[Staking] Bounded Slashing: Paginated Offence Processing & Slash Application

[Ank4n]

closes #3610.

helps #6344, but need to migrate storage Offences::Reports before we can remove exposure dependency in RC pallets.

replaces #6788.

Context

Slashing in staking is unbounded currently, which is a major blocker until staking can move to a parachain (AH).

Current Slashing Process (Unbounded)

1. Offence Reported

   • Offences include multiple validators, each with potentially large exposure pages.
   • Slashes are computed immediately and scheduled for application after 28 eras.

2. Slash Applied

   • All unapplied slashes are executed in one block at the start of the 28th era. This is an unbounded operation.

Proposed Slashing Process (Bounded)

1. Offence Queueing

   • Offences are queued after basic sanity checks.

2. Paged Offence Processing (Computing Slash)

   • Slashes are computed one validator exposure page at a time.
   • Unapplied slashes are stored in a double map:
     • Key 1 (k1): EraIndex
     • Key 2 (k2): (Validator, SlashFraction, PageIndex) — a unique identifier for each slash page

3. Paged Slash Application

   • Slashes are applied one page at a time across multiple blocks.
   • Slash application starts at the 27th era (one era earlier than before) to ensure all slashes are applied before stakers can unbond (which starts from era 28 onwards).

---

Worst-Case Block Calculation for Slash Application

Polkadot:

• 1 era = 24 hours, 1 block = 6s → 14,400 blocks/era
• On parachains (12s blocks) → 7,200 blocks/era

Kusama:

• 1 era = 6 hours, 1 block = 6s → 3,600 blocks/era
• On parachains (12s blocks) → 1,800 blocks/era

Worst-Case Assumptions:

• Total stakers: 40,000 nominators, 1000 validators. (Polkadot currently has ~23k nominators and 500 validators)
• Max slashed: 50% so 20k nominators, 250 validators.
• Page size: Validators with multiple page: (512 + 1)/2 = 256 , Validators with single page: 1

Calculation:

There might be a more accurate way to calculate this worst-case number, and this estimate could be significantly higher than necessary, but it shouldn’t exceed this value.

Blocks needed: 250 + 20k/256 = ~330 blocks.

Potential Improvement:

• Consider adding an Offchain Worker (OCW) task to further optimize slash application in future updates.
• Dynamically batch unapplied slashes based on number of nominators in the page, or process until reserved weight limit is exhausted.

---

Summary of Changes

Storage

• New:

  • OffenceQueue (StorageDoubleMap)
    • K1: Era
    • K2: Offending validator account
    • V: OffenceRecord
  • OffenceQueueEras (StorageValue)
    • V: BoundedVec<EraIndex, BoundingDuration>
  • ProcessingOffence (StorageValue)
    • V: (Era, offending validator account, OffenceRecord)

• Changed:

  • UnappliedSlashes:
    • Old: StorageMap<K -> Era, V -> Vec<UnappliedSlash>>
    • New: StorageDoubleMap<K1 -> Era, K2 -> (validator_acc, perbill, page_index), V -> UnappliedSlash>

Events

• New:
  • SlashComputed { offence_era, slash_era, offender, page }
  • SlashCancelled { slash_era, slash_key, payout }

Error

• Changed:
  • InvalidSlashIndex → Renamed to InvalidSlashRecord
• Removed:
  • NotSortedAndUnique
• Added:
  • EraNotStarted

Call

• Changed:
  • cancel_deferred_slash(era, slash_indices: Vec<u32>)
    → Now takes Vec<(validator_acc, slash_fraction, page_index)>
• New:
  • apply_slash(slash_era, slash_key: (validator_acc, slash_fraction, page_index))

Runtime Config

• FullIdentification is now set to a unit type (()) / null identity,
  replacing the previous exposure type for all runtimes using pallet_session::historical.

TODO

• Fixed broken CancelDeferredSlashes.
• Ensure on_offence called only with validator account for identification everywhere.
• Ensure we never need to read full exposure.
• Tests for multi block processing and application of slash.
• Migrate UnappliedSlashes
• Bench (crude, needs proper bench as followup)
  • on_offence()
  • process_offence()
  • apply_slash()

Followups (tracker link)

• OCW task to process offence + apply slashes.
• Minimum time for governance to cancel deferred slash.
• Allow root or staking admin to add a custom slash.
• Test HistoricalSession proof works fine with eras before removing exposure as full identity.
• Properly bench offence processing and slashing.
• Handle Offences::Reports migration when removing validator exposure as identity.

[paritytech-workflow-stopper]

All GitHub workflows were cancelled due to failure one of the required jobs.
Failed workflow url: https://github.com/paritytech/polkadot-sdk/actions/runs/13348574244
Failed job name: test-linux-stable

[seadanda]

High level LGTM