LearnToEarn

I went back through the Dusk whitepaper last night, focusing on the emergency mode, fallback, and rolling finality sections. The details were more nuanced than I first expected.

Emergency mode activates after 16 failed iterations. Step timeouts are then disabled, and open iterations continue until a candidate block reaches quorum in both validation and ratification. Multiple iterations can run at once, which improves the chance of producing a block but also increases the possibility of forks. If several candidates reach consensus, the lowest iteration is selected. At the last iteration, provisioners can request an emergency block, but it requires provisioners holding a majority of total network stake.

The fallback rules also caught my attention: a block from iteration J > 0 can potentially be replaced by a lower-iteration block that later reaches consensus, while iteration 0 cannot be replaced this way.

Then rolling finality adds another layer. If n previous iterations failed attestation, a block is accepted and needs 2×n consecutive attested or confirmed blocks to become confirmed. The paper's example uses iteration 5, n=2, meaning 4 more blocks are required.

I’m still wondering: does this design create any meaningful centralization risk around stake-weighted emergency recovery?

@Dusk #dusk $DUSK

I went back through the Dusk whitepaper last night, focusing on the emergency mode, fallback, and rolling finality sections. The details were more nuanced than I first expected.

Emergency mode activates after 16 failed iterations. Step timeouts are then disabled, and open iterations continue until a candidate block reaches quorum in both validation and ratification. Multiple iterations can run at once, which improves the chance of producing a block but also increases the possibility of forks. If several candidates reach consensus, the lowest iteration is selected. At the last iteration, provisioners can request an emergency block, but it requires provisioners holding a majority of total network stake.

The fallback rules also caught my attention: a block from iteration J > 0 can potentially be replaced by a lower-iteration block that later reaches consensus, while iteration 0 cannot be replaced this way.

Then rolling finality adds another layer. If n previous iterations failed attestation, a block is accepted and needs 2×n consecutive attested or confirmed blocks to become confirmed. The paper's example uses iteration 5, n=2, meaning 4 more blocks are required.

I’m still wondering: does this design create any meaningful centralization risk around stake-weighted emergency recovery?

@Dusk #dusk $DUSK

I went back through the Dusk whitepaper last night, focusing on the emergency mode, fallback, and rolling finality sections. The details were more nuanced than I first expected.

Emergency mode activates after 16 failed iterations. Step timeouts are then disabled, and open iterations continue until a candidate block reaches quorum in both validation and ratification. Multiple iterations can run at once, which improves the chance of producing a block but also increases the possibility of forks. If several candidates reach consensus, the lowest iteration is selected. At the last iteration, provisioners can request an emergency block, but it requires provisioners holding a majority of total network stake.

The fallback rules also caught my attention: a block from iteration J > 0 can potentially be replaced by a lower-iteration block that later reaches consensus, while iteration 0 cannot be replaced this way.

Then rolling finality adds another layer. If n previous iterations failed attestation, a block is accepted and needs 2×n consecutive attested or confirmed blocks to become confirmed. The paper's example uses iteration 5, n=2, meaning 4 more blocks are required.

I’m still wondering: does this design create any meaningful centralization risk around stake-weighted emergency recovery?

@Dusk #dusk $DUSK

I went back through the Dusk whitepaper last night, focusing on the emergency mode, fallback, and rolling finality sections. The details were more nuanced than I first expected.

Emergency mode activates after 16 failed iterations. Step timeouts are then disabled, and open iterations continue until a candidate block reaches quorum in both validation and ratification. Multiple iterations can run at once, which improves the chance of producing a block but also increases the possibility of forks. If several candidates reach consensus, the lowest iteration is selected. At the last iteration, provisioners can request an emergency block, but it requires provisioners holding a majority of total network stake.

The fallback rules also caught my attention: a block from iteration J > 0 can potentially be replaced by a lower-iteration block that later reaches consensus, while iteration 0 cannot be replaced this way.

Then rolling finality adds another layer. If n previous iterations failed attestation, a block is accepted and needs 2×n consecutive attested or confirmed blocks to become confirmed. The paper's example uses iteration 5, n=2, meaning 4 more blocks are required.

I’m still wondering: does this design create any meaningful centralization risk around stake-weighted emergency recovery?

@Dusk #dusk $DUSK

I went back through the @Dusk documentation last night, specifically the section on their Succinct Attestation consensus. It’s a permissionless, committee-based proof-of-stake setup run by provisioners....anyone who locks at least 1000 DUSK as stake.

A stake is just the amount plus the block height it was included at. Eligibility isn’t immediate. There’s a maturity period calculated as M = 2 × epoch − (height mod epoch), and the epoch is currently 2160 blocks. Only after that maturity window, and if the amount meets the minimum, does the stake enter the deterministic sortition lottery that picks the block generator and the voting committees for each round.

The process itself runs in rounds and iterations. Each iteration has three steps: proposal (one provisioner is selected to put forward a candidate block), validation (a committee votes Valid, Invalid, or NoCandidate, needing a 2/3 supermajority for Valid or a simple majority for Invalid), and ratification (a fresh committee confirms the result). A round can go through up to 50 iterations before it fails.

What I’m still turning over is how the non-interactive sortition and the rotating committees actually affect long-term decentralization and the risk of committee capture. The fixed parameters....1000 DUSK minimum, 2160-block epochs, 50-iteration cap
....feel deliberate, but I couldn’t find a clear discussion of how they might be adjusted later or what governance process would control that.

Curious how others read the security assumptions around the voting committees and the maturity delay. Does the design feel robust to you, or are there edge cases I’m missing?

#dusk $DUSK

I went back through the @Dusk documentation last night, specifically the section on their Succinct Attestation consensus. It’s a permissionless, committee-based proof-of-stake setup run by provisioners....anyone who locks at least 1000 DUSK as stake.

A stake is just the amount plus the block height it was included at. Eligibility isn’t immediate. There’s a maturity period calculated as M = 2 × epoch − (height mod epoch), and the epoch is currently 2160 blocks. Only after that maturity window, and if the amount meets the minimum, does the stake enter the deterministic sortition lottery that picks the block generator and the voting committees for each round.

The process itself runs in rounds and iterations. Each iteration has three steps: proposal (one provisioner is selected to put forward a candidate block), validation (a committee votes Valid, Invalid, or NoCandidate, needing a 2/3 supermajority for Valid or a simple majority for Invalid), and ratification (a fresh committee confirms the result). A round can go through up to 50 iterations before it fails.

What I’m still turning over is how the non-interactive sortition and the rotating committees actually affect long-term decentralization and the risk of committee capture. The fixed parameters....1000 DUSK minimum, 2160-block epochs, 50-iteration cap
....feel deliberate, but I couldn’t find a clear discussion of how they might be adjusted later or what governance process would control that.

Curious how others read the security assumptions around the voting committees and the maturity delay. Does the design feel robust to you, or are there edge cases I’m missing?

#dusk $DUSK

I went back through the @Dusk documentation last night, specifically the section on their Succinct Attestation consensus. It’s a permissionless, committee-based proof-of-stake setup run by provisioners....anyone who locks at least 1000 DUSK as stake.

A stake is just the amount plus the block height it was included at. Eligibility isn’t immediate. There’s a maturity period calculated as M = 2 × epoch − (height mod epoch), and the epoch is currently 2160 blocks. Only after that maturity window, and if the amount meets the minimum, does the stake enter the deterministic sortition lottery that picks the block generator and the voting committees for each round.

The process itself runs in rounds and iterations. Each iteration has three steps: proposal (one provisioner is selected to put forward a candidate block), validation (a committee votes Valid, Invalid, or NoCandidate, needing a 2/3 supermajority for Valid or a simple majority for Invalid), and ratification (a fresh committee confirms the result). A round can go through up to 50 iterations before it fails.

What I’m still turning over is how the non-interactive sortition and the rotating committees actually affect long-term decentralization and the risk of committee capture. The fixed parameters....1000 DUSK minimum, 2160-block epochs, 50-iteration cap
....feel deliberate, but I couldn’t find a clear discussion of how they might be adjusted later or what governance process would control that.

Curious how others read the security assumptions around the voting committees and the maturity delay. Does the design feel robust to you, or are there edge cases I’m missing?

#dusk $DUSK

I went back through the @Dusk documentation last night, specifically the section on their Succinct Attestation consensus. It’s a permissionless, committee-based proof-of-stake setup run by provisioners....anyone who locks at least 1000 DUSK as stake.

A stake is just the amount plus the block height it was included at. Eligibility isn’t immediate. There’s a maturity period calculated as M = 2 × epoch − (height mod epoch), and the epoch is currently 2160 blocks. Only after that maturity window, and if the amount meets the minimum, does the stake enter the deterministic sortition lottery that picks the block generator and the voting committees for each round.

The process itself runs in rounds and iterations. Each iteration has three steps: proposal (one provisioner is selected to put forward a candidate block), validation (a committee votes Valid, Invalid, or NoCandidate, needing a 2/3 supermajority for Valid or a simple majority for Invalid), and ratification (a fresh committee confirms the result). A round can go through up to 50 iterations before it fails.

What I’m still turning over is how the non-interactive sortition and the rotating committees actually affect long-term decentralization and the risk of committee capture. The fixed parameters....1000 DUSK minimum, 2160-block epochs, 50-iteration cap
....feel deliberate, but I couldn’t find a clear discussion of how they might be adjusted later or what governance process would control that.

Curious how others read the security assumptions around the voting committees and the maturity delay. Does the design feel robust to you, or are there edge cases I’m missing?

#dusk $DUSK

I went back through the documentation last night on the @Dusk transaction models and spent a few hours just trying to map how Moonlight and Phoenix actually fit together.

At first the distinction looked clean. Moonlight is the transparent, account-based side where each account keeps a public state that records its balance and nonce. Phoenix is the note-based shielded side: a note is structured around a recipient public key, a value v, and additional random scalars, with notes indexed inside a Merkle tree so a spender can prove inclusion without revealing the note itself. Spending requires a zero-knowledge proof and the publication of a nullifier so the network can reject double-spends. The docs also state that note values are bounded by 2^{64}-1.

Conversion paths between the two models (deposit into Phoenix notes, withdraw back to Moonlight accounts) are described, but I kept getting stuck on the exact security assumptions that hold during those hand-offs. The circuits are said to guarantee validity, yet I couldn’t find a clear statement on whether a single malformed conversion could affect the global nullifier set or the transparent balances that smart contracts rely on.

That raised a broader question for me about decentralization: if most value ends up living in Phoenix notes, how much practical governance power remains with the transparent account layer that contracts and oracles actually see?

Is the current circuit design and the 2^{64}-1 value bound considered final, or are there still open parameters around note generation, Merkle-tree depth, and nullifier uniqueness that the community is still iterating on?

Would appreciate any pointers from people who have gone deeper into the proofs.

#dusk $DUSK

I went back through the documentation last night on the @Dusk transaction models and spent a few hours just trying to map how Moonlight and Phoenix actually fit together.

At first the distinction looked clean. Moonlight is the transparent, account-based side where each account keeps a public state that records its balance and nonce. Phoenix is the note-based shielded side: a note is structured around a recipient public key, a value v, and additional random scalars, with notes indexed inside a Merkle tree so a spender can prove inclusion without revealing the note itself. Spending requires a zero-knowledge proof and the publication of a nullifier so the network can reject double-spends. The docs also state that note values are bounded by 2^{64}-1.

Conversion paths between the two models (deposit into Phoenix notes, withdraw back to Moonlight accounts) are described, but I kept getting stuck on the exact security assumptions that hold during those hand-offs. The circuits are said to guarantee validity, yet I couldn’t find a clear statement on whether a single malformed conversion could affect the global nullifier set or the transparent balances that smart contracts rely on.

That raised a broader question for me about decentralization: if most value ends up living in Phoenix notes, how much practical governance power remains with the transparent account layer that contracts and oracles actually see?

Is the current circuit design and the 2^{64}-1 value bound considered final, or are there still open parameters around note generation, Merkle-tree depth, and nullifier uniqueness that the community is still iterating on?

Would appreciate any pointers from people who have gone deeper into the proofs.

#dusk $DUSK

I went back through the documentation last night on the @Dusk transaction models and spent a few hours just trying to map how Moonlight and Phoenix actually fit together.

At first the distinction looked clean. Moonlight is the transparent, account-based side where each account keeps a public state that records its balance and nonce. Phoenix is the note-based shielded side: a note is structured around a recipient public key, a value v, and additional random scalars, with notes indexed inside a Merkle tree so a spender can prove inclusion without revealing the note itself. Spending requires a zero-knowledge proof and the publication of a nullifier so the network can reject double-spends. The docs also state that note values are bounded by 2^{64}-1.

Conversion paths between the two models (deposit into Phoenix notes, withdraw back to Moonlight accounts) are described, but I kept getting stuck on the exact security assumptions that hold during those hand-offs. The circuits are said to guarantee validity, yet I couldn’t find a clear statement on whether a single malformed conversion could affect the global nullifier set or the transparent balances that smart contracts rely on.

That raised a broader question for me about decentralization: if most value ends up living in Phoenix notes, how much practical governance power remains with the transparent account layer that contracts and oracles actually see?

Is the current circuit design and the 2^{64}-1 value bound considered final, or are there still open parameters around note generation, Merkle-tree depth, and nullifier uniqueness that the community is still iterating on?

Would appreciate any pointers from people who have gone deeper into the proofs.

#dusk $DUSK

I went back through the documentation last night on the @Dusk transaction models and spent a few hours just trying to map how Moonlight and Phoenix actually fit together.

At first the distinction looked clean. Moonlight is the transparent, account-based side where each account keeps a public state that records its balance and nonce. Phoenix is the note-based shielded side: a note is structured around a recipient public key, a value v, and additional random scalars, with notes indexed inside a Merkle tree so a spender can prove inclusion without revealing the note itself. Spending requires a zero-knowledge proof and the publication of a nullifier so the network can reject double-spends. The docs also state that note values are bounded by 2^{64}-1.

Conversion paths between the two models (deposit into Phoenix notes, withdraw back to Moonlight accounts) are described, but I kept getting stuck on the exact security assumptions that hold during those hand-offs. The circuits are said to guarantee validity, yet I couldn’t find a clear statement on whether a single malformed conversion could affect the global nullifier set or the transparent balances that smart contracts rely on.

That raised a broader question for me about decentralization: if most value ends up living in Phoenix notes, how much practical governance power remains with the transparent account layer that contracts and oracles actually see?

Is the current circuit design and the 2^{64}-1 value bound considered final, or are there still open parameters around note generation, Merkle-tree depth, and nullifier uniqueness that the community is still iterating on?

Would appreciate any pointers from people who have gone deeper into the proofs.

#dusk $DUSK

I went back through the documentation last night on the @Dusk transaction models and spent a few hours just trying to map how Moonlight and Phoenix actually fit together.

At first the distinction looked clean. Moonlight is the transparent, account-based side where each account keeps a public state that records its balance and nonce. Phoenix is the note-based shielded side: a note is structured around a recipient public key, a value v, and additional random scalars, with notes indexed inside a Merkle tree so a spender can prove inclusion without revealing the note itself. Spending requires a zero-knowledge proof and the publication of a nullifier so the network can reject double-spends. The docs also state that note values are bounded by 2^{64}-1.

Conversion paths between the two models (deposit into Phoenix notes, withdraw back to Moonlight accounts) are described, but I kept getting stuck on the exact security assumptions that hold during those hand-offs. The circuits are said to guarantee validity, yet I couldn’t find a clear statement on whether a single malformed conversion could affect the global nullifier set or the transparent balances that smart contracts rely on.

That raised a broader question for me about decentralization: if most value ends up living in Phoenix notes, how much practical governance power remains with the transparent account layer that contracts and oracles actually see?

Is the current circuit design and the 2^{64}-1 value bound considered final, or are there still open parameters around note generation, Merkle-tree depth, and nullifier uniqueness that the community is still iterating on?

Would appreciate any pointers from people who have gone deeper into the proofs.

#dusk $DUSK