REVIEW 4 major objections 5 minor 21 references
Monero Peer-to-peer Network Topology Analysis
T0 review · 4 major / 5 minor · reviewed 2026-08-16 · deepseek-v4-flash
Pith's one-line read Monero's P2P network is a core-periphery structure with 178 core peers.
desk verdict First k-core view of Monero's P2P topology, but it rests on an unpublished map and a tautological core-periphery read; deserves review with major revisions. read the letter →
The pith
A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.
The reading
What carries the argument
The load-bearing tool is k-core decomposition. A $k$-core is the maximal subgraph in which every node has degree at least $k$ within that subgraph; iteratively peeling nodes below the threshold exposes nested layers from periphery to core. Complementing this, the paper uses the nearest-neighbour degree $K_{nn}(k)$, the average degree of the neighbours of nodes of degree $k$, and the assortativity coefficient to show that low-degree peers attach to high-degree peers. The $k=16$ core of 178 peers is the concrete object that carries the core-periphery claim, and the scatter of connections from nodes to the top-14 hubs quantifies how peripheral nodes depend on the core.
What would settle it
Run k-core decomposition on a Monero P2P graph collected independently from multiple vantage points during the same period; if the largest $k$ with a sizable core is not 16, or if the 14 highest-degree super-peers do not appear as hubs, the paper's core-periphery claim is undercut. The most direct check is whether removing those 14 nodes from an independent full-network map reduces the largest connected component's size by the expected amount.
Extended reading notes
Core claim
The central claim is that Monero's P2P network is organized as a core and a periphery. The mapped network has 4,837 nodes, and k-core decomposition yields a most interconnected subgraph of 178 peers at $k=16$. The 14 highest-degree super-peers connect to 3,153 neighbors, and their mutual connections represent 82.1% of the entire network. Despite this, the super-peers do not form a clique: in the k-core adjacency matrix, connectivity among super-peers is sparse relative to their connections to non-super-peers, indicating a hierarchical relay topology. Removing the 14 super-peers leaves many remaining core members isolated or weakly connected, so the core's robustness depends heavily on those hubs. Degree correlation is disassortative, with an assortativity coefficient of $-0.28$, meaning low-degree peers attach preferentially to high-degree peers, and a dense cluster of nodes near degree 8 suggests a default configuration of eight outgoing connections.
Load-bearing premise
The central claim rests on the completeness and accuracy of the Monero network graph taken from the authors' prior work [22]; if that map is incomplete or biased, the k-core layers, the 178-peer core, and the 14 super-peers could all change.
Editorial extensions
If this is right
- For Monero operations, the result implies that ordinary peer churn among low-degree nodes should not fragment the network; the 178-peer core can sustain connectivity as long as the core stays intact.
- For attackers, the result implies that the most efficient disruption is not random node removal but targeted removal of the 14 super-peers or of core nodes with many edges to the periphery, since their removal sharply reduces core connectivity.
- For protocol design, the dense cluster near degree 8 indicates that default connection counts shape the topology, so changing the auto-peering default would shift the core-periphery boundary.
- For network science, Monero joins other real-world networks whose resilience comes from a small interconnected core, meaning that robustness and decentralization can coexist only if the core is itself distributed.
Reading between the lines
- The paper does not test what happens when the 14 super-peers are removed from the full network rather than from the k-core; a natural extension is to simulate targeted attacks on the full graph and compare the size of the largest connected component before and after removal.
- Because the map comes from a single prior snapshot, the k-core level and the identities of the super-peers may drift over time; re-running the same decomposition on later snapshots would show whether the core is persistent or transient.
- The same core-periphery lens could be applied to other privacy-oriented cryptocurrencies whose peer discovery was hardened, to check whether the observed hierarchy is a general consequence of anti-enumeration protocol updates rather than Monero-specific.
Signed reviews
Editorial analysis
A structured set of objections, weighed in public.
Referee Report
Summary. The paper analyzes the topology of the Monero peer-to-peer network, building on the authors' prior unpublished work [22] that reconstructed the network graph using a k-means method. The authors compute nearest-neighbor degree correlations, report a negative assortativity of -0.28, and apply k-core decomposition, finding a k=16 core of 178 peers and 14 super-peers. They interpret these observations as evidence of a core-periphery structure and claim that this structure explains resilience against targeted attacks on central nodes. The paper is short, presents a small number of figures, and relies entirely on the reconstructed graph from [22] without providing validation, null models, or uncertainty quantification.
Significance. If the reconstructed Monero network graph is faithful, the paper's identification of a core-periphery structure and a small set of super-peers would be a meaningful empirical contribution to understanding the architecture and attack resilience of privacy-focused cryptocurrency networks. The topic is relevant to the network-science and blockchain communities, and the use of k-core decomposition is methodologically standard. However, the central empirical claim depends critically on the unpublished companion paper [22], and the paper does not provide the validation or baselines needed to establish that the observed structure is a genuine property of the live Monero network rather than an artifact of the reconstruction method.
major comments (4)
- [Section 3, paragraphs 'The k-core algorithm partitions...' and 'By detailed checking...'] The entire analysis rests on the Monero network map reconstructed in the authors' prior unpublished work [22], which is described as having 'relatively high accuracy' without evidence. Because the mapping uses a k-means method to infer peer identities and edges from address-list samples, systematic errors—such as merging distinct peers behind NAT, missing short-lived connections, or misclassifying seed nodes—would directly alter the degree distribution, k-core sizes, super-peer identification, and assortativity. No ground-truth comparison, sensitivity analysis, or error bounds are provided. If the reconstructed graph is incomplete or biased, the reported k=16 core of 178 peers and the 14 super-peers may not be properties of the actual Monero network. The central claim is therefore not supported by the evidence supplied in this manuscript.
- [Section 3, 'The k-core algorithm partitions...' ] The k-core decomposition is used to 'confirm' a core-periphery structure, but k-core decomposition by construction always yields a nested hierarchy of densely connected subgraphs for any graph with sufficient degree heterogeneity. No null model is used: the authors do not compare the observed k-core size or the core-periphery pattern against a random graph with the same degree sequence, nor do they compute a quantitative core-periphery fit (for example, the Borgatti-Everett correlation with a core-periphery ideal). Without such a baseline, the claim that Monero's network exhibits a core-periphery structure is not tested against the natural alternative that the observed k-core is an expected feature of a heavy-tailed random network. This is a load-bearing point because the paper's main conclusion is the existence of core-periphery organization.
- [Abstract and Section 3, super-peer removal] The abstract states that the core-periphery structure 'explains why targeting central nodes does not easily lead to the rapid disintegration of the network's largest connected component,' and Section 3 claims that removing the 14 super-peers 'drastically reduces the connectivity of the remaining peers.' However, no attack simulation, percolation analysis, or quantitative robustness metric is presented in this paper; the referenced resilience finding appears to come from the unpublished work [22]. The resilience claim in the abstract is therefore not demonstrated by the results reported here and should either be supported with concrete simulations or removed from the abstract.
- [Fig. 1 and Section 3, first paragraph] The assortativity coefficient of -0.28 is reported without confidence intervals, significance testing, or any discussion of how the uncertainty in the reconstructed graph affects this point estimate. Because the graph itself is the output of an inference method with unknown error, the precision implied by reporting a single value is misleading. At minimum, the authors should provide a measure of uncertainty or a sensitivity analysis with respect to the mapping parameters.
minor comments (5)
- [Keywords and Section 2.2 heading] There are typographical errors: 'T opology' in the keywords, 'Alogrithm' in the Section 2.2 heading, and 'classick-means' in Section 2. These should be corrected.
- [Section 2.1, Eq. (1)] The notation in Eq. (1) is inconsistent: the left-hand side uses K while the right-hand side uses k, and the section text alternates between 'K' and 'k'. Please standardize the notation and define all symbols in one place.
- [Section 3, fourth paragraph] The statement that '3,153 neighbors are directly connected to the 14 super nodes' and that their 'mutual connections represent 82.1% of the entire network' is not clearly defined. What does 'directly connected' mean exactly, and how is the 82.1% computed? Please clarify the definitions and show the calculation.
- [Fig. 4 caption and text] The text says there are 'two dashed reference lines are plotted at x = 8' while the caption mentions 'Dashed red and purple lines' marking 'the reference thresholds at x = 8.' It is unclear whether there are two distinct lines at x=8 or a single line; please make the figure and caption consistent.
- [References] Reference [22] is listed as '(under review)' and is the foundation of the empirical analysis. If possible, provide a preprint identifier (e.g., arXiv number) or make the dataset and reconstruction code available so that the current paper's results can be independently checked.
Circularity Check
Topology claims rely on the authors' unreviewed reconstructed graph [22], and the qualitative core-periphery confirmation is partly guaranteed by the k-core definition.
-
self citation load bearing
[Section 2, first paragraph ('Monero Network Architecture Detection Methods'); Reference [22]]
"In our prior work [22], we mapped the Monero P2P network with relatively high accuracy using the classic k-means method, and then analyzed its connectivity patterns through centrality metrics and visualization techniques. However, this is just a partial picture of Monero's P2P network, which is not enough to understand Monero's network topology and its implications for decentralization, security, and potential vulnerabilities."
Every quantitative result in this paper—Knn(k), assortativity, the k=16 core with 178 peers, and the 14 super-peers—is computed on the graph reconstructed in the authors' own Reference [22], which is listed as '(under review)' and is not provided or benchmarked. The object of study is therefore, by construction, the output of the authors' unreviewed k-means reconstruction rather than an independently verified sample of the live Monero network. The central claim that the Monero network exhibits a core-periphery structure is load-bearing on this self-citation, and no ground-truth comparison, sensitivity analysis, or error bounds are supplied to show that the reconstructed graph approximates the real network.
-
self definitional
[Section 3, paragraph beginning 'The k-core algorithm partitions the Monero network into a core and a periphery']
"The k-core algorithm partitions the Monero network into a core and a periphery, as shown in Fig. 2. The detected structure suggests a core-periphery organization, where core nodes are densely interconnected, while peripheral nodes have fewer connections."
By definition, k-core decomposition removes nodes with degree below a threshold and returns the remaining 'core' plus the removed 'periphery', so every graph processed by this algorithm yields a core/periphery split. The qualitative conclusion that a core and a periphery exist is therefore guaranteed by the method rather than discovered from Monero-specific evidence. The empirical content is confined to the particular threshold (k=16), the size (178 peers), and the sparse super-peer interconnectivity; those numbers are not forced, but the headline 'confirmation' of core-periphery structure is partly a restatement of the algorithm's output.
full rationale
The paper's specific numeric findings—the k=16 core of 178 peers, the negative assortativity of -0.28, and the 14 super-peers—are real empirical outputs and are not logically entailed by the method. However, those outputs are computed on the authors' own network reconstruction from Reference [22], which is under review and never validated in this paper; thus the leap from 'properties of the reconstructed graph' to 'properties of the Monero P2P network' rests on an unverified self-citation. Additionally, the qualitative claim of a core-periphery structure is in part definitional, since k-core decomposition always produces a core and a periphery. Because the central qualitative claim is partly built into the algorithm and the underlying graph is an unreviewed self-cited input, while the quantitative results retain independent content, the appropriate circularity score is moderate.
Assumptions & free parameters
assumptions (3)
- domain assumption The network map reconstructed in the authors' prior work [22] accurately represents Monero's P2P network.
- domain assumption K-core decomposition is an appropriate tool to establish a core-periphery structure.
- domain assumption The disassortative degree correlation is a signature of core-periphery organization.
Cite this review
Pith. "Pith review of Monero Peer-to-peer Network Topology Analysis." pith.science (2026). https://pith.science/paper/YVVZMXO5
@misc{pith2026250417809,
author = {Pith},
title = {Pith review of: Monero Peer-to-peer Network Topology Analysis},
year = {2026},
howpublished = {\url{https://pith.science/paper/YVVZMXO5}},
note = {Machine review of arXiv:2504.17809}
}
read the original abstract
Monero, a privacy-focused cryptocurrency, employs a decentralized peer-to-peer (P2P) network that plays a critical role in transaction propagation and consensus formation. While much research has explored Monero's privacy transaction mechanisms, its underlying P2P network architecture has remained relatively underexplored. In this study, building on our recent work on Monero network detection, we further investigate the network topology of Monero's P2P structure, which has evolved following recent protocol updates that enhanced security by obscuring peer information. Using k-core decomposition, we confirm that the Monero network exhibits a core-periphery structure, where a tightly interconnected core of supernodes is crucial for maintaining network cohesion, while peripheral nodes rely on these core nodes for connectivity. This structure explains why targeting central nodes does not easily lead to the rapid disintegration of the network's largest connected component while also providing a deeper understanding of the true architecture of Monero's peer protocol.
Figures
Figures from the paper (2 more)
Reference graph
Works this paper leans on
-
[22]
”Charting the Uncharted: The Landscape of Monero Peer-to-Peer Network” (under review) 7
-
[1]
Bitcoin: A peer-to-peer electronic cash system,
Satoshi Nakamoto, “Bitcoin: A peer-to-peer electronic cash system,” 2008
work page 2008
-
[2]
V . Buterin, ”A next-generation smart contract and decentralized application platform,” *Ethereum White Paper*, 2014
work page 2014
-
[3]
B. Sch ¨utze, M. K¨ammerer, G. Klos, and P. Mildenberger, ”The public-key-infrastructure of the radiological society of Germany,” *European Journal of Radiology*, vol. 57, no. 3, pp. 323–328, 2006
work page 2006
- [4]
-
[5]
L. M. Bach, B. Mihaljevic, and M. Zagar, ”Comparative analysis of blockchain consensus algorithms,” in *2018 41st International Convention on Information and Communication Technology, Electronics and Microelectronics (MIPRO)*, pp. 1545–1550, 2018
work page 2018
-
[6]
C. Decker and R. Wattenhofer, ”Information propagation in the Bitcoin network,” in *IEEE P2P 2013 Proceedings*, pp. 1–10, 2013
work page 2013
-
[7]
A. Biryukov, D. Khovratovich, and I. Pustogarov, ”Deanonymisation of clients in Bitcoin P2P network,” in *Proceedings of the 2014 ACM SIGSAC Conference on Computer and Communications Security*, pp. 15–29, 2014
work page 2014
Show all 21 references
-
[8]
Heilman, A
E. Heilman, A. Kendler, A. Zohar, and S. Goldberg, ”Eclipse attacks on Bitcoin’s peer-to-peer network,” in *24th USENIX Security Symposium (USENIX Security 15)*, pp. 129–144, 2015
2015
-
[9]
Neudecker, P
T. Neudecker, P. Andelfinger, and H. Hartenstein, ”A simulation model for analysis of attacks on the Bitcoin peer-to-peer network,” in *2015 IFIP/IEEE International Symposium on Integrated Network Management (IM)*, pp. 1327–1332, 2015
2015
-
[10]
Y . Gao, C. Campajola, N. Vallarano, A. S. Teixeira, and C. J. Tessone, ”Heterogeneity-and homophily- induced vulnerability of a P2P network formation model: the IOTA auto-peering protocol”. arXiv preprint arXiv:2401.12633, 2024
2024 arXiv
-
[11]
”Transaction flows and holding time scaling laws of bitcoin.” Physica A: Statistical Mechanics and its Applications 658 (2025): 130294
Sornette, Didier, and Yu Zhang. ”Transaction flows and holding time scaling laws of bitcoin.” Physica A: Statistical Mechanics and its Applications 658 (2025): 130294
2025
-
[12]
”Bitcoin Transaction Behavior Modeling Based on Balance Data.” arXiv preprint arXiv:2409.10407 (2024)
Zhang, Yu, and Claudio Tessone. ”Bitcoin Transaction Behavior Modeling Based on Balance Data.” arXiv preprint arXiv:2409.10407 (2024)
2024 arXiv
-
[14]
Miller, M
A. Miller, M. M ¨oser, K. Lee, and A. Narayanan, ”An empirical analysis of linkability in the Monero blockchain,” *arXiv preprint arXiv:1704.04299*, 2017
2017 arXiv
-
[15]
Eskandari, A
S. Eskandari, A. Leoutsarakos, T. Mursch, and J. Clark, ”A first look at browser-based cryptojacking,” in *2018 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW)*, pp. 58–66, 2018
2018
-
[16]
Cao, Tong, Yu, Jiangshan, Decouchant, J´er´emie, Luo, Xiapu, and Verissimo, Paulo. ”Exploring the Mon- ero peer-to-peer network.” *Financial Cryptography and Data Security: 24th International Conference, FC 2020, Kota Kinabalu, Malaysia, February 10–14, 2020 Revised Selected P...
2020
-
[17]
S. P. Borgatti and M. G. Everett, ”Models of core /periphery structures,” *Social Networks*, vol. 21, no. 4, pp. 375–395, 2000
2000
-
[18]
Holme, ”Core-periphery organization of complex networks,” Phys
P. Holme, ”Core-periphery organization of complex networks,” Phys. Rev. E, 72(4), 046111 (2005)
2005
-
[19]
Batagelj and M
V . Batagelj and M. Zaversnik, ”An O(m) algorithm for cores decomposition of networks,” *arXiv preprint cs/0310049*, 2003
2003 arXiv
-
[20]
Barab ´asi, ”Network science,” *Philosophical Transactions of the Royal Society A: Mathematical, Physical and Engineering Sciences*, vol
A.-L. Barab ´asi, ”Network science,” *Philosophical Transactions of the Royal Society A: Mathematical, Physical and Engineering Sciences*, vol. 371, no. 1987, p. 20120375, 2013
1987
-
[21]
Newman, *Networks*
M. Newman, *Networks*. Oxford University Press, 2018
2018
Reviewed August 16, 2026 · model on record in the stance chip above.
Discussion (0). Continue with ORCID to comment.