Concept
Consensus and finality
How a validator committee certifies cuts, what makes a cut final, how the committee is chosen each epoch and what finality relies on.
On this page
Finality in Tenrai comes from signatures, not from accumulated work. A committee of validators votes on each cut, and a cut with enough votes is final at once.
Cuts
A cut has a height. It registers the work blocks that arrived inside their registration window, executes earlier registered blocks in a fixed order, and commits to the resulting state. The target interval is 2.5 seconds.
Everything before a cut is local and advisory: transactions in a mempool, work blocks a node holds. Balances, outputs, stake and transaction outcomes change only when a cut executes them.
Certificates
Committee members sign a vote for the cut with ML-DSA-65. A certificate is the vote plus the signatures that back it.
| Quorum | Just over two thirds of all eligible stake |
|---|---|
| Committee | The 64 eligible validators with the most stake |
| Coverage | The committee must hold at least 80 % of all eligible stake |
| Certificate size | About 175 to 207 KiB with 64 members |
A certified cut is final. Nodes never roll one back, and there are no reorganizations to follow. Two conflicting cuts at one height would need more than a third of the eligible stake to sign both, and signing both is provable.
The committee
Validators register with a self-bond and collect delegations. A validator's weight is its bonded stake, own and delegated together.
- At each epoch boundary the eligible validators are sorted by weight, and the top 64 form the committee. An epoch is one day: 34,560 cuts.
- Selection is deterministic. There is no random sampling and no rotation within an epoch.
- A member that stops signing is not replaced until the next epoch.
- A validator's node publishes a heartbeat transaction once per epoch. A validator without a final heartbeat in the last two epochs carries no weight in the next committee.
- A new validator can join a committee from the second epoch after its registration.
Attendance and rewards
A heartbeat keeps a validator eligible for the committee; it does not earn anything. Rewards follow attendance, which the chain reads only from the signatures in finalized cut certificates, so every node arrives at the same record. Each epoch is split into twelve equal windows, and a committee member qualifies for the epoch's staking rewards only if it signed in at least nine of them. A member that misses this is jailed for the next two epochs.
When no new committee can form
If the next committee would miss the coverage or quorum requirement, the sitting committee stays in office for another epoch and the chain keeps running. Stake that asked to exit stays bonded and slashable for as long as the committee it secures is still voting.
Liveness
The quorum is measured against all eligible stake, not only against the committee. At the 80 % coverage floor, the committee needs about 83 % of its own weight to sign, so progress stalls once roughly 17 % of committee weight is offline. The closer the committee comes to holding all eligible stake, the closer that tolerance moves to one third.
When the committee cannot reach a quorum, no cut is certified. Nothing final is lost; the chain waits. Mining continues on the last anchor, but an anchor takes at most 250 blocks, so most work found during a long stall earns nothing.
Misbehaviour
Signing two different votes for the same height is equivocation. The two signatures are proof, and a transaction can carry them as evidence. When a cut executes valid evidence, the validator is removed, its self-bond is burned, and every delegation that can still be slashed loses 10 % and unbonds with the rest. Downtime and missed attendance are never slashed.
What finality relies on
- Finality rests on more than two thirds of the eligible stake signing honestly. Proof of work does not add to it.
- A new committee forms only while its 64 members hold at least 80 % of all eligible stake.