Jito TipRouter: merkle consensus for MEV tips

Jito TipRouter is the Node Consensus Network that takes over tip distribution once an epoch ends. Operators compute a merkle tree of who is owed Jito tips, and after the July 2025 upgrade, shared priority fees too. They vote that tree on chain. When two thirds of restaked stake weight agree, crankers write the winning roots onto each validator distribution account so stakers can claim.

Tips themselves still originate in the Block Engine auction. That pipeline is covered in Jito Block Engine and Jito Bundles. This article is the distribution path: the on-chain program, the operator client, the permissionless keeper, and the claim.

The NCN and vault model underneath is Jito restaking. TipRouter is the production NCN that sits on it.

What happens in an epoch

During the epoch, Jito-Solana leaders collect tips into tip accounts. Eight tip PDAs per validator drain into a Tip Distribution Account. After the last slot of the epoch, operators rebuild who is owed from the bank, not from a spreadsheet.

1. A permissionless cranker sets Switchboard weights, then snapshots operators and vaults so voting weight is frozen for the epoch.
2. Each operator loads the last block of the previous epoch, builds a merkle tree per validator, then a meta merkle tree over those roots.
3. Operators call cast_vote with the 32-byte meta root. Consensus is two thirds or more of available stake weight on the same ballot. Operators can change their vote until consensus.
4. After quorum, a cranker calls set_merkle_root with a proof for each validator. That CPI writes the leaf root onto the Tip Distribution Account (and, after the upgrade, the Priority Fee Distribution Account).
5. Claimants present a merkle proof. Stake accounts, the validator commission slice, and the TipRouter fee PDA all appear as leaves.

Live consensus, claims, and operators sit on the TipRouter dashboard. Do not hard-code operator counts or TVL from a screenshot. Read that page.

Three pieces of software

Docs split TipRouter into an on-chain NCN program, a node operator client, and a permissionless cranker. You will hit all three if you run an operator or a keeper.

The on-chain program prices vault assets, snapshots operators, hosts the ballot box, and routes fees. Switchboard quotes JitoSOL, JTO, and other registered mints. A WeightTable is rebuilt each epoch. EpochSnapshot and OperatorSnapshot freeze stake weights and fee config so a late deposit cannot swing the vote.

The operator client is tip-router-operator-cli. It snapshots the bank, builds StakeMetaCollection, then GeneratedMerkleTreeCollection, then the meta tree. Each validator tree has stake-account claimants, a validator claimant sized by mev_commission_bps on the distribution account, and a TipRouter claimant sized by NcnConfig.fees_config.total_fees_bps(). That fee lands in the per-epoch BaseRewardReceiver PDA once every validator TipRouter leaf is claimed.

The cranker is jito-tip-router-cli in keeper mode. It walks a state machine: SetWeight, Snapshot, Vote, PostVoteCooldown, Distribute, Close. Anyone can crank. The keeper also registers vaults, emits metrics, and advances when a vote stalls or when rewards sit under 10,000 lamports.

Live addresses

These IDs are from TipRouter docs and from the operator CLI README plus the SDKs in jito-foundation/jito-tip-router. The program crate reads TIP_ROUTER_PROGRAM_ID at compile time. Mainnet docs list version 0.0.1 for the Tip Router program.

CLI README also lists a test NCN rYQFkFYXuDqJPoH2FvFtZTC8oC3CntgRjtNatx6q1z1 against the same Tip Router program id. Use the dashboard NCN on mainnet.

Priority fees on the same root

SIMD-0096 gave validators 100 percent of priority fees. Stakers do not see that stream unless the validator shares. JIP-16 extended TipRouter to distribute those fees the same way it distributes Jito tips. The Foundation announced the upgrade live on 2 July 2025.

Operators now build a meta tree whose leaves include both Tip Distribution Accounts and Priority Fee Distribution Accounts. One ballot, one quorum, two programs get their merkle roots. Validators opt in with the priority-fee-sharing module on Jito-Solana. That service records priority fees locally and transfers them into Priority Fee Distribution Accounts. The install path published with the upgrade is the priority-fee-sharing README on jito-foundation/jito-solana.

StakeNet Steward scoring for JitoSOL validators treats average priority-fee commission at or below 50 percent (5 percent margin, so 55 percent) as a pass. Above that, the score for that parameter is zero. That is pool policy, not a protocol hard fork.

Fees

TipRouter takes a cut of what it distributes, then splits that cut across the DAO and the restaked vaults that secure the NCN.

• 3 percent on distributed Jito tips. Of that fee, 90 percent goes to the Jito DAO, 5 percent to LST vault operators, 5 percent to JTO vault operators. Vaults pass a share to their restakers and operators.
• 1.5 percent on distributed priority fees. Same 90 / 5 / 5 split. The 1.5 percent applies only to the slice the validator chooses to share. Keep 70 percent, share 30 percent, and the protocol fee is 1.5 percent of the 30 percent.

Those rates are from the 2 July 2025 Foundation post. Launch-day copy in January 2025 used the same 3 percent tip fee written as 2.7 percent DAO plus 0.15 percent JitoSOL plus 0.15 percent JTO. Confirm live bps with get-tip-router-config before you write a fee UI.

After consensus, crankers route lamports from BaseRewardReceiver through route_base_rewards until still_routing is false, then distribute_base_rewards (DAO, in JitoSOL) and distribute_ncn_operator_rewards into per-operator NcnRewardReceiver accounts. A second route pass splits operator versus vault. Leftover lamports in the base pool go to the DAO group. Leftover in an NCN router go to the operator.

Run a keeper

The keeper CLI lives in the same repo. Build it, then either run the full loop or crank one state at a time.

git clone https://github.com/jito-foundation/jito-tip-router
cd jito-tip-router
cargo build --release
cargo install --path ./cli --bin jito-tip-router-cli --locked
jito-tip-router-cli --help

Global flags include --rpc-url, --ncn, --epoch, --keypair-path, and --print-tx to dump a base58 instruction without sending it. Program ids default from the crates. Override with TIP_ROUTER_PROGRAM_ID, RESTAKING_PROGRAM_ID, VAULT_PROGRAM_ID, and TIP_DISTRIBUTION_PROGRAM_ID.

# Full keeper loop (also: make ncn-keeper-start)
jito-tip-router-cli --rpc-url "$RPC_URL" --ncn jtoF4epChkmd75V2kxXSmywatczAomDqKu6VfWUQocT \
  --keypair-path ~/.config/solana/id.json keeper --cluster mainnet --region local

# One state at a time
jito-tip-router-cli --ncn jtoF4epChkmd75V2kxXSmywatczAomDqKu6VfWUQocT crank-set-weight
jito-tip-router-cli --ncn jtoF4epChkmd75V2kxXSmywatczAomDqKu6VfWUQocT crank-snapshot
jito-tip-router-cli --ncn jtoF4epChkmd75V2kxXSmywatczAomDqKu6VfWUQocT crank-distribute
jito-tip-router-cli --ncn jtoF4epChkmd75V2kxXSmywatczAomDqKu6VfWUQocT crank-close-epoch-accounts

jito-tip-router-cli --ncn jtoF4epChkmd75V2kxXSmywatczAomDqKu6VfWUQocT get-epoch-state
jito-tip-router-cli --ncn jtoF4epChkmd75V2kxXSmywatczAomDqKu6VfWUQocT get-ballot-box

If voting never reaches two thirds, the tie-breaker admin can force the winning root after epochs_before_stall. Pass --meta-merkle-root as a 64-character hex string or a bracketed byte array. When that admin is a Squads vault, add --print-tx --tie-breaker-admin <vault> and submit the printed instruction through Squads.

jito-tip-router-cli --ncn jtoF4epChkmd75V2kxXSmywatczAomDqKu6VfWUQocT \
  --keypair-path ~/.config/solana/id.json \
  --print-tx \
  admin-set-tie-breaker \
  --meta-merkle-root "acd135f3108551b20f3d00015..." \
  --tie-breaker-admin INSERT_SQUADS_VAULT

Run an operator

Operators need a ledger snapshot of the last block of the target epoch, then they vote. Docker: make start-operator. From source, the binary is tip-router-operator-cli.

# Snapshot bank, build trees, vote, optionally set roots and claim
RUST_LOG=info cargo r --bin tip-router-operator-cli -- \
  --keypair-path ~/.config/solana/id.json \
  --operator-address INSERT_OPERATOR \
  --rpc-url "$RPC_URL" \
  --ledger-path /tmp/tip-router/ledger \
  --backup-snapshots-dir /tmp/tip-router/snapshots \
  --snapshot-output-dir /tmp/tip-router/snapshots \
  --save-path /tmp/tip-router/EPOCH \
  run \
  --ncn-address jtoF4epChkmd75V2kxXSmywatczAomDqKu6VfWUQocT \
  --tip-router-program-id RouterBmuRBkPUbgEDMtdvTZ75GBdSREZR5uGUxxxpb \
  --tip-distribution-program-id 4R3gSG8BpU4t19KYj8CfnbtRpnT8gtk4dvTHxVRwc2r7 \
  --priority-fee-distribution-program-id Priority6weCZ5HwDn29NxLFpb7TDp2iLZ6XKc5e8d3 \
  --tip-payment-program-id T1pyyaTNZsKv2WcRAB8oVnk93mLJw2XzjtVYqCsaHqt \
  --set-merkle-roots false \
  --claim-tips false

Stages you can run alone: snapshot-slot, create-stake-meta, create-merkle-tree-collection, create-meta-merkle-tree, submit-epoch, claim-tips, reclaim-expired-accounts, get-tip-distribution-stats. Claim example from the operator README:

RUST_LOG=info cargo r --bin tip-router-operator-cli -- \
  --keypair-path ~/.config/solana/id.json \
  --operator-address INSERT_OPERATOR \
  --rpc-url "$RPC_URL" \
  --ledger-path /tmp/tip-router/ledger \
  --backup-snapshots-dir /tmp/tip-router/snapshots \
  --snapshot-output-dir /tmp/tip-router/snapshots \
  --save-path /tmp/tip-router/EPOCH \
  claim-tips \
  --tip-router-program-id RouterBmuRBkPUbgEDMtdvTZ75GBdSREZR5uGUxxxpb \
  --tip-distribution-program-id 4R3gSG8BpU4t19KYj8CfnbtRpnT8gtk4dvTHxVRwc2r7 \
  --priority-fee-distribution-program-id Priority6weCZ5HwDn29NxLFpb7TDp2iLZ6XKc5e8d3 \
  --ncn-address jtoF4epChkmd75V2kxXSmywatczAomDqKu6VfWUQocT \
  --epoch EPOCH

Claims below --min-claim-amount (default 5000 lamports) are skipped so fees do not eat the payout. Expired distribution accounts can be reclaimed with reclaim-expired-accounts so validators get rent back. The on-chain program also exposes claim_with_payer if a cranker pays the claim tx.

Join the NCN

Operators and vaults still go through Jito restaking tickets before TipRouter will snapshot them. The CLI README order is the one to follow.

• Operator: initialize_operator, set voter admin, initialize_operator_vault_ticket and warmup for every vault, then operator_warmup_ncn after the NCN exists.
• Vault: initialize_vault_operator_delegation, add_delegation, then NCN tickets and warmup.
• NCN (already live for TipRouter): vault tickets, operator state, ncn_warmup_operator.

Restaking CLI is a separate repo: jito-foundation/restaking, binary jito-restaking-cli.

Audits and license

The repo ships two public audits: Offside (25 October 2024, commit 443368a) and Certora (5 January 2025, commit ac76352), both under security_audits/. GitHub licenses the crate Apache-2.0 or MIT. Docs pages still mention Business Source License 1.1 and link the MIT file. Read the LICENSE files in the repo you pin.

People and links