Skip to content

fix: [IF-FINDING-002] Slashing parameters can be modified to unexpected values#1

Merged
AdriaCarrera merged 7 commits intoevmos/v0.50.11from
fix/IF-FINDING-002
Mar 18, 2025
Merged

fix: [IF-FINDING-002] Slashing parameters can be modified to unexpected values#1
AdriaCarrera merged 7 commits intoevmos/v0.50.11from
fix/IF-FINDING-002

Conversation

@AdriaCarrera
Copy link

[IF-FINDING-002] Slashing parameters can be modified to unexpected values

Description

In a Proof of Authority (PoA) system, validator power should remain unchanged after slashing events. If power reductions occur due to slashing, validators may end up with different staking powers, potentially violating the StakingPowerInvariant.
The Keeper Dependencies Parameters Invariant, which expects critical slashing parameters to be initialized to predefined values, does not hold. This is because the slashing parameters SlashFractionDoubleSign and SlashFractionDowntime can be modified through governance or set at genesis to unexpected values.

Problem scenarios

  • Validators may lose power unexpectedly if slashing parameters are modified post-genesis.
  • This could disrupt validator selection and consensus stability, especially in a PoA system where equal power is
    expected.

Recommendation

Implement restrictions on parameter changes through both governance and genesis configuration. This can be achieved by modifying the Cosmos SDK fork to prevent governance proposals from updating slashing factor parameters, and by adding genesis initialization checks that validate these values are non-zero before allowing chain startup.

Applied changes

  • Modified the validate params function and added default values to 0

@github-actions

This comment has been minimized.

@AdriaCarrera AdriaCarrera changed the title [IF-FINDING-002] Slashing parameters can be modified to unexpected values fix(IF-FINDING-002) Slashing parameters can be modified to unexpected values Mar 18, 2025
@AdriaCarrera AdriaCarrera changed the title fix(IF-FINDING-002) Slashing parameters can be modified to unexpected values fix: [IF-FINDING-002] Slashing parameters can be modified to unexpected values Mar 18, 2025
@AdriaCarrera AdriaCarrera merged commit dfa4166 into evmos/v0.50.11 Mar 18, 2025
42 of 45 checks passed
@AdriaCarrera AdriaCarrera deleted the fix/IF-FINDING-002 branch March 18, 2025 12:44
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants