  GossipSub is a popular new peer-to-peer network protocol designed to
disseminate messages quickly and efficiently by allowing peers to forward the
full content of messages only to a dynamically selected subset of their
neighboring peers (mesh neighbors) while gossiping about messages they have
seen with the rest. Peers decide which of their neighbors to graft or prune
from their mesh locally and periodically using a score for each neighbor.
Scores are calculated using a score function that depends on mesh-specific
parameters, weights and counters relating to a peer's performance in the
network. Since a GossipSub network's performance ultimately depends on the
performance of its peers, an important question arises: Is the score
calculation mechanism effective in weeding out non-performing or even
intentionally misbehaving peers from meshes? We answered this question in the
negative in our companion paper by reasoning about GossipSub using our formal,
official and executable ACL2s model. Based on our findings, we synthesized and
simulated attacks against GossipSub which were confirmed by the developers of
GossipSub, FileCoin, and Eth2.0, and publicly disclosed in MITRE
CVE-2022-47547. In this paper, we present a detailed description of our model.
We discuss design decisions, security properties of GossipSub, reasoning about
the security properties in context of our model, attack generation and lessons
we learnt when writing it.
