iCon: Automated Verification of Inter-Transaction Properties in Tezos Smart Contracts with Unknowns

Smart contracts play a critical role in blockchain applications, managing vast amounts of valuable assets. However, they are often vulnerable to attacks due to the inherent difficulties in modifying their code once deployed. Existing security analysis tools and verifiers primarily focus on single-contract verification, while many real-world blockchain applications involve multiple contracts and transactions. In this paper, we introduce an automated verifier, iCon, for inter-transaction properties of smart contracts on the Tezos blockchain platform. iCon is based on our program logic, which verifies inter-transaction properties in the presence of both known and unknown contracts. We present an abstraction technique for unknown contracts and propose a proof technique to ensure that an inter-transaction property holds for any existence of unknown contracts. The proof technique supports the correctness of our verification approach. We have implemented iCon on top of the Why3 verification framework, demonstrating its effectiveness through several case studies, including the decentralized exchange service Dexter2, of which a previous version had a flaw in its implementation.