CounterTooSmallOCert how do we check lastKESCounter in advance?

Staking & Delegation Setup a Stake Pool
1

Is it possible to know lastKESCounter in advance if you do not have an up-to-date cold.counter file?
For example, if a node attempts to mint it is able to determine lastKESCounter for that block.

"reason": {
  "kind": "ValidationError",
  "error": {
    "kind": "HeaderProtocolError",
    "error": {
      "failures": [
        {
          "lastKESCounter": "3",
          "kind": "CounterTooSmallOCert",
          "currentKESCounter": "2",
          "error": "The operational certificate's last KES counter is greater than the current KES counter."
        }
      ],
      "kind": "ChainTransitionError"
    }
  }
}

From what I have tested, cardano-cli query pool-params does not return any information about the last counter used.

2

See my message here. Try to extract from that script the code you would need to query the counter.

3

I’m not sure it’s possible to check lastKESCounter in advance with the network itself. This makes sense, as it’s meant to be a security measure, and what better way to protect KES than to only validate it when a block is being minted.

This particular script stores the previous iterations in a rotation-history.json file as more of a housekeeping check.

1 Like
4

Maybe I misunderstood. It gets the counter from the certificate file.

5

Yes, it gets the current count of the operation certificate you have created. But it will not determine what the network lastKESCounter is. Unfortunately, it seems the only way to deal with this kind of error, is when you see it after attempting to mint a block.

6

Ok I understand what you mean.

Btw, theoretically, if we keep old node certificates, we would be able to check what the latest counter was, or am I misunderstanding how it works? :slight_smile:

7

Yes, you always want to keep the most up-to-date cold.counter as that will generate the appropriate KES count. But as you say, if you only have the most up-to-date operation cert then:

cardano-cli text-view decode-cbor --in-file node.cert | grep int | head -1

Will at least give you the currentKESCounter of that particular certificate.

1 Like