Can bonded validators be slashed for infractions more than an unbonding period in the past?

[cwgoes]

I'm not clear on the exact conditions under which a validator can be slashed. Two options:

1. While bonded or unbonding, a validator can be slashed for any infraction which took place while they were bonded (including e.g. a double signature of a four-week-old block discovered now, as long as the validator is still bonded).
2. A validator, regardless of bonding status, can only be slashed for an infraction discovered less than a bonding period after it was committed (so a double-signature of a four-week-old block discovered now would not cause a validator to be slashed).

[ebuchman]

Are these mutually exclusive ?

We defintely want (2), so we can get people in their unbonding period, but if someone hasn't unbonded and they equivocated longer than the unbonding period ago, we could still punish them.

Only thing is Tendermint keeps a parameter which is how far back evidence can come from to prevent DoS

[cwgoes]

The difference is whether or not bonded validators can be slashed for equivocations more than a bonding period in the past at the time of discovery.

We certainly can punish still-bonded validators for older infractions, IIRC one concern discussed in the validator working group was dealing with compromised signing keys. If we always impose a limitation of a bonding period on slashing, validators who rotate their signing keys (and stay bonded) don't need to worry about the security of keys last used more than a bonding period in the past. Without that limitation, they need to keep all past keys secure until they unbond.

edit: see Zaki's comment

[zmanian]

If we can incentivize validators to destroy keys after rotation, it decreases the subjectivity of the chain.

[cwgoes]

If we can incentivize validators to destroy keys after rotation, it decreases the subjectivity of the chain.

Agreed. Do you think the best way to incentivize this is by not having a 3-week limit? That way validators who rotate and delete old keys approximately every bonding period can maintain the same level of assurance (assuming they delete their keys correctly!), and choosing not to delete their old keys incurs risk.

[cwgoes]

Limited somewhat by the necessity of ignoring evidence past a certain age in Tendermint to prevent spam, but we could still elect to slash bonded validators for infractions more than a bonding period and less than the Tendermint limit.

[cwgoes]

Tabled to post-launch, see #1378.

[jackzampolin]

Is there utility in continuing this discussion?

[cwgoes]

Is there utility in continuing this discussion?

I think there's a lot of utility in having a general incentive discussion; I suspect our current incentives are not perfect (in many ways, this perhaps one of them). I don't know if it really belongs on the SDK repo though.

[jackzampolin]

Closing this as out of scope for the SDK repo. Moving to Gaia