Make a slash governance proposal

[ValarDragon]

Summary

There should be a governance proposal type to slash a validator. It would specify slash_percentage and validator address.

Problem Definition

This has a number of use cases. It allows blockchain communities to codify social standards that validators have to adhere to, and in the event they are 'caught' by the community, it allows them to slash them on-chain. (Without needing a hard fork)

A social slashing standard that has interest from the Osmosis community is essentially a "No Sybilling" condition, where they can all agree that if governance is presented with sufficiently persuasive evidence of a validator sybilling in order to game airdrops, newer staking reward designs, etc. they would be slashed for a certain factor. (With some carveout for cotenancy situations etc.). This is in part motivated by some validator-sybil-gameable decentralization ideas, cref https://commonwealth.im/osmosis/discussion/2036-proposal-per-validator-epoch-bonus-for-better-decentralization

I'm generally of the view that this is important for many chains, if validators commit malicious activities not yet thought about in advance, or on other chains. I propose we add this as a governance proposal type to the slashing module. Chains can simply choose not to add this governance proposal type to their governance router if they don't want this feature.

Proposal

Make a new governance proposal type in slashing with the following proto:

message SlashValidatorProposal {
  option (gogoproto.equal) = true;
  option (gogoproto.goproto_getters) = false;
  option (gogoproto.goproto_stringer) = false;

  string title = 1;
  string description = 2;
  string  validator_address = 3 [(cosmos_proto.scalar) = "cosmos.AddressString"];
  string slash_factor_percent = 4 [
    (cosmos_proto.scalar)  = "cosmos.Dec",
    (gogoproto.customtype) = "github.com/cosmos/cosmos-sdk/types.Dec",
    (gogoproto.nullable)   = false
  ];
}

Heres an example of how you do custom governance proposal types if folks are interested:

• proto: https://github.com/osmosis-labs/osmosis/blob/main/proto/osmosis/pool-incentives/v1beta1/gov.proto
• gov.go: https://github.com/osmosis-labs/osmosis/blob/main/x/pool-incentives/types/gov.go
• keeper: https://github.com/osmosis-labs/osmosis/blob/main/x/pool-incentives/keeper/gov.go
• app.go: https://github.com/osmosis-labs/osmosis/blob/main/app/keepers.go#L263

Happy to help guide anyone interested in implementing this

To do this, you'd implement:

• the proto file here: https://github.com/cosmos/cosmos-sdk/tree/master/proto/cosmos/slashing/v1beta1
• gov.go here: https://github.com/cosmos/cosmos-sdk/tree/master/x/slashing/keeper
  • basically just calling https://github.com/cosmos/cosmos-sdk/blob/2f335a2b8cc4fcfa337c104823fab9f6ecb387da/x/slashing/keeper/keeper.go#L68 with distributionheight = ctx.BlockHeight()
• Another gov.go in the types folder

Reference SDK issue

There is a reference issue in the SDK here cosmos#10917 . I expect that I'm only going to track this one for the foreseeable future, since that one is blocked on a multi-month gov refactor.

---

For Admin Use

• Not duplicate issue
• Appropriate labels applied
• Appropriate contributors tagged
• Contributor assigned/self-assigned

[ValarDragon]

From @hleb-albau

I created a small draft, now lets discuss next:

1. What validator state should be considered for slashing(now, proposal creating or other)? How it should influence delegations and re-delegations before and after slashing point? Should we allow safe re-delegate tokens during vote or during deposit or not?
2. What if chain has unbounding period is less than vote period? (maybe just leave it as is, just make sanity check before call actual slash). We loose info about delegations and re-delegations after unbound succeed.
3. Can validator and its delegators vote on prop?
4. It seems that gov module has very simple route handler that not allow to register more advanced checks on proposal creation. For example, it is not possible to validate on proposal creation that validator exist and in active set. Maybe we need to advance route architecture?(or it should be done in ADR in other issue?)

[ValarDragon]

Re the questions:

1. I think the only way to do it efficiently in the SDK atm is Now. That will cover unbondings / redelegations though.
2. Hrm, I think thats an ok edge case. Would be good to potentially emit a warning if theres a sensible way of doing so.
3. Yup! If your being slashed, you should be allowed to say that you don't agree
4. Yeah, this is really unfortunate that none of the relevant validation methods get the context passed in. I think for a v1 of this feature, we'd have to be ok with the edge case of being able to slash inactives.