#Overview

The VoteManager handles casting and receiving votes for conflicts. When a conflict is detected, the local representative casts a signed vote for one of the competing blocks. Votes from other representatives arrive over the network, are validated, and stored. After each stored vote, the QuorumManager retallies to check if resolution has been reached.

#Vote Struct

1type Vote struct {2    RepPubKey       string // hex-encoded ed25519 public key of the representative3    BlockHash       string // hex-encoded hash of the block voted for4    ConflictAccount string // account address of the conflict5    ConflictPrev    string // previous hash of the conflict6    Timestamp       int64  // unix nanoseconds7    Signature       []byte // ed25519 signature over voteSigningBytes8    Weight          uint64 // vote weight snapshot at cast time (not signed)9}

#Casting Votes: OnConflict()

OnConflict is the ConflictCallback implementation. It fires exactly once when a conflict first reaches size 2.

#Process

1. Acquire the per-conflict mutex (prevents double-voting via TOCTOU)
2. Check if this representative has already voted on the conflict — skip if so
3. Select the block with the lexicographically lowest hash (deterministic tie-breaking)
4. Look up weight from the conflict's weight snapshot (falls back to live weight if snapshot unavailable)
5. Build the Vote struct with timestamp, block hash, and conflict identifiers
6. Sign the vote with ed25519 using the node's private key
7. Store the vote via VoteStore.PutVote()
8. Notify the QuorumManager via OnVote()
9. Broadcast the vote via the VoteEmitter callback
10. Flush any pending votes that arrived before this conflict was detected

#Deterministic Tie-Breaking

blockHash := lowestHash(c.BlockHashes)

All honest representatives vote for the same block — the one with the lowest hash. This prevents an attacker from controlling the outcome by manipulating network propagation order (e.g., sending Block A to some nodes first and Block B to others).

#Receiving Votes: ReceiveVote()

ReceiveVote validates and stores an incoming vote from the network.

#Validation Steps

Votes pass through ValidateVote() which checks four conditions:

const voteWindowNanos = int64(5 * 60 * 1e9) // ±5 minutes

#No Vote Flipping

A representative can only vote once per conflict. After a vote is stored, subsequent votes from the same representative on the same conflict are silently ignored:

voted, err := vm.store.HasVoted(v.ConflictAccount, v.ConflictPrev, v.RepPubKey)if voted {    return nil // idempotent: already voted, silently ignore}

This prevents a representative from changing its vote after seeing how others voted.

#Weight Assignment

When storing a received vote, the weight is set from the conflict's weight snapshot, not from the vote itself:

1if conflict != nil && conflict.WeightSnapshot != nil {2    v.Weight = conflict.WeightSnapshot[v.RepPubKey]3} else {4    w := vm.ledger.GetVoteWeight(v.RepPubKey)5    // ...6}

This prevents timing attacks where an attacker inflates weight between conflict detection and voting.

#Post-Storage

After successful storage:

1. The QuorumManager is notified via OnVote() to retally the conflict
2. If quorum is reached, conflict resolution proceeds immediately

#Vote Buffering

Votes can arrive before the local node has detected the referenced conflict (e.g., due to network propagation delays). These are buffered rather than rejected.

#Buffer Rules

• Votes must still pass signature, weight, and timestamp checks
• Only the conflict existence check is deferred
• Maximum 10 buffered votes per conflict (DoS protection)
• Buffered votes are flushed when the conflict is eventually detected via OnConflict()

const maxPendingVotesPerConflict = 10

Vote arrives → ValidateVote fails (conflict not found)    │    ├── Passes signature, weight, timestamp? → Buffer it    └── Fails other checks? → Reject it Later: OnConflict() fires → flushPendingVotes() replays buffered votes

#Vote Encoding

Votes are serialized to a compact binary format for network transmission.

#Signing Bytes Layout

The signed payload (137 bytes) contains all vote fields except Signature and Weight:

#Wire Format

The full encoded vote appends the signature to the signing bytes:

func EncodeVote(v *Vote) ([]byte, error)func DecodeVote(data []byte) (*Vote, error)

#VoteEmitter

The VoteEmitter is an optional callback that broadcasts locally cast votes to the network:

VoteEmitter func(v *Vote)

When set, it is called after the vote is stored locally and the QuorumManager is notified. The emitter typically feeds into the gossip layer for network-wide distribution.

#VoteManager Construction

func NewVoteManager(store VoteStore, keyPair *KeyPair, ledger *Ledger) *VoteManager

The QuorumManager is registered separately via SetQuorumManager() to break the circular dependency (QuorumManager also references VoteStore).

#VoteStore Interface

1type VoteStore interface {2    PutVote(vote *Vote) error3    GetVotesByConflict(account, previous string) ([]*Vote, error)4    HasVoted(account, previous, repPubKey string) (bool, error)5}

#Concurrency

The VoteManager uses two levels of locking:

• Per-conflict mutex (sync.Map of *sync.Mutex) — serializes HasVoted + PutVote to prevent double-counting via TOCTOU race conditions
• Pending votes mutex — protects the buffered vote map

This allows votes for different conflicts to be processed concurrently while ensuring each conflict's vote state is consistent.

#Related Pages

• Consensus Overview — how voting fits into the consensus lifecycle
• Delegation — how voting weight is derived
• Conflict Detection — what triggers vote casting
• Quorum — how votes are tallied and conflicts resolved
• Gossip — how votes are broadcast across the network