MECHANISM_DESIGN.md S5 penalty doesn't match code (entire stake + blacklist vs MIN_STAKE + jail) #274

Activity

1. abrahamnash

   self-assigned this

   on Oct 25, 2026
2. abrahamnash commented on Oct 25, 2026

   

   abrahamnash

   on Oct 25, 2026

   MemberAuthor

   More actions

   Decision: keep the code's behaviour for S5. Repeated liveness failures slash MIN_STAKE and jail for s5JailDuration; no permanent blacklist.

   Reasoning: S5 is unreliability, not provable malice. The full slash plus blacklist stays reserved for provable malice (S4). Given the correlated-outage case on #155 (one outage can trigger S5 on a multi-model validator), an irreversible ban would be disproportionate.

   For mainnet, we may revisit an escalation path: repeated S5 escalations after jail could lead to a full slash and blacklist.

   @umermjd11 could you update MECHANISM_DESIGN.md (the S5 row and the "Full slash" definition) to match the code, and close this issue with that PR?
3. abrahamnash

   assigned

   umermjd11

   and unassigned

   abrahamnash

   on Oct 25, 2026
4. umermjd11 commented on Oct 26, 2026

   

   umermjd11

   on Oct 26, 2026

   Collaborator

   More actions

   @abrahamnash Done in #286, which updates Developer/design/MECHANISM_DESIGN.md to match the code:

   • S5 row: the tier now reads "Escalated: MIN_STAKE + jail (no blacklist)".
   • Full slash: now reserved for provable malice (S4) only.
   • New "S5 escalation" entry: covers the MIN_STAKE slash, the s5JailDuration jail and the reactivate() exit. It also records your decision and reasoning, plus the possible mainnet escalation path.

   I checked it against DinValidatorStake.slashPartial on develop. The other docs already describe this correctly. #286 includes Closes #274, so this issue closes when the PR is merged.
5. Santiagocetran

   closed this as completedin #286on Nov 2, 2026
6. Santiagocetran

   added a commit that references this issue on Nov 2, 2026

   docs(MECHANISM_DESIGN): S5 escalation is MIN_STAKE + jail, not full s…

   ...

   8243ba6
7. umeradl commented on Nov 2, 2026

   

   umeradl

   on Nov 2, 2026

   Last edited by umeradl

   Member

   More actions

   Closed as completed by PR No. 286, verified on develop.

   The PR merged through the merge queue as 07e5bd79 on 2026-11-02, and its Closes keyword closed this issue at 15:47:58 UTC. Robbert verified the PR and Santiago approved and queued it (outcome comment).

   Checked against the decision above (keep the code's behaviour) and both items requested:

   Asked for	On develop (Developer/design/MECHANISM_DESIGN.md)
   S5 row matches the code	Line 81: "Escalated: MIN_STAKE + jail (no blacklist)"
   "Full slash" definition	Line 87: entire slashable stake + blacklist, "Reserved for provable malice (S4)"
   Decision and reasoning recorded	Lines 88–90: new "S5 escalation" entry (MIN_STAKE slash, s5JailDuration jail with a 7-day default, reactivate() exit), the decision dated 2026-10-25, the reasoning, and the possible mainnet escalation path

   The code matches the doc. DinValidatorStake.slashPartial applies _applySlash(validator, MIN_STAKE, "S5_RECIDIVISM") and then _jailInternal(validator, uint64(s5JailDuration), ...) (lines 369–370). s5JailDuration defaults to 7 days (line 239). Blacklisting is only the owner's separate blacklistValidator (line 471).

   Leftover (outside this issue's scope, not reopening): two task specs still describe the old escalation:

   • Developer/tasks/task_100926_13.md, lines 38 and 82: "escalation to full slash".
   • Developer/tasks/task_240926_17.md, line 58: "S5 escalation to full slash + jail".

   Only the specs' wording is stale. PR No. 218 (task_240926_17 Part 2) already describes and tests S5 as a MIN_STAKE slash + jail with no blacklist (adversarial-threat-model.md Row 3). The task wording can be corrected when those tasks are next touched.