Oracle Economics v2: Paying Attesters, Making Bans Expensive

The oracle hardening we wrote about previously slashes a validator for signing a bad price. It does not pay anything for signing a good one. That asymmetry has a hole in it: a validator that never bothers to attest loses nothing, and — worse — a validator that gets frozen or banned for repeat deviation kept its full block-reward income anyway, since income never depended on oracle duty in the first place. v0.9.0 (oracle economics v2, PR #842) closes both gaps.

An oracle-participation reward, paid from the existing pool

Rather than mint anything new, the fix redistributes: each block, an oracle slice — 10% of the validator pool (the proposer’s reward after the reserve slice and any above-target diversion) — is carved out and split equally among the block’s correct attesters, at commit. “Correct” excludes deviators, absentees, and any frozen or banned validator; their would-be shares are simply absorbed by the attesters who did show up, and the integer-floor remainder goes to the reserve. The split is revenue-neutral — the pool minus the slice, plus the slice paid out, is still exactly the pool — so the existing 75% validator-share floor and the per-block conservation proof are untouched.

The equal split (not power-weighted) is deliberate. Committee and subset membership are already stake-correlated — sortition into the committee is stake-weighted, and the subset is a uniform hash-rank over that committee — so an equal per-attester split reproduces the same stake-tracking shape the block reward already has. Weighting the slice by power again would compound a second stake factor on top of the first, which centralizes rather than merely reflecting existing stake. A pool validator’s share of the slice flows through the same commission/escrow split as its ordinary block reward, so delegators get their pro-rata cut and it is exactly as slash-immune as any other reward.

A slash that fits the crime

Before v0.9.0 the deviation slash was a flat escalation: a 1 basis-point base, doubling with each repeat offense, regardless of how far off the reported price actually was. A validator that mistakenly reported a price 0.1% off the accepted value and one that reported a price 800% off it paid the same ladder. Oracle economics v2 makes the slash magnitude-fair: a deviation now falls into a magnitude tier (a small miss stays at the ×1 base rate; a large one shifts ×8; an egregious one shifts ×64), each tier capped at its own ceiling (64 / 600 / 2500 basis points respectively), all still bounded by the hard 25%-per-period cap that was already in place. A validator whose feed is merely a little noisy is treated much more gently than one that is lying outright — and an egregious deviation now advances the freeze/ban counter by 2 steps instead of 1, so a validator that tries to move the price by a lot gets frozen and banned faster, not just slashed harder.

Ban stops being a free opt-out

The gap that made a ban cheap was structural: the code that decides which validators are “obligated” to attest excluded frozen and banned validators from that obligation — so once banned, a validator was simply outside the game, collecting its usual proposer income with no oracle duty and no further penalty. v0.9.0 removes that exemption. A frozen or banned validator is now counted as obligated and absent every block: it forfeits its share of the 10% oracle-participation slice, and being obligated-and-absent also degrades its oracle-availability score, which feeds the propose-gate exclusion we described in the hardening post. At the 10% slice size, that forfeiture alone is worth roughly 1.3% of stake per year on top of the one-time deviation slash — and combined with losing proposing turns, a ban now costs close to a validator’s entire ongoing franchise, not just a one-time haircut.

What this changes, and what it does not

This is a genesis-breaking change: the new oracle-participation and magnitude-fair-slash parameters are encoded into the stablecoin module’s genesis parameters, so it ships as a wipe-and-redeploy like every other consensus-affecting change, never a live migration. The absence-is-never-slashed principle from the original hardening design is unchanged — a validator that misses an attestation because it is offline is still never stake-slashed, only scored. And the split-committee guard that suppresses slashing when deviators make up half or more of the attesters is unchanged too. What changed is narrower and more honest: attesting correctly now has a price on it, and refusing to attest — including by being banned — now has a cost that actually bites.