How the node network works

Redacted is permissionless. Anyone with a wallet can use it, with no sign-up, no KYC and no identity checks, and withdrawals are always open. Every deposit is approved by the node network, and each node chooses what it checks before it approves. A short wait after each deposit makes it harder to match the deposit to what you do next, and it gives the nodes time to send back money they decide not to accept, which keeps the crowd you blend in with clean. Independent nodes make these decisions.

Redacted's core contributors build the software. Token holders set the wider rules after the token relaunch, and the DAO does until then. Node operators post a bond, carry private actions to the chain, approve deposits and vote on the brakes, and what they check along the way is up to them. No single node can send a deposit back or pause deposits alone. See Who decides what.

What a node does

• It carries actions to the chain from its own accounts, so your wallet never signs them.
• It can check the addresses an action involves against public data, through the Ozone instance it trusts.
• It approves deposits. The contract accepts no deposit without a node's approval, and what a node checks before it signs is up to that node.
• It confirms your own returns. When you move money from your Spending account back into the Reserve, a node confirms in a signed statement which part is your own money, and that part re-enters the Reserve at once. See Returns from Spending.
• It watches waiting deposits. It can check them again while they wait, votes on whether to send one back and admits them to the Reserve when the wait is over.
• It stays visibly live with regular heartbeats, which keep it ready for an active place, and it votes on the network's brakes.

What stays in your hands

Your proof fixes everything about an action, including which node may submit it and until when. A node delivers the action exactly as proved, or not at all. Funds go where you said, the fee is the one you set, an action runs once, and no node can take over another node's action or spend anything of yours. A deposit goes back only when at least two nodes agree. See The relayer.

A node sees the action it carries shortly before everyone else sees it on-chain and, for a deposit approval, the depositing address and amount, which the deposit makes public anyway. Like any web server, it sees the network address a request comes from. Under the node rules it doesn't keep that address, and the official software holds it in memory for at most a minute and never writes it down. A node never sees your keys, notes or balances, and it never learns which deposit your funds came from.

Which node carries your action

For every action, the app picks a node at random from all active nodes, each with the same chance (recently active nodes are tried first, and one that doesn't answer is replaced). You never sign up with a node, and the choice doesn't depend on your history, so the app neither avoids the node that approved your deposit nor returns to one that served you before.

The app does this deliberately. Which node approved a deposit and which node carried a later action are both public on-chain, so if the choice followed your history, anyone reading the chain could use the pattern to guess which deposit a later action came from. A choice that ignores your history leaves no pattern to read, and no single node sees all of your actions.

What nodes can check

What a node checks is up to the nodes. The node software can check addresses against public data such as sanctions lists and known hacks, and the nodes vote on how strict to be. Nobody is asked who they are. Where value crosses into or out of Private Mode, a node can check, through the Ozone instance it trusts (see Compliance):

• Deposits. A node can check the depositing address before it signs the approval. The approval is single-use, bound to that exact deposit, valid for an hour at most and public, so anyone can see which node approved which deposit.
• Payouts. A node can check the addresses an action sends value to before it carries the action, which covers withdrawal and transfer recipients, the contracts called and the addresses inside those calls, swap destinations and refund addresses. It can decline an address that appears on a list it trusts, or one it cannot check.
• Returns to the Reserve. Anyone can send coins to a Spending account's address, so before funds move from Spending back into the Reserve, a node traces where they came from. Your own money returns at once, and a node can keep value traced to a known hack or a sanctions list, or value it cannot check, out of the Reserve. That value stays in the Spending account and can still be sent out publicly, and a few coins from a bad source never stop anyone from using their own funds. See Returns from Spending.
• Trading. Counterparties inside products, such as whoever fills your order, are outside the checks, because a node cannot see them and a rule that tainted everyone who traded with a listed account would let anyone taint anyone.

Ozone is the reference screener, built by Redacted's core contributors. It works only from public data such as sanctions lists, stablecoin issuer blacklists and known hacks, and it is published as open source with the launch, so anyone can run it. Each node chooses which Ozone instance it trusts, and the node network can decide to use or add other sources. A node also decides whether to use the optional online checks, and it can run its own instance. Sending a deposit back takes at least two nodes, so no single node can do it alone, and no node has to follow any one instance.

A node that uses an Ozone instance gets answers signed by it, and it verifies the signature against the keys its operator trusts before relying on the answer. A node can also keep a signed copy of the lists, refreshed every few minutes, as a backup. If the online check cannot answer, it may fall back on that copy for a limited time, and it marks any deposit approval made that way on-chain. Nodes can vote for strict screening, which refuses every fallback.

New money waits briefly

New money waits about two hours before it can be used privately. That covers every deposit from a public wallet, and money that someone else sent to your Spending account when it moves into the Reserve. Your own money coming back from your Spending account is back at once (see Returns from Spending), and money already in the Reserve is always usable at once.

• The wait strengthens your privacy, because the gap between depositing and using the money makes the two harder to match by timing (see Why new money waits). It also gives the nodes time to send back money they decide not to accept, which keeps the crowd you blend in with clean.
• A rejected deposit goes back to the address it came from, and a rejected return of outside money goes back to its Spending account. No one can redirect it, keep it or send it anywhere else.
• A waiting deposit is rejected when at least two nodes vote to reject it, or a third of the active nodes once more than six are active. Only nodes decide, and the core contributors, the DAO and Bōheki can't reject a deposit. The official node software can vote by itself when the node's Ozone instance lists where the money came from, and every vote names its reason on-chain.
• You can cancel your own waiting deposit at any time, and it goes back to your wallet.
• During a large hack, two thirds of the nodes, or Bōheki, can lengthen the wait for new money to 24 hours (incident mode). While it lasts, returns of your own money wait too.
• Token holders set the wait (the DAO until the relaunch) at between 0 and 24 hours, with a day's notice. They can also switch off the shortcut for your own money, with the same notice.

Returns from Spending

When you move money from your Spending account back into the Reserve, the nodes keep it quick for what is yours.

• Your own money comes back at once. That is what came from your Reserve, every gain your positions make in the share you put in, and payments straight from another Redacted user's Reserve.
• Anyone can send coins to your Spending account's address, and those coins enter the Reserve through the same wait as a deposit.
• In a mixed return, your own part is back at once and the rest waits.
• A node traces where the money came from and confirms your own part in a signed statement, public on-chain like every node action. A return a node cannot confirm waits like a deposit.
• While incident mode or a deposit pause is on, returns wait for everyone, your own included.

Who runs the nodes

Every operator locks a bond and can lose part or all of it for breaking the rules (see The bond). Once governance switches staking on after the relaunch, holders can back a node with their stake. A node needs its bond to be active, so where holders put their stake helps decide which nodes run, although it is not a direct election (see Staking behind a node).

At first, governance admits operators. Opening admission to anyone who posts the minimum bond is a governance decision, made by the DAO until the relaunch and by token holders after it. That step is one-way, and from then on nobody chooses who joins.

Nodes run the official node package, which is published as open source with the launch. See Running a node.

How a node connects on chain

A node is an operator's bond, a signing key, one or more relayer accounts and an endpoint, tied together in one public record on-chain. Everything a node does afterwards is a public message too, so anyone can see which node did what.

One message registers a node with its bond, its signing key, its relayer accounts and its endpoint. A relayer account is usable only when both sides agree, meaning the operator lists it and the relayer names the operator back, and neither side can attach the other on its own.

The operator or a linked relayer sends regular heartbeats, and a node stays ready while it is bonded and sends them. A ready node holds one of the active places or waits on standby for one (see How the active nodes are chosen). If no active node carries an action or sends a heartbeat for 7 days, the emergency exit opens (see The emergency exit).

An active node relays actions, approves deposits, releases them after the wait, votes to send a deposit back (to its sender only), votes on the five safety switches and confirms own-money returns. Operators earn rewards and claim them any time. Once governance switches staking on, holders can stake behind a node (see Staking behind a node and Rewards).

Governance admits operators and can remove a node or cut its bond, with the reason published on-chain. Changes to the bond size and to rewards come with on-chain notice of at least a day (see Who controls what).

How the active nodes are chosen

The network keeps 21 active places at launch, and the nodes that hold them rotate every day, so no single node is essential. Each day the node that has been active the longest steps back to standby, the node with the least stake does too when enough stronger nodes are waiting, and the ready nodes with the most stake take the free places. A standby node is bonded and keeps sending heartbeats to stay ready. It does not relay or approve deposits, and it earns nothing until it holds a place. At launch governance admits the first operators, and with few of them every node is active. Governance can raise the number of places with notice. See Node rotation.

The bond

The bond is what a node puts at stake.

• An operator locks a bond when it registers, which is 100 RUNE at launch. It is held apart from users' money, and the Reserve's books never count it.
• A node stays ready while it is bonded and sends heartbeats, and only a ready node can hold an active place. A node that falls below the minimum, after a cut or a raised minimum, pauses until it tops up.
• Token holders (the DAO until the relaunch) can remove a node and cut part or all of its bond. The reason is published on-chain, and a cut is never more than the node has at stake.
• An operator can unbond at any time. The node stops at once, and the bond comes back after about 14 days. It can still be cut until it is paid out, so leaving doesn't escape a penalty.
• A node that neither carries an action nor sends a heartbeat for 14 days starts unbonding without a cut, and anyone can trigger it. That frees its place for a working node.
• Token holders (the DAO until the relaunch) can raise the minimum with a day's notice, by at most ten times per step, and can do so before admission opens to everyone. Once it is open, the bond is the entry barrier.

What nodes earn is described in Running a node.

Staking behind a node

Holders can back a node with their stake and share in its work. Governance switches staking on after the relaunch.

• Holders stake the bond currency (the token, after the relaunch) behind a node whose operator opened staking.
• The stake counts toward the node's bond, and the operator holds at least 10% of the minimum itself, so an operator can run a node that holders trust.
• Node rewards are split by stake, and the operator keeps a commission on the stakers' part. Stakers claim their rewards whenever they like.
• A slash takes from the operator and the stakers in proportion, unbonding stake included (see What happens in a slash).
• Unstaking takes the same period as a node bond, about 14 days.
• A node needs its bond to be active, so where holders stake helps decide which nodes run, although it is not a direct election.

What happens in a slash

A slash is how governance answers a breach of the node rules. Governance decides it, which means the DAO until the relaunch and token holders after it. It applies at once, and the reason is published on-chain, where it should cite the rule and the evidence, such as transaction hashes and the node's own records.

• It takes from the operator's bond and from the stake behind the node, both the stake that is active and the stake that is unbonding, in proportion to their size. The operator and the stakers each lose the same share of what they have at stake in that node.
• It is never more than the node has at stake, and the amount goes to the protocol's fee collector.
• Rewards a node has already earned stay claimable, by the operator and by the stakers.
• Unbonding takes about 14 days, and a bond or stake that is unbonding can still be slashed until it is claimed, so a node cannot avoid a slash by leaving.
• A node whose bond falls below the minimum after a slash pauses until it tops up.

Staking is off at launch, so at first a slash can only take from the operator's bond. Once governance switches staking on after the relaunch, the stakers share a slash with the operator as described above.

Who controls what

The short version is in Who decides what, and this section lists every decision with its safeguards.

No one holds a key that can spend users' notes, redirect an action or stop a withdrawal, and the contract applies that to everyone, the core contributors included. Its only administrator is the Redacted DAO (token holders after the relaunch), and its only fast brake is Bōheki. Neither of them, nor the core contributors, can turn away or send back anyone's money, which is left to the nodes alone.

Brakes that keep your way out open

Emergencies call for fast brakes, and these brakes are built so that everyone stays free to leave. Every brake acts only on money coming into the Reserve, and on everyone at once, so none of them is a decision about one person. There are two kinds.

• The active operators together control a fixed list of five safety switches, and each one votes on-chain. The switches are a deposit pause, a cap on deposits per hour, pausing new private accounts, strict screening and incident mode. A value applies once two thirds of the active nodes, and at least three, vote for it, and it holds until two thirds vote otherwise. Under the node rules each vote comes with a published reason. Fees, bonds, admission, code and anything that moves funds are not on the list, and the DAO cannot override a node vote.
• Bōheki is Japanese for "protective wall". It is a 2-of-3 multisig, set by the DAO, that can pause deposits or switch on incident mode once, for at most about 3 days (43,200 blocks). Using it spends it, and only the DAO can re-arm it, so Bōheki is a capped brake and new money is never delayed beyond 3 days without a DAO decision.

While deposits are paused, moving funds from Spending back into the Reserve waits too, your own money included. Withdrawals, Spending actions and the emergency exit are never affected.

The emergency exit

If no active node carries an action or sends a heartbeat for 7 days, the emergency exit opens by itself. Anyone can then withdraw from the Reserve, or close positions and move funds out of their Spending account, by submitting the action from their own wallet. The app switches to this mode when it sees the exit open.

Nothing can close it, delay it or change its 7 days, whether a node vote, Bōheki or a DAO setting, and the first node activity closes it again. The exit is for a network that has stopped. While nodes are active, withdrawals go through them, and if some decline a particular withdrawal, governance can remove those nodes and cut their bonds. While the exit is open, the Reserve accepts no new deposits, free exits stay free, and exits in this mode are sent from your own wallet.

Governance

After the token relaunch, governance switches on staking behind nodes (see Staking behind a node), and token holders decide who runs nodes by staking behind them, since a node needs its bond to be active. Through governance they also set the bond size, remove or slash a node and open admission to everyone, and they decide the fees, the wait, code upgrades and the screening policy. Stake influences which nodes run without being a direct election.

The Redacted DAO administers the contract. Until the relaunch it holds the token holders' role as a 2-of-3 group made up of one core contributor and two independent members, and its members and votes are public on-chain.

Code upgrades wait about 3 days, publicly visible, before they can run, and parameter changes wait for an on-chain notice. An emergency lane, which needs all three emergency signers (at launch the DAO's three members), can run an upgrade the DAO has already scheduled at once. See Security and upgrades.

Governance admits operators and can open admission to anyone with the bond, for good.

Ozone is the reference screener, built by Redacted's core contributors. It works only from public data, and every entry it lists names its source. It is published as open source with the launch. Each node chooses which Ozone instance it trusts, and the node network can decide to use or add other sources. After the relaunch, token holders decide the screening policy, and nodes vote on strict screening.

The official app connects only to the nodes listed in its release, which is a browser security measure.

Set at launch

These values are published with the release. They are the protocol fee (what it is charged on, and its rate), the node's share of it, the optional stipend for active nodes, the account registration fee that nodes sponsor, the number of active places and how often they rotate, and how long a proof stays valid (its expiry, and how many recent versions of the note tree it may be built against).