The story
An operator knowledge base with practical controls
The initial initiative, D.U.C.K. – Distributed Utilization of Configurations and Knowledge, was developed with node operators and other contributors in the Lido ecosystem.
Lionscraft's work involved organising specialist input, translating real operating risks into structured material and coordinating a community-based development process.
The approved 2023 project scope contained three outputs:
- A Risk Framework for identifying and documenting operational exposures.
- A Mitigations & Controls Library covering concrete methods for reducing them.
- A Communications Toolkit for planned and incident-related communications.
The material was released publicly in 2024. It addressed slashing, downtime, key security, infrastructure risks, access management, monitoring, recovery and supplier dependencies.
From recommendations to requirements
A knowledge base can explain good practice without giving two independent reviewers a consistent way to assess it.
As D.U.C.K. evolved, the programme worked on governance, more explicit controls, maintained documentation and assessment mechanisms.
Lionscraft participated in the design and coordination of the progression to ValOS – Validator Operations Standard. It was not a proprietary replacement for SOC 2 or ISO 27001: the intention was to express staking-specific expectations in a way operators could implement and assurance professionals could examine.
The work also included standards governance, contribution processes and a route to maintenance through the Lido ecosystem.
Fifty-three controls covering the real operating organisation
The ValOS specification launched in September 2026 with 53 explicit controls arranged under ten categories:
| Domain | What it addresses |
|---|---|
| Risk management | Identification, ownership and review of operational risks |
| Financial and regulatory risk | Relevant financial, compliance and governance exposures |
| People management | Employee responsibilities, training and offboarding |
| Technology stack | Validator software and infrastructure choices |
| Information and secrets | Protection and lifecycle of sensitive information |
| Access control | Authorisation and privileged access |
| Automated monitoring | Detection and response capabilities |
| Environmental threats | Physical and hosting dependencies |
| Development and updates | Changes, testing and deployment processes |
| Communication and incidents | Operational coordination and incident response |
The standards work connects organisational security management with protocol-specific operational risks. For example, redundancy and automated failover must be assessed against validator signing rules, not treated as unconditionally positive availability controls.
The actual controls can be inspected in the ValOS GitHub repository.
Designing a route to independent review
The programme also worked on making ValOS usable beyond self-assessment and documentation.
Lido publicly documented a US$60,000 early-adopter assessment subsidy pool intended to help selected node operators obtain professional reviews against ValOS. This funding was allocated to the assessment programme, not evidence of Lionscraft fee revenue or of completed assessments.
The standard, contribution workflow, governance and financial support for early reviews represent different elements of the same effort: defining relevant expectations and making them practical to assess.
Lionscraft's work continued across the transition from community guidance to a public specification and assurance-ready structure.