What governance can change
Everything on this page is a dial the chain exposes to governance. Nothing else can be changed by a proposal, and nothing here can be changed by anyone else.
Each table gives what the parameter does, what it was set to at genesis, and the range the contract will accept. The proposal form shows the same range next to the parameter while you fill it in, so you never have to remember any of it. This page is for deciding whether a change is worth proposing.
Three conventions
Percentages are written as whole numbers over a base, and the base is not the same everywhere. Block fee shares and commission run over 10,000, so 1000 is 10%. The redelegation fee runs over 100,000, so 2 is 0.002%. Each table says which applies.
Amounts are in L2P in the tables below. The proposal form takes them in wei, the smallest unit, which is the number followed by eighteen zeros.
Durations are in blocks. A block arrives every 1.5 seconds, so a day is 57,600 blocks and a week is 403,200.
Block fees
Where the fee on every transaction goes. The three shares are taken from the same fee and together may not exceed 100%; whatever is left goes to the validator that produced the block.
| Parameter | What it does | Genesis | Range |
|---|---|---|---|
burnRatio |
The share of every fee destroyed instead of paid out. Raising it makes L2P scarcer and pays validators less | 1000 (10%) | The three together at most 10000 |
systemRewardBaseRatio |
The share routed to the system reward pot, which funds fast finality and pays whistleblowers | 625 (6.25%) | The three together at most 10000 |
systemRewardAntiMEVRatio |
An extra system reward share that ramps up across a producer's turn, to discourage reordering transactions for profit. Does nothing while a turn is one block long | 0 (off) | The three together at most 10000 |
Emissions
How the 50 billion staking pool is paid out. The emission schedule has the full ten-year table.
| Parameter | What it does | Genesis | Range |
|---|---|---|---|
emissionRatePerBlock |
New L2P created per block in the first window | 317 | 1 to 317 |
emissionHalvingPeriod |
Blocks in a window, after which the rate halves | 105,192,000 (5 years) | At least 1,000,000, about 17 days |
emissionMaxHalvings |
Windows paid before issuance stops for good | 2 | 1 to 20 |
Note the ceiling on the rate: governance can slow issuance down, and can never speed it up beyond what genesis set. The pool itself is a constant and no parameter can make the contract pay out more than it holds.
Who produces blocks
| Parameter | What it does | Genesis | Range |
|---|---|---|---|
maxElectedValidators |
How many validators are elected into the set each epoch | 45 | 1 to 500 |
numOfCabinets |
Ceiling on how many of them actually produce blocks. With fewer validators than this, all of them produce | 21 | 1 up to the elected maximum |
maxNumOfCandidates |
Candidates eligible to rotate into a producing slot. Zero means no rotation | 0 (off) | Above 0 |
maxNumOfWorkingCandidates |
Producing slots handed to shuffled candidates every 200 blocks | 0 (off) | At most the candidate maximum |
turnLength |
Consecutive blocks one validator may produce | 0, which reads as 1 | 1, or 3 to 64 |
Maintenance
Planned downtime, so an operator can upgrade without being punished for it.
| Parameter | What it does | Genesis | Range |
|---|---|---|---|
maxNumOfMaintaining |
Validators allowed in maintenance at the same time. One producing validator must always remain | 3 | Below the number of cabinet validators |
maintainSlashScale |
Divides the missed-block count charged when a validator leaves maintenance | 2 | 1 to 9 |
Staking and delegation
The rules everyone who stakes or delegates lives under.
| Parameter | What it does | Genesis | Range |
|---|---|---|---|
minSelfDelegationL2P |
What a validator must hold of its own to stay active and to leave jail. The strongest lever on how much skin an operator has in the game | 7,000,000 | 3,500,000 to 350,000,000 |
minDelegationL2PChange |
The smallest delegation or redelegation, which keeps dust off the chain | 3,500 | 350 to 35,000 |
unbondPeriod |
How long your coins wait after you undelegate before you can claim them | 7 days | 3 to 30 days |
redelegateFeeRate |
Fee for moving stake straight to another validator, over a base of 100,000. Paid to the destination validator | 2 (0.002%) | 0 to 100 |
transferGasLimit |
Gas forwarded when the contract pays a delegator out. Too low and payouts to unusual wallets fail | 5,000 | 2,300 to 10,000 |
maxNodeIDs |
Node identities one validator may register | 5 | Above 0 |
stakeHubProtector |
The address that may pause staking and maintain the blacklist. A safety measure, and a considerable amount of trust | Set at genesis | Any real address |
Punishment
| Parameter | What it does | Genesis | Range |
|---|---|---|---|
misdemeanorThreshold |
Missed blocks before a validator's pending rewards are redistributed | 50 | At least 1, below the felony threshold |
felonyThreshold |
Missed blocks before removal from the set and a downtime slash | 150 | Above the misdemeanor threshold, at most 1000 |
downtimeSlashAmount |
Stake cut for downtime. Taken from self-delegation and sent to the system reward pot | 35,000 | At least 3,500, below the felony amount |
felonySlashAmount |
Stake cut for a double sign or a malicious vote | 700,000 | At least 35,000, above the downtime amount |
downtimeJailTime |
How long a validator is benched after a downtime slash | 2 days | At least 1 day, below the felony jail time |
felonyJailTime |
How long a validator is benched after a felony | 30 days | At least 3 days, above the downtime jail time |
felonySlashScope |
How far back evidence of a felony may reach | 57,600 (1 day) | 1 to 30 days |
felonySlashRewardRatio |
Share of the system reward balance paid to whoever submits valid evidence | 20 (20%) | 10 to 99 |
maxFelonyBetweenBreatheBlock |
Felonies accepted per day, so one bug cannot jail the whole set at once | 2 | Above 0 |
enableMaliciousVoteSlash |
Whether finality violations are punished at all | false (off) | On or off |
Governance itself
Governance can rewrite its own rules, which is why these deserve the most scrutiny. Voting power is counted in govL2P, which you hold automatically for every L2P you have staked.
| Parameter | What it does | Genesis | Range |
|---|---|---|---|
votingDelay |
Blocks between creating a proposal and voting opening. Zero means voting is open the moment a proposal exists | 0 | 0 blocks to 24 hours |
votingPeriod |
How long voting stays open | 403,200 (7 days) | 1 block to 30 days |
minPeriodAfterQuorum |
Voting always stays open this long after quorum is reached, so nothing is pushed over the line at the last second | 57,600 (1 day) | 1 block to 2 days |
proposalThreshold |
The govL2P needed to submit a proposal at all | 700,000 | 1 to 35,000,000 |
quorumNumerator |
Share of all govL2P that has to vote for the result to count | 10 (10%) | 5 to 20 |
governorProtector |
The address that may pause governance | Set at genesis | Any real address |
minDelay (timelock) |
How long a passed proposal waits before anyone may execute it. This is the window in which everyone who disagrees can react | 24 hours | Above 0, at most 14 days |
Proposals may only ever call GovHub, which is the single audited path for applying a parameter change. That is fixed at genesis and is not a parameter.
The system reward operators
| Parameter | What it does | Genesis | Range |
|---|---|---|---|
addOperator |
Authorises an address to draw on the system reward pot | The validator set and the slash indicator | Any real address |
deleteOperator |
Removes that authorisation again | Any real address |
What is switched off at genesis
Three things ship deliberately inactive. None of them is an oversight, and each has a moment at which it should be turned on.
Candidate rotation. maxNumOfCandidates and maxNumOfWorkingCandidates are both zero. Below 21 validators the rotation code is never reached, so setting numbers now would change nothing observable, and choosing them later means choosing them against real participation. This has to be set before the set grows past 21 validators: after that point every validator outside the top 21 is permanently shut out of block production until it is.
Malicious vote slashing. enableMaliciousVoteSlash is false, so evidence of a finality violation is rejected. Verifying that evidence is intricate, and a fault there punishes honest validators. Double-sign slashing protects the chain in the meantime. It gets enabled once losing two validators at once is survivable.
Governance itself. The governor stays closed until 35,000,000 govL2P exists, which is five fully staked validators. Until then no proposal can be submitted, so a small amount of stake cannot steer the chain in its first weeks. It opens on its own when the threshold is reached, and it gates the two settings above, because both need a proposal.
Before you propose one
Every range above is enforced by the contract itself. A value outside it can pass its vote and then fail on execution, so check the range in the form before you write the description. Write a proposal covers how the value is encoded.
Several parameters are bound to each other: the two slash amounts, the two jail times, the two downtime thresholds and the three fee shares all have to stay in the right order. Changing one of a pair usually means proposing the other as well.