  Programming digital contracts comes with unique challenges, which include (i)
expressing and enforcing protocols of interaction, (ii) controlling resource
usage, and (iii) preventing the duplication or deletion of a contract's assets.
This article presents the design and type-theoretic foundation of Nomos, a
programming language for digital contracts that addresses these challenges. To
express and enforce protocols, Nomos is based on shared binary session types.
To control resource usage, Nomos employs automatic amortized resource analysis.
To prevent the duplication or deletion of assets, Nomos uses a linear type
system. A monad integrates the effectful session-typed language with a
general-purpose functional language. Nomos' prototype implementation features
linear-time type checking and efficient type reconstruction that includes
automatic inference of resource bounds via off-the-shelf linear optimization.
The effectiveness of the language is evaluated with case studies about
implementing common smart contracts such as auctions, elections, and
currencies. Nomos is completely formalized, including the type system, a cost
semantics, and a transactional semantics to instantiate Nomos contracts on a
blockchain. The type soundness proof ensures that protocols are followed at
run-time and that types establish sound upper bounds on the resource
consumption, ruling out re-entrancy and out-of-gas vulnerabilities.
