Harambee Federated Byzantine Agreement.
HFBA is the consensus protocol that runs every Bantu ledger. It is non-mining, non-plutocratic, low-latency, and rooted in federated trust — validators each declare which other validators they trust, and the network's safety emerges from the overlap. Named after the Swahili word for 'all pull together.'
Harambee is a Swahili word meaning all pull together. It described community-led economic cooperation — collective savings, communal labor, shared risk — generations before the consensus protocol that bears its name. The protocol is named after the practice because the practice came first.
Four properties HFBA guarantees.
No single party — including the Foundation — controls consensus. Quorum requires overlapping agreement across independent validator organizations.
From transaction submission to finalized ledger. Single confirmation is sufficient — no 6-block waits.
Each validator declares its own quorum set. The system's trust topology is the union of these choices, not a hardcoded committee.
Safety is preserved as long as no single quorum is corrupted. Liveness is preserved as long as one of your trusted quorums is honest.
Four phases, every ledger.
Nomination
Each validator proposes the set of transactions it has seen. Validators vote to converge on a single candidate set — the union of trusted submissions.
Balloting
Validators run successive ballot rounds to commit the nominated set as the next ledger. Federated voting + quorum slices guarantee a single outcome.
Externalize
Once a quorum agrees, the ledger is externalized — written to history, broadcast, irreversible. Settlement in 3–5 seconds from submission to externalization.
Quorum advice
Validators publish their declared trust ('I will believe a ledger if quorums A, B, or C agree on it'). The network's safety emerges from the overlap of these declarations.
How HFBA differs from the alternatives.
On 51% attack resistance.
HFBA doesn't care about computational majority. Validators are weighted by their position in quorum sets, not by hash power or stake. A bad actor can only break safety by:
- Being inside the quorum sets of enough validators to form an overlapping bad quorum, AND
- Having the other honest validators in those sets agree with them.
That requires multi-organization compromise across operationally independent entities — a much higher bar than acquiring 51% of hash power or 33% of stake. Quorum sets are configured automatically per quality tier; validators are grouped to make Sybil attacks economically pointless.