You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: src/pages/guide/node/validator-config-v2.mdx
+61-31Lines changed: 61 additions & 31 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -7,7 +7,7 @@ description: Manage your validator with ValidatorConfig V2. Self-service key rot
7
7
8
8
ValidatorConfig V2 ([TIP-1017](/protocol/tips/tip-1017)) is a new precompile for managing consensus participants. It replaces the original ValidatorConfig with stronger safety guarantees: ed25519 signature verification at registration, append-only history, and self-service operations for validators.
9
9
10
-
V2 becomes available after the T2 hardfork is activated and after an admin has finished the migration of entries from V1 to V2. Migration completion will be communicated to operators — you can also [check if V2 is active](#check-if-v2-is-active) yourself.
10
+
V2 was [activated on mainnet](https://explore.mainnet.tempo.xyz/receipt/0x4716147e3c2bf5c8d014b8c27d6e2af0042d5a5f29bdead256d6f33038702d64)after the T2 hardfork.
11
11
12
12
## Validator states
13
13
@@ -38,24 +38,6 @@ All write operations require either the contract owner or the validator's own ad
If `isInitialized()` returns `true`, V2 is active and all operations on this page are available. If it returns `false`, the network is still on [ValidatorConfig V1](/guide/node/validator-config-v1).
58
-
59
41
## Reading validator state
60
42
61
43
### Query active validators
@@ -96,6 +78,58 @@ The returned `Validator` struct fields are:
96
78
97
79
## Operator guide
98
80
81
+
### Initial registration
82
+
83
+
To register a new validator, you must provide the following values to the Tempo team:
84
+
85
+
| Value | Format | Description |
86
+
|-------|--------|-------------|
87
+
|**Validator address**| Ethereum address (`0x…`) | The control address for your validator. Used to authorize on-chain operations (IP updates, rotation, ownership transfer). |
88
+
|**Public key**|`0x`-prefixed 32-byte hex | Your ed25519 identity key. Generate one with `tempo consensus generate-private-key` (see [below](#generating-a-signing-key)). |
89
+
|**Ingress**|`IP:port`| The inbound address other validators use to reach your node. Must be unique across all active validators. |
90
+
|**Egress**|`IP`| The outbound IP address your node uses to connect to other validators. |
91
+
|**Fee recipient**| Ethereum address (`0x…`) | The address that receives transaction fees from blocks your validator proposes. If you are not prepared to accept fees, use `0x0000000000000000000000000000000000000000`. |
92
+
|**Signature**|`0x`-prefixed hex | An ed25519 signature proving you control the signing key. See below. |
93
+
94
+
#### Generating a signing key
95
+
96
+
:::warning
97
+
Never share your private signing key. Anyone with access to it can impersonate your validator.
98
+
:::
99
+
100
+
Generate an ed25519 keypair:
101
+
102
+
```bash
103
+
tempo consensus generate-private-key --output <path>
104
+
```
105
+
106
+
Verify the public key:
107
+
108
+
```bash
109
+
tempo consensus calculate-public-key --private-key <path>
110
+
```
111
+
112
+
The public key should match the output of the `generate-private-key` command.
113
+
114
+
#### Creating the add-validator signature
115
+
116
+
The signature proves ownership of the ed25519 key being registered. Generate it with:
117
+
118
+
```bash
119
+
tempo consensus create-add-validator-signature \
120
+
--signing-key <PRIVATE_KEY_PATH> \
121
+
--validator-address <YOUR_VALIDATOR_ADDRESS> \
122
+
--public-key <YOUR_PUBLIC_KEY> \
123
+
--ingress <IP:PORT> \
124
+
--egress <IP> \
125
+
--fee-recipient <FEE_RECIPIENT_ADDRESS> \
126
+
--chain-id-from-rpc-url https://rpc.tempo.xyz
127
+
```
128
+
129
+
This outputs a hex-encoded signature. Provide this signature along with the values above to the Tempo team to complete registration.
130
+
131
+
Once the Tempo team adds your validator on-chain, it will enter the active set in the [next epoch](#validator-states).
132
+
99
133
### Update the Fee Recipient
100
134
101
135
The fee recipient used by your validator when constructing block proposals is managed on-chain. This can be updated and takes effect on the next finalized block
@@ -106,7 +140,6 @@ tempo consensus set-validator-fee-recipient <address/pubkey/index>
106
140
--rpc-url https://rpc.tempo.xyz
107
141
--private-key <PATH_TO_VALIDATOR_PRIVATE_KEY>
108
142
```
109
-
110
143
### Update IP addresses
111
144
112
145
If your node's network endpoints change, update them on-chain. The change takes effect at the next finalized block.
@@ -127,16 +160,23 @@ Ingress addresses must be unique across all active validators. The transaction w
127
160
128
161
### Rotate validator identity
129
162
130
-
V2 lets you rotate to a new ed25519 key while keeping your validator index stable. This is useful for key rotation or recovery without leaving and re-joining the committee.
163
+
V2 lets you rotate to a new ed25519 key while keeping your validator index stable. This is useful for key rotation or recovery without leaving and re-joining the committee.[Generate a new signing key](#generating-a-signing-key) first.
131
164
132
165
The simplest way to rotate is using the `tempo` CLI, which handles signature creation and the on-chain transaction in one step:
133
166
134
167
```bash
135
168
tempo consensus rotate-validator \
169
+
--validator-address <YOUR_VALIDATOR_ADDRESS> \
170
+
--public-key <NEW_PUBLIC_KEY> \
171
+
--ingress <NEW_IP:PORT> \
172
+
--egress <NEW_IP> \
136
173
--signing-key <NEW_PRIVATE_KEY_PATH> \
174
+
--private-key <ETHEREUM_PRIVATE_KEY_PATH> \
137
175
--rpc-url https://rpc.tempo.xyz
138
176
```
139
177
178
+
If self-service rotation is not yet enabled for your validator, use `tempo consensus create-rotate-validator-signature` to generate the signature and provide it to the Tempo team.
179
+
140
180
:::info
141
181
Rotation preserves your validator index and active validator count. The old entry is appended to history as deactivated, and the entry at your index is updated in place. You must use a different ingress address (changing the port is sufficient).
142
182
:::
@@ -155,16 +195,6 @@ tempo consensus validators-info --rpc-url https://rpc.tempo.xyz
155
195
Once the old validator shows `in_committee = false`, it is safe to shut down.
156
196
:::
157
197
158
-
#### Initial registration
159
-
160
-
When registering a new validator, generate the add-validator signature and provide it to the Tempo team:
161
-
162
-
```bash
163
-
tempo consensus create-add-validator-signature \
164
-
--signing-key <PRIVATE_KEY_PATH> \
165
-
--rpc-url https://rpc.tempo.xyz
166
-
```
167
-
168
198
### Transfer validator ownership
169
199
170
200
Rebind your validator entry to a new control address:
Copy file name to clipboardExpand all lines: src/pages/guide/node/validator.mdx
+4-23Lines changed: 4 additions & 23 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -4,11 +4,11 @@ description: Configure and run a Tempo validator node. Generate signing keys, pa
4
4
5
5
# Running a validator node
6
6
7
-
:::info
8
-
The management of the active validator set is currently permissioned by the Tempo team. If you are interested in becoming a validator, please [get in touch](mailto:partners@tempo.xyz) with the Tempo team.
9
-
:::
7
+
Validator nodes secure Tempo by validating blocks and participating in consensus.
10
8
11
-
Validator nodes secure Tempo by validating blocks and transactions, then using [Threshold Simplex](https://docs.rs/commonware-consensus/0.0.61/commonware_consensus/threshold_simplex/index.html) to reach consensus. They distribute signing shares among themselves to collectively sign block approvals and finalizations.
9
+
## Deploying a validator
10
+
11
+
The active validator set is currently permissioned. If you are interested in becoming a validator, please [get in touch](mailto:partners@tempo.xyz) with the Tempo team. See [Initial registration](/guide/node/validator-config-v2#initial-registration) for technical details.
12
12
13
13
## Cryptographic key hierarchy
14
14
@@ -18,22 +18,6 @@ All validators have two kinds of keys:
18
18
19
19
The signing key is static. Pre-T2, it can only be rotated by removing and re-creating a validator on-chain with the Tempo team. Post-T2, [ValidatorConfig V2](/guide/node/validator-config-v2) enables self-service rotation via the `rotateValidator` precompile. The signing share is dynamic and is updated periodically on each DKG ceremony. Once updated, it will be saved to disk. Currently, the DKG ceremony is scheduled to run on-chain every ~3 hours.
20
20
21
-
## Generating a signing key
22
-
23
-
You can generate an ED25519 keypair using the following command:
24
-
25
-
```bash
26
-
tempo consensus generate-private-key --output <path>
27
-
```
28
-
29
-
Once the private key is generated, you can calculate/verify the public key by running:
30
-
31
-
```bash
32
-
tempo consensus calculate-public-key --private-key <path>
33
-
```
34
-
35
-
The public key should match the output of the `generate-private-key` command.
36
-
37
21
## Running the validator
38
22
39
23
The process for running a validator node is very similar to [running a full node](/guide/node/rpc).
@@ -45,12 +29,9 @@ Once you've downloaded the snapshot and have been whitelisted on-chain, you can
If you are not prepared to accept fees, we recommend setting the `--consensus.fee-recipient` field to `0x0000000000000000000000000000000000000001` as that will funnel the funds to a non-user controllable wallet (there is no known private key for the address).
0 commit comments