A Merkle tree is a data structure for representing a key-value store as a tree. Each node of a Merkle tree is equipped with a hash value computed from those of their descendants. A Merkle tree is often used for representing a state of a blockchain system since it can be used for efficiently auditing the state in a trustless manner. Due to the safety-critical nature of blockchains, ensuring the correctness of their implementation is paramount. We show our formally verified implementation of the core part of Plebeia using F*. Plebeia is a library to manipulate an extension of Merkle trees (called Plebeia trees). It is being implemented as a part of the storage system of the Tezos blockchain system. To this end, we gradually ported Plebeia to F*; the OCaml code extracted from the modules ported to F* is linked with the unverified part of Plebeia. By this gradual porting process, we can obtain a working code from our partially verified implementation of Plebeia; we confirmed that the binary passes all the unit tests of Plebeia. More specifically, we verified the following properties on the implementation of Plebeia: (1) Each tree-manipulating function preserves the invariants on the data structure of a Plebeia tree and satisfies the functional requirements as a nested key-value store; (2) Each function for serializing/deserializing a Plebeia tree to/from the low-level storage is implemented correctly; and (3) The hash function for a Plebeia tree is relatively collision-resistant with respect to the cryptographic safety of the blake2b hash function. During porting Plebeia to F*, we found a bug in an old version of Plebeia, which was overlooked by the tests bundled with the original implementation. To the best of our knowledge, this is the first work that verifies a production-level implementation of a Merkle-tree library by F*.

中文翻译：

---

使用 F* 验证 Merkle Patricia 树库

Merkle 树是一种将键值存储表示为树的数据结构。Merkle 树的每个节点都配备了从它们的后代节点计算出来的哈希值。Merkle 树通常用于表示区块链系统的状态，因为它可以以去信任的方式有效地审计状态。由于区块链的安全关键性质，确保其实施的正确性至关重要。我们展示了我们使用 F* 对 Plebeia 核心部分的正式验证实现。Plebeia 是一个用于操作 Merkle 树（称为 Plebeia 树）的扩展的库。它正在作为 Tezos 区块链系统存储系统的一部分实施。为此，我们逐渐将 Plebeia 移植到 F*；从移植到 F* 的模块中提取的 OCaml 代码与 Plebeia 未经验证的部分相关联。通过这个渐进的移植过程，我们可以从我们部分验证的 Plebeia 实现中获得一个工作代码；我们确认二进制文件通过了 Plebeia 的所有单元测试。更具体地说，我们在 Plebeia 的实现上验证了以下属性：（1）每个树操作函数都保留了 Plebeia 树的数据结构上的不变量，并满足作为嵌套键值存储的功能要求；(2) Plebeia树到/从低级存储序列化/反序列化的每个函数都正确实现；(3) Plebeia 树的哈希函数相对于 blake2b 哈希函数的密码安全性而言是相对抗碰撞的。在将 Plebeia 移植到 F* 的过程中，我们在旧版本的 Plebeia 中发现了一个错误，与原始实现捆绑在一起的测试忽略了这一点。据我们所知，这是 F* 验证 Merkle 树库的生产级实现的第一项工作。