Voting power warmup and cooldown

[kwunyeung]

Feature description

Currently the voting power of a validator increases 2 blocks after the delegation has been processed. This open a possible attack vector if a network start with low voting power from each validator (which suppose to be more safe as not much assets are at stake), a delegator can suddenly bond relatively large amount of stake and start censorship immediately.

The same concern applies to unbonding as well. If there are two high stake delegations, one of them unbond most of the stake, the total voting power of the network drops and making the other high delegation validator have the opportunity to censor other validators.

Implementation proposal

A possible solution is to apply voting power with warmup and cooldown period. Solana has implemented this logic in delegation. The change of delegation is control by a warmup rate which is related to the total stake of the network. The delegation increase and decrease in epoch until it reaches the destination amount. This mechanism worth studying. Although we don't have epoch, we can apply this with block height.

https://docs.solana.com/cluster/stake-delegation-and-rewards#stake-warmup-cooldown-withdrawal

[RiccardoM]

@kwunyeung Should we propose this to be integrated directly into the Cosmos SDK?

[leobragaz]

Never seen it in this way! I will take a look at Solana's solution

[kwunyeung]

@RiccardoM I think it was mentioned somewhere sometime ago. At least I believe some validators should have similar concern on the sudden change voting power issue on Cosmos Hub. We definitely can upstream code back to the SDK but I don't want to wait for the typical ADR process in Tendermint/Cosmos-SDK. I prefer we make the changes on our requirements and propose upstreaming the code when it's stable.