Guardian Set

A Guardian Set is a decentralized committee of independent node operators. Each Guardian runs software to observe events on connected blockchains, sign VAA (Verified Action Approval) messages, and submit them to the Wormhole network. This structure eliminates single points of failure and ensures no single entity controls the bridge's attestations.

Security is enforced through a threshold signature scheme. A message is only considered valid and finalized when a supermajority (e.g., 13 of 19) of the Guardians have signed it. This Byzantine fault-tolerant model ensures liveness and correctness even if some Guardians are offline or malicious.

The composition of the Guardian Set is not static; it is managed by on-chain governance. The Wormhole governance community can vote to add or remove Guardians via a multisig contract. This allows for the rotation of node operators, penalization of bad actors, and adaptation to network growth.

Each Guardian node must run full nodes or reliable RPC endpoints for every blockchain supported by Wormhole (e.g., Ethereum, Solana, Sui, Aptos). They continuously monitor for emitted Wormhole messages, creating a unified attestation layer across heterogeneous chains.

The primary output of a Guardian Set is the Verified Action Approval (VAA). This is a signed payload containing immutable proof of an event on a source chain. Guardians broadcast signed VAAs to a P2P gossip network, where relayers can pick them up and deliver them to the destination chain.

While not a strict Proof-of-Stake system, Guardians are typically established entities with significant reputational and economic stake in the ecosystem's health (e.g., major staking providers, foundations). Malicious behavior would result in removal from the set and severe reputational damage.

The current, live set of nodes that are actively participating in the consensus protocol to observe events, produce signed attestations (VAA), and submit them on-chain. Their public keys are registered in the network's core contract. The set has a defined quorum threshold (e.g., 2/3+1) required for a message to be considered valid.

The cryptographic identity of each Guardian, consisting of a private key for signing and a registered public key for verification. Key management is critical for security, often involving HSMs (Hardware Security Modules) and geographic distribution. Compromise of a quorum of keys could threaten network integrity.

The minimum number of Guardians whose signatures are required to validate a message. For example, a 19-of-19 set requires unanimity, while a 13-of-19 set requires a supermajority. This Byzantine fault-tolerant mechanism ensures reliability even if some nodes are offline or malicious.

The process of changing the Guardian Set, either by adding/removing nodes or rotating keys. This is executed via a governance vote by the current active set, resulting in a VAA (Governance Payload) that upgrades the on-chain contract state. This allows for maintenance and decentralization without hard forks.

The core duty where each Guardian independently observes source chain events (e.g., emitted logs), forms an observation, and broadcasts it to peers. After receiving a supermajority of identical observations, each Guardian creates a signed attestation. The aggregated signatures form the Verifiable Action Approval (VAA).

A critical security practice where Guardian nodes are operated from diverse jurisdictions, cloud providers (AWS, GCP, Azure), and data centers. This minimizes correlated failure risk from regional outages, regulatory actions, or targeted attacks, enhancing the network's censorship resistance and liveness.

The primary role of a Guardian Set is to independently observe events on a source blockchain (like an asset lock or message emission) and produce a cryptographic attestation, typically a threshold signature, that the event is valid. This collective attestation is the proof that allows the destination chain to trust and act upon the message.

Security is achieved through a Byzantine Fault Tolerant (BFT) consensus model among the Guardians. A message is only considered valid and forwarded if a supermajority (e.g., 2/3 or more) of the Guardians sign it. This prevents a malicious minority from forging messages or censoring valid ones.

Guardians are typically reputable entities in the crypto space (e.g., validators, foundations, enterprises). The set is not permissionless; members are selected by governance. Each Guardian operates its own secure key management system to sign observations, and the set's public keys are registered on-chain for verification.

To maintain security and liveness, Guardian Sets are not static. A governance process (often via a DAO) can vote to add or remove members and rotate the set's keys. This allows the protocol to respond to members going offline, becoming compromised, or changes in the ecosystem's trust landscape.

• vs. Light Clients: Guardians provide attestations, while light clients cryptographically verify chain headers themselves.
• vs. Optimistic Models: Guardian attestations provide instant finality for message validity, whereas optimistic models have a challenge period where anyone can dispute a message's correctness.

A cryptographically signed message bundle produced when a quorum of Guardians reaches consensus on an observation (e.g., a token transfer or price feed). The VAA is the canonical proof that can be verified on-chain by any receiver. It contains:

• The consensus data payload
• Guardian signatures
• A sequence number
• The emitter chain and address

The decentralized process for managing the Guardian Set and network parameters. This typically involves on-chain voting by the set members to enact changes, such as:

• Adding or removing Guardians
• Updating the quorum threshold
• Upgrading core contracts Governance ensures the oracle network can adapt and upgrade without a central authority.

The raw event data (e.g., a transaction hash, token amount, or price) that a Guardian node detects and signs. Each Guardian independently observes the specified event from its assigned source chain or data feed. Consistent and accurate observation by the majority of the set is the foundation for generating a valid VAA.

An alternative term for Guardian, used specifically within the Wormhole network. A Phylax operates a node that observes events on connected blockchains, signs messages, and participates in governance. The terms are functionally synonymous, with 'Phylax' being Wormhole's branded implementation of the guardian concept.