{"id":"a24053c2-02a0-40fb-932a-2de3ea4395b5","arxiv_id":"2506.14124","paper_version":2,"verdict":"CONDITIONAL","confidence":"HIGH","novelty_score":8.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":0,"one_line_summary":"A generic compiler transforms any permissioned consensus protocol into a proof-of-stake permissionless protocol with the same fault tolerance, plus accountability.","lead":"This paper presents a generic compiler that turns any permissioned consensus protocol into a proof-of-stake protocol for the quasi-permissionless, partially synchronous setting, preserving key properties and adding accountability. It matters because it could automate the transfer of decades of permissioned consensus theory into practical permissionless blockchain systems.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The compiler's map_stake instantiates the permissioned protocol with exactly T permissioned-ids, so the 'any permissioned protocol' claim silently requires |Π| = T; the paper states no such condition.","rationale":"The paper is a serious and mostly rigorous contribution: the system model is explicit, the main proofs are detailed, and the claims are honestly scoped to quasi-permissionless and partial synchrony. The reader's weakest assumption correctly identifies the constant-total-stake axiom as important: map_stake converts every unit of stake into a permissioned-id, so a variable total stake would change the number of simulated protocol instances and break the epoch-based induction. My stress-test sharpens this into a more precise condition: even with a constant total stake, Algorithm 1 fixes the simulated process set to [1, T], while the input permissioned protocol P has its own process set Π of size n. If n ≠ T, the compiler cannot execute P as a black box with its assumed properties; it instead executes a protocol with a different number of processes. The paper does not state or prove n = T, and Section 2's restriction only says the total stake is constant, not that it equals the permissioned protocol's process count. This unstated matching condition is load-bearing because every preservation theorem (consistency, liveness, composable safety, accountability, message complexity) ultimately depends on each epoch being a valid execution of P with its original fault-tolerance and liveness parameters. A concrete instantiation with a 4-process permissioned protocol and total stake 5 would expose the mismatch and show whether the transformation is well-defined. Because the issue is a scope restriction that could be fixed by an explicit assumption or a generalized compiler, a conditional verdict is appropriate rather than a rejection of the paper's core techniques.","tokens_in":42309,"tokens_out":15352,"duration_ms":167278,"concrete_test":"Instantiate Algorithm 1 with a permissioned protocol P having n = 4 processes and a stake function S satisfying the paper's axioms with constant total stake T = 5. Execute map_stake and lines 63-65: they initialize P for permissioned-ids 1 through 5. Check whether this is a legitimate execution of P (i.e., whether P's correctness proofs for n = 4 apply) and whether Theorem 9's proof remains valid under this mismatch. If it does not, the theorems require an explicit |Π| = T condition, or the compiler must be modified to handle general n.","verdict_should_be":"CONDITIONAL","load_bearing_attack":"Algorithm 1 defines the simulated permissioned process set as the integer range [1, T] (lines 33, 38, 63), where T is the constant total stake from Section 2. But an input permissioned protocol P is a formal object with a fixed process set Π of size n (Appendix B.1). Unless n = T, the 'black-box' execution of P is actually an execution of a different protocol with a different number of processes, and the consistency, liveness, and quit-enhanced preservation lemmas (Lemma 16, Prop. 18, Theorem 9) do not apply, because they rely on P's guarantees for its own process count. The paper does not state |Π| = T, and the constant-total-stake axiom does not imply it. Even interpreting P as a family parameterized by n, the compiler fixes n = T, which is an unstated restriction on the central claim's scope. This is load-bearing: the epoch-based induction in Theorem 9 requires each simulated epoch to be a valid execution of P with the process set [1, T], and the preservation proofs all inherit that requirement.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper introduces a compiler T that takes a permissioned consensus protocol P satisfying consistency and liveness in the partially synchronous setting and outputs a quasi-permissionless proof-of-stake protocol T(P). The compiler executes P in epochs over permissioned-ids [1,T], where T is the constant total stake, and uses epoch-ending transactions, quorum signatures, and fully-certified logs to transition between epochs. The main theorems claim preservation of consistency, liveness, optimistic responsiveness, composable log-specific safety properties, and message complexity, plus a new accountability guarantee that holds even if P is not accountable. The formal model and detailed proofs are in Appendices A-C.","tokens_in":42524,"tokens_out":18257,"duration_ms":200115,"significance":"The contribution is potentially significant: a generic, closed-box permissioned-to-PoS compiler would allow permissioned protocol results to be lifted to the quasi-permissionless setting without bespoke reconfiguration designs. The paper's formal model is detailed, and the appendix proofs are mostly self-contained, with explicit preservation lemmas for quit-enhanced protocols. The accountability-by-construction result and the preservation of composable log-specific safety properties are notable strengths. However, two load-bearing scope gaps--the unstated requirement that the permissioned protocol's process set has size equal to the total stake T, and the unmodeled stake-locking assumption--currently limit the validity of the 'any permissioned protocol' claim and the liveness theorem. If these are fixed, the paper would be a strong contribution.","major_comments":[{"comment":"The compiler instantiates the input permissioned protocol P with the process set [1,T], where T is the constant total stake from §2, but P is formally defined in App. B.1 as a tuple with a fixed process set Π of size n. Unless n=T, the simulated 'execution of P' in each epoch is not an execution of P, and Lemmas 16-17 and Proposition 18, which are stated for P's own Π, do not apply. The constant-total-stake axiom does not imply n=T. Please either state n=T as a hypothesis of the main theorems, or define the input as a permissioned protocol family with properties holding for every process-set size, and adjust the 'any permissioned protocol' wording throughout.","section":"§4.2, Algorithm 1 (lines 33, 38, 63); App. B.1"},{"comment":"The liveness proof assumes that the correct validators of an epoch remain active throughout the l-overlap interval. In the formal model, S(L,·) is a function of the current log and only L.total_stake is constant; individual stakes can change via transactions finalized by P. The quasi-permissionless activity guarantee is conditional on positive stake in the current log, so a correct validator whose stake is transferred away mid-epoch is not guaranteed to remain active, and the simulated permissioned execution may lack a quorum of correct active processes. The paper should either model stake as locked for the duration of an epoch, or restrict the stake function/transactions so that validator sets cannot change within an epoch, or prove liveness without relying on continued activity.","section":"§2 ('Stake', 'Quasi-permissionless setting'); App. C.5 (Lemma 40, Theorem 11)"}],"minor_comments":[{"comment":"The claim that the modified transformation satisfies EAAC is stated informally and without a formal definition, theorem, or proof; please either provide a rigorous treatment or explicitly mark this as an informal extension or conjecture.","section":"Sec. 5, 'On establishing the EAAC property'"},{"comment":"The sentence 'Since P satisfies P against a ρ-bounded static adversary' should read 'Since P satisfies S against...'.","section":"App. C.4, proof of Thm. 10"},{"comment":"The equality 'GST = GST′’' contains a stray quotation mark; the intended statement is 'GST = GST′'.","section":"App. B.4, proof of Prop. 18"},{"comment":"In the second optimistic-responsiveness case, the proof derives finality by time max(τ,GST)+2δ+ℓ_or and then states the bound as 2δ+2ℓ_or; the larger bound is safe, but the two bounds should be presented consistently.","section":"App. C.5, proof of Thm. 11"},{"comment":"The phrase 'quasi-permissioned' should be 'quasi-permissionless'.","section":"Sec. 5"}],"recommendation":"major_revision","confidential_remarks":"The n=T mismatch is the most serious issue: the central 'any permissioned protocol' claim is not what the construction actually delivers. The stake-locking question is also likely to require a substantive model addition or clarification. If the authors can close these gaps without changing the main idea, the paper is likely to be a strong contribution; otherwise the current version overclaims its scope."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"The paper is worth your time. It gives the first closed-box compiler from permissioned to quasi-permissionless PoS consensus, preserving consistency, ℓ-liveness, optimistic responsiveness, composable log-specific safety properties, and message complexity, plus adding accountability. The quit-enhanced protocol analysis is a genuine technical contribution, and the appendix proofs are detailed and structurally sound. The authors are honest about the quasi-permissionless restriction and about the EAAC extension being informal. I'd send this to a serious referee.\n\nThe soft spot that matters: the compiler instantiates the permissioned protocol with exactly T permissioned-ids, where T is the constant total stake. But the input permissioned protocol is a formal object with a fixed process set of size n. If n ≠ T, the 'black-box' execution is not an execution of P, and the preservation lemmas (which rely on P's guarantees for its own process count) don't apply. The paper never states n = T, nor does it say the input is a family parameterized by n. This is load-bearing for the central claim, though probably fixable: either require the permissioned protocol to be defined for all finite process counts (as is standard for algorithms, if not for the formal model), or make T part of the input and require the protocol to meet its guarantees at that size. As written, the abstract's 'any permissioned protocol' is not quite true.\n\nOther issues are minor: the constant-total-stake assumption is explicit but worth flagging as a limitation, and the EAAC section is informally presented, which the authors admit. The static-adversary assumption is standard for this line of work.\n\nOn balance: the core construction and the main theorems for a fixed matching size appear correct, and the compiler idea is a real step forward. The paper needs a revision that either generalizes the input model or states the size condition explicitly. I'd accept for peer review with that expectation.","headline":"A genuine closed-box compiler result, but the 'any permissioned protocol' claim hides a load-bearing size-matching condition between the protocol's process count and the constant total stake.","tokens_in":43018,"tokens_out":3471,"would_cite":true,"duration_ms":42541,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":["68M14"],"pacs":[],"model":"deepseek-v4-flash","headline":"This paper presents a generic compiler that turns any permissioned consensus protocol into a proof-of-stake one, preserving the main safety and liveness properties and adding accountability.","keywords":["permissioned consensus","proof-of-stake","quasi-permissionless","generic compiler","epoch-based reconfiguration","accountability","partial synchrony"],"falsifier":"Run the compiled protocol with a stake function that mints or burns stake so that total stake differs between two logs, e.g., a reward transaction in the first epoch increases total stake for the second. Then $map\\_stake$ produces a different number of permissioned identities in the second epoch, so the claim that each epoch faithfully simulates the original permissioned protocol $P$ can no longer hold; exhibiting an actual consistency or liveness violation in such an execution would refute the paper's generality claim.","tokens_in":42145,"feed_emoji":"🪙","tokens_out":7487,"duration_ms":77812,"temperature":0.7,"pith_summary":"This paper aims to settle a long-standing transfer problem: how to turn any permissioned consensus protocol, designed for a fixed known set of validators, into a proof-of-stake permissionless protocol without redesigning it. Its contribution is a generic compiler that works in the partially synchronous model and outputs a quasi-permissionless protocol, meaning stake holders are assumed to be active but the validator set may change over time. If the input protocol satisfies consistency, liveness, optimistic responsiveness, or any composable log-specific safety property, the output satisfies the same property against the same fraction of faulty stake, and message complexity is preserved asymptotically. The output is also accountable even when the input was not: any consistency violation yields proofs of guilt against stakeholders controlling at least $1-2\\rho$ of the stake. A sympathetic reader would care because the result promises that proof-of-stake versions of established permissioned protocols, including DAG-based ones, can be obtained and analyzed generically rather than one protocol at a time.","feed_headline":"A compiler lifts permissioned consensus into proof-of-stake","feed_subtitle":"Same fault tolerance, safety, liveness and responsiveness carry over, plus accountability","key_machinery":"The load-bearing mechanism is the epoch-ending block, produced by a fully-certified log. A log is certified when a quorum of the epoch's validators, holding at least $(1-\\rho)T$ stake, signs it, and fully certified when every epoch prefix is certified; correct processes adopt only fully-certified logs. Since any two quorums intersect in a correct validator, two conflicting fully-certified logs cannot arise unless the adversary exceeds the allowed stake fraction. Epoch length is set to $ED = \\ell + \\Delta$ after GST so that all correct validators of an epoch overlap for at least the liveness parameter $\\ell$, which lets the underlying $P$ finalize new transactions. The other key object is the quit-enhanced permissioned protocol: a closed-box interface extension that lets correct processes stop participating, with preservation lemmas showing that consistency, liveness, responsiveness, and log-specific safety survive the extension.","core_discovery":"The central claim is the existence of a closed-box, epoch-based transformation $T$ that compiles any permissioned protocol $P$ into a proof-of-stake protocol $T(P)$ in the quasi-permissionless and partially synchronous setting. In each epoch a fresh instance of $P$ is run, with the validator set and genesis log taken from the finalized log of the previous epoch; every unit of stake is mapped to one permissioned identity, so a process with $s$ units simulates $s$ copies of $P$. The transformation handles the fact that correct processes quit at epoch boundaries by analyzing a quit-enhanced version of $P$, and it proves that quitting preserves the relevant properties. It then shows by induction across epochs that consistency and composable log-specific safety properties transfer, that liveness transfers with a modest blow-up in the time parameter, and that accountability—identification of culprits after a consistency violation—holds even if the original protocol had no accountability guarantee.","pith_inferences":["The constant-total-stake assumption ($L.total\\_stake = T$ for every log) is the cleanest point to attack: real stake functions change under issuance, slashing, and burning, so a natural next step is a variant that allows total stake to change only at epoch boundaries.","Because the compiler preserves every composable log-specific safety property simultaneously, application-level predicates such as transaction-validity rules transfer automatically, which may make the transformation useful for smart-contract state machines and not just a core ledger.","The compiler's accountability proof of guilt is derived from the same two conflicting fully-certified logs, suggesting that in the output protocol finality and accountability are inseparable even though neither is required of the input.","One testable adaptation would let the epoch length parameter $\\ell$ be tuned adaptively per epoch; whether that can be done without breaking the $\\ell+\\Delta$ overlap argument is not addressed in the paper."],"forward_implications":["Existing permissioned DAG-based protocols can be lifted to quasi-permissionless proof-of-stake protocols with the same fault tolerance, a transfer the paper says had not previously been formally analyzed.","The output protocol is $(1-2\\rho)$-accountable, so a consistency violation always leaves evidence sufficient for slashing the responsible stakeholders.","Because any consensus protocol needs a quadratic number of messages in the worst case, the extra quadratic signature round added by the compiler does not change asymptotic message complexity.","Protocol designers can prove properties in the simpler permissioned model and inherit them in the permissionless setting, including every composable log-specific safety property at once.","All transferred properties hold with the same resilience $\\rho$ in partial synchrony, so the compiler does not ask for a stronger honest majority."],"supporting_citations":[{"why":"Defines the quasi-permissionless setting and the permissionlessness hierarchy that justifies the paper's compromise to this setting.","marker":"[68]"},{"why":"Establishes the epoch-based pattern of running permissioned instances with an epoch-ending transition that the compiler generalizes.","marker":"[79]"},{"why":"Provides the partially synchronous model in which all protocols and properties are defined.","marker":"[43]"},{"why":"Gives the quadratic lower bound on consensus message complexity used to argue the compiler adds no asymptotic overhead.","marker":"[39]"},{"why":"Supplies the safety-property formulation underlying the paper's composable log-specific safety properties.","marker":"[4]"},{"why":"Illustrates a concrete permissioned protocol whose quit-enhanced analysis the compiler must handle, showing why naive epoch restart fails.","marker":"[19]"}],"fun_headline_variants":["Compiler turns any permissioned consensus into proof-of-stake","Generic compiler: permissioned to proof-of-stake, same fault tolerance","Compiler: permissioned to proof-of-stake, same safety+liveness, plus accountability","Epoch-based compiler turns permissioned protocols into proof-of-stake","From permissioned to proof-of-stake: a generic compiler with accountability"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The compiler assumes that every possible log has the same total amount of stake $T$; if the total stake could change, the mapping from stake units to simulated permissioned identities would change between epochs and the proof structure would break.","fun_headline_variants_meta":{"raw":{"variants":["Compiler turns any permissioned consensus into proof-of-stake","Generic compiler: permissioned to proof-of-stake, same fault tolerance","Compiler: permissioned to proof-of-stake, same safety+liveness, plus accountability","Epoch-based compiler turns permissioned protocols into proof-of-stake","From permissioned to proof-of-stake: a generic compiler with accountability"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.00089,"raw_usage":{"total_tokens":3783,"prompt_tokens":831,"completion_tokens":2952,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":447,"completion_tokens_details":{"reasoning_tokens":2857}},"tokens_in":447,"tokens_out":2952,"duration_ms":22364,"temperature":1.0,"reasoning_tokens":2857,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-07T00:18:19.304505+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run the compiled protocol with a stake function that mints or burns stake so that total stake differs between two logs, e.g., a reward transaction in the first epoch increases total stake for the second. Then $map\\_stake$ produces a different number of permissioned identities in the second epoch, so the claim that each epoch faithfully simulates the original permissioned protocol $P$ can no longer hold; exhibiting an actual consistency or liveness violation in such an execution would refute the paper's generality claim.","supporting_citations":[{"cited_title":"Hybrid consensus: Efficient consensus in the permissionless model","cited_arxiv_id":null,"evidence_quote":"Establishes the epoch-based pattern of running permissioned instances with an epoch-ending transition that the compiler generalizes."},{"cited_title":"Bounds on information exchange for byzantine agreement","cited_arxiv_id":null,"evidence_quote":"Gives the quadratic lower bound on consensus message complexity used to argue the compiler adds no asymptotic overhead."}],"review_version":1}