  Most blockchain platforms from Ethereum onwards render smart contracts as
stateful reactive objects that update their state and transfer crypto-assets in
response to transactions. A drawback of this design is that when users submit a
transaction, they cannot predict in which state it will be executed. This
exposes them to transaction-ordering attacks, a widespread class of attacks
where adversaries with the power to construct blocks of transactions can
extract value from smart contracts (the so-called MEV attacks). The UTXO model
is an alternative blockchain design that thwarts these attacks by requiring new
transactions to spend past ones: since transactions have unique identifiers,
reordering attacks are ineffective. Currently, the blockchains following the
UTXO model either provide contracts with limited expressiveness (Bitcoin), or
require complex run-time environments (Cardano). We present ILLUM , an
Intermediate-Level Language for the UTXO Model. ILLUM can express real-world
smart contracts, e.g. those found in Decentralized Finance. We define a
compiler from ILLUM to a bare-bone UTXO blockchain with loop-free scripts. Our
compilation target only requires minimal extensions to Bitcoin Script: in
particular, we exploit covenants, a mechanism for preserving scripts along
chains of transactions. We prove the security of our compiler: namely, any
attack targeting the compiled contract is also observable at the ILLUM level.
Hence, the compiler does not introduce new vulnerabilities that were not
already present in the source ILLUM contract. We evaluate the practicality of
ILLUM as a compilation target for higher-level languages. To this purpose, we
implement a compiler from a contract language inspired by Solidity to ILLUM,
and we apply it to a benchmark or real-world smart contracts.
