LibraryConsensus2014Design paperCorpus record
Tendermint: Consensus without Mining
Tendermint. Jae Kwon.
A practical Byzantine-fault-tolerant state machine for a known validator set, with instant finality on commit. It became the consensus engine under Cosmos SDK chains. The 2014 note is the origin, not the current CometBFT specification.
Tendermint runs a round of propose, prevote and precommit among a known weighted set. If more than two thirds prevote and precommit the same block, the block is final. It does not get unfinalised by a longer fork.
- Evidence
- Primary paper
- Re-measured
- No
- Assumptions
- 4
- Records linked
- 11
Code
Source, repository, and what is actually hosted
- Tendermint repositoryhttps://github.com/tendermint/tendermint
- tendermint/tendermintRepository taken from the source URL. No other study cites this repository. This is not an audit.
- Full text is not mirrored. Public availability is not a licence to copy the file onto this site.
- Add to a reading list
01 Claim ledger
What the paper is allowed to say
Each row is a sentence already in the study. The status is the same on every row: a model claim, not a live measurement.
Claim 01 · Paper model
The validator set is known
This is a Byzantine protocol for a named set with voting power. It is not a protocol that discovers its peers from proof of work. Membership changes are themselves a protocol step.
Claim 02 · Paper model
Two rounds of voting, not one
A prevote says the block is acceptable. A precommit says the voter is ready to commit. Splitting them is how the protocol avoids locking onto a value the rest of the set will abandon.
Claim 03 · Paper model
Two thirds plus one is the quorum
Safety needs more than two thirds of the voting power to be honest. A smaller quorum would let two quorums decide two blocks. The fraction is the design.
Claim 04 · Paper model
Finality means final
Once a block is committed, a later round does not reorg it. An application can act on the block. The cost of that promise is that the chain halts if the quorum goes offline.
Claim 05 · Paper model
The paper is the consensus core
Cosmos, the application framework, and interchain packets came around this core. Tendermint does not by itself move a token from one chain to another.
02 Three cuts
Observation, model, falsifier
A desk does not stop at the summary. Each claim is cut three ways, using only this study's own assumptions and checks. Nothing here is a new figure.
01 The validator set is known
Observation
What the study says
This is a Byzantine protocol for a named set with voting power. It is not a protocol that discovers its peers from proof of work. Membership changes are themselves a protocol step.
Model
What has to hold
Voting power is delegated to a set small enough to gossip votes. A million equal voters is outside the design.
Falsifier
What would retire it
How many validators are in the set, and how is voting power distributed among them?
02 Two rounds of voting, not one
Observation
What the study says
A prevote says the block is acceptable. A precommit says the voter is ready to commit. Splitting them is how the protocol avoids locking onto a value the rest of the set will abandon.
Model
What has to hold
Voting power is delegated to a set small enough to gossip votes. A million equal voters is outside the design.
Falsifier
What would retire it
Does the application wait for a commit, or for a block that can still be reorged?
03 Two thirds plus one is the quorum
Observation
What the study says
Safety needs more than two thirds of the voting power to be honest. A smaller quorum would let two quorums decide two blocks. The fraction is the design.
Model
What has to hold
Voting power is delegated to a set small enough to gossip votes. A million equal voters is outside the design.
Falsifier
What would retire it
How many validators are in the set, and how is voting power distributed among them?
04 Finality means final
Observation
What the study says
Once a block is committed, a later round does not reorg it. An application can act on the block. The cost of that promise is that the chain halts if the quorum goes offline.
Model
What has to hold
Clocks are roughly synchronised for round timeouts. Safety does not depend on clocks. Liveness does.
Falsifier
What would retire it
Does the application wait for a commit, or for a block that can still be reorged?
05 The paper is the consensus core
Observation
What the study says
Cosmos, the application framework, and interchain packets came around this core. Tendermint does not by itself move a token from one chain to another.
Model
What has to hold
The application defining validity is deterministic. A non-deterministic check splits the set.
Falsifier
What would retire it
Does the application wait for a commit, or for a block that can still be reorged?
03 Sequence
One action, as an operating tape
- 01A proposer for the round broadcasts a block.
- 02Validators broadcast prevotes for that block, or for nil if the proposal is missing or invalid.
- 03Each validator waits until it has seen prevotes from more than two thirds of the power.
- 04It then broadcasts a precommit. If more than two thirds precommit the same block, the node commits and moves to the next height.
- 05If the round fails, the protocol moves to a new round with a new proposer, under timeout rules that the paper specifies.
04 Load-bearing
The argument, and where a pitch drops it
Safety and liveness are traded in public
The cut
A chain that never reorgs must sometimes stop. Tendermint chooses that trade and writes it down. A product page that promises both instant finality and progress through arbitrary partitions is promising two protocols.
Why it carries weight
If this cut is skipped, the paper's name is being used without the mechanism that makes the name mean anything.
Where it is dropped
Finality is only as good as the assumption that less than one third of voting power equivocates.
Nil votes are doing real work
The cut
A validator who prevotes nil is not abstaining out of politeness. Nil is how a round is allowed to end when the proposer failed. Removing nil, or treating silence as a yes, breaks the round structure.
Why it carries weight
If this cut is skipped, the paper's name is being used without the mechanism that makes the name mean anything.
Where it is dropped
A named validator set is a governance object. The paper does not tell a venture who should hold the keys.
Accountability is the forensic claim
The cut
If two quorums ever commit two blocks, a large set of validators must have signed both. The paper treats those signatures as evidence. That only matters if the application has a political or legal place to take the evidence. The protocol does not punish by itself.
Why it carries weight
If this cut is skipped, the paper's name is being used without the mechanism that makes the name mean anything.
Where it is dropped
A named validator set is a governance object. The paper does not tell a venture who should hold the keys.
05 Register
What has to be true
Model · Not re-measured
Voting power is delegated to a set small enough to gossip votes. A million equal voters is outside the design.
Adversary · Not re-measured
More than two thirds of the power is honest and can talk to each other within the timeouts.
Network · Not re-measured
Clocks are roughly synchronised for round timeouts. Safety does not depend on clocks. Liveness does.
Model · Not re-measured
The application defining validity is deterministic. A non-deterministic check splits the set.
06 Divergence
What happened after the paper
CometBFT and the Cosmos stack carried this core into production, with evidence handling, light clients and later proposer-based timestamps. Those are descendants. The 2014 paper is still the clean statement of the three-phase round and the two-thirds quorum.
A later client, parameter set, or reward formula is a different object. Cite this paper for the mechanism. Cite a primary release for the network. This desk has not re-run the proof.
07 Pre-mortem
What to check before you use the idea
- 0 of 4 marked on this browser. A mark is a reading note, not a pass, a rating, or a recommendation.
08 Anatomy
The paper, in the order a builder needs
The problem it names
Proof-of-work chains confirm by depth. Application builders still have to decide how many blocks is 'enough', and reorgs remain possible. Tendermint treats a block that received a supermajority of precommits as final.
What the design proposes
- Validators are known for the round. Voting weight is assigned, not discovered by hashing.
- Rounds move through proposal, prevote and precommit. A lock rule stops a validator equivocating across values.
- Accountability: if safety breaks, evidence of double-signing can be shown.
How the mechanism is specified
- The protocol assumes partial synchrony for liveness and a bound on faulty voting power for safety.
- Applications sit above the engine. They do not invent their own fork choice.
- Membership changes are a protocol concern of their own. The note does not make an open set of anonymous miners.
What this page does not treat as proven
Why the desk still reads it
This is the right reference when a consortium or a zone needs a final vote rather than a probabilistic chain. It is the wrong reference if the venture cannot name who is allowed to sign.
09 Lexicon
Terms, opened into the record
- Prevote
- A signed statement that a proposed block is acceptable, before the validator locks in.
- Precommit
- A signed statement that the validator will commit the block if a quorum agrees.
- Commit
- The point at which more than two thirds have precommitted one block. The block is final.
- Voting power
- The weight of a validator. Quorums are measured in power, not in headcount.
10 Repository
Every linked record on this page
Underlined words open a page that already exists: a concept, a protocol profile, a failure record, or another paper. If a word is not underlined, this desk does not have a record for it.
This is Blockchain Lab's reading of a public design paper. It is not the paper, not a copy of it, and not an offer of tokens, equity, custody or a partnership. Later network behaviour can diverge from the text. Nothing here is investment, legal or technical advice.
Research status: Design paper. Last reviewed: 1 October 2026. This is a reading of a public paper, not investment, legal or security advice.