Validator Jailing

Solana's penalty system is based on credits earned for successful voting. Validators are not "jailed" in a traditional sense but are deactivated or penalized via inflation dilution.

• Poor Performance: Validators with low vote credit scores earn a smaller share of inflation rewards, effectively penalizing them economically.
• Delinquency: If a validator fails to vote for an extended period, it may be marked as delinquent and stop receiving votes, making it inactive. The primary disincentive is economic (loss of rewards) rather than a formal jailing contract.

The process to restore a jailed validator varies but typically involves:

• Mandatory Wait: A fixed jail period (e.g., 10 minutes in Cosmos, longer for severe faults) where the validator is inactive.
• Manual Action: The validator operator must usually broadcast an unjail transaction (Cosmos) or re-enable their node (others).
• Stake Implications: Unjailing often requires the validator's bonded stake to still be above the minimum threshold after any slashing.
• Repeat Offenses: Networks often impose escalating penalties, including longer jail times and larger slash amounts for validators jailed multiple times.

Validator jailing is a protocol-enforced penalty that removes a node from the active validator set for a defined period, preventing it from proposing or attesting to new blocks. It is triggered by double-signing (signing conflicting blocks) or downtime (missing too many attestations). This mechanism protects the network from Byzantine behavior and liveness failures.

Jailing is a consequence of slashing, where a portion of the validator's staked tokens is burned.

• Double-Signing (Safety Fault): Signing two different blocks at the same height. This is a severe offense with high slashing penalties (e.g., up to the entire stake on Ethereum).
• Downtime (Liveness Fault): Being offline and failing to participate in consensus for an extended period (e.g., ~10,000 epochs in Cosmos). Penalties are typically smaller but still significant.

Jailing imposes direct and opportunity costs on the validator and its delegators.

• Slashing Penalty: A portion of the bonded stake is permanently burned, reducing the validator's share.
• Missed Rewards: The jailed validator earns no block rewards or transaction fees during the jail period.
• Reputation Damage: A history of jailing can lead to delegators withdrawing their stake, reducing the validator's future earning potential and influence.

After serving the mandatory jail time, a validator must manually initiate an unjailing transaction to re-enter the candidate pool. This often requires a small fee. The validator must then wait to be selected back into the active set, which may involve a queue. Some protocols (e.g., Cosmos SDK) require this manual step to ensure the operator has addressed the initial fault.

Jailing is a critical Byzantine Fault Tolerance (BFT) mechanism. It ensures the safety and liveness of the blockchain by:

• Deterring Attacks: Making double-signing economically irrational.
• Removing Faulty Nodes: Isolating unreliable or malicious validators to maintain network health.
• Protecting Delegators: Aligning validator incentives with honest participation, as slashing affects both the operator and their stakers.

Implementation details vary by consensus mechanism:

• Cosmos (Tendermint): Jailing for downtime (~10,000 missed blocks) and double-signing. Requires manual unjail.
• Polygon (Bor): Heimdall validators can be jailed for double-signing or checkpoint signature failures.
• Ethereum (Proof-of-Stake): Uses the term "slashing" which effectively jails the validator, ejecting it from the validator set. Re-entry requires a full withdrawal and a new deposit.

Slashing is the punitive action of permanently burning or destroying a portion of a validator's staked tokens. It is the primary penalty for severe offenses like double-signing or liveliness violations that trigger jailing. This creates a direct financial disincentive for malicious or negligent behavior, protecting network security.

• Types: Slashing can be a fixed percentage or vary based on the offense severity.
• Example: On Ethereum, a validator can be slashed up to 1 ETH for an offense, with additional penalties from being forcibly exited.

The unbonding period (or unstaking period) is a mandatory waiting time a jailed or exiting validator must undergo before their staked funds can be withdrawn. This delay acts as a security cooldown, allowing the network to detect and slash for any prior malicious actions that may surface later.

• Purpose: Prevents a malicious actor from quickly attacking and withdrawing funds.
• Duration: Varies by chain (e.g., 21 days on Cosmos, variable on Ethereum). A jailed validator typically must wait through this period after the jail sentence ends.

Double-signing (or equivocation) is a Byzantine fault where a validator signs two different blocks at the same height. This is a slashable offense that results in immediate jailing, as it threatens the canonical chain's integrity and can enable attacks like nothing-at-stake.

• Cause: Often due to validator software misconfiguration or malicious intent.
• Detection: Networks use cryptographic proofs to identify conflicting signatures from the same validator key.

A liveness fault occurs when a validator fails to perform its duties, such as missing block proposals or attestations. Persistent liveness faults lead to jailing for inactivity. This ensures the network maintains sufficient participation for finality and block production.

• Thresholds: Chains define specific metrics (e.g., missing >50% of attestations in 18,000 epochs on Ethereum).
• Penalty: Often involves inactivity leaks, where the validator's stake is gradually eroded until it becomes active again or is ejected.

The validator set is the active group of nodes responsible for consensus and block production in a Proof-of-Stake system. Jailing temporarily or permanently removes a validator from this set, altering the network's security properties and reward distribution.

• Dynamic Membership: Validators can join (bond) and leave (unbond/jail/exit) the set.
• Impact: A large portion of the set being jailed can affect decentralization and increase the risk of censorship or chain halts.

Self-jailing is a voluntary action where a validator operator manually triggers their own jailing, often via a CLI command. This is a safety measure to prevent slashing during planned maintenance, security incidents, or key compromises.

• Use Case: An operator notices a security breach and self-jails to prevent the attacker from causing slashable offenses.
• Process: The validator stops signing and submits a self-jail transaction, entering the same unbonding period as punitive jailing.