livepeer.bot — your orchestrator keys can finally go cold
TL;DR: LIP-118 (Delegated Reward Calling) is live. I built a shared, immutable,
permissionless contract that calls reward() for every orchestrator who points their
reward caller at it. One transaction to join, zero to stay, opt out any time:
0x2F5901C6D8EB0181FA4f2b75EAAd0344a916fdDE
Website: https://livepeer.bot · Source: GitHub - Titan-Node/livepeer-bot: Auto reward calling smart contract for Livepeer Orchestrators · GitHub
The problem
Every round (~21 h), every active orchestrator has to land a reward() call, and before
LIP-118 that call had to come from the orchestrator key itself — the key that controls your
stake, sitting hot on a server forever, for one routine transaction a day.
LIP-118 (thanks @rickstaa, Sidestream, @kyriediculous!) fixes this: setRewardCaller(addr)
delegates exactly the reward call — nothing else — to an address you choose.
livepeer.bot is that address, shared by everyone. A permissionless sweep walks the active
set each round and calls reward for every subscriber who hasn’t been rewarded yet.
Why you can trust it (the part that matters)
- Immutable. No owner, no admin, no pause switch, no upgrade hook. The code you audit is
the code that runs forever. - Zero storage, holds no funds. There is nothing to drain or misconfigure.
- Delegation grants exactly one power. Your commission, your delegators’ shares and the
amounts are computed by the protocol and fixed at round initialization — the caller cannot
influence a single wei, only pay the gas. - Your own
reward()self-call keeps working. Delegation adds a caller; it never locks
you out. (Verified on a mainnet fork — it’s in the test suite.) - Opt out any time:
setRewardCaller(address(0)).
Verify, don’t trust: 93 tests including a mainnet-fork suite against the live LIP-118
deployment, two independent automated audits with every finding fixed or answered on the
record (audits/), source
verified on Arbiscan
and Blockscout.
The contract is ~470 lines and deliberately boring — read it.
Proof of life: the first delegated reward was already delivered in round 4292 —
tx 0x8f6caed3…62a7
(full 100-node sweep, one subscriber, zero failures).
How to join
From your orchestrator key — one transaction, then the key goes back in the freezer:
bash cast send 0x35Bcf3c30594191d53231E4FF333E8A770453e40 \ "setRewardCaller(address)" 0x2F5901C6D8EB0181FA4f2b75EAAd0344a916fdDE \ --rpc-url https://arb1.arbitrum.io/rpc --ledger
Any signer works (Safe, explorer write-contract page, go-livepeer’s wallet) — details on
livepeer.bot.
Who calls the sweep, and what it costs you
You: nothing. The sweep is permissionless and idempotent — I run a keeper that fires it
every round, and anyone can also run the one-liner (it’s on the site). Redundant callers
just skip each other’s work for pennies. Whole-network cost at today’s gas is roughly
$0.20–$4/day depending on adoption, paid by whoever calls; there’s a gas-donation wallet on
the site if you want to extend the keeper’s runway. No fees, no token, no profit motive —
this is infrastructure as a public good.
With Chainlink Automation sunset this summer, the honest decentralization story is: the
keeper (open source, anyone can run an identical one), the permissionless one-liner, and a
Chainlink CRE workflow that’s built and simulating, pending their Early Access rollout. The
repo documents all of it, including what we rejected and why.
The fine print
- Only the top-100 active set earns rewards — same as calling reward yourself.
- If you’re out-competed mid-round, an off-chain rescue in the keeper still catches your
final round (an edge our audits surfaced; it’s tested). - This is an independent community project, not affiliated with Livepeer Inc. No third-party
human audit yet — the test suite, fork verification and audit responses are linked above;
judge for yourself.
Questions, reviews, and hole-poking very welcome — that’s what this thread is for.
Titan