
Security News
Scaling Socket from Zero to 10,000+ Organizations
Socket CEO Feross Aboukhadijeh shares lessons from scaling a developer security startup to 10,000+ organizations in this founder interview.
Byzantine-Fault Tolerant State Machine Replication. Or Blockchain, for short.
| Branch | Tests | Linting |
|---|---|---|
| main | ||
| v0.38.x | ||
| v0.37.x | ||
| v0.34.x |
CometBFT is a Byzantine Fault Tolerant (BFT) middleware that takes a state transition machine - written in any programming language - and securely replicates it on many machines.
It is a fork of Tendermint Core and implements the Tendermint consensus algorithm.
For protocol details, refer to the CometBFT Specification.
For detailed analysis of the consensus protocol, including safety and liveness proofs, read our paper, "The latest gossip on BFT consensus".
Complete documentation can be found on the website.
Please do not depend on main as your production branch. Use
releases instead.
If you intend to run CometBFT in production, we're happy to help. To contact us, in order of preference:
#cometbftMore on how releases are conducted can be found here.
To report a security vulnerability, see our bug bounty program. For examples of the kinds of bugs we're looking for, see our security policy.
| CometBFT version | Requirement | Notes |
|---|---|---|
| main | Go version | Go 1.22 or higher |
| v0.38.x | Go version | Go 1.22 or higher |
| v0.37.x | Go version | Go 1.22 or higher |
| v0.34.x | Go version | Go 1.12 or higher |
See the install guide.
Please abide by the Code of Conduct in all interactions.
Before contributing to the project, please take a look at the contributing guidelines and the style guide. You may also find it helpful to read the specifications, and familiarize yourself with our Architectural Decision Records (ADRs) and Request For Comments (RFCs).
CometBFT uses Semantic Versioning to determine when and how the version changes. According to SemVer, anything in the public API can change at any time before version 1.0.0
To provide some stability to users of 0.X.X versions of CometBFT, the MINOR version is used to signal breaking changes across CometBFT's API. This API includes all publicly exposed types, functions, and methods in non-internal Go packages as well as the types and methods accessible via the CometBFT RPC interface.
Breaking changes to these public APIs will be documented in the CHANGELOG.
In an effort to avoid accumulating technical debt prior to 1.0.0, we do not guarantee that breaking changes (i.e. bumps in the MINOR version) will work with existing CometBFT blockchains. In these cases you will have to start a new blockchain, or write something custom to get the old data into the new chain. However, any bump in the PATCH version should be compatible with existing blockchain histories.
For more information on upgrading, see UPGRADING.md.
Because we are a small core team, we have limited capacity to ship patch updates, including security updates. Consequently, we strongly recommend keeping CometBFT up-to-date. Upgrading instructions can be found in UPGRADING.md.
Currently supported versions include:
Below are links to the original Tendermint consensus algorithm and relevant whitepapers which CometBFT will continue to build on.
CometBFT is currently maintained by Informal Systems. If you'd like to work full-time on CometBFT, we're hiring!
Funding for CometBFT development comes primarily from the Interchain Foundation, a Swiss non-profit. Informal Systems also maintains cometbft.com.
FAQs
Unknown package
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Socket CEO Feross Aboukhadijeh shares lessons from scaling a developer security startup to 10,000+ organizations in this founder interview.

Research
Socket Threat Research maps a rare inside look at OtterCookie’s npm-Vercel-GitHub chain, adding 197 malicious packages and evidence of North Korean operators.

Research
Socket researchers identified a malicious Chrome extension that manipulates Raydium swaps to inject an undisclosed SOL transfer, quietly routing fees to an attacker wallet.