Museo · Exhibit 01 · after Leslie Lamport
Why can’t a network survive a third of its members lying?
Scatter computers across the world, let some of them lie, and ask the honest ones to still agree on one history. They can — but only if fewer than one third are traitors. Not a half. A third. Turn the dials until you see why.
A commander orders “attack at dawn.” One general is a traitor — and a traitor doesn’t just go quiet. It tells different generals different things. Hover a general to see the orders they’re holding.
A general’s view
Hover (or tab to) a general to see the orders they received. Watch what a traitor does to its neighbours.
n = 7 tolerates up to 2 traitors (needs n ≥ 3f+1 = 4).
The idea
A consensus system is squeezed between two demands. Liveness: up to f generals can go silent, so you can never require more than n − f votes, or you wait forever. Safety: any two quorums must share an honest general, or two groups could each certify a different history — a fork. Two quorums of size q overlap in 2q − n generals, and that overlap has to out-number the liars: 2q − n > f.
Push the quorum as small as liveness allows, q = n − f, into the safety rule: 2(n − f) − n > f → n − 2f > f → n > 3f
That’s the whole answer. ⅓ isn’t chosen — it’s the exact point where “don’t wait for the silent third” and “the overlap must beat the liars” can no longer both be true. Below it: safe and live. At or past it: pick one.
This is why Sui works
Sui’s validators carry stake, so the bound is by stake, not headcount: a quorum is 2f + 1 of the stake, and the network stays safe as long as Byzantine validators hold less than ⅓ of it. Mysticeti — Sui’s consensus — is built on exactly this arithmetic. Cross ⅓ of stake and you don’t get a glitch; you get the impossibility you just slid into above.