[mjb]

Read section 3 and 4 of the whitepaper - the whole trust a quorum model is directly aimed at Sybil-style attacks. The key argument here is that the way they do group membership prevents these attacks by using a trusted quorum. This seems like a key place to focus attention for outside analysis of the properties of this protocol. If the assertions about this are incorrect, then the whole thing breaks down. As the Sybil paper points out, membership is critical for consensus. As a common-sense thing, "we have agreed" is super dependent on who "we" is.

As for eclipse, the model is so fundamentally different that it's not clear that there is a direct analogy for those network attacks. What do you have in mind? I'm not saying that it's obviously safe, just that attacks on the network protocol would have a very different flavor.