Help · Architecture

How Nodes Are Checked

Nodes report their own traffic, so ProofKit checks it: test downloads through each exit, entry-versus-exit and network-card comparisons, statistical anomaly checks, signed checkpoints, and a 1 TON stake that critical flags cut into.

Open in the app All help topics
example

Probe: 1 MB through the exit, node reports 1.6 MB → over 24 h, reported ≥ 1.5 × measured → critical flag 3 critical flags in 24 h → 10% of the stake slashed

Operators set their own prices and report their own traffic, so inflating traffic is the obvious way to cheat. These are the checks ProofKit runs, all of them on ProofKit's own servers.

Probes through each exit

At random moments, about every 5 minutes per exit on average, ProofKit's servers connect to the exit over Reality like a user and download a test file of around 1 MB (sometimes a real website instead). Later they compare the bytes with what the node reported for that connection.

  • Within 15% counts as a match. Probes too small to measure, or that could not get through, are left unresolved.
  • If, over 24 hours and at least 10 usable probes, a node reported 1.5 times or more what was measured, it gets a critical flag.
  • A test file whose content comes back altered raises a critical flag at once.

Comparisons between counters

  • Entry versus exit: on each entry–exit tunnel, the bytes one side sent should match what the other received. A gap over 10% (above 100 MB) raises a warning flag.
  • Network-card counters: a node that reports more VPN traffic than 1.1 times what its network interface carried, three times in a row, gets a critical flag. A report that is larger than the node's link could carry is thrown away.

Anomaly detection

Every hour, statistical checks look for a single route above 2 GB an hour and for traffic that looks generated. Each node's billed traffic in the last hour is also compared with its own previous 7 days, never with other nodes: an hour far above the node's usual level raises a warning, which is recorded for review and never counts toward a slash, because a busy node is not a cheating one. Checkpoint history is checked too: a counter that goes backwards is critical. See Checkpoint diff.

Stake and slashing

Each node locks 1 TON of its operator's balance. Three or more critical flags within 24 hours cost the node 10% of its stake, at most once a day. See Stake.

Limits

  • Most flags are warnings: they are recorded for review and don't count toward a slash.
  • Probe connections use their own identities, so a determined operator could learn to recognise them.
  • Checkpoints compare a node with itself; they show consistency, not accuracy.