Validators and the UNL

Anyone can run a validator. So why can't a troublemaker start a thousand of them and outvote everyone?

Because nobody is listening to them.

Every server on the XRP Ledger keeps a list of validators it trusts. The list is called a Unique Node List, or UNL. When your server decides whether a ledger is final, it counts votes only from validators on its list. A thousand strangers can shout all day. Your server ignores them.

Trust here has a narrow meaning. You do not have to believe each validator is perfect. You pick a group, run by different people in different places, that is unlikely to team up and cheat together.

In theory every operator picks their own list. In practice lists need to match closely. If two servers trusted different groups, they could reach different answers and split apart. So most servers use the same published lists.

The standard setup uses two lists. One is published by the XRP Ledger Foundation. One is published by Ripple. They are usually nearly the same. Together they are known as the default UNL.

How does a validator get on a list? Slowly. Publishers usually look for a year or more of reliable uptime, a known owner with a verified domain, and independence from operators already listed. They also want it in a different location from most others.

The publishers do not confirm transactions. They choose who is widely trusted, and that is real influence. A server operator can choose other publishers in the config file. The docs advise against it.

Trust is local. Each server evaluates proposals and validations only from its UNL. The standard quorum is 80% of trusted validators. server_info reports the count your server requires as validation_quorum.

Overlap. Early analysis held that 60% overlap between two UNLs prevented a fork. Later research showed 90% is needed in the worst case. This limits how far an operator can customize a UNL safely. A server on a divergent UNL may follow a different chain from everyone else.

Recommended lists. A server can download a signed list from a publisher and use it as its UNL.

• A list is identified by the publisher's public key.
• With several publishers configured, the UNL is the union of their lists. A validator on more than one list counts once.
• Lists carry a sequence number and an expiration. They can carry an activation date so servers switch together.
• Lists are served from websites and also relayed over the peer-to-peer network.

xrpl.org names https://vl.ripple.com and https://vl.xrplf.org as list publisher sites. Anyone can publish a list in the same format.

Validators outside any UNL. Sending validations does not give a validator a say in consensus. Other servers ignore them unless they add the validator to their UNL. This is the defense against a Sybil attack: trust needs a human to change a configuration.

Getting listed. Typical publisher criteria:

• High uptime and agreement with the network for at least a year.
• Domain verification through an xrp-ledger.toml file, linking the validator key and the domain in both directions.
• A separate, recognizable operator.
• A different physical location from most other validators.

Keys. A validator has a master key pair kept offline and a token in the server's config. The validator-keys tool generates both. Validators must not share a key pair.

What else validators decide. The same trusted validators vote on amendments and on fee settings. See How amendments happen and Special costs and fee voting.

Related: When validators go offline.