Limitations

A white paper that omits its own open problems is marketing. As of this draft:

• SQIsign is not a NIST standard. It is a Round 3 candidate in NIST's additional-signature process (§8.1). If later cryptanalysis weakens it, or NIST drops it, Spek's only remedy is a signature-scheme migration through a hard fork (§8.5, §14). Every operator chooses for themselves whether to adopt that fork.
• No independent audit. The code, including the vendored SQIsign and RandomX C and the FFI boundary, has been audited only by AI models (Anthropic's Claude). No human security firm, cryptographer, or SQIsign author has reviewed it. Mainnet is its first exposure to outside attackers. The uniqueness of the slot reveal (§4.1) is the property most worth a cryptographer's time: a related hash-based construction for proof-of-stake election, X-VRF, was later broken on exactly that property.
• Signing after the fact. Unbonded stake cannot stop a key that held stake at a fork point from signing a branch from that point later, including keys whose owners have since sold. Only restoration pins (running nodes) and compiled checkpoints (fresh nodes) bound it. On its own private branch an attacker also knows each beacon before that beacon's stake cutoff; simulation puts the break-even share at 0.45–0.47 for a branch inside the pin, and at about 0.42 (with a million candidate fits) for a fresh node that has no checkpoint past the fork. Comparing deep forks by early-window density (the Ouroboros Genesis rule) was evaluated and not adopted, because ordinary honest null slots let a dormant-stake branch win some early window far below the modelled threshold.
• Pins advance without network evidence. A restoration pin moves with the node's own tip, so a node partitioned, or mining alone, for longer than the pin lag (33–67 h) pins its own branch and refuses the other side on reconnect. Advancing pins only when the interval shows enough of the network producing it is planned follow-up work.
• No fast finality. Settlement is by confirmations (Appendix B) until the pin; there is no finality gadget. A committee-certificate design that needs no slashing is a candidate for a later upgrade.
• Download-time checks during the seed phase. Seed-phase eligibility needs the block bodies that hold the ticket records, so the header stage of a download checks signatures and horizons but no RandomX work. A fake seed-phase header chain is therefore as cheap to build as a fake post-seed one; pins, block-apply validation and the download candidate budgets bound both.
• Stake keys are hot and public. Every header shows its stake key, and the key lives on the mining machine. The payout rule keeps one stake unit per horizon at that address (two for the year before a renewal), and everything else goes to a hidden-key payout address. A node with no payout address configured keeps paying its stake address and warns daily.
• Roughtime operator count. The compiled-in pool has four independent operators against a quorum of three: any one operator may be dark or key-rotated and syncs still complete, but with one dark every remaining operator must answer, and two colluding operators can steer the vote median (by at most the per-sync step bound, per applied sync). Widening the operator set with independently operated servers is the remedy, never lowering the quorum.
• Network-wide multi-slot outage wedges the chain until an operator fills nulls (§5). Single-node outages self-heal.
• Withholding the top five. A node ranks at most five peer headers per slot plus its own (§5). If the five best headers of a slot are all withheld, every node that holds them settles the same canonical null: no body in the top five is committable, and a node's own block ranked sixth is skipped because no peer retains it, so committing it would leave each miner on a different block. Safety holds (one block per height; a node the withheld headers did not reach commits a real block, and any real block outranks the null), the slot's liveness is lost, and the withholder forfeits the slot's rewards. With an attacker share p of the draws for a slot, about p⁵ of slots are nulled; nulling a fraction f takes p = f^(1/5), that is p/(1−p) times the honest draw count: about 0.66× for 1% of slots, 1.7× for 10%, 6.7× for 50%. These are model estimates (independent uniform scores, every withheld header reaching every node), not simulation results. Each draw costs a recorded seed ticket per round in the seed phase and an aged stake output after it (§7).
• Multiple draws per operator. One key per node is policy, not consensus. An operator holding K funded stake outputs fields K draws for a one-time, refundable K × requirement. Whether the network's cost structure ends up capital-at-rest rather than consumed-opex turns on this, and it deserves explicit economic treatment rather than reliance on hardware scaling.
• Launch-time constants. Allocation keys, the stewardship commitment, the sealed launch ticket set, the launch nonce and the genesis timestamp are fixed by the open launch (§7.2); every one can be recomputed from public inputs.
• Not built, by decision: SPV proofs (the merkle domain separation is the prerequisite; wire hardening remains), DNS-seed discovery, native IPv6, data-availability sampling (removed, with no reserved header field), on-chain soft-fork signalling, post-sync assume-UTXO verification, NTS (licence-incompatible library), cross-parent double-sign forfeiture (a block's score does not depend on its parent, so signing two parents gains nothing a forfeiture would remove).
• Hard checkpoints are a permanent trust assumption for nodes with no history of their own (weak subjectivity): such a node trusts the release's compiled-in pins and the checkpoint signer set. They have no sunset; the signer set, its threshold and the signing procedure are part of the launch disclosure.