From 5ed4e382c33f63bf5b4d725d40d6b8443a0aaa3e Mon Sep 17 00:00:00 2001
From: AMATH <116212274+amathxbt@users.noreply.github.com>
Date: Thu, 25 Jun 2026 22:02:13 +0100
Subject: [PATCH] fix(setup): remove shared validator key copy from node1 to
 node2

The script was copying node1/validator_key.json and node1/keystore.json
into canopy_data/node2/, making both nodes sign consensus messages with
the identical validator key.

Running two validators with the same key is equivocation (double-signing).
The protocol treats it as a Byzantine fault and slashes the validator.

Remove the copy commands and replace them with a clear warning and the
correct command to initialise a fresh key for node2 via canopy init.
---
 setup.sh | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/setup.sh b/setup.sh
index 8dce7e0..13d88bf 100755
--- a/setup.sh
+++ b/setup.sh
@@ -3,8 +3,15 @@ echo "setting up the validator key"
 docker pull canopynetwork/canopy && \
 docker run --user root -it -p 50000:50000 -p 50001:50001 -p 50002:50002 -p 50003:50003 -p 9001:9001 --name canopy-config  --volume ${PWD}/canopy_data/node1/:/root/.canopy/ canopynetwork/canopy && \
 docker stop canopy-config && docker rm canopy-config && \
-cp canopy_data/node1/validator_key.json canopy_data/node2/ && \
-cp canopy_data/node1/keystore.json canopy_data/node2/
+# IMPORTANT: Do NOT copy node1 validator_key.json or keystore.json to node2.
+# Each validator must have its own unique key. Sharing a validator key between
+# nodes causes both to sign the same consensus messages, which is treated as
+# equivocation (double-signing) and results in the validator being slashed.
+# node2 should either generate a fresh key via "canopy init" or be given a
+# separate pre-existing key before starting.
+echo "WARNING: node2 requires its own validator_key.json and keystore.json.";
+echo "Please run: docker run --rm -v ${PWD}/canopy_data/node2:/root/.canopy canopynetwork/canopy init";
+echo "to generate a fresh key pair for node2 before starting the stack."
 
 # ask user for setup type
 echo "Please select setup type:"