Skip to content

Commit de50c7b

Browse files
AnnaShalevaAnnaShaleva
committedJun 24, 2024·
formal-models: extend dBFT with additional post-commit phase
Close #111. The additional step is called RMSendAck and allows to send Ack message once enough Commit messages are received. Block can be accepted only if BFT number of Ack messages are collected. Signed-off-by: Anna Shaleva <shaleva.ann@nspcc.ru>
·
v0.3.2v0.3.0
1 parent 96105d0 commit de50c7b

File tree

6 files changed

+646
-0
lines changed

6 files changed

+646
-0
lines changed
 

‎CHANGELOG.md

+1
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ This document outlines major changes between releases.
55
## [Unreleased]
66

77
New features:
8+
* TLA+ model for MEV-resistant dBFT extension (#116)
89

910
Behaviour changes:
1011
* simplify PublicKey interface (#114)

‎formal-models/.github/dbft_antiMEV.drawio

+111
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,111 @@
1+
<mxfile host="app.diagrams.net" modified="2024-06-24T11:45:32.984Z" agent="Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:126.0) Gecko/20100101 Firefox/126.0" etag="L3zGyTC-LyAz5kXq654f" version="24.5.5" type="google">
2+
<diagram name="Page-1" id="gx1AT7QsytIHyGW8taHa">
3+
<mxGraphModel grid="1" page="1" gridSize="10" guides="1" tooltips="1" connect="1" arrows="1" fold="1" pageScale="1" pageWidth="850" pageHeight="1100" math="0" shadow="0">
4+
<root>
5+
<mxCell id="0" />
6+
<mxCell id="1" parent="0" />
7+
<mxCell id="zO6A_hVda2gypDU5CBnV-14" value="" style="edgeStyle=orthogonalEdgeStyle;rounded=1;jumpSize=8;orthogonalLoop=1;jettySize=auto;html=1;strokeWidth=2;fontFamily=Comic Sans MS;fontSize=16;fontColor=#404040;startArrow=none;startFill=0;endArrow=classicThin;endFill=1;startSize=4;endSize=4;entryX=0.5;entryY=0;entryDx=0;entryDy=0;entryPerimeter=0;" edge="1" parent="1" target="zO6A_hVda2gypDU5CBnV-6">
8+
<mxGeometry relative="1" as="geometry">
9+
<mxPoint x="471" y="35" as="sourcePoint" />
10+
<mxPoint x="590" y="160" as="targetPoint" />
11+
</mxGeometry>
12+
</mxCell>
13+
<mxCell id="zO6A_hVda2gypDU5CBnV-15" value="&lt;div style=&quot;font-size: 14px;&quot;&gt;&lt;font style=&quot;font-size: 14px;&quot;&gt;send PReq (primary)&lt;/font&gt;&lt;/div&gt;&lt;div style=&quot;font-size: 14px;&quot;&gt;&lt;font style=&quot;font-size: 14px;&quot;&gt;or&lt;/font&gt;&lt;/div&gt;&lt;div style=&quot;font-size: 14px;&quot;&gt;&lt;font style=&quot;font-size: 14px;&quot;&gt;send PResp (backup)&lt;br&gt;&lt;/font&gt;&lt;/div&gt;" style="edgeLabel;html=1;align=center;verticalAlign=middle;resizable=0;points=[];fontSize=16;fontFamily=Comic Sans MS;fontColor=#404040;" connectable="0" vertex="1" parent="zO6A_hVda2gypDU5CBnV-14">
14+
<mxGeometry x="0.175" y="3" relative="1" as="geometry">
15+
<mxPoint x="-3" y="23" as="offset" />
16+
</mxGeometry>
17+
</mxCell>
18+
<mxCell id="zO6A_hVda2gypDU5CBnV-3" value="&lt;font style=&quot;font-size: 16px;&quot; face=&quot;Comic Sans MS&quot;&gt;initialized&lt;/font&gt;" style="strokeWidth=2;html=1;shape=mxgraph.flowchart.terminator;whiteSpace=wrap;fontFamily=Georgia;fontSize=16;strokeColor=#EA6B66;" vertex="1" parent="1">
19+
<mxGeometry x="340" y="10" width="130" height="50" as="geometry" />
20+
</mxCell>
21+
<mxCell id="zO6A_hVda2gypDU5CBnV-23" style="edgeStyle=orthogonalEdgeStyle;rounded=1;jumpSize=8;orthogonalLoop=1;jettySize=auto;html=1;entryX=0.5;entryY=0;entryDx=0;entryDy=0;entryPerimeter=0;strokeWidth=2;fontFamily=Comic Sans MS;fontSize=14;fontColor=#404040;startArrow=none;startFill=0;endArrow=classicThin;endFill=1;startSize=4;endSize=4;" edge="1" parent="1" source="zO6A_hVda2gypDU5CBnV-6" target="zO6A_hVda2gypDU5CBnV-7">
22+
<mxGeometry relative="1" as="geometry" />
23+
</mxCell>
24+
<mxCell id="zO6A_hVda2gypDU5CBnV-24" value="| PReq &lt;strong style=&quot;font-family: noto_regular; color: rgb(75, 75, 75); font-size: 10pt;&quot;&gt;∪ &lt;/strong&gt;PResp | ≥ M&lt;span style=&quot;font-family: noto_regular; color: rgb(75, 75, 75); font-size: 10pt;&quot;&gt;&lt;/span&gt;" style="edgeLabel;html=1;align=center;verticalAlign=middle;resizable=0;points=[];fontSize=14;fontFamily=Comic Sans MS;fontColor=#404040;" connectable="0" vertex="1" parent="zO6A_hVda2gypDU5CBnV-23">
25+
<mxGeometry x="-0.24" y="-1" relative="1" as="geometry">
26+
<mxPoint x="4" y="8" as="offset" />
27+
</mxGeometry>
28+
</mxCell>
29+
<mxCell id="zO6A_hVda2gypDU5CBnV-6" value="prepareSent" style="strokeWidth=2;html=1;shape=mxgraph.flowchart.terminator;whiteSpace=wrap;fontFamily=Georgia;fontSize=16;strokeColor=#EA6B66;" vertex="1" parent="1">
30+
<mxGeometry x="520" y="160" width="130" height="50" as="geometry" />
31+
</mxCell>
32+
<mxCell id="zO6A_hVda2gypDU5CBnV-25" style="edgeStyle=orthogonalEdgeStyle;rounded=1;jumpSize=8;orthogonalLoop=1;jettySize=auto;html=1;entryX=0.5;entryY=0;entryDx=0;entryDy=0;entryPerimeter=0;strokeWidth=2;fontFamily=Comic Sans MS;fontSize=14;fontColor=#404040;startArrow=none;startFill=0;endArrow=classicThin;endFill=1;startSize=4;endSize=4;" edge="1" parent="1" source="zO6A_hVda2gypDU5CBnV-7" target="zO6A_hVda2gypDU5CBnV-8">
33+
<mxGeometry relative="1" as="geometry" />
34+
</mxCell>
35+
<mxCell id="zO6A_hVda2gypDU5CBnV-26" value="| Commit | ≥ M" style="edgeLabel;html=1;align=center;verticalAlign=middle;resizable=0;points=[];fontSize=14;fontFamily=Comic Sans MS;fontColor=#404040;" connectable="0" vertex="1" parent="zO6A_hVda2gypDU5CBnV-25">
36+
<mxGeometry x="-0.1818" y="-2" relative="1" as="geometry">
37+
<mxPoint y="6" as="offset" />
38+
</mxGeometry>
39+
</mxCell>
40+
<mxCell id="zO6A_hVda2gypDU5CBnV-7" value="commitSent" style="strokeWidth=2;html=1;shape=mxgraph.flowchart.terminator;whiteSpace=wrap;fontFamily=Georgia;fontSize=16;strokeColor=#EA6B66;" vertex="1" parent="1">
41+
<mxGeometry x="520" y="310" width="130" height="50" as="geometry" />
42+
</mxCell>
43+
<mxCell id="zO6A_hVda2gypDU5CBnV-8" value="commitAckSent" style="strokeWidth=2;html=1;shape=mxgraph.flowchart.terminator;whiteSpace=wrap;fontFamily=Georgia;fontSize=16;strokeColor=#EA6B66;" vertex="1" parent="1">
44+
<mxGeometry x="520" y="470" width="130" height="50" as="geometry" />
45+
</mxCell>
46+
<mxCell id="zO6A_hVda2gypDU5CBnV-11" value="" style="edgeStyle=orthogonalEdgeStyle;rounded=1;orthogonalLoop=1;jettySize=auto;html=1;fontFamily=Comic Sans MS;fontSize=16;entryX=0;entryY=0.5;entryDx=0;entryDy=0;entryPerimeter=0;endSize=4;startSize=4;jumpSize=8;strokeWidth=2;startArrow=classicThin;startFill=1;endArrow=none;endFill=0;" edge="1" parent="1" source="zO6A_hVda2gypDU5CBnV-9" target="zO6A_hVda2gypDU5CBnV-3">
47+
<mxGeometry relative="1" as="geometry">
48+
<mxPoint x="275" y="85" as="targetPoint" />
49+
</mxGeometry>
50+
</mxCell>
51+
<mxCell id="zO6A_hVda2gypDU5CBnV-12" value="&lt;font style=&quot;font-size: 14px;&quot;&gt;t/o&lt;/font&gt;" style="edgeLabel;html=1;align=center;verticalAlign=middle;resizable=0;points=[];fontSize=16;fontFamily=Comic Sans MS;fontColor=#404040;" connectable="0" vertex="1" parent="zO6A_hVda2gypDU5CBnV-11">
52+
<mxGeometry x="-0.2125" y="1" relative="1" as="geometry">
53+
<mxPoint as="offset" />
54+
</mxGeometry>
55+
</mxCell>
56+
<mxCell id="zO6A_hVda2gypDU5CBnV-16" value="&amp;nbsp;t/o&amp;nbsp; " style="edgeStyle=orthogonalEdgeStyle;rounded=1;jumpSize=8;orthogonalLoop=1;jettySize=auto;html=1;entryX=0;entryY=0.5;entryDx=0;entryDy=0;entryPerimeter=0;strokeWidth=2;fontFamily=Comic Sans MS;fontSize=14;fontColor=#404040;startArrow=classicThin;startFill=1;endArrow=none;endFill=0;startSize=4;endSize=4;" edge="1" parent="1" target="zO6A_hVda2gypDU5CBnV-6">
57+
<mxGeometry relative="1" as="geometry">
58+
<mxPoint x="340" y="185" as="sourcePoint" />
59+
<mxPoint x="470" y="185" as="targetPoint" />
60+
</mxGeometry>
61+
</mxCell>
62+
<mxCell id="zO6A_hVda2gypDU5CBnV-17" style="edgeStyle=orthogonalEdgeStyle;rounded=1;jumpSize=8;orthogonalLoop=1;jettySize=auto;html=1;entryX=0.5;entryY=0;entryDx=0;entryDy=0;entryPerimeter=0;strokeWidth=2;fontFamily=Comic Sans MS;fontSize=14;fontColor=#404040;startArrow=none;startFill=0;endArrow=classicThin;endFill=1;startSize=4;endSize=4;" edge="1" parent="1" source="zO6A_hVda2gypDU5CBnV-9" target="zO6A_hVda2gypDU5CBnV-6">
63+
<mxGeometry relative="1" as="geometry">
64+
<Array as="points">
65+
<mxPoint x="275" y="240" />
66+
<mxPoint x="480" y="240" />
67+
<mxPoint x="480" y="140" />
68+
<mxPoint x="585" y="140" />
69+
</Array>
70+
</mxGeometry>
71+
</mxCell>
72+
<mxCell id="zO6A_hVda2gypDU5CBnV-22" value="&amp;nbsp;| Commit | &amp;gt; F&amp;nbsp; " style="edgeLabel;html=1;align=center;verticalAlign=middle;resizable=0;points=[];fontSize=14;fontFamily=Comic Sans MS;fontColor=#404040;" connectable="0" vertex="1" parent="zO6A_hVda2gypDU5CBnV-17">
73+
<mxGeometry x="-0.4" y="1" relative="1" as="geometry">
74+
<mxPoint x="-8" as="offset" />
75+
</mxGeometry>
76+
</mxCell>
77+
<mxCell id="zO6A_hVda2gypDU5CBnV-27" style="edgeStyle=orthogonalEdgeStyle;rounded=1;jumpSize=8;orthogonalLoop=1;jettySize=auto;html=1;entryX=0.5;entryY=0;entryDx=0;entryDy=0;entryPerimeter=0;strokeWidth=2;fontFamily=Comic Sans MS;fontSize=14;fontColor=#404040;startArrow=none;startFill=0;endArrow=classicThin;endFill=1;startSize=4;endSize=4;" edge="1" parent="1" source="zO6A_hVda2gypDU5CBnV-9" target="zO6A_hVda2gypDU5CBnV-3">
78+
<mxGeometry relative="1" as="geometry">
79+
<Array as="points">
80+
<mxPoint x="160" y="185" />
81+
<mxPoint x="160" y="-20" />
82+
<mxPoint x="405" y="-20" />
83+
</Array>
84+
</mxGeometry>
85+
</mxCell>
86+
<mxCell id="zO6A_hVda2gypDU5CBnV-28" value="&amp;nbsp;| CV | ≥ M, init at next view&amp;nbsp; " style="edgeLabel;html=1;align=center;verticalAlign=middle;resizable=0;points=[];fontSize=14;fontFamily=Comic Sans MS;fontColor=#404040;" connectable="0" vertex="1" parent="zO6A_hVda2gypDU5CBnV-27">
87+
<mxGeometry x="0.2286" y="-3" relative="1" as="geometry">
88+
<mxPoint x="47" y="-4" as="offset" />
89+
</mxGeometry>
90+
</mxCell>
91+
<mxCell id="zO6A_hVda2gypDU5CBnV-9" value="cv" style="strokeWidth=2;html=1;shape=mxgraph.flowchart.terminator;whiteSpace=wrap;fontFamily=Georgia;fontSize=16;strokeColor=#EA6B66;" vertex="1" parent="1">
92+
<mxGeometry x="210" y="160" width="130" height="50" as="geometry" />
93+
</mxCell>
94+
<mxCell id="bSvnLd7m7FiDBpnTT2Ld-1" style="edgeStyle=orthogonalEdgeStyle;rounded=1;jumpSize=8;orthogonalLoop=1;jettySize=auto;html=1;entryX=0.5;entryY=0;entryDx=0;entryDy=0;entryPerimeter=0;strokeWidth=2;fontFamily=Comic Sans MS;fontSize=14;fontColor=#404040;startArrow=none;startFill=0;endArrow=classicThin;endFill=1;startSize=4;endSize=4;" edge="1" parent="1">
95+
<mxGeometry relative="1" as="geometry">
96+
<mxPoint x="584.5" y="520" as="sourcePoint" />
97+
<mxPoint x="584.5" y="630" as="targetPoint" />
98+
</mxGeometry>
99+
</mxCell>
100+
<mxCell id="bSvnLd7m7FiDBpnTT2Ld-2" value="| Ack | ≥ M" style="edgeLabel;html=1;align=center;verticalAlign=middle;resizable=0;points=[];fontSize=14;fontFamily=Comic Sans MS;fontColor=#404040;" connectable="0" vertex="1" parent="bSvnLd7m7FiDBpnTT2Ld-1">
101+
<mxGeometry x="-0.1818" y="-2" relative="1" as="geometry">
102+
<mxPoint x="3" y="6" as="offset" />
103+
</mxGeometry>
104+
</mxCell>
105+
<mxCell id="bSvnLd7m7FiDBpnTT2Ld-3" value="blockAccepted" style="strokeWidth=2;html=1;shape=mxgraph.flowchart.terminator;whiteSpace=wrap;fontFamily=Georgia;fontSize=16;strokeColor=#EA6B66;" vertex="1" parent="1">
106+
<mxGeometry x="520" y="630" width="130" height="50" as="geometry" />
107+
</mxCell>
108+
</root>
109+
</mxGraphModel>
110+
</diagram>
111+
</mxfile>

‎formal-models/.github/dbft_antiMEV.png

68.5 KB
Loading

‎formal-models/README.md

+62
Original file line numberDiff line numberDiff line change
@@ -356,6 +356,68 @@ configuration:
356356
* [TLA⁺ specification](./dbft2.1_centralizedCV/dbftCentralizedCV.tla)
357357
* [TLC Model Checker configuration](./dbft2.1_centralizedCV/dbftCentralizedCV___AllGoodModel.launch)
358358

359+
## MEV-resistant dBFT models
360+
361+
[Neo X chain](https://docs.banelabs.org/) uses dBFT 2.0 algorithm as a consensus engine. As a part of
362+
the Neo X anti-MEV feature implementation, dBFT 2.0 extension was designed to
363+
provide single-block finality for encrypted transactions (a.k.a. envelope
364+
transactions). Compared to dBFT 2.0, MEV-resistant dBFT algorithm includes an
365+
additional `post-Commit` phase that is required to be passed through by consensus
366+
nodes before every block acceptance. This phase allows consensus nodes to exchange
367+
some additional data related to encrypted transactions and to the final state of
368+
accepting block using a new type of consensus messages. The improved protocol based
369+
on dBFT 2.0 with an additional phase will be referred below as MEV-resistant dBFT.
370+
371+
We've checked MEV-resistant dBFT model with the TLC Model Checker against the same
372+
set of launch configurations that was used to reveal the liveness problems of the
373+
[basic dBFT 2.0 model](#basic-dbft-20-model). MEV-resistant dBFT model brings no extra problems to the
374+
protocol, but it has been proved that this model has exactly the same
375+
[liveness bug](https://github.com/neo-project/neo-modules/issues/792) that the
376+
original dBFT 2.0 model has which is expected.
377+
378+
### Basic MEV-resistant dBFT model
379+
380+
This specification is an extension of the
381+
[basic dBFT 2.0 model](#basic-dbft-20-model). Compared to the base model,
382+
MEV-resistant dBFT specification additionally includes:
383+
384+
1. New message type `CommitAck` aimed to reflect an additional protocol
385+
message that should be sent by resource manager if at least `M` `Commit`
386+
messages were collected by the node (that confirms a.k.a. "PreBlock"
387+
final acceptance).
388+
2. New resource manager state `commitAckSent` aimed to reflect the additional phase
389+
of the protocol needed for consensus nodes to exchange some data that was not
390+
available at the time of the first commit. This RM state represents a consensus
391+
node state when it has sent these additional post-commit data but has not accepted
392+
the final block yet.
393+
3. New specification step `RMSendCommitAck` describing the transition between
394+
`commitSent` and `commitAckSent` phases of the protocol, or, which is the same,
395+
corresponding resource managers states. This step allows the resource manager to
396+
send `CommitAck` message if at least `M` valid `Commit` messages are collected.
397+
4. Adjusted behaviour of `RMAcceptBlock` step: block acceptance is possible iff the
398+
node has sent the `CommitAck` message and there are at least `M` `CommitAck`
399+
messages collected by the node.
400+
5. Adjusted behaviour of "faulty" resource managers: allow malicious nodes to send an
401+
`CommitAck` message via `RMFaultySendCommitAck` step.
402+
403+
It should be noted that, in comparison with the dBFT 2.0 protocol where the node is
404+
being locked in the `commitSent` state until the block acceptance, MEV-resistant dBFT
405+
does not allow to accept the block right after the `commitSent` state. However, it
406+
allows the node to move from `commitSent` phase further to the `commitAckSent` state
407+
and locks the node at this state until the block acceptance. No view change may be
408+
initiated or accepted by a node entered the `commitAckSent` state.
409+
410+
Here's the scheme of transitions between consensus node states for MEV-resistant dBFT
411+
algorithm:
412+
413+
![Basic MEV-resistant dBFT model transitions scheme](./.github/dbft_antiMEV.png)
414+
415+
Here you can find the specification file and the basic MEV-resistant dBFT TLC Model
416+
Checker launch configuration for the four "honest" consensus nodes scenario:
417+
418+
* [TLA⁺ specification](dbft_antiMEV/dbft.tla)
419+
* [TLC Model Checker configuration](dbft_antiMEV/dbft___AllGoodModel.launch)
420+
359421
## How to run/check the TLA⁺ specification
360422

361423
### Prerequirements

‎formal-models/dbft_antiMEV/dbft.tla

+430
Large diffs are not rendered by default.

‎formal-models/dbft_antiMEV/dbft___AllGoodModel.launch

+42
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
<?xml version="1.0" encoding="UTF-8" standalone="no"?>
2+
<launchConfiguration type="org.lamport.tla.toolbox.tool.tlc.modelCheck">
3+
<stringAttribute key="configurationName" value="AllGoodModel"/>
4+
<intAttribute key="distributedFPSetCount" value="0"/>
5+
<stringAttribute key="distributedNetworkInterface" value="172.200.0.254"/>
6+
<intAttribute key="distributedNodesCount" value="1"/>
7+
<stringAttribute key="distributedTLC" value="off"/>
8+
<intAttribute key="fpIndex" value="47"/>
9+
<intAttribute key="maxHeapSize" value="50"/>
10+
<stringAttribute key="modelBehaviorInit" value=""/>
11+
<stringAttribute key="modelBehaviorNext" value=""/>
12+
<stringAttribute key="modelBehaviorSpec" value="Spec"/>
13+
<intAttribute key="modelBehaviorSpecType" value="1"/>
14+
<stringAttribute key="modelBehaviorVars" value="msgs, rmState"/>
15+
<stringAttribute key="modelComments" value=""/>
16+
<booleanAttribute key="modelCorrectnessCheckDeadlock" value="true"/>
17+
<listAttribute key="modelCorrectnessInvariants">
18+
<listEntry value="1TypeOK"/>
19+
<listEntry value="1InvTwoBlocksAccepted"/>
20+
<listEntry value="1InvFaultNodesCount"/>
21+
</listAttribute>
22+
<listAttribute key="modelCorrectnessProperties">
23+
<listEntry value="1Liveness"/>
24+
</listAttribute>
25+
<intAttribute key="modelEditorOpenTabs" value="10"/>
26+
<stringAttribute key="modelParameterActionConstraint" value=""/>
27+
<listAttribute key="modelParameterConstants">
28+
<listEntry value="RMFault;;{};0;0"/>
29+
<listEntry value="MaxView;;1;0;0"/>
30+
<listEntry value="RMDead;;{};0;0"/>
31+
<listEntry value="RM;;{0, 1, 2, 3};0;0"/>
32+
</listAttribute>
33+
<stringAttribute key="modelParameterContraint" value="MaxViewConstraint"/>
34+
<listAttribute key="modelParameterDefinitions"/>
35+
<stringAttribute key="modelParameterModelValues" value="{}"/>
36+
<stringAttribute key="modelParameterNewDefinitions" value=""/>
37+
<intAttribute key="modelVersion" value="20191005"/>
38+
<intAttribute key="numberOfWorkers" value="8"/>
39+
<stringAttribute key="result.mail.address" value=""/>
40+
<stringAttribute key="specName" value="dbft"/>
41+
<stringAttribute key="tlcResourcesProfile" value="local custom"/>
42+
</launchConfiguration>

0 commit comments

Comments
 (0)
Please sign in to comment.