feat!: Add tombstone field to SlashJailParameters (#2433)

* add tombstone field to SlashJailParameters

* test fix

* make the tombstone field irrelevant for downtime infractions

* add log when setting tomstone  to true for downtime

Author: stana-miric

docs/docs/build/modules/02-provider.md

@@ -2884,11 +2884,13 @@ grpcurl -plaintext -d '{"consumer_id": "0"}' localhost:9090 interchain_security.
  "infraction_parameters":{
       "double_sign":{
          "slash_fraction":"0.050000000000000000",
-         "jail_duration":"9223372036.854775807s"
+         "jail_duration":"9223372036.854775807s",
+         "tombstone": true
       },
       "downtime":{
          "slash_fraction":"0.000000000000000000",
-         "jail_duration":"600s"
+         "jail_duration":"600s",
+         "tombstone": false
       }
    },
   "clientId": "07-tendermint-28"
@@ -3594,11 +3596,13 @@ Output:
   "infraction_parameters":{
       "double_sign":{
          "slash_fraction":"0.050000000000000000",
-         "jail_duration":"9223372036.854775807s"
+         "jail_duration":"9223372036.854775807s",
+         "tombstone": true
       },
       "downtime":{
          "slash_fraction":"0.000000000000000000",
-         "jail_duration":"600s"
+         "jail_duration":"600s",
+          "tombstone": false
       }
    }
 }

proto/interchain_security/ccv/provider/v1/provider.proto

@@ -574,4 +574,6 @@ message SlashJailParameters {
   // for permanent jailing use 9223372036854775807 which is the largest value a time.Duration can hold (approximately 292 years)
   google.protobuf.Duration jail_duration = 2
       [ (gogoproto.nullable) = false, (gogoproto.stdduration) = true ];
+  // Indicates whether the validator should be tombstoned when slashed
+  bool tombstone = 3;
 }

testutil/keeper/unit_test_helpers.go

@@ -306,10 +306,12 @@ func GetTestInfractionParameters() providertypes.InfractionParameters {
 		DoubleSign: &providertypes.SlashJailParameters{
 			JailDuration:  1200 * time.Second,
 			SlashFraction: math.LegacyNewDecWithPrec(5, 1), // 0.5
+			Tombstone:     true,
 		},
 		Downtime: &providertypes.SlashJailParameters{
 			JailDuration:  600 * time.Second,
 			SlashFraction: math.LegacyNewDec(0),
+			Tombstone:     false,
 		},
 	}
 }

x/ccv/provider/client/cli/tx.go

@@ -260,11 +260,13 @@ where create_consumer.json has the following structure:
   "infraction_parameters":{
    "double_sign":{
       "slash_fraction": "0.05",
-      "jail_duration": 9223372036854775807
+      "jail_duration": 9223372036854775807,
+      "tombstone": true	 
    },
    "downtime":{
       "slash_fraction": "0.0001",
-      "jail_duration": 600000000000
+      "jail_duration": 600000000000,
+      "tombstone": false	 
    }
   },
   "allowlisted_reward_denoms": {
@@ -369,11 +371,13 @@ where update_consumer.json has the following structure:
   "infraction_parameters":{
    "double_sign":{
       "slash_fraction": "0.05",
-      "jail_duration": 9223372036854775807
+      "jail_duration": 9223372036854775807,
+      "tombstone": true	  
    },
    "downtime":{
       "slash_fraction": "0.0001",
-      "jail_duration": 600000000000
+      "jail_duration": 600000000000,
+      "tombstone": false	 
    }
   },
   "allowlisted_reward_denoms": {

x/ccv/provider/keeper/consumer_equivocation.go

@@ -451,11 +451,17 @@ func (k Keeper) JailAndTombstoneValidator(ctx sdk.Context, providerAddr types.Pr
 		return fmt.Errorf("fail to set jail duration for validator: %s: %s", providerAddr.String(), err)
 	}
 
-	// Tombstone the validator so that we cannot slash the validator more than once
-	// Note that we cannot simply use the fact that a validator is jailed to avoid slashing more than once
-	// because then a validator could i) perform an equivocation, ii) get jailed (e.g., through downtime)
-	// and in such a case the validator would not get slashed when we call `SlashValidator`.
-	return k.slashingKeeper.Tombstone(ctx, providerAddr.ToSdkConsAddr())
+	if jailingParams.Tombstone {
+		// Tombstone the validator so that we cannot slash the validator more than once
+		// Note that we cannot simply use the fact that a validator is jailed to avoid slashing more than once
+		// because then a validator could i) perform an equivocation, ii) get jailed (e.g., through downtime)
+		// and in such a case the validator would not get slashed when we call `SlashValidator`.
+		if err = k.slashingKeeper.Tombstone(ctx, providerAddr.ToSdkConsAddr()); err != nil {
+			return fmt.Errorf("fail to tombstone validator: %s: %s", providerAddr.String(), err)
+		}
+	}
+
+	return nil
 }
 
 // ComputePowerToSlash computes the power to be slashed based on the tokens in non-matured `undelegations` and

x/ccv/provider/keeper/consumer_equivocation_test.go

@@ -792,10 +792,12 @@ func getTestInfractionParameters() *types.InfractionParameters {
 		DoubleSign: &types.SlashJailParameters{
 			JailDuration:  1200 * time.Second,
 			SlashFraction: math.LegacyNewDecWithPrec(5, 1), // 0.5
+			Tombstone:     true,
 		},
 		Downtime: &types.SlashJailParameters{
 			JailDuration:  600 * time.Second,
 			SlashFraction: math.LegacyNewDec(0),
+			Tombstone:     false,
 		},
 	}
 }

x/ccv/provider/keeper/infraction_parameters.go

@@ -33,6 +33,10 @@ func (k Keeper) SetInfractionParameters(ctx sdk.Context, consumerId string, para
 		return fmt.Errorf("failed to marshal infraction parameters (%+v) for consumer id (%s): %w", parameters, consumerId, err)
 	}
 
+	if parameters.Downtime.Tombstone {
+		k.Logger(ctx).Info("tombstone field is ignored for downtime infractions; setting it to true for consumer ID (%s) will have no effect", consumerId)
+	}
+
 	store.Set(types.ConsumerIdToInfractionParametersKey(consumerId), bz)
 
 	return nil
@@ -250,6 +254,9 @@ func compareSlashJailParameters(param1, param2 *types.SlashJailParameters) bool
 	if param1 == nil || param2 == nil {
 		return false
 	}
+	if param1.Tombstone != param2.Tombstone {
+		return false
+	}
 	if !param1.SlashFraction.Equal(param2.SlashFraction) {
 		return false
 	}

x/ccv/provider/types/msg_test.go

@@ -470,10 +470,12 @@ func TestMsgCreateConsumerValidateBasic(t *testing.T) {
 				DoubleSign: &types.SlashJailParameters{
 					JailDuration:  time.Duration(1<<63 - 1),        // max duration
 					SlashFraction: math.LegacyNewDecWithPrec(5, 2), // 0.05
+					Tombstone:     true,
 				},
 				Downtime: &types.SlashJailParameters{
 					JailDuration:  600 * time.Second,
 					SlashFraction: math.LegacyNewDec(0),
+					Tombstone:     false,
 				},
 			}, // valid infraction params
 			true,

x/ccv/provider/types/provider.go

@@ -44,10 +44,12 @@ func DefaultConsumerInfractionParameters(ctx context.Context, slashingKeeper ccv
 		DoubleSign: &SlashJailParameters{
 			JailDuration:  time.Duration(1<<63 - 1), // the largest value a time.Duration can hold 9223372036854775807 (approximately 292 years)
 			SlashFraction: doubleSignSlashingFraction,
+			Tombstone:     true,
 		},
 		Downtime: &SlashJailParameters{
 			JailDuration:  jailDuration,
 			SlashFraction: math.LegacyNewDec(0),
+			Tombstone:     false,
 		},
 	}, nil
 }