LibraryConsensus2014Design paperCorpus record
Tezos — a self-amending crypto-ledger
Tezos. L.M. Goodman.
Goodman's proposal for a ledger whose protocol can be amended by a defined on-ledger process, with stakeholders who bake blocks and who may delegate.
Tezos treats the rules of the ledger, including the rules for changing the rules, as something the stakeholders can amend on-chain, with a delay long enough to exit.
- Evidence
- Primary paper
- Re-measured
- No
- Assumptions
- 4
- Records linked
- 6
Code
Source, repository, and what is actually hosted
- tezos.com white paperhttps://tezos.com/whitepaper.pdf
- The source URL is not a GitHub repository. No code remote is invented.
- Full text is not mirrored. Public availability is not a licence to copy the file onto this site.
- Add to a reading list
01 Claim ledger
What the paper is allowed to say
Each row is a sentence already in the study. The status is the same on every row: a model claim, not a live measurement.
Claim 01 · Paper model
The amendment is the feature
Most chains upgrade by a software flag day coordinated off to the side. Tezos proposes that a proposal, a vote, a test period and an adoption period are protocol steps.
Claim 02 · Paper model
Stakeholders vote, and bakers represent them
The paper's electorate is stake, exercised by delegates called bakers. A vote is not a poll of wallet downloads.
Claim 03 · Paper model
Time is a safety rail
Adoption is delayed on purpose. Someone who dislikes an amendment is supposed to have time to sell, fork, or leave before the rule binds them.
Claim 04 · Paper model
The seed protocol still has to be a chain
Self-amendment does not replace consensus. The paper also sketches a proof-of-stake block production story. Later Tenderbake and other revisions replaced that sketch.
Claim 05 · Paper model
Formal verification is a stated ambition
The paper wants the protocol, and contracts, to be amenable to proofs. That is a research programme sitting beside the voting mechanism, not a theorem that every later amendment is safe.
02 Three cuts
Observation, model, falsifier
A desk does not stop at the summary. Each claim is cut three ways, using only this study's own assumptions and checks. Nothing here is a new figure.
01 The amendment is the feature
Observation
What the study says
Most chains upgrade by a software flag day coordinated off to the side. Tezos proposes that a proposal, a vote, a test period and an adoption period are protocol steps.
Model
What has to hold
Voters can obtain and review the protocol code behind a proposal hash. A vote on an unseen blob is only a vote on a blob.
02 Stakeholders vote, and bakers represent them
Observation
What the study says
The paper's electorate is stake, exercised by delegates called bakers. A vote is not a poll of wallet downloads.
Model
What has to hold
Most stake that bothers to vote is not captured, and quorum rules are high enough to mean something.
Falsifier
What would retire it
How long is the delay between a yes and the code becoming law?
03 Time is a safety rail
Observation
What the study says
Adoption is delayed on purpose. Someone who dislikes an amendment is supposed to have time to sell, fork, or leave before the rule binds them.
Model
What has to hold
Client software is updated before adoption. The chain cannot run code the node does not have.
04 The seed protocol still has to be a chain
Observation
What the study says
Self-amendment does not replace consensus. The paper also sketches a proof-of-stake block production story. Later Tenderbake and other revisions replaced that sketch.
Model
What has to hold
The testing period is long enough to reveal a broken amendment, and short enough that the network still bothers to wait.
Falsifier
What would retire it
Which consensus protocol is live now, as opposed to the one sketched in 2014?
05 Formal verification is a stated ambition
Observation
What the study says
The paper wants the protocol, and contracts, to be amenable to proofs. That is a research programme sitting beside the voting mechanism, not a theorem that every later amendment is safe.
Model
What has to hold
Voters can obtain and review the protocol code behind a proposal hash. A vote on an unseen blob is only a vote on a blob.
03 Sequence
One action, as an operating tape
- 01A baker submits a protocol amendment as a proposal hash.
- 02In the proposal period, stake-weighted votes select which proposal, if any, proceeds.
- 03A ballot period asks voters to accept or reject. The paper's thresholds are part of the design, not a default.
- 04A testing period runs the candidate so the network can watch it before it is sovereign.
- 05After the delay, the amendment becomes the protocol. Nodes that did not install the code simply stop understanding the chain.
04 Load-bearing
The argument, and where a pitch drops it
On-chain vote is not automatic legitimacy
The cut
A stake-weighted yes says that the bakers who showed up preferred this hash. It does not say the amendment is wise, that participation was broad, or that users read the diff. The paper's contribution is to make the procedure explicit. The political judgement stays outside.
Why it carries weight
If this cut is skipped, the paper's name is being used without the mechanism that makes the name mean anything.
Where it is dropped
The 2014 paper is not the current Tezos protocol hash.
The exit ramp is the moral core
The cut
The delay before adoption is what keeps an amendment from being a trap. If a later revision shortens that delay to the point that holders cannot react, the procedure has kept its name and dropped its protection.
Why it carries weight
If this cut is skipped, the paper's name is being used without the mechanism that makes the name mean anything.
Where it is dropped
Delegation creates representatives. The paper does not prove that representatives stay aligned with holders.
Delegation concentrates the electorate
The cut
Bakers exist so that small holders do not have to be online. They also mean a few operators cast most of the votes. Any reading of Tezos governance that counts bakers as if they were users is miscounting.
Why it carries weight
If this cut is skipped, the paper's name is being used without the mechanism that makes the name mean anything.
Where it is dropped
The 2014 paper is not the current Tezos protocol hash.
05 Register
What has to be true
Stake and threshold · Not re-measured
Most stake that bothers to vote is not captured, and quorum rules are high enough to mean something.
Cryptography · Not re-measured
Voters can obtain and review the protocol code behind a proposal hash. A vote on an unseen blob is only a vote on a blob.
Network · Not re-measured
The testing period is long enough to reveal a broken amendment, and short enough that the network still bothers to wait.
Model · Not re-measured
Client software is updated before adoption. The chain cannot run code the node does not have.
06 Divergence
What happened after the paper
Tezos adopted a series of amendments through this procedure, and replaced its original consensus sketch with Tenderbake, a Byzantine fault tolerant finality layer. The 2014 paper predicts the existence of that kind of change. It does not describe Tenderbake.
A later client, parameter set, or reward formula is a different object. Cite this paper for the mechanism. Cite a primary release for the network. This desk has not re-run the proof.
07 Pre-mortem
What to check before you use the idea
- 0 of 4 marked on this browser. A mark is a reading note, not a pass, a rating, or a recommendation.
08 Anatomy
The paper, in the order a builder needs
The problem it names
Forks that change the rules are political events coordinated off to the side. Tezos argues that the procedure for adopting a protocol change should itself be a protocol, so the ledger has a stated way to replace its own code.
What the design proposes
- A shell distinguishes the consensus-relevant protocol from the governance process that can swap it.
- Baking is the block production role. Delegation lets a holder assign rights without transferring ownership.
- Formal specification is part of the pitch: amendments should be arguments about a mathematical object, not only about a client repository.
How the mechanism is specified
- Stakeholders vote through a series of periods. The paper's process and the live governance process should not be assumed identical.
- Security deposits and penalties are how the design makes baking expensive to abuse.
- Self-amendment does not mean every social dispute fits in a vote. It means the rule-change path is explicit.
What this page does not treat as proven
- The 2014 paper is not the current Tezos protocol hash.
- Delegation creates representatives. The paper does not prove that representatives stay aligned with holders.
- Formal methods reduce a class of bugs. They do not replace key management or an honest specification.
Why the desk still reads it
A venture that expects to change settlement rules after launch should show the amendment path before the first version, not after the first argument. That is the part worth taking from Tezos.
09 Lexicon
Terms, opened into the record
- Self-amendment
- A protocol rule for replacing the protocol, including the voting rule itself, by an on-chain procedure.
- Baker
- A delegate who produces blocks and votes with stake assigned to them.
- Proposal hash
- The identifier of an amendment. The vote is about this identifier. The code is what it points at.
- Adoption delay
- The waiting period after a successful vote, meant to let dissenters leave before the new rule binds.
10 Repository
Every linked record on this page
Underlined words open a page that already exists: a concept, a protocol profile, a failure record, or another paper. If a word is not underlined, this desk does not have a record for it.
This is Blockchain Lab's reading of a public design paper. It is not the paper, not a copy of it, and not an offer of tokens, equity, custody or a partnership. Later network behaviour can diverge from the text. Nothing here is investment, legal or technical advice.
Research status: Design paper. Last reviewed: 1 October 2026. This is a reading of a public paper, not investment, legal or security advice.