Lido Modules
- Curated Module (CM)
- Simple Distributed Validator Technology (sDVT) or the second mainnet Lido protocol module, provides the first opportunity for solo and community stakers to participate in running validators using the Lido protocol by leveraging the established design of the Curated Operator Module and DVT solutions provided by Obol and SSV Network.
- Community Staking Module (CSM) allowing any node operator — and especially community stakers, from solo stakers, to groups of friends, to amateur operators — to operate validators by providing an ETH-based safety deposit.
Lido CSM
The Community Staking Module (CSM) is the Lido protocol’s first module with permissionless entry, allowing any node operator to operate validators by providing a token-based bond as security collateral.
CSM is supported for Ethereum staking.
Characteristics
- Bond requirement: 2.4 ETH for first validator nad 1.3 ETH for each next validator
- Reward rate: 10% broken down as:
- 4% allocated to Lido treasury
- 6% allocated to Operator's module
Guide in progress.
Prerequisites for this guide
- Installed and synced Execution and Consensus client
- Installed Mev-boost client with
-min-bid
set maximally to0.07
Validator keys generation
Validator client configuration for Lido
- Be sure
Builder-boost-factor
is set to100%
- Be sure
fee_recipient
is set to0x388C818CA8B9251b393131C08a736A67ccB19297
-
Do you want to create a new validation instance or extend exisiting instance for more validators?
Create a directory for validator instance data
sudo mkdir -p /var/lib/ethereum/lighthouse/vi1
-
Load keystores to
:/var/lib/ethereum/lighthouse/vi1
sudo /usr/local/bin/lighthouse --network mainnet account validator import --reuse-password --directory $HOME/keystores/ddk_i1 --datadir /var/lib/ethereum/lighthouse/vi1
- Insert keystores encryption password (the one used during keystores generation) on request
- If there are keystores with different encryption password, repeat the process for each encryption password
Create a service user for the validator instance
sudo useradd --system --no-create-home --shell /bin/false eth-lighthouse-vi1
Set ownership of
/var/lib/ethereum/lighthouse/vi1
tovalidators-i1
usersudo chown -R eth-lighthouse-vi1:eth-lighthouse-vi1 /var/lib/ethereum/lighthouse/vi1
Create configuration service file for
eth-lighthouse-vi1
service-
Open the configuration file
sudo nano /etc/systemd/system/eth-lighthouse-vi1.service
-
Copy the configuration below into the file.
[Unit] Description=Lighthouse Validator Instance (Mainnet) Wants=network-online.target After=network-online.target [Service] User=eth-lighthouse-vi1 Group=eth-lighthouse-vi1 Type=simple Restart=always RestartSec=5 ExecStart=/usr/local/bin/lighthouse vc \ --network mainnet \ --datadir /var/lib/ethereum/lighthouse/vi1 \ --suggested-fee-recipient 0xXXXXXXXXXXXXXXXX \ --beacon-nodes http://localhost:5052 \ --graffiti "Nethermind+Lighthouse" [Install] WantedBy=multi-user.target
-
Press
CTRL
+X
thenY
thenENTER
to save and exit the config file.
-
Other configurations
Nothing to do. You are ok.Extend Staking manager clients.conf
Inserteth-lighthouse-vi1
into clients.conf file that is used by Staking Manager.sudo nano /usr/local/etc/staking/config/clients.conf
Stop running validator instance
eth-lighthouse-vi1
sudo systemctl stop eth-lighthouse-vi1
Extend
/var/lib/ethereum/lighthouse/vi1
for new keystoressudo /usr/local/bin/lighthouse --network mainnet account validator import --reuse-password --directory $HOME/keystores/ddk_i1 --datadir /var/lib/ethereum/lighthouse/vi1
- You will be requested to insert keystores encryption password (the one used during keystores generation)
- If there are keystores with different encryption password, repeat the process for each encryption password
- Already existing keystores in the directory will be skipped
-
Load processed changes to the system
sudo systemctl daemon-reload
-
Start the validator instance
sudo systemctl start eth-lighthouse-vi1
-
Check the running validator instance
systemctl status eth-lighthouse-vi1
journalctl -fu eth-lighthouse-vi1
-
Activate service to start automatically on OS startup
$ sudo systemctl enable eth-lighthouse-vi1
- Open Delayed Start shell
sudo nano /usr/local/bin/delayed-start.sh
Configurate service start inside it
systemctl start eth-lighthouse-vi1
NOTE: This option requires installed Staking Manager util.
Add/Uncomment/usr/local/bin/staking.sh start validators
that will automatically launch all defined validator instances./usr/local/bin/staking.sh start validators
- Be sure,
delayed-start.service
service controllingdelayed-start.sh
is enabled for auto start with system startupsudo systemctl enable delayed-start.service
- Open Delayed Start shell
Guide to exit validator is available at https://stakers.space/lighthouse/exit-validator.
-
Do you want to create a new validation instance or extend exisiting instance for more validators?
Create a directory for validator instance data
sudo mkdir -p /var/lib/ethereum/lodestar/vi1
Enable accessing
/var/lib/ethereum/lodestar/vi1
for server usermyserveruser
sudo chown -R myserveruser:myserveruser /var/lib/ethereum/lodestar/vi1
Load keystores to
:/var/lib/ethereum/lodestar/vi1
Move to Lodestar client directory
cd /usr/local/bin/lodestar
./lodestar validator import --network mainnet --importKeystores $HOME/keystores/ddk_i1 --dataDir /var/lib/ethereum/lodestar/vi1
- Insert keystores encryption password (the one used during keystores generation) on request
- If there are keystores with different encryption password, repeat the process for each encryption password
Create a service user for the validator instance
sudo useradd --system --no-create-home --shell /bin/false eth-lodestar-vi1
Set ownership of
/var/lib/ethereum/lodestar/vi1
tolodestar-vi1
usersudo chown -R eth-lodestar-vi1:eth-lodestar-vi1 /var/lib/ethereum/lodestar/vi1
Enable access to
:NodeJs
for userlodestar-vi1
sudo usermod -aG nodejsusr eth-lodestar-vi1
Create configuration service file for
eth-lodestar-vi1
service-
Open the configuration file
sudo nano /etc/systemd/system/eth-lodestar-vi1.service
-
Copy the configuration below into the file.
:
This can be get with command$ node version
[Unit] Description=Lodestar Validator Instance (Ethereum Mainnet) Wants=network-online.target After=network-online.target [Service] User=eth-lodestar-vi1 Group=eth-lodestar-vi1 Type=simple Restart=always RestartSec=5 WorkingDirectory=/usr/local/bin/lodestar Environment="PATH=/home/nodejsusr/.nvm/versions/node/v/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin" ExecStart=/usr/local/bin/lodestar/lodestar validator \ --network mainnet \ --dataDir /var/lib/ethereum/lodestar/validators/i1 \ --suggestedFeeRecipient 0xXXXXXXXXXXXXXXXX \ # ToDo: Add Beacon API URL --force \ --graffiti "Nethermind+Lodestar" [Install] WantedBy=multi-user.target
-
Press
CTRL
+X
thenY
thenENTER
to save and exit the config file.
-
Adding validator instance to staking services manager
If you use a staking manager client, add the new instance into it.
Stop running validator instance
eth-lodestar-vi1
sudo systemctl stop eth-lodestar-vi1
Extend
/var/lib/ethereum/lodestar/validators/i1
for new keystores./lodestar validator import --network mainnet --importKeystores $HOME/keystores/ddk_i1 --dataDir /var/lib/ethereum/lodestar/vi1
- You will be requested to insert keystores encryption password (the one used during keystores generation)
- If there are keystores with different encryption password, repeat the process for each encryption password
- Already existing keystores in the directory will be skipped
Load processed changes to the system
sudo systemctl daemon-reload
Start the validator instance
sudo systemctl start eth-lodestar-vi1
Check the running validator instance
systemctl status eth-lodestar-vi1
journalctl -fu eth-lodestar-vi1
-
Other configurations
Activate service to start automatically on OS startup
$ sudo systemctl enable eth-lodestar-vi1
- Open Delayed Start shell
sudo nano /usr/local/bin/delayed-start.sh
Configurate service start inside it
systemctl start eth-lodestar-vi1
- Be sure,
delayed-start.service
service controllingdelayed-start.sh
is enabled for auto start with system startupsudo systemctl enable delayed-start.service
Configurate Lodestar validator Log monitor service
Log monitor service monitors the service log and process defined action (fixes) in a case of any issue detected.
- Check, whether the logmonitor util is installed:
/usr/local/bin/logmonitor.sh version
If the util is not installed, install Lodestar validator Log monitor from GitHub.
- Check defined Errors list for lodestarvalidator service
sudo nano /usr/local/etc/lodestarvalidator_tracking_records.txt
If not available, download it from GitHub. You can also modifiy it, if needed.
- Configurate the validator log monitor for service
eth-lodestar-vi1
, see guide on Github.
- Check, whether the logmonitor util is installed:
Activate service to start automatically on OS startup
Our guide uses a custom util for launching services. It has following benefits:
- It allows set delay for starting services. It eliminates slashing risk in the following scenario:
- A database corruption occures
- Lodestar Log monitor detects it, stopping the validator instance and clearing broken database
- Very quick power failure happens while the staking node starts immediately automatically
- As the database with last attestation is removed now, we need to prevent start of the validator instance to avoid double attestation / block proposal within the same slot.
- It allows starting services through a shared script
Starting all services through the Staking Manager util and its command
/usr/local/bin/staking.sh start validators
prevents a human error when there is forgotten set ofsudo systemctl enable ...
for any staking-related service.Extend Staking manager clients.conf
Inserteth-lodestar-vi1
into clients.conf file that is used by Staking Manager.sudo nano /usr/local/etc/staking/config/clients.conf
There's a
Start with delay
util to manage this.- Install Start with delay util from GitHub, if not installed yet.
- Open Start with delay util
sudo nano /usr/local/bin/delayed-start.sh
- Place new services (validator isntance and validator instance monitor) into the file
eth-lodestar-vi1
eth-lodestar-vi1_logmonitor
- Place command to start all validator services, if not attached yet
/usr/local/bin/staking.sh start validators
- Verify, that a service `delayed-start.service` exists and is automatically launched on system start. See GitHub for a guide to do that.
- It allows set delay for starting services. It eliminates slashing risk in the following scenario:
- Open Delayed Start shell
Guide to exit validator is available at https://stakers.space/lodestar/exit-validator.
-
Do you want to create a new validation instance or extend exisiting instance for more validators?
Create a directory for validator instance data
sudo mkdir -p /var/lib/ethereum/teku/vi1
If exists, remove
:deposit_data
file from keystores folder- Display files in the directory
cd $HOME/keystores/ddk_i1 && ls -lh
- If there is
deposit_data-XXX....json
file, remove itsudo rm deposit_data-XXX....json
- Display files in the directory
Copy keystores dedicated for instance
into
/var/lib/ethereum/teku/vi1/keystores
foldersudo mkdir /var/lib/ethereum/teku/vi1/keystores
sudo cp -a $HOME/keystores/ddk_i1/* /var/lib/ethereum/teku/vi1/keystores && cd /var/lib/ethereum/teku/vi1/keystores
Teku requires a
.txt
file with encryption password for each.json
validator file.-
Display all keystores in the directory
ls -lh
-
.json
Create a new
.txt
file for thekeystore-m_12381_3600_X_0_0-XXXXXXXXXX
.json keystore filesudo nano keystore-m_12381_3600_X_0_0-XXXXXXXXXX.txt
Insert an encryption password for the validator key (the one used during keystores generation) into that file.
Press
ctrl
+x
, theny
to save and exit - Set readonly permission for that file
sudo chmod 400 keystore-m_12381_3600_X_0_0-XXXXXXXXXX.txt
Now, you can either repeate the process for all other keystores in the folder, or use an automated solution to duplicate the created password file (with modified name) for all remaining keystores, see Shell Script to generate password files for Teku.
With automated process, to generate
.txt
file with a content of/var/lib/ethereum/teku/vi1/keystores/keystore-m_12381_3600_X_0_0-XXXXXXXXXX.txt
for all remaining keystores in the/var/lib/ethereum/teku/vi1/keystores/
directory, use commandsudo /opt/teku-create-validator-psw-files.sh /var/lib/ethereum/teku/vi1/keystores/keystore-m_12381_3600_X_0_0-XXXXXXXXXX.txt
-
Display all keystores in the directory
Create a service user for the validator instance
sudo useradd --system --no-create-home --shell /bin/false eth-teku-vi1
- Set ownership of validator instance data directory to validator-instance user
sudo chown -R eth-teku-vi1:eth-teku-vi1 /var/lib/ethereum/teku/vi1
Create configuration service file for
eth-teku-vi1
service- Open the configuration file
sudo nano /etc/systemd/system/eth-teku-vi1.service
-
Copy the configuration below into the file.
[Unit] Description=Teku Validator Instance (Ethereum Mainnet) Wants=network-online.target After=network-online.target [Service] User=eth-teku-vi1 Group=eth-teku-vi1 Type=simple Restart=always RestartSec=5 Environment="JAVA_OPTS=-Xmx4g" Environment="TEKU_OPTS=-XX:-HeapDumpOnOutOfMemoryError" ExecStart=/usr/local/bin/teku/bin/teku validator-client \ --network mainnet \ --beacon-node-api-endpoint http://127.0.0.1:5051 \ #--beacon-node-api-endpoint http://127.0.0.1:5051,http://192.10.10.101:5051,http://192.140.110.44:5051 \ --data-path /var/lib/ethereum/teku/vi1 \ --validator-keys /var/lib/ethereum/teku/vi1/keystores:/var/lib/ethereum/teku/vi1/keystores \ --validators-proposer-default-fee-recipient 0xXXXXXXXXXXXXXXXX \ #--builder-bid-compare-factor 100 \ --validators-graffiti "Nethermind+Teku" [Install] WantedBy=multi-user.target
- Open the configuration file
Stop running validator instance
eth-teku-vi1
sudo systemctl stop eth-teku-vi1
If exists, remove
:deposit_data
file from keystores folder- Display files in the directory
cd $HOME/keystores/ddk_i1 && ls -lh
- If there is
deposit_data-XXX....json
file, remove itrm deposit_data-XXX....json
- Display files in the directory
-
Copy keystores dedicated for instance
into
/var/lib/ethereum/teku/vi1/keystores
foldersudo mkdir /var/lib/ethereum/teku/vi1/keystores
sudo cp -a $HOME/keystores/ddk_i1/* /var/lib/ethereum/teku/vi1/keystores/keystores && cd /var/lib/ethereum/teku/vi1/keystores
Teku requires a
.txt
file with encryption password for each.json
validator file.-
Display all keystores in the directory
ls -lh
-
.json
Vreate a new
.txt
file for thekeystore-m_12381_3600_X_0_0-XXXXXXXXXX
.json keystore filenano keystore-m_12381_3600_X_0_0-XXXXXXXXXX.txt
Insert an encryption password for the validator key (the one used during keystores generation) into that file.
Press
ctrl
+x
, theny
to save and exit - Set readonly permission for that file
sudo chmod 400 keystore-m_12381_3600_X_0_0-XXXXXXXXXX.txt
Now, you can either repeate the process for all other keystores in the folder, or use an automated solution to duplicate the created password file (with modified name) for all remaining keystores, see Shell Script to generate password files for Teku.
With automated process, to generate
.txt
file with a content of/var/lib/ethereum/teku/vi1/keystores/keystore-m_12381_3600_X_0_0-XXXXXXXXXX.txt
for all remaining keystores in the/var/lib/ethereum/teku-vi1/keystores/
directory, use command$HOME/bashscripts/create-teku-pswfiles.sh /var/lib/ethereum/teku/vi1/keystores/keystore-m_12381_3600_X_0_0-XXXXXXXXXX.txt
-
Display all keystores in the directory
Load changes made in config files to the system
sudo systemctl daemon-reload
Start the validator instance
sudo systemctl start eth-teku-vi1
Check the running validator instance
systemctl status eth-teku-vi1
journalctl -fu eth-teku-vi1
Activate service to start automatically
sudo systemctl enable eth-teku-vi1
- Open Delayed Start shell
sudo nano /usr/local/bin/delayed-start.sh
- Attach command to remove lock files (to prevent start the validator in a case of existing lock fiels after a power failure). This must be processed before starting the validator service.
/usr/local/bin/remove-lock-files.sh '/var/lib/ethereum/teku/vi1/keystores'
- Configurate service start inside it
systemctl start eth-teku-vi1.service
- Be sure,
delayed-start.service
service controllingdelayed-start.sh
is enabled for auto start with system startupsudo systemctl enable delayed-start.service
Configurate Staking Manager util
- Open the configuration file
sudo nano /usr/local/etc/staking/config/clients.conf
If the file is empty, generate it with command
sudo /usr/local/bin/staking.sh init
- Set link to proper services. It should be as follow:
validatorServices="eth-teku-vi1.service"
- Open the configuration file
-
Activate service to start automatically on OS startup
- Open Start with delay util
sudo nano /usr/local/bin/delayed-start.sh
- Attach command to remove lock files (to prevent start the validator in a case of existing lock fiels after a power failure). This must be processed before starting the validator service.
/opt/remove-teku-validator-lock-files.sh '/var/lib/ethereum/teku/vi1/keystores'
- Place or uncomment a command to start the Validator instance(s), if not made yet
/usr/local/bin/staking.sh start validators
- Verify, that the service `delayed-start.service` exists and is automatically launched on system start.
sudo systemctl enable delayed-start.service
- Open Start with delay util
- Open Delayed Start shell
Guide to exit validator is available at https://stakers.space/teku/exit-validator.
-
Do you want to create a new validation instance or extend exisiting instance for more validators?
Create a directory for validator instance data
sudo mkdir -p /var/lib/ethereum/nimbus/vi1
-
Load keystores to
:/var/lib/ethereum/nimbus/vi1
sudo /usr/local/bin/nimbus-validator import data-dir=/var/lib/ethereum/nimbus/vi1 $HOME/keystores/ddk_i1
NOTE: If you have used different passwords for each of your validators you will get an error. Run the process multiple times, providing each of the different passwords until they are all imported. Use the accounts list command to verify.
Create a service user for the validator instance
sudo useradd --system --no-create-home --shell /bin/false eth-nimbus-vi1
Set ownership of
/var/lib/ethereum/nimbus/vi1
tovalidators-i1
usersudo chown -R eth-nimbus-vi1:eth-nimbus-vi1 /var/lib/ethereum/nimbus/vi1
Create configuration service file for
eth-nimbus-vi1
service-
Open the configuration file
sudo nano /etc/systemd/system/eth-nimbus-vi1.service
-
Copy the configuration below into the file.
[Unit] Description=Nimbus Validator Instance (Ethereum Mainnet) Wants=network-online.target After=network-online.target [Service] User=eth-teku-vi1 Group=eth-teku-vi1 Type=simple Restart=always RestartSec=5 ExecStart=/usr/local/bin/nimbus/nimbus_validator_client \ --network=mainnet \ --data-dir=/var/lib/ethereum/nimbus/vi1 \ --beacon-node=http://127.0.0.1:5052 \ --suggested-fee-recipient=0xXXXXXXXXXXXXXXXX \ --graffiti="Nethermind+Nimbus" # --payload-builder=true --payload-builder-url=https://${HOST}:${PORT}/ [Install] WantedBy=multi-user.target
See more flags at https://nimbus.guide/options.html
-
Press
CTRL
+X
thenY
thenENTER
to save and exit the config file.
-
Other configurations
Nothing to do. You are ok.Extend Staking manager clients.conf
Inserteth-nimbus-vi1
into clients.conf file that is used by Staking Manager.sudo nano /usr/local/etc/staking/config/clients.conf
Stop running validator instance
eth-nimbus-vi1
sudo systemctl stop eth-nimbus-vi1
Extend
/var/lib/ethereum/nimbus/vi1
for new keystoressudo /usr/local/bin/nimbus-validator import data-dir=/var/lib/ethereum/nimbus/vi1 $HOME/keystores/ddk_i1
NOTE: If you have used different passwords for each of your validators you will get an error. Run the process multiple times, providing each of the different passwords until they are all imported. Use the accounts list command to verify.
-
Load processed changes to the system
sudo systemctl daemon-reload
-
Start the validator instance
sudo systemctl start eth-nimbus-vi1
-
Check the running validator instance
systemctl status eth-nimbus-vi1
journalctl -fu eth-nimbus-vi1
-
Activate service to start automatically on OS startup
$ sudo systemctl enable eth-nimbus-vi1
Guide to exit validator is available at https://stakers.space/nimbus/exit-validator.
-
Do you want to create a new validation instance or extend exisiting instance for more validators?
Create a directory for validator instance data
sudo mkdir -p /var/lib/ethereum/prysm/vi1
-
Load keystores to
:/var/lib/ethereum/prysm/vi1
sudo /usr/local/bin/validator accounts import --mainnet --keys-dir=$HOME/keystores/ddk_i1 --wallet-dir=/var/lib/ethereum/prysm/vi1
- Accept Terms of Use
- Set a wallet password. This is different to the validator password you set during keys generation. Prysm will use this to decrypt the validator wallet. Back it up somewhere safe. You will need this later in this section and when configuring the validator.
- Provide the validator keys password. This is the password you set when you created the keys during keys generation
NOTE: If you have used different passwords for each of your validators you will get an error. Run the process multiple times, providing each of the different passwords until they are all imported. Use the accounts list command to verify.
Create a Wallet Password File
Create a file to store the wallet password so the Prysm validator service can access the wallet without you having to supply the password.
sudo nano /var/lib/ethereum/prysm/vi1/password.txt
Press
CTRL
+X
thenY
thenENTER
to save and exit the config file.Create a service user for the validator instance
sudo useradd --system --no-create-home --shell /bin/false eth-prysm-vi1
Set ownership of
/var/lib/ethereum/prysm/vi1
tovalidators-i1
usersudo chown -R eth-prysm-vi1:eth-prysm-vi1 /var/lib/ethereum/prysm/vi1
Create configuration service file for
eth-prysm-vi1
service-
Open the configuration file
sudo nano /etc/systemd/system/eth-prysm-vi1.service
-
Copy the configuration below into the file.
[Unit] Description=Prysm Consensus Client VC (Mainnet) Wants=network-online.target After=network-online.target [Service] User=eth-prysm-vi1 Group=eth-prysm-vi1 Type=simple Restart=always RestartSec=5 ExecStart=/usr/local/bin/validator \ --datadir=/var/lib/ethereum/prysm/vi1 \ --wallet-dir=/var/lib/ethereum/prysm/vi1 \ --wallet-password-file=/var/lib/ethereum/prysm/vi1/password.txt \ --suggested-fee-recipient=0xXXXXXXXXXXXXXXXX \ --graffiti="Nethermind+Prysm" \ --accept-terms-of-use [Install] WantedBy=multi-user.target
-
Press
CTRL
+X
thenY
thenENTER
to save and exit the config file.
-
Other configurations
Nothing to do. You are ok.Extend Staking manager clients.conf
Inserteth-prysm-vi1
into clients.conf file that is used by Staking Manager.sudo nano /usr/local/etc/staking/config/clients.conf
Stop running validator instance
eth-prysm-vi1
sudo systemctl stop eth-prysm-vi1
Extend
/var/lib/ethereum/prysm/vi1
for new keystoressudo /usr/local/bin/validator accounts import --mainnet --keys-dir=$HOME/keystores/ddk_i1 --wallet-dir=/var/lib/ethereum/prysm/vi1
- Accept Terms of Use
- Set a wallet password. This is different to the validator password you set during keys generation. Prysm will use this to decrypt the validator wallet. Back it up somewhere safe. You will need this later in this section and when configuring the validator.
- Provide the validator keys password. This is the password you set when you created the keys during keys generation
NOTE: If you have used different passwords for each of your validators you will get an error. Run the process multiple times, providing each of the different passwords until they are all imported. Use the accounts list command to verify.
-
Load processed changes to the system
sudo systemctl daemon-reload
-
Start the validator instance
sudo systemctl start eth-prysm-vi1
-
Check the running validator instance
systemctl status eth-prysm-vi1
journalctl -fu eth-prysm-vi1
-
Activate service to start automatically on OS startup
$ sudo systemctl enable eth-prysm-vi1
Guide to exit validator is available at https://stakers.space/prysm/exit-validator.