Background

On Sept 5 and Sept 7, multiple validators were slashed by the oracle module. As far as we can tell, the validators were running a legitimate version of the pricefeeder program and were not acting maliciously, but because of recent market volatility on ATOM:USD, these validators were slashed.

This report aims to explain how the oracle module works and present findings from the slashing investigation.

Oracle Mechanics

A new vote period begins every N blocks (N=30). The EndBlocker hook of the block right before a new period aggregates price votes. For example, if a new vote period begins on block 90, then the prices are aggregated at the end of block 89.

Pricefeeder listens to new blocks and send a price vote transaction after the block before a new voting period is committed. For example, once block 89 is published, the pricefeeder will react and immediately send a price vote. These price votes may be included in block 90 or a later block, depending on the tx propagation and network latency, but as long as they are included in block 119, then it’ll count as a vote for the period.

Slashing Mechanics

A validator must make a minimum number of valid votes to prevent slashing. The current min_valid_per_window is 69% and a slash window is 3600 blocks. Given a vote period of 30 blocks, that’s 120 vote periods per slash window. In order to meet the 69% requirement, their miss budget is 31% = 37.2 misses. If a validator misses more than 37 times, they are slashed 0.5% of their stake.

Oracle Params

$ nibid q oracle params | jq

{
  "params": {
    "vote_period": "30",
    "vote_threshold": "0.333333333333333333",
    "reward_band": "0.020000000000000000",
    "whitelist": [
      "ubtc:uusd",
      "ueth:uusd",
      "uatom:uusd",
      "uusdc:uusd",
      "uusdt:uusd",
      "unibi:uusd"
    ],
    "slash_fraction": "0.005000000000000000",
    "slash_window": "3600",
    "min_valid_per_window": "0.690000000000000000",
    "twap_lookback_window": "900s",
    "min_voters": "4",
    "validator_fee_ratio": "0.050000000000000000",
    "expiration_blocks": "900"
  }
}

Slashings

In total, there were three slashings:

First slashing

Second slashing