.. 3 Eval (x9) = yori Sa SSS computed in parallel w an ve . = x9 = Verify(a1) a = Verify(a2) ag ~ ... + Verify(az) vp = Yrs oe a Sea m2 me For Sloth++, a proposed improvement on the Sloth function that integrates SNARK for succinct verification, given x Z} where p is a sufficiently large prime such that p = 3 mod 4, Eval(x) =\/x mod p = xT mod p. For verification, mod p = Verify(y) = y?, it will also produce SNARKProve(ek, y) => 7. For permutation polynomial chain on injective rational maps, we use a candidate polynomial proposed by Guralnick and Muller over Fp: (a* ax a) + (a ax + a)* + (a8 arn+ a)? + Aa? r)(st0)/2 2x8

Eval(x) will be an algorithm that calculates the inversion of the polynomial with difficulty parameter s. This proposal assumes that computing polynomial GCDs is the fastest inversion method, requiring at least s sequential steps even if evaluated on optimized hardware with at least s parallel processors. Tlowever non-optimized hardware with minimum parallel processors will evaluate Eval at O(s) time.

Modifying Setup, we can implement Wesolowskis construction that uses the Rivest, Shamir, and Wagner (RSW) time-lock puzzle based on a trapdoor of group G of unknown order. We do not need an Iterated Sequential Function for an RSW construction as the difficulty parameter t is incremented sequentially during the evaluation. But this construction does not satisfy the decodable property that the previous two constructions do, as there is no efficient way of computing the inversion of the RSW algorithm. RSW assumes that given y = x? mod N, an evaluator would need t sequential squarings to evaluate y if the group order or factorization of N is unknown. To implement this, we will modify Setup by creating an unknown group order using Wesolowskis imaginary quadratic order. This way, Setup can simply choose a random discriminant, assuming that class group cannot be computed faster than solving RSW when the discriminant is large.

Pictrzak proposed a VDF candidate that improved upon Wesolowskis RSW puzzle by implementing a halving protocol, which allows for parallelism in the proof construction and a reduced proof time of ~V/t time. However, this comes at a cost of proof size and verification time at a factor of log(t). 3.3. 1-Round Settlement Model We propose a model where orders are settled in the same round that they are made (6 = 0) where the settlement logic deterministically selects the take order with the highest t. From round r to r+1, takers continuously submit a sequence of Commits with incremental t until the end of the round and the settlement smart contract will evaluate the winning take order at round r+1. Ty discovers T,, order and computes V (xy) Ty races to r Time t send Commit r+1 T, aT___>_ | Confirm (a(2), 20, yo, M, ta, Sn,) : THA) TH(2) a Ta Ta(2 Ta (1) (2) (3) (4) Confirm (7 a(4), Ta, Ya, M, ta, Sr) tr ty > te T, wins M Ta discovers M and ' T,, continuously sends