Verifying Liquidity of Bitcoin Contracts

Abstract

A landmark security property of smart contracts is liquidity: in a non-liquid contract, it may happen that some funds remain frozen. The relevance of this issue is witnessed by a recent liquidity attack to the Ethereum Parity Wallet, which has frozen ∼160M USD within the contract, making this sum unredeemable by any user. We address the problem of verifying liquidity of Bitcoin contracts. Focussing on BitML, a contracts DSL with a computationally sound compiler to Bitcoin, we study various notions of liquidity. Our main result is that liquidity of BitML contracts is decidable, in all the proposed variants. To prove this, we first transform the infinite-state semantics of BitML into a finitestate one, which focusses on the behaviour of any given set of contracts, abstracting the context moves. With respect to the chosen contracts, this abstraction is sound and complete. Our decision procedure for liquidity is then based on model-checking the finite space of states of the abstraction.1. We formalize a notion of liquidity (Definition 2), and we illustrate several meaningful variants. Our notion of liquidity takes into account both the contract and the strategy that a participant follows to perform contract actions. Roughly, a strategy is liquid when following it ensures that funds do not remain frozen within the contract, even in the presence of adversaries. 2. We introduce an abstraction of the semantics of BitML which is finite-state (Theorem 1), and sound and complete w.r.t. the concrete (infinite-state) semantics, given a set of contracts under observation (Theorems 2 and 3). 3. We devise a verification technique for liquidity in BitML. Our technique can establish whether a strategy is liquid for a given contract, and also to synthesise a liquid strategy, when it exists (Theorem 4).Our finite-state abstraction is general-purpose: verifying liquidity is only one of its possible applications (some other applications are discussed in Sect. 6). Related Works.Several recent works study security issues related to Ethereum smart contracts. A few papers address EVM, the bytecode language which is the target of compilation of Solidity. Among them, [27] introduces an operational semantics of a simplified version of EVM, and develops Oyente, a tool to detect some vulnerability patterns of EVM contracts through symbolic execution. Securify [35] checks vulnerability patterns by analysing dependency graphs extracted

Formal Models of Bitcoin Contracts: A Survey

“…BitML and Uppaal can also verify complex contract properties expressed in LTL, by model-checking the state space of the contract. Although this state space is potentially infinite for BitML, verification is possible through the finitestate abstraction in Bartoletti and Zunino (2019). Verification of Uppaal models is possible through the Uppaal model checker (http://www.uppaal.org); a tool for verifying BitML contracts is available (Atzei et al, 2019).…”

“…The compiler enjoys a computational soundness property, which basically ensures that computational attacks to compiled contracts at the Bitcoin level are also observable at the BitML level. In practice, this result can be exploited to prove the correctness of static analyses on BitML contracts, like the one for liquidity presented in Bartoletti and Zunino (2019).…”

Developing secure bitcoin contracts with BitML

“…Our verification technique is based on model-checking the state space of BitML contracts. Since this state space is infinite, before running the model-checker we reduce it to a finite-state one, by exploiting the abstraction in [14]. This abstraction resolves the three sources of infiniteness of the concrete semantics of BitML: the passing of time, the advertisement/stipulation of contracts, and the off-contract bitcoin transfers.…”

“…To obtain a finite-state system, the abstraction: (i) quotients time in a finite number of time intervals, (ii) disables the advertisement of new contracts, and (iii) limits the off-contract operations to those for transferring funds to contracts and for destroying them. This abstraction is shown in [14] to enjoy a strict correspondence with the concrete BitML semantics: namely, each concrete step of the contract under analysis is mimicked by an abstract step, and vice versa.…”

“…In this paper we consider BitML, a recent high-level language for smart contracts, featuring a computationally sound embedding into Bitcoin [13], and a sound and complete verification technique of relevant trace properties [14]. BitML can express many of the smart contracts in the literature [8,11], and execute them by appending suitable transactions to the Bitcoin blockchain.…”