# HotStuff Will Not Commit Conflicting Proposals ## Metadata **Status**:: #x **Zettel**:: #zettel/fleeting **Created**:: [[2026-01-22]] ## Synopsis Assume HotStuff has committed $w$ at view $v_1$ and $b$ at view $v_2$. Without loss of generality, let $v_1 < v_2$. Denote $qc_1$ as the commit quorum certificate (QC) for $w$, and $qc_2$ for $b$. There must exist a prepare QC at view $v$, where $v_1 < v \le v_2$, and its proposal conflicts with $w$. Such a prepare QC must exist, for example the prepare QC for $b$ in $v_2$ is a prerequisite of $qc_2$. ![[HotStuff Will Not Commit Conflicting Proposals - Drawing 202601220930.excalidraw.svg]] %%[[HotStuff Will Not Commit Conflicting Proposals - Drawing 202601220930.excalidraw|🖋 Edit in Excalidraw]]%% See some examples from the proposal hierarchy above: | b | Conflicting prepare QC | | --- | ---------------------- | | r | r | | s | r, s | | t | r | Let $qc_s$ be such a prepare QC at view $v_s$ with the minimum view number. There must exist an honest replica $r$ that has voted both $qc_1$ and $qc_s$, because $(2f + 1) + (2f + 1) - f > 0$. When $r$ voted $qc_s$, its locked QC is still on the branch leading by $w$, otherwise it contradicts with the assumption on the minimum view number of $qc_s$. The vote on $qc_s$ from replica $r$ means the QC has passed the `safeNode` predicate. > [!definition] [[HotStuff Protocol Illustration.excalidraw#^P789IAk45P4YvG37-n0Wd|safeNode]] predicate > ``` > \/ currNode.parent = lockedQC.node > \/ highQC.viewNumber > lockedQC.viewNumber > ``` The first condition does not match because $qc_s$ resides on a different branch than the locked QC. So the second condition must hold. However, this condition means there exists a prepare QC which view number is greater than locked QC and less than $v_s$. Note that this prepare QC conflicts with $w$ because: 1. Its view number is greater than locked QC, so it is not an ancestor of $w$. 2. Its child $qc_s$ conflicts with $w$, so it is not a descendant of $w$. This prepare QC also has a view number less than $v_s$, which violates the minimality of $qc_s$. This contradiction proves that the assumption is wrong, so the replica $r$ should not vote $qc_s$ thus HotStuff will not commit conflicting proposals.