Skip to content

docs(orchestrator): harden wallet setup with delegated reward calling - #1015

Open
rickstaa wants to merge 4 commits into
docs-v3from
docs/orchestrator-wallet-security
Open

docs(orchestrator): harden wallet setup with delegated reward calling#1015
rickstaa wants to merge 4 commits into
docs-v3from
docs/orchestrator-wallet-security

Conversation

@rickstaa

@rickstaa rickstaa commented Sep 7, 2026

Copy link
Copy Markdown
Member

Updates Activate on Arbitrum so the recommended setup is the secure one: a hardware wallet or Safe as the orchestrator wallet, a throwaway node wallet with -ethOrchAddr, and a LIP-118 reward caller (go-livepeer, standalone, or the shared livepeer.bot caller). Adds -ethOrchAddr, -cliAddr, and -enableCliTxRoutes to the CLI flags reference. Also fixes a README autolink that made mint broken-links fail.

Do not merge before livepeer/go-livepeer#4011. The go-livepeer reward caller tab and the -ethOrchAddr reward delegation it describes depend on that PR.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
@mintlify

mintlify Bot commented Sep 7, 2026

Copy link
Copy Markdown
Contributor

Preview deployment for your docs. Learn more about Mintlify Previews.

Project Status Preview Updated
livepeer 🟢 Ready View Preview Sep 7, 2026, 9:35 AM

Activation now recommends a hardware wallet or Safe, a throwaway node
wallet with -ethOrchAddr, and a LIP-118 reward caller. Adds the related
flags to the CLI reference.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
@rickstaa rickstaa changed the title docs(orchestrator): keep the orchestrator key off the work machine docs(orchestrator): harden wallet setup with delegated reward calling Sep 7, 2026
@rickstaa
rickstaa force-pushed the docs/orchestrator-wallet-security branch from 6f4b4b7 to fe2016c Compare September 7, 2026 09:37
@rickstaa
rickstaa requested a review from adamsoffer September 7, 2026 09:37
@Strykar

Strykar commented Sep 8, 2026

Copy link
Copy Markdown

cast does not check EIP-55, so the setRewardCaller recipe accepts a one-character typo that the node path now rejects (cast calldata "setRewardCaller(address)" 0x16a72bdb3017196825bC53809b87F96fbEE31F6C encodes fine). Worth a read-back right after the send, since step 8 only confirms ~22h later:

cast call 0x35Bcf3c30594191d53231E4FF333E8A770453e40 \
  "transcoderToRewardCaller(address)(address)" <ORCHESTRATOR_ADDR> --rpc-url <ARBITRUM_RPC_URL>

Step 5 tells cold-wallet users to call transcoder on the BondingManager but gives no argument format. It is transcoder(uint256 _rewardCut, uint256 _feeShare), both over PERC_DIVISOR = 1000000, and the second argument is fee share (delegators' portion), the inverse of the table's Fee Cut. Copying 10 and 95 from the table literally sets rewardCut 0.001% and feeShare 0.0095%. Either give the converted values (Reward Cut 10% is 100000; Fee Cut 95% is _feeShare 50000) or point that step at the Explorer.

@rickstaa

rickstaa commented Sep 8, 2026

Copy link
Copy Markdown
Member Author

cast does not check EIP-55, so the setRewardCaller recipe accepts a one-character typo that the node path now rejects (cast calldata "setRewardCaller(address)" 0x16a72bdb3017196825bC53809b87F96fbEE31F6C encodes fine). Worth a read-back right after the send, since step 8 only confirms ~22h later:

cast call 0x35Bcf3c30594191d53231E4FF333E8A770453e40 \
  "transcoderToRewardCaller(address)(address)" <ORCHESTRATOR_ADDR> --rpc-url <ARBITRUM_RPC_URL>

Step 5 tells cold-wallet users to call transcoder on the BondingManager but gives no argument format. It is transcoder(uint256 _rewardCut, uint256 _feeShare), both over PERC_DIVISOR = 1000000, and the second argument is fee share (delegators' portion), the inverse of the table's Fee Cut. Copying 10 and 95 from the table literally sets rewardCut 0.001% and feeShare 0.0095%. Either give the converted values (Reward Cut 10% is 100000; Fee Cut 95% is _feeShare 50000) or point that step at the Explorer.

Makes sense, updated.

…ller

Spell out the transcoder and setServiceURI calls with converted values
so cold-wallet users do not pass percentages, replace the delayed
reward-call check with a gas-free simulation, and warn that the node
host must be treated as compromisable.

Co-Authored-By: Avinash H. Duduskar <2946372+Strykar@users.noreply.github.com>
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

@adamsoffer adamsoffer left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM. One nit Claude Fable 5.1 caught is that the cast recipes assume a keystore, so they don't work as written for the hardware wallet or Safe the guide recommends.

Comment thread network/guides/orchestrator-activate.mdx
@adamsoffer
adamsoffer self-requested a review September 8, 2026 21:21
The guide recommends a hardware wallet or Safe, but every cast recipe
assumed a keystore. Name the ledger and trezor flags and route Safe
users through the Transaction Builder or Den, with cast calldata as
the fallback when the UI cannot load a function.

Co-Authored-By: Adam Soffer <adam@livepeer.org>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants