Skip to content

Slashing Risks

Slashing burns bonded stake as a penalty for validator misbehavior — and delegated stake is slashed alongside the validator’s own. Every delegator is underwriting their validator’s operational competence.

Signing two different blocks at the same height is the cardinal offense — it is the behavior that could fork the chain, so the protocol treats it as malicious regardless of intent. In practice, most double-signing incidents are operational accidents: two nodes running the same consensus key during a botched failover, or restored-from-backup state colliding with a live signer.

Consequences are severe: a significant stake burn and tombstoning (permanent removal) under standard Cosmos-style parameters.

Missing too many blocks in a window gets a validator jailed and a smaller portion of stake slashed. Downtime slashing is recoverable — the validator can unjail after the penalty — but it is a visible, on-chain operational failure that delegators can and do read.

The economic analysis framework in pkg/economics/ models nothing-at-stake behavior and slashing effectiveness directly (its audit input includes SlashingEnabled and SlashingPenaltyBPS). The conclusion built into the protocol: penalties must make dishonest or careless validation strictly unprofitable, including for well-capitalized attackers. The 21-day unbonding period extends the exposure window so misbehavior cannot outrun its consequences.

  • One key, one signer. Never run two nodes with the same consensus key — including “standby” nodes. Failover must be mutually exclusive by construction, not by procedure.
  • Guard state restores. Restoring a validator from backup without double-sign protection is the classic tombstoning story.
  • Alert on missed blocks well below the jailing threshold.
  • Drill failover. The repository ships DR drill tooling (infra/dr/run-failover-drill.sh) that produces evidence bundles — rehearse with it.
  • Prefer validators who publish their key-management and failover architecture.
  • Treat any double-sign history as disqualifying.
  • Diversify across validators — slashing is per-validator, and so is your exposure.