Should there be a limit on how many nodes can be reported/slashed as part of a single ceremony?

[msgmaxim]

Something I've seen more than once on testnet is that nodes reported all participants (including themselves) due to a software bug. I think N nodes being reported in a ceremony is almost certainly a result of a bug (or possibly an exploit). If something like this happens once, there is a very good chance that it will keep happening for subsequent ceremonies until all nodes lose their funds/validator status. Perhaps we should stall the network insted in cases like this, so we could manually interfere? (Instead of stalling the network, we could retry the ceremony w/o slashing anyone.) More generally, should there be threshold T (say 2/3 of all nodes) such that if T nodes are simultaneously reported in a ceremony, we should handle this failure differently?

[morelazers]

Good catch - Dan and I spoke about this a little last week in reference to this story. Capping the number of parties that are voted for probably makes sense on-chain, where if you vote for over T nodes we just disregard your vote.

I am pretty sure that it only makes sense to vote for 50 nodes maximum, since if you're voting for more than that, you're effectively attesting tot he fact that any signature generation would be impossible, right?

[msgmaxim]

I think T = 1/3 * N makes sense, since we already assume everywhere else that we don't have more than 1/3 dishonest parties. So 50 makes sense for N = 150, but in case we don't have 150 nodes, the threshold will need to be smaller, right?

[morelazers]

Yeah that's correct, we should limit to N/3

[dandanlen]

Does it matter that we only request a signature from N/3 + 1 parties in the first place? Ie. even if we have 150 nodes, we only request a signature from 101 nodes.

An alternative way to think of it might be that we ignore nodes if they report more than half the participating nodes (ie. half the threshold amount)?

[morelazers]

I don't think it matters how many we request the sig from - but I do think we should enforce in the context of N and not the context of T for the sake of clarity (enforcing in the context of T implies the context of N, but we should be explicit if possible).

[msgmaxim]

So I'm assuming this logic will be implemented on State Chain? (i.e. we don't need to limit the numer of nodes CFE can report?)

[morelazers]

Yes this sounds correct to me.