What does it mean if there is no delegation in a Certificate?

When I do a read_state call to a canister via the https interface and I get a Certificate response, what does it mean if there the delegation is not defined?
Apparently the delegation return is optional (see here).
I’m trying to identify if a canister exists by checking the controllers and module_hash for the canisters via read_state calls. When I do a read_state call, I get three options

  1. I get a response with a delegation and can read out the controllers and module_hash.
  2. I don’t get a response at all which I interpret that the canister doesn’t exist.
  3. I get a response but delegation is undefined.

I’d like to understand what the third option means. Can anyone help here?

I’m not sure if I phrased the question in an understandable way because my understanding of IC is still quite limited.

My understanding is this:

If you call read_state on a canister in the root subnet, it will have no delegation (i.e. undefined).

If you call read_state on a canister in any other subnet, it will have a delegation, which itself is a certificate that proves that the subnet is managed by the root subnet and also reveals that subnet’s public key.

Pretty much copied that verbatim from here.

My guess is you’re trying to read the state of the ledger canister, which lives in the root subnet?

3 Likes

Just want to confirm: your understanding is correct, a certificate has no delegation if and only if it comes from the root subnet (also known as “NNS”).

Thanks a lot, that helps. No, I’m actually trying to get information about the various canisters on the different subnets.
As an addition to my question above, what does it mean if the read_state yields a response for some canisterId but no controller is defined in the Certificate? Is this a leftover canister that has been deleted or does this have another meaning? E.g. if I check on canlista, I can find this canister but there is no controller defined and it says “No canister found”. Similarly, if I fetch the read_state of that canister, I don’t get a controller defined.

Every canister has a set of controllers, and that set can be empty. This is the most basic way to make an immutable canister (e.g. a smart contract). I have done so for example for the capture the ICP token challenge.

These days I would not do that, but leave the “Blackhole canister” as the sole controller.

2 Likes

Ok, thanks, I see. So if there is no controller, it may be a black-holed canister.
What’s the benefit of leaving the blackhole canister as the controller as compared to removing all controllers?

Also, following up my initial question, what does it mean if there is no module_hash for a canister? Would that mean that this is a “dead” canister? E.g. this one again.

Subtle nudging from Joachim there ; ) —Canlista now finally shows the whole controller set. (It also links to the subnet status pages too, which can be handy.)

@Dustin read_state doesn’t seem to find a controller array or module hash for that canister.
If the controller array were just empty Canlista would report that the canister “has no controllers”, which would be perfectly valid, as Joachim says.
Trying to call any methods on canister 6lkis returns an error “IC0301: Canister 6lkis-piaaa-aaaaa-qaaja-cai not found" from the IC.
Is this a canister you deployed/do you happen to know what this canister is?

Both a canister with no controllers at all and a canister that has had the blackhole canister set as its sole controller (example) would be immutable. But the blackhole canister also proxies the canister_status method, which allows you to check details that otherwise only a controller can see, eg the canister’s cycles balance.

1 Like

Ok, that makes sense, thanks a lot.

No, I just happend to find it and was wondering what it meant if there is no module_hash defined. I understand what it means if there is no controller defined (aka black holed) but still not what it means if there is no module hash. Is there even anything stored on the canister if there is no module hash?

Kinda, althought that’s confusing terminology, given that there is the “Blackhole canister”, so I’d consider a “blackholed canister” on that has the Blackhole canister as the sole controller.

What’s the benefit of leaving the blackhole canister as the controller as compared to removing all controllers?

It allows anyone to call canister_status, e.g. to get the cycle balance, which otherwise wouldn’t be possible. This enables applications like the the cycle tip jar.

Also, following up my initial question, what does it mean if there is no module_hash for a canister?

That the canister

  • has been created, but no code installed yet, or
  • had code installed, but it got explicitly removed (via uninstall_code),
  • it ran out of cycles, and got emptied by the system.
2 Likes