cosmos / cosmos/interchain-security

SlashPackets may lead to delegators getting incorrectly slashed

Open
#643 2 comments 0 reactions 0 assignees View on GitHub
more-info-needed scope: cosmos-sdk type: bug
Dominant language
Go
Stars
195
Forks
166
PR merge metrics
No merged PRs in 30d

Description

# Problem

As compare to the normal behavior of SDK chains, ICS introduces an extra delay between the time an infraction is committed and the time the misbehaving validator is slashed (i.e., due to relaying). If during this period a delegator delegates to the misbehaving validator, it will get slashed although it's stake did not contribute to power the validator had when it committed the infraction.

# Closing criteria

Asses whether this is indeed an issue. In case it is, figure out a way to fix it.

# Problem details

Currently, the SDK accepts two types of evidence: downtime and double-signing. For both an infraction height is created that is used by the staking module to avoid slashing undelegations or redelegations that occur before the infraction was committed (i.e., it affects what unbonding stake can be slashed). **_Note that the infraction height doesn't have any impact on the bonded stake that is slashed._** This means that if a delegator manages to delegate to a validator after it committed the infraction but before it got slashed, then that delegator will get slashed as well. The purpose of this issue is to analyze

- If this is a current issue in the SDK.
- If ICS makes this issue worse.

Note that, in the case of ICS, every infraction height on every consumer chain is mapped correctly to a height on the provider (see the [mapping from consumer chain block heights to provider chain block heights](https://github.com/cosmos/ibc/blob/main/spec/app/ics-028-cross-chain-validation/overview_and_basic_concepts.md#consumer-initiated-slashing) in the spec).

## Downtime

Downtime evidence is generated in `slashing.BeginBlock` based on the `LastCommitInfo` received from TM. If at height `h` a validator `V` has not voted in enough blocks, then `V` is slashed at height `h` for an infraction at height `h-2`, i.e., https://github.com/cosmos/cosmos-sdk/blob/47f46643affd7ec7978329c42bac47275ac7e1cc/x/slashing/keeper/infractions.go#L85.

This means that a delegator `D` can delegate to `V` at height `h-1` and as a result get slashed at height `h` for the downtime infraction at height `h-2`. ICS makes this worse due to the relaying delay.

## Double-singing

Double-signing evidence is passed to the SDK by TM and handled in `evidence.BeginBlock`. If at height `h`, some evidence is received for a validator `V` for an infraction committed at height `hi`, then `V` is slashed at height `h` for an infraction at height `hi-1`, i.e., https://github.com/cosmos/cosmos-sdk/blob/47f46643affd7ec7978329c42bac47275ac7e1cc/x/evidence/keeper/infraction.go#L101.

This means that a delegator `D` can delegate to `V` at any height in the interval `[hi, h-1]` and as a result get slashed at height `h` for the double-singing infraction at height `hi-1`. ICS makes this worse due to the relaying delay.

# TODOs
- [x] Labels have been added for issue
- [x] Issue has been added to the ICS project

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.