Soft opt out

proto/interchain_security/ccv/consumer/v1/consumer.proto

@@ -52,6 +52,11 @@ message Params {
   // which should be smaller than that of the provider in general.
   google.protobuf.Duration unbonding_period = 9
       [(gogoproto.nullable) = false, (gogoproto.stdduration) = true];
+
+  // The threshold for the percentage of validators at the bottom of the set who
+  // can opt out of running the consumer chain without being punished. For example, a
+  // value of 5% means that the validators in the smallest 5% of the set can opt out
+  string soft_opt_out_threshold = 10;
 }
 
 // LastTransmissionBlockHeight is the last time validator holding

tests/difference/core/driver/setup.go

@@ -513,6 +513,7 @@ func (b *Builder) createConsumerGenesis(client *ibctmtypes.ClientState) *consume
 		consumertypes.DefaultConsumerRedistributeFrac,
 		consumertypes.DefaultHistoricalEntries,
 		b.initState.UnbondingC,
+		"0.05",
 	)
 	return consumertypes.NewInitialGenesisState(client, providerConsState, valUpdates, params)
 }

testutil/keeper/unit_test_helpers.go

@@ -195,6 +195,18 @@ func GenPubKey() (crypto.PubKey, error) {
 	return cryptocodec.ToTmPubKeyInterface(privKey.PrivKey.PubKey())
 }
 
+// Generates a public key for unit tests (abiding by tricky interface implementations from tm/sdk) or panics
+func MustGenPubKey() crypto.PubKey {
+	privKey := PrivateKey{ed25519.GenPrivKey()}
+	key, err := cryptocodec.ToTmPubKeyInterface(privKey.PrivKey.PubKey())
+
+	if err != nil {
+		panic(err)
+	}
+
+	return key
+}
+
 // Obtains slash packet data with a newly generated key, and randomized field values
 func GetNewSlashPacketData() types.SlashPacketData {
 	b1 := make([]byte, 8)

x/ccv/consumer/keeper/params.go

@@ -21,6 +21,7 @@ func (k Keeper) GetParams(ctx sdk.Context) types.Params {
 		k.GetConsumerRedistributionFrac(ctx),
 		k.GetHistoricalEntries(ctx),
 		k.GetUnbondingPeriod(ctx),
+		k.GetSoftOptOutThreshold(ctx),
 	)
 }
 
@@ -106,3 +107,11 @@ func (k Keeper) GetUnbondingPeriod(ctx sdk.Context) time.Duration {
 	k.paramStore.Get(ctx, types.KeyConsumerUnbondingPeriod, &period)
 	return period
 }
+
+// GetSoftOptOutThreshold returns the percentage of validators at the bottom of the set
+// that can opt out of running the consumer chain
+func (k Keeper) GetSoftOptOutThreshold(ctx sdk.Context) string {
+	var str string
+	k.paramStore.Get(ctx, types.KeySoftOptOutThreshold, &str)
+	return str
+}

x/ccv/consumer/keeper/params_test.go

@@ -26,14 +26,15 @@ func TestParams(t *testing.T) {
 		types.DefaultConsumerRedistributeFrac,
 		types.DefaultHistoricalEntries,
 		types.DefaultConsumerUnbondingPeriod,
+		types.DefaultSoftOptOutThreshold,
 	) // these are the default params, IBC suite independently sets enabled=true
 
 	params := consumerKeeper.GetParams(ctx)
 	require.Equal(t, expParams, params)
 
 	newParams := types.NewParams(false, 1000,
 		"channel-2", "cosmos19pe9pg5dv9k5fzgzmsrgnw9rl9asf7ddwhu7lm",
-		7*24*time.Hour, 25*time.Hour, "0.5", 500, 24*21*time.Hour)
+		7*24*time.Hour, 25*time.Hour, "0.5", 500, 24*21*time.Hour, "0.05")
 	consumerKeeper.SetParams(ctx, newParams)
 	params = consumerKeeper.GetParams(ctx)
 	require.Equal(t, newParams, params)

x/ccv/consumer/keeper/validators.go

@@ -1,6 +1,8 @@
 package keeper
 
 import (
+	"encoding/binary"
+	"sort"
 	"time"
 
 	cryptocodec "github.com/cosmos/cosmos-sdk/crypto/codec"
@@ -100,13 +102,74 @@ func (k Keeper) ValidatorByConsAddr(sdk.Context, sdk.ConsAddress) stakingtypes.V
 	return stakingtypes.Validator{}
 }
 
+func (k Keeper) SetLargestSoftOptOutValidatorPower(ctx sdk.Context, power uint64) {
+	store := ctx.KVStore(k.storeKey)
+	store.Set(types.SoftOptOutThresholdPowerKey(), sdk.Uint64ToBigEndian(power))
+}
+
+// UpdateLargestSoftOptOutValidatorPower sets the largest validator power that is allowed to soft opt out
+// This is the largest validator power such that the sum of the power of all validators with a lower or equal power
+// is less than 5% of the total power of all validators
+func (k Keeper) UpdateLargestSoftOptOutValidatorPower(ctx sdk.Context) {
+	// get all validators
+	valset := k.GetAllCCValidator(ctx)
+
+	// sort validators by power ascending
+	sort.Slice(valset, func(i, j int) bool {
+		return valset[i].Power < valset[j].Power
+	})
+
+	// get total power in set
+	totalPower := sdk.ZeroDec()
+	for _, val := range valset {
+		totalPower = totalPower.Add(sdk.NewDecFromInt(sdk.NewInt(val.Power)))
+	}
+
+	// get power of the biggest validator who is allowed to soft opt out
+	powerSum := sdk.ZeroDec()
+	for _, val := range valset {
+		powerSum = powerSum.Add(sdk.NewDecFromInt(sdk.NewInt(val.Power)))
+		// if powerSum / totalPower > SoftOptOutThreshold
+		if powerSum.Quo(totalPower).GT(sdk.MustNewDecFromStr(k.GetSoftOptOutThreshold(ctx))) {
+			// set largestSoftOptOutValidatorPower to the power of this validator
+			k.SetLargestSoftOptOutValidatorPower(ctx, uint64(val.Power))
+			k.Logger(ctx).Info("largest soft opt out validator power updated", "power", val.Power)
+			return
+		}
+	}
+	// This will be hit if the SoftOptOutThreshold param is equal to 1
+	panic("unreachable")
+}
+
+// GetSoftOptOutThresholdPower returns the largest validator power that is allowed to soft opt out
+func (k Keeper) GetSoftOptOutThresholdPower(ctx sdk.Context) int64 {
+	store := ctx.KVStore(k.storeKey)
+	bz := store.Get(types.SoftOptOutThresholdPowerKey())
+	if bz == nil {
+		return 0
+	}
+	return int64(binary.BigEndian.Uint64(bz))
+}
+
 // Slash queues a slashing request for the the provider chain
 // All queued slashing requests will be cleared in EndBlock
 func (k Keeper) Slash(ctx sdk.Context, addr sdk.ConsAddress, infractionHeight, power int64, _ sdk.Dec, infraction stakingtypes.InfractionType) {
 	if infraction == stakingtypes.InfractionEmpty {
 		return
 	}
 
+	// if this is a downtime infraction and the validator is allowed to
+	// soft opt out, do not queue a slash packet
+	if infraction == stakingtypes.Downtime {
+		if power < k.GetSoftOptOutThresholdPower(ctx) {
+			// soft opt out
+			k.Logger(ctx).Debug("soft opt out",
+				"validator", addr,
+				"power", power,
+			)
+			return
+		}
+	}
 	// get VSC ID for infraction height
 	vscID := k.GetHeightValsetUpdateID(ctx, uint64(infractionHeight))
 

x/ccv/consumer/keeper/validators_test.go

@@ -191,3 +191,60 @@ func SetCCValidators(tb testing.TB, consumerKeeper keeper.Keeper,
 		consumerKeeper.SetCCValidator(ctx, ccv)
 	}
 }
+
+// Tests that UpdateLargestSoftOptOutValidatorPower updates the largest soft opt out validator power
+// Soft opt out allows the bottom 5% of validators in the set to opt out. UpdateLargestSoftOptOutValidatorPower
+// should update the largest soft opt out validator power to the power of the largest validator which is allowed to opt out
+func TestUpdateLargestSoftOptOutValidatorPower(t *testing.T) {
+	testCases := []struct {
+		name string
+		// validators to set in store
+		validators []*tmtypes.Validator
+		// expected largest soft opt out validator power
+		expLargestSoftOptOutValidatorPower int64
+	}{
+		{
+			name: "One",
+			validators: []*tmtypes.Validator{
+				tmtypes.NewValidator(testkeeper.MustGenPubKey(), 1),
+				tmtypes.NewValidator(testkeeper.MustGenPubKey(), 1),
+				tmtypes.NewValidator(testkeeper.MustGenPubKey(), 1),
+				tmtypes.NewValidator(testkeeper.MustGenPubKey(), 3),
+				tmtypes.NewValidator(testkeeper.MustGenPubKey(), 49),
+				tmtypes.NewValidator(testkeeper.MustGenPubKey(), 51),
+			},
+			expLargestSoftOptOutValidatorPower: 3,
+		},
+		{
+			name: "Two",
+			validators: []*tmtypes.Validator{
+				tmtypes.NewValidator(testkeeper.MustGenPubKey(), 1),
+				tmtypes.NewValidator(testkeeper.MustGenPubKey(), 1),
+				tmtypes.NewValidator(testkeeper.MustGenPubKey(), 1),
+				tmtypes.NewValidator(testkeeper.MustGenPubKey(), 3),
+				tmtypes.NewValidator(testkeeper.MustGenPubKey(), 500),
+			},
+			expLargestSoftOptOutValidatorPower: 500,
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			keeperParams := testkeeper.NewInMemKeeperParams(t)
+			// Explicitly register cdc with public key interface
+			keeperParams.RegisterSdkCryptoCodecInterfaces()
+			consumerKeeper, ctx, ctrl, _ := testkeeper.GetConsumerKeeperAndCtx(t, keeperParams)
+			consumerKeeper.SetParams(ctx, types.DefaultParams())
+			defer ctrl.Finish()
+
+			// set validators in store
+			SetCCValidators(t, consumerKeeper, ctx, tc.validators)
+
+			// update largest soft opt out validator power
+			consumerKeeper.UpdateLargestSoftOptOutValidatorPower(ctx)
+
+			// expect largest soft opt out validator power to be updated
+			require.Equal(t, tc.expLargestSoftOptOutValidatorPower, consumerKeeper.GetSoftOptOutThresholdPower(ctx))
+		})
+	}
+}

x/ccv/consumer/module.go

@@ -149,6 +149,9 @@ func (AppModule) ConsensusVersion() uint64 { return 1 }
 // Set the VSC ID for the subsequent block to the same value as the current block
 // Panic if the provider's channel was established and then closed
 func (am AppModule) BeginBlock(ctx sdk.Context, req abci.RequestBeginBlock) {
+	// Set largest soft opt out validator power
+	am.keeper.UpdateLargestSoftOptOutValidatorPower(ctx)
+
 	channelID, found := am.keeper.GetProviderChannel(ctx)
 	if found && am.keeper.IsChannelClosed(ctx, channelID) {
 		// The CCV channel was established, but it was then closed;