Quantum Cadence, part 1: Consensus Recap

TL;DR

Powerful quantum computers could eventually break the cryptography securing today’s blockchains. Financial infrastructure needs to be ready to meet the evolving security requirements. The Monad blockchain is building for stronger security to ensure quantum resistance. In our post-quantum roadmap, one item is quantum-safe consensus. This post is the first of a three-part series to explain the core concepts of consensus. We’ll then dive into the product evolution with Cadence in Part 2 and Quantum Cadence in Part 3.

Category Labs’ Quantum Cadence paper proposes an upgrade to Cadence, their consensus protocol with multiple concurrent proposers, built for 100 ms blocks and about 200 ms finality. Fast consensus protocols, Monad’s included, prove every decision with a certificate: the signatures of two-thirds of the validators, combined into one short signature (BLS). A quantum computer could forge those signatures, and no post-quantum signature is known to combine nearly as compactly. This is the aggregation wall. Ethereum Foundation researchers propose keeping certificates and shrinking the post-quantum signatures into one short proof that they all check out. Quantum Cadence takes a different route to the aggregation wall and finds a way to safely and efficiently reach consensus without aggregation altogether: validators count each other’s votes themselves.

Consensus

Picture a committee at a table in a room. The members are network validators, and their job is to agree on the next block, over and over. The assumption is that some members may be dishonest (Byzantine), to harm the network or to pursue their own financial benefit (more on this in the examples).

The example follows four committee members (validators), Alice, Bob, Carol and Eve, at a table. Eve, the liar, has a tail only the reader sees.

Four committee members, Alice, Bob, Carol and Eve, at a table. Eve, the liar, has a tail only the reader sees.

A liar, Eve, may say anything, say different things to different validators, or say nothing at all. A Byzantine consensus works as long as more than two-thirds of the validators are honest. With $n$ validators of whom at most $f$ lie, that means $n = 3f + 1$ . Simply put, four validators tolerate one liar. On Monad, a member’s vote counts in proportion to its stake. For the sake of simplicity, in this post we count seats and leave stake out, but the math behind it is the same.

What the room must get right

The committee has one job: consensus. For every item on the agenda (a block), every honest member must end up with the same answer, regardless of what the liars do. The liars can attack that in two ways.

They can try to split the room. If Alice and Bob walk out having decided A while Carol and Eve walk out having decided B, the room has two answers for one item, and two histories that both look final. The protocol word for a split is a fork.
They can refrain from participating, simply not answering, hoping to stall the protocol.

A consensus protocol wants to resist both a fork and a stall.

If two hands were enough, Eve backing both A and B forks the room; if all four were needed, Eve’s silence stalls it. Two-thirds, three of four, stops both.

More than two-thirds of the seats, three of four, stops both. If Eve stays silent, Alice, Bob and Carol still make three. If Eve backs both A and B, B would need a hand from Alice or Bob, who already said A. More than two-thirds of the seats, $2f + 1$ , is called a quorum, and from here on "two-thirds" is short for it.

One more number: $f + 1$ . When $f + 1$ validators say the same thing, at least one of them is honest, because at most $f$ lie. With four validators, that is two. This matters in Part 3: Quantum Cadence uses it to believe what others say without any proof attached.

From proposed to final

Every proposal comes from a chair, the member whose turn it is to lead; the protocol word is leader. The chair puts a proposal on the table, and the validators vote on it with a show of hands. Here Alice chairs.

A proposal passes through three states, and it takes two shows of hands to reach the last one.

Alice proposes A (proposed); two-thirds raise hands for it (voted, act now); two-thirds say they saw that (final).

It is proposed when it reaches you. It is voted when two-thirds raise hands for it. It is final when two-thirds say they saw that first show of hands.

Why twice? After the first show of hands, Alice knows that two-thirds voted for A, but not whether the others know it; a messenger may still be on the way. After the second, two-thirds of the room know that two-thirds voted, and the decision can no longer be lost.

Alice may act after the first show of hands anyway. That is speculative finality. Only one thing can undo it: a member who says two different things about the same item and signs both, which is called equivocation. The two signatures prove who did it.

Three ways to show a vote

A member can show its vote in three ways, and this impacts who the vote needs to convince. That difference is the cornerstone for understanding what Quantum Cadence changes, and why.

A raised hand convinces the room. Everyone it faces sees whose hand it is, and nobody can raise a hand in someone else’s name. It proves nothing outside: when Bob walks out and reports “Alice said yes”, the person at the door can only ask “says who?”. Hands also reach each member separately, so validators don’t all see the same hands at the same moment, and a liar can raise different hands toward different validators.
A signed ballot convinces anyone. Alice writes a vote down and signs it, and anyone can check the signature, inside the room or out. Ballots can be carried, copied and kept.
A tally sheet convinces anyone that two-thirds agreed. It is two-thirds of matching ballots, stapled together into one small sheet, so showing anyone how a quorum voted stays cheap.

The Quantum Problem

Signatures are safe because they rest on math problems today's computers cannot solve. A large quantum computer could solve them and sign in anyone's name. Monad's consensus, like Ethereum's, runs on tally sheets, which protocols call certificates. A large quantum computer could forge certificates (BLS signatures), so they will have to give way to quantum-safe ones. But quantum-safe signatures don't staple well: the tally sheet gets far bigger and slower to make. This is the aggregation wall. Ethereum Foundation researchers propose a workaround: replace the staple with one short proof, a SNARK, that all the signatures check out. We will show that Quantum Cadence takes a whole different path to the same problem.

What comes next

The rest of the series explains how BFT has evolved to MonadBFT and then Cadence, and then shows how Quantum Cadence handles quantum resistance and maintains performance.

References

M. M. Jalalzai, T. Klenze, J. Komatovic. Quantum Cadence: Post-Quantum Consensus with Multiple Concurrent Proposers. arXiv:2610.32803, 2026.
K. Babel, F. Elsheimy, L. Heimbach, M. M. Jalalzai, T. Klenze, J. Komatovic, J. Milionis, M. Setrin, V. Shoup. Cadence: Extreme Pipelining with Multiple Concurrent Proposers. arXiv:2607.02275, 2026.
J. Drake, D. Khovratovich, M. Kudinov, B. Wagner. Hash-Based Multi-Signatures for Post-Quantum Ethereum. IACR Communications in Cryptology 2(1), 2025; ePrint 2025/055.
Monad docs: MonadBFT.
Monad’s post-quantum roadmap, September 2026.