Slashing Event Handling

Exchange Rate During Major Slashing Event


If a major slashing event occurs for the protocol's validators, which causes a large loss of ETH controlled by the protocol, the exchange rate will not reflect this slashing until the next Oracle update. As the Oracle is configured to run every 8 hours, it is possible for another party to detect the slashing event, and request an unstake of all of their ETH at an elevated exchange rate before the oracle data "catches up" and the correct rate is quoted.

This leads to a loss of ETH for all remaining stakers, and would cause a rush to exit the protocol.


All unstake requests have a property called "finalization" which determines whether or not they can be claimed by the user. Requests will only finalize when an Oracle update has been posted when covers the block in which they were requested, plus some buffer.

This means that it is not possible to claim an unstake request if the Oracle has not posted up to date information.

The Oracle smart contracts also contain a check to determine if ETH was lost in the report window. If more than 0.1% (configurable) of the protocol's ETH was lost, the Oracle will automatically pause, and the report will not be accepted without human intervention.

This guarantees that all unstakes which happened before this point will not be finalized — and therefore are not claimable — until the Oracle report has been accepted by the security council.

While the unstake requests are not finalized, the Mantle LSP system has the ability to cancel them by removing them from the queue. This ensures that nobody can take advantage of the delay in the exchange rate updating.


Node Operator slashing is a low frequency event, see:

Scenario Example


Starting State: 10000 mETH, 11500 ETH, Exchange rate 1.150

Event: Mass slashing, 3000 ETH slashed


Action: Pause


[Realtime] Detect mass slashing, pause the protocol (no stake or unstake requests allowed)

This allows Oracle to send the updated report which contains slashed details but stops new unstake claims which may need cancelling.


[Within 8 hours] Detects consensus layer balance 8500 ETH

  • Submits Oracle Report, with effective exchange rate 0.850.

  • Oracle contract will consider this outside of Sanity Bounds and pause, see Oracle Sanity Checks

Action: Manual Review

Assess feasiblity of Slashing Insurance or compensation, if any:

Assess the cause of out-of-bound Oracle Report:

Determine which unstakeRequest exchange rates are valid (before slashed happened), and which ones need to be cancelled with users needing to issue a new unstakeRequest:

  • Run Oracle script: estimate-total-controlled <slashing-block> to determine what the new real totalControlled value is after the slashing.

  • Run Allocator script: requests-to-cancel <total-controlled> <slashing-block> - this shows the breakdown of request that happened after the slashing block but before the pause, and what the effect on the protocol would be if they were not canceled.

Action: Unpause

Unpauser Role (Security Council)

  • Verify actions above, escalate to Mantle Governance where required.

Result (assuming, no Topups)

  • New Stakers will receive an exchange rate of 0.850

    • For example Stake 1000 ETH received 1176.48 mETH

      • Total ETH in system = 8500 + 1000 = 9500

      • Total mETH in system = 10000 + 1176.48 = 11176.48

      • Fair exchange rate = 9500/11176.48 = 0.850

  • All slashing losses will be shared by old stakers (when the slashing happened)

    • New stakers will not incur loss

Last updated