I've been solo staking for a while. This is only for tech savvy users and it takes a while to setup. Non-technical users should use liquid staking. Just buy some rETH or whatever and forget about it. The APY doesn't really justify the risk or cost of solo staking. Companies with thousands of machines can make a profit at these low APYs using economy of scale. Solo staking only makes sense for hobbyists, enthusiasts, and researchers.
I don't stake for the APY. I stake because I want to see firsthand whether or not Ethereum is a viable blockchain. All the blockchains make various claims about decentralization. For example, try running your own Solana node. (hint: you can't). Running the blockchain node moves my knowledge about Ethereum from speculation to experience. I'll be able to see for myself if they make some change that makes Ethereum fail to live up to its promises.
Anyway, after the setup, my solo staking node is very low maintenance. The main maintenance task is that I subscribe to the github release notifications for the execution and consensus clients and install the software updates. I highly recommend the monitoring service and app at https://beaconcha.in/mobile
One more pro-tip for solo staking: prepare, practice and rehearse your exit transaction. Have both your validator and withdrawal keys backed up in case your validator machine goes down. You should be able to exit and withdraw quickly to minimize penalties if your node goes down.
I mentioned allnodes.com in the past, and it seems their service fits perfectly in the staking as a service category. And with their advanced plan you pay $10 per month and get MEV boost (where you have a few different options). So not sure if I'm missing something, but seems like a much better deal then the services you mentioned, as you state that they take about a 10% cut. Allnodes' fees is about the same as running your own node with $120 per year. (or $60 if you don't want MEV boost and some other features).
Allnodes provides a service to automate the setup of validator software and run your validator in the cloud using Linode/Digital Ocean servers. Cost is $5-10/month and you can pay with crypto. MEV is supported and the solo staker keeps all their MEV, no forced pooling of rewards or commission charged.
I don’t like using their Ethereum Validator Key Generator. I prefer the tool recommended by the Ethereum foundation just to reduce attack surface. Haven’t personally audited the generator code and am generally distrustful of sharing key material with a browser. Even if Allnodes code isn’t malicious, its possible that the key material is read (or worse, modified) by a malicious browser extension. This means your withdrawal address could be switched out with the attacker address in a worst case scenario. Unless you have really good security (clean, trusted browser template with no extensions), it will be safer to use the standalone key generator app recommended by the Ethereum foundation, and generate keys while the machine is offline. So do that for more security if using Allnodes.
Allnodes also depend on the Abyss Finance tool to deposit/stake. This has been audited by MixBytes and looks fine. https://abyss.finance/audit/eth2depositor_security_audit_mixbytes.pdf But I’d just personally prefer to deposit direct to the staking contract using the Ethereum Foundation launchpad, remember to carefully inspect the transaction. Unless I’m using Abyss to stake dozens of validators in bulk, why add a layer of smart contract risk?
Also with the recent warning from the ethstaker discord that certain AMD nodes might be vulnerable, allnodes just confirmed to me that they only used intel based systems FYI
Do you have an opinion on the Grid+ Lattice1? They claim they will open source their firmware in q3.
The messages go through wifi which increases the attack surface and gives me pause. By default they route messages through their servers, but they have an open source proxy to run locally. https://github.com/GridPlus/lattice-connect-v2
Looks interesting, gives me pause too, will look into it if they follow through on open sourcing their firmware. I think Hugh Karp (Nexus Mutual) uses this wallet already.
“Rather than trust any third party infrastructure provider, we deny them information about us and our transactions. This includes rotating IP addresses, avoiding browser fingerprinting, and using separate ‘seed phrases’ or bunches of private keys (JBOK) to avoid linking all accounts under a master seed phrase.”
Apologies but I have problems interpreting “and using separate ‘seed phrases’ or bunches of private keys (JBOK)”.
Could you kindly explain how you manage a bunch of seed phrases and private keys that you use with your MetaMask setups over TOR (and I suppose that will be in Firefox)?
What does JBOK means?
Do you recommend using Trezor’s passphrase feature to manage a bunch of new ETH addresses instead of generating and managing a bunch of BIP39 seed phrases? I figured that it could be more secure and convenient this way than writing down a bunch seed mnemonics and trying to keep them safe from theft or fire.
JBOK = just a bunch of keys (so not linked all under 1 seed)
My workflow for hot wallets
1. Generate private keys (can just create a new seed in Metamask, make a bunch of accounts, and export the private key of each manually).
2. Store the private keys securely on an airgapped machine. Store the public key and a description of the account with each private key so you don't get lost.
3. Start a clean browser with the latest Metamask as needed.
4. Import the private key of the account I want to interact with.
5. Destroy the browser when done. (actually use a separate VM for this)
I can use any browser with TOR on LizardOS, but if you want to install Metamask on the Tor Browser Bundle you'll need to use Firefox. (and remember to check the box to allow Metamask to run in private windows)
Yes, Trezor's passphrase feature is an excellent way to do what you suggest, just store the passphrases securely (don't memorize & forget them!)
Thanks a lot for your detail and wonderful guidelines! Appreciate very much your advice especially the use of Tor Browser bundle. I actually run some of my MetaMask within a new Ubuntu VM. Maybe I should set up and run Tor bundle instead.
I bought 2 Trezors last month and plan to take advantage of the passphrase feature to create new wallets each to be use with MetaMask to interact with staking and DeFi apps.
Will be trying out and gaining confidence in the use of multi-sig wallets you suggested for my BTC and ETH holdings.
dAppNode is a software wrapper for the Ethereum execution and consensus clients to get your system set up to be a validator without having to use the command line. dAppNode sells computers pre-installed with the software and ready to configure with an easy web interface.
This is a cool effort by an open source free software project. It ticks the ‘easy’ and ‘user friendly’ boxes. You can easily use a VPN with the product, and it supports running nodes on multiple blockchains, not just Ethereum.
However, Iguana is paranoid and doesn’t trust that they know what they’re doing with security. And the product isn’t well polished with some technical issues reported. On that basis, would avoid using unless you have the skillset and desire to become an active contributor and help fix!
A red flag is that they recommend installing their software with a sudo (??) wget pipe sudo bash pattern. In other words, this implicitly trusts web infrastructure (bad idea) and doesn’t give the user any assurance that they are installing a genuine digitally signed version of the program. These install scripts (which are run as root) then fetch hashes of other software to be installed from a single Github link. The project should be using digital signatures instead, to ensure integrity of the software supply chain.
There are some technical issues with the software. For example, validators can apparently fail silently without alerting the user through the GUI (only if they check the logs). This is only confirmed with RocketPool minipools. Rocketpool support is poor, it’s behind / out of date. Team don’t seem to have the resources to support Rocket. Rocket say 15-20% of all dissolved minipools are Dappnode users see e.g. https://discourse.dappnode.io/t/rocketpool-package-should-be-removed/2063
tl;dr - only use if you’re technically skilled and willing to help the team improve the product, but its a cool product and we hope it continues to develop
I've been solo staking for a while. This is only for tech savvy users and it takes a while to setup. Non-technical users should use liquid staking. Just buy some rETH or whatever and forget about it. The APY doesn't really justify the risk or cost of solo staking. Companies with thousands of machines can make a profit at these low APYs using economy of scale. Solo staking only makes sense for hobbyists, enthusiasts, and researchers.
I don't stake for the APY. I stake because I want to see firsthand whether or not Ethereum is a viable blockchain. All the blockchains make various claims about decentralization. For example, try running your own Solana node. (hint: you can't). Running the blockchain node moves my knowledge about Ethereum from speculation to experience. I'll be able to see for myself if they make some change that makes Ethereum fail to live up to its promises.
Anyway, after the setup, my solo staking node is very low maintenance. The main maintenance task is that I subscribe to the github release notifications for the execution and consensus clients and install the software updates. I highly recommend the monitoring service and app at https://beaconcha.in/mobile
One more pro-tip for solo staking: prepare, practice and rehearse your exit transaction. Have both your validator and withdrawal keys backed up in case your validator machine goes down. You should be able to exit and withdraw quickly to minimize penalties if your node goes down.
Good article, thanks for the overview.
I mentioned allnodes.com in the past, and it seems their service fits perfectly in the staking as a service category. And with their advanced plan you pay $10 per month and get MEV boost (where you have a few different options). So not sure if I'm missing something, but seems like a much better deal then the services you mentioned, as you state that they take about a 10% cut. Allnodes' fees is about the same as running your own node with $120 per year. (or $60 if you don't want MEV boost and some other features).
Allnodes provides a service to automate the setup of validator software and run your validator in the cloud using Linode/Digital Ocean servers. Cost is $5-10/month and you can pay with crypto. MEV is supported and the solo staker keeps all their MEV, no forced pooling of rewards or commission charged.
I don’t like using their Ethereum Validator Key Generator. I prefer the tool recommended by the Ethereum foundation just to reduce attack surface. Haven’t personally audited the generator code and am generally distrustful of sharing key material with a browser. Even if Allnodes code isn’t malicious, its possible that the key material is read (or worse, modified) by a malicious browser extension. This means your withdrawal address could be switched out with the attacker address in a worst case scenario. Unless you have really good security (clean, trusted browser template with no extensions), it will be safer to use the standalone key generator app recommended by the Ethereum foundation, and generate keys while the machine is offline. So do that for more security if using Allnodes.
Allnodes also depend on the Abyss Finance tool to deposit/stake. This has been audited by MixBytes and looks fine. https://abyss.finance/audit/eth2depositor_security_audit_mixbytes.pdf But I’d just personally prefer to deposit direct to the staking contract using the Ethereum Foundation launchpad, remember to carefully inspect the transaction. Unless I’m using Abyss to stake dozens of validators in bulk, why add a layer of smart contract risk?
tl;dr - if you want to use this service more securely, generate your own keys first, then follow “Instructions for Validator Migration” here https://help.allnodes.com/en/articles/4664440-how-to-setup-an-ethereum-validator-node-on-allnodes
Also with the recent warning from the ethstaker discord that certain AMD nodes might be vulnerable, allnodes just confirmed to me that they only used intel based systems FYI
that's useful, thank you very much!
Thanks, will look at AllNodes and also dAppNode, Kiln Finance.
I’ve been using the Bitbox02 as a hardwallet... open source software, yet now I hesitate as you all have not mentioned it... once.
Have I been using a secret scam, or an underground gem?
Any thoughts on other hardware wallets like keystone coldcard or ellipal titan? or do you think Trezor the safest choice for now?
The Titan doesn't look great to me and I can't find the source code.
Keystone is GPLv3 and has a Bitcoin only mode for reduced attach surface. Probably worth a review in depth actually.
Do you have an opinion on the Grid+ Lattice1? They claim they will open source their firmware in q3.
The messages go through wifi which increases the attack surface and gives me pause. By default they route messages through their servers, but they have an open source proxy to run locally. https://github.com/GridPlus/lattice-connect-v2
Looks interesting, gives me pause too, will look into it if they follow through on open sourcing their firmware. I think Hugh Karp (Nexus Mutual) uses this wallet already.
“Rather than trust any third party infrastructure provider, we deny them information about us and our transactions. This includes rotating IP addresses, avoiding browser fingerprinting, and using separate ‘seed phrases’ or bunches of private keys (JBOK) to avoid linking all accounts under a master seed phrase.”
Apologies but I have problems interpreting “and using separate ‘seed phrases’ or bunches of private keys (JBOK)”.
Could you kindly explain how you manage a bunch of seed phrases and private keys that you use with your MetaMask setups over TOR (and I suppose that will be in Firefox)?
What does JBOK means?
Do you recommend using Trezor’s passphrase feature to manage a bunch of new ETH addresses instead of generating and managing a bunch of BIP39 seed phrases? I figured that it could be more secure and convenient this way than writing down a bunch seed mnemonics and trying to keep them safe from theft or fire.
JBOK = just a bunch of keys (so not linked all under 1 seed)
My workflow for hot wallets
1. Generate private keys (can just create a new seed in Metamask, make a bunch of accounts, and export the private key of each manually).
2. Store the private keys securely on an airgapped machine. Store the public key and a description of the account with each private key so you don't get lost.
3. Start a clean browser with the latest Metamask as needed.
4. Import the private key of the account I want to interact with.
5. Destroy the browser when done. (actually use a separate VM for this)
I can use any browser with TOR on LizardOS, but if you want to install Metamask on the Tor Browser Bundle you'll need to use Firefox. (and remember to check the box to allow Metamask to run in private windows)
Yes, Trezor's passphrase feature is an excellent way to do what you suggest, just store the passphrases securely (don't memorize & forget them!)
Thanks a lot for your detail and wonderful guidelines! Appreciate very much your advice especially the use of Tor Browser bundle. I actually run some of my MetaMask within a new Ubuntu VM. Maybe I should set up and run Tor bundle instead.
I bought 2 Trezors last month and plan to take advantage of the passphrase feature to create new wallets each to be use with MetaMask to interact with staking and DeFi apps.
Will be trying out and gaining confidence in the use of multi-sig wallets you suggested for my BTC and ETH holdings.
Excellent, great to see people taking action!
Yes, thanks. Also Allnodes and Kiln Finance.
dAppNode is a software wrapper for the Ethereum execution and consensus clients to get your system set up to be a validator without having to use the command line. dAppNode sells computers pre-installed with the software and ready to configure with an easy web interface.
This is a cool effort by an open source free software project. It ticks the ‘easy’ and ‘user friendly’ boxes. You can easily use a VPN with the product, and it supports running nodes on multiple blockchains, not just Ethereum.
However, Iguana is paranoid and doesn’t trust that they know what they’re doing with security. And the product isn’t well polished with some technical issues reported. On that basis, would avoid using unless you have the skillset and desire to become an active contributor and help fix!
A red flag is that they recommend installing their software with a sudo (??) wget pipe sudo bash pattern. In other words, this implicitly trusts web infrastructure (bad idea) and doesn’t give the user any assurance that they are installing a genuine digitally signed version of the program. These install scripts (which are run as root) then fetch hashes of other software to be installed from a single Github link. The project should be using digital signatures instead, to ensure integrity of the software supply chain.
There are some technical issues with the software. For example, validators can apparently fail silently without alerting the user through the GUI (only if they check the logs). This is only confirmed with RocketPool minipools. Rocketpool support is poor, it’s behind / out of date. Team don’t seem to have the resources to support Rocket. Rocket say 15-20% of all dissolved minipools are Dappnode users see e.g. https://discourse.dappnode.io/t/rocketpool-package-should-be-removed/2063
The product isn’t polished in other ways. Example: there’s no easy way to exit your validator with some clients, see e.g. https://discourse.dappnode.io/t/how-to-exit-your-validator-from-the-ui/1745/3 and https://discourse.dappnode.io/c/tech-support/5 for a representative example of technical issues generally.
tl;dr - only use if you’re technically skilled and willing to help the team improve the product, but its a cool product and we hope it continues to develop