  This paper presents Twins, an automated unit test generator of Byzantine
attacks. Twins implements three types of Byzantine behaviors: (i) leader
equivocation, (ii) double voting, and (iii) losing internal state such as
forgetting 'locks' guarding voted values. To emulate interesting attacks by a
Byzantine node, it instantiates twin copies of the node instead of one, giving
both twins the same identities and network credentials. To the rest of the
system, the twins appear indistinguishable from a single node behaving in a
'questionable' manner. Twins can systematically generate Byzantine attack
scenarios at scale, execute them in a controlled manner, and examine their
behavior. Twins scenarios iterate over protocol rounds and vary the
communication patterns among nodes. Twins runs in a production setting within
DiemBFT where it can execute 44M Twins-generated scenarios daily. Whereas the
system at hand did not manifest errors, subtle safety bugs that were
deliberately injected for the purpose of validating the implementation of Twins
itself were exposed within minutes. Twins can prevent developers from
regressing correctness when updating the codebase, introducing new features, or
performing routine maintenance tasks. Twins only requires a thin wrapper over
DiemBFT, we thus envision other systems using it. Building on this idea, one
new attack and several known attacks against other BFT protocols were
materialized as Twins scenarios. In all cases, the target protocols break
within fewer than a dozen protocol rounds, hence it is realistic for the Twins
approach to expose the problems.
