Tombstoning (Validator Penalties)

Tombstoning is the nuclear option in validator penalty systems — reserved for the most serious violations that can only result from deliberate or catastrophically negligent behavior.

**Why tombstoning exists:** Standard slashing handles minor infractions (being offline, late votes) with proportional penalty. But double-signing — signing two different blocks at the same block height — is unambiguously dangerous: it creates the conditions for a chain split and potentially double-spending. The penalty must be severe enough to make the attack economically irrational.

**The double-signing problem:** If a validator signs Block A for height 100 AND Block B for height 100 (with different transaction sets), the network could temporarily follow two different chains. Resolving this requires recognizing that the validator committed equivocation — a provably malicious act.

**Tombstoning mechanics in Cosmos SDK chains:**

Cosmos Hub uses a specific tombstoning implementation: 1. Validator commits a double-sign infraction 2. Evidence is submitted on-chain by any node 3. Validator is jailed (removed from active set) immediately 4. After evidence confirmation, validator is tombstoned: - 5% of staked tokens slashed (Cosmos Hub's specific penalty) - Validator PERMANENTLY removed from the validator set - Cannot be unjailed — tombstoning is irreversible

**Tombstoning vs. jailing:** Jailing is temporary: a validator is removed from the active set for a defined period (typically for downtime) but can unjail by fixing the issue and submitting an unjail transaction. Tombstoning is permanent and typically triggered only by provable equivocation (double-signing).

**Practical implications for validator operators:** The most common cause of accidental double-signing is running two validator instances simultaneously (e.g., failed migration, backup node not properly disabled). Professional validators use HSMs (Hardware Security Modules) with double-sign protection and strict single-instance enforcement. The severity of tombstoning creates strong incentives for professional key management.

**Ethereum's version:** Ethereum calls this 'slashing' (the severe kind) rather than tombstoning — validators who equivocate have their entire stake confiscated over time via the 'correlational penalty' and are forcibly exited from the validator set permanently.