At Stakin, we value security and reliability above anything else. Operating Web3 infrastructure can be complicated and requires deep knowledge and expertise of each protocol and its established processes. With over 4 years of experience designing, maintaining, and operating critical Web3 and Proof-of-Stake mainnet network infrastructure, our team is well-equipped to ensure the security and reliability of your assets.

Our technical set-up is guided by principles of security, availability, diversification, and risk minimization. We always prioritize minimizing the risks that users' funds face, especially those related to double-signing or downtime slashing in non-custodial staking.

The sections outlined below provide details on some of the main components of our node infrastructure and security processes.

Validator Set-up

Stakin operates validators for over 40 blockchain networks. As each network is different, we adapt the relevant infrastructure to the constraints and requirements of each network. First and foremost, the goal is to avoid double-signing risks or extended downtime events, which could lead to missed rewards or downtime slashing.

Stakin sets up a unique and segregated infrastructure for each network that does not interact with the rest of our networks and operations. We want to make sure that our infrastructure is specifically designed, dedicated, and optimized for each network where we operate. Typically, we over-provision our infrastructure (higher CPU, RAM, disks, etc.) to ensure we can handle periods of high network stress.

When possible, our validators operate behind geographically distributed sentry nodes to improve the reliability of the setup and add an extra layer of protection against potential DDOS attacks.

Our validators have redundancy to ensure we can switch to a redundant machine in case of downtime. We use a manual failover process with multiple team members double-checking the setup to ensure that there are no double-signing risks. We’ve found that most historical double-signing events from validators are due to errors in automated failover processes.

Our 24/7 monitoring and alerting processes enable us to prevent, notice, and resolve issues within reasonable downtime windows. We also take frequent snapshots of blockchain databases in case of failure of the redundant validator. These snapshots help us quickly recover from any malfunction/issue or errors on the redundant machines.

Other Set-ups (Web3, RPC, Relayers)

When there is no risk of slashing events, Stakin focuses on maximizing the uptime of the infrastructure. In addition to operating validator nodes, Stakin operates a number of nodes that connect to the blockchain but whose role is not necessarily to produce or verify blocks. These nodes are helpful to Web3 projects and are sometimes part of the overall validator infrastructure, acting as security layers, components of Oracle features, or redundancy.

The different nodes we maintain in addition to our validators include:

• Sentry nodes, which protect against eventual DDOS;
• RPC nodes, which store a copy of the ledger and are used for several use cases: public endpoints, contribution to decentralized RPC projects and bridges, or private endpoints for oracles or other infrastructure we operate;
• Oracles, which are in charge of gathering off-chain or on-chain data and feeding this data to smart contracts;
• Relayers, especially on interoperability ecosystems, relay transactions for the benefit of the community between different blockchains and enable inter-blockchain communication and transfers.

ISO 27001 Certified

The Information Security Management System at Stakin and our non-custodial node infrastructure have been certified in accordance with ISO 27001:2022 by Bureau Veritas

The Information Security Management System (ISMS) at Stakin encompasses the security of our Tendermint, Ethereum, and Substrate-based non-custodial node infrastructure within the highly reliable threshold validation and staking environment and includes the following:

• Organizational Controls
• People Controls
• Physical Controls
• Technological Controls

This enables our delegators to earn staking yield securely and reliably without compromising the custody of their assets.

Systems Security

As a Web3 infrastructure provider, ensuring the security of your systems and network is paramount. That is why we implement hardening measures, including:

• Setting up firewalls and restricting ports to limit access to our systems and networks.
• Monitoring security logs to identify and respond to potential threats in real-time.
• Reviewing patches and dependencies frequently ensures we use the latest and most secure software.
• Conduct regular audits and testing of our infrastructure to identify and address vulnerabilities.

By implementing these measures, we can reduce the risks of hacking, downtime, and data breaches for our clients. We understand that security is a critical component of Web3 infrastructure. We are committed to ensuring our clients have the peace of mind to focus on their core business.

Providers

For diversification purposes, redundancy, latency, and due to specific dedicated node demands from clients (regulatory, compliance, or decentralization constraints), the infrastructure is deployed across a large number of data centers, hosting providers, and jurisdictions.

Our company uses a globally diversified network of bare metal and cloud providers. We deploy infrastructure on more than 10 leading providers globally operating from top-notch data centers in 4 regions and 10 countries. Our servers are deployed in Europe, North America, South America, and Asia.

In the case of dedicated and Whitelabel nodes, we can adapt the infrastructure for specific requirements such as compliance, latency, or decentralization and deploy it in some selected jurisdictions.

Monitoring

24/7 monitoring is vital to ensure that risks are minimized, and rewards are maximized.

Stakin has built its dashboards to track events at both the server and blockchain levels. For this purpose, we mainly use in-house built software and scripts that integrate with common dashboard solutions and notification/alerting across various company channels.

We also take advantage of open-source third-party and community solutions for redundancy.

Our company takes a proactive approach to server management, with alerts set at lower thresholds to prevent incidents and be able to work on the necessary troubleshooting or hardware upgrades before incidents happen.

By monitoring blockchain activity in addition to server activity, Stakin can get informed about potential network-level outages and take a participative approach towards troubleshooting with the other validators and community on how to resolve the issues.

Communications

The team has direct chats with core development teams, other peers, and network foundations in case of emergencies, such as unscheduled network upgrades, vulnerability discovery, network downtime, and attacks. In addition, Stakin maintains a security email address shared with development teams for security-related emergencies.

Business Continuity and Recovery

Our processes are built to ensure that incidents are escalated and resolved as quickly as possible. In case of an incident such as node downtime, DDOS, or targeted attack, our priority is to secure the users' funds and avoid double-signing, then work on potential downtime risks while keeping the infrastructure secure. As a non-custodial staking service, client funds are not directly at risk, except for slashing in the event of prolonged downtime or double-signing.

Our infrastructure is purposefully built for business continuity, from the node set-up to the monitoring, as well as through thorough geographical provider diversification.

We operate a validator backup node or a quick sync set-up for redundancy with a regular snapshot for each network. Backup validator nodes run at different providers and in various data centers than the validator itself and can be activated under the manual redundancy process.

The infrastructure security and redundancy processes are frequently tested on testnet networks for training and preparation purposes.

Organizational Security

Stakin has implemented a strict Information Security Policy with rules for access to production infrastructure, including servers operating blockchain nodes and validators.

Our approach to security extends beyond technical teams, DevOps, and network operations, with regular training and education on multiple blockchain-related risks, such as phishing risks and human engineering.

Stakin frequently reviews best practices in the industry to adapt its information security management systems at the organizational level and ensure the security and reliability of the infrastructure and the security of the overall operations.

We also conduct frequent reviews of our different service providers (bare metal, cloud, or other IT services) to ensure they meet our quality, security, and reliability standards.

Key Management

Stakin is a non-custodial validator, meaning that customer funds are, and always will be, within the delegator's or client's possession. It is nonetheless essential to have security processes in place for internal validator keys, as key compromise could result in downtime or slashing events.

At Stakin, we store operational-related and validator keys in encrypted vaults and hardware devices which a threshold of selected key custodians can access.

Privacy

Stakin does not store any customer data. We may collect data from visitors on our website and dashboard. For more information, please visit our Privacy Policy page.

Contact and Requests

For more information about our technical infrastructure-specific requests or to schedule a walkthrough session with one of our DevOps, please contact support@stakin.com. We'd love to help.