{"id":"6173ddc8-2b5b-4faa-8eb9-9fc33f97d9f3","arxiv_id":"2411.19175","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":2,"one_line_summary":"Ethereum PoS is probabilistically live rather than guaranteed live: a timed equivocation attack can delay finality, and the inactivity leak can produce safety violations even with under one-third Byzantine stake.","lead":"This PhD thesis analyzes whether Ethereum's Proof-of-Stake consensus stays safe and live when some validators misbehave or act selfishly. It finds a finality-delaying attack that can recur with small probability and shows the inactivity leak can let two conflicting chains finalize or push Byzantine stake past the one-third threshold.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Equation (III.1) conflates per-epoch attack continuation with the probability of a Byzantine proposer in the first j slots, omitting the timing-split condition that is the actual crux of the bouncing attack.","rationale":"The reader's weakest_assumption pinpoints exactly the same load-bearing gap: the probabilistic bouncing attack probability formula ignores the need to maintain the required split of honest views every epoch and treats a Byzantine proposer in the first j slots as sufficient. My concern is the same, made more precise: Equation III.1 conflates proposer-selection probability with full attack-continuation probability. This is not a disagreement with existing consensus; it is an internal derivation gap. The theorem's proof only computes the probability of a necessary condition, not of the complete event. That said, the thesis makes several independent contributions: a detailed pseudo-code formalization of Ethereum PoS, a safety proof under the distributed-systems model, and an inactivity-leak analysis with concrete formulas and tables. The safety theorem and the inactivity-leak scenarios do not all depend on Equation III.1; even if the formula is weakened, the qualitative finding that Ethereum PoS is not deterministically live may still stand because the attack construction itself is a valid execution if the stated timing assumptions hold. The quantitative claims, however, do depend on the formula, and those quantities are used later in Section IV.5.3 to argue that Byzantine stake can exceed 1/3 during the synchronous period. Since the reader already returned a CONDITIONAL verdict, my read does not move the verdict; it sharpens the condition that should be imposed before acceptance: derive or simulate the per-epoch timing-split probability and either correct Equation III.1 or explicitly present it as an upper bound under a stated timing assumption.","tokens_in":51225,"tokens_out":6690,"duration_ms":69243,"concrete_test":"Analytically or by simulation, compute the true per-epoch continuation probability of the probabilistic bouncing attack. Fix n, beta, j=8, and a concrete post-GST delay distribution (e.g., i.i.d. Uniform[0, Delta] or log-normal delays). For each possible Byzantine proposer slot r in {0,...,j-1} and each release time t within that slot, compute the honest fraction s(t) that switches branches; the attack can continue only if s(t) satisfies the justifiability and non-finalization interval from Eq. IV.14. Average over proposer assignments to obtain p_cont, then compare p_cont^k with Equation III.1's (1 - alpha^j)^k. If p_cont differs materially from (1 - alpha^j), the theorem overstates the liveness attack probability and the follow-on inactivity-leak threshold analysis needs revision.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central liveness claim rests on Theorem III.2, which states that the probabilistic bouncing attack persists for k epochs with probability P = (1 - alpha^j)^k. In the proof, the only per-epoch random event considered is whether a Byzantine validator is selected as proposer in one of the first j slots. But the attack also requires that the Byzantine proposer's block be released so that a specific fraction of honest validators receives it before the justified-checkpoint view locks and the complementary fraction receives it after. This split is not guaranteed by proposer selection alone: it depends on the proposer's slot, the release time within that slot, the message-delay distribution after GST, and the interval of honest-switch fractions that makes the target checkpoint justifiable while preventing finalization on the old branch (cf. the conditions in Section IV.5.3, Eq. IV.14). The thesis explicitly assumes a favorable setup and the ability to time message delivery, but it never derives the probability of achieving the required split in each epoch, nor shows that every Byzantine proposer in the first j slots can realize it. Consequently, Equation III.1 is not the attack probability; at best it is an upper bound conditional on a strong, unmodeled timing capability. This is the weakest load-bearing step: if the per-epoch success probability is materially smaller than (1 - alpha^j), the headline claims that Ethereum PoS is only probabilistically live and that Byzantine stake can exceed 1/3 during the inactivity leak lose their quantitative support.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The thesis formalizes the Ethereum Proof-of-Stake protocol from the public specifications and analyzes its robustness under three models: a distributed-systems model without incentives, a distributed-systems model with the inactivity-leak penalties, and a game-theoretic model of rational proposers and attesters. The central claims are that Ethereum PoS satisfies safety but is only probabilistically live, that the inactivity leak can lead to safety violations (conflicting finalization or Byzantine stake exceeding the one-third threshold) even when the initial Byzantine proportion is below one-third, and that a game-theoretic analysis can identify profitable deviations from the prescribed protocol.","tokens_in":51458,"tokens_out":11551,"duration_ms":102512,"significance":"If the results hold, the thesis would be a valuable contribution because it connects the actual Ethereum specification to explicit protocol constants and derives quantitative predictions (e.g., the probability of a bouncing attack and the time to conflicting finalization) without fitting parameters. The pseudo-code extraction from the specifications and the explicit treatment of the inactivity-leak stake dynamics are strengths. However, the quantitative liveness claim rests on an unmodeled timing capability, and the safety proof is informal. These gaps make the current version unsuitable for publication without substantial revision.","major_comments":[{"comment":"The probability (1 - alpha^j)^k is derived solely from the event that a Byzantine validator is selected as proposer in one of the first j slots of each epoch. The attack description, however, also requires that the Byzantine proposer release its block so that a specific fraction of honest validators receives it before the justified-checkpoint update window closes and the complementary fraction receives it after the window (the 'last minute delivery' splitting condition). Proposer selection does not imply that this split is realizable in a given epoch, and no probability is assigned to the split condition. Therefore Eq. (III.1) is not the probability that the attack lasts k epochs; it is at best an upper bound conditional on a strong, unmodeled timing capability. Since this formula is the quantitative basis for the claim that Ethereum PoS is 'probabilistically live' and is reused in Section IV.5.3, this is a load-bearing gap.","section":"III.3.3A, Theorem III.2, Eq. (III.1)"},{"comment":"The proof of Lemma III.2 is not rigorous. The sentence 'no justification occurred on a different chain before its finalization' is asserted without proof, but this is essentially the statement to be established. The argument then uses the fact that honest validators vote for the chain with the highest justified checkpoint, yet the interaction between finalization, the highest-justified-checkpoint rule, and the last-four-checkpoints condition in Algorithm 9 is never formalized. Since Theorem III.1 follows directly from this lemma, the claimed safety proof is incomplete.","section":"III.3.1, Lemma III.2, Theorem III.1"},{"comment":"The notion of 'probabilistic liveness' is never formally defined. Property III.2 defines liveness as an infinite-time property: the finalized chain is ever growing. The described attack only shows that finalization can be delayed for k epochs with probability (1 - alpha^j)^k, which tends to zero as k grows. It does not establish a positive probability of an infinite liveness violation. The paper should either define a finite-horizon probabilistic liveness property and prove the claim with respect to it, or explain why a measure-zero set of executions suffices to negate the deterministic liveness guarantee. As written, the connection between Theorem III.2 and the conclusion that the protocol is 'only probabilistically live' is not established.","section":"III.3.2, Property III.2"},{"comment":"The calculation that Byzantine stake exceeds the one-third threshold in the synchronous period is conditional on the probabilistic bouncing attack persisting, and the continuation probability is the contested Eq. (III.1) from Chapter III. In addition, the log-normal approximation allows the inactivity score to become negative, and the ejection and capping boundaries are inserted only through Eq. (IV.20) after the fact. The authors state that this is conservative, but the direction of the approximation error is not proved. The conclusion that Byzantine validators can exceed the safety threshold during the synchronous period is therefore conditional rather than established.","section":"IV.5.3, Eqs. (IV.18)-(IV.24)"}],"minor_comments":[{"comment":"The procedure name 'jutificationFinalization' is a typo for 'justificationFinalization'.","section":"III.2.2, Algorithm 9"},{"comment":"The symbol s is used both for stake (e.g., s_i(t) in Chapter IV) and for the number of slots (e.g., in Section V.2), which creates ambiguity across chapters.","section":"IV and V"},{"comment":"The notation 'e−t2/225' is ambiguous: it could be read as e^{-t^2/2^25} or e^{-t^2/225}. The exponents should be written consistently and the base (2^26 versus the text '226') clarified.","section":"IV.5.1, Eq. (IV.5)"},{"comment":"The citation '[Edg3]' appears without a full reference entry; please complete the citation.","section":"IV.5.1"},{"comment":"The summation index 'nX j=n−ϕk' uses n for the number of slots, while n was previously used for the number of validators; a distinct symbol such as s should be used for the number of slots.","section":"V.2.1, Eq. (V.2)"},{"comment":"The introduction states that the attack assumes the adversary knows the network delay but does not control it, whereas the attack description says the Byzantine proposer releases its block 'just in time' to split the honest validators. The paper should clarify exactly which message-scheduling capabilities the adversary has.","section":"I.6.2 and III.3.3A"},{"comment":"The y-axis label 'Probability 0' appears to be a typo, and the x-axis label should state the unit (epochs).","section":"Figure III.10"}],"recommendation":"major_revision","confidential_remarks":"The manuscript is a PhD thesis and contains three analyses that correspond to separate publications [PAT23], [PAT24a], and [PAT24b]. The editor may wish to verify that the arXiv version accurately reflects the peer-reviewed versions of those papers. The main technical concern is the unmodeled timing assumption in the probabilistic bouncing attack; unless this is addressed, the quantitative liveness claim should not be relied upon."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Here's my take on Pavloff's thesis. It's a real piece of work: it formalizes Ethereum PoS from the spec into pseudo-code, proves safety cleanly, and then does something genuinely new. The probabilistic bouncing attack — showing the SAFE_SLOTS_TO_UPDATE_JUSTIFIED patch is insufficient and that a Byzantine proposer in the first j slots can keep the chain from finalizing — is the kind of result a distributed systems person should care about. The inactivity leak analysis is the strongest part: explicit stake-evolution equations, a concrete 4686-epoch bound for conflicting finalization with honest-only validators, and a demonstration that Byzantine stake can cross the 1/3 threshold both during a partition and, under the bouncing attack, even after GST. The derivations are self-contained and the parameters come from the protocol, not fitted to the conclusion.\n\nThe soft spot is exactly where the stress-test lands. Theorem III.2 gives P = (1 - α^j)^k for a k-epoch bouncing attack, but the proof only counts whether a Byzantine proposer appears in the first j slots. The attack also requires the proposer's block to be released so that roughly one-third of honest validators receive it before their justified-checkpoint view locks and the rest after. That timing split is the actual crux of a splitting attack, and the thesis never derives its probability. It states a 'favorable setup' and assumes Byzantine validators can time delivery, but those assumptions are not part of Equation III.1. So the formula is at best an upper bound conditional on a strong, unmodeled capability. The qualitative point — that liveness is probabilistic, not guaranteed — survives, but the quantitative claim should be rephrased or the timing probability modeled.\n\nThe continuous approximations in the inactivity-leak chapter (Gaussian, log-normal) are acknowledged and conservative in one direction, but the bounding step could use more rigor. The game-theoretic chapter got truncated in this arXiv version, so I couldn't assess it; the model looks plausible.\n\nWho is this for? Researchers working on Ethereum PoS security, and more broadly on finality gadgets and penalty mechanisms. It deserves a serious referee: a good referee would push for the timing-split probability or a conditional statement, and for more justification of the continuous approximations, but the core ideas are worth engaging with. I'd cite the inactivity-leak analysis in my own work.","headline":"A serious thesis on Ethereum PoS with a novel attack and the first real analysis of the inactivity leak, but the headline liveness probability is an upper bound that omits the actual crux of the attack.","tokens_in":51987,"tokens_out":2788,"would_cite":true,"duration_ms":25437,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Ethereum's proof-of-stake protocol is safe but only probabilistically live, this thesis argues.","keywords":["Blockchain","Ethereum","Proof-of-Stake","Liveness","Safety","Inactivity leak","Game theory","Byzantine fault tolerance"],"falsifier":"Run a partially synchronous simulation with a favorable initial fork, a fixed honest fraction $\\alpha$, and safe slots $j=8$: the paper's formula predicts finality is delayed for $k$ epochs with probability $(1 - \\alpha^j)^k$. If, over many independent runs, the observed delay frequency for each $k$ is zero or diverges from the formula, or if a liveness proof is found in this model, the probabilistic liveness claim is refuted.","tokens_in":50997,"feed_emoji":"⛓️","tokens_out":5522,"duration_ms":54862,"temperature":0.7,"pith_summary":"This thesis argues that Ethereum's proof-of-stake protocol is robust in a narrow distributed-systems sense—safety holds—but that its liveness guarantee is weaker than commonly claimed: it is probabilistic, not deterministic. The author formalizes the protocol from its specifications, proves safety, and then exhibits a 'probabilistic bouncing attack' that can postpone finality for k epochs with probability $(1 - \\alpha^j)^k$, where $\\alpha$ is the honest stake fraction and $j$ is the number of safe slots before views lock. The thesis then studies the inactivity leak, a mechanism intended to restore finality during long partitions, and shows that it can lead two conflicting chains to finalize and can push Byzantine stake above the one-third safety threshold even when the initial Byzantine fraction is below one-third. A final game-theoretic analysis models proposers and attesters as rational players and identifies conditions under which they can profit from deviating from the protocol's prescribed strategy.","feed_headline":"Ethereum PoS is only probabilistically live, thesis argues","feed_subtitle":"A bouncing attack can delay finality; the inactivity leak can push Byzantine stake past 1/3.","key_machinery":"The load-bearing machinery is the probabilistic bouncing attack built on the protocol's safe-slots constant $j = \\texttt{SAFE\\_SLOTS\\_TO\\_UPDATE\\_JUSTIFIED}$. A Byzantine proposer sends a block just before slot $j$ so that roughly one-third of honest validators update their justified-checkpoint view and the rest do not, making the canonical chain bounce; the attack continues while a Byzantine validator is proposer in one of the first $j$ slots, yielding the formula $P(\\text{bouncing } k \\text{ times}) = (1 - \\alpha^j)^k$. For the inactivity leak analysis, the central object is the stake-evolution equation $s'(t) = -I(t)s(t)/2^{26}$ together with the inactivity-score random walk, from which the thesis derives a log-normal stake distribution and computes when the Byzantine-to-total stake ratio crosses one-third. In the game-theoretic part, the key objects are the attester reward schedule and the proposer reward function, which together determine when deviating from the fork choice rule is profitable.","core_discovery":"The central claim is that Ethereum PoS does not provide a deterministic liveness guarantee in the partially synchronous model. The thesis proves safety: no two conflicting checkpoints can be finalized. It then exhibits a probabilistic bouncing attack: a Byzantine proposer releases a block on a competing chain just before the safe-slots window closes, splitting honest validators' views so that justification bounces between two chains and finality is delayed. The probability that this attack lasts k epochs is $(1 - \\alpha^j)^k$. The thesis also shows that when the inactivity leak is active, two conflicting chains can be finalized after a long partition, and Byzantine validators can, by being semi-active, raise their stake proportion above one-third on both branches even when their initial proportion is below one-third. Finally, the game-theoretic model defines payoffs for proposers and attesters and shows that the obedient strategy is not always the unique best response: a cunning proposer can sometimes increase its reward by choosing a parent block that diverges from the fork choice rule, provided its block later becomes canonical.","pith_inferences":["The formula $(1 - \\alpha^j)^k$ can be inverted: an application that requires finality with error at most $\\varepsilon$ should wait $k$ epochs satisfying $(1 - \\alpha^j)^k < \\varepsilon$, converting the paper's probabilistic liveness claim into a concrete waiting-time rule.","The paper leaves implicit that the one-third Byzantine threshold is not a fixed invariant once penalties are active; the same stake-shifting effect it identifies in the inactivity leak could be probed for other penalty designs.","A testable extension is to simulate the probabilistic bouncing attack under the paper's own network assumptions and measure whether the required split of honest views is actually achievable; the current analysis conditions on that split rather than deriving it.","The game-theoretic result suggests that proposer-boost parameters and reward fractions could be tuned so that deviating from the fork choice rule is never profitable, which would make the protocol more robust to rational validators."],"forward_implications":["If the probabilistic bouncing attack is real, Ethereum PoS cannot promise liveness in the usual deterministic sense; the best available guarantee is that the probability of non-liveness decays exponentially with the number of epochs.","The safe-slots patch reduces the attack window but does not eliminate the attack; reducing $j$ to zero would prevent bouncing but would also prevent honest validators from reconciling different views, a more severe liveness threat.","An inactivity leak lasting more than roughly 4686 epochs with honest validators only can finalize two conflicting chains, so safety is bounded by partition duration.","With an initial Byzantine proportion close to one-third, semi-active Byzantine validators can push their stake proportion above one-third on both branches of a fork even during the synchronous period.","Under the game-theoretic payoffs, a proposer who builds on an older block can collect more attestation rewards and transaction fees than the obedient proposer, so the protocol is not automatically incentive compatible."],"supporting_citations":[{"why":"Supplies the current Ethereum protocol specifications from which the thesis extracts the pseudo-code and the value of the safe-slots constant $j$.","marker":"[Fou24]"},{"why":"The Ethereum PoS design paper whose safety and liveness claims the thesis re-examines against the current implementation.","marker":"[BHK+20]"},{"why":"Introduces the bouncing attack that the probabilistic bouncing attack extends to the patched protocol.","marker":"[Nak19a]"},{"why":"Proposes the safe-slots fixation patch that the thesis shows is insufficient for liveness.","marker":"[Nak19b]"},{"why":"Identifies the two-layer design of the protocol, Nakamoto-style fork choice combined with a finality gadget, which creates the attack surface.","marker":"[NTT21]"},{"why":"Provides evidence that attackers can predict the timing of validator message receipt, supporting the 'just-in-time' delivery assumption of the attack.","marker":"[SNM+22]"},{"why":"Introduces the inactivity leak mechanism whose safety consequences are analyzed in Chapter IV.","marker":"[BG17]"},{"why":"Supplies the game-theoretic modeling approach for proposer and attester incentives that Chapter V adapts to Ethereum PoS.","marker":"[CKWN16]"}],"fun_headline_variants":["Ethereum PoS liveness only probabilistic, safety deterministic","Bouncing attack can delay Ethereum finality","Thesis: Rational Ethereum validators can profit from deviating","Inactivity leak can break Ethereum safety, says thesis","Ethereum PoS: liveness probabilistic, safety proven"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The probabilistic bouncing attack depends on a favorable setup where, at some epoch, a checkpoint on a competing chain is justifiable, and on Byzantine validators being able to time message delivery so that about one-third of honest validators update their view just before the safe-slot lock and the rest just after it.","fun_headline_variants_meta":{"raw":{"variants":["Ethereum PoS liveness only probabilistic, safety deterministic","Bouncing attack can delay Ethereum finality","Thesis: Rational Ethereum validators can profit from deviating","Inactivity leak can break Ethereum safety, says thesis","Ethereum PoS: liveness probabilistic, safety proven"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.001442,"raw_usage":{"total_tokens":5837,"prompt_tokens":1000,"completion_tokens":4837,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":616,"completion_tokens_details":{"reasoning_tokens":4757}},"tokens_in":616,"tokens_out":4837,"duration_ms":31545,"temperature":1.0,"reasoning_tokens":4757,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-12T10:26:30.912937+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run a partially synchronous simulation with a favorable initial fork, a fixed honest fraction $\\alpha$, and safe slots $j=8$: the paper's formula predicts finality is delayed for $k$ epochs with probability $(1 - \\alpha^j)^k$. If, over many independent runs, the observed delay frequency for each $k$ is zero or diverges from the formula, or if a liveness proof is found in this model, the probabilistic liveness claim is refuted.","supporting_citations":[],"review_version":1}