Summary

Evidence follows a notion of expiration which gives a window of time that evidence can be submitted. In order to validate evidence a node must have the block and state when the infraction occurred. This all means that any node in consensus must have all the blocks and state (validator sets) from h to h - evidenceAge. If not then there is a chance that the node may panic on seeing valid evidence receiving 2/3 votes.

if err := cs.blockExec.ValidateBlock(cs.state, cs.ProposalBlock); err != nil {
	panic(fmt.Sprintf("enterPrecommit: +2/3 prevoted for an invalid block: %v", err))
}

Proposal

I see two ways of solving this:

1. By implementing Backfill blocks and state metadata #4629 and enforcing that the retain height be at least the maximum evidence age. This should safely ensure that all nodes participating in consensus have all the necessary blocks. Note1: this restriction is already somewhat enforced by the cosmos SDK. Note2: This would need to be for full nodes, seed nodes and validators

2. Separating out header validation logic and evidence validation logic where the former is mandatory (the nodes will panic if 2/3 vote on a block with say a different app hash) and the latter is only needed if you are to prevote/precommit for that block. If you see 2/3 vote for it then you skip the validating the evidence and by virtue of consensus (similarly to with txs or consensus param changes), accept it.

For Admin Use

• Not duplicate issue
• Appropriate labels applied
• Appropriate contributors tagged
• Contributor assigned/self-assigned