{"id":"8430619d-3359-4a5e-bf24-4af5d0227a90","arxiv_id":"2608.13271","paper_version":1,"verdict":"REJECT","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"high","formal_verification":"none","parameter_count":2,"one_line_summary":"Requiring every transaction to carry a Verifiable Delay Function proof can prevent front-running MEV when the delay exceeds the ledger's liveness parameter, but it leaves back-running and other attack classes open.","lead":"Blockchain MEV lets block creators profit by reordering or front-running users' transactions. This paper forces every transaction to include a verifiable-delay proof, so an attacker who sees a new transaction cannot react before it is finalized.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"VDF delay only prevents content-dependent reactive transactions; precomputed, content-independent front-running transactions bypass the mechanism, so Theorems 1 and 2 rest on an unstated and false assumption.","rationale":"The reader's weakest assumption is precisely the load-bearing gap: the security and equilibrium proofs assume that MEV can only be claimed by creating a new transaction after observing the honest transaction and then censoring the honest transaction for tau rounds. Precomputed, content-independent front-running transactions defeat both assumptions. I agree with the reader's assessment. The paper is transparent about back-running being out of scope, but the precomputed front-running gap is more severe because it affects the headline front-running claim itself, not just an admitted limitation. The implementation measurements and historical MEV data are useful secondary content but cannot repair the theorem gap. A careful revision restricting the claims to content-dependent front-running and explicitly modeling when a payload is selected would make the theorems sound, but as written the central claim that the mechanism prevents MEV is overbroad. Since this is the same essential concern the reader identified, the verdict should remain unchanged at REJECT.","tokens_in":16773,"tokens_out":6705,"duration_ms":75685,"concrete_test":"Construct a concrete counterexample in the paper's own model. Take Pi to be any live ledger satisfying the proportionality assumption, and let tx be an honest transaction that creates price impact on a constant-product market. Before round r, the adversary evaluates the VDF on a fixed valid payload m' (a buy order on that market) and obtains (y, pi), with m' containing no reference to tx. At round r the adversary observes tx and immediately broadcasts <m', (y, pi)> without censoring tx. Then check three things: (1) the transaction is accepted by Validate_VDF,CS of Eq. (1); (2) tx is still finalized by round r+u; (3) m' is ordered before tx. This demonstrates a valid execution in which the MEV opportunity is claimed, liveness is not broken, and no tau-round delay elapses after r, falsifying the proof step of Theorem 2.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The transformation in Eq. (1) makes a transaction valid only if a VDF proof over its commitment is supplied, so once a payload is fixed, turning it into a valid transaction requires at least tau rounds. The proofs of Theorems 1 and 2 implicitly assume that any transaction that extracts MEV from an honest tx has its payload fixed only after tx is observed: Theorem 1 says 'any transaction tx' which meaningfully relies on tx is created on round r at the earliest,' and Theorem 2 says 'the only way to claim a transaction's MEV opportunity is to censor it for at least tau > u rounds.' Neither step follows for an adversary that precomputes a valid transaction before seeing tx. Many front-running and sandwich strategies use a first transaction whose content does not reference the victim transaction, e.g., a DEX buy order; the adversary can evaluate the VDF on that payload in advance and broadcast it immediately after observing tx. Such a transaction is valid at round r, does not require censorship, and leaves liveness intact, so it is not covered by the theorems even though it captures the MEV opportunity. Definition 4 only excludes transactions that 'meaningfully rely on' tx: if that phrase means content dependence, precomputed front-runs fall outside the definition, and if it means economic dependence, the proof's timing claim that the transaction is 'created on round r at the earliest' is false. Section 4.3 concedes back-running but not this precomputed front-running gap, so the abstract's claim that a block creator 'cannot react to the appearance of a MEV opportunity without breaking liveness' is unsupported.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes a mechanism to mitigate MEV in distributed ledgers by requiring every transaction to include a VDF evaluation over a commitment to its payload, so that a valid transaction can only be constructed tau rounds after its payload is fixed. The authors define blockchain input causality and prove (Theorem 1) that applying this transformation to any ledger with liveness parameter u and choosing tau > u guarantees input causality. In a rational model, they argue the transformed protocol is an epsilon-Nash equilibrium when the original is one without MEV (Theorem 2), present a negative equilibrium (Theorem 3), and a compliance result (Theorem 4). They also report experiments on VDF candidates and historical MEV data to argue practical viability.","tokens_in":17059,"tokens_out":9383,"duration_ms":96303,"significance":"The idea of using VDFs to delay transaction creation is original and, if valid, would be a useful addition to the MEV countermeasure toolkit. The paper is clearly structured, the reduction of the Byzantine result to liveness is an elegant idea, and the implementation section with concrete VDF benchmarks and a large empirical MEV dataset is valuable. However, the positive results only hold for a restricted class of MEV attacks, namely reactive, content-dependent front-running, and the paper does not state or prove this restriction; as written, the central claims overstate the mechanism's power. The ambiguity in Definition 4's 'meaningfully relies on' is the crux of the problem.","major_comments":[{"comment":"The statement 'Any transaction tx' which meaningfully relies on tx is created on round r at the earliest' is an assumption, not a consequence of the model. An adversary can precompute a valid transaction whose payload does not reference tx (e.g., a DEX buy order) before round r, and broadcast it immediately after observing tx; such a transaction is valid at round r and bypasses the VDF delay. If 'meaningfully relies' is intended as content-dependence, then Definition 4 does not cover this attack; if it is intended as economic dependence, the timing claim is false. The proof of Theorem 1 thus does not establish input causality for all MEV-relevant adversarial transactions.","section":"Section 3, Definition 4 and Theorem 1 proof"},{"comment":"The claim 'the only way to claim a transaction's MEV opportunity is to censor it for at least tau > u rounds' is false: back-running MEV requires no censorship and is explicitly admitted out of scope in Section 4.3, and precomputed front-running transactions can be broadcast without censoring the honest transaction. Since this claim is the core of the rational-setting proofs, Theorems 2 and 4 are not proven as stated.","section":"Theorems 2 and 4"},{"comment":"The abstract's claim that 'a block creator cannot react to the appearance of a MEV opportunity without breaking liveness' and the introduction's statement that the mechanism 'eliminates MEV opportunities' are not supported by the formal results, which at best address reactive front-running. The conclusion's caveat 'albeit only non-predictable ones' (Section 5) contradicts the earlier unqualified claims and should be reflected in the abstract and theorems.","section":"Abstract and Introduction"}],"minor_comments":[{"comment":"The proportionality property is stated as an upper bound on the probability that a party produces a block, but the proofs in Theorems 2 and 3 use it as if it also gives a lower bound on honest block production; the relationship should be clarified.","section":"Section 2.3"},{"comment":"The recommendation to set the VDF delay to 'twice the safety parameter' should be reconciled with the earlier use of the liveness parameter u as the threshold in Theorems 1, 2, and 4.","section":"Section 4.1"},{"comment":"The link between the empirical MEV data and the mechanism's effectiveness is not quantified; the data do not indicate what fraction of MEV opportunities are content-dependent and created after observing the victim, which is the class the mechanism can address.","section":"Section 4.2"},{"comment":"The strategy S_MEV is parameterized by the transaction tx, but the proof's deviation analysis sometimes refers to 'all other parties' attempting to claim the MEV opportunity without specifying whether the deviating party also follows the censoring strategy; the argument would benefit from a more explicit game tree.","section":"Theorem 3"},{"comment":"The notion of compliance is introduced by citing [28] rather than being defined in the manuscript; a self-contained definition of the infraction-predicate-based compliance notion would improve readability and verifiability.","section":"Section 2.2"},{"comment":"Describing a 516-byte proof on a roughly 400-byte transaction as a 'significant' size increase seems overstated; 'modest' would be more accurate.","section":"Footnote 15"}],"recommendation":"reject","confidential_remarks":"The paper builds on a citation to the authors' own prior work [28] for the compliance framework; while self-citation is not inherently problematic, the framework is used as a black box and the reader cannot easily verify the compliance definitions from the manuscript itself. More importantly, the gap between the formal results and the practical claims is substantial; the authors should be asked to state the exact class of MEV attacks their mechanism addresses, ideally in the title and abstract, before this could be considered for publication. The empirical dataset analysis is a useful contribution regardless of the theoretical issues."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"The core idea here is simple and genuinely new: wrap transaction validity in a VDF evaluated over a commitment, so that a transaction cannot be constructed in response to a freshly observed victim transaction. The transformation is clean, the Byzantine framing via input causality is a nice lens, and the VDF benchmarking is useful (sub-800ms verification for a 60-minute delay). I also appreciate the honesty about back-running and about usability in fast markets. The historical MEV data is a solid secondary contribution.\n\nThe problem is that the main theorems overclaim. Theorem 1's proof says any transaction that meaningfully relies on tx is created at round r at the earliest, but that is only true if the adversarial payload is fixed after seeing tx. A precomputed front-run, e.g., a DEX buy order whose content does not reference the victim, can have its VDF evaluated in advance; the adversary just broadcasts it after observing tx. Such a transaction is valid immediately, requires no censorship, and leaves liveness intact. It falls outside Definition 4 only if 'meaningfully relies on' is read as content dependence, and then it is an attack on the abstract's claim. If it is read as economic dependence, the timing step in Theorem 1 is false. The same false step appears verbatim in Theorems 2 and 4: 'the only way to claim a transaction's MEV opportunity is to censor it for at least tau rounds.' That is wrong for precomputed front-running and for back-running (which the paper itself concedes out of scope). The negative equilibrium and compliance results inherit this flaw.\n\nThis is not a nitpick; it is load-bearing, because the abstract claims a block creator cannot react to a MEV opportunity without breaking liveness. The claimed class of prevented MEV is narrower than stated. The fix is tractable: restrict definitions and theorems to content-dependent, reactive front-running, and explicitly model precomputed attacks. As written, the paper's positive results do not support its headline.\n\nI would send this to peer review rather than desk-reject. The idea deserves a serious referee, the empirical work is reproducible, and the flaw is a fixable overclaim rather than an incoherent construction. But as it stands, I would not cite the theorems as established.","headline":"A clean VDF-based transaction-delay idea with a real formal gap: the theorems assume every MEV claim requires reactive, content-dependent front-running, which misses precomputed and back-running strategies.","tokens_in":17610,"tokens_out":1904,"would_cite":false,"duration_ms":23139,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"A verifiable delay before each transaction stops front-running MEV","keywords":["MEV","maximal extractable value","verifiable delay function","front-running","input causality","distributed ledger","Nash equilibrium","transaction censorship"],"falsifier":"Find a single valid transaction that depends on a freshly broadcast honest transaction and is included in the ledger before the honest transaction is finalized, under the transformed predicate with $\\tau > u$; its existence would falsify the input-causality claim.","tokens_in":16542,"feed_emoji":"🐢","tokens_out":11707,"duration_ms":140326,"temperature":0.7,"pith_summary":"This paper proposes a mechanism to stop front-running MEV in distributed ledgers by forcing every transaction to carry the output of a verifiable delay function evaluated on a commitment of its own payload. The central result is that if the enforced delay $\\tau$ exceeds the ledger's liveness parameter $u$, no valid transaction can be created that meaningfully depends on an honest transaction before that transaction is finalized. In the game-theoretic model, the same transformation turns a ledger that is an approximate equilibrium in the absence of MEV into an approximate equilibrium in its presence. The paper also exhibits a collusive equilibrium in which all parties censor a MEV-bearing transaction, and it argues from implementation benchmarks and historical MEV data that the delay is practically affordable for most real-world cases.","feed_headline":"A verifiable delay before each transaction stops front-running MEV","feed_subtitle":"The trick is making the attacker's response arrive after the honest transaction is already finalized.","key_machinery":"The load-bearing object is the transformed validity predicate $\\mathrm{Validate}_{\\mathrm{VDF,CS}}(tx,L) = \\mathrm{Validate}(m,L) \\land \\mathrm{Verify}(C,y,\\pi) \\land \\mathrm{Reveal}(C,m)=1$, where $C$ is a commitment to the transaction payload $m$ and $(y,\\pi)$ is a VDF output and proof on $C$. The predicate forces every valid transaction to be produced only after a sequential VDF evaluation on its own commitment, making the delay unavoidable and efficiently checkable. Sequentiality of the VDF supplies the time bound, binding of the commitment ties the delay to the specific payload, and hiding of the commitment allows the VDF work to be outsourced without revealing the payload.","core_discovery":"The paper's central claim is that applying the validity predicate transformation $\\mathrm{Validate}_{\\mathrm{VDF,CS}}$ to any live, censorship-compliant ledger protocol $\\Pi$ produces a protocol that guarantees blockchain input causality in the Byzantine setting when the VDF delay $\\tau$ is larger than the liveness bound $u$. A transformed transaction is a pair consisting of the original payload $m$ and a VDF output/proof pair $(y,\\pi)$ computed on a commitment of $m$; validity requires both the original validity predicate and the VDF verification, plus a successful reveal of the commitment. Because the VDF is sequential, an adversary that observes an honest transaction broadcast at round $r$ cannot produce a valid dependent transaction before round $r+\\tau$, while the honest transaction is finalized by round $r+u$. The game-theoretic result states that if $\\Pi$ is an $\\epsilon$-Nash equilibrium when no MEV exists, the transformed protocol is an $(\\epsilon+\\mathrm{negl}(\\lambda))$-Nash equilibrium when MEV exists, and censorship compliance is preserved. The negative result is a strategy profile in which all parties censor a MEV-bearing transaction for $\\tau$ rounds, which is itself an $\\epsilon$-Nash equilibrium.","pith_inferences":["A natural extension is to apply the delay selectively at the smart-contract level only to transactions that touch price-sensitive state, keeping ordinary transfers fast while shrinking the MEV surface where it matters.","The collusive equilibrium suggests the mechanism deters unilateral deviation but not coordinated censorship; pairing the delay with slashing conditions or deposits could make the censorship equilibrium unstable, a question the paper leaves open.","Because the VDF is evaluated on a commitment, users could set their own delay parameter per transaction, letting urgency be priced by the market rather than fixed system-wide; the paper does not explore per-transaction delay parameters.","Combining this delay with an encrypted-mempool or order-fairness layer could close the back-running gap the paper explicitly leaves out of scope."],"forward_implications":["A ledger that is live and an approximate equilibrium without MEV can be converted into a ledger that is an approximate equilibrium with MEV by requiring a VDF delay longer than its liveness parameter.","No valid front-running transaction can be created before the honest transaction it depends on is finalized, eliminating content-dependent front-running attacks.","If a majority of validators colludes to censor a MEV-bearing transaction for the full delay, that collusive behavior forms an equilibrium, so the defense does not stop cartel-level MEV.","For the VDF construction the paper recommends, proof verification stays below about 800 milliseconds even for a 60-minute delay, making the added validity check cheap for network nodes.","Historical MEV datasets cited in the paper show that the overwhelming majority of opportunities are worth less than a few hundred dollars, so a delay of tens of minutes would cover most real-world cases without crippling usability."],"supporting_citations":[{"why":"Defines verifiable delay functions and their sequentiality property, on which the enforced delay rests.","marker":"[10]"},{"why":"Supplies the input-causality notion that the paper adapts into blockchain input causality for Theorem 1.","marker":"[15]"},{"why":"Offers an earlier formulation of input causality used as the basis of the paper's MEV-resilience definition.","marker":"[44]"},{"why":"Provides the compliance framework and infraction-predicate machinery used in Theorem 4.","marker":"[28]"},{"why":"Defines MEV and motivates the threat model that the paper's defense targets.","marker":"[21]"},{"why":"Presents one of the two VDF constructions evaluated; its fast verification supports the practical feasibility claim.","marker":"[47]"},{"why":"Presents the alternative VDF construction evaluated, whose slower verification leads the paper to recommend the other candidate.","marker":"[42]"},{"why":"Quantifies MEV on layer-2 networks, supporting the paper's claim that most MEV opportunities are small enough for the delay to be practical.","marker":"[7]"}],"fun_headline_variants":["Verifiable delays stop MEV by making attackers wait","Slow and steady: verifiable delays prevent MEV","Beat MEV with verifiable delays: speed is the weakness","MEV-proof ledgers via mandatory verifiable delays"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The proof assumes that the only way to capture a MEV opportunity is to observe an honest transaction and then create a new dependent transaction, and that this requires censoring the honest transaction for at least $\\tau$ rounds; attacks that need no such dependency or censorship are outside the model.","fun_headline_variants_meta":{"raw":{"variants":["Verifiable delays stop MEV by making attackers wait","Slow and steady: verifiable delays prevent MEV","Beat MEV with verifiable delays: speed is the weakness","MEV-proof ledgers via mandatory verifiable delays"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000241,"raw_usage":{"total_tokens":1496,"prompt_tokens":894,"completion_tokens":602,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":510,"completion_tokens_details":{"reasoning_tokens":537}},"tokens_in":510,"tokens_out":602,"duration_ms":6661,"temperature":1.0,"reasoning_tokens":537,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-14T14:55:45.065691+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Find a single valid transaction that depends on a freshly broadcast honest transaction and is included in the ledger before the honest transaction is finalized, under the transformed predicate with $\\tau > u$; its existence would falsify the input-causality claim.","supporting_citations":[{"cited_title":"In: Annual international cryptology conference","cited_arxiv_id":null,"evidence_quote":"Defines verifiable delay functions and their sequentiality property, on which the enforced delay rests."},{"cited_title":"In: Annual International Cryptology Conference","cited_arxiv_id":null,"evidence_quote":"Supplies the input-causality notion that the paper adapts into blockchain input causality for Theorem 1."},{"cited_title":"ACM Transactions on Programming Languages and Systems (TOPLAS)16(3), 986–1009 (1994)","cited_arxiv_id":null,"evidence_quote":"Offers an earlier formulation of input causality used as the basis of the paper's MEV-resilience definition."},{"cited_title":"In: 2020 IEEE Symposium on Security and Privacy (SP)","cited_arxiv_id":null,"evidence_quote":"Defines MEV and motivates the threat model that the paper's defense targets."},{"cited_title":"Cryptology ePrint Archive, Paper 2018/623 (2018),https://eprint.iacr.org/2018/623,https://eprint","cited_arxiv_id":null,"evidence_quote":"Presents one of the two VDF constructions evaluated; its fast verification supports the practical feasibility claim."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Quantifies MEV on layer-2 networks, supporting the paper's claim that most MEV opportunities are small enough for the delay to be practical."}],"review_version":1}