valopers state

auth

Auth

updateInstructions

NewInstructionsProposalCallback

init.4

MonikerMaxLength

DescriptionMaxLength

ServerTypeCloud

ServerTypeOnPrem

ServerTypeDataCenter

ErrValoperExists

ErrValoperMissing

ErrInvalidAddress

ErrInvalidMoniker

ErrInvalidDescription

ErrInvalidServerType

ErrOperatorSquatGuard

ErrSigningKeyTaken

ErrFrontrunValidator

ErrRotationThrottled

ErrRegistryEntryMissing

ErrDisallowedPubKeyType

valopers

// operator-address -> Valoper

instructions

// markdown instructions for valoper's registration

signingRegistry

monikerMaxLengthMiddle

validateMonikerRe

// 32 characters, including spaces, hyphens or underscores in the middle

regEntry

regEntry tracks signing-address -> operator with retirement metadata. retiredAtHeight == 0 means the entry is currently active for the operator.

Valoper

Valoper represents a validator operator profile.

AddToAuthList

DeleteFromAuthList

Register

Register registers a new valoper. The \`addr\` parameter is the operator address (stable identity, profile key); \`pubKey\` is the consensus signing pubkey, from which the signing address is derived. Auth shape: - Post-genesis: OriginCaller must equal addr (operator-slot squat guard). Genesis-mode replay (ChainHeight()==0) bypasses, so migration .jsonl txs and historical Register replays succeed. - Signing-address uniqueness: derived(pubKey) must not already be in signingRegistry, active or retired. - Front-running guard: post-genesis, derived(pubKey) must not already be an active validator (a fresh registration cannot squat on the consensus address of an existing validator). Why OriginCaller==addr is sufficient (no IsUserCall): squatting requires the attacker to be able to satisfy OriginCaller==victim, which requires the victim's signing key. r/sys/namereg/v1.Register also gates on IsUserCall, but that's because IT reads unsafe.OriginSend() for the anti-squatting payment and IsUserCall is needed to ensure the OriginSend envelope reflects what landed at this realm rather than a phantom payment from a previous frame. valopers.Register has no per-call payment-receipt check (fees are validated against banker.OriginSend in a way that's symmetric to IsUserCall via direct comparison), so the IsUserCall tightening would only block legitimate \`maketx run\` flows (operator-authored scripts that legitimately set OriginCaller==operator) without adding identity-squat protection. Auth-list seeding: the profile's Authorizable owner is set to addr (NOT OriginCaller). At H>0 the squat guard makes them equal anyway; at H==0 the deployer pattern (one signer registers many operators) requires owner == addr so each operator can manage their own profile post-genesis without needing the deployer's auth.

UpdateMoniker

UpdateMoniker updates an existing valoper's moniker.

UpdateDescription

UpdateDescription updates an existing valoper's description.

UpdateKeepRunning

UpdateKeepRunning updates an existing valoper's active status. Calls v3.NotifyValoperChanged because the cache stores KeepRunning.

UpdateServerType

UpdateServerType updates an existing valoper's server type.

UpdateSigningKey

UpdateSigningKey rotates an operator's consensus signing key. Auth: caller must be on the operator's auth list (defaults to operator at Register time; extendable via AddToAuthList). Invariants checked at entry: - throttle: ChainHeight() - v.LastRotationHeight >= rotationPeriodBlocks - signingRegistry uniqueness: derived(newPubKey) not in registry (active OR retired); permanently blocks key reuse - fee: unsafe.OriginSend() >= rotationFee (mirrors Register's fee-check pattern) Effect: profile's SigningPubKey/SigningAddress/LastRotationHeight updated; old registry entry marked retired (retiredAtHeight = ChainHeight()); new entry inserted into signingRegistry; v3 emits remove+add to sysparams via RotateValoperSigningKey; v3 cache refreshed via NotifyValoperChanged. Rotation lands in consensus at H+2. Atomicity: Gno tx atomicity rolls back all state if any step panics. If v3.RotateValoperSigningKey panics, the registry insert and profile mutation revert with it.

GetByAddr

GetByAddr fetches the valoper using the operator address, if present.

Render

Render renders a single valoper with their information.

renderHome

isValoper

isValoper checks if the valoper exists.

validateMoniker

validateMoniker checks if the moniker is valid.

validateDescription

validateDescription checks if the description is valid.

validateBech32

validateBech32 checks if the value is a valid bech32 address.

validatePubKey

validatePubKey checks if the public key is valid.

assertPubKeyTypeAllowed

assertPubKeyTypeAllowed panics if pubKey's type is not in the chain's validator allow-list (empty list accepts any).

pubKeyTypeURL

pubKeyTypeURL returns the amino type URL (e.g. "/tm.PubKeyEd25519") of a bech32 consensus pubkey.

validateServerType

validateServerType checks if the server type is valid.