Check the queued validator keys before a Substrate session changes

Rotating a validator’s keys involves more than placing new keys in a local keystore. The session pallet distinguishes the current validator list from the keys queued for the following session.

Take one finalized session snapshot

Use the session storage exposed by the runtime you operate. Query all three values at one hash so a session transition cannot mix an old index with a new queue. Match the validator identifier according to that chain’s validator-ID type.

const apiAt = await api.at(await api.rpc.chain.getFinalizedHead())
const [session, active, queued] = await Promise.all([
  apiAt.query.session.currentIndex(),
  apiAt.query.session.validators(),
  apiAt.query.session.queuedKeys()
])
console.log(session.toString(), active.toJSON(), queued.toJSON())

Verify each key role locally

For example, a validator can appear in active while its entry in queued contains a newly rotated key. Compare every field of the queued bundle with the public keys retained by the validator process. Having one authority key says nothing about the other roles in the bundle.

If a validator is missing from the queued set, investigate the next session’s selection and key registration. Record the session index and boundary before deciding that the rotation has taken effect.

Sources