References - Ethereum consensus specifications —– phase0 beacon chain (https://…reum consensus specifications —– Electra (https://github.com/e…reum consensus specifications —– Bellatrix (https://github.com…from cosmoshub-4 - Lido CSM —– Penalties (https://docs.lido.…ido/csm/penalties) and Lido —– Burner contract (https://docs…racts/burner) - EigenLayer —– AllocationManager (https://gi…penalties rather than rewards)

Where slashing came from Slas…rns that evidence into a loss.His proof of stake design phi…costs far more than defending.

How Caper approaches this Cap…window must close at or above.There is a vote method and a c…ine the proposal has to clear.Dissent and exit are one act. …p/rage-quit-and-exit-rights) .

Concept Slashing – destroying …/slashing/v1beta1/params) on 30 July2 October 2026 Who actually pays Deleg…iki/economics/principal-agent)

Delegated proof of stake: the …hing/v1beta1/params) (gaia v27.58.3.0, 2 October 2026, unchanged since the 30 July 2026reading), the Cosmos Hub (/wiki/daos…validator costs you principal.

Pooled staking: whose bond, wh…e not protocol slashing at all –. For the default operator profile it charges 0.258 ETH for ejection after …sing a requested exit deadline, and 0.02 ETH for pulling an uploaded key; the charges now vary by operator profile, lower for Identified Community Stakers and scaled per 32 ETH of balance for 0x02 validators. Most of the operator's real …bonds standing in front of it.

How Caper approaches this Cap… without anyone's permission, taking a proportional share of the treasury with themin one transaction that pays them their share of the treasury and sells their tokens back to the caper's curve – and while a proposal's wind…p/rage-quit-and-exit-rights) .

References - Ethereum consen…s/blob/main/ELIPs/ELIP-006.md) - Vlad Zamfir – The History of Casper, Chapter 1 (https://blog.ethereum.org/2016/12/06/history-casper-chapter-1) (Ethereum Foundation Blog, December 2016; Slasher, security deposits and the nothing-at-stake problem) - Vitalik Buterin – Minimal Slashing Conditions (https://medium.com/@VitalikButerin/minimal-slashing-conditions-20f0b500fc6c) (March 2017; accountable safety and economic finality) - Vitalik Buterin – A Proof of Stake Design Philosophy (https://vitalik.eth.limo/general/2016/12/29/pos_design.html) (December 2016; security from penalties rather than rewards)

Where slashing came from Slashing began as an answer to the nothing-at-stake problem in early proof-of-stake designs: signing a block costs almost nothing, so a validator's best strategy when the chain forks is to sign on every branch. Vlad Zamfir's history of Ethereum's Casper research (https://blog.ethereum.org/2016/12/06/history-casper-chapter-1) traces the fix. Vitalik Buterin's Slasher proposal of early 2014 took away the block reward of a validator that signed blocks at the same height on two forks. In September 2014 Zamfir added a security deposit, many times the size of the reward and forfeited for the same offence, and concluded that the combination solved the problem. Others, among them Jae Kwon, the author of the Tendermint consensus protocol, reached the deposit idea independently. Buterin's Minimal Slashing Conditions (https://medium.com/@VitalikButerin/minimal-slashing-conditions-20f0b500fc6c) (2017) states what the mechanism buys in consensus terms. The protocol lists four rules an honest validator never breaks, such as sending two different votes for the same epoch, and chooses them so that two conflicting blocks can only both be finalised if at least a third of validators, weighted by deposit, provably broke one. Buterin calls this accountable safety: a fork that reverts a finalised block leaves evidence against at least a third of the stake, and slashing turns that evidence into a loss. His proof of stake design philosophy (https://vitalik.eth.limo/general/2016/12/29/pos_design.html) makes the economic case. In proof of work, he argues, the cost of attack and the cost of defence stand at one to one, because the network deters attackers smaller than X only by spending X every day. Proof of stake can impose penalties hundreds or thousands of times larger than the rewards honest validators earn, so attacking costs far more than defending.

How Caper approaches this Cap…ulbound vote tokens their own trading earnballots minted, so a large position alone …trol nor commands the treasury – and a holder who has never voted has no exit to take. The cost of bad governance f…p/rage-quit-and-exit-rights) .

How Caper approaches this Cap…ss earns a trigger that opens a forty-eight-hourthe market window against the caper's trailing seven-day average price, which the time-…p/rage-quit-and-exit-rights) .

How Caper approaches this Cap…(/wiki/governance/proposals) arerun in two phases, the second of them optimistic (/wiki/dao-govern…ting/optimistic-governance) : a proposal names one action, records the caper's trailing seven-day average price as a baseline, and passes forty-eight hours later if the live curve price is still at or above it. There is no vote method to call, so there is no counted balance to lock, and the double-spend of a vote that a bond exists to prevent has nothing to attach toholders rank the options on one ballot, and a legislative pass earns a trigger that opens a forty-eight-hour window against the caper's trailing seven-day average price, which the time-weighted price over that window must close at or above. There is a vote method and a counted balance – but nothing is immobilised to protect it. The tally crank folds every ballot at min(balance at cast, balance now), so weight that arrives to vote and leaves before the count is counted at whatever is left. That is a clamp at tally time rather than a lock at cast time: the vote double-spend a bond exists to prevent is priced out without taking custody of anyone's tokens. That answers the governance…p/rage-quit-and-exit-rights) .

How Caper approaches this Cap…enalises its own members. It does, since the ballot-era upgrade of 16 August 2026, have bonded stake in exactly the narrowhas no bond either, in any sense this page has been using the term. VNothing is physical custody: a member stakes governance tokens into their caper's GovernanceVault, a caststaked, nothing is immobilised, and there is no path in the contracts that takes a member's tokens for any reason. A caper's proposals (/wiki/governance/proposals) are optimistic (/wiki/dao-governance/voting) reads that vaulted balance as its holdings term andconcepts/voting/optimistic-governance) : a proposal names one action, refcount-locks the vault, and unstake asserts a zero refcount before it will return anything – the abort string is Stake locked while a cast ballot awaits release. The bond is what makes a double vote impossible: counted tokens cannot move until every tally they back is final, so one balance can never back two ballots on a proposal, across accounts or across settlement transactions (contracts/ballot/src/lib.rs). What is missing from that arrangement is the half this page is mostly about. The bond is custody, not collateral. Nothing confiscates it, nothing burns it, and no correlated-failure multiplier prices it: there is no path in the contracts that takes a membrds the caper's trailing seven-day average price as a baseline, and passes forty-eight hours later if the live curve price is still at or above it. There is no vote method to call, so there is no counted balance to lock, and the double-spend of a vote that a bond exists to prevent has nothing to attach to. That answer's staked tokens, for any reason. Every schedule above buys its property with a penalty and then has to answer the governance question that follows – who sets the penalty, and who eats it. A caper buys the same property with immobility and never has to answer it, because the loss it would have to allocate does not exist. The price a voter pays is illiquidity for the length of the settlement, it is known before the ballot is cast, and it falls on the voter alone. What it has instead isthe governance question every schedule above has to answer – who sets the penalty, and who eats it – by not having a penalty. The cost is the deterrent: a caper cannot make a bad actor pay. It can only make leaving cheap for everyone else. That is the lever it has instead, and it runs in the opposite leverdirection. A member who thinks the organisation has gone wrong does not need a penalty to be can leave (/wiki/foundations/leavied on anyone: they can leave andng-a-caper) at any moment, without anyone's permission, takeing a proportional share of the treasury with them once the ballot they cast has been released, which makes the cost of bad governance fall on whoever stays rather than on whoever can be blamed– and while a proposal's window is open that same sale is the objection, because selling pushes the price toward the baseline the proposal has to clear. Dissent and exit are one act. The share is the member's canonical vote weight, and it is (/wiki/governance/voting) , a product of both what they hold and how much they have votof the soulbound vote tokens their own trading earned, so a large position alone …rol nor commands the treasury. The cost of bad governance falls on whoever stays. See What is a caper (/wiki/f…p/rage-quit-and-exit-rights) .

How Caper approaches this Caper has no validators, no bonded stake and no slashing. I, and it is a DAO protocol rather tha…r penalises its own members. It does, since the ballot-era upgrade of 16 August 2026, have bonded stake in exactly the narrow sense this page has been using the term. Voting is physical custody: a member stakes governance tokens into their caper's GovernanceVault, a cast (/wiki/governance/voting) reads that vaulted balance as its holdings term and refcount-locks the vault, and unstake asserts a zero refcount before it will return anything – the abort string is Stake locked while a cast ballot awaits release. The bond is what makes a double vote impossible: counted tokens cannot move until every tally they back is final, so one balance can never back two ballots on a proposal, across accounts or across settlement transactions (contracts/ballot/src/lib.rs). What is missing from that arrangement is the half this page is mostly about. The bond is custody, not collateral. Nothing confiscates it, nothing burns it, and no correlated-failure multiplier prices it: there is no path in the contracts that takes a member's staked tokens, for any reason. Every schedule above buys its property with a penalty and then has to answer the governance question that follows – who sets the penalty, and who eats it. A caper buys the same property with immobility and never has to answer it, because the loss it would have to allocate does not exist. The price a voter pays is illiquidity for the length of the settlement, it is known before the ballot is cast, and it falls on the voter alone. What it has instead is the opp…hare of the treasury with them once the ballot they cast has been released, which makes the cost of bad …p/rage-quit-and-exit-rights) .

Programmable slashing: restaki…t chosen at creation ( ELIP-0026 (https://github.com/eigenfoun…/ELIPs/blob/main/ELIPs/ELIP-0026.md) , merged April 2025). Burning is wasteful but inc…eeds before reading the yield.

References - Ethereum consen…s/blob/main/ELIPs/ELIP-002.md) , with ELIP-006: Redistributable Slashing (https://github.com/eigenfoundation/ELIPs/blob/main/ELIPs/ELIP-006.md)

Concept Slashing – destroying part of a validator's bonded stake as the penalty for provable misbehaviour What it buys Economic security: an attack costs the attacker capital rather than only opportunity Two offence classes Liveness (being offline) · safety (signing two conflicting messages, i.e. equivocation) Ethereum penalty Effective balance ÷ 4,096 up front, plus a correlation penalty that reaches the full balance if a third of the network is slashed together ( Electra spec (https://github.com/ethereum/consensus-specs/blob/master/specs/electra/beacon-chain.md) ) Cosmos Hub penalty 5% of the whole delegation for a double-sign, 0.01% for downtime, read live from cosmoshub-4 (https://cosmos-rest.publicnode.com/cosmos/slashing/v1beta1/params) on 30 July 2026 Who actually pays Delegators and pool depositors, not only the operator who erred Governance angle On most chains the slashing fractions are parameters set by the same stake they penalise Related Cosmos Hub (/wiki/daos/networks/cosmos-hub) · Lido DAO (/wiki/daos/staking/lido-dao) · EigenLayer (/wiki/daos/staking/eigenlayer) · Principal–agent problem (/wiki/economics/principal-agent)

Slashing is the mechanism that turns a proof-of-stake validator's deposit into collateral. A validator posts stake, the protocol defines a short list of provable offences, and if the validator commits one the protocol destroys some of that stake. Rewards make honest operation profitable; slashing makes dishonest operation expensive. Without it, staking is a subscription fee with no downside, and a validator that signs two conflicting histories risks nothing but its future income. For a DAO the interesting part is not the cryptography. It is that slashing is the one place in crypto where a protocol takes money from people who did nothing wrong, on terms that are usually set by a token vote. The delegator who picked a badly-run validator loses funds; the depositor in a staking pool can absorb a loss through a rebase; and the numbers that decide how much they lose are, on most chains, governance parameters. Slashing therefore sits directly on top of the principal–agent problem (/wiki/economics/principal-agent) : the person bearing the loss is rarely the person who caused it, and rarely the person who voted on its size.

What bonded stake actually secures The two offence classes are not symmetrical, and confusing them is the most common error in DAO discussion of validator risk. - Liveness faults – the validator is offline and misses its duties. Nobody is harmed beyond the throughput lost, so the penalty is small and usually recoverable: on Ethereum a missed attestation forfeits the reward it would have earned; on Cosmos-SDK chains persistent absence gets the validator jailed and lightly slashed. - Safety faults – the validator signs two conflicting blocks or attestations for the same slot. That is the raw material of a chain reorganisation, it can only really happen through a misconfigured setup running the same key twice or through deliberate attack, and it is punished severely. The design goal is not to punish incompetence proportionally. It is to make the cost of an attack exceed its profit, which is why the harshest penalties are reserved for correlated safety faults – many validators equivocating at once, the only pattern that can actually finalise two conflicting states.

Ethereum: a schedule that punishes correlation, not error Ethereum's penalties live in the consensus specification (https://github.com/ethereum/consensus-specs/blob/master/specs/phase0/beacon-chain.md) rather than in any governance system, and they come in two parts. The first is immediate. A slashed validator loses its effective balance divided by MIN_SLASHING_PENALTY_QUOTIENT_ELECTRA, which the Electra specification (https://github.com/ethereum/consensus-specs/blob/master/specs/electra/beacon-chain.md) sets to 4,096: about 0.0078 ETH on a 32 ETH validator, and 0.5 ETH on the 2,048 ETH maximum introduced by EIP-7251 (https://eips.ethereum.org/EIPS/eip-7251) . Before the Pectra upgrade the divisor was 32 (https://github.com/ethereum/consensus-specs/blob/master/specs/bellatrix/beacon-chain.md) , so the up-front penalty on a 32 ETH validator was a full 1 ETH. Ethereum deliberately cut its own headline slashing penalty by a factor of 128, because a one-off operational mistake by a solo staker was never the thing the schedule needed to deter. The validator is also exited, and its withdrawal is pushed 8,192 epochs (about 36 days) into the future. The second part is where the deterrence actually lives. Halfway through that waiting period, 4,096 epochs (about 18 days) after the event, the protocol applies a correlation penalty proportional to how much stake was slashed alongside you in the trailing window. The spec multiplies the total slashed balance by PROPORTIONAL_SLASHING_MULTIPLIER_BELLATRIX = 3, caps it at the total active balance, and charges each slashed validator that fraction of its own balance. One validator slashed alone pays a rounding error. A third of the network slashed together saturates the multiplier and each participant loses essentially everything. The same event costs 128 times less or thousands of times more depending only on how many others did it with you. Reporting is also priced. The whistleblower reward is the offender's effective balance divided by 4,096, of which the block proposer takes an eighth – and because the spec falls back to the proposer when no separate whistleblower is identified, in practice the proposer is credited the whole amount.

Delegated proof of stake: the delegator pays too On a Cosmos-SDK chain the penalty is a flat fraction of the validator's entire bonded stake, which includes every delegation pointed at it. Read live from cosmoshub-4 (https://cosmos-rest.publicnode.com/cosmos/slashing/v1beta1/params) (gaia v27.5.0, 30 July 2026), the Cosmos Hub (/wiki/daos/networks/cosmos-hub) parameters are: Double-sign slash 5% of bonded stake, plus permanent tombstoning of the validator Downtime slash 0.01%, plus a 600-second jail Liveness window 10,000 blocks, of which at least 5% must be signed Unbonding period 1,814,400 seconds, i.e. 21 days ( staking params (https://cosmos-rest.publicnode.com/cosmos/staking/v1beta1/params) ) Two things follow. First, the liveness bar is extremely forgiving: a validator only has to sign 500 of any 10,000 blocks, so it can miss 9,500 in a row before the chain jails it. The chain is not really trying to police uptime by slashing, and treating downtime slashing as a meaningful risk misreads the parameters. Second, the 5% equivocation slash lands on the delegators. They did not run the duplicate signer, they cannot exit inside the 21-day unbonding queue, and their only real control was the choice of validator. Delegated proof of stake converts an operational question into a credit question: picking a validator is underwriting it. This is the same structural pattern as delegating a vote (/wiki/dao-governance/concepts/voting/voting-and-delegation) , with the difference that a bad delegate costs you influence while a bad validator costs you principal.

Pooled staking: whose bond, whose loss Liquid staking protocols sit between the two and have to answer the question explicitly: when a validator in the pool is slashed, does the operator eat it or do the depositors? Lido's Community Staking Module answers with a bond. Its penalties documentation (https://docs.lido.fi/run-on-lido/csm/penalties) states that the bond "acts as collateral for all validators under your Node Operator," and that slashing losses are assessed and deducted from that bond after the validator withdraws. The same schedule prices adjacent failures that are not protocol slashing at all – 0.258 ETH for ejection after repeated poor performance, 0.1 ETH for missing a requested exit deadline, 0.02 ETH for pulling an uploaded key. Most of the operator's real downside is this private penalty schedule rather than the consensus layer's. When losses exceed what the bond can cover, they surface at the token layer. Lido's Burner (https://docs.lido.fi/contracts/burner) contract burns stETH shares and keeps two separate counters, cover and non-cover, precisely because a "cover" burn exists to absorb a staking loss by reducing total pooled ETH. That is socialisation with an audit trail: every stETH holder pays a slice through the rebase, and the counters record how much was ever paid that way. For a DAO treasury holding a liquid staking token, that is the exposure to model – not the headline slashing fraction, but the size of the operator bonds standing in front of it.

Programmable slashing: restaking and AVS-defined offences EigenLayer (/wiki/daos/staking/eigenlayer) generalised the mechanism. Instead of a fixed protocol-defined offence list, an actively validated service defines its own conditions and its own penalty, and operators allocate a portion of their stake to be slashable under them. The AllocationManager (https://github.com/Layr-Labs/eigenlayer-contracts/blob/main/docs/core/AllocationManager.md) contract documents the shape: the service creates operator sets, names a single authorised slasher address, and calls slashOperator with wadsToSlash in parts of 1e18 – so anywhere from a rounding error to 100% of the allocated magnitude. The documentation is blunt that "slashing is instant and irreversible," and that the only conditions the core protocol enforces are the registration and allocation ones. What counts as an offence is entirely the service's business. Operators also stay slashable for a deallocation delay after deregistering, so committing a fault and walking out does not work. The consequential design choice is where the money goes. A normal operator set sends slashed funds to a burn address. A redistributing operator set sends them to a named recipient chosen at creation ( ELIP-002 (https://github.com/eigenfoundation/ELIPs/blob/main/ELIPs/ELIP-002.md) ). Burning is wasteful but incentive-neutral; redistribution funds a real insurance claim, and also means the party that profits from a slash can be the party that defines the offence and holds the slasher key. Any DAO considering staking its treasury into a restaking service is underwriting that service's private legal system, and should read who receives the proceeds before reading the yield.

The governance problem: the same stake votes on its own penalties Three overlapping conflicts make this a governance topic rather than an infrastructure one. - The penalised set writes the penalty. On Cosmos-SDK chains the slashing fractions are chain parameters amended by an on-chain proposal, and voting power is bonded stake. The people whose capital is at risk decide how much of it is at risk, which biases every such parameter in one direction over time. Ethereum reaches the opposite answer by putting the schedule in the consensus spec, where changing it requires a network upgrade rather than a vote, and by making the penalty depend on correlation rather than on anyone's judgement. - The same tokens do two jobs. Stake bonded for economic security is usually the same stake that carries governance weight, so the security budget and the electorate are one pool. That coupling is why validator sets shade into political blocs: on Cosmos Hub a delegator who does not vote has their validator's vote cast on their behalf, so choosing an operator for uptime quietly assigns a proxy. See Cosmos Hub (/wiki/daos/networks/cosmos-hub) for how that default plays out in real turnout figures. - Nobody prices the tail. Slashing schedules are built for correlated attacks, but the losses DAOs actually book come from mundane single-operator errors, and the fee those errors generate flows through bonds and rebases rather than through anything a governance forum discusses. A treasury that holds liquid staking tokens has an unvoted credit exposure to a handful of node operators. The general lesson generalises past validators: a penalty is only a deterrent if it lands on the decision-maker. Where it lands on someone else, it is an insurance premium being collected without a policy. Compare fee switches (/wiki/economics/fee-switches-and-value-accrual) , where governance argues for years about redistributing revenue it can see, while loss-sharing rules of this kind are usually inherited rather than chosen.

How Caper approaches this Caper has no validators, no bonded stake and no slashing. It is a DAO protocol rather than a consensus protocol, so it inherits Radix (https://www.radixdlt.com/) 's validator economics and never penalises its own members. What it has instead is the opposite lever. A member who thinks the organisation has gone wrong does not need a penalty to be levied on anyone: they can leave and take a proportional share of the treasury with them, which makes the cost of bad governance fall on whoever stays rather than on whoever can be blamed. The share is the member's canonical vote weight, and it is a product of both what they hold and how much they have voted, so a large position alone neither captures control nor commands the treasury. See What is a caper (/wiki/foundations/what-is-a-caper) and rage-quit and exit rights (/wiki/dao-governance/concepts/membership/rage-quit-and-exit-rights) .

References - Ethereum consensus specifications — phase0 beacon chain (https://github.com/ethereum/consensus-specs/blob/master/specs/phase0/beacon-chain.md) (slashing constants, EPOCHS_PER_SLASHINGS_VECTOR, process_slashings) - Ethereum consensus specifications — Electra (https://github.com/ethereum/consensus-specs/blob/master/specs/electra/beacon-chain.md) (MIN_SLASHING_PENALTY_QUOTIENT_ELECTRA = 4,096, WHISTLEBLOWER_REWARD_QUOTIENT_ELECTRA) - Ethereum consensus specifications — Bellatrix (https://github.com/ethereum/consensus-specs/blob/master/specs/bellatrix/beacon-chain.md) (the previous divisor of 32 and PROPORTIONAL_SLASHING_MULTIPLIER_BELLATRIX = 3) - Cosmos Hub slashing parameters (https://cosmos-rest.publicnode.com/cosmos/slashing/v1beta1/params) and staking parameters (https://cosmos-rest.publicnode.com/cosmos/staking/v1beta1/params) , read live from cosmoshub-4 - Lido CSM — Penalties (https://docs.lido.fi/run-on-lido/csm/penalties) and Lido — Burner contract (https://docs.lido.fi/contracts/burner) - EigenLayer — AllocationManager (https://github.com/Layr-Labs/eigenlayer-contracts/blob/main/docs/core/AllocationManager.md) and ELIP-002: Slashing via Unique Stake and Operator Sets (https://github.com/eigenfoundation/ELIPs/blob/main/ELIPs/ELIP-002.md)