Miden validator

miden-validator is a Miden node binary that validates network activity before blocks are committed. It is part of the Miden node repository; see the repository README for the overall project layout.

Role

The validator is separate from node so that block construction and block validation can be operated as distinct services. It verifies submitted transactions, validates proposed blocks, and signs blocks that satisfy the validator's checks.

The validator binary is also responsible for creating the genesis block, via its genesis command. The genesis block is not signed; it commits to the validator set that must sign every subsequent block, and is then used to initialize the validators, the node, and other services that need trusted genesis state.

Operation

The validator expects to operate as an internal service within a Miden network's infrastructure and exposes a gRPC API for use by trusted internal nodes.

It supports local development keys and KMS-backed signing for deployments that need external key management.

Peer-to-peer DKG

Validators compare ceremony transcript commitments and abort on a mismatch, including when a participant sends conflicting contributions to different peers (equivocation).

Completion requires every configured validator. Any participant can prevent completion by withholding messages or sending conflicting contributions. Run the ceremony with validators you trust to cooperate; it cannot exclude a faulty participant and continue with a smaller set.

Supply each peer to miden-validator dkg participate as --peer <PUBLIC_KEY> <ENDPOINT_ID>[@<IP:PORT>]. The socket address is required unless --enable-public-relay is set. By default, peers connect directly without public relays or address discovery. Use --bind-address <IP:PORT> to select the local UDP listening address. A nonzero port is required without public relays when any peer has a smaller endpoint ID, because those peers connect to you. Loopback addresses allow a local ceremony without internet access.

Use --enable-public-relay on each participant to opt into n0's public Iroh relays and address discovery. Peer socket addresses then become optional: --peer <PUBLIC_KEY> <ENDPOINT_ID> is sufficient. Direct connections remain available, with encrypted relay transport as a fallback. The public relays are intended for development and testing, not guaranteed production availability.

Each participant supplies its persistent identity with --endpoint-secret <FILE>. Regardless of the connection route, each endpoint must authenticate with its configured validator public key. Obtain these keys from a trusted source. All participants must configure the same validator set.

License

This project is MIT licensed.