Runtime Verification (United States)

LibraBFT is a Byzantine Fault Tolerant (BFT) consensus protocol based on HotStuff. We present an abstract model of the protocol underlying HotStuff / LibraBFT, and formal, machine-checked proofs of their core correctness (safety) property and an extended condition that enables non-participating parties to verify committed results. (Liveness properties would be proved for specific implementations, not for the abstract model presented in this paper.) A key contribution is precisely defining assumptions about the behavior of honest peers, in an abstract way, independent of any particular implementation. Therefore, our work is an important step towards proving correctness of an entire class of concrete implementations, without repeating the hard work of proving correctness of the underlying protocol. The abstract proofs are for a single configuration (epoch); extending these proofs across configuration changes is future work. Our models and proofs are expressed in Agda, and are available in open source.

RANDAO is a commit-reveal scheme for generating pseudo-random numbers in a decentralized fashion. The scheme is used in emerging blockchain systems as it is widely believed to provide randomness that is unpredictable and hard to manipulate by maliciously behaving nodes. However, RANDAO may still be susceptible to look-ahead attacks, in which an attacker (controlling a subset of nodes in the network) may attempt to pre-compute the outcomes of (possibly many) reveal strategies, and thus may bias the generated random number to his advantage. In this work, we formally evaluate resilience of RANDAO against such attacks. We first develop a probabilistic model in rewriting logic of RANDAO, and then apply statistical model checking and quantitative verification algorithms (using Maude and PVeStA) to analyze two different properties that provide different measures of bias that the attacker could potentially achieve using pre-computed strategies. We show through this analysis that unless the attacker is already controlling a sizable percentage of nodes while aggressively attempting to maximize control of the nodes selected to participate in the process, the expected achievable bias is quite limited.

The Algorand blockchain is a secure and decentralized public ledger based on pure proof of stake rather than proof of work. At its core it is a novel consensus protocol with exactly one block certified in each round: that is, the protocol guarantees that the blockchain does not fork. In this paper, we report on our effort to model and formally verify the Algorand consensus protocol in the Coq proof assistant. Similar to previous consensus protocol verification efforts, we model the protocol as a state transition system and reason over reachable global states. However, in contrast to previous work, our model explicitly incorporates timing issues (e.g., timeouts and network delays) and adversarial actions, reflecting a more realistic environment faced by a public blockchain. Thus far, we have proved asynchronous safety of the protocol: two different blocks cannot be certified in the same round, even when the adversary has complete control of message delivery in the network. We believe that our model is sufficiently general and other relevant properties of the protocol such as liveness can be proved for the same model.

This invited paper reports the current progress on smart contract verification with the \(\mathbb {K}\) framework in a language-independent style.

We present a novel program verification approach based on coinduction, which takes as input an operational semantics. No intermediates like program logics or verification condition generators are needed. Specifications can be written using any state predicates. We implement our approach in Coq, giving a certifying language-independent verification framework. Our proof system is implemented as a single module imported unchanged into language-specific proofs. Automation is reached by instantiating a generic heuristic with language-specific tactics. Manual assistance is also smoothly allowed at points the automation cannot handle. We demonstrate the power and versatility of our approach by verifying algorithms as complicated as Schorr-Waite graph marking and instantiating our framework for object languages in several styles of semantics. Finally, we show that our coinductive approach subsumes reachability logic, a recent language-independent sound and (relatively) complete logic for program verification that has been instantiated with operational semantics of languages as complex as C, Java and JavaScript.

With sensors in the ground, water, and air, the global system to detect nuclear tests already exceeds designers' expectations. Its potential now depends on political will.

Only few studies have assessed relative risks on occupational asthma and allergy among bakery workers, and none of them have included respiratory and work-related symptoms as well as sensitization to occupational allergens and pulmonary function. A random sample of 246 workers from traditional and industrial bakeries in two regions of Belgium were compared with a reference population of 251 workers from a petrochemical plant in the same region. Data on skin test positivity, symptoms, and lung function were collected by standardized procedures. Differences between the two subpopulations were analyzed using multiple logistic and linear regression analyses. On average, bakery workers did not more often have skin test positivity than reference workers (39.4% and 42.6%, respectively). However, bakery workers had a strongly increased risk of sensitization to specific bakery allergens (OR 22.0, 95% CI = 6.3-77.1.), whereas their risks of positive skin tests to common allergens, including wheat pollen and storage mite, were significantly decreased (OR 0.6, 95% CI = 0.4-0.9). Bakery workers had significantly more often respiratory and work-related symptoms. Accordingly, they had lower lung function parameters. Atopy and sensitization to bakers' allergens were independent and additional risk factors for work-related symptoms. Bakery workers are at increased risk of respiratory and allergic symptoms and skin test reactivity to specific bakers' allergens wheat flour and alpha-amylase. Wheat pollen and storage mite should not be regarded as baker's allergens. Nevertheless, pulmonary function of bakery workers can be characterized as mild airway obstruction only.