A Formal Model of Bitcoin Transactions

Abstract

We propose a formal model of Bitcoin transactions, which is sufficiently abstract to enable formal reasoning, and at the same time is concrete enough to serve as an alternative documentation to Bitcoin. We use our model to formally prove some well-formedness properties of the Bitcoin blockchain, for instance that each transaction can only be spent once. We release an open-source tool through which programmers can write transactions in our abstract model, and compile them into standard Bitcoin transactions.

A Proofs

Proof of Lemma 1

By Definition 13, is a consistent update of . The thesis follows from condition (2) of Definition 12.    $\square$

Proof of Theorem 1

Let be consistent. By contradiction, assume that there exist $i < j$ and $i',j'$ such that . By consistency, there exist $h,h'$ such that . Since , then by item (2) of Definition 12 it must be . Hence, by Definition 11 it follows that is already spent in . Since , by item (1) of Definition 12, must be unspent—contradiction.    $\square$

Proof of Lemma 2

Let be consistent. By contradiction, assume that , with (and so, ). By Definition 10 it must be , hence in particular . There are two cases. If , then by Definition 10 is not a blockchain, since $i \ne j$. Hence, . By Theorem 1, this cannot happen because is consistent—contradiction.    $\square$

Proof of Lemma 3

Straightforward from Lemma 2, taking .    $\square$

Proof of Theorem 2

Let . By contradiction, there exists some $i<n$ such that, given :

Let $U_i$ and $U_{i+1}$ be the UTXOs of and of , respectively, and let $U = U_i \cap U_{i+1}$. Since $val {(U_i)} < val {(U_{i+1})}$, then it must be $val {(U_i \setminus U)} < val {(U_{i+1} \setminus U)}$. The set $U_i \setminus U$ contains the outputs redeemed by , while the set $U_{i+1} \setminus U$ contains exactly the outputs in . Since is consistent, then . Then, by Definition 12, for each , there exists a unique $j \le i$ such that, given and :

Then, by item (3) of Definition 12:

while we assumed $val {(U_i \setminus U)} < val {(U_{i+1} \setminus U)}$—contradiction.    $\square$