{"id":"078bdf91-bd78-4cbb-b01f-53986af2ac53","arxiv_id":"2607.04032","paper_version":1,"verdict":"CONDITIONAL","confidence":"HIGH","novelty_score":6.5,"correctness_risk":"medium","formal_verification":"none","parameter_count":2,"one_line_summary":"DWB buffers and randomly settles recipient balance updates while BTBE buckets addresses, giving probabilistic unlinkability for TEE token transfers without full ORAM cost.","lead":"Two domain-specific data structures (DWB and BTBE) hide which storage keys a confidential token contract touches during transfers, so observers cannot link senders to recipients from access patterns alone. The designs have been shipped on Secret Network tokens holding over $10M and add only modest gas cost versus naive SNIP-20.","discovery_kind":"new_method","skeptic_critique":{"model":"grok-4.5","headline":"Anonymity-set size rests on the geometric model assuming every transfer triggers a uniform random settle; low volume or high reuse can shrink the practical candidate set, as the paper itself notes in §6.5.","rationale":"The reader correctly isolates the volume dependence of the geometric anonymity claim as the softest link; that dependence is both mathematically load-bearing for the strongest quantitative statement and explicitly flagged by the authors. No deeper internal contradiction (e.g., an unhandled side-channel that would collapse the constant-time or phony-write arguments, or a flaw that would make the BTBE buckets ineffective) surfaces on a careful reading of R1–R6, the DWB/BTBE constructions, or the probability derivation. The open implementation, 26 % gas overhead, and live migration of >$10 M of tokens supply independent practical support. Hence the CONDITIONAL verdict and the identified weakest assumption stand; the proposed simulation merely quantifies the already-recognized caveat rather than overturning the systems contribution.","tokens_in":12673,"tokens_out":569,"duration_ms":53318,"concrete_test":"Replay a realistic transfer trace (mainnet logs of the upgraded tokens, or a Zipf-distributed synthetic sequence matching observed volume and recipient reuse) against the open reference implementation with k=64; record the empirical CDF of settlement lags n and the size of the candidate transfer set at each observed balance-bucket write. If the n that reaches 99.5 % settlement falls well below ~300 or the median candidate set is ≪100, the headline anonymity figures do not hold under real traffic.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim’s probabilistic anonymity (e.g., n≈336 transfers for 99.5 % confidence that a given entry has settled when k=64) is derived from P=1-((k-1)/k)^n under the assumption that the buffer stays saturated and every subsequent execution independently selects a uniform random entry to settle. In the actual DWB dynamics (R2–R5), a settle occurs only on insertion of a new distinct recipient (or forced owner settle); accumulation (R3) and phony writes suppress eviction. Consequently the effective settling rate can be substantially lower than 1/k, and under low organic volume an adversary can more easily dominate the unknown buffer slots. The paper acknowledges exactly this dependence (“during low-activity periods, settlement intervals shrink and anonymity guarantees weaken,” §6.5) yet supplies neither a refined model that incorporates the insertion fraction f nor any measurement of realized n on mainnet traffic. The claimed anonymity-set sizes therefore remain conditional on traffic patterns that are not guaranteed.","agreement_with_reader":"agree"},"referee_report":{"model":"grok-4.5","summary":"The paper addresses storage-access-pattern linkage of senders and recipients in TEE-based confidential token contracts (e.g., Secret Network SNIP-20). It introduces two domain-specific structures: the Delayed Write Buffer (DWB), a fixed-capacity table that buffers pending recipient updates and randomly settles one entry per transfer once saturated, and the Bitwise-Trie of Bucketed Entries (BTBE), which groups balances/histories into constant-size buckets under a secret-keyed hash trie. Together with phony writes, constant-time search, accumulation of repeated recipients, and a private push-notification scheme (Counter/TxHash/Bloom modes), the design aims to break direct storage-key correlation while preserving the ERC-20-like interface. A reference implementation was deployed to 42 mainnet tokens securing >USD 10 M, with measured worst-case gas overhead of 26 % relative to the naïve baseline. Privacy is claimed via the elementary geometric settling probability 1-((k-1)/k)^n (illustrated for k=64 yielding n≈336 at 99.5 % confidence).","tokens_in":12968,"tokens_out":1167,"duration_ms":26391,"significance":"If the probabilistic unlinkability holds under realistic traffic, the work supplies a practical, low-overhead alternative to full ORAM for the narrow but economically important case of token transfers. Strengths include a live mainnet deployment, open reference code, explicit constant-time and phony-write rules that address the stated side-channel requirements (R4–R5), and a complementary notification system that removes polling. The domain-specific exploitation of asymmetric balance updates and delayed settlement is a genuine engineering contribution that existing general-purpose ORAM literature does not target. The result is therefore of immediate interest to TEE-based programmable-privacy platforms even if the anonymity analysis remains conditional.","major_comments":[{"comment":"§3.9 and Fig. 3 present the settling probability P=1-((k-1)/k)^n under the modelling assumption that every subsequent transfer independently selects a uniform random buffer entry to settle. Requirements R2–R3 and §3.4, however, state that an entry is settled only when a new distinct recipient must be inserted (accumulation otherwise occurs in place, and phony writes are used). Consequently the effective per-execution settling rate is the insertion fraction f≤1/k, not 1/k; the claimed anonymity-set sizes (e.g., n=336 for 99.5 % confidence at k=64) are therefore optimistic. A refined expression that incorporates f, or at least a mainnet measurement of realised settlement intervals, is required before the quantitative privacy claim can be accepted.","section":"§3.9 / Fig. 3"},{"comment":"The security argument is given only as an informal list of requirements R1–R6 and the geometric formula. No game-based definition of unlinkability (or even a precise adversary model that captures adaptive flush/flooding attacks under partial buffer knowledge) appears, nor is there a reduction showing that the DWB+BTBE construction meets such a definition. Without this, it is impossible to assess whether the constant-time and phony-write mechanisms close all side channels that a network-level observer can exploit.","section":"§2 Requirements / §6.3"},{"comment":"§6.5 correctly notes that low-activity periods shrink settlement intervals and weaken anonymity, yet the paper supplies neither an adaptive buffer-resizing mechanism nor any empirical distribution of inter-settlement times drawn from the 42 upgraded mainnet tokens. Because the central quantitative claim rests on sustained high volume, this omission leaves the practical privacy guarantee unsubstantiated.","section":"§6.5"}],"minor_comments":[{"comment":"The BTBE rebalancing example (Fig. 4) is helpful, but the text never states the concrete bucket capacity used in the mainnet deployment or the resulting worst-case trie height; both affect the gas figures reported in §6.2.","section":"§4 / §6.2"},{"comment":"Notation for the owner versus message sender is introduced late (§3.3 footnote); a short glossary or earlier definition would improve readability.","section":"§3.3"},{"comment":"Appendix A algorithms are useful, yet the main text never cross-references the precise nonce-construction or AAD choices that prevent traffic analysis; a one-sentence pointer would help.","section":"§5.3 / Appendix A"},{"comment":"Several references (e.g., [15] Jean-Louis et al.) are cited for the original access-pattern attack; a short comparison table of gas and anonymity-set size versus the decoy and ORAM alternatives they proposed would strengthen the related-work discussion.","section":"§1.1"}],"recommendation":"major_revision","confidential_remarks":"The engineering contribution and mainnet deployment are real and should be valued; the paper is closer to a solid systems/security engineering piece than to a cryptographic-theory paper. If the venue expects formal definitions and proofs, major revision is appropriate; if the venue is more systems-oriented, the same technical gaps could be treated as minor once the settling-rate analysis is tightened. No citation or novelty concerns."},"author_rebuttal":null,"desk_editor":{"model":"grok-4.5","letter":"The one thing to know is that this is a working systems fix for the sender-recipient linkage attack Jean et al. showed on Secret Network SNIP-20 tokens. Instead of decoys or full ORAM they built two domain-specific structures that exploit the fact that token transfers are asymmetric and can tolerate delayed settlement of the recipient side.\n\nWhat is new is the Delayed Write Buffer: a fixed-width table that is fully read/written every transfer, with random private settlement of one entry to make room, accumulation of repeats to the same recipient, and phony writes so the storage pattern stays constant whether or not a real settle or owner entry exists. The BTBE then buckets balances under a secret-keyed bitwise trie so even the eventual settle hits a constant-size anonymity set rather than a single key. They also specify a clean private push-notification scheme using seeds, counters/TxHash/Bloom modes, and constant-size padded events. The math for ideal settling probability is elementary and correct; they give the closed form and the n≈336 figure for 99.5 % at k=64. Gas is measured at +26 % worst-case, and they actually upgraded 42 mainnet tokens covering >$10 M with a lazy migration. That is real evidence.\n\nThe soft spot the stress-test correctly flags is that the geometric model assumes every subsequent transfer settles a uniform random entry. In the actual rules a settle only occurs on insertion of a new distinct recipient (or forced owner settle); accumulation plus phony writes suppress eviction. Effective rate can therefore be lower than 1/k, and low organic volume lets an adversary dominate unknown slots more easily. The paper itself notes the low-activity weakening in §6.5 but supplies neither a refined model with insertion fraction nor mainnet measurements of realized n. Query privacy is only partially addressed and there is no game-based definition. These are genuine limitations for a systems paper, not fatal ones; the constructions still break the direct correlation that existed before.\n\nThis is for people building or auditing confidential contracts on Secret/Oasis/Phala-style platforms, or anyone looking for lightweight write-only alternatives to ORAM on asymmetric workloads. The thinking is clear, the requirements R1–R6 are honest, and the deployment data is concrete. I would bring it to a systems reading group, cite the DWB/BTBE constructions if I work in the area, and I would definitely send it to peer review rather than desk-reject.","headline":"Practical, already-deployed fix for TEE token access-pattern leaks; anonymity is real but traffic-dependent and the settling model is idealized.","tokens_in":13532,"tokens_out":596,"would_cite":true,"duration_ms":17381,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"grok-4.5","headline":"Domain-specific buffers and bucketed tries break sender-recipient links in TEE token transfers by delaying and randomizing storage writes, at roughly 26 percent gas overhead.","keywords":["private token transfers","TEE smart contracts","storage access patterns","Delayed Write Buffer","bucketed balances","write-only ORAM","confidential notifications","Secret Network"],"falsifier":"On a live network running the DWB with known capacity k, measure the fraction of transfers whose recipient storage key is first accessed within n subsequent executions; if that fraction systematically exceeds the claimed geometric probability 1-((k-1)/k)^n under normal load, the privacy claim fails.","tokens_in":13575,"feed_emoji":"🔒","tokens_out":950,"duration_ms":11574,"temperature":0.7,"pith_summary":"TEE confidential smart contracts encrypt data but still leak who paid whom: when a transfer updates a recipient's balance, the unique storage key that is touched reveals the relationship. This paper shows that two purpose-built structures solve the leak for the common case of token transfers. A Delayed Write Buffer holds pending recipient credits and settles a random entry later, so the write no longer coincides with the transfer that created it; a Bitwise-Trie of constant-size address buckets further hides which balance is touched and blocks flooding attacks. Because token transfers are asymmetric (senders must be checked immediately, recipients can wait) and tolerate delayed settlement, the design stays practical: a reference implementation raised gas by about 26 percent, upgraded forty-two mainnet tokens securing more than ten million dollars, and supplies probabilistic anonymity sets whose size grows with subsequent transfer volume. A matching private-notification channel lets recipients learn of credits without polling or revealing identity.","feed_headline":"Buffers break sender-recipient links in private token transfers","feed_subtitle":"Random delayed settlement and address buckets give practical anonymity at 26% gas cost","key_machinery":"The Delayed Write Buffer (DWB): a fixed-capacity table that is fully read and rewritten on every transfer, accumulates repeated credits to the same recipient, and settles a privately chosen random entry (or performs a matching phony write) so that recipient storage is never touched at the moment of the transfer; complemented by the Bitwise-Trie of Bucketed Entries (BTBE) that places balances into constant-size anonymity sets.","core_discovery":"Storage-access-pattern attacks that link senders and recipients of encrypted token transfers can be defeated, with practical overhead, by a fixed-width Delayed Write Buffer that randomly settles distinct recipient entries together with a Bitwise-Trie that stores balances in constant-size address buckets; the combination yields probabilistic anonymity sets whose size is governed by the geometric settling probability and has already been deployed on mainnet.","pith_inferences":["The same asymmetric-buffer idea could be reused for other one-way state updates (allowances, escrow releases, NFT ownership) where only one party must be checked immediately.","Adaptive buffer resizing or quiet-period decoy traffic would be a natural next engineering step once low-activity degradation is observed in production.","Because the structures live entirely inside the contract, they remain portable to any TEE chain that already encrypts its key-value store.","Combining the DWB with a lightweight zk audit of the settlement stream could give stronger public verifiability without restoring access-pattern leakage."],"forward_implications":["Token contracts on TEE platforms can stop linking senders to recipients via storage keys without switching to general ORAM or multi-round protocols.","Existing SNIP-20-style interfaces remain usable; only the internal storage layout changes, so wallets and dApps need no rewrite.","Gas cost rises by a fixed, predictable factor (observed worst-case ~26 percent), making the privacy upgrade affordable for high-value bridged assets.","Recipients can receive real-time push notifications of credits without revealing their identity or forcing nodes to be polled.","Flooding and flush attacks that previously emptied anonymity sets are blocked by accumulation and constant-size buckets."],"fun_headline_variants":["Delayed buffers, random settles hide TEE token sender links","Write buffers plus buckets break encrypted transfer patterns","Random delayed settlement anonymizes private token recipients","Address buckets defeat access-pattern leaks in TEE transfers","DWB and BTBE give practical anonymity for confidential tokens"],"cache_read_input_tokens":128,"weakest_assumption_plain":"The anonymity set stays large only while the buffer remains full and later transfer volume is high enough that the chance an entry has settled stays uncertain; quiet periods shrink that set and weaken the guarantee.","fun_headline_variants_meta":{"raw":{"variants":["Delayed buffers, random settles hide TEE token sender links","Write buffers plus buckets break encrypted transfer patterns","Random delayed settlement anonymizes private token recipients","Address buckets defeat access-pattern leaks in TEE transfers","DWB and BTBE give practical anonymity for confidential tokens"]},"model":"grok-4.5","effort":"low","cost_usd":0.003708,"raw_usage":{"total_tokens":1126,"prompt_tokens":714,"num_sources_used":0,"completion_tokens":56,"cost_in_usd_ticks":37080000,"prompt_tokens_details":{"text_tokens":714,"audio_tokens":0,"image_tokens":0,"cached_tokens":128},"completion_tokens_details":{"audio_tokens":0,"reasoning_tokens":356,"accepted_prediction_tokens":0,"rejected_prediction_tokens":0}},"tokens_in":714,"tokens_out":56,"duration_ms":3744,"temperature":1.0,"reasoning_tokens":356,"cache_read_input_tokens":128,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-07-11T22:09:45.666995+00:00","model_set":{"reader":"grok-4.5"},"falsifier":"On a live network running the DWB with known capacity k, measure the fraction of transfers whose recipient storage key is first accessed within n subsequent executions; if that fraction systematically exceeds the claimed geometric probability 1-((k-1)/k)^n under normal load, the privacy claim fails.","supporting_citations":[],"review_version":1}