Disablement: Dispute participation disabling

[eskimor]

Some thoughts: #784 (comment)
More implementation hints (more concrete, should resolve the above): #784 (comment)

[eskimor]

@ordian please notes on era changes and handling.

[Overkillus]

Re: node side disablement

We added node side disablement to fight against cases where the offending validator is no longer in the active validator set but he commits an offence in the previous era. (Correct?)

If in era n+1 a bunch of honest validators got slashed for 0% and they occupy the 1/3 disablement limit then an offender in era n will not get node-side disabled since the runtime has a priority.

Is this an issue? How easy it is to exploit it? It seems to somewhat go against the property of re-enabling as across eras we have the safety as if we didn't have re-enabling.

[ordian]

If in era n+1 a bunch of honest validators got slashed for 0% and they occupy the 1/3 disablement limit then an offender in era n will not get node-side disabled since the runtime has a priority.

Yes, I was thinking about this scenario too. Although we take the runtime state at relay_parent. So it has to be like this: 1/3 honest nodes get slashed 0% in era n at relay X, in era n+1 an attacker disputes all blocks in era n starting from block X. We can't disable attacker nodes.

What we could do is to ignore the onchain state and just go with offchain one.

[eskimor]

This is totally fine. The reason we want re-enablement is to prevent a flatrate for trying to back an invalid candidate. The node side disabled list is only needed for spammers.

[Overkillus]

flatrate for trying to back an invalid candidate

As in backing without further consequences since you're already slashed for max?

Previous era backing on that scale will indeed be no longer possible so that seems like a good argument. Glad to have that one cleared 😄 was worried for a second.