Tezos: A Self-Amending Crypto-Ledger Formalizing On-Chain Governance Protocols

Blockchain Technology 12 min, 3 sec READ

by Martin Banov

A summary of the Tezos system, its innovative contributions to governance, and its approach to smart contract scripting and formal verifications.

Tezos is one of the more innovative and intriguing blockchain-based projects in the cryptosphere. It was originally founded in 2014 by Arthur and Kathleen Breitman with papers describing the specification and a basic functioning prototype. Central to Tezos is its approach to on-chain stakeholder governance and formal procedures for reaching social consensus about the state of its own protocol. It is, in that regard, a blockchain protocol that is not set in stone but designed to continuously evolve, upgrade, and amend itself.

Tezos strives to prevent the social consensus deadlocks and ecosystem fragmenting hard forks that have periodically occurred throughout the short history of cryptocurrencies. (For instance, the DAO hack that led to Ethereum's bifurcation into Ethereum and Ethereum Classic, Bitcoin's split into core and Bitcoin Cash over block size debates.) To avoid such irresolvable conflicts, Tezos fosters active participation in the core development process and decentralizing network maintenance. 

Another distinguishing feature of Tezos is that it is implemented in OCaml. OCaml, or Objective Caml, is an ML (Meta Language: a general-purpose functional programming language rooted in Lisp "with types") derived language created in 1996 that extends the core Caml with object-oriented programming constructs. The OCaml toolchain includes an interactive top-level interpreter, a bytecode compiler and a package manager (OPAM). It has a large standard library, making it useful for many of the same applications as Python and Perl (scripting, administrative operations, etc.), while also suitable for large-scale software engineering with its modular object-oriented programming constructs.

That Tezos is built from such modular components, allows for easily swapping modules in and out. Other networks (such as Bitcoin or Ethereum) can easily be represented within Tezos by implementing their respective components and interface to the networking layer. 

Formalizing On-Chain Crypto-Governance

One of the main innovations in Tezos is the incorporation of a formal protocol modification process (as a multi-stage amendment process) in the software code itself, allowing developers to independently submit source code modifications and be paid for it (including a request for compensation with their submission). Once a modification proposal is submitted, stake-holders ("bakers") vote for or against the modification (with one Tezzie - the system's native token symbolized by ꜩ and equal to a corresponding vote). At least 80% of stakeholders need to have voted in favor of the proposal for it to pass.

Once a proposal passes the preliminary vote, the modified protocol is then run in a sandbox testnet ecosystem simulation for three months. This trial run is carried out in order to test for any possible unforeseen or unexpected consequences of the modification that may not have been evident at the start. After the test period, a new vote takes place in the same fashion before the modifications are incorporated into the Tezos mainnet protocol. Up to twenty proposals can be submitted in a proposal period and proposals can be monitored at tzscan.io.

This is basically a more formalized governance template - whereby proposals can be effectively tested and demonstrated, than Bitcoin's and Ethereum's informal approach of BIP (Bitcoin Improvement Proposal) and EIP (Ethereum Improvement Proposal) proposal submissions on Github. Arguably, this procedural formalism may also avoid the community consensus pitfalls of Bitcoin, where development has stalled to a grinding halt and protocol development has been overtaken by a politburo of just a handful of developers who unilaterally decide on the direction of Bitcoin's future.

The Tezos procedure for implementation of meta-upgrades and amendments to the base protocol itself is a variation of Nomic (after nomos, Greek for law) - a game devised by philosopher Peter Suber (who specializes in philosophy of law and open access to knowledge) in 1982, in which the introspective set of rules include means for the players to change those rules, usually beginning through a system of democratic voting.

Nomic is a game in which changing the rules is a move. In that respect it differs from almost every other game. The primary activity of Nomic is proposing changes in the rules, debating the wisdom of changing them in that way, voting on the changes, deciding what can and cannot be done afterwards, and doing it. Even this core of the game, of course, can be changed.

— Peter Suber, The Paradox of Self-Amendment

Network Shell Interface and OCaml Modules

The network shell works by maintaining the best chain known to the client and is aware of three types of objects - transactions, blocks, and protocols (as OCaml modules used to amend the existing protocol). As the white paper defines it, "the blockchain protocol is fundamentally a monadic implementation of concurrent mutations of a global state" - with blocks defined by the operators acting on this global state.  

Liquid Proof-of-Stake With Optional Delegation

Tezos operates on Proof-of-Stake consensus, which combines a two-step verification protocol with an optional delegation. This Proof-of-Stake formula together with the on-chain governance model aligns the interests of the actors in the system, encouraging active involvement and participation, such that it incentivizes a thoughtful, deliberate, and sustainable development process as Tezos' fundamental value proposition. 

Liquid Proof-of-Stake Mechanism

Tezos' PoS mechanism allows any computer to become a validator node, so long as it meets a few basic conditions (i.e., a warranty of at least 10,000 Tezzies, or about 7 thousand USD at the time of writing). The network randomly chooses a node, among a list of nodes meeting the criteria, which decides on the next block to be appended to the chain. The node then verifies that the transactions to be included are valid, accordingly signed, and communicated for transfer.

After that, the block is further verified by another 32 randomly chosen validators from the list of eligible nodes and if the machine that created the block is found to have made a mistake, it will lose its warranty of at least 10,000 Tezzies.  

EDITOR'S NOTE: A correction of the above came via Twitter by Tezos expert @andimule:

You only put up a fraction (~8%) of your 10,000 for the bond/warranty if you just bake for yourself. It then increases if you have people delegating to you.

In exchange for participating in the network protocol and doing this work, both the block creator and its verifiers receive a small amount of Tezzies as a reward/incentive.  

Delegation Without Ownership Transfer

Tezos also combines a form of Delegated Proof of Stake, through which Tezos (XTZ) token holders who do not wish or who are not always able to directly participate in staking (as described above) can delegate someone else to validate on their behalf, without simutaneously transferring ownership by doing so. (This process is, therefore, not to be confused with the corruptible DPoS model in EOS or Lisk).

Tezos refers to this staking process as “baking”. In this model, bakers commit deposits and are rewarded for signing and publishing blocks. Baking is the action of signing and publishing a block and each block "baked" (or produced) by a random stakeholder is further notarized by the other 32 randomly picked stakeholders.

Bäckerei is a collection of Haskell scripts for managing and automating reward payments from bakers to their delegators. To do so, Bäckerei connects to a full-node, scans the entire transaction history, determines which delegators should be paid, performs calculations on exactly how much they should receive in rewards, and executes the transactions. The exact workings of the Bäckerei reward payments manager are described in this Medium post.

Seed Protocol

Similar to how blockchain-based cryptocurrencies start from a genesis hash or block, Tezos begins with an initial base protocol called the seed protocol. The direction of how the protocol will then evolve from there takes place in seasonal cycles of research and development, submitting proposals and votes, gradually coming to community agreement and final implementation.

Revisions and modifications are adopted over election rounds lasting 131 072 blocks each. Given the one minute block interval, this amounts to about three calendar months. The electoral cycle is itself divided in four quarters of 32 768 blocks and adoption requires a certain quorum to be met. This quorum starts at 80% but adjusts dynamically to reflect the average participation.

Michelson and Liquidity: Business Logic and Contract Scripting Languages

Tezos implements a smart contract language inspired by OCaml called Michelson, which is customized for business logic and modularity in implementing it as needed, in different pieces (rather than a generic "world computer" for running dApps, as the case with Ethereum). Michelson is low-level, stack-based and strongly typed, designed to facilitate formal verifications - allowing users to prove the properties of their contracts before deploying or executing them.

Each contract has an associated “manager” (in the case of an account, the owner). If the contract is flagged as spendable (e.g., similar to the @payable decorator in Ethereum Vyper contracts), the manager may spend the funds associated with the contract. Formally, a contract is represented as:

type contract = {
  counter: int; (* counter to prevent repeat attacks *)
  manager: id; (* hash of the contract 's manager public key *)
  balance: Int64.t; (* balance held *)
  signer: id option; (* id of the signer *)
  code: opcode list; (* contract code as a list of opcodes *)
  storage: data list; (* storage of the contract *)
  spendable: bool; (* may the money be spent by the manager? *)
  delegatable: bool; (* may the manager change the signing key? *)
}

As the low-level base syntax language (similar to what Plutus Core is to Plutus in the Cardano system), Michelson is designed as a readable compilation target with the goal that even the output of the compiler could be understood. The purpose is to provide a small and simple enough core language as a foundation. You can try Michelson via the available demo here.

Liquidity is a higher-level language which comes with a compiler to Michelson and a decompiler for translating between Michelson and Liquidity contract code. Liquidity uses local variables to store values instead of the low-level stack manipulations in Michelson. Liquidity documentation is provided here and an in-browser IDE is available here.

A formal verification framework for Liquidity is under development.

Legal Issues Surrounding The ICO

The uncapped ICO began on July 1, 2017, and went on to quickly reach the $232 million mark within two weeks, making it one of the most (or the most) heavily funded ICOs at the time.

However, following the success of the ICO, a major dispute took place between president Johann Gevers and Arthur and Kathleen Breitman - the owners of Tezos’ intellectual property rights. As a consequence, the launch of the Tezos platform itself stalled and was indefinitely delayed, which contributed to it subsequently running into legal troubles. Users and investors seeking refunds launched a series of lawsuits against the company, arguing that Tezzies (Tezos tokens) constitute unregistered securities.

In mid-February 2018, investors in the Tezos project regained optimism that the network would launch as two of the board members of the Tezos Foundation, Gevers himself included, voluntarily decided to step down and were replaced by Tezos community members Michal Mauny and Ryan Jesperson.

Team and People Involved

Kathleen Breitman is the CEO of Tezos. She holds a degree from Cornell University and was a senior strategy associate for R3 prior to Tezos. She has also worked for the Wall Street Journal.

Arthur Breitman is the CTO of Tezos, having previously worked as a quantitative analyst at Goldman Sachs and Morgan Stanley.

Among Tezos advisors, there have been such well-known luminaries in the domains of distributed systems design, computer science, and cryptography as Emin Gün Sirer and Zooko Wilcox.

The Tezos Commons Foundation,  as their mission statement explains, was established with the purpose of fostering "the growth of the global Tezos ecosystem through the identification, funding, and execution of projects that drive community growth, awareness, and success". 

Summary and Conclusion

Tezos falls into the category of digital commonwealth experiments that are actually innovative and bring something new to the table instead of trying to replicate the success of others or recycle ideas in various configurations that lack real purpose or vision. The on-chain governance model of Tezos is its main distinguishing feature. It is so well thought through as to align stakeholder and developer interests in an integrated environment conditioning a sort of decentralized organization (DAO) as a research agency and testbed for software engineering solutions to do with governance in a distributed computing environment holding significant value within its system. 

Upbeat #tezos meetup in #nyc with founders tonight, helps separate the platform from the #crypto price action. T-shirt quote from the evening, “This field is cross-disciplinary. Have some epistemological humility otherwise you’ll sound like a moron.” -@breitwoman 😂 pic.twitter.com/ArLdWKnoTo

— Hassan Ahmed (@Hassan_NY) November 20, 2018

The fact that Tezos employs OCaml as the grounding language for contract code also contributes to diversifying this emergent programming paradigm and to the crucially important formal verifications and proofs needed for ensuring contract code security, strengthening confidence and public trust in crypto-governance and distributed systems economies as a reliable foundation for building the institutions of tomorrow.

As the white paper concludes: 

Tezos’s true potential lies in putting the stakeholders in charge of deciding on a protocol that they feel best serves them.

Additional Resources and Relevant Material

Github repository and developer Gitlab.

Documentation and block explorer.

Community Matrix channel and subreddit.

An introductory course for learning the basic concepts of Tezos and the process of building decentralized applications.

Liquidity official documentation.

TezosKit, a Swift-based toolchain for interacting with the Tezos blockchain.

A useful curated collection of resources on specialized programming languages executed by decentralized peer-to-peer networks.

Vlad Zamfir's October blog post, "My Intentions for Blockchain Governance" is part of the ongoing discourse on the subject. Neither him nor Buterin have been proponents of coin holder voting (as inviting of corrupt practices, such as vote buying and other forms of bribery, reminiscent of EOS and its attempt at a "constitutionally" disguised crypto-oligarchy) and too formal or algorithmic governance templates (as conducive of inertia and lower participation), although the Tezos model significantly differs from other such familiar implementations.