tendermint/spec

Evidence time should be sourced from block time not vote time

Closed this issue · 0 comments

This issue follows from discussions brought up here

The short of this is that evidence time, which is used to check expiration, is currently derived from vote time of the oldest vote in the evidence struct itself. This is inherently an arbitrarily chosen time and because of such a misbehaving validator can place a timestamp three weeks in the past to make the evidence seem three weeks older than it actually is.

The rising consensus for solving this problem is to source the evidence time from the block time. This works even for in-consensus detection as block time is formulated as the median of the last commit and so is known before the consensus rounds even start. Of course as block time is calculated from the median time of votes in the commit, block time can also be manipulated but will require greater than 1/3 of the validator power and can't go back in time, thus making it a lot more safer than the vote timestamp.

Using block time (an outside element of the evidence itself) will mean that time will also now need to be validated as part of validating the evidence as a whole.