Note: This documentation assumes you have followed the instructions for Running a Full Node for Testnet.

The state-sync configuration in ~/.secretd/config/app.toml is as follows:

# snapshot-interval specifies the block interval at which local state sync snapshots are
# taken (0 to disable). Must be a multiple of pruning-keep-every.
snapshot-interval = 2000

# snapshot-keep-recent specifies the number of recent snapshots to keep and serve (0 to keep all).
snapshot-keep-recent = 10

1. Set SNAP_RPC variable to a snapshot RPC

SNAP_RPC="http://rpc.testnet.secretsaturn.net"

Set the state-sync BLOCK_HEIGHT and fetch the TRUST_HASH from the snapshot RPC. The BLOCK_HEIGHT to sync is determined by finding the latest block that's a multiple of snapshot-interval.

BLOCK_HEIGHT=$(curl -s $SNAP_RPC/block | jq -r .result.block.header.height | awk '{print $1 - ($1 % 2000)}'); \
TRUST_HASH=$(curl -s "$SNAP_RPC/block?height=$BLOCK_HEIGHT" | jq -r .result.block_id.hash)

2. Check variables to ensure they have been set

echo $BLOCK_HEIGHT $TRUST_HASH

# output should be something similar to:
# 3506000 FCB54D74A4A33F8C1CC18A7240D76D87CB192A89C17837C4DB6C6140612DDFEB

3. Set the required variables in ~/.secretd/config/config.toml

sed -i.bak -E "s|^(enable[[:space:]]+=[[:space:]]+).*$|\1true| ; \
s|^(rpc_servers[[:space:]]+=[[:space:]]+).*$|\1\"http://rpc.testnet.secretsaturn.net:26657,http://secret-testnet-rpc.01no.de:26657\"| ; \
s|^(trust_height[[:space:]]+=[[:space:]]+).*$|\1$BLOCK_HEIGHT| ; \
s|^(trust_hash[[:space:]]+=[[:space:]]+).*$|\1\"$TRUST_HASH\"| ; \
s|^(seeds[[:space:]]+=[[:space:]]+).*$|\1\"\"|" $HOME/.secretd/config/config.toml

4. Stop the node and reset the node database

It is recommended to copy data/priv_validator_state.json to a backup and restore it after unsafe-reset-all to avoid potential double signing.

sudo systemctl stop secret-node && secretd tendermint unsafe-reset-all --home ~/.secretd/

5. Restart node and check logs

This generally takes several minutes to complete, but has been known to take up to 24 hours.

sudo systemctl restart secret-node && journalctl -fu secret-node

How To Join Secret Network as a Full Node on Testnet

This document details how to join the Secret Network testnet as a full node. Once your full node is running, you can turn it into a validator in the optional last step.

Requirements

• Ubuntu/Debian host (with ZFS or LVM to be able to add more storage easily)

• A public IP address

• Open ports TCP 26656 & 26657 Note: If you're behind a router or firewall then you'll need to port forward on the network device.

• Reading Tendermint: Running in production

• RPC address of an already active node. You can use http://bootstrap.pulsar3.scrtlabs.com:26657, or any other node that exposes RPC services. Alternate RPC nodes available in the API Registry.

• Install SGX

Installation

Install SGX and secretd

For more information on SGX, see instructions for SGX Installation and Verifying SGX. See Node Registration Information if you'd like a more comprehensive overview on what's happening in these steps.

Initialize Secret Network Configs

Choose a moniker for yourself, and replace <MONIKER> with your moniker below. This moniker will serve as your public nickname in the network.

secretd init <MONIKER> --chain-id pulsar-3

This will generate the following files in ~/.secretd/config/

• genesis.json

• node_key.json

• priv_validator_key.json

Download genesis.json

The genesis file is how other nodes on the network know what network you should be on.

curl https://rpc.pulsar.scrttestnet.com/genesis | jq '.result.genesis' > ~/.secretd/config/genesis.json
# verify genesis.json checksum
echo "adb91d0ee8cb5da80ef47e0b13d42b89bba003063542054d67522e52ddb4f514 $HOME/.secretd/config/genesis.json" | sha256sum --check

Initialize Secret Enclave

Initialize /opt/secret/.sgx_secrets:

mkdir -p /opt/secret/.sgx_secrets

You can choose between two methods, 3a (automatic) or 3b (manual):

Initialize Secret Enclave - Automatic Registration (EXPERIMENTAL)

The following commands will create the necessary environment variables and attempt to automatically register the node.

export SCRT_ENCLAVE_DIR=/usr/lib
export SCRT_SGX_STORAGE=/opt/secret/.sgx_secrets
secretd auto-register --pulsar

If this step was successful, you can skip straight to Optimization.

Initialize Secret Enclave - Manual Registration

secretd init-enclave

Verify Enclave Initialization

Attestation certificate should have been created by the previous step

ls -lh /opt/secret/.sgx_secrets/attestation_combined.bin

Verify the certificate is valid. A 64 character registration key will be printed if it was successful.

PUBLIC_KEY=$(secretd dump /opt/secret/.sgx_secrets/pubkey.bin)
echo $PUBLIC_KEY

Configure secretd

Configure secretd. Initially you'll be using the bootstrap node, as you'll need to connect to a running node and your own node is not running yet.

secretd config chain-id pulsar-3
secretd config node https://rpc.pulsar.scrttestnet.com
secretd config output json

Fund Secret Wallet

If you already have a wallet funded with SCRT, you can import the wallet by doing the following:

secretd keys add <key-alias> --recover

Otherwise, you will need to set up a key. Make sure you back up the mnemonic and the keyring password.

secretd keys add <key-alias>

This will output your address, a 45 character-string starting with secret1.... Copy/paste it to get some test-SCRT from the faucet. Continue when you have confirmed your account has some test-SCRT in it.

Configure Node Attestation

1. Register your node on-chain

secretd tx register auth /opt/secret/.sgx_secrets/attestation_combined.bin -y --gas 700000 --from <key-alias>

2. Pull & check your node's encrypted seed from the network

SEED=$(secretd query register seed $PUBLIC_KEY | cut -c 3-)
echo $SEED

3. Get additional network parameters

These are necessary to configure the node before it starts.

secretd query register secret-network-params
ls -lh ./io-master-key.txt ./node-master-key.txt

Configure Your Secret Node

mkdir -p ~/.secretd/.node
secretd configure-secret node-master-key.txt $SEED

Add Seeds And Persistent Peers To Configuration File.

# seeds
perl -i -pe 's/seeds = ""/seeds = "07234140a165b470846fe995951401a8db88dd36\@bootstrap.pulsar3.scrtlabs.com:26656,b5d1bb9194c6148367b64586d6bc0128866fc646\@212.7.211.39:26656,a3c9c415fe6b46babd16f000c7dbd4d94be6e450\@178.162.151.73:26656,c088b57ebc7b2cfa2ec99e8b4ffef90bead96b47\@185.56.139.84:26656"/' ~/.secretd/config/config.toml

# persistent_peers
perl -i -pe 's/persistent_peers = ""/persistent_peers = "07234140a165b470846fe995951401a8db88dd36\@bootstrap.pulsar3.scrtlabs.com:26656,b5d1bb9194c6148367b64586d6bc0128866fc646\@212.7.211.39:26656,a3c9c415fe6b46babd16f000c7dbd4d94be6e450\@178.162.151.73:26656,c088b57ebc7b2cfa2ec99e8b4ffef90bead96b47\@185.56.139.84:26656"/' ~/.secretd/config/config.toml

Optimization

In order to be able to handle NFT minting and other Secret Contract-heavy operations, it's recommended to update your SGX memory enclave cache:

sed -i.bak -e "s/^contract-memory-enclave-cache-size *=.*/contract-memory-enclave-cache-size = \"15\"/" ~/.secretd/config/app.toml

Also checkout this document by [ block pane ] for fine tuning your machine for better uptime.

Set minimum-gas-price Parameter

We recommend 0.0125uscrt per gas unit:

perl -i -pe 's/^minimum-gas-prices = .+?$/minimum-gas-prices = "0.0125uscrt"/' ~/.secretd/config/app.toml

Your node will not accept transactions that specify --fees lower than the minimun-gas-price you set here.

Enable secret-node:

sudo systemctl enable secret-node

You are now a now ready to finally sync the full node. 🎉.

Go to Testnet State Sync to continue.

Get Node ID

secretd tendermint show-node-id

And publish yourself as a node with this ID:

<your-node-id>@<your-public-ip>:26656

Be sure to point your CLI to your running node instead of the bootstrap node

secretcli config node tcp://localhost:26657

If someone wants to add you as a peer, have them add the above address to their persistent_peers in their ~/.secretd/config/config.toml.

And if someone wants to use your node from their secretcli then have them run:

secretcli config chain-id pulsar-3
secretcli config output json
secretcli config indent true
secretcli config node tcp://<your-public-ip>:26657

State Sync

You can skip syncing from scratch or download a snapshot by State Syncing to the current block.

Optional: Become a Validator

To turn your full node into a validator, see Join Testnet as a Validator.

How to become a validator on Secret Network

1.

In order to become a validator, you node must be fully synced with the network. You can check this by doing:

When the value of catching_up is false, your node is fully sync'd with the network. You can speed up syncing time by to the current block.

2. Confirm Wallet is Funded:

This is the secret wallet which you used to create your full node, and will use to delegate your funds to you own validator. You must delegate at least 1 SCRT (1000000uscrt) from this wallet to your validator.

If you get the following message, it means that you have no tokens, or your node is not yet synced:

3. Create Validator

(remember 1 SCRT = 1,000,000 uSCRT, and so the command below stakes 100 SCRT).

4. Confirm Validator is Created

You should see your moniker listed.

Important CLI Commands for Validators

Staking more tokens

(remember 1 SCRT = 1,000,000 uSCRT)

In order to stake more tokens beyond those in the initial transaction, run:

Editing your Validator

Seeing your rewards from being a validator

Seeing your commissions from your delegators

Withdrawing rewards

Withdrawing rewards+commissions

Removing your validator

Currently deleting a validator is not possible. If you redelegate or unbond your self-delegations then your validator will become offline and all your delegators will start to unbond.

Changing your validator's commission-rate

You are currently unable to modify the --commission-max-rate and --commission-max-change-rate" parameters.

Modifying the commision-rate can be done using this:

Slashing

Unjailing

To unjail your jailed validator

Signing Info

To retrieve a validator's signing info:

Query Parameters

You can get the current slashing parameters via:

Query Parameters

You can get the current slashing parameters via:

This section will take you through the process of taking a node from fresh machine to full validator. The general steps are as follows:

Ensure your hardware is .

If you're running a local machine and not a cloud-based VM -

1. Update your BIOS to the latest available version

2. Go to your BIOS menu

3. Enable SGX (Set to "YES", it's not enough to set it to "software controlled")

4. Disable Secure Boot

5. Disable Hyperthreading

Check latest SGX DCAP driver

Make sure the SGX driver is installed. The following devices should appear:

If your kernel version if 5.11 or higher, then you probably already have the SGX driver installed. Otherwise - please update the kernel version to 5.11 or higher to ensure that these two devices appear.

Also make sure that the user under which the node is supposed to run has privileges to access SGX:

The sgx_prv should appear.

If it does not - Logout and re-login may be needed, for the change to take effect.

Install the DCAP runtime and AESM service

First, you need to add the Intel repository to APT and install the necessary SGX libraries:

If your system has 5th Gen Intel® Xeon® Scalable Processor(s)

For the DCAP attestation to work, you'll need to register your platform with Intel. This is achieved by the following:

You can check the file /var/log/mpa_registration.log, to see if the platform is registered successfully.

Configure Quote Provider

The Quote Provider library is needed to provide the data for DCAP attestation.The configuration file for it should can be found here:

/etc/sgx_default_qcnl.conf

1. Running a baremetal/physical machine

The simplest would be to use the PCCS run by SCRTLabs. Modify the following parameters in the file:

You can set those parameters by the following command:

1. Running on Cloud VPS providers

For cloud VPS providers, the cloud service providers may provide their own PCCS. Please see their documentation for more infomation.

Next, restart your aesmd service for the changes to take effect.

Use check-hw to test the DCAP attestation

Download and run the check-hw tool (included in the Release package). You should see the following:

That would mean all the above steps are ok, and you're good to go.

In case you see some error messages, but at the end the following:

That would mean there's a problem with DCAP attestation.

However the EPID attestation still works. Although you may technically run the node, it's strongly recommended to fix this. The EPID will be phased-out by Intel on April 2025.

To get a more detailed error info, run check-hw --testnet

Download, Verify and Install secretd

The most common method for install secretd is the Secret Network package installer for Debian/Ubuntu:

Download

Get the latest release of secretcli for your OS HERE.

Install

• Mac/Windows: Rename it from secretcli-${VERSION}-${OS} to secretcli or secretcli.exe and put it in your path

• Ubuntu/Debian: sudo dpkg -i secret*.deb

Setup the executable

Linux and MacOS users:

chmod +x secretcli

Configure

secretcli config chain-id pulsar-3
secretcli config output json
secretcli config node https://rpc.pulsar.scrttestnet.com

You can find alternate node endpoints in the API registry, or run your own full node

Check the installation

secretcli status

{
  "NodeInfo": {
    "protocol_version": {
      "p2p": "8",
      "block": "11",
      "app": "0"
    },
    "id": "a3c9c415fe6b46babd16f000c7dbd4d94be6e450",
    "listen_addr": "tcp://0.0.0.0:26656",
    "network": "pulsar-3",
    "version": "0.34.24",
    "channels": "40202122233038606100",
    "moniker": "pulsator3",
    "other": {
      "tx_index": "on",
      "rpc_address": "tcp://127.0.0.1:26657"
    }
  },
  "SyncInfo": {
    "latest_block_hash": "8295231C26AD045BD2451DB027F149DA089014F0DC69583AB50A3AE24DEE3B13",
    "latest_app_hash": "74070BFAE77578D5DD391EED26677DD6C3EBF535C5ACA15EA2C6FE12BC3DED46",
    "latest_block_height": "117302",
    "latest_block_time": "2023-07-19T18:35:38.186447689Z",
    "earliest_block_hash": "4EB0D9FA820FFCEEDED341FCBC996A05BDE271D155E88A6038CAB1445687FF1A",
    "earliest_app_hash": "E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855",
    "earliest_block_height": "1",
    "earliest_block_time": "2023-07-12T14:23:36.016368475Z",
    "catching_up": false
  },
  "ValidatorInfo": {
    "Address": "27BF7A7B7E8C5728150487E6E2C385945CA6DEDB",
    "PubKey": {
      "type": "tendermint/PubKeyEd25519",
      "value": "6Ux76jUesi24eWtXKTSyQWREaTT1VMS+HhEqIB2D5yo="
    },
    "VotingPower": "0"
  }
}

Create a new address

secretcli keys add <name>

See more details on how to use the CLI here