{"id":23802040,"url":"https://github.com/cwgoes/tm-proposer-idris","last_synced_at":"2026-02-05T16:32:31.467Z","repository":{"id":86516056,"uuid":"161911975","full_name":"cwgoes/tm-proposer-idris","owner":"cwgoes","description":"Formalization of Tendermint proposer election properties","archived":false,"fork":false,"pushed_at":"2019-01-13T17:59:02.000Z","size":57,"stargazers_count":15,"open_issues_count":0,"forks_count":1,"subscribers_count":2,"default_branch":"master","last_synced_at":"2025-01-01T22:19:09.818Z","etag":null,"topics":["blockchain","dlt","formal-verification","idris","tendermint"],"latest_commit_sha":null,"homepage":null,"language":"Idris","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/cwgoes.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2018-12-15T14:19:38.000Z","updated_at":"2024-05-17T16:48:21.000Z","dependencies_parsed_at":null,"dependency_job_id":"b568009a-a5ba-4c7e-b538-28c156911020","html_url":"https://github.com/cwgoes/tm-proposer-idris","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cwgoes%2Ftm-proposer-idris","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cwgoes%2Ftm-proposer-idris/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cwgoes%2Ftm-proposer-idris/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cwgoes%2Ftm-proposer-idris/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/cwgoes","download_url":"https://codeload.github.com/cwgoes/tm-proposer-idris/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":240052069,"owners_count":19740439,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["blockchain","dlt","formal-verification","idris","tendermint"],"created_at":"2025-01-01T22:18:39.544Z","updated_at":"2026-02-05T16:32:31.436Z","avatar_url":"https://github.com/cwgoes.png","language":"Idris","funding_links":[],"categories":[],"sub_categories":[],"readme":"### Summary\n\nFormal verification of fairness of the [Tendermint](https://github.com/tendermint/tendermint) proposer election algorithm in the proof assistant [Idris](https://idris-lang.org).\n\nIn particular, the Idris source in this repository proves that maximally strict bounds on stake-proportionality of proposer election hold over an epoch of any length with no power changes by inhabiting the following type:\n\n```idris\nfairlyProportional :\n  (idA : ProposerId) -\u003e (idB : ProposerId) -\u003e\n  (wA : ProposerWeight) -\u003e (wB : ProposerWeight) -\u003e\n  (pA : ProposerPriority) -\u003e (pB: ProposerPriority) -\u003e\n  (n : Nat) -\u003e\n  (wA \u003e= 0 = True) -\u003e (wB \u003e= 0 = True) -\u003e\n  (abs(pA - pB) \u003c= (wA + wB) = True) -\u003e\n  ((count idA (snd (incrementElectMany n ((idA, wA, pA), (idB, wB, pB)))))\n      \u003e= ((n * (wA / (wA + wB))) - 1) = True,\n   (count idA (snd (incrementElectMany n ((idA, wA, pA), (idB, wB, pB)))))\n      \u003c= ((n * (wA / (wA + wB))) + 1) = True)\n```\n\nwhere `incrementElectMany` repeats the proposer-election function and returns the list of elected proposers.\n\nIn English, this proof could be read as \"a validator, in a sequence of proposer elections where no other power\nchanges take place, proposes no fewer blocks than the total blocks in the epoch multiplied by its fraction of stake\nless one, and proposes no more blocks than the total blocks in the epoch multiplied by its fraction of stake plus one\".\n\nAs epochs can be as short as one block (for which one proposer must be chosen), this is the strictest possible fairness criterion.\n\nThe requisite initial bound on the difference in proposer priority is the reason for [this pull request](https://github.com/tendermint/tendermint/pull/3049).\n\n### Caveats\n\n- You must trust that the type theory used by Idris ([paper](https://pdfs.semanticscholar.org/1407/220ca09070233dca256433430d29e5321dc2.pdf)) is sound.\n- At present, this proof only covers the two-validator case - a reduction from the n-validator case is planned.\n- This fairness criterion only holds over epochs with no validator power (weight) changes.\n- The Idris standard library does not implement proofs of standard field laws for arithmetic operations over integers, so these are [assumed to hold](src/Types.idr).\n  In practice standard library proofs wouldn't be helpful anyways since the actual implementation is in Golang, not Idris.\n- This constitutes a proof of algorithmic correctness, which is not the same thing as implementational correctness - the Golang\n  code could have incorrect optimizations, integer overflow/underflow, etc.\n\n### Usage\n\nTo check that the verified properties hold, run:\n\n```bash\nmake check\n```\n\nTo open up a REPL and play around with proof components, run:\n\n```bash\nmake\n```\n\nOr to read the logic yourself, open [Main.idr](src/Main.idr).\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcwgoes%2Ftm-proposer-idris","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fcwgoes%2Ftm-proposer-idris","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcwgoes%2Ftm-proposer-idris/lists"}