- 30 Oct, 2019 1 commit
-
-
Jakob Botsch Nielsen authored
This lemma makes proving simple properties about the deployed contract state of a contract easier.
-
- 29 Oct, 2019 1 commit
-
-
Jakob Botsch Nielsen authored
Also use these from Congress.v
-
- 28 Oct, 2019 1 commit
-
-
Jakob Botsch Nielsen authored
-
- 25 Oct, 2019 1 commit
-
-
Jakob Botsch Nielsen authored
-
- 13 Oct, 2019 2 commits
-
-
Jakob Botsch Nielsen authored
-
Jakob Botsch Nielsen authored
Contracts cannot create blocks and balance of undeployed contract is 0
-
- 10 Oct, 2019 1 commit
-
-
Jakob Botsch Nielsen authored
-
- 25 Jun, 2019 1 commit
-
-
Jakob Botsch Nielsen authored
-
- 24 Jun, 2019 4 commits
-
-
Jakob Botsch Nielsen authored
-
Jakob Botsch Nielsen authored
Remove it from the contract's perspective for now.
-
Jakob Botsch Nielsen authored
-
Jakob Botsch Nielsen authored
-
- 21 Jun, 2019 1 commit
-
-
Jakob Botsch Nielsen authored
- No longer require that block reward can be computed from height. - Remove Chain's dependence on BlockHeader. Instead inline appropriate fields in Chain structure. - Change step_block to use a BlockHeader now instead of manually specifying all the fields. The new BlockHeader now additionally contains the creator and reward of that block, so step_block in effect contains the reward. - These refactorings means that the circulation proof changes. Introduce created_blocks to get list of blocks created by user, and prove instead that the circulation equals the sum of rewards in blocks. - Rename "baker" to a more general "creator" globally
-
- 13 Jun, 2019 1 commit
-
-
Jakob Botsch Nielsen authored
-
- 11 Jun, 2019 1 commit
-
-
Jakob Botsch Nielsen authored
-
- 10 Jun, 2019 1 commit
-
-
Jakob Botsch Nielsen authored
Versions are not used for anything and the comment is outdated.
-
- 07 Jun, 2019 2 commits
-
-
Jakob Botsch Nielsen authored
-
Jakob Botsch Nielsen authored
-
- 06 Jun, 2019 1 commit
-
-
Jakob Botsch Nielsen authored
This is much more realistic, as allowing contracts to efficiently access transaction histories for all addresses is extremely expensive. To do this, we * Add an account_balance operation in Chain instead * Change incoming_txs and outgoing_txs to compute transactions from traces * Require implementations to give a proof-relevant trace, and rework proofs to use these, as necessary
-
- 31 May, 2019 2 commits
-
-
Jakob Botsch Nielsen authored
This holds for reachable states without this, as proven in undeployed_contract_no_in_txs.
-
Jakob Botsch Nielsen authored
-
- 14 May, 2019 1 commit
-
-
Jakob Botsch Nielsen authored
-
- 09 May, 2019 1 commit
-
-
Jakob Botsch Nielsen authored
A state being reachable means there is an execution starting from the empty state, that ends up in the state.
-
- 05 May, 2019 2 commits
-
-
Jakob Botsch Nielsen authored
-
Jakob Botsch Nielsen authored
- Remove 'prove' tactic - Remove some duplicated tactics and make some proofs more efficient
-
- 03 May, 2019 1 commit
-
-
Jakob Botsch Nielsen authored
Match on smaller expressions, making everything much faster. Also optimize solve_single.
-
- 02 May, 2019 1 commit
-
-
Jakob Botsch Nielsen authored
This proves a concrete property about any Congress contract deployed to a blockchain. More specifically, we show that the count of transactions sent out by any Congress contract will always be less than or equal to the total number of actions it has receive in "create proposal" messages. Thus, this property is stated only over the transactions going in and out to the Congress contract. To prove this, we reason over incoming and outgoing transactions, the internal state of the congress and also the actions in the blockchain queue.
-
- 01 May, 2019 2 commits
-
-
Jakob Botsch Nielsen authored
-
Jakob Botsch Nielsen authored
This split between cases only makes things harder.
-
- 29 Apr, 2019 1 commit
-
-
Jakob Botsch Nielsen authored
These abstract the list structure of the trace away from the events, so that a trace is now a CursorList of ChainEvent values. The ChainState is a new type for the environment and queue.
-
- 27 Apr, 2019 2 commits
-
-
Jakob Botsch Nielsen authored
This moves ChainStep and ChainTrace to type. The reason being that our proofs will depend on prefixes of traces and it will be very useful (if not required) to be able to match on the trace and the steps. ChainBuilderType is changed appropriately: now, an implementation just needs to prove that ChainTrace empty_env [] cur_env [] is inhabited. Thus, ChainTrace can basically be seen as one particular way to order the execution so that we reach a state. When it is inhabited, it thus means that there exists a proper way to order actions so that we reach the state we are in.
-
Jakob Botsch Nielsen authored
-
- 26 Apr, 2019 4 commits
-
-
Jakob Botsch Nielsen authored
-
Jakob Botsch Nielsen authored
Since we will need to reason over specific inhabitants of traces, this is required to prove many interesting properties by induction, as explained to me by Danil Annenkov.
-
Jakob Botsch Nielsen authored
-
Jakob Botsch Nielsen authored
-
- 25 Apr, 2019 4 commits
-
-
Jakob Botsch Nielsen authored
Get rid of the proofs showing that ChainStep and ChainTrace respect EnvironmentEquiv. ChainTrace no longer respects this in the base case (this was necessary to define trace_app).
-
Jakob Botsch Nielsen authored
-
Jakob Botsch Nielsen authored
-
Jakob Botsch Nielsen authored
-