AI Agent OSGuarded mainnet beta. .rama identity, smart wallets, sponsored gas, permissions and scheduling are available for controlled testing.Open Agent OS
Learning center

Validators

Validator Incident Response

Use a clear incident process for node failure, checkpoint disruption, suspected compromise and network-level escalation.

In this guide

Practical outcomes

  • Preserve evidence
  • Contain impact
  • Document recovery

How this works in practice

Use a clear incident process for node failure, checkpoint disruption, suspected compromise and network-level escalation.

Validator operations rely on separate but connected layers: Bor must execute and produce blocks, Heimdall must coordinate validator state and spans, and the checkpoint path must submit and acknowledge commitments on schedule.

Implementation sequence

Turn the topic into a controlled implementation rather than a one-off transaction. Each step below should leave evidence a teammate, user or auditor can independently review.

  1. 01. Preserve evidence. Define the expected result, capture the relevant onchain or operational evidence, and stop for review if the result differs from the plan.
  2. 02. Contain impact. Define the expected result, capture the relevant onchain or operational evidence, and stop for review if the result differs from the plan.
  3. 03. Document recovery. Define the expected result, capture the relevant onchain or operational evidence, and stop for review if the result differs from the plan.

Evidence to retain

When investigating an incident, capture block height, sync state, peers, relevant process logs, checkpoint age, transaction hashes and the exact time window before restarting anything.

Control point

Use scoped recovery. A delayed checkpoint does not automatically justify restarting unrelated services. Classify the fault first, protect keys and state, then make the smallest change that restores the affected path.

Related guides