Problem with processing evidences too late

[angbrav]

There might be an issue that allows users to withdraw tokens without being slashed even when the misbehaving validator is caught on time. Here is an execution:

• Assume that user has a1 tokens delegated to val
• Assume that user undelegates a1 tokens from val at e. This creates an unbond u1 record s.t. u1.start < e && u1.end = e+unbonding_length. Note that the validator's total_deltas includes the a1 tokens from user until e+unbonding_length
• Assume now that some evidence is found for an action val did at epoch e+1.
• The evidence is scheduled to be processed by the end of e+unbonding_length+1
• Assume that user withdraws by e+unbonding_length.
• By that epoch, evidence has not been processed, therefore user withdraw a1 tokens (without slashing)

I think we need to consider ongoing unbonds to decide when to process evidences. Also, this will impact the solution for #7

[angbrav]

The issue manifests even if the slash is processed at the end of the found epoch.

• Assume that user has a1 tokens delegated to val
• Assume that user undelegates a1 tokens from val at e. This creates an unbond u1 record s.t. u1.start < e && u1.end = e+unbonding_length. Note that the validator's total_deltas includes the a1 tokens from user until e+unbonding_length
• Assume now that some evidence is found for an action val did at epoch e+2.
• The evidence is found at epoch e+unbonding_length+1.
• Assume that user withdraws by e+unbonding_length.
• By that epoch, evidence has not been processed, therefore user withdraw a1 tokens (without slashing)

Is this expected?

[tzemanovic]

ah, I think this is the same issue as what we also uncovered in anoma/namada#366 :)

[angbrav]

Yes, that was my impression as well.

[angbrav]

To fix this issue, we have agreed to make the following changes:

• total_deltas is updated at cur_epoch+pipeline_length. It cannot be done earlier due to integration constraints. This also applies to total_unbonds, voting_power, total_voting_power and validator_sets.
• the unbond record created ends at cur_epoch+pipline_length+unbonding_length

[angbrav]

Updated execution with the above changes. Assume that a piece of evidence is processed at the end of the epoch in which it is found.

• Assume that user has a1 tokens delegated to val
• Assume that user undelegates a1 tokens from val at e. This creates an unbond u1 record s.t. u1.start < e && u1.end = e+pipeline_length+unbonding_length. Note that the validator's total_deltas includes the a1 tokens from user until e+pipeline_length
• Assume now that some evidence is found for an action val did at epoch e+pipeline_lenght-1. This is the last epoch in which user's tokens count for val's total_deltas.
• The evidence is found at epoch e+pipeline_lenght-1+unbonding_length (the latest possible). The evidence will be processed by the end of this epoch, so that at the end ofe+pipeline_lenght-1+unbonding_length
• Assume that user withdraws by e+pipeline_length+unbonding_length.
• By that epoch, evidence has been processed, therefore user is slashed.

Assume now that a piece of evidence is processed by the evidence epoch + unbonding_length. This is how it works currently.

• Assume that user has a1 tokens delegated to val
• Assume that user undelegates a1 tokens from val at e. This creates an unbond u1 record s.t. u1.start < e && u1.end = e+pipeline_length+unbonding_length. Note that the validator's total_deltas includes the a1 tokens from user until e+pipeline_length
• Assume now that some evidence is found for an action val did at epoch e+pipeline_lenght-1. This is the last epoch in which user's tokens count for val's total_deltas.
• The evidence is found at epoch e+pipeline_lenght-1+unbonding_length (the latest possible). The evidence will be processed by the end of e+pipeline_lenght-1+unbonding_length
• Assume that user withdraws by e+pipeline_length+unbonding_length.
• By that epoch, evidence has been processed, therefore user is slashed.

These executions seem to imply that the fix solves the issue and that slashing is guaranteed if the evidence is found within the unbonding_lenght period, as required.