Consensus Evolution at Radix

Introduction

Radix's consensus protocol is the result of over a decade of iterative research by founder Dan Hughes. Between 2013 and 2020, Hughes designed, built, and discarded five distinct consensus architectures — each solving problems revealed by its predecessor — before arriving at Cerberus, the protocol that powers the Radix mainnet today. This article traces that research journey, examining what each iteration contributed and why it was ultimately superseded.

eMunie (2013–2015)

Hughes' distributed ledger work began with eMunie, a project launched in March 2013 — before Ethereum's whitepaper was published. eMunie was conceived as a platform for a decentralised stablecoin with an autonomous supply model that could expand and contract to maintain purchasing-power parity. The project used Delegated Proof of Stake and included features that were ahead of their time: an integrated naming system (predating ENS), encrypted messaging, a decentralised marketplace, and an asset creation system.

eMunie demonstrated that a broad-featured decentralised platform was technically feasible, but its consensus design was not built for the scale required by global finance. Hughes recognised that the underlying data structures — not just the consensus rules — needed rethinking.

Blocktrees & DAG Experiments (2015–2016)

Hughes explored alternative data structures to move beyond linear blockchain limitations. Blocktrees extended the blockchain into a tree structure where branches could process transactions independently, merging periodically. Directed Acyclic Graphs (DAGs) — a structure later popularised by IOTA — allowed transactions to reference multiple predecessors, enabling parallel validation.

Both approaches improved throughput over single-chain designs but introduced new problems. Blocktrees required complex merge logic and struggled with conflict resolution across branches. DAGs, while elegant for simple transfers, made it difficult to guarantee deterministic ordering for smart contract execution — a prerequisite for composable DeFi.

CAST (2016–2017)

Channeled Asynchronous State Trees (CAST) was Hughes' attempt to combine the best aspects of blocktrees and DAGs with a state-sharding model. CAST partitioned the ledger into channels that could process transactions asynchronously, with a tree structure for state management. This design moved closer to the sharded architecture that would eventually characterise Radix, but the asynchronous coordination model introduced edge cases around cross-channel atomicity that proved difficult to resolve formally.

Tempo (2017–2019)

Tempo was the fifth iteration and the first to achieve public recognition. Proposed in September 2017, it introduced two innovations that would carry forward into Cerberus:

• Pre-sharding — the ledger was partitioned into 2⁶⁴ (18.4 quintillion) fixed shards from genesis, so the shard space never needed to be reorganised as the network grew.
• Lazy consensus — nodes only communicated when necessary to resolve conflicts, dramatically reducing coordination overhead for non-conflicting transactions.

Tempo used logical clocks and temporal proofs to establish ordering between events across shards. In June 2019, Radix conducted a public test replaying 10 years of Bitcoin transactions onto a Tempo network, processing them in under 30 minutes and achieving over 1 million TPS.

However, Tempo had critical weaknesses: it lacked absolute transaction finality (relying on probabilistic guarantees), and analysis revealed the Weak Atom Problem — a class of cross-shard attacks where a malicious client could exploit the lazy consensus model to create conflicting transactions on different shards. Tempo also lacked robust Sybil protection for its validator selection mechanism.

Cerberus (2020–Present)

Cerberus, the sixth iteration, was published in August 2020 and directly addressed every weakness identified in Tempo. Its key design decisions were shaped by a decade of lessons:

• From lazy consensus to BFT — Cerberus replaced Tempo's probabilistic lazy consensus with deterministic BFT consensus (derived from HotStuff), providing absolute finality on every transaction.
• Braided consensus for atomicity — rather than relying on after-the-fact conflict detection, Cerberus braids independent BFT instances across shards into a single atomic commitment. This eliminates the Weak Atom Problem by design.
• Pre-sharding preserved — the practically unlimited shard space from Tempo was retained, maintaining linear scalability as validators are added.
• Formal validator sets — each shard has a defined validator set with stake-weighted selection, providing Sybil resistance that Tempo lacked.

The protocol was peer-reviewed and validated through a collaboration with UC Davis' ExpoLab. Testing demonstrated over 10 million TPS on 1,024 shards with linear throughput scaling.

Ongoing Research

Post-Cerberus research continues through projects like Cassandra (investigating liveness guarantees and dynamic validator sets) and hyperscale-rs (a community-built Rust implementation exploring the next-generation Xi'an release). Dan Hughes has stated that the Xi'an upgrade will bring further improvements to shard-level liveness, validator rotation, and throughput — building on Cerberus rather than replacing it.

External Links

• Dan Hughes on the Radix Blog
• Cerberus paper (arXiv)
• Tempo Whitepaper (PDF)
• Cerberus Infographic Series