{"id":"fd51d9b3-e115-4db5-b38f-ed0feea3cd4f","arxiv_id":"2506.02086","paper_version":1,"verdict":"REJECT","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"high","formal_verification":"none","parameter_count":0,"one_line_summary":"A graph-based method that finds single-entry/single-exit subgraphs in smart contract state machines and estimates gas costs to guide off-chain execution decisions.","lead":"This thesis proposes a way to decide which parts of a smart contract can be run off-chain to save cost. It models smart contracts as state machines, finds subgraphs with a single entry and exit, and adds a gas-cost model to guide the decision.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Algorithm 4's isSimpleSubgraph helper does not enforce unique entry/exit: the overwriting of S_start and S_end lets a two-entry subgraph pass, so the central 'finds simple subgraphs' claim is unsupported.","rationale":"The strongest claim is that Algorithm 4 successfully finds the simple subgraphs that should be considered for off-chain processing. That requires isSimpleSubgraph to be a correct decision procedure for the three properties in Section 3.3. The pseudocode does not satisfy this: the overwrite behavior produces false positives, so even a faithful implementation of the algorithm as presented would return subgraphs with multiple entry nodes. This is a direct defect in the central artifact, not merely a missing formal proof. The reader's Theorem 1 objection is valid for diamond-shaped overlaps, but it is less load-bearing than the helper bug: the enumeration in Algorithm 4 could still find the correct set of simple subgraphs if isSimpleSubgraph were fixed, and the count/order logic can be implemented by direct subset checks without relying on Theorem 1. The absence of a runnable artifact or reproducible validation in Section 4.4 compounds the problem, but the concrete algorithmic error is sufficient on its own. I therefore keep the reader's REJECT verdict; no change in verdict is needed.","tokens_in":36499,"tokens_out":11164,"duration_ms":125502,"concrete_test":"Implement isSimpleSubgraph exactly as written in Fig. 4.2, with S_start and S_end assigned (overwritten) for each node having an external incoming or outgoing edge respectively, and run it on S'={A,B,C} with transitions X->A, A->B, B->C, D->C, and A->Y, where X, D, Y are outside S'. A correct single-entry/single-exit test returns false because both A and C have external incoming edges; the pseudocode as written returns true. If the faithful implementation returns true, the helper bug is confirmed and the claimed validation in Section 4.4 is called into question.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim is that Algorithm 4 (Fig. 4.4) successfully finds the single-entry/single-exit subgraphs that should be considered for off-chain processing. That claim depends on isSimpleSubgraph (Fig. 4.2) correctly deciding the three properties from Section 3.3. It does not. The function records S_start as the last node seen with any incoming edge from outside S' and S_end as the last node seen with any outgoing edge to outside S'; it never counts entry or exit nodes, and it never checks connectivity. Because S_start and S_end are overwritten rather than accumulated, a subgraph with two entry nodes can pass the test. Concretely, take S'={A,B,C} with transitions X->A, A->B, B->C, D->C, and A->Y, where X, D, and Y are outside S'. Both A and C have external incoming edges, so the subgraph has two entry nodes and should be rejected. The pseudocode, however, sets S_start=C (overwriting A) and S_end=A, skips both A and C in the final loop, checks only B, and returns true. Algorithm 4 would therefore present this non-simple subgraph as an off-chain candidate, directly undermining the paper's main contribution. The reader's Theorem 1 counterexample is also real, but it is less load-bearing: even if Theorem 1 were repaired, a faithful implementation of Fig. 4.2 would still misclassify subgraphs; and if isSimpleSubgraph were corrected, the brute-force enumeration would find the simple subgraphs regardless of Theorem 1, with counts computed by direct subset checks.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The manuscript, a Master's thesis, proposes a three-part framework for moving parts of smart-contract computation off-chain: (i) an algorithm (Algorithm 4) that identifies \"simple subgraphs\" in the FSM graph of a smart contract, defined as connected subgraphs with a single entry node and a single exit node; (ii) an interface model for on-chain/off-chain interaction, including a bridge process and a data structure for off-chain storage; and (iii) a cost model, illustrated with Ethereum gas costs, to help decide when off-chaining a pattern is beneficial. The central algorithmic claim is that Algorithm 4, using the helper isSimpleSubgraph, successfully finds all simple subgraphs, and Theorem 1 is used to characterize the relationships among simple subgraphs in support of the ordering/counting logic.","tokens_in":36843,"tokens_out":8266,"duration_ms":81436,"significance":"If correct, the framework would offer a design-time, systematic method for identifying off-chain computation candidates, building on FSM-based smart-contract generation and separation of concerns. The interface and cost models address practically relevant aspects of blockchain scalability. However, the central algorithm contains a demonstrable correctness bug, and the supporting theorem is false as stated; these flaws directly undermine the paper's main contribution. The paper also claims empirical verification without providing an implementation or results, so the central claims are not currently substantiated.","major_comments":[{"comment":"The helper does not enforce the single-entry/single-exit property because it overwrites S_start and S_end instead of accumulating the set of nodes with external incoming/outgoing edges. Concretely, for S'={A,B,C} with transitions X->A, A->B, B->C, D->C, and A->Y (with X, D, Y outside S'), the function sets S_start=C (overwriting A), S_end=A, skips both A and C in the final loop, checks only B, and returns true even though both A and C are entry nodes. Algorithm 4 would therefore present this non-simple subgraph as an off-chain candidate, directly contradicting the claim that it finds all simple subgraphs. The helper also never checks connectivity of S', which is part of the definition of a simple subgraph.","section":"§4.2.1, Fig. 4.2 (helper isSimpleSubgraph)"},{"comment":"The proof of Theorem 1 assumes that the intersection of two connected subgraphs is connected: \"Clearly there must be an edge between some nodes s1 and s2 in S' as otherwise S' would not be connected and neither would be S1 and S2.\" This is false. In a diamond graph with nodes A, B, C, D and edges A->B, A->C, B->D, C->D, the simple subgraphs S1={A,B,D} and S2={A,C,D} share {A,D}, which contains no edge and is disconnected. Hence Theorem 1(b)(i) is false, and the claimed classification of overlap relationships between simple subgraphs is unsupported. Since the paper uses this theorem to justify the ordering/counting logic of Algorithm 4, the theoretical foundation for the 'what to off-chain' contribution is invalid.","section":"Chapter 4, Theorem 1 (page 32)"},{"comment":"The statement that \"we verified the results by running the algorithm on many use-cases and verified that Algorithm 4 found all simple-subgraphs successfully\" is not accompanied by any implementation, pseudocode execution trace, dataset, or reproducible artifact. Given the concrete counterexample to isSimpleSubgraph described above, this verification claim is not credible as written and would need to be substantiated by a corrected algorithm and by execution results, likely including machine-checked enumeration on representative FSM graphs.","section":"§4.4"}],"minor_comments":[{"comment":"Line 7 iterates \"For each Sx in L\" but L is never defined; presumably this should be Y. Please correct the undefined variable.","section":"Fig. 4.4 (Algorithm 4)"},{"comment":"The definition of simple subgraph requires connectivity, but the prose in §3.3 lists only the entry/exit/internal properties and does not explicitly restate connectivity; the helper should check it directly.","section":"§3.3 and Fig. 4.2"},{"comment":"The phrase \"off-chain execution cannot not access\" should read \"cannot access\".","section":"§5.1"},{"comment":"There is a typo in the pseudocode: \"if (state state==’sex’)\" has a duplicated \"state\" and uses non-ASCII quotation marks; please clean up the formatting.","section":"§5.3"},{"comment":"The cost model multiplies gas constants (SLOAD=200, SSTORE=20000) by a factor M described as \"the size of state variables,\" but the units of M are not specified; clarify whether M is the number of 32-byte words or an arbitrary scaling factor, since EVM gas costs are per word, not per arbitrary data size.","section":"§6.2.4"},{"comment":"The subsection numbering is duplicated: there are two subsections labelled 3.2.1, which should be renumbered sequentially.","section":"§3.2"}],"recommendation":"major_revision","confidential_remarks":"The manuscript is a Master's thesis. Chapter 5's interface model builds on the authors' own prior work (Bodorik, Liu, Jutla 2021) without a clear delineation of the new contribution in this thesis; please ensure appropriate attribution and clear novelty statements. The central algorithm and theorem need correction before the paper can be considered publishable. If the authors can provide a corrected helper, a repaired or removed Theorem 1, and a small machine-checked evaluation, the core idea may be salvageable."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"The core idea here is genuinely reasonable: model a smart contract as an FSM, then look for subgraphs with exactly one entry and one exit as candidates for off-chain processing. That is a clean, intuitive heuristic, and the author is right that it is not present in the cited prior work on off-chaining or FSM-to-contract tools. The interface model in Chapter 5 and the cost-estimation workflow in Chapter 6 also address the right questions, and the use cases help illustrate the intended workflow. The author is also honest about some limitations, such as the cost model ignoring method invocation frequency (Section 7.1).\n\nBut the central algorithm does not hold up. The isSimpleSubgraph helper in Fig. 4.2 records S_start and S_end by overwriting, not by counting. If a subgraph has two entry nodes and the first entry node is also the exit node, the final loop can skip both and let the subgraph pass. That is a concrete counterexample to the claim that Algorithm 4 finds all simple subgraphs. Theorem 1, which the paper relies on for ordering and counting relationships between simple subgraphs, also has a flawed proof; the claim that the intersection of two simple subgraphs with more than one shared node must itself be simple is false for diamond-shaped graphs, exactly as the stress-test note says. Section 4.4 asserts the algorithm was 'verified' on many use-cases, but no code or data is shipped, so that claim is not checkable.\n\nThe cost model is also very rough: it assumes equal state-variable sizes, uses a fixed gas table, and does not include invocation frequency until the author concedes that in the limitations. That is fine for a thesis but not for a research claim about when to off-chain.\n\nSo the paper does not currently support its main contribution. The idea is worth revisiting with a corrected algorithm, a proper proof or a verified implementation, and a real evaluation on a few contracts. As it stands, I would not send it to peer review. It is not a waste of time for someone curious about off-chain candidate detection, but I would not cite it as a result.","headline":"The core idea is sensible, but the central algorithm has a concrete bug and there is no implementation or data to back it up; this reads like a thesis draft rather than a rigorous research contribution.","tokens_in":37367,"tokens_out":3214,"would_cite":false,"duration_ms":34774,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":false},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"The author claims that the parts of a smart contract worth moving off-chain can be found automatically as simple subgraphs of its FSM graph—connected subgraphs with one entry and one exit—and that a gas-based cost model then decides…","keywords":["finite state machine","smart contract","off-chain computation","simple subgraph","blockchain cost model","separation of concerns","hierarchical state machine"],"falsifier":"Build an FSM with states A, B, C, E, and D and transitions A->B->E->D and A->C->E->D. Two simple subgraphs are {A,B,E,D} and {A,C,E,D}; their intersection {A,E,D} is disconnected, so Theorem 1's claim that the shared nodes form a simple subgraph fails, and the count-based ordering of Algorithm 4 is unsupported on this graph.","tokens_in":36234,"feed_emoji":"⛓️","tokens_out":8628,"duration_ms":80533,"temperature":0.7,"pith_summary":"Blockchain smart contracts are cheap to trust but expensive to run, so the idea is to execute some parts off-chain. This thesis claims that the decision of which parts can be off-chained can be made automatically, at design time, from the graph of the contract's finite state machine. The algorithm looks for simple subgraphs—connected groups of states with exactly one entry and one exit—because their computation is self-contained until the exit transition, and therefore can be delegated and summarized at the boundary. The paper also supplies an interface protocol for on-chain/off-chain handoff and a gas-based cost model that tells a developer when the off-chain move actually saves money. If this is right, off-chaining stops being an ad hoc developer judgment and becomes a systematic, automatable step in smart-contract design.","feed_headline":"Simple subgraphs pick what moves off the blockchain","feed_subtitle":"An FSM algorithm flags single-entry, single-exit patterns and a gas model decides when off-chain execution pays.","key_machinery":"The load-bearing object is the simple subgraph: a connected subgraph of the FSM graph with exactly one entry node (no internal node except the entry has edges from outside the subgraph) and exactly one exit node (no internal node except the exit has edges to outside). This single-entry/single-exit property means execution inside the subgraph is informationally sealed until the exit transition, so its entire run can be summarized by inputs at the entry and outputs at the exit. Algorithm 4 uses brute-force subset enumeration plus an isSimpleSubgraph test; Theorem 1's overlap claims organize the results into a containment count so candidates containing other candidates are presented first. The interface protocol and gas model are secondary machinery built on that boundary property.","core_discovery":"On the paper's own terms, the central discovery is that the vague notion of a pattern worth processing off-chain has a graph-theoretic characterization: a simple subgraph of the FSM state graph, i.e., a connected subgraph whose only connection to the outside world is one entry state and one exit state. Algorithm 4 enumerates all subsets of states, keeps those that pass the simple-subgraph test, and for each one counts how many other simple subgraphs it contains, yielding an order in which the developer should consider candidates. The paper further claims that once a simple subgraph is selected, its execution can be replaced by a hierarchical state-machine node, that an automatically generated interface can move the computation off-chain and back with attestation by affected parties, and that an analytical gas-cost model can determine whether the off-chain path is cheaper than the on-chain path. The escrow-deposit example is used to show the cost model can reject an off-chain candidate when on-chain data must be read repeatedly.","pith_inferences":["The simple-subgraph criterion is graph-structural, not blockchain-specific; the same single-entry/single-exit test could identify delegable units in state-machine models of other replicated systems, provided the boundary can be summarized.","The paper's Theorem 1 overlap claim is the fragile point; a modified algorithm that checks connected overlap, or that simply omits the count-based ordering, would preserve the main idea while escaping the diamond counterexample.","The cost model is static and linear; an immediate extension—weighting each pattern method by invocation frequency and measuring real EVM gas with a compiler—would turn the illustrative arithmetic into a decision tool.","The paper's own caveat that attestation semantics are application-specific suggests a natural next step: classify off-chain candidates by whether their results are digitally signable evidence, since only those preserve trust when the exit transition writes back."],"forward_implications":["If the algorithm is correct, the what-to-move-off-chain question reduces to scanning the FSM graph for simple subgraphs; no semantic analysis of method bodies is needed for candidate identification.","Because of the single-entry/single-exit property, any off-chain execution can be bracketed: blockchain data is read at the entry, cached off-chain, and written back with attestation at the exit.","The interface protocol implies each off-chain candidate needs only two generated hooks—an event that carries parameters plus blockchain data into the bridge, and a completion event that carries attested results back.","If a chosen simple subgraph contains smaller simple subgraphs, those are off-chained automatically, which reduces the developer's decision set to maximal candidates first.","The escrow-deposit gas calculation shows the method can reject a candidate: when off-chain processing must read on-chain balances, the SLOAD and SSTORE costs make off-chaining more expensive than staying on-chain."],"supporting_citations":[{"why":"Provides the FSM-to-smart-contract transformation whose graph representation the pattern-finding algorithm operates on.","marker":"(Mavridou & Laszka, 2018)"},{"why":"Defines the off-chain storage/computation trade-off and the content-addressable storage baseline the paper assumes.","marker":"(Eberhardt & Tai, 2017)"},{"why":"Categorizes off-chaining models and supplies the hybrid off-chain computation concept the paper adopts.","marker":"(Eberhardt & Tai, 2018)"},{"why":"Supplies the hierarchical state-machine definition used to replace a simple subgraph with a single node.","marker":"(Yannakakis M, 2000)"},{"why":"States the companion interface and attestation model that Chapter 5's on/off-chain protocol builds on.","marker":"(Bodorik, et al. 2021)"},{"why":"Provides the buyer–seller escrow use case used to test Algorithm 4 and the gas cost model.","marker":"(Asgaonkar & Krishnamachar, 2019)"},{"why":"Provides the South African real-estate transaction case study used to validate the simple-subgraph findings.","marker":"(Tilbury & Rey, 2019)"}],"fun_headline_variants":["FSM flags cheap off-chain moves","Graph test picks off-chain patterns","Gas model decides off-chain execution","Single-entry subgraphs move off-chain"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The counting and ordering step in Algorithm 4 depends on a geometric fact about the FSM graph: any two candidate subgraphs that share more than one state must share a connected block of states that itself has one entry and one exit. That fact fails for a diamond-shaped graph where two parallel paths share only the start, the finish, and one middle state.","fun_headline_variants_meta":{"raw":{"variants":["FSM flags cheap off-chain moves","Graph test picks off-chain patterns","Gas model decides off-chain execution","Single-entry subgraphs move off-chain"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000191,"raw_usage":{"total_tokens":1321,"prompt_tokens":901,"completion_tokens":420,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":517,"completion_tokens_details":{"reasoning_tokens":371}},"tokens_in":517,"tokens_out":420,"duration_ms":6156,"temperature":1.0,"reasoning_tokens":371,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-07T11:36:53.233112+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Build an FSM with states A, B, C, E, and D and transitions A->B->E->D and A->C->E->D. Two simple subgraphs are {A,B,E,D} and {A,C,E,D}; their intersection {A,E,D} is disconnected, so Theorem 1's claim that the shared nodes form a simple subgraph fails, and the count-based ordering of Algorithm 4 is unsupported on this graph.","supporting_citations":[{"cited_title":"Business Process Models of Blockchain and South African Real Estate Transactions,","cited_arxiv_id":null,"evidence_quote":"Provides the South African real-estate transaction case study used to validate the simple-subgraph findings."}],"review_version":1}