{"id":"930f80e0-c7cb-4670-a678-3ede3b3928db","arxiv_id":"2505.17891","paper_version":1,"verdict":"REJECT","confidence":"HIGH","novelty_score":8.0,"correctness_risk":"high","formal_verification":"none","parameter_count":0,"one_line_summary":"The authors present the first asymmetric-trust DAG-based consensus protocol, a new constant-round asymmetric gather primitive, and a counterexample showing simple quorum replacement fails.","lead":"Blockchain consensus usually assumes everyone shares the same trust list. This paper builds DAG-based ordering for networks with subjective trust, shows a naive approach fails, and offers a redesigned primitive, though the main protocol as printed has a bug.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Algorithm 4 lines 105–108 unconditionally advance from round 1 to round 2 before any quorum of round-1 vertices is received, so the round-quorum invariant used in Lemmas 4.2 and 4.3 does not hold for the printed protocol.","rationale":"The reader's weakest assumption identifies precisely the load-bearing flaw that an independent reading of Algorithm 4 confirms. The central claim of the paper is that Algorithm 4 is the first randomized asynchronous DAG-based consensus with asymmetric quorums, with expected constant-round termination. That claim depends on the wave structure matching the asymmetric gather of Algorithm 3, which in turn depends on each round being completed only after a quorum of the previous round's vertices is in the local DAG. Lines 105–108 break this for round 1: after broadcasting the round-1 vertex, a process immediately increments to round 2 and broadcasts a round-2 vertex, so the round-2 vertex may have strong edges only to a partial round-1 view. This invalidates the key invariant used in Lemma 4.2 and the 'each wave executes an asymmetric gather' argument in Lemma 4.3. The liveness probability bound in Lemma 4.4 then has no basis, because the common core of round-1 vertices is never guaranteed.\n\nWe find no reason to disagree with the reader's verdict. The negative result of Section 3.2 and Algorithm 3 are interesting and may be correct, but the headline consensus protocol is not sound as printed. The issue is concrete and localized: removing or guarding the unconditional round-1-to-2 transition would require re-proving the lemmas, but the current version does not support the central claim.","tokens_in":31437,"tokens_out":6433,"duration_ms":57475,"concrete_test":"Run a minimal simulation of Algorithm 4 (lines 94–120) on the 30-process quorum system of Fig. 1 with all correct processes and synchronous message delivery, logging DAG[1] at the moment each process first executes line 107. If any process broadcasts a round-2 vertex while DAG[1] contains no quorum of round-1 vertices, the unconditional transition is confirmed and the proof's round-quorum invariant is false. Alternatively, re-derive Lemma 4.2 replacing the cited line-99 justification with the actual control flow; the proof step 'any vertex in DAG_i[r] has a strong path to a quorum in DAG_i[r-1]' fails already for r=2.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The printed Algorithm 4 does not implement the round-change rule that its proofs assume. In the main while loop, line 99 waits for a quorum of the current round r, then increments r and broadcasts a vertex for the new round (lines 102–104). Immediately afterward, lines 105–108 check `r mod 4 = 1` and, if true, increment r again and broadcast another vertex. Starting from r = 0 (DAG[0] is a hardcoded quorum), this means a process creates and broadcasts its round-1 vertex, then immediately creates and broadcasts a round-2 vertex without waiting to receive round-1 vertices from any quorum. Section 4.3 explicitly states that 'a round is considered complete when a process has delivered vertices from all members of at least one of its quorums' and that this applies to round 1 and round 3 sets; the code violates this for round 1.\n\nLemma 4.2 opens with the invariant that any vertex in DAG_i[r] has a strong path to the vertices produced by some quorum in DAG_i[r-1], citing line 99. That invariant is false for r=2: the round-2 vertex is created when DAG[1] may contain only a subset of round-1 vertices, and its strong edges are fixed at creation (line 81). Lemma 4.3's proof that each wave executes an asymmetric gather is therefore unsupported, and the common-core argument that underlies the expected-constant-round liveness claim collapses. The protocol as printed is not proved correct.\n\nTo be fair, the surrounding ideas—the Section 3.2 counterexample and Algorithm 3—are plausible and the bug appears localized; a corrected round-advance rule may restore the argument. But as published, the central claim relies on a protocol that differs from the one analyzed.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes adapting DAG-based consensus to the asymmetric-trust model. It first shows, via a 30-process counterexample and a verifying Python script, that the standard three-round gather protocol fails when threshold quorums are replaced by asymmetric quorums (Section 3.2, Lemma 3.2). It then introduces Algorithm 3, a constant-round asymmetric gather protocol with proofs in Lemmas 3.3-3.8, and Algorithm 4, a DAG-Rider-style asymmetric atomic broadcast protocol claimed to terminate in an expected constant number of rounds proportional to |P|/q(Q). The main contribution is stated as the first randomized asynchronous DAG-based consensus protocol with asymmetric quorums.","tokens_in":31819,"tokens_out":13514,"duration_ms":124609,"significance":"If the protocol were correct as intended, this would be a genuinely novel contribution: it extends the DAG-Rider paradigm to a model where each process chooses its own quorums, and it identifies a non-obvious obstacle in adapting common-core primitives to asymmetric trust. The counterexample of Section 3.2 is a useful negative result, and the provision of a runnable Python verifier is a concrete checkability asset. The intended asymmetric gather protocol (Algorithm 3) and the expected-constant-round argument (Lemma 4.4) are plausible. However, the paper currently contains load-bearing pseudocode errors: Algorithm 4 does not implement the round-change rule on which the proofs of Lemmas 4.2 and 4.3 rely, and Algorithm 3's line 60 has a type-incorrect guard. These issues must be fixed before the central claims can be accepted.","major_comments":[{"comment":"Section 4.3 states that a round is considered complete only when a process has delivered vertices from all members of at least one of its quorums, and that this rule applies to round 1 and round 3 sets. Algorithm 4 does not implement this rule. After line 99 is satisfied for r=0, lines 100-104 create and broadcast the round-1 vertex; then lines 105-108 immediately increment r from 1 to 2 and create/broadcast a round-2 vertex, without checking Q |= DAG[1]. Likewise, after lines 109-116 move from round 2 to round 3, lines 117-120 immediately create a round-4 vertex without waiting for a quorum of round-3 vertices. Because line 81 records strong edges only to the creator's current DAG[round-1] at creation time, a round-2 or round-4 vertex created in this way may have strong edges to only a subset of the previous round, not to a quorum. The invariant used in Lemma 4.2 (\"any vertex in DAG_i[r] has a strong path to the vertices produced by some quorum in DAG_i[r-1]\") is therefore false for r=2 and r=4, and the claim in Lemma 4.3 that each wave executes an asymmetric gather is not supported. The proofs in Section 4.4 are proofs of a different, more constrained protocol than the one printed.","section":"Section 4.3, Algorithm 4, lines 105-108 and 117-120"},{"comment":"The guard \"T_j ⊆ S_i\" in Algorithm 3 is type-incorrect and appears to be a typo: S_i (lines 38/45) is the set of (process, value) pairs delivered from reliable broadcast, whereas T_j is a set of E-sets. The condition can never be satisfied for a non-empty T_j, so line 60 will never add received T_j sets to U and processes would ag-deliver an empty set even after receiving DISTRIBUTE T messages from a quorum (line 62). The surrounding text says \"all correct processes wait to deliver the original input messages before accepting any E or T set that contains them (Lines 48 and 60)\", which suggests the intended guard is \"T_j ⊆ T_i\" or an explicit check that all S-sets in T_j have been accepted. As printed, the asymmetric gather protocol of Section 3.3 does not satisfy the liveness part of Definition 3.1.","section":"Algorithm 3, line 60"}],"minor_comments":[{"comment":"The procedure getWaveVertexLeader is defined twice, once in Algorithm 4 (lines 89-93) and again in Algorithm 6 (lines 158-162); one definition should be removed.","section":"Algorithms 4 and 6"},{"comment":"There is a typo \"DISTRIBTUE T\" where \"DISTRIBUTE T\" is meant.","section":"Section 3.3, paragraph 4"},{"comment":"The notation q(Q) is used in the abstract and in Lemma 4.4 but is defined only informally in the sentence before Lemma 4.4; please introduce it as a formal definition for precision.","section":"Lemma 4.4 and preceding paragraph"},{"comment":"The condition \"∃Q ∈ Q_j for some Q_j ∈ Q : Q |= v.strongEdges\" is ambiguous: it should state clearly whether the quorum must belong to the sender's quorum system Q_j or may be drawn from any process's quorum system, since this affects the soundness of vertex validation.","section":"Algorithm 4, line 140"}],"recommendation":"major_revision","confidential_remarks":"The manuscript depends on primitives from Alpos et al. [3] for reliable broadcast and common coin; those are prior published protocols and the shared authorship is not itself a concern. The main risk is that the pseudocode and the proofs describe different protocols, so the revision must re-verify all lemmas of Section 4.4 against the corrected algorithm. The Section 3.2 counterexample with the Python verifier is a useful and checkable contribution that should be preserved."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Two things to know upfront. The Section 3.2 counterexample is real and valuable: it demonstrates that replacing threshold quorums with asymmetric ones inside Canetti-Rabin's three-round gather does not yield a common core. The 30-process quorum system and the Python script in Appendix A check out; this is a genuine negative result that was missing from the literature. The constant-round asymmetric gather in Section 3.3 (Algorithm 3) is also a substantive contribution — a new primitive with plausible, detailed proofs. If I were working on asymmetric trust, I would use this paper as the starting point.\n\nThe headline result, however, is not correct as printed. The stress-test note lands. In Algorithm 4, lines 105-108 unconditionally increment the round counter from 1 to 2 and broadcast a round-2 vertex immediately after broadcasting the process's own round-1 vertex, without waiting to receive round-1 vertices from a quorum. The code is very clear: starting from r=0 with a hardcoded quorum in DAG[0], the process reaches the round-1 broadcast, then immediately moves to round 2. Section 4.3 states the round-change rule explicitly — a round is complete only after receiving vertices from all members of one quorum — and the code violates that for round 1. Lemma 4.2 opens with the invariant that any vertex in DAG_i[r] has a strong path to some quorum's vertices in DAG_i[r-1], citing line 99. That invariant is false for r=2 as the code stands. Lemma 4.3, which argues each wave executes an asymmetric gather, is unsupported. The expected-constant-round liveness argument collapses.\n\nThis is load-bearing, but it looks localized. A corrected round-advance rule likely restores the proof framework; I do not see an obvious conceptual gap beyond this. The paper also glosses over the leader-sampling setup in Lemma 4.4, but that is minor by comparison.\n\nBottom line: the negative result and Algorithm 3 deserve to survive. The consensus protocol needs a serious revision and a re-proof before anyone cedes on the main claim. I would send this to referees — the core ideas are important and the flaw is fixable — but accept only after a careful revision.","headline":"The counterexample and asymmetric gather are solid, but the headline consensus protocol has a round-transition bug that invalidates the proof as printed.","tokens_in":32344,"tokens_out":3300,"would_cite":true,"duration_ms":32157,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":["68M14","68W15"],"pacs":[],"model":"deepseek-v4-flash","headline":"The paper presents the first randomized asynchronous DAG-based consensus protocol with asymmetric quorums, where each participant trusts its own list of peers, and claims expected constant-round progress.","keywords":["asymmetric quorum systems","DAG-based consensus","asynchronous atomic broadcast","common core","gather protocol","DAG-Rider","asymmetric trust"],"falsifier":"Run Algorithm 4 on the 30-process quorum system of Figure 1 with all processes correct and check whether, along any execution, a process reaches line 107 and broadcasts a round-2 vertex while its local DAG for round 1 is missing at least one vertex from every quorum in $Q_i$. The existence of such a vertex would show that the printed code does not satisfy the quorum-membership invariant on which Lemma 4.2 and the liveness argument depend; a corrected guard at line 105 would restore it.","tokens_in":31267,"feed_emoji":"🕸️","tokens_out":10339,"duration_ms":81161,"temperature":0.7,"pith_summary":"Most DAG-based consensus protocols assume every participant shares the same threshold trust assumption. This paper replaces that with asymmetric quorums, where each process maintains its own list of trusted peers, and argues that the standard constant-round gather primitive breaks under such per-process quorums. It exhibits a 30-process quorum system in which the naive quorum-replacement version of gather produces no common core, and then introduces a corrected constant-round asymmetric gather that uses ACK/READY/CONFIRM control messages to amplify quorum knowledge. On top of that gather, the paper adapts DAG-Rider into an asynchronous randomized atomic broadcast protocol that is claimed to be the first DAG-based consensus protocol with asymmetric quorums, deciding within an expected constant number of waves bounded by the ratio of the participant count to the smallest quorum size.","feed_headline":"DAG consensus now tolerates per-node trust lists","feed_subtitle":"A new constant-round gather keeps ordering alive when each party trusts its own quorum of peers.","key_machinery":"The load-bearing object is the asymmetric gather (Algorithm 3), which replaces threshold counting with per-process quorum conditions and inserts an amplification handshake: a process distributes its candidate set, waits for ACK messages from one of its own quorums, sends READY, waits for READY from a quorum, sends CONFIRM, and only then distributes its second-round sets. The effect is that some candidate set from a guild member is guaranteed to have reached a full quorum before second-round sets spread; quorum consistency forces every other guild member's chosen quorum to intersect that set's quorum, so one first-round candidate is contained in every delivered output. In the consensus protocol (Algorithm 4), each four-round wave is one execution of this gather structure, and the commit rule requires that a quorum of round-4 vertices have strong paths to the randomly chosen wave leader. The paper also defines the 'guild' as the set of wise processes that contains a quorum for each of its members; all guarantees are stated for this maximal guild.","core_discovery":"The central claim is that randomized asynchronous DAG-based consensus can be realized over asymmetric quorum systems, despite the fact that simply swapping asymmetric quorums into existing common-core primitives does not work. The paper proves the failure by giving a 30-process fail-prone system satisfying the asymmetric quorum-system condition where the quorum-replacement version of the standard three-round gather leaves no common core in any output. It then introduces Algorithm 3, a constant-round asymmetric gather whose ACK/READY/CONFIRM handshake guarantees that at least one guild member's candidate first-round set is held by every guild member when the protocol delivers. Building on this, Algorithm 4 adapts DAG-Rider's wave structure to asymmetric quorums, with round changes gated by per-process quorum conditions and a commit rule requiring strong paths from a quorum of round-4 vertices to the randomly chosen wave leader. The paper argues that the expected number of waves until a leader is committed is at most $|P|/q(Q)$, where $q(Q)$ is the size of the smallest quorum, making the expected latency constant when quorums have linear size.","pith_inferences":["A testable next step is to instantiate the new asymmetric gather in a protocol with a two-round common core, mirroring the Tusk-style approach, to see whether the extra control round can be trimmed without losing the common-core guarantee.","The paper's guarantees are stated for the maximal guild; an open question is whether a weaker liveness property can be proven for correct processes that are not wise, since the paper itself notes that naive processes can affect safety and liveness.","Another stress test is to simulate Algorithm 4 on the paper's 30-process counterexample quorum system and compare the empirical commit rate against the $|P|/q(Q)$ bound, using a system engineered to defeat quorum replacement as a clean benchmark."],"forward_implications":["With Algorithm 4, DAG-based atomic broadcast no longer needs a single global failure threshold: each node's own quorum list determines what it waits for, and the protocol still orders messages.","Expected progress remains constant: the number of waves until a leader is committed is at most $|P|/q(Q)$, so as long as quorum sizes grow linearly with the participant count, per-wave latency is bounded in expectation.","The new asymmetric gather is itself a reusable constant-round common-core primitive, so other DAG protocols with common-core commit rules can be converted to the asymmetric model using this machinery rather than the failed quorum-replacement heuristic.","The 30-process counterexample shows that existing asymmetric translations of common-core protocols cannot be used as-is, establishing that the extra control messages in Algorithm 3 are necessary rather than cosmetic."],"supporting_citations":[{"why":"Defines asymmetric quorum systems, guilds, and supplies the asymmetric reliable broadcast and common coin that Algorithm 4 builds on.","marker":"[3]"},{"why":"DAG-Rider, the protocol whose wave structure and commit rule Algorithm 4 adapts to asymmetric trust.","marker":"[22]"},{"why":"Provides the standard constant-round gather algorithm that Algorithm 3 generalizes and whose quorum-replacement version fails.","marker":"[1]"},{"why":"Introduces the gather primitive and common-core property that the asymmetric gather must reproduce.","marker":"[16]"},{"why":"The broadcast amplification protocol whose ACK/READY/CONFIRM pattern is reused in Algorithm 3.","marker":"[12]"},{"why":"Supplies the Byzantine quorum consistency and availability definitions used in every intersection argument.","marker":"[26]"},{"why":"Introduces asymmetric trust and fail-prone systems, the foundation of the asymmetric quorum model.","marker":"[20]"},{"why":"Tusk's two-round common core, whose quorum-replacement translation the paper shows also fails.","marker":"[21]"}],"fun_headline_variants":["First DAG consensus for asymmetric trust","Asymmetric trust: DAG consensus in constant rounds","Per-node trust lists now work in DAG consensus","Constant-round DAG consensus with asymmetric quorums","New common core enables asymmetric DAG consensus"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing premise is that a process advances from a round only after receiving that round's vertices from at least one of its own quorums, meaning a set of peers it trusts enough; Algorithm 4 as printed appears to violate this at lines 105-108, where a process can leave round 1 and broadcast a round-2 vertex immediately after broadcasting its own round-1 vertex, before any round-1 quorum has been received, and if that printed transition is real the quorum-membership property used by the proofs does not hold.","fun_headline_variants_meta":{"raw":{"variants":["First DAG consensus for asymmetric trust","Asymmetric trust: DAG consensus in constant rounds","Per-node trust lists now work in DAG consensus","Constant-round DAG consensus with asymmetric quorums","New common core enables asymmetric DAG consensus"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000545,"raw_usage":{"total_tokens":2630,"prompt_tokens":994,"completion_tokens":1636,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":610,"completion_tokens_details":{"reasoning_tokens":1575}},"tokens_in":610,"tokens_out":1636,"duration_ms":10495,"temperature":1.0,"reasoning_tokens":1575,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-07T14:39:40.120393+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run Algorithm 4 on the 30-process quorum system of Figure 1 with all processes correct and check whether, along any execution, a process reaches line 107 and broadcasts a round-2 vertex while its local DAG for round 1 is missing at least one vertex from every quorum in $Q_i$. The existence of such a vertex would show that the printed code does not satisfy the quorum-membership invariant on which Lemma 4.2 and the liveness argument depend; a corrected guard at line 105 would restore it.","supporting_citations":[{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Defines asymmetric quorum systems, guilds, and supplies the asymmetric reliable broadcast and common coin that Algorithm 4 builds on."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Provides the standard constant-round gather algorithm that Algorithm 3 generalizes and whose quorum-replacement version fails."}],"review_version":1}