{"id":"1c9c8d01-bfd0-47a9-a399-deb80aa433b2","arxiv_id":"2506.09823","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":4.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":9,"one_line_summary":"Frosty is extended from synchronous Snowman to partially synchronous Snowman diamond by using Simplex during fallback epochs and adding starting certificates that preserve finalized values across epochs.","lead":"This note adapts the Frosty liveness module to the partially synchronous Snowman diamond consensus protocol, so a fast blockchain consensus can fall back to a slower quorum protocol during long network stalls or attacks. A generalist might care because it closes a gap where Avalanche-style Snowman could lose liveness against large adversaries under realistic network conditions.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Cross-epoch consistency proof imports (⋄1) from [3] without showing the new alpha3 finality rule preserves it; the missing induction from (⋄0) is the load-bearing gap.","rationale":"Good-faith reading: this is a short research note whose aim is to combine two prior results: Frosty's liveness module and Snowman⋄'s partial-synchrony consistency. The central claim is the combined protocol's consistency and liveness under the stated parameters. The liveness argument (Claims 3 and 4) is plausible and mostly self-contained given standard Simplex liveness; the consistency argument reduces to two parts: within even epochs and across epochs. Within even epochs, the alpha3 rule is handled with (⋄0) and a first-violation argument that is sound, modulo the usual small-probability accounting. Across epochs is where the paper is not self-contained: it imports (⋄1) from [3] after changing the even-epoch finality rule. The reader flagged exactly this. My stress-test sharpens it: (⋄0) is not a substitute for (⋄1). (⋄0) only provides one prior correct finalization; (⋄1) requires a 3/4-correct-process property for starting votes. Connecting the two requires an induction over the chain of alpha3 finalizations back to an original finalization, and the paper does not provide it. I attempted this induction in my own reading and believe it can be completed, which is why I do not move the verdict to REJECT; however, because the paper leaves it as an unproved inference, the conditional verdict is appropriate. I also note a parameter typo (beta=12 vs 14) and the acknowledged partial-hash issue, which are secondary and do not alter the main concern. Recommended verdict stays CONDITIONAL/UNCHANGED.","tokens_in":11066,"tokens_out":29394,"duration_ms":325761,"concrete_test":"Formalize the induction explicitly: assume (⋄1) holds for every even-epoch finalization before time t, assume (⋄0) at t, and take an alpha3 finalization of sigma at t. Let tau be an extension of sigma that was already final for a correct process before t. If tau was finalized by the original rule, invoke (⋄1) for tau; if by alpha3, recurse. Verify that the resulting 3/4-correct-process property covers every starting vote for the epoch, including votes sent before t, using the 'until they enter the next odd epoch' formulation from [3, §8]. If the induction fails, exhibit an execution and a starting certificate whose Pref(C) does not extend sigma.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim depends on (⋄1), imported from Section 8 of [3], which was proved for Snowman⋄'s original finality rule. The new alpha3 decision rule (Algorithm 2, line 52) creates additional finalization events. The paper proves (⋄0) for these events, i.e., that such a finalization is preceded by some correct process already having finalized an extension of the value, and then asserts that (⋄1) still holds for the modified protocol. This is not immediate. To get (⋄1) for an alpha3-finalized value sigma, one must show that the earlier finalization of tau⊇sigma (whose existence follows from (⋄0)) itself carries the 'more than 3/4 of correct processes' starting-vote property; if tau was itself alpha3-finalized, the argument must recurse to the last original finalization. The paper gives no such inductive proof, and it also does not bound starting votes sent before the alpha3 finalization in the SC majority calculation. Because Pref(C) is defined from a 4n/5 starting certificate, a failure of (⋄1) for even one finalization can make Simplex finalize a value that does not extend an even-epoch final value, breaking consistency across epochs. The gap is probably repairable, but as written the proof of the central claim is incomplete. Secondary issues: Section 3 states beta=12 while Section 6 uses beta=14, and the partial-hash issue is acknowledged but not resolved.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper specifies Frosty, a liveness module, on top of Snowman⋄ for the partially synchronous setting. It proposes a two-epoch structure: even epochs run Snowman⋄ with an added decision condition (α3) that lets a process finalize a value when two consecutive samples contain at least α3 reports of finalized values extending it, while odd epochs run Simplex, initialized from a starting certificate of 4n/5 starting votes. The main claim is that for k=80, α1=41, α2=72, α3=48, β=14, γ≥300, n≥250, and f<n/5, the protocol maintains consistency across even and odd epochs and ensures liveness with small error probability under bounded executions. The consistency proof imports the lemma (⋄1) from [3] and separately proves a local lemma (⋄0) for the new α3 rule; the liveness proof assumes that the set E of available child blocks is never empty.","tokens_in":11487,"tokens_out":10261,"duration_ms":102979,"significance":"If correct, the contribution is practically relevant: it would extend the Frosty liveness module from the synchronous Snowman+ setting to the partially synchronous Snowman⋄, with explicit parameters and concrete error bounds, and it identifies Simplex as the fallback protocol. The paper is transparent about inherited assumptions and provides protocol pseudocode at a level suitable for subsequent implementation. However, the central cross-epoch consistency theorem is not established as written because the key lemma (⋄1) is imported from a protocol without the new α3 finalization rule, and no proof is given that the new rule preserves the lemma. The liveness result is also conditional on an unproved assumption about block availability. These gaps are local and likely repairable, but they are load-bearing for the stated claims.","major_comments":[{"comment":"The proof that Pref(C) extends every even-epoch final value relies on (⋄1), which is imported from [3] for 'any correct process finalizes σ while in an even epoch'. The protocol analyzed in [3] does not include the new finality condition given in Algorithm 2, line 52. That new condition creates additional finalization events, and the present paper proves only (⋄0) for those events. (⋄0) says that some correct process has already finalized a value extending σ; it does not say that more than 3/4 of the correct processes that later send starting votes extend σ, nor does it control starting votes sent before the α3-based finalization. Obtaining (⋄1) for an α3-finalized σ would require an induction over finalization events, showing that the earlier finalization τ⊇σ itself has the required starting-vote property, and if τ is also α3-finalized the argument must recurse. No such inductive proof is supplied. Without (⋄1), a starting certificate may fail to extend an even-epoch final value, so the cross-epoch consistency claim is not proved.","section":"Section 6.1, event (⋄1)"},{"comment":"Liveness is proved under the assumption that the set E specified in Algorithm 2, line 26 is never empty for correct processes when they begin the while loop. This is a substantive liveness assumption that is not derived from the partial-synchrony model or from any block-proposal mechanism. The abstract and Section 1 state the result without this qualification. The theorem should be stated with this caveat, or the assumption should be justified by an explicit argument that new blocks are always available to correct processes.","section":"Section 6.2, first paragraph"},{"comment":"The text says 'From (⋄1) and the fact that f>n/5 it follows that σ⊆Pref(C)'. The inequality should be f<n/5; with f>n/5 the implication is reversed. This step is the bridge from (⋄1) to cross-epoch consistency, so the inequality must be corrected and the arithmetic checked.","section":"Section 6.1, final paragraph"}],"minor_comments":[{"comment":"Section 3 states β=12, while Section 6 uses β=14 for the analysis; the discrepancy should be reconciled.","section":"Section 3 vs Section 6"},{"comment":"Condition (ii) reuses s′ as both the starting round of the interval and the index in rfin(j,s′,e); it should read rfin(j,s″,e) inside the quantification over s″.","section":"Algorithm 2, line 52"},{"comment":"The bound 2×10^{-13} is computed under the stated cap of 10,000 processes, 1000 years, and 5 rounds per second; this finite execution bound should be made part of the theorem statement, since the error probability grows with execution length.","section":"Section 6.1, probability bound for (⋄0)"},{"comment":"The footnote raises the partial-hash issue for the final block in Pref(C) but only says it 'requires consideration'; a sentence explaining why the partial hash does not affect consistency or liveness would remove ambiguity.","section":"Footnote 4"},{"comment":"The proof of (⋄0) is only sketched by reference to [2]; since [2] analyzes a different Snowman variant in the synchronous setting, a self-contained derivation of the binomial bound would strengthen the paper.","section":"Section 6.1, derivation of (⋄0)"}],"recommendation":"major_revision","confidential_remarks":"The manuscript is a short note that depends heavily on two self-authored preprints, [2] and [3]. The main gap—adapting the imported (⋄1) lemma to the new α3 rule—should be fixed before publication. The liveness assumption about the non-emptiness of E should be stated in the abstract and theorem statements. I would not recommend rejection if the authors can supply the missing induction and the numerical derivation for the cross-epoch property, but as written the central consistency claim is incomplete."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"This is a short, honest follow-up note that does exactly what it says: it takes the Frosty liveness module and bolts it onto Snowman⋄ for partial synchrony. The authors are upfront that the analysis leans on [2] and [3], and they give explicit parameter values (k=80, alphas 41/72/48, beta, gamma, n≥250, f<n/5). That concreteness is valuable. The liveness argument for Claim 3 is sketched plausibly, and the binomial bounds are simple enough to check. The main problem is exactly what the stress-test flagged: the consistency proof between even epoch e and odd epoch e+1 uses the imported event (⋄1) from Section 8 of [3], but the new alpha3 finality rule (Algorithm 2, line 52) creates additional finalization events that (⋄1) was not proved for. The paper proves (⋄0) for those events, i.e. that an alpha3 finalization is preceded by some correct process already having finalized an extension. But to get (⋄1) you need more: the earlier finalization that (⋄0) gives you must itself carry the \"more than 3/4 of correct processes\" starting-vote property. If that earlier finalization is itself alpha3-based, you need to recurse back to the last original finalization, and that induction is absent. The paper also does not account for starting votes sent before the alpha3 finalization when forming the 4n/5 starting certificate. This is a load-bearing gap, not a cosmetic one. It is probably repairable, but as written the central consistency claim is incomplete. Secondary issues are minor by comparison: Section 3 says beta=12 while Section 6 uses beta=14, and the partial-hash issue in fin() is acknowledged but hand-waved. The liveness proof assumes new blocks always exist (E non-empty), which is stated but makes the liveness guarantee conditional on a continuous supply of proposed blocks. On the positive side: the paper is well-positioned in its research program, the parameters are explicit, and the authors do not oversell. The citation pattern is reasonable — they cite their own preprints because they are building directly on them, and that is legitimate. Still, this is a note, not a full proof; a serious referee should ask for the missing (⋄1) induction and the beta fix. I would send this to peer review with the expectation of a major revision. The combination is worth having, but the proof needs to be completed. For a reading group or someone working on Avalanche-family protocols, it is worth a look as is; for a general consensus audience, wait for the revised version.","headline":"A useful combination note with a real gap: the cross-epoch consistency proof imports (⋄1) without showing the new alpha3 finality rule preserves it.","tokens_in":769,"tokens_out":876,"would_cite":false,"duration_ms":21315,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Appending the Frosty liveness module to Snowman⋄ preserves consistency and liveness in partial synchrony, for f < n/5 and n ≥ 250.","keywords":["Frosty","Snowman⋄","partial synchrony","liveness module","consensus","epoch change","Simplex","starting certificate"],"falsifier":"Run the even-epoch protocol with n = 250, f = 50, k = 80, α3 = 48 under an adversarial scheduler that controls sample sequences, and check whether a correct process can finalize a value σ via the α3 rule while fewer than 3/4 of the correct processes later include σ in their starting votes; exhibiting such an execution would invalidate (⋄1) and break the cross-epoch consistency argument.","tokens_in":10894,"feed_emoji":"❄️","tokens_out":4901,"duration_ms":48152,"temperature":0.7,"pith_summary":"This note shows that the Frosty liveness module, previously designed for the synchronous Snowman protocol, can be adapted to run on top of the partially synchronous Snowman⋄ protocol. The authors give two algorithms that split execution into even epochs running Snowman⋄ and odd epochs running a Simplex-based quorum protocol, connected by starting certificates. They argue that, for n ≥ 250 and f < n/5, the protocol preserves consistency across epochs and ensures liveness with small error probability, measured under bounded executions. The result matters because it gives Snowman-style consensus the liveness guarantees of Frosty without requiring a synchrony assumption.","feed_headline":"Frosty now keeps Snowman consistent under partial synchrony","feed_subtitle":"Modified Frosty bridges Snowman⋄ epochs with Simplex, preserving liveness and consistency for f < n/5.","key_machinery":"The central machinery is the epoch structure with starting and epoch certificates. A starting certificate is a set of at least 4n/5 signed starting votes, and Pref(C) is the longest chain extended by more than half of those votes; this bridge forces values finalized in an odd epoch to extend all even-epoch final values. An epoch certificate is a set of at least n/5 stuck messages that triggers movement into the next odd epoch. The other load-bearing piece is the new finality condition (α3 = 48): two consecutive samples in which at least 3/5 of the sampled processes report final values extending σ allow a process to finalize σ, which keeps epoch changes timely. In odd epochs, Simplex with notarizations and finalizations ensures quorum-based consistency.","core_discovery":"The central claim is that Algorithms 1 and 2 define a Frosty extension of Snowman⋄ that is consistent and live in the standard partial synchrony model: consistency holds at all times, and after GST liveness holds except for small error probabilities. Consistency across an even-to-odd epoch boundary is carried by the starting certificate: since each starting vote extends the previous even-epoch final value when event (⋄1) holds, Pref(C) extends every value finalized in the previous even epoch. Within even epochs the new α3 finality rule is shown safe because, conditioned on event (⋄0), it only finalizes a value already finalized by a correct process. Liveness is established by showing that, within bounded time after GST, either all correct processes advance their final value or all enter the odd epoch, where Simplex finalizes a new value.","pith_inferences":["The paper imports event (⋄1) from the Snowman⋄ consistency proof, but that proof was for the unmodified even-epoch protocol; because the new α3 finality rule changes even-epoch behavior, the cross-epoch consistency argument has a missing load-bearing link unless (⋄1) is re-established under the modification.","A natural testable extension is to verify (⋄1) computationally for the modified protocol around f = n/5, checking whether more than 3/4 of correct starting votes extend a value finalized under the α3 rule in worst-case sample sequences.","The parameter values (n ≥ 250, f < n/5, k = 80, α3 = 48) are chosen to make binomial estimates simple; the same structure likely works for other parameter ranges but with different error bounds.","The authors note that periods of asynchrony alone can trigger an epoch change, so in deployments γ must be calibrated against realistic asynchrony durations; this is a tuning concern the paper leaves to practice."],"forward_implications":["Frosty can be used with Snowman⋄ in partial synchrony, so the communication-complexity advantages of Snowman during normal operation are preserved while liveness attacks by adversaries up to f < n/5 are handled.","Consistency between even and odd epochs is guaranteed with error probability at most about 2×10⁻⁵ plus the small probability of (⋄0) failing, under the stated execution bounds.","An odd epoch finalizes at least μ Simplex blocks and then returns to Snowman⋄; the choice of μ and γ are parameters to be set by the implementer.","Epoch changes can now be triggered by long periods of asynchrony as well as deliberate liveness attacks, so γ should be chosen large enough to avoid spurious epoch changes."],"supporting_citations":[{"why":"Supplies the original Frosty liveness module, the epoch-change structure, and the α3 finality rule that this paper adapts to partial synchrony.","marker":"[2]"},{"why":"Gives the Snowman⋄ protocol for partial synchrony and the consistency proof from which event (⋄1) is imported for cross-epoch consistency.","marker":"[3]"},{"why":"Provides the Simplex consensus protocol used during odd epochs, including quorum intersection and liveness.","marker":"[4]"},{"why":"Describes the view/epoch-change approach between optimistic and fallback paths that motivates the Frosty epoch structure.","marker":"[5]"}],"fun_headline_variants":["Frosty adapted to partially synchronous Snowman","Modified Frosty handles partial synchrony for Snowman","Snowman⋄ gets Frosty liveness under partial synchrony","Frosty for Snowman⋄: consistency and liveness after GST","Consistent and live Snowman⋄ with Frosty in partial sync"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The cross-epoch consistency proof relies on event (⋄1): that whenever a correct process finalizes a value in an even epoch, more than 3/4 of correct processes that later send a starting vote extend that value, and this event is imported from the proof for the unmodified Snowman⋄ protocol without a proof that the new α3 finality rule preserves it.","fun_headline_variants_meta":{"raw":{"variants":["Frosty adapted to partially synchronous Snowman","Modified Frosty handles partial synchrony for Snowman","Snowman⋄ gets Frosty liveness under partial synchrony","Frosty for Snowman⋄: consistency and liveness after GST","Consistent and live Snowman⋄ with Frosty in partial sync"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.00042,"raw_usage":{"total_tokens":2081,"prompt_tokens":783,"completion_tokens":1298,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":399,"completion_tokens_details":{"reasoning_tokens":1211}},"tokens_in":399,"tokens_out":1298,"duration_ms":10203,"temperature":1.0,"reasoning_tokens":1211,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-07T04:41:44.013909+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run the even-epoch protocol with n = 250, f = 50, k = 80, α3 = 48 under an adversarial scheduler that controls sample sequences, and check whether a correct process can finalize a value σ via the α3 rule while fewer than 3/4 of the correct processes later include σ in their starting votes; exhibiting such an execution would invalidate (⋄1) and break the cross-epoch consistency argument.","supporting_citations":[{"cited_title":"Snowman for partial synchrony","cited_arxiv_id":"2501.15904","evidence_quote":"Gives the Snowman⋄ protocol for partial synchrony and the consistency proof from which event (⋄1) is imported for cross-epoch consistency."},{"cited_title":"Simplex consensus: A simple and fast consensus protocol","cited_arxiv_id":null,"evidence_quote":"Provides the Simplex consensus protocol used during odd epochs, including quorum intersection and liveness."},{"cited_title":"Jolteon and ditto: Network-adaptive efficient consensus with asynchronous fallback","cited_arxiv_id":null,"evidence_quote":"Describes the view/epoch-change approach between optimistic and fallback paths that motivates the Frosty epoch structure."}],"review_version":1}