DeepAI AI Chat
Log In Sign Up

Towards Formal Verification of HotStuff-based Byzantine Fault Tolerant Consensus in Agda: Extended Version

by   Harold Carr, et al.

LibraBFT is a Byzantine Fault Tolerant (BFT) consensus protocol based on HotStuff. We present an abstract model of the protocol underlying HotStuff / LibraBFT, and formal, machine-checked proofs of their core correctness (safety) property and an extended condition that enables non-participating parties to verify committed results. (Liveness properties would be proved for specific implementations, not for the abstract model presented in this paper.) A key contribution is precisely defining assumptions about the behavior of honest peers, in an abstract way, independent of any particular implementation. Therefore, our work is an important step towards proving correctness of an entire class of concrete implementations, without repeating the hard work of proving correctness of the underlying protocol. The abstract proofs are for a single configuration (epoch); extending these proofs across configuration changes is future work. Our models and proofs are expressed in Agda, and are available in open source.


page 1

page 2

page 3

page 4


Correctness Analysis of IBFT

In this paper we analyse the correctness of Istanbul BFT (IBFT), which i...

An approach to translating Haskell programs to Agda and reasoning about them

We are using the Agda programming language and proof assistant to formal...

Formal Verification of Authenticated, Append-Only Skip Lists in Agda: Extended Version

Authenticated Append-Only Skiplists (AAOSLs) enable maintenance and quer...

Deconstructing Stellar Consensus (Extended Version)

Some of the recent blockchain proposals, such as Stellar and Ripple, all...

Membership-based Manoeuvre Negotiation in Autonomous and Safety-critical Vehicular Systems

A fault-tolerant negotiation-based intersection crossing protocol is pre...

Formal Verification of a Geometry Algorithm: A Quest for Abstract Views and Symmetry in Coq Proofs

This extended abstract is about an effort to build a formal description ...

Locally Solvable Tasks and the Limitations of Valency Arguments

An elegant strategy for proving impossibility results in distributed com...