{"id":"385c2b00-f249-4db9-88a4-1f844010740e","arxiv_id":"2411.14245","paper_version":2,"verdict":"REJECT","confidence":"HIGH","novelty_score":4.0,"correctness_risk":"high","formal_verification":"none","parameter_count":7,"one_line_summary":"Pulsar proposes a tuneable density-based chain selection rule for proof of stake protocols, presented as an informal design document with no formal security proof.","lead":"Pulsar is a proof of stake consensus protocol designed to run as a sidechain to proof of work chains like Bitcoin. It introduces a tuneable density-based chain selection rule that the authors claim generalizes several existing longest-chain rules, and it is already implemented in the Mintlayer blockchain.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The composable chain-selection rule is not defined well enough to be a superset: at the stated α=0 limit, f(t)=0 gives no positive block trust, so the claimed recovery of Peercoin-style longest chain does not follow.","rationale":"Reading in good faith, the paper is a design white paper for Mintlayer and is candid about informality. The strongest claim is not the security lemmas in §6.1 (labelled future work) but the 'novel composable density-based chain selection rule' announced in the abstract and §3. For that claim to hold, the function f must actually interpolate between the named existing rules at the advertised extremes. The paper provides no algorithm that maps a slot string to a chain score, and the only explicit formula f(t)=1-e^{-αt} contradicts the α=0 behaviour it is claimed to reproduce. This is an internal inconsistency, not a disagreement with external consensus. The existence of the Mintlayer implementation is real supporting evidence, but code cannot be checked against an undefined rule; the proposed test would pin down the rule. The reader's verdict already identified the rule as under-specified and the superset claim as asserted rather than proven; this concrete boundary failure sharpens that concern. The additional issues in §6.1 (KES, MEV, slashing) are real but belong to future-work security analysis; the α=0 failure is more central because it attacks the novelty itself. Therefore I do not change the reader's REJECT verdict.","tokens_in":11846,"tokens_out":6748,"duration_ms":65157,"concrete_test":"Re-express the chain-selection rule as a precise scoring function S(chain; α) over a slot string {0,1}^n as used in §5.5. Then compute S for two small chains: C1 = blocks in slots {1,2} and C2 = block in slot {1} only, for α=0. If α=0 is meant to emulate longest chain, S(C1)>S(C2) must hold. As written, f(t)=0 gives S(C1)=S(C2) (or C2 wins if empty slots are penalized). Additionally, compare C1 with a longer but sparser chain at α→∞ against Ouroboros's density rule; if the scores do not match Ouroboros on all small examples, the superset claim fails. If the authors respond that f(t) is not the block score, the test should instead demand the actual aggregation formula used by the Mintlayer implementation (with a specific commit hash) and evaluate the same boundary.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The paper's central novelty (Section 5.5 and the abstract) is the claim that f(t)=α∫0^t e^{-αx}dx is a single tuneable chain-selection rule whose extremes recover existing PoS rules: 'With α=0, the chain selection rule will essentially prefer the chain with the most blocks acting as a traditional longest chain rule...' This is the load-bearing assertion, and it fails as written. For α=0 the formula gives f(t)=0 identically. Under the stated aggregation—'summing a chain trust value of valid blocks in slots'—every filled slot contributes zero trust, so no chain is preferred by block count; if empty slots subtract trust, fewer-slot chains win, the opposite of longest-chain. To get a longest-chain rule one would need a limiting/renormalized rule (e.g., f(t)/α → t as α→0), but no such normalization appears, and the text explicitly says α∈[0,∞) and treats α=0 as a valid setting. The α→∞ extreme is also only asserted: each filled block asymptotically contributes at most 1, but the exact aggregation over a slot string is never given, so 'acts as Ouroboros' cannot be checked. Because the 'superset' property is the paper's main contribution and is used to motivate the Mintlayer sidechain design, the central claim is unsupported at the boundary value that is explicitly advertised.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The manuscript presents Pulsar, a proof-of-stake consensus protocol intended as a sidechain to a proof-of-work chain. Its claimed contribution is a single composable density-based chain-selection rule, f(t)=α∫0^t e^{-αx}dx, said to interpolate between a longest-chain rule at α=0 and Ouroboros-style density selection as α→∞. The paper describes block structure, staking, epochs, pools, VRF-based slot leader selection, difficulty adjustment, finality depth, checkpointing, a simple game-theoretic equilibrium analysis, and a set of informal lemmas arguing that equivocation must be punished. It states that formal proofs are future work and that Pulsar is implemented in Mintlayer.","tokens_in":12077,"tokens_out":8206,"duration_ms":75017,"significance":"The manuscript is honest about its scope: Section 1 says formal discussions of performance and security are out of scope, and Section 5.5 says a formal proof is to follow. These limitations are important because the headline claims—a composable superset chain-selection rule and resistance to equivocation—are exactly the claims that need precision. If established, the work would be practically significant: a tuneable rule that connects longest-chain and density selection, plus a deployed sidechain implementation, would be useful. The paper also provides a useful survey of related PoS work. However, the current draft does not provide a definition precise enough to compute the rule, the α=0 boundary claim is contradicted by the formula, and the lemmas in Section 6.1 contain substantive errors. I therefore cannot regard the central claims as supported.","major_comments":[{"comment":"The central chain-selection rule is not specified to the point of being computable. The text says the rule 'works on the basis of summing a chain trust value of valid blocks in slots and removing a unit of trust for empty slots,' but it never defines how f(t)=α∫0^t e^{-αx}dx combines with Wb(t)=e^{-αt} to produce a score for a slot string. Consequently the alleged behavior at the extremes cannot be verified. In addition, the α=0 case is false as stated: f(t)=1-e^{-αt} is identically 0, so a filled block contributes no positive trust and the rule does not 'essentially prefer the chain with the most blocks'; no renormalized limiting rule is given. The α→∞ claim is also only asserted, since the exact aggregation is missing. Because the abstract and Section 3 advertise this rule as a 'superset' of existing rules, these omissions undermine the paper's main contribution.","section":"§5.5, chain-selection rule"},{"comment":"The Nash-equilibrium analysis is not a well-defined model. The utility expressions U_m^2 = φ_m^2·2r and U_m^h = φ_m·r are asserted without specifying the probability model for a malicious pool producing two valid blocks, how rewards on a competing fork are realized, or why a partial-synchrony assumption Δ=0 plus a constant block time justifies these forms. The subsequent derivation 'if φ_m < 1/2' and the condition 0 ≤ (φ_h−1)(2φ_h−1) therefore do not establish a Nash equilibrium in any stated strategy space. This section should either be made precise or explicitly labeled as illustrative only.","section":"§5.5, game-theoretic model"},{"comment":"Lemma 6.2 asserts that the maximum of k i.i.d. revenue draws grows as Θ(k). This is not generally true: for light-tailed or bounded distributions the maximum grows sublinearly (typically O(log k)), and for heavy-tailed distributions the growth rate is governed by the tail index, not by k. The claimed linear scaling of MEV revenue with the number of equivocated forks is therefore unsupported. Since this lemma feeds the motivation for the punishment mechanisms in Section 6.1, the security narrative is not established.","section":"§6.1, Lemma 6.2"},{"comment":"Lemma 6.3 assumes that a KES ratchets the signing key immediately after each signature, making a second signature in the same slot impossible. The cited Bellare–Miner scheme evolves keys per time period and permits multiple signatures within a period, so the assumption does not follow from the cited primitive. The manuscript itself states in §4.1.3 that KES is 'not essential' and that key ratcheting can happen after 'a defined period of time, be that a single use or a number of days,' which is inconsistent with the per-signature ratchet used in the lemma. The conclusion that equivocation is 'fully prevented' therefore does not follow.","section":"§6.1, Lemma 6.3"},{"comment":"Lemma 6.4 defines the slashing penalty as the leader's entire current stake plus all discounted future income, and then observes that any one-slot MEV gain is smaller than that quantity. Unprofitability is true by construction, so the lemma does not demonstrate that the protocol can enforce such a penalty, that slashing of this magnitude is implementable, or that a smaller penalty would suffice. The argument is circular with respect to the security property it claims to prove.","section":"§6.1, Lemma 6.4"}],"minor_comments":[{"comment":"The typeset title includes 'V ersion' with an extra space; please correct.","section":"Title"},{"comment":"The phrase 'he function Wb(t)' appears to be missing the initial 'T'; additionally, Wb(t) is defined only through its monotonicity and derivative, without stating its role relative to f(t).","section":"§5.5"},{"comment":"The pledge-incentive expression is not a well-formed equation as rendered ('σ + a·(...)/(a+1) → ...'); the intended formula should be restated cleanly with all variables defined on first use.","section":"§5.2.4"},{"comment":"The text alternates between calling the rule a 'longest chain rule' and a 'density' rule; this terminology should be unified, since the claimed novelty is a density-based rule.","section":"§5.3.1 and §5.5"},{"comment":"The notation r is used for the block reward and also, implicitly, for the reward in the game-theoretic utility expressions; distinct symbols would improve readability.","section":"§5.5 and §6.1"}],"recommendation":"reject","confidential_remarks":"Given the paper's own disclaimers, the draft is better described as a design overview than a formal consensus paper. The most serious issues are localizable: the chain-selection score is undefined, the α=0 limit contradicts the formula, and the security lemmas in Section 6.1 are mathematically incorrect. These are not mere presentation problems; they strike at the claimed contribution. I would not rule out a future submission after a substantial rewrite that defines the rule precisely and supplies sound proofs, but the current version is not publishable in its present form."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Colleague,\n\nThis is a design white paper for Mintlayer's PoS sidechain, and the authors are upfront that it's informal. The interesting idea is a single tunable density-based chain rule f(t) = alpha * integral_0^t e^{-alpha x} dx with parameter alpha, meant to interpolate between Peercoin-style longest-chain (alpha=0) and Ouroboros-style density (alpha -> infinity). If it worked, it would be a useful engineering contribution. The paper also gives a sensible overview of sidechain constraints—finality depth, checkpointing, dynamic availability, pool pledge incentives.\n\nBut the central claim fails on its own terms. For alpha=0, f(t) is identically 0, so every filled slot contributes zero trust; you cannot recover a longest-chain rule without an unstated normalization like f(t)/alpha -> t. The text explicitly allows alpha=0 as a valid setting, so this is not a minor edge case. The alpha -> infinity claim is also just asserted without specifying the exact aggregation over slot strings, so 'acts as Ouroboros' cannot be checked. Since the 'superset' property is the main contribution, this is load-bearing.\n\nThe security section (6.1) has errors that match the reader's report. Lemma 6.2 claims the maximum of k i.i.d. revenue draws grows as Theta(k); that's false for typical distributions—it's more like Theta(log k). Lemma 6.3 assumes a KES destroys the slot key after one signature, but standard KES (including the cited Bellare–Miner) evolves keys only at period boundaries and permits multiple signatures per period. Lemma 6.4 defines slashing as forfeiting all future income, so the conclusion that equivocation is unprofitable is built into the definition—and the protocol as described has no slashing anyway.\n\nWhat's genuinely good: the authors know the literature, discuss real tradeoffs, and there is an actual implementation (Mintlayer). That makes this a useful systems overview. But the mathematical core is not precise enough to analyze or reproduce, and the section 6.1 lemmas are not cosmetic errors.\n\nBottom line: this is a white paper for practitioners who want a design tour, not a research paper with verifiable results. I would not send it to peer review for a research track; a systems/experience track might be appropriate after heavy revision.\n\nRecommendation: desk reject for research; optionally redirect to a systems venue.","headline":"A candid design white paper whose central 'superset' chain-selection claim fails at its own alpha=0 boundary; not a research result as written.","tokens_in":12685,"tokens_out":3574,"would_cite":false,"duration_ms":31323,"reading_group":"no","serious_thinker":"no","would_accept_peer_review":false},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"A single tuneable rule can reproduce both longest-chain and density-based proof-of-stake selection.","keywords":["proof of stake","chain selection rule","density-based consensus","sidechain","verifiable random function","key-evolving signatures","finality","checkpointing"],"falsifier":"Attempt to produce a second valid signature with the same slot key before any key-evolution boundary in a standard key-evolving signature scheme, or on a Pulsar testnet have one pool broadcast two different blocks for the same slot; if both verify and are accepted by honest nodes, the protocol's no-equivocation premise fails.","tokens_in":11562,"feed_emoji":"⛓️","tokens_out":7657,"duration_ms":64903,"temperature":0.7,"pith_summary":"This paper proposes Pulsar, a proof-of-stake consensus protocol designed to run as a sidechain to a proof-of-work blockchain such as Bitcoin. Its central claim is that one composable, density-based chain-selection rule can replace the separate longest-chain and density rules used by earlier proof-of-stake protocols: with the tuning parameter $\\alpha = 0$ it behaves like a longest-chain rule, and as $\\alpha \\to \\infty$ it behaves like Ouroboros-style density selection. The rule is built from a per-slot trust function $f(t) = 1 - e^{-\\alpha t}$ that assigns a filled slot a bounded positive score and subtracts one unit for an empty slot, so the canonical chain is the one with the highest cumulative trust. If the claim is right, a proof-of-stake chain can pick its security-liveness tradeoff by tuning one parameter while remaining compatible with a Bitcoin-style mainchain, including reorganizing alongside it up to a fixed depth.","feed_headline":"One formula unifies two proof-of-stake chain rules","feed_subtitle":"Pulsar's tuneable density rule interpolates between longest-chain and Ouroboros-style selection for a Bitcoin sidechain.","key_machinery":"The central object is the composable chain-selection rule with trust function $f(t) = 1 - e^{-\\alpha t}$, equivalently per-slot weight $W_b(t) = e^{-\\alpha t}$; $\\alpha$ is a free parameter controlling how fast a block's trust contribution saturates. The rule scores a chain by summing the bounded positive trust of filled slots and subtracting one unit per empty slot, so a chain's score is never negative. It is 'composable' in the sense that one rule selects the canonical chain over the entire post-checkpoint history, reproducing the longest-chain rule at $\\alpha=0$ and Ouroboros-style density selection as $\\alpha\\to\\infty$. This function is what carries the argument that a single mechanism spans the standard design space of proof-of-stake chain selection.","core_discovery":"Pulsar's discovery is that a single rule, parameterized by $\\alpha \\in [0, \\infty)$, can express both Peercoin-style longest-chain selection and Ouroboros-style density selection. Slot leaders are chosen by a verifiable random function with probability proportional to stake; blocks carry a VRF proof, a signature, and a timestamp, and epochs rotate keys and randomness. The chain-selection rule scores a candidate chain by adding $f(t) = 1 - e^{-\\alpha t}$ for each filled slot and subtracting one unit of trust for each empty slot, with the exponential decay ensuring that no number of empty slots can outweigh a single filled slot's maximum score. The rule is applied only to the post-checkpoint history, and the protocol enforces a maximum reorganization depth of 1000 blocks, giving deterministic finality at that depth and probabilistic finality before it. The paper states the rule is a superset of existing longest-chain proof-of-stake rules and that a production implementation exists.","pith_inferences":["A testable consequence the paper leaves implicit is that observed reorg depth and fork rate should vary monotonically with $\\alpha$ in the deployed implementation; measuring that would directly test the claimed interpolation.","The no-equivocation guarantee rests on per-slot key destruction, but standard key-evolving signature schemes ratchet at period boundaries; if the implementation does not enforce single-signature keys, the protocol would need slashing or another equivocation penalty, which the paper itself identifies as future work.","The same rule could be applied to other networks by changing only the checkpoint and finality parameters, since the density scoring is independent of the mainchain's difficulty adjustment."],"forward_implications":["A deployment can choose its desired behavior by setting $\\alpha$: small values approximate a traditional longest-chain rule, large values approximate density-based selection, with intermediate values giving a continuous tradeoff.","The protocol can operate as a Bitcoin sidechain, with deterministic finality after 1000 blocks and probabilistic finality before that, so it can reorganize alongside the proof-of-work mainchain.","Because the trust function is bounded, long runs of empty slots cannot drive a chain's score negative, which the paper distinguishes from Ouroboros's $\\pm 1$ mapping.","Checkpointing past block hashes blocks long-range reorganizations, and a chain that ignores a checkpoint cannot win even if it is denser.","Under the stated key-evolving signature assumption, a slot leader cannot equivocate, so the protocol does not currently need slashing."],"supporting_citations":[{"why":"Supplies the Ouroboros density-based chain-selection rule that Pulsar generalizes and the formal proof-of-stake framework it builds on.","marker":"[Kia+17]"},{"why":"Supplies the Peercoin longest-chain-style rule and the no-punishment staking precedent Pulsar compares against.","marker":"[Pee12]"},{"why":"Supplies the key-evolving signature scheme whose per-period key evolution Pulsar relies on to prevent equivocation.","marker":"[BM99]"},{"why":"Supplies the verifiable random function used to select slot leaders without exposing them to denial-of-service attacks.","marker":"[MVR99]"},{"why":"Supplies the proof-of-stake sidechain and checkpointing model that Pulsar uses to organize alongside a PoW mainchain.","marker":"[GKZ19]"},{"why":"Defines the proof-of-work longest-chain model and Bitcoin mainchain that Pulsar is designed to complement.","marker":"[Nak08]"},{"why":"Supplies the formal-barriers result that motivates Pulsar's density-based rule rather than pure longest chain in proof of stake.","marker":"[Bro+19]"}],"fun_headline_variants":["Pulsar's single rule unifies longest-chain and density selection","One tuneable formula covers Peercoin and Ouroboros chain rules","A parameterized rule makes longest-chain a special case of density","Pulsar: one alpha-tuned formula for all proof-of-stake selection"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing premise is that a slot leader's signing key is destroyed immediately after signing, so a leader cannot produce two valid blocks for the same slot; if that single-use assumption fails, equivocation has no cost and the number of valid forks grows exponentially.","fun_headline_variants_meta":{"raw":{"variants":["Pulsar's single rule unifies longest-chain and density selection","One tuneable formula covers Peercoin and Ouroboros chain rules","A parameterized rule makes longest-chain a special case of density","Pulsar: one alpha-tuned formula for all proof-of-stake selection"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000562,"raw_usage":{"total_tokens":2620,"prompt_tokens":849,"completion_tokens":1771,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":465,"completion_tokens_details":{"reasoning_tokens":1693}},"tokens_in":465,"tokens_out":1771,"duration_ms":13565,"temperature":1.0,"reasoning_tokens":1693,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-12T15:23:11.931823+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Attempt to produce a second valid signature with the same slot key before any key-evolution boundary in a standard key-evolving signature scheme, or on a Pulsar testnet have one pool broadcast two different blocks for the same slot; if both verify and are accepted by honest nodes, the protocol's no-equivocation premise fails.","supporting_citations":[],"review_version":1}