{"id":"30494b42-212c-4735-8fe7-923d9915e24a","arxiv_id":"1908.03999","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":9,"one_line_summary":"A collateralized two-way peg with parametrized tokens lets Dogecoin cross to Ethereum without a fork, using bulletproofs and Truebit for verification.","lead":"This paper designs a two-way bridge that moves Dogecoin onto the Ethereum blockchain without changing Dogecoin's software. It uses bonded operators, a relay with cryptographic proofs, and price-tiered tokens to let smart contracts handle DOGE.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Trustless claim needs an unstated liveness assumption: no mechanism guarantees a challenger in the verification window, and §4.9 admits an attacker profits when no agents are watching but ETH collateral is staked.","rationale":"The central claim is that the construction is efficient, trustless, and retrofitting. The weakest point is the relay's security, which is enforced only by timely challenges. The reader's weakest assumption (rational, monitoring users) is exactly the keystone of that security. My read agrees, and I found the paper's own Section 4.9 explicitly concedes the failure mode: if no Operators, Crossers, or Hodlers are watching while ETH collateral is staked, an attacker can append a bogus history and profit. This is not merely a worst-case theoretical assumption; the protocol has no mechanism to prevent the verification window from being empty of challengers. The relay tax rewards successful extensions, not monitoring, and the compensation for a correct challenge only materializes if someone is already watching. Thus the 'trustless' property should be conditional on a liveness/monitoring assumption, exactly as the reader's CONDITIONAL verdict states. I recommend no change to the verdict.","tokens_in":26174,"tokens_out":15078,"duration_ms":157427,"concrete_test":"Write a minimal executable specification of the Bridge Contract's relay, minting, and unlocking logic (e.g., in a Solidity test harness or a formal model checker) in which no honest Relayer submits a challenge during the verification window. Submit a fabricated commitment (random 32-byte root) with a range equal to the current confirmed Dogecoin height, wait past the d-k-block timeout, then submit a lock report containing a Merkle proof of a fake transaction from an attacker-controlled address to a bridge head that has ETH collateral. Check whether the contract mints WOW and whether burning those WOW transfers the operator's collateral to the attacker. If the attack succeeds, the protocol is insecure in the exact scenario Section 4.9 identifies, and the 'trustless' claim requires an explicit liveness assumption.","verdict_should_be":"UNCHANGED","load_bearing_attack":"Under the relay protocol (§4.4–4.5), a Relayer submission is appended to the Bridge Contract's history if no one challenges it within d-k Dogecoin blocks. The Bridge Contract does not validate the Merkle commitment at acceptance time; verification occurs only upon a challenge. Hence an attacker can submit a fabricated commitment (e.g., a random 32-byte hash) with a plausible range, wait out the timeout, and then use Section 4.6's reporting mechanism to present a Merkle proof of a fake 'lock' transaction from an attacker-controlled address to a bridge head backed by real ETH collateral. The Bridge Contract will verify the Merkle proof against the adversary-chosen root and mint WOW. Burning those WOW in Section 4.7 then transfers the operator's ETH collateral to the attacker. The only defense is a timely challenge, but nothing guarantees that any honest, online Relayer exists during the window; the Section 2 rationality assumptions do not imply continuous monitoring, and free-riding is individually rational. The paper itself concedes the exposure in Section 4.9: an attacker 'does not gain coins or tokens via this method when no DOGE are locked and no ETH collateral is staked' — implying that when the bridge is actually in use (ETH collateral staked), the attacker does gain. Backtracking cannot undo already-minted WOW. The abstract's 'trustless' therefore holds only under an unstated liveness assumption.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes Dogethereum, a two-way peg between Dogecoin and Ethereum that requires no fork. An Operator posts ETH collateral in a Bridge Contract; a Crosser sends DOGE to the Operator's address; a Relayer relays the lock to Ethereum; the Bridge Contract mints WOW tokens; burning WOW triggers a DOGE unlock or forfeiture of the Operator's ETH collateral. The relay uses Merkle commitments and challenge-based verification, with bulletproofs and Truebit to verify scrypt proofs-of-work in disputes. The paper claims the construction is efficient, trustless, and retrofitting, and it argues via invariants in Section 5.1 that rational agents' monitoring keeps the reserves balanced. The paper also sketches an extension to Bitcoin/Ethereum and reports extrapolated performance estimates for scrypt bulletproof verification.","tokens_in":26474,"tokens_out":6685,"duration_ms":70421,"significance":"If the security claim held, this would be a significant contribution: a forkless, economically collateralized two-way peg with a permissionless relay, plus parametrized tokens to handle exchange-rate variability. The paper gives a detailed module-by-module specification that is useful for comparison with XCLAIM and with superblock relay designs, and it is unusually candid in Section 4.9 and Section 6 about the limits of the analysis and the uncompleted circuit implementation. However, the central 'trustless' claim is not established: the security argument assumes the availability and diligence of challengers, and the paper's own text concedes that an attacker gains when the bridge is actively in use but no one is watching. The protocol may be repairable by stating an explicit liveness assumption and by pairing the design with a formal game-theoretic proof, but as written the main claim overreaches.","major_comments":[{"comment":"The relay's acceptance path is not secure against an unchallenged bogus submission. Under §4.5, the Bridge Contract appends a submission to its history when no challenge arrives within d−k Dogecoin blocks, without any on-chain validation of the Merkle commitment at that time. §4.6 then mints WOW against any commitment in the history, verifying only that a Merkle proof is consistent with the stored, adversary-chosen root. An attacker can therefore submit a fabricated commitment with a plausible range, wait out the timeout, present a Merkle proof of a fake 'lock' transaction from an attacker-controlled address to an open bridge head, and obtain WOW backed by an Operator's real ETH collateral; burning those WOW in §4.7 transfers the collateral to the attacker. §4.9 explicitly concedes that the attacker gains when 'ETH collateral is staked.' The only defense is a timely challenge, but nothing in the protocol guarantees that a challenger exists: §2.4(C) states that individual Relayers 'need not monitor Dogecoin continuously,' and the rationality assumptions in §2 do not imply continuous monitoring. The abstract's 'trustless' claim therefore depends on an unstated liveness assumption, and the claim as written is unsupported.","section":"§4.4–4.6, §4.9"},{"comment":"The reserve equilibrium argument assumes the behaviors it is supposed to establish. Invariant 3's hypotheses are that rational Hodlers report missing DOGE, that Operators challenge Relayers who relay bogus locks, and that Crossers challenge bogus relay submissions. These are exactly the vigilance conditions the protocol's incentives are meant to guarantee. The surrounding argument (§2.4, §5.4) only asserts that incentives 'exist'; it does not prove that some rational agent is always online, informed, and willing to bear the cost of challenging within the verification window. Consequently, Invariant 3 does not provide a security proof of the DOGE–WOW bijection; it states a conditional whose antecedent includes the property to be shown.","section":"§5.1, Invariant 3"},{"comment":"The efficiency claim for the Dogecoin relay is not yet supported. The 12, 20, and 80 minute estimates for verifying 1, 10, and 100 Dogecoin proofs-of-work are extrapolations from benchmarks on secp256k1, and the text concedes 'Arithmetic circuits for general proofs have not yet been implemented.' Since the abstract advertises the construction as 'efficient,' the central performance claim for the Dogecoin-specific circuit remains unmeasured; the concrete SHA256 numbers do not validate the scrypt-based Dogecoin relay.","section":"§6"}],"minor_comments":[{"comment":"The suggested value for 'maximum extension length' reads '10,0000 Dogecoin blocks,' which appears to have an extra zero; presumably it should be 10,000.","section":"Fig. 4"},{"comment":"The sentence 'If no challenges occurs within d-k Dogecoin blocks' mixes singular and plural; it should read 'If no challenge occurs' or 'If no challenges occur.'","section":"§4.5"},{"comment":"There is a doubled article in 'the the Merkle proof' in condition 1(a); the duplicate 'the' should be removed.","section":"§4.6"},{"comment":"There is a duplicated 'the' in 'the the y-bridge queue's first element,' and the spelling 'Holder' appears alongside 'Hodler' throughout; the terminology should be unified.","section":"§4.7"},{"comment":"The phrase 'Thus we obtain the the following' contains a duplicated 'the'; it should read 'the following.'","section":"§5.1"},{"comment":"The claims about extending the construction to Bitcoin are speculative: Section 1.3 mentions 'a similar technique adds Ethereum-based smart contracts to Bitcoin,' but the paper only provides SHA256 benchmarks and does not describe a Bitcoin-side locking mechanism; the abstract's wording should be softened or the construction specified.","section":"§1.3 and §6"}],"recommendation":"major_revision","confidential_remarks":"The liveness gap is the central issue. The protocol may be publishable if the authors reposition the contribution as a trust-minimized bridge under an explicit honest-challenger liveness assumption and repair the security argument in Section 5.1 accordingly, rather than claiming unconditional trustlessness. The benchmark section also needs either actual measurements of the scrypt circuit or a clearly labeled preliminary-status claim. The authors should be asked to compare their trust assumptions with XCLAIM more explicitly, since the concurrent related work already implements a collateralized peg with different assumptions."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"The paper is a thorough, self-aware design for a two-way peg between Dogecoin and Ethereum that avoids a fork. What's new is the parametrized-token idea (a separate WOW token per exchange rate, removing the price oracle) and the relay construction using bulletproofs and Truebit to verify Dogecoin's scrypt proof-of-work. The collateralized peg itself is not new—the paper credits Habibian and XCLAIM—but this is arguably the most detailed public specification of the no-oracle variant. The writing is clear, the related work is honestly positioned, and the protocol design shows real care about attack surfaces like orphaned blocks and maximality gaps.\n\nThe main soft spot is the one the stress-test note identifies, and I checked it: §4.5 accepts a relay submission if no one challenges within d-k Dogecoin blocks. The Bridge Contract does not verify the Merkle commitment at acceptance time; verification only happens on challenge. An attacker can submit a fake commitment, wait out the window, then use §4.6's reporting mechanism to mint WOW backed by real ETH collateral and burn it to drain the operator's deposit. The only defense is a timely challenge, but the protocol has no mechanism to guarantee that any honest challenger exists. Invariant 3 (§5.1) simply assumes rational Hodlers, Operators, and Crossers will monitor and challenge; that is a liveness assumption, not a consequence of the incentives as written. The paper's own §4.9 concession—that an attacker gains nothing when no DOGE are locked and no ETH collateral is staked—implies the opposite when the bridge is in use. That tension weakens the abstract's 'trustless' claim.\n\nOther soft spots are minor in comparison: the security arguments are informal, the benchmarks in Section 6 are extrapolations rather than measurements, and the deep-backtracking backstop can leave the bridge permanently stuck. The paper does not hide these; it is unusually candid about them.\n\nThis is a real problem for the security claim as stated, but not a reason to dismiss the paper. The design is concrete enough to formalize, and the liveness assumption could be made explicit and tested. I'd send it to a serious venue; a good referee will want a clearer threat model and either a proof that the incentives guarantee a challenger or an honest statement that they don't. Researchers working on cross-chain bridges and cryptoeconomic protocols should read it, and I'd cite it for the parametrized-token and relay construction.","headline":"A detailed, honest design for a forkless Dogecoin-Ethereum peg whose 'trustless' claim depends on an unstated liveness assumption that someone will always challenge bogus relay submissions.","tokens_in":27034,"tokens_out":3927,"would_cite":true,"duration_ms":39512,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"This paper constructs a forkless two-way Dogecoin-Ethereum peg: Operator ETH collateral backs minted WOW tokens, and disputes over relayed Dogecoin locks are settled by bulletproofs verified through Truebit.","keywords":["Dogethereum","two-way peg","collateralized peg","cross-chain bridge","cryptoeconomic security","bulletproofs","Truebit","parametrized tokens"],"falsifier":"Run a testnet where every participant except one malicious Relayer is passive; the Relayer submits a fabricated lock with a valid-looking Merkle commitment and no one challenges. If the Bridge Contract mints WOW[$y$] after the verification timeout even though no DOGE is actually controlled by an Operator, the unanimous-consensus security claim is refuted in exactly the case the invariants depend on.","tokens_in":25936,"feed_emoji":"🌉","tokens_out":8476,"duration_ms":83457,"temperature":0.7,"pith_summary":"Dogecoin can be moved onto Ethereum without forking either chain: this paper specifies a two-way peg in which an Operator's ETH collateral, held in an Ethereum Bridge Contract, backs newly minted WOW tokens while the corresponding DOGE sits in the Operator's Dogecoin address. Burning WOW later obligates the Operator to release DOGE, and if the Operator defaults, the collateral is forfeited to the token holder. A relay conveys Dogecoin blocks into Ethereum under a unanimous-consensus rule that rejects orphaned chains, and disputes are resolved by succinct bulletproofs of scrypt proof-of-work verified through the Truebit protocol. Parametrized tokens WOW[$y$], indexed by exchange rate, keep the reserve balanced without a price oracle. If the construction is right, Dogecoin gains smart-contract access and the same recipe extends to Bitcoin.","feed_headline":"Collateral, not a fork, can move Dogecoin onto Ethereum","feed_subtitle":"Operators stake ETH to back WOW tokens; a verified relay reports Dogecoin locks, letting DOGE reach Ethereum smart contracts.","key_machinery":"The load-bearing object is the Bridge Contract, an Ethereum smart contract that escrows Operator ETH collateral, mints and burns parametrized WOW[$y$] tokens, and maintains the relay's history. The core mechanism is the collateralized peg: locked DOGE is not locked in the Dogecoin sense but is held by an Operator whose ETH deposit is forfeitable, so economic incentives substitute for a lock opcode. The relay's valid-extension requirements — Maximality, Validity, and Shallow-fork-free — are enforced through a challenge protocol; a challenged submission must be backed by a bulletproof, a succinct proof that a committed arithmetic circuit is satisfiable, showing that the committed block sequence is a valid, confirmed chain of scrypt proof-of-work, and Truebit verifies that proof on-chain.","core_discovery":"The central claim is that a 'lock' on Dogecoin does not have to be a consensus-level operation. In this design it is a cryptoeconomic fact: an Operator who has posted ETH collateral accepts DOGE into an address she controls, the Bridge Contract treats that transfer as a lock and mints WOW[$y$] to the sender, and if the Operator spends the DOGE before the corresponding WOW[$y$] is burned, she loses her ETH. The relay that carries Dogecoin events into Ethereum accepts only extensions that are maximal, valid, and shallow-fork-free, so orphaned block submissions cannot pollute the history. Disputed extensions are settled by a bulletproof that a committed sequence of scrypt proof-of-work is a confirmed valid extension of the history, with the proof itself checked by Truebit. Under the paper's rational-actor assumptions, two reserve invariants follow: WOW[$y$] in circulation equals $y$ times the ETH collateralized at rate $y$, and, per exchange-rate class, the number of locked DOGE equals the number of WOW[$y$] in circulation.","pith_inferences":["The passive-participant case is the real stress test: if few users monitor the relay, the unanimous-consensus design degrades toward first-submitter-wins, and a testnet with deliberately passive users would reveal the minimum active-Relayer population needed to keep the invariants.","The collateralized peg is a general pattern: pairing any Nakamoto-consensus chain with an expressive smart-contract chain reduces to building an arithmetic circuit for the source chain's hash, and the paper's Bitcoin extension already exhibits this.","Parameterized tokens could be reused outside bridges, for example to keep any smart-contract escrow solvent under exchange-rate volatility without an oracle; the paper uses them narrowly but the construction is not peg-specific.","The deep-backtracking modes imply a residual liveness gap: a sufficiently long bogus extension can stall the bridge permanently, which the authors accept only because it happens when no one is using the system; a deployment would want a stronger liveness mechanism."],"forward_implications":["A DOGE holder can receive WOW[$y$] tokens in Ethereum within minutes of a lock, and can burn them to reclaim DOGE, with no Dogecoin client update.","Ethereum smart contracts can read Dogecoin data through the same relay, giving Dogecoin a form of smart-contract functionality.","The same construction adapts to Bitcoin, letting Ethereum smart contracts hold tokenized bitcoin and access Bitcoin data.","Parametrized WOW tokens keep the peg solvent under exchange-rate moves down to the threshold $y$, without any price oracle.","The bridge remains live with any number of participants and is snoozable: it consumes gas only when used."],"supporting_citations":[{"why":"Supplies the Truebit on-chain verification oracle used to check bulletproofs, making scrypt proof-of-work verification tractable within Ethereum's gas limits.","marker":"[79]"},{"why":"Supplies the bulletproof argument system that proves a committed sequence of blocks is a valid scrypt proof-of-work chain, the core of dispute resolution.","marker":"[45]"},{"why":"The direct predecessor and baseline whose orphaned-block problem motivates the relay's Maximality, Validity, and Shallow-fork-free requirements.","marker":"[40]"},{"why":"Defines the longest-chain rule that determines the true Dogecoin blockchain the relay must mimic.","marker":"[66]"},{"why":"First documented the collateralized peg idea that this paper formalizes into modules and invariants.","marker":"[53]"},{"why":"Concurrent collateralized peg construction used as a comparison on handling exchange-rate risk.","marker":"[87]"}],"fun_headline_variants":["Collateral, not forks, bridges Dogecoin to Ethereum","Trustless Dogecoin bridge: stake ETH, lock DOGE","No fork needed to put Dogecoin on Ethereum","Economic locks put Dogecoin on Ethereum, no fork","Relay DOGE to ETH via collateral and bulletproofs"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing premise is that Hodlers, Operators, and Crossers will actively monitor Dogecoin and the Bridge Contract and challenge bogus relay submissions before the timeout; the paper also assumes away block-withholding and 51% attacks, so a passive user base can leave a malicious relayer free to mint unbacked WOW.","fun_headline_variants_meta":{"raw":{"variants":["Collateral, not forks, bridges Dogecoin to Ethereum","Trustless Dogecoin bridge: stake ETH, lock DOGE","No fork needed to put Dogecoin on Ethereum","Economic locks put Dogecoin on Ethereum, no fork","Relay DOGE to ETH via collateral and bulletproofs"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000239,"raw_usage":{"total_tokens":1522,"prompt_tokens":959,"completion_tokens":563,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":575,"completion_tokens_details":{"reasoning_tokens":479}},"tokens_in":575,"tokens_out":563,"duration_ms":5944,"temperature":1.0,"reasoning_tokens":479,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-14T13:54:52.275663+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run a testnet where every participant except one malicious Relayer is passive; the Relayer submits a fabricated lock with a valid-looking Merkle commitment and no one challenges. If the Bridge Contract mints WOW[$y$] after the verification timeout even though no DOGE is actually controlled by an Operator, the unanimous-consensus security claim is refuted in exactly the case the invariants depend on.","supporting_citations":[{"cited_title":"A scalable verification so- lution for blockchains","cited_arxiv_id":null,"evidence_quote":"Supplies the Truebit on-chain verification oracle used to check bulletproofs, making scrypt proof-of-work verification tractable within Ethereum's gas limits."},{"cited_title":"Bulletproofs: Short proofs for confidential transactions and more","cited_arxiv_id":null,"evidence_quote":"Supplies the bulletproof argument system that proves a committed sequence of blocks is a valid scrypt proof-of-work chain, the core of dispute resolution."},{"cited_title":"Using superblocks to bridge Dogecoin to Ethereum","cited_arxiv_id":null,"evidence_quote":"The direct predecessor and baseline whose orphaned-block problem motivates the relay's Maximality, Validity, and Shallow-fork-free requirements."},{"cited_title":"Bitcoin: A peer-to-peer electronic cash system","cited_arxiv_id":null,"evidence_quote":"Defines the longest-chain rule that determines the true Dogecoin blockchain the relay must mimic."},{"cited_title":"The Doge-Ethereum bridge: a cryptoeconomic two-way peg","cited_arxiv_id":null,"evidence_quote":"First documented the collateralized peg idea that this paper formalizes into modules and invariants."},{"cited_title":"Knottenbelt","cited_arxiv_id":null,"evidence_quote":"Concurrent collateralized peg construction used as a comparison on handling exchange-rate risk."}],"review_version":1}