{"id":"3dbade69-8700-4731-9596-787359c00e8b","arxiv_id":"2504.15449","paper_version":1,"verdict":"CONDITIONAL","confidence":"HIGH","novelty_score":5.0,"correctness_risk":"high","formal_verification":"none","parameter_count":2,"one_line_summary":"A heuristic pairing Ethereum-Polygon bridge transactions by address, time, value, and token type matches up to 99.65% of deposits, but matches are not checked against ground truth.","lead":"The authors match over two million Ethereum-Polygon bridge transactions using the same wallet address on both chains plus time, value, and token type. The work charts cross-chain flows, bridge delays, and the Ethereum Merge's effect, but matching accuracy is not validated against a known ground truth.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The headline 'exact match' rates are uniqueness rates, not validated accuracy; the time tolerance is tuned on the same data with no ground-truth labels, so false pairings can inflate all downstream statistics.","rationale":"The reader identified the same load-bearing assumption: uniqueness of a heuristic match is treated as correctness, with no ground-truth validation and a tolerance fitted on the same data. I agree and would sharpen it: the risk is not merely that match rates are upper bounds, but that false positives can silently enter the matched dataset. Because the matching is exact on address, value, token, and a very wide window, and because stablecoin transfers frequently repeat identical values from the same address, a unique match is not a guarantee of a correct pair. The paper's own statements—that an exact match is valid and that withdrawal match rates are lower—do not resolve this. However, the concern is fixable by external validation against bridge event logs or explorer records, and the authors clearly list several limitations. Thus the appropriate verdict remains CONDITIONAL, consistent with the reader's assessment; no change to the verdict is needed. The proposed concrete test would settle whether the reported rates are genuine accuracy or only internal uniqueness metrics.","tokens_in":13571,"tokens_out":4013,"duration_ms":40301,"concrete_test":"Build a labeled sample by extracting, for 1,000 randomly selected Ethereum LockedEther/LockedERC20/LockedERC721 events, the corresponding Polygon mint transaction from the bridge's own state-sync records (e.g., query a Polygon archive node for the token-mint event matching the bridge's state ID, or scrape the official bridge explorer for deposit/withdrawal transaction hashes). Run the heuristic on this sample with the paper's fitted tolerances and compute precision (matched-and-labeled-correct / all matched) and recall (matched-and-labeled-correct / all labeled). Repeat for 1,000 withdrawals using the ExitedEther/ExitedERC20 events as anchors. If precision is materially below 99% for deposits or 95% for withdrawals, or if a held-out tolerance split changes reported rates by more than one percentage point, the headline rates are uniqueness fractions, not accuracy.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The paper's headline rates in §5.1 (Table 5) are computed by counting 'exact matches' defined in §3.2 as a transaction matched to exactly one candidate. The statement 'an exact match is a valid cross-chain transaction' equates uniqueness with correctness without a ground-truth check. This matters because the time tolerance is fit on a 10,000-transaction sample drawn from the same dataset by maximizing the exact-match rate (Fig. 3), so the reported rates partly reflect the fitting objective, not external accuracy. For withdrawals the fitted tolerance is ~9,166 minutes (≈6.4 days), and for fungible ERC20 tokens there are many repeated same-address/same-value transfers; a unique candidate within that window can still be the wrong counterpart. Since all downstream analyses (§5.2: time costs, volumes, merge effect, NFT case study) are computed on the matched set, even a modest false-positive rate changes medians and correlations. The authors acknowledge API incompleteness and low withdrawal rates, but those are recall concerns; the unvalidated false-positive rate is the load-bearing risk.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"This paper proposes a heuristic algorithm to match cross-chain transactions between Ethereum and Polygon, using the fact that user addresses are identical on EVM-compatible chains and combining transaction time, value, and token identification. The algorithm is applied to roughly two million bridge transactions from August 2020 to August 2023, and the paper reports deposit match rates of up to 99.65% and withdrawal match rates of up to 92.78% across Ether, ERC-20, and ERC-721 assets. Using the matched dataset, the paper analyzes cross-chain time costs, transaction counts and volumes, withdrawal-to-deposit ratios, a case study of the KONGZ VX NFT collection, and discusses security and governance implications of the Polygon PoS bridge.","tokens_in":13811,"tokens_out":5131,"duration_ms":45142,"significance":"The paper addresses a timely and practically important problem: cross-chain transactions are opaque, which hampers auditing, compliance, and behavioral analysis. The data collection effort is substantial, and the descriptive findings—one-way asset flow, stablecoin dominance, the effect of the Ethereum Merge on deposit times, and the NFT case study—are potentially valuable. The proposed matching heuristic, if properly validated, could be extended to other EVM bridge pairs and would be a useful tool for the community. However, the central claim of high matching accuracy is not currently supported: the reported match rates are uniqueness rates computed under an in-sample-fitted time tolerance, not correctness rates validated against ground truth. Because every downstream statistic in Section 5 is computed on the matched set, this validation gap is load-bearing.","major_comments":[{"comment":"The paper defines an 'exact match' as a transaction with exactly one candidate counterpart, and then states 'an exact match is a valid cross-chain transaction.' This equates uniqueness with correctness without any ground-truth validation. The match rates reported in Table 5 are therefore uniqueness rates, not accuracy rates. Moreover, the time tolerance is selected by maximizing this exact-match rate on a 10,000-transaction sample drawn from the same dataset (Figure 3), so the full-data rates in Table 5 are in-sample and may substantially overstate true matching accuracy. To support the headline claims, the authors should validate against a ground-truth set (e.g., bridge explorer records, manual inspection of a random sample) and report precision, recall, and confidence intervals.","section":"Section 3.2 and Table 5"},{"comment":"The withdrawal time tolerance is fitted to about 9,166 minutes (roughly 6.4 days). For fungible ERC-20 tokens, particularly stablecoins such as USDC, USDT, and DAI, addresses frequently make repeated transfers of identical amounts. Within a 6.4-day window, a unique candidate can easily be the wrong counterpart. Consequently, the reported withdrawal match rate for ERC-20 (67.55%) and all withdrawal-related statistics in Section 5.2 rest on a matched set whose false-positive rate is unknown and potentially material. The authors should quantify this risk, for example by testing on known bridge transactions or by incorporating additional transaction attributes (e.g., transaction hashes or internal call structure) to reduce ambiguity.","section":"Section 3.2, Algorithm 1"},{"comment":"The Polygon-side data are collected via the Polygonscan API, which has query limits that can omit transactions for high-volume addresses, as the paper acknowledges. In addition, the withdrawal sample is restricted to addresses with previous deposits, and withdrawals are identified by a single method ID (0x3805550f). These choices affect both recall and precision of the matched set. Unmatched records may reflect data-collection incompleteness rather than algorithm failure, and the matched set may be biased toward less active addresses. The authors should report the number of affected addresses, provide robustness checks against an alternative data source (e.g., a full Polygon node), and discuss how the known incompleteness affects the match-rate estimates and downstream analyses.","section":"Section 4 and Section 5.1.1"},{"comment":"Because the deposit time tolerance is set to approximately 24.2 minutes, the deposit time-cost distribution is censored at that threshold. The reported median time costs and the claim that the Ethereum Merge prolonged deposit times could be artifacts of this censoring. The authors should either use a larger, validated tolerance (and report how the additional matches are verified) or explicitly analyze the sensitivity of the Merge conclusion to the tolerance choice.","section":"Section 5.2.1 and Figures 5–7"},{"comment":"There is an inconsistency between the pseudocode and the stated matching criteria. Table 3 defines the time criterion as |E.timestamp - P.timestamp| ≤ time tolerance, but Algorithm 1 (lines 5 and 10) drops rows only when p.timestamp - e.timestamp ≥ time tolerance. This one-sided check would keep a Polygon transaction that occurs long before the Ethereum transaction, contrary to the stated rule. The authors should correct the pseudocode or the table and confirm that the implementation matches the reported results.","section":"Algorithm 1 and Table 3"}],"minor_comments":[{"comment":"The heading 'Address consistency in EVM-based blockhains' contains a typo: 'blockhains' should be 'blockchains.'","section":"Section 3.2"},{"comment":"The y-axis ranges in Figure 3 (deposit match rate peaking around 0.80) appear inconsistent with the full-data match rates in Table 5 (e.g., 94.97% for Ether deposits). The authors should clarify whether Figure 3 uses a different definition or a restricted sample, and reconcile the numbers.","section":"Section 3.2 and Figure 3"},{"comment":"The text states 'we filtered out transactions from addresses that have received tokens before,' but the intent appears to be the opposite: the withdrawal sample keeps only addresses that had received tokens before (i.e., depositors). Please rephrase to avoid confusion.","section":"Section 4, Table 4"},{"comment":"The number of ERC-721 deposits is given as 34,135 in the text but 34,315 in Table 4. One of these is a typo; please correct.","section":"Section 4"},{"comment":"The text refers to 'withdrawal rates' but the right-hand axis in Figures 8–10 shows values up to 3.0, which suggests these are withdrawal-to-deposit ratios rather than percentages. Please use consistent terminology and label the axis accordingly.","section":"Section 5.2.2"},{"comment":"Reference [29] is listed as 'Untitled' and is incomplete, and references [27] and [28] use masked hashes that are not reproducible. Please provide complete and accessible references.","section":"References"}],"recommendation":"major_revision","confidential_remarks":"The paper's main contributions are the large-scale dataset and the descriptive findings, but the matching validation is insufficient for the claims made. I recommend major revision rather than rejection because the method is plausible and the underlying data could be re-analyzed with proper ground-truth validation. The authors should also address the inconsistency between the pseudocode and the stated time criterion, as it affects reproducibility."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Colleague,\n\nHere's my read on Yan et al. (arXiv:2504.15449). The useful core is the first large-scale matched dataset of Polygon PoS Bridge transactions—over two million deposit events and hundreds of thousands of withdrawals, matched by address, value, token, and time window. The descriptive findings are genuinely interesting: deposits typically complete in 10–20 minutes while withdrawals take hours or longer; the Merge increased deposit settlement times; asset flows are mostly one-way from Ethereum to Polygon; stablecoins dominate ERC20 bridge traffic; and the KONGZ VX case study suggests lower fees on Polygon have not moved NFT trading activity off Ethereum. If the matching is reliable, this is a practical tool for auditing cross-chain flows.\n\nThe soft spot is not the method itself; it's the evaluation. The paper defines an \"exact match\" as a transaction that matches exactly one candidate, and then equates uniqueness with validity. The time tolerance is chosen by maximizing the exact-match rate on a 10,000-transaction sample from the same dataset, so the reported match rates are partly an in-sample property of the fitting objective. There is no ground truth check, and no code or matched data are released. For withdrawals the fitted tolerance is about 6.4 days, and for fungible ERC20s there are many repeated same-address, same-value transfers; a unique candidate within that window can still be the wrong counterpart. That means the downstream medians and volume estimates inherit whatever false-positive rate the heuristic has. The authors do acknowledge API incompleteness and the low withdrawal match rates, but those are recall limitations; the unverified precision is the load-bearing risk.\n\nAlso minor: the withdrawal analysis only considers addresses that previously deposited, which filters out a class of withdrawals; and there are some presentation slips (e.g., \"tionIntroduction\", an \"Untitled\" reference). None of these sink the paper, but they mark it as needing polish.\n\nNet: this is a reasonable and potentially useful study, but the headline accuracy claims should be treated as internal consistency measures until checked against bridge explorer records or a held-out validated sample. I'd send it to peer review with a request to add ground-truth validation and release artifacts. If the validation checks out, it becomes a solid reference for cross-chain behavior.\n\nRecommendation: worth engaging.","headline":"Useful empirical study of Polygon bridge flows, but the headline match rates are uniqueness rates, not validated accuracy—the time tolerance is in-sample and there is no ground truth.","tokens_in":14283,"tokens_out":2581,"would_cite":true,"duration_ms":22653,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"A heuristic that joins public transaction records on address, time, token, and value is claimed to trace up to 99.65% of Ethereum-Polygon bridge deposits and 92.78% of withdrawals.","keywords":["cross-chain transactions","bridge tracing","Ethereum","Polygon","EVM address consistency","transaction matching heuristic","stablecoins","NFTs"],"falsifier":"Compare a random sample of the paper's unique matches against Polygon's official bridge explorer or against the bridge contracts' own event logs, such as checkpoint and state-sync records. If a material share of unique matches, especially ERC-20 withdrawals within the 6.4-day tolerance, are not the true lock-mint or burn-exit pair but ordinary transfers of the same token and amount, then the exact-match-is-valid assumption fails and the reported match rates overstate accuracy.","tokens_in":13369,"feed_emoji":"🔗","tokens_out":5606,"duration_ms":49838,"temperature":0.7,"pith_summary":"This paper tries to establish that cross-chain transfers between EVM-compatible blockchains can be traced without access to bridge-internal records. Because the same user address is valid on both Ethereum and Polygon, the authors match a bridge transaction on one chain to its counterpart on the other by joining on address, time window, token identity, and transferred value. Applied to over two million Ethereum-Polygon bridge transactions from August 2020 to August 2023, the heuristic reportedly matches up to 99.65% of deposits and 92.78% of withdrawals across Ether, ERC-20 tokens, and NFTs. If those match rates are accurate, the method turns public blockchain data into a usable audit trail for bridge flows, and the paper's downstream statistics—one-way asset movement, stablecoin dominance, and withdrawal delays—would describe the true bridge activity.","feed_headline":"99.65% of Ethereum-Polygon bridge deposits matched by heuristic","feed_subtitle":"A simple join on address, time, amount, and token traces over two million cross-chain transactions.","key_machinery":"The load-bearing object is Algorithm 1, a join-based matching heuristic. For each source-chain transaction it fetches all target-chain transactions sent to the same address, then keeps only rows whose timestamp difference lies within the tolerance, whose token name or address matches (WETH treated as Ether for deposits), and whose value is equal (for ERC-721, token ID equality replaces value equality). The algorithm's output is a one-to-one assignment where uniqueness is equated with validity; the time tolerance is a tuned parameter, selected from a 10,000-transaction sample and applied globally to all later analysis.","core_discovery":"The central claim is that an exact match under four criteria is a valid cross-chain transaction. The algorithm takes each Ethereum-side lock event (LockedEther, LockedERC20, LockedERC721) and finds the unique Polygon-side transaction sent to the same address with the same token and value inside a tunable time tolerance; the tolerance is chosen by maximizing exact-match rate on a 10,000-transaction sample, giving about 24.2 minutes for deposits and about 9,167 minutes (roughly 6.4 days) for withdrawals. The paper reports match rates of 94.97% for Ether deposits, 93.04% for ERC-20 deposits, and 99.65% for NFT deposits, with withdrawal rates of 81.74%, 67.55%, and 92.78% respectively. It then treats the matched set as ground truth for an empirical analysis of cross-chain timing, volumes, and user behavior.","pith_inferences":["If the same matching rule is applied to other EVM pairs (for example Ethereum-Arbitrum or Ethereum-Optimism), the address-consistency property should recover comparable flow-level statistics, but the time tolerance would need to be re-estimated because bridge finality differs from Polygon's.","The 6.4-day withdrawal tolerance means any two identical-value transfers of the same token from the same address within that window will collide; for stablecoins with repeated rounded amounts, this could systematically overcount ordinary transfers as genuine withdrawals—an editorial check, not a claim the paper makes.","A stronger test of the method would use bridge-internal data, such as the official bridge explorer's deposit and withdrawal records or state-sync events, as ground truth and measure precision rather than only the exact-match rate.","The released matched dataset could support downstream studies of cross-chain arbitrage and MEV, but any such estimates inherit the false-positive error in withdrawal matches, so direction-specific error bars would be needed."],"forward_implications":["Most bridged assets move one way, from Ethereum to Polygon: withdrawal-to-deposit ratios stay below 50% for most of the study period, with a temporary reversal around the time of the Ethereum Merge.","Stablecoins (USDC.e, USDT, DAI) dominate ERC-20 cross-chain activity, so stablecoin flows should be central to any bridge risk monitoring.","Deposit completion times roughly doubled after the Ethereum Merge and stabilized near 20 minutes, linking consensus finality changes to bridge latency.","Withdrawals are slower and more variable than deposits because they require a separate user-initiated claim step, and extreme delays—up to six months—leave funds unclaimed and expose users to governance and double-spend risks.","NFT traffic across the bridge is concentrated in a few collections, and the largest collection's secondary trading remains on Ethereum despite Polygon's lower fees."],"supporting_citations":[{"why":"Supplies the key enabling property: the same external address works on every EVM chain, which is the first matching criterion.","marker":"[25]"},{"why":"Describes Polygon as a sidechain and the bridge design whose lock-and-mint and burn-and-prove events ground the data collection.","marker":"[11]"},{"why":"Documents the two-step withdrawal procedure (burn on Polygon, claim on Ethereum), which explains the withdrawal time asymmetry.","marker":"[30]"},{"why":"Documents the withdrawal process and expected timeframes used to interpret slow withdrawals.","marker":"[31]"},{"why":"Provides the reported case of a user leaving over $2 million in WETH unclaimed for six months, supporting the unclaimed-assets risk.","marker":"[32]"},{"why":"Supplies the bridge-attack analysis used to argue that long confirmation windows create double-spend and replay risk.","marker":"[33]"},{"why":"Supplies the cross-chain bridge attack-surface survey used for the security discussion.","marker":"[34]"},{"why":"Reference for the Ethereum Merge event, tied to the observed increase in deposit completion times.","marker":"[29]"}],"fun_headline_variants":["Heuristic traces 99.65% of Ethereum-Polygon deposits","Cross-chain deposits matched at 99.65% with simple heuristic","Address, time, value, token: keys to tracing bridge txs","Ethereum-Polygon bridge traces 99.65% via four-field match","Matching 2M cross-chain transactions with 99.65% recall"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The paper's central assumption is that uniqueness under the four matching criteria equals correctness: a transaction that matches exactly one counterpart is taken to be the actual cross-chain transfer, even though withdrawals are matched under a multi-day tolerance and stablecoins often transfer identical rounded amounts.","fun_headline_variants_meta":{"raw":{"variants":["Heuristic traces 99.65% of Ethereum-Polygon deposits","Cross-chain deposits matched at 99.65% with simple heuristic","Address, time, value, token: keys to tracing bridge txs","Ethereum-Polygon bridge traces 99.65% via four-field match","Matching 2M cross-chain transactions with 99.65% recall"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000833,"raw_usage":{"total_tokens":3643,"prompt_tokens":961,"completion_tokens":2682,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":577,"completion_tokens_details":{"reasoning_tokens":2583}},"tokens_in":577,"tokens_out":2682,"duration_ms":16448,"temperature":1.0,"reasoning_tokens":2583,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-16T11:26:10.134785+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Compare a random sample of the paper's unique matches against Polygon's official bridge explorer or against the bridge contracts' own event logs, such as checkpoint and state-sync records. If a material share of unique matches, especially ERC-20 withdrawals within the 6.4-day tolerance, are not the true lock-mint or burn-exit pair but ordinary transfers of the same token and amount, then the exact-match-is-valid assumption fails and the reported match rates overstate accuracy.","supporting_citations":[{"cited_title":"[Online; accessed 2024-01-30]","cited_arxiv_id":null,"evidence_quote":"Supplies the key enabling property: the same external address works on every EVM chain, which is the first matching criterion."},{"cited_title":"& Arjun, A","cited_arxiv_id":null,"evidence_quote":"Describes Polygon as a sidechain and the bridge design whose lock-and-mint and burn-and-prove events ground the data collection."},{"cited_title":"[Online; accessed 2025-03-03]","cited_arxiv_id":null,"evidence_quote":"Documents the two-step withdrawal procedure (burn on Polygon, claim on Ethereum), which explains the withdrawal time asymmetry."},{"cited_title":"How to withdraw and how long does it take for the withdrawal process of my assets in polygon plasma bridge? : Polygon support","cited_arxiv_id":null,"evidence_quote":"Documents the withdrawal process and expected timeframes used to interpret slow withdrawals."},{"cited_title":"Lost in translation: Polygon bridge’s unclaimed millions — zengo (2022)","cited_arxiv_id":null,"evidence_quote":"Provides the reported case of a user leaving over $2 million in WETH unclaimed for six months, supporting the unclaimed-assets risk."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Supplies the bridge-attack analysis used to argue that long confirmation windows create double-spend and replay risk."},{"cited_title":"& Lin, Z","cited_arxiv_id":null,"evidence_quote":"Supplies the cross-chain bridge attack-surface survey used for the security discussion."},{"cited_title":"[Online; accessed 2025-03-25]","cited_arxiv_id":null,"evidence_quote":"Reference for the Ethereum Merge event, tied to the observed increase in deposit completion times."}],"review_version":1}