tests: slashing-conservation property tests (staking)#454
Merged
adamkrellenstein merged 1 commit intoJun 3, 2026
Merged
Conversation
Add seeded-random property tests over the slashing surface, mirroring the existing distribute_ordering_reward_conserves pattern (fresh test_runtime_with_genesis per case, core-context calls, post-state asserts): - slash: burned + redistributable == slashed; burned is exactly the τ_slash 50% share; slashed == min(amount, stake) (saturates, never negative); stake drops by exactly slashed. - distribute_slash: Σ recipient stake == n·base + amount (exact, no dust). - slash_equivocation: λ_equiv=100% (full stake taken); burned + bounty == slashed; offender zeroed; self-publication ⇒ no bounty. Slashing is security-critical and adversarially exposed (the audit found a real self-publication leak here), so it warrants conservation properties beyond the point tests. Test-only; no contract change.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Stacked on #440. Adds seeded-random conservation property tests over the slashing surface — slashing is security-critical and adversarially exposed (the audit found a real self-publication leak here), so it warrants invariants beyond the existing point tests.
Tests (mirror the existing
distribute_ordering_reward_conservespattern)slash:burned + redistributable == slashed;burnedis exactly the τ_slash 50% share;slashed == min(amount, stake)(saturates, never negative); stake drops by exactlyslashed.distribute_slash:Σ recipient stake == n·base + amount(exact, no dust).slash_equivocation: λ_equiv=100% (full stake taken);burned + bounty == slashed; offender zeroed/ejected; self-publication ⇒ no bounty.Design decisions
StdRng-style loop, notproptest— matches the existing*_over_random_casestemplate and the lite-harness style (freshtest_runtime_with_genesisper case,Signer::Corecalls, post-state asserts). No new dependency.+/==only (e.g.burned + burned == slashedrather than a*or-), since the hostDecimaloperator surface used elsewhere in these tests is+/comparison.Test-only; no contract change.
Note
Low Risk
Test-only additions to indexer contract tests; no production staking logic is modified.
Overview
Adds seeded-random conservation property tests in
staking_slash.rsfor the staking slashing APIs, using the same lite-runtime*_over_random_casesstyle asdistribute_ordering_reward_conserves_over_random_cases(fresh genesis per seed,Decimalchecked with+/==only).slash: many cases assertslashed == min(amount, stake),burned + redistributable == slashed, 50% burn viaburned + burned == slashed, and stake reduced by exactlyslashed(including amounts above stake).distribute_slash: asserts total recipient stake equalsn·base + amountwith no dust.slash_equivocation: full-stake slash,burned + bounty == slashed, offender stake zeroed, and alternating self vs external publisher (no bounty on self-publication, positive bounty otherwise).Test-only; no contract or runtime behavior changes.
Reviewed by Cursor Bugbot for commit 9faf910. Bugbot is set up for automated code reviews on this repo. Configure here.