Kaizen: Building a Performant Blockchain System Verified for Consensus and Integrity
Total Page:16
File Type:pdf, Size:1020Kb
Kaizen: Building a Performant Blockchain System Verified for Consensus and Integrity Faria Kalim∗, Karl Palmskogy, Jayasi Meharz, Adithya Murali∗, Indranil Gupta∗ and P. Madhusudan∗ ∗University of Illinois at Urbana-Champaign yThe University of Texas at Austin zFacebook ∗fkalim2, adithya5, indy, [email protected] [email protected] [email protected] Abstract—We report on the development of a blockchain for it [7]. This protocol can then be automatically translated to system that is significantly verified and performant, detailing equivalent code in a functional language and deployed using the design, proof, and system development based on a process of a shim layer to a network to obtain working reference imple- continuous refinement. We instantiate this framework to build, to the best of our knowledge, the first blockchain (Kaizen) that is mentations of the basic protocol. However, there are several performant and verified to a large degree, and a cryptocurrency drawbacks to this—it is extremely hard to work further on protocol (KznCoin) over it. We experimentally compare its the reference implementation to refine it to correct imperative performance against the stock Bitcoin implementation. and performant code, and to add more features to it to meet practical requirements for building applications. I. INTRODUCTION The second technique, pioneered by the IronFleet sys- Blockchains are used to build a variety of distributed sys- tems [8], is to use a system such as Dafny to prove a system tems, e.g., applications such as cryptocurrency (Bitcoin [1] and correct with respect to its specification via automated theorem altcoins [2]), banking, finance, automobiles, health, supply- proving (using SMT solvers) guided by manual annotations. chain, and others [3], [4], [5]. In scenarios where there is In this paper, we develop our Kaizen approach for traditionally a central ledger, blockchain-based approaches blockchain protocols using a synergistic blend of the two tech- provide a democratized and decentralized alternative. niques above. Kaizen is a variant of the IronFleet approach. At the heart of any blockchain system is a distributed Our approach is to start with an abstract distributed protocol consensus protocol. This protocol ensures that the ledger is (a consensus protocol for blockchain in our case) and prove sharded into blocks, and that all nodes in the system agree correctness properties using an interactive theorem prover. We on the order, content, and dependency verification of the then refine the protocol to an imperative program using a blocks. Yet, today all blockchain and cryptocurrency with large program verifier that supports more automated verification, deployments remain largely unverified implementations. like Dafny, and similar to IronFleet. Interactive higher-order Formally verifying blockchains, and more broadly dis- theorem provers such as Coq are extremely powerful, capable tributed systems, is extremely challenging, especially due to of virtually proving/checking any proof written by humans. concurrency and asynchrony. Implementations of distributed IronFleet showed that correctness of several distributed proto- systems running in production are large pieces of code with cols can be coaxed into first-order systems with standard theo- several features, functionalities, and optimizations, making ries as supported by Dafny (using ghost code and tactics). Yet, them hard to verify ex-post. Consequently, the only techniques we believe that the flexibility afforded by interactive theorem that are viable for realizing verified systems involve designing provers significantly enlarge the scope of correctness proofs. them correct by construction. Interactive theorem provers such as Coq have been used to The main contribution of this paper is to build a blockchain prove complex properties involving cryptography and game- system, and an associated cryptocurrency system that are based proofs, pseudorandomess and probability [9], [10], [11]. both performant and have a verified consensus protocol at The idea that building verified systems need both automated their core. Our approach ensures both safety and liveness SMT reasoning (for speed and less manual annotation) and properties of the blockchain and cryptocurrency system. We expressive logics (for proving more complex theorems that build this system using a novel iterative refinement process cannot be easily reduced to SMT reasoning) is not new. that combines interactive theorem proving and refinement The Everest project [12] at Microsoft Research that aims verification using automated Floyd-Hoare style techniques. to build a verified HTTPS ecosystem uses F∗, and F∗ has The Kaizen refinement framework: There are two main tech- grown over the years to support interactive theorem proving niques for constructing correct distributed software today. The in addition to automated SMT-based reasoning [13]. Similarly, first is a set of techniques based on using interactive theorem the newly designed Lean proof assistant [14] also combines provers, such as Coq [6], where Coq type theory experts write SMT reasoning with interactive theorem proving. a high-level abstract protocol and prove correctness properties The Kaizen blockchain and KznCoin: We build a blockchain yThe first two authors contributed equally to this work. system and a cryptocurrency over it by using a refinement zWork done while at University of Illinois at Urbana-Champaign. framework as the one described above. Our starting point is a recently developed formalization of the blockchain/blockforest Sergey [15], preserving all their safety and liveness prop- protocol in Coq by Pirlea and Sergey [15], where the abstract erties. We then add at the deployment layer a network shim distributed protocol works in an asynchronous out-of-order and carefully argued (but not formally verified) refinements message-passing environment and where several properties are to gain further performance. proved regarding validity of the reachable global states of the • An evaluation of the cryptocurrency against a reference system as well as an eventual consistency property. The goal Bitcoin implementation on a real network that shows that we set for ourselves is to take this protocol expressed in Coq the system can be used as a backbone for a full-fledged and to continuously refine it to a usable performant imperative Bitcoin-like cryptocurrency that uses standard proof-of implementation of an altcoin, with proven refinement guaran- work measures for controlling the growth of the chain. tees. The proven refinement ensures that our core protocol We provide artifacts and supplementary material at this URL: implementation inherits all the safety and liveness (eventual https://madhu.cs.illinois.edu/kaizen consistency) properties proved for the abstract protocol in Coq. We develop our KznCoin cryptocurrency on top of the II. BACKGROUND Kaizen blockchain and evaluate its performance against A. Blockchains and Bitcoin the stock Bitcoin implementation [16]. We argue that the blockchain can be used as a backbone for a full-fledged A blockchain is an open, distributed ledger that can record Bitcoin-like cryptocurrency that uses standard proof-of work transactions between two parties in serializable order, in a measures for controlling the growth of the chain. verifiable and permanent way [17], [18]. Bitcoin is a de- In our experience in this project, we found our refinement centralized cryptocurrency that uses Nakamoto consensus [1] methodology to be friendly to systems developers, as it allows to maintain a blockchain of transactions across an untrusted teams with different expertise to collaboratively build a com- peer-to-peer network [18]. The peers in the network generally plex verified system. Experts in interactive theorem provers belong to different organizations or companies so that there is can work on designing abstract distributed protocols and no single point of authority. These peers use gossip protocols prove complex properties. Meanwhile, systems engineers who to propagate transactions and blocks further in the network. are not necessarily trained in formal verification or abstract A node in the network can transfer currency from their ad- specification languages, can work on refining the protocol dress to another by creating a digitally signed transaction. Any using imperative code using automated verification techniques, new transaction must pass a reference to a previous transaction and concentrate their efforts on instantiating the protocol for that the node might have received from another address. This particular applications and making them more performant, ensures that all nodes in the network can cryptographically keeping control of the design at all times. verify the creator of the transaction. Tamper-proof chain: We focus our verification on the core blockchain consensus Each block has a unique hash and properties under crash failures and eventual message delivery. contains the hash of the preceding block, as well as the Merkle Proving correctness under Byzantine models remains an open hash of its transactions. The first block in the chain, called problem in the community (see Section IX on related work the genesis block, is defined in the protocol. To effectively and the discussion in Section VIII). tamper with a transaction in the middle of the chain, an adversary would have to tamper with the transaction’s hash in Our work can also be seen as exploring a new point in the block. This would cause the hash of the block to change. distributed systems verification,