FAQ

Trust and security

Does the marketplace ever see my validator identity key?

No. The plaintext key exists only inside the Nitro Enclave's memory. At rest it is a KMS-wrapped ciphertext that only the attested enclave can decrypt (PCR-gated). The marketplace API issues short-lived ES256 JWTs and never touches the key. See the security overview.

Can the TEE sign anything other than a QUIC handshake?

No. The enclave rejects any payload that does not match Firedancer's fd_keyguard_payload_matches_tls_cv matcher, so it only ever signs TLS 1.3 CertificateVerify payloads. It can never produce a vote or transaction signature. A JWT authorizes signing for its full TTL (600 s by default) under a quota.max_handshakes_per_min claim, so it is a metered time window, not a single-use ticket. Details in the threat model.

What happens if my KMS key is deleted or mis-rotated?

The wrapped identity key becomes undecryptable and the TEE cannot boot its signer. The probe alerts after 3 consecutive failed checks (about 3 minutes) but does not delist your validator automatically. There is no rotation command in v1: recovery means destroying the instance, redeploying with a fresh seed, and re-registering with validator-cli register (a new pubkey means a new listing). Full procedure in the key rotation runbook.

What does the validator learn about my trading?

Handshake metadata only: who connected, when, from which IP, and signing volume. The TEE is invoked at handshake time, never per transaction, so the validator never sees transaction content, programs, or P&L.

Money

What does a lease cost?

The validator sets a flat price in SOL per epoch (shared seats have a separate, usually lower price). Total = price per epoch times epochs booked. The platform takes a 10% fee, and that rate is frozen onto the lease at booking, so later fee changes never re-price an existing lease. Browse live prices at /validators, and see validator pricing for how operators set them.

How do I pay? Do you take cards? Is there KYC?

Payment is a non-custodial Solana Pay transaction request you sign from your own wallet, SOL only in v1. The wallet fetches one unsigned transaction containing both legs atomically: 90% to the validator payout wallet, 10% to the platform wallet. No card path, no payment processor, no KYC/KYB, and the marketplace never holds custody. You have 15 minutes to pay before the booking expires. Walkthrough in booking a lease.

What is the difference between exclusive and shared?

Exclusive is the default: one trader gets the validator's full stake-weighted bandwidth for the booked epochs, and every live validator offers it. Shared is validator opt-in: up to a fixed seat cap of co-tenants at a separate price, where each seat's JWT carries a reduced handshake quota of max(1, floor(budget / seats)) per minute. Post-handshake stream allocation is the leader's SWQoS decision, so shared traders accept residual dilution from co-tenants. See booking a lease.

Can I cancel mid-lease and get a refund?

No. The epoch is the billing unit and paying is committing, so there is no trader-initiated cancellation. Prorated refunds happen only when the lease is ended from the other side: a validator revoke (refunded within 24 hours), an admin revoke, or a hard takedown. The refund covers the current epoch through the end of the lease (a revoke in the final epoch still refunds that epoch), and it is paid in SOL from a platform-held buffer funded by the 10% fee leg. An admin suspension does not refund anything (existing leases keep running). There is no contractual SLA and no automatic credit for TEE downtime in v1.

What if I book and never pay?

The booking holds its slot in pending_payment for 15 minutes, then a sweep marks it expired_unpaid and frees the slot. The payment endpoint returns 404 for the dead memo, so a late wallet cannot even build the transaction. No funds ever moved, so there is nothing to refund.

Mechanics

How long is an epoch, and how long can a lease run?

A Solana epoch is 432,000 slots at 0.4 s each, roughly 2 days. A lease covers 1 to 30 consecutive epochs and starts at the next epoch boundary after payment confirms. You can extend a lease in place with POST /v1/leases/{id}/extend, priced at the per-epoch rate frozen at booking even if the validator has raised prices since. An auto-renew flag exists via PATCH /v1/leases/{id}/auto-renew. Endpoint details in the leases API.

Are there region restrictions or a stake minimum?

No on both. Validators may run the TEE in any AWS region, and there is no minimum stake to list. Judge a listing by its region, its probe p50 handshake latency (measured every 60 s from eu-central-1), and its effectiveness data (leader time per epoch, stake percentile). See the validators API.

How fast does a revocation cut off access?

Revocation means the marketplace stops issuing JWTs for the lease. The last issued JWT stays valid until its exp, so access ends within one JWT TTL: 10 minutes at the default 600 s, never more than the 3600 s hard cap. No revocation list is pushed to the TEE.

Reporting

Where do bug reports and security issues go?

Use GitHub's private vulnerability reporting on the open-source TEE repository (nodexpert-labs/staked-quic-connection-provider, Security > Report a vulnerability), never a public issue. A platform-wide bug bounty is a pre-GA requirement and is not live yet. Scope and disclosure process in security reporting.