{"id":"ee0967b3-1e70-4fa2-816a-52d19fa5f605","arxiv_id":"2607.20929","paper_version":1,"verdict":"REJECT","confidence":"HIGH","novelty_score":7.0,"correctness_risk":"high","formal_verification":"none","parameter_count":0,"one_line_summary":"The claimed exact consensus number for constant-state untraceable asset transfer under strong untraceability is invalid; allowing duplicate masking sets makes the consensus number unbounded.","lead":"The paper formalizes sender-untraceable cryptocurrencies as shared objects and claims to compute their consensus numbers, finding a quadratic synchronization cost for constant-state designs. The main upper bound fails because multiple processes may use identical masking sets, which makes the stated consensus number unbounded under the paper's own model.","discovery_kind":"first_principles","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Duplicate (even identical) masking sets break the CUAT+ upper bound: a single S reused by N processes gives N-consensus, so Theorem 6.20's quadratic bound is false.","rationale":"The paper's central claim is the exact quadratic consensus number for CUAT+ under strong untraceability. The reader's rejection rests on duplicate masking sets breaking the upper-bound proofs. My read confirms and strengthens this: a single masking set reused by all processes already yields unbounded consensus number, because the CUAT transfer acts like a multi-location CAS whose new account set exposes the winner. The upper-bound step that fails is Theorem 6.16's use of Fisher's inequality on distinct sets while i_a and j_a count multiplicities; the counterexample is admissible under the paper's own Definition 4.3 and Theorem 4.4, since the repeated identical masking sets give every account the same incidence. This is not an edge case external to the model: the paper's own lower-bound construction in Theorem 6.19 uses duplicate row masking sets, so the missing distinctness assumption is not stated or implied by the object definition. The LUAT analysis, the conflict-graph formalism, and the fairness results appear independent and may survive a repair, but the abstract's quantitative CUAT+ result is false as stated. Since the reader already reached REJECT, no verdict adjustment is needed.","tokens_in":39192,"tokens_out":12901,"duration_ms":128893,"concrete_test":"Implement the N=4 instance of the protocol above for lambda=3: S={a1,a2,a3}, every process owns a1; each p_i writes input v_i to R[i] and a distinct S_i' to A[i] before transfer. Enumerate all interleavings (or model-check) and verify: exactly one transfer returns TRUE, all FALSE processes identify the unique S_j' in A\\A0 and decide R[j]; and the history (four invocations all carrying S) has uniform account incidence 4, qualifying under Theorem 4.4. If this succeeds for N=4 (and scales to arbitrary N), the claimed value 8 for lambda=3 is refuted.","verdict_should_be":"UNCHANGED","load_bearing_attack":"Definition 6.1 permits arbitrarily many processes to invoke transfer with the same old masking set S; Definition 6.3 collapses identical sets to one vertex, and Lemma 6.8's \"if every pair {S_i,S_j} conflicted ... form an n-clique\" silently assumes the S_i are distinct. The upper bounds inherit this: Theorem 6.16 counts per-process incidences i_a, j_a (which count multiplicities) but bounds them by lambda using Fisher's inequality applied to the set of distinct masking sets; once S_i are duplicated, the multiplicity can exceed lambda while the distinct-family incidence stays small.\n\nThe failure is not benign. For any lambda >= 2 and any N, let all N processes co-own a_1 in S = {a_1,...,a_lambda}. Each p_i first writes its input to R[i] and a distinct fresh new-account set S_i' to A[i], then invokes transfer(S_i', pi_i) on one CUAT+_lambda object. Exactly one transfer linearizes first and succeeds; every other transfer finds S invalid and fails. The current account set returned contains exactly the winner's S_j', so each loser scans A[i] and adopts R[j]. Agreement, validity, and wait-freedom are immediate. Strong untraceability holds: every one of the N masking sets in the history is S, so each account in S has incidence N, and Theorem 4.4 admits the execution. Hence cons(CUAT+_lambda) is unbounded for every lambda >= 2, contradicting Theorems 6.10, 6.16, and 6.20. The paper's own even-lambda grid (Theorem 6.19) assigns the same row set to lambda/2 processes, so the distinctness needed by the upper bound is not part of the model.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper formalizes two shared-memory objects for sender-untraceable cryptocurrencies: the linear untraceable asset transfer (LUAT), which retains spent accounts and appends nullifiers, and the constant untraceable asset transfer (CUAT), which consumes and replaces its whole masking set. It claims that LUAT has consensus number 2 (or max(k,2) with a shared account) regardless of the masking-set size and untraceability notion, while CUAT under strong untraceability has consensus number exactly 4*floor(lambda/2)*ceil(lambda/2) for every lambda >= 3, with weak untraceability giving unbounded consensus power already for one-round protocols. The analysis is carried out through a conflict graph on masking sets and a uniform-incidence characterization of strong untraceability, with lower bounds built from projective planes, cyclic difference covers, and grid/cyclic cross-cover families. The paper also proves that CUAT is not starvation-free whereas LUAT is, and connects these results to deployed systems such as Quisquis, Zcash, and Monero.","tokens_in":39488,"tokens_out":8881,"duration_ms":85073,"significance":"If the claimed exact characterization were correct, it would be a significant contribution: it would place two privacy-preserving payment designs in the consensus hierarchy, quantify the synchronization cost of strong untraceability, and separate storage costs from coordination costs. The paper has genuine strengths: the formal object definitions are clear, the LUAT results are coherent and well argued, the lower-bound constructions (projective planes, cyclic difference covers, cross-cover families) are concrete and reproducible, and the connection to real systems is useful. However, the central upper-bound theorem for CUAT under strong untraceability is invalid under the model as stated, because the model permits multiple processes to use identical masking sets while the upper-bound proofs count only distinct sets. The headline result is therefore false, and the error is load-bearing rather than cosmetic.","major_comments":[{"comment":"The upper-bound proof of Theorem 6.16 is invalid because the model permits duplicate masking sets. Definition 6.1 never requires the old masking sets S_beta of different transfers to be distinct, and Definition 6.3 defines the conflict graph with one vertex per masking set, so a set reused by several processes is represented by a single vertex. The proof counts i_a and j_a as per-process incidences (multiplicities), but then bounds them by lambda using Fisher's inequality applied to the family of distinct masking sets. Once a set is reused, every account in it can have multiplicity larger than lambda while the number of distinct sets stays small; the step 'vm = d*lambda ... d <= v ... m <= lambda' mixes multiplicities with distinct-set counts and does not hold. The claimed bound on the number of processes therefore does not follow.","section":"§6.1 and §6.2.4 (Definitions 6.1, 6.3; Theorem 6.16)"},{"comment":"Lemma 6.8 assumes distinctness of the masking sets when it argues that pairwise conflict of S_1,...,S_n yields an n-clique: if S_i = S_j, the two vertices v_{S_i} and v_{S_j} coincide, so there is no n-clique. The model never forbids equality, and the paper's own constructions use it (Lemma 6.19 assigns the same row set to lambda/2 processes). Consequently the one-round upper bound of Theorem 6.12 is also false as stated: with all processes reusing one set of size lambda, every pair conflicts, but the conflict graph has only one vertex.","section":"§6.2.1 (Lemma 6.8)"},{"comment":"The proof of Theorem 6.10 contains the assertion that two processes across the valency partition use distinct pending masking sets, with the justification that identical sets would leave 'no consistent register to adopt.' This is incorrect: if two processes use the same old masking set S, at most one transfer succeeds, the response returns the fresh account set S'_winner, and the loser can match S'_winner against the registers where processes published their proposed new sets and adopt the winner's input. This is precisely the mechanism of the attempt-and-adopt protocol of Lemma 6.7. Hence the complete-bipartite-subgraph structure extracted in Lemma 6.6 is not necessary, and the upper bound on the number of processes collapses.","section":"§6.2.2 (Theorem 6.10)"},{"comment":"There is a concrete counterexample to Theorem 6.20. For any integer N and any lambda >= 2, let N processes co-own a_1 in S = {a_1,...,a_lambda}. Each p_i writes its input to R[i], publishes a distinct fresh account set S_i' in A[i], and invokes a transfer with old masking set S. Exactly one transfer linearizes first and succeeds; every other transfer fails because S is invalidated. Each loser reads the returned account set, identifies S_winner, and adopts the corresponding register value, giving wait-free N-process consensus with validity and agreement. The history is admissible under strong untraceability because every account in S has incidence N, so the uniformity condition of Theorem 4.4 is satisfied. Therefore cons(CUAT+_lambda) is unbounded for every lambda >= 2, contradicting Theorems 6.10, 6.16, and 6.20.","section":"§6.1 and §4 (Definitions 6.1, 4.3; Theorem 4.4)"}],"minor_comments":[{"comment":"The bound |F| <= lambda^2 - lambda + 1 is attributed to 'Füredi [Für81] and Ihringer and Kupavskii [IK19]' but no theorem number or statement is given; please cite the exact result.","section":"§6.2.4 (Theorem 6.12)"},{"comment":"The sentence 'if d masking sets of size lambda cover v accounts with common incidence m' should specify whether d counts distinct sets or transfers; the present text is ambiguous and, as discussed above, the two readings give different bounds.","section":"§6.2.4 (Theorem 6.16)"},{"comment":"The strong() function is not specified in the figure and the text refers the reader to [IK19]; supplying the pseudocode or a precise construction would make the lower bound easier to verify.","section":"Figure 4"}],"recommendation":"reject","confidential_remarks":"The flaw is in the central theorem and is already visible inside the paper's own constructions, which reuse masking sets; a simple restriction to simple families would invalidate the lower bound as well. I do not see a local fix that preserves the claimed exact result under the stated model."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Punchline: the paper's main result, cons(CUAT+_lambda) = lambda^2 (or lambda^2-1 for odd), is false. The upper-bound proofs assume each process uses a distinct pending masking set, but the model does not require that, and the paper's own lower-bound grid construction for even lambda assigns the same row set to lambda/2 processes. The stress-test counterexample works: for any N, give every process the same old masking set S. Each writes its input to a register, then invokes transfer on S. The first transfer linearizes and succeeds; the others find S invalid and fail. The response to every invocation includes the current account set, so losers identify the winner's fresh accounts and adopt the winner's register. Agreement, validity, and wait-freedom are immediate. Strong untraceability is satisfied because every account in S has incidence N, so the history is uniform. This gives N-process consensus for arbitrary N, so cons(CUAT+_lambda) is unbounded, contradicting Theorems 6.10, 6.16, and 6.20.\n\nWhat is good: the LUAT half is solid and well argued. The consensus number of 2 for unshared accounts, max(k,2) for k-shared, and the garbage-collection analysis look correct. The formal separation of LUAT and CUAT, and the conflict-graph framing, are useful. The weak-untraceability result (unbounded via a hub account) is correct. The lower-bound constructions — projective plane, cyclic difference cover, cross-cover families — are interesting, even though the upper bound they target is false.\n\nThe soft spot is load-bearing: Lemma 6.8 and Theorems 6.10/6.16 count vertices of the conflict graph and silently identify processes with distinct masking sets. Once duplicates are allowed, the clique number and the incidence count no longer bound the number of processes. This is not an exotic case; the natural hub protocol that the paper itself uses for weak untraceability is exactly the duplicate-set construction.\n\nWho this is for: readers working on consensus numbers of asset-transfer objects. The LUAT contribution is citable; the CUAT+ quadratic claim should be withdrawn or replaced by a bound that explicitly restricts the model to distinct masking sets, if that is what the authors want to model.\n\nRecommendation: reject. The paper deserves a serious referee — the flaw is subtle and the framework is worth examining — but the central result is false, and the upper bound cannot be patched without changing the model. If the authors want to salvage the CUAT+ section, they need to either add a distinctness condition to the definition or accept unboundedness and focus on the one-round lower bounds, which remain valid.","headline":"The CUAT+ quadratic consensus number is false — duplicate masking sets break the upper bound — though the LUAT half is a clean contribution.","tokens_in":40079,"tokens_out":5167,"would_cite":true,"duration_ms":46329,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":["68M14","68Q85","05D05","05B25"],"pacs":[],"model":"deepseek-v4-flash","headline":"A constant-state private payment object has quadratic consensus power in its anonymity-set size.","keywords":["consensus number","sender untraceability","constant-state cryptocurrency","masking set","conflict graph","uniform incidence","wait-free consensus","asset transfer"],"falsifier":"Take $\\lambda=4$, where the claimed bound is 16. Allow two of the 17 processes to submit the exact same masking set and keep the remaining sets as in the paper's even grid; if attempt-and-adopt still solves wait-free 17-process consensus, Theorem 6.20 is false. More generally, checking whether the conflict graph's clique number can exceed $4\\lfloor\\lambda/2\\rfloor\\lceil\\lambda/2\\rceil$ under identical masking sets settles whether the distinctness assumption is load-bearing.","tokens_in":38932,"feed_emoji":"🔐","tokens_out":8772,"duration_ms":77026,"temperature":0.7,"pith_summary":"This paper asks how sender untraceability changes the synchronization cost of a cryptocurrency, comparing designs that keep spent accounts (linear state, LUAT) with designs that consume and replace the whole masking set (constant state, CUAT). It establishes that LUAT has consensus number 2 regardless of masking-set size or untraceability notion, while CUAT's consensus number is unbounded under weak untraceability and exactly $4\\lfloor\\lambda/2\\rfloor\\lceil\\lambda/2\\rceil$ under strong untraceability. This exact quadratic value, $\\lambda^2$ for even $\\lambda$ and $\\lambda^2-1$ for odd $\\lambda$, is the paper's main quantitative discovery: the same masking sets that bound storage also determine how many processes must coordinate. A sympathetic reader should care because the result turns a privacy-mechanism choice into a measured performance tradeoff between storage and agreement.","feed_headline":"Constant-state privacy costs quadratic synchronization","feed_subtitle":"In anonymous cryptocurrencies, the same masking sets that shrink storage force up to $\\lambda^2$ processes to coordinate.","key_machinery":"The load-bearing objects are the conflict graph, whose vertices are masking sets and whose edges join sets sharing an account index, and the uniform-incidence condition that strong untraceability imposes on histories. For the one-round regime, consensus power equals the largest clique in the conflict graph; the upper bound is the extremal size of a symmetric pairwise-intersecting $\\lambda$-uniform family, attained by a projective plane when $\\lambda-1$ is a prime power. For unrestricted protocols the relevant structure at a critical configuration is a complete bipartite intersection between opposite valency classes rather than a clique, and the exact bound $4\\lfloor\\lambda/2\\rfloor\\lceil\\lambda/2\\rceil$ is reached by composing a cyclic difference cover with either a grid (even $\\lambda$) or a cyclic cross-cover family (odd $\\lambda$). The same conflict graph, read over a workload, also yields the chromatic-number characterization of sequential rounds, the independence-number bound on parallel throughput, and the starvation impossibility based on repeated zero-value transfers.","core_discovery":"Under the paper's model, the difference between untraceable payment designs is not privacy but what a transfer does to its masking set. LUAT transfers name their masking set as decoys and consume only one account, so transfers on distinct accounts commute; the deny-set reveals the transfer's position in the linearization order, giving consensus number exactly 2 (and $\\max(k,2)$ when $k$ processes share an account). CUAT transfers atomically consume and replace all $\\lambda$ accounts of the masking set, so overlapping sets conflict. Weak untraceability imposes no global incidence restriction and a single hub account yields arbitrarily large cliques, making $\\mathrm{cons}(\\mathrm{CUAT}^-_\\lambda)=\\infty$ already for one-round protocols. Strong untraceability holds on a history exactly when any two accounts sharing a masking set appear in the same number of masking sets in that history; this uniform-incidence constraint bounds the conflict graph, and the paper's matching constructions attain it, so $\\mathrm{cons}(\\mathrm{CUAT}^+_\\lambda)=4\\lfloor\\lambda/2\\rfloor\\lceil\\lambda/2\\rceil = \\lambda^2$ for even $\\lambda$ and $\\lambda^2-1$ for odd $\\lambda$ for every $\\lambda\\ge 3$. The protocol achieving the lower bound runs two groups of processes through a cyclic one-round protocol and reconciles the group decisions on a cross-cover family whose sets intersect exactly across groups.","pith_inferences":["A direct stress test of the upper bound is to allow duplicate masking sets in the construction: the proofs count one vertex per process and would break if two processes submit the identical set, potentially changing $4\\lfloor\\lambda/2\\rfloor\\lceil\\lambda/2\\rceil$.","The quadratic dependence on $\\lambda$ suggests that a constant-state deployment should keep anonymity sets small if it wants to preserve shardable parallelism; alternatively, designs that make invalidation sender-local sidestep conflict while keeping bounded state at the price of per-epoch throughput caps.","The exact bound resembles a multi-word compare-and-swap counting argument, so one could test whether weakening strong untraceability to a bounded number of historical observations interpolates between unbounded and the quadratic value."],"forward_implications":["A constant-state private payment system modeled by CUAT cannot have a contention-free parallel commit slice larger than about $\\lambda^2$ processes, so the anonymity parameter directly caps the amount of independent processing available.","Strong untraceability adds a combinatorial constraint, uniform incidence, that is harmless for LUAT but is exactly what caps CUAT's power; privacy itself is not the cost, the coupling of privacy with state reclamation is.","One-round submission, the way payment systems actually use CUAT, supports only between $\\lfloor\\lambda^2/2\\rfloor$ and $\\lambda^2-\\lambda+1$ processes, with the upper end reachable exactly when $\\lambda-1$ is a prime power.","CUAT cannot be made starvation-free by any wait-free implementation: an unfair scheduler can always let a zero-value re-randomization win the race against a competitor's transfer on the same masking set.","LUAT's storage growth can be garbage-collected by a $k$-partitioning object with consensus number 2, so the linear-state design pays for privacy in storage rather than in synchronization."],"supporting_citations":[{"why":"Supplies the consensus-number definition, wait-free consensus, and the critical-configuration technique on which every upper bound rests.","marker":"[Her91]"},{"why":"Supplies the shared-memory asset-transfer object model, ownership semantics, and the baseline consensus number of 1 for standard asset transfer.","marker":"[Gue+22]"},{"why":"Supplies the bound on regular pairwise-intersecting uniform families and the projective-plane incidence used in the one-round upper bound and construction.","marker":"[IK19]"},{"why":"Introduces the Quisquis account-rerandomization design that the CUAT object formalizes.","marker":"[Fau+19]"},{"why":"Documents the epoch-scoped design with sender-local invalidation and the conjectured denial-of-service behavior that Theorem 7.4 proves.","marker":"[Bün+20]"},{"why":"Supplies the extremal-set inequality used to cap the clique size of uniformly incident pairwise-intersecting masking sets.","marker":"[Für81]"}],"fun_headline_variants":["Untraceable crypto: linearity syncs, constant-state quadratically","Anonymous coins: quadratic sync for constant-state privacy","Strong untraceability makes consensus number quadratic in masking set size","Untraceability's hidden cost: quadratic sync","Constant-state anonymity: quadratic coordination cost"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The one-round upper-bound arguments assume that different processes never invoke the same masking set, so the conflict graph has one vertex per process and each vertex is distinct; the model never explicitly forbids duplicate masking sets, and the even-$\\lambda$ cross-cover construction deliberately assigns the same row masking set to $\\lambda/2$ processes within a class.","fun_headline_variants_meta":{"raw":{"variants":["Untraceable crypto: linearity syncs, constant-state quadratically","Anonymous coins: quadratic sync for constant-state privacy","Strong untraceability makes consensus number quadratic in masking set size","Untraceability's hidden cost: quadratic sync","Constant-state anonymity: quadratic coordination cost"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000515,"raw_usage":{"total_tokens":2606,"prompt_tokens":1160,"completion_tokens":1446,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":776,"completion_tokens_details":{"reasoning_tokens":1368}},"tokens_in":776,"tokens_out":1446,"duration_ms":10642,"temperature":1.0,"reasoning_tokens":1368,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-15T15:37:14.953349+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Take $\\lambda=4$, where the claimed bound is 16. Allow two of the 17 processes to submit the exact same masking set and keep the remaining sets as in the paper's even grid; if attempt-and-adopt still solves wait-free 17-process consensus, Theorem 6.20 is false. More generally, checking whether the conflict graph's clique number can exceed $4\\lfloor\\lambda/2\\rfloor\\lceil\\lambda/2\\rceil$ under identical masking sets settles whether the distinctness assumption is load-bearing.","supporting_citations":[],"review_version":2}