# Signatures of magnetic inertial dynamics in two-sublattice ferromagnets

Ritwik Mondal1,2 1Department of Spintronics and Nanoelectronics, Institute of
Physics ASCR, v.v.i., Cukrovarnická 10, Prague 6, 162 53, Czech Republic
2Department of Physics and Astronomy, Uppsala University, Box 516, SE-75120
Uppsala, Sweden<EMAIL_ADDRESS>
###### Abstract

The magnetic inertial dynamics have been investigated for one sublattice
ferromagnets. Here, we develop the magnetization dynamics in two-sublattice
ferromagnets including the intra- and inter-sublattice inertial dynamics.
First, we derive the magnetic susceptibility of such a ferromagnet. Next, by
finding the poles of the susceptibility, we calculate the precession and
nutation resonance frequencies. Our results suggest that while the resonance
frequencies show decreasing behavior with the increasing intra-sublattice
relaxation time, the effect of inter-sublattice inertial dynamics is
contrasting.

##  1 Introduction

Ultrafast manipulation of electrons’ spin remains at the heart of future
generation spin-based memory technology [1, 2, 3]. It has been observed that a
fs laser pulse is capable of demagnetizing a ferromagnetic material [4, 5, 6].
On the other hand, using these ultrashort pulses, magnetic switching has been
reported in ferrimagnetic [7, 8, 9] and ferromagnetic materials [10, 11].
These observations have been explained through the spin dynamics within
Landau-Lifshitz-Gilbert (LLG) equation of motion [12, 13, 14, 15].

The phenomenological LLG spin dynamics consists of spin precession and a
transverse damping [16, 17, 18]. Such an equation of motion has been derived
from a relativistic Dirac theory, where the transverse damping is found to
originate from spin-orbit coupling [19, 20, 21, 22]. However, at ultrashort
timescales, the traditional LLG equation needs to be supplemented by several
other spin torque terms [23]. Especially, at the ultrafast timescales, the
magnetic inertia becomes particularly relevant [24]. The effect of magnetic
inertia has been incorporated within extended LLG dynamics as a torque due to
the second-order time derivative of the magnetization $\bm{M}(\bm{r},t)$. The
inertial LLG (ILLG) equation of motion reads [25, 26, 27]

$\displaystyle\frac{\partial\bm{M}}{\partial t}$
$\displaystyle=\bm{M}\times\left[-\gamma\bm{H}+\frac{\alpha}{M_{0}}\frac{\partial\bm{M}}{\partial
t}+\frac{\eta}{M_{0}}\frac{\partial^{2}\bm{M}}{\partial t^{2}}\right]\,,$ (1)

where $M_{0}$ and $\bm{H}$ define the ground state magnetization and an
effective field, respectively. The first and second terms in Eq. (1) represent
the traditional LLG equation [18]. The inertial spin dynamics in the last term
of Eq. (1) gives rise to the spin nutation [28, 29]. The ILLG equation
signifies the fact that the dynamics of a magnetic moment shows precession
with nutation at ultrafast timescales, followed by transverse damping [24].
The ILLG equation has schematically been depicted in Fig. 1. A simple
dimension analysis shows that the transverse damping is characterized by a
dimensionless parameter $\alpha$, and the inertial dynamics are strengthened
by inertial relaxation time $\eta$.

Figure 1:  Schematic depiction of ILLG equation of motion.

The ILLG dynamics have been derived within the relativistic Dirac framework as
well, where it shows that the Gilbert damping $\alpha$ and inertial relaxation
time $\eta$ are tensors [30]. In particular, the relativistic theory derives
that the Gilbert damping dynamics is associated with the imaginary part of the
susceptibility, while the inertial dynamics is given by the real part [31].
Such findings are found to be consistent with a linear response theory of
ferromagnet [32]. The inertial dynamics have also been derived within
classical mechanics of a current loop [33]. Eq. (1) has been applied to a
single sublattice ferromagnet beyond ferromagnetic resonance (FMR), observing
an additional peak due to nutation resonance [34, 35, 36]. While the FMR peak
appears at the GHz regime, the nutation resonance peak appears at the THz
regime [37]. The ILLG equation has also been applied to antiferromagnets and
ferrimagnets, and it has been predicted that the spin nutation should be
better detected in antiferromagnets as it is exchange enhanced [38].

Recently, the spin nutation resonance has been observed for ferromagnets in
the experiment [39]. Indeed, the nutation resonance peak has been seen at
around 0.5 THz. Note that the experiment was performed in two-sublattice
ferromagnets namely CoFeB and NiFe. For two-sublattice ferromagnet, the inter-
sublattice exchange energies become important. Here, we describe the inertial
effects in a two-sublattice ferromagnet coupled by the Heisenberg exchange
interaction. We follow the similar procedure of Ref. [38] and derive the
magnetic susceptibility. We not only consider the intra-sublattice inertial
dynamics, but also the inter-sublattice dynamics. Our results suggest that
there are two precession resonance peaks: one at GHz regime and another at THz
regime. Similarly, two nutation peaks can also be observed, both are at the
THz regime. By calculating the precession and nutation resonance frequencies,
we observe that the resonance frequencies decrease with increasing intra-
sublattice relaxation time, however, the scenario is different for inter-
sublattice inertial dynamics.

##  2 Theory of intra- and inter-sublattice inertial dynamics in two-
sublattice ferromagnets

The inertial dynamics for antiferromagnets have been introduced in Ref. [38].
For two-sublattice magnetic systems having magnetization ${\bm{M}}_{A}$ and
${\bm{M}}_{B}$, for $A$ and $B$ representing the two-sublattice, the ILLG
equations of motion can be recast as

$\displaystyle\frac{\partial{\bm{M}}_{A}}{\partial t}$
$\displaystyle=-\gamma_{A}\left(\bm{M}_{A}\times\bm{H}_{A}\right)+\frac{\alpha_{AA}}{M_{A0}}\left(\bm{M}_{A}\times\frac{\partial{\bm{M}}_{A}}{\partial
t}\right)+\frac{\alpha_{AB}}{M_{B0}}\left(\bm{M}_{A}\times\frac{\partial{\bm{M}}_{B}}{\partial
t}\right)$
$\displaystyle+\frac{\eta_{AA}}{M_{A0}}\left(\bm{M}_{A}\times\frac{\partial^{2}{\bm{M}}_{A}}{\partial
t^{2}}\right)+\frac{\eta_{AB}}{M_{B0}}\left(\bm{M}_{A}\times\frac{\partial^{2}{\bm{M}}_{B}}{\partial
t^{2}}\right)$ (2) $\displaystyle\frac{\partial{\bm{M}}_{B}}{\partial t}$
$\displaystyle=-\gamma_{B}\left(\bm{M}_{B}\times\bm{H}_{B}\right)+\frac{\alpha_{BB}}{M_{B0}}\left(\bm{M}_{B}\times\frac{\partial{\bm{M}}_{B}}{\partial
t}\right)+\frac{\alpha_{BA}}{M_{A0}}\left(\bm{M}_{B}\times\frac{\partial{\bm{M}}_{A}}{\partial
t}\right)$
$\displaystyle+\frac{\eta_{BB}}{M_{B0}}\left(\bm{M}_{B}\times\frac{\partial^{2}{\bm{M}}_{B}}{\partial
t^{2}}\right)+\frac{\eta_{BA}}{M_{A0}}\left(\bm{M}_{B}\times\frac{\partial^{2}{\bm{M}}_{A}}{\partial
t^{2}}\right)$ (3)

In each ILLG dynamics, the first term represents the spin precession around an
effective field ${\bm{H}}_{A/B}$. The intra- and inter-sublattice Gilbert
damping dynamics have been denoted by the second and third terms,
respectively. Similarly, the last two terms define inertial dynamics. While
the intra-sublattice Gilbert and inertial dynamics have been weighed by
$\alpha_{AA/BB}$ and $\eta_{AA/BB}$, the same for inter-sublattice dynamics
are denoted by $\alpha_{AB/BA}$ and $\eta_{AB/BA}$. From a simple dimension
analysis, it is clear to show that the Gilbert damping parameters $\alpha$ are
dimensionless, in contrast, the inertial relaxation times $\eta$ have a
dimension of time [26, 30]. It is worth mentioning that the Gilbert damping
$\alpha$ has been calculated for several materials within ab initio frameworks
[40, 41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 51, 32, 52], while there are also
proposals to calculate the inertial relaxation time within extended breathing
Fermi surface model [53, 54, 55]. These ILLG equations have been contemplated
to forecast the signatures of inertial dynamics in collinear antiferromagnets
and ferrimagnets [38].

We consider that the two-sublattice ferromagnet is aligned collinear at the
ground state such that ${\bm{M}}_{A}=M_{A0}\hat{\bm{z}}$ and
${\bm{M}}_{B}=M_{B0}\hat{\bm{z}}$. The ferromagnetic system is under the
application of an external Zeeman field ${\bm{H}}_{0}=H_{0}\hat{\bm{z}}$.
Then, the free energy of the considered two-sublattice system can be
considered as the sum of Zeeman, anisotropy, and exchange energies as

$\displaystyle\mathcal{F}\left(\bm{M}_{A},\bm{M}_{B}\right)$
$\displaystyle=-H_{0}\left(M_{Az}+M_{Bz}\right)-\frac{K_{A}}{M^{2}_{A0}}M^{2}_{Az}-\frac{K_{B}}{M^{2}_{B0}}M^{2}_{Bz}-\frac{J}{M_{A0}M_{B0}}\bm{M}_{A}\cdot\bm{M}_{B}\,,$
(4)

where $K_{A}$ and $K_{B}$ are anisotropy energies and $J$ is the isotropic
Heisenberg exchange with $J>0$ for ferromagnetic coupling. To calculate the
linear response properties of the system, we consider that the small
deviations of magnetization $\bm{m}_{A}(t)$ and $\bm{m}_{B}(t)$ with respect
to the ground state are induced by the transverse external field
$\bm{h}_{A}(t)$ and $\bm{h}_{B}(t)$. We calculate the effective field in the
ILLG equation as the derivative of free energy in Eq. (4) to the corresponding
magnetization

$\displaystyle\bm{H}_{A}=-\frac{\partial\mathcal{F}\left(\bm{M}_{A},\bm{M}_{B}\right)}{\partial\bm{M}_{A}}$
$\displaystyle=\left(H_{0}+\frac{2K_{A}}{M^{2}_{A0}}M_{Az}\right)\hat{\bm{z}}+\frac{J}{M_{A0}M_{B0}}\bm{M}_{B}$
$\displaystyle=\frac{1}{M_{A0}}\left(H_{0}M_{A0}+2K_{A}+J\right)\hat{\bm{z}}+\frac{J}{M_{A0}M_{B0}}\bm{m}_{B}\,,$
(5)
$\displaystyle\bm{H}_{B}=-\frac{\partial\mathcal{F}\left(\bm{M}_{A},\bm{M}_{B}\right)}{\partial\bm{M}_{B}}$
$\displaystyle=\left(H_{0}+\frac{2K_{B}}{M^{2}_{B0}}M_{Bz}\right)\hat{\bm{z}}+\frac{J}{M_{A0}M_{B0}}\bm{M}_{A}$
$\displaystyle=\frac{1}{M_{B0}}\left(H_{0}M_{B0}+2K_{B}+J\right)\hat{\bm{z}}+\frac{J}{M_{A0}M_{B0}}\bm{m}_{A}\,.$
(6)

We then expand the magnetization around the ground state in small deviations,
$\bm{M}_{A}=M_{A0}\hat{\bm{z}}+\bm{m}_{A}(t)$ and
$\bm{M}_{B}=M_{B0}\hat{\bm{z}}+\bm{m}_{B}(t)$. Essentially, with the effective
fields in Eqs. (2) and (6) along with the magnetization, the linear response
for sublattice A provides

$\displaystyle\frac{\partial{\bm{m}}_{A}}{\partial t}$
$\displaystyle=-\frac{\gamma_{A}}{M_{A0}}\left(H_{0}M_{A0}+2K_{A}+J\right)\left[m_{Ay}\hat{\bm{x}}-m_{Ax}\hat{\bm{y}}\right]-\frac{\gamma_{A}J}{M_{B0}}\left[m_{Bx}\hat{\bm{y}}-m_{By}\hat{\bm{x}}\right]$
$\displaystyle-\gamma_{A}M_{A0}\left[h_{Ax}\hat{\bm{y}}-h_{Ay}\hat{\bm{x}}\right]+\alpha_{AA}\left[\frac{\partial
m_{Ax}}{\partial t}\hat{\bm{y}}-\frac{\partial m_{Ay}}{\partial
t}\hat{\bm{x}}\right]+\frac{\alpha_{AB}M_{A0}}{M_{B0}}\left[\frac{\partial
m_{Bx}}{\partial t}\hat{\bm{y}}-\frac{\partial m_{By}}{\partial
t}\hat{\bm{x}}\right]$
$\displaystyle+\eta_{AA}\left[\frac{\partial^{2}m_{Ax}}{\partial
t^{2}}\hat{\bm{y}}-\frac{\partial^{2}m_{Ay}}{\partial
t^{2}}\hat{\bm{x}}\right]+\frac{\eta_{AB}M_{A0}}{M_{B0}}\left[\frac{\partial^{2}m_{Bx}}{\partial
t^{2}}\hat{\bm{y}}-\frac{\partial^{2}m_{By}}{\partial
t^{2}}\hat{\bm{x}}\right]\,,$ (7)

obtaining the dynamics for two components $x$ and $y$ as

$\displaystyle\gamma_{A}M_{A0}h_{Ax}$
$\displaystyle=\frac{\gamma_{A}}{M_{A0}}\left(H_{0}M_{A0}+2K_{A}+J\right)m_{Ax}-\frac{\gamma_{A}J}{M_{B0}}m_{Bx}+\alpha_{AA}\frac{\partial
m_{Ax}}{\partial t}+\frac{\alpha_{AB}M_{A0}}{M_{B0}}\frac{\partial
m_{Bx}}{\partial t}$ $\displaystyle-\frac{\partial m_{Ay}}{\partial
t}+\eta_{AA}\frac{\partial^{2}m_{Ax}}{\partial
t^{2}}+\frac{\eta_{AB}M_{A0}}{M_{B0}}\frac{\partial^{2}m_{Bx}}{\partial
t^{2}}\,,$ (8) $\displaystyle\gamma_{A}M_{A0}h_{Ay}$
$\displaystyle=\frac{\gamma_{A}}{M_{A0}}\left(H_{0}M_{A0}+2K_{A}+J\right)m_{Ay}-\frac{\gamma_{A}J}{M_{B0}}m_{By}+\alpha_{AA}\frac{\partial
m_{Ay}}{\partial t}+\frac{\alpha_{AB}M_{A0}}{M_{B0}}\frac{\partial
m_{By}}{\partial t}$ $\displaystyle+\frac{\partial m_{Ax}}{\partial
t}+\eta_{AA}\frac{\partial^{2}m_{Ay}}{\partial
t^{2}}+\frac{\eta_{AB}M_{A0}}{M_{B0}}\frac{\partial^{2}m_{By}}{\partial
t^{2}}\,.$ (9)

In the circular basis defined by $m_{A\pm}=m_{Ax}\pm{\rm i}m_{Ay}$ and
$h_{A\pm}=h_{Ax}\pm{\rm i}h_{Ay}$, the equations can be put together

$\displaystyle\gamma_{A}M_{A0}h_{A\pm}$
$\displaystyle=\frac{\gamma_{A}}{M_{A0}}\left(H_{0}M_{A0}+2K_{A}+J\right)m_{A\pm}-\frac{\gamma_{A}J}{M_{B0}}m_{B\pm}+\alpha_{AA}\frac{\partial
m_{A\pm}}{\partial t}+\frac{\alpha_{AB}M_{A0}}{M_{B0}}\frac{\partial
m_{B\pm}}{\partial t}$ $\displaystyle\pm{\rm i}\frac{\partial
m_{A\mp}}{\partial t}+\eta_{AA}\frac{\partial^{2}m_{A\pm}}{\partial
t^{2}}+\frac{\eta_{AB}M_{A0}}{M_{B0}}\frac{\partial^{2}m_{B\pm}}{\partial
t^{2}}\,.$ (10)

Similarly, one can calculate the linear response of the sublattice B in the
circular basis defined by $m_{B\pm}=m_{Bx}\pm{\rm i}m_{By}$ and
$h_{B\pm}=h_{Bx}\pm{\rm i}h_{By}$ as

$\displaystyle\gamma_{B}M_{B0}h_{B\pm}$
$\displaystyle=\frac{\gamma_{B}}{M_{B0}}\left(H_{0}M_{B0}+2K_{B}+J\right)m_{B\pm}-\frac{\gamma_{B}J}{M_{A0}}m_{A\pm}+\alpha_{BB}\frac{\partial
m_{B\pm}}{\partial t}+\frac{\alpha_{BA}M_{B0}}{M_{A0}}\frac{\partial
m_{A\pm}}{\partial t}$ $\displaystyle\pm{\rm i}\frac{\partial
m_{B\mp}}{\partial t}+\eta_{BB}\frac{\partial^{2}m_{B\pm}}{\partial
t^{2}}+\frac{\eta_{BA}M_{B0}}{M_{A0}}\frac{\partial^{2}m_{A\pm}}{\partial
t^{2}}\,.$ (11)

We define the response functions $m_{A\pm},m_{B\pm},h_{A\pm},h_{B\pm}\propto
e^{\pm{\rm i}\omega t}$ and
$\Omega_{A}=\frac{\gamma_{A}}{M_{A0}}\left(H_{0}M_{A0}+2K_{A}+J\right)$ and
$\Omega_{B}=\frac{\gamma_{B}}{M_{B0}}\left(H_{0}M_{B0}+2K_{B}+J\right)$. To
simplify the expressions, we introduce the following:
$\Gamma_{AA}=\gamma_{A}M_{A0}$, $\Gamma_{BB}=\gamma_{B}M_{B0}$,
$\Gamma_{AB}=\gamma_{A}M_{B0}$ and $\Gamma_{BA}=\gamma_{B}M_{A0}$ such that
$\Gamma_{AA}\Gamma_{BB}=\Gamma_{AB}\Gamma_{BA}$. The linear response Eqs. (10)
and (11) can be written in a matrix formalism

$\displaystyle\begin{pmatrix}h_{A\pm}\\\ h_{B\pm}\end{pmatrix}$
$\displaystyle=\begin{pmatrix}\dfrac{1}{\Gamma_{AA}}\left(\Omega_{A}\pm{\rm
i}\omega\alpha_{AA}-\omega^{2}\eta_{AA}-\omega\right)&-\dfrac{1}{\Gamma_{AB}}\left(\dfrac{\gamma_{A}J}{M_{A0}}\mp{\rm
i}\omega\alpha_{AB}+\omega^{2}\eta_{AB}\right)\\\
-\dfrac{1}{\Gamma_{BA}}\left(\dfrac{\gamma_{B}J}{M_{B0}}\mp{\rm
i}\omega\alpha_{BA}+\omega^{2}\eta_{BA}\right)&\dfrac{1}{\Gamma_{BB}}\left(\Omega_{B}\pm{\rm
i}\omega\alpha_{BB}-\omega^{2}\eta_{BB}-\omega\right)\end{pmatrix}\begin{pmatrix}m_{A\pm}\\\
m_{B\pm}\end{pmatrix}\,.$ (12)

For finding the susceptibility, we recall
$\bm{m}_{\pm}=\chi_{\pm}\cdot{\bm{h}}_{\pm}$ such that the susceptibility
matrix derives as

$\displaystyle\chi^{AB}_{\pm}$
$\displaystyle=\dfrac{1}{\mathcal{D}_{\pm}}\begin{pmatrix}\dfrac{1}{\Gamma_{BB}}\left(\Omega_{B}\pm{\rm
i}\omega\alpha_{BB}-\omega^{2}\eta_{BB}-\omega\right)&\dfrac{1}{\Gamma_{BA}}\left(\dfrac{\gamma_{B}J}{M_{B0}}\mp{\rm
i}\omega\alpha_{BA}+\omega^{2}\eta_{BA}\right)\\\
\dfrac{1}{\Gamma_{AB}}\left(\dfrac{\gamma_{A}J}{M_{A0}}\mp{\rm
i}\omega\alpha_{AB}+\omega^{2}\eta_{AB}\right)&\dfrac{1}{\Gamma_{AA}}\left(\Omega_{A}\pm{\rm
i}\omega\alpha_{AA}-\omega^{2}\eta_{AA}-\omega\right)\end{pmatrix}\,,$ (13)

where the determinant is expressed as

$\displaystyle\mathcal{D}_{\pm}$
$\displaystyle=\frac{1}{\Gamma_{AA}\Gamma_{BB}}\left(\Omega_{A}\pm{\rm
i}\omega\alpha_{AA}-\omega^{2}\eta_{AA}-\omega\right)\left(\Omega_{B}\pm{\rm
i}\omega\alpha_{BB}-\omega^{2}\eta_{BB}-\omega\right)$
$\displaystyle-\frac{1}{\Gamma_{AB}\Gamma_{BA}}\left(\frac{\gamma_{A}J}{M_{A0}}\mp{\rm
i}\omega\alpha_{AB}+\omega^{2}\eta_{AB}\right)\left(\frac{\gamma_{B}J}{M_{B0}}\mp{\rm
i}\omega\alpha_{BA}+\omega^{2}\eta_{BA}\right)\,.$ (14)

Note that the intra-sublattice dynamical parameters enter in the diagonal
elements of the susceptibility matrix, however, the inter-sublattice dynamics
are reflected in the off-diagonal elements. Such a susceptibility matrix has
been obtained with intra- and inter-sublattice Gilbert damping dynamics for
antiferromagnets [56]. To find the resonance frequencies, one has to solve the
equation setting $\mathcal{D}_{\pm}=0$. Therefore, a fourth-order equation in
frequency is obtained

$\displaystyle\mathbb{A}_{\pm}\omega^{4}+\mathbb{B}_{\pm}\omega^{3}+\mathbb{C}_{\pm}\omega^{2}+\mathbb{D}_{\pm}\omega+\mathbb{E}_{\pm}$
$\displaystyle=0\,,$ (15)

with the following coefficients

$\displaystyle\mathbb{A}_{\pm}$
$\displaystyle=\eta_{AA}\eta_{BB}-\eta_{AB}\eta_{BA}\,,$ (16)
$\displaystyle\mathbb{B}_{\pm}$ $\displaystyle=(\eta_{AA}+\eta_{BB})\mp{\rm
i}\left(\alpha_{AA}\eta_{BB}+\alpha_{BB}\eta_{AA}\right)\pm{\rm
i}\left(\alpha_{AB}\eta_{BA}+\alpha_{BA}\eta_{AB}\right)\,,$ (17)
$\displaystyle\mathbb{C}_{\pm}$ $\displaystyle=1\mp{\rm
i}\left(\alpha_{AA}+\alpha_{BB}\right)-\left(\Omega_{A}\eta_{BB}+\Omega_{B}\eta_{AA}\right)-\alpha_{AA}\alpha_{BB}$
$\displaystyle-\left(\frac{\gamma_{A}}{M_{A0}}\eta_{BA}+\frac{\gamma_{B}}{M_{B0}}\eta_{AB}\right)J-\alpha_{AB}\alpha_{BA}\,,$
(18) $\displaystyle\mathbb{D}_{\pm}$
$\displaystyle=-\left(\Omega_{A}+\Omega_{B}\right)\pm{\rm
i}\left(\Omega_{A}\alpha_{BB}+\Omega_{B}\alpha_{AA}\right)\pm{\rm
i}\left(\frac{\gamma_{A}}{M_{A0}}\alpha_{BA}+\frac{\gamma_{B}}{M_{B0}}\alpha_{AB}\right)J\,,$
(19) $\displaystyle\mathbb{E}_{\pm}$
$\displaystyle=\Omega_{A}\Omega_{B}-\frac{\gamma_{A}\gamma_{B}}{M_{A0}M_{B0}}J^{2}\,.$
(20)

The analytical solution of the above-mentioned equation is very cumbersome.
Therefore, we adopt the numerical techniques for solving Eq. (15). The
solution of the above equation results in four frequencies, two of them
correspond to the precession resonance ($\omega_{\rm p}$) of each sublattice
and the other two belong to the nutation resonance ($\omega_{\rm n}$). The
real and imaginary parts of the resonance frequency are denoted by ${\tt Re}$
and ${\tt Im}$, respectively. For example, the precession resonance
frequencies are $\omega_{\rm p}={\tt Re}\left(\omega_{\rm p}\right)+{\rm
i}{\tt Im}\left(\omega_{\rm p}\right)$, while the nutation resonance
frequencies are $\omega_{\rm n}={\tt Re}\left(\omega_{\rm n}\right)+{\rm
i}{\tt Im}\left(\omega_{\rm n}\right)$. Comparing Eq. (15), a similar equation
has been obtained for antiferromagnets and ferrimagnets [38], however, without
the inter-sublattice inertial dynamics. We mention that the inter-sublattice
Gilbert damping dynamics have extensively been discussed [56, 57]. Therefore,
we will not consider in the following discussions. In particular, we allow
$\alpha_{AB}=\alpha_{BA}=0$, and calculate the inertial effects on precession
and nutation resonances.

##  3 Numerical results

To calculate the resonace frequencies, we numerically solve the Eq. (15) for
two-sublattice ferromagnets having same magnetic moments in each sublattice
i.e., $M_{A0}=M_{B0}$. We use the following parameters:
$\gamma_{A}=\gamma_{B}=1.76\times 10^{11}$ T-1-s-1, $J=10^{-21}$ J,
$K_{A}=K_{B}=10^{-23}$ J, $\alpha_{AA}=\alpha_{BB}=\alpha=0.05$,
$\alpha_{AB}=\alpha_{BA}=0$. The considered exchange and anisotropy energies
have similar order of magnitude as typical ferromagnets e.g., Fe [58]. The
chosen Gilbert damping $\alpha=0.05$ is within the ab initio reported values
[51]. For inertial relaxation times, even though, the ab initio calculation
suggests about fs timescales for transition metals [55], the recent experiment
predicts it to be a higher value up to several hundreds of fs [39]. Therefore,
in what follows, we have considered the inertial relaxation times ranging from
fs to ps.

###  3.1 Intra-sublattice inertial dynamics

Figure 2: The calculated resonance frequencies as a function of intra-
sublattice inertial relaxation time for two-sublattice ferromagnets using
$M_{A0}=M_{B0}=2\mu_{B}$. (a) The precession and nutation resonance
frequencies and (b) the effective Gilbert damping have been plotted. Figure 3:
The calculated precession resonance frequencies as a function of
$M_{A0}/M_{B0}$ for two-sublattice ferromagnets, at several intra-sublattice
inertial relaxation times. (a) The real part of the lower precession resonance
frequencies, (b) the effective damping of lower resonance mode, (c) the real
part of the upper precession resonance frequencies, (d) the effective damping
of upper resonance mode, has been plotted.

To focus on the intra-sublattice inertial dynamics, we set the inter-
sublattice relaxation time to zero i.e., $\eta_{AB}=\eta_{BA}$ = 0, keeping
the same inertial relaxation time in two-sublattice
$\eta_{AA}=\eta_{BB}=\eta$. With this set of specifications, the calculated
frequencies have been shown in Fig. 2. One can see that there exist two
precession resonance frequencies (positive) and the corresponding two nutation
resonance frequencies (negative). We denote these two positive precession
frequencies as $\omega_{\rm p+}^{\rm u}$ and $\omega_{\rm p+}^{\rm l}$, while
the two negative nutation frequencies are $\omega_{\rm n-}^{\rm u}$ and
$\omega_{\rm n-}^{\rm l}$. The superscripts “u” and “l” denote the upper and
lower frequencies, respectively. These results are in contrast with the
observation in antiferromagnets or ferrimagnets, where one positive and one
negative precession (and nutation) frequencies are expected [38].
Nevertheless, the quantitative comparison of the calculated frequencies agrees
with those of the ferrimagnets, where the upper (THz), and lower (GHz)
frequency precession resonances are called an exchange and ferromagnetic
modes, respectively [38, 59]. Similar to antiferromagnets and ferrimagnets
[38], the resonance frequencies decrease with the intra-sublattice inertial
relaxation time in the case of two-sublattice ferromagnets. Especially, the
lower nutation resonance frequency scales with $1/\eta$, while the upper one
shows deviation from $1/\eta$ at higher relaxation times. This deviation from
$1/\eta$ has been noticed in two nutation modes for antiferromagnets and
ferrimagnets [38]. An interesting feature is that the precession and nutation
frequencies cross each other at certain inertial relaxation times in
ferromagnets. Such crossing was not observed in antiferromagnets and
ferrimagnets [38]. The crossing happens especially with the upper precession
mode with lower nutation mode as seen in Fig. 2(a). However, we note that
crossing of these two modes have positive and negative frequencies, meaning
that the upper precession mode ($\omega_{\rm p+}^{\rm u}$) has a positive
rotational sense, however, the lower nutation mode ($\omega_{\rm n-}^{\rm l}$)
has the opposite rotational sense in circular basis.

The inertial dynamics affect the effective Gilbert damping in a system. This
has been demonstrated in Fig. 2(b) for two-sublattice ferromagnet by the ratio
of imaginary and real parts of the calculated frequencies. We have used the
same Gilbert damping for both the sublattices $\alpha\sim 0.05$ and therefore,
the effective damping remains the same at smaller inertial relaxation times.
However, the effective damping decreases with increased relaxation times, a
fact that is consistent with the results of antiferromagnets [38]. It is
observed that the decrease in effective damping is exactly the same for
precession and corresponding nutation modes. Moreover, the upper precession
mode is influenced strongly, which has already been observed for ferrimagnets
[38].

Next, we calculate the influence of different sublattice magnetic moment
($M_{A0}\neq M_{B0}$) on inertial dynamics. In particular, we compute the
precession resonance frequencies as a function of the ratio of magnetic
moments ($M_{A0}/M_{B0}$), at several inertial relaxation times in Fig. 3. We
observe that the resonance frequencies decrease with increasing difference in
the magnetic moments. Such reduction is less visible in case of lower
precession frequencies e.g., Fig. 3(a), however, more prominent in upper
precession frequencies in Fig. 3(c). However, the difference of frequencies
calculated at several relaxation times are similar for $M_{A0}=M_{B0}$ and
$M_{A0}\neq M_{B0}$. The latter suggests that the inertial dynamics do not get
quantitatively influenced by the same or different sublattice magnetic
moments. A similar conclusion can also be made from the computation of
effective damping in Figs. 3(b) and 3(d). The effective damping for the upper
and lower precession modes remains almost constant (with a very small positive
slope) for a higher ratio of $M_{A0}/M_{B0}$.

###  3.2 Inter-sublattice inertial dynamics

Figure 4: The calculated resonance frequencies as a function of inter-
sublattice inertial relaxation time for two-sublattice ferromagnets using
$M_{A0}=M_{B0}=2\mu_{B}$. The intra-sublattice inertial relaxation time was
kept constant $\eta=100$ fs. (a) The precession and nutation resonance
frequencies and (b) the effective Gilbert damping have been plotted.

To investigate the inter-sublattice inertial dynamics, we set the intra-
sublattice relaxation time as $\eta_{AA}=\eta_{BB}=\eta=100$ fs. Such a
relaxation time is lower than the experimental findings in two-sublattice
ferromagnets [39]. In fact, the direct comparison of Eq. (2) with the Eq. (2)
of Ref. [39] provides $\eta\sim\alpha\tau$. With the experimental findings for
CoFeB, $\alpha=0.0044$ and $\tau=72$ ps (see Table 1 in Ref. [39]), we
calculate $\eta=316$ fs. We compute the effect of inter-sublattice inertial
dynamics as a function of $\eta_{AB}=\eta_{BA}=\eta^{\prime}$ in Fig. 4
considering $\eta^{\prime}<\eta$. As we mentioned earlier, the overlapping of
precession ($\omega_{\rm p+}^{\rm u}$) and nutation ($\omega_{\rm n-}^{\rm
l}$) frequencies at the intra-sublattice relaxation time $\eta=100$ fs can be
seen. We observe that the upper precession resonance frequency ($\omega_{\rm
p+}^{\rm u}$) increases, while the lower one ($\omega_{\rm p+}^{\rm l}$)
decreases very small with inter-sublattice relaxation times. A similar
conclusion can be made for nutation frequencies. This is in contrast to the
observation of intra-sublattice inertial dynamics as discussed above. A
divergence in the upper nutation frequency can be noticed at the limit
$\eta^{\prime}\rightarrow\eta$. Such divergence can be explained through the
coefficient $\mathbb{A}$ in Eq. (15). At the limit
$\eta^{\prime}\rightarrow\eta$, the coefficient of fourth power in frequency
becomes
$\mathbb{A}=\eta_{AA}\eta_{BB}-\eta_{AB}\eta_{BA}=\eta^{2}-\eta^{\prime
2}\rightarrow 0$, which brings the fourth-order equation into an effective
third-order equation in frequency.

A similar observation can also be concluded from the calculation of effective
damping in Fig. 4(b). Similar to the intra-sublattice inertial dynamics, the
effective damping of the precession and corresponding nutation mode behaves
exactly the same for the inter-sublattice inertial dynamics. We observe that
the damping of upper precession and nutation modes increases with inter-
sublattice inertial relaxation time, however, it is the opposite for lower
precession and nutation modes. Therefore, we conclude that the effect of
intra- and inter-sublattice inertial dynamics are contrasting.

##  4 Conclusions

To conclude, we have incorporated the intra- and inter-sublattice inertial
dynamics within the LLG equation of motion and calculated the FMR resonance
for two-sublattice ferromagnets. To this end, we first derive the magnetic
susceptibility that is a tensor. To calculate the resonance frequencies, we
find the poles of the susceptibility. Without the inertial dynamics, there
exist two precession modes in a typical two-sublattice ferromagnet. The
introduction of inertial dynamics shows two nutation resonance frequencies
corresponding to the precession modes. We note that these precession and
nutation resonances can be excited by right and left circularly polarised
pulses, respectively, and vice-versa within a circular basis. The precession
and nutation frequencies decrease with the intra-sublattice relaxation time as
also has been seen in the case of antiferromagnets in previous work [38].
However, at certain relaxation times, the precession and nutation frequencies
overlap with each other. Note that these overlapping precession and nutation
frequencies have opposite rotational sense in circular basis, thus, they can
be neatly realised in the experiments. The inter-sublattice inertial dynamics
increase the resonance frequencies and effective damping for upper precession
mode, however, have opposite effect on lower precession mode in two-sublattice
ferromagnets.

##  5 Acknowledgments

The author acknowledges Levente Rózsa and Ulrich Nowak for valuable
discussions and the Swedish Research Council (VR 2019-06313) for research
funding.

## References

  * [1] Bigot J Y, Vomir M and Beaurepaire E 2009 Nat. Phys. 5 515–520 URL https://www.nature.com/articles/nphys1285
  * [2] Stanciu C D, Hansteen F, Kimel A V, Kirilyuk A, Tsukamoto A, Itoh A and Rasing Th 2007 Phys. Rev. Lett. 99 047601 URL http://link.aps.org/doi/10.1103/PhysRevLett.99.047601
  * [3] Kimel A V, Kirilyuk A, Hansteen F, Pisarev R V and Rasing T 2007 J. Phys.: Condens. Matter 19 043201 URL https://doi.org/10.1088%2F0953-8984%2F19%2F4%2F043201
  * [4] Beaurepaire E, Merle J C, Daunois A and Bigot J Y 1996 Phys. Rev. Lett. 76 4250–4253 URL http://link.aps.org/doi/10.1103/PhysRevLett.76.4250
  * [5] Koopmans B, van Kampen M, Kohlhepp J T and de Jonge W J M 2000 Phys. Rev. Lett. 85 844–847 URL http://link.aps.org/doi/10.1103/PhysRevLett.85.844
  * [6] Koopmans B, van Kampen M and de Jonge W J M 2003 J. Phys.: Condens. Matter 15 S723 URL http://stacks.iop.org/0953-8984/15/i=5/a=324
  * [7] Mangin S, Gottwald M, Lambert C H, Steil D, Uhlíř V, Pang L, Hehn M, Alebrand S, Cinchetti M, Malinowski G, Fainman Y, Aeschlimann M and Fullerton E E 2014 Nat. Mater. 13 286–292 URL http://dx.doi.org/10.1038/nmat3864
  * [8] Hassdenteufel A, Hebler B, Schubert C, Liebig A, Teich M, Helm M, Aeschlimann M, Albrecht M and Bratschitsch R 2013 Advanced Materials 25 3122–3128 URL https://onlinelibrary.wiley.com/doi/abs/10.1002/adma.201300176
  * [9] Kimel A V, Kirilyuk A, Usachev P A, Pisarev R V, Balbashov A M and Rasing Th 2005 Nature 435 655–657 URL http://dx.doi.org/10.1038/nature03564
  * [10] Lambert C H, Mangin S, Varaprasad B S D C S, Takahashi Y K, Hehn M, Cinchetti M, Malinowski G, Hono K, Fainman Y, Aeschlimann M and Fullerton E E 2014 Science 345 1337–1340 URL https://science.sciencemag.org/content/345/6202/1337
  * [11] John R, Berritta M, Hinzke D, Müller C, Santos T, Ulrichs H, Nieves P, Walowski J, Mondal R, Chubykalo-Fesenko O, McCord J, Oppeneer P M, Nowak U and Münzenberg M 2017 Sci. Rep. 7 4114 URL https://doi.org/10.1038/s41598-017-04167-w
  * [12] Ostler T A, Barker J, Evans R F L, Chantrell R W, Atxitia U, Chubykalo-Fesenko O, El Moussaoui S, Le Guyader L, Mengotti E, Heyderman L J, Nolting F, Tsukamoto A, Itoh A, Afanasiev D, Ivanov B A, Kalashnikova A M, Vahaplar K, Mentink J, Kirilyuk A, Rasing T and Kimel A V 2012 Nature Communications 3 666 URL https://doi.org/10.1038/ncomms1666
  * [13] Wienholdt S, Hinzke D, Carva K, Oppeneer P M and Nowak U 2013 Phys. Rev. B 88(2) 020406 URL https://link.aps.org/doi/10.1103/PhysRevB.88.020406
  * [14] Gerlach S, Oroszlany L, Hinzke D, Sievering S, Wienholdt S, Szunyogh L and Nowak U 2017 Phys. Rev. B 95(22) 224435 URL https://link.aps.org/doi/10.1103/PhysRevB.95.224435
  * [15] Frietsch B, Donges A, Carley R, Teichmann M, Bowlan J, Döbrich K, Carva K, Legut D, Oppeneer P M, Nowak U and Weinelt M 2020 Science Advances 6 URL https://advances.sciencemag.org/content/6/39/eabb1601
  * [16] Landau L D and Lifshitz E M 1935 Phys. Z. Sowjetunion 8 101–114
  * [17] Gilbert T L and Kelly J M October 1955 American Institute of Electrical Engineers (New York) pp 253–263
  * [18] Gilbert T L 2004 IEEE Transactions on Magnetics 40 3443–3449
  * [19] Hickey M C and Moodera J S 2009 Phys. Rev. Lett. 102(13) 137601 URL http://link.aps.org/doi/10.1103/PhysRevLett.102.137601
  * [20] Mondal R, Berritta M, Carva K and Oppeneer P M 2015 Phys. Rev. B 91 174415 URL http://journals.aps.org/prb/pdf/10.1103/PhysRevB.91.174415
  * [21] Mondal R, Berritta M and Oppeneer P M 2016 Phys. Rev. B 94 144419 URL http://link.aps.org/doi/10.1103/PhysRevB.94.144419
  * [22] Mondal R, Berritta M and Oppeneer P M 2018 Phys. Rev. B 98(21) 214429 URL https://link.aps.org/doi/10.1103/PhysRevB.98.214429
  * [23] Mondal R, Donges A, Ritzmann U, Oppeneer P M and Nowak U 2019 Phys. Rev. B 100(6) 060409 URL https://link.aps.org/doi/10.1103/PhysRevB.100.060409
  * [24] Böttcher D and Henk J 2012 Phys. Rev. B 86 020404 URL http://link.aps.org/doi/10.1103/PhysRevB.86.020404
  * [25] Ciornei M C 2010 Role of magnetic inertia in damped macrospin dynamics Ph.D. thesis Ecole Polytechnique, France
  * [26] Ciornei M C, Rubí J M and Wegrowe J E 2011 Phys. Rev. B 83 020410 URL http://link.aps.org/doi/10.1103/PhysRevB.83.020410
  * [27] Bhattacharjee S, Nordström L and Fransson J 2012 Phys. Rev. Lett. 108(5) 057204 URL https://link.aps.org/doi/10.1103/PhysRevLett.108.057204
  * [28] Wegrowe J E and Ciornei M C 2012 Am. J. Phys. 80 607–611 URL http://dx.doi.org/10.1119/1.4709188
  * [29] Wegrowe J E and Olive E 2016 J. Phys.: Condens. Matter 28 106001 URL http://stacks.iop.org/0953-8984/28/i=10/a=106001
  * [30] Mondal R, Berritta M, Nandy A K and Oppeneer P M 2017 Phys. Rev. B 96(2) 024425 URL https://link.aps.org/doi/10.1103/PhysRevB.96.024425
  * [31] Mondal R, Berritta M and Oppeneer P M 2018 J. Phys.: Condens. Matter 30 265801 URL http://stacks.iop.org/0953-8984/30/i=26/a=265801
  * [32] Thonig D and Henk J 2014 New Journal of Physics 16 013032 URL https://doi.org/10.1088/1367-2630/16/1/013032
  * [33] Giordano S and Déjardin P M 2020 Phys. Rev. B 102(21) 214406 URL https://link.aps.org/doi/10.1103/PhysRevB.102.214406
  * [34] Olive E, Lansac Y and Wegrowe J E 2012 Appl. Phys. Lett. 100 192407 URL https://doi.org/10.1063/1.4712056
  * [35] Olive E, Lansac Y, Meyer M, Hayoun M and Wegrowe J E 2015 J. Appl. Phys. 117 213904 URL https://doi.org/10.1063/1.4921908
  * [36] Makhfudz I, Olive E and Nicolis S 2020 Appl. Phys. Lett. 117 132403 URL https://doi.org/10.1063/5.0013062
  * [37] Cherkasskii M, Farle M and Semisalova A 2020 Phys. Rev. B 102(18) 184432 URL https://link.aps.org/doi/10.1103/PhysRevB.102.184432
  * [38] Mondal R, Großenbach S, Rósza L and Nowak U 2020 Phys. Rev. B 103(10) 104404 URL https://link.aps.org/doi/10.1103/PhysRevB.103.104404
  * [39] Neeraj K, Awari N, Kovalev S, Polley D, Zhou Hagström N, Arekapudi S S P K, Semisalova A, Lenz K, Green B, Deinert J C, Ilyakov I, Chen M, Bawatna M, Scalera V, d’Aquino M, Serpico C, Hellwig O, Wegrowe J E, Gensch M and Bonetti S 2020 Nat. Phys. URL https://doi.org/10.1038/s41567-020-01040-y
  * [40] Kamberský V 1970 Can. J. Phys. 48 2906
  * [41] Kamberský V 1976 Czech. J. Phys. B 26 1366–1383 URL http://dx.doi.org/10.1007/BF01587621
  * [42] Kuneš J and Kamberský V 2002 Phys. Rev. B 65 212411 URL http://link.aps.org/doi/10.1103/PhysRevB.65.212411
  * [43] Kuneš J and Kamberský V 2003 Phys. Rev. B 68(1) 019901 URL https://link.aps.org/doi/10.1103/PhysRevB.68.019901
  * [44] Tserkovnyak Y, Brataas A and Bauer G E W 2002 Phys. Rev. Lett. 88 117601 URL http://link.aps.org/doi/10.1103/PhysRevLett.88.117601
  * [45] Steiauf D and Fähnle M 2005 Phys. Rev. B 72 064450 URL http://link.aps.org/doi/10.1103/PhysRevB.72.064450
  * [46] Fähnle M and Steiauf D 2006 Phys. Rev. B 73(18) 184427 URL https://link.aps.org/doi/10.1103/PhysRevB.73.184427
  * [47] Kamberský V 2007 Phys. Rev. B 76 134416 URL http://link.aps.org/doi/10.1103/PhysRevB.76.134416
  * [48] Gilmore K, Idzerda Y U and Stiles M D 2007 Phys. Rev. Lett. 99 027204 URL http://link.aps.org/doi/10.1103/PhysRevLett.99.027204
  * [49] Brataas A, Tserkovnyak Y and Bauer G E W 2008 Phys. Rev. Lett. 101(3) 037207 URL https://link.aps.org/doi/10.1103/PhysRevLett.101.037207
  * [50] Gilmore K, Idzerda Y U and Stiles M D 2008 J. Appl. Phys. 103 07D303 URL http://dx.doi.org/10.1063/1.2832348
  * [51] Ebert H, Mankovsky S, Ködderitzsch D and Kelly P J 2011 Phys. Rev. Lett. 107 066603 URL http://link.aps.org/doi/10.1103/PhysRevLett.107.066603
  * [52] Edwards D M 2016 Journal of Physics: Condensed Matter 28 086004 URL https://doi.org/10.1088/0953-8984/28/8/086004
  * [53] Fähnle M, Steiauf D and Illg C 2011 Phys. Rev. B 84 172403 URL http://link.aps.org/doi/10.1103/PhysRevB.84.172403
  * [54] Fähnle M, Steiauf D and Illg C 2013 Phys. Rev. B 88 219905(E) URL https://link.aps.org/doi/10.1103/PhysRevB.88.219905
  * [55] Thonig D, Eriksson O and Pereiro M 2017 Sci. Rep. 7 931 URL http://dx.doi.org/10.1038/s41598-017-01081-z
  * [56] Kamra A, Troncoso R E, Belzig W and Brataas A 2018 Phys. Rev. B 98(18) 184402 URL https://link.aps.org/doi/10.1103/PhysRevB.98.184402
  * [57] Yuan H Y, Liu Q, Xia K, Yuan Z and Wang X R 2019 EPL (Europhysics Letters) 126 67006 URL https://doi.org/10.1209/0295-5075/126/67006
  * [58] Pajda M, Kudrnovský J, Turek I, Drchal V and Bruno P 2001 Phys. Rev. B 64(17) 174402 URL https://link.aps.org/doi/10.1103/PhysRevB.64.174402
  * [59] Schlickeiser F, Atxitia U, Wienholdt S, Hinzke D, Chubykalo-Fesenko O and Nowak U 2012 Phys. Rev. B 86(21) 214416 URL https://link.aps.org/doi/10.1103/PhysRevB.86.214416


# ERC-20R and ERC-721R: Reversible Transactions on Ethereum

Kaili Wang
<EMAIL_ADDRESS>Qinchen Wang
<EMAIL_ADDRESS>Dan Boneh
<EMAIL_ADDRESS>
###### Abstract

Blockchains are meant to be persistent: posted transactions are immutable and
cannot be changed. As a result, when a theft takes place, there are limited
options for reversing the disputed transaction, and this has led to
significant losses in the blockchain ecosystem.

In this paper we propose reversible versions of ERC-20 and ERC-721, the most
widely used token standards. With these new standards, a transaction is
eligible for reversal for a short period of time after it has been posted on
chain. After the dispute period has elapsed, the transaction can no longer be
reversed. Within the short dispute period, a sender can request to reverse a
transaction by convincing a decentralized set of judges to first freeze the
disputed assets, and then later convincing them to reverse the transaction.

Supporting reversibility in the context of ERC-20 and ERC-721 raises many
interesting technical challenges. This paper explores these challenges and
proposes a design for our ERC-20R and ERC-721R standards, the reversible
versions of ERC-20 and ERC-721. We also provide a prototype implementation.
Our goal is to initiate a deeper conversation about reversibility in the hope
of reducing some of the losses in the blockchain ecosystem.

##  1 Introduction

Since their inception, cryptocurrencies have been plagued by thefts and
accidental losses [26]. Victims include end users [7], DAOs [20], bridges [18,
15, 25, 9], and exchanges [10, 1, 8, 22, 23]. Usually, the stolen assets are
first transferred from the victim’s address to an address controlled by the
attacker. From there the assets are laundered by transferring them to other
addresses and eventually to an offramp. In a few cases, the assets are seized
at the offramp [4].

The annual losses can be quite high. In 2020, $7.8 billion was stolen, and in
2021 that amount doubled to $14 billion [5, 21]. A recent well publicized
attack on the Ronin bridge resulted in a theft of over $600 million [18]. The
attacker transferred ETH and USDC from the Ronin contract on Ethereum to an
address controlled by the attacker. From there, some of the funds were moved
to the Tornado mixer [19]. Other bridges have experienced similar thefts [15,
25, 9]. In many of these attacks, the assets stolen were held in ERC-20
contracts.

Similarly, NFTs held in ERC-721 and ERC-1155 contracts have seen an uptick in
thefts. In a twelve months period following July 2021, an estimated $100
million were stolen in NFTs using phishing and other attacks [12, 5].

These attacks were often discovered soon after the theft took place. Had there
been a way to reverse the offending transaction(s) – as in traditional finance
– the damage could have been greatly reduced.

Beyond theft, transaction finality has also worked against us when funds are
accidentally sent to a wrong address. In May 2022, a Cosmos-based blockchain
called JUNO passed a proposal to move $36 million USD to a specific address.
The address contained a typo [14] and consequently the funds were lost. The
funds could have been recovered had there been a way to reverse that
transaction.

##### Reversible transactions.

In a 2018 tweet, Vitalik Buterin wrote that

> Someone should come along and issue an ERC20 called “Reversible Ether” that
> is 1:1 backed by ether but has a DAO that can revert transfers within $N$
> days.

Nowadays, this can be applied to any ERC-20 token (not just wrapped ETH), as
well as to NFTs.

Enabling reversible transactions is not easy and introduces many fascinating
technical challenges. The main contribution of this paper is to explore how to
support reversibility within the ERC-20 and ERC-721 framework. We propose two
new standards that allow transaction reversal within a limited time window,
say four days. We call these standards ERC-20R and ERC-721R, the reversible
versions of ERC-20 and ERC-721, respectively.

We envision the following high-level workflow for reversing a posted
transaction (see Figure 1):

  * •

Request freeze. The victim posts a freeze request to a governance contract,
along with the relevant evidence, and some stake. A request to freeze a
transaction can only be initiated by an address that is directly affected by
the transaction.

  * •

Freeze assets. A decentralized set of judges decides to accept or reject the
request. If accepted, the judges instruct an on-chain governance contract to
call the freeze function on the impacted ERC-20R or ERC-721R contract.
Subsequently, the assets in question are frozen and can no longer be
transferred. For NFTs, this is a simple matter of freezing the disputed NFT.
For ERC-20 tokens this is more complicated, as we explain below. We discuss
the operation of the governance contract, and the selection of judges, in
Section 3. We envision the freeze process being relatively quick, taking the
judges at most one or two days to make a decision.

  * •

Trial. Both sides can then present evidence to the decentralized set of
judges. Eventually the judges reach a decision, at which point they instruct
the governance contract to call either the reverse or rejectReverse functions
on the impacted ERC-20R or ERC-721R contract. The reverse function transfers
the disputed (frozen) assets to their original owner. The rejectReverse
releases the freeze on the disputed assets and leaves them where they are. The
trial may be lengthy, possibly taking several weeks or months.

Figure 1: The process for reversing a transaction.

A more complete workflow is presented in Figure 2.

Figure 2: Overview of reversal process

##### Locating the stolen assets.

By the time the victim submits a freeze request, the attacker may have already
moved the stolen assets through multiple accounts. In fact, the attacker can
monitor the mempool, and move the assets as soon as it sees a request to
freeze the stolen assets. In the case of an NFT, the attacker may have sold
the stolen NFT to an unsuspecting honest user. In the case of an ERC-20 token,
the attacker may have divided the stolen tokens across multiple accounts; it
may have exchanged a portion of the tokens for another ERC-20 token using an
honest on-chain exchange; it may have burned a portion of the tokens; or it
may have sent the tokens to a mixer. The new reversible standards must
properly handle all these cases.

In case of a dispute over an ERC-721 NFT, the freeze is applied to the current
holder of the NFT: either the original attacker, or an honest user who
purchased the stolen NFT from the attacker. If the judges decide that a theft
took place, then the ERC-721R contract sends the NFT back to the pre-theft
owner. The current owner of the NFT loses the NFT. This policy is consistent
with tort law in many countries, but of course, other policies can be
implemented.

In case of a dispute over stolen ERC-20 tokens things are more complicated. By
the time the freeze is executed, the funds may have been dispersed across many
downstream accounts, some honest and some dishonest. In Section 2 we present
an example algorithm that assigns fractional responsibility to each of the
downstream accounts that received a portion of the stolen funds. The partial
freeze is then applied to these accounts. Implementing this freeze strategy
requires the ERC-20 contract to maintain a transaction log during the dispute
window so that the freeze function can trace the funds when it is called by
the governance contract. If the judges decide that a theft took place, the
ERC-20R contract moves the frozen tokens from the obligated accounts to the
pre-theft account. We discuss this in more detail in Section 2.

##### Will reversibility introduce delays?

Suppose Alice holds tokens in an ERC-20R (an R-token) and she wishes to
exchange them for ETH or for some other ERC-20 (a non-R-token). Bob is willing
to do the ETH-for-token exchange with Alice and they agree on the exchange
rate. Clearly Bob will not release his ETH to Alice until he is assured that
the R-tokens that Alice sent him cannot be taken back due an upstream reversal
request. This means that Bob will only accept R-tokens that were transferred
to Alice at least four days ago, if the dispute window is four days. We refer
to such R-tokens as “old” tokens, since they are no longer subject a freeze
and reversal. If Alice has sufficiently many old R-tokens then the transaction
can settle right away. Otherwise, Bob will delay final settlement for four
days, after which he is assured that Alice’s R-tokens cannot be taken away due
to an upstream reversal. In particular, if Alice steals some R-tokens from
Victor (the victim) and immediately tries to exchange them for Bob’s non-R-
token, that exchange will only settle four days later, by which time Victor
may have asked for the theft to be reversed. To reiterate, an exchange of a
recently transferred R-token for a non-R-token will be subject to delay.

Interestingly, if Alice wants to exchange one reversible token for another
reversible token, then Bob can immediately settle that exchange. No delay is
needed. If the transaction that sends Alice’s tokens to Bob is later reversed,
then Bob can request to reverse the matching transaction that sends his tokens
to Alice. Hence an R-token to R-token exchange can settle instantly, but an
R-token to a non-R-token exchange may need to be delayed until the reversible
tokens are sufficiently old.

The consequence of this is that once a few key tokens become reversible, there
is a strong incentive for other tokens to become reversible to avoid
settlement delays. In other words, reversibility is viral.

###  1.1 Implementation

We provide a reference implementation of these new standards. Our Solidity
implementation is split into two parts: (i) the main ERC-20R and ERC-721R
contracts that keep track of all the balances and transactions, and (ii) a
governance contract that selects judges and gathers votes. Our ERC-20R and
ERC-721R implementations are extensions of the OpenZeppelin non-reversible
contracts.

Recall that an ERC-20 contract manages the balances of many accounts. In our
ERC-20R contract, an account balance is a pair of numbers we call Rbalance and
NRbalance.

  * •

The NRbalance is the current account balance due to incoming transactions
whose dispute window has elapsed. Funds in the NRbalance are non-reversible:
they are no longer subject to a potential freeze and reversal.

  * •

The Rbalance is the account balance due to recent incoming transactions. Funds
in the Rbalance are subject to reversal.

As the dispute window elapses, funds move from the Rbalance to the NRbalance.
This is done using the clean function discussed below.

When an account owner sends funds from its own account to another account
(say, to fulfill an exchange of assets), the account owner specifies how much
to take out of the Rbalance and how much to take out of the NRbalance. That
is, the standard ERC-20 transfer function now comes in two flavors: transfer()
and Rtransfer(). The former transfers from the non-reversible balance, while
the latter transfers from the reversible balance. Either way, the transferred
funds are added to the Rbalance of the recipient. Note that our transfer
function is backwards compatible with the ERC-20 specification. When the
contract needs to burn tokens in an account (e.g., due to a fiat or base token
withdrawal), it will typically only burn tokens from the NRbalance of the
account. However, there may be situations where the contract is willing to
burn from the Rbalance.

Beyond the new transfer interface, an ERC-20R and ERC-721R contract exposes
the new interface functions freeze, reverse, rejectReverse, and clean. Let us
describe this API in more detail:

  * •

freeze(): calculates the amounts to freeze on the attacker’s address as well
as potential downstream addresses, and freezes those amounts. For ERC-20R it
returns a claimID that points to an on-chain list of (account,amount) pairs.
The list identifies all the accounts that contain frozen assets associated
with the complaint, and the amount frozen in each. For ERC-721R it returns a
boolean success flag. The inner workings of the freeze function is explained
in Section 2.

  * •

reverse(): sends all frozen assets associated with the claimed theft back to
the original owner. For ERC-20R, takes as argument a valid claimID. For
ERC-721R, takes in arguments $(\textit{tokenId},\textit{index})$ where index
identifies the transaction being reversed.

  * •

rejectReverse(): unfreezes all amounts associated with the claim. For ERC-20R,
takes as argument a claimID; for ERC-721R, takes as argument a tokenId.

  * •

clean(): Reversible contracts store some transaction data on chain. The clean
function removes on-chain information for transactions whose dispute window
has elapsed. The data structure that is being updated is explained in Section
2.1. In addition, for ERC-20R this function moves the relevant balance from
the Rbalance to the NRbalance.

The freeze, reverse and rejectReverse functions can only be called by the
governance contract, while anyone can call the clean function.

###  1.2 Related Work

In the fall of 2018, one of the co-creators of the ERC-20 standard proposed
the concept of a reversible ICO, where investors would be able to get a refund
amount inversely proportional to how recently they invested [24]. Although
this safeguards against a single token being a scam at launch, it does not
protect against malicious transactions.

Eigenmann [11] drafted a contract for a reversible token that extends the
ERC-20 standard. It used an escrow method, where the escrow period was 30
days, during which the sender could recall the money at any time. This is
problematic because Bob could pay Alice for a service, and then reverse the
payment 28 days later, after Alice completed the service. A similar approach
is used in a proposal for refunds in ERC-721 mints [13], where Bob can get his
money back within a certain time window after buying an NFT. In our proposal,
Bob would need to present sufficient evidence to a committee of judges for a
transaction to be reversed. This protects counter-parties to the disputed
transaction.

The Reversecoin project from 2015 launched as a layer 1 blockchain [6]. It
introduced a timeout period between transaction initiation and confirmation.
Each account has an offline key pair that enables the owner to either reverse
a transaction or immediately confirm it. This may not prevent some modern
hacks: the attacker would either steal the confirmation key, or trick the user
into using the confirmation key to confirm a malicious transaction. The
elegant Bitcoin Convenants proposal [17] similarly uses two keys (or more) to
enable a vault owner to finalize or revert transactions from the vault 24
hours after they were posted.

A closely related project is Lossless.io [16]. The company provides a wrapped
version of certain ERC-20 tokens. Anyone with staked LSS tokens can monitor
on-chain events for hacks, and can freeze an address if the address is
involved in a hack. Only a single address can be frozen for a given hack, so
one must act quickly after a hack to freeze the attacker’s address before the
funds are further dispersed. The quickest spotter is rewarded in a winner-
takes-all fashion. Transactions can also be frozen automatically by open-
source mechanisms built by the Lossless team. The company then decides
unilaterally whether the reversal is warranted, and if so reverses the
transfer. If a recipient burns the wrapped token it receives, by converting
them back to the base unwrapped token, then reversal is no longer possible.
This cannot happen in our proposal since token burns come from an account’s
NRbalance (unless the contract willingly accepts the risk of burning Rbalance
tokens).

Finally, centralized exchanges maintain the ability to freeze and remove
assets. For example, Binance USD (BUSD), issued by Paxos, states that (link):

> Paxos also has the ability to create and burn BUSD tokens at will, as well
> as freeze and remove funds from people who exhibit nefarious or illicit
> activity.

The same holds for other centralized tokens. In these centralized systems, the
operator acts as a centralized judge that can reverse transactions.

##  2 The transaction reversal process

In this section we describe the details of the ERC-20R and ERC-721R process of
reverting a transaction. We describe the data structures and algorithms needed
to track the funds that will be frozen and later sent back to the victim, if
the victim prevails.

###  2.1 Freezing assets

After a theft from an ERC-20R or an ERC-721R contract, the victim posts an on-
chain freeze request to the governance contract. The request includes the
offending transaction ID, a link to evidence that an unauthorized transfer
took place, and some stake. If the judges are convinced by the evidence (see
Section 3) then they instruct the governance contract to call the freeze
function on the relevant ERC-20R or ERC-721R contract. Once the assets are
frozen, any attempt to transfer them will fail. If the judges are unconvinced,
they instruct the governance contract to reject the request, and the victim
loses the stake.

In this section we explain what happens when the governance contract calls the
freeze function on the relevant ERC-20R or ERC-721R contract.

####  2.1.1 An ERC-721R freeze

The freeze function on an ERC-721R contract is quite simple. First, we add two
structures to the contract:

     mapping(uint256 => bool )  _frozen;
     mapping(uint256 => Queue)  _owners;

The _frozen structure indicates if a particular tokenID is frozen. If
_frozen[tokenID] is true then the asset is frozen, and cannot be transferred.

The _owners structure keeps track of the recent list of owners for the asset
identified by tokenID. On every transfer, a pair (newOwner, blockNumber) is
appended to the queue at _owners[tokenID] to record that at this block number,
the new owner of tokenID became newOwner. This _owners structure looks as:

$\begin{cases}\textit{tokenID}_{0}\to\bigl{[}(\textit{owner}_{0},\textit{bn}_{0}),(\textit{owner}_{1},\textit{bn}_{1}),\ldots\bigr{]}\\\\[3.87498pt]
\textit{tokenID}_{1}\to\bigl{[}(\textit{owner}_{0},\textit{bn}_{0}),(\textit{owner}_{1},\textit{bn}_{1}),\ldots\bigr{]}\\\\[3.87498pt]
\textit{tokenID}_{2}\to\bigl{[}(\textit{owner}_{0},\textit{bn}_{0}),(\textit{owner}_{1},\textit{bn}_{1}),\ldots\bigr{]}\\\
\quad\ldots\end{cases}$

where for each tokenID we have $\textit{bn}_{0}\leq\textit{bn}_{1}\leq\cdots$

The governance contract freezes an asset by calling
freeze(tokenID, index)
where index points to an entry in the queue _owners[tokenID]. The function
first verifies that the disputed transfer took place within the dispute window
by using the block number at position index+1 in the queue _owners[tokenID].
The function also ensures that the asset is not already frozen. If the checks
succeed, the function sets _frozen[tokenID] to true, indicating that the asset
is frozen. That’s it. Doing these checks on-chain ensures that even malicious
judges cannot reverse a transaction outside of the dispute window.

If at a later time the ERC-721R contract is asked to revert the disputed
transfer (that is, the governance contract calls the reverse function), the
contract simply transfers tokenID to the address written at position index in
the queue _owners[tokenID]. This was the owner before the disputed
transaction.

Calling the clean function on this contract with a list of token IDs removes
data from the _owners structure that is no longer needed. This removes
transfers that can no longer be reverted because the dispute window has
elapsed. It is done to save on chain storage. Note that a frozen tokenID
cannot be cleaned until it becomes unfrozen; this preserves the data needed to
reverse a disputed transaction, if needed.

####  2.1.2 An ERC-20R freeze

The freeze function on an ERC-20 contract is much more complicated. The
problem is that the tokens might have been transferred to multiple accounts
between the time of the theft and the freeze request.

Figure 3 shows a transaction from a victim address $v$ to an attacker address
$a_{0}$. Subsequent transfers from $a_{0}$ that took place after the disputed
transaction, but prior to a freeze request, are indicated as directed edges in
the graph. All these downstream addresses may hold stolen funds that may need
to be frozen.

Figure 3: An example graph $G$ of transfers following the disputed transaction
from $v$ to $a_{0}$.

Another complication is that tokens can be burned and simply vanish from the
system. For example, in a stablecoin contract that is collateralized by a fiat
currency, the account $a_{8}$ may choose to redeem its coins for fiat
currency, at which point the coins at $a_{8}$ are burned. If the contract
supports burning token from the Rbalance of $a_{8}$ then there might not be
sufficient assets to freeze at address $a_{8}$, and the stolen funds are
permanently lost. This is why burns generally apply to the NRbalance of an
account.

Yet another complication is that a single address, say address $a_{1}$, might
own funds obtained from multiple thefts. When the funds are frozen, the system
needs to remember the amount frozen for each reversion request, and if a
reversion request is approved, only the funds associated with that request
should be taken out of account $a_{1}$.

If there are multiple freeze events on a single account, the frozen amount is
cumulative. In particular, if account $a$ has a total of $s$ frozen coins,
then the ERC-20R contract will reject any transfer that causes the Rbalance of
account $a$ to drop below $s$.

##### Calculating suspect addresses.

Let us begin by describing a specific strategy for calculating the amount to
freeze on each account in the graph $G$ from Figure 3. Accounts that are
subject to a freeze are called suspect addresses. Our freeze algorithm will
chase the stolen funds across the transaction graph and freeze funds across
suspected addresses. The algorithm will freeze assets that are as close as
possible to $a_{0}$ in $G$.

Before we describe the detailed algorithm, let us first see a few examples.
Suppose that $s$ coins are stolen from the victim $v$ and transferred to
account $a_{0}$ at time $T_{0}$. At time $T_{f}>T_{0}$ the ERC-20R contract
receives a request to freeze that transaction.

Example 1. If at time $T_{f}$ the Rbalance at $a_{0}$ is $s$ or more, then $s$
coins will be frozen at $a_{0}$ and the process concludes.

Example 2. Suppose that at some time between $T_{0}$ and $T_{f}$ a transaction
transfers $s/4$ coins from $a_{0}$ to $a_{1}$ and an additional $s/4$ coins
from $a_{0}$ to $a_{2}$. The remaining Rbalance at $a_{0}$ is $s/2$ and no
subsequent transactions apply to $a_{0}$. Then at the freeze time, the entire
$s/2$ Rbalance at $a_{0}$ will be frozen. Moreover, if the Rbalance at $a_{1}$
and $a_{2}$ is exactly $(s/4)$, then $(s/4)$ coins will be frozen at each of
those accounts. Now that a total of $s$ coins has been frozen, the process
terminates. Note that $a_{1}$ or $a_{2}$ might be the addresses of an honest
exchange or a mixing service, in which case a portion of the coin’s liquidity
pool at the exchange or mix will become frozen.

Example 3. Suppose that following the disputed transaction from $v$ to
$a_{0}$, there is a second transaction $a_{0}\to a_{1}$. Clearly if there are
insufficient funds at $a_{0}$ at the time of the freeze, then some of the
freeze obligations should pass on to $a_{1}$, as explained in the previous
paragraph. However, suppose that at some time before the $a_{0}\to a_{1}$
transaction, there is a transaction $a_{1}\to a_{2}$ that transfers funds from
$a_{1}$ to $a_{2}$. We propose that none of the freeze obligations will pass
on to $a_{2}$, because the $a_{1}\to a_{2}$ transaction was posted before the
disputed funds arrived at $a_{1}$. The funds sent to $a_{2}$ are not directly
involved in the dispute. One can give examples where this policy can lead us
astray, but by in large, we claim that $a_{2}$ should not be involved in the
freeze.

These examples suggest that the freeze process is an iterative procedure that
freezes the maximum amount possible at every step. If the Rbalance at the
current node is insufficient, then the obligation is passed to the descendants
of that node. The process terminates once $s$ coins are frozen, or once there
are no more descendants to process.

We stress that the freezing algorithm in its entirety runs in a single
transaction. This ensures that account balances cannot change while the freeze
process is executing.

##### Terminology.

Suppose that the freeze function is called to freeze a transaction $t_{0}$
that transferred $s$ coins from address $v$ to address $a_{0}$. Let
$t_{\scriptscriptstyle\text{f}}$ be the posted freeze transaction on chain. To
describe the freeze algorithm, we use the following notation:

  * •

$\textit{toFreeze}(a)$ is the number of coins that the freeze transaction
$t_{\scriptscriptstyle\text{f}}$ will freeze at address $a$. At the start of
the algorithm $\textit{toFreeze}(a)=0$ for all $a$, with the exception of
$a_{0}$, where

$\textit{toFreeze}(a_{0})\mathrel{\mathop{:}}=\min\bigl{(}s,\textit{Bal}(a_{0})\bigr{)}.$
(1)

The quantity $\textit{Bal}(a)$, for an address $a$, is the available Rbalance
at $a$ at the time of $t_{\scriptscriptstyle\text{f}}$. This $\textit{Bal}(a)$
is calculated as the Rbalance at $a$ at the beginning of the freeze
transaction minus the amount of coins already frozen at $a$ due to a prior
dispute. Thus (1) will freeze the maximum amount possible at $a_{0}$.

  * •

For a transaction $t=(a\to b)$, from $a$ to $b$, let $\textit{val}(t)$ be the
value transferred from $a$ to $b$.

  * •

$\textit{burnedAt}(a)$ is set to the number of coins burned at address $a$
from its Rbalance between the first transaction that sent a portion of the
disputed funds to $a$ and the freeze transaction
$t_{\scriptscriptstyle\text{f}}$.

Now, consider the graph $G$ that is defined by the set of transactions that
took place after the disputed transaction and before the freeze transaction.
The nodes in the graph are addresses, and every directed edge represents a
transfer from one address to another. The graph only includes an edge $b\to c$
if there is directed path of transactions from $a_{0}$ to address $b$ that all
took place after $t_{0}$.

##### The algorithm.

We first describe a freeze algorithm that applies when the graph $G$ rooted at
$a_{0}$ is a directed acyclic graph (DAG). In Appendix A we extend the
algorithm to handle cycles by introducing a pre-processing phase that
eliminates cycles.

The freeze algorithm is implemented in the function CalcFreeze shown in Figure
4. This function is called as

$\textit{CalcFreeze}(t_{0})$

where $t_{0}$ is the disputed transaction.

The algorithm begins by constructing a topological sort of the vertices of $G$
staring at $a_{0}$. A topological sort is a list $L$ of the vertices in $G$,
where every vertex in $G$ appears exactly once in $L$, such that for every
edge $(a\to b)$, the vertex $a$ appears in $L$ before $b$. Every DAG has a
topological sort $L$, and $L$ can be constructed in linear time in the number
of edges.

For each address $a$ in $G$ the algorithm builds a value $\textit{oblig}(a)$
that indicates the obligation amount that is passed to address $a$ and its
descendants as a result of the disputed transaction. The value of
$\textit{oblig}(a)$ can increase whenever the algorithm process an address
that sent funds to $a$. For all $a$, the array $\textit{oblig}(a)$ is
initially set to zero.

$\textit{CalcFreeze}(t_{0})$: / / freeze trans. $t_{0}{\scriptstyle=(v\to
a_{0})}$
$L\mathrel{\mathop{:}}=\text{(topological sort of the graph rooted at
$a_{0}$)}$
/ / assuming the graph $G$ is a DAG
$\textit{oblig}(a_{0})\mathrel{\mathop{:}}=\textit{val}(t_{0})$
/ / the obligation of $a_{0}$ due to $t_{0}$
for each $a$ in $L$ in order do: / / start at $a_{0}$

  1. 1:

$\tau\mathrel{\mathop{:}}=\textit{oblig}(a)$
/ / total obligation at $a$ from parents

  2. 2:

$\textit{toFreeze}(a)\mathrel{\mathop{:}}=\min\bigl{(}\tau,\
\textit{Bal}(a)\bigr{)}$
/ / amount to freeze at $a$

  3. 3:

$\tau^{\prime}\mathrel{\mathop{:}}=\tau-\textit{toFreeze}(a)-\textit{burnedAt}(a)$
/ / the amount left to freeze, but do not
/ / pass burned amount downstream

  4. 4:

if $\tau^{\prime}\leq 0$: continue / / all done with $a$

  5. 5:

$E(a)\mathrel{\mathop{:}}=\text{sort}(\ \\{t{\scriptstyle=(a\to b)}\\}\ )$
/ / the set of trans. from $a$ sorted
/ / in reverse chronological order

  6. 6:

for each $t{\scriptstyle=(a\to b)}$ in $E(a)$ in order do:
/ / for each outgoing edge from $a$,
/ / starting with the most recent one

  7. 7:

$\textit{ob}\mathrel{\mathop{:}}=\min\bigl{(}\tau^{\prime},\textit{val}(t)\bigr{)}$

  8. 8:

$\textit{oblig}(b)\ \text{+=}\ \ \textit{ob}\quad;\quad\tau^{\prime}\
\text{{\bf--}\,=}\ \textit{ob}$
/ / obligate recipient $b$ to ob tokens

  9. 9:

if $\tau^{\prime}\leq 0$: break
/ / all done with $a$,
/ / terminate the inner loop on line (6)

Figure 4: The freeze algorithm for a DAG

The algorithm attempts to freeze the maximal amount possible at every node
$a$, starting with the root $a_{0}$. Line (3) calculates $\tau^{\prime}$, the
amount left to freeze after the available Rbalance at $a$ is frozen. Moreover,
the algorithm subtracts the Rbalance amount burned at $a$ because that
obligation should not transfer to the descendants of $a$. The remaining
amount, $\tau^{\prime}$, should pass as an obligation to the descendants of
$a$. In Line (6) the algorithm loops over all the transactions that take funds
out of $a$. The loop proceeds in reverse chronological order, namely from the
most recent transaction to the oldest transaction. Then Line (8) obligates the
recipient of the most recent transaction from $a$ to the maximal possible
amount. This continues until all of $\tau^{\prime}$ is passed as an obligation
to the children of $a$. We analyze this algorithm and its properties in
Appendix A.

Note that every address $a$ is only visited once, and only after all its
parents have been processed. Consequently, the running time is linear in the
number of edges in the graph. More precisely, if there are $V$ nodes and $E$
edges in the graph then the running time is $O(V+E)$ thanks to the data
structure we use that keeps edges in a chronologically sorted order.

Once this algorithm completes, the contract will add the quantity
$\textit{toFreeze}(a)$ to the number of coins frozen at address $a$ (recall
that $a$ might already have frozen coins due to a prior dispute). This means
that a subsequent transfer out of address $a$ will fail if it causes the
Rbalance of $a$ to drop below the commulative frozen amount.

##### Implementing the algorithm.

The ERC-20R contract needs to maintain enough state to support the freeze
process. We introduce a new Solidity data structure called _spenditures that
serves two functions: (i) when asked to freeze a transaction, the contract
needs to verify that the transaction took place within the dispute window, and
(ii) for an address $a$, the contract needs to identify all downstream
addresses that received funds from $a$ after the disputed transaction took
place.

The new Solidity data structure called _spenditures is illustrated in Figure
5.

Figure 5: Spenditures nested map.

We refer to each sequence of $\Delta$ blocks as an epoch (e.g.,
$\Delta=1000$). For each epoch, the _spenditures data structure lists all the
transactions that took place during that epoch for each source address (Alice
and Bob in the figure). Each Spenditure entry in Figure 5 contains the triple
(to, amount, blockNumber). Every time the contract processes a transfer
request, it appends a Spenditure entry to the appropriate array in the
_spenditures structure. A burn transaction adds a Spenditure triple where the
to field is null.

The freeze function takes in arguments
(epoch, from, index),
where epoch identifies the epoch in which the disputed transaction took place,
from identifies the payer, and index identifies the specific Spenditure in the
data structure. The index argument is provided by the governance contract by
running an off-chain search over the _spenditures structure to locate the
disputed transaction.

The freeze function checks that the requested transaction is within the
dispute window, and if so, runs the freeze algorithm using the _spenditures
data structure to determine the edges of the graph $G$ from Figure 3. The
final calculated freeze amounts per address are frozen. In addition, all these
freeze amounts are recorded in a secondary array called _claims that is
indexed by a newly generated 256-bit ClaimID. If the victim prevails in trial,
this array is used to transfer the correct amount from every suspect address
to the victim. The freeze function returns the ClaimID that indicates how to
reverse the transaction.

##### The clean function.

To minimize on-chain storage, our ERC-20R includes a clean function that takes
in an epoch and an array of addresses. The function deletes all array entries
in _spenditures with the specified epoch and sender addresses for epochs for
which the dispute window has elapsed. For every deleted entry, the specified
_spenditures amount is transferred from the account’s Rbalance to its
NRbalance, while making sure that the total Rbalance does not drop below the
frozen amount at the account. Anyone can call the clean function and free up
on-chain storage that is no longer needed.

###  2.2 Reversing a transaction

Once the trial over a disputed transaction concludes, the governance contract
will call the rejectReverse function or the Reverse function on the ERC-20R or
ERC-721R contract.

  * •

An ERC-20R reversal takes as input a ClaimID which is an index into the
_claims array. The entry indicates the obligation of each suspect account in
the disputed transfer. The function transfers the specified amount from the
Rbalance of suspect accounts to the original owner, and clears the freezes.

  * •

An ERC-721R reversal takes as input TokenID and an index into _owners array.
This indicates the owner prior to the disputed transaction. The asset is then
transferred to the original owner, and the asset is unfrozen.

##  3 The Arbitration Process

We now turn to the governance process where judges examine the evidence on a
disputed transaction and decide if the transaction should be revered. Some of
the key issues in designing this process are: (i) how judges are selected,
(ii) how judges are compensated, and (iii) how to discourage misbehaving
judges, such as judges who take bribes or make bad decisions on disputed
transactions.

This process is orchestrated by a governance contract. A single governance
contract can govern many 20R and 721R contracts. Judges vote on cases by
either using an on chain or off chain voting system. Once enough votes on a
case are collected, the governance contract calls the appropriate function on
the 20R or 721R contract to either execute the reversal or dismiss the case.
To ensure that judges make independent decisions, it is important that votes
remain secret until sufficiently many votes are cast. This could be done, for
example, using some flavor of a commit-and-reveal voting scheme, or any other
semi-private voting scheme.

###  3.1 Selecting judges

We envision a large pool of available judges who will be compensated for their
work. When a freeze request is submitted, the governance contract selects a
random and unpredictable quorum of $n$ judges from the pool. The value of $n$
can be fixed, say $n=12$, or it can increase with the size of the disputed
transaction, so that deciding on a large transaction requires more judges.
This random selection is best implemented using a randomness beacon [2]. This
quorum of judges decides on the initial freeze request, and later decides
whether to approve or reject the reversal request.

Who can join the pool of judges and preside over cases? One can envision a
process that requires a real world identity, a requirement for qualifications,
and a statement of conflicts, much like real-world judge selection. We will
leave the details of how to admit applicants into the pool of judges to future
policy discussions of the exact mechanism.

###  3.2 Compensating judges

Every freeze request to the governance contract is accompanied by some stake
from the party requesting the freeze. This stake can be used to compensate
judges for their work. We state the following principle in deciding how to
compensate judges: When judges submit their vote on a freeze request or on a
reversal decision, they are compensated for their work. However, the
compensation amount is independent of their voting decision.

If judges approve a freeze request, then the claimant’s staked amount, minus
fees, remains locked in the governance contract. If later the claimant loses
the trial, the staked amount can compensate the defendant for their effort. If
the claimant wins the trial, they could get back their excess stake.
Importantly, if the judges reject the initial freeze request, then the
claimant’s staked amount minus the judges’ fixed fees, should be burned.

##### Priority fees.

While victims must provide a minimal stake along with a freeze request, they
can optionally provide additional stake if they so choose. This extra “tip”
from the victim could potentially indicate the priority of the case. Judges
could rule on cases by priority rather than by chronological order. The tip
could either be burned, or given to the prevailing party, or some combination
of the two.

###  3.3 Discouraging judicial misbehavior

A judge might fail to vote in a timely manner, or they might frequently vote
with the extreme minority, potentially indicating an issue with their decision
making. In either case, the governance contract could remove such a judge from
the pool.

A more interesting question is how to prevent bribery, where a party bribes
judges to vote in its favor. There are several technical solutions that could
help partially mitigate this issue. One approach is to use a secrecy-
preserving process for selecting the quorum of judges to preside over a case:
a selected judge will learn that they were selected; however, on their own,
they will not know who the other judges are, nor will they be able to prove to
anyone that they were selected (if they honestly follow the selection
protocol). Once all the selected judges vote, the set of judges is revealed
along with a proof that the correct set voted. Importantly, the proof is
revealed by the posted data from the selected judges, not by a set of
trustees. This way, a party who wishes to bribe a judge will not know who to
bribe because the set of judges is only revealed after they all voted. This
makes it more difficult (but not impossible) to bribe judges.

##  4 Discussion and Extensions

##### Backwards compatibility.

Our ERC-20R standard is backwards compatible with the existing DeFi
infrastructure, such as exchanges and lending protocols. First the transfer()
function in ERC-20R has the same API as the transfer() function in the ERC-20
standard. Hence, no software changes are needed to process a customer request.
Second, because the transfer() function transfers funds from Alice’s NRbalance
(her balance of “old” tokens that are no longer reversible), the exchange is
assured that the funds that Alice sends to it will not be reversed due to a
subsequent upstream reversal. Of course, Alice herself might try to reverse
the transaction that sent Alice’s tokens to the exchange, but as long as the
exchange can show that it honestly processed the swap, that reversal request
will be rejected, and Alice will lose the fee needed to file a freeze request.
Hence, the only change to the DeFi provider is that it may need to respond to
false reversal requests by Alice.

When the exchange sends ERC-20R tokens to Alice, it will call the transfer()
function, as it does today. This transfers funds from the exchange’s
NRbalance. Hence, the exchange will need to ensure that its NRbalance is
sufficiently high to support customer demand. This is done by calling the
clean() function frequently, to transfer maturing funds from the exchange’s
Rbalance to it NRbalance.

Finally, some exchanges and lending protocols may be willing to take the risk
and accept funds from Alice’s Rbalance, most likely charging Alice a higher
fee in the process. These transactions will require greater scrutiny by the
DeFi provider, and will require additional software to properly assess the
risk.

##### Reversibility is viral.

An exchange that processes a swap of one 20R token for another 20R token is
safe to do so without delay: if one side of the transaction is later claimed
to have come from stolen funds, the exchange can initiate a reversal on the
other side of the transaction. However, exchanging a 20R token for a non-
reversible ERC-20 token is more dangerous. The exchange might only approve
such a swap after the dispute window has elapsed on the 20R side of the
transaction. This introduces a delay when swapping a reversible token for a
non-reversible one. Thus, once some key tokens become reversible, other tokens
are incentivized to do the same to eliminate this delay. In other words,
reversibility is viral.

##### Automation.

In addition to judges, one could also experiment with an algorithmic
transaction monitor that factors into the final decision. A decision to freeze
or reverse could then be a function of both the risk score given by the
monitoring algorithm and the judges’ votes. For example, if the algorithm
determines a high likelihood that a transaction is a result of theft, then a
reversal rejection would require a higher threshold of judges voting against
the case. One could also use such an algorithm to broadcast alerts of
suspicious transactions, lowering the risk that a victim will miss the
reversion window.

##### Appeals.

Future work may consider an appeals process, in which the party who loses the
trial can request another group of judges to rule on the disputed transaction.
We do not explore this here.

##### Partial reversals.

In some cases judges may opt for a partial reversal, where part of the funds
go back to the owner, and part stay with the recipient. While we focused on
complete reversals, the API can support partial reversals.

##### Grouping disputes.

A transaction that sends coins from address $A_{1}$ to $A_{2}$ is often
accompanied by a transaction from $A_{2}$ to $A_{1}$. For example, $A_{1}$
might send DAI to $A_{2}$, and in exchange $A_{2}$ sends an NFT to $A_{1}$.
Suppose that both DAI and the NFT support our reversible standards. Then, if
$A_{1}$ asks to reverse the DAI transaction, $A_{2}$ will likely ask to
reverse the NFT transaction. As an optimization, both claims can be decided
jointly by the same quorum of judges.

##  5 Conclusion

In this paper, we proposed extensions to ERC-20 and ERC-721 that introduce a
short time window when a transaction can be reversed. If adopted widely, these
standards can protect the blockchain community from large financial losses. We
hope that this paper will generate more discussion of reversibility as well as
new designs to address the challenges that it raises.

##### Acknowledgments.

This work was supported by NSF, the Simons Foundation, NTT Research, Coinbase,
and UBRI.

##  Appendix A Details of the freeze algorithm

In this section we extend and further analyze the freeze algorithm in Figure
4.

###  A.1 Properties of the algorithm

First, let us examine some properties of the freeze algorithm in Figure 4.
Consider the two transaction graphs in Figure 6. Both show the flow of funds,
starting with a disputed transaction from $v$ to $a_{0}$. Let us assume that
when freeze is called, the balance at $a_{0}$ and $a_{1}$ is zero in both
graphs. As a result, in both graphs, calling freeze on the transaction from
$v$ to $a_{0}$ will transfer the obligation to addresses $a_{2}$ and $a_{3}$,
which is where the funds reside at the time of the freeze.

In the graph $G_{1}$ the transaction from $a_{1}$ to $a_{3}$ is the most
recent, and therefore the algorithm will freeze $10$ tokens at $a_{3}$ and
zero tokens at $a_{2}$. This may seem unfair because both $a_{2}$ and $a_{3}$
may have received a portion of the disputed funds. We stress, however, that in
this case there is no “correct” answer because it is not possible to determine
how exactly $a_{1}$ split the 20 tokens at its disposal (10 from the disputed
transaction and 10 from a prior balance). Our algorithm’s decision is as
“correct” as any other answer.

Interestingly, an algorithm that tries to split the obligation evenly between
$a_{2}$ and $a_{3}$ in the graph $G_{1}$ can lead to paradoxical results.
Consider the graph $G_{2}$. The algorithm needs to obligate $a_{2}$ and
$a_{3}$ to a total of 20 tokens. By the discussion in Section 2 (Example 3),
address $a_{3}$ bears the full responsibility for the second transaction from
$a_{0}$ to $a_{1}$, and will therefore be obligated to 10 tokens as a result
of this transaction. Now, if $a_{3}$ were to bear a portion of the
responsibility for the first transaction from $a_{0}$ to $a_{1}$, then the
total obligation passed to $a_{3}$ would exceed 10 tokens. Since the balance
at $a_{3}$ may only be equal to 10, this strategy will cause the algorithm to
fail to freeze 20 tokens in total. Consequently, splitting the obligation
between $a_{2}$ and $a_{3}$ in such cases may lead to freezing a reduced
number of tokens, thereby preventing the victim from recovering the disputed
funds.

Our algorithm does not suffer from this issue: Theorem 1 below shows that our
freeze algorithm in Figure 4 always freezes the correct amount: 10 tokens in
the graph $G_{1}$ and 20 tokens in the graph $G_{2}$.

Figure 6: Two graphs where transactions are ordered chronologically from top
to bottom. In both graphs, the balance at $a_{0}$ and $a_{1}$ is zero at the
time of the freeze. In $G_{1}$ the starting balance at $a_{1}$ is 10.

###  A.2 Graphs with cycles

The freeze algorithm in Figure 4 relies on a topological sort of the nodes in
the graph $G$. The topological sort only exists when the graph is acyclic.
Here we extend the algorithm to any directed graph, even one that includes
cycles. We use a pre-processing phase that eliminates cycles.

Let us first see an example. Suppose the graph contains a transaction
$t=(a_{0}\to a_{1})$ for five coins, and a subsequent transaction
$t^{\prime}=(a_{1}\to a_{0})$ for three coins. This simple cycle means that
$a_{0}$ sent five coins to $a_{1}$, and $a_{1}$ subsequently sent three coins
back to $a_{0}$. For the purpose of our freeze algorithm, we can replace both
transactions by a single transaction from $a_{0}$ to $a_{1}$ for two coins,
and eliminate the cycle.

More generally, let $t_{0}=(v\to a_{0})$ be the disputed transaction. The pre-
processing step scans the graph rooted at $a_{0}$ to look for a directed cycle
of transactions $c_{0},\ldots,c_{k-1}$ where $c_{i}=(b_{i}\to b_{i+1\bmod k})$
that were all posted after the disputed transaction. Let $c$ be the
transaction of smallest value along the cycle, breaking ties arbitrarily. Let
$d\mathrel{\mathop{:}}=\textit{val}(c)$. We can eliminate the cycle by
removing transaction $c$ from the graph, and subtracting $d$ from the value of
every other transaction in the cycle. The algorithm can repeat this process
until the graph is free of cycles. At this point, the algorithm from Figure 4
can be applied to the resulting graph.

###  A.3 Two correctness theorems

Finally, we argue that the algorithm will freeze the correct amount. The first
theorem shows that the algorithm will freeze the correct total amount. The
second theorem shows that the algorithm will not over-freeze funds at any
single address.

######  Theorem 1.

Suppose that no burn transactions are processed between the disputed
transaction $t_{0}$ and the freeze transaction
$t_{\scriptscriptstyle\text{f}}$ . Moreover, there are no prior freezes in the
system. Then, if the disputed transaction $t_{0}$ sends $s$ tokens to address
$a_{0}$, then the freeze algorithm in Figure 4 will freeze a total of exactly
$s$ tokens. In particular, when the algorithm terminates we have

$s=\sum_{a}\textit{toFreeze}(a).$ (2)

###### Proof sketch.

First, let us assume that the directed graph rooted at $a_{0}$ is a DAG. We
argue that the algorithm satisfies two properties:

  * •

Property 1. When an address $a$ is processed in the main loop, let us call the
quantity $\tau^{\prime}$ computed on Line (3) the excess obligation at $a$,
namely the obligation not covered by $a$’s current balance. We claim that when
the algorithm completes processing address $a$, the quantity $\tau^{\prime}$
is added to the total obligation of the children of $a$.

  * •

Property 2. For a transaction $t:a\to b$, let $\textit{ob}(b,t)$ be the
obligation that the algorithm passes to $b$ as a result of $t$. We claim that
for every transaction $t:a\to b$ we have

$\textit{ob}(b,t)\leq\textit{val}(t).$

This means that the funds that transaction $t$ sends to $b$ (and its
descendants) is sufficient to cover the full obligation that the algorithm
passes to $b$.

Together these two properties prove the lemma: at every address, the exact
excess obligation is passed to its children, and there are sufficient funds at
the descendants to cover these obligations.

Let us prove these two properties. Property 2 is immediate from Line (8) in
the algorithm. This line ensures that for every transaction $t$, at most
$\textit{val}(t)$ is added to the obligation at $b$.

Figure 7: A sequence of $m+1$ incoming transactions to $a$ from its parent
$a_{0}$, along with $m$ outgoing transactions from $a$, interleaved in time.
Incoming transaction number $i$ obligates $a_{0}$ to $x_{i}$ tokens, and
outgoing transaction number $j$ sends $y_{j}$ tokens to $b_{j}$.

Property 1 follows from the fact that no coins are burned. In particular,
consider the node $a$ in Figure 7. The total obligation passed to $a$ is
$\tau\mathrel{\mathop{:}}=x_{0}+\ldots+x_{m}$. Let $\textit{Bal}(a)$ be the
balance at $a$ just prior to the freeze transaction. Then, by Property 2 and
because no tokens were burned we know that

$\tau\leq\textit{Bal}(a)+\underbrace{(y_{1}+\ldots+y_{m})}_{\text{\scriptsize
amount that left $a$}}.$

Moreover, by Line (3) we know that $\tau-\tau^{\prime}=\textit{Bal}(a)$ and
therefore

$\tau^{\prime}\leq y_{1}+\ldots+y_{m}.$ (3)

But when (3) holds, the loop in Lines (6) to (9) is guaranteed to add
$\tau^{\prime}$ to the total obligations of the children of $a$. This proves
Property 1.

To complete the proof we observe that the cycle elimination process from
Section A.2 does not affect the number of frozen tokens. Hence, the lemma
applies equally well to non-DAG graphs, assuming the cycle elimination process
is applied first. ∎

Next, we show that the algorithm will not over-obligate an address. This is
where we rely on the reverse chronological order loop in Line (6). Consider
again the transactions out of $a$ in Figure 7. We show that for every
$j\in\\{1,\ldots,m\\}$, the address $b_{j}$ will bear no obligation for funds
that arrived at $a$ after transaction number $j$. To define this, for a
transaction $t:a\to b$ we use the following terminology:

  * •

$\textit{ob}(b,t)$ is the obligation passed on to $b$ as a result of
transaction $t$. In other words, $\textit{ob}(b,t)$ is the value added to
$\textit{oblig}(b)$ when the algorithm processes the transaction $t$.

  * •

$\textit{obsum}(a,t)$ is the sum of all the obligations that were added to
$\textit{oblig}(a)$ as a result of the transactions that sent funds to $a$
prior to $t$. For example, for a transaction $t_{j}:a\to b_{j}$ in Figure 7 we
have

$\textit{obsum}(a,t_{j})=x_{0}+\ldots+x_{j-1}$

The following theorem shows that for a transaction $t:a\to b$ we have
$\textit{ob}(b,t)\leq\textit{obsum}(a,t)$. This means that the obligation
passed to $b$ will not exceed the obligations passed to $a$ due to
transactions that preceded $t$. In other words, $b$ will not bear
responsibility for an amount transferred to $a$ after transaction $t$.

######  Theorem 2.

Suppose that no burn transactions are processed between the disputed
transaction $t_{0}$ and the freeze transaction
$t_{\scriptscriptstyle\text{f}}$ . Then when the algorithm terminates, for
every transaction $t:a\to b$ we have

$\textit{ob}(b,t)\leq\textit{obsum}(a,t)$ (4)

###### Proof.

Let us prove the theorem for the graph in Figure 7. The exact same argument
applies to other graphs. Let $\textit{Bal}(a)$ be the balance at address $a$
at the time of the freeze. As usual, let

$\tau=x_{0}+\ldots+x_{m}.$ (5)

Now, fix some $j\in\\{1,\ldots,m\\}$ and let $t_{j}$ be the transaction $a\to
b_{j}$ in Figure 7. Observe that if

$\tau\leq\textit{Bal}(a)+\sum_{i=j+1}^{m}y_{i}$

then $\textit{ob}(b_{j},t_{j})=0$ and the theorem follows trivially. Hence, we
can assume that

$\tau>\textit{Bal}(a)+\sum_{i=j+1}^{m}y_{i}.$

In this case, by definition of the loop in Lines (6) to (9) in the algorithm
we know that

$\textit{ob}(b_{j},t_{j})=\\\ \min\left(y_{j},\ \ \
\tau-\textit{Bal}(a)-\sum_{i=j+1}^{m}y_{i}\right).$ (6)

Since no coins were burned at $a$ we know that

$\sum_{i=j}^{m}x_{i}\leq\textit{Bal}(a)+\sum_{i=j+1}^{m}y_{i}$

and therefore by (6) we obtain

$\textit{ob}(b_{j},t_{j})\leq\min\bigl{(}y_{j},\
\tau-\sum_{i=j}^{m}x_{j}\bigr{)}.$

It now follow by (5) that

$\textit{ob}(b_{j},t_{j})\leq x_{0}+\ldots+x_{j-1}=\textit{obsum}(a,t_{j})$

as required. This completes the proof. ∎

###  A.4 Preventing double freezes

Consider two transactions $v\to a_{0}$ and $a_{0}\to a_{1}$ issued in that
order, each transferring $\tau$ tokens. Suppose, that the final balance at
$a_{0}$ is zero and at $a_{1}$ is $2\tau$. Next, suppose $v$ requests to
freeze the $v\to a_{0}$ transaction, which will freeze $\tau$ tokens at
$a_{1}$. The problem is that now $a_{0}$ can request to freeze the $a_{0}\to
a_{1}$ transaction. This second request is attempting to again freeze the
$\tau$ tokens from $v$, and should do nothing. However, our freeze algorithm,
as currently described, will freeze an additional $\tau$ tokens at $a_{1}$.

We briefly describe two ways to prevent double freezes. First, the judges can
recognize the second freeze as a double freeze and reject this freeze request.

Alternatively, there is a simple modification to the freeze algorithm in
Figure 4 that eliminates double freezes. Recall that the freeze algorithm in
Figure 4 processes one transaction at a time in the transaction graph. Every
transaction is recorded in the _spenditures data structure shown in Figure 5.
Consider a transaction $a\to b$, and let
$S=(\textit{to},\textit{amount},\textit{blockNumber})$ be the corresponding
triple in the _spenditures data structure. If the freeze algorithm obligates
$b$ to $\tau_{0}\leq\tau$ tokens due to this transaction, then the algorithm
does two more steps: first, it subtracts $\tau_{0}$ from the amount field in
the triple $S$, and second, it adds the triple $(a,\textit{index},\tau_{0})$
to the _claims array for this freeze request. The first step ensures that
funds cannot be double frozen. The second step is needed for the
rejectReverse() function. If the reversal is eventually rejected, then the
rejectReverse() function will add $\tau_{0}$ back to the triple $S$ in the
_spenditures data structure from which it was subtracted.

## References

  * [1] Sarah Ahmed.  Bitgrail hack - one of the largest crypto hacks in history.  link, 2022\.
  * [2] The beacon chain.  link, 2018.
  * [3] Dan Boneh, Saba Eskandarian, Lucjan Hanzlik, and Nicola Greco.  Single secret leader election.  In Proceedings of the 2nd ACM Conference on Advances in Financial Technologies, page 12–24, 2020.
  * [4] Ed Caesar.  How a young couple failed to launder billions of dollars in stolen bitcoin.  link, 2022\.
  * [5] Chainalysis.  The 2022 crypto crime report.  link, 2022\.
  * [6] Obulapathi N Challa.  Reversecoin: Worlds first cryptocurrency with reversible transactions.  link, 2014\.
  * [7] Vishal Chawla.  Uniswap liquidity provider hacked for $8 million in phishing attack.  link, 2022\.
  * [8] Evelyn Cheng.  Japanese cryptocurrency exchange loses more than $500 million to hackers.  link, 2018\.
  * [9] CryptoSec.  Documented timeline of DeFi exploits.  link, 2022.
  * [10] CryptoSec.  Documented timeline of exchange hacks.  link, 2022.
  * [11] Dean Eigenmann.  Reversible token.  link, 2018\.
  * [12] Elliptic.  Elliptic NFT report 2022 edition: NFTs and financial crime.  link, 2022\.
  * [13] Guy Eshet.  Refunds for NFTs – the new ERC721R standard.  link, 2022\.
  * [14] Sam Kessler.  Typo moves $36M in seized JUNO tokens to wrong wallet.  link, 2022\.
  * [15] Olga Kharif, Sidhartha Shukla, and Bloomberg.  Hackers just stole $100 million in crypto from harmony’s horizon bridge.  link, June 2022.
  * [16] Lossless.  Lossless whitepaper.  link, 2020.
  * [17] Malte Möser, Ittay Eyal, and Emin Gün Sirer.  Bitcoin covenants.  In Financial Cryptography, volume 9604 of Lecture Notes in Computer Science, pages 126–141. Springer, 2016.
  * [18] Ronin’s Newsletter.  Community alert: Ronin validators compromised.  link, 2022\.
  * [19] Muyao Shen.  Hacker moves crypto stolen from ronin breach to help cover its tracks.  link, 2022\.
  * [20] Cryptopedia Staff.  What was The DAO?  link, 2022\.
  * [21] Smiljanic Stasha.  Cryptocurrency hacking statistics: Facts on hacking crypto.  link, Feb. 2022.
  * [22] Chainalysis Team.  The kucoin hack: What we know so far and how the hackers are using DeFi protocols to launder stolen funds.  link, 2020\.
  * [23] Jordan Tuwiner.  What was the Mt. Gox hack?  link, 2022.
  * [24] Fabian Vogelsteller.  rICO — the reversible ICO.  Medium, 2020.
  * [25] Wikipedia contributors.  Poly network exploit — Wikipedia, the free encyclopedia.  link, 2022\.  [Online; accessed July-2022].
  * [26] Florian Zandt.  Infographic: The biggest crypto heists.  link, 2022\.