Closed adrianbrink closed 10 months ago
We should be able to copy the Cosmos SDK model:
Let me know if you have any questions /cc @grarco @brentstone
Some initial notes to spec out how to do this specifically in Namada. Please comment.
finalize_block
, expose two functions from the PoS crate: record_liveness_data
, which takes the req.votes
as input and is called every block, and jail_for_liveness
, which is called upon a new epoch.
jail_for_liveness
should be called before record_liveness_data
.jail_for_liveness
every block too?LazyMap<Address, LazyMap<BlockHeight, bool>
that records a bool
indicating if a validator Address
signed the block in some BlockHeight
.
PosParams
called max_num_liveness_blocks: u64
(or similar) to remove map elements for which the height
< current_height - max_num_liveness_blocks
.record_liveness_data
will instantiate their data.record_liveness_data(votes)
votes
,(height, vote.signed_last_block)
into validator_liveness_data
height
in the map, if height < current_heigh - max_num_liveness_blocks
, remove the key-valjail_for_liveness
validator_liveness_data
,true
values. Use another PosParam called liveness_protection_threshold: Dec
such that if sum(true) / max_num_liveness_blocks < liveness_protection_threshold
, then the validator is jailed and the validator set is appropriately updated.validator_liveness_data
Not positive if jailing or deactivating is the proper thing to do, or if it even matters. Also please comment on whether we think it is better to call jail_for_liveness
upon a new epoch or every block. The downside of calling it upon a new epoch is that we cannot jail/deactivate misbehaving validators until the following epoch, letting them remain for one more whole epoch if they are in consensus.
jail_for_liveness
should be a cheap call so I think we can do it every block.
Validators should be jailed but without being slashed and they can unjail themselves.
The threshold for liveness should be something like missed more than 10% of the last 10,000 blocks. That means that the sliding windows is ~12 hours with 5 second blocks, which means that you can be down for about 1.5 hours.
jail_for_liveness
every block; this would allow the network to respond more quickly.bitfield is good.
we can port the code over from the sdk.
Cool, this sounds good. Chatted with @grarco about what we will do too.
Is this really completed already? :open_mouth:
Implement liveness protection.
In particular, the current idea would be to jail a consensus validator who has not voted on enough blocks within some past interval.
Started implementation here: https://github.com/anoma/namada/pull/981