Pith. sign in

REVIEW 2 major objections 5 minor 92 references

From Permissioned to Proof-of-Stake Consensus

T0 review · 2 major / 5 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read This paper presents a generic compiler that turns any permissioned consensus protocol into a proof-of-stake one, preserving the main safety and liveness properties and adding accountability.

desk verdict A genuine closed-box compiler result, but the 'any permissioned protocol' claim hides a load-bearing size-matching condition between the protocol's process count and the constant total stake. read the letter →

arxiv 2506.14124 v2 pith:Z23ZVQJL submitted 2025-06-17 cs.CR

Jovan Komatovic , Andrew Lewis-Pye , Joachim Neu , Tim Roughgarden , Ertem Nusret Tas This is my paper · ORCID
classification cs.CR MSC 68M14
keywords permissionedconsensusproof-of-stakequasi-permissionlessgenericcompilerepoch-basedreconfigurationaccountabilitypartialsynchrony
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper aims to settle a long-standing transfer problem: how to turn any permissioned consensus protocol, designed for a fixed known set of validators, into a proof-of-stake permissionless protocol without redesigning it. Its contribution is a generic compiler that works in the partially synchronous model and outputs a quasi-permissionless protocol, meaning stake holders are assumed to be active but the validator set may change over time. If the input protocol satisfies consistency, liveness, optimistic responsiveness, or any composable log-specific safety property, the output satisfies the same property against the same fraction of faulty stake, and message complexity is preserved asymptotically. The output is also accountable even when the input was not: any consistency violation yields proofs of guilt against stakeholders controlling at least $1-2\rho$ of the stake. A sympathetic reader would care because the result promises that proof-of-stake versions of established permissioned protocols, including DAG-based ones, can be obtained and analyzed generically rather than one protocol at a time.

What carries the argument

The load-bearing mechanism is the epoch-ending block, produced by a fully-certified log. A log is certified when a quorum of the epoch's validators, holding at least $(1-\rho)T$ stake, signs it, and fully certified when every epoch prefix is certified; correct processes adopt only fully-certified logs. Since any two quorums intersect in a correct validator, two conflicting fully-certified logs cannot arise unless the adversary exceeds the allowed stake fraction. Epoch length is set to $ED = \ell + \Delta$ after GST so that all correct validators of an epoch overlap for at least the liveness parameter $\ell$, which lets the underlying $P$ finalize new transactions. The other key object is the quit-enhanced permissioned protocol: a closed-box interface extension that lets correct processes stop participating, with preservation lemmas showing that consistency, liveness, responsiveness, and log-specific safety survive the extension.

What would settle it

Run the compiled protocol with a stake function that mints or burns stake so that total stake differs between two logs, e.g., a reward transaction in the first epoch increases total stake for the second. Then $map\_stake$ produces a different number of permissioned identities in the second epoch, so the claim that each epoch faithfully simulates the original permissioned protocol $P$ can no longer hold; exhibiting an actual consistency or liveness violation in such an execution would refute the paper's generality claim.

Watch

Extended reading notes

Core claim

The central claim is the existence of a closed-box, epoch-based transformation $T$ that compiles any permissioned protocol $P$ into a proof-of-stake protocol $T(P)$ in the quasi-permissionless and partially synchronous setting. In each epoch a fresh instance of $P$ is run, with the validator set and genesis log taken from the finalized log of the previous epoch; every unit of stake is mapped to one permissioned identity, so a process with $s$ units simulates $s$ copies of $P$. The transformation handles the fact that correct processes quit at epoch boundaries by analyzing a quit-enhanced version of $P$, and it proves that quitting preserves the relevant properties. It then shows by induction across epochs that consistency and composable log-specific safety properties transfer, that liveness transfers with a modest blow-up in the time parameter, and that accountability—identification of culprits after a consistency violation—holds even if the original protocol had no accountability guarantee.

Load-bearing premise

The compiler assumes that every possible log has the same total amount of stake $T$; if the total stake could change, the mapping from stake units to simulated permissioned identities would change between epochs and the proof structure would break.

Editorial extensions

If this is right

  • Existing permissioned DAG-based protocols can be lifted to quasi-permissionless proof-of-stake protocols with the same fault tolerance, a transfer the paper says had not previously been formally analyzed.
  • The output protocol is $(1-2\rho)$-accountable, so a consistency violation always leaves evidence sufficient for slashing the responsible stakeholders.
  • Because any consensus protocol needs a quadratic number of messages in the worst case, the extra quadratic signature round added by the compiler does not change asymptotic message complexity.
  • Protocol designers can prove properties in the simpler permissioned model and inherit them in the permissionless setting, including every composable log-specific safety property at once.
  • All transferred properties hold with the same resilience $\rho$ in partial synchrony, so the compiler does not ask for a stronger honest majority.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The constant-total-stake assumption ($L.total\_stake = T$ for every log) is the cleanest point to attack: real stake functions change under issuance, slashing, and burning, so a natural next step is a variant that allows total stake to change only at epoch boundaries.
  • Because the compiler preserves every composable log-specific safety property simultaneously, application-level predicates such as transaction-validity rules transfer automatically, which may make the transformation useful for smart-contract state machines and not just a core ledger.
  • The compiler's accountability proof of guilt is derived from the same two conflicting fully-certified logs, suggesting that in the output protocol finality and accountability are inseparable even though neither is required of the input.
  • One testable adaptation would let the epoch length parameter $\ell$ be tuned adaptively per epoch; whether that can be done without breaking the $\ell+\Delta$ overlap argument is not addressed in the paper.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

2 major / 5 minor

Summary. The paper introduces a compiler T that takes a permissioned consensus protocol P satisfying consistency and liveness in the partially synchronous setting and outputs a quasi-permissionless proof-of-stake protocol T(P). The compiler executes P in epochs over permissioned-ids [1,T], where T is the constant total stake, and uses epoch-ending transactions, quorum signatures, and fully-certified logs to transition between epochs. The main theorems claim preservation of consistency, liveness, optimistic responsiveness, composable log-specific safety properties, and message complexity, plus a new accountability guarantee that holds even if P is not accountable. The formal model and detailed proofs are in Appendices A-C.

Significance. The contribution is potentially significant: a generic, closed-box permissioned-to-PoS compiler would allow permissioned protocol results to be lifted to the quasi-permissionless setting without bespoke reconfiguration designs. The paper's formal model is detailed, and the appendix proofs are mostly self-contained, with explicit preservation lemmas for quit-enhanced protocols. The accountability-by-construction result and the preservation of composable log-specific safety properties are notable strengths. However, two load-bearing scope gaps--the unstated requirement that the permissioned protocol's process set has size equal to the total stake T, and the unmodeled stake-locking assumption--currently limit the validity of the 'any permissioned protocol' claim and the liveness theorem. If these are fixed, the paper would be a strong contribution.

major comments (2)
  1. [§4.2, Algorithm 1 (lines 33, 38, 63); App. B.1] The compiler instantiates the input permissioned protocol P with the process set [1,T], where T is the constant total stake from §2, but P is formally defined in App. B.1 as a tuple with a fixed process set Π of size n. Unless n=T, the simulated 'execution of P' in each epoch is not an execution of P, and Lemmas 16-17 and Proposition 18, which are stated for P's own Π, do not apply. The constant-total-stake axiom does not imply n=T. Please either state n=T as a hypothesis of the main theorems, or define the input as a permissioned protocol family with properties holding for every process-set size, and adjust the 'any permissioned protocol' wording throughout.
  2. [§2 ('Stake', 'Quasi-permissionless setting'); App. C.5 (Lemma 40, Theorem 11)] The liveness proof assumes that the correct validators of an epoch remain active throughout the l-overlap interval. In the formal model, S(L,·) is a function of the current log and only L.total_stake is constant; individual stakes can change via transactions finalized by P. The quasi-permissionless activity guarantee is conditional on positive stake in the current log, so a correct validator whose stake is transferred away mid-epoch is not guaranteed to remain active, and the simulated permissioned execution may lack a quorum of correct active processes. The paper should either model stake as locked for the duration of an epoch, or restrict the stake function/transactions so that validator sets cannot change within an epoch, or prove liveness without relying on continued activity.
minor comments (5)
  1. [Sec. 5, 'On establishing the EAAC property'] The claim that the modified transformation satisfies EAAC is stated informally and without a formal definition, theorem, or proof; please either provide a rigorous treatment or explicitly mark this as an informal extension or conjecture.
  2. [App. C.4, proof of Thm. 10] The sentence 'Since P satisfies P against a ρ-bounded static adversary' should read 'Since P satisfies S against...'.
  3. [App. B.4, proof of Prop. 18] The equality 'GST = GST′’' contains a stray quotation mark; the intended statement is 'GST = GST′'.
  4. [App. C.5, proof of Thm. 11] In the second optimistic-responsiveness case, the proof derives finality by time max(τ,GST)+2δ+ℓ_or and then states the bound as 2δ+2ℓ_or; the larger bound is safe, but the two bounds should be presented consistently.
  5. [Sec. 5] The phrase 'quasi-permissioned' should be 'quasi-permissionless'.

Circularity Check

0 steps flagged · score 1.0 of 10

Self-contained epoch-based compiler; no load-bearing circularity; self-citation is limited to motivating framework.

full rationale

The paper's derivation chain is self-contained. The main preservation theorems (Thm 9-12) are proved by induction over epochs and by quorum-intersection arguments that rely only on the assumed properties of the input permissioned protocol P (consistency, ℓ-liveness, responsiveness) and on the formal model, not on any fitted constants or on the output being defined as the input. The map_stake machinery and the constant-total-stake assumption are a design/scope condition: the compiler instantiates the permissioned protocol over [1,T] permissioned-ids, which is a modeling choice about the input protocol family rather than a prediction derived from P; the stated condition L.total_stake = T is an assumption on the stake function, not a consequence of the compiler. The recursive definitions of epoch/completed (Defs. 20-23) are well-founded (recurse on predecessors) and are explicitly flagged as non-circular. The only mild concern is the use of co-authored prior work (Lewis-Pye-Roughgarden [68] for the QP hierarchy, EAAC, and accountability vocabulary; Neu-Tas-Tse results for DA impossibilities) to motivate the QP restriction and extensions, but these citations are not used to prove the compiler's preservation theorems and do not by themselves force the claimed results; they are external impossibility/classification statements. The unstated |Π|=T scope issue in the skeptic headline is a formalization gap / overclaim about 'any permissioned protocol', but it is a correctness caveat, not a circular reduction. Overall, no step reduces by construction to its own input.

Assumptions & free parameters 0 free parameters · 5 assumptions · 0 invented entities

The compiler's correctness rests on the QP model, constant total stake, eventual delivery even for offline senders, and the assumed liveness parameter of the input protocol. These are all stated as model assumptions, not derived.

assumptions (5)
  • domain assumption The gossip primitive guarantees eventual delivery of messages even if the sender goes offline after sending.
    Section 2 (Communication) and App. A.2. Used to ensure fully-certified logs propagate across epoch boundaries.
  • domain assumption Every log L has the same total stake T: L.total_stake = T for all L.
    Section 2 (Stake). Required by the map_stake function, which assigns one permissioned-id per unit of stake.
  • domain assumption The adversary is static and controls at most a fraction rho of the total stake.
    Section 2 and App. A.3. The proofs assume a static, not adaptive, adversary.
  • domain assumption The input permissioned protocol P satisfies consistency and liveness with a known finite parameter l against a rho-bounded adversary.
    This is the premise of the main theorems (Thm. 9, 11). The compiler uses l to set the epoch length ED = l + Delta.
  • domain assumption The quasi-permissionless setting: correct processes with positive stake are active after GST and do not experience clock drift after GST.
    Section 2 and App. A.3. The analysis is confined to the QP setting; the DA setting is explicitly out of scope.

how reviews work

0 comments
Cite this review

Pith. "Pith review of From Permissioned to Proof-of-Stake Consensus." pith.science (2026). https://pith.science/paper/Z23ZVQJL

@misc{pith2026250614124,
  author       = {Pith},
  title        = {Pith review of: From Permissioned to Proof-of-Stake Consensus},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/Z23ZVQJL}},
  note         = {Machine review of arXiv:2506.14124}
}
read the original abstract

This paper presents the first generic compiler that transforms any permissioned consensus protocol into a proof-of-stake permissionless consensus protocol. For each of the following properties, if the initial permissioned protocol satisfies that property in the partially synchronous setting, the consequent proof-of-stake protocol also satisfies that property in the partially synchronous and quasi-permissionless setting (with the same fault-tolerance): consistency; liveness; optimistic responsiveness; every composable log-specific property; and message complexity of a given order. Moreover, our transformation ensures that the output protocol satisfies accountability (identifying culprits in the event of a consistency violation), whether or not the original permissioned protocol satisfied it.

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

92 extracted references · 69 canonical work pages

  1. [1]

    BVP : Byzantine vertical Paxos

    Ittai Abraham and Dahlia Malkhi. BVP : Byzantine vertical Paxos . In Distributed Cryptocurrencies and Consensus Ledgers (DCCL) , 2016

    2016

  2. [2]

    Dynamic atomic storage without consensus

    Marcos Kawazoe Aguilera, Idit Keidar, Dahlia Malkhi, and Alexander Shraer. Dynamic atomic storage without consensus. J. ACM , 58(2):7:1--7:32, 2011

    2011

  3. [3]

    Efficient and modular consensus-free reconfiguration for fault-tolerant storage

    Eduardo Alchieri, Alysson Bessani, Fab \' ola Greve, and Joni da Silva Fraga. Efficient and modular consensus-free reconfiguration for fault-tolerant storage. In OPODIS , volume 95 of LIPIcs , pages 26:1--26:17. Schloss Dagstuhl - Leibniz-Zentrum f \" u r Informatik, 2017

    2017

  4. [4]

    Schneider

    Bowen Alpern and Fred B. Schneider. Defining liveness. Inf. Process. Lett. , 21(4):181--185, 1985

    1985

  5. [5]

    Schneider

    Bowen Alpern and Fred B. Schneider. Recognizing safety and liveness. Distributed Comput. , 2(3):117--126, 1987

    1987

  6. [6]

    Secure Spread : An integrated architecture for secure group communication

    Yair Amir, Cristina Nita - Rotaru, Jonathan Robert Stanton, and Gene Tsudik. Secure Spread : An integrated architecture for secure group communication. IEEE Trans. Dependable Secur. Comput. , 2(3):248--261, 2005

    2005

  7. [7]

    The Spread wide area group communication system

    Yair Amir and Jonathan Stanton. The Spread wide area group communication system. Technical Report CNDS-98-4, The Center for Networking and Distributed Systems, The Johns Hopkins University, 1998

    1998

  8. [8]

    Shoal++: High throughput DAG BFT can be fast and robust! In NSDI , pages 813--826

    Balaji Arun, Zekun Li, Florian Suri - Payer, Sourav Das, and Alexander Spiegelman. Shoal++: High throughput DAG BFT can be fast and robust! In NSDI , pages 813--826. USENIX Association, 2025

    2025

Show all 92 references
  1. [9]

    Mysticeti: Reaching the limits of latency with uncertified dags

    Kushal Babel, Andrey Chursin, George Danezis, Anastasios Kichidis, Lefteris Kokoris-Kogias, Arun Koshy, Alberto Sonnino, and Mingwei Tian. Mysticeti: Reaching the limits of latency with uncertified dags. arXiv:2310.14821v4 [cs.DC], 2023. URL: http://arxiv.org/abs/2310.14821v4,...

  2. [10]

    Fastpay: High-performance byzantine fault tolerant settlement

    Mathieu Baudet, George Danezis, and Alberto Sonnino. Fastpay: High-performance byzantine fault tolerant settlement. In AFT , pages 163--177. ACM , 2020

    2020

  3. [11]

    Can a public blockchain keep a secret? In TCC (1) , volume 12550 of Lecture Notes in Computer Science , pages 260--290

    Fabrice Benhamouda, Craig Gentry, Sergey Gorbunov, Shai Halevi, Hugo Krawczyk, Chengyu Lin, Tal Rabin, and Leonid Reyzin. Can a public blockchain keep a secret? In TCC (1) , volume 12550 of Lecture Notes in Computer Science , pages 260--290. Springer, 2020

    2020

  4. [12]

    Cryptocurrencies without proof of work

    Iddo Bentov, Ariel Gabizon, and Alex Mizrahi. Cryptocurrencies without proof of work. arXiv:1406.5694v9 [cs.CR], 2014. URL: http://arxiv.org/abs/1406.5694v9, https://arxiv.org/abs/1406.5694v9 arXiv:1406.5694v9

    2014 arXiv

  5. [13]

    Proof of activity: Extending Bitcoin 's proof of work via proof of stake [extended abstract]

    Iddo Bentov, Charles Lee, Alex Mizrahi, and Meni Rosenfeld. Proof of activity: Extending Bitcoin 's proof of work via proof of stake [extended abstract]. SIGMETRICS Perform. Evaluation Rev. , 42(3):34--37, 2014

    2014

  6. [14]

    State machine replication for the masses with BFT-SMART

    Alysson Neves Bessani, João Sousa, and Eduardo Adílio Pelinson Alchieri. State machine replication for the masses with BFT-SMART . In DSN , pages 355--362. IEEE Computer Society, 2014

    2014

  7. [15]

    Birman and Thomas A

    Kenneth P. Birman and Thomas A. Joseph. Reliable communication in the presence of failures. ACM Trans. Comput. Syst. , 5(1):47--76, 1987

    1987

  8. [16]

    Sui lutris: A blockchain combining broadcast and consensus

    Sam Blackshear, Andrey Chursin, George Danezis, Anastasios Kichidis, Lefteris Kokoris - Kogias, Xun Li, Mark Logan, Ashok Menon, Todd Nowacki, Alberto Sonnino, Brandon Williams, and Lu Zhang. Sui lutris: A blockchain combining broadcast and consensus. In CCS , pages 2606--2620...

    2024

  9. [17]

    An asynchronous [(n-1)/3]-resilient consensus protocol

    Gabriel Bracha. An asynchronous [(n-1)/3]-resilient consensus protocol. In PODC , pages 154--162. ACM , 1984

    1984

  10. [18]

    Tendermint : Byzantine fault tolerance in the age of blockchains

    Ethan Buchman. Tendermint : Byzantine fault tolerance in the age of blockchains. Master's thesis, University of Guelph, https://allquantor.at/blockchainbib/pdf/buchman2016tendermint.pdf, 2016

    2016

  11. [19]

    The latest gossip on BFT consensus

    Ethan Buchman, Jae Kwon, and Zarko Milosevic. The latest gossip on BFT consensus. arXiv:1807.04938v3 [cs.DC], 2018. URL: http://arxiv.org/abs/1807.04938v3, https://arxiv.org/abs/1807.04938v3 arXiv:1807.04938v3

    2018 arXiv

  12. [20]

    The economic limits of permissionless consensus

    Eric Budish, Andrew Lewis - Pye, and Tim Roughgarden. The economic limits of permissionless consensus. In EC , pages 704--731. ACM , 2024

    2024

  13. [21]

    Casper the friendly finality gadget

    Vitalik Buterin and Virgil Griffith. Casper the friendly finality gadget. arXiv:1710.09437v4 [cs.CR], 2017. URL: http://arxiv.org/abs/1710.09437v4, https://arxiv.org/abs/1710.09437v4 arXiv:1710.09437v4

    2017 arXiv

  14. [22]

    Combining ghost and casper

    Vitalik Buterin, Diego Hernandez, Thor Kamphefner, Khiem Pham, Zhi Qiao, Danny Ryan, Juhyeok Sin, Ying Wang, and Yan X Zhang. Combining ghost and casper. arXiv:2003.03052v3 [cs.CR], 2020. URL: http://arxiv.org/abs/2003.03052v3, https://arxiv.org/abs/2003.03052v3 arXiv:2003.03052v3

    2003 arXiv

  15. [23]

    Christian Cachin, Rachid Guerraoui, and Lu \' s E. T. Rodrigues. Introduction to Reliable and Secure Distributed Programming (2. ed.) . Springer, 2011

    2011

  16. [24]

    Secure and efficient asynchronous broadcast protocols

    Christian Cachin, Klaus Kursawe, Frank Petzold, and Victor Shoup. Secure and efficient asynchronous broadcast protocols. In CRYPTO , volume 2139 of Lecture Notes in Computer Science , pages 524--541. Springer, 2001

    2001

  17. [25]

    Carbon: Scaling trusted payments with untrusted machines

    Martina Camaioni, Rachid Guerraoui, Jovan Komatovic, Matteo Monti, Pierre - Louis Roman, Manuel Vidigueira, and Gauthier Voron. Carbon: Scaling trusted payments with untrusted machines. IEEE Trans. Dependable Secur. Comput. , 22(2):1168--1180, 2025

    2025

  18. [26]

    Practical byzantine fault tolerance and proactive recovery

    Miguel Castro and Barbara Liskov. Practical byzantine fault tolerance and proactive recovery. ACM Trans. Comput. Syst. , 20(4):398--461, 2002

    2002

  19. [27]

    Hubert Chan, Rafael Pass, and Elaine Shi

    T-H. Hubert Chan, Rafael Pass, and Elaine Shi. PaLa : A simple partially synchronous blockchain. Cryptology ePrint Archive, Paper 2018/981, 2018. URL: https://eprint.iacr.org/2018/981

    2018

  20. [28]

    Algorand: A secure and efficient distributed ledger

    Jing Chen and Silvio Micali. Algorand: A secure and efficient distributed ledger. Theor. Comput. Sci. , 777:155--183, 2019

    2019

  21. [29]

    Chockler, Idit Keidar, and Roman Vitenberg

    Gregory V. Chockler, Idit Keidar, and Roman Vitenberg. Group communication specifications: a comprehensive study. ACM Comput. Surv. , 33(4):427--469, 2001

    2001

  22. [30]

    Byzantine consensus is (n^2) : the Dolev - Reischuk bound is tight even in partial synchrony! Distributed Comput

    Pierre Civit, Muhammad Ayaz Dzulfikar, Seth Gilbert, Vincent Gramoli, Rachid Guerraoui, Jovan Komatovic, and Manuel Vidigueira. Byzantine consensus is (n^2) : the Dolev - Reischuk bound is tight even in partial synchrony! Distributed Comput. , 37(2):89--119, 2024

    2024

  23. [31]

    Polygraph: Accountable byzantine agreement

    Pierre Civit, Seth Gilbert, and Vincent Gramoli. Polygraph: Accountable byzantine agreement. In ICDCS , pages 403--413. IEEE , 2021

    2021

  24. [32]

    As easy as ABC: optimal (a)ccountable (b)yzantine (c)onsensus is easy! J

    Pierre Civit, Seth Gilbert, Vincent Gramoli, Rachid Guerraoui, and Jovan Komatovic. As easy as ABC: optimal (a)ccountable (b)yzantine (c)onsensus is easy! J. Parallel Distributed Comput. , 181:104743, 2023

    2023

  25. [33]

    Crime and punishment in distributed byzantine decision tasks

    Pierre Civit, Seth Gilbert, Vincent Gramoli, Rachid Guerraoui, Jovan Komatovic, Zarko Milosevic, and Adi Seredinschi. Crime and punishment in distributed byzantine decision tasks. In ICDCS , pages 34--44. IEEE , 2022

    2022

  26. [34]

    Staking module: End-block

    Cosmos Network . Staking module: End-block. https://docs.cosmos.network/v0.46/modules/staking/05\_end\_block.html, 2023

    2023

  27. [35]

    Snow White : Robustly reconfigurable consensus and applications to provably secure proof of stake

    Phil Daian, Rafael Pass, and Elaine Shi. Snow White : Robustly reconfigurable consensus and applications to provably secure proof of stake. In Financial Cryptography , volume 11598 of Lecture Notes in Computer Science , pages 23--41. Springer, 2019

    2019

  28. [36]

    Narwhal and Tusk : a DAG -based mempool and efficient BFT consensus

    George Danezis, Lefteris Kokoris - Kogias, Alberto Sonnino, and Alexander Spiegelman. Narwhal and Tusk : a DAG -based mempool and efficient BFT consensus. In EuroSys , pages 34--50. ACM , 2022

    2022

  29. [37]

    Ouroboros Praos : An adaptively-secure, semi-synchronous proof-of-stake blockchain

    Bernardo David, Peter Gazi, Aggelos Kiayias, and Alexander Russell. Ouroboros Praos : An adaptively-secure, semi-synchronous proof-of-stake blockchain. In EUROCRYPT (2) , volume 10821 of Lecture Notes in Computer Science , pages 66--98. Springer, 2018

    2018

  30. [38]

    A survey on long-range attacks for proof of stake protocols

    Evangelos Deirmentzoglou, Georgios Papakyriakopoulos, and Constantinos Patsakis. A survey on long-range attacks for proof of stake protocols. IEEE Access , 7:28712--28725, 2019

    2019

  31. [39]

    Bounds on information exchange for byzantine agreement

    Danny Dolev and R \" u diger Reischuk. Bounds on information exchange for byzantine agreement. J. ACM , 32(1):191--204, 1985

    1985

  32. [40]

    Raymond Strong

    Danny Dolev and H. Raymond Strong. Authenticated algorithms for byzantine agreement. SIAM J. Comput. , 12(4):656--666, 1983

    1983

  33. [41]

    Bchain: Byzantine replication with high throughput and embedded reconfiguration

    Sisi Duan, Hein Meling, Sean Peisert, and Haibin Zhang. Bchain: Byzantine replication with high throughput and embedded reconfiguration. In OPODIS , volume 8878 of Lecture Notes in Computer Science , pages 91--106. Springer, 2014

    2014

  34. [42]

    Foundations of dynamic BFT

    Sisi Duan and Haibin Zhang. Foundations of dynamic BFT . In SP , pages 1317--1334. IEEE , 2022

    2022

  35. [43]

    Lynch, and Larry J

    Cynthia Dwork, Nancy A. Lynch, and Larry J. Stockmeyer. Consensus in the presence of partial synchrony. J. ACM , 35(2):288--323, 1988

    1988

  36. [44]

    Ethereum consensus specifications

    Ethereum Foundation . Ethereum consensus specifications. https://github.com/ethereum/consensus-specs, 2023. Accessed: 2023-12-14

    2023

  37. [45]

    Fischer, Nancy A

    Michael J. Fischer, Nancy A. Lynch, and Mike Paterson. Impossibility of distributed consensus with one faulty process. J. ACM , 32(2):374--382, 1985

    1985

  38. [46]

    Elastic configuration maintenance via a parsimonious speculating snapshot solution

    Eli Gafni and Dahlia Malkhi. Elastic configuration maintenance via a parsimonious speculating snapshot solution. In DISC , volume 9363 of Lecture Notes in Computer Science , pages 140--153. Springer, 2015

    2015

  39. [47]

    Garay, Aggelos Kiayias, and Nikos Leonardos

    Juan A. Garay, Aggelos Kiayias, and Nikos Leonardos. The Bitcoin backbone protocol: Analysis and applications. J. ACM , 71(4):25:1--25:49, 2024

    2024

  40. [48]

    Algorand: Scaling byzantine agreements for cryptocurrencies

    Yossi Gilad, Rotem Hemo, Silvio Micali, Georgios Vlachos, and Nickolai Zeldovich. Algorand: Scaling byzantine agreements for cryptocurrencies. In SOSP , pages 51--68. ACM , 2017

    2017

  41. [49]

    Storing and retrieving secrets on a blockchain

    Vipul Goyal, Abhiram Kothapalli, Elisaweta Masserova, Bryan Parno, and Yifan Song. Storing and retrieving secrets on a blockchain. In Public Key Cryptography (1) , volume 13177 of Lecture Notes in Computer Science , pages 252--282. Springer, 2022

    2022

  42. [50]

    Dynamic byzantine reliable broadcast

    Rachid Guerraoui, Jovan Komatovic, Petr Kuznetsov, Yvonne - Anne Pignolet, Dragos - Adrian Seredinschi, and Andrei Tonkikh. Dynamic byzantine reliable broadcast. In OPODIS , volume 184 of LIPIcs , pages 23:1--23:18. Schloss Dagstuhl - Leibniz-Zentrum f \" u r Informatik, 2020

    2020

  43. [51]

    The consensus number of a cryptocurrency

    Rachid Guerraoui, Petr Kuznetsov, Matteo Monti, Matej Pavlovic, and Dragos - Adrian Seredinschi. The consensus number of a cryptocurrency. Distributed Comput. , 35(1):1--15, 2022

    2022

  44. [52]

    Peerreview: practical accountability for distributed systems

    Andreas Haeberlen, Petr Kouznetsov, and Peter Druschel. Peerreview: practical accountability for distributed systems. In SOSP , pages 175--188. ACM , 2007

    2007

  45. [53]

    Smartmerge: A new approach to reconfiguration for atomic storage

    Leander Jehl, Roman Vitenberg, and Hein Meling. Smartmerge: A new approach to reconfiguration for atomic storage. In DISC , volume 9363 of Lecture Notes in Computer Science , pages 154--169. Springer, 2015

    2015

  46. [54]

    All you need is DAG

    Idit Keidar, Eleftherios Kokoris - Kogias, Oded Naor, and Alexander Spiegelman. All you need is DAG . In PODC , pages 165--175. ACM , 2021

    2021

  47. [55]

    Gossiping in distributed systems

    Anne - Marie Kermarrec and Maarten van Steen. Gossiping in distributed systems. ACM SIGOPS Oper. Syst. Rev. , 41(5):2--7, 2007

    2007

  48. [56]

    Ouroboros: A provably secure proof-of-stake blockchain protocol

    Aggelos Kiayias, Alexander Russell, Bernardo David, and Roman Oliynykov. Ouroboros: A provably secure proof-of-stake blockchain protocol. In CRYPTO (1) , volume 10401 of Lecture Notes in Computer Science , pages 357--388. Springer, 2017

    2017

  49. [57]

    PPCoin : Peer-to-peer crypto-currency with proof-of-stake

    Sunny King and Scott Nadal. PPCoin : Peer-to-peer crypto-currency with proof-of-stake. https://peercoin.net/assets/paper/peercoin-paper.pdf, 2012

    2012

  50. [58]

    Enhancing bitcoin security and performance with strong consistency via collective signing

    Eleftherios Kokoris - Kogias, Philipp Jovanovic, Nicolas Gailly, Ismail Khoffi, Linus Gasser, and Bryan Ford. Enhancing bitcoin security and performance with strong consistency via collective signing. In USENIX Security Symposium , pages 279--296. USENIX Association, 2016

    2016

  51. [59]

    From permissioned to proof-of-stake consensus

    Jovan Komatovic, Andrew Lewis-Pye, Joachim Neu, Tim Roughgarden, and Ertem Nusret Tas. From permissioned to proof-of-stake consensus. Cryptology ePrint Archive, Paper 2025/1139, 2025. URL: https://eprint.iacr.org/2025/1139

    2025

  52. [60]

    Reconfigurable lattice agreement and applications

    Petr Kuznetsov, Thibault Rieutord, and Sara Tucci Piergiovanni . Reconfigurable lattice agreement and applications. In OPODIS , volume 153 of LIPIcs , pages 31:1--31:17. Schloss Dagstuhl - Leibniz-Zentrum f \" u r Informatik, 2019

    2019

  53. [61]

    Asynchronous reconfiguration with byzantine failures

    Petr Kuznetsov and Andrei Tonkikh. Asynchronous reconfiguration with byzantine failures. Distributed Comput. , 35(6):477--502, 2022

    2022

  54. [62]

    Tendermint: Consensus without mining

    Jae Kwon. Tendermint: Consensus without mining. https://tendermint.com/static/docs/tendermint.pdf, 2014

    2014

  55. [63]

    The part-time parliament

    Leslie Lamport. The part-time parliament. ACM Trans. Comput. Syst. , 16(2):133--169, 1998

    1998

  56. [64]

    Stoppable Paxos

    Leslie Lamport, Dahlia Malkhi, and Lidong Zhou. Stoppable Paxos . Unpublished manuscript, https://lamport.azurewebsites.net/pubs/stoppable.pdf, 2009

    2009

  57. [65]

    Vertical Paxos and primary-backup replication

    Leslie Lamport, Dahlia Malkhi, and Lidong Zhou. Vertical Paxos and primary-backup replication. In PODC , pages 312--313. ACM , 2009

    2009

  58. [66]

    Reconfiguring a state machine

    Leslie Lamport, Dahlia Malkhi, and Lidong Zhou. Reconfiguring a state machine. SIGACT News , 41(1):63--73, 2010

    2010

  59. [67]

    Quadratic worst-case message complexity for state machine replication in the partial synchrony model

    Andrew Lewis-Pye. Quadratic worst-case message complexity for state machine replication in the partial synchrony model. arXiv:2201.01107v1 [cs.DC], 2022. URL: http://arxiv.org/abs/2201.01107v1, https://arxiv.org/abs/2201.01107v1 arXiv:2201.01107v1

    2022 arXiv

  60. [68]

    Permissionless consensus

    Andrew Lewis-Pye and Tim Roughgarden. Permissionless consensus. arXiv:2304.14701v5 [cs.DC], 2023. URL: http://arxiv.org/abs/2304.14701v5, https://arxiv.org/abs/2304.14701v5 arXiv:2304.14701v5

    2023 arXiv

  61. [69]

    Beyond optimal fault tolerance

    Andrew Lewis-Pye and Tim Roughgarden. Beyond optimal fault tolerance. arXiv:2501.06044v7 [cs.DC], 2025. URL: http://arxiv.org/abs/2501.06044v7, https://arxiv.org/abs/2501.06044v7 arXiv:2501.06044v7

    2025 arXiv

  62. [70]

    CHURP: dynamic-committee proactive secret sharing

    Sai Krishna Deepak Maram, Fan Zhang, Lun Wang, Andrew Low, Yupeng Zhang, Ari Juels, and Dawn Song. CHURP: dynamic-committee proactive secret sharing. In CCS , pages 2369--2386. ACM , 2019

    2019

  63. [71]

    Distributed consensus from proof of stake is impossible

    Gregory Maxwell and Andrew Poelstra. Distributed consensus from proof of stake is impossible. https://download.wpsoftware.net/bitcoin/pos.pdf, 2014

    2014

  64. [72]

    The honey badger of BFT protocols

    Andrew Miller, Yu Xia, Kyle Croman, Elaine Shi, and Dawn Song. The honey badger of BFT protocols. In CCS , pages 31--42. ACM , 2016

    2016

  65. [73]

    Moser, Yair Amir, P

    Louise E. Moser, Yair Amir, P. M. Melliar - Smith, and Deborah A. Agarwal. Extended virtual synchrony. In ICDCS , pages 56--65. IEEE Computer Society, 1994

    1994

  66. [74]

    Bitcoin: A peer-to-peer electronic cash system

    Satoshi Nakamoto. Bitcoin: A peer-to-peer electronic cash system. https://bitcoin.org/bitcoin.pdf, 2008

    2008

  67. [75]

    Ebb-and-flow protocols: A resolution of the availability-finality dilemma

    Joachim Neu, Ertem Nusret Tas, and David Tse. Ebb-and-flow protocols: A resolution of the availability-finality dilemma. In SP , pages 446--465. IEEE , 2021

    2021

  68. [76]

    The availability-accountability dilemma and its resolution via accountability gadgets

    Joachim Neu, Ertem Nusret Tas, and David Tse. The availability-accountability dilemma and its resolution via accountability gadgets. In Financial Cryptography , volume 13411 of Lecture Notes in Computer Science , pages 541--559. Springer, 2022

    2022

  69. [77]

    Short paper: Accountable safety implies finality

    Joachim Neu, Ertem Nusret Tas, and David Tse. Short paper: Accountable safety implies finality. In FC (1) , volume 14744 of Lecture Notes in Computer Science , pages 41--50. Springer, 2024

    2024

  70. [78]

    Ousterhout

    Diego Ongaro and John K. Ousterhout. In search of an understandable consensus algorithm. In USENIX ATC , pages 305--319. USENIX Association, 2014

    2014

  71. [79]

    Hybrid consensus: Efficient consensus in the permissionless model

    Rafael Pass and Elaine Shi. Hybrid consensus: Efficient consensus in the permissionless model. In DISC , volume 91 of LIPIcs , pages 39:1--39:16. Schloss Dagstuhl - Leibniz-Zentrum f \" u r Informatik, 2017

    2017

  72. [80]

    The sleepy model of consensus

    Rafael Pass and Elaine Shi. The sleepy model of consensus. In ASIACRYPT (2) , volume 10625 of Lecture Notes in Computer Science , pages 380--409. Springer, 2017

    2017

  73. [81]

    Thunderella: Blockchains with optimistic instant confirmation

    Rafael Pass and Elaine Shi. Thunderella: Blockchains with optimistic instant confirmation. In EUROCRYPT (2) , volume 10821 of Lecture Notes in Computer Science , pages 3--33. Springer, 2018

    2018

  74. [82]

    Uniform reliable multicast in a virtually synchronous environment

    Andr \' e Schiper and Alain Sandoz. Uniform reliable multicast in a virtually synchronous environment. In ICDCS , pages 561--568. IEEE Computer Society, 1993

    1993

  75. [83]

    BFT protocol forensics

    Peiyao Sheng, Gerui Wang, Kartik Nayak, Sreeram Kannan, and Pramod Viswanath. BFT protocol forensics. In CCS , pages 1722--1743. ACM , 2021

    2021

  76. [84]

    Abc: Proof-of-stake without consensus

    Jakub Sliwinski and Roger Wattenhofer. Abc: Proof-of-stake without consensus. arXiv:1909.10926v3 [cs.CR], 2019. URL: http://arxiv.org/abs/1909.10926v3, https://arxiv.org/abs/1909.10926v3 arXiv:1909.10926v3

    1909 arXiv

  77. [85]

    Shoal: Improving DAG-BFT latency and robustness

    Alexander Spiegelman, Balaji Arun, Rati Gelashvili, and Zekun Li. Shoal: Improving DAG-BFT latency and robustness. In FC (1) , volume 14744 of Lecture Notes in Computer Science , pages 92--109. Springer, 2024

    2024

  78. [86]

    Bullshark: DAG BFT protocols made practical

    Alexander Spiegelman, Neil Giridharan, Alberto Sonnino, and Lefteris Kokoris - Kogias. Bullshark: DAG BFT protocols made practical. In CCS , pages 2705--2718. ACM , 2022

    2022

  79. [87]

    Dynamic reconfiguration: Abstraction and optimal asynchronous solution

    Alexander Spiegelman, Idit Keidar, and Dahlia Malkhi. Dynamic reconfiguration: Abstraction and optimal asynchronous solution. In DISC , volume 91 of LIPIcs , pages 40:1--40:15. Schloss Dagstuhl - Leibniz-Zentrum f \" u r Informatik, 2017

    2017

  80. [88]

    Improved dynamic byzantine fault tolerant consensus mechanism

    Fei Tang, Jinlan Peng, Ping Wang, Huihui Zhu, and Tingxian Xu. Improved dynamic byzantine fault tolerant consensus mechanism. Computer Communications , 2024. https://doi.org/10.1016/j.comcom.2024.08.004. https://doi.org/10.1016/j.comcom.2024.08.004 doi:10.1016/j.comcom.2024.08.004

    2024 doi

  81. [89]

    Rosenfeld

    User cunicula and M. Rosenfeld. Proof of stake brainstorming. https://bitcointalk.org/index.php?topic=37194.0, 2011

    2011

  82. [90]

    Proof of stake instead of proof of work

    User QuantumMechanic . Proof of stake instead of proof of work. https://bitcointalk.org/index.php?topic=27787.0, 2011

    2011

  83. [91]

    Netcoin proof-of-work and proof-of-stake hybrid design

    User tacotime . Netcoin proof-of-work and proof-of-stake hybrid design. https://web.archive.org/web/20131213085759/http://www.netcoin.io/wiki/Netcoin\_Proof-of-Work\_and\_Proof-of-Stake\_Hybrid\_Design, 2013

    2013

  84. [92]

    Reiter, Guy Golan - Gueta, and Ittai Abraham

    Maofan Yin, Dahlia Malkhi, Michael K. Reiter, Guy Golan - Gueta, and Ittai Abraham. HotStuff : BFT consensus with linearity and responsiveness. In PODC , pages 347--356. ACM , 2019

    2019

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.