Concept
Proof of stake
How validators, delegations and stake positions work on Tenrai. The lifecycle of a position, epochs and snapshots, rewards, unbonding and slashing.
On this page
Stake gives validators their weight in the committee that certifies cuts. This page describes the staking state; Consensus and finality describes the voting.
Validators and positions
A validator is a record on the chain: an owner, a consensus key, a network endpoint and a state. It is created by a registration that bonds the validator's own stake, the self-bond, of at least 100,000 TRAI.
A stake position is one bonded amount: the self-bond or a delegation of at least 1,000 TRAI. A position has an owner, who may unbond and withdraw it, and a reward address, which receives its income. Delegating does not hand over the coins. The validator can never move a delegator's stake.
| Limit | Value |
|---|---|
| Validator records | 256 |
| Committee seats | 64 |
| Stake positions in total | 65,536 |
A validator's weight is the sum of its bonded positions.
Epochs and snapshots
An epoch is 34,560 cuts, one day. Two cuts before an epoch begins, the chain takes a snapshot of the staking state. The committee and the weights of the new epoch come from that snapshot and stay fixed until the next one. Bonding or unbonding during an epoch changes the weights of a later epoch, never of the running one.
A validator counts in a snapshot only while it is live and active:
| Live | Its last heartbeat is at most two epochs old. The validator's node sends one heartbeat transaction per epoch, paid from a separate fee key |
|---|---|
| Active | Its two-epoch registration delay has passed and it is not jailed |
These checks decide who can enter a committee, not who earns.
Earning depends on attendance. Each epoch is split into twelve equal windows, and a committee member qualifies for the epoch's rewards only if its signature is in finalized cut certificates in at least nine of them. The chain records this itself, so every node arrives at the same result. A member that misses it is jailed for two epochs; jailing costs no stake.
Life of a position
| State | Meaning |
|---|---|
| Bonded | Counts toward the validator's weight and earns rewards |
| Exit requested | The owner asked for it back. It stays bonded and slashable while the sitting committee still votes with its weight |
| Unbonding | No longer counted. Waiting for the end of the unbonding period |
| Withdrawable | The owner can withdraw the principal into a normal output |
The unbonding period is 10 days from the finalized exit request. Requests are worked off in order, at most 256 per cut.
A finalized validator exit requests an exit for every still-bonded position, including delegations. Each delegation remains owned by its delegator, who withdraws the remaining principal after unbonding. Shutting down a validator node does not force an exit: a delegator can always request an exit for its own position without the validator being online.
Rewards
Half of every cut's subsidy and half of every fee go into the staking pool of the running accounting interval, which is as long as an epoch. When the interval ends, the pool is paid out in proportion to principal, to the positions as they stood when the interval began. Payouts are ordinary outputs, created by the cuts that follow, at most 512 positions per cut.
- Only positions of committee members that qualified through attendance share the pool. A validator outside the committee earns nothing for that interval, however live it is.
- A validator chooses a commission from 0 % to 10 % of its delegators' rewards, in steps of 0.1 %. Its own bond keeps its full share; the commission comes out of the delegators' shares.
- Only one commission change can be pending. It takes effect 14 epochs after it is scheduled; the rate at the start of an interval applies to the whole interval.
- Rewards are not added to the position. To compound, bond them as a new position.
Updating a consensus key or endpoint
A validator can replace its consensus key. The new key signs after a delay of two epochs, so the committee of the running and the next epoch is never changed underneath it. The registration and the rotation both include a proof that the validator holds the new key.
A validator can also schedule a replacement for its registered endpoint without changing its consensus key. The owner and the active consensus key both authorize it, and it takes effect at the finalized epoch boundary two epochs later. A public IP change is learned through the validator overlay and needs no transaction.
Slashing
A validator that signs two conflicting votes for one height has equivocated. Once the evidence is executed, the validator record is removed and its self-bond is burned. Every delegation to it that can still be slashed loses 10 % of its principal and unbonds with the rest.
Equivocation is the only offence that costs principal. A missed heartbeat, downtime or missed attendance can cost rewards and jail a validator, but never stake.
Risk for delegators
A delegator loses at most 10 % of a position, and only when a validator is proven to have equivocated. The rest stays theirs and becomes withdrawable after unbonding. The usual cause is an operator who runs the same key on two machines.