## Description A `VetoSlasher` can be deployed for Veto slashing: 1) The `middleware` of a `network` can submit a slashing request by calling [`VetoSlasher#requestSlash()`](https://cantina.xyz/code/8bab566e-a6d4-4c1b-9f28-71a94bfd1da2/src/contracts/slasher/VetoSlasher.sol#L80-L121): ```solidity 92: if ( 93: captureTimestamp < Time.timestamp() + vetoDuration - IVault(vault).epochDuration() 94: || captureTimestamp >= Time.timestamp() 95: ) { 96: revert InvalidCaptureTimestamp(); 97: } ``` ``` 106: uint48 vetoDeadline = Time.timestamp() + vetoDuration; ``` As we can see, given a request time $t_{request}$, veto duration $V$, epoch duration $D$, the capture time $t_{capture}$ should meet the below requirements: ```math \begin{align*} t_{request} + V - D <= t_{capture} < t_{request} &(L92-L97)&(1) \end{align*} ``` And the veto deadline should calculated as below: ```math \begin{align*} t_{deadline} = t_{request} + V &(L106)&(2) \end{align*} ``` 2) The `resolver` of the `network` could veto the request by calling [`VetoSlasher#vetoSlash()`](https://cantina.xyz/code/8bab566e-a6d4-4c1b-9f28-71a94bfd1da2/src/contracts/slasher/VetoSlasher.sol#L192-L228): ```solidity if (request.vetoDeadline <= Time.timestamp()) { revert VetoPeriodEnded(); } ``` As we can see, the veto time $t_{veto}$ must meet the following requirement: ```math \begin{align*} t_{veto} < t_{deadline}&(3) \end{align*} ``` 3) In case the request is not vetoed, the `middleware` of the `network` could execute the slashing request as long as it is not expired by calling [`VetoSlasher#executeSlash()`](https://cantina.xyz/code/8bab566e-a6d4-4c1b-9f28-71a94bfd1da2/src/contracts/slasher/VetoSlasher.sol#L126-L187): ```solidity if ( resolverAt(request.subnetwork, request.captureTimestamp, executeSlashHints.captureResolverHint) != address(0) && resolverAt(request.subnetwork, Time.timestamp(), executeSlashHints.currentResolverHint) != address(0) @> && request.vetoDeadline > Time.timestamp() ) { revert VetoPeriodNotEnded(); } address vault_ = vault; @> if (Time.timestamp() - request.captureTimestamp > IVault(vault_).epochDuration()) { @> revert SlashPeriodEnded(); @> } ``` the execute time $t_{execute}$ must meet the following requirement: ```math \begin{align*} t_{deadline} <= t_{execute} <= t_{capture} + D&(4) \end{align*} ``` If a slashing request with $t_{capture} = t_{request} + V - D + \Delta t$ is submitted($\Delta t >= 0$), all other values could calculated as below: ```math \begin{align*} t_{capture} &= t_{request} + V - D + \Delta t \\ t_{deadline} &= t_{request} + V &(2)\\ \end{align*} ``` ```math \begin{align*} t_{deadline} &<= t_{execute} &<= t_{capture} + D &(4)\\ \Downarrow \\ t_{request} + V &<= t_{execute} &<= t_{request} + V - D + \Delta t + D \\ \Downarrow \\ t_{request} + V &<= t_{execute} &<= t_{request} + V + \Delta t \\ \end{align*} ``` From the above we can see, the slashing request can only be executed between the time of $t_{request} + V$ and $t_{request} + V + \Delta t$. However, the time interval of two consecutive blocks in Ethereum is 12 seconds. If $\Delta t$ is less than $12$, the slashing request might not have chance to be executed. This kind of situation could also occur when $D - V < 12$, where $\Delta t$ will always be less than $12$ : ```math \begin{align*} t_{capture} &= t_{request} + V - D + \Delta t \\ t_{capture} &< t_{request} &(1)\\ \Downarrow \\ t_{request} + V - D + \Delta t &< t_{request}\\ \Downarrow \\ \Delta t &< D - V\\ \Downarrow \\ \Delta t &< 12\\ \end{align*} ``` ## Recommendation - Introduce `executeDuration`($E$) for `VetoSlasher`, which should be initialized in [`VetoSlasher#__initialize()`](https://cantina.xyz/code/8bab566e-a6d4-4c1b-9f28-71a94bfd1da2/src/contracts/slasher/VetoSlasher.sol#L260-L278) and meet the following requirements: ```math \begin{align*} E &> 12 \\ E + V &<= D \\ \end{align*} ``` - Update [`VetoSlasher#requestSlash()`](https://cantina.xyz/code/8bab566e-a6d4-4c1b-9f28-71a94bfd1da2/src/contracts/slasher/VetoSlasher.sol#L80-L121) to meet the following requirement: ```math t_{request} + V + E - D <= t_{capture} < t_{request} ```

Competition	Date	Submissions	Payout
Reserve Protocol	Apr 30, 2026	1	$371
Morpho	Jul 15, 2025	3	$1,150
Eigenlayer	Mar 7, 2025	3	$0
BadgerDAO	Mar 5, 2025	1	$15
LI.FI	Jan 13, 2025	1	$0
DESK	Jan 6, 2025	1	$0
Symbiotic	Sep 11, 2024	4	$3,745
Euler	May 20, 2024	3	$13,669

0xpiken

Public reviews