Pith. sign in

REVIEW 3 major objections 3 minor 1 cited by

A second voting round is the dividing line: two-round-finality consensus cannot push data expansion below about 2.5, while three-round protocols can approach 1.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · deepseek-v4-flash

2026-08-02 18:20 UTC pith:BSFOVUNB

load-bearing objection Genuinely new lower bound and a clever recovery mechanism, but the main proof does not close for randomized protocols and liveness rests on an unproven condition; the paper is promising but not finished. the 3 major comments →

arxiv 2603.11797 v3 pith:BSFOVUNB submitted 2026-03-12 cs.DC

The Carnot Bound: Limits and Possibilities for Bandwidth-Efficient Consensus

Andrew Lewis-Pye , Patrick O'Grady This is my paper
classification cs.DC MSC 68M1468W15
keywords consensusstate machine replicationerasure codingdata expansion rateByzantine faultspartial synchronythroughputbandwidth
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

This paper asks how close leader-based consensus can get to raw network bandwidth when the leader sends erasure-coded fragments instead of full copies of each block. It proves that protocols with 2-round finality (one proposal round, one voting round) cannot push the data expansion rate below about 2.5, and that this bound is tight because existing erasure-coded protocols already reach it. It then shows that protocols with 3-round finality (two voting rounds) escape the bound: the extra voting round acts as a recovery mechanism, letting a leader attempt an aggressive code and fall back to a safe one when reconstruction fails, so the rate can approach 1 under good conditions. Two protocols, Carnot 1 and Carnot 2, implement this for Extractable SMR and full SMR respectively, with safe fallback rates of about 1.33 and 1.5. A reader should care because the data expansion rate directly divides achievable throughput: dropping it from 2.5 toward 1 is what lets consensus run closer to wire speed.

Core claim

On the paper's own terms, the discovery is a phase transition in what bandwidth-efficient consensus can achieve. Theorem 8.1 states that any polynomial-time protocol with 2-round finality forces the data expansion rate to be at least about 2.5: the broadcaster's input must be recoverable from the first-round messages sent to any set of n-2f-f*+1 processors, and the proof establishes this by an indistinguishability simulation in which the broadcaster crashes right after sending those messages. With 3-round finality the paper shows the bound disappears: the second voting round lets correct processors detect that data availability has not been achieved, nullify the view, and retry, so leaders c

What carries the argument

The central quantity is the data expansion rate d = n/k, the ratio of total data the leader sends to payload size when an (n,k)-erasure code is used. The load-bearing mechanism is the second voting round in 3-round-finality protocols: it converts a partial reconstruction failure into a detectable, recoverable event — if a view cannot certify data availability, it is nullified and retried. Carnot 1's stage-2 M-certificate (a threshold certificate from f+1 stage-2 votes) proves that at least one correct processor has decoded the payload, allowing view progression without extra fragment echoing; Carnot 2 adds a dual Merkle root so that recovery fragments from a conservative (n,n-f-1)-encoding a

Load-bearing premise

The load-bearing premise is that correct processors can be counted on to disseminate enough fragments of each proposed block (the 'fragments are well disseminated' condition) for the optimistic rates to hold; the 2-round lower-bound argument additionally presumes deterministic or fixed-coin protocol behaviour so that a simulation without the input is valid.

What would settle it

Run Carnot 2 with n=3f+1, a correct leader, and an adversary that delivers the leader's proposals but delays every non-leader fragment echo past all timeouts. If a block is ever finalised, the well-disseminated premise is not load-bearing; if the chain stalls indefinitely, the premise is confirmed as necessary.

Watch this falsifier — get emailed when new claim-graph text bears on it.

If this is right

  • For protocols with 2-round finality, the data expansion rate is bounded below by approximately 2.5, and this bound is tight because existing erasure-coded protocols already reach it.
  • Adding a second voting round eliminates the bound: 3-round-finality protocols can approach a data expansion rate of 1 in good conditions, meaning throughput can approach the network bandwidth S/d.
  • Under adversarial conditions, Carnot 1 falls back to a safe rate of about 1.33 (with n>=4f+1 and no extra fragment dissemination), and Carnot 2 to about 1.5 (with n>=3f+1 and extra dissemination only when Byzantine processors interfere).
  • Both protocols support stable leaders, which pipeline proposals within a superview and remove the inter-proposal gap that limits throughput in rotating-leader schemes.
  • Carnot 1 solves Extractable SMR, which is sufficient for data-availability layers, while Carnot 2 solves full SMR; this splits the design space by how much local data each correct processor must hold.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • A natural question the paper leaves open: whether the 2.5 lower bound survives for randomised protocols with negligible error, since the proof's indistinguishability simulation assumes deterministic or fixed-coin behaviour.
  • The recovery pattern — commit to two encodings (aggressive and conservative) and fall back to the conservative one on a certified failure signal — is a general template that could be applied to other data-dissemination tasks, such as data-availability sampling or verifiable information dispersal, beyond SMR.
  • If the aggressive rates prove stable in practice, leaders could adaptively tune the erasure parameter k based on observed fragment-echo rates, effectively interpolating between the 1.33/1.5 safe rates and rates near 1, without protocol change.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

3 major / 3 minor

Summary. The paper studies bandwidth-efficient leader-based SMR with erasure coding, introducing the data expansion rate as the ratio of total leader-sent data to payload size. It claims a fundamental lower bound of approximately 2.5 on the data expansion rate for protocols with 2-round finality (Theorem 8.1), and asserts that this bound is matched by existing protocols such as E-Minimmit and Kudzu. On the positive side, it presents two 3-round-finality protocols, Carnot 1 (Extractable SMR, n >= 4f+1) and Carnot 2 (full SMR, n >= 3f+1), which use a recovery mechanism to let leaders attempt aggressive erasure codes and fall back to safer ones, claiming expansion rates approaching 1 under favourable conditions. The paper also gives a Pipes-model throughput/latency analysis and compares with DispersedSimplex and Sailfish.

Significance. If the lower bound is established for the full class of protocols, it is a clean and nontrivial contribution, and the positive protocols are concrete design proposals with a plausible recovery mechanism. The Pipes-model analysis is a useful addition and the paper provides detailed, structured proofs. However, the main lower-bound proof has a serious gap for randomized protocols, and the positive-protocol liveness proof leaves a key condition as an assumption rather than proving it. The central claims are therefore not yet fully supported, though they appear potentially fixable.

major comments (3)
  1. [Section 8.2, Theorem 8.1] The proof concludes that the broadcaster's input can be computed from its timeslot-0 messages to P by 'simulating E1 without knowledge of v'. This is valid only for deterministic protocols, or for a fixed assignment of all random coins. The theorem is stated for all polynomial-time protocols, which in this literature includes randomized protocols with private coins. In a randomized protocol, the view of P1 in E1 is a random variable depending on the coins of the broadcaster and of processors in P2, P3, and P4; the simulator is not given those coins. The indistinguishability statements show only that for each fixed tape assignment the messages determine the output, not that the output is computable from the messages alone and equal to v. No averaging or derandomization argument is supplied. Since Theorem 8.1 is the basis for the claimed 2.5 data-expansion lower bound, this is a load-beari
  2. [Section 8.2] The proof fixes t* after asserting that all correct processors terminate in E1, but it does not justify that t* is known or polynomially bounded from the protocol description. To compute the input by simulation, the simulator must know when to stop; otherwise the 'polynomial-time' part of the theorem is unsupported. If only computability (rather than polynomial-time computability) is needed for the erasure-coding application, the theorem should be restated accordingly.
  3. [Appendices A.10 and B.11] The liveness lemmas for non-initial views assume 'fragments are well disseminated' in the interval of views, i.e., that at least k correct processors disseminate their certified fragments. This condition is not derived from the protocol. A correct processor disseminates its fragment only after receiving a votable fragment, which requires the parent block to be in blocks and N-certificates for intervening views. The lemmas need to prove that under a correct leader and synchrony these prerequisites are met for every correct processor. Without such a proof, the formal support for the claim that non-initial views can safely use aggressive expansion rates (approaching 1) is incomplete.
minor comments (3)
  1. [Section 9] The section is empty ('Experiments: To be added') despite the introduction promising an experimental comparison. Either include the experiments or remove the section and adjust the surrounding text.
  2. [Appendix A/B] Typographical errors: 'Uniqe' in the headings of Lemmas A.3 and B.3; 'A must more detailed analysis' in Appendix B.3 should be 'A much more detailed analysis'.
  3. [Section 7.4] The comparison with DispersedSimplex would be easier to verify if the specific variant and parameter assumptions (stable leader, block sizes, forwarding assumptions) were stated in one place, since the latency formula in Equation (4) is sensitive to those details.

Circularity Check

0 steps flagged

No circular derivation: the lower bound is an independent indistinguishability argument and the positive protocols build on external Simplex; only minor non-load-bearing self-citations appear.

full rationale

The central negative result (Theorem 8.1) is derived from a 2-round Byzantine Broadcast indistinguishability proof, not from the protocols the paper presents or from any fitted constant. The data-expansion lower bound n/k >= (5f+1)/(2f+2) is arithmetic applied to the theorem's recovery-from-messages-to-P conclusion; it is not assumed in the definition of 2-round finality. The positive protocols are explicitly built on Simplex [10] and use Cachin-Tessaro certified fragments [8]; their safe expansion rates 4/3 and 3/2 follow from the chosen erasure thresholds, not from fitting. Self-citations occur ([25] for the Pipes model, [11] as one tightness witness, [26] for Extractable SMR, and a footnote to a previous version), but none is load-bearing: [31] independently witnesses tightness, and the Pipes model is used as a measurement framework rather than as a premise for the impossibility theorem. Correctness concerns are separate from circularity: as written, the E1 simulation in Section 8.2 appears to require deterministic protocol behavior to compute v from the timeslot-0 messages, so the theorem may not close over randomized polynomial-time protocols; Lemmas A.10/B.11 assume 'fragments are well disseminated' without guaranteeing it; and Section 9 is empty. These are proof gaps, not reductions of the results to their own inputs. Accordingly, no circular step is identified.

Axiom & Free-Parameter Ledger

4 free parameters · 6 axioms · 4 invented entities

The central claims rest on standard distributed-computing assumptions (partial synchrony, perfect crypto, erasure codes) plus protocol-specific parameters (k, x, s, s*) and two unproven or under-specified conditions: well-disseminated fragments for aggressive rates, and deterministic/fixed-randomness behavior in the lower-bound proof.

free parameters (4)
  • reconstruction parameter k = g(S,v) = n-f-1 for initial views; range [n-f-1, n-1] otherwise
    The leader chooses k to balance data expansion n/k against reconstruction risk; the paper leaves g flexible and does not prove that an aggressive choice always finalizes.
  • superview length x = unspecified
    Number of views per stable leader; affects pipelining and latency, left as a free protocol parameter.
  • recovery timer s = unspecified
    Timer controlling when a processor sends recovery fragments in Carnot 2; chosen roughly as the expected time until stage-2 votes, not derived.
  • block-send time s* = depends on bandwidth and block size
    Used in Pipes-model analysis and timeouts; a model parameter rather than a fitted constant.
axioms (6)
  • domain assumption Partial synchrony with known Δ and unknown GST (Dwork et al.)
    The protocols and lower bound assume the standard partial-synchrony model from Section 2.
  • domain assumption Perfect cryptographic primitives: authenticated channels, PKI, collision-resistant hash, threshold signatures; adversary cannot break them
    Section 2 states the adversary is computationally bounded and the schemes are treated as perfect.
  • standard math Erasure codes with fragment size β/k and Merkle tree commitments (Cachin-Tessaro)
    The coding and verification machinery is imported from prior work and assumed to be correct.
  • domain assumption Good case in Pipes analysis: synchronous network, all processors correct, balanced sending, equal bandwidth S, no download bottleneck
    Section 7 restricts throughput and latency analysis to the good case, following [25].
  • ad hoc to paper Fragments are well disseminated: at least k correct processors disseminate their certified fragments for non-initial views
    Lemmas A.10 and B.11 require this condition; it is not guaranteed by protocol rules but is assumed for liveness of aggressive-rate blocks.
  • ad hoc to paper Indistinguishability argument fixes random coins or assumes deterministic protocol behavior
    Theorem 8.1's proof simulates executions without knowing the input; for randomized protocols this needs an explicit coin-fixing argument not provided.
invented entities (4)
  • stage-2 M-certificate no independent evidence
    purpose: Compact data-availability certificate in Carnot 1 formed from f+1 stage-2 votes; lets processors advance without collecting n-f fragments.
    Internal protocol object with no external falsifiable handle; security follows from the paper's proofs.
  • N-certificate no independent evidence
    purpose: Compact nullification certificate used for view progression and safety in Carnot 1 and Carnot 2.
    Internal protocol object defined by threshold signatures over nullify messages.
  • superview no independent evidence
    purpose: A stable-leader tenure of x views, allowing pipelined block proposals without inter-leader gaps.
    New organizational concept of this paper; no external evidence.
  • recovery encoding with dual Merkle roots no independent evidence
    purpose: In Carnot 2, commit to both an aggressive primary encoding and a conservative recovery encoding so recovery fragments are verifiable.
    Internal mechanism added to solve the verification problem for recovery fragments.

pith-pipeline@v1.3.0-alltime-deepseek · 41475 in / 22760 out tokens · 198021 ms · 2026-08-02T18:20:34.422634+00:00 · methodology

0 comments
read the original abstract

In leader-based State Machine Replication (SMR), the leader's outgoing bandwidth is a natural throughput bottleneck. Erasure coding can alleviate this by letting the leader send each processor one fragment of each block rather than a full copy. The data expansion rate, the ratio of total data sent to payload size, determines how close throughput can get to network bandwidth. We investigate the fundamental limits of bandwidth-efficient leader-based consensus. We prove that protocols with 2-round finality (one voting round) cannot achieve a data expansion rate below approximately~$2.5$, matching existing protocols. Protocols with 3-round finality (two voting rounds) can do significantly better: the second voting round provides a recovery mechanism, letting leaders attempt aggressive erasure codes and safely fall back to conservative ones when reconstruction fails, without compromising consistency. We present two 3-round protocols realising this. Carnot~1 solves Extractable SMR, in which any correct processor can efficiently reconstruct any finalised block from fragments held by correct processors, but processors need not hold full blocks locally; this suffices for settings such as data availability layers. Carnot~1 assumes $n \geq 4f+1$ (at most $f$ Byzantine) and requires no fragment dissemination beyond the initial messages. Carnot~2 solves full SMR, where every correct processor eventually receives every finalised transaction. It operates under optimal resilience $n \geq 3f+1$, at the cost of additional fragment dissemination when Byzantine processors interfere. Both protocols support stable leaders. Under favourable conditions, leaders can use expansion rates approaching $1$; under adversarial conditions, they revert to safe rates of approximately $1.33$ and $1.5$, respectively, both well below the $2.5$ lower bound for 2-round finality.

Figures

Figures reproduced from arXiv: 2603.11797 by Andrew Lewis-Pye, Patrick O'Grady.

Figure 1
Figure 1. Figure 1: Latency for Carnot 2 and DispersedSimplex. [PITH_FULL_IMAGE:figures/full_fig_p028_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: Latency for Carnot 2 and Sailfish: parameters are the same as for Figure 1. [PITH_FULL_IMAGE:figures/full_fig_p029_2.png] view at source ↗

Review history (2 revisions) →

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score.

  1. Multimmit: Extending Blocks for Faster Finality

    cs.DC 2026-07 conditional novelty 7.0

    Multimmit finalises transaction blocks in one voting round with roughly 3δ average latency from dissemination, confining a faulty producer's damage to its own chain.

Reference graph

Works this paper leans on

39 extracted references · 6 linked inside Pith · cited by 1 Pith paper

  1. [1]

    Ittai Abraham, Kartik Nayak, Ling Ren, and Zhuolun Xiang. 2021. Good-case latency of byzantine broadcast: A complete categorization. InProceedings of the 2021 ACM Symposium on Principles of Distributed Computing. 331–341

    2021

  2. [2]

    Kushal Babel, Andrey Chursin, George Danezis, Anastasios Kichidis, Lefteris Kokoris-Kogias, Arun Koshy, Alberto Sonnino, and Mingwei Tian. 2023. Mysticeti: Reaching the limits of latency with uncertified dags.arXiv preprint arXiv:2310.14821(2023)

    arXiv 2023

  3. [3]

    Dan Boneh, Ben Lynn, and Hovav Shacham. 2001. Short signatures from the Weil pairing. InInternational conference on the theory and application of cryptology and information security. Springer, 514–532

    2001

  4. [4]

    Francisco Brasileiro, Fabíola Greve, Achour Mostéfaoui, and Michel Raynal. 2001. Consensus in one communication step. InInternational Conference on Parallel Computing Technologies. Springer, 42–50

    2001

  5. [5]

    2016.Tendermint: Byzantine fault tolerance in the age of blockchains

    Ethan Buchman. 2016.Tendermint: Byzantine fault tolerance in the age of blockchains. Ph. D. Dissertation

    2016

  6. [6]

    Ethan Buchman, Jae Kwon, and Zarko Milosevic. 2018. The latest gossip on BFT consensus.arXiv preprint arXiv:1807.04938(2018)

    Pith/arXiv arXiv 2018

  7. [7]

    Vitalik Buterin and Virgil Griffith. 2017. Casper the friendly finality gadget.arXiv preprint arXiv:1710.09437(2017)

    Pith/arXiv arXiv 2017

  8. [8]

    Christian Cachin and Stefano Tessaro. 2005. Asynchronous verifiable information dispersal. In24th IEEE Symposium on Reliable Distributed Systems (SRDS’05). IEEE, 191–201

    2005

  9. [9]

    Miguel Castro, Barbara Liskov, et al. 1999. Practical byzantine fault tolerance. InOsDI, Vol. 99. 173–186

    1999

  10. [10]

    Benjamin Y Chan and Rafael Pass. 2023. Simplex consensus: A simple and fast consensus protocol. InTheory of Cryptography Conference. Springer, 452–479

    2023

  11. [11]

    Brendan Kobayashi Chou, Andrew Lewis-Pye, and Patrick O’Grady. 2025. Minimmit: Fast finality with even faster blocks.arXiv preprint arXiv:2508.10862(2025)

    arXiv 2025

  12. [12]

    George Danezis, Lefteris Kokoris-Kogias, Alberto Sonnino, and Alexander Spiegelman. 2022. Narwhal and tusk: a dag-based mempool and efficient bft consensus. InProceedings of the Seventeenth European Conference on Computer Systems. 34–50

    2022

  13. [13]

    Isaac Doidge, Raghavendra Ramesh, Nibesh Shrestha, and Joshua Tobkin. 2024. Moonshot: Optimizing chain-based rotating leader bft via optimistic proposals.arXiv preprint arXiv:2401.01791(2024)

    Pith/arXiv arXiv 2024

  14. [14]

    Lynch, and Larry Stockmeyer

    Cynthia Dwork, Nancy A. Lynch, and Larry Stockmeyer. 1988. Consensus in the Presence of Partial Synchrony.J. ACM35, 2 (1988), 288–323

    1988

  15. [15]

    Bruno França, Denis Kolegov, Igor Konnov, and Grzegorz Prusak. 2025. ChonkyBFT: Consensus Protocol of ZKsync. arXiv preprint arXiv:2503.15380(2025)

    Pith/arXiv arXiv 2025

  16. [16]

    Roy Friedman, Achour Mostefaoui, and Michel Raynal. 2005. Simple and efficient oracle-based consensus protocols for asynchronous Byzantine systems.IEEE Transactions on Dependable and Secure Computing2, 1 (2005), 46–56

    2005

  17. [17]

    Adam Gągol and Michał Świętek. 2018. Aleph: A leaderless, asynchronous, byzantine fault tolerant consensus protocol. arXiv preprint arXiv:1810.05256(2018)

    Pith/arXiv arXiv 2018

  18. [18]

    Rachid Guerraoui and Marko Vukolić. 2007. Refined quorum systems. InProceedings of the twenty-sixth annual ACM symposium on Principles of distributed computing. 119–128

    2007

  19. [19]

    Idit Keidar, Eleftherios Kokoris-Kogias, Oded Naor, and Alexander Spiegelman. 2021. All you need is dag. InProceedings of the 2021 ACM Symposium on Principles of Distributed Computing. 165–175

    2021

  20. [20]

    Idit Keidar, Oded Naor, Ouri Poupko, and Ehud Shapiro. 2022. Cordial miners: Fast and efficient consensus for every eventuality.arXiv preprint arXiv:2205.09174(2022)

    Pith/arXiv arXiv 2022

  21. [21]

    Quentin Kniep, Jakub Sliwinski, and Roger Wattenhofer. 2025. Solana Alpenglow Consensus.https:// www.scribd.com/ document/ 895233790/ Solana-Alpenglow-White-Paper(2025)

    2025

  22. [22]

    Klaus Kursawe. 2002. Optimistic byzantine agreement. In21st IEEE Symposium on Reliable Distributed Systems, 2002. Proceedings.IEEE, 262–267

    2002

  23. [23]

    Petr Kuznetsov, Andrei Tonkikh, and Yan X Zhang. 2021. Revisiting optimal resilience of fast byzantine consensus. In Proceedings of the 2021 ACM Symposium on Principles of Distributed Computing. 343–353

    2021

  24. [24]

    Leslie Lamport, Robert Shostak, and Marshall Pease. 1982. The Byzantine generals problem.ACM Transactions on Programming Languages and Systems (TOPLAS)4, 3 (1982), 382–401

    1982

  25. [25]

    Andrew Lewis-Pye, Kartik Nayak, and Nibesh Shrestha. 2025. The Pipes Model for Latency Analysis.Cryptology ePrint Archive(2025)

    2025

  26. [26]

    Andrew Lewis-Pye and Ehud Shapiro. 2025. Morpheus Consensus: Excelling on trails and autobahns.arXiv preprint arXiv:2502.08465(2025). Lewis-Pye and O’Grady35

    arXiv 2025

  27. [27]

    J-P Martin and Lorenzo Alvisi. 2006. Fast byzantine consensus.IEEE Transactions on Dependable and Secure Computing 3, 3 (2006), 202–215

    2006

  28. [28]

    Fred B Schneider. 1990. Implementing fault-tolerant services using the state machine approach: A tutorial.ACM Computing Surveys (CSUR)22, 4 (1990), 299–319

    1990

  29. [29]

    Fred B Schneider. 1993. Replication management using the state-machine approach, distributed systems. (1993)

    1993

  30. [30]

    Victor Shoup. 2023. Sing a song of Simplex.Cryptology ePrint Archive(2023)

    2023

  31. [31]

    Victor Shoup, Jakub Sliwinski, and Yann Vonlanthen. 2025. Kudzu: Fast and Simple High-Throughput BFT.arXiv preprint arXiv:2505.08771(2025)

    arXiv 2025

  32. [32]

    Nibesh Shrestha and Aniket Kate. 2025. Hydrangea++: Enhancing Hydrangea with Optimistic Proposals. (2025)

    2025

  33. [33]

    Nibesh Shrestha, Aniket Kate, and Kartik Nayak. 2025. Hydrangea: Optimistic Two-Round Partial Synchrony with One-Third Fault Resilience.Cryptology ePrint Archive(2025)

    2025

  34. [34]

    Nibesh Shrestha, Rohan Shrothrium, Aniket Kate, and Kartik Nayak. 2025. Sailfish: Towards improving the latency of dag-based bft. In2025 IEEE Symposium on Security and Privacy (SP). IEEE, 1928–1946

    2025

  35. [35]

    Yee Jiun Song and Robbert Van Renesse. 2008. Bosco: One-step byzantine asynchronous consensus. InInternational Symposium on Distributed Computing. Springer, 438–450

    2008

  36. [36]

    Alexander Spiegelman, Balaji Arun, Rati Gelashvili, and Zekun Li. 2024. Shoal: Improving dag-bft latency and robustness. InInternational Conference on Financial Cryptography and Data Security. Springer, 92–109

    2024

  37. [37]

    Alexander Spiegelman, Neil Giridharan, Alberto Sonnino, and Lefteris Kokoris-Kogias. 2022. Bullshark: Dag bft protocols made practical. InProceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security. 2705–2718

    2022

  38. [38]

    Yann Vonlanthen, Jakub Sliwinski, Massimo Albarello, and Roger Wattenhofer. 2024. Banyan: Fast rotating leader bft. InProceedings of the 25th International Middleware Conference. 494–507

    2024

  39. [39]

    Maofan Yin, Dahlia Malkhi, Michael K Reiter, Guy Golan Gueta, and Ittai Abraham. 2019. HotStuff: BFT consensus with linearity and responsiveness. InProceedings of the 2019 ACM Symposium on Principles of Distributed Computing. 347–356. A Carnot 1: analysis in the standard model Throughout this section, we assume𝑛≥ 4𝑓+ 1, and we consider the standard model ...

    2019