Hardening the Oracle: Escalating Slashes, Provability, and a Quorum That Expands

Update (2026-07-02): the escalating-slash mechanism described below is the v0.0.3 design — a flat doubling ladder (1, 2, 4, … bps) with no regard for how far off a deviation was, and a frozen/banned validator kept full oracle income with zero further duty. v0.9.0’s oracle-economics-v2 (PR #842) replaced both: the slash is now magnitude-fair — a small miss stays cheap, but a deviation ×8 or ×64 the tolerance band jumps tiers immediately (ceilings 64/600/2500 bps under the same hard 25%/period cap), and ban is no longer a free opt-out — a new oracle-participation reward (a 10% slice of the validator pool, split equally among correct attesters, revenue-neutral) means a frozen/banned validator now forfeits that slice and its proposing turns too. See “Oracle Economics v2: Paying Attesters, Making Bans Expensive” for the current mechanism; this post stays as the historical record of what shipped in v0.0.3.

In an earlier post we described the Anemos oracle: each block a rotating committee subset signs the ANM/USD price into a block-body section the existing certificate already attests, and the chain takes a slashed-deviation, never-slashed-absence stance. That design works, but a first version only has to be correct against honest participants. The hardening is about what happens when participants are adversarial, lazy, or simply absent — and about being principled about which of those we are even allowed to punish.

The crux: split penalties by provability

The organizing principle of the hardening is a single distinction: stake is slashed only for provable misbehavior. A signed price outside the band is provable — the signature is right there in the certificate, attributable to a specific validator. That can be slashed without trusting anyone’s word.

Availability is not provably attributable. If a validator’s price vote never makes it into a block, you cannot prove from on-chain data whether it stayed silent or whether the proposer dropped its gossiped vote. Slashing stake for absence would therefore let a malicious proposer frame an honest validator. So absence is never met with a stake slash — only with a recoverable exclusion. This split is the rule everything else follows from.

Escalating deviation slash with lazy decay

A first deviation is cheap; a repeat offender pays more. The deviation slash now escalates — from a base of 1 basis point, doubling with each effective repeat, capped at 64 bps — so a validator that keeps signing bad prices faces a sharply rising cost, while a one-off glitch barely stings. The repeat count decays on a half-life, computed lazily at read time rather than on a timer, so a validator that cleans up its act is gradually forgiven without any background bookkeeping. As before, the forfeited ANM is moved into the reserve it endangered — a transfer, not a burn.

Availability as a recoverable gate, not a slash

A validator that repeatedly fails to attest while its peers succeed earns a falling oracle- availability score, and a low score excludes it from proposing until it recovers. No stake is lost. Critically, availability obligations only count on blocks that actually carried an oracle section — so a network with no feeders running, or an oracle that is legitimately quiet, keeps every score intact and never penalizes anyone. It is a gate you can always walk back through, by attesting again.

A quorum that expands to stay fresh

The thin first-tier subset is efficient, but if too few of its members show up, the proposer would be forced to carry the old price forward. Instead the subset is now tiered and expanding: when the narrow tier cannot reach quorum, the proposer deterministically widens to a larger tier — a prefix-superset of the same ranking, so every node agrees on who is in it — and produces a fresh price rather than a stale one. Because feeders cache their latest reading, a committee member can sign from cache the instant it is asked, so widening the tier is cheap.

The median, the ±10% move cap, and the slow ~3.5-hour price TWA are unchanged. The honest framing from the first post still stands: the ceiling is honest-majority-of-stake, and we lead the defense with economic security and a slow, well-bounded price. The hardening does not raise that ceiling — nothing can — it makes the floor underneath it much harder to chip at.