{"id":"777de7b3-a4aa-47bd-bd36-11ce898f0696","arxiv_id":"2606.04912","paper_version":1,"verdict":"UNVERDICTED","confidence":"LOW","novelty_score":7.0,"correctness_risk":"unknown","formal_verification":"none","parameter_count":0,"one_line_summary":"TeeDAO couples BFT-ordered governance with heterogeneity-aware DPSS and MPC to manage dynamic committees of heterogeneous TEEs, with a prototype showing 1.8x throughput gains in 61-node clusters.","lead":"TeeDAO is a three-layer framework that automatically organizes multiple heterogeneous Trusted Execution Environments using BFT governance combined with distributed proactive secret sharing and multi-party computation. A smart generalist might read it to see one approach for reducing single-vendor hardware risks in secure computing systems.","discovery_kind":"new_method","skeptic_critique":{"model":"grok-4.3","headline":"Coupling of BFT governance with heterogeneity-aware DPSS lacks explicit mechanism for cross-TEE attestation normalization in secret recovery/resharing","rationale":"The reader's weakest_assumption directly identifies the same coupling point. Because the full manuscript is referenced but the load-bearing step (attestation-to-DPSS handoff) is not evidenced even at the abstract level, the concern remains load-bearing and the unverdicted status is appropriate.","tokens_in":1754,"tokens_out":351,"duration_ms":15145,"concrete_test":"In the prototype/integration section, extract the pseudocode or description of how attestation results from SGX, TDX, and CSV are processed before being passed to the DPSS resharing routine; check whether a single normalization function or common attestation verifier is defined. If absent or if each TEE path uses independent verification without BFT-enforced agreement on the normalized output, the consistency claim does not hold.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim requires that attestation-driven committee changes are consistently reflected in DPSS recovery, resharing, and MPC across SGX/TDX/CSV without new vulnerabilities. The abstract states that COBRA's DPSS is integrated with HotStuff and \"adapted\" for the three TEEs, but provides no description of how attestation outputs (which differ in format, measurement, and revocation semantics) are normalized into a common committee view or how the proactive resharing protocol accounts for TEE-specific timing or capability differences. If the adaptation assumes uniform attestation semantics or omits a cross-TEE verification step inside the BFT-ordered state machine, desynchronization or expanded attack surface becomes possible precisely when the committee is dynamic.","agreement_with_reader":"agree"},"referee_report":{"model":"grok-4.3","summary":"The paper introduces TeeDAO, a three-layer framework for organizing heterogeneous TEEs (Intel SGX, TDX, Hygon CSV) that couples BFT-ordered governance (HotStuff) with heterogeneity-aware DPSS (adapted from COBRA) and MPC. This ensures attestation-driven committee changes are reflected in secret recovery, resharing, and computation for dynamic committees, providing unified interfaces with guarantees of availability, integrity, and confidentiality. A prototype implementation is evaluated, claiming up to 1.8x higher key-value store throughput in a 61-node cluster versus state-of-the-art systems, with efficient autonomous management and <18% MPC overhead.","tokens_in":1910,"tokens_out":481,"duration_ms":17171,"significance":"If the core integration holds, TeeDAO would advance distributed-trust systems by enabling resilient use of multiple TEE implementations without centralized management, dispersing attack surfaces while maintaining performance in applications like key-value stores. The prototype evaluation and explicit coupling of BFT with DPSS/MPC represent concrete engineering contributions that could inform future heterogeneous TEE deployments.","major_comments":[{"comment":"Abstract, paragraph on framework coupling: the central claim that 'attestation-driven committee changes are consistently reflected in secret recovery, resharing, and computation across a dynamic committee of heterogeneous TEEs' requires an explicit mechanism for normalizing attestation outputs (differing in format, measurement, and revocation semantics across SGX/TDX/CSV) into a common committee view inside the BFT state machine. No such normalization step or handling of TEE-specific timing/capability differences is described, which is load-bearing for the consistency guarantee and leaves open the possibility of desynchronization or expanded attack surface precisely when the committee is dynamic.","section":"Abstract"}],"minor_comments":[{"comment":"Abstract: performance claims (1.8x throughput, <18% overhead) supply no methods details, error bars, baseline definitions, or data exclusion rules, preventing verification of the evaluation results.","section":"Abstract"},{"comment":"Abstract: the three-layer framework is introduced without a high-level diagram or enumeration of the layers, making the architecture description harder to follow.","section":"Abstract"}],"recommendation":"major_revision","confidential_remarks":null},"author_rebuttal":{"model":"grok-4.3","summary":"We thank the referee for the constructive feedback on TeeDAO. We address the single major comment below and will revise the manuscript accordingly.","responses":[{"response":"We agree that the abstract presents a high-level claim without sufficient detail on attestation normalization. The manuscript describes a heterogeneity-aware DPSS adaptation and its coupling to HotStuff but does not explicitly document the normalization layer that maps SGX/TDX/CSV attestation outputs (formats, measurements, revocation semantics) or handles timing and capability differences into a unified BFT committee view. We will revise by adding a dedicated subsection on attestation normalization (including a common parser, standardized measurement mapping, revocation checks, and epoch-based synchronization to avoid desynchronization) and will update the abstract to reference this mechanism. This addresses the load-bearing consistency concern.","revision_made":"yes","referee_comment":"[Abstract] Abstract, paragraph on framework coupling: the central claim that 'attestation-driven committee changes are consistently reflected in secret recovery, resharing, and computation across a dynamic committee of heterogeneous TEEs' requires an explicit mechanism for normalizing attestation outputs (differing in format, measurement, and revocation semantics across SGX/TDX/CSV) into a common committee view inside the BFT state machine. No such normalization step or handling of TEE-specific timing/capability differences is described, which is load-bearing for the consistency guarantee and leaves open the possibility of desynchronization or expanded attack surface precisely when the committee is dynamic."}],"tokens_in":1409,"tokens_out":322,"duration_ms":22556,"standing_objections":[]},"desk_editor":{"model":"grok-4.3","letter":"TeeDAO gives a working prototype that combines BFT governance with heterogeneity-aware DPSS and MPC for mixed TEEs from three vendors. The system reports up to 1.8x higher key-value store throughput on a 61-node cluster versus prior systems, plus under 18% overhead on MPC tasks. That is concrete evidence of a deployable setup rather than just a design sketch.\n\nThe three-layer framework and the specific integration of HotStuff with COBRA's DPSS, adapted for SGX, TDX, and CSV, is the main new piece. It handles dynamic committees where attestation triggers changes that should propagate into secret recovery, resharing, and computation. The evaluation on real hardware from different vendors is a step beyond most single-vendor TEE papers.\n\nThe soft spot is the coupling mechanism itself. The abstract says the DPSS is adapted and that attestation-driven changes are reflected consistently, but it gives no description of how the differing attestation formats, measurements, and revocation rules from the three TEEs are normalized into one committee view inside the BFT state machine. Without that step, or TEE-specific timing adjustments in resharing, desynchronization or added attack surface remains possible exactly when the committee changes. The stress-test note on this point holds up from the given description.\n\nThe paper is for people working on distributed confidential computing who need to move past single-TEE trust. It has enough implementation and numbers to deserve referee time, even with the attestation gap. I would send it for review.","headline":"TeeDAO ships a real prototype tying HotStuff BFT to adapted COBRA DPSS across SGX/TDX/CSV with 1.8x throughput on 61 nodes, but the cross-TEE attestation normalization for dynamic committees is not detailed enough to verify consistency.","tokens_in":2403,"tokens_out":411,"would_cite":false,"duration_ms":20405,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"grok-4.3","headline":"TeeDAO couples BFT governance with heterogeneity-aware DPSS and MPC to maintain consistent secrets across changing committees of different TEEs.","keywords":["TEE","decentralized autonomous organization","BFT consensus","distributed proactive secret sharing","secure multi-party computation","heterogeneous TEEs","attestation","dynamic committee"],"falsifier":"Demonstration of inconsistent secret recovery or a new vulnerability arising after an attestation-based committee change in a setup with mixed TEE types.","tokens_in":2662,"feed_emoji":"🔒","tokens_out":634,"duration_ms":25990,"temperature":0.7,"pith_summary":"The paper introduces TeeDAO, a three-layer framework designed to organize multiple heterogeneous TEE instances into a decentralized system. It integrates BFT consensus for governance with distributed proactive secret sharing and multi-party computation that handles differences between TEE types. This setup ensures that when the committee of TEEs changes based on attestations, the secrets can be recovered and reshared securely without interruption. A reader would care because it addresses the vulnerability of depending on one TEE implementation while avoiding centralized control in distributed trust systems.","feed_headline":"TeeDAO ensures consistent secrets across heterogeneous TEE committees","feed_subtitle":"It couples BFT governance with DPSS and MPC so secret recovery and computation stay intact when committees change via attestations.","key_machinery":"The coupling of BFT-ordered governance with heterogeneity-aware DPSS and MPC that reflects attestation-driven committee changes in secret management and computation.","core_discovery":"TeeDAO is a novel three-layer framework that automatically organizes multiple heterogeneous TEE instances and provides unified interfaces to support diverse applications, while ensuring long-term guarantees of availability, integrity, and confidentiality. TeeDAO couples BFT-ordered governance with heterogeneity-aware Distributed Proactive Secret Sharing (DPSS) and Secure Multi-Party Computation (MPC) so that attestation-driven committee changes are consistently reflected in secret recovery, resharing, and computation across a dynamic committee of heterogeneous TEEs.","pith_inferences":["The framework could allow applications to operate across multiple TEE vendors without increasing attack surface from any single implementation.","Similar coupling of consensus and secret sharing might apply to other dynamic committee systems beyond TEEs.","Testing with a wider range of TEE types would check whether the heterogeneity handling generalizes."],"forward_implications":["Evaluations show up to 1.8x higher key-value store throughput in a 61-node cluster compared to prior systems.","It supports integration with Intel SGX, TDX, and Hygon CSV.","It achieves efficient autonomous management of the committee.","It incurs minimal computation overhead of less than 18% for multi-party computation tasks."],"fun_headline_variants":["TeeDAO keeps secrets consistent in dynamic heterogeneous TEEs","DPSS and BFT couple for TeeDAO's heterogeneous TEE secret management","TeeDAO automates secret resharing in attestation-driven TEE committees","Consistent computation and recovery across TeeDAO's heterogeneous TEEs"],"cache_read_input_tokens":2112,"weakest_assumption_plain":"Attestation-driven committee changes can be consistently reflected in secret recovery, resharing, and computation without introducing new vulnerabilities from TEE heterogeneity or implementation differences.","fun_headline_variants_meta":{"raw":{"variants":["TeeDAO keeps secrets consistent in dynamic heterogeneous TEEs","DPSS and BFT couple for TeeDAO's heterogeneous TEE secret management","TeeDAO automates secret resharing in attestation-driven TEE committees","Consistent computation and recovery across TeeDAO's heterogeneous TEEs"]},"model":"grok-4.3","cost_usd":0.004947,"raw_usage":{"total_tokens":2439,"prompt_tokens":705,"num_sources_used":0,"completion_tokens":66,"cost_in_usd_ticks":49474500,"prompt_tokens_details":{"text_tokens":705,"audio_tokens":0,"image_tokens":0,"cached_tokens":256},"completion_tokens_details":{"audio_tokens":0,"reasoning_tokens":1668,"accepted_prediction_tokens":0,"rejected_prediction_tokens":0}},"tokens_in":705,"tokens_out":66,"duration_ms":13178,"temperature":1.0,"reasoning_tokens":1668,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-06-28T05:38:41.679621+00:00","model_set":{"reader":"grok-4.3"},"falsifier":"Demonstration of inconsistent secret recovery or a new vulnerability arising after an attestation-based committee change in a setup with mixed TEE types.","supporting_citations":[],"review_version":1}