Slashing
This is the operator-facing summary. For the deep technical guide (how to configure your node to vote on slashings), see Slashing and offenses in Advanced operations.
Slashing is the protocol's way of penalising validators who fail their duties. This page covers what happens to you, not what your node does to others.
TL;DR
- Slashing is live on mainnet.
- Each slash deducts up to 2,000 AZTEC from your bonded stake (1% of the 200,000 AZTEC activation stake).
- Your stake is ejected from the active set if it falls below 190,000 AZTEC, and is no longer recoverable without a full exit if it falls below 100,000 AZTEC.
- That gives you roughly five slashes of headroom from a full stake before ejection.
- A community veto council can stop a benign slash before it executes.
What gets you slashed
The protocol defines nine offense types. The penalty for each is set in node config (sequencers vote on payloads that combine offenses and amounts), with the on-chain ceiling per offense being 2,000 AZTEC.
| Offense | What it means |
|---|---|
INACTIVITY | You missed too many attestation duties while on the committee |
PROPOSED_INSUFFICIENT_ATTESTATIONS | You published a checkpoint with fewer than the required (2/3+1) committee signatures |
PROPOSED_INCORRECT_ATTESTATIONS | You published a checkpoint with invalid signatures or signatures from non-committee members |
ATTESTED_DESCENDANT_OF_INVALID | You attested to a block built on top of an invalid block |
BROADCASTED_INVALID_BLOCK_PROPOSAL | You sent an invalid block proposal over p2p |
DUPLICATE_PROPOSAL | You sent two proposals for the same position (typically an HA misconfiguration) |
DUPLICATE_ATTESTATION | You signed attestations for different proposals at the same slot |
VALID_EPOCH_PRUNED | A committee you were part of did not get its epoch proven in time |
DATA_WITHHOLDING | A committee you were part of did not make epoch-proving data available |
The first three are what most operators encounter in practice. The duplicate-proposal and duplicate-attestation offenses almost always trace back to two of your nodes sharing keys, not malice.
How much you lose
Each slash deducts up to 2,000 AZTEC from your bonded stake. The TallySlashingProposer contract holds three penalty tiers (SLASH_AMOUNT_SMALL, SLASH_AMOUNT_MEDIUM, SLASH_AMOUNT_LARGE). All three are currently set to 2,000 AZTEC, so the practical penalty is uniform regardless of which tier the offense maps to.
The 2,000 AZTEC figure is 1% of the 200,000 AZTEC activation stake. Repeat offenses stack.
Thresholds you should know
| Threshold | Value | What happens at this level |
|---|---|---|
| Activation | 200,000 AZTEC | What you stake to become an active validator |
| Local ejection | 190,000 AZTEC | Below this, you get ejected from the active validator set on the canonical rollup |
| Protocol-wide ejection (GSE) | 100,000 AZTEC | Below this, you cannot re-activate without going through a full unbond + re-deposit cycle |
The local ejection threshold is configurable per rollup deployment by governance. The GSE floor is a protocol-wide constant.
Starting from a full 200,000 AZTEC stake, five slashes (10,000 AZTEC) bring you exactly to the local threshold. The sixth slash ejects you. Plan for five slashes of headroom, six if you started slightly above the activation minimum.
How you know you have been slashed
There is no per-slash event emitted on L1. The visible signal is a GSE stake balance reduction for your attester.
The community surfaces that catch this for you:
- slashveto.me publishes pending slash payloads before they execute, so you get warning before a slash lands.
- dashtec.xyz shows per-epoch performance and flags slashing events against tracked attesters.
- haveibeenslashed.xyz is a focused tool for checking a single attester address against historical slashing events.
Most operators learn about a slash from one of these dashboards or from a community announcement before the round executes, not from their own node logs.
The veto council
A community group operates as the Vetoer for the Slasher contract (0xBbB4aF368d02827945748b28CD4b2D42e4A37480, a multisig). When the TallySlashingProposer reports a pending slash payload, the council reviews it. If the slash looks benign (a known HA misconfiguration, a one-time outage on a usually-reliable operator, a bug in the slashing software, etc.) they call vetoPayload(address) and the slash does not execute.
The Vetoer can also pause slashing entirely for up to 3 days at a time via setSlashingEnabled(false).
Reaching the council
If you believe a slash against you is in flight and is benign:
- Check slashveto.me for the pending payload first.
- Post in the
#mn-sequencer-technicalDiscord channel with your attester address, what you think happened, and your node logs. The council members watch the channel. - The council has discretion. They favor vetoing benign slashes during the network's early operational period; they do not veto deliberate or repeated bad behaviour.
There is no formal appeal process. The veto is preventative (stops the slash before it lands), not restitutive (does not restore stake after a slash).
What to do if you have been slashed
The action depends on how far below thresholds you are.
Stake is still above 190,000 AZTEC
You are still an active validator. The only loss is the slashed amount.
Action: investigate root cause. Review your node logs around the offense time, identify whether it was an inactivity, proposing, or attestation issue, and fix it so it does not repeat. The veto council will be less likely to intervene on a second incident.
Stake has fallen below 190,000 AZTEC (local ejection)
You have been removed from the active validator set on this rollup. You stop earning new rewards.
Action: top up your stake by depositing more AZTEC to bring it back above 190,000. This re-activates you on the next epoch boundary. The deposit goes through the standard staking flow; see Day-2 essentials.
Stake has fallen below 100,000 AZTEC (protocol-wide ejection)
You are out at the GSE level. Topping up does not reactivate you; you have to call initiateWithdraw on the Rollup contract, wait the 4-day exit delay, finalize the withdrawal, then re-deposit through the staking dashboard.
The full exit-redeposit cycle takes a minimum of 4 days plus whatever queue depth exists at the time of re-staking.
Bricked or jailed (genesis stake only)
"Bricked" and "jailed" are community terms for genesis sequencers whose stake fell below threshold and who cannot recover until the vault unlock period completes. If you fall into this category, your stake is locked in the contract until the unlock date and you cannot top it up.
Reach out via Discord; Foundation team members have visibility into individual genesis-stake situations.
See also
- Slashing and offenses: the deep technical guide to slashing rounds, offsets, and how your node votes
- Identity model: which key is at risk when slashing happens (your attester)
- Claiming rewards: what happens to unclaimed rewards if you are ejected