Draft CIP-0128 Would Let Validators Join Canton Without Whitelisting, Gated by a Traffic Purchase
The proposal replaces Foundation-run IP allowlists with automatic onboarding once about $600 of traffic is bought in Canton Coin, with Super Validators able to vote to block abusers.
A draft Canton Improvement Proposal would open the Global Synchronizer to new validators without any review or governance step. CIP-0128, "Remove IP Whitelists from the Global Synchronizer", was created on 5 October 2026 by Martin Florian, Nicu Reut, Pasindu Tennage and Moritz Kiefer. Its status is Draft, and it has not been approved.
How validators join today
According to the draft, validator access to the Global Synchronizer's public interfaces, the Scan and sequencer APIs, has been capped through IP whitelists combined with onboarding secrets. New validators request access through a process coordinated by the Canton Foundation. The cap gave Super Validators time to test defences against attacks and to tune incentives.
The draft says Canton's scaling team has since confirmed that the network can accept a higher rate of validator onboarding than current demand, and that the Splice and Canton security teams have defined a Super Validator configuration that limits the impact of a wide range of attacks.
What the draft proposes
- Pay for traffic, then connect. A new validator gets synchronizer access automatically once a minimum amount of traffic has been bought for it in Canton Coin. Super Validators observe the purchase and grant the permission once a BFT quorum among them is reached.
- A starting threshold of 10MB. The draft says that at the current MainNet rate this means spending at least $600 on traffic. The amount would be set by an on-ledger governance vote.
- Anyone can buy it. Any party holding enough CC can buy traffic for a new validator, including through token-standard transfers to a dedicated address with a memo. The draft suggests services may emerge that sell traffic for fiat.
- Blocking by vote. Super Validators could suspend or revoke a validator's access by vote through a new
ValidatorBlocklist contract, and could later restore it.
- Open APIs with rate limits. Scan and sequencer APIs would become reachable on the open internet, and every Super Validator would have to enforce shared rate limits and DDoS protection.
Existing validators would keep operating as they do now.
Conditions before it takes effect
The draft lists prerequisites: audits and hardening of the Scan and sequencer APIs, traffic-based onboarding in place, consistent rate limiting across Super Validators, and a testing period on DevNet before TestNet and MainNet.
Other governance drafts
Two other drafts were opened in recent weeks and remain unapproved: a proposal to admit Ankr as a Super Validator with a milestone-based weight of 6 (24 September), and a draft from IntellectEU's Przemysław Pawelec to manage Super Validator weights on ledger (30 September).
