Canton Network has approved CIP-0117, introducing Logical Synchronizers as the new mechanism for protocol upgrades. The change reduces upgrade downtime from as much as three hours to seconds, removing the coordinated network halts that previous upgrades required.
Until now, every major Canton protocol upgrade required a global network pause. Super Validator operators joined a live coordination call, all nodes exported migration dumps, new Canton components were deployed, dumps were reimported, and every validator operator had to manually spin up a new node from a migration-specific backup. The process took between 90 minutes and three hours and required explicit action from all participants. Previous upgrades under CIP-0062 and CIP-0089 followed this pattern.
CIP-0117 replaces that process entirely. Under the new procedure, a successor synchronizer node spins up alongside the existing one before the scheduled upgrade window. Validators upgrade their binaries independently, at their own pace, before the cutover time. At the scheduled upgrade time, the network switches over automatically. No coordinated shutdown, no migration dumps, and no manual recovery steps are required from validator operators.
Validator history is fully preserved across upgrades. Applications see a continuous transaction stream with a pause of seconds to minutes during the switchover. Application developers are not required to take any action.
The first Logical Synchronizer Upgrade is scheduled across three environments: DevNet on June 10, TestNet on June 17, and MainNet on June 27. The minimum required Splice version is 0.6.5.
Upgrade cancellation is possible between the topology freeze time and the upgrade time if the successor synchronizer is found to be unhealthy, with no data loss and no recovery steps required.
CIP-0117 was approved June 5, 2026. Development of the Logical Synchronizer capability was funded in part by the Canton Foundation Development Fund.
