github.com/vipernet-xyz/tm@v0.34.24/spec/light-client/verification/Blockchain_002_draft.tla (about) 1 ------------------------ MODULE Blockchain_002_draft ----------------------------- 2 (* 3 This is a high-level specification of Tendermint blockchain 4 that is designed specifically for the light client. 5 Validators have the voting power of one. If you like to model various 6 voting powers, introduce multiple copies of the same validator 7 (do not forget to give them unique names though). 8 *) 9 EXTENDS Integers, FiniteSets 10 11 Min(a, b) == IF a < b THEN a ELSE b 12 13 CONSTANT 14 AllNodes, 15 (* a set of all nodes that can act as validators (correct and faulty) *) 16 ULTIMATE_HEIGHT, 17 (* a maximal height that can be ever reached (modelling artifact) *) 18 TRUSTING_PERIOD 19 (* the period within which the validators are trusted *) 20 21 Heights == 1..ULTIMATE_HEIGHT (* possible heights *) 22 23 (* A commit is just a set of nodes who have committed the block *) 24 Commits == SUBSET AllNodes 25 26 (* The set of all block headers that can be on the blockchain. 27 This is a simplified version of the Block data structure in the actual implementation. *) 28 BlockHeaders == [ 29 height: Heights, 30 \* the block height 31 time: Int, 32 \* the block timestamp in some integer units 33 lastCommit: Commits, 34 \* the nodes who have voted on the previous block, the set itself instead of a hash 35 (* in the implementation, only the hashes of V and NextV are stored in a block, 36 as V and NextV are stored in the application state *) 37 VS: SUBSET AllNodes, 38 \* the validators of this bloc. We store the validators instead of the hash. 39 NextVS: SUBSET AllNodes 40 \* the validators of the next block. We store the next validators instead of the hash. 41 ] 42 43 (* A signed header is just a header together with a set of commits *) 44 LightBlocks == [header: BlockHeaders, Commits: Commits] 45 46 VARIABLES 47 now, 48 (* the current global time in integer units *) 49 blockchain, 50 (* A sequence of BlockHeaders, which gives us a bird view of the blockchain. *) 51 Faulty 52 (* A set of faulty nodes, which can act as validators. We assume that the set 53 of faulty processes is non-decreasing. If a process has recovered, it should 54 connect using a different id. *) 55 56 (* all variables, to be used with UNCHANGED *) 57 vars == <<now, blockchain, Faulty>> 58 59 (* The set of all correct nodes in a state *) 60 Corr == AllNodes \ Faulty 61 62 (* APALACHE annotations *) 63 a <: b == a \* type annotation 64 65 NT == STRING 66 NodeSet(S) == S <: {NT} 67 EmptyNodeSet == NodeSet({}) 68 69 BT == [height |-> Int, time |-> Int, lastCommit |-> {NT}, VS |-> {NT}, NextVS |-> {NT}] 70 71 LBT == [header |-> BT, Commits |-> {NT}] 72 (* end of APALACHE annotations *) 73 74 (****************************** BLOCKCHAIN ************************************) 75 76 (* the header is still within the trusting period *) 77 InTrustingPeriod(header) == 78 now < header.time + TRUSTING_PERIOD 79 80 (* 81 Given a function pVotingPower \in D -> Powers for some D \subseteq AllNodes 82 and pNodes \subseteq D, test whether the set pNodes \subseteq AllNodes has 83 more than 2/3 of voting power among the nodes in D. 84 *) 85 TwoThirds(pVS, pNodes) == 86 LET TP == Cardinality(pVS) 87 SP == Cardinality(pVS \intersect pNodes) 88 IN 89 3 * SP > 2 * TP \* when thinking in real numbers, not integers: SP > 2.0 / 3.0 * TP 90 91 (* 92 Given a set of FaultyNodes, test whether the voting power of the correct nodes in D 93 is more than 2/3 of the voting power of the faulty nodes in D. 94 *) 95 IsCorrectPower(pFaultyNodes, pVS) == 96 LET FN == pFaultyNodes \intersect pVS \* faulty nodes in pNodes 97 CN == pVS \ pFaultyNodes \* correct nodes in pNodes 98 CP == Cardinality(CN) \* power of the correct nodes 99 FP == Cardinality(FN) \* power of the faulty nodes 100 IN 101 \* CP + FP = TP is the total voting power, so we write CP > 2.0 / 3 * TP as follows: 102 CP > 2 * FP \* Note: when FP = 0, this implies CP > 0. 103 104 (* This is what we believe is the assumption about failures in Tendermint *) 105 FaultAssumption(pFaultyNodes, pNow, pBlockchain) == 106 \A h \in Heights: 107 pBlockchain[h].time + TRUSTING_PERIOD > pNow => 108 IsCorrectPower(pFaultyNodes, pBlockchain[h].NextVS) 109 110 (* Can a block be produced by a correct peer, or an authenticated Byzantine peer *) 111 IsLightBlockAllowedByDigitalSignatures(ht, block) == 112 \/ block.header = blockchain[ht] \* signed by correct and faulty (maybe) 113 \/ block.Commits \subseteq Faulty /\ block.header.height = ht /\ block.header.time >= 0 \* signed only by faulty 114 115 (* 116 Initialize the blockchain to the ultimate height right in the initial states. 117 We pick the faulty validators statically, but that should not affect the light client. 118 *) 119 InitToHeight == 120 /\ Faulty \in SUBSET AllNodes \* some nodes may fail 121 \* pick the validator sets and last commits 122 /\ \E vs, lastCommit \in [Heights -> SUBSET AllNodes]: 123 \E timestamp \in [Heights -> Int]: 124 \* now is at least as early as the timestamp in the last block 125 /\ \E tm \in Int: now = tm /\ tm >= timestamp[ULTIMATE_HEIGHT] 126 \* the genesis starts on day 1 127 /\ timestamp[1] = 1 128 /\ vs[1] = AllNodes 129 /\ lastCommit[1] = EmptyNodeSet 130 /\ \A h \in Heights \ {1}: 131 /\ lastCommit[h] \subseteq vs[h - 1] \* the non-validators cannot commit 132 /\ TwoThirds(vs[h - 1], lastCommit[h]) \* the commit has >2/3 of validator votes 133 /\ IsCorrectPower(Faulty, vs[h]) \* the correct validators have >2/3 of power 134 /\ timestamp[h] > timestamp[h - 1] \* the time grows monotonically 135 /\ timestamp[h] < timestamp[h - 1] + TRUSTING_PERIOD \* but not too fast 136 \* form the block chain out of validator sets and commits (this makes apalache faster) 137 /\ blockchain = [h \in Heights |-> 138 [height |-> h, 139 time |-> timestamp[h], 140 VS |-> vs[h], 141 NextVS |-> IF h < ULTIMATE_HEIGHT THEN vs[h + 1] ELSE AllNodes, 142 lastCommit |-> lastCommit[h]] 143 ] \****** 144 145 146 (* is the blockchain in the faulty zone where the Tendermint security model does not apply *) 147 InFaultyZone == 148 ~FaultAssumption(Faulty, now, blockchain) 149 150 (********************* BLOCKCHAIN ACTIONS ********************************) 151 (* 152 Advance the clock by zero or more time units. 153 *) 154 AdvanceTime == 155 \E tm \in Int: tm >= now /\ now' = tm 156 /\ UNCHANGED <<blockchain, Faulty>> 157 158 (* 159 One more process fails. As a result, the blockchain may move into the faulty zone. 160 The light client is not using this action, as the faults are picked in the initial state. 161 However, this action may be useful when reasoning about fork detection. 162 *) 163 OneMoreFault == 164 /\ \E n \in AllNodes \ Faulty: 165 /\ Faulty' = Faulty \cup {n} 166 /\ Faulty' /= AllNodes \* at least process remains non-faulty 167 /\ UNCHANGED <<now, blockchain>> 168 ============================================================================= 169 \* Modification History 170 \* Last modified Wed Jun 10 14:10:54 CEST 2020 by igor 171 \* Created Fri Oct 11 15:45:11 CEST 2019 by igor