{"id":"2d7c10c8-5a30-46bd-b0cd-a065449024e8","arxiv_id":"1908.04295","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":3,"one_line_summary":"An interactive coin offering protocol lets buyers submit demand tables over total sale valuations and uses automatic smart-contract refunds so that all buyers with sufficiently high valuations can participate.","lead":"This paper designs an Ethereum smart contract for token crowdsales where each buyer submits a desired purchase amount for every possible total sale size. The protocol lets buyers enter and exit before a withdrawal lock, and automatically refunds low-priority bids so the final sale matches buyers' demands.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Permanent bids created by voluntary withdrawals are not subject to their personal caps, so Section 5.1's satisfaction proof (which totals only active addresses) fails for every buyer who withdrew before the lock.","rationale":"The abstract and Section 5.1 claim that final purchase amounts satisfy every buyer's valuation table. That claim is load-bearing because it is the precise sense in which 'everyone can successfully participate.' The proof in Section 5.1 explicitly handles only active addresses, yet the Final Stage pays both 'active' and 'permanent' addresses. A permanent address created by Step 2 has an unchanged cap but can no longer be removed by Step 3, so it can receive tokens at a valuation above its stated cap, contradicting the single-step table definition. This is not a heuristic or gas-estimate issue; it is an internal inconsistency in the protocol as written. The reader's weakest assumption about pointer moves and gas is real, but it is secondary: even with unbounded gas, the current Step 2/Step 3/5.1 combination fails for any buyer who used the advertised voluntary-withdrawal feature. The concern is also reachable in normal use, not only by a sophisticated adversary, so it should be patched and proved before the central claim is accepted.","tokens_in":11753,"tokens_out":11675,"duration_ms":133936,"concrete_test":"Simulate the Section 4 main loop exactly as written: before the lock, address X submits (v=100, c=50) and voluntarily withdraws; after t, submit additional bids so the final valuation exceeds 50. Check whether X receives any permanent balance at final payout, and whether Step 3 reverts when X's cap is the global minimum. If the implementation excludes permanent addresses from the minimum or enforces caps on permanent balances, quote that deviation as the necessary patch.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The voluntary-withdrawal step (Section 4, Step 2) turns a bid into 'permanent' and leaves it a balance b(A), but it neither cancels the address's personal cap nor creates a new valuation table. Step 3's automatic withdrawals only kick out 'active' addresses, even though Step 3.1 computes the minimum cap over 'active or permanent' addresses. Section 5.1's satisfaction argument then sums purchase amounts only over active addresses. Concretely, a buyer who bids v=100 with cap=50 and voluntarily withdraws before the lock receives permanent tokens even if the final valuation exceeds 50, although the single-step table A(V) in Section 5.1 says the purchase should be 0 when V>c(A). The permanent bid can also jam Step 3: if a permanent address holds the global minimum cap, no active address attains that minimum, so the loop's min set is empty or picks the wrong bucket. This is a direct counterexample to the claimed universal satisfaction, independent of gas limits.","agreement_with_reader":"disagree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper studies token crowdsales on Ethereum. It first states an impossibility: any fixed-valuation crowdsale that guarantees a fixed fraction of tokens for a given currency amount cannot guarantee universal participation. It then proposes an \"interactive coin offering\" in which each buyer submits a valuation table, i.e., a desired contribution amount as a step function of the total sale valuation. Before a withdrawal lock, buyers may voluntarily withdraw part of their bids, with a penalty and a permanently committed remainder; after the lock, the contract automatically withdraws active bids whose personal caps are exceeded, processing minimal-cap bids first and issuing partial refunds when the cap boundary is crossed. The paper claims that the final valuation and purchase amounts satisfy every buyer's valuation table, that the valuation is monotone increasing after the lock, that whale and blackout attacks are deterred, and that the required heap maintenance can be implemented on-chain via an incentivized sorted linked list of cap buckets. An epilogue describes a TrueBit implementation and later modifications.","tokens_in":11949,"tokens_out":13824,"duration_ms":158303,"significance":"If fully established, the protocol would be a notable market-clearing mechanism for token sales: it replaces fixed-price rationing with a valuation-table mechanism and offers an on-chain complexity workaround via incentivized pointer advice. The paper deserves credit for identifying a real problem and for a concrete, inventive protocol design, including the impossibility proposition of Section 1, the two-phase lock structure, and the bucket/pointer implementation sketch of Section 6. However, the headline guarantee is materially weakened by the fact that \"satisfaction\" at personal-cap values is defined as an interval condition rather than exact quantity matching, and, more importantly, by the exclusion of permanent bids from the satisfaction proof. The central theorem is therefore not established as written, and the paper would need a protocol-level revision to repair this. The security analysis of Section 5.3 is heuristic rather than a formal equilibrium argument. With a corrected treatment of permanent bids and explicit gas-limit assumptions, this could become a solid contribution.","major_comments":[{"comment":"The proof of universal satisfaction omits permanent addresses. Step 2 of Section 4 turns a voluntarily withdrawn active address into \"permanent\" and leaves a positive balance b(A), while Step 3's automatic-withdrawal loop and Section 5.1's single-step table A(V) operate only on active addresses. For a permanent address with c(A)=50 and a positive remaining bid, the table A(V) defined in Section 5.1 gives A(V)=0 whenever V>50, but the Final Stage pays b(A)>0 regardless of V. Concretely, with flat pricing, a bid of v(A)=100 at a=0 with c(A)=50, voluntarily withdrawn at s=t/2, leaves b(A)=50 tokens; if the remaining active bids push V to 120, the buyer receives 50 tokens even though her valuation table demanded 0 at V=120. The \"two cases\" paragraph in Section 5.1 sums only over active addresses, so this is not a minor gap but a counterexample to the paper's central claim. The protocol must either subject permanent bids to their personal caps in Step 3 or explicitly restrict the satisfaction claim to active bids, in which case it no longer covers all buyers.","section":"Section 4 (Steps 2 and 3) and Section 5.1"},{"comment":"The minimum in Step 3.1 is computed over \"active or permanent\" addresses, but the loop then selects B_1,...,B_k among active addresses with that minimum. If the global minimum cap belongs only to permanent addresses, no active address attains the minimum, so S is undefined and Steps 3.2 and 3.3 cannot be executed. Example: a permanent address has cap 50, an active address has cap 100, and V=120. The loop condition is satisfied because the active cap 100 is exceeded, but Step 3.1 returns min=50 with k=0. This is a protocol specification bug independent of gas limits; either the minimum should be taken over active addresses only, or the protocol must define how permanent minima are processed.","section":"Section 4, Step 3.1"},{"comment":"Section 6 explicitly admits that \"insufficient gas could result in an incorrect valuation pointer at the next time step.\" The correctness of the Section 5 invariants depends on Step 3 executing all required automatic withdrawals in the block in which new bids arrive, and the 300,000 pointer moves per block is an estimate, not a proof that a block's automatic-withdrawal work is bounded. Please state the gas assumption as an explicit hypothesis of the Section 5 claims, or add a mechanism that allows the while loop to be spread over multiple blocks without breaking the monotone-valuation invariant. As written, the abstract's unconditional claim that \"everyone can successfully participate\" is stronger than what the implementation section establishes.","section":"Section 6, gas-limit paragraph"}],"minor_comments":[{"comment":"The proof of the monotone valuation invariant contains a false sentence: \"the valuation at the end of Step 3 is no less than the personal cap of every active address.\" When Step 3.2 fully removes the minimal-cap bucket, remaining active caps can be strictly larger than the end-of-step valuation. The intended invariant (end-of-step valuation is at least the minimum personal cap among active addresses at the beginning of Step 3) is repairable, but the proof should be rewritten.","section":"Section 5.2"},{"comment":"The satisfaction definition (a)-(b) is an interval condition at cap points: at a valuation equal to a personal cap, any purchase amount between the left and right limits counts as satisfying. The abstract and introduction should be qualified accordingly, since \"satisfy every buyer's valuation table\" does not mean exact quantity matching at those discontinuity points.","section":"Section 5.1, satisfaction definition"},{"comment":"The paper does not specify how V is updated when an address becomes permanent in Step 2. The initialization formula defines V as a sum over active addresses only, yet permanent addresses still hold capital in the sale and receive tokens at the Final Stage. Please state explicitly whether and how permanent balances enter the valuation V, since this affects the interpretation of every invariant in Section 5.","section":"Section 4, Step 2 and Step 3"},{"comment":"The blackout-attack analysis is heuristic. In particular, the relation between the claimed \"withdrawal penalty ap/3\" and the formula for b(A) in Step 2.2 should be spelled out, and the recursive rationality argument should be presented as a heuristic rather than a formal equilibrium result.","section":"Section 5.3"}],"recommendation":"major_revision","confidential_remarks":"The permanent-bid issue is the main obstacle: it directly contradicts the central satisfaction theorem and also makes Step 3.1 ill-defined in some states. The paper's idea is promising and the issue appears fixable by amending the protocol (for example, by applying automatic withdrawals to permanent balances as well), so I do not recommend rejection. I would ask the authors to rework Section 4/5 accordingly and to state the gas and implementation assumptions explicitly before the next round."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Colleague,\n\nThe headline: this is a creative mechanism paper, but the central guarantee is not proven. The stress-test is correct: voluntary withdrawals create permanent bids that are not subject to personal caps, so a buyer who withdraws can end up with tokens even when the final valuation exceeds her cap. Section 5.1 proves satisfaction only over active addresses, so the counterexample is real. Worse, Step 3.1 computes the minimum cap over active or permanent addresses but selects active addresses; if the minimum is held by a permanent address, there is no active address to kick out and the loop breaks.\n\nWhat's new and good: the valuation-table approach is a real departure from capped sales, and the bucket/linked-list design with incentivized third-party advice is clever and likely reusable. The monotone valuation invariant for active addresses is plausible, and the paper is transparent about gas limits in Section 6.\n\nSoft spots: the blackout analysis is heuristic, not a formal equilibrium. The 'satisfies the valuation table' definition is permissive at cap points, which weakens the participation guarantee. But the permanent-bid issue is the load-bearing flaw.\n\nVerdict: the protocol as written does not deliver the paper's abstract promise. Still, the idea is good enough that a proper revision (e.g., subjecting permanent bids to caps, or excluding them from the min) could fix it. I'd send this to peer review, but the referee should require a corrected invariant and a formal proof. The paper is useful for people working on cryptoeconomic mechanism design; I'd bring it to reading group.","headline":"Clever mechanism, but the central 'everyone participates' claim has a concrete counterexample involving permanent bids; still worth a serious look.","tokens_in":12463,"tokens_out":4194,"would_cite":true,"duration_ms":45003,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"The paper claims that a token crowdsale can let everyone successfully participate if each buyer specifies a desired purchase quantity at every possible valuation, and it specifies a smart-contract protocol that enforces this.","keywords":["token crowdsale","valuation table","universal participation","smart contract","automatic withdrawals","monotone valuation invariant","personal cap","Ethereum"],"falsifier":"In a test deployment, create a block in which new bids push the valuation past many personal-cap buckets at once and make the required refunds exceed the block's gas limit; if the valuation pointer falls behind and a fresh bid can enter with a personal cap equal to the stale valuation, the monotone invariant and the universal-participation guarantee fail.","tokens_in":11547,"feed_emoji":"🪙","tokens_out":6691,"duration_ms":64431,"temperature":0.7,"pith_summary":"Token crowdsales that fix a price per token face a dilemma: a fixed valuation cannot simultaneously guarantee buyers a fixed fraction of the supply and guarantee that everyone gets in. This paper argues that the dilemma disappears once each buyer submits a valuation table—a desired purchase amount for each possible total sale valuation—instead of a single bid. The protocol it describes automatically refunds buyers whose personal valuation cap is exceeded, so the final sale valuation and everyone's purchases satisfy every submitted table. The contribution is a market-clearing mechanism for token sales: participation is universal by construction, and final quantities agree with contingent demand.","feed_headline":"Crowdsales can let everyone in if buyers submit demand curves","feed_subtitle":"An interactive token sale that refunds outbid buyers satisfies every buyer's valuation table instead of a fixed cap.","key_machinery":"The load-bearing object is the buyer's valuation table, a step function from total sale amount to contribution amount. The protocol operationalizes it through personal caps and a sorted linked list of cap buckets maintained by a valuation pointer. After the withdrawal lock, the smart contract runs a loop that finds the active bids with the smallest personal cap, refunds them in full or in part until the remaining active caps all exceed the current valuation, and thereby enforces the monotone valuation invariant. The linked-list bucket design keeps each operation verifiable in constant time, with outside parties paid to supply insertion advice, so the contract can run the loop within per-block gas limits.","core_discovery":"The central claim is that a token crowdsale can satisfy every buyer's valuation table, not merely the buyers who arrive first or bid highest. For each buyer, a valuation table maps the sale's total valuation to the amount that buyer wants to contribute; the final outcome counts as satisfying the table when the buyer's actual contribution equals the table value at the final valuation, or falls between the table's left and right limits at a discontinuity. The protocol achieves this by letting bids enter freely before a withdrawal lock, then—after the lock—repeatedly refunding the active bids with the smallest personal caps until every remaining cap exceeds the current valuation. The result is that the final valuation and purchase amounts satisfy every table, and the sale valuation only moves upward after the lock, which blocks whales from pushing the valuation down. Thus the protocol is a constructive bypass of the Proposition that fixed-valuation crowdsales cannot combine a guaranteed fraction with universal participation.","pith_inferences":["An immediate corollary the paper leaves implicit is that the protocol is a market-clearing mechanism: the final valuation is the price at which each buyer's contingent demand is exactly met, so the sale replaces price-setting with automated contingent refunds.","If the gas-limit and pointer-advice assumptions hold, the same design could be applied outside token sales to any allocation problem where participants submit contingent demand schedules and an on-chain contract can execute refunds, such as capped multi-unit auctions.","A testable extension would measure, under realistic bid distributions, how granular the personal-cap buckets must be to keep the valuation pointer moving within one block's gas limit; the paper's 300,000-moves estimate is a ceiling, not a guarantee.","The guarantees concern satisfying pre-stated valuation tables, not price discovery; whether social interaction actually drives buyers to reveal true valuations remains an empirical question the paper does not settle."],"forward_implications":["A buyer who submits a complete valuation table is guaranteed that the final sale outcome matches her table, up to the standard tie convention, so universal participation becomes possible even though no fixed-valuation sale can offer it.","The impossibility Proposition is bypassed by making the valuation endogenous: the contract refunds low-cap bids until the remaining active caps exceed the current valuation, so each buyer's final quantity agrees with her contingent demand.","After the withdrawal lock, the sale valuation is monotonically increasing, so a whale cannot push the valuation down below earlier bidders' caps.","The linked-list bucket implementation makes each contract operation verifiable in constant time, with third parties paid to supply insertion advice, so the loop can in principle run within per-block gas limits.","The voluntary-withdrawal penalty derived from the inflation ramp makes the blackout attack unprofitable for a rational adversary whenever the penalty fraction exceeds the relative bonus gap."],"supporting_citations":[{"why":"Supplies the impossibility result—no fixed-valuation crowdsale can guarantee both a fixed fraction and universal participation—that the interactive protocol is designed to bypass.","marker":"[1]"}],"fun_headline_variants":["Demand schedules unlock inclusive token sales","Every bidder satisfied by interactive crowdsale","Refund-based token sale satisfies all demand curves","Smart contract refunds open token sales to every demand curve"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The whole guarantee depends on each block being able to process every refund the contract needs to make in that block, and on outside helpers always telling the contract where the current valuation sits; if either fails, the contract may not enforce the invariant that protects buyers.","fun_headline_variants_meta":{"raw":{"variants":["Demand schedules unlock inclusive token sales","Every bidder satisfied by interactive crowdsale","Refund-based token sale satisfies all demand curves","Smart contract refunds open token sales to every demand curve"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000673,"raw_usage":{"total_tokens":2972,"prompt_tokens":760,"completion_tokens":2212,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":376,"completion_tokens_details":{"reasoning_tokens":2154}},"tokens_in":376,"tokens_out":2212,"duration_ms":19725,"temperature":1.0,"reasoning_tokens":2154,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-14T13:56:12.518579+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"In a test deployment, create a block in which new bids push the valuation past many personal-cap buckets at once and make the required refunds exceed the block's gas limit; if the valuation pointer falls behind and a fresh bid can enter with a personal cap equal to the stale valuation, the monotone invariant and the universal-participation guarantee fail.","supporting_citations":[{"cited_title":"On several occasions, single crow dsales have consumed the network’s entire bandwidth for consecutive ho urs","cited_arxiv_id":null,"evidence_quote":"Supplies the impossibility result—no fixed-valuation crowdsale can guarantee both a fixed fraction and universal participation—that the interactive protocol is designed to bypass."}],"review_version":1}