TODO
Each oracle report, it decides how many requests to finalize and at what rate. Requests are finalized in the order in which they were created by moving the cursor to the last finalized request. Oracle must take two things into account:
The Oracle report has two parts: the report of the number of validators and their total balance and the finalization of requests in the Withdrawal Queue. The tricky part is that the finalization of requests requires data from the first part of the report. So to calculate them we simulate oracle report making static call to handleOracleReport
in Lido contract, getting share rate and amount of ETH that can be withdrawn from Withdrawal Vault and Execution Layer Rewards Vault taking into account the limits.
The protocol can be in two states: Turbo and Bunker modes. Turbo mode is a usual state when requests are finalized as fast as possible, while Bunker mode assumes a more prudent requests finalization and is activated if it's necessary to mitigate undesirable factors. More datails in Withdrawals Landscape.
In Turbo mode, there is only one border that does not allow to finalize requests created close to the reference slot to which the oracle report is performed.
In Bunker mode there are more safe borders. The protocol takes into account the impact of negative factors that occurred in a certain period and finalizes requests on which the negative effects have already been socialized. The safe border is considered to be the earliest of of the following:
Before we begin examining each border, let's introduce some notations that are used in the graphs below:
The border is a constant interval near the reference epoch in which no requests can be finalized:
The border represents the latest epoch before the reference slot before which there are no incompleted associated slashings.
In the image above there are 4 slashings on the timeline that start with slashed_epoch
and end with withdrawable_epoch
and some points in time: withrawal request and reference epoch relationship of the slashnings with which we want to analyze.
The slashing is non-associated with the withdrawal request since it started and ended before the request was created. It's completed since withdrawable_epoch
is before reference_epoch
.
The slashing is associated with withdrawal request, since the request is in its boundaries. In this case the slashing is completed since withdrawable_epoch
is before reference_epoch
, so all possible impact from it is accounted. This slashing should not block the finalization of this request.
Slashing is associated with the withdrawal request and is still going on. The impact from it is still incomplete, so such a request cannot be finalized.
Incompleted but non-associated slashing do not block finalization of the request. The impact of it is still incomplete, nevertheless we must allow users to unstake even in bad weather.
The border is calculated as the earliest slashed_epoch
among all incompleted slashings at the point of reference_epoch
rounded to the start of the closest oracle report frame - NEW_REQUESTS_BORDER
.
Detailed research of associated slashings
Bunker mode can be enabled by a negative rebase in case of mass validator penalties. In this case the border is considered the reference slot of the previous oracle report from the moment the Bunker mode was activated - NEW_REQUESTS_BORDER
.
This border has a maximum length equal to two times the governance reaction time.
The safe border is chosen depending on the protocol mode and is always the longest of all.
Activation of Bunker mode assumes the presence of one of the following events:
TODO: describe in details
With the amount of available ETH, rate and safe border, the oracle can find the request id up to and including which requests can be finalized.