github.com/vipernet-xyz/tm@v0.34.24/spec/consensus/consensus-paper/proof.tex (about) 1 \section{Proof of Tendermint consensus algorithm} \label{sec:proof} 2 3 \begin{lemma} \label{lemma:majority-intersection} For all $f\geq 0$, any two 4 sets of processes with voting power at least equal to $2f+1$ have at least one 5 correct process in common. \end{lemma} 6 7 \begin{proof} As the total voting power is equal to $n=3f+1$, we have $2(2f+1) 8 = n+f+1$. This means that the intersection of two sets with the voting 9 power equal to $2f+1$ contains at least $f+1$ voting power in common, \ie, 10 at least one correct process (as the total voting power of faulty processes 11 is $f$). The result follows directly from this. \end{proof} 12 13 \begin{lemma} \label{lemma:locked-decision_value-prevote-v} If $f+1$ correct 14 processes lock value $v$ in round $r_0$ ($lockedValue = v$ and $lockedRound = 15 r_0$), then in all rounds $r > r_0$, they send $\Prevote$ for $id(v)$ or 16 $\nil$. \end{lemma} 17 18 \begin{proof} We prove the result by induction on $r$. 19 20 \emph{Base step $r = r_0 + 1:$} Let's denote with $C$ the set of correct 21 processes with voting power equal to $f+1$. By the rules at 22 line~\ref{line:tab:recvProposal} and line~\ref{line:tab:acceptProposal}, the 23 processes from the set $C$ can't accept $\Proposal$ for any value different 24 from $v$ in round $r$, and therefore can't send a $\li{\Prevote,height_p, 25 r,id(v')}$ message, if $v' \neq v$. Therefore, the Lemma holds for the base 26 step. 27 28 \emph{Induction step from $r_1$ to $r_1+1$:} We assume that no process from the 29 set $C$ has sent $\Prevote$ for values different than $id(v)$ or $\nil$ until 30 round $r_1 + 1$. We now prove that the Lemma also holds for round $r_1 + 1$. As 31 processes from the set $C$ send $\Prevote$ for $id(v)$ or $\nil$ in rounds $r_0 32 \le r \le r_1$, by Lemma~\ref{lemma:majority-intersection} there is no value 33 $v' \neq v$ for which it is possible to receive $2f+1$ $\Prevote$ messages in 34 those rounds (i). Therefore, we have for all processes from the set $C$, 35 $lockedValue = v$ and $lockedRound \ge r_0$. Let's assume by a contradiction 36 that a process $q$ from the set $C$ sends $\Prevote$ in round $r_1 + 1$ for 37 value $id(v')$, where $v' \neq v$. This is possible only by 38 line~\ref{line:tab:prevote-higher-proposal}. Note that this implies that $q$ 39 received $2f+1$ $\li{\Prevote,h_q, r,id(v')}$ messages, where $r > r_0$ and $r 40 < r_1 +1$ (see line~\ref{line:tab:cond-prevote-higher-proposal}). A 41 contradiction with (i) and Lemma~\ref{lemma:majority-intersection}. 42 \end{proof} 43 44 \begin{lemma} \label{lemma:agreement} Algorithm~\ref{alg:tendermint} satisfies 45 Agreement. \end{lemma} 46 47 \begin{proof} Let round $r_0$ be the first round of height $h$ such that some 48 correct process $p$ decides $v$. We now prove that if some correct process 49 $q$ decides $v'$ in some round $r \ge r_0$, then $v = v'$. 50 51 In case $r = r_0$, $q$ has received at least $2f+1$ 52 $\li{\Precommit,h_p,r_0,id(v')}$ messages at line~\ref{line:tab:onDecideRule}, 53 while $p$ has received at least $2f+1$ $\li{\Precommit,h_p,r_0,id(v)}$ 54 messages. By Lemma~\ref{lemma:majority-intersection} two sets of messages of 55 voting power $2f+1$ intersect in at least one correct process. As a correct 56 process sends a single $\Precommit$ message in a round, then $v=v'$. 57 58 We prove the case $r > r_0$ by contradiction. By the 59 rule~\ref{line:tab:onDecideRule}, $p$ has received at least $2f+1$ voting-power 60 equivalent of $\li{\Precommit,h_p,r_0,id(v)}$ messages, i.e., at least $f+1$ 61 voting-power equivalent correct processes have locked value $v$ in round $r_0$ and have 62 sent those messages (i). Let denote this set of messages with $C$. On the 63 other side, $q$ has received at least $2f+1$ voting power equivalent of 64 $\li{\Precommit,h_q, r,id(v')}$ messages. As the voting power of all faulty 65 processes is at most $f$, some correct process $c$ has sent one of those 66 messages. By the rule at line~\ref{line:tab:recvPrevote}, $c$ has locked value 67 $v'$ in round $r$ before sending $\li{\Precommit,h_q, r,id(v')}$. Therefore $c$ 68 has received $2f+1$ $\Prevote$ messages for $id(v')$ in round $r > r_0$ (see 69 line~\ref{line:tab:recvPrevote}). By Lemma~\ref{lemma:majority-intersection}, a 70 process from the set $C$ has sent $\Prevote$ message for $id(v')$ in round $r$. 71 A contradiction with (i) and Lemma~\ref{lemma:locked-decision_value-prevote-v}. 72 \end{proof} 73 74 \begin{lemma} \label{lemma:agreement} Algorithm~\ref{alg:tendermint} satisfies 75 Validity. \end{lemma} 76 77 \begin{proof} Trivially follows from the rule at line 78 \ref{line:tab:validDecisionValue} which ensures that only valid values can be 79 decided. \end{proof} 80 81 \begin{lemma} \label{lemma:round-synchronisation} If we assume that: 82 \begin{enumerate} 83 \item a correct process $p$ is the first correct process to 84 enter a round $r>0$ at time $t > GST$ (for every correct process 85 $c$, $round_c \le r$ at time $t$) 86 \item the proposer of round $r$ is 87 a correct process $q$ 88 \item for every correct process $c$, 89 $lockedRound_c \le validRound_q$ at time $t$ 90 \item $\timeoutPropose(r) 91 > 2\Delta + \timeoutPrecommit(r-1)$, $\timeoutPrevote(r) > 2\Delta$ and 92 $\timeoutPrecommit(r) > 2\Delta$, 93 \end{enumerate} 94 then all correct processes decide in round $r$ before $t + 4\Delta + 95 \timeoutPrecommit(r-1)$. 96 \end{lemma} 97 98 \begin{proof} As $p$ is the first correct process to enter round $r$, it 99 executed the line~\ref{line:tab:nextRound} after $\timeoutPrecommit(r-1)$ 100 expired. Therefore, $p$ received $2f+1$ $\Precommit$ messages in the round 101 $r-1$ before time $t$. By the \emph{Gossip communication} property, all 102 correct processes will receive those messages the latest at time $t + 103 \Delta$. Correct processes that are in rounds $< r-1$ at time $t$ will 104 enter round $r-1$ (see the rule at line~\ref{line:tab:nextRound2}) and 105 trigger $\timeoutPrecommit(r-1)$ (see rule~\ref{line:tab:startTimeoutPrecommit}) 106 by time $t+\Delta$. Therefore, all correct processes will start round $r$ 107 by time $t+\Delta+\timeoutPrecommit(r-1)$ (i). 108 109 In the worst case, the process $q$ is the last correct process to enter round 110 $r$, so $q$ starts round $r$ and sends $\Proposal$ message for some value $v$ 111 at time $t + \Delta + \timeoutPrecommit(r-1)$. Therefore, all correct processes 112 receive the $\Proposal$ message from $q$ the latest by time $t + 2\Delta + 113 \timeoutPrecommit(r-1)$. Therefore, if $\timeoutPropose(r) > 2\Delta + 114 \timeoutPrecommit(r-1)$, all correct processes will receive $\Proposal$ message 115 before $\timeoutPropose(r)$ expires. 116 117 By (3) and the rules at line~\ref{line:tab:recvProposal} and 118 \ref{line:tab:acceptProposal}, all correct processes will accept the 119 $\Proposal$ message for value $v$ and will send a $\Prevote$ message for 120 $id(v)$ by time $t + 2\Delta + \timeoutPrecommit(r-1)$. Note that by the 121 \emph{Gossip communication} property, the $\Prevote$ messages needed to trigger 122 the rule at line~\ref{line:tab:acceptProposal} are received before time $t + 123 \Delta$. 124 125 By time $t + 3\Delta + \timeoutPrecommit(r-1)$, all correct processes will receive 126 $\Proposal$ for $v$ and $2f+1$ corresponding $\Prevote$ messages for $id(v)$. 127 By the rule at line~\ref{line:tab:recvPrevote}, all correct processes will send 128 a $\Precommit$ message (see line~\ref{line:tab:precommit-v}) for $id(v)$ by 129 time $t + 3\Delta + \timeoutPrecommit(r-1)$. Therefore, by time $t + 4\Delta + 130 \timeoutPrecommit(r-1)$, all correct processes will have received the $\Proposal$ 131 for $v$ and $2f+1$ $\Precommit$ messages for $id(v)$, so they decide at 132 line~\ref{line:tab:decide} on $v$. 133 134 This scenario holds if every correct process $q$ sends a $\Precommit$ message 135 before $\timeoutPrevote(r)$ expires, and if $\timeoutPrecommit(r)$ does not expire 136 before $t + 4\Delta + \timeoutPrecommit(r-1)$. Let's assume that a correct process 137 $c_1$ is the first correct process to trigger $\timeoutPrevote(r)$ (see the rule 138 at line~\ref{line:tab:recvAny2/3Prevote}) at time $t_1 > t$. This implies that 139 before time $t_1$, $c_1$ received a $\Proposal$ ($step_{c_1}$ must be 140 $\prevote$ by the rule at line~\ref{line:tab:recvAny2/3Prevote}) and a set of 141 $2f+1$ $\Prevote$ messages. By time $t_1 + \Delta$, all correct processes will 142 receive those messages. Note that even if some correct process was in the 143 smaller round before time $t_1$, at time $t_1 + \Delta$ it will start round $r$ 144 after receiving those messages (see the rule at 145 line~\ref{line:tab:skipRounds}). Therefore, all correct processes will send 146 their $\Prevote$ message for $id(v)$ by time $t_1 + \Delta$, and all correct 147 processes will receive those messages the by time $t_1 + 2\Delta$. Therefore, 148 as $\timeoutPrevote(r) > 2\Delta$, this ensures that all correct processes receive 149 $\Prevote$ messages from all correct processes before their respective local 150 $\timeoutPrevote(r)$ expire. 151 152 On the other hand, $\timeoutPrecommit(r)$ is triggered in a correct process $c_2$ 153 after it receives any set of $2f+1$ $\Precommit$ messages for the first time. 154 Let's denote with $t_2 > t$ the earliest point in time $\timeoutPrecommit(r)$ is 155 triggered in some correct process $c_2$. This implies that $c_2$ has received 156 at least $f+1$ $\Precommit$ messages for $id(v)$ from correct processes, i.e., 157 those processes have received $\Proposal$ for $v$ and $2f+1$ $\Prevote$ 158 messages for $id(v)$ before time $t_2$. By the \emph{Gossip communication} 159 property, all correct processes will receive those messages by time $t_2 + 160 \Delta$, and will send $\Precommit$ messages for $id(v)$. Note that even if 161 some correct processes were at time $t_2$ in a round smaller than $r$, by the 162 rule at line~\ref{line:tab:skipRounds} they will enter round $r$ by time $t_2 + 163 \Delta$. Therefore, by time $t_2 + 2\Delta$, all correct processes will 164 receive $\Proposal$ for $v$ and $2f+1$ $\Precommit$ messages for $id(v)$. So if 165 $\timeoutPrecommit(r) > 2\Delta$, all correct processes will decide before the 166 timeout expires. \end{proof} 167 168 169 \begin{lemma} \label{lemma:validValue} If a correct process $p$ locks a value 170 $v$ at time $t_0 > GST$ in some round $r$ ($lockedValue = v$ and 171 $lockedRound = r$) and $\timeoutPrecommit(r) > 2\Delta$, then all correct 172 processes set $validValue$ to $v$ and $validRound$ to $r$ before starting 173 round $r+1$. \end{lemma} 174 175 \begin{proof} In order to prove this Lemma, we need to prove that if the 176 process $p$ locks a value $v$ at time $t_0$, then no correct process will 177 leave round $r$ before time $t_0 + \Delta$ (unless it has already set 178 $validValue$ to $v$ and $validRound$ to $r$). It is sufficient to prove 179 this, since by the \emph{Gossip communication} property the messages that 180 $p$ received at time $t_0$ and that triggered rule at 181 line~\ref{line:tab:recvPrevote} will be received by time $t_0 + \Delta$ by 182 all correct processes, so all correct processes that are still in round $r$ 183 will set $validValue$ to $v$ and $validRound$ to $r$ (by the rule at 184 line~\ref{line:tab:recvPrevote}). To prove this, we need to compute the 185 earliest point in time a correct process could leave round $r$ without 186 updating $validValue$ to $v$ and $validRound$ to $r$ (we denote this time 187 with $t_1$). The Lemma is correct if $t_0 + \Delta < t_1$. 188 189 If the process $p$ locks a value $v$ at time $t_0$, this implies that $p$ 190 received the valid $\Proposal$ message for $v$ and $2f+1$ 191 $\li{\Prevote,h,r,id(v)}$ at time $t_0$. At least $f+1$ of those messages are 192 sent by correct processes. Let's denote this set of correct processes as $C$. By 193 Lemma~\ref{lemma:majority-intersection} any set of $2f+1$ $\Prevote$ messages 194 in round $r$ contains at least a single message from the set $C$. 195 196 Let's denote as time $t$ the earliest point in time a correct process, $c_1$, triggered 197 $\timeoutPrevote(r)$. This implies that $c_1$ received $2f+1$ $\Prevote$ messages 198 (see the rule at line \ref{line:tab:recvAny2/3Prevote}), where at least one of 199 those messages was sent by a process $c_2$ from the set $C$. Therefore, process 200 $c_2$ had received $\Proposal$ message before time $t$. By the \emph{Gossip 201 communication} property, all correct processes will receive $\Proposal$ and 202 $2f+1$ $\Prevote$ messages for round $r$ by time $t+\Delta$. The latest point 203 in time $p$ will trigger $\timeoutPrevote(r)$ is $t+\Delta$\footnote{Note that 204 even if $p$ was in smaller round at time $t$ it will start round $r$ by time 205 $t+\Delta$.}. So the latest point in time $p$ can lock the value $v$ in 206 round $r$ is $t_0 = t+\Delta+\timeoutPrevote(r)$ (as at this point 207 $\timeoutPrevote(r)$ expires, so a process sends $\Precommit$ $\nil$ and updates 208 $step$ to $\precommit$, see line \ref{line:tab:onTimeoutPrevote}). 209 210 Note that according to the Algorithm \ref{alg:tendermint}, a correct process 211 can not send a $\Precommit$ message before receiving $2f+1$ $\Prevote$ 212 messages. Therefore, no correct process can send a $\Precommit$ message in 213 round $r$ before time $t$. If a correct process sends a $\Precommit$ message 214 for $\nil$, it implies that it has waited for the full duration of 215 $\timeoutPrevote(r)$ (see line 216 \ref{line:tab:precommit-nil-onTimeout})\footnote{The other case in which a 217 correct process $\Precommit$ for $\nil$ is after receiving $2f+1$ $Prevote$ for 218 $\nil$ messages, see the line \ref{line:tab:precommit-v-1}. By 219 Lemma~\ref{lemma:majority-intersection}, this is not possible in round $r$.}. 220 Therefore, no correct process can send $\Precommit$ for $\nil$ before time $t + 221 \timeoutPrevote(r)$ (*). 222 223 A correct process $q$ that enters round $r+1$ must wait (i) $\timeoutPrecommit(r)$ 224 (see line \ref{line:tab:nextRound}) or (ii) receiving $f+1$ messages from the 225 round $r+1$ (see the line \ref{line:tab:skipRounds}). In the former case, $q$ 226 receives $2f+1$ $\Precommit$ messages before starting $\timeoutPrecommit(r)$. If 227 at least a single $\Precommit$ message from a correct process (at least $f+1$ 228 voting power equivalent of those messages is sent by correct processes) is for 229 $\nil$, then $q$ cannot start round $r+1$ before time $t_1 = t + 230 \timeoutPrevote(r) + \timeoutPrecommit(r)$ (see (*)). Therefore in this case we have: 231 $t_0 + \Delta < t_1$, i.e., $t+2\Delta+\timeoutPrevote(r) < t + \timeoutPrevote(r) + 232 \timeoutPrecommit(r)$, and this is true whenever $\timeoutPrecommit(r) > 2\Delta$, so 233 Lemma holds in this case. 234 235 If in the set of $2f+1$ $\Precommit$ messages $q$ receives, there is at least a 236 single $\Precommit$ for $id(v)$ message from a correct process $c$, then $q$ 237 can start the round $r+1$ the earliest at time $t_1 = t+\timeoutPrecommit(r)$. In 238 this case, by the \emph{Gossip communication} property, all correct processes 239 will receive $\Proposal$ and $2f+1$ $\Prevote$ messages (that $c$ received 240 before time $t$) the latest at time $t+\Delta$. Therefore, $q$ will set 241 $validValue$ to $v$ and $validRound$ to $r$ the latest at time $t+\Delta$. As 242 $t+\Delta < t+\timeoutPrecommit(r)$, whenever $\timeoutPrecommit(r) > \Delta$, the 243 Lemma holds also in this case. 244 245 In case (ii), $q$ received at least a single message from a correct process $c$ 246 from the round $r+1$. The earliest point in time $c$ could have started round 247 $r+1$ is $t+\timeoutPrecommit(r)$ in case it received a $\Precommit$ message for 248 $v$ from some correct process in the set of $2f+1$ $\Precommit$ messages it 249 received. The same reasoning as above holds also in this case, so $q$ set 250 $validValue$ to $v$ and $validRound$ to $r$ the latest by time $t+\Delta$. As 251 $t+\Delta < t+\timeoutPrecommit(r)$, whenever $\timeoutPrecommit(r) > \Delta$, the 252 Lemma holds also in this case. \end{proof} 253 254 \begin{lemma} \label{lemma:agreement} Algorithm~\ref{alg:tendermint} satisfies 255 Termination. \end{lemma} 256 257 \begin{proof} Lemma~\ref{lemma:round-synchronisation} defines a scenario in 258 which all correct processes decide. We now prove that within a bounded 259 duration after GST such a scenario will unfold. Let's assume that at time 260 $GST$ the highest round started by a correct process is $r_0$, and that 261 there exists a correct process $p$ such that the following holds: for every 262 correct process $c$, $lockedRound_c \le validRound_p$. Furthermore, we 263 assume that $p$ will be the proposer in some round $r_1 > r$ (this is 264 ensured by the $\coord$ function). 265 266 We have two cases to consider. In the first case, for all rounds $r \ge r_0$ 267 and $r < r_1$, no correct process locks a value (set $lockedRound$ to $r$). So 268 in round $r_1$ we have the scenario from the 269 Lemma~\ref{lemma:round-synchronisation}, so all correct processes decides in 270 round $r_1$. 271 272 In the second case, a correct process locks a value $v$ in round $r_2$, where 273 $r_2 \ge r_0$ and $r_2 < r_1$. Let's assume that $r_2$ is the highest round 274 before $r_1$ in which some correct process $q$ locks a value. By Lemma 275 \ref{lemma:validValue} at the end of round $r_2$ the following holds for all 276 correct processes $c$: $validValue_c = lockedValue_q$ and $validRound_c = r_2$. 277 Then in round $r_1$, the conditions for the 278 Lemma~\ref{lemma:round-synchronisation} holds, so all correct processes decide. 279 \end{proof} 280