Minimmit, Multimmit and the New Consensus Frontier with Patrick O'Grady

Patrick O'Grady founded Commonware, a Rust library of over 40 composable primitives for building blockchains, released under MIT and Apache 2 licenses. Unlike frameworks such as Cosmos SDK, which limits customization to above the state machine level, Commonware exposes every layer of the stack including P2P, consensus, execution, and cryptography. O'Grady's path ran from Stanford through Coinbase, where he built Rosetta, a universal read-write abstraction for blockchain interaction that required listed assets to implement its specification, leading to protocol-breaking changes in networks including Cosmos Hub 3. He then spent roughly three and a half years at Avalanche before concluding its multi-EVM direction was too limiting and starting Commonware the following day.

Commonware has published two consensus protocols, Minimmit and Multimmit, both derivatives of Simplex Consensus. O'Grady first encountered Simplex at an IC3 retreat in Switzerland in 2022 and described it as the first consensus protocol he felt he could implement in a weekend. Simplex uses all-to-all voting rather than linear broadcast approaches like HotStuff, simplifying the protocol and improving performance. Commonware's contribution was natively embedding threshold consensus and a verifiable random function for random leader election into the protocol, requiring approximately 25 implementation iterations with co-author Ben before reaching a correct result. Solana is migrating to a Simplex-inspired protocol called Alpenglow, and Tempo also runs on Simplex Consensus.

Minimmit targets the 5F plus 1 fault tolerance setting, which Alpenglow brought to prominence by splitting Byzantine and crash fault thresholds to 20 percent each rather than using the traditional unified threshold of fewer than 33 percent. Reducing Byzantine tolerance to 20 percent makes single-round finalization achievable. In a standard 3F plus 1 system with a 100 millisecond network delta, end-to-end finalization takes roughly 300 milliseconds across proposal, vote, and finalization rounds. The 5F plus 1 setting requires only two steps, approximately halving latency. Unlike Alpenglow, Minimmit drops the additional crash tolerance layer and instead reorients quorums to reduce view latency, since user transaction latency equals view latency plus finalization latency. O'Grady acknowledged that whether sub-300 millisecond finalization matters to human users is debatable but argued it is likely meaningful for bots and trading systems where milliseconds affect liquidity.

Multimmit builds on Minimmit by enabling multiple mini commits and was released just before the conversation. In Multimmit, a validator votes simultaneously on all validators' tips rather than on a single block digest and can add digests extending beyond the leader's proposed tip in its vote. The minimum quorum construction limits how much any two certificates can differ, ensuring the next-round leader must extend a finalized tip even without having seen it finalized locally. O'Grady estimates end-to-end finality under Multimmit on a global network at 200 to 300 milliseconds, which he claims is a couple hundred milliseconds faster than any other construction on a global network. Multimmit certificates are a couple of kilobytes, larger than the roughly 150 to 200 byte threshold signatures used in standard Simplex, but not large enough to cause network congestion. Commonware will likely implement Multimmit directly and skip a standalone Minimmit implementation, though this is not final.

Multimmit also addresses censorship resistance. If enough validators have independently certified a block, the network can override a censoring leader, and any certificate finalized by any node guarantees future views must build on that tip. This property is particularly relevant to auction or exchange scenarios where a leader could benefit from excluding certain transactions.

On decoupled state machine replication, O'Grady prefers coupling decoupled transaction broadcast with traditional consensus over DAG-based approaches. In this model a node broadcasts a mini block, collects votes as proof of availability, generates a 2F plus 1 certificate, and puts that certificate into consensus rather than raw transactions. The pre-certification step historically added one latency delta compared to DAG approaches. O'Grady argues Multimmit eliminates that penalty by allowing concurrent broadcast with decoupled transaction dissemination, making it competitive with DAG latency while retaining the robustness of traditional consensus. Commonware has fully departed from designs that separate block production from finalization, such as BABE and GRANDPA in Polkadot and Ethereum 2, using exclusively single-shot protocols where view production and finality determination happen simultaneously.

On security, Commonware works with Asymmetric Research on continuous fuzzing running around the clock for over a year and with QED Audit on continuous automated bug finding. O'Grady does not believe in point-in-time audits because code is always changing, though Commonware is conducting one with ZK Security. He emphasizes that projects building on Commonware should still conduct their own audits on top of the runtime. O'Grady believes consensus research is now close to theoretical performance bounds and that a new paper is unlikely to produce dramatically better results, with the caveat that ZK could change many of those assumptions. His stated goal is for Commonware to let the industry focus on application development rather than repeatedly reimplementing slightly modified consensus protocols. Commonware runs a team of 11 engineers and deliberately keeps headcount small, spending resources elsewhere to preserve team capability and cohesion.