Permissioned consensus · draft
Not ratifiedOne block. No second history.
QBFT is how a closed list of named validators agrees on the next block once. Besu recommends it for new private networks. Identity is the security assumption. The 2 October package is a restricted draft, and it expands MLSP as a settlement platform — a different name from the metal protocol.
Block period
2 s
Chain id
20260001
Base fee
0
Who has to be awake
Faults tolerated f = ⌊(n − 1) / 3⌋. Quorum Q = ⌊2n / 3⌋ + 1. Phase-0 baseline in the package is five validators: one fault, quorum four. Two down and the chain halts. That is the point.
Faults f
1
Quorum Q
4
Live now
5
Quorum is available. A committed block on this design does not reorganize. Final money still settles wherever the banks already settle. The chain only records that the club agreed.
Prepared, then committed
Height 100, four-validator intuition, quorum three. Deposit A is the locked page. Deposit B is the page a late chair might try to sneak in.
No proposal yet. The height is open.
IBFT 2.0 could leave validators split between “I prepared A” and “I want the next round.” QBFT attaches the prepare set, so the next proposal cannot invent B once A was locked. Commit seals in the header are what a later node checks. They are not a zero-knowledge proof, and they are not legal tender.
Besu, in one line
The Java Ethereum client a bank can run — mainnet-capable, QBFT for a club, Apache 2.0. Keys stay in Web3Signer or an HSM, not in a keystore on the node. Maintainer concentration is the governance risk: a 2025 TAC note counted about 19 of 21 maintainers at Consensys.
What the package fixes at genesis
Five placeholder validator addresses, epoch length 30,000, request timeout 4 seconds, gas price zero, discovery off, RPC on localhost only. The package says those addresses must be replaced at a witnessed key ceremony. Starting on the placeholders produces an invalid chain.