Formal Analysis of the Ice Protocol