Validator Installation

These values are grounded in the current c8ntinuum genesis and node code.

Network constants

Field	Value
Binary	`ctmd`
Home directory	`~/.ctmd`; `/var/lib/ctmd` on Linux hosts set up with the manual mainnet install or `deploy.sh`
Cosmos chain ID	`c8ntinuum_8-1`
EVM chain ID	`8`
Account prefix	`c8`
Validator prefix	`c8valoper`
Consensus prefix	`c8valcons`
Staking denom	`ctm`
Display symbol	`CTM`
Denom exponent	`18`

Prerequisites

A fully synced ctmd node. Install it with the manual mainnet install below. deploy.sh, described in Full Node Installation, is the install path for non-validator nodes; validators do not use it. Submit create-validator only after ctmd status reports catching_up as false.
The node home. Commands on this page use ~/.ctmd, the default home of ctmd. The manual install below puts the node home at /var/lib/ctmd, owned by the ctmd user, so run commands that read it, such as ctmd comet show-validator, as that user with --home /var/lib/ctmd.

Manual mainnet install

This route installs a mainnet ctmd node on Linux by hand. Each step does what deploy.sh install and deploy.sh state-sync do, so the host ends up with the same layout, service unit, and configuration as a deploy.sh host, without the script. Release binaries exist for linux-amd64, linux-arm64, and darwin-arm64; the systemd steps apply to Linux only. You need curl, jq, tar, sha256sum, and systemd. Run the commands in a root shell (sudo -i), as deploy.sh does, and keep one working directory for the downloaded files.

Download and verify the release

Release binaries are listed in metadata.json. Resolve the current version and the tarball and checksum URLs for your platform:

PLATFORM=linux-amd64   # or linux-arm64
curl -fsSL https://resources.c8ntinuum.io/metadata.json -o metadata.json
VERSION=$(jq -r '.ctmd.latest_version' metadata.json)
TARBALL_URL=$(jq -r --arg p "$PLATFORM" '.ctmd.artifacts[$p].url' metadata.json)
CHECKSUM_URL=$(jq -r --arg p "$PLATFORM" '.ctmd.artifacts[$p].sha256_url' metadata.json)
echo "$VERSION $TARBALL_URL"

Download the tarball and its .sha256 file, then verify the tarball. The check must print OK:

curl -fsSLO "$TARBALL_URL"
curl -fsSLO "$CHECKSUM_URL"
sha256sum -c "ctmd-${VERSION}-${PLATFORM}.tar.gz.sha256"

The tarball unpacks to ctmd-<version>-<platform>/, which holds bin/ctmd and a lib/ directory of bundled shared libraries (RocksDB, the SP1 verifier, and their compression libraries). ctmd needs both.

tar -xzf "ctmd-${VERSION}-${PLATFORM}.tar.gz"
RELEASE_DIR="ctmd-${VERSION}-${PLATFORM}"

Install the binary and libraries

Install into a versioned directory under /opt, then point the /opt/ctmd and /usr/local/bin/ctmd symlinks at it. This is the layout deploy.sh uses, so Rollback works the same way on this host.

install -d -m 0755 -o root -g root /opt "/opt/ctmd-${VERSION}" "/opt/ctmd-${VERSION}/bin" "/opt/ctmd-${VERSION}/lib"
install -m 0755 -o root -g root "$RELEASE_DIR/bin/ctmd" "/opt/ctmd-${VERSION}/bin/ctmd"
cp -aP "$RELEASE_DIR/lib/." "/opt/ctmd-${VERSION}/lib/"
chown -R root:root "/opt/ctmd-${VERSION}"

ln -sfn "/opt/ctmd-${VERSION}" /opt/ctmd
ln -sfn /opt/ctmd/bin/ctmd /usr/local/bin/ctmd

Create the service user and node home

getent group ctmd >/dev/null || groupadd --system ctmd
id -u ctmd >/dev/null 2>&1 || \
  useradd --system --gid ctmd --home-dir /var/lib/ctmd --shell /usr/sbin/nologin --no-create-home ctmd

install -d -o root -g ctmd -m 0750 /var/lib/ctmd
install -d -o ctmd -g ctmd -m 0750 /var/lib/ctmd/config /var/lib/ctmd/data
install -d -o ctmd -g ctmd -m 0700 /var/lib/ctmd/tmp

Check that the binary runs with its bundled libraries. It prints the release version:

(cd /var/lib/ctmd && sudo -u ctmd env HOME=/var/lib/ctmd LD_LIBRARY_PATH=/opt/ctmd/lib /usr/local/bin/ctmd version)

Initialize the node

Initialize the node home as the ctmd user with the mainnet chain ID. Like deploy.sh, run it from inside the node home, in a subshell so your working directory does not change:

(cd /var/lib/ctmd && sudo -u ctmd env HOME=/var/lib/ctmd LD_LIBRARY_PATH=/opt/ctmd/lib \
  /usr/local/bin/ctmd init <your-validator-moniker> --home /var/lib/ctmd --chain-id c8ntinuum_8-1)

ctmd init also creates the validator consensus key at /var/lib/ctmd/config/priv_validator_key.json. Back it up securely, and see KMS and sentry architecture before you rely on the local file signer.

Install and verify genesis

Replace the generated genesis.json with the mainnet genesis, then check it against the SHA-256 that metadata.json publishes. The check must print OK:

curl -fsSL "$(jq -r '.genesis.mainnet.url' metadata.json)" -o /var/lib/ctmd/config/genesis.json
EXPECTED=$(curl -fsSL "$(jq -r '.genesis.mainnet.sha256_url' metadata.json)" | awk '{print $1}')
echo "$EXPECTED  /var/lib/ctmd/config/genesis.json" | sha256sum -c -

The mainnet genesis SHA-256 is ebe6292aa5885b508b1d455c93564683c92e9cc3f80592ee615b1cffbc74a653.

Configure peers and chain IDs

Build the seed and persistent peer lists from the mainnet entry in peers.json:

curl -fsSL https://resources.c8ntinuum.io/peers.json -o peers.json
jq -r '(.networks.mainnet.seeds // []) | map("\(.id)@\(.host):\(.port // 26656)") | join(",")' peers.json
jq -r '(.networks.mainnet.persistent_peers // []) | map("\(.id)@\(.host):\(.port // 26656)") | join(",")' peers.json

Set these keys in /var/lib/ctmd/config/config.toml, using the two lists printed above:

[p2p]
seeds = "<seeds>"
persistent_peers = "<persistent-peers>"
max_packet_msg_payload_size = 10240

[mempool]
type = "app"

Once your validator runs behind sentries, replace persistent_peers with your sentries, as described in KMS and sentry architecture. Set the EVM chain ID in /var/lib/ctmd/config/app.toml explicitly:

[evm]
evm-chain-id = 8

Set the client chain ID in /var/lib/ctmd/config/client.toml:

chain-id = "c8ntinuum_8-1"

Configure state sync (optional)

State sync bootstraps the node from a recent snapshot instead of replaying from genesis. deploy.sh state-sync takes the trust height and hash from the first trusted RPC in peers.json, 2000 blocks below its latest height, and builds the persistent peers from the node IDs of the two trusted RPCs and the hosts of the first two persistent peers:

RPC_1=$(jq -r '.networks.mainnet.trusted_rpcs[0].url' peers.json)
RPC_2=$(jq -r '.networks.mainnet.trusted_rpcs[1].url' peers.json)
HOST_1=$(jq -r '.networks.mainnet.persistent_peers[0].host' peers.json)
HOST_2=$(jq -r '.networks.mainnet.persistent_peers[1].host' peers.json)

LATEST_HEIGHT=$(curl -fsSL "$RPC_1/block" | jq -r '.result.block.header.height')
TRUST_HEIGHT=$((LATEST_HEIGHT - 2000))
TRUST_HASH=$(curl -fsSL "$RPC_1/block?height=$TRUST_HEIGHT" | jq -r '.result.block_id.hash')
NODE_1=$(curl -fsSL "$RPC_1/status" | jq -r '.result.node_info.id')
NODE_2=$(curl -fsSL "$RPC_2/status" | jq -r '.result.node_info.id')

echo "rpc_servers = \"$RPC_1,$RPC_2\""
echo "trust_height = $TRUST_HEIGHT"
echo "trust_hash = \"$TRUST_HASH\""
echo "persistent_peers = \"$NODE_1@$HOST_1:26656,$NODE_2@$HOST_2:26656\""

Put the printed values in /var/lib/ctmd/config/config.toml:

[statesync]
enable = true
rpc_servers = "<rpc-1>,<rpc-2>"
trust_height = <trust-height>
trust_hash = "<trust-hash>"
trust_period = "168h0m0s"

[p2p]
persistent_peers = "<node-1>@<host-1>:26656,<node-2>@<host-2>:26656"

A node home that has never started holds no chain data. If this node has already run, stop it and clear its chain data first, as deploy.sh state-sync does. The reset needs write access to the node home, which the next step closes again:

systemctl stop ctmd.service
chmod 0770 /var/lib/ctmd
(cd /var/lib/ctmd && sudo -u ctmd env HOME=/var/lib/ctmd LD_LIBRARY_PATH=/opt/ctmd/lib \
  /usr/local/bin/ctmd comet unsafe-reset-all --home /var/lib/ctmd --keep-addr-book)

Reset only before the node has signed blocks as a validator: unsafe-reset-all also resets the validator signing state (data/priv_validator_state.json). On a validator that has already signed, that can make it sign the same height twice, and a double sign is slashed 5% and permanently jails (tombstones) the validator. Skip this section to replay from genesis instead.

Set ownership

After editing, restore the ownership and modes that deploy.sh sets on the node home:

chown -R ctmd:ctmd /var/lib/ctmd
chown root:ctmd /var/lib/ctmd /var/lib/ctmd/config/genesis.json
chmod 0750 /var/lib/ctmd /var/lib/ctmd/config /var/lib/ctmd/data
chmod 0640 /var/lib/ctmd/config/genesis.json
chmod 0700 /var/lib/ctmd/tmp

Run the node as a service

Create /etc/systemd/system/ctmd.service with the unit that deploy.sh generates. LD_LIBRARY_PATH points at the bundled libraries of the active install, and TMPDIR points at the node-owned temp directory that state sync writes to.

[Unit]
Description=ctmd node
After=network-online.target
Wants=network-online.target

[Service]
User=ctmd
Group=ctmd
WorkingDirectory=/var/lib/ctmd
Environment=HOME=/var/lib/ctmd
Environment=LD_LIBRARY_PATH=/opt/ctmd/lib
Environment=TMPDIR=/var/lib/ctmd/tmp
UMask=0077
StateDirectory=ctmd
StateDirectoryMode=0750
ExecStart=/usr/local/bin/ctmd start --home /var/lib/ctmd
Restart=on-failure
RestartSec=10s
KillSignal=SIGINT
TimeoutStopSec=600
TimeoutStartSec=300
LimitNOFILE=1000000
LimitNPROC=65535
StandardOutput=journal
StandardError=journal
SyslogIdentifier=ctmd-node
KeyringMode=private

Nice=-5
CPUWeight=1000
StartupCPUWeight=1000
IOWeight=1000
StartupIOWeight=1000
IOSchedulingClass=best-effort
IOSchedulingPriority=0
TasksMax=infinity
CPUQuota=
MemoryHigh=infinity
MemoryMax=infinity
CPUAffinity=

NoNewPrivileges=yes
PrivateDevices=yes
PrivateIPC=yes
PrivateUsers=no
PrivateNetwork=no
ProtectSystem=strict
ProtectHome=yes
ProtectHostname=yes
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectKernelLogs=yes
ProtectControlGroups=yes
ProtectClock=yes
ProtectProc=invisible
ProcSubset=all
CapabilityBoundingSet=
AmbientCapabilities=
RestrictSUIDSGID=yes
RestrictRealtime=yes
RestrictNamespaces=yes
LockPersonality=yes
MemoryDenyWriteExecute=no
SystemCallArchitectures=native
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK

[Install]
WantedBy=multi-user.target

Linux service unit explains the fields that matter to an operator. Enable and start the service, then follow the logs:

systemctl daemon-reload
systemctl enable ctmd.service
systemctl start ctmd.service
journalctl -u ctmd.service -f

Wait until the node reports catching_up as false:

curl -s http://127.0.0.1:26657/status | jq '.result.sync_info.catching_up'

If you configured state sync, turn it off once the node has caught up, as deploy.sh does: stop the service, set enable = false under [statesync] in config.toml, and start the service again.

Create validator

Generate an operator key. eth_secp256k1 is the default account key algorithm for ctmd.

ctmd keys add validator --algo eth_secp256k1 --keyring-backend file

Get the node consensus public key from the validator home:

ctmd comet show-validator --home ~/.ctmd

On a host set up with the manual mainnet install, run it as the ctmd user against /var/lib/ctmd:

(cd /var/lib/ctmd && sudo -u ctmd env HOME=/var/lib/ctmd LD_LIBRARY_PATH=/opt/ctmd/lib /usr/local/bin/ctmd comet show-validator --home /var/lib/ctmd)

Create validator.json. The pubkey must be the /cosmos.crypto.ed25519.PubKey output from ctmd comet show-validator.

{
  "pubkey": {
    "@type": "/cosmos.crypto.ed25519.PubKey",
    "key": "<base64-consensus-pubkey>"
  },
  "amount": "888888000000000000000000ctm",
  "moniker": "<validator-name>",
  "identity": "",
  "website": "",
  "security": "<validator-security-contact>",
  "details": "",
  "commission-rate": "0.10",
  "commission-max-rate": "0.20",
  "commission-max-change-rate": "0.01",
  "min-self-delegation": "888888000000000000000000"
}

Submit the transaction:

ctmd tx staking create-validator validator.json \
  --from validator \
  --keyring-backend file \
  --chain-id c8ntinuum_8-1 \
  --node <comet-rpc> \
  --fees <fee>ctm \
  --gas auto \
  --gas-adjustment 1.3

<fee> must be at least the gas limit multiplied by the chain’s minimum gas price, currently 222000000000ctm (222 gwei) per unit of gas, or by the current base fee if it is higher (ctmd query feemarket base-fee). To have ctmd compute the fee, pass that per-gas price with --gas-prices, for example --gas-prices 222000000000ctm, instead of --fees. See Gas on c8ntinuum for the fee market parameters. c8ntinuum enforces a validator creation floor of 888,888 CTM (888888000000000000000000ctm, 888888 * 10^18) for both the initial self-delegation amount and min-self-delegation. The six genesis validators use this minimum self-delegation and have between 999000000000000000000000ctm and 999912000000000000000000ctm self-bonded. For the module-level policy details and EVM staking precompile coverage, see Minimum Self-Delegation Check.

Commission bounds

The six genesis validators use:

Field	Value
`commission-rate`	`0.10`
`commission-max-rate`	`0.20` for three validators, `1.00` for the other three
`commission-max-change-rate`	`0.01` for the same three validators, `1.00` for the other three
Chain-wide `min_commission_rate`	`0`

General staking validation still applies: commission values cannot be negative, rate <= max-rate, max-rate <= 1, max-change-rate <= max-rate, and commission can be changed (raised or lowered) at most once per 24 hours, with each increase capped at max-change-rate.

Keys and Ledger

Account/operator keys default to eth_secp256k1.
Supported account algorithms are eth_secp256k1 and secp256k1.
Consensus validator keys are CometBFT ed25519 keys exposed through ctmd comet show-validator.
The default coin type for ctmd is 60, with default path m/44'/60'/0'/0/0.
Ledger coin type 60 uses the Ethereum app and creates an eth_secp256k1 public key.
Ledger coin type 118 uses the Cosmos app and creates a Cosmos secp256k1 public key.
ctmd keys add --ledger rejects a custom --hd-path; use --coin-type, --account, and --index.

ctmd keys add validator-eth-ledger \
  --ledger \
  --coin-type 60 \
  --algo eth_secp256k1

ctmd keys add validator-cosmos-ledger \
  --ledger \
  --coin-type 118 \
  --algo secp256k1

KMS and sentry architecture

c8ntinuum does not require a specific KMS or sentry topology; use these as operational recommendations.

Lowest-complexity signing uses the local CometBFT file signer under ~/.ctmd/config/priv_validator_key.json, but this has the largest key-exposure risk.
Remote signing can be implemented with TMKMS or Horcrux-compatible CometBFT remote signer setups.
For threshold signing or high availability, prefer Horcrux-style threshold signing over running duplicate live validator keys.
Never run the same validator consensus key in two active signers at once.
Keep the validator node private and connect it only to sentry nodes.
Public sentries should expose P2P and any intended public RPC surfaces; the validator should use sentries as persistent peers.
Recommended validator-side settings include pex = false, no public RPC, and firewall access limited to sentries and the signer.
Recommended sentry-side settings include pex = true, persistent_peers including the validator, and private_peer_ids including the validator node ID.

Ports and services

Service	Default	Notes
CometBFT P2P	`tcp://0.0.0.0:26656`	Public on sentries
CometBFT RPC	`tcp://127.0.0.1:26657`	Keep private unless intentionally exposed
ABCI	`tcp://0.0.0.0:26658`	Internal application transport
Cosmos REST API	`tcp://localhost:1317`	Disabled by default
Cosmos gRPC	`localhost:9090`	Enabled by default (`[grpc] enable = true` in `app.toml`), bound to localhost
gRPC-Web flag default	`0.0.0.0:9900`	Requires gRPC/gRPC-Web enablement
EVM JSON-RPC HTTP	`127.0.0.1:8545`	Disabled by default
EVM JSON-RPC WebSocket	`127.0.0.1:8546`	Disabled by default
EVM JSON-RPC metrics	`127.0.0.1:6065`	Enabled with JSON-RPC and `--metrics`
Geth metrics address	`127.0.0.1:8100`	Used by telemetry/API metrics plumbing
CometBFT Prometheus	`:26660`	Disabled by default

gRPC is enabled by default on localhost:9090. The REST API, JSON-RPC, and telemetry are disabled by default unless explicitly enabled in config or via start flags.

Monitoring

Monitor at least:

Process health and automatic restart behavior for ctmd.
Sync status from ctmd status; alert if catching_up is true on a validator.
Peer count and sentry connectivity from CometBFT RPC.
Block height progress, block time, disk usage, memory, file descriptors, and database growth.
Validator signing info from ctmd query slashing signing-info $(ctmd comet show-address).
Missed blocks well before the downtime threshold; alert before 4444 missed blocks in the 8888 block window.
JSON-RPC, gRPC, API, and indexer latency only on nodes intentionally serving those surfaces.

Validator incentive state is tracked by x/valrewards, including epoch reward settings, reward-pool funding, outstanding reward queries, and one-time validator reward claims. See Validator Rewards for CLI and precompile details.

Slashing, jailing, and unjail

Mainnet (c8ntinuum_8-1) slashing params, from ctmd query slashing params:

Param	Value
`signed_blocks_window`	`8888`
`min_signed_per_window`	`0.500000000000000000`
`downtime_jail_duration`	`600s`
`slash_fraction_downtime`	`0.010000000000000000`
`slash_fraction_double_sign`	`0.050000000000000000`

A validator is jailed for downtime when it misses more than half of the 8888 block signing window after the slashing warm-up period. Downtime burns 1% and jails for 600s. Double-signing burns 5%, jails, and tombstones the validator; tombstoned validators cannot be unjailed. Unjail only after fixing the signer/node issue, waiting until jailed_until has passed, and confirming self-delegation is at least 888888000000000000000000ctm.

ctmd query slashing signing-info "$(ctmd comet show-address)"
ctmd query staking validator <c8valoper...>

ctmd tx slashing unjail \
  --from validator \
  --keyring-backend file \
  --chain-id c8ntinuum_8-1 \
  --node <comet-rpc> \
  --fees <fee>ctm \
  --gas auto \
  --gas-adjustment 1.3

Upgrade flow and emergency contacts

Use Upgrade Instructions as the canonical upgrade runbook. Validators should layer signing-key safety, sentry topology, TMKMS, and double-sign protection checks on top of each release-specific upgrade notice.

Getting Started

Operations

Advanced

Network constants

Prerequisites

Manual mainnet install

Download and verify the release

Install the binary and libraries

Create the service user and node home

Initialize the node

Install and verify genesis

Configure peers and chain IDs

Configure state sync (optional)

Set ownership

Run the node as a service

Create validator

Commission bounds

Keys and Ledger

KMS and sentry architecture

Ports and services

Monitoring

Slashing, jailing, and unjail

Upgrade flow and emergency contacts

​Network constants

​Prerequisites

​Manual mainnet install

​Download and verify the release

​Install the binary and libraries

​Create the service user and node home

​Initialize the node

​Install and verify genesis

​Configure peers and chain IDs

​Configure state sync (optional)

​Set ownership

​Run the node as a service

​Create validator

​Commission bounds

​Keys and Ledger

​KMS and sentry architecture

​Ports and services

​Monitoring

​Slashing, jailing, and unjail

​Upgrade flow and emergency contacts

Network constants

Prerequisites

Manual mainnet install

Download and verify the release

Install the binary and libraries

Create the service user and node home

Initialize the node

Install and verify genesis

Configure peers and chain IDs

Configure state sync (optional)

Set ownership

Run the node as a service

Create validator

Commission bounds

Keys and Ledger

KMS and sentry architecture

Ports and services

Monitoring

Slashing, jailing, and unjail

Upgrade flow and emergency contacts