─┤ Block Parliament Security Policy ├─

Last updated: August 24, 2026
← back to home

─┤ Overview ├─ §

Block Parliament is a Solana mainnet validator operated by Gabe Rodriguez, a core contributor to the Agave validator client at Anza. This document describes the security measures and operational practices in place to protect delegator stake and maintain reliable validator operations.

Important: When you delegate, your SOL moves to a stake account that remains under your control. Validators cannot access, move, or withdraw your delegated stake.

─┤ Key Management ├─ §

Withdrawal Authority Separation

The validator's withdrawal authority key (AN58nFDFdehKbP7d3KALhnCJAsWNE7cWpCR6dLVAj9xm) is stored separately from the validator identity and vote account keys. This key is kept offline and never resides on the validator server, preventing unauthorized fund access even in the event of server compromise.

Identity Key Protection

The validator identity key is stored on the server with restricted file permissions (owned by the sol user, mode 600). Administrative access (via the ubuntu account) is separate from the validator process account (sol), which has no sudo privileges.

Hardware Wallet Backup

Critical keys are backed up to hardware wallets stored in secure physical locations. Seed phrases are never stored digitally or transmitted over networks.

─┤ Infrastructure ├─ §

Dedicated Bare-Metal Server

Mainnet runs on dedicated Latitude bare metal in Los Angeles: AMD EPYC 7443P 24-core CPU, 512 GB RAM, 2 × 4 TB NVMe plus a dedicated 250 GB NVMe system disk. Testnet runs on a separate dedicated host for release validation.

Hardened Operating System

Linux installation with only essential packages plus monitoring agents (Alloy for metrics, Prometheus exporters). The validator process runs under a dedicated unprivileged user account.

Network Security
  • • Strict firewall rules: only necessary ports exposed (Solana gossip/turbine/repair, SSH, metrics exporter)
  • • SSH access via public-key authentication only (password auth disabled)
  • • fail2ban active with aggressive settings (5 attempts → 12hr ban)

─┤ Access Control ├─ §

Limited Personnel

Server access is limited to the operator (Gabe Rodriguez) and one contractor (Christopher Vannelli). No other third-party vendors have access to validator infrastructure.

User Isolation
  • • Administrator account (ubuntu) separate from validator process account (sol)
  • • SSH root login disabled
  • • Validator user cannot sudo or access admin functions

─┤ Monitoring & Alerting ├─ §

24/7 Automated Monitoring

Dedicated RPC exporters run on the mainnet and testnet hosts, remote-write health and freshness metrics to Grafana Cloud, and alert through Telegram and email for:

  • • Validator delinquency (not voting)
  • • Health check failures
  • • Vote account issues
  • • Exporter or telemetry staleness
Metrics Collection

System and validator metrics (CPU, memory, disk, slot lag, vote performance) are collected and stored in Grafana Cloud for trend analysis and incident investigation.

Public Performance Data

Validator performance is publicly verifiable via Stakewiz, validators.app, and on-chain data.

─┤ Software & Updates ├─ §

Validator Client

Mainnet runs the Jito-enhanced Agave client with BAM. The current version is shown on the live metrics page. The operator contributes to Agave and Solana on-chain programs at Anza.

Update Process
  • • New releases tracked via Solana Tech Discord
  • • Updates tested on testnet validator before mainnet
  • • Tower file backed up before any upgrade (prevents consensus issues)
  • • OS security patches applied regularly
No Unproven Modifications

The validator runs standard Jito-Agave releases without custom consensus modifications that could affect network behavior.

─┤ MEV & Jito Integration ├─ §

Block Parliament runs Jito MEV infrastructure. MEV tips are distributed automatically by Jito's on-chain programs—the validator receives its configured commission, and Jito distributes the remainder to stakers.

Configuration
  • • Mainnet location: Los Angeles
  • • Block engine region: Salt Lake City
  • • BAM region: Los Angeles
  • • Shred routing: Jito plus DoubleZero multicast
  • • Tip programs: Official Jito mainnet contracts
  • • Current commission rates: view on Solscan ↗

─┤ Incident Response ├─ §

In the event of a security incident or validator issue, the operator follows these procedures:

  • 1. Detection — Automated alerts or manual observation
  • 2. Assessment — Determine scope and severity
  • 3. Containment — Isolate affected systems if needed
  • 4. Resolution — Apply fixes, restore service
  • 5. Review — Document lessons learned, improve processes

For issues affecting delegators, updates will be posted via @grod220 on X.

─┤ Verify On-Chain ├─ §

All claims on this page can be verified independently:

─┤ Security Contact ├─ §

To report security concerns or vulnerabilities related to Block Parliament validator operations: