statements (effectful) s ::= x <- f read from mutable field f := x store to a field x = e assign a pure expression match x with pat => s end pattern matching and branching x <- &B read from blockchain state accept accept incoming payment send ms send list of messages

29 Statement Semantics JsK : BlockchainState! Configuration! Configuration BlockchainState Immutable global data (block number etc.) Configuration = Env Fields Balance Incoming Emitted Immutable bindings Contract's own funds Messages to be sent Mutable fields Funds sent to contract

30 Global Execution Model Account X

31 Global Execution Model Account X m1 Contract C m6 m2 m4 Contract D m3 Contract E m5 Account Z Account Y

32 z } { Global Execution Model m1 m6 Conf C Conf 0 C Conf 00 C Conf D m2 Conf 0 D Final contract states m4 Conf E Conf 0 E Fixed MAX length of call sequence

33 Global Execution Model m1 m6 Conf C Conf 0 C Conf 00 C m2 Conf D Conf 0 D m4 Conf E Conf 0 E

34 Putting it All Together Scilla contracts are (infinite) State-Transition Systems Interaction between contracts via sending/receiving messages Messages trigger (effectful) transitions (sequences of statements) A contract can send messages to other contracts via send statement Most computations are done via pure expressions, no storable closures Contract's state is immutable parameters, mutable fields, balance

35 Contract Structure Library of pure functions Transition 1 Immutable parameters... Mutable fields Transition N

36 Working Example: Crowdfunding contract Parameters: campaign's owner, deadline (max block), funding goal Fields: registry of backers, "campaign-complete" boolean flag Transitions: Donate money (when the campaign is active) Get funds (as an owner, after the deadline, if the goal is met) Reclaim donation (after the deadline, if the goal is not met)

37 transition Donate (sender: Address, amount: Int) blk <- & BLOCKNUMBER; in_time = blk_leq blk max_block; match in_time with True => bs <- backers; res = check_update bs sender amount; match res with None => msg = {tag : Main; to : sender; amount : 0; code : already_backed}; msgs = one_msg msg; send msgs Some bs1 => backers := bs1; accept; msg = {tag : Main; to : sender; amount : 0; code : accepted_code}; msgs = one_msg msg; send msgs end False => msg = {tag : Main; to : sender; amount : 0; code : missed_dealine}; msgs = one_msg msg; send msgs end end

38 transition Donate (sender: Address, amount: Int) blk <- & BLOCKNUMBER; in_time = blk_leq blk max_block; match in_time with True => bs <- backers; res = check_update bs sender amount; match res with None => msg = {tag : Main; to : sender; amount : 0; code : already_backed}; msgs = one_msg msg; send msgs Some bs1 => backers := bs1; accept; msg = {tag : Main; to : sender; amount : 0; code : accepted_code}; msgs = one_msg msg; send msgs end False => msg = {tag : Main; to : sender; amount : 0; code : missed_dealine}; msgs = one_msg msg; send msgs end end Structure of the incoming message

39 transition Donate (sender: Address, amount: Int) blk <- & BLOCKNUMBER; in_time = blk_leq blk max_block; match in_time with True => bs <- backers; res = check_update bs sender amount; match res with None => msg = {tag : Main; to : sender; amount : 0; code : already_backed}; msgs = one_msg msg; send msgs Some bs1 => backers := bs1; accept; msg = {tag : Main; to : sender; amount : 0; code : accepted_code}; msgs = one_msg msg; send msgs end False => msg = {tag : Main; to : sender; amount : 0; code : missed_dealine}; msgs = one_msg msg; send msgs end end Reading from blockchain state

40 transition Donate (sender: Address, amount: Int) blk <- & BLOCKNUMBER; in_time = blk_leq blk max_block; match in_time with True => bs <- backers; res = check_update bs sender amount; match res with None => msg = {tag : Main; to : sender; amount : 0; code : already_backed}; msgs = one_msg msg; send msgs Some bs1 => backers := bs1; accept; msg = {tag : Main; to : sender; amount : 0; code : accepted_code}; msgs = one_msg msg; send msgs end False => msg = {tag : Main; to : sender; amount : 0; code : missed_dealine}; msgs = one_msg msg; send msgs end end Using pure library functions (defined above in the contract)

41 transition Donate (sender: Address, amount: Int) blk <- & BLOCKNUMBER; in_time = blk_leq blk max_block; match in_time with Manipulating with fields True => bs <- backers; res = check_update bs sender amount; match res with None => msg = {tag : Main; to : sender; amount : 0; code : already_backed}; msgs = one_msg msg; send msgs Some bs1 => backers := bs1; accept; msg = {tag : Main; to : sender; amount : 0; code : accepted_code}; msgs = one_msg msg; send msgs end False => msg = {tag : Main; to : sender; amount : 0; code : missed_dealine}; msgs = one_msg msg; send msgs end end

42 transition Donate (sender: Address, amount: Int) blk <- & BLOCKNUMBER; in_time = blk_leq blk max_block; match in_time with True => bs <- backers; res = check_update bs sender amount; match res with None => msg = {tag : Main; to : sender; amount : 0; code : already_backed}; msgs = one_msg msg; send msgs Some bs1 => backers := bs1; accept; msg = {tag : Main; to : sender; amount : 0; code : accepted_code}; msgs = one_msg msg; send msgs end False => msg = {tag : Main; to : sender; amount : 0; code : missed_dealine}; msgs = one_msg msg; send msgs end end Accepting incoming funds

43 transition Donate (sender: Address, amount: Int) blk <- & BLOCKNUMBER; in_time = blk_leq blk max_block; match in_time with Creating and sending messages True => bs <- backers; res = check_update bs sender amount; match res with None => msg = {tag : Main; to : sender; amount : 0; code : already_backed}; msgs = one_msg msg; send msgs Some bs1 => backers := bs1; accept; msg = {tag : Main; to : sender; amount : 0; code : accepted_code}; msgs = one_msg msg; send msgs end False => msg = {tag : Main; to : sender; amount : 0; code : missed_dealine}; msgs = one_msg msg; send msgs end end

44 transition Donate (sender: Address, amount: Int) blk <- & BLOCKNUMBER; in_time = blk_leq blk max_block; match in_time with Amount of own funds True => bs <- backers; transferred in a message res = check_update bs sender amount; match res with None => msg = {tag : Main; to : sender; amount : 0; code : already_backed}; msgs = one_msg msg; send msgs Some bs1 => backers := bs1; accept; msg = {tag : Main; to : sender; amount : 0; code : accepted_code}; msgs = one_msg msg; send msgs end False => msg = {tag : Main; to : sender; amount : 0; code : missed_dealine}; msgs = one_msg msg; send msgs end end

45 transition Donate (sender: Address, amount: Int) blk <- & BLOCKNUMBER; in_time = blk_leq blk max_block; match in_time with Numeric code to inform the recipient True => bs <- backers; res = check_update bs sender amount; match res with None => msg = {tag : Main; to : sender; amount : 0; code : already_backed}; msgs = one_msg msg; send msgs Some bs1 => backers := bs1; accept; msg = {tag : Main; to : sender; amount : 0; code : accepted_code}; msgs = one_msg msg; send msgs end False => msg = {tag : Main; to : sender; amount : 0; code : missed_dealine}; msgs = one_msg msg; send msgs end end

46 Demo

47 Verifying Scilla Contracts Scilla Coq Proof Assistant Local properties (e.g., "transition does not throw an exception") Invariants (e.g., "balance is always strictly positive") Temporal properties (something good eventually happens)

48 Coq Proof Assistant State-of-the art verification framework Based on dependently typed functional language Interactive requires a human in the loop Very small trusted code base Used to implement fully verified compilers operating systems distributed protocols (including blockchains)

49 z } { Temporal Properties Q since P as long R conf conf, conf R * conf, P(conf) Q(conf, conf ) m Conf C Conf 0 m Conf 00 C C P holds here R holds for intermediate messages Q holds here Token price only goes up No payments accepted after the quorum is reached No changes can be made after locking Consensus results are irrevocable

50 Temporal Properties Q since P as long R conf conf, conf R * conf, P(conf) Q(conf, conf ) Definition since_as_long (P : conf! Prop) (Q : conf! conf! Prop) (R : bstate * message! Prop) := sc conf conf', P st! (conf conf' sc) ( b, b sc! R b)! Q conf conf'.

51 Specifying properties of Crowdfunding Lemma 1: Contract will always have enough balance to refund everyone. Lemma 2: Contract will not alter its contribution records. Lemma 3: Each contributor will be refunded the right amount, if the campaign fails.

52 Lemma 2: Contract will not alter its contribution records. Definition donated (b : address) (d : amount) conf := b donated amount d conf.backers(b) == d. Definition no_claims_from (b : address) (q : bstate * message) := b didn t try to claim q.message.sender!= b. Lemma donation_preserved (b : address) (d : amount): since_as long (donated b d) (fun c c' => donated b d c') (no_claims_from b). b s records are preserved by the contract

53 Demo

54 Misconceptions, revisited Need a low-level language Need a language easy to reason about Must be Turing-complete Primitive recursion suffices in most cases Code is law Code should abide by a specification

55 What s next? Certified interpreter for Scilla contracts Compilation into an efficient back-end (LLVM, WASM) Certifications for Proof-Carrying Code (storable on a blockchain) Automated Model Checking smart contract properties PL support for sharded contract executions

56 To Take Away Formal verification of functional and temporal properties of smart contracts requires a language with a clear separation of concerns Scilla: is a Smart Contract Intermediate-Level Language that provides it: Small: builds on the polymorphic lambda-calculus with extensions. Principled: separates computations, effects, and communication. Verifiable: formal semantics and methodology for machine-assisted reasoning. Thanks!

57 Advertisement Do you want to work on formal proofs of correctness for practicaldistributed systems and smart contracts in Coq? Join the PhD program at National University of Singapore! To start in August 2019, apply by 15 December 2018 To start in January 2020, apply by 15 June 2019 Also, postdoc positions at Yale-NUS College are available starting early Get in touch with questions about topics and positions Check ilyaserey.net for my contact details.