Committee Size: How a Committee of Four Locked Everyone Else Out
For a while, the Anemos testnet committee was stuck at exactly four validators, and no new validator — no matter how much real stake it bonded — could rotate in. The cause was not a networking problem or a stuck node. It was a clean logical interaction between two reasonable rules that, together, formed a trap. This post walks through it, because the diagnosis is more interesting than the fix.
The displacement rule
Anemos inherits Pactus’s BFT committee design: a fixed-size active committee, with sortition-based rotation in and out each block. To keep the committee from being captured by a single large staker in one step, there is a displacement rule — a joining validator’s power must be less than one third of the committee’s total power. That is a sensible safety rule. A new entrant should be a fraction of the set it joins, not an instant supermajority.
The trap
The testnet’s genesis validators were placeholders: they existed to start the chain, but they carried effectively zero stake (power 1 each). So the committee’s total power was tiny.
Now apply the displacement rule. A real validator bonds a meaningful stake and shows up wanting a seat. Its power is large — and the committee it wants to join has almost no power at all. So the joiner’s power is far more than one third of the committee’s total, and the rule rejects it. Every time. The very validators the testnet existed to attract were the ones the rule kept locking out, and the committee could never grow past its four near-empty genesis seats.
The genesis committee was too small and too powerless to ever accept a real participant. It was a committee that could only stay the size it started.
The fix
The fix is to make the committee larger than the genesis validator count, so there is room for real-stake validators to occupy seats and accumulate total committee power — at which point the one-third displacement test becomes satisfiable for the next joiner, exactly as intended. The committee size is now:
- 11 on testnet (matching the oracle subset size), and
- 75 on mainnet (the oracle’s committee target).
With headroom in the committee, real-stake validators can now rotate in normally: bond, win sortition, take a seat, and the set grows and rotates the way a healthy PoS committee should. The displacement rule stays exactly as it was — it was never wrong — it simply now operates against a committee with enough capacity and power for the rule to make sense.
A genesis-hash consequence
Committee size is a genesis parameter, so changing it changes the genesis hash — both the testnet and mainnet full hashes moved. (The validator-zero identity hash the wallets check is unchanged, so wallet network validation still matches.) Because it is a genesis-affecting, breaking change, it ships the way all such changes do for us: a clean wipe-and-redeploy from a single new genesis, so the network never forks.
The lesson we keep relearning is that the dangerous bugs are rarely a wrong rule. They are two right rules meeting at a corner case no one drew on the whiteboard.