{"id":"f978192b-8dd0-4f56-b60e-2b164a6530c7","arxiv_id":"2502.04659","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":0,"one_line_summary":"CRATE is a trust-minimized protocol for atomic, serializable cross-rollup transactions on distinct L1 chains, with formal models, security proofs, and an implementation.","lead":"The paper proposes CRATE, a protocol that lets a single logical transaction run atomically across two different rollup chains, either fully executing or doing nothing. It is a step toward restoring the composability that layer-2 scaling removes, and it ships with an implementation and a cross-rollup flash loan application.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Appendix A, Algorithm 3 inserts DAG action hashes into trigTree instead of actTree, so the DAG contract as printed cannot satisfy the 2PC root checks and Theorem 2 is unsubstantiated.","rationale":"The reader's weakest assumption was the trustless-bridge dependency, but the bridge is stated in Remark 1 and the proof note, so it is at least an explicit assumption rather than an internal contradiction. The DAG GSC tree-insertion error is more load-bearing because the paper's central formal claim includes Theorem 2 for DAG CRTs, and the proof chain from Claim 2 through Lemma 4 to Theorem 2 contradicts the displayed Algorithm 3. Even if this is a typo, the formal specification as printed does not support the theorem. The fix is likely local (change trigTree.insert to actTree.insert in Algorithm 3, line 30), so a conditional verdict is appropriate rather than outright rejection. The secondary issues--the deferred induction in Theorem 1 and the abstract's dropped bridge-liveness phrase--reinforce that the paper needs a corrected formal write-up but do not change the conditional posture. My concern is therefore not the same as the reader's weakest assumption, hence disagreement with the reader's identification, while the overall verdict remains CONDITIONAL.","tokens_in":53785,"tokens_out":10371,"duration_ms":98924,"concrete_test":"Execute a minimal two-rollup DAG CRT (e.g., one source action on rol1 triggering two sub-actions on rol2) against the exact Algorithm 3 GSC and Algorithm 4 VSM. After the ACTION call returns, query both GSC trees: if actTree roots are the empty-tree root while trigTree contains the action hashes, the 2PC commit will revert on lines 29-30 of Algorithm 4. Also inspect the repository's DAG GSC implementation to see whether its ACTION function uses actTree.insert; if it does, the paper's Algorithm 3 should be corrected and Theorem 2 re-verified against the corrected pseudocode.","verdict_should_be":"CONDITIONAL","load_bearing_attack":"The most load-bearing gap is an internal inconsistency in the DAG-CRT specification on which Theorem 2 depends. In Appendix A, Algorithm 3, the ACTION function (lines 18-34) hashes each executed sub-action and calls trigTree.insert(msgHash) at line 30. In the chain-CRT GSC (Algorithm 1, line 33), the analogous hash is inserted into actTree, and the DAG proof in Appendix E relies on Claim 2, which explicitly requires a.desc subset of actTree and a.descnext subset of trigTree. Reading Algorithm 3 literally, TRIGGER (lines 10-17) also writes to trigTree, so actTree is never written. The VSM commit check (Algorithm 4, lines 29-31) requires trigRt' = oVSM.actRt' and actRt' = oVSM.trigRt'. If actTree is empty on both VSMs, these equations can hold only when trigTree is also empty, i.e., when no CRT is present. Thus the DAG protocol as printed cannot pass the 2PC atomicity check, and Theorem 2 cannot be derived from the stated contract. This is not a disagreement about trust assumptions; it is a concrete tree-insertion error in the formal specification. A secondary but related weakness is that Theorem 1's proof asserts an induction over multiple CRTs in a batch without supplying it, and the abstract omits the bridge-liveness assumption acknowledged in Remark 1.","agreement_with_reader":"disagree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes CRATE, a protocol for executing cross-rollup transactions (CRTs) atomically across two rollups on distinct L1 chains. It defines two formal CRT models (chain-CRT and DAG-CRT), gives a security definition of atomicity, and proves two theorems: Theorem 1 for chain-CRTs and Theorem 2 for DAG-CRTs. The protocol uses a modified General System Contract (GSC) with sessions and nonces, plus a Two-Phase Commit (2PC) protocol between Validator Smart Contracts (VSMs) to achieve all-or-nothing, order-preserving execution in four L1 rounds. The paper also reports an implementation and gas-cost evaluation compared with Zksync Era, and a cross-rollup flash loan application.","tokens_in":54049,"tokens_out":5615,"duration_ms":43663,"significance":"If the identified gaps are repaired, CRATE would be a valuable contribution. It gives the first formal treatment of cross-rollup composability in the trigger–action framework, identifies a real serializability attack on the prior SVS proposal, and provides a concrete 2PC-based design with a plausible constant-round finality argument. The open-source implementation and gas benchmarks are useful evidence of practicality, and the explicit trust assumptions (L1 safety/liveness and bridge liveness) are mostly stated clearly, though the abstract understates them.","major_comments":[{"comment":"In Algorithm 3, line 30, the ACTION function executes each triggered sub-action and then calls trigTree.insert(msgHash). In the chain-CRT GSC (Algorithm 1, line 33) the analogous hash is inserted into actTree, and Claim 2 explicitly requires a.desc ⊆* actTree and a.descnext ⊆* trigTree. As printed, Algorithm 3 never writes actTree, so the VSM commit check (Algorithm 4, lines 29–30, requiring trigRt' = oVSM.actRt' and actRt' = oVSM.trigRt') can succeed only when trigTree is also empty, i.e., when no CRT is present. Theorem 2 therefore cannot be derived from the DAG-CRT contract as specified.","section":"Appendix A, Algorithm 3"},{"comment":"The proof claims 'using an inductive argument across all CRTs present in batch1 and batch2, at least one of (I,II,III) is not preserved.' Lemma 1 and Lemma 3, however, are stated for a single CRT instance. The induction is not supplied, and it is not immediate that the tree-equality and nonce-sum predicates compose over multiple CRTs in a batch. Because the theorem claims atomicity for arbitrary batches, this missing induction is load-bearing.","section":"Section 7.1, Theorem 1 proof"},{"comment":"Algorithm 4's VERCOMEVD verifies trigRt' = oVSM.actRt', actRt' = oVSM.trigRt', and entryNonce' + oVSM.entryNonce' = sessionNonce' (lines 29–31). It does not verify that oVSM.sessionNonce' equals this same value, even though Lemma 3's condition (II) requires sessionNonce1 = sessionNonce2 = entryNonce1 + entryNonce2. The proof of Theorem 1 states that the VSM 'must see that all three properties (I,II,III) are preserved,' but the pseudocode as printed checks only one of the two session nonces.","section":"Section 6 and Algorithm 4"},{"comment":"The abstract states that CRATE 'only relies on the underlying L1s and the liveness of L2s,' but Remark 1 requires a trustless bridge between the L1s and assumes that a VSM only accepts bridge-relayed final state; the contributions bullet correctly lists 'liveness of a bridge.' The abstract should be corrected to include the bridge liveness assumption, since the formal theorems inherit this dependency.","section":"Abstract and Remark 1"}],"minor_comments":[{"comment":"The sentence preceding Claim 1 says a.desc and a.descnext are inserted into the trigger and action trees, respectively; the correct order is action and trigger trees, as Claim 1 states.","section":"Section 7.1, before Claim 1"},{"comment":"The trigger calls in the flash-loan Solidity code pass a hard-coded value 10_000 as an argument, but its meaning (e.g., a gas limit) is not explained in the text.","section":"Appendix F"},{"comment":"The phrase 'immediate next accepted after running CRAT protocol' is ambiguous for local state digests; consider clarifying that the definition refers to the first accepted digest pair after the CRT's submission.","section":"Section 4.1, Definition 1"}],"recommendation":"major_revision","confidential_remarks":"The DAG-CRT insertion bug (Algorithm 3 line 30) is concrete and fixable, but as printed it invalidates Theorem 2. The missing induction in Theorem 1 and the partial session-nonce check in Algorithm 4 also require substantive proof repair. The implementation work appears independent of these formal issues, so a revision that fixes the pseudocode, supplies the missing induction, and reconciles the trust assumptions in the abstract would make the paper publishable."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Here's the short version: the chain-CRT part of this paper is worth reading, and the DAG-CRT part is broken as printed. The authors find a concrete reordering attack on SVS for CRTs longer than two, and they fix it with session nonces and an active flag. That fix is plausible, and the formal chain-CRT model is a real contribution. The 2PC adaptation to distinct L1s is classical but applied carefully, and the implementation gives concrete gas numbers (0.64–1.5x MPT, 0.32–0.75x SNARK versus Zksync). Credit where it's due: the attack is real, the definitions are careful, and the deferred proofs in Appendix D are substantive.\n\nThe problem is Theorem 2. In Appendix A, Algorithm 3, the ACTION function inserts each executed sub-action hash into trigTree, not actTree. The VSM commit check, Algorithm 4, requires trigRt' = oVSM.actRt' and actRt' = oVSM.trigRt'. If both GSCs write only to trigTree, then actTree stays empty on both sides, and the equations hold only when trigTree is also empty — meaning no CRT is present. So the DAG protocol as printed cannot pass the 2PC check, and Theorem 2 has no supportable base. This is not a trust-assumption quibble; it's a tree-insertion error in the specification.\n\nThere are smaller issues. Theorem 1's proof asserts an induction over multiple CRTs in a batch without showing it; the lemmas are stated per CRT. The abstract claims trust in 'underlying L1s and liveness of L2s' but drops the bridge-liveness assumption that Remark 1 admits. Algorithm 4's VERCOMEVD checks only one of the two nonce-equalities from the text (entryNonce' + oVSM.entryNonce' = sessionNonce' but not equality with oVSM.sessionNonce'). The gas evaluation reports averages without variance, though the Zksync comparison range is given.\n\nBottom line: the chain-CRT story is plausible and worth refereeing. The DAG extension needs a corrected contract and a real proof before Theorem 2 can be taken seriously. The paper deserves a serious referee, but with the expectation of major revision.","headline":"CRATE has a real attack and a plausible chain-CRT fix, but the DAG-CRT contract as printed cannot pass its own 2PC check, leaving Theorem 2 unsupported.","tokens_in":54631,"tokens_out":2388,"would_cite":true,"duration_ms":20703,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"CRATE makes cross-rollup transactions atomic and order-preserving across two rollups on different L1 chains, with finality in four L1 rounds.","keywords":["cross-rollup composability","atomicity","serializability","two-phase commit","rollup","validity proofs","cross-chain interoperability","General System Contract"],"falsifier":"Set up two rollups and a malicious executor, submit a chain CRT of length 3, and have the executor run the actions in reverse order; if the VSM commit checks pass (equal GSC Merkle roots and equal nonce sums) for the reversed batch, Theorem 1 is wrong. Conversely, running an honest batch and checking that the four L1 transactions always settle in the claimed four rounds would confirm the latency claim.","tokens_in":53531,"feed_emoji":"🔗","tokens_out":4198,"duration_ms":40094,"temperature":0.7,"pith_summary":"The paper proposes CRATE, a protocol that lets a user execute a sequence of transactions spanning two rollups on different layer-1 chains as one atomic, order-preserving operation. Existing rollup-to-rollup schemes either break serializability for transactions longer than two steps or rely on a trusted shared sequencer. CRATE claims to restore both all-or-nothing execution and ordering using only the security of the underlying L1s, liveness of the L2s, and a trustless bridge between the L1s. The paper also formalizes two programming models for cross-rollup transactions and proves atomicity in both.","feed_headline":"Cross-rollup transactions go atomic in 4 L1 rounds","feed_subtitle":"A session-nonce two-phase commit gives all-or-nothing, order-preserving execution across rollups on different chains.","key_machinery":"The load-bearing machinery is a modified General System Contract (GSC) on each rollup that records triggered actions in a Merkle trigger tree and executed actions in a Merkle action tree, while maintaining a session nonce, an entry nonce, and an active flag to tie each triggered action to its session. The L1-side Validator Smart Contracts (VSMs) run a leader-follower two-phase commit: one VSM pre-commits, the other pre-commits after seeing proof, the leader commits after seeing matching GSC roots and nonce equality, and the follower commits after seeing the leader's decision. Cross-L1 evidence is verified against finalized headers relayed by a trustless bridge.","core_discovery":"CRATE's central claim is that atomicity for cross-rollup transactions can be reduced to two checks that L1 validator contracts can enforce: matching Merkle roots of trigger/action trees between the two rollups' general system contracts, and a session-nonce accounting rule that forces actions to execute in the intended order. A two-phase commit between the two validator contracts makes the state-digest update all-or-nothing even though the rollups live on distinct L1s. The paper proves Theorem 1 for chain CRTs and Theorem 2 for the more expressive DAG CRTs, both for two rollups.","pith_inferences":["The same leader-follower two-phase commit structure could in principle be extended to more than two rollups, but the paper only proves the two-rollup case; that extension is my inference, not a paper claim.","A testable prediction following from the proof structure is that any violation of atomicity must appear either as a GSC root mismatch or a nonce-sum violation; monitoring those two values in a live deployment would catch an attack.","If bridge relay latency or non-final header risk materializes, the four-round estimate is optimistic; the protocol's actual security depends on bridge finality, an assumption the paper explicitly flags."],"forward_implications":["Cross-rollup flash loans and arbitrage become possible without trusting a shared sequencer or bridge operator.","Rollups on separate L1s can interoperate with constant, four-round L1 latency independent of CRT length.","The session-nonce design blocks the reordering attack that breaks the prior trigger-action scheme for CRTs longer than two actions.","The DAG model lets one action fan out to multiple triggered sub-actions, matching applications like flash loans where several contracts must act on the other rollup.","With SNARK-based membership proofs, the added L1 gas is about 32 to 75 percent of a vanilla zk-rollup's observed batch submission cost."],"supporting_citations":[{"why":"Source of the trigger-action paradigm and Merkle-tree consistency check that CRATE extends and fixes.","marker":"[50]"},{"why":"Trustless bridge used as the mechanism for verifying evidence about the other L1's state.","marker":"[54]"},{"why":"Two-phase commit framework adapted into the leader-follower VSM protocol.","marker":"[16]"},{"why":"Supplies the observed L1 gas usage baseline that CRATE's overhead is compared against.","marker":"[34]"},{"why":"Groth16 SNARKs used to compress membership proofs in the efficient implementation.","marker":"[30]"},{"why":"Flash loan application that motivates the DAG-CRT programming model and the practicality evaluation.","marker":"[40]"}],"fun_headline_variants":["Atomic cross-rollup transactions in 4 L1 rounds","Cross-rollup atomicity via session-nonce two-phase commit","CRATE: All-or-nothing across distinct L1 chains","4 rounds on L1 for cross-rollup atomic execution","Trustless cross-rollup composability with CRATE"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The protocol depends on a trustless bridge between the two L1s that relays only finalized headers to both validator contracts; if that bridge stalls or relays non-final state, the two-phase commit evidence cannot prove atomicity across the chains.","fun_headline_variants_meta":{"raw":{"variants":["Atomic cross-rollup transactions in 4 L1 rounds","Cross-rollup atomicity via session-nonce two-phase commit","CRATE: All-or-nothing across distinct L1 chains","4 rounds on L1 for cross-rollup atomic execution","Trustless cross-rollup composability with CRATE"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000605,"raw_usage":{"total_tokens":2790,"prompt_tokens":882,"completion_tokens":1908,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":498,"completion_tokens_details":{"reasoning_tokens":1832}},"tokens_in":498,"tokens_out":1908,"duration_ms":12899,"temperature":1.0,"reasoning_tokens":1832,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-08T21:57:48.644789+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Set up two rollups and a malicious executor, submit a chain CRT of length 3, and have the executor run the actions in reverse order; if the VSM commit checks pass (equal GSC Merkle roots and equal nonce sums) for the reversed batch, Theorem 1 is wrong. Conversely, running an honest batch and checking that the four L1 transactions always settle in the claimed four rounds would confirm the latency claim.","supporting_citations":[{"cited_title":"Shared validity sequencing | umbra research","cited_arxiv_id":null,"evidence_quote":"Source of the trigger-action paradigm and Merkle-tree consistency check that CRATE extends and fixes."},{"cited_title":"zkBridge: Trustless Cross-chain Bridges Made Practical","cited_arxiv_id":null,"evidence_quote":"Trustless bridge used as the mechanism for verifying evidence about the other L1's state."},{"cited_title":"Concurrency control and recovery in database systems","cited_arxiv_id":null,"evidence_quote":"Two-phase commit framework adapted into the leader-follower VSM protocol."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Supplies the observed L1 gas usage baseline that CRATE's overhead is compared against."},{"cited_title":"On the size of pairing-based non-interactive arguments","cited_arxiv_id":null,"evidence_quote":"Groth16 SNARKs used to compress membership proofs in the efficient implementation."},{"cited_title":"Attacking the DeFi Ecosystem with Flash Loans for Fun and Profit","cited_arxiv_id":null,"evidence_quote":"Flash loan application that motivates the DAG-CRT programming model and the practicality evaluation."}],"review_version":1}