Skip to content
Blockchain LabBlockchain LabTHE VENTURE STUDIO

LibraryConsensus2022Design paperCorpus record

Narwhal and Tusk: A DAG-based Mempool and Efficient BFT Consensus

Narwhal and Tusk. George Danezis, Lefteris Kokoris-Kogias, Alberto Sonnino and Alexander Spiegelman.

Split the mempool from the consensus. Narwhal is a DAG of certified batches. Tusk picks a leader inside that DAG. Later Sui consensus descends from this split. The paper is not a Sui status report.

Narwhal certifies batches of transactions in a DAG before anyone orders them. Tusk then picks an anchor in that DAG. Consensus messages stay small because the bytes were already witnessed.
Evidence
Primary paper
Re-measured
No
Assumptions
4
Records linked
7

Code

Source, repository, and what is actually hosted

  • arXiv:2105.11827https://arxiv.org/abs/2105.11827
  • The source URL is not a GitHub repository. No code remote is invented.
  • Full text is not mirrored. Public availability is not a licence to copy the file onto this site.
  • Add to a reading list

01 Claim ledger

What the paper is allowed to say

Each row is a sentence already in the study. The status is the same on every row: a model claim, not a live measurement.

  1. Claim 01 · Paper model

    The mempool is the DAG

    Validators keep publishing batches that point at earlier batches. A quorum signs a certificate that the batch is stored. The certificate, not the batch, is what consensus has to talk about.

  2. Claim 02 · Paper model

    Fetch from any signer

    If the author goes quiet, a node that holds the certificate can ask another signer for the bytes. Availability is a quorum property, not a favour from the leader.

  3. Claim 03 · Paper model

    Tusk commits an anchor

    A random coin selects which certified block is the anchor of a round. The commit walks the causal history of that anchor. The coin is there so a bad leader cannot freeze the choice.

  4. Claim 04 · Paper model

    Later systems split again

    Bullshark replaces the coin with a different commit. Sui's production consensus moved further. The paper is the separation of data and order, not those clients.

02 Three cuts

Observation, model, falsifier

A desk does not stop at the summary. Each claim is cut three ways, using only this study's own assumptions and checks. Nothing here is a new figure.

  1. 01 The mempool is the DAG

    Observation

    What the study says

    Validators keep publishing batches that point at earlier batches. A quorum signs a certificate that the batch is stored. The certificate, not the batch, is what consensus has to talk about.

    Model

    What has to hold

    A quorum of validators stores what they sign and will serve it later.

    Falsifier

    What would retire it

    Are consensus messages certificates or full blocks?

  2. 02 Fetch from any signer

    Observation

    What the study says

    If the author goes quiet, a node that holds the certificate can ask another signer for the bytes. Availability is a quorum property, not a favour from the leader.

    Model

    What has to hold

    Nodes actually fetch missing batches. A certificate without a fetch path is a pointer into a void.

    Falsifier

    What would retire it

    Who will serve the bytes if the author is offline?

  3. 03 Tusk commits an anchor

    Observation

    What the study says

    A random coin selects which certified block is the anchor of a round. The commit walks the causal history of that anchor. The coin is there so a bad leader cannot freeze the choice.

    Model

    What has to hold

    Fewer than one third are Byzantine, so certificates cannot be forged and unavailable batches cannot both be certified and withheld from all honest nodes.

    Falsifier

    What would retire it

    How is the anchor chosen, and can a leader grind it?

  4. 04 Later systems split again

    Observation

    What the study says

    Bullshark replaces the coin with a different commit. Sui's production consensus moved further. The paper is the separation of data and order, not those clients.

    Model

    What has to hold

    A quorum of validators stores what they sign and will serve it later.

    Falsifier

    What would retire it

    Which later commit rule does the live system actually run?

03 Sequence

One action, as an operating tape

  1. 01A validator packs transactions into a batch, includes hashes of earlier certificates, and asks peers to sign.
  2. 02A certificate forms when a quorum has signed. The batch is now referenced by a small object.
  3. 03Validators stream certificates to each other and keep the DAG.
  4. 04Tusk uses shared randomness to pick an anchor among certified blocks of a round.
  5. 05The ordered log is the causal past of successive anchors, with duplicates removed.

04 Load-bearing

The argument, and where a pitch drops it

  1. Throughput was stuck behind the leader's bandwidth

    The cut

    HotStuff-style leaders were re-shipping the block. Narwhal's claim is that once a quorum has stored the batch, ordering it is a metadata problem. A system that still puts the full block inside the consensus vote has not taken the split.

    Why it carries weight

    If this cut is skipped, the paper's name is being used without the mechanism that makes the name mean anything.

    Where it is dropped

    The mempool can still be censored by a quorum that refuses to sign a validator's batches.

  2. Certificates are not execution

    The cut

    A certified batch can still contain a transaction the application will reject. The DAG proves the bytes were available to the quorum. Interpretation is later.

    Why it carries weight

    If this cut is skipped, the paper's name is being used without the mechanism that makes the name mean anything.

    Where it is dropped

    A certificate proves availability to the quorum that signed. It does not prove every full node has the bytes yet.

05 Register

What has to be true

  • Stake and threshold · Not re-measured

    A quorum of validators stores what they sign and will serve it later.

  • Stake and threshold · Not re-measured

    Fewer than one third are Byzantine, so certificates cannot be forged and unavailable batches cannot both be certified and withheld from all honest nodes.

  • Cryptography · Not re-measured

    The random coin is unpredictable to the adversary before the round is fixed. A grindable coin restores leader control.

  • Model · Not re-measured

    Nodes actually fetch missing batches. A certificate without a fetch path is a pointer into a void.

06 Divergence

What happened after the paper

The Narwhal mempool and the Tusk commit rule were implemented in research prototypes and then revised. Sui in particular moved through Bullshark and later Mysticeti. When a team says Narwhal, ask whether they mean the certified DAG, the random-coin commit, or a descendant that kept only the DAG.

A later client, parameter set, or reward formula is a different object. Cite this paper for the mechanism. Cite a primary release for the network. This desk has not re-run the proof.

07 Pre-mortem

What to check before you use the idea

  5. 0 of 4 marked on this browser. A mark is a reading note, not a pass, a rating, or a recommendation.

08 Anatomy

The paper, in the order a builder needs

The problem it names

Classic BFT leaders re-send the bulk data. Narwhal's claim is that availability of batches can be certified by quorum before anyone orders them, so consensus messages stay small.

What the design proposes

  • Each validator publishes batches that reference earlier batches, and collects a certificate.
  • A missing batch can be fetched from any replica that signed, not only the author.
  • Consensus then orders certificates, not raw transactions.

How the mechanism is specified

  • The DAG already contains the causal history. A commit walks that history.
  • Throughput scales with how fast certificates can be stored and fetched.
  • Tusk uses a random coin so the commit does not wait on a leader timeout in the same way HotStuff does.

What this page does not treat as proven

  • A certificate proves availability to the quorum that signed. It does not prove every full node has the bytes yet.
  • Bullshark, Mysticeti, and production Sui changed the commit rule. Do not describe them as this PDF.
  • The mempool can still be censored by a quorum that refuses to sign a validator's batches.

Why the desk still reads it

When someone shows a DAG consensus diagram, ask whether the data plane and the ordering plane are actually separate, and who you call when a certificate points at bytes you cannot fetch.

09 Lexicon

Terms, opened into the record

Certificate
A quorum signature on a batch, used as a name for bytes that are supposed to be stored.
Anchor
The certified block a round commits. Its causal history is what gets ordered.

10 Repository

Every linked record on this page

Underlined words open a page that already exists: a concept, a protocol profile, a failure record, or another paper. If a word is not underlined, this desk does not have a record for it.

This is Blockchain Lab's reading of a public design paper. It is not the paper, not a copy of it, and not an offer of tokens, equity, custody or a partnership. Later network behaviour can diverge from the text. Nothing here is investment, legal or technical advice.

Research status: Design paper. Last reviewed: 1 October 2026. This is a reading of a public paper, not investment, legal or security advice.