Validator FAQ

Check the FAQ for running a validator on Qubetics.

General Concepts

What is a validator?

Qubetics is powered by Tendermint Core (Comet BFT), which relies on a set of validators to secure the network. Validators run a full node and participate in consensus by broadcasting votes which contain cryptographic signatures signed by their private key. Validators commit new blocks in the blockchain and receive revenue in exchange for their work. They also participate in on-protocol treasury governance by voting on governance proposals. A validator's voting influence is weighted according to their total stake.

What is "staking"?

Qubetics is a public Proof-of-Stake (PoS) blockchain, meaning that validator's weight is determined by the amount of staking tokens (TICS) bonded as collateral. These staking tokens can be staked directly by the validator or delegated to them by TICS holders.

Any user in the system can declare its intention to become a validator by sending a create-validator transaction. From there, they become validators.

The weight (i.e. total stake or voting power) of a validator determines wether or not it is an active validator, and also how frequently this node will have to propose a block and how much revenue it will obtain. Initially, only the top 100 validators with the most weight will be active validators. If validators double-sign, or are frequently offline, they risk their staked tokens (including TICS delegated by users) being "slashed" by the protocol to penalize negligence and misbehavior.

What is a full node?

A full node is a program that fully validates transactions and blocks of a blockchain. It is distinct from a light client node that only processes block headers and a small subset of transactions. Running a full node requires more resources than a light client but is necessary in order to be a validator. In practice, running a full-node only implies running a non-compromised and up-to-date version of the software with low network latency and without downtime.

Of course, it is possible and encouraged for any user to run full nodes even if they do not plan to be validators.

What is a delegator?

Delegators are TICS holders who cannot, or do not want to run validator operations themselves. Users can delegate TICS to a validator and obtain a part of its revenue in exchange (for more detail on how revenue is distributed, see What is the incentive to stake? and What is a validator's commission? sections below).

Because they share revenue with their validators, delegators also share responsibility. Should a validator misbehave, each of its delegators will be partially slashed in proportion to their stake. This is why delegators should perform due-diligence on validators before delegating, as well as diversifying by spreading their stake over multiple validators.

Delegators play a critical role in the system, as they are responsible for choosing validators. Be aware that being a delegator is not a passive role. Delegators are obligated to remain vigilant and actively monitor the actions of their validators, switching should they fail to act responsibly.

Becoming a Validator

How to become a validator?

Any participant in the network can signal their intent to become a validator by creating a validator and registering its validator profile. To do so, the candidate broadcasts a create-validator transaction, in which they must submit the following information:

• Validator's PubKey: Validator operators can have different accounts for validating and holding liquid funds. The PubKey submitted must be associated with the private key with which the validator intends to sign prevotes and precommits.

• Validator's Address: qubeticsvaloper1- address. This is the address used to identify your validator publicly. The private key associated with this address is used to bond, unbond, and claim rewards.

• Validator's name (also known as the moniker)

• Validator's website (optional)

• Validator's description (optional)

• Initial commission rate: The commission rate on block provisions, block rewards and fees charged to delegators.

• Maximum commission: The maximum commission rate which this validator will be allowed to charge.

• Commission change rate: The maximum daily increase of the validator commission.

• Minimum self-bond amount: Minimum amount of TICS the validator needs to have bonded at all times. If the validator's self-bonded stake falls below this limit, its entire staking pool will be unbonded.

• Initial self-bond amount: Initial amount of TICS the validator wants to self-bond.

qubeticsd tx staking create-validator
--pubkey qubeticsvalconspub1zcjduepqs5s0vddx5m65h5ntjzwd0x8g3245rgrytpds4ds7vdtlwx06mcesmnkzly
--amount "2tics"
--from tmp
--commission-rate="0.20"
--commission-max-rate="1.00"
--commission-max-change-rate="0.01"
--min-self-delegation "1"
--moniker "validator"
--chain-id "qubetics_9030-1"
--gas auto

Once a validator is created and registered, TICS holders can delegate TICS to it, effectively adding stake to its pool. The total stake of a validator is the sum of the TICS self-bonded by the validator's operator and the TICS bonded by external delegators.

Only the top 100 validators with the most stake are considered the active validators, becoming bonded validators. If ever a validator's total stake dips below the top 100, the validator loses its validator privileges (meaning that it won't generate rewards) and no longer serves as part of the active set (i.e doesn't participate in consensus), entering unbonding mode and eventually becomes unbonded.

Validator keys and states

What are the different types of keys?

In short, there are two types of keys:

• Tendermint Key: This is a unique key used to sign block hashes. It is associated with a public key qubeticsvalconspub.

  • Generated when the node is created with qubeticsd init.

  • Get this value with qubeticsd tendermint show-validator e.g. qubeticsvalconspub1zcjduc3qcyj09qc03elte23zwshdx92jm6ce88fgc90rtqhjx8v0608qh5sspc

• Application keys: These keys are created from the application and used to sign transactions. As a validator, you will probably use one key to sign staking-related transactions, and another key to sign oracle-related transactions. Application keys are associated with a public key qubeticspub- and an address qubetics-. Both are derived from account keys generated by qubetics keys add.

⚠️ A validator's operator key is directly tied to an application key, but uses reserved prefixes solely for this purpose: qubeticsvaloper and qubeticsvaloperpub

What are the different states a validator can be in?

After a validator is created with a create-validator transaction, it can be in three states:

• bonded: Validator is in the active set and participates in consensus. Validator is earning rewards and can be slashed for misbehaviour.

• unbonding: Validator is not in the active set and does not participate in consensus. Validator is not earning rewards, but can still be slashed for misbehaviour. This is a transition state from bonded to unbonded. If validator does not send a rebond transaction while in unbonding mode, it will take two weeks for the state transition to complete.

• unbonded: Validator is not in the active set, and therefore not signing blocks. Unbonded validators cannot be slashed, but do not earn any rewards from their operation. It is still possible to delegate TICS to this validator. Un-delegating from an unbonded validator is immediate.

Delegators have the same state as their validator.

⚠️warning Delegations are not necessarily bonded. TICS can be delegated and bonded, delegated and unbonding, delegated and unbonded, or liquid.

What is "self-bond"? How can I increase my "self-bond"?

The validator operator's "self-bond" refers to the amount of TICS stake delegated to itself. You can increase your self-bond by delegating more TICS to your validator account.

Is there a testnet faucet?

If you want to obtain coins for the testnet, you can do so by using the faucet.

Is there a minimum amount of TICS that must be staked to be an active (bonded) validator?

There is 25000TICS token minimum. The top 100 validators with the highest total stake (where total stake = self-bonded stake + delegators stake) are the active validators.

How will delegators choose their validators?

Delegators are free to choose validators according to their own subjective criteria. That said, criteria anticipated to be important include:

• Amount of self-bonded TICS: Number of TICS a validator self-bonded to its staking pool. A validator with higher amount of self-bonded TICS has more skin in the game, making it more liable for its actions.

• Amount of delegated TICS: Total number of TICS delegated to a validator. A high stake shows that the community trusts this validator, but it also means that this validator is a bigger target for hackers. Validators are expected to become less and less attractive as their amount of delegated TICS grows. Bigger validators also increase the centralization of the network.

• Commission rate: Commission applied on revenue by validators before it is distributed to their delegators

• Track record: Delegators will likely look at the track record of the validators they plan to delegate to. This includes seniority, past votes on proposals, historical average uptime and how often the node was compromised.

Apart from these criteria, there will be a possibility for validators to signal a website address to complete their resume. Validators will need to build reputation one way or another to attract delegators.

Responsibilities

Do validators need to be publicly identified?

No, they do not. Each delegator will value validators based on their own criteria. Validators will be able(and are advised) to register a website address when they nominate themselves so that they can advertise their operation as they see fit. Some delegators may prefer a website that clearly displays the team running the validator and their resume, while others might prefer anonymous validators with positive track records. Most likely both identified and anonymous validators will coexist in the validator set.

What are the responsibilities of a validator?

Validators have three main responsibilities:

• Be able to constantly run a correct version of the software: validators need to make sure that their servers are always online and their private keys are not compromised.

• Provide oversight and feedback on correct deployment of community pool funds: the Qubetics protocol includes the a governance system for proposals to the facilitate adoption of its currencies. Validators are expected to hold budget executors to account to provide transparency and efficient use of funds.

Additionally, validators are expected to be active members of the community. They should always be up-to-date with the current state of the ecosystem so that they can easily adapt to any change.

What does staking imply?

Staking Qubetics can be thought of as a safety deposit on validation activities. When a validator or a delegator wants to retrieve part or all of their deposit, they send an unbonding transaction. Then, the deposit undergoes a two week unbonding period during which they are liable to being slashed for potential misbehavior committed by the validator before the unbonding process started.

Validators, and by association delegators, receive block provisions, block rewards, and fee rewards. If a validator misbehaves, a certain portion of its total stake is slashed (the severity of the penalty depends on the type of misbehavior). This means that every user that bonded TICS to this validator gets penalized in proportion to its stake. Delegators are therefore incentivized to delegate to validators that they anticipate will function safely.

Can a validator run away with its delegators' TICS?

By delegating to a validator, a user delegates staking power. The more staking power a validator has, the more weight it has in the consensus and processes. This does not mean that the validator has custody of its delegators' TICS. By no means can a validator run away with its delegator's funds.

Even though delegated funds cannot be stolen by their validators, delegators are still liable if their validators misbehave. In such case, each delegators' stake will be partially slashed in proportion to their relative stake.

How often will a validator be chosen to propose the next block? Does it go up with the quantity of TICS staked?

The validator that is selected to mine the next block is called the proposer, the "leader" in the consensus for the round. Each proposer is selected deterministically, and the frequency of being chosen is equal to the relative total stake (where total stake = self-bonded stake + delegators stake) of the validator. For example, if the total bonded stake across all validators is 100 TICS, and a validator's total stake is 10 TICS, then this validator will be chosen 10% of the time as the proposer.

To understand more about the proposer selection process in Tendermint BFT consensus, read more in their official docs.

Incentives

What is the incentive to stake?

The main incentive to stake is that you earn 30% APY in block rewards, while unstaked tokens get diluted since rewards are only distributed to stakers. On top of that, 20% of transaction fees are burned (making TICS more scarce), and 80% goes into the community pool to grow the ecosystem. So staking not only gives you yield but also protects your share of the network over time.

What is the incentive to run a validator?

Validators earn proportionally more revenue than their delegators because of commissions.

Validators also play a major role in governance. If a delegator does not vote, they inherit the vote from their validator. This gives validators a major responsibility in the ecosystem.

What is a validator's commission?

Revenue received by a validator's pool is split between the validator and its delegators. The validator can apply a commission on the part of the revenue that goes to its delegators. This commission is set as a percentage. Each validator is free to set its initial commission, maximum daily commission change rate and maximum commission. Qubetics enforces the parameter that each validator sets. These parameters can only be defined when initially declaring candidacy, and may only be constrained further after being declared.

How are block provisions distributed?

Block provisions (rewards) are distributed proportionally to all validators relative to their total stake (voting power). This means that even though each validator gains TICS with each provision, all validators will still maintain equal weight.

Let us take an example where we have 10 validators with equal staking power and a commission rate of 1%. Let us also assume that the provision for a block is 1000 TICS and that each validator has 20% of self-bonded TICS. These tokens do not go directly to the proposer. Instead, they are evenly spread among validators. So now each validator's pool has 100 TICS. These 100 TICS will be distributed according to each participant's stake:

• Commission: 100*80%*1% = 0.8 TICS

• Validator gets: 100\*20% + Commission = 20.8 TICS

• All delegators get: 100\*80% - Commission = 79.2 TICS

Then, each delegator can claim its part of the 79.2 TICS in proportion to their stake in the validator's staking pool. Note that the validator's commission is not applied on block provisions. Note that block rewards (paid in TICS) are distributed according to the same mechanism.

How are fees distributed?

Fees are not distributed 20% of transaction fees are burned (making TICS more scarce), and 80% goes into the community pool to grow the ecosystem.

What are the slashing conditions?

If a validator misbehaves, its bonded stake along with its delegators' stake and will be slashed. The severity of the punishment depends on the type of fault. There are 3 main faults that can result in slashing of funds for a validator and its delegators:

• Double-signing: If someone reports on chain A that a validator signed two blocks at the same height on chain A and chain B, and if chain A and chain B share a common ancestor, then this validator will get slashed on chain A. The penalty for double signing is 5% of total stake.

• Downtime: If a validator misses more than 50% of the last 100000 blocks, they will get slashed by 1%.

• Unavailability: If a validator's signature has not been included in the last X blocks, the network measures this within a defined slashing window. Here, X is the number of missed blocks by the validator, and Y is the maximum allowed misses. For example, with a slashing window of 100,000 blocks, X represents the actual missed count, and Y is set at 50,000 (50% of the window). If the validator misses fewer than 50,000 blocks, it stays active without penalty. If it misses 50,000 or more, the validator is slashed, jailed, and removed from the active set, requiring delegators to redelegate or wait until the validator unjails. The 50% threshold is used to ensure liveness. If it were set to 100%, then a validator would only be punished after missing every block, which would make the system ineffective. By setting it to 50%, the network allows some downtime, giving validators a chance to recover and stay active if they miss fewer than 50,000 blocks, without affecting their stake. If the threshold is breached, the penalty applied is 1% of the validator’s and delegator stake.

Note that even if a validator does not intentionally misbehave, it can still be slashed if its node crashes, looses connectivity, gets DDoSed, or if its private key is compromised.

Do validators need to self-bond TICS?

A validator’s total stake comes from two parts:

• their own self-bonded stake (what they personally lock up), and

• the delegated stake (what delegators delegate to them).

Even if a validator doesn’t put much of their own tokens, they can still attract delegators. That’s why reputation matters a lot.

However, delegators usually prefer validators who also stake their own tokens — this shows they have skin in the game.

To give confidence, a validator can set a minimum self-bond amount. If their self-bond drops below that limit, both the validator and their delegators will automatically unbond.

Technical Requirements

What are hardware requirements?

Validators should expect to provision one or more data center locations with redundant power, networking, firewalls, HSMs and servers.

We expect that a modest level of hardware specifications will be needed initially and that they might rise as network use increases.

What are software requirements?

In addition to running an Qubetics node, validators should develop monitoring, alerting and management solutions.

What are bandwidth requirements?

Qubetics has the capacity for very high throughput compared to chains like Ethereum or Bitcoin.

As such, we recommend that the data center nodes only connect to trusted full nodes in the cloud or other validators that know each other socially. This relieves the data center node from the burden of mitigating denial-of-service attacks.

Ultimately, as the network becomes more used, one can realistically expect daily bandwidth on the order of several gigabytes.

What does running a validator imply in terms of logistics?

A successful validator operation will require the efforts of multiple highly skilled individuals and continuous operational attention. This will be considerably more involved than running a bitcoin miner for instance.

What can validators expect in terms of operations?

Running effective operation is the key to avoiding unexpectedly unbonding or being slashed. This includes being able to respond to attacks, outages, as well as to maintain security and isolation in your data center.

What are the maintenance requirements?

Validators should expect to perform regular software updates to accommodate upgrades and bug fixes. There will inevitably be issues with the network early in its bootstrapping phase that will require substantial vigilance.

How can validators protect themselves from Denial-of-Service attacks?

Denial-of-service attacks occur when an attacker sends a flood of internet traffic to an IP address to prevent the server at the IP address from connecting to the internet.

An attacker scans the network, tries to learn the IP address of various validator nodes and disconnect them from communication by flooding them with traffic.

One recommended way to mitigate these risks is for validators to carefully structure their network topology in a so-called sentry node architecture.

Validator nodes should only connect to full-nodes they trust because they operate them themselves or are run by other validators they know socially. A validator node will typically run in a data center. Most data centers provide direct links the networks of major cloud providers. The validator can use those links to connect to sentry nodes in the cloud. This shifts the burden of denial-of-service from the validator's node directly to its sentry nodes, and may require new sentry nodes be spun up or activated to mitigate attacks on existing ones.

Sentry nodes can be quickly spun up or change their IP addresses. Because the links to the sentry nodes are in private IP space, an internet based attacked cannot disturb them directly. This will ensure validator block proposals and votes always make it to the rest of the network.

It is expected that good operating procedures on that part of validators will completely mitigate these threats.

For more on sentry node architecture, see this.