{"id":"0cf43e2b-3826-498d-95ea-309db6494ab1","arxiv_id":"1908.07567","paper_version":1,"verdict":"REJECT","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"high","formal_verification":"none","parameter_count":0,"one_line_summary":"Eunomia orders blocks across parallel blockchains using a virtual logical clock and fine-grained UTXO sharding, claiming security against up to half adversarial computing power and near-optimal throughput.","lead":"This report proposes Eunomia, a blockchain that runs many parallel chains and orders their blocks with a logical clock, similar to event ordering in distributed systems. It claims higher throughput and easier light-client verification than earlier parallel chain designs, but the security proof has significant gaps.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The security proof's independence assumption is undermined by the synchronized-block validity rule; Sec. VII-A acknowledges the dependency but does not prove it away.","rationale":"The reader's weakest assumption exactly matches the load-bearing gap I identify: Lemma 1 assumes each of the m chains is independent, but the protocol's synchronized-block reference in every block header couples block validity across chains. I confirmed this by tracing Algorithm 1: line 10 rejects any block whose parent clock exceeds the synchronized block's clock, so a delay or omission of the referenced synchronized block can invalidate otherwise valid honest blocks. This directly undermines the per-chain block-generation probability p that Lemma 1 needs. The paper's Sec. VII-A is unusually candid about the dependency, but the resolution offered—'nodes will relay the synchronized block'—is an implementation heuristic, not a security proof. Since the consistency and liveness theorems (Theorem 2) are derived by first applying Lemma 1 to each chain, this gap is load-bearing. I also noted that Lemma 4's proof contains an apparent self-citation ('By Lemma 4') where Lemma 3 is intended, which further weakens confidence in the sketched lemmas. My recommendation is unchanged from the reader's REJECT: the protocol idea is interesting and clearly described, but the central security claim is not proven by the submitted text. A targeted simulation or a corrected formal analysis of Lemma 1 would be the natural next step.","tokens_in":16378,"tokens_out":3411,"duration_ms":540437,"concrete_test":"Build a round-based simulation of the exact two-chain case (m=2) with m-for-1 PoW, Algorithm 1, and an adversary that delays synchronized blocks from one chain to the other by up to Δ rounds while delivering all other messages on time. Run for at least 10^6 rounds and measure the number of successfully appended valid blocks per chain per round, comparing to the predicted rate p. If the valid-block rate of the delayed chain falls materially below p, Lemma 1's independence premise fails and Theorem 2 is not established; if the rate remains p, the independence claim still needs a rigorous proof rather than the assertion in Sec. VII-A.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim—consistency, liveness, and near-optimal throughput under <1/2 adversarial power—rests on Lemma 1 (Sec. VI-A), which lifts Theorem 1 from [5] to each parallel chain by asserting that chain C_i runs 'in the same way' as a single Nakamoto chain. That assertion is not justified once Algorithm 1 is included. In Algorithm 1, lines 6–14, a newly mined block is valid only if its parent clock v_i does not exceed the clock v_j of the referenced synchronized block; otherwise the block is rejected (v = -1). Since the synchronized block is normally the largest-clock block among all m chains, the validity of a block on chain C_i depends on the timely availability and relative clock value of blocks on other chains. An adversary controlling message delivery can delay synchronized blocks from a fast chain, so honest miners on a slower chain cannot include a synchronized block with clock >= v_i, and their otherwise valid PoW solutions become invalid. Their effective block-generation rate then drops below p, breaking the premise of Lemma 1 and invalidating the subsequent lift of the NC consistency/growth/quality properties. The paper itself concedes this in Sec. VII-A: 'each chain's block generation cannot be viewed as independent with each other anymore, which deviates from the design goal and makes the analysis complicated.' The following sentence merely asserts that relaying synchronized blocks 'remains independent'—no proof or formal argument is supplied. Lemmas 3 and 4 are also only sketched, and the proof of Lemma 4 even appears to cite Lemma 4 where Lemma 3 is meant. The headline result is therefore unsupported as written.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes Eunomia, a permissionless parallel-chain protocol based on m independent Nakamoto Consensus chains, m-for-1 PoW, a virtual logical clock for global block ordering, and fine-grained UTXO sharding. The central claims are that Eunomia satisfies consistency and liveness under less than 1/2 adversarial computation power and approaches the network bandwidth limit, while also being SPV-friendly. The security argument in Sec. VI proceeds by first lifting known Nakamoto Consensus properties to each chain (Lemma 1) and then combining per-chain properties to prove global consistency, growth, and quality (Lemmas 2–4). The paper also presents an informal incentive argument in Sec. V-D intended to deter denial-of-ordering attacks.","tokens_in":16599,"tokens_out":3183,"duration_ms":33039,"significance":"If the main theorem were established, the result would be significant: it would show that a parallel-chain protocol can achieve near-optimal throughput without a dedicated synchronization chain or additional ordering blocks, while preserving the simple security analysis of Nakamoto Consensus and providing SPV support. The paper also makes a useful design point by connecting logical clocks in distributed systems to block ordering. However, the central proof depends on an independence assumption that the paper itself acknowledges is violated, and the supporting lemmas are only sketched. The contribution is therefore not currently substantiated by the provided analysis.","major_comments":[{"comment":"The proof of Lemma 1 asserts that each chain Ci of Eunomia runs 'in the same way' as a single Nakamoto chain and therefore inherits the properties of Theorem 1. This is not justified under Algorithm 1. In lines 6–14 of Algorithm 1, a newly mined block is valid only if its parent clock vi does not exceed the clock vj of the referenced synchronized block; otherwise its clock is set to -1 and the block is rejected. Because the synchronized block is normally the largest-clock block among all chains, the validity of a block on chain Ci depends on the timely availability and relative clock value of blocks on other chains. An adversary controlling message delivery can delay synchronized blocks from fast chains, causing otherwise valid honest PoW solutions to be rejected and lowering the honest block-generation rate below p. The paper itself concedes this in Sec. VII-A: 'each chain's block generation cannot be viewed as independent with each other anymore, which deviates from the design goal and makes the analysis complicated.' The following sentence asserts without proof that relaying synchronized blocks keeps the chains independent. Lemma 1 is therefore not established, and the subsequent lift of consistency, chain-growth, and chain-quality to Eunomia is unsupported.","section":"Sec. VI-A, Lemma 1"},{"comment":"The proof of Lemma 3 does not establish the claimed 4T/pn bound for global confirmation. It argues that by time t1 = t0 + 2T/pn each chain has at least T blocks attached, and that by the chain-quality property 'there must have one block of honest participants which synchronizes its belonging chain to the value x', where x is the largest virtual clock among the last per-chain confirmed blocks at time t0. This is a non sequitur: chain-quality only guarantees a fraction of honest blocks in a window; it does not guarantee that any of them references the particular synchronized block with clock x. Moreover, the proof uses the undefined term 'partially confirmed' when moving from t1 to t2, and it only addresses the single clock x rather than all per-chain confirmed blocks at t0. A formal argument deriving the confirmation delay from the stated growth and quality properties is missing and is load-bearing for liveness.","section":"Sec. VI-B, Lemma 3"},{"comment":"The proof of Lemma 4 is only a sketch and does not derive the L-growth and L-quality statements. It states that each chain has at least γT blocks becoming newly 'partially-confirmed' from t0 to t1 = t0 + γ·2T/pn and then invokes 'Lemma 4' to conclude the proof; the correct reference should be Lemma 3, and even with that replacement the argument does not quantify how the global sequence grows by m·γ·T blocks per (γ+2)·2T/pn rounds. The notions 'partially-confirmed' and 'per-chain confirmed' are not formally defined in the proof, and the relationship between per-chain growth, the global ordering rule (Sec. V-C), and the global sequence length is not shown. Since Theorem 2's liveness claim rests on these lemmas, the main theorem is not proven.","section":"Sec. VI-B, Lemma 4"},{"comment":"The incentive-compatibility claim against denial-of-ordering attacks is informal. The text argues that a miner who chooses a non-maximal synchronized block will either produce invalid blocks or blocks that do not extend the longest chain, and therefore 'will suffer from economic loss.' No utility model, adversary strategy space, or equilibrium notion is defined, and no formal statement connects this argument to the protocol's security properties. As this is presented as a distinct contribution (denial-of-ordering resistance), it should be stated as a theorem with a proof or explicitly labeled as a heuristic discussion.","section":"Sec. V-D"}],"minor_comments":[{"comment":"In the paragraph after Theorem 2, the text says 'Theorem 1 shows that the globally confirmed block sequence L satisfies...' but it should refer to Theorem 2; Theorem 1 is the external Nakamoto Consensus corollary and does not mention L.","section":"Sec. VI-B, Theorem 2"},{"comment":"The input/output notation is inconsistent: the output is declared as a real number v ∈ R, but the algorithm returns integer clock values and -1. The genesis condition 'B ∈ (Gi)^n_i=0' uses n where m is intended, and the indexing should be over the m genesis blocks.","section":"Algorithm 1"},{"comment":"The notation for the synchronized bar is written as min^m_{i=0}{vi} and later as min^{m−1}_{i=0}; the bounds should be made consistent, and the global ordering rule needs a precise definition of how blocks with equal clocks are ordered beyond 'tie breaking of i'.","section":"Sec. V-C"},{"comment":"The SPV verification procedure for light clients is described only by example. The 'T-traced verification' is not specified as an algorithm, and no proof is given that a light client can detect invalid cross-chain UTXO references with only block headers and Merkle proofs.","section":"Sec. IV-D"},{"comment":"The sentence 'It is hard for the node to invoke Algorithm 1' is unclear; the subsequent discussion of storing synchronized-block headers and Merkle proofs should be stated as a precise storage and verification rule rather than an informal remark.","section":"Sec. VII-A"},{"comment":"The claim that a vector clock 'cannot exploit its advantage' in forked branches is not explained; a sentence justifying this would help the reader understand why logical clocks are chosen over vector clocks.","section":"Sec. II-C"}],"recommendation":"reject","confidential_remarks":"The paper is an early technical report whose main theorem rests on an independence assumption that the authors themselves flag in Sec. VII-A. The issue is not a minor gap: Algorithm 1's synchronized-block validity rule couples the chains, so the proof of Lemma 1, and hence Theorem 2, does not go through as written. Lemmas 3 and 4 are also sketches rather than proofs. The design idea may be salvageable with a different analytical framework, but the current manuscript would require a substantially new security analysis rather than local fixes, which places it beyond a minor or standard major revision for a journal. I would not object to a resubmission if the authors replace the per-chain independence argument with a rigorous analysis that accounts for the cross-chain dependency, or if they remove the synchronized-block dependency from the validity rule."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Here's the short version: Eunomia offers a real new combination—parallel chains, a Lamport-style virtual logical clock for global ordering, and fine-grained UTXO sharding that keeps SPV feasible—but the security proof as written does not establish the headline consistency and liveness claims. The design idea is clear enough to deserve serious referee attention, even though the proof needs real work.\n\nWhat is actually new: OHIE uses attachment blocks, Prism uses a dedicated synchronization chain, and Chainweb lacks formal analysis. Eunomia instead orders blocks by a virtual clock computed from a synchronized-block reference and then by chain index, with no extra ordering blocks. That is a genuine alternative to the cited parallel-chain protocols. The UTXO sharding with cross-chain UTXO post-confirmation is also a sensible attempt to solve double-spending and light-client verification in a multi-chain setting. The exposition is readable, the modular reliance on Nakamoto consensus is reasonable, and the paper is honest about where its analysis gets hard. The citation pattern looks fine: it leans on Garay et al. and Pass et al. rather than self-citations.\n\nThe soft spot is load-bearing. Lemma 1 asserts that each chain C_i runs like an independent Nakamoto chain, so Theorem 1 from Pass et al. lifts to each chain. But Algorithm 1 makes a block invalid unless its own chain clock does not exceed the clock of the referenced synchronized block, and that synchronized block normally lives on another chain. An adversary who delays synchronized blocks can make honest blocks fail the clock check, lowering the honest block generation rate below p. The paper's own Sec. VII-A admits the cross-chain dependency 'makes the analysis complicated' and then asserts without proof that relaying synchronized blocks keeps the chains independent. That is not a resolution. Lemmas 3 and 4 are also sketches, and Lemma 4's proof cites 'Lemma 4' where it means Lemma 3. The incentive-compatibility argument in Sec. V-D is informal but not the main source of the problem.\n\nSo the central theorem is unsupported as written. I do not see circularity or fabrication here—it is an under-supported proof, not a fake one. The idea may be repairable, perhaps by redefining the clock so validity does not depend on cross-chain delivery, or by analyzing the chains as dependent. But that repair is not in this report.\n\nFor an editor: this deserves peer review rather than desk rejection. The subfield should know about this approach, and a referee can push for the missing independence argument. For my own work, I would cite it as a proposal, not as a settled security result.","headline":"Eunomia is a genuine new combination—logical-clock ordering with UTXO sharding—but its main security proof hinges on an unproven independence assumption that the paper itself admits.","tokens_in":17200,"tokens_out":2352,"would_cite":true,"duration_ms":221488,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Eunomia claims that a virtual logical clock computed from the block graph can order blocks across parallel chains without a dedicated synchronization chain, and that UTXO sharding removes cross-chain double spends.","keywords":["parallel chains","logical clock","global block ordering","UTXO sharding","simple payment verification","proof of work","permissionless blockchain","scalability"],"falsifier":"Run the protocol with two chains and a small confirmation depth, and let the adversary delay every synchronized block until just after the next block referencing it is mined. If an honest miner's block can then be rejected because its parent clock exceeds the synchronized clock—or if one honest node's globally confirmed sequence is not a prefix of another's—the independence assumption fails. This can be checked in a discrete-event simulation before deployment.","tokens_in":16129,"feed_emoji":"⛓️","tokens_out":7935,"duration_ms":77739,"temperature":0.7,"pith_summary":"A blockchain made of many parallel proof-of-work chains can only scale if blocks from different chains are fused into one agreed order. Eunomia's proposal is to do that fusion with a virtual logical clock: every block is timestamped by a counter computed from the blocks it references, chains synchronize by pointing at the block with the largest clock, and the global sequence is just the per-chain confirmed blocks sorted by clock and chain index. The paper argues this preserves the causal order of blocks, needs no extra ordering blocks, and makes the ordering rule incentive-compatible, since a miner who references the wrong synchronized block risks mining an invalid block. A separate fine-grained UTXO sharding assigns each unspent output to a single chain, so conflicting transactions cannot appear in two chains and light clients can verify payments with a bounded backtrace. If the proofs hold, a permissionless proof-of-work system can approach the network's bandwidth limit while tolerating up to half adversarial computing power.","feed_headline":"Logical clock orders parallel chains without a sync bottleneck","feed_subtitle":"Eunomia claims network-limit throughput, half-adversary tolerance, and SPV-friendly checks in one permissionless design.","key_machinery":"The load-bearing object is the virtual logical clock computed by Algorithm 1 (logicalClockCompute): for each new block, the clock is the synchronized block's clock plus one, with an invalid value returned if the parent clock is larger. The synchronized block is the block with the largest clock among the m main chains, referenced in the new block's header, so the m chains exchange timing information in a fully distributed way and no chain acts as a unique clock. The second mechanism is fine-grained UTXO sharding: each UTXO carries a sharding index naming the only chain where it can be spent, which removes cross-chain double spending and limits the backtrace a light client needs to a T-block confirmation window.","core_discovery":"The central claim is that block ordering in a parallel chain is an event-ordering problem, and a virtual logical clock—a counter derived from the block graph rather than wall-clock time—solves it without a dedicated synchronization chain or extra ordering blocks. Each block receives a clock equal to the clock of a synchronized block, the last block with the largest clock among the m chains, plus one, provided the parent block's clock does not exceed the synchronized clock; otherwise the block is invalid. Blocks across chains are globally ordered by the pair (clock, chain index), and only per-chain confirmed blocks with clock below the synchronized bar enter the globally confirmed sequence. The paper also claims that tagging each UTXO with a sharding index restricts any output to be spent in one specific chain, so conflicting transactions cannot appear in separate chains, and light clients can verify payments by backtracing inputs within a T-block window. Together these mechanisms are claimed to yield consistency, liveness, and throughput approaching the network capacity while tolerating less than 1/2 adversarial computing power.","pith_inferences":["The paper does not push this further, but the same clock rule could be applied to DAG-based ledgers if a tie-break policy is added for blocks with multiple parents.","This suggests a concrete stress test: delay synchronized-block delivery in a simulation and measure whether any chain's growth rate drops; a drop would contradict the assumed independence of chains.","One observable design cost is that cross-chain UTXO spends wait through the T-block window, so an implementation should measure whether this erases the parallelism latency gain for cross-chain payments.","The incentive argument implies a rational attacker would mine on low-clock ancestor blocks to suppress global confirmation; quantifying the economic break-even point would make the 1/2 bound more precise."],"forward_implications":["Throughput scales roughly with the number m of parallel chains, because every chain mines and confirms blocks concurrently and ordering does not wait on a single chain.","No special synchronization chain or attachment block is needed; the ordering information rides inside ordinary block headers, so protocol overhead stays low.","The ordering respects block causality: a block cannot be ordered before blocks it references, avoiding the inverted-order attack vector of pre-defined sequences.","A rational miner has an economic incentive to reference the true largest-clock synchronized block, since deviating can produce a rejected block.","Light clients need only headers plus a T-block backtrace to detect invalidated cross-chain UTXOs, making SPV feasible in the parallel setting."],"supporting_citations":[{"why":"Supplies the logical-clock ordering idea that the paper adapts to timestamp and order blocks across chains.","marker":"[15]"},{"why":"Provides the asynchronous proof-of-work consensus theorem that Eunomia lifts to each chain instance for consistency, growth, and quality.","marker":"[5]"},{"why":"Introduces the m-for-1 proof-of-work and backbone framework that lets multiple chains keep the security of a single proof-of-work chain.","marker":"[4]"},{"why":"Defines the parallel-chains composition approach that Eunomia extends and contrasts with synchronization-chain ordering.","marker":"[12]"},{"why":"Presents the pre-defined-ordering baseline whose attachment-block overhead and causality distortion Eunomia aims to avoid.","marker":"[14]"},{"why":"Sets the Bitcoin UTXO model, longest-chain rule, and SPV procedures that Eunomia's sharding and verification build on.","marker":"[1]"}],"fun_headline_variants":["No sync chain: logical clock orders parallel blocks","Eunomia: logical clock, no sync, SPV-friendly parallel chains","Permissionless parallel chains ordered by logical clock","Logical clock syncs parallel chains, beats DoR, SPV-friendly","Eunomia: virtual logical clock for permissionless parallel chains"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The argument assumes each of the m chains behaves exactly like one independent proof-of-work chain, even though a block's validity depends on a synchronized block from another chain; the report asserts this independence but leaves the cross-chain dependency unproved.","fun_headline_variants_meta":{"raw":{"variants":["No sync chain: logical clock orders parallel blocks","Eunomia: logical clock, no sync, SPV-friendly parallel chains","Permissionless parallel chains ordered by logical clock","Logical clock syncs parallel chains, beats DoR, SPV-friendly","Eunomia: virtual logical clock for permissionless parallel chains"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000625,"raw_usage":{"total_tokens":2951,"prompt_tokens":1059,"completion_tokens":1892,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":675,"completion_tokens_details":{"reasoning_tokens":1808}},"tokens_in":675,"tokens_out":1892,"duration_ms":13020,"temperature":1.0,"reasoning_tokens":1808,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-14T12:03:57.320851+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run the protocol with two chains and a small confirmation depth, and let the adversary delay every synchronized block until just after the next block referencing it is mined. If an honest miner's block can then be rejected because its parent clock exceeds the synchronized clock—or if one honest node's globally confirmed sequence is not a prefix of another's—the independence assumption fails. This can be checked in a discrete-event simulation before deployment.","supporting_citations":[{"cited_title":"Time, Clocks, and the Ordering of Events in a Distributed System,","cited_arxiv_id":null,"evidence_quote":"Supplies the logical-clock ordering idea that the paper adapts to timestamp and order blocks across chains."},{"cited_title":"Analysis of the Blockc hain Protocol in Asynchronous Networks,","cited_arxiv_id":null,"evidence_quote":"Provides the asynchronous proof-of-work consensus theorem that Eunomia lifts to each chain instance for consistency, growth, and quality."},{"cited_title":"The Bitcoin Back bone Protocol: Analysis and Applications,","cited_arxiv_id":null,"evidence_quote":"Introduces the m-for-1 proof-of-work and backbone framework that lets multiple chains keep the security of a single proof-of-work chain."},{"cited_title":"Parallel chains: Improving throughput and latency of blockchain protocols via paralle l composi- tion,","cited_arxiv_id":null,"evidence_quote":"Defines the parallel-chains composition approach that Eunomia extends and contrasts with synchronization-chain ordering."},{"cited_title":"Ohie: Blockcha in scaling made simple,","cited_arxiv_id":null,"evidence_quote":"Presents the pre-defined-ordering baseline whose attachment-block overhead and causality distortion Eunomia aims to avoid."},{"cited_title":"Bitcoin: A peer-to-peer electronic cash s ystem,","cited_arxiv_id":null,"evidence_quote":"Sets the Bitcoin UTXO model, longest-chain rule, and SPV procedures that Eunomia's sharding and verification build on."}],"review_version":1}