Verification of Bitcoin Script in Agda using Weakest Preconditions for Access Control

Abstract

This paper addresses the verification of Bitcoin smart contracts using the interactive theorem prover Agda. It focuses on two standard smart contracts that govern the distribution of Bitcoins, Pay to Public Key Hash (P2PKH) and Pay to Multisig (P2MS). Both are written in Bitcoin's low-level language script, and provide the security property of access control to the distribution of Bitcoins.The paper introduces an operational semantics of the script commands used in P2PKH and P2MS, and formalises it in the Agda proof assistant using Hoare triples. It advocates weakest preconditions in the context of Hoare triples as the appropriate notion for verifying access control. Two methodologies for obtaining human-readable weakest preconditions are discussed in order to close the validation gap between user requirements and formal specification of smart contracts:(1) a step-by-step approach, which works backwards instruction by instruction through a script, sometimes stepping over several instructions in one go; (2) symbolic execution of the code and translation into a nested case distinction, which allows to read off weakest preconditions as the disjunction of accepting paths. A syntax for equational reasoning with Hoare Triples is defined in order to formalise those approaches in Agda.

Computing Sufficient and Necessary Conditions in CTL: A Forgetting Approach

“…During the past decades, the weakest precondition was extended to the weakest preexpectation of probabilistic programs [11][12][13]. Therefore, we can use the weakest preexpectation to demonstrate that an expected probability arrives for a pointed postcondition, e.g., verifying Bitcoin's smart contracts [38] and checking the validity of algebraic safety assertions [39]. The SNC and WSC are also used to compute successor state axioms in planning [40,9,14].…”