There is a tension at the center of every BFT blockchain design: more validators means more decentralization, but it also means slower blocks. CometBFT — the consensus engine Sanect is built on — makes this tension explicit. The protocol does not gracefully degrade as validator count climbs. It hits a ceiling.
Sanect's design acknowledges this ceiling and builds a structure around it rather than pretending it does not exist.
The CometBFT Validator Ceiling
In CometBFT's two-phase voting protocol, every validator must hear from and respond to every other validator in the prevote and precommit rounds. The message complexity is O(n²). At 50 validators, a single consensus round requires roughly 2,500 message exchanges. At 150 validators, that becomes 22,500. At 1,000 validators, the network overhead alone exceeds the timeout windows that produce fast blocks.
The empirical ceiling for sub-second block times in CometBFT — without protocol modifications like BLS signature aggregation — is approximately 150 active validators. Beyond that, block time exceeds one second even on low-latency private networks. In a globally distributed public validator set with intercontinental round trips, the practical ceiling for 400ms blocks is lower: around 50.
This is not a Sanect limitation. It is a CometBFT v0.39 fact. We chose 50 because it is provably within the ceiling with margin to spare, not because it was the largest number we could claim.
The Active Set: Top-50 by Stake
Sanect uses delegated proof-of-stake with a 50-validator active set. Any registered validator address is ranked by its total delegated stake — self-delegation plus delegations from SNCT holders. The top 50 by stake produce blocks and earn rewards. Everyone else waits.
The rotation is automatic. If a validator in position 52 accumulates enough delegations to displace the validator in position 50, it enters the active set at the next rotation check. There is no governance vote, no application process, no manual intervention. Stake determines rank; rank determines participation.
This design has a few direct consequences:
- Delegator power is real. SNCT holders who delegate to a waiting validator are actively working to bring it into the active set. Delegation is not just yield-farming — it shapes consensus participation.
- The active set self-corrects on poor performance. A validator that gets jailed for downtime loses block rewards and may see delegators move their stake elsewhere, pushing it out of the top 50 naturally.
- New entrants have a path. A well-capitalized validator that registers today can enter the active set on the strength of delegations alone — no whitelist, no relationship with the team.
The Waiting Queue: Unlimited Registrations
Any address can register as a Sanect validator. There is no cap on registrations. The minimum self-delegation is 1,000 SNCT on mainnet (100 SNCT on testnet) — a low bar designed to prevent spam while not pricing out independent operators.
Validators outside the top 50 are registered, staked, and ready. They run full nodes. They verify blocks. They watch the active set. They are not producing blocks or earning staking rewards, but they are the decentralization backstop — if 10 active validators disappear simultaneously, the next 10 in the queue begin participating at the next rotation.
The queue also creates a credible "thousands of validators" story over time. A chain that caps registrations at 50 is a 50-validator chain. A chain with an unbounded waiting queue that happens to have 50 active producers at any moment is something different — it is a network with broad participation even if consensus is concentrated in the current top 50.
Slashing: The Accountability Layer
Active validators are held to performance standards enforced by slashing. The current parameters:
- Downtime: Validators must sign at least 50% of blocks in any rolling 10,000-block window (~1 hour at 400ms blocks). Failure results in a 0.01% stake slash and a 10-minute jail period. This is intentionally gentle — a brief deployment restart should not cost a validator meaningful stake.
- Double-sign: Equivocation — signing two different blocks at the same height — results in a 5% stake slash and permanent tombstoning. This punishment is severe because double-signing is the attack CometBFT's safety guarantees are designed to prevent. Validators who double-sign cannot rejoin the active set.
- Jail exit: After a downtime jail, validators can unjail themselves after 10 minutes using the slashing precompile at address
0x0000000000000000000000000000000000000806. The unjail call must come from the validator's operator address — it cannot be proxied.
Geographic Distribution and the Jurisdiction Rule
Sanect's Variant A topology targets a specific geographic distribution for the 50-validator active set: no single jurisdiction holds 2/3 of the stake. In practice, this means the Asian validators — Singapore, Mumbai, Delhi, Chennai, Hong Kong, Tokyo — together hold approximately 52% of the set, while European and US East validators hold the remaining 48%.
The significance of the 2/3 threshold is not cosmetic. In CometBFT, finalizing a block requires a 2/3 supermajority. If a single government or coalition could control 2/3 of the validator stake, it could censor transactions or halt the chain by directing validators to not sign. With the current distribution, no single country can reach the 2/3 threshold alone, and no two regions can collude to exclude the third.
Decentralization is not about the number of validators. It is about whether any single actor can coerce enough of them simultaneously to break safety. Geographic and jurisdictional diversity is the variable that matters.
How Staking Affects Validator Rank
Validator rank is updated continuously as delegations change. When SNCT holders delegate to a validator, that validator's total stake increases — moving it up the ranking. When delegators undelegate (subject to the standard ~21-day unbonding period), stake decreases and rank may fall.
The unbonding period exists to prevent rapid stake reshuffling that could destabilize the active set composition. A validator cannot be instantly dropped from 1st to 51st by a mass undelegation — the 21-day window smooths the transition and gives the chain time to adapt.
Self-delegation is required at registration but does not cap at any fixed amount. Large validators who self-delegate significant SNCT have more skin in the game — a double-sign slashes their own stake proportionally. This aligns incentives without requiring validators to be anonymous custodians of delegator capital.