20+20
Alpenglow tolerates 20% adversarial stake plus 20% offline stake. This lesson takes the offline arm: a fifth of the stake is dark, then the network splits. What still finalizes, and how does the cluster recover?
Alpenglow's headline resilience claim is 20+20: safety holds with up to 20% of stake behaving adversarially, and liveness holds with a further 20% simply offline.
The numbers come straight from the thresholds. The fast path needs 80% Notarize votes; with 20% offline it is out of reach. The slow path needs 60% Notarize and then 60% Finalize votes; 80% online stake clears it comfortably. Two conflicting 60% certificates would need at least 20% of stake to vote twice, which is the adversarial budget.
In this scenario just over a fifth of the stake is offline from the start. At 4.0 s the online validators are split in two for 1.5 s.
This build has no adversarial behaviour yet (that is the attack lab, milestone 4), so we look at the offline arm only.
Press Start.
Where it stops
-
A fifth of the stake never shows up
-
Which certificate finalizes?
The first block is being produced. Predict how it will be finalized.
With 79% of the stake online, how does the first block get finalized?
- Fast path: an 80% Fast-Finalization certificate
- Slow path: a 60% Notarization certificate, then a 60% Finalization certificate
- It cannot be finalized while 21% is offline
- It depends on which validators are offline
The fast path needs 80% of all stake to vote Notarize; only 79% can. The block is still notarized at 60%, every validator that voted Notarize then casts a Finalize vote, and at 60% Finalize votes a Finalization certificate forms. One extra round trip, roughly 100 ms, and finality is reached.
-
The second 20: a partition
-
SafeToSkip fires
-
Standstill recovery
-
The partition heals
-
Finality resumes
What you saw
- 21% offline: the fast path (80%) is gone, the slow path (60% + 60%) finalizes about 100 ms later than the fast path would.
- A partition on top: neither side has 60% of total stake, so everything stalls safely; SafeToSkip and fallback votes prepare the cleanup.
- Standstill recovery re-broadcasts votes and certificates so a healed cluster can actually use what each side voted during the split.
- Windows led by offline validators keep getting skipped after the heal; that is the cost of liveness with dark stake.
Try next
- Paste the scenario as custom JSON and set the offline
stake_pctto 0.35: the slow path fails too and only Skip certificates form. - Compare the same scenario under TowerBFT (Compare mode): with 21% offline it still confirms but roots even later.