{"id":"1cf7c5f6-0419-4db3-bdf1-472cdc2139ab","arxiv_id":"2509.01118","paper_version":2,"verdict":"REJECT","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"high","formal_verification":"none","parameter_count":3,"one_line_summary":"Ocior is a leaderless asynchronous BFT protocol advertising two-round finality and O(n) overhead via a layered threshold signature, but its adaptive-security proofs are deferred and its O(n) computation good case is vanishingly rare at maximal corruption.","lead":"A leaderless asynchronous Byzantine-fault-tolerant consensus protocol claims two-round finality for simple transactions, linear communication, and adaptive security. The decisive guarantees rest on proofs deferred to an extended version, and on a 'good case' that the paper's own parameters make exponentially unlikely.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"LTS 'good case' is impossible at the paper's own n=1400, t=466 parameters, so the advertised O(n) good-case computation cannot hold at optimal resilience.","rationale":"The reader's REJECT verdict is correct. The two-round good-case latency and the quorum-intersection safety argument (Theorem 1) are internally plausible; I would not attack those. The decisive defect is the LTS parameterization used to substantiate O(n) aggregation. The paper's own n=1400 example cannot have a good case at t=466 by a pure pigeonhole count, so the 'good case' probability is not merely low but zero for that configuration. This is stronger than the reader's probabilistic estimate. The reader's separate concern about deferred ADKG proofs (Section VI) is valid and independently prevents acceptance of the adaptive-security claim, but the LTS count is a concrete internal inconsistency. Because advertised O(n) computation is a headline contribution, the verdict remains REJECT. If the authors can exhibit a feasible parameter set with positive good-case probability and prove ADKG security, the work could be revisited; currently no such parameters are given.","tokens_in":54580,"tokens_out":16888,"duration_ms":217542,"concrete_test":"Analytical check: for the Fig. 2 parameters, let x be the number of Layer-3 groups containing at most t3=n3-k3=2 faulty nodes. Show x≤116 by capacity: if x=117, the remaining 23 groups would need to contain ≥466-234=232 faults, exceeding their capacity 230. Compare with Definition 27's requirement of 13×9=117 such groups for any good case. If the check passes, no LTS final signature can be produced at t=466, so the paper must either supply a different parameter set satisfying n=∏ nℓ, ∏ kℓ ≥ k, with non-negligible good-case probability, or retract the O(n) best-case computation claim.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The most load-bearing condition is that the OciorBLSts LTS 'good case' (Definition 27) is satisfiable whenever the paper's complexity claims are invoked. At the paper's own parameters (Section III.B/C, Fig. 2: n=1400, t=466, L=3, n1=14, k1=13, n2=10, k2=9, n3=10, k3=8), a good-case collection must produce at least k1=13 valid Layer-1 signatures. A valid Layer-1 signature needs k2=9 valid Layer-2 parents, and a valid Layer-2 signature requires its corresponding Layer-3 group P3,b to have at least k3=8 valid bottom signatures; under worst-case Byzantine withholding, this means at most n3-k3=2 faulty nodes in that 10-node group. Hence any good case requires 13*9=117 distinct Layer-3 groups with at most 2 faulty nodes. But with t=466 faulty nodes over 140 Layer-3 groups, this is impossible: 117 groups can contain at most 234 faults, leaving at least 232 faults for the remaining 23 groups, whose total capacity is 230. Therefore the good case has probability zero for any corruption set of size 466. This contradicts Section III.C's assertion that after O(t) epochs the probability of a good case 'becomes very high' and invalidates Theorem 7's O(n) best-case computation per transaction at optimal resilience. The OciorBLSts 'instantaneous aggregation' and O(n) aggregation claims are unsupported; only the O(n log^2 n) TS fallback remains. Separately, Section VI defers all ADKG proofs, so adaptive security is also unverified.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes Ocior, an asynchronous leaderless BFT consensus protocol claiming optimal resilience (n >= 3t+1 against an adaptive adversary), O(n) expected communication per transaction, O(n) best-case / O(n log^2 n) worst-case computation, and two-round good-case finality for two-party transactions. The design uses n parallel proposal chains, per-transaction consensus instances, short \"Attested Proof of Seal\" certificates, and a new threshold-signature scheme OciorBLSts based on Layered Threshold Signatures (LTS). Section VI introduces OciorADKG to support adaptive security. The paper gives theorems for safety, liveness, round complexity, communication complexity, and computation complexity, with section-level proofs and pseudocode.","tokens_in":54920,"tokens_out":9269,"duration_ms":122018,"significance":"If the results were established, this would be a substantial advance: two-round asynchronous finality at optimal resilience with linear communication would be stronger than existing asynchronous BFT protocols. The manuscript is detailed and the basic quorum-intersection safety argument (Theorem 1) is internally consistent for same-parent conflicts; the two-round good-case latency is plausible by construction under well-behaved scheduling; and the algebraic identity in Appendix A is proved correctly. However, the headline good-case computation claim is contradicted by the paper's own LTS parameters, and the adaptive-security claim is explicitly deferred to an extended version. The central contributions are therefore not established in the submitted manuscript.","major_comments":[{"comment":"The LTS 'good case' is impossible at the paper's own parameters (n=1400, t=466, L=3, n1=14, k1=13, n2=10, k2=9, n3=10, k3=8). A valid final signature requires 13 valid Layer-1 partial signatures, each requiring 9 valid Layer-2 parents, each requiring 8 valid Layer-3 leaves in a 10-node group. Hence 117 distinct Layer-3 groups must each contain at most n3-k3=2 faulty nodes. With t=466, 117 groups can absorb at most 234 faulty nodes, leaving at least 232 faulty nodes for the remaining 23 groups, whose total capacity is 230. Therefore the good case has probability zero for every corruption set of size 466. This directly contradicts the Section III.C assertion that the probability of a good case 'becomes very high' after O(t) epochs, and it invalidates Theorem 7's O(n) best-case computation per transaction at optimal resilience.","section":"Section III.C, Definition 27, Fig. 2"},{"comment":"The adaptive-security guarantee, featured in the title and abstract, has no proof in this manuscript. Section VI explicitly states: 'we focus on describing the proposed OciorADKG protocol and the introduced primitives, while leaving detailed proofs to the extended version of this paper.' The construction depends on the new OciorSHPC and OciorASHVSS primitives and on the author's own APVA protocol [23], none of which is established here. Since the consensus theorems assume adaptively secure threshold signatures, the central security claim is unsupported.","section":"Section VI"},{"comment":"There is a load-bearing inconsistency about the vote threshold for finality. The basic protocol description says a proposer generates a threshold signature after receiving k=ceil((n+t+1)/2) valid partial signatures, but Algorithm 4 (line 12) and Algorithm 5 (line 128) wait for |A_ts[ID]| = n-t before running TS.Combine. For n > 3t+1, k < n-t, so the two-round finality claim in Theorem 5 is not tied to a single, well-defined combination event. The paper should specify exactly which condition produces the APS and prove the good-case latency for that condition.","section":"Section IV.B, Algorithm 4, Algorithm 5"},{"comment":"The proof of O(n) expected communication relies on the unproven assertion that 'each honest node selects a transaction different from those proposed by other honest nodes with constant probability' and does not rigorously account for duplicate proposals, re-proposals, and APS propagation in the per-transaction amortization. Since O(n) communication is one of the paper's headline optimality claims, this needs a precise argument with explicit parameters and adversarial cases.","section":"Section V, Theorem 6"}],"minor_comments":[{"comment":"'information theocratic secure' should read 'information-theoretically secure'.","section":"Algorithm 2 caption"},{"comment":"The statement that the adversary 'becomes effectively static after O(t) epochs' is informal and not proved. An adaptive adversary can keep corrupting different nodes over time; the security argument must handle all corruption patterns, not only those that exhaust the budget.","section":"Section III.C"},{"comment":"The inequality '>= (3t+1+t+1)/2 - 2t > 1' is false at n=3t+1, where the value is exactly 1. The lemma may still be repairable, but the calculation should be corrected to '>= 1'.","section":"Lemma 2 proof"},{"comment":"The text contains typos such as 'f alse' for 'false'. Also, the security games would benefit from explicitly stating that partial signatures from corrupted nodes count toward the adversary's 'obtained' set, which is implicitly done but should be formalized.","section":"Definitions 19, 20, 28, 29"},{"comment":"The table lists Ocior's good-case computation as O(n), but this is exactly the claim contradicted by the LTS parameter analysis; the table should be reconsidered after the LTS good-case issue is resolved.","section":"Section I, Table I"}],"recommendation":"reject","confidential_remarks":"The manuscript's load-bearing components are either self-contradicted at its own parameter setting (the LTS good case) or deferred to an extended version (OciorADKG correctness and adaptive security). Moreover, several key building blocks are drawn from the author's own unrefereed or self-cited work ([15]-[17], [23]), which makes external verification difficult. The editor may wish to require complete proofs of the ADKG and a valid parameter regime for the LTS good case before any further review round."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"First thing to know: the layered threshold signature (LTS) construction is genuinely new—fixed small groups with precomputed Lagrange coefficients is a real improvement over the cited O(n log^2 n) aggregation work—and the parallel per-node chain design with Type I/II APS proofs is coherent. The safety core (Theorem 1) holds up as a quorum-intersection argument, and the two-round good-case latency for honest-proposed transactions is true by construction.\n\nThe soft spots are where the paper actually lands. The O(n) computation claim is not just unproven; it is impossible at the paper's own parameters. With n=1400, t=466, L=3, n3=10, k3=8, a good case requires 13 Layer-1 signatures, each from 9 Layer-2 signatures, each requiring a Layer-3 group with at most 2 faults—so 117 distinct Layer-3 groups must each have ≤2 faults. Any corruption set of size 466 leaves at least 232 faults for the remaining 23 groups, whose total capacity is 230. The good case has probability exactly zero for every corruption set, contradicting Section III.C's claim that it becomes 'very high' after O(t) epochs. Consequently Theorem 7's O(n) best-case computation cannot hold at optimal resilience; only the O(n log^2 n) fallback remains.\n\nAdaptive security is similarly unestablished: Section VI explicitly defers all OciorADKG proofs to an extended version, and the protocol leans on the author's own APVA and COOL-based HMDM results, none of which is machine-checked or externally verified. Finally, the O(n) communication bound in Theorem 6 rests on an unstated workload assumption—that honest nodes pick distinct transactions with constant probability—which is a property of the transaction pool, not a protocol guarantee.\n\nWorth saying the paper is well-organized and the definitions are careful; the author is thinking hard about a real problem. But the two headline results are not supported. The LTS idea might be salvageable with different parameters or multiple independent LTS instantiations, and the ADKG proofs could be supplied. As it stands, a serious expert should look at the LTS construction and the impossibility argument, but the paper should not be accepted as is.","headline":"Genuine LTS novelty, but the O(n) computation claim is impossible at the paper's own parameters and adaptive security is deferred—so the headline results don't stand.","tokens_in":55553,"tokens_out":5109,"would_cite":false,"duration_ms":58398,"reading_group":"maybe","serious_thinker":"no","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Asynchronous BFT finalizes transactions in two rounds with linear overhead","keywords":["asynchronous Byzantine fault tolerance","leaderless consensus","adaptive security","threshold signature","layered threshold signature","Attested Proof of Seal","communication complexity","blockchain finality"],"falsifier":"Fix n=1400, t=466, L=3 with group sizes (14,10,10) and thresholds (13,9,8). Compute or simulate the probability that a random placement of 466 faulty nodes puts at most 2 faulty nodes in every one of the 140 leaf groups of size 10. If that probability is negligible rather than very high, the central good-case assumption fails. Alternatively, run Ocior with an adaptive adversary and measure how often a two-round APS is actually produced before the fallback path completes.","tokens_in":1903,"feed_emoji":"⚡","tokens_out":4434,"duration_ms":126279,"temperature":0.7,"pith_summary":"Ocior sets out to close the gap between asynchronous Byzantine fault-tolerant consensus and latency-sensitive blockchains. It claims a leaderless protocol that can irrevocably finalize a two-party transaction after two one-way message rounds even under arbitrary network delays and an adaptive adversary controlling up to t of n >= 3t+1 nodes, while spending only O(n) expected messages and O(n) best-case computation per transaction. The load-bearing mechanism is a new threshold-signature design, OciorBLSts, which layers partial signatures in a tree so aggregation can happen online and in linear time whenever the good case of signature collection occurs. The paper also introduces short Attested Proofs of Seal so light clients can verify finality without running a full node. If correct, this gives asynchronous finality at costs previously attainable only in partially synchronous or leader-based settings.","feed_headline":"Asynchronous BFT finalizes transactions in two rounds with linear overhead","feed_subtitle":"A leaderless design promises adaptive security at n >= 3t+1 and short proofs of seal for every transaction.","key_machinery":"OciorBLSts is the central object: an adaptively secure non-interactive threshold signature formed by composing one conventional threshold signature (TS) with one or more Layered Threshold Signatures (LTS). In LTS, n = n_1 * ... * n_L signers are arranged as leaves of a tree, with group thresholds k_l whose product is at least k; any k_l valid signatures in a group produce a parent partial signature, and after L levels the final signature emerges. This allows instantaneous, O(n) aggregation in the good case, with the ordinary TS scheme as a fallback at O(n log^2 n) worst-case cost. The consensus layer uses these signatures to seal transactions on n parallel chains and to form Type I and Type","core_discovery":"Ocior claims that asynchronous BFT consensus need not sacrifice latency, throughput, or adaptive security. The protocol runs n parallel chains, one proposed by each node, and attaches threshold signatures to transactions; finality is a short signature called an APS. A legitimate two-party transaction proposed by an honest node can receive an APS after two asynchronous one-way rounds for any n >= 3t+1, and no conflicting transaction can later receive a valid APS because each signature requires votes from k = ceil((n+t+1)/2) nodes. The expected communication per transaction is O(n), and computation is O(n) in the good case or O(n log^2 n) in the worst case. The enabling primitive, OciorBLSts,","pith_inferences":["The paper leaves implicit that the good case may be rare at its own scale: with n=1400, t=466, L=3, and group thresholds (k1,k2,k3)=(13,9,8), every one of the 140 leaf groups of size 10 must contain at most 2 faulty nodes before LTS can finish, so the claimed O(n) good-case aggregation may occur with very low probability under random placement of the faulty nodes.","Two-round finality is a good-case latency bound; in adversarial executions the fallback paths (four rounds, HMDM multicasts, or broadcasting of locked signatures) may dominate, so end-to-end latency can be much larger in practice.","The layered-signature idea could plausibly be reused to certify arbitrary values, not just asset transfers, but the paper's safety argument is tied to parent-child transaction legitimacy and double-spending checks, so such reuse would need a new conflict model.","A direct stress test is to run Ocior under an adaptive scheduler that targets proposer nodes and measure how often the two-round APS path completes relative to the fallback paths; the paper does not report such an evaluation."],"forward_implications":["If Ocior is correct, a client sending a two-party transfer can receive a short, independently verifiable proof of finality after two one-way network delays, without waiting for ledger ordering.","Expected per-transaction message complexity of O(n) would remove batching as a prerequisite for throughput, letting a consensus node handle individual transactions concurrently.","The absence of a designated leader means no single node can be targeted to stall the system; an adaptive adversary is tolerated as long as the total corruption budget stays below t with n >= 3t+1.","The Type II APS path guarantees eventual dissemination of any transaction with acceptance weight 3, bridging fast client-visible finality to full system-wide acceptance.","The adaptive security of the whole protocol rests on OciorADKG; the paper explicitly commits to proving that in an extended version."],"supporting_citations":[{"why":"Leader-based linear BFT consensus whose round and communication costs Ocior compares against.","marker":"[3]"},{"why":"Classic three-round partially synchronous BFT, a baseline for round complexity.","marker":"[4]"},{"why":"Prior two-round latency barrier in partial synchrony and the bound Ocior claims to break in asynchrony.","marker":"[5]"},{"why":"HoneyBadger asynchronous BFT, the baseline for O(n) communication per transaction with static security.","marker":"[6]"},{"why":"EPIC, an adaptively secure asynchronous BFT baseline that Ocior improves on in latency and computation.","marker":"[7]"},{"why":"Optimized threshold signature aggregation at O(n log^2 n), the cost the LTS reduces to O(n) in good cases.","marker":"[10]"},{"why":"Degree-checking technique used by the strictly-hiding polynomial commitment in OciorADKG.","marker":"[21]"},{"why":"Verifiable encryption scheme used to handle missing shares in OciorASHVSS.","marker":"[22]"},{"why":"Partial vector agreement protocol used by OciorADKG to agree on which secret-sharing instances are valid.","marker":"[23]"},{"why":"COOL-based honest-majority distributed multicast underpinning OciorHMDMit and signature dissemination.","marker":"[15]-[17]"}],"fun_headline_variants":["Two rounds, linear cost: leaderless async BFT","Leaderless async BFT: 2-round finality, O(n) overhead","Ocior: adaptive secure BFT with two-round finality","Ultra-fast async BFT: no leader, linear overhead","Ocior consensus: two rounds, linear complexity"],"cache_read_input_tokens":56832,"weakest_assumption_plain":"The adaptive-security and good-case guarantees rest on the key-generation protocol OciorADKG, whose detailed proofs are not in this paper, and on the assumption that a favorable good case of signature collection becomes overwhelmingly likely after O(t) epochs; if either premise fails, the headline adaptive-security and O(n)-computation claims collapse.","fun_headline_variants_meta":{"raw":{"variants":["Two rounds, linear cost: leaderless async BFT","Leaderless async BFT: 2-round finality, O(n) overhead","Ocior: adaptive secure BFT with two-round finality","Ultra-fast async BFT: no leader, linear overhead","Ocior consensus: two rounds, linear complexity"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.00019,"raw_usage":{"total_tokens":1253,"prompt_tokens":900,"completion_tokens":353,"prompt_tokens_details":{"cached_tokens":256},"prompt_cache_hit_tokens":256,"prompt_cache_miss_tokens":644,"completion_tokens_details":{"reasoning_tokens":275}},"tokens_in":644,"tokens_out":353,"duration_ms":4542,"temperature":1.0,"reasoning_tokens":275,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-05T12:57:23.950259+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Fix n=1400, t=466, L=3 with group sizes (14,10,10) and thresholds (13,9,8). Compute or simulate the probability that a random placement of 466 faulty nodes puts at most 2 faulty nodes in every one of the 140 leaf groups of size 10. If that probability is negligible rather than very high, the central good-case assumption fails. Alternatively, run Ocior with an adaptive adversary and measure how often a two-round APS is actually produced before the fallback path completes.","supporting_citations":[{"cited_title":"Hotstuff: BFT consensus with linearity and responsiveness,","cited_arxiv_id":null,"evidence_quote":"Leader-based linear BFT consensus whose round and communication costs Ocior compares against."},{"cited_title":"Practical Byzantine fault tolerance,","cited_arxiv_id":null,"evidence_quote":"Classic three-round partially synchronous BFT, a baseline for round complexity."},{"cited_title":"Hydrangea: Optimistic two-round partial synchrony,","cited_arxiv_id":null,"evidence_quote":"Prior two-round latency barrier in partial synchrony and the bound Ocior claims to break in asynchrony."},{"cited_title":"The honey badger of BFT protocols,","cited_arxiv_id":null,"evidence_quote":"HoneyBadger asynchronous BFT, the baseline for O(n) communication per transaction with static security."},{"cited_title":"EPIC: Efficient asynchronous BFT with adaptive security,","cited_arxiv_id":null,"evidence_quote":"EPIC, an adaptively secure asynchronous BFT baseline that Ocior improves on in latency and computation."},{"cited_title":"Towards scalable threshold cryptosystems,","cited_arxiv_id":null,"evidence_quote":"Optimized threshold signature aggregation at O(n log^2 n), the cost the LTS reduces to O(n) in good cases."},{"cited_title":"SCRAPE: Scalable randomness attested by public entities,","cited_arxiv_id":null,"evidence_quote":"Degree-checking technique used by the strictly-hiding polynomial commitment in OciorADKG."},{"cited_title":"Non-interactive distributed key generation and key resharing,","cited_arxiv_id":null,"evidence_quote":"Verifiable encryption scheme used to handle missing shares in OciorASHVSS."},{"cited_title":"OciorABA: Improved Error-Free Asynchronous Byzantine Agreement via Partial Vector Agreement","cited_arxiv_id":"2501.11788","evidence_quote":"Partial vector agreement protocol used by OciorADKG to agree on which secret-sharing instances are valid."}],"review_version":1}