Mysticeti-C Byzantine Consensus Protocol

• Mysticeti-C is a Byzantine consensus protocol that employs an uncertified DAG to implicitly certify blocks without explicit 2f+1 signatures, reducing latency.
• It uses a novel direct plus indirect commit rule within a three-round pipeline to ensure reliable block finalization and robust censorship resistance.
• Empirical results show sub-second WAN finality and high TPS performance, outperforming protocols like Bullshark and Narwhal under similar load.

Mysticeti-C is a Byzantine consensus protocol based on a Directed Acyclic Graph (DAG), distinguished by its achievement of the theoretical lower bound of three message rounds for consensus latency in partially synchronous environments. By avoiding explicit certification of blocks, Mysticeti-C delivers high throughput, resource efficiency, robust censorship resistance, and sub-second wide-area network (WAN) finality, directly addressing key limitations of prior DAG-based and classic BFT protocols (Babel et al., 2023).

1. Design Motivation and Context

Conventional certified-DAG consensus protocols such as Narwhal and Bullshark achieve significant throughput by allowing every validator to propose a block per "wave." However, these designs incur substantial latency due to the explicit certification requirement: a block must first collect reliable-broadcast signatures (approximately three message delays), followed by a recursive DAG commit rule (another ∼3 delays), resulting in typical WAN latencies of 2–3 seconds. Conversely, PBFT-style state machine replication can commit in three message delays but only supports one proposal per round and exhibits vulnerability in asynchronous or faulty conditions.

Mysticeti-C's central insight is that a DAG constructed from blocks carrying individual signatures—but lacking explicit 2f+1 signature certificates—provides sufficient guarantees against equivocation and ensures data availability. This structure allows blocks to traverse a three-round pipeline (propose, vote, commit) without waiting for certificates. The protocol introduces an implicit certification mechanism embedded in the DAG topology and a novel "direct plus indirect" commit rule, enabling commitment in three message rounds even under crash failures and without sacrificing high proposer throughput.

2. Uncertified-DAG Commit Rule

Time in Mysticeti-C is partitioned into logical waves, each of three rounds (wavelength = 3). Each round $r$ of wave $w$ admits up to $S$ proposer-slots (e.g., $S = 2$ or $3$), deterministically assigned to validators. An honest proposer at slot $(w, r, \ell)$ constructs a block referencing:

1. Its own prior block ("self-parent").
2. At least $2f+1$ distinct blocks from round $r-1$.

Each block is signed and disseminated via multicast. Two DAG-recognizable patterns underpin the implicit commit rule:

• Certificate pattern: If at least $2f+1$ blocks in round $r+1$ "support" a proposal $B$ for a slot $s$ (the first depth-first encounter for $(v, r)$ is $B$), then $B$ is implicitly certified.
• Skip pattern: If $2f+1$ blocks in round $r+1$ omit support for any proposal at slot $s$, then $s$ is skipped.

No explicit certificates are constructed/disseminated; only the first certified proposal or confirmed skip per slot is identified.

Commitment proceeds slotwise in total order:

• Direct decision: Slots with certificate pattern are marked "to-commit"; those with skip pattern are marked "to-skip"; others remain undecided.
• Indirect decision: Identifies an anchor slot $s'$ (first slot with round $\geq r+3$ that is decided). If undecided, defer. If committed and reachable from a certificate, mark "to-commit;" else "to-skip."
• Commit sequence: Sequentially walk slots, committing/skipping as indicated until the first undecided is encountered.

This guarantees: (1) every honest slot is eventually decided, (2) no more than one proposal per slot is ever certified, (3) all correct validators agree on the commit prefix.

3. Latency and Message Complexity Analysis

The protocol matches the Martin and Alvisi three-message round lower bound for Byzantine consensus in partial synchrony. The latency per block is quantified as $L = 3 \cdot \delta$, where $\delta$ is the one-way network delay bound post-GST.

In each wave:

• 1st delay: The proposer issues a block.
• 2nd delay: Validators include the block in round $r+1$ blocks (implicit votes).
• 3rd delay: Validators include $2f+1$ such votes in round $r+2$ blocks (implicit commit certificates), finalizing commitment.

Each proposal, vote, and commit is accomplished by a single broadcast of a signed block. The signature cost per block is $O(1)$ (a single signing and verification). Message complexity is $O(n)$ per block in bytes (one multicast per block to $n$ parties), $O(n^2)$ total point-to-point messages per round, with signature overhead amortized at $O(1)$ per block.

Under crash failures, the skip pattern permits prompt exclusion of missing proposers, ensuring that honest slots are decided within three rounds, upholding the latency bound.

4. Safety and Liveness

Mysticeti-C satisfies the standard Byzantine atomic broadcast properties. The safety proof hinges on several structural lemmas:

• Unique-support and unique-cert: No correct validator supports more than one proposal per slot, ensuring intersection quorums and at most one certified proposal per slot.
• Recursion-safety: Once a block $B$ obtains $2f+1$ implicit certificates at round $x$, all subsequent blocks must reference $B$, preventing certificate "orphaning."
• Direct-skip and direct-commit safety: A slot directly skipped/committed by any validator cannot be committed/skipped by another.
• Proposer-consistent prefix: Each validator’s sequence of committed proposer slots is a prefix of any other's, guaranteeing total order.

Liveness results from:

• View-sync: After GST, all honest validators enter rounds within $\delta$ of each other.
• Proposer-proposal and sufficient-votes: Any honest proposer block attains $2f+1$ implicit votes by the next wave under suitable timeout.
• Decision-liveness: Within any $3f+3$ round window, at least three consecutive rounds will feature honest proposers, thereby ensuring eventual commitment cascades for undecided slots.

Thus, every honest proposal commits in three rounds after GST.

5. Empirical Performance

Mysticeti-C was benchmarked on geo-distributed AWS testbeds (10 and 50 node deployments, 13 regions, two proposer slots per round, 1s first-slot timeout, clients submitting 512-byte transactions). Notable measurement results:

Configuration	p50 Commit Latency	Throughput (TPS, sub-1.5s latency)
10 validators	≈0.3 s @ 100k TPS	Peaks >400k
50 validators	≈0.5 s @ 100k TPS	Peaks ≈120k

For comparison, contemporary protocols under similar load:

• HotStuff/HotStuff-over-Narwhal: p50 ≈1.0–1.5 s
• Bullshark: p50 ≈1.2–1.6 s

Under $f=3$ crash faults (10-node committee), Mysticeti-C sustains sub-second latency up to 50k TPS and ≈1 s up to 80k TPS; Bullshark and Narwhal/HotStuff-over-Narwhal degrade to 8–10 s latencies under similar conditions.

The Mysticeti-FPC variant integrates a fast-path for payment transactions, embedding consensus-less assets transfers into the DAG. This achieves p50 "fast-path" finality at ≈0.25 s under low load, sustaining >175k TPS before hitting the 0.5 s latency threshold. By contrast, Zef is limited to 7–20k TPS at similar latencies.

6. Integration in Sui and Practical Impact

Mysticeti-C was integrated into Sui’s production codebase—replacing Bullshark—in a 137-validator, 9-region deployment (Vultr cloud, Aquarium testnet). With a continuous 5k TPS load, measured commit latencies were:

• Bullshark: p50/p95 = 2.89s / 4.60s
• Mysticeti-C: p50/p95 = 0.65s / 0.975s

This demonstrates greater than fourfold reduction in median commit latency, achieving sub-second finality in a live public blockchain setting.

7. Summary and Significance

Mysticeti-C demonstrates that carefully architected uncertified DAGs, utilizing an implicit commit rule, can attain the theoretically minimal three-round latency while sustaining high multi-proposer throughput, low ($O(1)$) signature overhead, robust fault resilience, and sub-second WAN finality at scale. The protocol represents a new performance baseline for Byzantine consensus in permissioned blockchains, exhibiting graceful degradation under crash faults and enabling efficient integration into high-throughput production ledgers such as Sui (Babel et al., 2023).