{"id":"5cf77b8c-746d-4322-9971-f2ce6cb790e7","arxiv_id":"2509.06616","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":0,"one_line_summary":"Mangrove gives each smart contract its own consensus instance, enabling parallel state replication without a global order and claiming two-step optimistic latency.","lead":"Mangrove is a proposed blockchain architecture that runs a separate consensus stream for each smart contract instead of one global transaction order, allowing transactions to different contracts to proceed in parallel. The paper claims that under optimistic conditions, an honest user and an honest leader, a transaction can be created and executed in two communication steps while conflicting transactions are still prevented.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Quorum Consensus with Quorum Validity is asserted via a sketchy reduction to [21], and the slow path, hence No Conflict, depends entirely on it; no concrete algorithm or proof is supplied.","rationale":"The paper presents a coherent high-level design with detailed proofs for the fast path and for derived system properties, and the fast-path latency story is qualified in Table 1. However, the slow path -- which is the fallback that guarantees liveness and safety whenever the optimistic conditions fail -- depends on a Quorum Consensus primitive with a nonstandard Quorum Validity property. The paper's support for this primitive is a short reduction to an external theorem plus a sketch of how existing DAG-BFT protocols might be extended. This is precisely the weakest load-bearing assumption: without a concrete instantiation, the Agreement and Termination guarantees of the slow path, and therefore the central No Conflict property, remain unverified. The reader's verdict of CONDITIONAL is appropriate: the architecture is promising and the fast-path arguments are plausible, but the missing Quorum Consensus instantiation and absence of implementation prevent unconditional acceptance. I found no independent flaw in the fast-path logic or in the No Conflict proof that would require a stronger verdict than CONDITIONAL.","tokens_in":26148,"tokens_out":28628,"duration_ms":262000,"concrete_test":"Independently re-derive Claim 13 from first principles: construct a concrete Quorum Consensus algorithm for n = 3f + 2p + 1 under partial synchrony that provably satisfies both parts of Property 12, or give a complete, formal mapping of [21]'s Theorem 5 to this setting including the threshold n - 3f. Then re-run the slow-path No Conflict proof (Lemma 18 and the PoA Agreement proof) against that instantiation. If the reduction does not yield a per-transaction quorum-support guarantee, the slow-path safety argument fails.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central No Conflict claim (Property 9) and the slow-path safety argument rest on Property 12, Quorum Validity, and on Claim 13 asserting that an algorithm satisfying it exists. Claim 13 is not a proof: it is a terse reduction to Theorem 5 of [21] using undefined mappings between configurations, and Appendix B only sketches how Narwhal, Bullshark, Shoal, or Mysticeti might be adapted by adding direct votes on transactions. No concrete protocol, pseudocode, or machine-checked derivation is provided, and no implementation or benchmark validates the primitive. The slow-path proofs in Section F (especially Lemma 18 and the PoA Agreement proof) explicitly invoke Quorum Validity parts (I) and (II); if either direction of Claim 13 fails, a conflicting transaction could be committed in a slow-path Quorum Consensus decision, and the central no-cross-instance-double-spending guarantee would not follow. The concern is not that the construction is internally inconsistent, but that the load-bearing existence claim is insufficiently supported for unconditional acceptance. The reader's weakest-assumption analysis identifies the same gap.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"Mangrove proposes a replicated-actor blockchain execution model in which each smart contract (reactive actor) and each user actor is served by its own agreement instance, eliminating a global transaction order. For reactive actors the paper defines Parallel Optimistic Agreement (POA) with a two-step fast path and a slow path built from Quorum Consensus and Transaction Agreement; for user-actor-only transactions it uses Parallel Optimistic Broadcast. The paper claims an optimistic latency of 2-3 communication steps, a resilience bound of n >= 3f + 2p + 1, horizontal scalability per actor, and no cross-instance double spending. Appendices contain full pseudocode and proofs of Agreement, Validity, No Conflict, and system-level properties.","tokens_in":26343,"tokens_out":8443,"duration_ms":81499,"significance":"The contribution is conceptually interesting and, if the proofs go through, would be a meaningful advance: per-contract consensus without a global order, with a formal no-conflict cross-instance guarantee and fast-path latency comparable to consensus-less systems. The paper is honest about scope: it provides no implementation or benchmarks and explicitly acknowledges high message complexity. Its formal apparatus is detailed, and the high-level intersection arguments for Agreement and No Conflict are plausible. The main weakness is that the slow path is built on a Quorum Consensus black box whose existence is only argued by a terse reduction and an informal appendix sketch, and the central no-conflict claim depends on that primitive.","major_comments":[{"comment":"Quorum Consensus with Quorum Validity is the load-bearing primitive. The proof as written is a shorthand: it uses I^{n-f}, sim(c), and val(c') from [21] without defining how POA proposals correspond to [21]'s configurations, and it asserts that a block present in n-2f proposals belongs to val(c') for every c' in sim(c) without proving that an algorithm from [21] can be instantiated to decide exactly such blocks while preserving Agreement and Termination. Appendix B's direct-vote extension is only a sketch; it does not give pseudocode, invariants, or a proof that Narwhal/Tusk, Bullshark, Shoal, or Mysticeti can be modified to satisfy Quorum Validity (II). Since Lemma 18, the slow-path Agreement proof, Validity (II), and the No Conflict Property all invoke Quorum Validity (I)/(II), a gap here propagates to the paper's central claim. Please either replace this black box with a fully specified algorithm or give a complete reduction.","section":"§6.1, Claim 13"},{"comment":"The common leader oracle is stated as an assumption ('we require this function to output an honest leader infinitely often'), and the suggested implementations are a common random source or round-robin. Neither is part of the stated GST model. The liveness properties (Termination, Multi-Termination, and the fast-termination results in Table 1) are conditioned on this oracle. This is acceptable as an explicit assumption, but the assumption should be stated in the formal system model and in the theorem statements so that readers can see it is not derived from the network model.","section":"§5.2 and Properties 10/11"},{"comment":"The proof that every honest validator proposes the fast-path-decided block B to Quorum Consensus relies on Lemma 18, whose final case (SP-lock via a Quorum Consensus decision) uses Quorum Validity (II). Thus the Agreement proof is conditional on Claim 13. If the Quorum Consensus instantiation is only supplied later or at a different threshold, the Agreement and No Conflict proofs must be re-examined in full rather than merely cited as complete.","section":"Appendix D, Agreement Property"}],"minor_comments":[{"comment":"The abstract states 'a latency of 2 communication steps', but Table 1 reports 2delta for UA and RA-RA, and 2delta/3delta for UA-RA, while Property 27 states 3 communication steps for UA-RA. Please qualify the abstract or align the statements.","section":"Abstract and Table 1"},{"comment":"Remark 30 refers to 'Theorem 7', but no theorem with that number exists; the intended reference is likely a Property of reactive-actor validity or agreement. Please fix the cross-reference.","section":"Remark 30"},{"comment":"Line 83 of Algorithm 6 uses the identifier 'B' where the context is the block decided in Quorum Consensus, B_qc. This is confusing and should be renamed for consistency with lines 82-94.","section":"Algorithm 6, Part 3"},{"comment":"The proof of Lemma 32 says 'In case tx is either UA-RA, RA-RA or RA'; the token 'RA' is not defined and should be either 'RA-RA' or a separate defined transaction type.","section":"Lemma 32"}],"recommendation":"major_revision","confidential_remarks":"The decisive issue for acceptance is the instantiation of Quorum Consensus. If the authors can supply a complete algorithm or a full reduction that establishes Quorum Validity, the paper is likely publishable; without that, the central no-conflict claim is not established. I would ask for this repair before further review."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Peer, quick take on Mangrove (arXiv:2509.06616). The core idea is good: run one consensus instance per reactive actor, use FP and SP locks at user-actor entities to stop conflicting transactions from being decided in different instances, and skip a global order entirely. Under the optimistic conditions they carefully qualify in Table 1, the two- and three-step latency claims are plausible, and the within-validator locking design is the kind of concrete mechanism that makes the parallelization story real.\n\nThe paper does a lot right. The proofs in Appendix F are structured, and the intersection arguments for Agreement and No Conflict have the right shape. The authors are honest about what the model gives up: no free atomic composability, higher message complexity, deep cascades need separate agreements. That candor earns credit.\n\nThe soft spot is exactly where your reader put it, and I think the stress-test note is on target, not a manufactured flaw. The slow path leans on Quorum Consensus satisfying Quorum Validity (Property 12), and Claim 13 is not a full proof: it is a one-paragraph reduction to Theorem 5 of [21] with hand-wavy config mappings, and Appendix B only sketches how existing DAG-BFT protocols could be adapted. The slow-path proofs (Lemma 18, the POA Agreement argument) invoke Quorum Validity parts (I) and (II) directly. If that primitive cannot be instantiated at the assumed thresholds, the security of slow-path decisions, and therefore the No Conflict property across parallel POA instances, does not follow. This is load-bearing. It is also addressable: give a concrete protocol or a proper formal reduction and the gap closes. There is no sign of internal contradiction.\n\nMinor quibbles: the leader oracle is standard but still an assumption worth stating cleanly, and the common-random-source requirement is waved at rather than specified. Neither is disqualifying.\n\nThe citation pattern looks fair. The use of [21] is legitimate but insufficiently detailed for a central primitive.\n\nBottom line: this deserves a serious referee. I would send it to review with the expectation of major revision or a conditional accept, with the Quorum Consensus instantiation as the primary condition. If you work on parallel BFT or blockchain execution, it is worth reading; I would probably cite it for the locking design even in preprint form.","headline":"Per-contract consensus with a genuinely new locking design, but the slow path leans on a Quorum Consensus primitive that is asserted via a sketchy reduction rather than actually instantiated.","tokens_in":26864,"tokens_out":2220,"would_cite":true,"duration_ms":21342,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":["68M14","68M12","68M15"],"pacs":[],"model":"deepseek-v4-flash","headline":"Mangrove proposes that every smart contract runs its own consensus instance, so conflicting transactions are excluded by per-actor locks instead of a global total order.","keywords":["blockchain","parallel execution","state replication","optimistic agreement","Byzantine fault tolerance","smart contracts","per-actor consensus"],"falsifier":"Run a concrete implementation or simulation of the slow path using a real Quorum Consensus algorithm satisfying Property 12, with $n=3f+2p+1$; if two conflicting transactions from the same user actor and sequence number can be decided in POA instances for different reactive actors in any asynchronous-before-GST schedule, the No Conflict property fails. Alternatively, under synchronous, honest-leader, at-most-$p$-faulty conditions, measure whether an honest user's UA-RA transaction is executed within three communication steps; exceeding that would contradict Fast UA-RA Transaction Execution.","tokens_in":25931,"feed_emoji":"⚡","tokens_out":4610,"duration_ms":41667,"temperature":0.7,"pith_summary":"Mangrove aims to show that a blockchain can support general smart contracts without maintaining a strict total order over all transactions. The paper's central claim is that a separate consensus instance per smart contract, coordinated by lightweight local locks at each user actor, can prevent double-spending across instances while letting different contracts make progress independently. If correct, this would give blockchain systems the parallel scalability of consensus-less payment protocols without giving up the ordering that smart contracts need. Under optimistic conditions, a transaction can be committed in two communication steps, matching the best known latency for this class of protocols.","feed_headline":"Per-contract consensus in two steps, with no global order","feed_subtitle":"Mangrove orders each smart contract on its own chain and uses local locks to stop cross-chain double-spending.","key_machinery":"The central object is Parallel Optimistic Agreement (POA), a per-recipient consensus instance whose fast path consists of a leader broadcast followed by a single round of votes carrying fallback blocks. Its safety rests on Wait-Free Locking, two maps at each user actor entity — FP-locked for fast-path voting and SP-locked for slow-path proposals — that tie a sequence number to a single transaction, ensuring that no conflicting transaction can be adopted by enough honest validators in any POA instance. The slow path additionally relies on Quorum Consensus, a consensus primitive satisfying Quorum Validity, and Transaction Agreement, a per-sequence-number strong Byzantine agreement used retroactively to resolve conflicts after fast-path failure.","core_discovery":"The paper claims that using a Replicated Actor Model, where user actors and reactive actors (smart contracts) each have their own agreement stream, eliminates the need for a global transaction order while preserving safety. The load-bearing result is the Parallel Optimistic Agreement (POA) primitive: each reactive actor runs its own POA instances, and conflicting transactions from the same user actor and sequence number cannot be simultaneously decided in any two instances, even when those instances belong to different actors. This is achieved by wait-free locking: a validator's user actor entity maintains fast-path and slow-path lock maps that bind a sequence number to one transaction, so conflicting transactions cannot gather the required quorum of votes. Under an honest leader, synchrony, and at most $p$ misbehaving validators, with $n\\geq 3f+2p+1$ total validators, the fast path terminates in two communication steps for user-actor and reactive-actor transactions, and two or three steps for user-to-contract transactions. The slow path, invoked only on failure, uses a Quorum Consensus primitive with Quorum Validity followed by per-sequence-number Transaction Agreements to preserve safety and liveness.","pith_inferences":["Editorial inference: if a practical Quorum Consensus with Quorum Validity can be instantiated, the per-actor lock pattern suggests a general recipe for replicated state machines: local single-writer locks at shared objects can replace global ordering for cross-object conflict prevention, beyond blockchains.","Editorial inference: a testable prediction absent from the paper is that, under heavy contention on one reactive actor, the throughput of all other actors remains flat; a benchmark comparing Mangrove-style per-actor ordering with sharding would directly test this.","Editorial inference: because UA-RA transactions pay an extra step when the leader is not the author, a leaderless variant of POA might reduce all transaction types to two steps at the cost of a larger validator set, echoing the $5f+1$ tradeoff already noted in the paper's discussion of Flutter.","Editorial inference: the model implies atomic composability, such as flash loans, must be reintroduced at the application layer via locking and execution contexts; whether this suffices for composability-critical decentralized finance under adversarial contention is a question the paper opens but does not answer."],"forward_implications":["Each smart contract maintains its own ordered chain, so congestion at one contract does not slow down unrelated contracts, and throughput can be scaled horizontally by assigning different actor entities to different machines.","Optimistic transactions execute in two communication steps for user-actor and reactive-actor transactions, and two or three steps for user-to-contract transactions, under the stated honesty and synchrony assumptions.","Conflicting transactions from the same user and sequence number can never both be committed, even when they target different reactive actors, without requiring a global order.","If a user misbehaves by issuing conflicting transactions, only the fast path's liveness is affected; honest transactions are still committed through the slow path, and the misbehavior is evidenced by two signed conflicting transactions.","The protocol matches the resilience bound $n\\geq 3f+2p+1$ for fast Byzantine consensus with all users as proposers, which the paper argues is the best possible in that setting."],"supporting_citations":[{"why":"Supplies the two-step optimistic Byzantine consensus method and the resilience bound $n\\geq 3f+2p+1$ that Mangrove's fast path matches.","marker":"[40]"},{"why":"Establishes lower resilience bounds for fast consensus with restricted proposers, against which Mangrove's all-users-as-proposers generality is contrasted.","marker":"[38]"},{"why":"Provides the validity-of-consensus theorem to which Claim 13 reduces the existence of Quorum Consensus with Quorum Validity.","marker":"[21]"},{"why":"Baseline consensus-less payment system whose parallel settlement model Mangrove extends to general smart contracts.","marker":"[13]"},{"why":"Comparison system for parallel execution of non-conflicting transactions and fast optimistic commits.","marker":"[54]"},{"why":"Supplies the Sui object model and broadcast-plus-consensus design that Mangrove's actor model is closely related to.","marker":"[16]"},{"why":"Defines Byzantine reliable broadcast, which underlies the user-actor properties and the Parallel Optimistic Broadcast primitive.","marker":"[17]"},{"why":"Specifies total order broadcast, whose agreement, validity, total order, and integrity schema the reactive actor properties follow.","marker":"[25]"}],"fun_headline_variants":["Per-contract consensus in two steps, no global order","Parallel chains via local locks and per-contract consensus","Mangrove: two-step per-contract agreement","Without a global order: parallel contract execution","Local consensus per contract, global safety ensured"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The slow path's safety rests on the existence of a Quorum Consensus primitive whose Quorum Validity holds at the assumed thresholds, and the paper reduces this to an existing theorem without supplying a concrete algorithm; if that primitive cannot be instantiated, the no-conflict and termination guarantees of the slow path do not follow.","fun_headline_variants_meta":{"raw":{"variants":["Per-contract consensus in two steps, no global order","Parallel chains via local locks and per-contract consensus","Mangrove: two-step per-contract agreement","Without a global order: parallel contract execution","Local consensus per contract, global safety ensured"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000757,"raw_usage":{"total_tokens":3340,"prompt_tokens":895,"completion_tokens":2445,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":511,"completion_tokens_details":{"reasoning_tokens":2372}},"tokens_in":511,"tokens_out":2445,"duration_ms":15314,"temperature":1.0,"reasoning_tokens":2372,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-15T16:14:47.681494+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run a concrete implementation or simulation of the slow path using a real Quorum Consensus algorithm satisfying Property 12, with $n=3f+2p+1$; if two conflicting transactions from the same user actor and sequence number can be decided in POA instances for different reactive actors in any asynchronous-before-GST schedule, the No Conflict property fails. Alternatively, under synchronous, honest-leader, at-most-$p$-faulty conditions, measure whether an honest user's UA-RA transaction is executed within three communication steps; exceeding that would contradict Fast UA-RA Transaction Execution.","supporting_citations":[{"cited_title":"URL: https://forum.dfinity.org/t/ lament-a-tale-of-constant-struggle-of-what-its-like-trying-to-scale-on-icp/35829","cited_arxiv_id":null,"evidence_quote":"Provides the validity-of-consensus theorem to which Claim 13 reduces the existence of Quorum Consensus with Quorum Validity."},{"cited_title":"URL: https:// aptosfoundation.org","cited_arxiv_id":null,"evidence_quote":"Baseline consensus-less payment system whose parallel settlement model Mangrove extends to general smart contracts."},{"cited_title":"Cuttlefish: Expressive Fast Path Blockchains with FastUnlock","cited_arxiv_id":"2309.12715","evidence_quote":"Defines Byzantine reliable broadcast, which underlies the user-actor properties and the Parallel Optimistic Broadcast primitive."},{"cited_title":"Cryptocon- currency: (almost) consensusless asset transfer with shared accounts","cited_arxiv_id":null,"evidence_quote":"Specifies total order broadcast, whose agreement, validity, total order, and integrity schema the reactive actor properties follow."}],"review_version":2}