  Smart contracts are appealing because they are self-executing business
agreements between parties with the predefined and immutable obligations and
rights. However, as with all software, smart contracts may contain
vulnerabilities because of design flaws, which may be exploited by one of the
parties to defraud the others. In this paper, we demonstrate a systematic
approach to building secure design models for smart contracts using formal
methods. To build the secure models, we first model the behaviors of
participating parties as state machines, and then, we model the predefined
obligations and rights of contracts, which specify the interactions among state
machines for achieving the business goal. After that, we illustrate executable
secure model design patterns in TLA+ (Temporal Logic of Actions) to against
well-known smart contract vulnerabilities in terms of state machines and
obligations and rights at the design level. These vulnerabilities are found in
Ethereum contracts, including Call to the unknown, Gasless send, Reentrancy,
Lost in the transfer, and Unpredictable state. The resultant TLA+
specifications are called secure models. We illustrate our approach to detect
the vulnerabilities using a real-estate contract example at the design level.
