Pith. sign in

REVIEW 2 major objections 4 minor 47 references

Fast Deterministically Safe Proof-of-Work Consensus

T0 review · 2 major / 4 minor · reviewed 2026-08-03 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read The paper claims the first fully permissionless proof-of-work total-order broadcast protocol with deterministic security and constant expected latency, achieved by filtering out time-travel attacks before consensus runs.

desk verdict A promising layered design for deterministic PoW consensus that, as written, has a load-bearing off-by-one timing error in the DPoW oracle; the core idea is sound enough to warrant a rewrite, not a desk reject. read the letter →

arxiv 2512.19968 v3 pith:J5DHFNV6 submitted 2025-12-23 cs.CR

Ali Farahbakhsh , Giuliano Losa , Youer Pu , Lorenzo Alvisi , Ittay Eyal This is my paper
classification cs.CR
keywords proof-of-worktotal-orderbroadcastdeterministicsafetytime-travelattackpermissionlessconsensusprimitiveconstantlatency
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Permissionless proof-of-work protocols normally settle for probabilistic safety, where a lucky attacker can rewrite history, or pay steep latency. Sieve-MMR aims to get deterministic safety at constant expected latency without any external checkpointing by splitting the problem in two: a bottom layer (Sieve) guarantees that messages delivered in each round are fresh, and a top layer (the MMR consensus logic) builds total order on those fresh messages. The bottom layer's job is to stop time-travel attacks, where an adversary stockpiles proof-of-work in the past and releases it in the present to dominate quorums. Sieve does this by making every message carry a proof-of-work over a coffer of messages from the previous round, then filtering out messages whose coffers do not overlap a trusted set. If correct, this would give proof-of-work the same deterministic finality guarantees as modern BFT consensus at expected seven-step finality.

What carries the argument

The central object is the coffer-DAG of DPoW evaluations: vertices are messages, and an edge m1 → m2 means that m2 is in m1's coffer. Each correct message includes a DPoW over (payload, coffer, nonce) and is timestamped with its round; because a message from an earlier round cannot contain messages generated later, the overlap between a message's coffer and a known-good previous-round set is a timestamp test. The filtering policies use this: Online-Sieve is a single threshold test, and Bootstrap-Sieve repeats the test over the entire DAG. The DPoW oracle is what makes generating a fake coffer history costly, and it has deterministic work with verification in k log w hash calls.

What would settle it

Run the oracle's delivery rule with K ticks per step and weight equal to the node's power P: the condition ⌈wK/P⌉ = K forces delivery at tick t+K, i.e., the first tick of the next step, not the last tick of the current step that Algorithm 1 assumes. Separately, generate a valid DPoW for a challenge at step s and attach it to a message claiming timestamp s+1: the verification interface checks only the challenge and weight, not generation time, so the message will be accepted by the verification check alone.

Watch

Extended reading notes

Core claim

Sieve implements a time-travel-resilient broadcast (TTRB) primitive in which every delivered message carries a valid deterministic proof-of-work generated in the previous round, and every correct node's message from the previous round is delivered. The mechanism is a DAG: each message's coffer lists the non-antique messages from the prior round, and the DPoW hashes the payload plus coffer. Online-Sieve accepts a message only if its coffer intersects the trusted previous-round set in more than a weighted 1-ρ fraction; Bootstrap-Sieve does the same over the whole history for nodes that were offline. Sieve-MMR layers the MMR consensus rules on top, which need only the 2/3-weight supermajority p

Load-bearing premise

The load-bearing premise is that the deterministic-PoW oracle binds each proof to the step in which it was requested and returns a weight-P proof within that same step — but the paper's own oracle model schedules delivery at the first tick of the next step, and its concrete Merkle-tree instantiation does not bind proofs to a step.

Editorial extensions

If this is right

  • Within the symbolic model where cryptographic primitives are not broken, security is deterministic: no probability of fork from an attacker with a minority of total work.
  • Expected time to finality for a correct block is 7 steps, with a best case of 3, independent of the number of participants.
  • Standalone Sieve tolerates a 1/2-bounded adversary; when composed with MMR, the budget tightens to 1/3-bounded, matching the consensus layer's requirement.
  • The TTRB abstraction gives a reusable interface; the paper conjectures other dynamically-available consensus protocols could be ported to proof-of-work the same way.
  • Constant-time DPoW verification remains open; if achieved, the protocol's assumptions align more closely with real hardware and energy costs.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • An immediate repair would be to include the round number in the DPoW challenge and schedule the oracle to deliver weight-P responses at the last tick of the current step; without that, the paper's own oracle model and Algorithm 1 disagree on when the response arrives.
  • If TTRB is general, one could implement the same time-travel filter using verifiable delay functions or another deterministic-work primitive only for the first message of each round, reducing the work overhead from every message to one per node per round.
  • The exponential Bootstrap-Sieve could be replaced by an incremental filtering rule that maintains a trusted set across rounds, making catch-up practical; this is an engineering question the paper leaves open.
  • The leader-election token method assumes DPoW outputs behave as a random oracle; with the concrete Merkle-tree instantiation this is plausible but unproven, so the claimed 2/3 finality probability is conditional on the output distribution.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

2 major / 4 minor

Summary. The paper presents Sieve-MMR, a two-layer proof-of-work total-order broadcast protocol. The lower layer, Sieve, implements a new abstraction called time-travel-resilient broadcast (TTRB) using a deterministic proof-of-work oracle (DPoW). The upper layer ports the MMR consensus protocol on top of Sieve. The paper claims that this is the first fully permissionless PoW TOB protocol with deterministic safety and constant expected latency, tolerating a 1/3-bounded adversary. The correctness argument is a layered composition: Sieve is shown to implement TTRB under a correct-supremacy assumption, and MMR is shown to implement TOB given TTRB. The appendix contains PlusCal/TLA+ models of both layers.

Significance. If the claimed result held, it would be a significant advance: it would give a fully permissionless PoW protocol with deterministic safety and expected-constant latency, avoiding the probabilistic guarantees of Bitcoin-style consensus and the external-checkpointing defenses of PoS. The high-level design is attractive: TTRB cleanly captures the message-delivery property needed to port dynamically available protocols to the permissionless setting, and the paper is unusually explicit about its assumptions and about the limitations of Bootstrap-Sieve. The presence of PlusCal/TLA+ specifications is a strength. However, the central implementation claim is currently undermined by a load-bearing timing inconsistency between the DPoW oracle model and Algorithm 1, and the concrete Coelho instantiation does not implement the oracle's generation-time binding. These issues can likely be repaired, but they require substantive revision.

major comments (2)
  1. [§3 and Algorithm 1] The DPoW delivery schedule is inconsistent with Sieve's broadcast timing. In §3, a call dpow(γ, P(n)) made at tick t=sK is delivered at the earliest tick t'>t such that n has been active for ⌈P(n)K/P(n)⌉=K ticks in [t, t'). The interval [sK, sK+K) contains exactly K ticks, so delivery occurs at t'=sK+K, i.e., the first tick of step s+1. Algorithm 1 (line 10) expects the response to be available at tick t mod K = K−1, i.e., the last tick of step s, and broadcasts the pending message at that tick. Thus, under the model as written, correct nodes never receive a weight-P(n) DPoW response within the step in which it was requested; pending-ttrb-msg is overwritten at the next NewStep call, and no correct Sieve message is ever broadcast. This breaks the base case of the induction in Theorem 1 and makes TTRB2 unsatisfiable. The PlusCal model in Appendix B.1 sidesteps the issue by assuming the mes
  2. [§7 and §4.3] The proposed concrete implementation of DPoW does not provide two properties on which TTRB relies. First, the DPoW oracle in §3 binds a DPoW evaluation to the step in which dpow(γ,w) was called and to the particular caller's pending request. The Coelho construction P(χ,w) computes a proof from χ and w alone, with no step parameter, no caller-bound pending state, and no delivery schedule. Second, Algorithm 1 forms γ = ⟨ttrb-msg, L, r⟩ in TTRBCast (line 23) and does not include the current step s; the timestamp s is added later only in the broadcast message m. Consequently, a Byzantine node can compute proofs at any time and later attach an arbitrary timestamp to them, and there is no concrete mechanism that forces a weight-P(n) evaluation to be ready at the last tick of the current step. This is not merely an implementation gap: TTRB1 requires 'oracle generation time s−1', but Sieve never
minor comments (4)
  1. [Appendix B.1] The PlusCal model assumes a uniform tWB for all correct processes and treats DPoW generation as starting at tick % tWB = 0 and completing at tick % tWB = tWB−1. The model therefore does not check the oracle's per-node power P(n), the pending-call uniqueness rule, or the off-by-one concern above. This should be stated explicitly when the model is presented.
  2. [§3, DPoW oracle] The oracle's scheduling rule says a caller with no pending evaluation receives a response for the earliest t' satisfying the active-tick condition. If a node calls dpow with a weight smaller than P(n), the response can arrive in the middle of a step; Algorithm 1 only handles the case where R contains exactly one response at the last tick. The paper should clarify whether calls with non-maximal weights are allowed and what the protocol does with responses that arrive at non-boundary ticks.
  3. [Figures 4 and 5] The text refers to red edges in Figure 3 and to the semantics of shaded/unshaded nodes, but in a monochrome print the color distinction is lost. Please use shape or label distinctions as well.
  4. [§4.2] The phrase 'messages that are not causally preceded by a correct message from the previous step' is slightly ambiguous: the filtering condition in Online-Sieve is about coffer intersection weight, not causal reachability. Consider rewording to match Algorithm 2.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity found: Sieve and Sieve-MMR are layered inductive constructions with explicit assumptions; the cited prior work is not used as a substitute for the paper's derivation.

full rationale

The paper's derivation chain is layered and does not reduce any claimed result to its own inputs. Sieve implements TTRB from the explicit correct-supremacy assumption and the DPoW oracle model; the correctness proof defines the Sieve Invariant separately from TTRB (Definition 5) and proves by induction that both Online-Sieve and Bootstrap-Sieve preserve it (Lemmas 3 and 5), with TTRB following as Lemma 1 and Theorem 1. The Sieve-MMR layer is also compositional: it assumes only Assumption 1, derives MMR1 and MMR2 from TTRB1/TTRB2 and Lemma 2, and then proves the TOB properties in Appendix A from those derived properties. There are no fitted parameters being renamed as predictions, and no definition of a target quantity in terms of itself. The self-citations that do appear (e.g., [34], [35]) are either pointers to formal models or background context, not load-bearing uniqueness theorems or unexplained ansatzes. The paper also openly labels its own limitations, such as the exponential complexity of Bootstrap-Sieve and its declarative nature, which further supports a non-circular presentation. The potentially serious off-by-one issue between the DPoW oracle's delivery schedule in Section 3 and Algorithm 1's expectation that a weight-P(n) response arrives in the last tick of the current step is a model-consistency or correctness concern, not a circularity: it does not make a prediction identical to an input or make a derivation depend on itself. The central claims are therefore self-contained given the stated idealizations, and no circular step is exhibited.

Assumptions & free parameters 2 free parameters · 5 assumptions · 1 invented entities

The central construction rests on a standard security assumption (Byzantine minority), a strong network assumption (synchronous all-to-all), and an idealized DPoW oracle with timestamping. The free parameters are few and not fitted to data, but the oracle abstraction is the most fragile piece: its ideal properties are used directly in the proofs and are not fully realized by the proposed implementation.

free parameters (2)
  • Step length K = K ≫ 1 (unspecified constant)
    Number of ticks per protocol step; a design parameter chosen by the protocol, not fitted to data. Correctness requires K to be large enough for one DPoW per step, but the paper does not give a concrete value.
  • Adversary bound ρ = ρ = 1/3 for Sieve-MMR (ρ ≤ 1/2 for standalone Sieve)
    Fraction of Byzantine DPoW weight allowed; inherited from the MMR protocol's 1/3-bounded adversary assumption. This is an assumption on the environment, not a fitted value.
assumptions (5)
  • domain assumption Correct supremacy: over every interval of steps, Byzantine DPoW weight is strictly less than ρ of total DPoW weight
    Stated in §3 and used throughout the proofs of Sieve (Lemmas 2, 3, 5) and MMR (Properties 1–3). This is the security premise of the system.
  • ad hoc to paper DPoW oracle: a trusted global oracle returns unique, verifiable evaluations bound to the step they were requested in, with response time ⌈wK/P(n)⌉
    Introduced in §3 as a black-box primitive. The paper provides a concrete proposal in §7, but that proposal does not implement the timestamp binding and is probabilistic, so the ideal oracle remains an extra assumption for the deterministic proofs.
  • domain assumption Synchronous, reliable, all-to-all network with atomic delivery at step boundaries
    Assumed in §3 and needed for the TTRB round structure and for MMR's quorum counting. The paper acknowledges this is required for fully permissionless deterministic safety.
  • standard math Random oracle for H and for leader election
    Used for DPoW verification (Coelho construction) and for leader election (§6.2). Standard cryptographic assumption; the paper qualifies that guarantees hold in the Dolev-Yao model.
  • domain assumption Dolev-Yao adversary: cannot break cryptographic primitives or guess random nonces
    Stated in §1: deterministic safety holds only if adversaries do not break crypto or guess messages. This is the typical computational model.
invented entities (1)
  • DPoW oracle
    purpose: Provides deterministic proof-of-work evaluations with a unique value and a private generation-time map, enabling Sieve to filter time-traveling messages.
    The ideal oracle is a new postulated primitive with secret state and timestamping. The concrete Coelho-based construction is a probabilistic PoW and lacks the timestamp binding, so there is no falsifiable external handle for the oracle's key properties.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Fast Deterministically Safe Proof-of-Work Consensus." pith.science (2026). https://pith.science/paper/J5DHFNV6

@misc{pith2026251219968,
  author       = {Pith},
  title        = {Pith review of: Fast Deterministically Safe Proof-of-Work Consensus},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/J5DHFNV6}},
  note         = {Machine review of arXiv:2512.19968}
}
read the original abstract

Permissionless blockchains achieve consensus while allowing unknown nodes to join and leave the system at any time. They typically come in two flavors: proof of work (PoW) and proof of stake (PoS), and both are vulnerable to attacks. PoS protocols suffer from long-range attacks, wherein attackers alter execution history at little cost, and PoW protocols are vulnerable to attackers with enough computational power to subvert execution history. PoS protocols respond by relying on external mechanisms like social consensus; PoW protocols either fall back to probabilistic guarantees, or are slow. We present Sieve-MMR, the first fully-permissionless protocol with deterministic security and constant expected latency that does not rely on external mechanisms. We obtain Sieve-MMR by porting a PoS protocol (MMR) to the PoW setting. From MMR we inherit constant expected latency and deterministic security, and proof-of-work gives us resilience against long-range attacks. The main challenge to porting MMR to the PoW setting is what we call time-travel attacks, where attackers use PoWs generated in the distant past to increase their perceived PoW power in the present. We respond by proposing Sieve, a novel algorithm that implements a new broadcast primitive we dub time-travel-resilient broadcast (TTRB). Sieve relies on a black-box, deterministic PoW primitive to implement TTRB, which we use as the messaging layer for MMR.

Figures

Figures reproduced from arXiv: 2512.19968 by the authors.

Figure 1
Figure 1. Example of time-travel attack. Although active correct nodes form a majority among active nodes [PITH_FULL_IMAGE:figures/full_fig_p005_1.png] view at source ↗
Figure 2
Figure 2. Protocol stack of the Sieve-MMR algorithm. [PITH_FULL_IMAGE:figures/full_fig_p007_2.png] view at source ↗
Figure 3
Figure 3. Example execution in which correct nodes [PITH_FULL_IMAGE:figures/full_fig_p011_3.png] view at source ↗
Figures from the paper (2 more)
Figure 4
Figure 4. Figure 4: An execution showing that Online-Sieve on its own is not enough. It shows what a new node [PITH_FULL_IMAGE:figures/full_fig_p013_4.png]
Figure 5
Figure 5. Figure 5: An example execution showing Bootstrap-Sieve in action. A newly joining correct node [PITH_FULL_IMAGE:figures/full_fig_p013_5.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

47 extracted references · 2 linked inside Pith

  1. [1]

    Accessed: 2025- 01-02

    Chia green paper.https://docs.chia.net/files/ChiaGreenPaper_20241008.pdf. Accessed: 2025- 01-02

    2025

  2. [2]

    Ethereum proof-of-stake consensus specifications

  3. [3]

    Winkle: Foiling Long-Range Attacks in Proof- of-Stake Systems

    Sarah Azouvi, George Danezis, and Valeria Nikolaenko. Winkle: Foiling Long-Range Attacks in Proof- of-Stake Systems. InProceedings of the 2nd ACM Conference on Advances in Financial Technologies, AFT ’20, pages 189–201, New York, NY, USA, October 2020. Association for Computing Machinery

    2020

  4. [4]

    Pikachu: Securing PoS Blockchains from Long-Range Attacks by Checkpointing into Bitcoin PoW using Taproot

    Sarah Azouvi and Marko Vukoli´ c. Pikachu: Securing PoS Blockchains from Long-Range Attacks by Checkpointing into Bitcoin PoW using Taproot. InProceedings of the 2022 ACM Workshop on Develop- ments in Consensus, ConsensusDay ’22, pages 53–65, New York, NY, USA, November 2022. Association for Computing Machinery

    2022

  5. [5]

    Prism: Deconstruct- ing the blockchain to approach physical limits

    Vivek Bagaria, Sreeram Kannan, David Tse, Giulia Fanti, and Pramod Viswanath. Prism: Deconstruct- ing the blockchain to approach physical limits. InProceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security, pages 585–602, 2019

    2019

  6. [6]

    Another advantage of free choice (extended abstract) completely asynchronous agree- ment protocols

    Michael Ben-Or. Another advantage of free choice (extended abstract) completely asynchronous agree- ment protocols. InProceedings of the second annual ACM symposium on Principles of distributed computing, pages 27–30, 1983

    1983

  7. [7]

    Verifiable Delay Functions

    Dan Boneh, Joseph Bonneau, Benedikt B¨ unz, and Ben Fisch. Verifiable Delay Functions. In Hovav Shacham and Alexandra Boldyreva, editors,Advances in Cryptology – CRYPTO 2018, Lecture Notes in Computer Science, pages 757–788, Cham, 2018. Springer International Publishing

    2018

  8. [8]

    The latest gossip on BFT consensus, November 2019

    Ethan Buchman, Jae Kwon, and Zarko Milosevic. The latest gossip on BFT consensus, November 2019

    2019

Show all 47 references
  1. [9]

    The Economic Limits of Permissionless Con- sensus, June 2024

    Eric Budish, Andrew Lewis-Pye, and Tim Roughgarden. The Economic Limits of Permissionless Con- sensus, June 2024

    2024

  2. [10]

    An (Almost) Constant-Effort Solution-Verification Proof-of-Work Protocol Based on Merkle Trees

    Fabien Coelho. An (Almost) Constant-Effort Solution-Verification Proof-of-Work Protocol Based on Merkle Trees. In Serge Vaudenay, editor,Progress in Cryptology – AFRICACRYPT 2008, pages 80–93, Berlin, Heidelberg, 2008. Springer

    2008

  3. [11]

    Atomic broadcast: From simple message diffusion to byzantine agreement.Information and Computation, 118(1):158–179, 1995

    Flaviu Cristian, Houtan Aghili, Ray Strong, and Danny Dolev. Atomic broadcast: From simple message diffusion to byzantine agreement.Information and Computation, 118(1):158–179, 1995

    1995

  4. [12]

    Snow White: Robustly Reconfigurable Consensus and Appli- cations to Provably Secure Proof of Stake

    Phil Daian, Rafael Pass, and Elaine Shi. Snow White: Robustly Reconfigurable Consensus and Appli- cations to Provably Secure Proof of Stake. In Ian Goldberg and Tyler Moore, editors,Financial Cryp- tography and Data Security, Lecture Notes in Computer Science, pages 23–41, Cha...

    2019

  5. [13]

    Goldfish: No More Attacks on Proof-of-Stake Ethereum, May 2023

    Francesco D’Amato, Joachim Neu, Ertem Nusret Tas, and David Tse. Goldfish: No More Attacks on Proof-of-Stake Ethereum, May 2023

    2023

  6. [14]

    PoSAT: Proof-of-Work Availability and Unpredictabil- ity, Without the Work

    Soubhik Deb, Sreeram Kannan, and David Tse. PoSAT: Proof-of-Work Availability and Unpredictabil- ity, Without the Work. In Nikita Borisov and Claudia Diaz, editors,Financial Cryptography and Data Security, pages 104–128, Berlin, Heidelberg, 2021. Springer

    2021

  7. [15]

    Everything is a race and nakamoto always wins

    Amir Dembo, Sreeram Kannan, Ertem Nusret Tas, David Tse, Pramod Viswanath, Xuechao Wang, and Ofer Zeitouni. Everything is a race and nakamoto always wins. InProceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security, pages 859–878, 2020. 22

    2020

  8. [16]

    On the security of public key protocols.IEEE Transactions on infor- mation theory, 29(2):198–208, 1983

    Danny Dolev and Andrew Yao. On the security of public key protocols.IEEE Transactions on infor- mation theory, 29(2):198–208, 1983

    1983

  9. [17]

    Bitcoin-NG: A scalable blockchain protocol

    Ittay Eyal, Adem Efe Gencer, Emin G¨ un Sirer, and Robbert Van Renesse. Bitcoin-NG: A scalable blockchain protocol. In13th USENIX symposium on networked systems design and implementation (NSDI 16), pages 45–59. USENIX, 2016

    2016

  10. [18]

    An optimal probabilistic protocol for synchronous byzantine agree- ment.SIAM Journal on Computing, 26(4):873–933, 1997

    Pesech Feldman and Silvio Micali. An optimal probabilistic protocol for synchronous byzantine agree- ment.SIAM Journal on Computing, 26(4):873–933, 1997

    1997

  11. [19]

    Parallel Chains: Improving Throughput and Latency of Blockchain Protocols via Parallel Composition, 2018

    Matthias Fitzi, Peter Gaˇ zi, Aggelos Kiayias, and Alexander Russell. Parallel Chains: Improving Throughput and Latency of Blockchain Protocols via Parallel Composition, 2018

    2018

  12. [20]

    Round-by-round fault detectors, unifying synchrony and asynchrony (extendeda abstract)

    Eli Gafni. Round-by-round fault detectors, unifying synchrony and asynchrony (extendeda abstract). In Proc. 17th Annual ACM Symposium on Principles of Distributed Computing (PODC), Puerto Vallarta, Mexico, June, pages 143–152, 1998

    1998

  13. [21]

    Brief Announcement: Byzantine Consensus Under Dynamic Participation with a Well-Behaved Majority

    Eli Gafni and Giuliano Losa. Brief Announcement: Byzantine Consensus Under Dynamic Participation with a Well-Behaved Majority. In Rotem Oshman, editor,37th International Symposium on Distributed Computing (DISC 2023), volume 281 ofLeibniz International Proceedings in Informati...

    2023

  14. [22]

    The Bitcoin Backbone Protocol: Analysis and Applications

    Juan Garay, Aggelos Kiayias, and Nikos Leonardos. The Bitcoin Backbone Protocol: Analysis and Applications. In Elisabeth Oswald and Marc Fischlin, editors,Advances in Cryptology - EUROCRYPT 2015, pages 281–310, Berlin, Heidelberg, 2015. Springer

    2015

  15. [23]

    Proof-of-Work-Based Consensus in Expected-Constant Time

    Juan Garay, Aggelos Kiayias, and Yu Shen. Proof-of-Work-Based Consensus in Expected-Constant Time. In Marc Joye and Gregor Leander, editors,Advances in Cryptology – EUROCRYPT 2024, pages 96–125, Cham, 2024. Springer Nature Switzerland

    2024

  16. [24]

    Algorand: Scaling byzantine agreements for cryptocurrencies

    Yossi Gilad, Rotem Hemo, Silvio Micali, Georgios Vlachos, and Nickolai Zeldovich. Algorand: Scaling byzantine agreements for cryptocurrencies. InProceedings of the 26th symposium on operating systems principles, pages 51–68, 2017

    2017

  17. [25]

    The knowledge complexity of interactive proof- systems

    Shafi Goldwasser, Silvio Micali, and Chales Rackoff. The knowledge complexity of interactive proof- systems. InProviding sound foundations for cryptography: On the work of shafi goldwasser and silvio micali, pages 203–225. 2019

    2019

  18. [26]

    On expected constant-round protocols for byzantine agreement

    Jonathan Katz and Chiu-Yuen Koo. On expected constant-round protocols for byzantine agreement. InAnnual International Cryptology Conference, pages 445–462. Springer, 2006

    2006

  19. [27]

    Parallel Proof-of-Work with Concrete Bounds

    Patrik Keller and Rainer B¨ ohme. Parallel Proof-of-Work with Concrete Bounds. InProceedings of the 4th ACM Conference on Advances in Financial Technologies, AFT ’22, pages 1–15, New York, NY, USA, July 2023. Association for Computing Machinery

    2023

  20. [28]

    Short paper: Posh proof of staked hardware consensus.Cryptology ePrint Archive, 2020

    Rami Khalil and Naranker Dulay. Short paper: Posh proof of staked hardware consensus.Cryptology ePrint Archive, 2020

    2020

  21. [29]

    Ouroboros: A Provably Secure Proof-of-Stake Blockchain Protocol

    Aggelos Kiayias, Alexander Russell, Bernardo David, and Roman Oliynykov. Ouroboros: A Provably Secure Proof-of-Stake Blockchain Protocol. In Jonathan Katz and Hovav Shacham, editors,Advances in Cryptology – CRYPTO 2017, Lecture Notes in Computer Science, pages 357–388, Cham, 2...

    2017

  22. [30]

    Time, clocks, and the ordering of events in a distributed system.Communications of the ACM, 21(7):558–565, 1978

    Leslie Lamport. Time, clocks, and the ordering of events in a distributed system.Communications of the ACM, 21(7):558–565, 1978

    1978

  23. [31]

    Byzantine generals in the permissionless setting

    Andrew Lewis-Pye and Tim Roughgarden. Byzantine generals in the permissionless setting. InInter- national Conference on Financial Cryptography and Data Security, pages 21–37. Springer, 2023. 23

    2023

  24. [32]

    Permissionless Consensus

    Andrew Lewis-Pye and Tim Roughgarden. Permissionless Consensus. (arXiv:2304.14701), March 2024

    2024 arXiv

  25. [33]

    Nakamoto consensus with verifiable delay puzzle.arXiv preprint arXiv:1908.06394, 2019

    Jieyi Long. Nakamoto consensus with verifiable delay puzzle.arXiv preprint arXiv:1908.06394, 2019

    1908 arXiv

  26. [34]

    Formal models of the Sieve-MMR protocol, October 2025

    Giuliano Losa. Formal models of the Sieve-MMR protocol, October 2025

    2025

  27. [35]

    Consensus in the Unknown-Participation Message-Adversary Model, October 2023

    Giuliano Losa and Eli Gafni. Consensus in the Unknown-Participation Message-Adversary Model, October 2023

    2023

  28. [36]

    Towards practical sleepy BFT

    Dahlia Malkhi, Atsuki Momose, and Ling Ren. Towards practical sleepy BFT. Cryptology ePrint Archive, Paper 2022/1448, 2023

    2022

  29. [37]

    Towards Practical Sleepy BFT

    Dahlia Malkhi, Atsuki Momose, and Ling Ren. Towards Practical Sleepy BFT. InProceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security, CCS ’23, pages 490–503, New York, NY, USA, November 2023. Association for Computing Machinery

    2023

  30. [38]

    Micali, M

    S. Micali, M. Rabin, and S. Vadhan. Verifiable random functions. In40th Annual Symposium on Foundations of Computer Science (Cat. No.99CB37039), pages 120–130, October 1999

    1999

  31. [39]

    Constant Latency in Sleepy Consensus

    Atsuki Momose and Ling Ren. Constant Latency in Sleepy Consensus. InProceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security, CCS ’22, pages 2295–2308, New York, NY, USA, November 2022. Association for Computing Machinery

    2022

  32. [40]

    Bitcoin: A peer-to-peer electronic cash system, 2008

    Satoshi Nakamoto. Bitcoin: A peer-to-peer electronic cash system, 2008

    2008

  33. [41]

    The Sleepy Model of Consensus

    Rafael Pass and Elaine Shi. The Sleepy Model of Consensus. In Tsuyoshi Takagi and Thomas Peyrin, editors,Advances in Cryptology – ASIACRYPT 2017, Lecture Notes in Computer Science, pages 380– 409, Cham, 2017. Springer International Publishing

    2017

  34. [42]

    Safe permissionless consensus

    Youer Pu, Lorenzo Alvisi, and Ittay Eyal. Safe permissionless consensus. In Christian Scheideler, editor,36th International Symposium on Distributed Computing, DISC 2022, October 25-27, 2022, Augusta, Georgia, USA, volume 246 ofLIPIcs, pages 33:1–33:15. Schloss Dagstuhl - Leib...

    2022

  35. [43]

    Gorilla: Safe permissionless byzantine consensus

    Youer Pu, Ali Farahbakhsh, Lorenzo Alvisi, and Ittay Eyal. Gorilla: Safe permissionless byzantine consensus. In Rotem Oshman, editor,37th International Symposium on Distributed Computing, DISC 2023, October 10-12, 2023, L’Aquila, Italy, volume 281 ofLIPIcs, pages 31:1–31:16. S...

    2023

  36. [44]

    Implementing fault-tolerant services using the state machine approach: A tutorial

    Fred B Schneider. Implementing fault-tolerant services using the state machine approach: A tutorial. Acm Computing Surveys (CSUR), 22(4):299–319, 1990

    1990

  37. [45]

    Bitcoin-Enhanced Proof-of-Stake Security: Possibilities and Impossibilities

    Ertem Nusret Tas, David Tse, Fangyu Gai, Sreeram Kannan, Mohammad Ali Maddah-Ali, and Fisher Yu. Bitcoin-Enhanced Proof-of-Stake Security: Possibilities and Impossibilities. In2023 IEEE Sympo- sium on Security and Privacy (SP), pages 126–145, May 2023

    2023

  38. [46]

    Swiper: A new paradigm for efficient weighted distributed proto- cols

    Andrei Tonkikh and Luciano Freitas. Swiper: A new paradigm for efficient weighted distributed proto- cols. InProceedings of the 43rd ACM Symposium on Principles of Distributed Computing, PODC ’24, pages 283–294, New York, NY, USA, June 2024. Association for Computing Machinery

    2024

  39. [47]

    the maximal grade-1 chain

    Ronghua Xu and Yu Chen. Fairledger: a fair proof-of-sequential-work based lightweight distributed ledger for iot networks. In2022 IEEE International Conference on Blockchain (Blockchain), pages 348–355. IEEE, 2022. 24 A Correctness of the Sieve-MMR Algorithm In this section, w...

    2022

Pith tools

Reviewed August 3, 2026 · model on record in the stance chip above.