Snowman for partial synchrony

Aaron Buchwald; Andrew Lewis-Pye; Kevin Sekniqi; Stephen Buttolph

REVIEW 2 major objections 3 minor 1 cited by

Snowman for partial synchrony

T0 review · 2 major / 3 minor · reviewed 2026-08-10 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Snowman consensus stays safe under partial synchrony

desk verdict Real new result — a non-lockstep partial-synchrony consistency proof for Snowman — but the advertised 2e-5 error bound rests on a 5-rounds-per-second cap the protocol never enforces. read the letter →

arxiv 2501.15904 v3 pith:ZV33O2JY submitted 2025-01-27 cs.DC

Aaron Buchwald , Stephen Buttolph , Andrew Lewis-Pye , Kevin Sekniqi This is my paper · ORCID

classification cs.DC

keywords SnowmanprotocolAvalanchepartialsynchronyprobabilisticconsensusByzantinefaulttolerancestatemachinereplicationmetastability

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper claims that a modified version of Avalanche's Snowman protocol, called Snowman⋄, guarantees probabilistic consistency even when message delays are unbounded before an unknown global stabilization time and when correct processes run sampling rounds as fast as their local message delays allow. This removes two restrictions of the prior proof: synchrony and lockstep execution. The key change is a lock rule that makes a sufficiently strong sampled majority sticky, so the earlier 75%-threshold argument can be rebuilt without synchronized clocks. For at least 250 processes, fewer than one fifth of them Byzantine, and parameters $k=80$, $\alpha_1=41$, $\alpha_2=72$, $\beta=12$, the paper bounds the probability that any two correct processes finalize incompatible chains by about $2\times 10^{-5}$ under stated bounds on execution length and round rate. If correct, Snowman⋄ gives Avalanche-style low communication cost with a safety guarantee that holds through periods of asynchrony.

What carries the argument

The machinery is the lock/locktime state attached to each sampled value. In Snowflake⋄, the local variable $val$ is the current bit, $lock$ says whether the process has recently seen a strong sample ($\alpha_2$ out of $k$) of that bit, and $locktime$ records when it locked; responses report the value together with the duration for which it has been locked. A locked process can only switch color after sampling $\alpha_2$ responses reporting the opposite value locked for at least $2\Delta$. This replaces the lockstep assumption with an interval-based threshold: the protocol's statements $(\dagger^\diamond_0)$, $(\dagger^\diamond_1)$, and $(\dagger^\diamond_2)$ show that a 75% locked-on-red interval is absorbing and that any output implies such an interval existed. Snowman⋄ runs one Snowflake⋄ instance per bit of the hash chain, using the first disagreeing bit to choose between competing blocks, so the same lock machinery lifts to state machine replication.

What would settle it

Run Snowman⋄ with 250 processes and 49 Byzantine processes under partial synchrony, with adversarial message-delivery schedules that concentrate multiple sampling rounds within a small window while 75% of correct processes are locked on red. The paper's claim is that a locked process switches to blue with probability below $1.9\times 10^{-5}$ per such opportunity; a simulation that, across many independent opportunities, finds a higher frequency of unlocks and incompatible finalizations would refute the bound.

Watch

Extended reading notes

Core claim

The central discovery is that consistency for Snowman does not require synchrony or lockstep if the protocol makes its decision threshold sticky. In Snowflake⋄, the binary agreement layer underlying Snowman⋄, a process that samples at least $\alpha_2$ copies of its current color in a round locks onto that color; once locked, it only flips after a later sample reports at least $\alpha_2$ processes locked on the opposite color for at least $2\Delta$. Because sampled processes report how long they have been locked, a process can tell whether a response supports the claim that a large locked majority existed throughout a recent interval, even though clocks are not synchronized. The proof then mirrors the synchronous argument: if 75% of correct processes are locked on a value for an interval of length $2\Delta$, the locked set is stable forever (except with small probability), and no one can finalize the opposite value. Section 8 converts this into a probabilistic consistency guarantee for Snowman⋄: with $k=80$, $\alpha_1=41$, $\alpha_2=72$, $\beta=12$, at least 250 processes, and fewer than one fifth Byzantine, cumulative error below $2\times 10^{-5}$.

Load-bearing premise

The load-bearing assumption is the accounting bound under which the error probabilities are union-bounded: at most 10,000 processes running for at most 1,000 years at at most five sampling rounds per second, a cap the protocol itself does not enforce.

Editorial extensions

If this is right

If the proof is correct, Snowman⋄ remains safe during arbitrarily long periods of asynchrony before the global stabilization time, rather than only under reliable communication.
A correct process's finalized chain only grows over time, and no two correct processes can finalize chains that diverge, except with probability below $2\times 10^{-5}$ under the stated bounds.
The result tolerates any number of crash or omission failures alongside fewer than one fifth Byzantine processes, because the consistency argument does not rely on liveness of crashed processes.
With a known bound $\Delta^*$ on clock skew, the protocol can cut finalization latency by up to $2\Delta$; with an additional assumption that at most 10% of processes are Byzantine over a one-hour window, temporary finalization has reversion probability below $10^{-6}$.
Communication remains sampling based, so the expected per-participant cost stays constant in the common case, preserving the scalability property that motivated Snowman.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

The stated $2\times 10^{-5}$ bound is an accounting bound, not a protocol-invariant one: nothing in Snowman⋄ prevents a process from starting more than five rounds per second when delays are small, so a deployment that wants the bound should enforce a round pace or re-derive the union bound for faster rounds.
The lock-and-report-locktime mechanism is a general recipe for adding partial-synchrony safety to other metastable sampling protocols; one could try attaching the same $2\Delta$-lock semantics to DAG-based Avalanche or to FPC-BI-style voting.
A natural empirical check is to simulate Snowman⋄ around the global stabilization time with adversarial message schedules and measure how often the 75%-locked interval property fails; the paper predicts a rate below $1.9\times 10^{-5}$ for the stated parameters, which is testable even though the full 1000-year bound is not.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

The main contribution is real: a Snowman variant with an explicit lock/locktime mechanism, and a probabilistic consistency proof that works in partial synchrony without the lockstep assumption. The proof is the paper. The three-part structure around (†⋄0), (†⋄1), and (†⋄2) is clear, and the binomial accounting is consistent. The paper also does the right thing by focusing on consistency and leaving liveness to the Frosty module from the earlier paper. The citation pattern is fine; the self-citation to [9] is appropriate since this is explicitly an extension of that analysis.

The soft spot is the round-rate cap. Every union bound in Sections 6 and 8 assumes each process initiates at most 5 rounds per second. The protocol imposes no such limit. Algorithm 2's lines 36–47 and Algorithm 3's lines 44–45 start a new round as soon as the responses for the current round suffice, or after 2Δ. Once past GST, the adversary can arrange message delays well below Δ, so a correct process can initiate rounds far faster than 5/sec. The per-round failure probabilities are per round initiation, so the cumulative error scales with the actual rate. At 100 rounds/sec, the leading term alone is about 3.7e-4, twenty times the advertised 2e-5. The theorem, as stated, is conditional on an external bound the protocol does not enforce, and the abstract overstates what the proof gives.

This is fixable. Enforce a minimum spacing between rounds, or state the error bound as a function of the actual round rate. The rest of the proof is plausible and deserves a careful read. The Snowman⋄ section is compressed — it is an analogue of Section 6 rather than a fully expanded argument — but the mapping is reasonable, and Section 9's temporary-finality discussion is honest about its extra assumptions.

Who this is for: people working on leaderless BFT and Avalanche-style protocols. It is a serious paper with a genuine new result, and it should go to peer review. The round-rate gap needs to be addressed before publication, but it is not a reason to desk-reject.

Referee Report

2 major / 3 minor

Summary. This paper presents Snowflake⋄ and Snowman⋄, modifications of the Snowflake+ and Snowman protocols introduced in [9], and analyzes them in the partially synchronous setting without the lockstep assumption. Snowflake⋄ is a binary Byzantine agreement protocol in which processes sample k peers and update their value upon seeing α1 samples of the opposite color, and lock on a value upon seeing α2 samples of their present value; a lock can be broken only by α2 samples reporting the opposite color with a sufficiently long lock time. Snowman⋄ builds a state-machine-replication protocol from multiple Snowflake⋄ instances over the bits of block hashes. The main results are probabilistic agreement for Snowflake⋄ (Section 6) and probabilistic consistency for Snowman⋄ (Section 8): for t < n/5, n ≥ 250, k = 80, α1 = 41, α2 = 72, β = 12, the cumulative probability of inconsistency is bounded by approximately 2e-5, under the accounting assumption that at most 10,000 processes run for at most 1,000 years with each process initiating at most 5 rounds per second. The proofs proceed by establishing three invariants, namely (†⋄0), (†⋄1), and (†⋄2), via binomial tail bounds and union bounds over processes and rounds. Section 9 discusses optional mechanisms for quicker finality.

Significance. If the stated bounds hold, the paper is a meaningful step: it removes the synchronous lockstep restriction from the prior analysis of Snowman and provides explicit parameter values and concrete error probabilities for a partially synchronous setting. The proof technique is transparent: the key probabilistic facts are simple binomial calculations, and the protocol pseudocode is precise enough to check the round and response accounting. The paper also honestly identifies t < n/5 as a convenience assumption and refers to the Frosty module for liveness, so the contribution is sharply scoped to consistency. The main qualification is that the advertised 2e-5 error bound is conditional on a per-process round-rate cap that the protocol does not enforce; as written, the central theorem overstates what the proof establishes. With that gap repaired, either by enforcing the cap in the protocol or by stating the theorem conditionally, the paper would make a solid contribution to the rigorous analysis of the Snow family.

major comments (2)

[Sections 3.1, 6, 8; Algorithms 2 and 3] The advertised consistency error bound, under 2e-5 in Sections 6 and 8, is computed under the assumption that each process initiates at most 5 rounds per second, but the protocol does not enforce any such rate limit. Algorithm 2 (lines 36-48) and Algorithm 3 (lines 44-45) allow a correct process to start a new round as soon as the responses received so far suffice to determine the round value, or after a 2Δ timeout; in partial synchrony, once past GST the adversary can schedule message delays much smaller than Δ and correct processes can respond promptly, so a correct process can initiate rounds at rates arbitrarily higher than 5 per second. The per-round failure probabilities, such as 1.18e-20 for (†⋄0) and 0.0131^12 for (†⋄2), are per round initiation, so the cumulative error grows linearly with the number of initiations. At 100 rounds per second per process over 1000 years, the (†⋄0) contribution alone is about 3.7e-4, already exceeding the advertised 2e-5. The theorem statements at the starts of Sections 6 and 8 do not list a round-rate bound among their hypotheses. I recommend either adding a minimum spacing between round initiations to Algorithms 2 and 3 and proving the bound for that modified protocol, or explicitly stating the theorem as conditional on an environment-imposed execution bound and revising the abstract's claim that processes proceed 'at their own speed'.
[Section 8] The proof of consistency for Snowman⋄ is presented as a compressed analogue of the Snowflake⋄ argument, but it is the central theorem of the paper and needs to be spelled out at the same level of detail as Section 6. In particular, Part 3 states that consistency 'follows directly from (†⋄1) and (†⋄2)' after defining the strings Ξ_t and Ξ*_t, but it does not fully justify why the 'longest string' thresholds remain well-defined as the preferred prefix pref grows, how the lock and unlock conditions in Algorithm 3 (lines 15-19 and 35-41) preserve the invariants across the multiple Snowflake⋄ instances, or why the union bound in Part 2 remains valid when a process may initiate rounds at different rates for different parts of the hash chain. These steps are plausible and analogous to Section 6, but they are load-bearing for the paper's central claim and should be expanded so that a reader can verify the induction without reconstructing it.

minor comments (3)

[Sections 3.1 and 6] The '5 rounds per second' bound is introduced as an accounting assumption in the prose but is not named as a formal parameter. I recommend defining R_max explicitly and stating the final theorem as, for example, 'for any execution with at most R_max round initiations per process, the error probability is at most ...'.
[Section 8] The proof uses the symbols Ξ_t and Ξ*_t, whose subscript and superscript placement is easy to confuse in the typeset text; using distinct symbols such as A_t and B_t would improve readability.
[Section 9] The temporary-finality analysis assumes clocks synchronized to within Δ* but does not state whether Δ* is known to the processes or only to the analyst; this should be clarified.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity; the consistency proof is a self-contained probabilistic argument.

full rationale

The paper's derivation chain is internal and non-circular. Section 6 establishes probabilistic agreement for Snowflake-diamond by proving the predicates (†⋄0), (†⋄1), and (†⋄2) from binomial tail estimates and union bounds; these predicates are conclusions of the analysis, not assumptions. Section 8 adapts the same argument to Snowman-diamond consistency, and the final cumulative error bound is a sum of per-round probabilities times the stated execution-count bound. The protocol parameters k=80, alpha1=41, alpha2=72, beta=12 are fixed constants chosen for convenient binomial calculations, not fitted to the claimed result. The citation to [9] supplies background, the lockstep Snowflake+ analysis, and the Frosty liveness module, but the partial-synchrony consistency proof does not load-bearingly depend on [9]; Section 3.1 reproduces the relevant synchronous argument, and the new proof proceeds by its own binomial and union-bound calculations. The only notable weakness is that the 'at most 5 rounds per second' assumption in Section 2 is not enforced by Algorithms 2 or 3, so the advertised error bound applies only to executions satisfying that external cap. That is a gap between the theorem statement and the protocol's full execution set—a correctness risk, not a circular reduction. No equation, predicate, or parameter is defined in terms of the target consistency claim, and no fitted quantity is later relabeled as a prediction. Therefore no significant circularity is present.

Assumptions & free parameters 5 free parameters · 6 assumptions · 0 invented entities

No data fitting or fitted constants: protocol parameters are hand-picked for proof simplicity. The main uncharged input is the externally imposed execution bound on round rates; if it does not hold, the error bound grows. The paper also assumes constant-offset real-time clocks and standard cryptographic and network ideals.

free parameters (5)

k (sample size) = 80
Sample size fixed in the proof to make binomial calculations concrete; the paper states the result for k=80.
alpha1 (change-color threshold) = 41
Chosen just above k/2 to make Part 1 probability Bin(80,0.6,>=41) large enough.
alpha2 (lock and finality threshold) = 72
Chosen as 0.9k so that Bin(80,0.8,>=72) < 0.0131, giving the needed union-bound tail.
beta (consecutive support rounds) = 12
Chosen so that 0.0131^12 < 1e-22, which keeps the cumulative error below about 2e-7 in Part 2.
execution bounds for error accounting = 10000 processes, 1000 years, 5 rounds/s
Used in every union bound in Sections 6 and 8. These bounds are not enforced by the protocol instructions.

assumptions (6)

domain assumption Partial synchrony: known Delta, unknown GST, messages arrive by max(t,GST)+Delta
Standard model assumed in Section 2.
domain assumption At most t < n/5 Byzantine processes and n >= 250
Assumed in Sections 6 and 8 to make the binomial bounds simple.
domain assumption Correct process clocks proceed in real time, with constant offsets and no drift
Stated in Section 2; used to interpret locktime reports over real-time intervals.
domain assumption Perfect cryptographic schemes: authenticated point-to-point channels, PKI, collision-resistant hash
Section 2 restricts attention to executions where the adversary cannot break the cryptography.
domain assumption Sampling is uniform with replacement over all processes
Protocol specification; all probability calculations use the binomial distribution.
ad hoc to paper Each correct process initiates at most 5 rounds per second for at most 1000 years, with at most 10000 processes
Needed to union-bound small probabilities; not guaranteed by the protocol instructions.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Snowman for partial synchrony." pith.science (2026). https://pith.science/paper/ZV33O2JY

@misc{pith2026250115904,
  author       = {Pith},
  title        = {Pith review of: Snowman for partial synchrony},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/ZV33O2JY}},
  note         = {Machine review of arXiv:2501.15904}
}

read the original abstract

Snowman is the consensus protocol run by blockchains on Avalanche. Recent work established a rigorous proof of probabilistic consistency for Snowman in the \emph{synchronous} setting, under the simplifying assumption that correct processes execute sampling rounds in `lockstep'. In this paper, we describe a modification of the protocol that ensures consistency in the \emph{partially synchronous} setting, and when correct processes carry out successive sampling rounds at their own speed, with the time between sampling rounds determined by local message delays.

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

Frosty for partial synchrony
cs.DC 2025-06 conditional novelty 4.0 of 10

Frosty is extended from synchronous Snowman to partially synchronous Snowman diamond by using Simplex during fallback epochs and adding starting certificates that preserve finalized values across epochs.

Reference graph

Works this paper leans on

30 extracted references · 27 canonical work pages · cited by 1 Pith paper

[9]

Frosty: Bringing strong liveness guarantees to the snow family of consensus protocols

Aaron Buchwald, Stephen Buttolph, Andrew Lewis-Pye, Patr ick O’Grady, and Kevin Sekniqi. Frosty: Bringing strong liveness guarantees to the snow family of consensus protocols. arXiv preprint arXiv:2404.14250, 2024

arXiv 2024
[1]

An Analysis of Avalanche Consensus

Ignacio Amores-Sesar, Christian Cachin, and Philipp Schneider. An a nalysis of avalanche consensus. arXiv preprint arXiv:2401.02811, 2024

work page Pith review arXiv 2024
[2]

When is Spring coming? A Security Analysis of Avalanche Consensus

Ignacio Amores-Sesar, Christian Cachin, and Enrico Tedeschi. When is spring coming? a security analysis of avalanche consensus. arXiv preprint arXiv:2210.03423, 2022

work page Pith review arXiv 2022
[3]

Prism: Deconstructing the blockchain to approach physical limits

Vivek Bagaria, Sreeram Kannan, David Tse, Giulia Fanti, and Pramod Vis wanath. Prism: Deconstructing the blockchain to approach physical limits. In Proceedings of the 2019 ACM SIGSAC Conference on Computer an d Commu- nications Security, pages 585–602, 2019

work page 2019
[4]

Digital m orphogenesis via schelling segregation

George Barmpalias, Richard Elwes, and Andy Lewis-Pye. Digital m orphogenesis via schelling segregation. In 2014 IEEE 55th Annual Symposium on Foundations of Computer Scien ce, pages 156–165. IEEE, 2014

work page 2014
[5]

Consensus dynamics: An overview

Luca Becchetti, Andrea Clementi, and Emanuele Natale. Consensus dynamics: An overview. ACM SIGACT News , 51(1):58–104, 2020

work page 2020
[6]

Stabilizing consensus with many opinions

Luca Becchetti, Andrea Clementi, Emanuele Natale, Francesco P asquale, and Luca Trevisan. Stabilizing consensus with many opinions. In Proceedings of the twenty-seventh annual ACM-SIAM symposium on Discrete algorithms, pages 620–635. SIAM, 2016

work page 2016
[7]

An analysis of one-dimensional schelling segregation

Christina Brandt, Nicole Immorlica, Gautam Kamath, and Robert K leinberg. An analysis of one-dimensional schelling segregation. In Proceedings of the forty-fourth annual ACM symposium on The ory of computing , pages 789–804, 2012

work page 2012

Show all 30 references

[8]

History of the lenz-ising model

Stephen G Brush. History of the lenz-ising model. Reviews of modern physics , 39(4):883, 1967

1967
[10]

The powe r of two choices in distributed voting

Colin Cooper, Robert Elsässer, and Tomasz Radzik. The powe r of two choices in distributed voting. In International Colloquium on Automata, Languages, and Programming , pages 435–446. Springer, 2014

2014
[11]

Phase transitions of the k-majority dynamics in a biased communication model

Emilio Cruciani, Hlafo Alﬁe Mimun, Matteo Quattropani, and Sara Rizzo. Phase transitions of the k-majority dynamics in a biased communication model. In Proceedings of the 22nd International Conference on Distri buted Computing and Networking, pages 146–155, 2021

2021
[12]

Stabilizing con- sensus with the power of two choices

Benjamin Doerr, Leslie Ann Goldberg, Lorenz Minder, Thomas Sau erwald, and Christian Scheideler. Stabilizing con- sensus with the power of two choices. In Proceedings of the twenty-third annual ACM symposium on Par allelism in algorithms and architectures, pages 149–158, 2011

2011
[13]

Bounds on information exchange f or byzantine agreement

Danny Dolev and Rüdiger Reischuk. Bounds on information exchange f or byzantine agreement. Journal of the ACM (JACM), 32(1):191–204, 1985

1985
[14]

Brief announcement: rapid asynchronous plurality consensus

Robert Elsässer, Tom Friedetzky, Dominik Kaaser, Frederik M allmann-Trenn, and Horst Trinker. Brief announcement: rapid asynchronous plurality consensus. In Proceedings of the ACM symposium on principles of distribut ed computing, pages 363–365, 2017

2017
[15]

Nearly-tight analysis fo r 2-choice and 3-majority consensus dynamics

Mohsen Ghaﬀari and Johannes Lengler. Nearly-tight analysis fo r 2-choice and 3-majority consensus dynamics. In Proceedings of the 2018 ACM Symposium on Principles of Distr ibuted Computing, pages 305–313, 2018

2018
[16]

Ergodic theorems for w eakly interacting inﬁnite systems and the voter model

Richard A Holley and Thomas M Liggett. Ergodic theorems for w eakly interacting inﬁnite systems and the voter model. The annals of probability , pages 643–663, 1975

1975
[17]

Lumiere: Making optimal bft for partial synchrony practical

Andrew Lewis-Pye, Dahlia Malkhi, Oded Naor, and Kartik Nayak. Lumiere: Making optimal bft for partial synchrony practical. In Proceedings of the 43rd ACM Symposium on Principles of Distr ibuted Computing, pages 135–144, 2024

2024
[18]

Permissionless consensus

Andrew Lewis-Pye and Tim Roughgarden. Permissionless consensus. arXiv preprint arXiv:2304.14701, 2023

2023 arXiv
[19]

Expected linear round synchronization: T he missing link for linear byzantine smr

Oded Naor and Idit Keidar. Expected linear round synchronization: T he missing link for linear byzantine smr. Dis- tributed Computing, 37(1):19–33, 2024

2024
[20]

Apricot phase four: Snowman++ and reduced c -chain transaction fees

Patrick O’Grady. Apricot phase four: Snowman++ and reduced c -chain transaction fees. https:// medium.com/ avalancheavax/ apricot-phase-four-snowman-and-reduced-c-chain-transaction-fees-1e1f6 7b42ecf
[21]

Self-organized segr egation on the grid

Hamed Omidvar and Massimo Franceschetti. Self-organized segr egation on the grid. In Proceedings of the ACM Symposium on Principles of Distributed Computing , pages 401–410, 2017

2017
[22]

Improved intolerance intervals and size bounds for a schelling-type spin system

Hamed Omidvar and Massimo Franceschetti. Improved intolerance intervals and size bounds for a schelling-type spin system. Journal of Statistical Mechanics: Theory and Experiment , 2021(7):073302, 2021

2021
[23]

A schelling model with a variable threshold in a closed city segregation model

Diego Ortega, Javier Rodríguez-Laguna, and Elka Korutcheva . A schelling model with a variable threshold in a closed city segregation model. analysis of the universality classes. Physica A: Statistical Mechanics and its Applications , 574:126010, 2021

2021
[24]

Fpc-bi: Fast probabilistic consensus within byzantine infrastructures

Serguei Popov and William J Buchanan. Fpc-bi: Fast probabilistic consensus within byzantine infrastructures. Journal of Parallel and Distributed Computing , 147:77–86, 2021

2021
[25]

Voting-based probabilis tic consensuses and their applications in distributed ledgers

Serguei Popov and Sebastian Müller. Voting-based probabilis tic consensuses and their applications in distributed ledgers. Annals of Telecommunications, pages 1–23, 2022

2022
[26]

Scalable and probabilistic lead- erless bft consensus through metastability

Team Rocket, Maofan Yin, Kevin Sekniqi, Robbert van Renesse, and Emin Gün Sirer. Scalable and probabilistic lead- erless bft consensus through metastability. arXiv preprint arXiv:1906.08936, 2019. Aaron Buchwald, Stephen Buttolph, Andrew Lewis-Pye, and Kevin S ekniqi 23

1906 arXiv
[27]

Models of segregation

Thomas C Schelling. Models of segregation. The American economic review, 59(2):488–493, 1969

1969
[28]

Sailﬁsh: Towards improving latency of dag-based bft

Nibesh Shrestha, Rohan Shrothrium, Aniket Kate, and Kartik Nayak. Sailﬁsh: Towards improving latency of dag-based bft. Cryptology ePrint Archive, 2024

2024
[29]

Bullshark: Dag bft protocols made practical

Alexander Spiegelman, Neil Giridharan, Alberto Sonnino, and Lefter is Kokoris-Kogias. Bullshark: Dag bft protocols made practical. In Proceedings of the 2022 ACM SIGSAC Conference on Computer an d Communications Security , pages 2705–2718, 2022

2022
[30]

Hotstuﬀ: Bft consensus with linearity and responsiveness

Maofan Yin, Dahlia Malkhi, Michael K Reiter, Guy Golan Gueta, a nd Ittai Abraham. Hotstuﬀ: Bft consensus with linearity and responsiveness. In Proceedings of the 2019 ACM Symposium on Principles of Distr ibuted Computing , pages 347–356, 2019

2019

Pith tools

Reviewed August 10, 2026 · model on record in the stance chip above.

[1] [9]

Frosty: Bringing strong liveness guarantees to the snow family of consensus protocols

Aaron Buchwald, Stephen Buttolph, Andrew Lewis-Pye, Patr ick O’Grady, and Kevin Sekniqi. Frosty: Bringing strong liveness guarantees to the snow family of consensus protocols. arXiv preprint arXiv:2404.14250, 2024

arXiv 2024

[2] [1]

An Analysis of Avalanche Consensus

Ignacio Amores-Sesar, Christian Cachin, and Philipp Schneider. An a nalysis of avalanche consensus. arXiv preprint arXiv:2401.02811, 2024

work page Pith review arXiv 2024

[3] [2]

When is Spring coming? A Security Analysis of Avalanche Consensus

Ignacio Amores-Sesar, Christian Cachin, and Enrico Tedeschi. When is spring coming? a security analysis of avalanche consensus. arXiv preprint arXiv:2210.03423, 2022

work page Pith review arXiv 2022

[4] [3]

Prism: Deconstructing the blockchain to approach physical limits

Vivek Bagaria, Sreeram Kannan, David Tse, Giulia Fanti, and Pramod Vis wanath. Prism: Deconstructing the blockchain to approach physical limits. In Proceedings of the 2019 ACM SIGSAC Conference on Computer an d Commu- nications Security, pages 585–602, 2019

work page 2019

[5] [4]

Digital m orphogenesis via schelling segregation

George Barmpalias, Richard Elwes, and Andy Lewis-Pye. Digital m orphogenesis via schelling segregation. In 2014 IEEE 55th Annual Symposium on Foundations of Computer Scien ce, pages 156–165. IEEE, 2014

work page 2014

[6] [5]

Consensus dynamics: An overview

Luca Becchetti, Andrea Clementi, and Emanuele Natale. Consensus dynamics: An overview. ACM SIGACT News , 51(1):58–104, 2020

work page 2020

[7] [6]

Stabilizing consensus with many opinions

Luca Becchetti, Andrea Clementi, Emanuele Natale, Francesco P asquale, and Luca Trevisan. Stabilizing consensus with many opinions. In Proceedings of the twenty-seventh annual ACM-SIAM symposium on Discrete algorithms, pages 620–635. SIAM, 2016

work page 2016

[8] [7]

An analysis of one-dimensional schelling segregation

Christina Brandt, Nicole Immorlica, Gautam Kamath, and Robert K leinberg. An analysis of one-dimensional schelling segregation. In Proceedings of the forty-fourth annual ACM symposium on The ory of computing , pages 789–804, 2012

work page 2012