Field Notes

entity

Matrix

StatusStableReviewdue UpdatedStands on6 sourcesSupportsnotes

Matrix is an open protocol for federated real-time communication and shared room state. Users belong to homeservers, and homeservers exchange room events through federation.

Architecture

A room may span many homeservers. Participating servers replicate persistent events, retrieve history and missing state, and synchronize membership and device information. This supports organizational autonomy, bridges, and rich collaboration. It also distributes metadata and operational trust across the servers represented in a room.

A room is not a message log. It is an append-only DAG of signed events that each participating homeserver replicates in part, and every event names the earlier events that authorize it to exist — its auth chain. A server can therefore verify independently that an event was permitted, by walking that chain back toward the room’s creation without trusting the server that relayed it.

The consequences of that structure run through the rest of this note. Because authorization is proved by reference to earlier events, membership changes, bans, and power-level changes cannot be removed without breaking the proofs built on top of them. Because no server holds the whole graph, ordering is reconstructed rather than known, and the depth and origin_server_ts fields used to break ties are supplied by the sending server. Because copies live on servers under other administrations, removal is advisory: a redaction strips an event’s content on servers that honor it and leaves the event’s position in the graph intact. An operator who ignores redactions can serve the original later to a server backfilling history.

Security boundary

Matrix E2EE uses Olm for device-to-device sessions and Megolm for group messages. Encryption is enabled at room level and depends on compatible clients, device verification, key sharing, backup, and recovery behavior.

Encrypted payloads remain opaque to homeservers, but federation still reveals room participation, server relationships, event timing, device-key activity, and other routing information. Bridges can introduce additional trust boundaries or terminate E2EE.

In Secure and decentralized communication stacks, Matrix is a strong federated collaboration substrate without being a metadata-private messenger.

State resolution and state resets

When two homeservers hold conflicting views of a room’s state, a state resolution algorithm decides which view wins. Its failure mode is the state reset: state reverting to an earlier or incorrect value with no event that would validly produce it. Users get re-added to rooms they left, membership stops being recognized, or access control rolls back. Administrators losing power over their own public rooms was the most visible symptom.

Room version 12 addressed this in September 2025, bundling three changes from Project Hydra.1 State Resolution v2.1 begins iterative auth checks from an empty state map and replays the events between conflicted events, not just the events themselves, resolving CVE-2025-49090. Room creators now hold an infinite power level that cannot be set in m.room.power_levels or changed after creation, which removes the path by which a reset stripped moderators. Room IDs became hashes of the create event, resolving CVE-2025-54315.

Room version 12 is the default for new rooms, but existing rooms carry the version they were created with. A room’s exposure to this class of bug is a property of that room rather than of the server running it, and closing it requires a room upgrade.

Media

Until 2024 a homeserver’s media repository served downloads without authentication, so a media URL worked for anyone holding it and a server could be induced to fetch and cache remote media. MSC3916 moved downloads and thumbnails to authenticated endpoints in Matrix 1.11, and Synapse has enforced this by default since November 2024.2

Media stored before a server enforced authentication stays reachable on the legacy endpoints indefinitely, a deliberate choice to avoid breaking existing links. The liability question that motivated the change is unaltered by it: a homeserver still caches media its users request from elsewhere, and nothing in the distribution scans that content.

Assessing critiques

Why not matrix collects twenty-one objections to the protocol and is a useful inventory of what the append-only model costs, provided its date is read correctly: the text is from 2023 and was republished under a 2026 byline, by which point its claims about media authentication and about state resets having no fix had both been overtaken.

  1. Project Hydra: Improving state resolution in Matrix (Matrix.org, 14 August 2025) describes MSC4289, MSC4291, and MSC4297, and names #rust, the Matrix.org Foundation office room, TWIM, Techlore, and Furrytech among the rooms whose state resets it fixes. Room version 12 shipped as the new default in Matrix 1.16 on 17 September 2025; the room version is specified at spec.matrix.org/v1.16/rooms/v12. ↩

  2. Matrix v1.11 release (Matrix.org, 20 June 2024) announces MSC3916 and the freeze plan for unauthenticated endpoints. Synapse 1.120.0 (26 November 2024) changed enable_authenticated_media to default true, noting matrix.org had enforced it since September 2024; the option was removed in July 2025. ↩

Built on 6 sources (6 external).

Working out connections…