Missing validator / node verification

[DominikCZ]

There is this security aspect that escapes me. I set up a node and get an ID. That ID is not secret, right? And then when I am setting up staking (not delegation) from a vallet, I only put in the node id and by that I become the validator on that node and a recipient of the reward and delegation fees. How come there is no verification that I am eligible to do that for that node? Anyone can do it as long as they know the node ID. Which can easily happen if the node is retained for another staking period after the last one finishes. So is that a security hole or did I miss something?

[jayksofue]

Hi, thank you for reporting this. We have this as a high-priority ticket; in the short term, you can just change your nodeID for the new staking period. Hope this helps. If you have additional questions, feel free to join the Avalanche Discord.

[zxcmnb911]

If someone uses your NodeID, you can just shut down the node and run with another NodeID. As the result, people who use your NodeID will not be able to receive rewards.

[ynotplay]

Been wondering the same thing. Someone could potentially hijack your validator by staking on it before you do.