Arxiv paper on IFC for smart contracts with off-chain components, showing even loop-free code can block and spoil the model, naturally.