Tezos — a self-amending crypto-ledger White paper

1 Tezos a self - amending crypto -ledgerWhite GoodmanSeptember 2, 2014 Changes between the original paper and our current implementation areindicated in red. Our argument is not flatlycircular, but something like it. Willard van Orman QuineAbstractWe present Tezos , a generic and self - amending crypto - ledger . Tezoscan instantiate any blockchain based ledger . The operations of a regularblockchain are implemented as a purely functional module abstracted intoa shell responsible for network operations. Bitcoin, Ethereum, Cryptonote,etc. can all be represented within Tezos by implementing the proper in-terface to the network importantly, Tezos supports meta upgrades: the protocols canevolve by amending their own code.

2 To achieve this, Tezos begins witha seed protocol defining a procedure for stakeholders to approve amend-ments to the protocol,includingamendments to the voting procedureitself. This is not unlike philosopher Peter Suber s Nomic[3], a game builtaround a fully introspective set of addition, Tezos s seed protocol is based on a pure proof-of-stakesystem and supports Turing complete smart contracts. Tezos is imple-mented in OCaml, a powerful functional programming language offeringspeed, an unambiguous syntax and semantic, and an ecosystem makingTezos a good candidate for formal proofs of with the Bitcoin protocol and basic cryptographic primi-tives are assumed in the rest of this Introduction32 self - amending Mathematical representation.

3 The network shell.. Clock.. Chain selection algorithm.. Network level defense.. Functional representation.. Validating the chain.. amending the protocol.. RPC..73 Seed Economy.. Coins.. Mining and signing rewards.. Lost coins.. Amendment rules.. Proof-of-stake mechanism.. Overview.. Clock.. Generating the random seed.. Follow-the-coin procedure.. Mining blocks.. Signing blocks.. Weight of the chain.. Denunciations.. Smart contracts.. Contract type.. Origination.. Transactions.. Storage fees.. Code.. Fees.

4 164 Conclusion1721 IntroductionIn the first part of this paper , we will discuss the concept of abstract blockchainsand the implementation of a self - amending crypto - ledger . In the second part,we will describe our proposed seed self - amending cryptoledgerA blockchain protocol can be decomposed into three distinct protocols:-The network protocol discovers blocks and broadcasts transaction protocol specifies what makes a transaction consensus protocol forms consensus around a unique implements a generic network shell. This shell is agnostic to thetransaction protocol and to the consensus protocol.

5 We refer to the transactionprotocol and the consensus protocol together as a blockchain protocol . Wewill first give a mathematical representation of a blockchain protocol and thendescribe some of the implementation choices in Mathematical representationA blockchain protocol is fundamentally a monadic implementation of concurrentmutations of a global state. This is achieved by defining blocks as operatorsacting on this global state. The free monoid of blocks acting on the genesis stateforms a tree structure. A global, canonical, state is defined as the minimal leaffor a specified suggests the following abstract representation:-Let(S; )be a totally ordered, countable, set of possible /2 Srepresent a special, invalid, SS[f gbe the set of blocks.]

6 The set ofvalidblocks isB\ total order onSis extended so that8s2S; <s. This order deter-mines which leaf in the block tree is considered to be the canonical one. BlocksinBare seen as operators acting on the in all, any blockchain protocol1(be it Bitcoin, Litecoin, Peercoin, Ethereum,Cryptonote, etc) can be fully determined by the tuple:(S; ; ;B SS[f g)1 GHOST is an approach which orders the leafs based on properties of the tree. Such anapproach is problematic for both theoretical and practical reasons. It is almost always betterto emulate it by inserting proofs of mining in the main networking protocol is fundamentally identical for these blockchains.]

7 Mining algorithms are but an emergent property of the network, given theincentives for block Tezos , we make a blockchain protocol introspective by letting blocks acton the protocol itself. We can then express the set of protocols recursively asP={(S; ; ;B S(S P)[f g)} The network shellThis formal mathematical description doesn t tell ushowto build the block is the role of the network shell, which acts as an interface between a gossipnetwork and the network shell works by maintaining the best chain known to the is aware of three type of objects. The first two are transactions and blocks,which are only propagated through the network if deemed valid.]

8 The third areprotocols, OCaml modules used to amend the existing protocol. They will bedescribed in more details later on. For now we will focus on transaction most arduous part of the network shell is to protect nodes againstdenial-of-service ClockEvery block carries a timestamp visible to the network shell. Blocks that appearto come from the future are buffered if their timestamps are within a few minutesof the system time and rejected otherwise. The protocol design must toleratereasonable clock drifts in the clients and must assume that timestamps can Chain selection algorithmThe shell maintains a single chain rather than a full tree of blocks.

9 This chainis only overwritten if the client becomes aware of a strictly better a tree would be more parsimonious in terms of network commu-nications but would be susceptible to denial-of-service attacks where an attackerproduces a large number of low-scoring but valid , it remains possible for a node to lie about the score of a given chain, alie that the client may only uncover after having processed a potentially largenumber of blocks. However, such a node can be subsequently , a protocol can have the property that low scoring chains exhibita low rate of block creation.

10 Thus, the client would only consider a few blocksof a weak fork before concluding that the announced score was a Network level defenseIn addition, the shell is defensive . It attempts to connect to many peers acrossvarious IP ranges. It detects disconnected peers and bans malicious protect against certain denial of service attacks, the protocol providesthe shell with context dependent bounds on the size of blocks and Functional Validating the chainWe can efficiently capture almost all the genericity of our abstract blockchainstructure with the following OCaml types.