Yoalto/Protocol

One validator set.
255 payment lanes.

Yoalto separates where a payment executes from who agrees on it. One validator set finalizes every partition under HotStuff; each account lives on exactly one partition and its payments execute only there. Nothing on the payment path needs a cross‑partition lock.

Architecture

Three layers, no shared bottleneck.

Consensus · HotStuff, per partition 2-chain commit · 500 ms views · 2n/3+1
256 partitions chain 0 system · 0x01 → 0xFF payments
deterministic account residence · local reads only
Storage · shared FoundationDB cluster sparse Merkle tree (JMT) · partitions spread across pods

A validator is the whole bottom two layers: a pod cluster over one FoundationDB cluster, not a single machine. Adding capacity means adding pods.

Transaction lifecycle

How a payment settles.

01

Home partition

Every account's home partition is derived by hashing its identity — MurmurHash3-32 over the claim hash, mapped into [1, 255]. Any client computes it before sending; no sequencer assigns it, and it never moves.

02

SEND

On the sender's home partition: debit the balance, advance the account's nonce, and emit a commitment. It finalizes there, without waiting on the recipient's partition or taking a lock anywhere else.

03

RECEIVE

On the recipient's home partition: verify the SEND against a Merkle proof and the signed quorum certificate that finalized it, then credit. The two halves are independent transactions — this is the pattern Nano proved in production.

04

Finality

HotStuff finalizes each partition's blocks under a 2‑chain commit rule with a 2n/3+1 threshold. Leaders are drawn per (partition, view) by deterministic stake‑weighted election, so no single node proposes for all 256 partitions at once.

Consensus parameters
Target block time500 ms
Views per epoch172,800 (~24 h)
Commit rule2-chain
Fault tolerance2n/3 + 1
Leader electionstake-weighted, per (partition, view)
Validator-set changesigned EpochCert
Aggregate signatureBLS · 48 bytes
RandomnessDKG group key, committed on chain
Epoch parameters live on chain rather than in node config. Every value changes what the epoch boundary computes, so a node reading them from a file would write a different state root and fall out of consensus.
Cryptography

Not post-quantum. Built to become so in one transaction.

Yoalto signs consensus with BLS and user transactions with Ed25519. Neither is post‑quantum, and this page will not pretend otherwise. What the design does provide is a migration that costs one transaction rather than a chain‑wide event: an account's external address is a claim hash fixed when the account opens, held separately from the key that signs for it. Rotating to a different scheme changes the key, not the address, so nobody's sends or receives break.

Validator signaturesBLS (supranational/blst)
Account signaturesEd25519
Account identityclaim_hash = sha3(initial_pubkey)
Attestation hashingSHA-256
Comparison

Where the parallelism actually comes from.

PropertySingle-chain L1Rollup stackYoalto
Execution parallelism1 lane1 lane per rollup 255 payment partitions
Payment modelGlobal stateBridged, async SEND / RECEIVE, per partition
Cross-partition atomicityAtomicBridged None — by design
Validator scalingVerticalVertical Horizontal — pods over FoundationDB
Validator-set propagationGlobalPer rollup Signed EpochCerts, 48 bytes
Added trust assumptionBridge + proverNone

These are architectural properties, not benchmark results. No throughput comparison appears here because Yoalto has not published one.

Security model

Assumptions, stated plainly.

Honest majorityMore than two thirds of voting power behaves honestly
NetworkPartial synchrony; HotStuff pacemaker drives view changes
Validator setOne set across all partitions, rotated by signed EpochCert
DeterminismHandlers read only their own partition; cross-partition writes are unique-keyed
Epoch parametersOn chain — a node reading them from config would compute a different state root
Known gaps

And what is not done yet.

Validator registrationGenesis validators only; needs proof-of-possession first
Validator rewardsNot built — fees are burned
SlashingTwo reasons defined; fault detection not built
Mempool gossipNone between validators; each is fed by its own submit subject
Reorg / unfinalizeNo unwind path — 2-chain commit is treated as final
Fee marketFee is ≥ 0 and burned; no priority fees
Post-quantum signaturesEd25519 only; the migration path is designed, not built
External auditNone. One internal adversarial review, 2026-07
The 2026-07 review was internal: roughly 41k lines across 104 packages, twelve findings, all fixed. It did not conclude the codebase was clean, and no external firm has audited any of this.