feat: verifiable downtime evidence with optimistic challenges and consumer pausing - #63
Open
giunatale wants to merge 12 commits into
Open
feat: verifiable downtime evidence with optimistic challenges and consumer pausing#63giunatale wants to merge 12 commits into
giunatale wants to merge 12 commits into
Conversation
app.NewContext(true) builds a context from an empty header, so the export context reported block height 0. x/distribution's CalculateDelegationRewards replays validator slash events between the delegation's creation height and the context height, so at height 0 it replayed none: for any validator slashed after its delegation was created, the recomputed final stake exceeded the current stake and the export panicked in prepForZeroHeightGenesis. Use NewContextLegacy with LastBlockHeight, matching upstream simapp.
…vidence packets the consumer stored packet.SourceClient (the provider's own client) as its ProviderClientID on first VSC recv, guarded by a "set once" check. that value is meaningless for the consumer's own outbound sends -- it needs packet.DestinationClient, its own client id, which is guaranteed by ibc-go's RecvPacket to already have a registered counterparty. this was invisible until now because nothing before the downtime evidence feature ever needed the consumer to send an IBC v2 packet back to the provider; the genesis-time self-created client (never linked to a counterparty by the relayer) was silently latched onto forever, so every evidence packet failed to send with "counterparty not found". discovery now resyncs on every accepted VSC packet instead of once, so a stale value from a placeholder client heals itself.
giunatale
force-pushed
the
giunatale/feat/offline-detection
branch
from
July 22, 2026 11:45
d6b755a to
be849ec
Compare
giunatale
marked this pull request as ready for review
July 22, 2026 11:45
giunatale
requested review from
clockworkgr,
julienrbrt and
tbruyelle
as code owners
July 22, 2026 11:45
This was referenced Jul 30, 2026
julienrbrt
approved these changes
Aug 3, 2026
julienrbrt
left a comment
julienrbrt
left a comment
Member
There was a problem hiding this comment.
I have some tiny nits i'll share, but amazing work! so ACK
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #38
Downtime on a consumer chain is unprovable on the provider, but it is disprovable: a single validator signature for a claimed-missed height, sealed under a light-client-verified header, indicts the evidence source.
This PR builds the downtime pipeline around that asymmetry.
handling becomes log-only) and report a per-window bitmap to the provider.
Window parameters are provider-owned and distributed via consumer genesis
and VSC packets, with staged activation
share x missed fraction, converted via photon), then queues the slash
behind a challenge window instead of executing it.
DowntimeSlashFractionacts as a per-window ceiling (default 0.0001), repeated
windows queue independently and can compound
MsgChallengeConsumerDowntimelets anyone cancel a validator's pendingslashes by proving a claimed-missed block was actually signed. A
successful challenge refunds the withheld fee shares (escrowed in the
consumer fee pool for the window's duration) and moves the consumer to a
new
CONSUMER_PHASE_PAUSED: no VSC packets, fee accrual stopped, resumableby governance (
MsgResumeConsumer, with a forced snapshot resync), andauto-stopped after
MaxPauseDuration.provider chain id.
The first two commits are standalone fixes for 2 pre-existing bugs on main (export at a zero height panicked after any slash & the consumer stored the provider's client id instead of its own)
Full design and operational notes in
docs/consumer-downtime.md.