mainnet: open to public validators (2026-04-16)

After four weeks of closed hardening and 4 bounty-validated fixes,
mainnet opens to permissionless validator participation. The 5 Fly
nodes are peers, not gatekeepers — ranking is stake-weighted.

Infrastructure:
- fly-mainnet-[1-5].toml: added [[services]] block exposing port
  9333 to the public internet, removed NO_BOOTSTRAP=true. External
  nodes can now reach ultradag-mainnet-*.fly.dev:9333 for P2P.

Docs:
- PROGRAM.md: status "Testnet (mainnet closed)" → "Mainnet & Testnet".
  Added April 16 public-open date. Replaced Mainnet Access Policy
  section with open-access rules.
- README.md: "mainnet is currently closed" → "mainnet is open".
- site/index.astro: "Mainnet — Closed During Hardening Phase"
  section replaced with open-access instructions + run-a-node snippet.

Not changed: NETWORK_ID differs between testnet/mainnet builds as
cryptographic replay protection — this stays. `--validators N` still
passed at startup to set the quorum floor (GHSA-rprp-wjrh-hx7g).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: UltraDAGcom

README.md

@@ -22,7 +22,7 @@
 | 🟡 **Medium** | 1,000 – 5,000 UDAG |
 | 🟢 **Low** | 100 – 1,000 UDAG |
 
-**All testing happens on [testnet](https://ultradag-node-1.fly.dev/status)** — mainnet is currently closed to external participation while the bounty program hardens the code. See [`PROGRAM.md`](./docs/security/bug-bounty/PROGRAM.md#mainnet-access-policy-current-phase) for the mainnet access policy.
+**Mainnet is open** — anyone can run a validator at `ultradag-mainnet-[1-5].fly.dev:9333`. Please prefer [testnet](https://ultradag-node-1.fly.dev/status) for destructive exploration and reproduction PoCs. See [`PROGRAM.md`](./docs/security/bug-bounty/PROGRAM.md#mainnet-access-policy) for scope and rules.
 
 Reports are private via GitHub Security Advisories. Testnet resets **do not** affect any reward commitment — the append-only [`LEDGER.md`](./docs/security/bug-bounty/LEDGER.md) is the binding record, not on-chain balances. See [`LEDGER.md → Testnet Reset Safety`](./docs/security/bug-bounty/LEDGER.md#testnet-reset-safety) for why.
 

docs/security/bug-bounty/PROGRAM.md

@@ -1,27 +1,26 @@
 # UltraDAG Bug Bounty Program
 
 **Operator:** JMS Media Group LLC (Wyoming, USA; Filing ID 2026-001951812) — the legal entity behind the UltraDAG project and the payer of record for all bounty rewards.  
-**Status:** Active — Testnet (mainnet is closed while the bounty program hardens the code)  
+**Status:** Active — Mainnet & Testnet  
 **Launch Date:** March 8, 2026  
-**Mainnet Genesis:** April 10, 2026 (validators running, closed to external peers)  
-**Mainnet Public Open:** TBD (gated on bounty program results)  
+**Mainnet Genesis:** April 10, 2026  
+**Mainnet Public Open:** April 16, 2026 (anyone can run a validator)  
 **Total Pool:** 500,000 UDAG
 
 ## Overview
 
-UltraDAG is offering rewards for security researchers who discover and responsibly disclose vulnerabilities in the UltraDAG codebase. **All testing happens against the public testnet.** Mainnet is currently running but is **closed to external participation** — only the founder-operated Fly.io validators can join the P2P mesh. External users cannot connect as validators, peers, or relays. The public RPC on mainnet is still readable for transparency (you can query `/status`, `/balance`, etc.), but no new state can be introduced by outsiders until the bounty program has had time to harden the code.
+UltraDAG is offering rewards for security researchers who discover and responsibly disclose vulnerabilities in the UltraDAG codebase. **Mainnet is now open** — anyone can run a validator, stake UDAG, and participate in consensus. Testing is welcome on both mainnet and testnet; please prefer testnet for destructive exploration. Mainnet nodes are reachable at `ultradag-mainnet-[1-5].fly.dev:9333` (P2P) and `https://ultradag-mainnet-[1-5].fly.dev` (RPC).
 
-Valid reports are rewarded in testnet UDAG, recorded in the append-only [`LEDGER.md`](./LEDGER.md), and convertible 1:1 to mainnet UDAG per the vesting schedule in that file — regardless of how many times testnet is reset in the interim. See [`LEDGER.md` → Testnet Reset Safety](./LEDGER.md#testnet-reset-safety) for why a testnet wipe does not affect your claim.
+Valid reports are rewarded in UDAG, recorded in the append-only [`LEDGER.md`](./LEDGER.md), and convertible 1:1 to mainnet UDAG per the vesting schedule in that file. See [`LEDGER.md` → Testnet Reset Safety](./LEDGER.md#testnet-reset-safety) for why a testnet wipe does not affect your claim.
 
-## Mainnet Access Policy (current phase)
+## Mainnet Access Policy
 
-Mainnet is in a deliberate **hardening phase**. Key points:
+Mainnet is **fully open**:
 
-- **P2P port 9333 is not exposed to the public internet** on any mainnet node. External hosts cannot open TCP connections to the Noise handshake endpoint. The 5 mainnet nodes reach each other over Fly's internal WireGuard mesh (`ultradag-mainnet-[1-5].internal`) only.
-- **RPC port 10333 remains public** at `https://ultradag-mainnet-[1-5].fly.dev` for transparency. Anyone can read chain state; no one can submit transactions that affect it unless they go through the existing RPC (and most state-changing RPC endpoints are testnet-only on mainnet builds).
-- **Pre-launch token distribution happens on Arbitrum** via an ERC-20 representation of UDAG. Buying UDAG in this phase gets you Arbitrum-side tokens, not native mainnet UDAG. This lets the maintainer restart mainnet freely during hardening without invalidating any token holder. See `bridge/README.md`.
-- **Mainnet will open to public participation** only after the bounty program has validated the code against real adversaries over a meaningful window. There is no fixed date; the decision is gated on the findings in this program.
-- **Until mainnet opens, attacking mainnet nodes is out of scope and explicitly illegal.** Test against testnet only. If you can somehow reach a mainnet node (through a misconfiguration or a Fly bug) — report it privately as a finding, do not exploit it.
+- **P2P port 9333 is public** on all mainnet nodes at `ultradag-mainnet-[1-5].fly.dev:9333`. External validators and observers can connect directly.
+- **RPC port 10333 is public** at `https://ultradag-mainnet-[1-5].fly.dev` for both reads and transaction submission.
+- **Validator set is permissionless** — any address with enough UDAG can stake and enter the active set. The 5 founder-operated Fly nodes have no protocol-level privilege; ranking is by effective stake.
+- **Please do not DoS mainnet.** In-scope attacks are those demonstrating a protocol or implementation bug via a minimal PoC — not brute traffic floods. If you can crash or halt a live mainnet node with a single crafted message, that's a valid Critical; sustained DoS traffic is out of scope and may be reported to the hosting provider.
 
 ## Scope
 

site/src/pages/index.astro

@@ -585,39 +585,39 @@ const GECKOTERMINAL_URL =
 <span class="kw">curl</span> <span class="str">http://localhost:10333/status</span></pre>
       </div>
 
-      <!-- Mainnet Access Policy (currently closed during hardening phase) -->
+      <!-- Mainnet Access — fully open as of 2026-04-16 -->
       <div class="code-section reveal">
         <div class="code-header">
           <div class="code-dots"><div class="code-dot"></div><div class="code-dot"></div><div class="code-dot"></div></div>
-          <span class="code-label">Mainnet — Closed During Hardening Phase</span>
-        </div>
-        <pre><span class="cm"># Mainnet is RUNNING but closed to external participation.</span>
-<span class="cm"># The 5 founder-operated validators are producing rounds, finalizing,</span>
-<span class="cm"># and crediting the 7-bucket emission, but external hosts cannot join</span>
-<span class="cm"># the P2P mesh (the Noise handshake port is not exposed to the public</span>
-<span class="cm"># internet on any mainnet node).</span>
-
-<span class="cm"># Why?</span>
-<span class="cm">#   We want the bug bounty program to harden every consensus, state,</span>
-<span class="cm">#   network, and cryptographic path against real adversaries BEFORE</span>
-<span class="cm">#   letting third-party validators stake real value. Mainnet is our</span>
-<span class="cm">#   production-shaped but non-user-facing environment until then.</span>
-
-<span class="cm"># What you can still do with mainnet:</span>
-<span class="cm">#   1. Query read-only RPC for transparency:</span>
+          <span class="code-label">Mainnet — Open to the Public</span>
+        </div>
+        <pre><span class="cm"># Mainnet opened to public participation on 2026-04-16.</span>
+<span class="cm"># Anyone can run a validator, stake UDAG, and join the active set.</span>
+<span class="cm"># The 5 founder-operated Fly nodes are peers, not gatekeepers —</span>
+<span class="cm"># ranking is purely stake-weighted.</span>
+
+<span class="cm"># Run a mainnet node from source:</span>
+<span class="kw">git clone</span> https://github.com/UltraDAGcom/core &amp;&amp; <span class="kw">cd</span> core
+<span class="kw">cargo build --release --features mainnet</span>
+./target/release/ultradag-node \
+  --data-dir ./mainnet-data --port 9333 --rpc-port 10333 \
+  --seed ultradag-mainnet-1.fly.dev:9333 \
+  --validators 5
+
+<span class="cm"># Query mainnet state:</span>
 <span class="kw">curl</span> <span class="str">https://ultradag-mainnet-1.fly.dev/status</span>
-<span class="cm">#   2. Inspect any address balance or name:</span>
 <span class="kw">curl</span> <span class="str">https://ultradag-mainnet-1.fly.dev/balance/udag1...</span>
-<span class="cm">#   3. Watch the chain progress via /round/:N and /vertex/:hash</span>
 
-<span class="cm"># Where to test, find bugs, and earn UDAG:</span>
-<span class="cm">#   → Testnet (instructions above) — 5 public validators, open mesh,</span>
-<span class="cm">#     full faucet, every RPC path enabled, full bug bounty scope.</span>
-<span class="cm">#     See docs/security/bug-bounty/PROGRAM.md for rewards + rules.</span>
+<span class="cm"># Stake to enter the validator active set:</span>
+<span class="cm">#   1. Fund your address with UDAG (bridge from Arbitrum, or earn via</span>
+<span class="cm">#      faucet/bounty on testnet first).</span>
+<span class="cm">#   2. Submit a Stake tx via /tx/submit — see docs/stake.md.</span>
+<span class="cm">#   3. If your effective stake lands in the top-N, you produce rounds</span>
+<span class="cm">#      and earn the 44% validator emission share.</span>
 
-<span class="cm"># When will mainnet open?</span>
-<span class="cm">#   Gated on bounty program results. No fixed date — we'll announce</span>
-<span class="cm">#   when we're confident enough adversarial testing has happened.</span></pre>
+<span class="cm"># Bug bounty: still runs on mainnet AND testnet.</span>
+<span class="cm">#   Use testnet for destructive PoCs. Report via GitHub Security.</span>
+<span class="cm">#   See docs/security/bug-bounty/PROGRAM.md for rewards + rules.</span></pre>
       </div>
 
       <!-- Additional Info -->
@@ -626,18 +626,18 @@ const GECKOTERMINAL_URL =
         <div class="node-info-grid">
           <div>
             <p>
-              ✓ <strong>Read-only RPC</strong> public on port 10333<br />
-              ✓ <strong>Full transparency</strong> — all state queryable<br />
-              ✗ <strong>P2P mesh</strong> closed to external nodes<br />
-              ✗ <strong>Public staking</strong> disabled until bounty review
+              ✓ <strong>P2P port 9333</strong> public on all mainnet nodes<br />
+              ✓ <strong>RPC port 10333</strong> public — reads and writes<br />
+              ✓ <strong>Permissionless validators</strong> — stake to join<br />
+              ✓ <strong>Stake-weighted active set</strong> — no allowlist
             </p>
           </div>
           <div>
             <p>
-              ✓ <strong>Bug bounty</strong> runs on testnet (open mesh)<br />
-              ✓ <strong>Pre-launch tokens</strong> on Arbitrum (ERC-20)<br />
-              ✓ <strong>Restartable</strong> — Arbitrum holders insulated<br />
-              ✓ <strong>Open date</strong> gated on bounty results
+              ✓ <strong>Bug bounty</strong> open on mainnet &amp; testnet<br />
+              ✓ <strong>Token on Arbitrum</strong> (ERC-20) + native UDAG<br />
+              ✓ <strong>Open validator set</strong> — top-N by effective stake<br />
+              ✓ <strong>Opened 2026-04-16</strong> to public participation
             </p>
           </div>
         </div>

tools/operations/deployment/fly/fly-mainnet-1.toml

@@ -12,7 +12,6 @@ primary_region = "ams"
   DATA_DIR = "/data"
   VALIDATORS = "5"
   SEED = "ultradag-mainnet-2.internal:9333 ultradag-mainnet-3.internal:9333 ultradag-mainnet-4.internal:9333 ultradag-mainnet-5.internal:9333"
-  NO_BOOTSTRAP = "true"
   # CLEAN_STATE = "true"
 
 [mounts]
@@ -33,23 +32,19 @@ primary_region = "ams"
     path = "/health"
     timeout = "10s"
 
-# Mainnet P2P port 9333 is INTENTIONALLY not exposed as a public [[services]]
-# block. The 5 mainnet nodes reach each other over Fly's internal WireGuard
-# mesh via `.internal` DNS (see SEED above), which doesn't require a public
-# port. Closing port 9333 to the public internet keeps the mainnet P2P
-# protocol as a private allowlist — only the 5 nodes in this org can even
-# attempt a Noise handshake. External observers can still query the public
-# RPC endpoint on port 10333 via [http_service] above.
-#
-# To re-open mainnet to public peers, restore this block (the default Fly
-# P2P pattern — identical to the testnet fly-node-*.toml files):
-#
-# [[services]]
-#   protocol = "tcp"
-#   internal_port = 9333
-#   [[services.ports]]
-#     port = 9333
-#     handlers = []
+# Mainnet P2P is OPEN to public peers — anyone can run a validator or
+# observer node. Stake-weighted active-set selection (top-N by effective
+# stake) is the only gate; the former founder-only WireGuard mesh was
+# lifted for mainnet launch on 2026-04-16.
+[[services]]
+  internal_port = 9333
+  protocol = "tcp"
+  auto_stop_machines = false
+  auto_start_machines = true
+  min_machines_running = 1
+
+  [[services.ports]]
+    port = 9333
 
 [deploy]
   strategy = "immediate"

tools/operations/deployment/fly/fly-mainnet-2.toml

@@ -12,7 +12,6 @@ primary_region = "ams"
   DATA_DIR = "/data"
   VALIDATORS = "5"
   SEED = "ultradag-mainnet-1.internal:9333 ultradag-mainnet-3.internal:9333 ultradag-mainnet-4.internal:9333 ultradag-mainnet-5.internal:9333"
-  NO_BOOTSTRAP = "true"
   # CLEAN_STATE = "true"
 
 [mounts]
@@ -33,10 +32,17 @@ primary_region = "ams"
     path = "/health"
     timeout = "10s"
 
-# Mainnet P2P port 9333 is INTENTIONALLY not exposed as a public [[services]]
-# block. See fly-mainnet-1.toml for the full rationale. Nodes reach each
-# other over Fly's internal WireGuard mesh via `.internal` DNS. To re-open
-# mainnet to public peers, restore the standard P2P [[services]] block.
+# Mainnet P2P is OPEN to public peers — anyone can run a validator or
+# observer node. Stake-weighted active-set selection is the only gate.
+[[services]]
+  internal_port = 9333
+  protocol = "tcp"
+  auto_stop_machines = false
+  auto_start_machines = true
+  min_machines_running = 1
+
+  [[services.ports]]
+    port = 9333
 
 [deploy]
   strategy = "immediate"

tools/operations/deployment/fly/fly-mainnet-3.toml

@@ -12,7 +12,6 @@ primary_region = "ams"
   DATA_DIR = "/data"
   VALIDATORS = "5"
   SEED = "ultradag-mainnet-1.internal:9333 ultradag-mainnet-2.internal:9333 ultradag-mainnet-4.internal:9333 ultradag-mainnet-5.internal:9333"
-  NO_BOOTSTRAP = "true"
   # CLEAN_STATE = "true"
 
 [mounts]
@@ -33,10 +32,17 @@ primary_region = "ams"
     path = "/health"
     timeout = "10s"
 
-# Mainnet P2P port 9333 is INTENTIONALLY not exposed as a public [[services]]
-# block. See fly-mainnet-1.toml for the full rationale. Nodes reach each
-# other over Fly's internal WireGuard mesh via `.internal` DNS. To re-open
-# mainnet to public peers, restore the standard P2P [[services]] block.
+# Mainnet P2P is OPEN to public peers — anyone can run a validator or
+# observer node. Stake-weighted active-set selection is the only gate.
+[[services]]
+  internal_port = 9333
+  protocol = "tcp"
+  auto_stop_machines = false
+  auto_start_machines = true
+  min_machines_running = 1
+
+  [[services.ports]]
+    port = 9333
 
 [deploy]
   strategy = "immediate"

tools/operations/deployment/fly/fly-mainnet-4.toml

@@ -12,7 +12,6 @@ primary_region = "ams"
   DATA_DIR = "/data"
   VALIDATORS = "5"
   SEED = "ultradag-mainnet-1.internal:9333 ultradag-mainnet-2.internal:9333 ultradag-mainnet-3.internal:9333 ultradag-mainnet-5.internal:9333"
-  NO_BOOTSTRAP = "true"
   # CLEAN_STATE = "true"
 
 [mounts]
@@ -33,10 +32,17 @@ primary_region = "ams"
     path = "/health"
     timeout = "10s"
 
-# Mainnet P2P port 9333 is INTENTIONALLY not exposed as a public [[services]]
-# block. See fly-mainnet-1.toml for the full rationale. Nodes reach each
-# other over Fly's internal WireGuard mesh via `.internal` DNS. To re-open
-# mainnet to public peers, restore the standard P2P [[services]] block.
+# Mainnet P2P is OPEN to public peers — anyone can run a validator or
+# observer node. Stake-weighted active-set selection is the only gate.
+[[services]]
+  internal_port = 9333
+  protocol = "tcp"
+  auto_stop_machines = false
+  auto_start_machines = true
+  min_machines_running = 1
+
+  [[services.ports]]
+    port = 9333
 
 [deploy]
   strategy = "immediate"

tools/operations/deployment/fly/fly-mainnet-5.toml

@@ -12,7 +12,6 @@ primary_region = "ams"
   DATA_DIR = "/data"
   VALIDATORS = "5"
   SEED = "ultradag-mainnet-1.internal:9333 ultradag-mainnet-2.internal:9333 ultradag-mainnet-3.internal:9333 ultradag-mainnet-4.internal:9333"
-  NO_BOOTSTRAP = "true"
   # CLEAN_STATE = "true"
 
 [mounts]
@@ -33,10 +32,17 @@ primary_region = "ams"
     path = "/health"
     timeout = "10s"
 
-# Mainnet P2P port 9333 is INTENTIONALLY not exposed as a public [[services]]
-# block. See fly-mainnet-1.toml for the full rationale. Nodes reach each
-# other over Fly's internal WireGuard mesh via `.internal` DNS. To re-open
-# mainnet to public peers, restore the standard P2P [[services]] block.
+# Mainnet P2P is OPEN to public peers — anyone can run a validator or
+# observer node. Stake-weighted active-set selection is the only gate.
+[[services]]
+  internal_port = 9333
+  protocol = "tcp"
+  auto_stop_machines = false
+  auto_start_machines = true
+  min_machines_running = 1
+
+  [[services.ports]]
+    port = 9333
 
 [deploy]
   strategy = "immediate"