Skip to main content
SpringerLink
Log in

Formal Verification of Workflow Policies for Smart Contracts in Azure Blockchain

  • Conference paper
  • First Online:
Verified Software. Theories, Tools, and Experiments (VSTTE 2019)

Part of the book series: Lecture Notes in Computer Science ((LNPSE,volume 12031))

Abstract

Ensuring correctness of smart contracts is paramount to ensuring trust in blockchain-based systems. This paper studies the safety and security of smart contracts in the Azure Blockchain Workbench, an enterprise Blockchain-as-a-Service offering from Microsoft. In particular, we formalize semantic conformance of smart contracts against a state machine workflow with access-control policy and propose an approach to reducing semantic conformance checking to safety verification using program instrumentation. We develop a new Solidity program verifier VeriSol that is based on translation to Boogie, and have applied it to analyze all application contracts shipped with the Azure Blockchain Workbench and found previously unknown bugs in these published smart contracts. After fixing these bugs, VeriSol was able to successfully perform full verification for all of these contracts.

This is a preview of subscription content, log in via an institution to check access.

Access this chapter

Log in via an institution
Chapter
USD 29.95
Price excludes VAT (USA)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
eBook
USD 39.99
Price excludes VAT (USA)
  • Available as EPUB and PDF
  • Read on any device
  • Instant download
  • Own it forever
Softcover Book
USD 54.99
Price excludes VAT (USA)
  • Compact, lightweight edition
  • Dispatched in 3 to 5 business days
  • Free shipping worldwide - see info

Tax calculation will be finalised at checkout

Purchases are for personal use only

Institutional subscriptions

Notes

  1. 1.

    https://docs.microsoft.com/en-us/azure/blockchain/workbench/configuration.

  2. 2.

    The details can be found on the associated web page: https://github.com/Azure-Samples/blockchain/tree/master/blockchain-workbench/application-and-smart-contract-samples/hello-blockchain.

  3. 3.

    We omit several aspects of the language such as arrays and mappings due to space limit. More details can be found in the extended version of this paper [30].

  4. 4.

    We assume that the hash function is collision-free. In our implementation, we enforce this by keeping a mapping from each string constant to a counter.

References

  1. Explaining the DAO exploit for beginners in solidity (2016). https://medium.com/@MyPaoG/explaining-the-dao-exploit-for-beginners-in-solidity-80ee84f0d470

  2. Solidity: Function modifiers (2016). https://solidity.readthedocs.io/en/v0.4.24/structure-of-a-contract.html#function-modifiers

  3. Forecast: Blockchain business value, worldwide, 2017–2030 (2017). https://www.gartner.com/en/documents/3627117

  4. Microsoft azure blockchain (2017). https://azure.microsoft.com/en-us/solutions/blockchain/

  5. Parity: The bug that put \$169m of ethereum on ice? Yeah, it was on the todo list for months (2017). https://www.theregister.co.uk/2017/11/16/parity_flaw_not_fixed

  6. Applications and smart contract samples for workbench (2018). https://github.com/Azure-Samples/blockchain/tree/master/blockchain-workbench/application-and-smart-contract-samples

  7. Asset transfer sample for azure blockchain workbench (2018). https://github.com/Azure-Samples/blockchain/tree/master/blockchain-workbench/application-and-smart-contract-samples/asset-transfer

  8. Azure blockchain content and samples (2018). https://github.com/Azure-Samples/blockchain

  9. Azure blockchain workbench (2018). https://azure.microsoft.com/en-us/features/blockchain-workbench/

  10. Manticore (2018). https://github.com/trailofbits/manticore

  11. Mythril classic: Security analysis tool for ethereum smart contracts (2018). https://github.com/ConsenSys/mythril-classic

  12. Slither, the solidity source analyzer (2018). https://github.com/trailofbits/slither

  13. Verisol: A formal verifier and analysis tool for solidity smart contracts (2018). https://github.com/Microsoft/verisol

  14. Atzei, N., Bartoletti, M., Cimoli, T.: A survey of attacks on ethereum smart contracts (SoK). In: Maffei, M., Ryan, M. (eds.) POST 2017. LNCS, vol. 10204, pp. 164–186. Springer, Heidelberg (2017). https://doi.org/10.1007/978-3-662-54455-6_8

    Chapter  Google Scholar 

  15. Barnett, M., Chang, B.-Y.E., DeLine, R., Jacobs, B., Leino, K.R.M.: Boogie: a modular reusable verifier for object-oriented programs. In: de Boer, F.S., Bonsangue, M.M., Graf, S., de Roever, W.-P. (eds.) FMCO 2005. LNCS, vol. 4111, pp. 364–387. Springer, Heidelberg (2006). https://doi.org/10.1007/11804192_17

    Chapter  Google Scholar 

  16. Bhargavan, K., et al.: Formal verification of smart contracts: short paper. In Proceedings of the 2016 ACM Workshop on Programming Languages and Analysis for Security, PLAS@CCS 2016, Vienna, Austria, 24 October 2016, pp. 91–96 (2016)

    Google Scholar 

  17. Flanagan, C., Leino, K.R.M.: Houdini, an annotation assistant for ESC/Java. In: Oliveira, J.N., Zave, P. (eds.) FME 2001. LNCS, vol. 2021, pp. 500–517. Springer, Heidelberg (2001). https://doi.org/10.1007/3-540-45251-6_29

    Chapter  Google Scholar 

  18. Grech, N., Kong, M., Jurisevic, A., Brent, L., Scholz, B., Smaragdakis, Y.: MadMax: surviving out-of-gas conditions in ethereum smart contracts. PACMPL 2(OOPSLA), 116:1–116:27 (2018)

    Article  Google Scholar 

  19. Grossman, S., et al.: Online detection of effectively callback free objects with applications to smart contracts. PACMPL 2(POPL), 48:1–48:28 (2018)

    Article  Google Scholar 

  20. Hildenbrandt, E., et al.: KEVM: a complete formal semantics of the ethereum virtual machine. In 31st IEEE Computer Security Foundations Symposium, CSF 2018, Oxford, United Kingdom, 9–12 July 2018, pp. 204–217 (2018)

    Google Scholar 

  21. Kalra, S., Goel, S., Dhawan, M., Sharma, S.: ZEUS: analyzing safety of smart contracts. In: 25th Annual Network and Distributed System Security Symposium, NDSS 2018, San Diego, California, USA, 18–21 February 2018 (2018)

    Google Scholar 

  22. Lahiri, S.K., Qadeer, S.: Complexity and algorithms for monomial and clausal predicate abstraction. In: Schmidt, R.A. (ed.) CADE 2009. LNCS (LNAI), vol. 5663, pp. 214–229. Springer, Heidelberg (2009). https://doi.org/10.1007/978-3-642-02959-2_18

    Chapter  Google Scholar 

  23. Lahiri, S.K., Qadeer, S., Galeotti, J.P., Voung, J.W., Wies, T.: Intra-module inference. In: Bouajjani, A., Maler, O. (eds.) CAV 2009. LNCS, vol. 5643, pp. 493–508. Springer, Heidelberg (2009). https://doi.org/10.1007/978-3-642-02658-4_37

    Chapter  Google Scholar 

  24. Lal, A., Qadeer, S., Lahiri, S.K.: A solver for reachability modulo theories. In: Madhusudan, P., Seshia, S.A. (eds.) CAV 2012. LNCS, vol. 7358, pp. 427–443. Springer, Heidelberg (2012). https://doi.org/10.1007/978-3-642-31424-7_32

    Chapter  Google Scholar 

  25. Rustan, K., Leino, M.: Efficient weakest preconditions. Inf. Process. Lett. 93(6), 281–288 (2005)

    Google Scholar 

  26. Luu, L., Chu, D.H., Olickel, H., Saxena, P., Hobor, A.: Making smart contracts smarter. In: Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security, Vienna, Austria, 24–28 October 2016, pp. 254–269 (2016)

    Google Scholar 

  27. Mavridou, A., Laszka, A.: Tool demonstration: Fsolidm for designing secure ethereum smart contracts. In: Principles of Security and Trust - 7th International Conference, POST 2018, Held as Part of the European Joint Conferences on Theory and Practice of Software, ETAPS 2018, Thessaloniki, Greece, 14–20 April 2018, Proceedings, pp. 270–277 (2018)

    Google Scholar 

  28. Nikolic, I., Kolluri, A., Sergey, I., Saxena, P., Hobor, A.: Finding the greedy, prodigal, and suicidal contracts at scale. In: Proceedings of the 34th Annual Computer Security Applications Conference, ACSAC 2018, San Juan, PR, USA, 03–07 December 2018, pp. 653–663 (2018)

    Google Scholar 

  29. Tsankov, P., et al.: Securify: practical security analysis of smart contracts. In: Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security, CCS 2018, Toronto, ON, Canada, 15–19 October 2018, pp. 67–82 (2018)

    Google Scholar 

  30. Wang, Y., et al.: Formal specification and verification of smart contracts in azure blockchain (2018). https://arxiv.org/abs/1812.08829/

Download references

Author information

Authors and Affiliations

  1. University of Texas at Austin, Austin, USA

    Yuepeng Wang, Rong Pan, Isil Dillig & Kostas Ferles

  2. Microsoft Research, Redmond, USA

    Shuvendu K. Lahiri & Shuo Chen

  3. Microsoft Azure, Redmond, USA

    Cody Born & Immad Naseer

Authors
  1. Yuepeng Wang
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. Shuvendu K. Lahiri
    View author publications

    You can also search for this author in PubMed Google Scholar

  3. Shuo Chen
    View author publications

    You can also search for this author in PubMed Google Scholar

  4. Rong Pan
    View author publications

    You can also search for this author in PubMed Google Scholar

  5. Isil Dillig
    View author publications

    You can also search for this author in PubMed Google Scholar

  6. Cody Born
    View author publications

    You can also search for this author in PubMed Google Scholar

  7. Immad Naseer
    View author publications

    You can also search for this author in PubMed Google Scholar

  8. Kostas Ferles
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding author

Correspondence to Yuepeng Wang .

Editor information

Editors and Affiliations

  1. Indian Institute of Technology Bombay, Mumbai, India

    Supratik Chakraborty

  2. SRI International, Menlo Park, CA, USA

    Jorge A. Navas

Rights and permissions

Reprints and permissions

Copyright information

© 2020 Springer Nature Switzerland AG

About this paper

Check for updates. Verify currency and authenticity via CrossMark

Cite this paper

Wang, Y. et al. (2020). Formal Verification of Workflow Policies for Smart Contracts in Azure Blockchain. In: Chakraborty, S., Navas, J. (eds) Verified Software. Theories, Tools, and Experiments. VSTTE 2019. Lecture Notes in Computer Science(), vol 12031. Springer, Cham. https://doi.org/10.1007/978-3-030-41600-3_7

Download citation

  • DOI: https://doi.org/10.1007/978-3-030-41600-3_7

  • Published:

  • Publisher Name: Springer, Cham

  • Print ISBN: 978-3-030-41599-0

  • Online ISBN: 978-3-030-41600-3

  • eBook Packages: Computer ScienceComputer Science (R0)

Publish with us

Policies and ethics

Search

Navigation