Slashing
When Tenzro Network 1 slashes a bond: double-signing proven by finality certificates, and provable breaches of an operator's own signed policy.
Operators on Tenzro Network 1 back their roles with a bond in TNZO. Slashing burns that bond when an operator does something it provably should not. The rule is narrow on purpose: you are slashed only on evidence anyone can check, and only against rules you signed up to.
What is slashable
There are two kinds of slashable offence.
Double-signing. A validator signs at most one checkpoint for each position in the chain. Two signatures from the same validator over different checkpoints for the same position are proof of double-signing. Because checkpoint signatures in finality certificates are ML-DSA-65 signatures that chain back to the validator's hardware key, they are transferable: anyone holding both can prove the offence to anyone else. See Finality certificates.
Breach of your own policy. Every operator publishes a signed policy describing what it offers: for example which models it serves, its availability and retention commitments, where data may be processed and what attestation it provides. An operator is slashed only for a provable breach of its own published policy, such as a failed retrievability proof against a storage commitment or a missed availability proof for a rental it was paid for. See Operator policies.
What is not slashable
- Being offline, slow or behind. These cost rewards and reputation, not the bond, unless the operator's own policy promised otherwise.
- Anything that cannot be proven with evidence. Local observations, complaints or reputation scores alone never slash.
- Rules the operator never signed. The network does not slash one operator for another's standards.
Evidence
A slashing claim carries its evidence with it:
| Offence | Evidence |
|---|---|
| Double-signing | Two checkpoint signatures by the same validator for the same position, each traceable to its hardware key |
| Policy breach | The operator's signed policy plus the proof that the commitment was broken, for example a failed proof of retrievability or a missing signed availability proof |
Any node can submit evidence. Verification is deterministic: every validator checks the same evidence against the same rules and reaches the same result, so the outcome does not depend on who reported it.
Penalty
When evidence verifies:
- The offender's bond is burned. Burned TNZO is removed from circulation.
- A validator is removed from the active set and marked
Jailed. - The offender's other obligations are re-checked against what remains of its stake, and it sheds any it can no longer cover.
- A
ValidatorSlashedevent is emitted. See Events.
Evidence can still be submitted while a bond is in its 7-day unbonding period, so leaving the set does not escape a penalty for something done while active.
Why slashing is narrow
A broad slashing rule lets honest operators be punished for bad luck or ambiguity, which drives away the home and small operators the network is built for. Narrow rules on hard evidence keep the risk predictable: if you do not sign conflicting checkpoints and you keep the promises in your own policy, your bond is safe.