Skip to content
Blockchain LabBlockchain LabTHE VENTURE STUDIO

LibraryConsensus2019Design paperCorpus record

HotStuff: BFT Consensus in the Lens of Blockchain

HotStuff. Maofan Yin, Dahlia Malkhi, Michael K. Reiter, Guy Golan Gueta and Ittai Abraham.

A three-phase BFT protocol whose communication is linear in the number of replicas, because a leader collects a threshold signature instead of everyone talking to everyone. Diem used a variant. The paper is not that network.

HotStuff commits a block once three successive quorum certificates build on it. A leader collects a threshold signature, so the cost grows linearly with the number of replicas, and a view change uses the same shape as an ordinary proposal.
Evidence
Primary paper
Re-measured
No
Assumptions
4
Records linked
6

Code

Source, repository, and what is actually hosted

  • arXiv:1803.05069https://arxiv.org/abs/1803.05069
  • The source URL is not a GitHub repository. No code remote is invented.
  • Full text is not mirrored. Public availability is not a licence to copy the file onto this site.
  • Add to a reading list

01 Claim ledger

What the paper is allowed to say

Each row is a sentence already in the study. The status is the same on every row: a model claim, not a live measurement.

  1. Claim 01 · Paper model

    Linear, because of the leader

    Replicas send votes to the leader, not to each other. The leader broadcasts one certificate. Without threshold signatures the vote is still linear inbound, and the certificate stops being small.

  2. Claim 02 · Paper model

    Three certificates

    In the pipelined protocol a block rides under the next leaders' certificates. Commit is not a single round of applause. A diagram with one vote is a different protocol.

  3. Claim 03 · Paper model

    View change looks ordinary

    The next leader speaks only if they carry the highest certificate. There is no separate mesh of blame messages. That is the practical difference from PBFT.

  4. Claim 04 · Paper model

    Responsiveness has a definition

    After the network is stable, a correct leader can finish as fast as messages travel. It does not mean a silent leader is replaced instantly. The timeout is still there.

02 Three cuts

Observation, model, falsifier

A desk does not stop at the summary. Each claim is cut three ways, using only this study's own assumptions and checks. Nothing here is a new figure.

  1. 01 Linear, because of the leader

    Observation

    What the study says

    Replicas send votes to the leader, not to each other. The leader broadcasts one certificate. Without threshold signatures the vote is still linear inbound, and the certificate stops being small.

    Model

    What has to hold

    Threshold signatures work, if the small-certificate claim is in play. A broken ceremony breaks the certificate.

    Falsifier

    What would retire it

    Is there a quorum certificate, and who aggregates it?

  2. 02 Three certificates

    Observation

    What the study says

    In the pipelined protocol a block rides under the next leaders' certificates. Commit is not a single round of applause. A diagram with one vote is a different protocol.

    Model

    What has to hold

    Leaders eventually rotate to an honest replica. A fixed corrupt leader is a liveness failure.

    Falsifier

    What would retire it

    How many successive certificates commit a block?

  3. 03 View change looks ordinary

    Observation

    What the study says

    The next leader speaks only if they carry the highest certificate. There is no separate mesh of blame messages. That is the practical difference from PBFT.

    Model

    What has to hold

    Threshold signatures work, if the small-certificate claim is in play. A broken ceremony breaks the certificate.

    Falsifier

    What would retire it

    Is there a quorum certificate, and who aggregates it?

  4. 04 Responsiveness has a definition

    Observation

    What the study says

    After the network is stable, a correct leader can finish as fast as messages travel. It does not mean a silent leader is replaced instantly. The timeout is still there.

    Model

    What has to hold

    After an unknown delay, messages between honest replicas arrive within a bound. That is partial synchrony.

    Falsifier

    What would retire it

    Is there a quorum certificate, and who aggregates it?

03 Sequence

One action, as an operating tape

  1. 01A leader proposes a block that extends the highest quorum certificate it knows.
  2. 02Replicas vote. The leader assembles a certificate and the next phase begins, often as the next block.
  3. 03A block that has three certificates on its chain commits.
  4. 04If the leader fails, replicas timeout and the next leader proposes, carrying the highest certificate they have seen.
  5. 05A client that needs finality waits for the commit certificate, not for the proposal.

04 Load-bearing

The argument, and where a pitch drops it

  1. The leader is the product problem

    The cut

    Linearity is purchased by giving one replica the microphone. That replica can omit transactions until the view changes. Any HotStuff deployment is a statement about how often leaders rotate and who pays them.

    Why it carries weight

    If this cut is skipped, the paper's name is being used without the mechanism that makes the name mean anything.

    Where it is dropped

    A known replica set is assumed. Stake-weighted election is extra machinery.

  2. Diem was a variant

    The cut

    The Libra/Diem chain used a HotStuff-family protocol with its own pacing and signature scheme. The academic paper does not describe Diem's validator politics, and Diem's shutdown does not refute the paper.

    Why it carries weight

    If this cut is skipped, the paper's name is being used without the mechanism that makes the name mean anything.

    Where it is dropped

    Diem, Aptos, and later chains changed parameters and networking. Cite the paper or cite the chain.

05 Register

What has to be true

  • Stake and threshold · Not re-measured

    Fewer than one third of replicas are Byzantine.

  • Network · Not re-measured

    After an unknown delay, messages between honest replicas arrive within a bound. That is partial synchrony.

  • Stake and threshold · Not re-measured

    Threshold signatures work, if the small-certificate claim is in play. A broken ceremony breaks the certificate.

  • Adversary · Not re-measured

    Leaders eventually rotate to an honest replica. A fixed corrupt leader is a liveness failure.

06 Divergence

What happened after the paper

Aptos, Diem, and other chains shipped HotStuff variants with different pacing, batching, and signature tools. Narwhal later argued that the leader should order certificates of data, not the data itself. Cite HotStuff for the three-phase linear commit, and cite the chain for everything it changed.

A later client, parameter set, or reward formula is a different object. Cite this paper for the mechanism. Cite a primary release for the network. This desk has not re-run the proof.

07 Pre-mortem

What to check before you use the idea

  5. 0 of 4 marked on this browser. A mark is a reading note, not a pass, a rating, or a recommendation.

08 Anatomy

The paper, in the order a builder needs

The problem it names

PBFT's view change is expensive. HotStuff wants a view change that looks like the ordinary case, and a commit rule that stays responsive once messages are flowing.

What the design proposes

  • Prepare, pre-commit, commit, pipelined so one phase can serve the next block.
  • A leader aggregates votes into a quorum certificate.
  • The next leader needs that certificate, not a mesh of complaints.

How the mechanism is specified

  • A block commits when three successive quorum certificates build on it, in the pipelined presentation.
  • Linearity assumes a threshold signature. Without it, the leader still receives a linear number of votes, but the certificate is fat.
  • Responsiveness means the protocol moves at network speed after the network has settled, not that a leader cannot stall.

What this page does not treat as proven

  • The leader is still a choke point for censorship during their turn.
  • A known replica set is assumed. Stake-weighted election is extra machinery.
  • Diem, Aptos, and later chains changed parameters and networking. Cite the paper or cite the chain.

Why the desk still reads it

If a team says HotStuff, ask to see the quorum certificate and the view change. If the diagram is a complete graph of voters, it is a different protocol.

09 Lexicon

Terms, opened into the record

Quorum certificate
A threshold signature, or an equivalent set of votes, that a quorum accepted a block.
Pipelining
Using the vote for the next block as one of the phases for the previous block.

10 Repository

Every linked record on this page

Underlined words open a page that already exists: a concept, a protocol profile, a failure record, or another paper. If a word is not underlined, this desk does not have a record for it.

Failures

This is Blockchain Lab's reading of a public design paper. It is not the paper, not a copy of it, and not an offer of tokens, equity, custody or a partnership. Later network behaviour can diverge from the text. Nothing here is investment, legal or technical advice.

Research status: Design paper. Last reviewed: 1 October 2026. This is a reading of a public paper, not investment, legal or security advice.